@hydra-acp/archiver 0.1.15 → 0.1.17

package/dist/index.js

@@ -1,34 +1,13 @@
 #!/usr/bin/env node
-import { createHash } from "node:crypto";
-import { readFileSync } from "node:fs";
-import { userInfo } from "node:os";
-import { dirname, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-import { ArchiveLoop } from "./archive-loop.js";
-import { EncryptedBackend } from "./backend/encrypted.js";
-import { makeBackend } from "./backend/factory.js";
-import { ArchiverBridge } from "./bridge.js";
-import { runColdSweep } from "./cold-sweep.js";
-import { loadConfig, loadEncryptionKey, loadLoginConfig } from "./config.js";
-import { DaemonClient } from "./daemon.js";
-import { HydraDiscovery } from "./discovery.js";
-import { lineageFromKey } from "./envelope.js";
-import { runKeygen } from "./keygen.js";
-import { runGoogleLogin } from "./oauth/google.js";
-import { PullLoop } from "./pull-loop.js";
-import { DEFAULT_RULE, loadRule } from "./rule.js";
-import { SyncState } from "./state.js";
-import { logger, setDebug } from "./util/log.js";
-const log = logger("main");
-const USAGE = `usage: hydra-acp-archiver [<command>]
+import{createHash as P}from"node:crypto";import{readFileSync as x}from"node:fs";import{userInfo as w}from"node:os";import{dirname as S,resolve as U}from"node:path";import{fileURLToPath as R}from"node:url";import{ArchiveLoop as C}from"./archive-loop.js";import{EncryptedBackend as E}from"./backend/encrypted.js";import{makeBackend as A}from"./backend/factory.js";import{ArchiverBridge as T}from"./bridge.js";import{runColdSweep as G}from"./cold-sweep.js";import{loadConfig as D,loadEncryptionKey as L,loadLoginConfig as B}from"./config.js";import{DaemonClient as M}from"./daemon.js";import{HydraDiscovery as H}from"./discovery.js";import{lineageFromKey as F}from"./envelope.js";import{runKeygen as K}from"./keygen.js";import{runGoogleLogin as _}from"./oauth/google.js";import{PullLoop as z}from"./pull-loop.js";import{DEFAULT_RULE as j,loadRule as y}from"./rule.js";import{SyncState as N}from"./state.js";import{logger as O,setDebug as v}from"./util/log.js";const o=O("main"),k=`usage: hydra-acp-archiver [<command>]
 
 Commands:
-  setup          Interactive first-run wizard — picks a backend, sets up
+  setup          Interactive first-run wizard \u2014 picks a backend, sets up
                  OAuth/credentials/encryption, writes archiver.conf, and
                  (optionally) registers the extension with hydra.
   (no args)      Run as a daemon-managed extension (the daemon spawns it
                  this way automatically when registered).
-  gdrive login   Interactive Google OAuth flow — opens a browser and writes
+  gdrive login   Interactive Google OAuth flow \u2014 opens a browser and writes
                  the refresh token to ~/.hydra-acp/archiver-google-token.json.
   keygen         Generate a symmetric encryption key and write it to
                  HYDRA_ACP_ARCHIVER_KEY_PATH (or ~/.hydra-acp/archiver-key).
@@ -36,219 +15,15 @@ Commands:
 Flags:
   --version, -v   Print version and exit.
   --help, -h      Show this message.
-`;
-function readVersion() {
-    try {
-        const here = dirname(fileURLToPath(import.meta.url));
-        const pkg = JSON.parse(readFileSync(resolve(here, "../package.json"), "utf8"));
-        return pkg.version ?? "unknown";
-    }
-    catch {
-        return "unknown";
-    }
-}
-const TRUTHY = new Set(["1", "true", "yes", "on", "t"]);
-async function runLogin() {
-    setDebug(TRUTHY.has((process.env.DEBUG ?? "").toLowerCase()));
-    const cfg = loadLoginConfig();
-    log.info(`credentials=${cfg.credentialsPath} token=${cfg.tokenPath}`);
-    await runGoogleLogin({
-        credentialsPath: cfg.credentialsPath,
-        tokenPath: cfg.tokenPath,
-    });
-    log.info("login complete — you can now start the archiver extension");
-}
-async function runExtension() {
-    const config = loadConfig();
-    setDebug(config.debug);
-    const encryptionKey = await loadEncryptionKey(config.encryptionKeyPath);
-    if (config.prefix === "") {
-        if (encryptionKey !== undefined) {
-            config.prefix = createHash("sha256").update(encryptionKey).digest().subarray(0, 8).toString("hex") + "/";
-            log.info(`auto-prefix (key fingerprint): ${config.prefix}`);
-        }
-        else {
-            config.prefix = userInfo().username.toLowerCase().replace(/[^a-z0-9-]/g, "-") + "/";
-            log.info(`auto-prefix (username): ${config.prefix}`);
-        }
-    }
-    const state = new SyncState(config.statePath);
-    await state.load(readVersion(), config.prefix, config.backend);
-    function buildBackend(prefix) {
-        const raw = makeBackend({ ...config, prefix });
-        return encryptionKey !== undefined ? new EncryptedBackend(raw, encryptionKey) : raw;
-    }
-    // syncBackend sees the full user namespace (all hosts) — used for listing
-    // and pulling. uploadBackend scopes writes to this host's subdirectory.
-    const syncBackend = buildBackend(config.prefix);
-    const uploadBackend = buildBackend(config.prefix + config.hostId + "/");
-    await syncBackend.init();
-    await uploadBackend.init();
-    // Reconcile state.json with what's actually on the backend. Without
-    // this a wiped backend (manual nuke, retention delete, expired share)
-    // leaves us believing every lineage is "already uploaded" — the hash
-    // skip in archive-loop never fires a re-upload and the user wonders
-    // why nothing flooded in. One list call at startup makes state a
-    // hint-cache instead of a source of truth.
-    try {
-        const entries = await syncBackend.list();
-        const presentLineages = new Set();
-        for (const e of entries) {
-            const id = lineageFromKey(e.key);
-            if (id !== undefined) {
-                presentLineages.add(id);
-            }
-        }
-        const pruned = await state.reconcile(presentLineages);
-        log.info(`reconciled state with backend: present=${presentLineages.size} pruned=${pruned}`);
-    }
-    catch (err) {
-        log.warn(`state reconcile skipped — backend list failed: ${err.message}`);
-    }
-    const daemon = new DaemonClient({
-        daemonUrl: config.hydraDaemonUrl,
-        token: config.hydraToken,
-    });
-    let currentRule = DEFAULT_RULE;
-    currentRule = await loadRule(config.ruleConfigPath);
-    const archive = new ArchiveLoop({
-        daemon,
-        backend: uploadBackend,
-        state,
-        getRule: () => currentRule,
-        debounceMs: config.uploadDebounceMs,
-        host: { host: config.hostId, user: userInfo().username },
-    });
-    const pull = new PullLoop({
-        daemon,
-        backend: syncBackend,
-        state,
-        intervalMs: config.pullIntervalMs,
-        hostId: config.hostId,
-    });
-    pull.start();
-    // Backfill: archive every cold session the daemon knows about.
-    // Runs in the background so the rest of startup (discovery,
-    // bridges) doesn't block on it. Hash dedup means restarts are cheap.
-    void runColdSweep({
-        daemonUrl: config.hydraDaemonUrl,
-        token: config.hydraToken,
-        archive,
-    }).catch((err) => {
-        log.warn(`cold sweep failed: ${err.message}`);
-    });
-    const bridges = new Map();
-    const discovery = new HydraDiscovery({
-        daemonUrl: config.hydraDaemonUrl,
-        token: config.hydraToken,
-        pollIntervalMs: config.hydraPollIntervalMs,
-        onAdd: (session) => {
-            if (bridges.has(session.sessionId)) {
-                return;
-            }
-            log.info(`attaching to ${session.sessionId} agent=${session.agentId ?? "?"} cwd=${session.cwd}`);
-            const bridge = new ArchiverBridge({
-                daemonWsUrl: config.hydraWsUrl,
-                token: config.hydraToken,
-                sessionId: session.sessionId,
-                meta: {
-                    ...(session.cwd !== undefined ? { cwd: session.cwd } : {}),
-                    ...(session.agentId !== undefined
-                        ? { agentId: session.agentId }
-                        : {}),
-                    ...(session.title !== undefined ? { title: session.title } : {}),
-                },
-                archive,
-            });
-            bridges.set(session.sessionId, bridge);
-            bridge.start();
-        },
-        onRemove: (sessionId) => {
-            const bridge = bridges.get(sessionId);
-            if (!bridge) {
-                return;
-            }
-            log.info(`detaching from ${sessionId}`);
-            bridges.delete(sessionId);
-            bridge.stop();
-        },
-    });
-    discovery.start();
-    process.on("SIGHUP", () => {
-        log.info(`SIGHUP — reloading rule from ${config.ruleConfigPath}`);
-        loadRule(config.ruleConfigPath)
-            .then((rule) => {
-            currentRule = rule;
-            log.info("rule reload complete");
-        })
-            .catch((err) => {
-            log.warn(`rule reload failed: ${err.message}`);
-        });
-    });
-    const shutdown = (sig) => {
-        log.info(`${sig} received — shutting down`);
-        discovery.stop();
-        pull.stop();
-        archive.stop();
-        for (const bridge of bridges.values()) {
-            bridge.stop();
-        }
-        setTimeout(() => process.exit(0), 200).unref();
-    };
-    process.on("SIGINT", () => shutdown("SIGINT"));
-    process.on("SIGTERM", () => shutdown("SIGTERM"));
-    log.info(`hydra-acp-archiver up; daemon=${config.hydraDaemonUrl} backend=${config.backend} host=${config.hostId} rule=${config.ruleConfigPath}`);
-}
-async function main() {
-    const cmd = process.argv[2];
-    if (cmd === "-v" || cmd === "--version") {
-        process.stdout.write(`hydra-acp-archiver ${readVersion()}\n`);
-        return;
-    }
-    if (cmd === undefined) {
-        await runExtension();
-        return;
-    }
-    if (cmd === "gdrive") {
-        const sub = process.argv[3];
-        if (sub === "login") {
-            await runLogin();
-            return;
-        }
-        const subcmds = "login";
-        process.stderr.write(sub !== undefined
-            ? `hydra-acp-archiver gdrive: unknown subcommand "${sub}"\n\nAvailable: ${subcmds}\n`
-            : `hydra-acp-archiver gdrive: missing subcommand\n\nAvailable: ${subcmds}\n`);
-        process.exit(2);
-    }
-    if (cmd === "login") {
-        process.stderr.write(`hydra-acp-archiver: "login" is not a command; did you mean "gdrive login"?\n`);
-        process.exit(2);
-    }
-    if (cmd === "keygen") {
-        await runKeygen();
-        return;
-    }
-    if (cmd === "setup") {
-        const { runSetup } = await import("./setup/wizard.js");
-        await runSetup();
-        return;
-    }
-    if (cmd === "-h" || cmd === "--help" || cmd === "help") {
-        process.stdout.write(USAGE);
-        return;
-    }
-    process.stderr.write(`hydra-acp-archiver: unknown command "${cmd}"\n\n${USAGE}`);
-    process.exit(2);
-}
-main().catch((err) => {
-    const msg = err.message;
-    process.stderr.write(`hydra-acp-archiver: ${msg}\n`);
-    if (/invalid_grant/i.test(msg)) {
-        process.stderr.write("Google refresh token is invalid. Run `hydra-acp-archiver gdrive login` to re-authorize.\n");
-        // sysexits EX_CONFIG — tells the daemon supervisor not to restart us.
-        process.exit(78);
-    }
-    process.exit(1);
-});
-//# sourceMappingURL=index.js.map
+`;function b(){try{const e=S(R(import.meta.url));return JSON.parse(x(U(e,"../package.json"),"utf8")).version??"unknown"}catch{return"unknown"}}const Y=new Set(["1","true","yes","on","t"]);async function V(){v(Y.has((process.env.DEBUG??"").toLowerCase()));const e=B();o.info(`credentials=${e.credentialsPath} token=${e.tokenPath}`),await _({credentialsPath:e.credentialsPath,tokenPath:e.tokenPath}),o.info("login complete \u2014 you can now start the archiver extension")}async function W(){const e=D();v(e.debug);const n=await L(e.encryptionKeyPath);e.prefix===""&&(n!==void 0?(e.prefix=P("sha256").update(n).digest().subarray(0,8).toString("hex")+"/",o.info(`auto-prefix (key fingerprint): ${e.prefix}`)):(e.prefix=w().username.toLowerCase().replace(/[^a-z0-9-]/g,"-")+"/",o.info(`auto-prefix (username): ${e.prefix}`)));const a=new N(e.statePath);await a.load(b(),e.prefix,e.backend);function p(r){const t=A({...e,prefix:r});return n!==void 0?new E(t,n):t}const s=p(e.prefix),l=p(e.prefix+e.hostId+"/");await s.init(),await l.init();try{const r=await s.list(),t=new Set;for(const $ of r){const g=F($.key);g!==void 0&&t.add(g)}const I=await a.reconcile(t);o.info(`reconciled state with backend: present=${t.size} pruned=${I}`)}catch(r){o.warn(`state reconcile skipped \u2014 backend list failed: ${r.message}`)}const u=new M({daemonUrl:e.hydraDaemonUrl,token:e.hydraToken,toolContent:e.toolContent});let c=j;c=await y(e.ruleConfigPath);const d=new C({daemon:u,backend:l,state:a,getRule:()=>c,debounceMs:e.uploadDebounceMs,host:{host:e.hostId,user:w().username}}),m=new z({daemon:u,backend:s,state:a,intervalMs:e.pullIntervalMs,hostId:e.hostId});m.start(),G({daemonUrl:e.hydraDaemonUrl,token:e.hydraToken,archive:d}).catch(r=>{o.warn(`cold sweep failed: ${r.message}`)});const i=new Map,f=new H({daemonUrl:e.hydraDaemonUrl,token:e.hydraToken,pollIntervalMs:e.hydraPollIntervalMs,onAdd:r=>{if(i.has(r.sessionId))return;o.info(`attaching to ${r.sessionId} agent=${r.agentId??"?"} cwd=${r.cwd}`);const t=new T({daemonWsUrl:e.hydraWsUrl,token:e.hydraToken,sessionId:r.sessionId,meta:{...r.cwd!==void 0?{cwd:r.cwd}:{},...r.agentId!==void 0?{agentId:r.agentId}:{},...r.title!==void 0?{title:r.title}:{}},archive:d});i.set(r.sessionId,t),t.start()},onRemove:r=>{const t=i.get(r);t&&(o.info(`detaching from ${r}`),i.delete(r),t.stop())}});f.start(),process.on("SIGHUP",()=>{o.info(`SIGHUP \u2014 reloading rule from ${e.ruleConfigPath}`),y(e.ruleConfigPath).then(r=>{c=r,o.info("rule reload complete")}).catch(r=>{o.warn(`rule reload failed: ${r.message}`)})});const h=r=>{o.info(`${r} received \u2014 shutting down`),f.stop(),m.stop(),d.stop();for(const t of i.values())t.stop();setTimeout(()=>process.exit(0),200).unref()};process.on("SIGINT",()=>h("SIGINT")),process.on("SIGTERM",()=>h("SIGTERM")),o.info(`hydra-acp-archiver up; daemon=${e.hydraDaemonUrl} backend=${e.backend} host=${e.hostId} rule=${e.ruleConfigPath}`)}async function J(){const e=process.argv[2];if(e==="-v"||e==="--version"){process.stdout.write(`hydra-acp-archiver ${b()}
+`);return}if(e===void 0){await W();return}if(e==="gdrive"){const n=process.argv[3];if(n==="login"){await V();return}const a="login";process.stderr.write(n!==void 0?`hydra-acp-archiver gdrive: unknown subcommand "${n}"
+
+Available: ${a}
+`:`hydra-acp-archiver gdrive: missing subcommand
+
+Available: ${a}
+`),process.exit(2)}if(e==="login"&&(process.stderr.write(`hydra-acp-archiver: "login" is not a command; did you mean "gdrive login"?
+`),process.exit(2)),e==="keygen"){await K();return}if(e==="setup"){const{runSetup:n}=await import("./setup/wizard.js");await n();return}if(e==="-h"||e==="--help"||e==="help"){process.stdout.write(k);return}process.stderr.write(`hydra-acp-archiver: unknown command "${e}"
+
+${k}`),process.exit(2)}J().catch(e=>{const n=e.message;process.stderr.write(`hydra-acp-archiver: ${n}
+`),/invalid_grant/i.test(n)&&(process.stderr.write("Google refresh token is invalid. Run `hydra-acp-archiver gdrive login` to re-authorize.\n"),process.exit(78)),process.exit(1)});

package/dist/keygen.js

@@ -1,26 +1,8 @@
-import { chmod, mkdir, writeFile } from "node:fs/promises";
-import { homedir } from "node:os";
-import { dirname, resolve } from "node:path";
-import { createHash, randomBytes } from "node:crypto";
-export async function runKeygen() {
-    const keyPath = process.env.HYDRA_ACP_ARCHIVER_KEY_PATH ??
-        resolve(homedir(), ".hydra-acp", "archiver-key");
-    const key = randomBytes(32);
-    const hex = key.toString("hex");
-    const fingerprint = createHash("sha256")
-        .update(key)
-        .digest()
-        .subarray(0, 8)
-        .toString("hex");
-    await mkdir(dirname(keyPath), { recursive: true });
-    await writeFile(keyPath, hex + "\n", { mode: 0o600 });
-    await chmod(keyPath, 0o600);
-    process.stdout.write(`key written to ${keyPath}\n`);
-    process.stdout.write(`key fingerprint: ${fingerprint}\n`);
-    process.stdout.write(`\n`);
-    process.stdout.write(`Copy ${keyPath} to every machine that should share this archive.\n`);
-    if (!process.env.HYDRA_ACP_ARCHIVER_KEY_PATH) {
-        process.stdout.write(`Then add to your extension env config:\n  "HYDRA_ACP_ARCHIVER_KEY_PATH": "${keyPath}"\n`);
-    }
-}
-//# sourceMappingURL=keygen.js.map
+import{chmod as i,mkdir as s,writeFile as n}from"node:fs/promises";import{homedir as a}from"node:os";import{dirname as c,resolve as d}from"node:path";import{createHash as h,randomBytes as p}from"node:crypto";async function _(){const e=process.env.HYDRA_ACP_ARCHIVER_KEY_PATH??d(a(),".hydra-acp","archiver-key"),t=p(32),r=t.toString("hex"),o=h("sha256").update(t).digest().subarray(0,8).toString("hex");await s(c(e),{recursive:!0}),await n(e,r+`
+`,{mode:384}),await i(e,384),process.stdout.write(`key written to ${e}
+`),process.stdout.write(`key fingerprint: ${o}
+`),process.stdout.write(`
+`),process.stdout.write(`Copy ${e} to every machine that should share this archive.
+`),process.env.HYDRA_ACP_ARCHIVER_KEY_PATH||process.stdout.write(`Then add to your extension env config:
+  "HYDRA_ACP_ARCHIVER_KEY_PATH": "${e}"
+`)}export{_ as runKeygen};

package/dist/oauth/google.js

@@ -1,16 +1,4 @@
-import { spawn } from "node:child_process";
-import { createServer } from "node:http";
-import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
-import { dirname } from "node:path";
-import { google } from "googleapis";
-import { logger } from "../util/log.js";
-const log = logger("oauth");
-// drive.file is a non-sensitive scope: the app can only see files it
-// creates plus those a user explicitly hands to it via the picker. This
-// keeps the verification footprint small and the user's other Drive
-// content invisible to the archiver.
-const SCOPES = ["https://www.googleapis.com/auth/drive.file"];
-const CREDS_HINT = `
+import{spawn as w}from"node:child_process";import{createServer as k}from"node:http";import{chmod as y,mkdir as v,readFile as h,writeFile as C}from"node:fs/promises";import{dirname as _}from"node:path";import{google as p}from"googleapis";import{logger as O}from"../util/log.js";const l=O("oauth"),P=["https://www.googleapis.com/auth/drive.file"],g=`
 Set up Google OAuth credentials first:
   1. Visit https://console.cloud.google.com/
   2. Create or select a project, then enable the Google Drive API
@@ -18,185 +6,8 @@ Set up Google OAuth credentials first:
   4. Create credentials -> OAuth client ID -> Application type: Desktop app
   5. Download the JSON and save it to ~/.hydra-acp/archiver-google-credentials.json
      (or set HYDRA_ACP_ARCHIVER_GOOGLE_CREDENTIALS)
-`;
-async function loadCredentials(path) {
-    let text;
-    try {
-        text = await readFile(path, "utf8");
-    }
-    catch (err) {
-        const e = err;
-        if (e.code === "ENOENT") {
-            throw new Error(`OAuth credentials file not found at ${path}.\n${CREDS_HINT}`);
-        }
-        throw err;
-    }
-    const parsed = JSON.parse(text);
-    const c = parsed.installed ?? parsed.web;
-    if (!c || !c.client_id || !c.client_secret) {
-        throw new Error(`OAuth credentials at ${path} missing client_id/client_secret.\n${CREDS_HINT}`);
-    }
-    return { client_id: c.client_id, client_secret: c.client_secret };
-}
-async function loadToken(path) {
-    try {
-        const text = await readFile(path, "utf8");
-        return JSON.parse(text);
-    }
-    catch (err) {
-        const e = err;
-        if (e.code === "ENOENT") {
-            return undefined;
-        }
-        throw err;
-    }
-}
-async function saveToken(path, token) {
-    await mkdir(dirname(path), { recursive: true });
-    await writeFile(path, JSON.stringify(token, null, 2), { mode: 0o600 });
-    await chmod(path, 0o600);
-}
-function tryOpenBrowser(url) {
-    let cmd;
-    let args;
-    switch (process.platform) {
-        case "darwin":
-            cmd = "open";
-            args = [url];
-            break;
-        case "win32":
-            cmd = "cmd";
-            args = ["/c", "start", "", url];
-            break;
-        default:
-            cmd = "xdg-open";
-            args = [url];
-            break;
-    }
-    try {
-        const child = spawn(cmd, args, { stdio: "ignore", detached: true });
-        child.on("error", () => {
-            log.info("could not auto-open browser; copy the URL above into a browser");
-        });
-        child.unref();
-    }
-    catch {
-        log.info("could not auto-open browser; copy the URL above into a browser");
-    }
-}
-// Runtime-side: load creds + token, return an OAuth2Client that
-// auto-refreshes its access token. Throws with a clear message if the
-// user hasn't run the login flow yet.
-export async function loadGoogleAuth(opts) {
-    const creds = await loadCredentials(opts.credentialsPath);
-    const token = await loadToken(opts.tokenPath);
-    if (!token || !token.refresh_token) {
-        throw new Error(`No Google OAuth token at ${opts.tokenPath}. Run \`hydra-acp-archiver-login\` first.`);
-    }
-    const client = new google.auth.OAuth2(creds.client_id, creds.client_secret);
-    client.setCredentials(token);
-    // Persist refreshed tokens whenever google-auth-library issues a new
-    // access token, so we keep the latest expiry on disk for future runs.
-    client.on("tokens", (next) => {
-        const merged = { ...token, ...next };
-        void saveToken(opts.tokenPath, merged).catch((err) => {
-            log.warn(`failed to persist refreshed token: ${err.message}`);
-        });
-    });
-    return client;
-}
-// Login-side: interactive flow using a loopback redirect on a
-// kernel-assigned port. Writes refresh+access tokens to tokenPath.
-export async function runGoogleLogin(opts) {
-    const creds = await loadCredentials(opts.credentialsPath);
-    // Bind loopback server first so we can build the redirect_uri with
-    // the assigned port.
-    const { port, codePromise, close } = await startCallbackServer();
-    const redirectUri = `http://127.0.0.1:${port}`;
-    const client = new google.auth.OAuth2(creds.client_id, creds.client_secret, redirectUri);
-    const authUrl = client.generateAuthUrl({
-        access_type: "offline",
-        scope: SCOPES,
-        // prompt=consent forces a refresh_token even if the user previously
-        // granted access — without it, repeat logins return only an access
-        // token.
-        prompt: "consent",
-    });
-    log.info("Open this URL in a browser to authorize the archiver:");
-    log.info(authUrl);
-    tryOpenBrowser(authUrl);
-    let code;
-    try {
-        code = await codePromise;
-    }
-    finally {
-        close();
-    }
-    const { tokens } = await client.getToken(code);
-    if (!tokens.refresh_token) {
-        throw new Error("Google did not return a refresh_token. Revoke the app at https://myaccount.google.com/permissions and try again.");
-    }
-    await saveToken(opts.tokenPath, tokens);
-    log.info(`token saved to ${opts.tokenPath}`);
-}
-async function startCallbackServer() {
-    let resolveCode = () => void 0;
-    let rejectCode = () => void 0;
-    const codePromise = new Promise((resolve, reject) => {
-        resolveCode = resolve;
-        rejectCode = reject;
-    });
-    const server = createServer((req, res) => {
-        try {
-            const url = new URL(req.url ?? "/", `http://127.0.0.1`);
-            const code = url.searchParams.get("code");
-            const error = url.searchParams.get("error");
-            if (error) {
-                res.statusCode = 400;
-                res.setHeader("content-type", "text/plain; charset=utf-8");
-                res.end(`Authorization error: ${error}\n\nYou can close this tab.`);
-                rejectCode(new Error(`OAuth error: ${error}`));
-                return;
-            }
-            if (!code) {
-                res.statusCode = 400;
-                res.setHeader("content-type", "text/plain; charset=utf-8");
-                res.end("Missing ?code parameter. You can close this tab.");
-                return;
-            }
-            res.statusCode = 200;
-            res.setHeader("content-type", "text/plain; charset=utf-8");
-            res.end("hydra-acp-archiver: authorization complete. You can close this tab.");
-            resolveCode(code);
-        }
-        catch (err) {
-            res.statusCode = 500;
-            res.end("internal error");
-            rejectCode(err);
-        }
-    });
-    await new Promise((resolve, reject) => {
-        server.once("error", reject);
-        server.listen(0, "127.0.0.1", () => resolve());
-    });
-    const addr = server.address();
-    if (!addr || typeof addr === "string") {
-        server.close();
-        throw new Error("failed to determine callback server port");
-    }
-    const port = addr.port;
-    log.info(`listening for OAuth redirect on http://127.0.0.1:${port}`);
-    return {
-        port,
-        codePromise,
-        close: () => {
-            try {
-                server.close();
-            }
-            catch {
-                // ignore
-            }
-        },
-    };
-}
-//# sourceMappingURL=google.js.map
+`;async function f(e){let t;try{t=await h(e,"utf8")}catch(i){throw i.code==="ENOENT"?new Error(`OAuth credentials file not found at ${e}.
+${g}`):i}const n=JSON.parse(t),r=n.installed??n.web;if(!r||!r.client_id||!r.client_secret)throw new Error(`OAuth credentials at ${e} missing client_id/client_secret.
+${g}`);return{client_id:r.client_id,client_secret:r.client_secret}}async function A(e){try{const t=await h(e,"utf8");return JSON.parse(t)}catch(t){if(t.code==="ENOENT")return;throw t}}async function m(e,t){await v(_(e),{recursive:!0}),await C(e,JSON.stringify(t,null,2),{mode:384}),await y(e,384)}function E(e){let t,n;switch(process.platform){case"darwin":t="open",n=[e];break;case"win32":t="cmd",n=["/c","start","",e];break;default:t="xdg-open",n=[e];break}try{const r=w(t,n,{stdio:"ignore",detached:!0});r.on("error",()=>{l.info("could not auto-open browser; copy the URL above into a browser")}),r.unref()}catch{l.info("could not auto-open browser; copy the URL above into a browser")}}async function $(e){const t=await f(e.credentialsPath),n=await A(e.tokenPath);if(!n||!n.refresh_token)throw new Error(`No Google OAuth token at ${e.tokenPath}. Run \`hydra-acp-archiver-login\` first.`);const r=new p.auth.OAuth2(t.client_id,t.client_secret);return r.setCredentials(n),r.on("tokens",i=>{const a={...n,...i};m(e.tokenPath,a).catch(s=>{l.warn(`failed to persist refreshed token: ${s.message}`)})}),r}async function U(e){const t=await f(e.credentialsPath),{port:n,codePromise:r,close:i}=await b(),a=`http://127.0.0.1:${n}`,s=new p.auth.OAuth2(t.client_id,t.client_secret,a),o=s.generateAuthUrl({access_type:"offline",scope:P,prompt:"consent"});l.info("Open this URL in a browser to authorize the archiver:"),l.info(o),E(o);let c;try{c=await r}finally{i()}const{tokens:d}=await s.getToken(c);if(!d.refresh_token)throw new Error("Google did not return a refresh_token. Revoke the app at https://myaccount.google.com/permissions and try again.");await m(e.tokenPath,d),l.info(`token saved to ${e.tokenPath}`)}async function b(){let e=()=>{},t=()=>{};const n=new Promise((s,o)=>{e=s,t=o}),r=k((s,o)=>{try{const c=new URL(s.url??"/","http://127.0.0.1"),d=c.searchParams.get("code"),u=c.searchParams.get("error");if(u){o.statusCode=400,o.setHeader("content-type","text/plain; charset=utf-8"),o.end(`Authorization error: ${u}
+
+You can close this tab.`),t(new Error(`OAuth error: ${u}`));return}if(!d){o.statusCode=400,o.setHeader("content-type","text/plain; charset=utf-8"),o.end("Missing ?code parameter. You can close this tab.");return}o.statusCode=200,o.setHeader("content-type","text/plain; charset=utf-8"),o.end("hydra-acp-archiver: authorization complete. You can close this tab."),e(d)}catch(c){o.statusCode=500,o.end("internal error"),t(c)}});await new Promise((s,o)=>{r.once("error",o),r.listen(0,"127.0.0.1",()=>s())});const i=r.address();if(!i||typeof i=="string")throw r.close(),new Error("failed to determine callback server port");const a=i.port;return l.info(`listening for OAuth redirect on http://127.0.0.1:${a}`),{port:a,codePromise:n,close:()=>{try{r.close()}catch{}}}}export{$ as loadGoogleAuth,U as runGoogleLogin};