clawdbot-penfield 1.0.1

package/dist/src/api-client.js

@@ -0,0 +1,53 @@
+export class PenfieldApiClient {
+    auth;
+    apiUrl;
+    logger;
+    constructor(auth, apiUrl, logger) {
+        this.auth = auth;
+        this.apiUrl = apiUrl;
+        this.logger = logger;
+    }
+    async request(method, endpoint, body, queryParams) {
+        const token = await this.auth.getAccessToken();
+        let url = `${this.apiUrl}${endpoint}`;
+        if (queryParams) {
+            const params = new URLSearchParams(queryParams);
+            url += `?${params.toString()}`;
+        }
+        this.logger?.info(`[penfield] ${method} ${endpoint}`);
+        const response = await fetch(url, {
+            method,
+            headers: {
+                Authorization: `Bearer ${token}`,
+                "Content-Type": "application/json",
+            },
+            body: body ? JSON.stringify(body) : undefined,
+        });
+        // Handle rate limiting
+        if (response.status === 429) {
+            const retryAfter = response.headers.get("Retry-After");
+            throw new Error(`Rate limit exceeded. Retry after ${retryAfter} seconds`);
+        }
+        if (!response.ok) {
+            const error = await response.json().catch(() => ({}));
+            const errorMessage = `API request failed: ${response.status} ${response.statusText}` +
+                (error.error?.message ? ` - ${error.error.message}` : "");
+            this.logger?.error(`[penfield] ${errorMessage}`);
+            throw new Error(errorMessage);
+        }
+        const data = await response.json();
+        return (data.data || data);
+    }
+    async get(endpoint, queryParams) {
+        return this.request("GET", endpoint, undefined, queryParams);
+    }
+    async post(endpoint, body) {
+        return this.request("POST", endpoint, body);
+    }
+    async put(endpoint, body) {
+        return this.request("PUT", endpoint, body);
+    }
+    async delete(endpoint, queryParams) {
+        return this.request("DELETE", endpoint, undefined, queryParams);
+    }
+}

package/dist/src/auth-service.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Background authentication service for Penfield plugin
+ *
+ * Handles OAuth 2.0 token refresh silently in the background
+ * without agent involvement. Registered as a Clawdbot service.
+ *
+ * Supports RFC 8628 Device Code Flow and RFC 9700 Token Rotation.
+ * For refresh tokens, use a DCR-registered client with offline_access scope.
+ *
+ * Service lifecycle:
+ * - start(): Load credentials, begin background refresh loop
+ * - stop(): Clear refresh interval, cleanup
+ */
+import type { Logger } from './types.js';
+export interface AuthService {
+    /** Start the auth service and background refresh loop */
+    start(): Promise<void>;
+    /** Stop the service and cleanup */
+    stop(): Promise<void>;
+    /** Get a valid access token (cached or refreshed) */
+    getAccessToken(): Promise<string>;
+    /** Check if authenticated with valid credentials */
+    isAuthenticated(): boolean;
+}
+interface AuthServiceOptions {
+    authUrl: string;
+    /** Optional clientId - will be loaded from credentials if not provided */
+    clientId?: string;
+}
+export declare function createAuthService(api: {
+    logger: Logger;
+    resolvePath: (path: string) => string;
+}, options: AuthServiceOptions): AuthService;
+export {};
+//# sourceMappingURL=auth-service.d.ts.map

package/dist/src/auth-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-service.d.ts","sourceRoot":"","sources":["../../src/auth-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAKzC,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,mCAAmC;IACnC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,qDAAqD;IACrD,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,oDAAoD;IACpD,eAAe,IAAI,OAAO,CAAC;CAC5B;AAED,UAAU,kBAAkB;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;CAAE,EAC9D,OAAO,EAAE,kBAAkB,GAC1B,WAAW,CAsMb"}

package/dist/src/auth-service.js

@@ -0,0 +1,197 @@
+/**
+ * Background authentication service for Penfield plugin
+ *
+ * Handles OAuth 2.0 token refresh silently in the background
+ * without agent involvement. Registered as a Clawdbot service.
+ *
+ * Supports RFC 8628 Device Code Flow and RFC 9700 Token Rotation.
+ * For refresh tokens, use a DCR-registered client with offline_access scope.
+ *
+ * Service lifecycle:
+ * - start(): Load credentials, begin background refresh loop
+ * - stop(): Clear refresh interval, cleanup
+ */
+import { loadCredential, saveCredential, TOKEN_EXPIRY_BUFFER_MS } from './store.js';
+import { refreshAccessToken } from './device-flow.js';
+// Refresh interval: check every 60 minutes
+const REFRESH_INTERVAL_MS = 60 * 60 * 1000;
+export function createAuthService(api, options) {
+    const { authUrl, clientId: providedClientId } = options;
+    const logger = api.logger;
+    // In-memory token cache
+    let accessToken = null;
+    let refreshToken = null;
+    let expiresAt = 0;
+    let clientId = providedClientId || null;
+    // Background refresh interval
+    let refreshInterval = null;
+    let isRunning = false;
+    /**
+     * Load credentials from file into memory cache
+     */
+    function loadCredentials() {
+        const cred = loadCredential(api);
+        if (!cred)
+            return false;
+        accessToken = cred.access;
+        refreshToken = cred.refresh || null;
+        expiresAt = cred.expires;
+        clientId = cred.clientId || clientId;
+        return true;
+    }
+    /**
+     * Save current in-memory tokens to file (RFC 9700 token rotation)
+     */
+    function saveTokensToFile() {
+        if (accessToken && expiresAt > 0 && clientId) {
+            saveCredential(api, {
+                clientId,
+                access: accessToken,
+                refresh: refreshToken || undefined, // May be undefined for non-DCR clients
+                expires: expiresAt,
+            });
+        }
+    }
+    /**
+     * Check if token is expired or about to expire
+     */
+    function isTokenExpired() {
+        if (!accessToken || !expiresAt)
+            return true;
+        return Date.now() >= expiresAt - TOKEN_EXPIRY_BUFFER_MS;
+    }
+    /**
+     * Perform OAuth token refresh using RFC 8628 + RFC 9700
+     * Retry with exponential backoff on network errors
+     */
+    async function doRefreshAccessToken() {
+        if (!refreshToken) {
+            logger.info('[penfield-auth] No refresh token - automatic refresh disabled');
+            return false;
+        }
+        if (!clientId) {
+            logger.warn('[penfield-auth] No clientId - cannot refresh token');
+            return false;
+        }
+        const maxRetries = 3;
+        let attempt = 0;
+        const baseDelay = 1000; // 1 second
+        while (attempt < maxRetries) {
+            attempt++;
+            try {
+                const result = await refreshAccessToken(authUrl, refreshToken, clientId);
+                // Update in-memory tokens (RFC 9700: always use new refresh token)
+                accessToken = result.access_token;
+                refreshToken = result.refresh_token || refreshToken; // Rotate if provided
+                expiresAt = Date.now() + result.expires_in * 1000;
+                // Persist to file
+                saveTokensToFile();
+                if (attempt > 1) {
+                    logger.info(`[penfield-auth] Token refreshed successfully after ${attempt} attempts`);
+                }
+                else {
+                    logger.info('[penfield-auth] Token refreshed successfully');
+                }
+                return true;
+            }
+            catch (err) {
+                const isNetworkError = err instanceof TypeError || String(err).includes('fetch') || String(err).includes('network');
+                if (isNetworkError && attempt < maxRetries) {
+                    const delay = baseDelay * Math.pow(2, attempt - 1);
+                    logger.warn(`[penfield-auth] Network error on attempt ${attempt}/${maxRetries}, retrying in ${delay}ms: ${err}`);
+                    await new Promise(resolve => setTimeout(resolve, delay));
+                }
+                else {
+                    logger.warn(`[penfield-auth] Token refresh failed: ${err}`);
+                    return false;
+                }
+            }
+        }
+        return false;
+    }
+    /**
+     * Background refresh loop - runs every 60 minutes
+     */
+    async function backgroundRefresh() {
+        if (!isRunning)
+            return;
+        try {
+            // Reload from file first (handles edge cases)
+            const cred = loadCredential(api);
+            if (!cred) {
+                // No credentials yet - service is running but not authenticated
+                return;
+            }
+            // Check if we need to refresh
+            const msUntilExpiry = cred.expires - Date.now();
+            if (msUntilExpiry < TOKEN_EXPIRY_BUFFER_MS) {
+                await doRefreshAccessToken();
+            }
+        }
+        catch (err) {
+            // Log but don't crash - continue checking on next interval
+            logger.warn(`[penfield-auth] Background refresh check failed: ${err}`);
+        }
+    }
+    return {
+        async start() {
+            if (isRunning)
+                return;
+            // Load credentials from file
+            const hasCreds = loadCredentials();
+            if (hasCreds) {
+                if (refreshToken) {
+                    logger.info('[penfield-auth] Credentials loaded, starting background refresh');
+                }
+                else {
+                    logger.info('[penfield-auth] Credentials loaded (no refresh token - manual re-auth required when expired)');
+                }
+            }
+            else {
+                logger.info('[penfield-auth] No credentials found, service running in unauthenticated mode');
+            }
+            // Start background refresh loop
+            isRunning = true;
+            refreshInterval = setInterval(backgroundRefresh, REFRESH_INTERVAL_MS);
+        },
+        async stop() {
+            if (!isRunning)
+                return;
+            isRunning = false;
+            if (refreshInterval) {
+                clearInterval(refreshInterval);
+                refreshInterval = null;
+            }
+            logger.info('[penfield-auth] Service stopped');
+        },
+        async getAccessToken() {
+            // Load from file if not in memory
+            if (!accessToken || !expiresAt) {
+                if (!loadCredentials()) {
+                    throw new Error('Not authenticated. Run: clawdbot penfield login');
+                }
+            }
+            // Refresh if expired or about to expire
+            if (isTokenExpired()) {
+                // Try refresh first if we have a refresh token
+                if (refreshToken) {
+                    const success = await doRefreshAccessToken();
+                    if (!success) {
+                        throw new Error('Token refresh failed. Run: clawdbot penfield login');
+                    }
+                }
+                else {
+                    throw new Error('Token expired. Run: clawdbot penfield login');
+                }
+            }
+            return accessToken;
+        },
+        isAuthenticated() {
+            if (!accessToken || !expiresAt) {
+                return loadCredentials();
+            }
+            // Even without refresh token, we're authenticated if we have a valid access token
+            return Date.now() < expiresAt - TOKEN_EXPIRY_BUFFER_MS;
+        },
+    };
+}

package/dist/src/cli.d.ts

@@ -0,0 +1,9 @@
+/**
+ * CLI command registration for Penfield plugin
+ */
+import type { ClawdbotPluginApi } from './types.js';
+/**
+ * Register the 'penfield' CLI command group with 'login' subcommand
+ */
+export declare function registerLoginCommand(api: ClawdbotPluginApi): void;
+//# sourceMappingURL=cli.d.ts.map

package/dist/src/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAsB,MAAM,YAAY,CAAC;AAKxE;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,CA4CjE"}

package/dist/src/cli.js

@@ -0,0 +1,50 @@
+/**
+ * CLI command registration for Penfield plugin
+ */
+import { executeDeviceFlow } from './device-flow.js';
+import { saveCredential } from './store.js';
+import { DEFAULT_AUTH_URL } from './config.js';
+/**
+ * Register the 'penfield' CLI command group with 'login' subcommand
+ */
+export function registerLoginCommand(api) {
+    api.registerCli(({ program, logger }) => {
+        const root = program
+            .command('penfield')
+            .description('Penfield Memory commands');
+        root
+            .command('login')
+            .description('Authenticate with Penfield using OAuth Device Flow')
+            .action(async () => {
+            try {
+                // Use pluginConfig directly (same as index.ts)
+                const config = api.pluginConfig;
+                const authUrl = config?.authUrl || DEFAULT_AUTH_URL;
+                logger.info(`[penfield] CLI login - authUrl: ${authUrl}`);
+                // CLI context doesn't have api.runtime, so create a prompter from logger
+                const prompter = {
+                    info(msg) { logger.info(msg); },
+                    warn(msg) { logger.warn(msg); },
+                    error(msg) { logger.error(msg); },
+                };
+                const tokens = await executeDeviceFlow({
+                    authUrl,
+                    clientId: config?.clientId, // Optional - will register if not provided
+                    prompter,
+                    // openUrl not available in CLI context
+                });
+                saveCredential(api, {
+                    clientId: tokens.clientId,
+                    access: tokens.access_token,
+                    refresh: tokens.refresh_token,
+                    expires: Date.now() + tokens.expires_in * 1000,
+                });
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                logger.error(`Login failed: ${message}`);
+                process.exit(1);
+            }
+        });
+    }, { commands: ['penfield'] });
+}

package/dist/src/config.d.ts

@@ -0,0 +1,16 @@
+import { z } from "zod";
+declare const DEFAULT_AUTH_URL: string;
+declare const DEFAULT_API_URL: string;
+export { DEFAULT_AUTH_URL, DEFAULT_API_URL };
+export declare const PenfieldConfigSchema: z.ZodObject<{
+    authUrl: z.ZodOptional<z.ZodString>;
+    apiUrl: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    authUrl?: string | undefined;
+    apiUrl?: string | undefined;
+}, {
+    authUrl?: string | undefined;
+    apiUrl?: string | undefined;
+}>;
+export type PenfieldConfig = z.infer<typeof PenfieldConfigSchema>;
+//# sourceMappingURL=config.d.ts.map

package/dist/src/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,QAAA,MAAM,gBAAgB,QAA+D,CAAC;AACtF,QAAA,MAAM,eAAe,QAA6D,CAAC;AAEnF,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC;AAO7C,eAAO,MAAM,oBAAoB;;;;;;;;;EAGtB,CAAC;AAEZ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/src/config.js

@@ -0,0 +1,14 @@
+import { z } from "zod";
+// Production defaults - can be overridden via config or environment variables
+const DEFAULT_AUTH_URL = process.env.PENFIELD_AUTH_URL || "https://auth.penfield.app";
+const DEFAULT_API_URL = process.env.PENFIELD_API_URL || "https://api.penfield.app";
+export { DEFAULT_AUTH_URL, DEFAULT_API_URL };
+// Minimal config schema - everything optional for device flow
+// Note: enabled is handled by Clawdbot at entry level, not in pluginConfig
+//
+// IMPORTANT: This zod schema is the source of truth for config validation.
+// If you modify this, also update clawdbot.plugin.json configSchema to match.
+export const PenfieldConfigSchema = z.object({
+    authUrl: z.string().optional(),
+    apiUrl: z.string().optional(),
+}).strict();

package/dist/src/device-flow.d.ts

@@ -0,0 +1,35 @@
+/**
+ * RFC 8628 Device Code Flow implementation for Penfield OAuth
+ *
+ * Discovers endpoints dynamically from /.well-known/oauth-authorization-server
+ */
+export interface DeviceFlowParams {
+    /** Base URL of Penfield Auth service (e.g., https://auth.penfield.app) */
+    authUrl: string;
+    /** OAuth client ID (optional - will register if not provided) */
+    clientId?: string;
+    /** Prompter for showing messages to user */
+    prompter: {
+        info(msg: string): void;
+        warn(msg: string): void;
+        error(msg: string): void;
+    };
+    /** Optional: open URL in browser */
+    openUrl?: (url: string) => Promise<void>;
+}
+export interface DeviceFlowResult {
+    clientId: string;
+    access_token: string;
+    refresh_token?: string;
+    expires_in: number;
+    scope?: string;
+}
+/**
+ * Execute the complete OAuth Device Code Flow (RFC 8628)
+ */
+export declare function executeDeviceFlow(params: DeviceFlowParams): Promise<DeviceFlowResult>;
+/**
+ * Refresh an access token using a refresh token (RFC 8628 + RFC 9700)
+ */
+export declare function refreshAccessToken(authUrl: string, refreshToken: string, clientId: string): Promise<DeviceFlowResult>;
+//# sourceMappingURL=device-flow.d.ts.map

package/dist/src/device-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow.d.ts","sourceRoot":"","sources":["../../src/device-flow.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,QAAQ,EAAE;QAAE,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACzF,oCAAoC;IACpC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA8ED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA2G3F;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,CAAC,CA4B3B"}

package/dist/src/device-flow.js

@@ -0,0 +1,169 @@
+/**
+ * RFC 8628 Device Code Flow implementation for Penfield OAuth
+ *
+ * Discovers endpoints dynamically from /.well-known/oauth-authorization-server
+ */
+/**
+ * Discover OAuth endpoints from .well-known/oauth-authorization-server
+ */
+async function discoverEndpoints(authUrl) {
+    const response = await fetch(`${authUrl}/.well-known/oauth-authorization-server`);
+    if (!response.ok) {
+        throw new Error(`Failed to discover OAuth endpoints: ${response.statusText}`);
+    }
+    return response.json();
+}
+/**
+ * Register a dynamic client (DCR) if clientId not provided
+ * Returns the client_id to use
+ */
+async function getOrRegisterClient(authUrl, providedClientId, prompter) {
+    if (providedClientId) {
+        return providedClientId;
+    }
+    // Discover endpoints dynamically (RFC 8414)
+    const discovery = await discoverEndpoints(authUrl);
+    // RFC 8414: registration_endpoint must be advertised if DCR is supported
+    if (!discovery.registration_endpoint) {
+        throw new Error('Dynamic Client Registration not supported: registration_endpoint not advertised in OAuth discovery');
+    }
+    const registrationEndpoint = discovery.registration_endpoint;
+    const regResp = await fetch(registrationEndpoint, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            client_name: 'clawdbot-penfield',
+            redirect_uris: ['http://localhost:8080/callback'],
+            grant_types: ['urn:ietf:params:oauth:grant-type:device_code', 'refresh_token'],
+            response_types: ['code'],
+            token_endpoint_auth_method: 'none',
+            scope: 'read write offline_access'
+        })
+    });
+    if (!regResp.ok) {
+        const error = await regResp.json().catch(() => ({}));
+        throw new Error(`Client registration failed: ${error.error_description || error.error || regResp.statusText}`);
+    }
+    const client = await regResp.json();
+    prompter?.info(`[penfield] Registered dynamic client: ${client.client_id}`);
+    return client.client_id;
+}
+/**
+ * Execute the complete OAuth Device Code Flow (RFC 8628)
+ */
+export async function executeDeviceFlow(params) {
+    const { authUrl, clientId, prompter, openUrl } = params;
+    // Discover endpoints dynamically
+    const discovery = await discoverEndpoints(authUrl);
+    const tokenEndpoint = discovery.token_endpoint;
+    // Get or register client
+    const actualClientId = await getOrRegisterClient(authUrl, clientId, prompter);
+    // RFC 8628: device_authorization_endpoint must be advertised for device flow
+    if (!discovery.device_authorization_endpoint) {
+        throw new Error('Device Authorization Grant not supported: device_authorization_endpoint not advertised in OAuth discovery');
+    }
+    const deviceEndpoint = discovery.device_authorization_endpoint;
+    // Request offline_access for refresh tokens (RFC 8628 + RFC 9700)
+    const scope = 'read write offline_access';
+    // Step 1: Request device code (form-encoded per RFC 8628)
+    const deviceResp = await fetch(deviceEndpoint, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            client_id: actualClientId,
+            scope
+        })
+    });
+    if (!deviceResp.ok) {
+        const error = await deviceResp.json().catch(() => ({}));
+        throw new Error(`Device authorization failed: ${deviceResp.statusText}${error.error ? ` - ${error.error}` : ''}`);
+    }
+    const deviceData = await deviceResp.json();
+    const { device_code, user_code, verification_uri_complete, expires_in, interval } = deviceData;
+    // Step 2: Show user instructions
+    prompter.info(`🔐 Penfield Authorization Required\n`);
+    prompter.info(`To authorize, visit: ${verification_uri_complete || deviceData.verification_uri}`);
+    prompter.info(`Or enter code: ${user_code}\n`);
+    prompter.info(`Waiting for authorization...`);
+    if (openUrl && verification_uri_complete) {
+        try {
+            await openUrl(verification_uri_complete);
+        }
+        catch {
+            // Silently ignore openUrl failures
+        }
+    }
+    // Step 3: Poll for token (form-encoded per RFC 8628)
+    let pollInterval = interval || 5;
+    const expiresAt = Date.now() + (expires_in * 1000);
+    while (Date.now() < expiresAt) {
+        await new Promise(resolve => setTimeout(resolve, pollInterval * 1000));
+        const tokenResp = await fetch(tokenEndpoint, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+                grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+                device_code,
+                client_id: actualClientId
+            })
+        });
+        if (tokenResp.ok) {
+            const tokens = await tokenResp.json();
+            prompter.info('✅ Authorization successful!');
+            return {
+                clientId: actualClientId,
+                access_token: tokens.access_token,
+                refresh_token: tokens.refresh_token,
+                expires_in: tokens.expires_in,
+                scope: tokens.scope
+            };
+        }
+        const error = await tokenResp.json().catch(() => ({}));
+        if (error.error === 'authorization_pending') {
+            continue;
+        }
+        if (error.error === 'slow_down') {
+            pollInterval += 5;
+            continue;
+        }
+        if (error.error === 'access_denied') {
+            throw new Error('Authorization denied by user');
+        }
+        if (error.error === 'expired_token') {
+            throw new Error('Device code expired - please try again');
+        }
+        // Provide meaningful error message
+        const errorDesc = error.error_description || error.error || 'Unknown error';
+        throw new Error(`Authorization failed: ${errorDesc}`);
+    }
+    throw new Error('Device code expired - please try again');
+}
+/**
+ * Refresh an access token using a refresh token (RFC 8628 + RFC 9700)
+ */
+export async function refreshAccessToken(authUrl, refreshToken, clientId) {
+    // Discover token endpoint dynamically
+    const discovery = await discoverEndpoints(authUrl);
+    const tokenEndpoint = discovery.token_endpoint;
+    const tokenResp = await fetch(tokenEndpoint, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            grant_type: 'refresh_token',
+            refresh_token: refreshToken,
+            client_id: clientId
+        })
+    });
+    if (!tokenResp.ok) {
+        const error = await tokenResp.json().catch(() => ({}));
+        throw new Error(`Token refresh failed: ${error.error_description || error.error || tokenResp.statusText}`);
+    }
+    const tokens = await tokenResp.json();
+    return {
+        clientId, // Pass through the clientId
+        access_token: tokens.access_token,
+        refresh_token: tokens.refresh_token, // RFC 9700: token rotation - use new refresh token
+        expires_in: tokens.expires_in,
+        scope: tokens.scope
+    };
+}

package/dist/src/runtime.d.ts

@@ -0,0 +1,18 @@
+import { type AuthService } from "./auth-service.js";
+import { PenfieldApiClient } from "./api-client.js";
+import { type PenfieldConfig } from "./config.js";
+import type { ClawdbotPluginApi, Logger } from "./types.js";
+export interface PenfieldRuntime {
+    config: PenfieldConfig;
+    apiClient: PenfieldApiClient;
+    authService: AuthService;
+    stop: () => Promise<void>;
+}
+export interface CreateRuntimeParams {
+    api: ClawdbotPluginApi;
+    config: PenfieldConfig;
+    authService: AuthService;
+    logger?: Logger;
+}
+export declare function createPenfieldRuntime(params: CreateRuntimeParams): Promise<PenfieldRuntime>;
+//# sourceMappingURL=runtime.d.ts.map

package/dist/src/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAmB,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAE5D,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,cAAc,CAAC;IACvB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,WAAW,EAAE,WAAW,CAAC;IACzB,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,iBAAiB,CAAC;IACvB,MAAM,EAAE,cAAc,CAAC;IACvB,WAAW,EAAE,WAAW,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,eAAe,CAAC,CAmBjG"}

package/dist/src/runtime.js

@@ -0,0 +1,18 @@
+import { PenfieldApiClient } from "./api-client.js";
+import { DEFAULT_API_URL } from "./config.js";
+export async function createPenfieldRuntime(params) {
+    const { config, authService, logger } = params;
+    logger?.info("[penfield] Initializing runtime");
+    const apiUrl = config.apiUrl || DEFAULT_API_URL;
+    // Create API client with existing auth service
+    const apiClient = new PenfieldApiClient(authService, apiUrl, logger);
+    return {
+        config,
+        apiClient,
+        authService,
+        async stop() {
+            await authService.stop();
+            logger?.info("[penfield] Runtime stopped");
+        },
+    };
+}