@idea1/cli 1.10.4 → 1.11.0

package/dist/prompts/platform-prompts.d.ts

@@ -1,33 +1,8 @@
-import type { DevWorkflowType } from '../workflow/data/workflow-context.js';
-export declare const setWorkflowStatusPrompt: import("../services/template-renderer.js").RenderTemplate<{
-    projectItemUrl: string;
-    workflowStatus: string;
-    pullRequestUrl: string | null;
-    assignedToEmail: string | null;
-}>;
-export declare const listTeamMembersPrompt: import("../services/template-renderer.js").RenderTemplate<Record<string, never>>;
-export declare const getProjectItemSummaryForBranchPrompt: import("../services/template-renderer.js").RenderTemplate<{
-    repositoryFullName: string;
-    branchName: string;
-}>;
-export declare const getProjectItemSummaryPrompt: import("../services/template-renderer.js").RenderTemplate<{
-    projectItemUrl: string;
-}>;
-export declare const upsertProjectItemWorkflowContextPrompt: import("../services/template-renderer.js").RenderTemplate<{
-    projectItemUrl: string;
-    repositoryFullName: string;
-    branchName: string;
-    baseBranch: string;
-    devWorkflowType: DevWorkflowType;
-    stackBranch: string | null;
-    integrationBranch: string | null;
-}>;
+/**
+ * The prompt the platform service runs to name a branch after a project item: a text-only task on
+ * the item's description, which the service reads from the platform and puts in the prompt.
+ */
 export declare const generateBranchNamePrompt: import("../services/template-renderer.js").RenderTemplate<{
-    projectItemUrl: string;
-}>;
-export declare const listProjectsPrompt: import("../services/template-renderer.js").RenderTemplate<Record<string, never>>;
-export declare const createProjectItemPrompt: import("../services/template-renderer.js").RenderTemplate<{
-    title: string;
-    projectName: string;
+    description: string;
 }>;
 //# sourceMappingURL=platform-prompts.d.ts.map

package/dist/prompts/platform-prompts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform-prompts.d.ts","sourceRoot":"","sources":["../../src/prompts/platform-prompts.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AAuB5E,eAAO,MAAM,uBAAuB;oBAClB,MAAM;oBACN,MAAM;oBACN,MAAM,GAAG,IAAI;qBACZ,MAAM,GAAG,IAAI;EAQ/B,CAAC;AAEF,eAAO,MAAM,qBAAqB,kFAIjC,CAAC;AAEF,eAAO,MAAM,oCAAoC;wBAAyC,MAAM;gBAAc,MAAM;EAGnH,CAAC;AAEF,eAAO,MAAM,2BAA2B;oBAAqC,MAAM;EAGlF,CAAC;AAEF,eAAO,MAAM,sCAAsC;oBACjC,MAAM;wBACF,MAAM;gBACd,MAAM;gBACN,MAAM;qBACD,eAAe;iBACnB,MAAM,GAAG,IAAI;uBACP,MAAM,GAAG,IAAI;EASjC,CAAC;AAEF,eAAO,MAAM,wBAAwB;oBAAqC,MAAM;EAI/E,CAAC;AAEF,eAAO,MAAM,kBAAkB,kFAG9B,CAAC;AAEF,eAAO,MAAM,uBAAuB;WAA4B,MAAM;iBAAe,MAAM;EAK1F,CAAC"}
+{"version":3,"file":"platform-prompts.d.ts","sourceRoot":"","sources":["../../src/prompts/platform-prompts.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,eAAO,MAAM,wBAAwB;iBAAkC,MAAM;EAK5E,CAAC"}

package/dist/prompts/platform-prompts.js

@@ -1,49 +1,10 @@
 import { compileTemplate } from '../services/template-renderer.js';
 /**
- * The prompts the platform service runs to drive the Idea1 MCP tools, one Handlebars template per
- * platform call, each typed with the model it renders. The output schemas the answers are parsed
- * with belong to the platform service; the prompts only name the tool, its parameters and where
- * the answer goes.
+ * The prompt the platform service runs to name a branch after a project item: a text-only task on
+ * the item's description, which the service reads from the platform and puts in the prompt.
  */
-/**
- * Where a call that returns a project item summary puts the tool's result.
- */
-const PROJECT_ITEM_SUMMARY_OUTPUT_INSTRUCTIONS = 'Copy the tool\'s result into the "projectItemSummary" field exactly as returned: url, externalId, title, epicId, ' +
-    'completionDate, legacyWorkflowStatus, projectId (null when the item is out of scope), assignedToUserId (null when ' +
-    'unassigned) and "workflowContext" with its workflowStatus, codingAgentUrl, ' +
-    'pullRequestUrl, repositoryFullName, branchName, baseBranch, devWorkflowType, stackBranch, integrationBranch and ' +
-    'branchState (the number the tool returned), or null when the result\'s workflowContext is null. Put null in ' +
-    '"error". If the tool returns an error, put its message verbatim in "error" and null in "projectItemSummary".';
-// TODO: This direct workflow-context update moves out of the update_item MCP tool into an authenticated platform
-// API call. The CLI will authenticate a user and call the API for direct integrations like this; MCP tools will then
-// be only operations that agents should run.
-export const setWorkflowStatusPrompt = compileTemplate('Record the workflow status of {{projectItemUrl}} as "{{workflowStatus}}" by calling the update_item MCP tool with ' +
-    'itemReference "{{projectItemUrl}}", workflowStatus "{{workflowStatus}}"' +
-    '{{#if pullRequestUrl}}, pullRequestUrl "{{pullRequestUrl}}"{{/if}}' +
-    '{{#if assignedToEmail}}, assignedToEmail "{{assignedToEmail}}"{{/if}}' +
-    ' and no other fields. ' +
-    'Put "done" in the "result" field on success, or an explanation in the "error" field on failure.');
-export const listTeamMembersPrompt = compileTemplate('List the team\'s members using the list_team_members MCP tool. Copy the tool\'s result into the "members" field ' +
-    'exactly as returned: each member\'s userId, email, role and gitHubUsername (null when the member has no linked ' +
-    'GitHub account), in the order returned.');
-export const getProjectItemSummaryForBranchPrompt = compileTemplate('Call the get_item_summary_for_branch MCP tool with repositoryFullName "{{repositoryFullName}}" and branchName "{{branchName}}". ' +
-    PROJECT_ITEM_SUMMARY_OUTPUT_INSTRUCTIONS);
-export const getProjectItemSummaryPrompt = compileTemplate('Call the get_item_summary MCP tool with itemReference "{{projectItemUrl}}". ' +
-    PROJECT_ITEM_SUMMARY_OUTPUT_INSTRUCTIONS);
-export const upsertProjectItemWorkflowContextPrompt = compileTemplate('Call the upsert_item_workflow_context MCP tool with itemReference "{{projectItemUrl}}", ' +
-    'repositoryFullName "{{repositoryFullName}}", branchName "{{branchName}}", baseBranch "{{baseBranch}}", ' +
-    'devWorkflowType "{{devWorkflowType}}"' +
-    '{{#if stackBranch}}, stackBranch "{{stackBranch}}"{{/if}}' +
-    '{{#if integrationBranch}}, integrationBranch "{{integrationBranch}}"{{/if}}. ' +
-    'Pass only these parameters. ' +
-    PROJECT_ITEM_SUMMARY_OUTPUT_INSTRUCTIONS);
-export const generateBranchNamePrompt = compileTemplate('Get the description of {{projectItemUrl}} with the get_item_description MCP tool and generate a git branch name based on the description. ' +
+export const generateBranchNamePrompt = compileTemplate('Generate a git branch name for the project item described below. ' +
     'Don\'t use any branch name prefix or folder structure, just a one part branch name. Put the branch name in the "result" field. ' +
-    'If you cannot generate a branch name, put an explanation in the "error" field.');
-export const listProjectsPrompt = compileTemplate('List the team\'s Idea1 projects using the list_projects MCP tool. ' +
-    'Put the names of the projects whose status is Live in the "projects" field, in the order returned.');
-export const createProjectItemPrompt = compileTemplate('Create a new idea1 project item using the create_item MCP tool with description "# {{title}}" in the project named ' +
-    '"{{projectName}}" (pass projectName "{{projectName}}"). Put the created item\'s URL (the create_item result\'s ' +
-    'CreatedItemUrl) in the "projectItemUrl" field and null in the "error" field. If the tool returns an error, put the ' +
-    'error message in the "error" field and an empty string in the "projectItemUrl" field.');
+    'If you cannot generate a branch name, put an explanation in the "error" field.\n\n' +
+    'Project item description:\n\n{{description}}');
 //# sourceMappingURL=platform-prompts.js.map

package/dist/prompts/platform-prompts.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform-prompts.js","sourceRoot":"","sources":["../../src/prompts/platform-prompts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAGnE;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,wCAAwC,GAC5C,mHAAmH;IACnH,oHAAoH;IACpH,6EAA6E;IAC7E,kHAAkH;IAClH,8GAA8G;IAC9G,8GAA8G,CAAC;AAEjH,iHAAiH;AACjH,qHAAqH;AACrH,6CAA6C;AAC7C,MAAM,CAAC,MAAM,uBAAuB,GAAG,eAAe,CAMpD,oHAAoH;IACpH,yEAAyE;IACzE,oEAAoE;IACpE,uEAAuE;IACvE,wBAAwB;IACxB,iGAAiG,CAClG,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAClD,kHAAkH;IAClH,iHAAiH;IACjH,yCAAyC,CAC1C,CAAC;AAEF,MAAM,CAAC,MAAM,oCAAoC,GAAG,eAAe,CACjE,kIAAkI;IAClI,wCAAwC,CACzC,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG,eAAe,CACxD,8EAA8E;IAC9E,wCAAwC,CACzC,CAAC;AAEF,MAAM,CAAC,MAAM,sCAAsC,GAAG,eAAe,CASnE,0FAA0F;IAC1F,yGAAyG;IACzG,uCAAuC;IACvC,2DAA2D;IAC3D,+EAA+E;IAC/E,8BAA8B;IAC9B,wCAAwC,CACzC,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG,eAAe,CACrD,4IAA4I;IAC5I,iIAAiI;IACjI,gFAAgF,CACjF,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAe,CAC/C,oEAAoE;IACpE,oGAAoG,CACrG,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,eAAe,CACpD,qHAAqH;IACrH,iHAAiH;IACjH,qHAAqH;IACrH,uFAAuF,CACxF,CAAC"}
+{"version":3,"file":"platform-prompts.js","sourceRoot":"","sources":["../../src/prompts/platform-prompts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAEnE;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,eAAe,CACrD,mEAAmE;IACnE,iIAAiI;IACjI,oFAAoF;IACpF,8CAA8C,CAC/C,CAAC"}

package/dist/services/platform-auth.d.ts

@@ -0,0 +1,43 @@
+/**
+ * The CLI's OAuth client of the Idea1 platform: it holds the credential every platform call is
+ * authorized with, and signs the user in and out.
+ *
+ * The CLI is a public client (no secret) that registers itself dynamically with the platform's
+ * authorization server, discovered at `{apiBase}/.well-known/oauth-authorization-server`. Signing in
+ * is the authorization code flow with PKCE: the browser opens the platform's consent page, where the
+ * user picks the team the grant is bound to, and the platform redirects back to a loopback server
+ * the CLI runs on a random port of 127.0.0.1 (the registered `http://127.0.0.1/callback` matches on
+ * any port). The resulting team-bound access token is short-lived; the refresh token renews it.
+ *
+ * The credential lives in the operating system's credential store (macOS Keychain, Windows
+ * Credential Manager, Secret Service on Linux) under the service `idea1-cli` and the API base URL as
+ * the account, as the JSON of a `StoredCredential`. Parallel CLI processes share it: the platform
+ * does not rotate refresh tokens, so concurrent refreshes all stay valid and the last write wins.
+ *
+ * `IDEA1_TOKEN`, when set, is the bearer token of every call instead (a team API client's token in
+ * CI, or a test's): nothing is read from or written to the credential store, and nothing is
+ * refreshed. `IDEA1_API_BASE_URL` points the CLI at another platform than https://api.idea1.ai.
+ */
+export declare const API_BASE_URL_ENV = "IDEA1_API_BASE_URL";
+export declare const TOKEN_ENV = "IDEA1_TOKEN";
+/**
+ * The base URL of the platform's API, without a trailing slash.
+ */
+export declare function apiBaseUrl(): string;
+/**
+ * `fetch` with the platform credential as the bearer token. Signs the user in first when there is
+ * no usable credential (an unattended run fails instead, asking for `idea1 login`), renews an
+ * expired access token, and on a 401 renews it and retries the request once. With `IDEA1_TOKEN`
+ * set, that token is sent as it is and a 401 is the caller's response.
+ */
+export declare function authorizedFetch(url: string, init: RequestInit): Promise<Response>;
+/**
+ * Sign in through the browser, replacing any stored credential for the platform.
+ */
+export declare function login(): Promise<void>;
+/**
+ * Revoke the stored credential's refresh token and remove the credential from the credential
+ * store. Returns false when there was no credential to remove.
+ */
+export declare function logout(): Promise<boolean>;
+//# sourceMappingURL=platform-auth.d.ts.map

package/dist/services/platform-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth.d.ts","sourceRoot":"","sources":["../../src/services/platform-auth.ts"],"names":[],"mappings":"AAQA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,eAAO,MAAM,gBAAgB,uBAAuB,CAAC;AACrD,eAAO,MAAM,SAAS,gBAAgB,CAAC;AA0DvC;;GAEG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAGnC;AAOD;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAcvF;AAED;;GAEG;AACH,wBAAsB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAQ3C;AAED;;;GAGG;AACH,wBAAsB,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,CAa/C"}

package/dist/services/platform-auth.js

@@ -0,0 +1,380 @@
+import { createHash, randomBytes } from 'crypto';
+import { createServer } from 'http';
+import { AsyncEntry } from '@napi-rs/keyring';
+import { logger } from '../lib/logger.js';
+import { isUnattended } from '../lib/prompt.js';
+import { openUrl } from './os-launcher.js';
+/**
+ * The CLI's OAuth client of the Idea1 platform: it holds the credential every platform call is
+ * authorized with, and signs the user in and out.
+ *
+ * The CLI is a public client (no secret) that registers itself dynamically with the platform's
+ * authorization server, discovered at `{apiBase}/.well-known/oauth-authorization-server`. Signing in
+ * is the authorization code flow with PKCE: the browser opens the platform's consent page, where the
+ * user picks the team the grant is bound to, and the platform redirects back to a loopback server
+ * the CLI runs on a random port of 127.0.0.1 (the registered `http://127.0.0.1/callback` matches on
+ * any port). The resulting team-bound access token is short-lived; the refresh token renews it.
+ *
+ * The credential lives in the operating system's credential store (macOS Keychain, Windows
+ * Credential Manager, Secret Service on Linux) under the service `idea1-cli` and the API base URL as
+ * the account, as the JSON of a `StoredCredential`. Parallel CLI processes share it: the platform
+ * does not rotate refresh tokens, so concurrent refreshes all stay valid and the last write wins.
+ *
+ * `IDEA1_TOKEN`, when set, is the bearer token of every call instead (a team API client's token in
+ * CI, or a test's): nothing is read from or written to the credential store, and nothing is
+ * refreshed. `IDEA1_API_BASE_URL` points the CLI at another platform than https://api.idea1.ai.
+ */
+export const API_BASE_URL_ENV = 'IDEA1_API_BASE_URL';
+export const TOKEN_ENV = 'IDEA1_TOKEN';
+const DEFAULT_API_BASE_URL = 'https://api.idea1.ai';
+const CREDENTIAL_STORE_SERVICE = 'idea1-cli';
+const CLIENT_NAME = 'Idea1 CLI';
+const CLIENT_SCOPE = 'team:read projects:read projects:write';
+/** The redirect URI the client registers; the loopback server listens on a random port of it. */
+const REGISTERED_REDIRECT_URI = 'http://127.0.0.1/callback';
+const SIGN_IN_TIMEOUT_MS = 5 * 60 * 1000;
+/** An access token this close to its expiry is renewed before it is used. */
+const EXPIRY_MARGIN_MS = 60 * 1000;
+/**
+ * An OAuth error response (RFC 6749 §5.2), from an endpoint or from the authorization redirect.
+ */
+class OAuthError extends Error {
+    code;
+    constructor(code, description) {
+        super(description === null ? `idea1.ai sign-in failed: ${code}` : `idea1.ai sign-in failed: ${code} (${description})`);
+        this.code = code;
+    }
+}
+/**
+ * The base URL of the platform's API, without a trailing slash.
+ */
+export function apiBaseUrl() {
+    const configured = process.env[API_BASE_URL_ENV]?.trim();
+    return (configured ? configured : DEFAULT_API_BASE_URL).replace(/\/+$/, '');
+}
+function tokenFromEnvironment() {
+    const token = process.env[TOKEN_ENV]?.trim();
+    return token ? token : null;
+}
+/**
+ * `fetch` with the platform credential as the bearer token. Signs the user in first when there is
+ * no usable credential (an unattended run fails instead, asking for `idea1 login`), renews an
+ * expired access token, and on a 401 renews it and retries the request once. With `IDEA1_TOKEN`
+ * set, that token is sent as it is and a 401 is the caller's response.
+ */
+export async function authorizedFetch(url, init) {
+    const environmentToken = tokenFromEnvironment();
+    if (environmentToken !== null) {
+        return fetch(url, withBearer(init, environmentToken));
+    }
+    const credential = await serialized(() => usableCredential(null));
+    const response = await fetch(url, withBearer(init, credential.accessToken));
+    if (response.status !== 401) {
+        return response;
+    }
+    const renewed = await serialized(() => usableCredential(credential.accessToken));
+    return fetch(url, withBearer(init, renewed.accessToken));
+}
+/**
+ * Sign in through the browser, replacing any stored credential for the platform.
+ */
+export async function login() {
+    if (tokenFromEnvironment() !== null) {
+        throw new Error(`${TOKEN_ENV} is set, and every platform call uses it: unset it to sign in with \`idea1 login\`.`);
+    }
+    await serialized(async () => {
+        await signIn((await readStoredCredential())?.clientId ?? null);
+    });
+}
+/**
+ * Revoke the stored credential's refresh token and remove the credential from the credential
+ * store. Returns false when there was no credential to remove.
+ */
+export async function logout() {
+    return serialized(async () => {
+        const stored = await readStoredCredential();
+        if (stored === null) {
+            return false;
+        }
+        try {
+            await revoke(stored);
+        }
+        finally {
+            await credentialStoreEntry().deletePassword();
+        }
+        return true;
+    });
+}
+/**
+ * Credential reads, renewals and sign-ins run one at a time in a process, so parallel platform
+ * calls renew or sign in once.
+ */
+let credentialQueue = Promise.resolve();
+function serialized(work) {
+    const result = credentialQueue.then(work);
+    credentialQueue = result.catch(() => undefined);
+    return result;
+}
+/**
+ * A credential whose access token is current, other than `rejectedAccessToken` (the one a 401 was
+ * answered with, unless another call or process has renewed it since). A credential the platform
+ * no longer honours is removed, and the user signs in again.
+ */
+async function usableCredential(rejectedAccessToken) {
+    const stored = await readStoredCredential();
+    if (stored === null) {
+        return signInWhenAttended(null);
+    }
+    const expired = Date.parse(stored.accessTokenExpiresAt) - EXPIRY_MARGIN_MS <= Date.now();
+    if (!expired && stored.accessToken !== rejectedAccessToken) {
+        return stored;
+    }
+    try {
+        return await refresh(stored);
+    }
+    catch (error) {
+        if (error instanceof OAuthError && (error.code === 'invalid_grant' || error.code === 'invalid_client')) {
+            await credentialStoreEntry().deletePassword();
+            return signInWhenAttended(error.code === 'invalid_grant' ? stored.clientId : null);
+        }
+        throw error;
+    }
+}
+async function signInWhenAttended(clientId) {
+    if (isUnattended()) {
+        throw new Error(`Not signed in to idea1.ai (${apiBaseUrl()}). Run \`idea1 login\` to sign in.`);
+    }
+    logger.step(`Signing in to idea1.ai (${apiBaseUrl()})...`);
+    return signIn(clientId);
+}
+/**
+ * Sign in through the browser with the given registered client, or a newly registered one, and
+ * store the credential: the authorization code flow with PKCE (S256) and `state`, redirected to a
+ * loopback server on a random port.
+ *
+ * The platform answers an authorization request it refuses outright, such as one for a client it
+ * no longer knows, with an error page instead of a redirect to the loopback server. So before the
+ * browser opens, the request for a stored client is sent once without following its redirect: a
+ * client the platform no longer knows is registered again, and any other refusal ends the sign-in.
+ */
+async function signIn(storedClientId) {
+    const metadata = await discoverAuthorizationServer();
+    const codeVerifier = base64Url(randomBytes(32));
+    const codeChallenge = base64Url(createHash('sha256').update(codeVerifier).digest());
+    const state = base64Url(randomBytes(16));
+    const callback = await listenForAuthorizationCallback(state);
+    try {
+        const authorizationUrlFor = (clientId) => {
+            const url = new URL(metadata.authorization_endpoint);
+            url.search = new URLSearchParams({
+                response_type: 'code',
+                client_id: clientId,
+                redirect_uri: callback.redirectUri,
+                scope: CLIENT_SCOPE,
+                state,
+                code_challenge: codeChallenge,
+                code_challenge_method: 'S256'
+            }).toString();
+            return url.toString();
+        };
+        let clientId = storedClientId ?? await registerClient(metadata);
+        if (storedClientId !== null) {
+            const refusal = await authorizationRefusal(authorizationUrlFor(storedClientId));
+            if (refusal?.code === 'invalid_client') {
+                clientId = await registerClient(metadata);
+            }
+            else if (refusal !== null) {
+                throw refusal;
+            }
+        }
+        const [code] = await Promise.all([callback.code, openInBrowser(authorizationUrlFor(clientId))]);
+        const tokens = await postTokenRequest(metadata, {
+            grant_type: 'authorization_code',
+            code,
+            redirect_uri: callback.redirectUri,
+            client_id: clientId,
+            code_verifier: codeVerifier
+        });
+        if (tokens.refresh_token === null) {
+            throw new Error('idea1.ai issued no refresh token for the sign-in.');
+        }
+        return storeTokens(clientId, tokens, tokens.refresh_token);
+    }
+    finally {
+        callback.close();
+    }
+}
+/**
+ * The OAuth error the authorize endpoint answers a request with instead of redirecting it; null
+ * when it redirects. The endpoint validates the request and redirects to the consent page with no
+ * side effect, so the request is safe to send ahead of the browser.
+ */
+async function authorizationRefusal(authorizationUrl) {
+    const response = await fetch(authorizationUrl, { redirect: 'manual', headers: { Accept: 'application/json' } });
+    const text = await response.text();
+    const error = response.status >= 400 && response.status < 500 ? parseOAuthError(text) : null;
+    return error === null ? null : new OAuthError(error.error, error.error_description ?? null);
+}
+async function openInBrowser(url) {
+    logger.dim(`Sign in to idea1.ai in your browser. If it does not open, open this URL:\n${url}`);
+    try {
+        await openUrl(url);
+    }
+    catch (error) {
+        logger.warning(`Could not open the browser: ${error.message}`);
+    }
+}
+/**
+ * A loopback HTTP server on a random port of 127.0.0.1 that receives the authorization redirect:
+ * `code` settles with the authorization code, the platform's error, or a timeout.
+ */
+async function listenForAuthorizationCallback(state) {
+    const server = createServer();
+    let timeout;
+    const code = new Promise((resolve, reject) => {
+        timeout = setTimeout(() => reject(new Error(`Sign-in did not finish in the browser within ${SIGN_IN_TIMEOUT_MS / 60_000} minutes.`)), SIGN_IN_TIMEOUT_MS);
+        server.on('request', (request, response) => {
+            const url = new URL(request.url ?? '/', 'http://127.0.0.1');
+            // Anything other than the redirect of this sign-in (a favicon, a stale tab) is not an answer.
+            if (url.pathname !== '/callback' || url.searchParams.get('state') !== state) {
+                response.writeHead(404).end();
+                return;
+            }
+            const error = url.searchParams.get('error');
+            const authorizationCode = url.searchParams.get('code');
+            if (error !== null || !authorizationCode) {
+                writeCallbackPage(response, 'Sign-in did not complete. Return to the terminal for details; you can close this tab.');
+                reject(new OAuthError(error ?? 'invalid_request', url.searchParams.get('error_description')));
+                return;
+            }
+            writeCallbackPage(response, 'Signed in to idea1.ai. You can close this tab and return to the terminal.');
+            resolve(authorizationCode);
+        });
+    });
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', () => resolve());
+    });
+    const { port } = server.address();
+    const redirectUri = new URL(REGISTERED_REDIRECT_URI);
+    redirectUri.port = String(port);
+    return {
+        redirectUri: redirectUri.toString(),
+        code,
+        close: () => {
+            clearTimeout(timeout);
+            server.close();
+            server.closeAllConnections();
+        }
+    };
+}
+function writeCallbackPage(response, message) {
+    response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', Connection: 'close' });
+    response.end('<!doctype html><html><head><meta charset="utf-8"><title>Idea1 CLI</title></head>' +
+        `<body style="font-family: system-ui, sans-serif; margin: 4rem; text-align: center"><p>${message}</p></body></html>`);
+}
+let authorizationServerMetadata = null;
+function discoverAuthorizationServer() {
+    authorizationServerMetadata ??= readJson(fetch(`${apiBaseUrl()}/.well-known/oauth-authorization-server`, { headers: { Accept: 'application/json' } })).catch(error => {
+        authorizationServerMetadata = null;
+        throw error;
+    });
+    return authorizationServerMetadata;
+}
+async function registerClient(metadata) {
+    const registration = await readJson(fetch(metadata.registration_endpoint, {
+        method: 'POST',
+        headers: { Accept: 'application/json', 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            client_name: CLIENT_NAME,
+            redirect_uris: [REGISTERED_REDIRECT_URI],
+            grant_types: ['authorization_code', 'refresh_token'],
+            response_types: ['code'],
+            token_endpoint_auth_method: 'none',
+            scope: CLIENT_SCOPE
+        })
+    }));
+    return registration.client_id;
+}
+/**
+ * Renew the access token. The platform does not rotate refresh tokens, so the stored one is kept
+ * unless the response carries another.
+ */
+async function refresh(stored) {
+    const tokens = await postTokenRequest(await discoverAuthorizationServer(), {
+        grant_type: 'refresh_token',
+        refresh_token: stored.refreshToken,
+        client_id: stored.clientId
+    });
+    return storeTokens(stored.clientId, tokens, tokens.refresh_token ?? stored.refreshToken);
+}
+async function revoke(stored) {
+    const metadata = await discoverAuthorizationServer();
+    await readSuccessBody(fetch(metadata.revocation_endpoint, {
+        method: 'POST',
+        headers: { Accept: 'application/json', 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({ token: stored.refreshToken, token_type_hint: 'refresh_token', client_id: stored.clientId }).toString()
+    }));
+}
+function postTokenRequest(metadata, parameters) {
+    return readJson(fetch(metadata.token_endpoint, {
+        method: 'POST',
+        headers: { Accept: 'application/json', 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams(parameters).toString()
+    }));
+}
+/**
+ * The JSON body of an OAuth endpoint's success response.
+ */
+async function readJson(pending) {
+    return JSON.parse(await readSuccessBody(pending));
+}
+/**
+ * The body of an OAuth endpoint's success response; an error response throws OAuthError with the
+ * endpoint's `error` code, or an Error naming the HTTP status when it has none.
+ */
+async function readSuccessBody(pending) {
+    const response = await pending;
+    const text = await response.text();
+    if (response.ok) {
+        return text;
+    }
+    const error = parseOAuthError(text);
+    if (error !== null) {
+        throw new OAuthError(error.error, error.error_description ?? null);
+    }
+    throw new Error(`idea1.ai refused ${response.url} (${response.status} ${response.statusText})${text.trim() ? `: ${text.trim().slice(0, 500)}` : ''}`);
+}
+function parseOAuthError(text) {
+    try {
+        const body = JSON.parse(text);
+        return typeof body.error === 'string' ? { error: body.error, error_description: body.error_description } : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function storeTokens(clientId, tokens, refreshToken) {
+    const credential = {
+        clientId,
+        refreshToken,
+        accessToken: tokens.access_token,
+        accessTokenExpiresAt: new Date(Date.now() + tokens.expires_in * 1000).toISOString()
+    };
+    await credentialStoreEntry().setPassword(JSON.stringify(credential));
+    return credential;
+}
+async function readStoredCredential() {
+    const value = await credentialStoreEntry().getPassword();
+    return value === null ? null : JSON.parse(value);
+}
+function credentialStoreEntry() {
+    return new AsyncEntry(CREDENTIAL_STORE_SERVICE, apiBaseUrl());
+}
+function withBearer(init, token) {
+    return { ...init, headers: { ...init.headers, Authorization: `Bearer ${token}` } };
+}
+function base64Url(bytes) {
+    return bytes.toString('base64url');
+}
+//# sourceMappingURL=platform-auth.js.map

package/dist/services/platform-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth.js","sourceRoot":"","sources":["../../src/services/platform-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAE,YAAY,EAAuB,MAAM,MAAM,CAAC;AAEzD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AACrD,MAAM,CAAC,MAAM,SAAS,GAAG,aAAa,CAAC;AAEvC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AACpD,MAAM,wBAAwB,GAAG,WAAW,CAAC;AAC7C,MAAM,WAAW,GAAG,WAAW,CAAC;AAChC,MAAM,YAAY,GAAG,wCAAwC,CAAC;AAC9D,iGAAiG;AACjG,MAAM,uBAAuB,GAAG,2BAA2B,CAAC;AAC5D,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,6EAA6E;AAC7E,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC;AAuCnC;;GAEG;AACH,MAAM,UAAW,SAAQ,KAAK;IACP;IAArB,YAAqB,IAAY,EAAE,WAA0B;QAC3D,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC,CAAC,4BAA4B,IAAI,KAAK,WAAW,GAAG,CAAC,CAAC;QADpG,SAAI,GAAJ,IAAI,CAAQ;IAEjC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,UAAU;IACxB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC;IACzD,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,oBAAoB;IAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;IAC7C,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,IAAiB;IAClE,MAAM,gBAAgB,GAAG,oBAAoB,EAAE,CAAC;IAChD,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5E,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IACjF,OAAO,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK;IACzB,IAAI,oBAAoB,EAAE,KAAK,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,qFAAqF,CAAC,CAAC;IACrH,CAAC;IAED,MAAM,UAAU,CAAC,KAAK,IAAI,EAAE;QAC1B,MAAM,MAAM,CAAC,CAAC,MAAM,oBAAoB,EAAE,CAAC,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM;IAC1B,OAAO,UAAU,CAAC,KAAK,IAAI,EAAE;QAC3B,MAAM,MAAM,GAAG,MAAM,oBAAoB,EAAE,CAAC;QAC5C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;gBAAS,CAAC;YACT,MAAM,oBAAoB,EAAE,CAAC,cAAc,EAAE,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,IAAI,eAAe,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;AAE1D,SAAS,UAAU,CAAI,IAAsB;IAC3C,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAAC,mBAAkC;IAChE,MAAM,MAAM,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC5C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,oBAAoB,CAAC,GAAG,gBAAgB,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACzF,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,WAAW,KAAK,mBAAmB,EAAE,CAAC;QAC3D,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,UAAU,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,eAAe,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,CAAC,EAAE,CAAC;YACvG,MAAM,oBAAoB,EAAE,CAAC,cAAc,EAAE,CAAC;YAC9C,OAAO,kBAAkB,CAAC,KAAK,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,QAAuB;IACvD,IAAI,YAAY,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,8BAA8B,UAAU,EAAE,oCAAoC,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,2BAA2B,UAAU,EAAE,MAAM,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,MAAM,CAAC,cAA6B;IACjD,MAAM,QAAQ,GAAG,MAAM,2BAA2B,EAAE,CAAC;IACrD,MAAM,YAAY,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,MAAM,aAAa,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACpF,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAE7D,IAAI,CAAC;QACH,MAAM,mBAAmB,GAAG,CAAC,QAAgB,EAAU,EAAE;YACvD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;YACrD,GAAG,CAAC,MAAM,GAAG,IAAI,eAAe,CAAC;gBAC/B,aAAa,EAAE,MAAM;gBACrB,SAAS,EAAE,QAAQ;gBACnB,YAAY,EAAE,QAAQ,CAAC,WAAW;gBAClC,KAAK,EAAE,YAAY;gBACnB,KAAK;gBACL,cAAc,EAAE,aAAa;gBAC7B,qBAAqB,EAAE,MAAM;aAC9B,CAAC,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxB,CAAC,CAAC;QAEF,IAAI,QAAQ,GAAG,cAAc,IAAI,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;QAChE,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC,CAAC;YAChF,IAAI,OAAO,EAAE,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACvC,QAAQ,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC5C,CAAC;iBAAM,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC5B,MAAM,OAAO,CAAC;YAChB,CAAC;QACH,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAEhG,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE;YAC9C,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,YAAY,EAAE,QAAQ,CAAC,WAAW;YAClC,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,YAAY;SAC5B,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC7D,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,oBAAoB,CAAC,gBAAwB;IAC1D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAChH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7F,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC;AAC9F,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAW;IACtC,MAAM,CAAC,GAAG,CAAC,6EAA6E,GAAG,EAAE,CAAC,CAAC;IAC/F,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,OAAO,CAAC,+BAAgC,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,8BAA8B,CAAC,KAAa;IACzD,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,IAAI,OAAmC,CAAC;IAExC,MAAM,IAAI,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnD,OAAO,GAAG,UAAU,CAClB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gDAAgD,kBAAkB,GAAG,MAAM,WAAW,CAAC,CAAC,EAC/G,kBAAkB,CACnB,CAAC;QAEF,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YACzC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAC5D,8FAA8F;YAC9F,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC5E,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBAC9B,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,iBAAiB,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACvD,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACzC,iBAAiB,CAAC,QAAQ,EAAE,uFAAuF,CAAC,CAAC;gBACrH,MAAM,CAAC,IAAI,UAAU,CAAC,KAAK,IAAI,iBAAiB,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;gBAC9F,OAAO;YACT,CAAC;YAED,iBAAiB,CAAC,QAAQ,EAAE,2EAA2E,CAAC,CAAC;YACzG,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;IACjD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACrD,WAAW,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAEhC,OAAO;QACL,WAAW,EAAE,WAAW,CAAC,QAAQ,EAAE;QACnC,IAAI;QACJ,KAAK,EAAE,GAAG,EAAE;YACV,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC/B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAwB,EAAE,OAAe;IAClE,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7F,QAAQ,CAAC,GAAG,CACV,kFAAkF;QAClF,yFAAyF,OAAO,oBAAoB,CACrH,CAAC;AACJ,CAAC;AAED,IAAI,2BAA2B,GAAgD,IAAI,CAAC;AAEpF,SAAS,2BAA2B;IAClC,2BAA2B,KAAK,QAAQ,CACtC,KAAK,CAAC,GAAG,UAAU,EAAE,yCAAyC,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAC7G,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;QACd,2BAA2B,GAAG,IAAI,CAAC;QACnC,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,OAAO,2BAA2B,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,QAAqC;IACjE,MAAM,YAAY,GAAG,MAAM,QAAQ,CAA6B,KAAK,CAAC,QAAQ,CAAC,qBAAqB,EAAE;QACpG,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,WAAW,EAAE,WAAW;YACxB,aAAa,EAAE,CAAC,uBAAuB,CAAC;YACxC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,0BAA0B,EAAE,MAAM;YAClC,KAAK,EAAE,YAAY;SACpB,CAAC;KACH,CAAC,CAAC,CAAC;IACJ,OAAO,YAAY,CAAC,SAAS,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,OAAO,CAAC,MAAwB;IAC7C,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,2BAA2B,EAAE,EAAE;QACzE,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,SAAS,EAAE,MAAM,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,OAAO,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC;AAC3F,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,MAAwB;IAC5C,MAAM,QAAQ,GAAG,MAAM,2BAA2B,EAAE,CAAC;IACrD,MAAM,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,mBAAmB,EAAE;QACxD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAC5F,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE;KACnI,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAqC,EAAE,UAAkC;IACjG,OAAO,QAAQ,CAAgB,KAAK,CAAC,QAAQ,CAAC,cAAc,EAAE;QAC5D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAC5F,IAAI,EAAE,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;KACjD,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,QAAQ,CAAI,OAA0B;IACnD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,CAAM,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAAC,OAA0B;IACvD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,oBAAoB,QAAQ,CAAC,GAAG,KAAK,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACxJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA2D,CAAC;QACxF,OAAO,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAClH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,MAAqB,EAAE,YAAoB;IACtF,MAAM,UAAU,GAAqB;QACnC,QAAQ;QACR,YAAY;QACZ,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,oBAAoB,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;KACpF,CAAC;IACF,MAAM,oBAAoB,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;IACrE,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,oBAAoB;IACjC,MAAM,KAAK,GAAG,MAAM,oBAAoB,EAAE,CAAC,WAAW,EAAE,CAAC;IACzD,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAqB,CAAC;AACvE,CAAC;AAED,SAAS,oBAAoB;IAC3B,OAAO,IAAI,UAAU,CAAC,wBAAwB,EAAE,UAAU,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,UAAU,CAAC,IAAiB,EAAE,KAAa;IAClD,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAiC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,CAAC;AAC/G,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACrC,CAAC"}

package/dist/services/platform.d.ts

@@ -6,30 +6,33 @@ import type { ClaudeRunOptions } from './claude.js';
  * The CLI's access to the Idea1 cloud platform (app.idea1.ai / api.idea1.ai): reading a project
  * item's summary (by item or by branch), recording the item's workflow context, setting its workflow
  * status (with the teammate it is assigned to), creating items, listing the team's Projects and
- * members, deriving a branch name from an item. Callers use `platform.someFunction()` and know
- * nothing about the transport.
+ * members, deriving a branch name from an item, and reading who is signed in. Callers use
+ * `platform.someFunction()` and know nothing about the transport.
  *
- * Today the transport is Claude Code driving the Idea1 MCP tools. That is an implementation detail
- * of this module - it may be replaced by authenticated calls to the platform's HTTP API without
- * touching any caller. Because these are simple tool calls rather than implementation sessions,
- * every Claude run here uses PLATFORM_CALL_RUN_OPTIONS. The prompts are the templates in
- * `src/prompts/platform-prompts.ts`; this module owns the output schemas their answers are read with.
+ * The transport is the platform's REST API, authorized with the user's OAuth credential or
+ * `IDEA1_TOKEN` (see `platform-auth.ts`), on the team that credential is bound to. Responses are the
+ * platform's `ApiDataResponse` envelope; a refused request surfaces as an Error carrying the
+ * platform's status and message. Claude is used only to name branches, on PLATFORM_CALL_RUN_OPTIONS.
  */
 /**
- * Model and effort for every platform call: a small, fast model at medium effort is all a
- * single MCP tool call needs, and pinning it keeps these calls consistent and cheap.
+ * Model and effort for the Claude run that names a branch: a small, fast model at medium effort is
+ * all a one-line answer from a description needs, and pinning it keeps the run consistent and cheap.
  */
 export declare const PLATFORM_CALL_RUN_OPTIONS: Required<ClaudeRunOptions>;
+/**
+ * Who the platform credential signs in as: the user's email address and the team its calls work on.
+ */
+export interface SignedInUser {
+    emailAddress: string;
+    teamName: string;
+}
 /**
  * Record workflow context updates on an idea1.ai project item directly, with no side effects on the
  * platform: the CLI has already run the transition's work locally. The item must be under workflow
  * management (have a workflow context); the workflow engine is the only caller, as the persist step
  * of a transition. `assignedToEmail` names the team member the item is assigned to along with the
- * status; null leaves the assignment as it is.
- *
- * TODO: Direct workflow-context updates move from the update_item MCP tool to an authenticated
- * platform API call; the CLI will authenticate a user and call the API for direct integrations
- * like this, and MCP tools will be only operations that agents should run.
+ * status; null leaves the assignment as it is. Returns false, with a warning, when the platform did
+ * not record it.
  */
 export declare function setWorkflowStatus(itemUrl: string, status: string, pullRequestUrl: string | null, assignedToEmail: string | null): Promise<boolean>;
 /**
@@ -67,7 +70,7 @@ export interface UpsertProjectItemWorkflowContextInput {
  */
 export declare function upsertProjectItemWorkflowContext(input: UpsertProjectItemWorkflowContextInput): Promise<ProjectItemSummary>;
 /**
- * Generate a branch name from a project item description
+ * Generate a branch name from a project item's description.
  */
 export declare function generateBranchName(itemUrl: string): Promise<string>;
 /**
@@ -86,9 +89,13 @@ export declare function listTeamMembers(): Promise<TeamMember[]>;
  */
 export declare function resolveTeammate(identity: string): Promise<TeamMember>;
 /**
- * Create a new idea1 project item with the given title in the named Project.
+ * Create a new idea1 project item with the given title in the named live Project.
  * The item is created with description `# <title>`.
  * Returns the created item's URL.
  */
 export declare function createProjectItem(title: string, projectName: string): Promise<string>;
+/**
+ * The user the platform credential signs in as, and the team its calls work on.
+ */
+export declare function getSignedInUser(): Promise<SignedInUser>;
 //# sourceMappingURL=platform.d.ts.map

package/dist/services/platform.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../../src/services/platform.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAelE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD;;;;;;;;;;;;GAYG;AAEH;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,gBAAgB,CAAyC,CAAC;AAgB3G;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,EAAE,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAsBxJ;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,KAAK,EAAE;IAAE,kBAAkB,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAclJ;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAkBxF;AAED;;GAEG;AACH,MAAM,WAAW,qCAAqC;IACpD,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,eAAe,CAAC;IACjC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED;;;;;;GAMG;AACH,wBAAsB,gCAAgC,CAAC,KAAK,EAAE,qCAAqC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAkBhI;AAwED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAezE;AAED;;GAEG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAUtD;AAoBD;;;GAGG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAQvD;AAkBD;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAQ3E;AA4BD;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAe3F"}
+{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../../src/services/platform.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAmB,MAAM,sCAAsC,CAAC;AAC7F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAKlE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;;;;GAWG;AAEH;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,gBAAgB,CAAyC,CAAC;AA4D3G;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAqID;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,EAAE,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAaxJ;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,KAAK,EAAE;IAAE,kBAAkB,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CASlJ;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAIxF;AAED;;GAEG;AACH,MAAM,WAAW,qCAAqC;IACpD,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,eAAe,CAAC;IACjC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED;;;;;;GAMG;AACH,wBAAsB,gCAAgC,CAAC,KAAK,EAAE,qCAAqC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAehI;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAWzE;AAUD;;GAEG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAItD;AAID;;;GAGG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAQvD;AAcD;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAQ3E;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAY3F;AAED;;GAEG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,YAAY,CAAC,CAG7D"}