claude-flow 3.32.2 → 3.32.9

package/v3/@claude-flow/cli/dist/src/auth/client.js

@@ -0,0 +1,242 @@
+/**
+ * `ruflo auth login` flow orchestration (ADR-306) — composes
+ * `@claude-flow/security`'s ported OAuth primitives (loopback PKCE, OOB
+ * manual-paste, refresh) the same way meta-proxy's `oauth/login.rs`
+ * orchestrates its own Rust primitives. See security-bridge.ts for why the
+ * package is loaded lazily, and oauth/client.ts (in @claude-flow/security)
+ * for why this targets the live `auth.cognitum.one` surface rather than
+ * ADR-308's unconfirmed `/v1/auth/*` spec.
+ *
+ * @module auth/client
+ */
+import * as readline from 'node:readline/promises';
+import { existsSync } from 'node:fs';
+import { loadSecurityOAuth } from './security-bridge.js';
+import { KEYCHAIN_SERVICE } from './constants.js';
+import { getProfile, setProfile } from './state.js';
+import { getSessionToken, setSessionToken } from './session.js';
+import { hasConsent } from '../funnel/index.js';
+import { domainForScope } from './scopes.js';
+/** Refresh before there is less than one minute left on the access token. */
+export const ACCESS_TOKEN_REFRESH_WINDOW_MS = 60_000;
+/**
+ * Best-effort headlessness signal — a false negative just means the browser
+ * flow is attempted and a real browser opens fine anyway; a false positive
+ * means the user falls back to the manual OOB flow, which always works
+ * regardless. Mirrors meta-proxy's `login.rs::is_probably_headless()`.
+ */
+export function isProbablyHeadless() {
+    return Boolean(process.env.SSH_CONNECTION || process.env.SSH_TTY || process.env.CONTAINER || existsDockerEnv());
+}
+function existsDockerEnv() {
+    try {
+        return existsSync('/.dockerenv');
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Validates the OAuth callback params against the request that started the
+ * flow — the CSRF-critical step, extracted so it's independently testable.
+ * Order matters: an explicit `error` (user denied) and a missing code are
+ * reported as their own reasons; a missing or mismatched `state` is always
+ * a state-mismatch, even when a code is present.
+ */
+export function validateCallback(error, code, returnedState, expectedState) {
+    if (error)
+        return { ok: false, reason: 'denied', detail: error };
+    if (!code)
+        return { ok: false, reason: 'denied', detail: 'no authorization code received' };
+    if (!returnedState || returnedState !== expectedState)
+        return { ok: false, reason: 'state-mismatch' };
+    return { ok: true, code };
+}
+export class LoginCancelledError extends Error {
+    constructor() {
+        super('login cancelled: no code was entered');
+        this.name = 'LoginCancelledError';
+    }
+}
+export class LoginDeniedError extends Error {
+    constructor(detail) {
+        super(`authorization was denied or failed: ${detail}`);
+        this.name = 'LoginDeniedError';
+    }
+}
+export class StateMismatchError extends Error {
+    constructor() {
+        super('state mismatch — the OAuth callback did not match the request this CLI sent');
+        this.name = 'StateMismatchError';
+    }
+}
+export class NotLoggedInError extends Error {
+    constructor(profile) {
+        super(`not logged in for profile "${profile}" — run: ruflo auth login --profile ${profile}`);
+        this.name = 'NotLoggedInError';
+    }
+}
+export class SessionOnlyExpiredError extends Error {
+    constructor(profile) {
+        super(`profile "${profile}" has no persisted refresh token and its in-memory access token is ` +
+            `absent or expiring — run: ruflo auth login --profile ${profile}`);
+        this.name = 'SessionOnlyExpiredError';
+    }
+}
+export class ScopeConsentMismatchError extends Error {
+    constructor(profile, scopes) {
+        super(`profile "${profile}" has scope(s) without matching local consent: ${scopes.join(', ')} — ` +
+            'authenticated capability denied');
+        this.name = 'ScopeConsentMismatchError';
+    }
+}
+/** Browser-based loopback PKCE login — the ADR-306 default for an interactive desktop. */
+export async function browserLogin(print) {
+    const sec = await loadSecurityOAuth();
+    const server = await sec.CallbackServer.bind();
+    const pkce = sec.generatePkce();
+    const url = sec.authorizeUrl(server.redirectUri, pkce.state, pkce.codeChallenge);
+    print('Opening your browser to sign in to Cognitum...');
+    print(`If it doesn't open automatically, visit:\n\n  ${url}\n`);
+    await sec.openBrowser(url).catch(() => { }); // best-effort — the URL above is always the fallback
+    print('Waiting for you to finish signing in...');
+    const result = await server.awaitCallback();
+    const validated = validateCallback(result.error, result.code, result.state, pkce.state);
+    if (!validated.ok) {
+        if (validated.reason === 'state-mismatch')
+            throw new StateMismatchError();
+        throw new LoginDeniedError(validated.detail ?? 'unknown');
+    }
+    const tokens = await sec.exchangeCode(validated.code, pkce.codeVerifier, server.redirectUri);
+    return { tokens, method: 'pkce' };
+}
+/** Headless fallback: prints the authorize URL with the OOB redirect, prompts for the pasted code. */
+export async function manualLogin(print, input = process.stdin) {
+    const sec = await loadSecurityOAuth();
+    print('Browser-based callback unavailable (SSH/container detected, or --no-browser).\n');
+    const pkce = sec.generatePkce();
+    const url = sec.authorizeUrl(sec.OOB_REDIRECT_URI, pkce.state, pkce.codeChallenge);
+    print(`Open this URL in a browser and authorize:\n\n  ${url}\n`);
+    // `rl.question()` resolves on a newline-terminated 'line' event — if `input`
+    // ends without ever emitting one (e.g. stdin closed early, or piped input
+    // with no trailing newline), it hangs forever rather than treating EOF as
+    // a cancellation. Race it against the interface's own 'close' event so an
+    // early EOF resolves to "" (-> LoginCancelledError below) instead of hanging.
+    const rl = readline.createInterface({ input, terminal: false });
+    let code;
+    try {
+        const closed = new Promise((resolve) => rl.once('close', () => resolve('')));
+        code = (await Promise.race([rl.question('Paste the code shown after authorizing: '), closed])).trim();
+    }
+    finally {
+        rl.close();
+    }
+    if (!code)
+        throw new LoginCancelledError();
+    const tokens = await sec.exchangeManualCode(code, pkce.codeVerifier);
+    return { tokens, method: 'device' };
+}
+/**
+ * `--token-stdin`: reads one JSON object from stdin,
+ * `{access_token, refresh_token?, expires_in, scope}`. Wire format is not
+ * specified by ADR-306 — defined here as typed JSON rather than a bare
+ * token string, so scope/expiry are explicit rather than inferred.
+ */
+export async function tokenStdinLogin(input = process.stdin) {
+    const chunks = [];
+    for await (const chunk of input)
+        chunks.push(chunk);
+    const raw = Buffer.concat(chunks).toString('utf-8').trim();
+    if (!raw)
+        throw new Error('--token-stdin: no input received on stdin');
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error('--token-stdin expects a single JSON object: {"access_token","refresh_token"?,"expires_in","scope"}');
+    }
+    if (!parsed.access_token)
+        throw new Error('--token-stdin: JSON is missing required field "access_token"');
+    const tokens = {
+        access_token: parsed.access_token,
+        token_type: 'Bearer',
+        refresh_token: parsed.refresh_token,
+        expires_in: parsed.expires_in,
+    };
+    return { tokens, method: 'token-stdin' };
+}
+/**
+ * Refreshes an access token. Classifies failure into network-unreachable
+ * vs. a reachable-but-erroring server so callers can print an honest
+ * message instead of collapsing both into "offline" (ADR-308 failure
+ * policy: local ruflo functionality is never affected by auth being
+ * unavailable, but the diagnostic should say WHY it's unavailable).
+ */
+export async function refreshAccessToken(refreshTokenValue) {
+    const sec = await loadSecurityOAuth();
+    try {
+        return await sec.refreshToken(refreshTokenValue);
+    }
+    catch (e) {
+        if (e instanceof sec.OAuthError) {
+            if (e.code === 'network') {
+                throw new Error('Could not reach the Cognitum auth service. ruflo core functionality is unaffected — ' +
+                    'sign-in is not required for local use.');
+            }
+            throw new Error(`Cognitum auth service returned an unexpected response: ${e.message}`);
+        }
+        throw e;
+    }
+}
+/**
+ * Returns an access token suitable for an authenticated call.
+ *
+ * Fast path: a process-memory token with more than one minute remaining.
+ * Slow path: load the profile's refresh token from the OS keychain, perform
+ * one refresh, persist a rotated refresh token BEFORE exposing the new access
+ * token, then update metadata and the process cache. Refresh is deliberately
+ * demand-driven: offline-safe commands such as plain `auth status` never call
+ * this function and therefore never create background traffic or retry loops.
+ */
+export async function getValidAccessToken(profileName = 'default') {
+    const profile = getProfile(profileName);
+    if (!profile)
+        throw new NotLoggedInError(profileName);
+    const scopesWithoutConsent = profile.scopes.filter((scope) => {
+        const domain = domainForScope(scope);
+        return domain !== undefined && !hasConsent(domain);
+    });
+    if (scopesWithoutConsent.length > 0) {
+        throw new ScopeConsentMismatchError(profileName, scopesWithoutConsent);
+    }
+    const cached = getSessionToken(profileName, ACCESS_TOKEN_REFRESH_WINDOW_MS);
+    if (cached)
+        return cached;
+    if (!profile.keychainRef)
+        throw new SessionOnlyExpiredError(profileName);
+    const sec = await loadSecurityOAuth();
+    const keychain = await sec.createKeychainAdapter();
+    const refreshTokenValue = await keychain.getSecret(KEYCHAIN_SERVICE, profile.keychainRef);
+    if (!refreshTokenValue)
+        throw new SessionOnlyExpiredError(profileName);
+    const refreshed = await refreshAccessToken(refreshTokenValue);
+    if (!refreshed.access_token)
+        throw new Error('Cognitum refresh response did not contain an access token');
+    // Cognitum rotates refresh tokens with reuse detection. Commit the rotated
+    // credential first; if this write fails, do not publish/cache the access
+    // token and do not retry the already-spent old refresh token here.
+    if (refreshed.refresh_token) {
+        await keychain.setSecret(KEYCHAIN_SERVICE, profile.keychainRef, refreshed.refresh_token);
+    }
+    const expiresAtMs = Date.now() + Math.max(0, refreshed.expires_in ?? 0) * 1000;
+    setSessionToken(profileName, refreshed.access_token, expiresAtMs);
+    setProfile(profileName, {
+        ...profile,
+        accountId: refreshed.account_email ?? profile.accountId,
+        accessTokenExpiresAt: new Date(expiresAtMs).toISOString(),
+        linkedAt: new Date().toISOString(),
+    });
+    return refreshed.access_token;
+}
+//# sourceMappingURL=client.js.map

package/v3/@claude-flow/cli/dist/src/auth/constants.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Shared ADR-306 constants — split out so `commands/auth.ts` and
+ * `auth/client.ts` reference the same keychain service name rather than two
+ * independently-typed string literals that could silently drift apart.
+ */
+export declare const KEYCHAIN_SERVICE = "ruflo-cognitum-auth";
+//# sourceMappingURL=constants.d.ts.map

package/v3/@claude-flow/cli/dist/src/auth/constants.js

@@ -0,0 +1,7 @@
+/**
+ * Shared ADR-306 constants — split out so `commands/auth.ts` and
+ * `auth/client.ts` reference the same keychain service name rather than two
+ * independently-typed string literals that could silently drift apart.
+ */
+export const KEYCHAIN_SERVICE = 'ruflo-cognitum-auth';
+//# sourceMappingURL=constants.js.map

package/v3/@claude-flow/cli/dist/src/auth/scopes.d.ts

@@ -0,0 +1,14 @@
+/**
+ * ADR-306 scope <-> ADR-302 consent-domain mapping.
+ *
+ * The 5 ADR-306 scopes map 1:1 onto 5 `ConsentDomain` values that already
+ * exist in src/funnel/types.ts (pre-provisioned for exactly this purpose —
+ * see that file's own comments). No new consent machinery is needed; this
+ * module is just the lookup table ADR-306 describes but never names in code.
+ */
+import type { ConsentDomain } from '../funnel/index.js';
+export declare const SCOPE_TO_DOMAIN: Record<string, ConsentDomain>;
+export declare function domainForScope(scope: string): ConsentDomain | undefined;
+/** `login` always requests this scope only, on first run — ADR-306. */
+export declare const INITIAL_SCOPE = "account.create";
+//# sourceMappingURL=scopes.d.ts.map

package/v3/@claude-flow/cli/dist/src/auth/scopes.js

@@ -0,0 +1,21 @@
+/**
+ * ADR-306 scope <-> ADR-302 consent-domain mapping.
+ *
+ * The 5 ADR-306 scopes map 1:1 onto 5 `ConsentDomain` values that already
+ * exist in src/funnel/types.ts (pre-provisioned for exactly this purpose —
+ * see that file's own comments). No new consent machinery is needed; this
+ * module is just the lookup table ADR-306 describes but never names in code.
+ */
+export const SCOPE_TO_DOMAIN = {
+    'account.create': 'account',
+    'proxy.use': 'proxy-install',
+    'cloud.route': 'cloud-routing',
+    'telemetry.write': 'telemetry',
+    'hosted.memory.use': 'hosted-memory',
+};
+export function domainForScope(scope) {
+    return SCOPE_TO_DOMAIN[scope];
+}
+/** `login` always requests this scope only, on first run — ADR-306. */
+export const INITIAL_SCOPE = 'account.create';
+//# sourceMappingURL=scopes.js.map

package/v3/@claude-flow/cli/dist/src/auth/security-bridge.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Lazy loader for `@claude-flow/security`'s OAuth + keychain surface
+ * (ADR-306). `@claude-flow/security` is an `optionalDependency` of this
+ * package (see package.json) — `ruflo auth` is the one capability that
+ * genuinely cannot function without it, so this module's job is turning "the
+ * optional package failed to install" into one clear, actionable error
+ * instead of a raw `ERR_MODULE_NOT_FOUND` stack trace. Mirrors the
+ * lazy-`require`-in-try/catch idiom already used for this same package in
+ * src/mcp-client.ts's `applyContentBoundaryGuardrail`, but as an async
+ * dynamic `import()` (the security package is itself `"type": "module"`).
+ *
+ * Only `import type` is used for the package's real types below — type-only
+ * imports are fully erased at compile time and never touch the runtime
+ * module resolver, so this file type-checks whether or not the optional
+ * dependency happens to be installed in a given consumer's node_modules.
+ */
+import type { authorizeUrl as AuthorizeUrlFn, exchangeCode as ExchangeCodeFn, refreshToken as RefreshTokenFn, exchangeManualCode as ExchangeManualCodeFn, generatePkce as GeneratePkceFn, OAuthTokenResponse, PkceRequest, CallbackServer as CallbackServerClass, CallbackResult, openBrowser as OpenBrowserFn, createKeychainAdapter as CreateKeychainAdapterFn, KeychainAdapter, OAuthError as OAuthErrorClass } from '@claude-flow/security';
+export interface SecurityOAuthModule {
+    authorizeUrl: typeof AuthorizeUrlFn;
+    exchangeCode: typeof ExchangeCodeFn;
+    refreshToken: typeof RefreshTokenFn;
+    exchangeManualCode: typeof ExchangeManualCodeFn;
+    generatePkce: typeof GeneratePkceFn;
+    CallbackServer: typeof CallbackServerClass;
+    openBrowser: typeof OpenBrowserFn;
+    createKeychainAdapter: typeof CreateKeychainAdapterFn;
+    OAuthError: typeof OAuthErrorClass;
+    OOB_REDIRECT_URI: string;
+}
+export type { OAuthTokenResponse, PkceRequest, CallbackResult, KeychainAdapter };
+export declare class SecurityPackageMissingError extends Error {
+    constructor(cause: unknown);
+}
+/** Loads `@claude-flow/security`'s OAuth surface, throwing a clear error if it's absent. */
+export declare function loadSecurityOAuth(): Promise<SecurityOAuthModule>;
+//# sourceMappingURL=security-bridge.d.ts.map

package/v3/@claude-flow/cli/dist/src/auth/security-bridge.js

@@ -0,0 +1,42 @@
+/**
+ * Lazy loader for `@claude-flow/security`'s OAuth + keychain surface
+ * (ADR-306). `@claude-flow/security` is an `optionalDependency` of this
+ * package (see package.json) — `ruflo auth` is the one capability that
+ * genuinely cannot function without it, so this module's job is turning "the
+ * optional package failed to install" into one clear, actionable error
+ * instead of a raw `ERR_MODULE_NOT_FOUND` stack trace. Mirrors the
+ * lazy-`require`-in-try/catch idiom already used for this same package in
+ * src/mcp-client.ts's `applyContentBoundaryGuardrail`, but as an async
+ * dynamic `import()` (the security package is itself `"type": "module"`).
+ *
+ * Only `import type` is used for the package's real types below — type-only
+ * imports are fully erased at compile time and never touch the runtime
+ * module resolver, so this file type-checks whether or not the optional
+ * dependency happens to be installed in a given consumer's node_modules.
+ */
+export class SecurityPackageMissingError extends Error {
+    constructor(cause) {
+        super("ruflo auth needs the '@claude-flow/security' package, which isn't installed " +
+            "(it's an optional dependency — install/reinstall failed or was skipped for this " +
+            `platform). Try: npm install @claude-flow/security. Underlying error: ${cause instanceof Error ? cause.message : String(cause)}`);
+        this.name = 'SecurityPackageMissingError';
+    }
+}
+let cached = null;
+/** Loads `@claude-flow/security`'s OAuth surface, throwing a clear error if it's absent. */
+export async function loadSecurityOAuth() {
+    if (cached)
+        return cached;
+    try {
+        const mod = (await import('@claude-flow/security'));
+        if (!mod.authorizeUrl || !mod.createKeychainAdapter) {
+            throw new Error('module loaded but is missing expected OAuth exports');
+        }
+        cached = mod;
+        return mod;
+    }
+    catch (e) {
+        throw new SecurityPackageMissingError(e);
+    }
+}
+//# sourceMappingURL=security-bridge.js.map

package/v3/@claude-flow/cli/dist/src/auth/session.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Process-lifetime in-memory access-token cache (ADR-306).
+ *
+ * The access token is never written to `auth.json` or any other disk file —
+ * only the refresh token (via the OS keychain, or nowhere in session-only
+ * mode) survives a process exit. Every fresh `ruflo` invocation starts with
+ * an empty cache and re-derives an access token from the refresh token (or
+ * asks the user to log in again, in session-only mode). This is a deliberate
+ * ADR-306 usability cost, not something to "fix" by persisting the access
+ * token — see auth/types.ts's doc comment.
+ */
+export declare function setSessionToken(profile: string, accessToken: string, expiresAtMs: number): void;
+/**
+ * Returns the cached access token when it remains valid for at least
+ * `minValidityMs`. Authenticated callers use a small refresh window so a
+ * token cannot expire while an outbound request is in flight.
+ */
+export declare function getSessionToken(profile: string, minValidityMs?: number): string | null;
+export declare function clearSessionToken(profile: string): void;
+//# sourceMappingURL=session.d.ts.map

package/v3/@claude-flow/cli/dist/src/auth/session.js

@@ -0,0 +1,32 @@
+/**
+ * Process-lifetime in-memory access-token cache (ADR-306).
+ *
+ * The access token is never written to `auth.json` or any other disk file —
+ * only the refresh token (via the OS keychain, or nowhere in session-only
+ * mode) survives a process exit. Every fresh `ruflo` invocation starts with
+ * an empty cache and re-derives an access token from the refresh token (or
+ * asks the user to log in again, in session-only mode). This is a deliberate
+ * ADR-306 usability cost, not something to "fix" by persisting the access
+ * token — see auth/types.ts's doc comment.
+ */
+const sessions = new Map();
+export function setSessionToken(profile, accessToken, expiresAtMs) {
+    sessions.set(profile, { accessToken, expiresAt: expiresAtMs });
+}
+/**
+ * Returns the cached access token when it remains valid for at least
+ * `minValidityMs`. Authenticated callers use a small refresh window so a
+ * token cannot expire while an outbound request is in flight.
+ */
+export function getSessionToken(profile, minValidityMs = 0) {
+    const entry = sessions.get(profile);
+    if (!entry)
+        return null;
+    if (Date.now() + Math.max(0, minValidityMs) >= entry.expiresAt)
+        return null;
+    return entry.accessToken;
+}
+export function clearSessionToken(profile) {
+    sessions.delete(profile);
+}
+//# sourceMappingURL=session.js.map

package/v3/@claude-flow/cli/dist/src/auth/state.d.ts

@@ -0,0 +1,19 @@
+/**
+ * `auth.json` persistence — atomic tmp+rename, 0600, under ~/.ruflo (ADR-306).
+ * Reuses the exact same primitives `proxy-config.toml`'s consent mirror and
+ * every other funnel state file already use (src/funnel/state.ts).
+ */
+import type { AuthFile, ProfileAuthState } from './types.js';
+export declare const DEFAULT_PROFILE = "default";
+export declare function readAuthFile(): AuthFile;
+export declare function getProfile(name?: string): ProfileAuthState | null;
+export declare function listProfiles(): {
+    defaultProfile: string;
+    profiles: ProfileAuthState[];
+};
+/** Writes/overwrites a profile. The first profile ever written becomes the default. */
+export declare function setProfile(name: string, state: ProfileAuthState, makeDefault?: boolean): void;
+export declare function removeProfile(name: string): boolean;
+/** `auth logout --all` — forgets every profile. */
+export declare function clearAllProfiles(): void;
+//# sourceMappingURL=state.d.ts.map

package/v3/@claude-flow/cli/dist/src/auth/state.js

@@ -0,0 +1,53 @@
+/**
+ * `auth.json` persistence — atomic tmp+rename, 0600, under ~/.ruflo (ADR-306).
+ * Reuses the exact same primitives `proxy-config.toml`'s consent mirror and
+ * every other funnel state file already use (src/funnel/state.ts).
+ */
+import { readStateJson, writeStateJson, deleteStateFile } from '../funnel/state.js';
+const AUTH_FILE = 'auth.json';
+export const DEFAULT_PROFILE = 'default';
+function emptyAuthFile() {
+    return { schemaVersion: 1, defaultProfile: DEFAULT_PROFILE, profiles: {} };
+}
+export function readAuthFile() {
+    const file = readStateJson(AUTH_FILE);
+    return file ?? emptyAuthFile();
+}
+function writeAuthFile(file) {
+    writeStateJson(AUTH_FILE, file);
+}
+export function getProfile(name) {
+    const file = readAuthFile();
+    const key = name ?? file.defaultProfile;
+    return file.profiles[key] ?? null;
+}
+export function listProfiles() {
+    const file = readAuthFile();
+    return { defaultProfile: file.defaultProfile, profiles: Object.values(file.profiles) };
+}
+/** Writes/overwrites a profile. The first profile ever written becomes the default. */
+export function setProfile(name, state, makeDefault = false) {
+    const file = readAuthFile();
+    const isFirst = Object.keys(file.profiles).length === 0;
+    file.profiles[name] = state;
+    if (makeDefault || isFirst)
+        file.defaultProfile = name;
+    writeAuthFile(file);
+}
+export function removeProfile(name) {
+    const file = readAuthFile();
+    if (!(name in file.profiles))
+        return false;
+    delete file.profiles[name];
+    if (file.defaultProfile === name) {
+        const remaining = Object.keys(file.profiles);
+        file.defaultProfile = remaining[0] ?? DEFAULT_PROFILE;
+    }
+    writeAuthFile(file);
+    return true;
+}
+/** `auth logout --all` — forgets every profile. */
+export function clearAllProfiles() {
+    deleteStateFile(AUTH_FILE);
+}
+//# sourceMappingURL=state.js.map

package/v3/@claude-flow/cli/dist/src/auth/types.d.ts

@@ -0,0 +1,27 @@
+/**
+ * `ruflo auth` state shapes (ADR-306).
+ *
+ * `auth.json` holds identity metadata ONLY — never token material. The
+ * access token lives exclusively in a process-lifetime in-memory singleton
+ * (session.ts); the refresh token goes to the OS keychain (keychainRef set)
+ * or nowhere at all when no keychain backend is reachable (keychainRef:
+ * null — session-only mode, ADR-306's accepted usability cost, not a bug).
+ */
+export interface ProfileAuthState {
+    accountId: string;
+    scopes: string[];
+    /** ISO timestamp — the access token's own expiry, not tracked beyond this. */
+    accessTokenExpiresAt: string;
+    /** OS-keychain account identifier for this profile's refresh token, or null if session-only. */
+    keychainRef: string | null;
+    profile: string;
+    loginMethod: 'pkce' | 'device' | 'token-stdin';
+    /** ISO timestamp of the login that created/last-refreshed this profile. */
+    linkedAt: string;
+}
+export interface AuthFile {
+    schemaVersion: 1;
+    defaultProfile: string;
+    profiles: Record<string, ProfileAuthState>;
+}
+//# sourceMappingURL=types.d.ts.map

package/v3/@claude-flow/cli/dist/src/auth/types.js

@@ -0,0 +1,11 @@
+/**
+ * `ruflo auth` state shapes (ADR-306).
+ *
+ * `auth.json` holds identity metadata ONLY — never token material. The
+ * access token lives exclusively in a process-lifetime in-memory singleton
+ * (session.ts); the refresh token goes to the OS keychain (keychainRef set)
+ * or nowhere at all when no keychain backend is reachable (keychainRef:
+ * null — session-only mode, ADR-306's accepted usability cost, not a bug).
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/v3/@claude-flow/cli/dist/src/commands/auth.d.ts

@@ -0,0 +1,15 @@
+/**
+ * `ruflo auth` — Cognitum identity (ADR-306).
+ *
+ * `login` obtains OAuth tokens via the loopback PKCE flow (default,
+ * interactive desktop), the OOB manual-paste flow (`--no-browser`, or
+ * auto-detected headless environments), or `--token-stdin` (CI/enterprise
+ * automation — refuses interactively otherwise, per ADR-306). The refresh
+ * token goes to the OS keychain when reachable, or nowhere (session-only —
+ * a deliberate usability cost, not a bug) when it isn't. The access token
+ * itself is NEVER written to disk; see src/auth/session.ts.
+ */
+import type { Command } from '../types.js';
+export declare const authCommand: Command;
+export default authCommand;
+//# sourceMappingURL=auth.d.ts.map