@rolino/local-auth 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,32 @@
+# @rolino/local-auth
+
+## 0.1.0
+
+### Minor Changes
+
+- 2f5220f: Expose Bluesky consistently across public publishing contracts, the SDK, CLI,
+  and MCP, including 300-grapheme caption overrides, text and image readiness,
+  health reporting, scheduling, and immediate publishing. The fixed release group
+  also advances `@rolino/local-auth` even though its source does not change.
+- edd5f2e: Validate YouTube descriptions by their 5,000-byte UTF-8 provider limit so every Rolino client rejects multibyte text that YouTube would refuse.
+- 1b644ef: Prepare the first coordinated public release of Rolino's contracts, SDK, shared
+  local authentication, CLI, and local stdio MCP packages.
+- 420484d: Add reusable media discovery and direct local-file uploads across the public
+  API contracts, SDK, CLI, and MCP so agents can safely prepare folder-based
+  social scheduling workflows. The fixed release group also advances
+  `@rolino/local-auth` even though its source does not change.
+- 52373a6: Expose YouTube consistently across public contracts, the SDK, CLI, and MCP,
+  including explicit draft metadata, readiness and health, early scheduled
+  preparation, exact publish confirmation, and typed pending reconciliation.
+  The fixed release group also advances `@rolino/local-auth` even though its
+  source does not change.
+
+### Patch Changes
+
+- Updated dependencies [fdc916f]
+- Updated dependencies [2f5220f]
+- Updated dependencies [edd5f2e]
+- Updated dependencies [1b644ef]
+- Updated dependencies [420484d]
+- Updated dependencies [52373a6]
+  - @rolino/sdk@0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Vlad
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,20 @@
+# `@rolino/local-auth`
+
+Node-only, host-scoped credential storage shared by Rolino's CLI and local
+stdio MCP adapter. Environment credentials take precedence over the portable
+owner-only file store.
+
+This package must not be used by the browser, public SDK, application routes,
+or server domain services. It is published only as a supported transitive
+dependency of the CLI and local MCP server; applications should not treat its
+file format as a public credential-storage API.
+
+## Support, security, and license
+
+Stable releases are published only after the maintainer approves the release
+gate. Report bugs through the
+[Rolino issue tracker](https://github.com/deifos/rolino/issues) and security
+issues through the repository's
+[security policy](https://github.com/deifos/rolino/security/policy).
+
+`@rolino/local-auth` is available under the MIT License.

package/dist/index.cjs

@@ -0,0 +1,117 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  clearStoredCredential: () => clearStoredCredential,
+  credentialStorePath: () => credentialStorePath,
+  loadStoredCredential: () => loadStoredCredential,
+  resolveCredential: () => resolveCredential,
+  saveStoredCredential: () => saveStoredCredential
+});
+module.exports = __toCommonJS(index_exports);
+var import_node_fs = require("fs");
+var import_node_os = require("os");
+var import_node_path = require("path");
+var import_sdk = require("@rolino/sdk");
+function defaultConfigDirectory(env) {
+  if (env.ROLINO_CONFIG_DIR) return env.ROLINO_CONFIG_DIR;
+  if (process.platform === "win32" && env.APPDATA) {
+    return (0, import_node_path.join)(env.APPDATA, "Rolino");
+  }
+  if (process.platform === "darwin") {
+    return (0, import_node_path.join)((0, import_node_os.homedir)(), "Library", "Application Support", "Rolino");
+  }
+  return (0, import_node_path.join)(env.XDG_CONFIG_HOME ?? (0, import_node_path.join)((0, import_node_os.homedir)(), ".config"), "rolino");
+}
+function credentialStorePath(env = process.env) {
+  return (0, import_node_path.join)(defaultConfigDirectory(env), "credentials.json");
+}
+function isStoredCredential(value) {
+  if (!value || typeof value !== "object") return false;
+  const credential = value;
+  return typeof credential.token === "string" && credential.token.length > 0 && typeof credential.createdAt === "string" && typeof credential.expiresAt === "string" && Boolean(credential.organization) && typeof credential.organization?.id === "string" && typeof credential.organization?.name === "string";
+}
+function readStore(env) {
+  const path = credentialStorePath(env);
+  if (!(0, import_node_fs.existsSync)(path)) return { version: 1, credentials: {} };
+  let parsed;
+  try {
+    parsed = JSON.parse((0, import_node_fs.readFileSync)(path, "utf8"));
+  } catch {
+    throw new TypeError(`Rolino could not read its credential store at ${path}.`);
+  }
+  if (!parsed || typeof parsed !== "object") {
+    throw new TypeError(`Rolino's credential store at ${path} is invalid.`);
+  }
+  const candidate = parsed;
+  if (candidate.version !== 1 || !candidate.credentials || typeof candidate.credentials !== "object" || !Object.values(candidate.credentials).every(isStoredCredential)) {
+    throw new TypeError(`Rolino's credential store at ${path} is invalid.`);
+  }
+  return candidate;
+}
+function writeStore(store, env) {
+  const path = credentialStorePath(env);
+  (0, import_node_fs.mkdirSync)((0, import_node_path.dirname)(path), { recursive: true, mode: 448 });
+  (0, import_node_fs.writeFileSync)(path, `${JSON.stringify(store, null, 2)}
+`, {
+    encoding: "utf8",
+    mode: 384
+  });
+  (0, import_node_fs.chmodSync)(path, 384);
+}
+function loadStoredCredential(baseUrl, env = process.env) {
+  return readStore(env).credentials[(0, import_sdk.normalizeRolinoBaseUrl)(baseUrl)] ?? null;
+}
+function saveStoredCredential(baseUrl, credential, env = process.env) {
+  const store = readStore(env);
+  store.credentials[(0, import_sdk.normalizeRolinoBaseUrl)(baseUrl)] = credential;
+  writeStore(store, env);
+  return credentialStorePath(env);
+}
+function clearStoredCredential(baseUrl, env = process.env) {
+  const path = credentialStorePath(env);
+  const store = readStore(env);
+  const key = (0, import_sdk.normalizeRolinoBaseUrl)(baseUrl);
+  const existed = Boolean(store.credentials[key]);
+  delete store.credentials[key];
+  if (Object.keys(store.credentials).length === 0) {
+    if ((0, import_node_fs.existsSync)(path)) (0, import_node_fs.unlinkSync)(path);
+  } else {
+    writeStore(store, env);
+  }
+  return existed;
+}
+function resolveCredential(baseUrl, env = process.env) {
+  if (env.ROLINO_TOKEN) {
+    return { source: "environment", token: env.ROLINO_TOKEN };
+  }
+  const stored = loadStoredCredential(baseUrl, env);
+  return stored ? { source: "stored", token: stored.token, credential: stored } : { source: "none", token: null };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  clearStoredCredential,
+  credentialStorePath,
+  loadStoredCredential,
+  resolveCredential,
+  saveStoredCredential
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import {\r\n  chmodSync,\r\n  existsSync,\r\n  mkdirSync,\r\n  readFileSync,\r\n  unlinkSync,\r\n  writeFileSync,\r\n} from \"node:fs\";\r\nimport { homedir } from \"node:os\";\r\nimport { dirname, join } from \"node:path\";\r\n\r\nimport { normalizeRolinoBaseUrl } from \"@rolino/sdk\";\r\n\r\nexport type StoredCredential = {\r\n  token: string;\r\n  createdAt: string;\r\n  expiresAt: string;\r\n  organization: { id: string; name: string };\r\n};\r\n\r\ntype CredentialStore = {\r\n  version: 1;\r\n  credentials: Record<string, StoredCredential>;\r\n};\r\n\r\nfunction defaultConfigDirectory(env: Record<string, string | undefined>) {\r\n  if (env.ROLINO_CONFIG_DIR) return env.ROLINO_CONFIG_DIR;\r\n  if (process.platform === \"win32\" && env.APPDATA) {\r\n    return join(env.APPDATA, \"Rolino\");\r\n  }\r\n  if (process.platform === \"darwin\") {\r\n    return join(homedir(), \"Library\", \"Application Support\", \"Rolino\");\r\n  }\r\n  return join(env.XDG_CONFIG_HOME ?? join(homedir(), \".config\"), \"rolino\");\r\n}\r\n\r\nexport function credentialStorePath(\r\n  env: Record<string, string | undefined> = process.env,\r\n) {\r\n  return join(defaultConfigDirectory(env), \"credentials.json\");\r\n}\r\n\r\nfunction isStoredCredential(value: unknown): value is StoredCredential {\r\n  if (!value || typeof value !== \"object\") return false;\r\n  const credential = value as Partial<StoredCredential>;\r\n  return typeof credential.token === \"string\"\r\n    && credential.token.length > 0\r\n    && typeof credential.createdAt === \"string\"\r\n    && typeof credential.expiresAt === \"string\"\r\n    && Boolean(credential.organization)\r\n    && typeof credential.organization?.id === \"string\"\r\n    && typeof credential.organization?.name === \"string\";\r\n}\r\n\r\nfunction readStore(env: Record<string, string | undefined>): CredentialStore {\r\n  const path = credentialStorePath(env);\r\n  if (!existsSync(path)) return { version: 1, credentials: {} };\r\n\r\n  let parsed: unknown;\r\n  try {\r\n    parsed = JSON.parse(readFileSync(path, \"utf8\"));\r\n  } catch {\r\n    throw new TypeError(`Rolino could not read its credential store at ${path}.`);\r\n  }\r\n  if (!parsed || typeof parsed !== \"object\") {\r\n    throw new TypeError(`Rolino's credential store at ${path} is invalid.`);\r\n  }\r\n  const candidate = parsed as Partial<CredentialStore>;\r\n  if (\r\n    candidate.version !== 1\r\n    || !candidate.credentials\r\n    || typeof candidate.credentials !== \"object\"\r\n    || !Object.values(candidate.credentials).every(isStoredCredential)\r\n  ) {\r\n    throw new TypeError(`Rolino's credential store at ${path} is invalid.`);\r\n  }\r\n  return candidate as CredentialStore;\r\n}\r\n\r\nfunction writeStore(\r\n  store: CredentialStore,\r\n  env: Record<string, string | undefined>,\r\n) {\r\n  const path = credentialStorePath(env);\r\n  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });\r\n  writeFileSync(path, `${JSON.stringify(store, null, 2)}\\n`, {\r\n    encoding: \"utf8\",\r\n    mode: 0o600,\r\n  });\r\n  chmodSync(path, 0o600);\r\n}\r\n\r\nexport function loadStoredCredential(\r\n  baseUrl: string,\r\n  env: Record<string, string | undefined> = process.env,\r\n) {\r\n  return readStore(env).credentials[normalizeRolinoBaseUrl(baseUrl)] ?? null;\r\n}\r\n\r\nexport function saveStoredCredential(\r\n  baseUrl: string,\r\n  credential: StoredCredential,\r\n  env: Record<string, string | undefined> = process.env,\r\n) {\r\n  const store = readStore(env);\r\n  store.credentials[normalizeRolinoBaseUrl(baseUrl)] = credential;\r\n  writeStore(store, env);\r\n  return credentialStorePath(env);\r\n}\r\n\r\nexport function clearStoredCredential(\r\n  baseUrl: string,\r\n  env: Record<string, string | undefined> = process.env,\r\n) {\r\n  const path = credentialStorePath(env);\r\n  const store = readStore(env);\r\n  const key = normalizeRolinoBaseUrl(baseUrl);\r\n  const existed = Boolean(store.credentials[key]);\r\n  delete store.credentials[key];\r\n\r\n  if (Object.keys(store.credentials).length === 0) {\r\n    if (existsSync(path)) unlinkSync(path);\r\n  } else {\r\n    writeStore(store, env);\r\n  }\r\n  return existed;\r\n}\r\n\r\nexport function resolveCredential(\r\n  baseUrl: string,\r\n  env: Record<string, string | undefined> = process.env,\r\n) {\r\n  if (env.ROLINO_TOKEN) {\r\n    return { source: \"environment\" as const, token: env.ROLINO_TOKEN };\r\n  }\r\n  const stored = loadStoredCredential(baseUrl, env);\r\n  return stored\r\n    ? { source: \"stored\" as const, token: stored.token, credential: stored }\r\n    : { source: \"none\" as const, token: null };\r\n}\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qBAOO;AACP,qBAAwB;AACxB,uBAA8B;AAE9B,iBAAuC;AAcvC,SAAS,uBAAuB,KAAyC;AACvE,MAAI,IAAI,kBAAmB,QAAO,IAAI;AACtC,MAAI,QAAQ,aAAa,WAAW,IAAI,SAAS;AAC/C,eAAO,uBAAK,IAAI,SAAS,QAAQ;AAAA,EACnC;AACA,MAAI,QAAQ,aAAa,UAAU;AACjC,eAAO,2BAAK,wBAAQ,GAAG,WAAW,uBAAuB,QAAQ;AAAA,EACnE;AACA,aAAO,uBAAK,IAAI,uBAAmB,2BAAK,wBAAQ,GAAG,SAAS,GAAG,QAAQ;AACzE;AAEO,SAAS,oBACd,MAA0C,QAAQ,KAClD;AACA,aAAO,uBAAK,uBAAuB,GAAG,GAAG,kBAAkB;AAC7D;AAEA,SAAS,mBAAmB,OAA2C;AACrE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,aAAa;AACnB,SAAO,OAAO,WAAW,UAAU,YAC9B,WAAW,MAAM,SAAS,KAC1B,OAAO,WAAW,cAAc,YAChC,OAAO,WAAW,cAAc,YAChC,QAAQ,WAAW,YAAY,KAC/B,OAAO,WAAW,cAAc,OAAO,YACvC,OAAO,WAAW,cAAc,SAAS;AAChD;AAEA,SAAS,UAAU,KAA0D;AAC3E,QAAM,OAAO,oBAAoB,GAAG;AACpC,MAAI,KAAC,2BAAW,IAAI,EAAG,QAAO,EAAE,SAAS,GAAG,aAAa,CAAC,EAAE;AAE5D,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,UAAM,6BAAa,MAAM,MAAM,CAAC;AAAA,EAChD,QAAQ;AACN,UAAM,IAAI,UAAU,iDAAiD,IAAI,GAAG;AAAA,EAC9E;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,UAAU;AACzC,UAAM,IAAI,UAAU,gCAAgC,IAAI,cAAc;AAAA,EACxE;AACA,QAAM,YAAY;AAClB,MACE,UAAU,YAAY,KACnB,CAAC,UAAU,eACX,OAAO,UAAU,gBAAgB,YACjC,CAAC,OAAO,OAAO,UAAU,WAAW,EAAE,MAAM,kBAAkB,GACjE;AACA,UAAM,IAAI,UAAU,gCAAgC,IAAI,cAAc;AAAA,EACxE;AACA,SAAO;AACT;AAEA,SAAS,WACP,OACA,KACA;AACA,QAAM,OAAO,oBAAoB,GAAG;AACpC,oCAAU,0BAAQ,IAAI,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACzD,oCAAc,MAAM,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,GAAM;AAAA,IACzD,UAAU;AAAA,IACV,MAAM;AAAA,EACR,CAAC;AACD,gCAAU,MAAM,GAAK;AACvB;AAEO,SAAS,qBACd,SACA,MAA0C,QAAQ,KAClD;AACA,SAAO,UAAU,GAAG,EAAE,gBAAY,mCAAuB,OAAO,CAAC,KAAK;AACxE;AAEO,SAAS,qBACd,SACA,YACA,MAA0C,QAAQ,KAClD;AACA,QAAM,QAAQ,UAAU,GAAG;AAC3B,QAAM,gBAAY,mCAAuB,OAAO,CAAC,IAAI;AACrD,aAAW,OAAO,GAAG;AACrB,SAAO,oBAAoB,GAAG;AAChC;AAEO,SAAS,sBACd,SACA,MAA0C,QAAQ,KAClD;AACA,QAAM,OAAO,oBAAoB,GAAG;AACpC,QAAM,QAAQ,UAAU,GAAG;AAC3B,QAAM,UAAM,mCAAuB,OAAO;AAC1C,QAAM,UAAU,QAAQ,MAAM,YAAY,GAAG,CAAC;AAC9C,SAAO,MAAM,YAAY,GAAG;AAE5B,MAAI,OAAO,KAAK,MAAM,WAAW,EAAE,WAAW,GAAG;AAC/C,YAAI,2BAAW,IAAI,EAAG,gCAAW,IAAI;AAAA,EACvC,OAAO;AACL,eAAW,OAAO,GAAG;AAAA,EACvB;AACA,SAAO;AACT;AAEO,SAAS,kBACd,SACA,MAA0C,QAAQ,KAClD;AACA,MAAI,IAAI,cAAc;AACpB,WAAO,EAAE,QAAQ,eAAwB,OAAO,IAAI,aAAa;AAAA,EACnE;AACA,QAAM,SAAS,qBAAqB,SAAS,GAAG;AAChD,SAAO,SACH,EAAE,QAAQ,UAAmB,OAAO,OAAO,OAAO,YAAY,OAAO,IACrE,EAAE,QAAQ,QAAiB,OAAO,KAAK;AAC7C;","names":[]}

package/dist/index.d.cts

@@ -0,0 +1,28 @@
+type StoredCredential = {
+    token: string;
+    createdAt: string;
+    expiresAt: string;
+    organization: {
+        id: string;
+        name: string;
+    };
+};
+declare function credentialStorePath(env?: Record<string, string | undefined>): string;
+declare function loadStoredCredential(baseUrl: string, env?: Record<string, string | undefined>): StoredCredential | null;
+declare function saveStoredCredential(baseUrl: string, credential: StoredCredential, env?: Record<string, string | undefined>): string;
+declare function clearStoredCredential(baseUrl: string, env?: Record<string, string | undefined>): boolean;
+declare function resolveCredential(baseUrl: string, env?: Record<string, string | undefined>): {
+    source: "environment";
+    token: string;
+    credential?: undefined;
+} | {
+    source: "stored";
+    token: string;
+    credential: StoredCredential;
+} | {
+    source: "none";
+    token: null;
+    credential?: undefined;
+};
+
+export { type StoredCredential, clearStoredCredential, credentialStorePath, loadStoredCredential, resolveCredential, saveStoredCredential };

package/dist/index.d.ts

@@ -0,0 +1,28 @@
+type StoredCredential = {
+    token: string;
+    createdAt: string;
+    expiresAt: string;
+    organization: {
+        id: string;
+        name: string;
+    };
+};
+declare function credentialStorePath(env?: Record<string, string | undefined>): string;
+declare function loadStoredCredential(baseUrl: string, env?: Record<string, string | undefined>): StoredCredential | null;
+declare function saveStoredCredential(baseUrl: string, credential: StoredCredential, env?: Record<string, string | undefined>): string;
+declare function clearStoredCredential(baseUrl: string, env?: Record<string, string | undefined>): boolean;
+declare function resolveCredential(baseUrl: string, env?: Record<string, string | undefined>): {
+    source: "environment";
+    token: string;
+    credential?: undefined;
+} | {
+    source: "stored";
+    token: string;
+    credential: StoredCredential;
+} | {
+    source: "none";
+    token: null;
+    credential?: undefined;
+};
+
+export { type StoredCredential, clearStoredCredential, credentialStorePath, loadStoredCredential, resolveCredential, saveStoredCredential };

package/dist/index.js

@@ -0,0 +1,95 @@
+// src/index.ts
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  unlinkSync,
+  writeFileSync
+} from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+import { normalizeRolinoBaseUrl } from "@rolino/sdk";
+function defaultConfigDirectory(env) {
+  if (env.ROLINO_CONFIG_DIR) return env.ROLINO_CONFIG_DIR;
+  if (process.platform === "win32" && env.APPDATA) {
+    return join(env.APPDATA, "Rolino");
+  }
+  if (process.platform === "darwin") {
+    return join(homedir(), "Library", "Application Support", "Rolino");
+  }
+  return join(env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "rolino");
+}
+function credentialStorePath(env = process.env) {
+  return join(defaultConfigDirectory(env), "credentials.json");
+}
+function isStoredCredential(value) {
+  if (!value || typeof value !== "object") return false;
+  const credential = value;
+  return typeof credential.token === "string" && credential.token.length > 0 && typeof credential.createdAt === "string" && typeof credential.expiresAt === "string" && Boolean(credential.organization) && typeof credential.organization?.id === "string" && typeof credential.organization?.name === "string";
+}
+function readStore(env) {
+  const path = credentialStorePath(env);
+  if (!existsSync(path)) return { version: 1, credentials: {} };
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    throw new TypeError(`Rolino could not read its credential store at ${path}.`);
+  }
+  if (!parsed || typeof parsed !== "object") {
+    throw new TypeError(`Rolino's credential store at ${path} is invalid.`);
+  }
+  const candidate = parsed;
+  if (candidate.version !== 1 || !candidate.credentials || typeof candidate.credentials !== "object" || !Object.values(candidate.credentials).every(isStoredCredential)) {
+    throw new TypeError(`Rolino's credential store at ${path} is invalid.`);
+  }
+  return candidate;
+}
+function writeStore(store, env) {
+  const path = credentialStorePath(env);
+  mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  writeFileSync(path, `${JSON.stringify(store, null, 2)}
+`, {
+    encoding: "utf8",
+    mode: 384
+  });
+  chmodSync(path, 384);
+}
+function loadStoredCredential(baseUrl, env = process.env) {
+  return readStore(env).credentials[normalizeRolinoBaseUrl(baseUrl)] ?? null;
+}
+function saveStoredCredential(baseUrl, credential, env = process.env) {
+  const store = readStore(env);
+  store.credentials[normalizeRolinoBaseUrl(baseUrl)] = credential;
+  writeStore(store, env);
+  return credentialStorePath(env);
+}
+function clearStoredCredential(baseUrl, env = process.env) {
+  const path = credentialStorePath(env);
+  const store = readStore(env);
+  const key = normalizeRolinoBaseUrl(baseUrl);
+  const existed = Boolean(store.credentials[key]);
+  delete store.credentials[key];
+  if (Object.keys(store.credentials).length === 0) {
+    if (existsSync(path)) unlinkSync(path);
+  } else {
+    writeStore(store, env);
+  }
+  return existed;
+}
+function resolveCredential(baseUrl, env = process.env) {
+  if (env.ROLINO_TOKEN) {
+    return { source: "environment", token: env.ROLINO_TOKEN };
+  }
+  const stored = loadStoredCredential(baseUrl, env);
+  return stored ? { source: "stored", token: stored.token, credential: stored } : { source: "none", token: null };
+}
+export {
+  clearStoredCredential,
+  credentialStorePath,
+  loadStoredCredential,
+  resolveCredential,
+  saveStoredCredential
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import {\r\n  chmodSync,\r\n  existsSync,\r\n  mkdirSync,\r\n  readFileSync,\r\n  unlinkSync,\r\n  writeFileSync,\r\n} from \"node:fs\";\r\nimport { homedir } from \"node:os\";\r\nimport { dirname, join } from \"node:path\";\r\n\r\nimport { normalizeRolinoBaseUrl } from \"@rolino/sdk\";\r\n\r\nexport type StoredCredential = {\r\n  token: string;\r\n  createdAt: string;\r\n  expiresAt: string;\r\n  organization: { id: string; name: string };\r\n};\r\n\r\ntype CredentialStore = {\r\n  version: 1;\r\n  credentials: Record<string, StoredCredential>;\r\n};\r\n\r\nfunction defaultConfigDirectory(env: Record<string, string | undefined>) {\r\n  if (env.ROLINO_CONFIG_DIR) return env.ROLINO_CONFIG_DIR;\r\n  if (process.platform === \"win32\" && env.APPDATA) {\r\n    return join(env.APPDATA, \"Rolino\");\r\n  }\r\n  if (process.platform === \"darwin\") {\r\n    return join(homedir(), \"Library\", \"Application Support\", \"Rolino\");\r\n  }\r\n  return join(env.XDG_CONFIG_HOME ?? join(homedir(), \".config\"), \"rolino\");\r\n}\r\n\r\nexport function credentialStorePath(\r\n  env: Record<string, string | undefined> = process.env,\r\n) {\r\n  return join(defaultConfigDirectory(env), \"credentials.json\");\r\n}\r\n\r\nfunction isStoredCredential(value: unknown): value is StoredCredential {\r\n  if (!value || typeof value !== \"object\") return false;\r\n  const credential = value as Partial<StoredCredential>;\r\n  return typeof credential.token === \"string\"\r\n    && credential.token.length > 0\r\n    && typeof credential.createdAt === \"string\"\r\n    && typeof credential.expiresAt === \"string\"\r\n    && Boolean(credential.organization)\r\n    && typeof credential.organization?.id === \"string\"\r\n    && typeof credential.organization?.name === \"string\";\r\n}\r\n\r\nfunction readStore(env: Record<string, string | undefined>): CredentialStore {\r\n  const path = credentialStorePath(env);\r\n  if (!existsSync(path)) return { version: 1, credentials: {} };\r\n\r\n  let parsed: unknown;\r\n  try {\r\n    parsed = JSON.parse(readFileSync(path, \"utf8\"));\r\n  } catch {\r\n    throw new TypeError(`Rolino could not read its credential store at ${path}.`);\r\n  }\r\n  if (!parsed || typeof parsed !== \"object\") {\r\n    throw new TypeError(`Rolino's credential store at ${path} is invalid.`);\r\n  }\r\n  const candidate = parsed as Partial<CredentialStore>;\r\n  if (\r\n    candidate.version !== 1\r\n    || !candidate.credentials\r\n    || typeof candidate.credentials !== \"object\"\r\n    || !Object.values(candidate.credentials).every(isStoredCredential)\r\n  ) {\r\n    throw new TypeError(`Rolino's credential store at ${path} is invalid.`);\r\n  }\r\n  return candidate as CredentialStore;\r\n}\r\n\r\nfunction writeStore(\r\n  store: CredentialStore,\r\n  env: Record<string, string | undefined>,\r\n) {\r\n  const path = credentialStorePath(env);\r\n  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });\r\n  writeFileSync(path, `${JSON.stringify(store, null, 2)}\\n`, {\r\n    encoding: \"utf8\",\r\n    mode: 0o600,\r\n  });\r\n  chmodSync(path, 0o600);\r\n}\r\n\r\nexport function loadStoredCredential(\r\n  baseUrl: string,\r\n  env: Record<string, string | undefined> = process.env,\r\n) {\r\n  return readStore(env).credentials[normalizeRolinoBaseUrl(baseUrl)] ?? null;\r\n}\r\n\r\nexport function saveStoredCredential(\r\n  baseUrl: string,\r\n  credential: StoredCredential,\r\n  env: Record<string, string | undefined> = process.env,\r\n) {\r\n  const store = readStore(env);\r\n  store.credentials[normalizeRolinoBaseUrl(baseUrl)] = credential;\r\n  writeStore(store, env);\r\n  return credentialStorePath(env);\r\n}\r\n\r\nexport function clearStoredCredential(\r\n  baseUrl: string,\r\n  env: Record<string, string | undefined> = process.env,\r\n) {\r\n  const path = credentialStorePath(env);\r\n  const store = readStore(env);\r\n  const key = normalizeRolinoBaseUrl(baseUrl);\r\n  const existed = Boolean(store.credentials[key]);\r\n  delete store.credentials[key];\r\n\r\n  if (Object.keys(store.credentials).length === 0) {\r\n    if (existsSync(path)) unlinkSync(path);\r\n  } else {\r\n    writeStore(store, env);\r\n  }\r\n  return existed;\r\n}\r\n\r\nexport function resolveCredential(\r\n  baseUrl: string,\r\n  env: Record<string, string | undefined> = process.env,\r\n) {\r\n  if (env.ROLINO_TOKEN) {\r\n    return { source: \"environment\" as const, token: env.ROLINO_TOKEN };\r\n  }\r\n  const stored = loadStoredCredential(baseUrl, env);\r\n  return stored\r\n    ? { source: \"stored\" as const, token: stored.token, credential: stored }\r\n    : { source: \"none\" as const, token: null };\r\n}\r\n"],"mappings":";AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,eAAe;AACxB,SAAS,SAAS,YAAY;AAE9B,SAAS,8BAA8B;AAcvC,SAAS,uBAAuB,KAAyC;AACvE,MAAI,IAAI,kBAAmB,QAAO,IAAI;AACtC,MAAI,QAAQ,aAAa,WAAW,IAAI,SAAS;AAC/C,WAAO,KAAK,IAAI,SAAS,QAAQ;AAAA,EACnC;AACA,MAAI,QAAQ,aAAa,UAAU;AACjC,WAAO,KAAK,QAAQ,GAAG,WAAW,uBAAuB,QAAQ;AAAA,EACnE;AACA,SAAO,KAAK,IAAI,mBAAmB,KAAK,QAAQ,GAAG,SAAS,GAAG,QAAQ;AACzE;AAEO,SAAS,oBACd,MAA0C,QAAQ,KAClD;AACA,SAAO,KAAK,uBAAuB,GAAG,GAAG,kBAAkB;AAC7D;AAEA,SAAS,mBAAmB,OAA2C;AACrE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,aAAa;AACnB,SAAO,OAAO,WAAW,UAAU,YAC9B,WAAW,MAAM,SAAS,KAC1B,OAAO,WAAW,cAAc,YAChC,OAAO,WAAW,cAAc,YAChC,QAAQ,WAAW,YAAY,KAC/B,OAAO,WAAW,cAAc,OAAO,YACvC,OAAO,WAAW,cAAc,SAAS;AAChD;AAEA,SAAS,UAAU,KAA0D;AAC3E,QAAM,OAAO,oBAAoB,GAAG;AACpC,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO,EAAE,SAAS,GAAG,aAAa,CAAC,EAAE;AAE5D,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;AAAA,EAChD,QAAQ;AACN,UAAM,IAAI,UAAU,iDAAiD,IAAI,GAAG;AAAA,EAC9E;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,UAAU;AACzC,UAAM,IAAI,UAAU,gCAAgC,IAAI,cAAc;AAAA,EACxE;AACA,QAAM,YAAY;AAClB,MACE,UAAU,YAAY,KACnB,CAAC,UAAU,eACX,OAAO,UAAU,gBAAgB,YACjC,CAAC,OAAO,OAAO,UAAU,WAAW,EAAE,MAAM,kBAAkB,GACjE;AACA,UAAM,IAAI,UAAU,gCAAgC,IAAI,cAAc;AAAA,EACxE;AACA,SAAO;AACT;AAEA,SAAS,WACP,OACA,KACA;AACA,QAAM,OAAO,oBAAoB,GAAG;AACpC,YAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACzD,gBAAc,MAAM,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,GAAM;AAAA,IACzD,UAAU;AAAA,IACV,MAAM;AAAA,EACR,CAAC;AACD,YAAU,MAAM,GAAK;AACvB;AAEO,SAAS,qBACd,SACA,MAA0C,QAAQ,KAClD;AACA,SAAO,UAAU,GAAG,EAAE,YAAY,uBAAuB,OAAO,CAAC,KAAK;AACxE;AAEO,SAAS,qBACd,SACA,YACA,MAA0C,QAAQ,KAClD;AACA,QAAM,QAAQ,UAAU,GAAG;AAC3B,QAAM,YAAY,uBAAuB,OAAO,CAAC,IAAI;AACrD,aAAW,OAAO,GAAG;AACrB,SAAO,oBAAoB,GAAG;AAChC;AAEO,SAAS,sBACd,SACA,MAA0C,QAAQ,KAClD;AACA,QAAM,OAAO,oBAAoB,GAAG;AACpC,QAAM,QAAQ,UAAU,GAAG;AAC3B,QAAM,MAAM,uBAAuB,OAAO;AAC1C,QAAM,UAAU,QAAQ,MAAM,YAAY,GAAG,CAAC;AAC9C,SAAO,MAAM,YAAY,GAAG;AAE5B,MAAI,OAAO,KAAK,MAAM,WAAW,EAAE,WAAW,GAAG;AAC/C,QAAI,WAAW,IAAI,EAAG,YAAW,IAAI;AAAA,EACvC,OAAO;AACL,eAAW,OAAO,GAAG;AAAA,EACvB;AACA,SAAO;AACT;AAEO,SAAS,kBACd,SACA,MAA0C,QAAQ,KAClD;AACA,MAAI,IAAI,cAAc;AACpB,WAAO,EAAE,QAAQ,eAAwB,OAAO,IAAI,aAAa;AAAA,EACnE;AACA,QAAM,SAAS,qBAAqB,SAAS,GAAG;AAChD,SAAO,SACH,EAAE,QAAQ,UAAmB,OAAO,OAAO,OAAO,YAAY,OAAO,IACrE,EAAE,QAAQ,QAAiB,OAAO,KAAK;AAC7C;","names":[]}

package/package.json

@@ -0,0 +1,62 @@
+{
+  "name": "@rolino/local-auth",
+  "version": "0.1.0",
+  "description": "Host-scoped local credential storage shared by Rolino's Node.js adapters",
+  "type": "module",
+  "license": "MIT",
+  "keywords": [
+    "rolino",
+    "authentication",
+    "credentials",
+    "cli",
+    "mcp"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deifos/rolino.git",
+    "directory": "packages/local-auth"
+  },
+  "homepage": "https://github.com/deifos/rolino/tree/main/packages/local-auth#readme",
+  "bugs": {
+    "url": "https://github.com/deifos/rolino/issues"
+  },
+  "sideEffects": false,
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    }
+  },
+  "files": [
+    "dist/**/*.js",
+    "dist/**/*.cjs",
+    "dist/**/*.map",
+    "dist/**/*.d.ts",
+    "dist/**/*.d.cts",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsup src/index.ts --format esm,cjs --dts --sourcemap --clean",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@rolino/sdk": "0.1.0"
+  },
+  "engines": {
+    "node": ">=20.19.0"
+  }
+}