@monadeo.com/grimoire-core 0.3.7 → 0.4.1

package/dist/auth.d.ts

@@ -1,8 +1,28 @@
-export declare function storeRefreshToken(token: string): void;
-export declare function readRefreshToken(): string | undefined;
-export declare function clearRefreshToken(): void;
+export interface StoredSession {
+    refresh_token: string;
+    supabase_url: string;
+    supabase_anon_key: string;
+}
+export declare function storeSession(session: StoredSession): void;
+export declare function readSession(): StoredSession | undefined;
+export declare function clearSession(): void;
 export declare function storeMachineToken(token: string): void;
 export declare function readMachineToken(): string | undefined;
 export declare function clearMachineToken(): void;
-export declare function browserLogin(apiBase: string, openBrowser: (url: string) => void): Promise<void>;
+export interface AuthConfig {
+    supabase_url: string;
+    supabase_anon_key: string;
+    oauth_provider: string;
+    redirect_urls: string[];
+}
+export interface TokenResponse {
+    access_token: string;
+    refresh_token: string;
+    expires_in: number;
+}
+export declare function fetchAuthConfig(apiBase: string): Promise<AuthConfig>;
+type GrantType = "pkce" | "refresh_token";
+export declare function gotrueToken(supabaseUrl: string, anonKey: string, grantType: GrantType, body: Record<string, string>): Promise<TokenResponse>;
+export declare function browserLogin(apiBase: string, openBrowser: (url: string) => void, timeoutMs?: number): Promise<void>;
+export {};
 //# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAmBA,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAIrD;AAED,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAWrD;AAED,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAaD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAIrD;AAED,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAOrD;AAED,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAWD,wBAAsB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAmDrG"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAsBA,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI,CAIzD;AAED,wBAAgB,WAAW,IAAI,aAAa,GAAG,SAAS,CAmBvD;AAED,wBAAgB,YAAY,IAAI,IAAI,CAEnC;AASD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAIrD;AAED,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAOrD;AAED,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAED,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAKD,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAmB1E;AAED,KAAK,SAAS,GAAG,MAAM,GAAG,eAAe,CAAC;AAY1C,wBAAsB,WAAW,CAC/B,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,SAAS,EACpB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B,OAAO,CAAC,aAAa,CAAC,CA0BxB;AAkCD,wBAAsB,YAAY,CAChC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAClC,SAAS,SAAU,GAClB,OAAO,CAAC,IAAI,CAAC,CAuDf"}

package/dist/auth.js

@@ -3,31 +3,43 @@ import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node
 import { createServer } from "node:http";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
+import { ApiError } from "./errors.js";
 import { fetchWithTimeout } from "./http.js";
 // Session storage is a 0600 file, not the OS keychain (Astro 2026-07-14):
 // keychain ACLs are per binary, so every agent runtime spawning the MCP server
 // re-prompted the user — gcloud and Codex accept the same file-based model.
 // A machine token via GRIMOIRE_AUTH_TOKEN overrides interactive auth (CI only).
+function configDir() {
+    return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "grimoire");
+}
 function credentialsPath() {
-    return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "grimoire", "credentials.json");
+    return join(configDir(), "credentials.json");
 }
-export function storeRefreshToken(token) {
+export function storeSession(session) {
     const path = credentialsPath();
     mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-    writeFileSync(path, JSON.stringify({ refresh_token: token }) + "\n", { mode: 0o600 });
+    writeFileSync(path, JSON.stringify(session) + "\n", { mode: 0o600 });
 }
-export function readRefreshToken() {
+export function readSession() {
     try {
         const parsed = JSON.parse(readFileSync(credentialsPath(), "utf8"));
-        return typeof parsed.refresh_token === "string" && parsed.refresh_token !== ""
-            ? parsed.refresh_token
-            : undefined;
+        if (typeof parsed.refresh_token === "string" &&
+            parsed.refresh_token !== "" &&
+            typeof parsed.supabase_url === "string" &&
+            typeof parsed.supabase_anon_key === "string") {
+            return {
+                refresh_token: parsed.refresh_token,
+                supabase_url: parsed.supabase_url,
+                supabase_anon_key: parsed.supabase_anon_key,
+            };
+        }
+        return undefined;
     }
     catch {
         return undefined;
     }
 }
-export function clearRefreshToken() {
+export function clearSession() {
     if (existsSync(credentialsPath()))
         rmSync(credentialsPath());
 }
@@ -35,7 +47,7 @@ export function clearRefreshToken() {
 // GRIMOIRE_AUTH_TOKEN in a shell profile (that env var still overrides). Same
 // 0600 model as credentials.json — never the world-readable config.json.
 function machineTokenPath() {
-    return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "grimoire", "machine-token");
+    return join(configDir(), "machine-token");
 }
 export function storeMachineToken(token) {
     const path = machineTokenPath();
@@ -55,58 +67,145 @@ export function clearMachineToken() {
     if (existsSync(machineTokenPath()))
         rmSync(machineTokenPath());
 }
+// The API publishes everything a client needs to log in: the public Supabase
+// URL, its anon key (public by design), the OAuth provider, and the loopback
+// callbacks that are allow-listed for the PKCE flow.
+export async function fetchAuthConfig(apiBase) {
+    const res = await fetchWithTimeout(`${apiBase.replace(/\/+$/, "")}/v1/auth/config`);
+    if (!res.ok)
+        throw new ApiError(res.status, "auth_config_unavailable", await res.text());
+    const body = (await res.json());
+    if (typeof body.supabase_url !== "string" ||
+        typeof body.supabase_anon_key !== "string" ||
+        typeof body.oauth_provider !== "string" ||
+        !Array.isArray(body.redirect_urls) ||
+        body.redirect_urls.length === 0) {
+        throw new ApiError(res.status, "auth_config_malformed", body);
+    }
+    return {
+        supabase_url: body.supabase_url,
+        supabase_anon_key: body.supabase_anon_key,
+        oauth_provider: body.oauth_provider,
+        redirect_urls: body.redirect_urls.map(String),
+    };
+}
+function parseDetail(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+// Supabase Auth (GoTrue) token endpoint: POST /auth/v1/token?grant_type=…, the
+// anon key in the apikey header, JSON body per grant.
+export async function gotrueToken(supabaseUrl, anonKey, grantType, body) {
+    const res = await fetchWithTimeout(`${supabaseUrl.replace(/\/+$/, "")}/auth/v1/token?grant_type=${grantType}`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", apikey: anonKey },
+        body: JSON.stringify(body),
+    });
+    const text = await res.text();
+    if (!res.ok) {
+        throw new ApiError(res.status, grantType === "pkce" ? "login_failed" : "refresh_failed", parseDetail(text));
+    }
+    const parsed = JSON.parse(text);
+    if (typeof parsed.access_token !== "string" ||
+        typeof parsed.refresh_token !== "string" ||
+        typeof parsed.expires_in !== "number") {
+        throw new ApiError(res.status, "token_malformed", parsed);
+    }
+    return {
+        access_token: parsed.access_token,
+        refresh_token: parsed.refresh_token,
+        expires_in: parsed.expires_in,
+    };
+}
 function base64url(buf) {
     return buf.toString("base64url");
 }
-// Browser login via the Grimoire auth broker (Firebase is not an OAuth AS): open
-// the hosted page with a PKCE challenge, receive the one-time code on a loopback
-// callback, exchange it for the Firebase refresh token. The random state binds the
-// callback to this login attempt; anything but GET /callback with that state gets
-// a 404 and the server keeps waiting.
-export async function browserLogin(apiBase, openBrowser) {
-    // The broker lives at the bare origin (/auth/cli/*, no /v1 prefix): normalize
-    // away trailing slashes so the URLs are always built against the origin.
-    const broker = apiBase.replace(/\/+$/, "");
+// Bind the first free allow-listed loopback callback (IPv4). The bases come
+// from the API, so the client and the Supabase allow list cannot drift.
+async function bindCallback(server, redirectUrls) {
+    for (const candidate of redirectUrls) {
+        const port = Number(new URL(candidate).port);
+        const bound = await new Promise((resolve) => {
+            const onError = () => {
+                server.off("error", onError);
+                resolve(false);
+            };
+            server.once("error", onError);
+            server.listen(port, "127.0.0.1", () => {
+                server.off("error", onError);
+                resolve(true);
+            });
+        });
+        if (bound)
+            return candidate;
+    }
+    throw new Error(`No free login callback port among: ${redirectUrls.join(", ")}`);
+}
+// OAuth Authorization Code with PKCE through Supabase Auth: open the provider
+// login in the browser, receive the code on a loopback callback, exchange code +
+// verifier for tokens. No client secret exists anywhere in the client.
+//
+// Supabase Auth's /authorize carries no `state` parameter, so the per-attempt
+// state rides in the callback path (`/callback/<state>`); any other path is a
+// 404 and the server keeps waiting. The allow list holds `/callback/*`.
+export async function browserLogin(apiBase, openBrowser, timeoutMs = 300_000) {
+    const config = await fetchAuthConfig(apiBase);
     const verifier = base64url(randomBytes(32));
     const challenge = base64url(createHash("sha256").update(verifier).digest());
     const state = base64url(randomBytes(16));
     const code = await new Promise((resolve, reject) => {
+        let timer;
+        const finish = (outcome) => {
+            if (timer)
+                clearTimeout(timer);
+            server.closeAllConnections();
+            server.close();
+            if ("code" in outcome)
+                resolve(outcome.code);
+            else
+                reject(outcome.error);
+        };
         const server = createServer((req, res) => {
             const url = new URL(req.url ?? "/", "http://127.0.0.1");
-            const received = url.searchParams.get("code");
-            if (req.method !== "GET" ||
-                url.pathname !== "/callback" ||
-                url.searchParams.get("state") !== state ||
-                !received) {
+            if (req.method !== "GET" || url.pathname !== `/callback/${state}`) {
                 res.writeHead(404).end();
                 return;
             }
-            // Land the user on the hosted branded page rather than raw loopback text.
-            res.writeHead(302, { Location: `${broker}/auth/cli/success` }).end();
-            clearTimeout(timer);
-            server.close();
-            resolve(received);
-        });
-        server.listen(0, "127.0.0.1", () => {
-            const port = server.address().port;
-            const redirect = `http://127.0.0.1:${port}/callback`;
-            openBrowser(`${broker}/auth/cli/start?code_challenge=${challenge}&code_challenge_method=S256&state=${state}&redirect_uri=${encodeURIComponent(redirect)}`);
+            const failure = url.searchParams.get("error_description") ?? url.searchParams.get("error");
+            const received = url.searchParams.get("code");
+            if (failure || !received) {
+                res.writeHead(400, { "Content-Type": "text/plain" }).end(`Login failed: ${failure ?? "no code"}`);
+                finish({ error: new Error(`Login failed: ${failure ?? "no code returned"}`) });
+                return;
+            }
+            res
+                .writeHead(200, { "Content-Type": "text/plain" })
+                .end("Logged in to Grimoire. You can close this tab.");
+            finish({ code: received });
         });
-        const timer = setTimeout(() => {
-            server.close();
-            reject(new Error("Login timed out"));
-        }, 300_000);
+        bindCallback(server, config.redirect_urls)
+            .then((redirectBase) => {
+            timer = setTimeout(() => finish({ error: new Error("Login timed out") }), timeoutMs);
+            const authorize = new URL(`${config.supabase_url.replace(/\/+$/, "")}/auth/v1/authorize`);
+            authorize.searchParams.set("provider", config.oauth_provider);
+            authorize.searchParams.set("redirect_to", `${redirectBase.replace(/\/+$/, "")}/${state}`);
+            authorize.searchParams.set("code_challenge", challenge);
+            authorize.searchParams.set("code_challenge_method", "s256");
+            openBrowser(authorize.toString());
+        })
+            .catch((err) => finish({ error: err }));
     });
-    const res = await fetchWithTimeout(`${broker}/auth/cli/exchange`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ code, code_verifier: verifier }),
+    const tokens = await gotrueToken(config.supabase_url, config.supabase_anon_key, "pkce", {
+        auth_code: code,
+        code_verifier: verifier,
+    });
+    storeSession({
+        refresh_token: tokens.refresh_token,
+        supabase_url: config.supabase_url,
+        supabase_anon_key: config.supabase_anon_key,
     });
-    if (!res.ok)
-        throw new Error(`Token exchange failed: ${res.status}`);
-    const { refresh_token } = (await res.json());
-    if (typeof refresh_token !== "string" || refresh_token.length === 0) {
-        throw new Error("Token exchange succeeded but returned no refresh token");
-    }
-    storeRefreshToken(refresh_token);
 }

package/dist/client.d.ts

@@ -1,14 +1,20 @@
-import type { components, operations } from "./generated/schema.js";
-export type SearchResultChunk = components["schemas"]["Chunk"];
-export type SourceCard = components["schemas"]["SourceCard"];
-export type ContextChunk = components["schemas"]["ContextChunk"];
-export type SearchRequest = operations["search"]["requestBody"]["content"]["application/json"];
-export type SearchResponse = operations["search"]["responses"][200]["content"]["application/json"];
-export type ListSourcesResponse = operations["listSources"]["responses"][200]["content"]["application/json"];
-export type ListVersionsResponse = operations["listVersions"]["responses"][200]["content"]["application/json"];
-export type ContextResponse = operations["getDocumentContext"]["responses"][200]["content"]["application/json"];
-export type Job = components["schemas"]["Job"];
-export type SubmitSourceResponse = operations["submitSource"]["responses"][201]["content"]["application/json"];
+import type { components } from "./generated/schema.js";
+type Schemas = components["schemas"];
+export type SearchRequest = Schemas["SearchRequest"];
+export type SearchResponse = Schemas["SearchResponse"];
+export type SearchResult = Schemas["SearchResult"];
+export type SourceSelector = Schemas["SourceSelector"];
+export type SourceOut = Schemas["SourceOut"];
+export type VersionsOut = Schemas["VersionsOut"];
+export type DocWindowOut = Schemas["DocWindowOut"];
+export type ReportIn = Schemas["ReportIn"];
+export type ReportOut = Schemas["ReportOut"];
+export type SubmissionIn = Schemas["SubmissionIn"];
+export type SubmitAccepted = Schemas["SubmitAccepted"];
+export type JobOut = Schemas["JobOut"];
+export type MeOut = Schemas["MeOut"];
+export type UserGrantOut = Schemas["UserGrantOut"];
+export type TokenMinted = Schemas["TokenMinted"];
 export { ApiError } from "./errors.js";
 export interface ClientOptions {
     baseUrl?: string;
@@ -17,21 +23,30 @@ export interface ClientOptions {
 export declare class GrimoireClient {
     private readonly baseUrl;
     private readonly machineToken?;
-    private cachedIdToken?;
+    private cachedAccessToken?;
     private refreshInFlight?;
     constructor(opts?: ClientOptions);
     private bearer;
-    private refreshIdToken;
+    private refreshAccessToken;
     refreshSession(): Promise<void>;
     private send;
     private request;
     private parseResponse;
     search(input: SearchRequest): Promise<SearchResponse>;
-    listSources(q?: string): Promise<ListSourcesResponse>;
-    listVersions(sourceId: string): Promise<ListVersionsResponse>;
-    getContext(chunkId: string, window?: number): Promise<ContextResponse>;
-    reportResult(chunkId: string, verdict: string, note?: string): Promise<unknown>;
-    submitSource(body: Record<string, unknown>): Promise<SubmitSourceResponse>;
-    getJob(jobId: string): Promise<Job>;
+    listSources(): Promise<SourceOut[]>;
+    listVersions(product: string): Promise<VersionsOut>;
+    getDoc(pointId: string, window?: number): Promise<DocWindowOut>;
+    reportResult(pointId: string, verdict: ReportIn["verdict"], note?: string): Promise<ReportOut>;
+    submitSource(body: SubmissionIn): Promise<SubmitAccepted>;
+    getJob(jobId: string): Promise<JobOut>;
+    me(): Promise<MeOut>;
+    reviewQueue(): Promise<JobOut[]>;
+    approveJob(jobId: string): Promise<JobOut>;
+    listUsers(): Promise<UserGrantOut[]>;
+    grantUser(subject: string, name: string): Promise<UserGrantOut>;
+    revokeUser(subject: string): Promise<UserGrantOut>;
+    mintToken(name: string, quotaPerDay: number): Promise<TokenMinted>;
+    recrawlSource(sourceId: string): Promise<JobOut>;
+    rejectJob(jobId: string, reason: string): Promise<JobOut>;
 }
 //# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEpE,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC;AAC/D,MAAM,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC;AAC7D,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,cAAc,CAAC,CAAC;AACjE,MAAM,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAC;AAC/F,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAC;AACnG,MAAM,MAAM,mBAAmB,GAC7B,UAAU,CAAC,aAAa,CAAC,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAC;AAC7E,MAAM,MAAM,oBAAoB,GAC9B,UAAU,CAAC,cAAc,CAAC,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAC;AAC9E,MAAM,MAAM,eAAe,GACzB,UAAU,CAAC,oBAAoB,CAAC,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAC;AAEpF,MAAM,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC;AAC/C,MAAM,MAAM,oBAAoB,GAC9B,UAAU,CAAC,cAAc,CAAC,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAC;AAE9E,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAS;IACvC,OAAO,CAAC,aAAa,CAAC,CAAuC;IAC7D,OAAO,CAAC,eAAe,CAAC,CAAkB;gBAE9B,IAAI,GAAE,aAAkB;YAKtB,MAAM;YAYN,cAAc;IAuBtB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;YAIvB,IAAI;YASJ,OAAO;YAWP,aAAa;IAwB3B,MAAM,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAOrD,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAIrD,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAI7D,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAI,GAAG,OAAO,CAAC,eAAe,CAAC;IAIjE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAO/E,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAI1E,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;CAGpC"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,KAAK,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;AACrC,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;AACrD,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;AACvD,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;AACnD,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;AACvD,MAAM,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;AAC7C,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;AACjD,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;AACnD,MAAM,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAC3C,MAAM,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;AAC7C,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;AACnD,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;AACvD,MAAM,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AACvC,MAAM,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AACrC,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;AACnD,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;AAEjD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAUD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAS;IACvC,OAAO,CAAC,iBAAiB,CAAC,CAAuC;IACjE,OAAO,CAAC,eAAe,CAAC,CAAkB;gBAE9B,IAAI,GAAE,aAAkB;YAKtB,MAAM;YAaN,kBAAkB;IAoB1B,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;YAIvB,IAAI;YASJ,OAAO;YAYP,aAAa;IAsB3B,MAAM,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAIrD,WAAW,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;IAInC,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAInD,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAI,GAAG,OAAO,CAAC,YAAY,CAAC;IAI1D,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAK9F,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC;IAIzD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAItC,EAAE,IAAI,OAAO,CAAC,KAAK,CAAC;IAIpB,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAIhC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAI1C,SAAS,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAIpC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAO/D,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAIlD,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAOlE,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIhD,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAM1D"}

package/dist/client.js

@@ -1,12 +1,19 @@
-import { readMachineToken, readRefreshToken } from "./auth.js";
+import { gotrueToken, readMachineToken, readSession, storeSession } from "./auth.js";
 import { loadGlobalConfig } from "./config.js";
 import { ApiError } from "./errors.js";
 import { fetchWithTimeout } from "./http.js";
 export { ApiError } from "./errors.js";
+const CODES = {
+    401: "unauthorized",
+    403: "forbidden",
+    404: "not_found",
+    422: "invalid_request",
+    429: "quota_exceeded",
+};
 export class GrimoireClient {
     baseUrl;
     machineToken;
-    cachedIdToken;
+    cachedAccessToken;
     refreshInFlight;
     constructor(opts = {}) {
         this.baseUrl = (opts.baseUrl ?? loadGlobalConfig().apiBaseUrl).replace(/\/+$/, "");
@@ -15,39 +22,37 @@ export class GrimoireClient {
     async bearer() {
         if (this.machineToken)
             return this.machineToken;
-        if (this.cachedIdToken && this.cachedIdToken.expiresAt > Date.now() + 60_000) {
-            return this.cachedIdToken.token;
+        if (this.cachedAccessToken && this.cachedAccessToken.expiresAt > Date.now() + 60_000) {
+            return this.cachedAccessToken.token;
         }
-        this.refreshInFlight ??= this.refreshIdToken().finally(() => {
+        this.refreshInFlight ??= this.refreshAccessToken().finally(() => {
             this.refreshInFlight = undefined;
         });
         return this.refreshInFlight;
     }
-    // Exchange the Firebase refresh token for a fresh ID token (silent refresh).
-    async refreshIdToken() {
-        const refresh = readRefreshToken();
-        if (!refresh)
+    // Exchange the stored refresh token for a fresh access token. GoTrue rotates
+    // refresh tokens, so the new one replaces the stored one every time.
+    async refreshAccessToken() {
+        const session = readSession();
+        if (!session)
             throw new ApiError(401, "not_logged_in", "Run `grimoire login`");
-        const res = await fetchWithTimeout(`${this.baseUrl}/auth/cli/refresh`, {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ refresh_token: refresh }),
-        });
-        if (!res.ok)
-            throw new ApiError(res.status, "refresh_failed", "Run `grimoire login`");
-        let payload;
+        let tokens;
         try {
-            payload = await res.json();
-        }
-        catch {
-            throw new ApiError(res.status, "refresh_failed", "Malformed refresh response");
+            tokens = await gotrueToken(session.supabase_url, session.supabase_anon_key, "refresh_token", {
+                refresh_token: session.refresh_token,
+            });
         }
-        const { id_token, expires_in } = payload;
-        if (typeof id_token !== "string" || typeof expires_in !== "number") {
-            throw new ApiError(res.status, "refresh_failed", "Malformed refresh response");
+        catch (err) {
+            if (err instanceof ApiError)
+                throw new ApiError(err.status, "refresh_failed", "Run `grimoire login`");
+            throw err;
         }
-        this.cachedIdToken = { token: id_token, expiresAt: Date.now() + expires_in * 1000 };
-        return id_token;
+        storeSession({ ...session, refresh_token: tokens.refresh_token });
+        this.cachedAccessToken = {
+            token: tokens.access_token,
+            expiresAt: Date.now() + tokens.expires_in * 1000,
+        };
+        return tokens.access_token;
     }
     async refreshSession() {
         await this.bearer();
@@ -63,14 +68,15 @@ export class GrimoireClient {
     }
     async request(path, init = {}, auth = true) {
         let res = await this.send(path, init, auth);
-        // A 401 despite a locally-unexpired ID token means it was revoked server-side:
-        // force one refresh and retry exactly once.
+        // A 401 despite a locally-unexpired access token means it was revoked
+        // server-side: force one refresh and retry exactly once.
         if (res.status === 401 && auth && !this.machineToken) {
-            this.cachedIdToken = undefined;
+            this.cachedAccessToken = undefined;
             res = await this.send(path, init, auth);
         }
         return this.parseResponse(res);
     }
+    // FastAPI errors carry {"detail": "..."} (string) or {"detail": [...]} (422).
     async parseResponse(res) {
         const isJson = res.headers.get("content-type")?.includes("json") ?? false;
         const text = await res.text();
@@ -86,35 +92,28 @@ export class GrimoireClient {
             }
         }
         if (!res.ok) {
-            const code = parsed && typeof body === "object" && body !== null
-                ? (body.error ?? "error")
-                : "error";
-            throw new ApiError(res.status, code, parsed ? body : text);
+            const detail = parsed && typeof body === "object" && body !== null ? body.detail : undefined;
+            throw new ApiError(res.status, CODES[res.status] ?? "error", detail ?? (parsed ? body : text));
         }
         if (isJson)
             return (parsed ? body : {});
         return text;
     }
     search(input) {
-        return this.request("/v1/search", {
-            method: "POST",
-            body: JSON.stringify(input),
-        });
+        return this.request("/v1/search", { method: "POST", body: JSON.stringify(input) });
     }
-    listSources(q) {
-        return this.request(`/v1/sources${q ? `?q=${encodeURIComponent(q)}` : ""}`);
+    listSources() {
+        return this.request("/v1/sources");
     }
-    listVersions(sourceId) {
-        return this.request(`/v1/sources/${encodeURIComponent(sourceId)}/versions`);
+    listVersions(product) {
+        return this.request(`/v1/sources/${encodeURIComponent(product)}/versions`);
     }
-    getContext(chunkId, window = 2) {
-        return this.request(`/v1/documents/${encodeURIComponent(chunkId)}/context?window=${window}`);
+    getDoc(pointId, window = 2) {
+        return this.request(`/v1/doc/${encodeURIComponent(pointId)}?window=${window}`);
     }
-    reportResult(chunkId, verdict, note) {
-        return this.request("/v1/feedback", {
-            method: "POST",
-            body: JSON.stringify({ chunk_id: chunkId, verdict, note }),
-        });
+    reportResult(pointId, verdict, note) {
+        const body = { point_id: pointId, verdict, ...(note ? { note } : {}) };
+        return this.request("/v1/report", { method: "POST", body: JSON.stringify(body) });
     }
     submitSource(body) {
         return this.request("/v1/sources", { method: "POST", body: JSON.stringify(body) });
@@ -122,4 +121,40 @@ export class GrimoireClient {
     getJob(jobId) {
         return this.request(`/v1/jobs/${encodeURIComponent(jobId)}`);
     }
+    me() {
+        return this.request("/v1/me");
+    }
+    reviewQueue() {
+        return this.request("/v1/staff/review-queue");
+    }
+    approveJob(jobId) {
+        return this.request(`/v1/staff/jobs/${encodeURIComponent(jobId)}/approve`, { method: "POST" });
+    }
+    listUsers() {
+        return this.request("/v1/staff/users");
+    }
+    grantUser(subject, name) {
+        return this.request("/v1/staff/users", {
+            method: "POST",
+            body: JSON.stringify({ subject, name }),
+        });
+    }
+    revokeUser(subject) {
+        return this.request(`/v1/staff/users/${encodeURIComponent(subject)}`, { method: "DELETE" });
+    }
+    mintToken(name, quotaPerDay) {
+        return this.request("/v1/staff/tokens", {
+            method: "POST",
+            body: JSON.stringify({ name, quota_per_day: quotaPerDay }),
+        });
+    }
+    recrawlSource(sourceId) {
+        return this.request(`/v1/staff/sources/${encodeURIComponent(sourceId)}/recrawl`, { method: "POST" });
+    }
+    rejectJob(jobId, reason) {
+        return this.request(`/v1/staff/jobs/${encodeURIComponent(jobId)}/reject`, {
+            method: "POST",
+            body: JSON.stringify({ reason }),
+        });
+    }
 }

package/dist/config.d.ts

@@ -5,15 +5,12 @@ export interface SourcePin {
 export interface GlobalConfig {
     apiBaseUrl: string;
     defaultSources?: SourcePin[];
-    defaultLanguage?: string;
-    maxResponseTokens?: number;
     updateCheckHours?: number;
 }
 export interface ProjectConfig {
     sources?: SourcePin[];
-    language?: string;
 }
-export declare const DEFAULT_API_BASE = "https://grimoire-api.monadeo.com";
+export declare const DEFAULT_API_BASE = "https://cli.grimoire.monadeo.com";
 export declare function globalConfigPath(): string;
 export declare function loadGlobalConfig(): GlobalConfig;
 export declare function saveGlobalConfig(config: GlobalConfig): void;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,SAAS,EAAE,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAID,eAAO,MAAM,gBAAgB,qCAAqC,CAAC;AAEnE,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAiBD,wBAAgB,gBAAgB,IAAI,YAAY,CAQ/C;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAI3D;AAKD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAU1F;AAID,wBAAgB,iBAAiB,CAAC,QAAQ,SAAgB,GAAG,aAAa,GAAG,SAAS,CAYrF;AAED,wBAAgB,qBAAqB,IAAI,SAAS,EAAE,CAEnD"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,SAAS,EAAE,CAAC;IAC7B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC;CACvB;AAID,eAAO,MAAM,gBAAgB,qCAAqC,CAAC;AAEnE,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAiBD,wBAAgB,gBAAgB,IAAI,YAAY,CAQ/C;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAI3D;AAKD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAU1F;AAID,wBAAgB,iBAAiB,CAAC,QAAQ,SAAgB,GAAG,aAAa,GAAG,SAAS,CAYrF;AAED,wBAAgB,qBAAqB,IAAI,SAAS,EAAE,CAEnD"}

package/dist/config.js

@@ -1,9 +1,9 @@
 import { readFileSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
-// Bare origin — API paths are absolute (/v1/..., /auth/cli/...), so the base must
-// never carry a path prefix or auth-broker URLs would be built wrong.
-export const DEFAULT_API_BASE = "https://grimoire-api.monadeo.com";
+// Bare origin — API paths are absolute (/v1/...), so the base must never carry a
+// path prefix.
+export const DEFAULT_API_BASE = "https://cli.grimoire.monadeo.com";
 export function globalConfigPath() {
     return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "grimoire", "config.json");
 }