@rolino/local-auth 0.5.0 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @rolino/local-auth
 
+## 0.6.0
+
+### Minor Changes
+
+- a56f834: Replace custom interactive CLI authorization with exact-resource OAuth, add the stateless MCP 2026-07-28 transport foundation, and provide safe connection instructions for workspace discovery and confirmed actions.
+
+### Patch Changes
+
+- Updated dependencies [d162f85]
+- Updated dependencies [50cb9fc]
+- Updated dependencies [1ac7ed5]
+- Updated dependencies [a56f834]
+  - @rolino/sdk@0.6.0
+
 ## 0.5.0
 
 ### Minor Changes

package/README.md

@@ -1,8 +1,11 @@
 # `@rolino/local-auth`
 
-Node-only, host-scoped credential storage shared by Rolino's CLI and local
-stdio MCP adapter. Environment credentials take precedence over the portable
-owner-only file store.
+Node-only OAuth token storage shared by Rolino's CLI and local stdio MCP
+adapter. Token sets are scoped by host, issuer, client, and exact resource.
+The store refreshes short-lived access tokens under one rotation lock and
+writes the owner-only file atomically. Environment API keys still take
+precedence for headless automation. The removed interactive credential is
+never read or converted.
 
 This package must not be used by the browser, public SDK, application routes,
 or server domain services. It is published only as a supported transitive

package/dist/index.cjs

@@ -20,98 +20,179 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
-  clearStoredCredential: () => clearStoredCredential,
-  credentialStorePath: () => credentialStorePath,
-  loadStoredCredential: () => loadStoredCredential,
-  resolveCredential: () => resolveCredential,
-  saveStoredCredential: () => saveStoredCredential
+  ROLINO_CLI_OAUTH_CLIENT_ID: () => ROLINO_CLI_OAUTH_CLIENT_ID,
+  clearOAuthTokenSet: () => clearOAuthTokenSet,
+  createOAuthAccessTokenProvider: () => createOAuthAccessTokenProvider,
+  loadOAuthTokenSet: () => loadOAuthTokenSet,
+  oauthConfiguration: () => oauthConfiguration,
+  oauthTokenStorePath: () => oauthTokenStorePath,
+  resolveLocalAuthentication: () => resolveLocalAuthentication,
+  saveOAuthTokenSet: () => saveOAuthTokenSet
 });
 module.exports = __toCommonJS(index_exports);
 var import_node_fs = require("fs");
 var import_node_os = require("os");
 var import_node_path = require("path");
 var import_sdk = require("@rolino/sdk");
+var ROLINO_CLI_OAUTH_CLIENT_ID = "rolino-cli";
+var refreshLocks = /* @__PURE__ */ new Map();
 function defaultConfigDirectory(env) {
   if (env.ROLINO_CONFIG_DIR) return env.ROLINO_CONFIG_DIR;
-  if (process.platform === "win32" && env.APPDATA) {
-    return (0, import_node_path.join)(env.APPDATA, "Rolino");
-  }
-  if (process.platform === "darwin") {
-    return (0, import_node_path.join)((0, import_node_os.homedir)(), "Library", "Application Support", "Rolino");
-  }
+  if (process.platform === "win32" && env.APPDATA) return (0, import_node_path.join)(env.APPDATA, "Rolino");
+  if (process.platform === "darwin") return (0, import_node_path.join)((0, import_node_os.homedir)(), "Library", "Application Support", "Rolino");
   return (0, import_node_path.join)(env.XDG_CONFIG_HOME ?? (0, import_node_path.join)((0, import_node_os.homedir)(), ".config"), "rolino");
 }
-function credentialStorePath(env = process.env) {
-  return (0, import_node_path.join)(defaultConfigDirectory(env), "credentials.json");
+function oauthTokenStorePath(env = process.env) {
+  return (0, import_node_path.join)(defaultConfigDirectory(env), "oauth-tokens.json");
+}
+function oauthConfiguration(baseUrl) {
+  const host = (0, import_sdk.normalizeRolinoBaseUrl)(baseUrl);
+  return {
+    host,
+    issuer: `${host}/api/auth`,
+    clientId: ROLINO_CLI_OAUTH_CLIENT_ID,
+    resource: `${host}/api/v1`
+  };
 }
-function isStoredCredential(value) {
+function tokenKey(input) {
+  return JSON.stringify([input.host, input.issuer, input.clientId, input.resource]);
+}
+function isTokenSet(value) {
   if (!value || typeof value !== "object") return false;
-  const credential = value;
-  return typeof credential.token === "string" && credential.token.length > 0 && typeof credential.createdAt === "string" && typeof credential.expiresAt === "string" && Boolean(credential.organization) && typeof credential.organization?.id === "string" && typeof credential.organization?.name === "string";
+  const token = value;
+  return [
+    token.host,
+    token.issuer,
+    token.clientId,
+    token.resource,
+    token.accessToken,
+    token.accessTokenExpiresAt,
+    token.refreshToken,
+    token.refreshTokenExpiresAt
+  ].every((item) => typeof item === "string" && item.length > 0) && Array.isArray(token.scopes) && token.scopes.every((scope) => typeof scope === "string");
 }
 function readStore(env) {
-  const path = credentialStorePath(env);
-  if (!(0, import_node_fs.existsSync)(path)) return { version: 1, credentials: {} };
-  let parsed;
+  const path = oauthTokenStorePath(env);
+  if (!(0, import_node_fs.existsSync)(path)) return { version: 2, tokens: {} };
   try {
-    parsed = JSON.parse((0, import_node_fs.readFileSync)(path, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs.readFileSync)(path, "utf8"));
+    if (parsed.version !== 2 || !parsed.tokens || typeof parsed.tokens !== "object" || !Object.values(parsed.tokens).every(isTokenSet)) throw new Error("invalid");
+    return parsed;
   } catch {
-    throw new TypeError(`Rolino could not read its credential store at ${path}.`);
-  }
-  if (!parsed || typeof parsed !== "object") {
-    throw new TypeError(`Rolino's credential store at ${path} is invalid.`);
+    throw new TypeError(`Rolino could not read its OAuth token store at ${path}.`);
   }
-  const candidate = parsed;
-  if (candidate.version !== 1 || !candidate.credentials || typeof candidate.credentials !== "object" || !Object.values(candidate.credentials).every(isStoredCredential)) {
-    throw new TypeError(`Rolino's credential store at ${path} is invalid.`);
-  }
-  return candidate;
 }
 function writeStore(store, env) {
-  const path = credentialStorePath(env);
+  const path = oauthTokenStorePath(env);
+  const temporary = `${path}.${process.pid}.tmp`;
   (0, import_node_fs.mkdirSync)((0, import_node_path.dirname)(path), { recursive: true, mode: 448 });
-  (0, import_node_fs.writeFileSync)(path, `${JSON.stringify(store, null, 2)}
+  (0, import_node_fs.writeFileSync)(temporary, `${JSON.stringify(store, null, 2)}
 `, {
     encoding: "utf8",
     mode: 384
   });
+  (0, import_node_fs.chmodSync)(temporary, 384);
+  (0, import_node_fs.renameSync)(temporary, path);
   (0, import_node_fs.chmodSync)(path, 384);
+  return path;
 }
-function loadStoredCredential(baseUrl, env = process.env) {
-  return readStore(env).credentials[(0, import_sdk.normalizeRolinoBaseUrl)(baseUrl)] ?? null;
+function loadOAuthTokenSet(baseUrl, env = process.env) {
+  const configuration = oauthConfiguration(baseUrl);
+  return readStore(env).tokens[tokenKey(configuration)] ?? null;
 }
-function saveStoredCredential(baseUrl, credential, env = process.env) {
+function saveOAuthTokenSet(tokenSet, env = process.env) {
+  const configuration = oauthConfiguration(tokenSet.host);
+  if (tokenSet.host !== configuration.host || tokenSet.issuer !== configuration.issuer || tokenSet.clientId !== configuration.clientId || tokenSet.resource !== configuration.resource) throw new TypeError("The OAuth token set does not match the Rolino host.");
   const store = readStore(env);
-  store.credentials[(0, import_sdk.normalizeRolinoBaseUrl)(baseUrl)] = credential;
-  writeStore(store, env);
-  return credentialStorePath(env);
+  store.tokens[tokenKey(tokenSet)] = tokenSet;
+  const path = writeStore(store, env);
+  const retiredInteractiveCredential = (0, import_node_path.join)(defaultConfigDirectory(env), "credentials.json");
+  if ((0, import_node_fs.existsSync)(retiredInteractiveCredential)) (0, import_node_fs.unlinkSync)(retiredInteractiveCredential);
+  return path;
 }
-function clearStoredCredential(baseUrl, env = process.env) {
-  const path = credentialStorePath(env);
+function clearOAuthTokenSet(baseUrl, env = process.env) {
+  const path = oauthTokenStorePath(env);
   const store = readStore(env);
-  const key = (0, import_sdk.normalizeRolinoBaseUrl)(baseUrl);
-  const existed = Boolean(store.credentials[key]);
-  delete store.credentials[key];
-  if (Object.keys(store.credentials).length === 0) {
+  const key = tokenKey(oauthConfiguration(baseUrl));
+  const existed = Boolean(store.tokens[key]);
+  delete store.tokens[key];
+  if (!Object.keys(store.tokens).length) {
     if ((0, import_node_fs.existsSync)(path)) (0, import_node_fs.unlinkSync)(path);
   } else {
     writeStore(store, env);
   }
   return existed;
 }
-function resolveCredential(baseUrl, env = process.env) {
-  if (env.ROLINO_TOKEN) {
-    return { source: "environment", token: env.ROLINO_TOKEN };
-  }
-  const stored = loadStoredCredential(baseUrl, env);
-  return stored ? { source: "stored", token: stored.token, credential: stored } : { source: "none", token: null };
+async function refreshOAuthTokenSet(options) {
+  const current = loadOAuthTokenSet(options.baseUrl, options.env);
+  if (!current) throw new TypeError("OAuth sign-in is required. Run `rolino auth login`.");
+  const key = tokenKey(current);
+  const existing = refreshLocks.get(key);
+  if (existing) return existing;
+  const refresh = (async () => {
+    const body = new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: current.refreshToken,
+      client_id: current.clientId,
+      resource: current.resource
+    });
+    const response = await options.fetch(`${current.issuer}/oauth2/token`, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+      body
+    });
+    const payload = await response.json().catch(() => null);
+    if (!response.ok || !payload || typeof payload.access_token !== "string") {
+      throw new TypeError("OAuth sign-in is required. Run `rolino auth login`.");
+    }
+    const expiresIn = typeof payload.expires_in === "number" ? payload.expires_in : 300;
+    const refreshed = {
+      ...current,
+      accessToken: payload.access_token,
+      accessTokenExpiresAt: new Date(Date.now() + expiresIn * 1e3).toISOString(),
+      refreshToken: typeof payload.refresh_token === "string" ? payload.refresh_token : current.refreshToken,
+      scopes: typeof payload.scope === "string" ? payload.scope.split(/\s+/).filter(Boolean) : current.scopes
+    };
+    saveOAuthTokenSet(refreshed, options.env);
+    return refreshed;
+  })().finally(() => refreshLocks.delete(key));
+  refreshLocks.set(key, refresh);
+  return refresh;
+}
+function createOAuthAccessTokenProvider(options) {
+  const env = options.env ?? process.env;
+  const fetchImplementation = options.fetch ?? globalThis.fetch;
+  const obtain = async (force) => {
+    if (env.ROLINO_TOKEN) return env.ROLINO_TOKEN;
+    const token = loadOAuthTokenSet(options.baseUrl, env);
+    if (!token) return void 0;
+    if (!force && Date.parse(token.accessTokenExpiresAt) - Date.now() > 3e4) {
+      return token.accessToken;
+    }
+    return (await refreshOAuthTokenSet({
+      baseUrl: options.baseUrl,
+      env,
+      fetch: fetchImplementation
+    })).accessToken;
+  };
+  const provider = (() => obtain(false));
+  provider.refresh = () => obtain(true);
+  return provider;
+}
+function resolveLocalAuthentication(baseUrl, env = process.env) {
+  if (env.ROLINO_TOKEN) return { source: "environment", tokenSet: null };
+  const tokenSet = loadOAuthTokenSet(baseUrl, env);
+  return tokenSet ? { source: "oauth", tokenSet } : { source: "none", tokenSet: null };
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  clearStoredCredential,
-  credentialStorePath,
-  loadStoredCredential,
-  resolveCredential,
-  saveStoredCredential
+  ROLINO_CLI_OAUTH_CLIENT_ID,
+  clearOAuthTokenSet,
+  createOAuthAccessTokenProvider,
+  loadOAuthTokenSet,
+  oauthConfiguration,
+  oauthTokenStorePath,
+  resolveLocalAuthentication,
+  saveOAuthTokenSet
 });
 //# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import {\r\n  chmodSync,\r\n  existsSync,\r\n  mkdirSync,\r\n  readFileSync,\r\n  unlinkSync,\r\n  writeFileSync,\r\n} from \"node:fs\";\r\nimport { homedir } from \"node:os\";\r\nimport { dirname, join } from \"node:path\";\r\n\r\nimport { normalizeRolinoBaseUrl } from \"@rolino/sdk\";\r\n\r\nexport type StoredCredential = {\r\n  token: string;\r\n  createdAt: string;\r\n  expiresAt: string;\r\n  organization: { id: string; name: string };\r\n};\r\n\r\ntype CredentialStore = {\r\n  version: 1;\r\n  credentials: Record<string, StoredCredential>;\r\n};\r\n\r\nfunction defaultConfigDirectory(env: Record<string, string | undefined>) {\r\n  if (env.ROLINO_CONFIG_DIR) return env.ROLINO_CONFIG_DIR;\r\n  if (process.platform === \"win32\" && env.APPDATA) {\r\n    return join(env.APPDATA, \"Rolino\");\r\n  }\r\n  if (process.platform === \"darwin\") {\r\n    return join(homedir(), \"Library\", \"Application Support\", \"Rolino\");\r\n  }\r\n  return join(env.XDG_CONFIG_HOME ?? join(homedir(), \".config\"), \"rolino\");\r\n}\r\n\r\nexport function credentialStorePath(\r\n  env: Record<string, string | undefined> = process.env,\r\n) {\r\n  return join(defaultConfigDirectory(env), \"credentials.json\");\r\n}\r\n\r\nfunction isStoredCredential(value: unknown): value is StoredCredential {\r\n  if (!value || typeof value !== \"object\") return false;\r\n  const credential = value as Partial<StoredCredential>;\r\n  return typeof credential.token === \"string\"\r\n    && credential.token.length > 0\r\n    && typeof credential.createdAt === \"string\"\r\n    && typeof credential.expiresAt === \"string\"\r\n    && Boolean(credential.organization)\r\n    && typeof credential.organization?.id === \"string\"\r\n    && typeof credential.organization?.name === \"string\";\r\n}\r\n\r\nfunction readStore(env: Record<string, string | undefined>): CredentialStore {\r\n  const path = credentialStorePath(env);\r\n  if (!existsSync(path)) return { version: 1, credentials: {} };\r\n\r\n  let parsed: unknown;\r\n  try {\r\n    parsed = JSON.parse(readFileSync(path, \"utf8\"));\r\n  } catch {\r\n    throw new TypeError(`Rolino could not read its credential store at ${path}.`);\r\n  }\r\n  if (!parsed || typeof parsed !== \"object\") {\r\n    throw new TypeError(`Rolino's credential store at ${path} is invalid.`);\r\n  }\r\n  const candidate = parsed as Partial<CredentialStore>;\r\n  if (\r\n    candidate.version !== 1\r\n    || !candidate.credentials\r\n    || typeof candidate.credentials !== \"object\"\r\n    || !Object.values(candidate.credentials).every(isStoredCredential)\r\n  ) {\r\n    throw new TypeError(`Rolino's credential store at ${path} is invalid.`);\r\n  }\r\n  return candidate as CredentialStore;\r\n}\r\n\r\nfunction writeStore(\r\n  store: CredentialStore,\r\n  env: Record<string, string | undefined>,\r\n) {\r\n  const path = credentialStorePath(env);\r\n  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });\r\n  writeFileSync(path, `${JSON.stringify(store, null, 2)}\\n`, {\r\n    encoding: \"utf8\",\r\n    mode: 0o600,\r\n  });\r\n  chmodSync(path, 0o600);\r\n}\r\n\r\nexport function loadStoredCredential(\r\n  baseUrl: string,\r\n  env: Record<string, string | undefined> = process.env,\r\n) {\r\n  return readStore(env).credentials[normalizeRolinoBaseUrl(baseUrl)] ?? null;\r\n}\r\n\r\nexport function saveStoredCredential(\r\n  baseUrl: string,\r\n  credential: StoredCredential,\r\n  env: Record<string, string | undefined> = process.env,\r\n) {\r\n  const store = readStore(env);\r\n  store.credentials[normalizeRolinoBaseUrl(baseUrl)] = credential;\r\n  writeStore(store, env);\r\n  return credentialStorePath(env);\r\n}\r\n\r\nexport function clearStoredCredential(\r\n  baseUrl: string,\r\n  env: Record<string, string | undefined> = process.env,\r\n) {\r\n  const path = credentialStorePath(env);\r\n  const store = readStore(env);\r\n  const key = normalizeRolinoBaseUrl(baseUrl);\r\n  const existed = Boolean(store.credentials[key]);\r\n  delete store.credentials[key];\r\n\r\n  if (Object.keys(store.credentials).length === 0) {\r\n    if (existsSync(path)) unlinkSync(path);\r\n  } else {\r\n    writeStore(store, env);\r\n  }\r\n  return existed;\r\n}\r\n\r\nexport function resolveCredential(\r\n  baseUrl: string,\r\n  env: Record<string, string | undefined> = process.env,\r\n) {\r\n  if (env.ROLINO_TOKEN) {\r\n    return { source: \"environment\" as const, token: env.ROLINO_TOKEN };\r\n  }\r\n  const stored = loadStoredCredential(baseUrl, env);\r\n  return stored\r\n    ? { source: \"stored\" as const, token: stored.token, credential: stored }\r\n    : { source: \"none\" as const, token: null };\r\n}\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qBAOO;AACP,qBAAwB;AACxB,uBAA8B;AAE9B,iBAAuC;AAcvC,SAAS,uBAAuB,KAAyC;AACvE,MAAI,IAAI,kBAAmB,QAAO,IAAI;AACtC,MAAI,QAAQ,aAAa,WAAW,IAAI,SAAS;AAC/C,eAAO,uBAAK,IAAI,SAAS,QAAQ;AAAA,EACnC;AACA,MAAI,QAAQ,aAAa,UAAU;AACjC,eAAO,2BAAK,wBAAQ,GAAG,WAAW,uBAAuB,QAAQ;AAAA,EACnE;AACA,aAAO,uBAAK,IAAI,uBAAmB,2BAAK,wBAAQ,GAAG,SAAS,GAAG,QAAQ;AACzE;AAEO,SAAS,oBACd,MAA0C,QAAQ,KAClD;AACA,aAAO,uBAAK,uBAAuB,GAAG,GAAG,kBAAkB;AAC7D;AAEA,SAAS,mBAAmB,OAA2C;AACrE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,aAAa;AACnB,SAAO,OAAO,WAAW,UAAU,YAC9B,WAAW,MAAM,SAAS,KAC1B,OAAO,WAAW,cAAc,YAChC,OAAO,WAAW,cAAc,YAChC,QAAQ,WAAW,YAAY,KAC/B,OAAO,WAAW,cAAc,OAAO,YACvC,OAAO,WAAW,cAAc,SAAS;AAChD;AAEA,SAAS,UAAU,KAA0D;AAC3E,QAAM,OAAO,oBAAoB,GAAG;AACpC,MAAI,KAAC,2BAAW,IAAI,EAAG,QAAO,EAAE,SAAS,GAAG,aAAa,CAAC,EAAE;AAE5D,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,UAAM,6BAAa,MAAM,MAAM,CAAC;AAAA,EAChD,QAAQ;AACN,UAAM,IAAI,UAAU,iDAAiD,IAAI,GAAG;AAAA,EAC9E;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,UAAU;AACzC,UAAM,IAAI,UAAU,gCAAgC,IAAI,cAAc;AAAA,EACxE;AACA,QAAM,YAAY;AAClB,MACE,UAAU,YAAY,KACnB,CAAC,UAAU,eACX,OAAO,UAAU,gBAAgB,YACjC,CAAC,OAAO,OAAO,UAAU,WAAW,EAAE,MAAM,kBAAkB,GACjE;AACA,UAAM,IAAI,UAAU,gCAAgC,IAAI,cAAc;AAAA,EACxE;AACA,SAAO;AACT;AAEA,SAAS,WACP,OACA,KACA;AACA,QAAM,OAAO,oBAAoB,GAAG;AACpC,oCAAU,0BAAQ,IAAI,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACzD,oCAAc,MAAM,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,GAAM;AAAA,IACzD,UAAU;AAAA,IACV,MAAM;AAAA,EACR,CAAC;AACD,gCAAU,MAAM,GAAK;AACvB;AAEO,SAAS,qBACd,SACA,MAA0C,QAAQ,KAClD;AACA,SAAO,UAAU,GAAG,EAAE,gBAAY,mCAAuB,OAAO,CAAC,KAAK;AACxE;AAEO,SAAS,qBACd,SACA,YACA,MAA0C,QAAQ,KAClD;AACA,QAAM,QAAQ,UAAU,GAAG;AAC3B,QAAM,gBAAY,mCAAuB,OAAO,CAAC,IAAI;AACrD,aAAW,OAAO,GAAG;AACrB,SAAO,oBAAoB,GAAG;AAChC;AAEO,SAAS,sBACd,SACA,MAA0C,QAAQ,KAClD;AACA,QAAM,OAAO,oBAAoB,GAAG;AACpC,QAAM,QAAQ,UAAU,GAAG;AAC3B,QAAM,UAAM,mCAAuB,OAAO;AAC1C,QAAM,UAAU,QAAQ,MAAM,YAAY,GAAG,CAAC;AAC9C,SAAO,MAAM,YAAY,GAAG;AAE5B,MAAI,OAAO,KAAK,MAAM,WAAW,EAAE,WAAW,GAAG;AAC/C,YAAI,2BAAW,IAAI,EAAG,gCAAW,IAAI;AAAA,EACvC,OAAO;AACL,eAAW,OAAO,GAAG;AAAA,EACvB;AACA,SAAO;AACT;AAEO,SAAS,kBACd,SACA,MAA0C,QAAQ,KAClD;AACA,MAAI,IAAI,cAAc;AACpB,WAAO,EAAE,QAAQ,eAAwB,OAAO,IAAI,aAAa;AAAA,EACnE;AACA,QAAM,SAAS,qBAAqB,SAAS,GAAG;AAChD,SAAO,SACH,EAAE,QAAQ,UAAmB,OAAO,OAAO,OAAO,YAAY,OAAO,IACrE,EAAE,QAAQ,QAAiB,OAAO,KAAK;AAC7C;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import {\n  chmodSync,\n  existsSync,\n  mkdirSync,\n  readFileSync,\n  renameSync,\n  unlinkSync,\n  writeFileSync,\n} from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\n\nimport { normalizeRolinoBaseUrl } from \"@rolino/sdk\";\n\nexport const ROLINO_CLI_OAUTH_CLIENT_ID = \"rolino-cli\";\n\nexport type OAuthTokenSet = {\n  host: string;\n  issuer: string;\n  clientId: string;\n  resource: string;\n  accessToken: string;\n  accessTokenExpiresAt: string;\n  refreshToken: string;\n  refreshTokenExpiresAt: string;\n  scopes: string[];\n};\n\ntype OAuthTokenStore = {\n  version: 2;\n  tokens: Record<string, OAuthTokenSet>;\n};\n\ntype RefreshableTokenProvider = (() => Promise<string | undefined>) & {\n  refresh: () => Promise<string | undefined>;\n};\n\nconst refreshLocks = new Map<string, Promise<OAuthTokenSet>>();\n\nfunction defaultConfigDirectory(env: Record<string, string | undefined>) {\n  if (env.ROLINO_CONFIG_DIR) return env.ROLINO_CONFIG_DIR;\n  if (process.platform === \"win32\" && env.APPDATA) return join(env.APPDATA, \"Rolino\");\n  if (process.platform === \"darwin\") return join(homedir(), \"Library\", \"Application Support\", \"Rolino\");\n  return join(env.XDG_CONFIG_HOME ?? join(homedir(), \".config\"), \"rolino\");\n}\n\nexport function oauthTokenStorePath(\n  env: Record<string, string | undefined> = process.env,\n) {\n  return join(defaultConfigDirectory(env), \"oauth-tokens.json\");\n}\n\nexport function oauthConfiguration(baseUrl: string) {\n  const host = normalizeRolinoBaseUrl(baseUrl);\n  return {\n    host,\n    issuer: `${host}/api/auth`,\n    clientId: ROLINO_CLI_OAUTH_CLIENT_ID,\n    resource: `${host}/api/v1`,\n  };\n}\n\nfunction tokenKey(input: Pick<OAuthTokenSet, \"host\" | \"issuer\" | \"clientId\" | \"resource\">) {\n  return JSON.stringify([input.host, input.issuer, input.clientId, input.resource]);\n}\n\nfunction isTokenSet(value: unknown): value is OAuthTokenSet {\n  if (!value || typeof value !== \"object\") return false;\n  const token = value as Partial<OAuthTokenSet>;\n  return [token.host, token.issuer, token.clientId, token.resource, token.accessToken,\n    token.accessTokenExpiresAt, token.refreshToken, token.refreshTokenExpiresAt]\n    .every((item) => typeof item === \"string\" && item.length > 0)\n    && Array.isArray(token.scopes)\n    && token.scopes.every((scope) => typeof scope === \"string\");\n}\n\nfunction readStore(env: Record<string, string | undefined>): OAuthTokenStore {\n  const path = oauthTokenStorePath(env);\n  if (!existsSync(path)) return { version: 2, tokens: {} };\n  try {\n    const parsed = JSON.parse(readFileSync(path, \"utf8\")) as Partial<OAuthTokenStore>;\n    if (\n      parsed.version !== 2\n      || !parsed.tokens\n      || typeof parsed.tokens !== \"object\"\n      || !Object.values(parsed.tokens).every(isTokenSet)\n    ) throw new Error(\"invalid\");\n    return parsed as OAuthTokenStore;\n  } catch {\n    throw new TypeError(`Rolino could not read its OAuth token store at ${path}.`);\n  }\n}\n\nfunction writeStore(store: OAuthTokenStore, env: Record<string, string | undefined>) {\n  const path = oauthTokenStorePath(env);\n  const temporary = `${path}.${process.pid}.tmp`;\n  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });\n  writeFileSync(temporary, `${JSON.stringify(store, null, 2)}\\n`, {\n    encoding: \"utf8\",\n    mode: 0o600,\n  });\n  chmodSync(temporary, 0o600);\n  renameSync(temporary, path);\n  chmodSync(path, 0o600);\n  return path;\n}\n\nexport function loadOAuthTokenSet(\n  baseUrl: string,\n  env: Record<string, string | undefined> = process.env,\n) {\n  const configuration = oauthConfiguration(baseUrl);\n  return readStore(env).tokens[tokenKey(configuration)] ?? null;\n}\n\nexport function saveOAuthTokenSet(\n  tokenSet: OAuthTokenSet,\n  env: Record<string, string | undefined> = process.env,\n) {\n  const configuration = oauthConfiguration(tokenSet.host);\n  if (\n    tokenSet.host !== configuration.host\n    || tokenSet.issuer !== configuration.issuer\n    || tokenSet.clientId !== configuration.clientId\n    || tokenSet.resource !== configuration.resource\n  ) throw new TypeError(\"The OAuth token set does not match the Rolino host.\");\n  const store = readStore(env);\n  store.tokens[tokenKey(tokenSet)] = tokenSet;\n  const path = writeStore(store, env);\n  const retiredInteractiveCredential = join(defaultConfigDirectory(env), \"credentials.json\");\n  if (existsSync(retiredInteractiveCredential)) unlinkSync(retiredInteractiveCredential);\n  return path;\n}\n\nexport function clearOAuthTokenSet(\n  baseUrl: string,\n  env: Record<string, string | undefined> = process.env,\n) {\n  const path = oauthTokenStorePath(env);\n  const store = readStore(env);\n  const key = tokenKey(oauthConfiguration(baseUrl));\n  const existed = Boolean(store.tokens[key]);\n  delete store.tokens[key];\n  if (!Object.keys(store.tokens).length) {\n    if (existsSync(path)) unlinkSync(path);\n  } else {\n    writeStore(store, env);\n  }\n  return existed;\n}\n\nasync function refreshOAuthTokenSet(options: {\n  baseUrl: string;\n  env: Record<string, string | undefined>;\n  fetch: typeof globalThis.fetch;\n}) {\n  const current = loadOAuthTokenSet(options.baseUrl, options.env);\n  if (!current) throw new TypeError(\"OAuth sign-in is required. Run `rolino auth login`.\");\n  const key = tokenKey(current);\n  const existing = refreshLocks.get(key);\n  if (existing) return existing;\n\n  const refresh = (async () => {\n    const body = new URLSearchParams({\n      grant_type: \"refresh_token\",\n      refresh_token: current.refreshToken,\n      client_id: current.clientId,\n      resource: current.resource,\n    });\n    const response = await options.fetch(`${current.issuer}/oauth2/token`, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/x-www-form-urlencoded\", accept: \"application/json\" },\n      body,\n    });\n    const payload = await response.json().catch(() => null) as Record<string, unknown> | null;\n    if (!response.ok || !payload || typeof payload.access_token !== \"string\") {\n      throw new TypeError(\"OAuth sign-in is required. Run `rolino auth login`.\");\n    }\n    const expiresIn = typeof payload.expires_in === \"number\" ? payload.expires_in : 300;\n    const refreshed: OAuthTokenSet = {\n      ...current,\n      accessToken: payload.access_token,\n      accessTokenExpiresAt: new Date(Date.now() + expiresIn * 1_000).toISOString(),\n      refreshToken: typeof payload.refresh_token === \"string\" ? payload.refresh_token : current.refreshToken,\n      scopes: typeof payload.scope === \"string\" ? payload.scope.split(/\\s+/).filter(Boolean) : current.scopes,\n    };\n    saveOAuthTokenSet(refreshed, options.env);\n    return refreshed;\n  })().finally(() => refreshLocks.delete(key));\n  refreshLocks.set(key, refresh);\n  return refresh;\n}\n\nexport function createOAuthAccessTokenProvider(options: {\n  baseUrl: string;\n  env?: Record<string, string | undefined>;\n  fetch?: typeof globalThis.fetch;\n}): RefreshableTokenProvider {\n  const env = options.env ?? process.env;\n  const fetchImplementation = options.fetch ?? globalThis.fetch;\n  const obtain = async (force: boolean) => {\n    if (env.ROLINO_TOKEN) return env.ROLINO_TOKEN;\n    const token = loadOAuthTokenSet(options.baseUrl, env);\n    if (!token) return undefined;\n    if (!force && Date.parse(token.accessTokenExpiresAt) - Date.now() > 30_000) {\n      return token.accessToken;\n    }\n    return (await refreshOAuthTokenSet({\n      baseUrl: options.baseUrl,\n      env,\n      fetch: fetchImplementation,\n    })).accessToken;\n  };\n  const provider = (() => obtain(false)) as RefreshableTokenProvider;\n  provider.refresh = () => obtain(true);\n  return provider;\n}\n\nexport function resolveLocalAuthentication(\n  baseUrl: string,\n  env: Record<string, string | undefined> = process.env,\n) {\n  if (env.ROLINO_TOKEN) return { source: \"environment\" as const, tokenSet: null };\n  const tokenSet = loadOAuthTokenSet(baseUrl, env);\n  return tokenSet\n    ? { source: \"oauth\" as const, tokenSet }\n    : { source: \"none\" as const, tokenSet: null };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qBAQO;AACP,qBAAwB;AACxB,uBAA8B;AAE9B,iBAAuC;AAEhC,IAAM,6BAA6B;AAuB1C,IAAM,eAAe,oBAAI,IAAoC;AAE7D,SAAS,uBAAuB,KAAyC;AACvE,MAAI,IAAI,kBAAmB,QAAO,IAAI;AACtC,MAAI,QAAQ,aAAa,WAAW,IAAI,QAAS,YAAO,uBAAK,IAAI,SAAS,QAAQ;AAClF,MAAI,QAAQ,aAAa,SAAU,YAAO,2BAAK,wBAAQ,GAAG,WAAW,uBAAuB,QAAQ;AACpG,aAAO,uBAAK,IAAI,uBAAmB,2BAAK,wBAAQ,GAAG,SAAS,GAAG,QAAQ;AACzE;AAEO,SAAS,oBACd,MAA0C,QAAQ,KAClD;AACA,aAAO,uBAAK,uBAAuB,GAAG,GAAG,mBAAmB;AAC9D;AAEO,SAAS,mBAAmB,SAAiB;AAClD,QAAM,WAAO,mCAAuB,OAAO;AAC3C,SAAO;AAAA,IACL;AAAA,IACA,QAAQ,GAAG,IAAI;AAAA,IACf,UAAU;AAAA,IACV,UAAU,GAAG,IAAI;AAAA,EACnB;AACF;AAEA,SAAS,SAAS,OAAyE;AACzF,SAAO,KAAK,UAAU,CAAC,MAAM,MAAM,MAAM,QAAQ,MAAM,UAAU,MAAM,QAAQ,CAAC;AAClF;AAEA,SAAS,WAAW,OAAwC;AAC1D,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,QAAQ;AACd,SAAO;AAAA,IAAC,MAAM;AAAA,IAAM,MAAM;AAAA,IAAQ,MAAM;AAAA,IAAU,MAAM;AAAA,IAAU,MAAM;AAAA,IACtE,MAAM;AAAA,IAAsB,MAAM;AAAA,IAAc,MAAM;AAAA,EAAqB,EAC1E,MAAM,CAAC,SAAS,OAAO,SAAS,YAAY,KAAK,SAAS,CAAC,KACzD,MAAM,QAAQ,MAAM,MAAM,KAC1B,MAAM,OAAO,MAAM,CAAC,UAAU,OAAO,UAAU,QAAQ;AAC9D;AAEA,SAAS,UAAU,KAA0D;AAC3E,QAAM,OAAO,oBAAoB,GAAG;AACpC,MAAI,KAAC,2BAAW,IAAI,EAAG,QAAO,EAAE,SAAS,GAAG,QAAQ,CAAC,EAAE;AACvD,MAAI;AACF,UAAM,SAAS,KAAK,UAAM,6BAAa,MAAM,MAAM,CAAC;AACpD,QACE,OAAO,YAAY,KAChB,CAAC,OAAO,UACR,OAAO,OAAO,WAAW,YACzB,CAAC,OAAO,OAAO,OAAO,MAAM,EAAE,MAAM,UAAU,EACjD,OAAM,IAAI,MAAM,SAAS;AAC3B,WAAO;AAAA,EACT,QAAQ;AACN,UAAM,IAAI,UAAU,kDAAkD,IAAI,GAAG;AAAA,EAC/E;AACF;AAEA,SAAS,WAAW,OAAwB,KAAyC;AACnF,QAAM,OAAO,oBAAoB,GAAG;AACpC,QAAM,YAAY,GAAG,IAAI,IAAI,QAAQ,GAAG;AACxC,oCAAU,0BAAQ,IAAI,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACzD,oCAAc,WAAW,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,GAAM;AAAA,IAC9D,UAAU;AAAA,IACV,MAAM;AAAA,EACR,CAAC;AACD,gCAAU,WAAW,GAAK;AAC1B,iCAAW,WAAW,IAAI;AAC1B,gCAAU,MAAM,GAAK;AACrB,SAAO;AACT;AAEO,SAAS,kBACd,SACA,MAA0C,QAAQ,KAClD;AACA,QAAM,gBAAgB,mBAAmB,OAAO;AAChD,SAAO,UAAU,GAAG,EAAE,OAAO,SAAS,aAAa,CAAC,KAAK;AAC3D;AAEO,SAAS,kBACd,UACA,MAA0C,QAAQ,KAClD;AACA,QAAM,gBAAgB,mBAAmB,SAAS,IAAI;AACtD,MACE,SAAS,SAAS,cAAc,QAC7B,SAAS,WAAW,cAAc,UAClC,SAAS,aAAa,cAAc,YACpC,SAAS,aAAa,cAAc,SACvC,OAAM,IAAI,UAAU,qDAAqD;AAC3E,QAAM,QAAQ,UAAU,GAAG;AAC3B,QAAM,OAAO,SAAS,QAAQ,CAAC,IAAI;AACnC,QAAM,OAAO,WAAW,OAAO,GAAG;AAClC,QAAM,mCAA+B,uBAAK,uBAAuB,GAAG,GAAG,kBAAkB;AACzF,UAAI,2BAAW,4BAA4B,EAAG,gCAAW,4BAA4B;AACrF,SAAO;AACT;AAEO,SAAS,mBACd,SACA,MAA0C,QAAQ,KAClD;AACA,QAAM,OAAO,oBAAoB,GAAG;AACpC,QAAM,QAAQ,UAAU,GAAG;AAC3B,QAAM,MAAM,SAAS,mBAAmB,OAAO,CAAC;AAChD,QAAM,UAAU,QAAQ,MAAM,OAAO,GAAG,CAAC;AACzC,SAAO,MAAM,OAAO,GAAG;AACvB,MAAI,CAAC,OAAO,KAAK,MAAM,MAAM,EAAE,QAAQ;AACrC,YAAI,2BAAW,IAAI,EAAG,gCAAW,IAAI;AAAA,EACvC,OAAO;AACL,eAAW,OAAO,GAAG;AAAA,EACvB;AACA,SAAO;AACT;AAEA,eAAe,qBAAqB,SAIjC;AACD,QAAM,UAAU,kBAAkB,QAAQ,SAAS,QAAQ,GAAG;AAC9D,MAAI,CAAC,QAAS,OAAM,IAAI,UAAU,qDAAqD;AACvF,QAAM,MAAM,SAAS,OAAO;AAC5B,QAAM,WAAW,aAAa,IAAI,GAAG;AACrC,MAAI,SAAU,QAAO;AAErB,QAAM,WAAW,YAAY;AAC3B,UAAM,OAAO,IAAI,gBAAgB;AAAA,MAC/B,YAAY;AAAA,MACZ,eAAe,QAAQ;AAAA,MACvB,WAAW,QAAQ;AAAA,MACnB,UAAU,QAAQ;AAAA,IACpB,CAAC;AACD,UAAM,WAAW,MAAM,QAAQ,MAAM,GAAG,QAAQ,MAAM,iBAAiB;AAAA,MACrE,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,qCAAqC,QAAQ,mBAAmB;AAAA,MAC3F;AAAA,IACF,CAAC;AACD,UAAM,UAAU,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,IAAI;AACtD,QAAI,CAAC,SAAS,MAAM,CAAC,WAAW,OAAO,QAAQ,iBAAiB,UAAU;AACxE,YAAM,IAAI,UAAU,qDAAqD;AAAA,IAC3E;AACA,UAAM,YAAY,OAAO,QAAQ,eAAe,WAAW,QAAQ,aAAa;AAChF,UAAM,YAA2B;AAAA,MAC/B,GAAG;AAAA,MACH,aAAa,QAAQ;AAAA,MACrB,sBAAsB,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAK,EAAE,YAAY;AAAA,MAC3E,cAAc,OAAO,QAAQ,kBAAkB,WAAW,QAAQ,gBAAgB,QAAQ;AAAA,MAC1F,QAAQ,OAAO,QAAQ,UAAU,WAAW,QAAQ,MAAM,MAAM,KAAK,EAAE,OAAO,OAAO,IAAI,QAAQ;AAAA,IACnG;AACA,sBAAkB,WAAW,QAAQ,GAAG;AACxC,WAAO;AAAA,EACT,GAAG,EAAE,QAAQ,MAAM,aAAa,OAAO,GAAG,CAAC;AAC3C,eAAa,IAAI,KAAK,OAAO;AAC7B,SAAO;AACT;AAEO,SAAS,+BAA+B,SAIlB;AAC3B,QAAM,MAAM,QAAQ,OAAO,QAAQ;AACnC,QAAM,sBAAsB,QAAQ,SAAS,WAAW;AACxD,QAAM,SAAS,OAAO,UAAmB;AACvC,QAAI,IAAI,aAAc,QAAO,IAAI;AACjC,UAAM,QAAQ,kBAAkB,QAAQ,SAAS,GAAG;AACpD,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,CAAC,SAAS,KAAK,MAAM,MAAM,oBAAoB,IAAI,KAAK,IAAI,IAAI,KAAQ;AAC1E,aAAO,MAAM;AAAA,IACf;AACA,YAAQ,MAAM,qBAAqB;AAAA,MACjC,SAAS,QAAQ;AAAA,MACjB;AAAA,MACA,OAAO;AAAA,IACT,CAAC,GAAG;AAAA,EACN;AACA,QAAM,YAAY,MAAM,OAAO,KAAK;AACpC,WAAS,UAAU,MAAM,OAAO,IAAI;AACpC,SAAO;AACT;AAEO,SAAS,2BACd,SACA,MAA0C,QAAQ,KAClD;AACA,MAAI,IAAI,aAAc,QAAO,EAAE,QAAQ,eAAwB,UAAU,KAAK;AAC9E,QAAM,WAAW,kBAAkB,SAAS,GAAG;AAC/C,SAAO,WACH,EAAE,QAAQ,SAAkB,SAAS,IACrC,EAAE,QAAQ,QAAiB,UAAU,KAAK;AAChD;","names":[]}

package/dist/index.d.cts

@@ -1,28 +1,42 @@
-type StoredCredential = {
-    token: string;
-    createdAt: string;
-    expiresAt: string;
-    organization: {
-        id: string;
-        name: string;
-    };
+declare const ROLINO_CLI_OAUTH_CLIENT_ID = "rolino-cli";
+type OAuthTokenSet = {
+    host: string;
+    issuer: string;
+    clientId: string;
+    resource: string;
+    accessToken: string;
+    accessTokenExpiresAt: string;
+    refreshToken: string;
+    refreshTokenExpiresAt: string;
+    scopes: string[];
 };
-declare function credentialStorePath(env?: Record<string, string | undefined>): string;
-declare function loadStoredCredential(baseUrl: string, env?: Record<string, string | undefined>): StoredCredential | null;
-declare function saveStoredCredential(baseUrl: string, credential: StoredCredential, env?: Record<string, string | undefined>): string;
-declare function clearStoredCredential(baseUrl: string, env?: Record<string, string | undefined>): boolean;
-declare function resolveCredential(baseUrl: string, env?: Record<string, string | undefined>): {
+type RefreshableTokenProvider = (() => Promise<string | undefined>) & {
+    refresh: () => Promise<string | undefined>;
+};
+declare function oauthTokenStorePath(env?: Record<string, string | undefined>): string;
+declare function oauthConfiguration(baseUrl: string): {
+    host: string;
+    issuer: string;
+    clientId: string;
+    resource: string;
+};
+declare function loadOAuthTokenSet(baseUrl: string, env?: Record<string, string | undefined>): OAuthTokenSet | null;
+declare function saveOAuthTokenSet(tokenSet: OAuthTokenSet, env?: Record<string, string | undefined>): string;
+declare function clearOAuthTokenSet(baseUrl: string, env?: Record<string, string | undefined>): boolean;
+declare function createOAuthAccessTokenProvider(options: {
+    baseUrl: string;
+    env?: Record<string, string | undefined>;
+    fetch?: typeof globalThis.fetch;
+}): RefreshableTokenProvider;
+declare function resolveLocalAuthentication(baseUrl: string, env?: Record<string, string | undefined>): {
     source: "environment";
-    token: string;
-    credential?: undefined;
+    tokenSet: null;
 } | {
-    source: "stored";
-    token: string;
-    credential: StoredCredential;
+    source: "oauth";
+    tokenSet: OAuthTokenSet;
 } | {
     source: "none";
-    token: null;
-    credential?: undefined;
+    tokenSet: null;
 };
 
-export { type StoredCredential, clearStoredCredential, credentialStorePath, loadStoredCredential, resolveCredential, saveStoredCredential };
+export { type OAuthTokenSet, ROLINO_CLI_OAUTH_CLIENT_ID, clearOAuthTokenSet, createOAuthAccessTokenProvider, loadOAuthTokenSet, oauthConfiguration, oauthTokenStorePath, resolveLocalAuthentication, saveOAuthTokenSet };

package/dist/index.d.ts

@@ -1,28 +1,42 @@
-type StoredCredential = {
-    token: string;
-    createdAt: string;
-    expiresAt: string;
-    organization: {
-        id: string;
-        name: string;
-    };
+declare const ROLINO_CLI_OAUTH_CLIENT_ID = "rolino-cli";
+type OAuthTokenSet = {
+    host: string;
+    issuer: string;
+    clientId: string;
+    resource: string;
+    accessToken: string;
+    accessTokenExpiresAt: string;
+    refreshToken: string;
+    refreshTokenExpiresAt: string;
+    scopes: string[];
 };
-declare function credentialStorePath(env?: Record<string, string | undefined>): string;
-declare function loadStoredCredential(baseUrl: string, env?: Record<string, string | undefined>): StoredCredential | null;
-declare function saveStoredCredential(baseUrl: string, credential: StoredCredential, env?: Record<string, string | undefined>): string;
-declare function clearStoredCredential(baseUrl: string, env?: Record<string, string | undefined>): boolean;
-declare function resolveCredential(baseUrl: string, env?: Record<string, string | undefined>): {
+type RefreshableTokenProvider = (() => Promise<string | undefined>) & {
+    refresh: () => Promise<string | undefined>;
+};
+declare function oauthTokenStorePath(env?: Record<string, string | undefined>): string;
+declare function oauthConfiguration(baseUrl: string): {
+    host: string;
+    issuer: string;
+    clientId: string;
+    resource: string;
+};
+declare function loadOAuthTokenSet(baseUrl: string, env?: Record<string, string | undefined>): OAuthTokenSet | null;
+declare function saveOAuthTokenSet(tokenSet: OAuthTokenSet, env?: Record<string, string | undefined>): string;
+declare function clearOAuthTokenSet(baseUrl: string, env?: Record<string, string | undefined>): boolean;
+declare function createOAuthAccessTokenProvider(options: {
+    baseUrl: string;
+    env?: Record<string, string | undefined>;
+    fetch?: typeof globalThis.fetch;
+}): RefreshableTokenProvider;
+declare function resolveLocalAuthentication(baseUrl: string, env?: Record<string, string | undefined>): {
     source: "environment";
-    token: string;
-    credential?: undefined;
+    tokenSet: null;
 } | {
-    source: "stored";
-    token: string;
-    credential: StoredCredential;
+    source: "oauth";
+    tokenSet: OAuthTokenSet;
 } | {
     source: "none";
-    token: null;
-    credential?: undefined;
+    tokenSet: null;
 };
 
-export { type StoredCredential, clearStoredCredential, credentialStorePath, loadStoredCredential, resolveCredential, saveStoredCredential };
+export { type OAuthTokenSet, ROLINO_CLI_OAUTH_CLIENT_ID, clearOAuthTokenSet, createOAuthAccessTokenProvider, loadOAuthTokenSet, oauthConfiguration, oauthTokenStorePath, resolveLocalAuthentication, saveOAuthTokenSet };

package/dist/index.js

@@ -4,92 +4,171 @@ import {
   existsSync,
   mkdirSync,
   readFileSync,
+  renameSync,
   unlinkSync,
   writeFileSync
 } from "fs";
 import { homedir } from "os";
 import { dirname, join } from "path";
 import { normalizeRolinoBaseUrl } from "@rolino/sdk";
+var ROLINO_CLI_OAUTH_CLIENT_ID = "rolino-cli";
+var refreshLocks = /* @__PURE__ */ new Map();
 function defaultConfigDirectory(env) {
   if (env.ROLINO_CONFIG_DIR) return env.ROLINO_CONFIG_DIR;
-  if (process.platform === "win32" && env.APPDATA) {
-    return join(env.APPDATA, "Rolino");
-  }
-  if (process.platform === "darwin") {
-    return join(homedir(), "Library", "Application Support", "Rolino");
-  }
+  if (process.platform === "win32" && env.APPDATA) return join(env.APPDATA, "Rolino");
+  if (process.platform === "darwin") return join(homedir(), "Library", "Application Support", "Rolino");
   return join(env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "rolino");
 }
-function credentialStorePath(env = process.env) {
-  return join(defaultConfigDirectory(env), "credentials.json");
+function oauthTokenStorePath(env = process.env) {
+  return join(defaultConfigDirectory(env), "oauth-tokens.json");
+}
+function oauthConfiguration(baseUrl) {
+  const host = normalizeRolinoBaseUrl(baseUrl);
+  return {
+    host,
+    issuer: `${host}/api/auth`,
+    clientId: ROLINO_CLI_OAUTH_CLIENT_ID,
+    resource: `${host}/api/v1`
+  };
 }
-function isStoredCredential(value) {
+function tokenKey(input) {
+  return JSON.stringify([input.host, input.issuer, input.clientId, input.resource]);
+}
+function isTokenSet(value) {
   if (!value || typeof value !== "object") return false;
-  const credential = value;
-  return typeof credential.token === "string" && credential.token.length > 0 && typeof credential.createdAt === "string" && typeof credential.expiresAt === "string" && Boolean(credential.organization) && typeof credential.organization?.id === "string" && typeof credential.organization?.name === "string";
+  const token = value;
+  return [
+    token.host,
+    token.issuer,
+    token.clientId,
+    token.resource,
+    token.accessToken,
+    token.accessTokenExpiresAt,
+    token.refreshToken,
+    token.refreshTokenExpiresAt
+  ].every((item) => typeof item === "string" && item.length > 0) && Array.isArray(token.scopes) && token.scopes.every((scope) => typeof scope === "string");
 }
 function readStore(env) {
-  const path = credentialStorePath(env);
-  if (!existsSync(path)) return { version: 1, credentials: {} };
-  let parsed;
+  const path = oauthTokenStorePath(env);
+  if (!existsSync(path)) return { version: 2, tokens: {} };
   try {
-    parsed = JSON.parse(readFileSync(path, "utf8"));
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    if (parsed.version !== 2 || !parsed.tokens || typeof parsed.tokens !== "object" || !Object.values(parsed.tokens).every(isTokenSet)) throw new Error("invalid");
+    return parsed;
   } catch {
-    throw new TypeError(`Rolino could not read its credential store at ${path}.`);
-  }
-  if (!parsed || typeof parsed !== "object") {
-    throw new TypeError(`Rolino's credential store at ${path} is invalid.`);
+    throw new TypeError(`Rolino could not read its OAuth token store at ${path}.`);
   }
-  const candidate = parsed;
-  if (candidate.version !== 1 || !candidate.credentials || typeof candidate.credentials !== "object" || !Object.values(candidate.credentials).every(isStoredCredential)) {
-    throw new TypeError(`Rolino's credential store at ${path} is invalid.`);
-  }
-  return candidate;
 }
 function writeStore(store, env) {
-  const path = credentialStorePath(env);
+  const path = oauthTokenStorePath(env);
+  const temporary = `${path}.${process.pid}.tmp`;
   mkdirSync(dirname(path), { recursive: true, mode: 448 });
-  writeFileSync(path, `${JSON.stringify(store, null, 2)}
+  writeFileSync(temporary, `${JSON.stringify(store, null, 2)}
 `, {
     encoding: "utf8",
     mode: 384
   });
+  chmodSync(temporary, 384);
+  renameSync(temporary, path);
   chmodSync(path, 384);
+  return path;
 }
-function loadStoredCredential(baseUrl, env = process.env) {
-  return readStore(env).credentials[normalizeRolinoBaseUrl(baseUrl)] ?? null;
+function loadOAuthTokenSet(baseUrl, env = process.env) {
+  const configuration = oauthConfiguration(baseUrl);
+  return readStore(env).tokens[tokenKey(configuration)] ?? null;
 }
-function saveStoredCredential(baseUrl, credential, env = process.env) {
+function saveOAuthTokenSet(tokenSet, env = process.env) {
+  const configuration = oauthConfiguration(tokenSet.host);
+  if (tokenSet.host !== configuration.host || tokenSet.issuer !== configuration.issuer || tokenSet.clientId !== configuration.clientId || tokenSet.resource !== configuration.resource) throw new TypeError("The OAuth token set does not match the Rolino host.");
   const store = readStore(env);
-  store.credentials[normalizeRolinoBaseUrl(baseUrl)] = credential;
-  writeStore(store, env);
-  return credentialStorePath(env);
+  store.tokens[tokenKey(tokenSet)] = tokenSet;
+  const path = writeStore(store, env);
+  const retiredInteractiveCredential = join(defaultConfigDirectory(env), "credentials.json");
+  if (existsSync(retiredInteractiveCredential)) unlinkSync(retiredInteractiveCredential);
+  return path;
 }
-function clearStoredCredential(baseUrl, env = process.env) {
-  const path = credentialStorePath(env);
+function clearOAuthTokenSet(baseUrl, env = process.env) {
+  const path = oauthTokenStorePath(env);
   const store = readStore(env);
-  const key = normalizeRolinoBaseUrl(baseUrl);
-  const existed = Boolean(store.credentials[key]);
-  delete store.credentials[key];
-  if (Object.keys(store.credentials).length === 0) {
+  const key = tokenKey(oauthConfiguration(baseUrl));
+  const existed = Boolean(store.tokens[key]);
+  delete store.tokens[key];
+  if (!Object.keys(store.tokens).length) {
     if (existsSync(path)) unlinkSync(path);
   } else {
     writeStore(store, env);
   }
   return existed;
 }
-function resolveCredential(baseUrl, env = process.env) {
-  if (env.ROLINO_TOKEN) {
-    return { source: "environment", token: env.ROLINO_TOKEN };
-  }
-  const stored = loadStoredCredential(baseUrl, env);
-  return stored ? { source: "stored", token: stored.token, credential: stored } : { source: "none", token: null };
+async function refreshOAuthTokenSet(options) {
+  const current = loadOAuthTokenSet(options.baseUrl, options.env);
+  if (!current) throw new TypeError("OAuth sign-in is required. Run `rolino auth login`.");
+  const key = tokenKey(current);
+  const existing = refreshLocks.get(key);
+  if (existing) return existing;
+  const refresh = (async () => {
+    const body = new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: current.refreshToken,
+      client_id: current.clientId,
+      resource: current.resource
+    });
+    const response = await options.fetch(`${current.issuer}/oauth2/token`, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+      body
+    });
+    const payload = await response.json().catch(() => null);
+    if (!response.ok || !payload || typeof payload.access_token !== "string") {
+      throw new TypeError("OAuth sign-in is required. Run `rolino auth login`.");
+    }
+    const expiresIn = typeof payload.expires_in === "number" ? payload.expires_in : 300;
+    const refreshed = {
+      ...current,
+      accessToken: payload.access_token,
+      accessTokenExpiresAt: new Date(Date.now() + expiresIn * 1e3).toISOString(),
+      refreshToken: typeof payload.refresh_token === "string" ? payload.refresh_token : current.refreshToken,
+      scopes: typeof payload.scope === "string" ? payload.scope.split(/\s+/).filter(Boolean) : current.scopes
+    };
+    saveOAuthTokenSet(refreshed, options.env);
+    return refreshed;
+  })().finally(() => refreshLocks.delete(key));
+  refreshLocks.set(key, refresh);
+  return refresh;
+}
+function createOAuthAccessTokenProvider(options) {
+  const env = options.env ?? process.env;
+  const fetchImplementation = options.fetch ?? globalThis.fetch;
+  const obtain = async (force) => {
+    if (env.ROLINO_TOKEN) return env.ROLINO_TOKEN;
+    const token = loadOAuthTokenSet(options.baseUrl, env);
+    if (!token) return void 0;
+    if (!force && Date.parse(token.accessTokenExpiresAt) - Date.now() > 3e4) {
+      return token.accessToken;
+    }
+    return (await refreshOAuthTokenSet({
+      baseUrl: options.baseUrl,
+      env,
+      fetch: fetchImplementation
+    })).accessToken;
+  };
+  const provider = (() => obtain(false));
+  provider.refresh = () => obtain(true);
+  return provider;
+}
+function resolveLocalAuthentication(baseUrl, env = process.env) {
+  if (env.ROLINO_TOKEN) return { source: "environment", tokenSet: null };
+  const tokenSet = loadOAuthTokenSet(baseUrl, env);
+  return tokenSet ? { source: "oauth", tokenSet } : { source: "none", tokenSet: null };
 }
 export {
-  clearStoredCredential,
-  credentialStorePath,
-  loadStoredCredential,
-  resolveCredential,
-  saveStoredCredential
+  ROLINO_CLI_OAUTH_CLIENT_ID,
+  clearOAuthTokenSet,
+  createOAuthAccessTokenProvider,
+  loadOAuthTokenSet,
+  oauthConfiguration,
+  oauthTokenStorePath,
+  resolveLocalAuthentication,
+  saveOAuthTokenSet
 };
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import {\r\n  chmodSync,\r\n  existsSync,\r\n  mkdirSync,\r\n  readFileSync,\r\n  unlinkSync,\r\n  writeFileSync,\r\n} from \"node:fs\";\r\nimport { homedir } from \"node:os\";\r\nimport { dirname, join } from \"node:path\";\r\n\r\nimport { normalizeRolinoBaseUrl } from \"@rolino/sdk\";\r\n\r\nexport type StoredCredential = {\r\n  token: string;\r\n  createdAt: string;\r\n  expiresAt: string;\r\n  organization: { id: string; name: string };\r\n};\r\n\r\ntype CredentialStore = {\r\n  version: 1;\r\n  credentials: Record<string, StoredCredential>;\r\n};\r\n\r\nfunction defaultConfigDirectory(env: Record<string, string | undefined>) {\r\n  if (env.ROLINO_CONFIG_DIR) return env.ROLINO_CONFIG_DIR;\r\n  if (process.platform === \"win32\" && env.APPDATA) {\r\n    return join(env.APPDATA, \"Rolino\");\r\n  }\r\n  if (process.platform === \"darwin\") {\r\n    return join(homedir(), \"Library\", \"Application Support\", \"Rolino\");\r\n  }\r\n  return join(env.XDG_CONFIG_HOME ?? join(homedir(), \".config\"), \"rolino\");\r\n}\r\n\r\nexport function credentialStorePath(\r\n  env: Record<string, string | undefined> = process.env,\r\n) {\r\n  return join(defaultConfigDirectory(env), \"credentials.json\");\r\n}\r\n\r\nfunction isStoredCredential(value: unknown): value is StoredCredential {\r\n  if (!value || typeof value !== \"object\") return false;\r\n  const credential = value as Partial<StoredCredential>;\r\n  return typeof credential.token === \"string\"\r\n    && credential.token.length > 0\r\n    && typeof credential.createdAt === \"string\"\r\n    && typeof credential.expiresAt === \"string\"\r\n    && Boolean(credential.organization)\r\n    && typeof credential.organization?.id === \"string\"\r\n    && typeof credential.organization?.name === \"string\";\r\n}\r\n\r\nfunction readStore(env: Record<string, string | undefined>): CredentialStore {\r\n  const path = credentialStorePath(env);\r\n  if (!existsSync(path)) return { version: 1, credentials: {} };\r\n\r\n  let parsed: unknown;\r\n  try {\r\n    parsed = JSON.parse(readFileSync(path, \"utf8\"));\r\n  } catch {\r\n    throw new TypeError(`Rolino could not read its credential store at ${path}.`);\r\n  }\r\n  if (!parsed || typeof parsed !== \"object\") {\r\n    throw new TypeError(`Rolino's credential store at ${path} is invalid.`);\r\n  }\r\n  const candidate = parsed as Partial<CredentialStore>;\r\n  if (\r\n    candidate.version !== 1\r\n    || !candidate.credentials\r\n    || typeof candidate.credentials !== \"object\"\r\n    || !Object.values(candidate.credentials).every(isStoredCredential)\r\n  ) {\r\n    throw new TypeError(`Rolino's credential store at ${path} is invalid.`);\r\n  }\r\n  return candidate as CredentialStore;\r\n}\r\n\r\nfunction writeStore(\r\n  store: CredentialStore,\r\n  env: Record<string, string | undefined>,\r\n) {\r\n  const path = credentialStorePath(env);\r\n  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });\r\n  writeFileSync(path, `${JSON.stringify(store, null, 2)}\\n`, {\r\n    encoding: \"utf8\",\r\n    mode: 0o600,\r\n  });\r\n  chmodSync(path, 0o600);\r\n}\r\n\r\nexport function loadStoredCredential(\r\n  baseUrl: string,\r\n  env: Record<string, string | undefined> = process.env,\r\n) {\r\n  return readStore(env).credentials[normalizeRolinoBaseUrl(baseUrl)] ?? null;\r\n}\r\n\r\nexport function saveStoredCredential(\r\n  baseUrl: string,\r\n  credential: StoredCredential,\r\n  env: Record<string, string | undefined> = process.env,\r\n) {\r\n  const store = readStore(env);\r\n  store.credentials[normalizeRolinoBaseUrl(baseUrl)] = credential;\r\n  writeStore(store, env);\r\n  return credentialStorePath(env);\r\n}\r\n\r\nexport function clearStoredCredential(\r\n  baseUrl: string,\r\n  env: Record<string, string | undefined> = process.env,\r\n) {\r\n  const path = credentialStorePath(env);\r\n  const store = readStore(env);\r\n  const key = normalizeRolinoBaseUrl(baseUrl);\r\n  const existed = Boolean(store.credentials[key]);\r\n  delete store.credentials[key];\r\n\r\n  if (Object.keys(store.credentials).length === 0) {\r\n    if (existsSync(path)) unlinkSync(path);\r\n  } else {\r\n    writeStore(store, env);\r\n  }\r\n  return existed;\r\n}\r\n\r\nexport function resolveCredential(\r\n  baseUrl: string,\r\n  env: Record<string, string | undefined> = process.env,\r\n) {\r\n  if (env.ROLINO_TOKEN) {\r\n    return { source: \"environment\" as const, token: env.ROLINO_TOKEN };\r\n  }\r\n  const stored = loadStoredCredential(baseUrl, env);\r\n  return stored\r\n    ? { source: \"stored\" as const, token: stored.token, credential: stored }\r\n    : { source: \"none\" as const, token: null };\r\n}\r\n"],"mappings":";AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,eAAe;AACxB,SAAS,SAAS,YAAY;AAE9B,SAAS,8BAA8B;AAcvC,SAAS,uBAAuB,KAAyC;AACvE,MAAI,IAAI,kBAAmB,QAAO,IAAI;AACtC,MAAI,QAAQ,aAAa,WAAW,IAAI,SAAS;AAC/C,WAAO,KAAK,IAAI,SAAS,QAAQ;AAAA,EACnC;AACA,MAAI,QAAQ,aAAa,UAAU;AACjC,WAAO,KAAK,QAAQ,GAAG,WAAW,uBAAuB,QAAQ;AAAA,EACnE;AACA,SAAO,KAAK,IAAI,mBAAmB,KAAK,QAAQ,GAAG,SAAS,GAAG,QAAQ;AACzE;AAEO,SAAS,oBACd,MAA0C,QAAQ,KAClD;AACA,SAAO,KAAK,uBAAuB,GAAG,GAAG,kBAAkB;AAC7D;AAEA,SAAS,mBAAmB,OAA2C;AACrE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,aAAa;AACnB,SAAO,OAAO,WAAW,UAAU,YAC9B,WAAW,MAAM,SAAS,KAC1B,OAAO,WAAW,cAAc,YAChC,OAAO,WAAW,cAAc,YAChC,QAAQ,WAAW,YAAY,KAC/B,OAAO,WAAW,cAAc,OAAO,YACvC,OAAO,WAAW,cAAc,SAAS;AAChD;AAEA,SAAS,UAAU,KAA0D;AAC3E,QAAM,OAAO,oBAAoB,GAAG;AACpC,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO,EAAE,SAAS,GAAG,aAAa,CAAC,EAAE;AAE5D,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;AAAA,EAChD,QAAQ;AACN,UAAM,IAAI,UAAU,iDAAiD,IAAI,GAAG;AAAA,EAC9E;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,UAAU;AACzC,UAAM,IAAI,UAAU,gCAAgC,IAAI,cAAc;AAAA,EACxE;AACA,QAAM,YAAY;AAClB,MACE,UAAU,YAAY,KACnB,CAAC,UAAU,eACX,OAAO,UAAU,gBAAgB,YACjC,CAAC,OAAO,OAAO,UAAU,WAAW,EAAE,MAAM,kBAAkB,GACjE;AACA,UAAM,IAAI,UAAU,gCAAgC,IAAI,cAAc;AAAA,EACxE;AACA,SAAO;AACT;AAEA,SAAS,WACP,OACA,KACA;AACA,QAAM,OAAO,oBAAoB,GAAG;AACpC,YAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACzD,gBAAc,MAAM,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,GAAM;AAAA,IACzD,UAAU;AAAA,IACV,MAAM;AAAA,EACR,CAAC;AACD,YAAU,MAAM,GAAK;AACvB;AAEO,SAAS,qBACd,SACA,MAA0C,QAAQ,KAClD;AACA,SAAO,UAAU,GAAG,EAAE,YAAY,uBAAuB,OAAO,CAAC,KAAK;AACxE;AAEO,SAAS,qBACd,SACA,YACA,MAA0C,QAAQ,KAClD;AACA,QAAM,QAAQ,UAAU,GAAG;AAC3B,QAAM,YAAY,uBAAuB,OAAO,CAAC,IAAI;AACrD,aAAW,OAAO,GAAG;AACrB,SAAO,oBAAoB,GAAG;AAChC;AAEO,SAAS,sBACd,SACA,MAA0C,QAAQ,KAClD;AACA,QAAM,OAAO,oBAAoB,GAAG;AACpC,QAAM,QAAQ,UAAU,GAAG;AAC3B,QAAM,MAAM,uBAAuB,OAAO;AAC1C,QAAM,UAAU,QAAQ,MAAM,YAAY,GAAG,CAAC;AAC9C,SAAO,MAAM,YAAY,GAAG;AAE5B,MAAI,OAAO,KAAK,MAAM,WAAW,EAAE,WAAW,GAAG;AAC/C,QAAI,WAAW,IAAI,EAAG,YAAW,IAAI;AAAA,EACvC,OAAO;AACL,eAAW,OAAO,GAAG;AAAA,EACvB;AACA,SAAO;AACT;AAEO,SAAS,kBACd,SACA,MAA0C,QAAQ,KAClD;AACA,MAAI,IAAI,cAAc;AACpB,WAAO,EAAE,QAAQ,eAAwB,OAAO,IAAI,aAAa;AAAA,EACnE;AACA,QAAM,SAAS,qBAAqB,SAAS,GAAG;AAChD,SAAO,SACH,EAAE,QAAQ,UAAmB,OAAO,OAAO,OAAO,YAAY,OAAO,IACrE,EAAE,QAAQ,QAAiB,OAAO,KAAK;AAC7C;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import {\n  chmodSync,\n  existsSync,\n  mkdirSync,\n  readFileSync,\n  renameSync,\n  unlinkSync,\n  writeFileSync,\n} from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\n\nimport { normalizeRolinoBaseUrl } from \"@rolino/sdk\";\n\nexport const ROLINO_CLI_OAUTH_CLIENT_ID = \"rolino-cli\";\n\nexport type OAuthTokenSet = {\n  host: string;\n  issuer: string;\n  clientId: string;\n  resource: string;\n  accessToken: string;\n  accessTokenExpiresAt: string;\n  refreshToken: string;\n  refreshTokenExpiresAt: string;\n  scopes: string[];\n};\n\ntype OAuthTokenStore = {\n  version: 2;\n  tokens: Record<string, OAuthTokenSet>;\n};\n\ntype RefreshableTokenProvider = (() => Promise<string | undefined>) & {\n  refresh: () => Promise<string | undefined>;\n};\n\nconst refreshLocks = new Map<string, Promise<OAuthTokenSet>>();\n\nfunction defaultConfigDirectory(env: Record<string, string | undefined>) {\n  if (env.ROLINO_CONFIG_DIR) return env.ROLINO_CONFIG_DIR;\n  if (process.platform === \"win32\" && env.APPDATA) return join(env.APPDATA, \"Rolino\");\n  if (process.platform === \"darwin\") return join(homedir(), \"Library\", \"Application Support\", \"Rolino\");\n  return join(env.XDG_CONFIG_HOME ?? join(homedir(), \".config\"), \"rolino\");\n}\n\nexport function oauthTokenStorePath(\n  env: Record<string, string | undefined> = process.env,\n) {\n  return join(defaultConfigDirectory(env), \"oauth-tokens.json\");\n}\n\nexport function oauthConfiguration(baseUrl: string) {\n  const host = normalizeRolinoBaseUrl(baseUrl);\n  return {\n    host,\n    issuer: `${host}/api/auth`,\n    clientId: ROLINO_CLI_OAUTH_CLIENT_ID,\n    resource: `${host}/api/v1`,\n  };\n}\n\nfunction tokenKey(input: Pick<OAuthTokenSet, \"host\" | \"issuer\" | \"clientId\" | \"resource\">) {\n  return JSON.stringify([input.host, input.issuer, input.clientId, input.resource]);\n}\n\nfunction isTokenSet(value: unknown): value is OAuthTokenSet {\n  if (!value || typeof value !== \"object\") return false;\n  const token = value as Partial<OAuthTokenSet>;\n  return [token.host, token.issuer, token.clientId, token.resource, token.accessToken,\n    token.accessTokenExpiresAt, token.refreshToken, token.refreshTokenExpiresAt]\n    .every((item) => typeof item === \"string\" && item.length > 0)\n    && Array.isArray(token.scopes)\n    && token.scopes.every((scope) => typeof scope === \"string\");\n}\n\nfunction readStore(env: Record<string, string | undefined>): OAuthTokenStore {\n  const path = oauthTokenStorePath(env);\n  if (!existsSync(path)) return { version: 2, tokens: {} };\n  try {\n    const parsed = JSON.parse(readFileSync(path, \"utf8\")) as Partial<OAuthTokenStore>;\n    if (\n      parsed.version !== 2\n      || !parsed.tokens\n      || typeof parsed.tokens !== \"object\"\n      || !Object.values(parsed.tokens).every(isTokenSet)\n    ) throw new Error(\"invalid\");\n    return parsed as OAuthTokenStore;\n  } catch {\n    throw new TypeError(`Rolino could not read its OAuth token store at ${path}.`);\n  }\n}\n\nfunction writeStore(store: OAuthTokenStore, env: Record<string, string | undefined>) {\n  const path = oauthTokenStorePath(env);\n  const temporary = `${path}.${process.pid}.tmp`;\n  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });\n  writeFileSync(temporary, `${JSON.stringify(store, null, 2)}\\n`, {\n    encoding: \"utf8\",\n    mode: 0o600,\n  });\n  chmodSync(temporary, 0o600);\n  renameSync(temporary, path);\n  chmodSync(path, 0o600);\n  return path;\n}\n\nexport function loadOAuthTokenSet(\n  baseUrl: string,\n  env: Record<string, string | undefined> = process.env,\n) {\n  const configuration = oauthConfiguration(baseUrl);\n  return readStore(env).tokens[tokenKey(configuration)] ?? null;\n}\n\nexport function saveOAuthTokenSet(\n  tokenSet: OAuthTokenSet,\n  env: Record<string, string | undefined> = process.env,\n) {\n  const configuration = oauthConfiguration(tokenSet.host);\n  if (\n    tokenSet.host !== configuration.host\n    || tokenSet.issuer !== configuration.issuer\n    || tokenSet.clientId !== configuration.clientId\n    || tokenSet.resource !== configuration.resource\n  ) throw new TypeError(\"The OAuth token set does not match the Rolino host.\");\n  const store = readStore(env);\n  store.tokens[tokenKey(tokenSet)] = tokenSet;\n  const path = writeStore(store, env);\n  const retiredInteractiveCredential = join(defaultConfigDirectory(env), \"credentials.json\");\n  if (existsSync(retiredInteractiveCredential)) unlinkSync(retiredInteractiveCredential);\n  return path;\n}\n\nexport function clearOAuthTokenSet(\n  baseUrl: string,\n  env: Record<string, string | undefined> = process.env,\n) {\n  const path = oauthTokenStorePath(env);\n  const store = readStore(env);\n  const key = tokenKey(oauthConfiguration(baseUrl));\n  const existed = Boolean(store.tokens[key]);\n  delete store.tokens[key];\n  if (!Object.keys(store.tokens).length) {\n    if (existsSync(path)) unlinkSync(path);\n  } else {\n    writeStore(store, env);\n  }\n  return existed;\n}\n\nasync function refreshOAuthTokenSet(options: {\n  baseUrl: string;\n  env: Record<string, string | undefined>;\n  fetch: typeof globalThis.fetch;\n}) {\n  const current = loadOAuthTokenSet(options.baseUrl, options.env);\n  if (!current) throw new TypeError(\"OAuth sign-in is required. Run `rolino auth login`.\");\n  const key = tokenKey(current);\n  const existing = refreshLocks.get(key);\n  if (existing) return existing;\n\n  const refresh = (async () => {\n    const body = new URLSearchParams({\n      grant_type: \"refresh_token\",\n      refresh_token: current.refreshToken,\n      client_id: current.clientId,\n      resource: current.resource,\n    });\n    const response = await options.fetch(`${current.issuer}/oauth2/token`, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/x-www-form-urlencoded\", accept: \"application/json\" },\n      body,\n    });\n    const payload = await response.json().catch(() => null) as Record<string, unknown> | null;\n    if (!response.ok || !payload || typeof payload.access_token !== \"string\") {\n      throw new TypeError(\"OAuth sign-in is required. Run `rolino auth login`.\");\n    }\n    const expiresIn = typeof payload.expires_in === \"number\" ? payload.expires_in : 300;\n    const refreshed: OAuthTokenSet = {\n      ...current,\n      accessToken: payload.access_token,\n      accessTokenExpiresAt: new Date(Date.now() + expiresIn * 1_000).toISOString(),\n      refreshToken: typeof payload.refresh_token === \"string\" ? payload.refresh_token : current.refreshToken,\n      scopes: typeof payload.scope === \"string\" ? payload.scope.split(/\\s+/).filter(Boolean) : current.scopes,\n    };\n    saveOAuthTokenSet(refreshed, options.env);\n    return refreshed;\n  })().finally(() => refreshLocks.delete(key));\n  refreshLocks.set(key, refresh);\n  return refresh;\n}\n\nexport function createOAuthAccessTokenProvider(options: {\n  baseUrl: string;\n  env?: Record<string, string | undefined>;\n  fetch?: typeof globalThis.fetch;\n}): RefreshableTokenProvider {\n  const env = options.env ?? process.env;\n  const fetchImplementation = options.fetch ?? globalThis.fetch;\n  const obtain = async (force: boolean) => {\n    if (env.ROLINO_TOKEN) return env.ROLINO_TOKEN;\n    const token = loadOAuthTokenSet(options.baseUrl, env);\n    if (!token) return undefined;\n    if (!force && Date.parse(token.accessTokenExpiresAt) - Date.now() > 30_000) {\n      return token.accessToken;\n    }\n    return (await refreshOAuthTokenSet({\n      baseUrl: options.baseUrl,\n      env,\n      fetch: fetchImplementation,\n    })).accessToken;\n  };\n  const provider = (() => obtain(false)) as RefreshableTokenProvider;\n  provider.refresh = () => obtain(true);\n  return provider;\n}\n\nexport function resolveLocalAuthentication(\n  baseUrl: string,\n  env: Record<string, string | undefined> = process.env,\n) {\n  if (env.ROLINO_TOKEN) return { source: \"environment\" as const, tokenSet: null };\n  const tokenSet = loadOAuthTokenSet(baseUrl, env);\n  return tokenSet\n    ? { source: \"oauth\" as const, tokenSet }\n    : { source: \"none\" as const, tokenSet: null };\n}\n"],"mappings":";AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,eAAe;AACxB,SAAS,SAAS,YAAY;AAE9B,SAAS,8BAA8B;AAEhC,IAAM,6BAA6B;AAuB1C,IAAM,eAAe,oBAAI,IAAoC;AAE7D,SAAS,uBAAuB,KAAyC;AACvE,MAAI,IAAI,kBAAmB,QAAO,IAAI;AACtC,MAAI,QAAQ,aAAa,WAAW,IAAI,QAAS,QAAO,KAAK,IAAI,SAAS,QAAQ;AAClF,MAAI,QAAQ,aAAa,SAAU,QAAO,KAAK,QAAQ,GAAG,WAAW,uBAAuB,QAAQ;AACpG,SAAO,KAAK,IAAI,mBAAmB,KAAK,QAAQ,GAAG,SAAS,GAAG,QAAQ;AACzE;AAEO,SAAS,oBACd,MAA0C,QAAQ,KAClD;AACA,SAAO,KAAK,uBAAuB,GAAG,GAAG,mBAAmB;AAC9D;AAEO,SAAS,mBAAmB,SAAiB;AAClD,QAAM,OAAO,uBAAuB,OAAO;AAC3C,SAAO;AAAA,IACL;AAAA,IACA,QAAQ,GAAG,IAAI;AAAA,IACf,UAAU;AAAA,IACV,UAAU,GAAG,IAAI;AAAA,EACnB;AACF;AAEA,SAAS,SAAS,OAAyE;AACzF,SAAO,KAAK,UAAU,CAAC,MAAM,MAAM,MAAM,QAAQ,MAAM,UAAU,MAAM,QAAQ,CAAC;AAClF;AAEA,SAAS,WAAW,OAAwC;AAC1D,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,QAAQ;AACd,SAAO;AAAA,IAAC,MAAM;AAAA,IAAM,MAAM;AAAA,IAAQ,MAAM;AAAA,IAAU,MAAM;AAAA,IAAU,MAAM;AAAA,IACtE,MAAM;AAAA,IAAsB,MAAM;AAAA,IAAc,MAAM;AAAA,EAAqB,EAC1E,MAAM,CAAC,SAAS,OAAO,SAAS,YAAY,KAAK,SAAS,CAAC,KACzD,MAAM,QAAQ,MAAM,MAAM,KAC1B,MAAM,OAAO,MAAM,CAAC,UAAU,OAAO,UAAU,QAAQ;AAC9D;AAEA,SAAS,UAAU,KAA0D;AAC3E,QAAM,OAAO,oBAAoB,GAAG;AACpC,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO,EAAE,SAAS,GAAG,QAAQ,CAAC,EAAE;AACvD,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;AACpD,QACE,OAAO,YAAY,KAChB,CAAC,OAAO,UACR,OAAO,OAAO,WAAW,YACzB,CAAC,OAAO,OAAO,OAAO,MAAM,EAAE,MAAM,UAAU,EACjD,OAAM,IAAI,MAAM,SAAS;AAC3B,WAAO;AAAA,EACT,QAAQ;AACN,UAAM,IAAI,UAAU,kDAAkD,IAAI,GAAG;AAAA,EAC/E;AACF;AAEA,SAAS,WAAW,OAAwB,KAAyC;AACnF,QAAM,OAAO,oBAAoB,GAAG;AACpC,QAAM,YAAY,GAAG,IAAI,IAAI,QAAQ,GAAG;AACxC,YAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACzD,gBAAc,WAAW,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,GAAM;AAAA,IAC9D,UAAU;AAAA,IACV,MAAM;AAAA,EACR,CAAC;AACD,YAAU,WAAW,GAAK;AAC1B,aAAW,WAAW,IAAI;AAC1B,YAAU,MAAM,GAAK;AACrB,SAAO;AACT;AAEO,SAAS,kBACd,SACA,MAA0C,QAAQ,KAClD;AACA,QAAM,gBAAgB,mBAAmB,OAAO;AAChD,SAAO,UAAU,GAAG,EAAE,OAAO,SAAS,aAAa,CAAC,KAAK;AAC3D;AAEO,SAAS,kBACd,UACA,MAA0C,QAAQ,KAClD;AACA,QAAM,gBAAgB,mBAAmB,SAAS,IAAI;AACtD,MACE,SAAS,SAAS,cAAc,QAC7B,SAAS,WAAW,cAAc,UAClC,SAAS,aAAa,cAAc,YACpC,SAAS,aAAa,cAAc,SACvC,OAAM,IAAI,UAAU,qDAAqD;AAC3E,QAAM,QAAQ,UAAU,GAAG;AAC3B,QAAM,OAAO,SAAS,QAAQ,CAAC,IAAI;AACnC,QAAM,OAAO,WAAW,OAAO,GAAG;AAClC,QAAM,+BAA+B,KAAK,uBAAuB,GAAG,GAAG,kBAAkB;AACzF,MAAI,WAAW,4BAA4B,EAAG,YAAW,4BAA4B;AACrF,SAAO;AACT;AAEO,SAAS,mBACd,SACA,MAA0C,QAAQ,KAClD;AACA,QAAM,OAAO,oBAAoB,GAAG;AACpC,QAAM,QAAQ,UAAU,GAAG;AAC3B,QAAM,MAAM,SAAS,mBAAmB,OAAO,CAAC;AAChD,QAAM,UAAU,QAAQ,MAAM,OAAO,GAAG,CAAC;AACzC,SAAO,MAAM,OAAO,GAAG;AACvB,MAAI,CAAC,OAAO,KAAK,MAAM,MAAM,EAAE,QAAQ;AACrC,QAAI,WAAW,IAAI,EAAG,YAAW,IAAI;AAAA,EACvC,OAAO;AACL,eAAW,OAAO,GAAG;AAAA,EACvB;AACA,SAAO;AACT;AAEA,eAAe,qBAAqB,SAIjC;AACD,QAAM,UAAU,kBAAkB,QAAQ,SAAS,QAAQ,GAAG;AAC9D,MAAI,CAAC,QAAS,OAAM,IAAI,UAAU,qDAAqD;AACvF,QAAM,MAAM,SAAS,OAAO;AAC5B,QAAM,WAAW,aAAa,IAAI,GAAG;AACrC,MAAI,SAAU,QAAO;AAErB,QAAM,WAAW,YAAY;AAC3B,UAAM,OAAO,IAAI,gBAAgB;AAAA,MAC/B,YAAY;AAAA,MACZ,eAAe,QAAQ;AAAA,MACvB,WAAW,QAAQ;AAAA,MACnB,UAAU,QAAQ;AAAA,IACpB,CAAC;AACD,UAAM,WAAW,MAAM,QAAQ,MAAM,GAAG,QAAQ,MAAM,iBAAiB;AAAA,MACrE,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,qCAAqC,QAAQ,mBAAmB;AAAA,MAC3F;AAAA,IACF,CAAC;AACD,UAAM,UAAU,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,IAAI;AACtD,QAAI,CAAC,SAAS,MAAM,CAAC,WAAW,OAAO,QAAQ,iBAAiB,UAAU;AACxE,YAAM,IAAI,UAAU,qDAAqD;AAAA,IAC3E;AACA,UAAM,YAAY,OAAO,QAAQ,eAAe,WAAW,QAAQ,aAAa;AAChF,UAAM,YAA2B;AAAA,MAC/B,GAAG;AAAA,MACH,aAAa,QAAQ;AAAA,MACrB,sBAAsB,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAK,EAAE,YAAY;AAAA,MAC3E,cAAc,OAAO,QAAQ,kBAAkB,WAAW,QAAQ,gBAAgB,QAAQ;AAAA,MAC1F,QAAQ,OAAO,QAAQ,UAAU,WAAW,QAAQ,MAAM,MAAM,KAAK,EAAE,OAAO,OAAO,IAAI,QAAQ;AAAA,IACnG;AACA,sBAAkB,WAAW,QAAQ,GAAG;AACxC,WAAO;AAAA,EACT,GAAG,EAAE,QAAQ,MAAM,aAAa,OAAO,GAAG,CAAC;AAC3C,eAAa,IAAI,KAAK,OAAO;AAC7B,SAAO;AACT;AAEO,SAAS,+BAA+B,SAIlB;AAC3B,QAAM,MAAM,QAAQ,OAAO,QAAQ;AACnC,QAAM,sBAAsB,QAAQ,SAAS,WAAW;AACxD,QAAM,SAAS,OAAO,UAAmB;AACvC,QAAI,IAAI,aAAc,QAAO,IAAI;AACjC,UAAM,QAAQ,kBAAkB,QAAQ,SAAS,GAAG;AACpD,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,CAAC,SAAS,KAAK,MAAM,MAAM,oBAAoB,IAAI,KAAK,IAAI,IAAI,KAAQ;AAC1E,aAAO,MAAM;AAAA,IACf;AACA,YAAQ,MAAM,qBAAqB;AAAA,MACjC,SAAS,QAAQ;AAAA,MACjB;AAAA,MACA,OAAO;AAAA,IACT,CAAC,GAAG;AAAA,EACN;AACA,QAAM,YAAY,MAAM,OAAO,KAAK;AACpC,WAAS,UAAU,MAAM,OAAO,IAAI;AACpC,SAAO;AACT;AAEO,SAAS,2BACd,SACA,MAA0C,QAAQ,KAClD;AACA,MAAI,IAAI,aAAc,QAAO,EAAE,QAAQ,eAAwB,UAAU,KAAK;AAC9E,QAAM,WAAW,kBAAkB,SAAS,GAAG;AAC/C,SAAO,WACH,EAAE,QAAQ,SAAkB,SAAS,IACrC,EAAE,QAAQ,QAAiB,UAAU,KAAK;AAChD;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rolino/local-auth",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Host-scoped local credential storage shared by Rolino's Node.js adapters",
   "type": "module",
   "license": "MIT",
@@ -54,7 +54,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@rolino/sdk": "0.5.0"
+    "@rolino/sdk": "0.6.0"
   },
   "engines": {
     "node": ">=20.19.0"