granola-toolkit 0.22.0 → 0.23.0

package/README.md

@@ -193,12 +193,17 @@ The machine-readable `export` command includes:
 The initial server API includes:
 
 - `GET /health`
+- `GET /auth/status`
 - `GET /state`
 - `GET /events` for server-sent state updates
 - `GET /meetings`
 - `GET /meetings/resolve?q=<query>`
 - `GET /meetings/:id`
 - `GET /exports/jobs`
+- `POST /auth/login`
+- `POST /auth/logout`
+- `POST /auth/mode`
+- `POST /auth/refresh`
 - `POST /exports/notes`
 - `POST /exports/jobs/:id/rerun`
 - `POST /exports/transcripts`
@@ -217,6 +222,7 @@ The initial browser client includes:
 - a focused meeting workspace with notes, transcript, metadata, and raw tabs
 - keyboard-first workspace switching with `1`-`4`, `[` and `]`
 - app-state status from the shared core
+- an auth session panel for login, refresh, source switching, and sign-out
 - note and transcript export actions backed by the same local API
 - a recent export-jobs panel with rerun actions
 - stronger empty and error states for list/detail failures
@@ -239,9 +245,22 @@ If you do not want to keep passing `--supabase`, import the desktop app session
 ```bash
 granola auth login
 granola auth status
+granola auth refresh
+granola auth use stored
+granola auth use supabase
 ```
 
-That stores a reusable Granola session locally and lets `granola notes` use it directly. `granola auth logout` deletes the stored session.
+That stores a reusable Granola session locally and lets `granola notes` use it directly.
+
+`granola auth` now supports:
+
+- `login` to import the desktop app session into the toolkit store
+- `status` to inspect the active source, stored-session availability, refresh support, and any last auth error
+- `refresh` to refresh the stored session explicitly
+- `use stored` or `use supabase` to switch the active auth source
+- `logout` to delete the stored session
+
+The same auth actions are also available from the web workspace.
 
 ### Incremental Writes
 

package/dist/cli.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { existsSync } from "node:fs";
-import { execFile } from "node:child_process";
 import { mkdir, readFile, rm, stat, unlink, writeFile } from "node:fs/promises";
 import { homedir, platform } from "node:os";
 import { dirname, join } from "node:path";
-import { promisify } from "node:util";
 import { NodeHtmlMarkdown } from "node-html-markdown";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
 import { createHash, randomUUID } from "node:crypto";
 import { createServer } from "node:http";
 //#region src/utils.ts
@@ -153,6 +153,60 @@ function transcriptSpeakerLabel(segment) {
 	return segment.source === "microphone" ? "You" : "System";
 }
 //#endregion
+//#region src/cache.ts
+function parseCacheDocument(id, value) {
+	const record = asRecord(value);
+	if (!record) return;
+	return {
+		createdAt: stringValue(record.created_at),
+		id,
+		title: stringValue(record.title),
+		updatedAt: stringValue(record.updated_at)
+	};
+}
+function parseTranscriptSegments(value) {
+	if (!Array.isArray(value)) return;
+	return value.flatMap((segment) => {
+		const record = asRecord(segment);
+		if (!record) return [];
+		return [{
+			documentId: stringValue(record.document_id),
+			endTimestamp: stringValue(record.end_timestamp),
+			id: stringValue(record.id),
+			isFinal: Boolean(record.is_final),
+			source: stringValue(record.source),
+			startTimestamp: stringValue(record.start_timestamp),
+			text: stringValue(record.text)
+		}];
+	});
+}
+function parseCacheContents(contents) {
+	const outer = parseJsonString(contents);
+	if (!outer) throw new Error("failed to parse cache JSON");
+	const rawCache = outer.cache;
+	let cachePayload;
+	if (typeof rawCache === "string") cachePayload = parseJsonString(rawCache);
+	else cachePayload = asRecord(rawCache);
+	const state = cachePayload ? asRecord(cachePayload.state) : void 0;
+	if (!state) throw new Error("failed to parse cache state");
+	const rawDocuments = asRecord(state.documents) ?? {};
+	const rawTranscripts = asRecord(state.transcripts) ?? {};
+	const documents = {};
+	for (const [id, rawDocument] of Object.entries(rawDocuments)) {
+		const document = parseCacheDocument(id, rawDocument);
+		if (document) documents[id] = document;
+	}
+	const transcripts = {};
+	for (const [id, rawTranscript] of Object.entries(rawTranscripts)) {
+		const segments = parseTranscriptSegments(rawTranscript);
+		if (segments) transcripts[id] = segments;
+	}
+	return {
+		documents,
+		transcripts
+	};
+}
+//#endregion
 //#region src/client/auth.ts
 const execFileAsync$1 = promisify(execFile);
 const DEFAULT_CLIENT_ID = "client_GranolaMac";
@@ -380,121 +434,126 @@ function createDefaultSessionStore() {
 	return platform() === "darwin" ? new KeychainSessionStore() : new FileSessionStore();
 }
 //#endregion
-//#region src/commands/auth.ts
-function authHelp() {
-	return `Granola auth
-
-Usage:
-  granola auth <login|status|logout>
-
-Subcommands:
-  login               Import credentials from the Granola desktop app
-  status              Show whether a stored Granola session is available
-  logout              Delete the stored Granola session
-
-Options:
-  --supabase <path>   Path to supabase.json for auth login
-  -h, --help          Show help
-`;
-}
-const authCommand = {
-	description: "Manage stored Granola sessions",
-	flags: { help: { type: "boolean" } },
-	help: authHelp,
-	name: "auth",
-	async run({ commandArgs, globalFlags }) {
-		const [action] = commandArgs;
-		switch (action) {
-			case "login": return await login(globalFlags.supabase);
-			case "logout": return await logout();
-			case "status": return await status();
-			case void 0:
-				console.log(authHelp());
-				return 1;
-			default: throw new Error("invalid auth command: expected login, status, or logout");
-		}
-	}
-};
-async function login(supabaseFlag) {
-	const supabasePath = typeof supabaseFlag === "string" && supabaseFlag.trim() || firstExistingPath(granolaSupabaseCandidates());
-	if (!supabasePath) throw new Error(`supabase.json not found. Pass --supabase or create .granola.toml. Expected locations include: ${granolaSupabaseCandidates().join(", ")}`);
-	if (!existsSync(supabasePath)) throw new Error(`supabase.json not found: ${supabasePath}`);
-	const sessionStore = createDefaultSessionStore();
-	const session = await new SupabaseFileSessionSource(supabasePath).loadSession();
-	await sessionStore.writeSession(session);
-	console.log(`Imported Granola session from ${supabasePath}`);
-	return 0;
-}
-async function status() {
-	const session = await createDefaultSessionStore().readSession();
-	if (!session) {
-		console.log("No stored Granola session");
-		return 1;
-	}
-	console.log("Stored Granola session");
-	console.log(`Client ID: ${session.clientId}`);
-	console.log(`Refresh token: ${session.refreshToken ? "available" : "missing"}`);
-	console.log(`Sign-in method: ${session.signInMethod ?? "unknown"}`);
-	return 0;
-}
-async function logout() {
-	await createDefaultSessionStore().clearSession();
-	console.log("Stored Granola session deleted");
-	return 0;
-}
-//#endregion
-//#region src/cache.ts
-function parseCacheDocument(id, value) {
-	const record = asRecord(value);
-	if (!record) return;
+//#region src/client/default-auth.ts
+function hasStoredSession(session) {
+	return Boolean(session?.accessToken.trim());
+}
+function resolveActiveMode(options) {
+	if (options.preferredMode === "stored-session" && options.storedSessionAvailable) return "stored-session";
+	if (options.preferredMode === "supabase-file" && options.supabaseAvailable) return "supabase-file";
+	if (options.storedSessionAvailable) return "stored-session";
+	return "supabase-file";
+}
+function missingSupabaseError() {
+	return /* @__PURE__ */ new Error(`supabase.json not found. Pass --supabase or create .granola.toml. Expected locations include: ${granolaSupabaseCandidates().join(", ")}`);
+}
+function buildDefaultGranolaAuthInfo(config, options = {}) {
+	const existsSyncImpl = options.existsSyncImpl ?? existsSync;
+	const session = options.session;
+	const storedSessionAvailable = hasStoredSession(session);
+	const supabasePath = config.supabase || void 0;
+	const supabaseAvailable = Boolean(supabasePath && existsSyncImpl(supabasePath));
 	return {
-		createdAt: stringValue(record.created_at),
-		id,
-		title: stringValue(record.title),
-		updatedAt: stringValue(record.updated_at)
+		clientId: session?.clientId,
+		lastError: options.lastError,
+		mode: resolveActiveMode({
+			preferredMode: options.preferredMode,
+			storedSessionAvailable,
+			supabaseAvailable
+		}),
+		refreshAvailable: Boolean(session?.refreshToken?.trim()),
+		signInMethod: session?.signInMethod,
+		storedSessionAvailable,
+		supabaseAvailable,
+		supabasePath
 	};
 }
-function parseTranscriptSegments(value) {
-	if (!Array.isArray(value)) return;
-	return value.flatMap((segment) => {
-		const record = asRecord(segment);
-		if (!record) return [];
-		return [{
-			documentId: stringValue(record.document_id),
-			endTimestamp: stringValue(record.end_timestamp),
-			id: stringValue(record.id),
-			isFinal: Boolean(record.is_final),
-			source: stringValue(record.source),
-			startTimestamp: stringValue(record.start_timestamp),
-			text: stringValue(record.text)
-		}];
+async function inspectDefaultGranolaAuth(config, options = {}) {
+	const sessionStore = options.sessionStore ?? createDefaultSessionStore();
+	const session = options.session ?? await sessionStore.readSession();
+	return buildDefaultGranolaAuthInfo(config, {
+		existsSyncImpl: options.existsSyncImpl,
+		lastError: options.lastError,
+		preferredMode: options.preferredMode,
+		session
 	});
 }
-function parseCacheContents(contents) {
-	const outer = parseJsonString(contents);
-	if (!outer) throw new Error("failed to parse cache JSON");
-	const rawCache = outer.cache;
-	let cachePayload;
-	if (typeof rawCache === "string") cachePayload = parseJsonString(rawCache);
-	else cachePayload = asRecord(rawCache);
-	const state = cachePayload ? asRecord(cachePayload.state) : void 0;
-	if (!state) throw new Error("failed to parse cache state");
-	const rawDocuments = asRecord(state.documents) ?? {};
-	const rawTranscripts = asRecord(state.transcripts) ?? {};
-	const documents = {};
-	for (const [id, rawDocument] of Object.entries(rawDocuments)) {
-		const document = parseCacheDocument(id, rawDocument);
-		if (document) documents[id] = document;
+var DefaultAuthController = class {
+	#lastError;
+	#preferredMode;
+	constructor(config, options = {}) {
+		this.config = config;
+		this.options = options;
 	}
-	const transcripts = {};
-	for (const [id, rawTranscript] of Object.entries(rawTranscripts)) {
-		const segments = parseTranscriptSegments(rawTranscript);
-		if (segments) transcripts[id] = segments;
+	sessionStore() {
+		return this.options.sessionStore ?? createDefaultSessionStore();
 	}
-	return {
-		documents,
-		transcripts
-	};
+	readSession() {
+		return this.sessionStore().readSession();
+	}
+	resolveSupabasePath(overridePath) {
+		const supabasePath = overridePath?.trim() || this.config.supabase || "";
+		if (!supabasePath) throw missingSupabaseError();
+		if (!(this.options.existsSyncImpl ?? existsSync)(supabasePath)) throw new Error(`supabase.json not found: ${supabasePath}`);
+		return supabasePath;
+	}
+	sessionSource(supabasePath) {
+		return this.options.sessionSourceFactory?.(supabasePath) ?? new SupabaseFileSessionSource(supabasePath);
+	}
+	async inspect() {
+		const session = await this.readSession();
+		return buildDefaultGranolaAuthInfo(this.config, {
+			existsSyncImpl: this.options.existsSyncImpl,
+			lastError: this.#lastError,
+			preferredMode: this.#preferredMode,
+			session
+		});
+	}
+	async login(options = {}) {
+		const supabasePath = this.resolveSupabasePath(options.supabasePath);
+		const session = await this.sessionSource(supabasePath).loadSession();
+		await this.sessionStore().writeSession(session);
+		this.#lastError = void 0;
+		this.#preferredMode = "stored-session";
+		return await this.inspect();
+	}
+	async logout() {
+		await this.sessionStore().clearSession();
+		this.#lastError = void 0;
+		this.#preferredMode = void 0;
+		return await this.inspect();
+	}
+	async refresh() {
+		const session = await this.readSession();
+		if (!hasStoredSession(session)) {
+			this.#lastError = "no stored Granola session found";
+			throw new Error(this.#lastError);
+		}
+		try {
+			const refreshed = await refreshGranolaSession(session, this.options.fetchImpl);
+			await this.sessionStore().writeSession(refreshed);
+			this.#lastError = void 0;
+			this.#preferredMode = "stored-session";
+			return await this.inspect();
+		} catch (error) {
+			this.#lastError = error instanceof Error ? error.message : String(error);
+			throw error;
+		}
+	}
+	async switchMode(mode) {
+		const state = await this.inspect();
+		if (mode === "stored-session" && !state.storedSessionAvailable) {
+			this.#lastError = "no stored Granola session found";
+			throw new Error(this.#lastError);
+		}
+		if (mode === "supabase-file") this.resolveSupabasePath();
+		this.#lastError = void 0;
+		this.#preferredMode = mode;
+		return await this.inspect();
+	}
+};
+function createDefaultGranolaAuthController(config, options = {}) {
+	return new DefaultAuthController(config, options);
 }
 //#endregion
 //#region src/client/parsers.ts
@@ -690,26 +749,16 @@ var AuthenticatedHttpClient = class {
 };
 //#endregion
 //#region src/client/default.ts
-async function inspectDefaultGranolaAuth(config) {
-	const storedSession = await createDefaultSessionStore().readSession();
-	const hasStoredSession = Boolean(storedSession?.accessToken.trim());
-	return {
-		mode: hasStoredSession ? "stored-session" : "supabase-file",
-		storedSessionAvailable: hasStoredSession,
-		supabasePath: config.supabase || void 0
-	};
-}
-async function createDefaultGranolaRuntime(config, logger = console) {
+async function createDefaultGranolaRuntime(config, logger = console, options = {}) {
+	const auth = await inspectDefaultGranolaAuth(config, { preferredMode: options.preferredMode });
+	if (!auth.storedSessionAvailable && !config.supabase) throw new Error(`supabase.json not found. Pass --supabase or create .granola.toml. Expected locations include: ${granolaSupabaseCandidates().join(", ")}`);
+	if (!auth.storedSessionAvailable && config.supabase && !existsSync(config.supabase)) throw new Error(`supabase.json not found: ${config.supabase}`);
 	const sessionStore = createDefaultSessionStore();
-	const auth = await inspectDefaultGranolaAuth(config);
-	const hasStoredSession = auth.storedSessionAvailable;
-	if (!hasStoredSession && !config.supabase) throw new Error(`supabase.json not found. Pass --supabase or create .granola.toml. Expected locations include: ${granolaSupabaseCandidates().join(", ")}`);
-	if (!hasStoredSession && config.supabase && !existsSync(config.supabase)) throw new Error(`supabase.json not found: ${config.supabase}`);
 	return {
 		auth,
 		client: new GranolaApiClient(new AuthenticatedHttpClient({
 			logger,
-			tokenProvider: hasStoredSession ? new StoredSessionTokenProvider(sessionStore, { source: config.supabase && existsSync(config.supabase) ? new SupabaseFileSessionSource(config.supabase) : void 0 }) : new CachedTokenProvider(new SupabaseFileTokenSource(config.supabase), new NoopTokenStore())
+			tokenProvider: auth.mode === "stored-session" ? new StoredSessionTokenProvider(sessionStore, { source: config.supabase && existsSync(config.supabase) ? new SupabaseFileSessionSource(config.supabase) : void 0 }) : new CachedTokenProvider(new SupabaseFileTokenSource(config.supabase), new NoopTokenStore())
 		}))
 	};
 }
@@ -1675,6 +1724,24 @@ var GranolaApp = class {
 		this.emitStateUpdate();
 		return this.getState();
 	}
+	resetDocumentsState() {
+		this.#granolaClient = void 0;
+		this.#documents = void 0;
+		this.#state.documents = {
+			count: 0,
+			loaded: false
+		};
+	}
+	applyAuthState(auth, options = {}) {
+		if (options.resetDocuments) this.resetDocumentsState();
+		this.#state.auth = { ...auth };
+		if (options.view) this.#state.ui = {
+			...this.#state.ui,
+			view: options.view
+		};
+		this.emitStateUpdate();
+		return { ...auth };
+	}
 	nowIso() {
 		return (this.deps.now ?? (() => /* @__PURE__ */ new Date()))().toISOString();
 	}
@@ -1693,10 +1760,9 @@ var GranolaApp = class {
 			return this.#granolaClient;
 		}
 		if (!this.deps.createGranolaClient) throw new Error("Granola API client is not configured");
-		const runtime = await this.deps.createGranolaClient();
+		const runtime = await this.deps.createGranolaClient(this.#state.auth.mode);
 		this.#granolaClient = runtime.client;
-		this.#state.auth = { ...runtime.auth };
-		this.emitStateUpdate();
+		this.applyAuthState(runtime.auth);
 		return this.#granolaClient;
 	}
 	missingCacheError() {
@@ -1751,6 +1817,64 @@ var GranolaApp = class {
 			written: patch.written
 		});
 	}
+	requireAuthController() {
+		if (!this.deps.authController) throw new Error("Granola auth control is not configured");
+		return this.deps.authController;
+	}
+	async inspectAuth() {
+		if (!this.deps.authController) return { ...this.#state.auth };
+		const auth = await this.deps.authController.inspect();
+		return this.applyAuthState(auth, { view: "auth" });
+	}
+	async loginAuth(options = {}) {
+		const controller = this.requireAuthController();
+		try {
+			const auth = await controller.login(options);
+			return this.applyAuthState(auth, {
+				resetDocuments: true,
+				view: "auth"
+			});
+		} catch (error) {
+			const auth = await controller.inspect();
+			this.applyAuthState(auth, { view: "auth" });
+			throw error;
+		}
+	}
+	async logoutAuth() {
+		const auth = await this.requireAuthController().logout();
+		return this.applyAuthState(auth, {
+			resetDocuments: true,
+			view: "auth"
+		});
+	}
+	async refreshAuth() {
+		const controller = this.requireAuthController();
+		try {
+			const auth = await controller.refresh();
+			return this.applyAuthState(auth, {
+				resetDocuments: true,
+				view: "auth"
+			});
+		} catch (error) {
+			const auth = await controller.inspect();
+			this.applyAuthState(auth, { view: "auth" });
+			throw error;
+		}
+	}
+	async switchAuthMode(mode) {
+		const controller = this.requireAuthController();
+		try {
+			const auth = await controller.switchMode(mode);
+			return this.applyAuthState(auth, {
+				resetDocuments: true,
+				view: "auth"
+			});
+		} catch (error) {
+			const auth = await controller.inspect();
+			this.applyAuthState(auth, { view: "auth" });
+			throw error;
+		}
+	}
 	async listDocuments() {
 		if (this.#documents) return this.#documents;
 		const documents = await (await this.getGranolaClient()).listDocuments({ timeoutMs: this.config.notes.timeoutMs });
@@ -1950,11 +2074,13 @@ var GranolaApp = class {
 };
 async function createGranolaApp(config, options = {}) {
 	const auth = await inspectDefaultGranolaAuth(config);
+	const authController = createDefaultGranolaAuthController(config);
 	const exportJobStore = createDefaultExportJobStore();
 	return new GranolaApp(config, {
 		auth,
+		authController,
 		cacheLoader: loadOptionalGranolaCache,
-		createGranolaClient: async () => await createDefaultGranolaRuntime(config, options.logger),
+		createGranolaClient: async (mode) => await createDefaultGranolaRuntime(config, options.logger, { preferredMode: mode }),
 		exportJobs: await exportJobStore.readJobs(),
 		exportJobStore,
 		now: options.now
@@ -2076,6 +2202,103 @@ async function waitForShutdown(close) {
 	});
 }
 //#endregion
+//#region src/commands/auth.ts
+function authHelp() {
+	return `Granola auth
+
+Usage:
+  granola auth <login|status|logout|refresh|use> [options]
+
+Subcommands:
+  login               Import credentials from the Granola desktop app
+  status              Show the current Granola auth state
+  logout              Delete the stored Granola session
+  refresh             Refresh the stored Granola session
+  use <stored|supabase>
+                      Switch the active auth source for this toolkit instance
+
+Options:
+  --supabase <path>   Path to supabase.json for auth login
+  --config <path>     Path to .granola.toml
+  --debug             Enable debug logging
+  -h, --help          Show help
+`;
+}
+function formatAuthSource(mode) {
+	return mode === "stored-session" ? "stored session" : "supabase.json";
+}
+function printAuthState(state) {
+	console.log(`Active source: ${formatAuthSource(state.mode)}`);
+	console.log(`Stored session: ${state.storedSessionAvailable ? "available" : "missing"}`);
+	console.log(`supabase.json: ${state.supabaseAvailable ? "available" : "missing"}`);
+	if (state.supabasePath) console.log(`supabase path: ${state.supabasePath}`);
+	if (state.clientId) console.log(`Client ID: ${state.clientId}`);
+	console.log(`Refresh token: ${state.refreshAvailable ? "available" : "missing"}`);
+	if (state.signInMethod) console.log(`Sign-in method: ${state.signInMethod}`);
+	if (state.lastError) console.log(`Last error: ${state.lastError}`);
+}
+const authCommand = {
+	description: "Manage stored Granola sessions",
+	flags: { help: { type: "boolean" } },
+	help: authHelp,
+	name: "auth",
+	async run({ commandArgs, globalFlags }) {
+		const [action, value] = commandArgs;
+		const config = await loadConfig({
+			globalFlags,
+			subcommandFlags: {}
+		});
+		debug(config.debug, "using config", config.configFileUsed ?? "(none)");
+		debug(config.debug, "supabase", config.supabase);
+		const app = await createGranolaApp(config);
+		switch (action) {
+			case "login": {
+				const state = await app.loginAuth();
+				console.log(`Imported Granola session from ${state.supabasePath ?? "desktop app defaults"}`);
+				printAuthState(state);
+				return 0;
+			}
+			case "logout": {
+				const state = await app.logoutAuth();
+				console.log("Stored Granola session deleted");
+				printAuthState(state);
+				return 0;
+			}
+			case "refresh": {
+				const state = await app.refreshAuth();
+				console.log("Stored Granola session refreshed");
+				printAuthState(state);
+				return 0;
+			}
+			case "status": {
+				const state = await app.inspectAuth();
+				printAuthState(state);
+				return state.storedSessionAvailable ? 0 : 1;
+			}
+			case "use": {
+				const mode = resolveAuthMode(value);
+				const state = await app.switchAuthMode(mode);
+				console.log(`Switched auth source to ${formatAuthSource(state.mode)}`);
+				printAuthState(state);
+				return 0;
+			}
+			case void 0:
+				console.log(authHelp());
+				return 1;
+			default: throw new Error("invalid auth command: expected login, status, logout, refresh, or use");
+		}
+	}
+};
+function resolveAuthMode(value) {
+	switch (value) {
+		case "stored":
+		case "stored-session": return "stored-session";
+		case "supabase":
+		case "supabase-file": return "supabase-file";
+		default: throw new Error("invalid auth mode: expected stored or supabase");
+	}
+}
+//#endregion
 //#region src/commands/exports.ts
 function exportsHelp() {
 	return `Granola exports
@@ -2460,6 +2683,7 @@ const state = {
 
 const els = {
   appState: document.querySelector("[data-app-state]"),
+  authPanel: document.querySelector("[data-auth-panel]"),
   detailBody: document.querySelector("[data-detail-body]"),
   detailMeta: document.querySelector("[data-detail-meta]"),
   empty: document.querySelector("[data-empty]"),
@@ -2526,6 +2750,7 @@ function renderWorkspaceTabs() {
 function renderAppState() {
   if (!state.appState) {
     els.appState.innerHTML = "<p>Waiting for server state…</p>";
+    els.authPanel.innerHTML = "<p>Waiting for auth state…</p>";
     return;
   }
 
@@ -2548,9 +2773,75 @@ function renderAppState() {
     "</div>",
   ].join("");
 
+  renderAuthPanel();
   renderExportJobs();
 }
 
+function authActionButton(label, action, disabled) {
+  return (
+    '<button class="button button--secondary" data-auth-action="' +
+    escapeHtml(action) +
+    '"' +
+    (disabled ? " disabled" : "") +
+    ">" +
+    escapeHtml(label) +
+    "</button>"
+  );
+}
+
+function authModeButton(label, mode, disabled) {
+  return (
+    '<button class="button button--secondary" data-auth-mode="' +
+    escapeHtml(mode) +
+    '"' +
+    (disabled ? " disabled" : "") +
+    ">" +
+    escapeHtml(label) +
+    "</button>"
+  );
+}
+
+function renderAuthPanel() {
+  const auth = state.appState?.auth;
+  if (!auth) {
+    els.authPanel.innerHTML = '<div class="auth-card"><div class="auth-card__meta">Auth state unavailable.</div></div>';
+    return;
+  }
+
+  const activeSource = auth.mode === "stored-session" ? "Stored session" : "supabase.json";
+  const lastError = auth.lastError
+    ? '<div class="auth-card__meta auth-card__error">' + escapeHtml(auth.lastError) + "</div>"
+    : "";
+
+  els.authPanel.innerHTML = [
+    '<div class="auth-card">',
+    '<div class="status-grid">',
+    '<div><span class="status-label">Active</span><strong>' + escapeHtml(activeSource) + "</strong></div>",
+    '<div><span class="status-label">Stored</span><strong>' + escapeHtml(auth.storedSessionAvailable ? "available" : "missing") + "</strong></div>",
+    '<div><span class="status-label">supabase.json</span><strong>' + escapeHtml(auth.supabaseAvailable ? "available" : "missing") + "</strong></div>",
+    '<div><span class="status-label">Refresh</span><strong>' + escapeHtml(auth.refreshAvailable ? "available" : "missing") + "</strong></div>",
+    "</div>",
+    auth.clientId
+      ? '<div class="auth-card__meta">Client ID: ' + escapeHtml(auth.clientId) + "</div>"
+      : "",
+    auth.signInMethod
+      ? '<div class="auth-card__meta">Sign-in method: ' + escapeHtml(auth.signInMethod) + "</div>"
+      : "",
+    auth.supabasePath
+      ? '<div class="auth-card__meta">supabase path: ' + escapeHtml(auth.supabasePath) + "</div>"
+      : "",
+    lastError,
+    '<div class="auth-card__actions">',
+    authActionButton("Import desktop session", "login", !auth.supabaseAvailable),
+    authActionButton("Refresh stored session", "refresh", !auth.storedSessionAvailable || !auth.refreshAvailable),
+    authModeButton("Use stored session", "stored-session", !auth.storedSessionAvailable || auth.mode === "stored-session"),
+    authModeButton("Use supabase.json", "supabase-file", !auth.supabaseAvailable || auth.mode === "supabase-file"),
+    authActionButton("Sign out", "logout", !auth.storedSessionAvailable),
+    "</div>",
+    "</div>",
+  ].join("");
+}
+
 function renderMeetingList() {
   if (state.listError) {
     els.list.innerHTML =
@@ -2805,12 +3096,24 @@ async function quickOpenMeeting() {
 
 async function refreshAll() {
   setStatus("Refreshing…", "busy");
-  const [appState] = await Promise.all([fetchJson("/state"), loadMeetings()]);
-  state.appState = appState;
+  const [appState, authState] = await Promise.all([fetchJson("/state"), fetchJson("/auth/status"), loadMeetings()]);
+  state.appState = {
+    ...appState,
+    auth: authState,
+  };
   renderAppState();
   setStatus("Connected", "ok");
 }
 
+async function syncAuthState() {
+  const [appState, authState] = await Promise.all([fetchJson("/state"), fetchJson("/auth/status")]);
+  state.appState = {
+    ...appState,
+    auth: authState,
+  };
+  renderAppState();
+}
+
 async function exportNotes() {
   setStatus("Exporting notes…", "busy");
   await fetchJson("/exports/notes", {
@@ -2845,6 +3148,62 @@ async function rerunJob(id) {
   }
 }
 
+async function loginAuth() {
+  setStatus("Importing desktop session…", "busy");
+  try {
+    await fetchJson("/auth/login", { method: "POST" });
+    await refreshAll();
+  } catch (error) {
+    await syncAuthState();
+    setStatus("Auth import failed", "error");
+    state.detailError = error instanceof Error ? error.message : String(error);
+    renderMeetingDetail();
+  }
+}
+
+async function logoutAuth() {
+  setStatus("Signing out…", "busy");
+  try {
+    await fetchJson("/auth/logout", { method: "POST" });
+    await refreshAll();
+  } catch (error) {
+    await syncAuthState();
+    setStatus("Sign out failed", "error");
+    state.detailError = error instanceof Error ? error.message : String(error);
+    renderMeetingDetail();
+  }
+}
+
+async function refreshAuth() {
+  setStatus("Refreshing session…", "busy");
+  try {
+    await fetchJson("/auth/refresh", { method: "POST" });
+    await refreshAll();
+  } catch (error) {
+    await syncAuthState();
+    setStatus("Refresh failed", "error");
+    state.detailError = error instanceof Error ? error.message : String(error);
+    renderMeetingDetail();
+  }
+}
+
+async function switchAuthMode(mode) {
+  setStatus("Switching auth source…", "busy");
+  try {
+    await fetchJson("/auth/mode", {
+      body: JSON.stringify({ mode }),
+      headers: { "content-type": "application/json" },
+      method: "POST",
+    });
+    await refreshAll();
+  } catch (error) {
+    await syncAuthState();
+    setStatus("Switch failed", "error");
+    state.detailError = error instanceof Error ? error.message : String(error);
+    renderMeetingDetail();
+  }
+}
+
 els.list.addEventListener("click", (event) => {
   if (!(event.target instanceof Element)) {
     return;
@@ -2868,6 +3227,36 @@ els.jobsList.addEventListener("click", (event) => {
   void rerunJob(button.dataset.rerunJobId);
 });
 
+els.authPanel.addEventListener("click", (event) => {
+  if (!(event.target instanceof Element)) {
+    return;
+  }
+
+  const actionButton = event.target.closest("[data-auth-action]");
+  if (actionButton) {
+    switch (actionButton.dataset.authAction) {
+      case "login":
+        void loginAuth();
+        return;
+      case "logout":
+        void logoutAuth();
+        return;
+      case "refresh":
+        void refreshAuth();
+        return;
+      default:
+        return;
+    }
+  }
+
+  const modeButton = event.target.closest("[data-auth-mode]");
+  if (!modeButton) {
+    return;
+  }
+
+  void switchAuthMode(modeButton.dataset.authMode);
+});
+
 els.refreshButton.addEventListener("click", () => {
   void refreshAll();
 });
@@ -3066,6 +3455,13 @@ const granolaWebMarkup = String.raw`
       </div>
       <p>Initial beta web client. It speaks to the same local API that future TUI and attach flows will use.</p>
     </section>
+    <section class="auth-panel">
+      <div class="auth-panel__head">
+        <h3>Auth Session</h3>
+        <p>Inspect, refresh, and switch between stored session and <code>supabase.json</code>.</p>
+      </div>
+      <div class="auth-panel__body" data-auth-panel></div>
+    </section>
     <section class="jobs-panel">
       <div class="jobs-panel__head">
         <h3>Recent Export Jobs</h3>
@@ -3295,10 +3691,12 @@ body {
   width: min(440px, 100%);
 }
 
+.auth-panel,
 .jobs-panel {
   padding: 0 24px 18px;
 }
 
+.auth-panel__head h3,
 .jobs-panel__head h3 {
   margin: 0;
   font-size: 0.92rem;
@@ -3306,12 +3704,43 @@ body {
   text-transform: uppercase;
 }
 
+.auth-panel__head p,
 .jobs-panel__head p {
   margin: 6px 0 0;
   color: var(--muted);
   font-size: 0.9rem;
 }
 
+.auth-panel__body {
+  display: grid;
+  gap: 12px;
+  margin-top: 14px;
+}
+
+.auth-card {
+  display: grid;
+  gap: 12px;
+  padding: 14px 16px;
+  border: 1px solid var(--line);
+  border-radius: 18px;
+  background: rgba(255, 255, 255, 0.72);
+}
+
+.auth-card__meta {
+  color: var(--muted);
+  font-size: 0.9rem;
+}
+
+.auth-card__actions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 8px;
+}
+
+.auth-card__error {
+  color: var(--error);
+}
+
 .jobs-list {
   display: grid;
   gap: 10px;
@@ -3419,6 +3848,11 @@ body {
   cursor: pointer;
 }
 
+.button:disabled {
+  cursor: not-allowed;
+  opacity: 0.56;
+}
+
 .button--primary {
   background: var(--ink);
   color: white;
@@ -3566,6 +4000,13 @@ function parseMeetingSort(value) {
 		default: throw new Error("invalid sort: expected updated-desc, updated-asc, title-asc, or title-desc");
 	}
 }
+function parseAuthMode(value) {
+	switch (value) {
+		case "stored-session":
+		case "supabase-file": return value;
+		default: throw new Error("invalid auth mode: expected stored-session or supabase-file");
+	}
+}
 function sendJson(response, body, init = {}) {
 	const payload = `${JSON.stringify(body, null, 2)}\n`;
 	response.writeHead(init.status ?? 200, {
@@ -3648,6 +4089,10 @@ async function startGranolaServer(app, options = {}) {
 				sendJson(response, app.getState());
 				return;
 			}
+			if (method === "GET" && path === "/auth/status") {
+				sendJson(response, await app.inspectAuth());
+				return;
+			}
 			if (method === "GET" && path === "/events") {
 				response.writeHead(200, {
 					"cache-control": "no-cache, no-transform",
@@ -3701,6 +4146,25 @@ async function startGranolaServer(app, options = {}) {
 				sendJson(response, await app.getMeeting(id, { requireCache: url.searchParams.get("includeTranscript") === "true" }));
 				return;
 			}
+			if (method === "POST" && path === "/auth/login") {
+				const body = await readJsonBody(request);
+				const supabasePath = typeof body.supabasePath === "string" && body.supabasePath.trim() ? body.supabasePath.trim() : void 0;
+				sendJson(response, await app.loginAuth({ supabasePath }));
+				return;
+			}
+			if (method === "POST" && path === "/auth/logout") {
+				sendJson(response, await app.logoutAuth());
+				return;
+			}
+			if (method === "POST" && path === "/auth/refresh") {
+				sendJson(response, await app.refreshAuth());
+				return;
+			}
+			if (method === "POST" && path === "/auth/mode") {
+				const body = await readJsonBody(request);
+				sendJson(response, await app.switchAuthMode(parseAuthMode(body.mode)));
+				return;
+			}
 			if (method === "POST" && path === "/exports/notes") {
 				const body = await readJsonBody(request);
 				sendJson(response, await app.exportNotes(noteFormatFromBody(body.format)), { status: 202 });
@@ -3803,11 +4267,16 @@ const serveCommand = {
 		console.log(`Granola server listening on ${server.url.href}`);
 		console.log("Endpoints:");
 		console.log("  GET  /health");
+		console.log("  GET  /auth/status");
 		console.log("  GET  /state");
 		console.log("  GET  /events");
 		console.log("  GET  /meetings");
 		console.log("  GET  /meetings/:id");
 		console.log("  GET  /exports/jobs");
+		console.log("  POST /auth/login");
+		console.log("  POST /auth/logout");
+		console.log("  POST /auth/mode");
+		console.log("  POST /auth/refresh");
 		console.log("  POST /exports/notes");
 		console.log("  POST /exports/jobs/:id/rerun");
 		console.log("  POST /exports/transcripts");
@@ -3964,11 +4433,16 @@ const commands = [
 			console.log("Routes:");
 			console.log("  GET  /");
 			console.log("  GET  /health");
+			console.log("  GET  /auth/status");
 			console.log("  GET  /state");
 			console.log("  GET  /events");
 			console.log("  GET  /meetings");
 			console.log("  GET  /meetings/:id");
 			console.log("  GET  /exports/jobs");
+			console.log("  POST /auth/login");
+			console.log("  POST /auth/logout");
+			console.log("  POST /auth/mode");
+			console.log("  POST /auth/refresh");
 			console.log("  POST /exports/notes");
 			console.log("  POST /exports/jobs/:id/rerun");
 			console.log("  POST /exports/transcripts");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "granola-toolkit",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "description": "Toolkit for exporting and working with Granola meetings, notes, and transcripts",
   "keywords": [
     "cli",