@pocketcoder/host 0.0.2

package/dist/auth/login.js

@@ -0,0 +1,180 @@
+import { randomUUID } from "node:crypto";
+import { exec } from "node:child_process";
+import { platform } from "node:os";
+import { startOAuthServer } from "./oauth-server.js";
+import { manualCodeEntry } from "./manual-flow.js";
+import { loadTokens, saveTokens } from "./token-storage.js";
+import { exchangeCodeViaGateway } from "./gateway-auth.js";
+import { logger } from "../utils/logger.js";
+/**
+ * Decode a JWT token to extract the payload (without verification).
+ * Used for implicit flow to extract user info from access_token.
+ */
+function decodeJwtPayload(token) {
+    const parts = token.split(".");
+    if (parts.length !== 3) {
+        throw new Error("Invalid JWT format");
+    }
+    const payload = Buffer.from(parts[1], "base64url").toString("utf-8");
+    return JSON.parse(payload);
+}
+/**
+ * Injectable code exchange function. Defaults to exchangeCodeViaGateway().
+ */
+let _exchangeCodeFn = exchangeCodeViaGateway;
+/**
+ * Injectable OAuth URL provider function.
+ * The OAuth URL is the Supabase project's auth endpoint. Since the daemon
+ * doesn't have Supabase keys, this URL must be configured or provided.
+ */
+let _getOAuthUrlFn = () => {
+    throw new Error("OAuth URL provider not configured. Call setGetOAuthUrlFn() first.");
+};
+/** Set the code exchange implementation (called during daemon startup). */
+export function setExchangeCodeFn(fn) {
+    _exchangeCodeFn = fn;
+}
+/** Set the OAuth URL provider implementation (called during daemon startup). */
+export function setGetOAuthUrlFn(fn) {
+    _getOAuthUrlFn = fn;
+}
+/**
+ * Open a URL in the user's default browser.
+ * Falls back to logging the URL if opening fails.
+ */
+function openBrowser(url) {
+    const os = platform();
+    let command;
+    if (os === "darwin") {
+        command = `open "${url}"`;
+    }
+    else if (os === "win32") {
+        command = `start "" "${url}"`;
+    }
+    else {
+        command = `xdg-open "${url}"`;
+    }
+    exec(command, (err) => {
+        if (err) {
+            // Browser open failed - user will need to manually navigate
+            // The URL is already logged by the login function
+        }
+    });
+}
+// Injectable browser opener for testing
+let _openBrowser = openBrowser;
+/**
+ * Override the browser opener function (for testing).
+ */
+export function setOpenBrowser(fn) {
+    _openBrowser = fn;
+}
+/**
+ * Reset the browser opener to the default (for testing).
+ */
+export function resetOpenBrowser() {
+    _openBrowser = openBrowser;
+}
+// Injectable manual code entry for testing
+let _manualCodeEntryFn = manualCodeEntry;
+/** Override the manual code entry function (for testing). */
+export function setManualCodeEntryFn(fn) {
+    _manualCodeEntryFn = fn;
+}
+/** Reset the manual code entry function to the default (for testing). */
+export function resetManualCodeEntryFn() {
+    _manualCodeEntryFn = manualCodeEntry;
+}
+/**
+ * Orchestrate the complete login flow:
+ * 1. Try to start temporary OAuth callback server
+ * 2. If server starts: open browser and wait for callback
+ * 3. If server fails: fall back to manual code entry
+ * 4. Exchange code for tokens via Gateway (if code flow) or use tokens directly (if implicit flow)
+ * 5. Preserve or generate machineKey (UUID v4)
+ * 6. Save complete auth data to auth.json
+ * 7. Return success with user info
+ */
+export async function login() {
+    // Load existing tokens to preserve machine_key if present
+    const existingTokens = await loadTokens();
+    const machineKey = existingTokens?.machine_key ?? randomUUID();
+    let callbackResult;
+    try {
+        // Try starting the automatic OAuth callback server
+        callbackResult = await loginWithCallbackServer();
+    }
+    catch (serverErr) {
+        // If the server fails to bind, fall back to manual mode
+        const errMsg = serverErr instanceof Error ? serverErr.message : String(serverErr);
+        logger.warn(`OAuth callback server failed (${errMsg}), falling back to manual mode`);
+        const code = await loginWithManualEntry();
+        callbackResult = { code };
+    }
+    let session;
+    if (callbackResult.access_token && callbackResult.refresh_token) {
+        // Implicit flow - we already have tokens, decode JWT to get user info
+        logger.info("Using implicit flow tokens");
+        const payload = decodeJwtPayload(callbackResult.access_token);
+        session = {
+            access_token: callbackResult.access_token,
+            refresh_token: callbackResult.refresh_token,
+            expires_at: typeof payload.exp === "number" ? payload.exp : Math.floor(Date.now() / 1000) + 3600,
+            user: {
+                id: payload.sub,
+                email: payload.email,
+            },
+        };
+    }
+    else if (callbackResult.code) {
+        // Code flow - exchange code for tokens via Gateway
+        logger.info("Using code flow, exchanging via gateway");
+        session = await _exchangeCodeFn(callbackResult.code);
+    }
+    else {
+        throw new Error("OAuth callback returned neither code nor tokens");
+    }
+    // Build the complete auth tokens
+    const tokens = {
+        machine_key: machineKey,
+        access_token: session.access_token,
+        refresh_token: session.refresh_token,
+        expires_at: session.expires_at,
+        user_id: session.user.id,
+    };
+    // Save to auth.json
+    await saveTokens(tokens);
+    return {
+        user_id: session.user.id,
+        email: session.user.email,
+        machine_key: machineKey,
+    };
+}
+/**
+ * Automatic login flow using a local callback server.
+ * Starts an HTTP server, opens the browser, and waits for the OAuth callback.
+ * Returns either a code (for code flow) or tokens directly (for implicit flow).
+ */
+async function loginWithCallbackServer() {
+    const oauthServer = await startOAuthServer();
+    try {
+        const oauthUrl = await _getOAuthUrlFn(oauthServer.callbackUrl);
+        _openBrowser(oauthUrl);
+        return await oauthServer.waitForCallback();
+    }
+    catch (err) {
+        oauthServer.close();
+        throw err;
+    }
+}
+/**
+ * Manual login flow as a fallback.
+ * Gets the OAuth URL with a placeholder redirect, then prompts the user
+ * to visit it manually and paste the authorization code.
+ */
+async function loginWithManualEntry() {
+    // Use a placeholder redirect since there's no callback server
+    const oauthUrl = await _getOAuthUrlFn("urn:ietf:wg:oauth:2.0:oob");
+    return _manualCodeEntryFn(oauthUrl);
+}
+//# sourceMappingURL=login.js.map

package/dist/auth/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/auth/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,EAAE,gBAAgB,EAA4B,MAAM,mBAAmB,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAkB5C;;;GAGG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,IAAI,eAAe,GAAkD,sBAAsB,CAAC;AAE5F;;;;GAIG;AACH,IAAI,cAAc,GAA4C,GAAG,EAAE;IACjE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;AACvF,CAAC,CAAC;AAEF,2EAA2E;AAC3E,MAAM,UAAU,iBAAiB,CAAC,EAAiD;IACjF,eAAe,GAAG,EAAE,CAAC;AACvB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,gBAAgB,CAAC,EAA2C;IAC1E,cAAc,GAAG,EAAE,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC;IACtB,IAAI,OAAe,CAAC;IACpB,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpB,OAAO,GAAG,SAAS,GAAG,GAAG,CAAC;IAC5B,CAAC;SAAM,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;QAC1B,OAAO,GAAG,aAAa,GAAG,GAAG,CAAC;IAChC,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,aAAa,GAAG,GAAG,CAAC;IAChC,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QACpB,IAAI,GAAG,EAAE,CAAC;YACR,4DAA4D;YAC5D,kDAAkD;QACpD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,wCAAwC;AACxC,IAAI,YAAY,GAA0B,WAAW,CAAC;AAEtD;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,EAAyB;IACtD,YAAY,GAAG,EAAE,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,YAAY,GAAG,WAAW,CAAC;AAC7B,CAAC;AAED,2CAA2C;AAC3C,IAAI,kBAAkB,GAAyC,eAAe,CAAC;AAE/E,6DAA6D;AAC7D,MAAM,UAAU,oBAAoB,CAAC,EAAwC;IAC3E,kBAAkB,GAAG,EAAE,CAAC;AAC1B,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,sBAAsB;IACpC,kBAAkB,GAAG,eAAe,CAAC;AACvC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK;IACzB,0DAA0D;IAC1D,MAAM,cAAc,GAAG,MAAM,UAAU,EAAE,CAAC;IAC1C,MAAM,UAAU,GAAG,cAAc,EAAE,WAAW,IAAI,UAAU,EAAE,CAAC;IAE/D,IAAI,cAAmC,CAAC;IAExC,IAAI,CAAC;QACH,mDAAmD;QACnD,cAAc,GAAG,MAAM,uBAAuB,EAAE,CAAC;IACnD,CAAC;IAAC,OAAO,SAAS,EAAE,CAAC;QACnB,wDAAwD;QACxD,MAAM,MAAM,GAAG,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAClF,MAAM,CAAC,IAAI,CAAC,iCAAiC,MAAM,gCAAgC,CAAC,CAAC;QACrF,MAAM,IAAI,GAAG,MAAM,oBAAoB,EAAE,CAAC;QAC1C,cAAc,GAAG,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;IAED,IAAI,OAA2B,CAAC;IAEhC,IAAI,cAAc,CAAC,YAAY,IAAI,cAAc,CAAC,aAAa,EAAE,CAAC;QAChE,sEAAsE;QACtE,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,gBAAgB,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QAC9D,OAAO,GAAG;YACR,YAAY,EAAE,cAAc,CAAC,YAAY;YACzC,aAAa,EAAE,cAAc,CAAC,aAAa;YAC3C,UAAU,EACR,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI;YACtF,IAAI,EAAE;gBACJ,EAAE,EAAE,OAAO,CAAC,GAAa;gBACzB,KAAK,EAAE,OAAO,CAAC,KAA2B;aAC3C;SACF,CAAC;IACJ,CAAC;SAAM,IAAI,cAAc,CAAC,IAAI,EAAE,CAAC;QAC/B,mDAAmD;QACnD,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;QACvD,OAAO,GAAG,MAAM,eAAe,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,iCAAiC;IACjC,MAAM,MAAM,GAAe;QACzB,WAAW,EAAE,UAAU;QACvB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;KACzB,CAAC;IAEF,oBAAoB;IACpB,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;IAEzB,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;QACxB,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;QACzB,WAAW,EAAE,UAAU;KACxB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,uBAAuB;IACpC,MAAM,WAAW,GAAG,MAAM,gBAAgB,EAAE,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAC/D,YAAY,CAAC,QAAQ,CAAC,CAAC;QACvB,OAAO,MAAM,WAAW,CAAC,eAAe,EAAE,CAAC;IAC7C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,KAAK,EAAE,CAAC;QACpB,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,oBAAoB;IACjC,8DAA8D;IAC9D,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,2BAA2B,CAAC,CAAC;IACnE,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC;AACtC,CAAC"}

package/dist/auth/manual-flow.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Prompt the user to manually paste an OAuth authorization code.
+ *
+ * Used as a fallback when the automatic OAuth callback server cannot bind
+ * (e.g., port blocked by firewall, running in SSH session, etc.).
+ *
+ * Displays the auth URL for the user to visit manually, then reads the
+ * authorization code from stdin.
+ */
+export declare function manualCodeEntry(authUrl: string): Promise<string>;
+/**
+ * Read a line from stdin with a prompt.
+ * Returns the trimmed input.
+ */
+export declare function promptForCode(): Promise<string>;
+//# sourceMappingURL=manual-flow.d.ts.map

package/dist/auth/manual-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manual-flow.d.ts","sourceRoot":"","sources":["../../src/auth/manual-flow.ts"],"names":[],"mappings":"AAIA;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAetE;AAED;;;GAGG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,CAerD"}

package/dist/auth/manual-flow.js

@@ -0,0 +1,44 @@
+import { createInterface } from "node:readline";
+import { logger } from "../utils/logger.js";
+/**
+ * Prompt the user to manually paste an OAuth authorization code.
+ *
+ * Used as a fallback when the automatic OAuth callback server cannot bind
+ * (e.g., port blocked by firewall, running in SSH session, etc.).
+ *
+ * Displays the auth URL for the user to visit manually, then reads the
+ * authorization code from stdin.
+ */
+export async function manualCodeEntry(authUrl) {
+    logger.info("Automatic callback server failed — falling back to manual mode");
+    console.log("\nCould not start local callback server.");
+    console.log("Please visit the following URL in your browser:\n");
+    console.log(`  ${authUrl}\n`);
+    console.log("After authorizing, copy the code from the page and paste it below.\n");
+    const code = await promptForCode();
+    if (!code) {
+        throw new Error("No authorization code provided");
+    }
+    return code;
+}
+/**
+ * Read a line from stdin with a prompt.
+ * Returns the trimmed input.
+ */
+export async function promptForCode() {
+    const rl = createInterface({
+        input: process.stdin,
+        output: process.stdout,
+    });
+    try {
+        return await new Promise((resolve) => {
+            rl.question("Authorization code: ", (answer) => {
+                resolve(answer.trim());
+            });
+        });
+    }
+    finally {
+        rl.close();
+    }
+}
+//# sourceMappingURL=manual-flow.js.map

package/dist/auth/manual-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manual-flow.js","sourceRoot":"","sources":["../../src/auth/manual-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAe;IACnD,MAAM,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;IAE9E,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC;IAC9B,OAAO,CAAC,GAAG,CAAC,sEAAsE,CAAC,CAAC;IAEpF,MAAM,IAAI,GAAG,MAAM,aAAa,EAAE,CAAC;IAEnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,EAAE,GAAG,eAAe,CAAC;QACzB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;YAC3C,EAAE,CAAC,QAAQ,CAAC,sBAAsB,EAAE,CAAC,MAAM,EAAE,EAAE;gBAC7C,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACzB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC"}

package/dist/auth/oauth-server.d.ts

@@ -0,0 +1,22 @@
+export interface OAuthCallbackResult {
+    code?: string;
+    access_token?: string;
+    refresh_token?: string;
+}
+export interface OAuthServer {
+    /** The port the server is listening on. */
+    port: number;
+    /** The full callback URL to use as the redirect URI. */
+    callbackUrl: string;
+    /** Promise that resolves with the code when the callback is received. */
+    waitForCallback: () => Promise<OAuthCallbackResult>;
+    /** Manually close the server (e.g., on cancellation). */
+    close: () => void;
+}
+/**
+ * Start a temporary HTTP server on a random port to receive the OAuth callback.
+ * The server listens only on 127.0.0.1 and closes automatically after the
+ * callback is received or after a 5-minute timeout.
+ */
+export declare function startOAuthServer(): Promise<OAuthServer>;
+//# sourceMappingURL=oauth-server.d.ts.map

package/dist/auth/oauth-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-server.d.ts","sourceRoot":"","sources":["../../src/auth/oauth-server.ts"],"names":[],"mappings":"AA8DA,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,eAAe,EAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACpD,yDAAyD;IACzD,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,WAAW,CAAC,CAsH7D"}

package/dist/auth/oauth-server.js

@@ -0,0 +1,165 @@
+import { createServer } from "node:http";
+/** Timeout for waiting for the OAuth callback (5 minutes). */
+const OAUTH_TIMEOUT_MS = 5 * 60 * 1000;
+const SUCCESS_HTML = `<!DOCTYPE html>
+<html>
+<head><title>PocketCoder</title></head>
+<body>
+<h1>Authentication successful!</h1>
+<p>You can close this window.</p>
+</body>
+</html>`;
+const ERROR_HTML = `<!DOCTYPE html>
+<html>
+<head><title>PocketCoder</title></head>
+<body>
+<h1>Login Failed</h1>
+<p>You can close this window.</p>
+</body>
+</html>`;
+/**
+ * HTML page that extracts tokens from URL fragment and posts them back.
+ * Supabase implicit flow returns tokens in the fragment (#access_token=...).
+ */
+const FRAGMENT_EXTRACTOR_HTML = `<!DOCTYPE html>
+<html>
+<head><title>PocketCoder - Completing Login...</title></head>
+<body>
+<h1>Completing login...</h1>
+<p>Please wait...</p>
+<script>
+  const hash = window.location.hash.substring(1);
+  const params = new URLSearchParams(hash);
+  const accessToken = params.get('access_token');
+  const refreshToken = params.get('refresh_token');
+  const error = params.get('error');
+
+  if (error) {
+    document.body.innerHTML = '<h1>Login Failed</h1><p>' + error + '</p>';
+  } else if (accessToken && refreshToken) {
+    fetch('/auth/tokens', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ access_token: accessToken, refresh_token: refreshToken })
+    }).then(() => {
+      document.body.innerHTML = '<h1>Authentication successful!</h1><p>You can close this window.</p>';
+    }).catch(err => {
+      document.body.innerHTML = '<h1>Error</h1><p>' + err.message + '</p>';
+    });
+  } else {
+    document.body.innerHTML = '<h1>Error</h1><p>Missing tokens in response</p>';
+  }
+</script>
+</body>
+</html>`;
+/**
+ * Start a temporary HTTP server on a random port to receive the OAuth callback.
+ * The server listens only on 127.0.0.1 and closes automatically after the
+ * callback is received or after a 5-minute timeout.
+ */
+export async function startOAuthServer() {
+    let settled = false;
+    let result = null;
+    let error = null;
+    let onSettle = null;
+    function settle() {
+        settled = true;
+        onSettle?.();
+    }
+    const server = createServer((req, res) => {
+        const reqUrl = new URL(req.url ?? "/", `http://127.0.0.1`);
+        // Handle GET /auth/callback - serve HTML that extracts fragment tokens
+        if (req.method === "GET" && reqUrl.pathname === "/auth/callback") {
+            const errorParam = reqUrl.searchParams.get("error");
+            if (errorParam) {
+                res.writeHead(400, { "Content-Type": "text/html" });
+                res.end(ERROR_HTML);
+                error = new Error(errorParam);
+                settle();
+                return;
+            }
+            // Check for code flow (code in query string)
+            const code = reqUrl.searchParams.get("code");
+            if (code) {
+                res.writeHead(200, { "Content-Type": "text/html" });
+                res.end(SUCCESS_HTML);
+                result = { code };
+                settle();
+                return;
+            }
+            // No code - serve HTML to extract tokens from fragment (implicit flow)
+            res.writeHead(200, { "Content-Type": "text/html" });
+            res.end(FRAGMENT_EXTRACTOR_HTML);
+            return;
+        }
+        // Handle POST /auth/tokens - receive tokens from JavaScript
+        if (req.method === "POST" && reqUrl.pathname === "/auth/tokens") {
+            let body = "";
+            req.on("data", (chunk) => {
+                body += chunk.toString();
+            });
+            req.on("end", () => {
+                try {
+                    const data = JSON.parse(body);
+                    if (data.access_token && data.refresh_token) {
+                        res.writeHead(200, { "Content-Type": "application/json" });
+                        res.end(JSON.stringify({ success: true }));
+                        result = { access_token: data.access_token, refresh_token: data.refresh_token };
+                        settle();
+                    }
+                    else {
+                        res.writeHead(400, { "Content-Type": "application/json" });
+                        res.end(JSON.stringify({ error: "Missing tokens" }));
+                    }
+                }
+                catch {
+                    res.writeHead(400, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ error: "Invalid JSON" }));
+                }
+            });
+            return;
+        }
+        res.writeHead(404, { "Content-Type": "text/plain" });
+        res.end("Not Found");
+    });
+    // Wait for the server to be listening
+    await new Promise((resolve, reject) => {
+        server.on("error", reject);
+        server.listen(0, "127.0.0.1", () => {
+            resolve();
+        });
+    });
+    const address = server.address();
+    const port = address.port;
+    const callbackUrl = `http://127.0.0.1:${port}/auth/callback`;
+    // Set up timeout
+    const timeout = setTimeout(() => {
+        error = new Error("OAuth callback timed out after 5 minutes");
+        settle();
+        server.close();
+    }, OAUTH_TIMEOUT_MS);
+    function close() {
+        clearTimeout(timeout);
+        server.close();
+    }
+    async function waitForCallback() {
+        if (!settled) {
+            await new Promise((resolve) => {
+                onSettle = resolve;
+            });
+        }
+        clearTimeout(timeout);
+        server.close();
+        if (error) {
+            throw error;
+        }
+        return result;
+    }
+    return {
+        port,
+        callbackUrl,
+        waitForCallback,
+        close,
+    };
+}
+//# sourceMappingURL=oauth-server.js.map

package/dist/auth/oauth-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-server.js","sourceRoot":"","sources":["../../src/auth/oauth-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAKzC,8DAA8D;AAC9D,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvC,MAAM,YAAY,GAAG;;;;;;;QAOb,CAAC;AAET,MAAM,UAAU,GAAG;;;;;;;QAOX,CAAC;AAET;;;GAGG;AACH,MAAM,uBAAuB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA8BxB,CAAC;AAmBT;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAAM,GAA+B,IAAI,CAAC;IAC9C,IAAI,KAAK,GAAiB,IAAI,CAAC;IAC/B,IAAI,QAAQ,GAAwB,IAAI,CAAC;IAEzC,SAAS,MAAM;QACb,OAAO,GAAG,IAAI,CAAC;QACf,QAAQ,EAAE,EAAE,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAW,YAAY,CAAC,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;QAChF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAE3D,uEAAuE;QACvE,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;YACjE,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACpD,IAAI,UAAU,EAAE,CAAC;gBACf,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACpB,KAAK,GAAG,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC9B,MAAM,EAAE,CAAC;gBACT,OAAO;YACT,CAAC;YAED,6CAA6C;YAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,IAAI,EAAE,CAAC;gBACT,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBACtB,MAAM,GAAG,EAAE,IAAI,EAAE,CAAC;gBAClB,MAAM,EAAE,CAAC;gBACT,OAAO;YACT,CAAC;YAED,uEAAuE;YACvE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;YACpD,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QAED,4DAA4D;QAC5D,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;YAChE,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBACvB,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC3B,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAsD,CAAC;oBACnF,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;wBAC5C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;wBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;wBAC3C,MAAM,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;wBAChF,MAAM,EAAE,CAAC;oBACX,CAAC;yBAAM,CAAC;wBACN,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;wBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC;oBACvD,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;QACrD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,sCAAsC;IACtC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,MAAM,WAAW,GAAG,oBAAoB,IAAI,gBAAgB,CAAC;IAE7D,iBAAiB;IACjB,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;QAC9B,KAAK,GAAG,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,MAAM,EAAE,CAAC;QACT,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAErB,SAAS,KAAK;QACZ,YAAY,CAAC,OAAO,CAAC,CAAC;QACtB,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;IAED,KAAK,UAAU,eAAe;QAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAClC,QAAQ,GAAG,OAAO,CAAC;YACrB,CAAC,CAAC,CAAC;QACL,CAAC;QAED,YAAY,CAAC,OAAO,CAAC,CAAC;QACtB,MAAM,CAAC,KAAK,EAAE,CAAC;QAEf,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,CAAC;QACd,CAAC;QAED,OAAO,MAAO,CAAC;IACjB,CAAC;IAED,OAAO;QACL,IAAI;QACJ,WAAW;QACX,eAAe;QACf,KAAK;KACN,CAAC;AACJ,CAAC"}

package/dist/auth/token-refresh.d.ts

@@ -0,0 +1,36 @@
+/** Set the token refresh implementation (called during daemon startup). */
+export declare function setRefreshFn(fn: (refreshToken: string) => Promise<{
+    access_token: string;
+    refresh_token: string;
+    expires_at: number;
+}>): void;
+/**
+ * Check whether the stored access token is expired (or will expire within the buffer window).
+ * Uses the expires_at field (epoch seconds) from auth.json.
+ */
+export declare function isTokenExpired(expiresAt: number): boolean;
+/**
+ * Refresh the token if it is expired or about to expire.
+ * Loads tokens from auth.json, checks expiry, refreshes via Gateway if needed,
+ * and saves the updated tokens back to auth.json.
+ *
+ * Returns true if tokens were refreshed, false if they were still valid.
+ * Throws if no tokens are stored.
+ */
+export declare function refreshTokenIfNeeded(): Promise<boolean>;
+/**
+ * Get a valid access token, refreshing if needed.
+ * Returns the current access_token string.
+ * Throws if no tokens are stored or refresh fails.
+ */
+export declare function getValidAccessToken(): Promise<string>;
+/**
+ * Start the periodic token monitor. Checks token expiry every 60 seconds
+ * and refreshes 5 minutes before expiry.
+ */
+export declare function startTokenMonitor(): void;
+/**
+ * Stop the periodic token monitor.
+ */
+export declare function stopTokenMonitor(): void;
+//# sourceMappingURL=token-refresh.d.ts.map

package/dist/auth/token-refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-refresh.d.ts","sourceRoot":"","sources":["../../src/auth/token-refresh.ts"],"names":[],"mappings":"AAoBA,2EAA2E;AAC3E,wBAAgB,YAAY,CAC1B,EAAE,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC,GACD,IAAI,CAEN;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAGzD;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,CA4B7D;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC,CAO3D;AAqBD;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAcxC;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CAMvC"}

package/dist/auth/token-refresh.js

@@ -0,0 +1,116 @@
+import { loadTokens, saveTokens } from "./token-storage.js";
+import { clearTokens } from "./token-storage.js";
+import { refreshTokenViaGateway } from "./gateway-auth.js";
+import { logger } from "../utils/logger.js";
+/** Refresh tokens 5 minutes (300 seconds) before actual expiry. */
+const REFRESH_BUFFER_SECONDS = 300;
+/** Check token expiry every 60 seconds. */
+const MONITOR_INTERVAL_MS = 60_000;
+/**
+ * Injectable refresh function. Defaults to refreshTokenViaGateway().
+ */
+let _refreshFn = refreshTokenViaGateway;
+/** Set the token refresh implementation (called during daemon startup). */
+export function setRefreshFn(fn) {
+    _refreshFn = fn;
+}
+/**
+ * Check whether the stored access token is expired (or will expire within the buffer window).
+ * Uses the expires_at field (epoch seconds) from auth.json.
+ */
+export function isTokenExpired(expiresAt) {
+    const now = Math.floor(Date.now() / 1000);
+    return now >= expiresAt - REFRESH_BUFFER_SECONDS;
+}
+/**
+ * Refresh the token if it is expired or about to expire.
+ * Loads tokens from auth.json, checks expiry, refreshes via Gateway if needed,
+ * and saves the updated tokens back to auth.json.
+ *
+ * Returns true if tokens were refreshed, false if they were still valid.
+ * Throws if no tokens are stored.
+ */
+export async function refreshTokenIfNeeded() {
+    const tokens = await loadTokens();
+    if (!tokens) {
+        throw new Error("No auth tokens found. Please login first.");
+    }
+    if (!isTokenExpired(tokens.expires_at)) {
+        return false;
+    }
+    logger.info("Access token expired or expiring soon, refreshing...");
+    try {
+        const session = await _refreshFn(tokens.refresh_token);
+        await saveTokens({
+            machine_key: tokens.machine_key,
+            access_token: session.access_token,
+            refresh_token: session.refresh_token,
+            expires_at: session.expires_at,
+            user_id: tokens.user_id,
+        });
+        logger.info("Token refreshed successfully");
+        return true;
+    }
+    catch {
+        logger.error("Token refresh failed, clearing tokens");
+        await clearTokens();
+        throw new Error("Failed to refresh token. Tokens cleared. Please login again.");
+    }
+}
+/**
+ * Get a valid access token, refreshing if needed.
+ * Returns the current access_token string.
+ * Throws if no tokens are stored or refresh fails.
+ */
+export async function getValidAccessToken() {
+    await refreshTokenIfNeeded();
+    const tokens = await loadTokens();
+    if (!tokens) {
+        throw new Error("No auth tokens found. Please login first.");
+    }
+    return tokens.access_token;
+}
+// ── Token Monitor ──────────────────────────────────────────────────────
+let monitorInterval = null;
+/**
+ * Run a single monitoring check. Attempts to refresh the token if needed.
+ * Errors are logged but not thrown — the monitor continues running.
+ */
+async function monitorCheck() {
+    try {
+        const refreshed = await refreshTokenIfNeeded();
+        if (refreshed) {
+            logger.info("Token monitor: refreshed access token");
+        }
+    }
+    catch (err) {
+        logger.error(`Token monitor: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+/**
+ * Start the periodic token monitor. Checks token expiry every 60 seconds
+ * and refreshes 5 minutes before expiry.
+ */
+export function startTokenMonitor() {
+    if (monitorInterval) {
+        return;
+    }
+    logger.debug("Starting token monitor (checking every 60s)");
+    monitorInterval = setInterval(() => {
+        void monitorCheck();
+    }, MONITOR_INTERVAL_MS);
+    if (monitorInterval.unref) {
+        monitorInterval.unref();
+    }
+}
+/**
+ * Stop the periodic token monitor.
+ */
+export function stopTokenMonitor() {
+    if (monitorInterval) {
+        clearInterval(monitorInterval);
+        monitorInterval = null;
+        logger.debug("Token monitor stopped");
+    }
+}
+//# sourceMappingURL=token-refresh.js.map

package/dist/auth/token-refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-refresh.js","sourceRoot":"","sources":["../../src/auth/token-refresh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,mEAAmE;AACnE,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAEnC,2CAA2C;AAC3C,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC;;GAEG;AACH,IAAI,UAAU,GAIT,sBAAsB,CAAC;AAE5B,2EAA2E;AAC3E,MAAM,UAAU,YAAY,CAC1B,EAIE;IAEF,UAAU,GAAG,EAAE,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,OAAO,GAAG,IAAI,SAAS,GAAG,sBAAsB,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IAEpE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACvD,MAAM,UAAU,CAAC;YACf,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACtD,MAAM,WAAW,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,MAAM,oBAAoB,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC,YAAY,CAAC;AAC7B,CAAC;AAED,0EAA0E;AAE1E,IAAI,eAAe,GAA0C,IAAI,CAAC;AAElE;;;GAGG;AACH,KAAK,UAAU,YAAY;IACzB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,oBAAoB,EAAE,CAAC;QAC/C,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAE5D,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE;QACjC,KAAK,YAAY,EAAE,CAAC;IACtB,CAAC,EAAE,mBAAmB,CAAC,CAAC;IAExB,IAAI,eAAe,CAAC,KAAK,EAAE,CAAC;QAC1B,eAAe,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,IAAI,eAAe,EAAE,CAAC;QACpB,aAAa,CAAC,eAAe,CAAC,CAAC;QAC/B,eAAe,GAAG,IAAI,CAAC;QACvB,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACxC,CAAC;AACH,CAAC"}

package/dist/auth/token-storage.d.ts

@@ -0,0 +1,20 @@
+import type { AuthTokens } from "./types.js";
+/**
+ * Save auth tokens to auth.json with 0600 permissions (Unix).
+ */
+export declare function saveTokens(tokens: AuthTokens): Promise<void>;
+/**
+ * Load auth tokens from auth.json.
+ * Returns null if the file doesn't exist or has invalid structure.
+ */
+export declare function loadTokens(): Promise<AuthTokens | null>;
+/**
+ * Remove auth.json (clear tokens).
+ */
+export declare function clearTokens(): Promise<void>;
+/**
+ * Check if valid, non-expired tokens exist.
+ * Returns true if tokens are present and expires_at is in the future.
+ */
+export declare function hasValidTokens(): Promise<boolean>;
+//# sourceMappingURL=token-storage.d.ts.map

package/dist/auth/token-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-storage.d.ts","sourceRoot":"","sources":["../../src/auth/token-storage.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AA0B7C;;GAEG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAIlE;AAED;;;GAGG;AACH,wBAAsB,UAAU,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAS7D;AAED;;GAEG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAMjD;AAED;;;GAGG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC,CAKvD"}