@pocketcoder/host 0.0.2

package/dist/auth/__tests__/token-refresh.test.js

@@ -0,0 +1,205 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+// Mock token-storage
+vi.mock("../token-storage.js", () => ({
+    loadTokens: vi.fn(),
+    saveTokens: vi.fn(),
+    clearTokens: vi.fn(),
+}));
+vi.mock("../gateway-auth.js", () => ({
+    refreshTokenViaGateway: vi.fn(),
+}));
+vi.mock("../../utils/logger.js", () => ({
+    logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn() },
+}));
+import { loadTokens, saveTokens, clearTokens } from "../token-storage.js";
+import { isTokenExpired, refreshTokenIfNeeded, getValidAccessToken, setRefreshFn, startTokenMonitor, stopTokenMonitor, } from "../token-refresh.js";
+const mockLoadTokens = vi.mocked(loadTokens);
+const mockSaveTokens = vi.mocked(saveTokens);
+const mockClearTokens = vi.mocked(clearTokens);
+const mockRefreshFn = vi.fn();
+function makeTokens(overrides = {}) {
+    return {
+        machine_key: "mk-test-123",
+        access_token: "at-old",
+        refresh_token: "rt-old",
+        expires_at: Math.floor(Date.now() / 1000) + 3600, // 1 hour from now
+        user_id: "user-123",
+        ...overrides,
+    };
+}
+describe("token-refresh", () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+        setRefreshFn(mockRefreshFn);
+    });
+    afterEach(() => {
+        stopTokenMonitor();
+    });
+    describe("isTokenExpired", () => {
+        it("should detect expired token", () => {
+            const pastTime = Math.floor(Date.now() / 1000) - 100;
+            expect(isTokenExpired(pastTime)).toBe(true);
+        });
+        it("should not flag valid token as expired", () => {
+            const futureTime = Math.floor(Date.now() / 1000) + 3600;
+            expect(isTokenExpired(futureTime)).toBe(false);
+        });
+        it("should refresh 5 minutes before expiry", () => {
+            // Token expires in 4 minutes (240 seconds) - should be considered expired (buffer is 300s)
+            const almostExpired = Math.floor(Date.now() / 1000) + 240;
+            expect(isTokenExpired(almostExpired)).toBe(true);
+            // Token expires in 6 minutes (360 seconds) - should NOT be considered expired
+            const stillValid = Math.floor(Date.now() / 1000) + 360;
+            expect(isTokenExpired(stillValid)).toBe(false);
+        });
+    });
+    describe("refreshTokenIfNeeded", () => {
+        it("should not refresh valid token", async () => {
+            const tokens = makeTokens();
+            mockLoadTokens.mockResolvedValue(tokens);
+            const result = await refreshTokenIfNeeded();
+            expect(result).toBe(false);
+            expect(mockRefreshFn).not.toHaveBeenCalled();
+            expect(mockSaveTokens).not.toHaveBeenCalled();
+        });
+        it("should refresh token when expired", async () => {
+            const tokens = makeTokens({
+                expires_at: Math.floor(Date.now() / 1000) - 100,
+            });
+            mockLoadTokens.mockResolvedValue(tokens);
+            const newExpiry = Math.floor(Date.now() / 1000) + 3600;
+            mockRefreshFn.mockResolvedValue({
+                access_token: "at-new",
+                refresh_token: "rt-new",
+                expires_at: newExpiry,
+            });
+            const result = await refreshTokenIfNeeded();
+            expect(result).toBe(true);
+            expect(mockRefreshFn).toHaveBeenCalledWith("rt-old");
+            expect(mockSaveTokens).toHaveBeenCalledWith({
+                machine_key: "mk-test-123",
+                access_token: "at-new",
+                refresh_token: "rt-new",
+                expires_at: newExpiry,
+                user_id: "user-123",
+            });
+        });
+        it("should refresh 5 minutes before expiry", async () => {
+            const tokens = makeTokens({
+                expires_at: Math.floor(Date.now() / 1000) + 200, // 200s from now, within 300s buffer
+            });
+            mockLoadTokens.mockResolvedValue(tokens);
+            const newExpiry = Math.floor(Date.now() / 1000) + 3600;
+            mockRefreshFn.mockResolvedValue({
+                access_token: "at-refreshed",
+                refresh_token: "rt-refreshed",
+                expires_at: newExpiry,
+            });
+            const result = await refreshTokenIfNeeded();
+            expect(result).toBe(true);
+            expect(mockRefreshFn).toHaveBeenCalled();
+        });
+        it("should throw when no tokens stored", async () => {
+            mockLoadTokens.mockResolvedValue(null);
+            await expect(refreshTokenIfNeeded()).rejects.toThrow("No auth tokens found");
+        });
+        it("should clear tokens on refresh failure", async () => {
+            const tokens = makeTokens({
+                expires_at: Math.floor(Date.now() / 1000) - 100,
+            });
+            mockLoadTokens.mockResolvedValue(tokens);
+            mockRefreshFn.mockRejectedValue(new Error("Refresh failed"));
+            await expect(refreshTokenIfNeeded()).rejects.toThrow("Failed to refresh token. Tokens cleared.");
+            expect(mockClearTokens).toHaveBeenCalled();
+        });
+    });
+    describe("getValidAccessToken", () => {
+        it("should return valid token without refreshing", async () => {
+            const tokens = makeTokens({ access_token: "at-current" });
+            mockLoadTokens.mockResolvedValue(tokens);
+            const result = await getValidAccessToken();
+            expect(result).toBe("at-current");
+            expect(mockRefreshFn).not.toHaveBeenCalled();
+        });
+        it("should refresh and return new token when expired", async () => {
+            const expiredTokens = makeTokens({
+                access_token: "at-old",
+                expires_at: Math.floor(Date.now() / 1000) - 100,
+            });
+            const newExpiry = Math.floor(Date.now() / 1000) + 3600;
+            const refreshedTokens = makeTokens({
+                access_token: "at-refreshed",
+                refresh_token: "rt-refreshed",
+                expires_at: newExpiry,
+            });
+            // First call (from refreshTokenIfNeeded): returns expired tokens
+            // Second call (from getValidAccessToken after refresh): returns refreshed tokens
+            mockLoadTokens.mockResolvedValueOnce(expiredTokens).mockResolvedValueOnce(refreshedTokens);
+            mockRefreshFn.mockResolvedValue({
+                access_token: "at-refreshed",
+                refresh_token: "rt-refreshed",
+                expires_at: newExpiry,
+            });
+            const result = await getValidAccessToken();
+            expect(result).toBe("at-refreshed");
+        });
+        it("should throw when no tokens available", async () => {
+            mockLoadTokens.mockResolvedValue(null);
+            await expect(getValidAccessToken()).rejects.toThrow("No auth tokens found");
+        });
+    });
+    describe("startTokenMonitor / stopTokenMonitor", () => {
+        beforeEach(() => {
+            vi.useFakeTimers();
+        });
+        afterEach(() => {
+            stopTokenMonitor();
+            vi.useRealTimers();
+        });
+        it("should periodically check token expiry", async () => {
+            const tokens = makeTokens();
+            mockLoadTokens.mockResolvedValue(tokens);
+            startTokenMonitor();
+            // Advance by 60 seconds (one interval tick)
+            await vi.advanceTimersByTimeAsync(60_000);
+            expect(mockLoadTokens).toHaveBeenCalled();
+        });
+        it("should refresh expired token on monitor tick", async () => {
+            const tokens = makeTokens({
+                expires_at: Math.floor(Date.now() / 1000) - 100,
+            });
+            mockLoadTokens.mockResolvedValue(tokens);
+            const newExpiry = Math.floor(Date.now() / 1000) + 3600;
+            mockRefreshFn.mockResolvedValue({
+                access_token: "at-monitor",
+                refresh_token: "rt-monitor",
+                expires_at: newExpiry,
+            });
+            startTokenMonitor();
+            await vi.advanceTimersByTimeAsync(60_000);
+            expect(mockRefreshFn).toHaveBeenCalledWith("rt-old");
+            expect(mockSaveTokens).toHaveBeenCalled();
+        });
+        it("should not throw on monitor errors", async () => {
+            mockLoadTokens.mockRejectedValue(new Error("disk error"));
+            startTokenMonitor();
+            // Should not throw — errors are caught and logged
+            await vi.advanceTimersByTimeAsync(60_000);
+        });
+        it("should stop monitoring when stopTokenMonitor is called", async () => {
+            const tokens = makeTokens();
+            mockLoadTokens.mockResolvedValue(tokens);
+            startTokenMonitor();
+            stopTokenMonitor();
+            await vi.advanceTimersByTimeAsync(120_000);
+            // loadTokens should not have been called since the monitor was stopped before any tick
+            expect(mockLoadTokens).not.toHaveBeenCalled();
+        });
+        it("should be idempotent when called multiple times", () => {
+            startTokenMonitor();
+            startTokenMonitor(); // Should not create a second interval
+            stopTokenMonitor();
+        });
+    });
+});
+//# sourceMappingURL=token-refresh.test.js.map

package/dist/auth/__tests__/token-refresh.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-refresh.test.js","sourceRoot":"","sources":["../../../src/auth/__tests__/token-refresh.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAIzE,qBAAqB;AACrB,EAAE,CAAC,IAAI,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;IACpC,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE;IACnB,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE;IACnB,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE;CACrB,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC;IACnC,sBAAsB,EAAE,EAAE,CAAC,EAAE,EAAE;CAChC,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,CAAC;IACtC,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;CACzE,CAAC,CAAC,CAAC;AAEJ,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,mBAAmB,EACnB,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,cAAc,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AAC7C,MAAM,cAAc,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AAC7C,MAAM,eAAe,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC/C,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAE9B,SAAS,UAAU,CAAC,YAAiC,EAAE;IACrD,OAAO;QACL,WAAW,EAAE,aAAa;QAC1B,YAAY,EAAE,QAAQ;QACtB,aAAa,EAAE,QAAQ;QACvB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,EAAE,kBAAkB;QACpE,OAAO,EAAE,UAAU;QACnB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,YAAY,CAAC,aAAa,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,gBAAgB,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;YACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;YACrD,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;YACxD,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,2FAA2F;YAC3F,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;YAC1D,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAEjD,8EAA8E;YAC9E,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;YACvD,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;QACpC,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;YAC9C,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,cAAc,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAEzC,MAAM,MAAM,GAAG,MAAM,oBAAoB,EAAE,CAAC;YAE5C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC3B,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;YAC7C,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;YACjD,MAAM,MAAM,GAAG,UAAU,CAAC;gBACxB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG;aAChD,CAAC,CAAC;YACH,cAAc,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAEzC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;YACvD,aAAa,CAAC,iBAAiB,CAAC;gBAC9B,YAAY,EAAE,QAAQ;gBACtB,aAAa,EAAE,QAAQ;gBACvB,UAAU,EAAE,SAAS;aACtB,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,oBAAoB,EAAE,CAAC;YAE5C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,MAAM,CAAC,aAAa,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YACrD,MAAM,CAAC,cAAc,CAAC,CAAC,oBAAoB,CAAC;gBAC1C,WAAW,EAAE,aAAa;gBAC1B,YAAY,EAAE,QAAQ;gBACtB,aAAa,EAAE,QAAQ;gBACvB,UAAU,EAAE,SAAS;gBACrB,OAAO,EAAE,UAAU;aACpB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,MAAM,GAAG,UAAU,CAAC;gBACxB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,EAAE,oCAAoC;aACtF,CAAC,CAAC;YACH,cAAc,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAEzC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;YACvD,aAAa,CAAC,iBAAiB,CAAC;gBAC9B,YAAY,EAAE,cAAc;gBAC5B,aAAa,EAAE,cAAc;gBAC7B,UAAU,EAAE,SAAS;aACtB,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,oBAAoB,EAAE,CAAC;YAE5C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,MAAM,CAAC,aAAa,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;YAClD,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAEvC,MAAM,MAAM,CAAC,oBAAoB,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,MAAM,GAAG,UAAU,CAAC;gBACxB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG;aAChD,CAAC,CAAC;YACH,cAAc,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACzC,aAAa,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAE7D,MAAM,MAAM,CAAC,oBAAoB,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAClD,0CAA0C,CAC3C,CAAC;YACF,MAAM,CAAC,eAAe,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;QACnC,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;YAC5D,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC;YAC1D,cAAc,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAEzC,MAAM,MAAM,GAAG,MAAM,mBAAmB,EAAE,CAAC;YAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAClC,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;YAChE,MAAM,aAAa,GAAG,UAAU,CAAC;gBAC/B,YAAY,EAAE,QAAQ;gBACtB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG;aAChD,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;YACvD,MAAM,eAAe,GAAG,UAAU,CAAC;gBACjC,YAAY,EAAE,cAAc;gBAC5B,aAAa,EAAE,cAAc;gBAC7B,UAAU,EAAE,SAAS;aACtB,CAAC,CAAC;YAEH,iEAAiE;YACjE,iFAAiF;YACjF,cAAc,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;YAE3F,aAAa,CAAC,iBAAiB,CAAC;gBAC9B,YAAY,EAAE,cAAc;gBAC5B,aAAa,EAAE,cAAc;gBAC7B,UAAU,EAAE,SAAS;aACtB,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,mBAAmB,EAAE,CAAC;YAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;YACrD,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAEvC,MAAM,MAAM,CAAC,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;QAC9E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;QACpD,UAAU,CAAC,GAAG,EAAE;YACd,EAAE,CAAC,aAAa,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;QAEH,SAAS,CAAC,GAAG,EAAE;YACb,gBAAgB,EAAE,CAAC;YACnB,EAAE,CAAC,aAAa,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,cAAc,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAEzC,iBAAiB,EAAE,CAAC;YAEpB,4CAA4C;YAC5C,MAAM,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;YAE1C,MAAM,CAAC,cAAc,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;YAC5D,MAAM,MAAM,GAAG,UAAU,CAAC;gBACxB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG;aAChD,CAAC,CAAC;YACH,cAAc,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAEzC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;YACvD,aAAa,CAAC,iBAAiB,CAAC;gBAC9B,YAAY,EAAE,YAAY;gBAC1B,aAAa,EAAE,YAAY;gBAC3B,UAAU,EAAE,SAAS;aACtB,CAAC,CAAC;YAEH,iBAAiB,EAAE,CAAC;YAEpB,MAAM,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;YAE1C,MAAM,CAAC,aAAa,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YACrD,MAAM,CAAC,cAAc,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;YAClD,cAAc,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;YAE1D,iBAAiB,EAAE,CAAC;YAEpB,kDAAkD;YAClD,MAAM,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;YACtE,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,cAAc,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAEzC,iBAAiB,EAAE,CAAC;YACpB,gBAAgB,EAAE,CAAC;YAEnB,MAAM,EAAE,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;YAE3C,uFAAuF;YACvF,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;YACzD,iBAAiB,EAAE,CAAC;YACpB,iBAAiB,EAAE,CAAC,CAAC,sCAAsC;YAC3D,gBAAgB,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/auth/__tests__/token-storage.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=token-storage.test.d.ts.map

package/dist/auth/__tests__/token-storage.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-storage.test.d.ts","sourceRoot":"","sources":["../../../src/auth/__tests__/token-storage.test.ts"],"names":[],"mappings":""}

package/dist/auth/__tests__/token-storage.test.js

@@ -0,0 +1,145 @@
+import { describe, expect, it, vi, beforeEach, afterEach } from "vitest";
+import { mkdtemp, rm, readFile, stat } from "node:fs/promises";
+import { tmpdir, platform } from "node:os";
+import { join } from "node:path";
+const VALID_TOKENS = {
+    machine_key: "550e8400-e29b-41d4-a716-446655440000",
+    access_token: "eyJ.test.token",
+    refresh_token: "refresh_abc123",
+    expires_at: 1707666000,
+    user_id: "github|12345",
+};
+describe("token-storage", () => {
+    let tempDir;
+    let authPath;
+    beforeEach(async () => {
+        tempDir = await mkdtemp(join(tmpdir(), "pocketcoder-auth-test-"));
+        authPath = join(tempDir, "auth.json");
+    });
+    afterEach(async () => {
+        vi.restoreAllMocks();
+        await rm(tempDir, { recursive: true, force: true });
+    });
+    async function importModule() {
+        vi.resetModules();
+        vi.doMock("../../utils/paths.js", () => ({
+            getAuthPath: () => authPath,
+        }));
+        return await import("../token-storage.js");
+    }
+    describe("saveTokens", () => {
+        it("should save tokens with secure permissions", async () => {
+            const { saveTokens } = await importModule();
+            await saveTokens(VALID_TOKENS);
+            const content = await readFile(authPath, "utf-8");
+            const parsed = JSON.parse(content);
+            expect(parsed).toEqual(VALID_TOKENS);
+            if (platform() !== "win32") {
+                const fileStat = await stat(authPath);
+                // 0o600 = owner read+write only
+                const mode = fileStat.mode & 0o777;
+                expect(mode).toBe(0o600);
+            }
+        });
+        it("should write valid JSON with all fields", async () => {
+            const { saveTokens } = await importModule();
+            await saveTokens(VALID_TOKENS);
+            const content = await readFile(authPath, "utf-8");
+            const parsed = JSON.parse(content);
+            expect(parsed.machine_key).toBe(VALID_TOKENS.machine_key);
+            expect(parsed.access_token).toBe(VALID_TOKENS.access_token);
+            expect(parsed.refresh_token).toBe(VALID_TOKENS.refresh_token);
+            expect(parsed.expires_at).toBe(VALID_TOKENS.expires_at);
+            expect(parsed.user_id).toBe(VALID_TOKENS.user_id);
+        });
+        it("should overwrite existing tokens", async () => {
+            const { saveTokens, loadTokens } = await importModule();
+            await saveTokens(VALID_TOKENS);
+            const updated = {
+                ...VALID_TOKENS,
+                access_token: "new_token",
+                expires_at: 9999999999,
+            };
+            await saveTokens(updated);
+            const loaded = await loadTokens();
+            expect(loaded).toEqual(updated);
+        });
+    });
+    describe("loadTokens", () => {
+        it("should load tokens from file", async () => {
+            const { saveTokens, loadTokens } = await importModule();
+            await saveTokens(VALID_TOKENS);
+            const loaded = await loadTokens();
+            expect(loaded).toEqual(VALID_TOKENS);
+        });
+        it("should return null when file does not exist", async () => {
+            const { loadTokens } = await importModule();
+            const loaded = await loadTokens();
+            expect(loaded).toBeNull();
+        });
+        it("should return null for invalid JSON", async () => {
+            const { loadTokens } = await importModule();
+            const { writeFile } = await import("node:fs/promises");
+            await writeFile(authPath, "not valid json");
+            const loaded = await loadTokens();
+            expect(loaded).toBeNull();
+        });
+        it("should validate token structure on load", async () => {
+            const { loadTokens } = await importModule();
+            const { writeFile } = await import("node:fs/promises");
+            // Missing required fields
+            await writeFile(authPath, JSON.stringify({ machine_key: "test" }));
+            expect(await loadTokens()).toBeNull();
+            // Wrong types
+            await writeFile(authPath, JSON.stringify({
+                machine_key: "test",
+                access_token: "test",
+                refresh_token: "test",
+                expires_at: "not-a-number",
+                user_id: "test",
+            }));
+            expect(await loadTokens()).toBeNull();
+            // Valid structure
+            await writeFile(authPath, JSON.stringify(VALID_TOKENS));
+            expect(await loadTokens()).toEqual(VALID_TOKENS);
+        });
+    });
+    describe("hasValidTokens", () => {
+        it("should return true when tokens exist and are not expired", async () => {
+            const { saveTokens, hasValidTokens } = await importModule();
+            const futureTokens = {
+                ...VALID_TOKENS,
+                expires_at: Math.floor(Date.now() / 1000) + 3600,
+            };
+            await saveTokens(futureTokens);
+            expect(await hasValidTokens()).toBe(true);
+        });
+        it("should return false when tokens are expired", async () => {
+            const { saveTokens, hasValidTokens } = await importModule();
+            const expiredTokens = {
+                ...VALID_TOKENS,
+                expires_at: Math.floor(Date.now() / 1000) - 100,
+            };
+            await saveTokens(expiredTokens);
+            expect(await hasValidTokens()).toBe(false);
+        });
+        it("should return false when no tokens exist", async () => {
+            const { hasValidTokens } = await importModule();
+            expect(await hasValidTokens()).toBe(false);
+        });
+    });
+    describe("clearTokens", () => {
+        it("should clear tokens by removing file", async () => {
+            const { saveTokens, clearTokens, loadTokens } = await importModule();
+            await saveTokens(VALID_TOKENS);
+            await clearTokens();
+            const loaded = await loadTokens();
+            expect(loaded).toBeNull();
+        });
+        it("should not throw when file does not exist", async () => {
+            const { clearTokens } = await importModule();
+            await expect(clearTokens()).resolves.toBeUndefined();
+        });
+    });
+});
+//# sourceMappingURL=token-storage.test.js.map

package/dist/auth/__tests__/token-storage.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-storage.test.js","sourceRoot":"","sources":["../../../src/auth/__tests__/token-storage.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAIjC,MAAM,YAAY,GAAe;IAC/B,WAAW,EAAE,sCAAsC;IACnD,YAAY,EAAE,gBAAgB;IAC9B,aAAa,EAAE,gBAAgB;IAC/B,UAAU,EAAE,UAAU;IACtB,OAAO,EAAE,cAAc;CACxB,CAAC;AAEF,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,IAAI,OAAe,CAAC;IACpB,IAAI,QAAgB,CAAC;IAErB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC,CAAC;QAClE,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,EAAE,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,YAAY;QACzB,EAAE,CAAC,YAAY,EAAE,CAAC;QAClB,EAAE,CAAC,MAAM,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC;YACvC,WAAW,EAAE,GAAG,EAAE,CAAC,QAAQ;SAC5B,CAAC,CAAC,CAAC;QACJ,OAAO,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAC7C,CAAC;IAED,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;QAC1B,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;YAC1D,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;YAC5C,MAAM,UAAU,CAAC,YAAY,CAAC,CAAC;YAE/B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAErC,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;gBAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACtC,gCAAgC;gBAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC;gBACnC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;YACvD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;YAC5C,MAAM,UAAU,CAAC,YAAY,CAAC,CAAC;YAE/B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;YAC1D,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;YAC5D,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;YAC9D,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;YACxD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;YAChD,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;YACxD,MAAM,UAAU,CAAC,YAAY,CAAC,CAAC;YAE/B,MAAM,OAAO,GAAe;gBAC1B,GAAG,YAAY;gBACf,YAAY,EAAE,WAAW;gBACzB,UAAU,EAAE,UAAU;aACvB,CAAC;YACF,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;YAE1B,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;YAClC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;QAC1B,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;YACxD,MAAM,UAAU,CAAC,YAAY,CAAC,CAAC;YAE/B,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;YAClC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;YAC3D,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;YAE5C,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;YAClC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;YACnD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;YAC5C,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YACvD,MAAM,SAAS,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;YAE5C,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;YAClC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;YACvD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;YAC5C,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAEvD,0BAA0B;YAC1B,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YACnE,MAAM,CAAC,MAAM,UAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YAEtC,cAAc;YACd,MAAM,SAAS,CACb,QAAQ,EACR,IAAI,CAAC,SAAS,CAAC;gBACb,WAAW,EAAE,MAAM;gBACnB,YAAY,EAAE,MAAM;gBACpB,aAAa,EAAE,MAAM;gBACrB,UAAU,EAAE,cAAc;gBAC1B,OAAO,EAAE,MAAM;aAChB,CAAC,CACH,CAAC;YACF,MAAM,CAAC,MAAM,UAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YAEtC,kBAAkB;YAClB,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC;YACxD,MAAM,CAAC,MAAM,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;YACxE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;YAC5D,MAAM,YAAY,GAAe;gBAC/B,GAAG,YAAY;gBACf,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI;aACjD,CAAC;YACF,MAAM,UAAU,CAAC,YAAY,CAAC,CAAC;YAE/B,MAAM,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;YAC3D,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;YAC5D,MAAM,aAAa,GAAe;gBAChC,GAAG,YAAY;gBACf,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG;aAChD,CAAC;YACF,MAAM,UAAU,CAAC,aAAa,CAAC,CAAC;YAEhC,MAAM,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;YACxD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;YAChD,MAAM,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;QAC3B,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;YACpD,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;YACrE,MAAM,UAAU,CAAC,YAAY,CAAC,CAAC;YAE/B,MAAM,WAAW,EAAE,CAAC;YAEpB,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;YAClC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;YAC7C,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QACvD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/auth/gateway-auth.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Auth exchange via Gateway.
+ *
+ * The daemon sends OAuth codes and refresh tokens to the Gateway (never directly
+ * to Supabase). The Gateway handles the Supabase interaction and returns tokens.
+ *
+ * See PRD.md: "auth_exchange Message" and "token_refresh Message" sections.
+ */
+export interface ExchangeResult {
+    access_token: string;
+    refresh_token: string;
+    expires_at: number;
+    user: {
+        id: string;
+        email: string;
+        github_username: string;
+    };
+}
+export interface RefreshResult {
+    access_token: string;
+    refresh_token: string;
+    expires_at: number;
+}
+/**
+ * Exchange an OAuth authorization code for session tokens via the Gateway.
+ *
+ * Opens a temporary WebSocket to the Gateway, sends an auth_exchange request,
+ * and waits for the response with tokens.
+ */
+export declare function exchangeCodeViaGateway(code: string): Promise<ExchangeResult>;
+/**
+ * Refresh tokens via the Gateway.
+ *
+ * Opens a temporary WebSocket to the Gateway, sends a token_refresh request,
+ * and waits for the response with new tokens.
+ */
+export declare function refreshTokenViaGateway(refreshToken: string): Promise<RefreshResult>;
+//# sourceMappingURL=gateway-auth.d.ts.map

package/dist/auth/gateway-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-auth.d.ts","sourceRoot":"","sources":["../../src/auth/gateway-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAiBH,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CA+BlF;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CA8BzF"}

package/dist/auth/gateway-auth.js

@@ -0,0 +1,117 @@
+/**
+ * Auth exchange via Gateway.
+ *
+ * The daemon sends OAuth codes and refresh tokens to the Gateway (never directly
+ * to Supabase). The Gateway handles the Supabase interaction and returns tokens.
+ *
+ * See PRD.md: "auth_exchange Message" and "token_refresh Message" sections.
+ */
+import WebSocket from "ws";
+import { randomUUID } from "node:crypto";
+import { getEnv } from "../env.js";
+/** Default timeout for auth operations (30 seconds). */
+const AUTH_TIMEOUT_MS = 30_000;
+/**
+ * Exchange an OAuth authorization code for session tokens via the Gateway.
+ *
+ * Opens a temporary WebSocket to the Gateway, sends an auth_exchange request,
+ * and waits for the response with tokens.
+ */
+export async function exchangeCodeViaGateway(code) {
+    const { gatewayUrl } = getEnv();
+    const requestId = `auth_${randomUUID()}`;
+    const request = {
+        type: "auth_exchange",
+        requestId,
+        payload: { code },
+    };
+    const response = await sendAndWait(gatewayUrl, request, requestId, "auth_exchange_response");
+    if (response.error) {
+        throw new Error(`Auth exchange failed: ${response.error.message}`);
+    }
+    if (!response.payload) {
+        throw new Error("Auth exchange returned empty payload");
+    }
+    return {
+        access_token: response.payload.access_token,
+        refresh_token: response.payload.refresh_token,
+        expires_at: response.payload.expires_at,
+        user: response.payload.user,
+    };
+}
+/**
+ * Refresh tokens via the Gateway.
+ *
+ * Opens a temporary WebSocket to the Gateway, sends a token_refresh request,
+ * and waits for the response with new tokens.
+ */
+export async function refreshTokenViaGateway(refreshToken) {
+    const { gatewayUrl } = getEnv();
+    const requestId = `refresh_${randomUUID()}`;
+    const request = {
+        type: "token_refresh",
+        requestId,
+        payload: { refresh_token: refreshToken },
+    };
+    const response = await sendAndWait(gatewayUrl, request, requestId, "token_refresh_response");
+    if (response.error) {
+        throw new Error(`Token refresh failed: ${response.error.message}`);
+    }
+    if (!response.payload) {
+        throw new Error("Token refresh returned empty payload");
+    }
+    return {
+        access_token: response.payload.access_token,
+        refresh_token: response.payload.refresh_token,
+        expires_at: response.payload.expires_at,
+    };
+}
+/**
+ * Open a temporary WebSocket, send a message, and wait for a response
+ * matching the given requestId and type. Closes the connection afterward.
+ */
+function sendAndWait(url, message, requestId, expectedType) {
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const ws = new WebSocket(url);
+        const timer = setTimeout(() => {
+            if (!settled) {
+                settled = true;
+                ws.close();
+                reject(new Error(`Auth request timed out after ${AUTH_TIMEOUT_MS}ms`));
+            }
+        }, AUTH_TIMEOUT_MS);
+        ws.on("open", () => {
+            ws.send(JSON.stringify(message));
+        });
+        ws.on("message", (data) => {
+            try {
+                const parsed = JSON.parse(data.toString());
+                if (parsed.type === expectedType && parsed.requestId === requestId) {
+                    settled = true;
+                    clearTimeout(timer);
+                    ws.close();
+                    resolve(parsed);
+                }
+            }
+            catch {
+                // Ignore unparseable messages
+            }
+        });
+        ws.on("error", (err) => {
+            if (!settled) {
+                settled = true;
+                clearTimeout(timer);
+                reject(new Error(`WebSocket error during auth: ${err.message}`));
+            }
+        });
+        ws.on("close", (code) => {
+            if (!settled) {
+                settled = true;
+                clearTimeout(timer);
+                reject(new Error(`WebSocket closed unexpectedly (code: ${code})`));
+            }
+        });
+    });
+}
+//# sourceMappingURL=gateway-auth.js.map

package/dist/auth/gateway-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-auth.js","sourceRoot":"","sources":["../../src/auth/gateway-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,SAAS,MAAM,IAAI,CAAC;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AASzC,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAEnC,wDAAwD;AACxD,MAAM,eAAe,GAAG,MAAM,CAAC;AAe/B;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAAY;IACvD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE,CAAC;IAChC,MAAM,SAAS,GAAG,QAAQ,UAAU,EAAE,EAAE,CAAC;IAEzC,MAAM,OAAO,GAAwB;QACnC,IAAI,EAAE,eAAe;QACrB,SAAS;QACT,OAAO,EAAE,EAAE,IAAI,EAAE;KAClB,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,WAAW,CAChC,UAAU,EACV,OAAO,EACP,SAAS,EACT,wBAAwB,CACzB,CAAC;IAEF,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO;QACL,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,YAAY;QAC3C,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,aAAa;QAC7C,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;QACvC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI;KAC5B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,YAAoB;IAC/D,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE,CAAC;IAChC,MAAM,SAAS,GAAG,WAAW,UAAU,EAAE,EAAE,CAAC;IAE5C,MAAM,OAAO,GAAwB;QACnC,IAAI,EAAE,eAAe;QACrB,SAAS;QACT,OAAO,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE;KACzC,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,WAAW,CAChC,UAAU,EACV,OAAO,EACP,SAAS,EACT,wBAAwB,CACzB,CAAC;IAEF,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO;QACL,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,YAAY;QAC3C,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,aAAa;QAC7C,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;KACxC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAClB,GAAW,EACX,OAAgB,EAChB,SAAiB,EACjB,YAAoB;IAEpB,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,EAAE,GAAG,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC;QAE9B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,IAAI,CAAC;gBACf,EAAE,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,eAAe,IAAI,CAAC,CAAC,CAAC;YACzE,CAAC;QACH,CAAC,EAAE,eAAe,CAAC,CAAC;QAEpB,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACjB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAoB,EAAE,EAAE;YACxC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAA4B,CAAC;gBAEtE,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;oBACnE,OAAO,GAAG,IAAI,CAAC;oBACf,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,EAAE,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO,CAAC,MAAW,CAAC,CAAC;gBACvB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,8BAA8B;YAChC,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;YAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACnE,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAY,EAAE,EAAE;YAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,CAAC,IAAI,KAAK,CAAC,wCAAwC,IAAI,GAAG,CAAC,CAAC,CAAC;YACrE,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/login.d.ts

@@ -0,0 +1,43 @@
+export interface LoginResult {
+    user_id: string;
+    email: string | undefined;
+    machine_key: string;
+}
+/** Result from exchanging an OAuth code via Gateway. */
+export interface CodeExchangeResult {
+    access_token: string;
+    refresh_token: string;
+    expires_at: number;
+    user: {
+        id: string;
+        email: string | undefined;
+    };
+}
+/** Set the code exchange implementation (called during daemon startup). */
+export declare function setExchangeCodeFn(fn: (code: string) => Promise<CodeExchangeResult>): void;
+/** Set the OAuth URL provider implementation (called during daemon startup). */
+export declare function setGetOAuthUrlFn(fn: (redirectTo: string) => Promise<string>): void;
+/**
+ * Override the browser opener function (for testing).
+ */
+export declare function setOpenBrowser(fn: (url: string) => void): void;
+/**
+ * Reset the browser opener to the default (for testing).
+ */
+export declare function resetOpenBrowser(): void;
+/** Override the manual code entry function (for testing). */
+export declare function setManualCodeEntryFn(fn: (authUrl: string) => Promise<string>): void;
+/** Reset the manual code entry function to the default (for testing). */
+export declare function resetManualCodeEntryFn(): void;
+/**
+ * Orchestrate the complete login flow:
+ * 1. Try to start temporary OAuth callback server
+ * 2. If server starts: open browser and wait for callback
+ * 3. If server fails: fall back to manual code entry
+ * 4. Exchange code for tokens via Gateway (if code flow) or use tokens directly (if implicit flow)
+ * 5. Preserve or generate machineKey (UUID v4)
+ * 6. Save complete auth data to auth.json
+ * 7. Return success with user info
+ */
+export declare function login(): Promise<LoginResult>;
+//# sourceMappingURL=login.d.ts.map

package/dist/auth/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/auth/login.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wDAAwD;AACxD,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;CACjD;AA6BD,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAEzF;AAED,gFAAgF;AAChF,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,CAElF;AA4BD;;GAEG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAE9D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AAKD,6DAA6D;AAC7D,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,CAEnF;AAED,yEAAyE;AACzE,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAED;;;;;;;;;GASG;AACH,wBAAsB,KAAK,IAAI,OAAO,CAAC,WAAW,CAAC,CA2DlD"}