@sideboard-ai/core 0.1.202 → 0.1.203

package/dist/{chunk-7AHAABKN.js → chunk-FZYYEMET.js}

@@ -1,198 +1,16 @@
 import {
-  httpFetch
-} from "./chunk-N7WZ6NIN.js";
+  textFromAbleTimeDoc
+} from "./chunk-3PYH2RLA.js";
+import {
+  assertAbleTimeCredential,
+  callAbleTimeTool,
+  normalizeAbleTimeHost,
+  rewriteAbleTimeError
+} from "./chunk-BFEBFGCS.js";
 import {
-  getAbleTimeAccessToken,
-  getAbleTimeHost,
   isAbleTimeConnected,
   saveAbleTimeConnection
-} from "./chunk-CXFW5LIH.js";
-
-// src/integrations/abletime-mcp.ts
-var DEFAULT_ABLETIME_HOST = "https://track.abletime.com";
-var ABLETIME_MCP_PATH = "/api/public/v2/mcp";
-var ABLETIME_MCP_PM_PATH = "/api/public/v2/mcp/pm";
-var MCP_PROTOCOL_VERSION = "2025-03-26";
-var ABLETIME_PM_TOOL_NAMES = [
-  "set_task_assignee",
-  "set_task_priority",
-  "set_task_stage",
-  "set_task_dependency",
-  "set_task_blocked",
-  "set_task_locked",
-  "set_task_schedule",
-  "clear_task_schedule",
-  "archive_task",
-  "delete_task"
-];
-function abletimeToolUsesPm(name) {
-  return ABLETIME_PM_TOOL_NAMES.includes(name);
-}
-function normalizeAbleTimeHost(raw) {
-  const trimmed = raw?.trim() || DEFAULT_ABLETIME_HOST;
-  const withScheme = /^https?:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`;
-  return withScheme.replace(/\/+$/, "");
-}
-function abletimeMcpUrl(host, opts) {
-  const path = opts?.pm ? ABLETIME_MCP_PM_PATH : ABLETIME_MCP_PATH;
-  return `${normalizeAbleTimeHost(host)}${path}`;
-}
-function rewriteAbleTimeError(message) {
-  if (/INTEGRATION_AGENT_ACCESS_DISABLED|agent access/i.test(message)) {
-    return `${message} \u2014 Enable Agent access (MCP) in AbleTime Settings \u2192 Integrations \u2192 API Keys.`;
-  }
-  if (/INTEGRATION_PAT_REQUIRED|organization api key/i.test(message)) {
-    return `${message} \u2014 AbleTime MCP needs a personal access token (apt_\u2026), not an organization API key.`;
-  }
-  if (/INTEGRATION_PLAN_REQUIRED/i.test(message)) {
-    return `${message} \u2014 AbleTime plan does not include API access.`;
-  }
-  if (/INTEGRATION_KEY_INVALID|INTEGRATION_KEY_MISSING|401|unauthorized|invalid token/i.test(message)) {
-    return `${message} \u2014 Reconnect AbleTime from Account settings (Profile \u2192 API Access).`;
-  }
-  return message;
-}
-function asRecord(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
-}
-function parseSseJson(body) {
-  const blocks = body.split(/\n\n+/);
-  let last;
-  for (const block of blocks) {
-    const data = block.split("\n").filter((line) => line.startsWith("data:")).map((line) => line.slice(5).trim()).filter((line) => line && line !== "[DONE]").join("\n");
-    if (!data) continue;
-    try {
-      last = JSON.parse(data);
-    } catch {
-    }
-  }
-  if (last !== void 0) return last;
-  try {
-    return JSON.parse(body);
-  } catch {
-    throw new Error(`AbleTime MCP returned a non-JSON response: ${body.slice(0, 200)}`);
-  }
-}
-function unwrapToolResult(result) {
-  const record = asRecord(result);
-  if (!record) return result;
-  const content = record.content;
-  if (Array.isArray(content)) {
-    const texts = content.map((part) => {
-      const item = asRecord(part);
-      if (!item) return "";
-      return typeof item.text === "string" ? item.text : "";
-    }).filter(Boolean);
-    if (texts.length === 1) {
-      const text = texts[0];
-      try {
-        return JSON.parse(text);
-      } catch {
-        return text;
-      }
-    }
-    if (texts.length > 1) return texts.join("\n");
-  }
-  if (record.structuredContent != null) return record.structuredContent;
-  if (record.isError === true) {
-    const message = typeof record.message === "string" ? record.message : textsFromUnknown(result) || "AbleTime tool failed";
-    throw new Error(message);
-  }
-  return result;
-}
-function textsFromUnknown(value) {
-  const record = asRecord(value);
-  if (!record) return "";
-  if (typeof record.message === "string") return record.message;
-  if (typeof record.error === "string") return record.error;
-  return "";
-}
-async function abletimeMcpRequest(method, params, opts) {
-  const token = (opts?.token ?? getAbleTimeAccessToken())?.trim();
-  if (!token) {
-    throw new Error("AbleTime is not connected \u2014 paste a personal access token in Account settings");
-  }
-  const url = abletimeMcpUrl(
-    opts?.host ?? (opts?.token ? DEFAULT_ABLETIME_HOST : getAbleTimeHost()),
-    { pm: opts?.pm }
-  );
-  const res = await httpFetch(url, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      Accept: "application/json, text/event-stream",
-      Authorization: `Bearer ${token}`,
-      "MCP-Protocol-Version": MCP_PROTOCOL_VERSION
-    },
-    body: JSON.stringify({
-      jsonrpc: "2.0",
-      id: 1,
-      method,
-      ...params === void 0 ? {} : { params }
-    })
-  });
-  const body = await res.text().catch(() => "");
-  if (!res.ok) {
-    throw new Error(
-      rewriteAbleTimeError(
-        `AbleTime MCP error ${res.status}${body ? `: ${body.slice(0, 240)}` : ""}`
-      )
-    );
-  }
-  const contentType = res.headers.get("content-type") ?? "";
-  const parsed = contentType.includes("text/event-stream") ? parseSseJson(body) : (() => {
-    try {
-      return JSON.parse(body);
-    } catch {
-      return parseSseJson(body);
-    }
-  })();
-  const rpc = asRecord(parsed);
-  if (rpc?.error) {
-    const detail = typeof rpc.error.message === "string" && rpc.error.message.trim() ? rpc.error.message : `AbleTime MCP error ${rpc.error.code ?? ""}`.trim();
-    throw new Error(rewriteAbleTimeError(detail));
-  }
-  if (rpc && "result" in rpc) return rpc.result;
-  return parsed;
-}
-async function initializeIfNeeded(opts) {
-  try {
-    await abletimeMcpRequest(
-      "initialize",
-      {
-        protocolVersion: MCP_PROTOCOL_VERSION,
-        capabilities: {},
-        clientInfo: { name: "sideboard", version: "1.0.0" }
-      },
-      opts
-    );
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    if (/already initialized|not (required|supported)|method not found|-32601/i.test(message)) {
-      return;
-    }
-    throw err;
-  }
-}
-async function callAbleTimeTool(name, args = {}, opts) {
-  if (!opts?.token && !isAbleTimeConnected()) {
-    throw new Error("AbleTime is not connected \u2014 paste a personal access token in Account settings");
-  }
-  const requestOpts = { ...opts, pm: opts?.pm ?? abletimeToolUsesPm(name) };
-  const call = () => abletimeMcpRequest("tools/call", { name, arguments: args }, requestOpts).then((result) => {
-    return unwrapToolResult(result);
-  });
-  try {
-    return await call();
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    if (/initialize|session|not initialized|-32000/i.test(message)) {
-      await initializeIfNeeded(requestOpts);
-      return await call();
-    }
-    throw err instanceof Error ? new Error(rewriteAbleTimeError(err.message)) : err;
-  }
-}
+} from "./chunk-QFBBUFD4.js";
 
 // src/integrations/abletime.ts
 var CLOSED_STATES = /* @__PURE__ */ new Set([
@@ -203,7 +21,7 @@ var CLOSED_STATES = /* @__PURE__ */ new Set([
   "archived",
   "closed"
 ]);
-function asRecord2(value) {
+function asRecord(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function asString(value) {
@@ -220,14 +38,14 @@ function firstString(record, keys) {
 function firstRecord(record, keys) {
   if (!record) return null;
   for (const key of keys) {
-    const value = asRecord2(record[key]);
+    const value = asRecord(record[key]);
     if (value) return value;
   }
   return null;
 }
 function asList(value) {
   if (Array.isArray(value)) return value;
-  const record = asRecord2(value);
+  const record = asRecord(value);
   if (!record) return [];
   for (const key of ["data", "tasks", "projects", "items", "results", "nodes"]) {
     if (Array.isArray(record[key])) return record[key];
@@ -239,7 +57,7 @@ function labelsOf(record) {
   if (!Array.isArray(raw)) return [];
   return raw.map((item) => {
     if (typeof item === "string") return item.trim();
-    const rec = asRecord2(item);
+    const rec = asRecord(item);
     return rec ? firstString(rec, ["name", "title", "label"]) : "";
   }).filter(Boolean);
 }
@@ -247,13 +65,13 @@ function commentsOf(record) {
   const raw = record.comments ?? record.notes ?? record.discussion;
   const out = [];
   for (const item of asList(raw)) {
-    const rec = asRecord2(item);
+    const rec = asRecord(item);
     if (!rec) continue;
-    const body = firstString(rec, ["body", "text", "comment", "content", "message"]);
+    const body = firstString(rec, ["body", "text", "comment", "message", "contentSanitized"]) || textFromAbleTimeDoc(rec.content);
     if (!body) continue;
-    const user = firstString(asRecord2(rec.user) ?? asRecord2(rec.author), ["name", "display_name"]) || firstString(rec, ["user_name", "author"]);
+    const user = firstString(asRecord(rec.user) ?? asRecord(rec.author), ["name", "display_name", "username"]) || firstString(rec, ["user_name", "author", "username"]);
     const comment = { body };
-    const id = firstString(rec, ["id", "comment_id"]);
+    const id = firstString(rec, ["id", "comment_id", "commentId"]);
     if (id) comment.id = id;
     const url = firstString(rec, ["url", "permalink"]);
     if (url) comment.url = url;
@@ -277,11 +95,11 @@ function taskUrl(task, host) {
   return `${base}/tasks/${slug}`;
 }
 function mapAbleTimeTask(raw, host) {
-  const record = asRecord2(raw);
+  const record = asRecord(raw);
   if (!record) return null;
   const nested = firstRecord(record, ["task", "data"]) ?? record;
-  const id = firstString(nested, ["id", "task_id", "taskId"]);
-  const identifier = firstString(nested, ["reference", "ref", "identifier", "key", "code", "number"]) || id;
+  const id = firstString(nested, ["id", "task_id", "taskId", "timeflowTaskId"]);
+  const identifier = firstString(nested, ["reference", "ref", "identifier", "key", "code", "number", "taskRef"]) || id;
   const title = firstString(nested, ["title", "name"]);
   if (!id && !identifier && !title) return null;
   const resolvedId = id || identifier;
@@ -292,21 +110,22 @@ function mapAbleTimeTask(raw, host) {
     identifier: resolvedIdentifier,
     title: title || resolvedIdentifier,
     url,
-    description: firstString(nested, ["description", "body", "details"]) || void 0,
-    state: firstString(nested, ["state", "board_state", "boardState", "status"]) || void 0,
-    projectId: firstString(nested, ["project_id", "projectId"]) || firstString(asRecord2(nested.project), ["id"]) || void 0,
-    categoryId: firstString(nested, ["category_id", "categoryId"]) || firstString(asRecord2(nested.category), ["id"]) || void 0,
+    description: firstString(nested, ["description", "body", "details", "descriptionSanitized"]) || textFromAbleTimeDoc(nested.description) || void 0,
+    state: firstString(nested, ["state", "board_state", "boardState", "status", "taskState"]) || void 0,
+    projectId: firstString(nested, ["project_id", "projectId"]) || firstString(asRecord(nested.project), ["id"]) || void 0,
+    categoryId: firstString(nested, ["category_id", "categoryId", "projectCategoryId"]) || firstString(asRecord(nested.category), ["id"]) || void 0,
     assignee: assigneeOf(nested),
     labels: labelsOf(nested),
     comments: commentsOf(nested),
-    createdAt: firstString(nested, ["created_at", "createdAt", "created"]) || void 0,
+    createdAt: firstString(nested, ["created_at", "createdAt", "created", "dateCreated"]) || void 0,
     updatedAt: firstString(nested, [
       "updated_at",
       "updatedAt",
       "modified_at",
       "modifiedAt",
       "last_activity_at",
-      "lastActivityAt"
+      "lastActivityAt",
+      "lastUpdate"
     ]) || void 0
   };
 }
@@ -337,16 +156,16 @@ function issueAttachmentForAbleTimeTask(task) {
   };
 }
 function mapProject(raw) {
-  const record = asRecord2(raw);
+  const record = asRecord(raw);
   if (!record) return null;
-  const id = firstString(record, ["id", "project_id"]);
-  const name = firstString(record, ["name", "title"]);
+  const id = firstString(record, ["id", "project_id", "projectId"]);
+  const name = firstString(record, ["name", "title", "projectName"]);
   if (!id && !name) return null;
   const categories = asList(record.categories ?? record.category).map((item) => {
-    const rec = asRecord2(item);
+    const rec = asRecord(item);
     if (!rec) return null;
-    const categoryId = firstString(rec, ["id", "category_id"]);
-    const categoryName = firstString(rec, ["name", "title"]);
+    const categoryId = firstString(rec, ["id", "category_id", "projectCategoryId", "categoryId"]);
+    const categoryName = firstString(rec, ["name", "title", "categoryName"]);
     if (!categoryId && !categoryName) return null;
     return { id: categoryId || categoryName, name: categoryName || categoryId };
   }).filter((item) => Boolean(item));
@@ -358,7 +177,7 @@ function isOpenTask(task) {
 }
 async function getAbleTimeOrientation(opts) {
   const raw = await callAbleTimeTool("orientation", {}, opts);
-  const record = asRecord2(raw);
+  const record = asRecord(raw);
   const viewerRec = firstRecord(record, ["viewer", "user", "actor", "me", "person"]) ?? record;
   const viewer = {
     id: firstString(viewerRec, ["id", "user_id"]) || void 0,
@@ -437,7 +256,7 @@ async function commentAbleTimeTask(input, opts) {
     { id, task_id: id, task: id, body, comment: body, text: body },
     opts
   );
-  const rec = asRecord2(raw);
+  const rec = asRecord(raw);
   return {
     id: rec ? firstString(rec, ["id", "comment_id"]) || void 0 : void 0,
     body: rec ? firstString(rec, ["body", "text", "comment"]) || body : body
@@ -627,8 +446,7 @@ async function listAbleTimeAssignedIssues(opts) {
   };
 }
 async function verifyAbleTimeConnection(input) {
-  const token = input.token.trim();
-  if (!token) throw new Error("AbleTime personal access token is required");
+  const token = assertAbleTimeCredential(input.token);
   const host = input.host?.trim() || void 0;
   const orientation = await getAbleTimeOrientation({ token, host });
   saveAbleTimeConnection({
@@ -640,16 +458,6 @@ async function verifyAbleTimeConnection(input) {
 }
 
 export {
-  DEFAULT_ABLETIME_HOST,
-  ABLETIME_MCP_PATH,
-  ABLETIME_MCP_PM_PATH,
-  ABLETIME_PM_TOOL_NAMES,
-  abletimeToolUsesPm,
-  normalizeAbleTimeHost,
-  abletimeMcpUrl,
-  rewriteAbleTimeError,
-  abletimeMcpRequest,
-  callAbleTimeTool,
   taskUrl,
   mapAbleTimeTask,
   toAbleTimeIssueInfo,

package/dist/{chunk-54RSAMBH.js → chunk-LCU6GBZP.js}

@@ -7,7 +7,7 @@ import {
   resolveRepoRoot,
   takenSlugsFromThread,
   teamSlugFromName
-} from "./chunk-RPX6VDW7.js";
+} from "./chunk-QSEF2YVQ.js";
 import {
   ATTACHMENTS_DIR,
   attachmentsGitignoreBody
@@ -30,7 +30,7 @@ import {
   resolveThreadDefaults,
   resolveViewerProfile,
   resolveViewerProfileForRepo
-} from "./chunk-ISV5IFH3.js";
+} from "./chunk-X743YN5Y.js";
 import {
   appDataDir,
   globalAgentCwd,

package/dist/chunk-MHPINQKY.js

@@ -0,0 +1,260 @@
+import {
+  DEFAULT_ABLETIME_HOST,
+  normalizeAbleTimeHost
+} from "./chunk-BFEBFGCS.js";
+import {
+  httpFetch
+} from "./chunk-N7WZ6NIN.js";
+import {
+  disconnectAbleTimeConnection,
+  getAbleTimeHost,
+  loadAppSettings,
+  saveAbleTimeConnection
+} from "./chunk-QFBBUFD4.js";
+
+// src/integrations/abletime-oauth.ts
+import { createHash, randomBytes } from "crypto";
+import { createServer } from "http";
+var ABLETIME_OAUTH_PORT = 19849;
+var ABLETIME_OAUTH_REDIRECT = `http://127.0.0.1:${ABLETIME_OAUTH_PORT}/callback`;
+var BAKED_ABLETIME_OAUTH_CLIENT_ID = "https://www.sideboard.cloud/oauth/abletime-client.json";
+var ABLETIME_OAUTH_RESOURCE = `${DEFAULT_ABLETIME_HOST}/api/public/v2/mcp`;
+var REFRESH_SKEW_MS = 5 * 6e4;
+function hasBakedAbleTimeOAuth() {
+  return Boolean(BAKED_ABLETIME_OAUTH_CLIENT_ID.trim());
+}
+function ableTimeOAuthClientId() {
+  return process.env.SIDEBOARD_ABLETIME_OAUTH_CLIENT_ID?.trim() || BAKED_ABLETIME_OAUTH_CLIENT_ID.trim();
+}
+function ableTimeOAuthResource(host) {
+  return `${normalizeAbleTimeHost(host)}/api/public/v2/mcp`;
+}
+function createAbleTimePkce() {
+  const verifier = randomBytes(32).toString("base64url");
+  const challenge = createHash("sha256").update(verifier).digest("base64url");
+  return { verifier, challenge };
+}
+function ableTimeOAuthAuthorizeUrl(clientId, state, codeChallenge, host) {
+  const base = normalizeAbleTimeHost(host);
+  const params = new URLSearchParams({
+    response_type: "code",
+    client_id: clientId,
+    redirect_uri: ABLETIME_OAUTH_REDIRECT,
+    code_challenge: codeChallenge,
+    code_challenge_method: "S256",
+    state,
+    resource: ableTimeOAuthResource(host)
+  });
+  return `${base}/oauth/authorize?${params.toString()}`;
+}
+function htmlPage(title, body) {
+  return `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title>
+<style>body{font-family:ui-sans-serif,system-ui,sans-serif;padding:48px 24px;max-width:36rem;margin:0 auto;color:#1a1a1a}
+h1{font-size:1.25rem}p{line-height:1.5;color:#444}</style></head><body>${body}</body></html>`;
+}
+async function exchangeAbleTimeToken(body, host) {
+  const url = `${normalizeAbleTimeHost(host)}/api/oauth/token`;
+  const res = await httpFetch(url, {
+    method: "POST",
+    headers: {
+      Accept: "application/json",
+      "Content-Type": "application/x-www-form-urlencoded"
+    },
+    body
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok || data.error || !data.access_token?.trim()) {
+    const detail = data.error_description || data.error || `HTTP ${res.status}`;
+    throw new Error(`AbleTime OAuth token exchange failed: ${detail}`);
+  }
+  return data;
+}
+function persistAbleTimeTokens(data, input) {
+  return saveAbleTimeConnection({
+    accessToken: data.access_token.trim(),
+    refreshToken: data.refresh_token?.trim(),
+    expiresIn: data.expires_in,
+    host: input?.host,
+    viewerName: input?.viewerName
+  });
+}
+var refreshInFlight = null;
+async function refreshAbleTimeAccessToken(refreshToken) {
+  const host = getAbleTimeHost();
+  const body = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: refreshToken,
+    client_id: ableTimeOAuthClientId(),
+    resource: ableTimeOAuthResource(host)
+  });
+  try {
+    const data = await exchangeAbleTimeToken(body, host);
+    persistAbleTimeTokens(data, { host });
+    return data.access_token.trim();
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (/invalid_grant|invalid_token|unauthorized/i.test(message)) {
+      disconnectAbleTimeConnection();
+      throw new Error("AbleTime sign-in expired \u2014 connect again in Account settings");
+    }
+    throw err;
+  }
+}
+async function ensureAbleTimeAccessToken() {
+  const settings = loadAppSettings();
+  const access = settings.integrations.abletimeAccessToken?.trim() || "";
+  const refresh = settings.integrations.abletimeRefreshToken?.trim() || "";
+  const expiresAt = settings.integrations.abletimeTokenExpiresAt ?? 0;
+  if (access && (!refresh || Date.now() < expiresAt - REFRESH_SKEW_MS)) {
+    return access;
+  }
+  if (refresh) {
+    if (!refreshInFlight) {
+      refreshInFlight = refreshAbleTimeAccessToken(refresh).finally(() => {
+        refreshInFlight = null;
+      });
+    }
+    return refreshInFlight;
+  }
+  return access || null;
+}
+var ABLETIME_OAUTH_CANCELLED = "AbleTime sign-in cancelled";
+var AbleTimeOAuthCancelledError = class extends Error {
+  constructor(message = ABLETIME_OAUTH_CANCELLED) {
+    super(message);
+    this.name = "AbleTimeOAuthCancelledError";
+  }
+};
+function isAbleTimeOAuthCancelled(err) {
+  if (err instanceof AbleTimeOAuthCancelledError) return true;
+  const message = err instanceof Error ? err.message : String(err);
+  return message.includes(ABLETIME_OAUTH_CANCELLED);
+}
+async function startAbleTimeOAuth(opts) {
+  if (opts?.signal?.aborted) {
+    throw new AbleTimeOAuthCancelledError();
+  }
+  const clientId = ableTimeOAuthClientId();
+  if (!clientId) {
+    throw new Error(
+      `AbleTime browser sign-in needs a Client ID Metadata Document URL. Host ${BAKED_ABLETIME_OAUTH_CLIENT_ID} (see site/oauth/abletime-client.json), or set SIDEBOARD_ABLETIME_OAUTH_CLIENT_ID.`
+    );
+  }
+  const host = opts?.host?.trim() || void 0;
+  const state = randomBytes(16).toString("hex");
+  const pkce = createAbleTimePkce();
+  const authorizeUrl = ableTimeOAuthAuthorizeUrl(clientId, state, pkce.challenge, host);
+  const timeoutMs = opts?.timeoutMs ?? 5 * 6e4;
+  const code = await new Promise((resolve, reject) => {
+    let settled = false;
+    const finish = (err, value) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      if (err) reject(err);
+      else resolve(value);
+    };
+    const server = createServer((req, res) => {
+      try {
+        const url = new URL(req.url || "/", `http://127.0.0.1:${ABLETIME_OAUTH_PORT}`);
+        if (url.pathname !== "/callback") {
+          res.writeHead(404);
+          res.end("Not found");
+          return;
+        }
+        const err = url.searchParams.get("error");
+        const gotState = url.searchParams.get("state");
+        const gotCode = url.searchParams.get("code");
+        if (err) {
+          res.writeHead(400, { "Content-Type": "text/html" });
+          res.end(htmlPage("AbleTime", `<h1>Authorization cancelled</h1><p>${err}</p>`));
+          finish(new AbleTimeOAuthCancelledError(`AbleTime OAuth: ${err}`));
+          return;
+        }
+        if (gotState !== state || !gotCode) {
+          res.writeHead(400, { "Content-Type": "text/html" });
+          res.end(htmlPage("AbleTime", "<h1>Invalid callback</h1><p>State or code missing.</p>"));
+          finish(new Error("AbleTime OAuth callback was invalid"));
+          return;
+        }
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(
+          htmlPage(
+            "AbleTime connected",
+            "<h1>AbleTime connected</h1><p>You can close this tab and return to Sideboard.</p>"
+          )
+        );
+        finish(void 0, gotCode);
+      } catch (e) {
+        finish(e instanceof Error ? e : new Error(String(e)));
+      }
+    });
+    const timer = setTimeout(() => {
+      finish(new Error("AbleTime sign-in timed out \u2014 try again"));
+    }, timeoutMs);
+    const onAbort = () => finish(new AbleTimeOAuthCancelledError());
+    const cleanup = () => {
+      clearTimeout(timer);
+      opts?.signal?.removeEventListener("abort", onAbort);
+      server.close();
+    };
+    opts?.signal?.addEventListener("abort", onAbort, { once: true });
+    if (opts?.signal?.aborted) {
+      onAbort();
+      return;
+    }
+    server.on("error", (e) => {
+      finish(
+        e instanceof Error && e.code === "EADDRINUSE" ? new Error(
+          `Port ${ABLETIME_OAUTH_PORT} is in use. Close whatever is bound there, or paste an AbleTime token instead.`
+        ) : e instanceof Error ? e : new Error(String(e))
+      );
+    });
+    server.listen(ABLETIME_OAUTH_PORT, "127.0.0.1", () => {
+      void Promise.resolve(opts?.openUrl?.(authorizeUrl)).catch((e) => {
+        finish(e instanceof Error ? e : new Error(String(e)));
+      });
+    });
+  });
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    code,
+    redirect_uri: ABLETIME_OAUTH_REDIRECT,
+    client_id: clientId,
+    code_verifier: pkce.verifier,
+    resource: ableTimeOAuthResource(host)
+  });
+  const data = await exchangeAbleTimeToken(body, host);
+  persistAbleTimeTokens(data, { host });
+  const token = data.access_token.trim();
+  try {
+    const { getAbleTimeOrientation } = await import("./abletime-SISJEPJ3.js");
+    const orientation = await getAbleTimeOrientation({ token, host });
+    return saveAbleTimeConnection({
+      accessToken: token,
+      refreshToken: data.refresh_token?.trim(),
+      expiresIn: data.expires_in,
+      host,
+      viewerName: orientation.viewer.name
+    });
+  } catch {
+    return loadAppSettings();
+  }
+}
+
+export {
+  ABLETIME_OAUTH_PORT,
+  ABLETIME_OAUTH_REDIRECT,
+  BAKED_ABLETIME_OAUTH_CLIENT_ID,
+  ABLETIME_OAUTH_RESOURCE,
+  hasBakedAbleTimeOAuth,
+  ableTimeOAuthClientId,
+  ableTimeOAuthResource,
+  createAbleTimePkce,
+  ableTimeOAuthAuthorizeUrl,
+  ensureAbleTimeAccessToken,
+  ABLETIME_OAUTH_CANCELLED,
+  AbleTimeOAuthCancelledError,
+  isAbleTimeOAuthCancelled,
+  startAbleTimeOAuth
+};