hngr 0.3.0 → 0.4.0

package/dist/{catalog-DbGLqQ8a.mjs → catalog-Bv304SXJ.mjs}

@@ -28,7 +28,11 @@ function catalogFlagType(flag) {
 * cannot decide lives here, so the ambiguity is reviewable in one place
 * instead of hidden in the derivation algorithm.
 */
-/** Endpoints that never appear in the command tree. */
+/**
+* Endpoints that never appear in the command tree. An entry excludes that path
+* and everything below it, so a subtree needs one line rather than one line
+* per operation.
+*/
 const EXCLUDED_PATHS = [
 	"/api/v1/login",
 	"/api/v1/logout",
@@ -45,7 +49,8 @@ const EXCLUDED_PATHS = [
 	"/api/v1/auth/device/token",
 	"/api/v1/auth/device/lookup",
 	"/api/v1/auth/device/approve",
-	"/api/v1/auth/device/deny"
+	"/api/v1/auth/device/deny",
+	"/api/v1/oauth"
 ];
 /**
 * Single operations whose path still generates other commands. Category
@@ -150,11 +155,12 @@ const METHOD_KEY = {
 */
 function deriveCommands(doc) {
 	const excluded = new Set(EXCLUDED_PATHS);
+	const excludedSubtrees = EXCLUDED_PATHS.map((path) => `${path}/`);
 	const excludedOperations = new Set(EXCLUDED_OPERATIONS.map((operation) => `${operation.method} ${operation.path}`));
 	const overrides = new Map(COMMAND_OVERRIDES.map((item) => [overrideKey(item), item]));
 	const commands = [];
 	for (const [path, pathItem] of Object.entries(doc.paths)) {
-		if (excluded.has(path)) continue;
+		if (excluded.has(path) || excludedSubtrees.some((prefix) => path.startsWith(prefix))) continue;
 		for (const method of METHODS) {
 			const operation = pathItem[METHOD_KEY[method]];
 			if (!operation || excludedOperations.has(`${method} ${path}`)) continue;
@@ -876,10 +882,11 @@ const COMMANDS = deriveCommands({
 		"/api/v1/me/tokens/{token_id}": { "delete": {
 			"operationId": "revokeMyAccessToken",
 			"summary": "Revoke one of the authenticated Principal's Access Tokens.",
+			"description": "When the token belongs to an OAuth grant, every access token and\nrefresh token sharing its `grant_id` is revoked in the same\ntransaction.\n",
 			"security": [{ "sessionCookie": [] }, { "bearerToken": [] }],
 			"parameters": [{ "$ref": "#/components/parameters/TokenID" }],
 			"responses": {
-				"204": { "description": "Revoked. The token stops authenticating immediately." },
+				"204": { "description": "Revoked. The token and, when it belongs to a grant, its siblings stop authenticating immediately." },
 				"400": { "$ref": "#/components/responses/Problem" },
 				"401": { "$ref": "#/components/responses/Problem" },
 				"403": { "$ref": "#/components/responses/Problem" },
@@ -887,6 +894,106 @@ const COMMANDS = deriveCommands({
 				"default": { "$ref": "#/components/responses/Problem" }
 			}
 		} },
+		"/api/v1/oauth/register": { "post": {
+			"operationId": "registerOAuthClient",
+			"summary": "Register a public OAuth client through Dynamic Client Registration.",
+			"description": "Anonymous. Implements RFC 7591 registration for the public native\nclients that connect to Native MCP: no client secret is issued, and\npossession of the `client_id` plus an exactly matching redirect URI is\nthe whole identity. `client_name` is 1–100 characters and\n`redirect_uris` holds 1–10 absolute URIs without a fragment: `https`\nanywhere, `http` only on localhost, 127.0.0.1 or [::1]. Exact\nduplicates are removed. Registration failures are RFC 6749 error\nbodies, not problem details.\n",
+			"security": [],
+			"requestBody": {
+				"required": true,
+				"content": { "application/json": { "schema": { "$ref": "#/components/schemas/OAuthClientRegistrationRequest" } } }
+			},
+			"responses": {
+				"201": {
+					"description": "The registered client. Hangar never issues a client secret.",
+					"headers": { "Cache-Control": {
+						"description": "Always `no-store`.",
+						"schema": { "type": "string" }
+					} },
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/OAuthClientRegistration" } } }
+				},
+				"400": { "$ref": "#/components/responses/OAuthError" },
+				"413": { "$ref": "#/components/responses/OAuthProblem" },
+				"default": { "$ref": "#/components/responses/OAuthProblem" }
+			}
+		} },
+		"/api/v1/oauth/token": { "post": {
+			"operationId": "exchangeOAuthToken",
+			"summary": "Exchange an authorization code or refresh token for an MCP token pair.",
+			"description": "Anonymous and form-encoded. `grant_type=authorization_code` requires\n`code`, `redirect_uri`, `client_id` and `code_verifier`; the code is\nsingle use and the PKCE challenge must be S256.\n`grant_type=refresh_token` requires `refresh_token` and `client_id` and\nrotates the refresh token. Presenting an already rotated refresh token\nrevokes the whole grant. Every failure is an RFC 6749 error body with\nstatus 400.\n",
+			"security": [],
+			"requestBody": {
+				"required": true,
+				"content": { "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/ExchangeOAuthTokenRequest" } } }
+			},
+			"responses": {
+				"200": {
+					"description": "A fresh MCP access token and a refresh token.",
+					"headers": { "Cache-Control": {
+						"description": "Always `no-store`.",
+						"schema": { "type": "string" }
+					} },
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/OAuthToken" } } }
+				},
+				"400": { "$ref": "#/components/responses/OAuthError" },
+				"413": { "$ref": "#/components/responses/OAuthProblem" },
+				"default": { "$ref": "#/components/responses/OAuthProblem" }
+			}
+		} },
+		"/api/v1/oauth/authorization-request": {
+			"get": {
+				"operationId": "lookupOAuthAuthorizationRequest",
+				"summary": "Read the consent page preview of an authorization request.",
+				"description": "Session-only. Validates `response_type=code`, the registered client,\nthe exact `redirect_uri` and `code_challenge_method=S256` before\nreturning anything displayable. An invalid request answers 400 and\nnever redirects, so an unknown client cannot be used for an open\nredirect. The preview never includes the redirect URI itself.\n",
+				"security": [{ "sessionCookie": [] }],
+				"parameters": [
+					{ "$ref": "#/components/parameters/OAuthResponseType" },
+					{ "$ref": "#/components/parameters/OAuthClientID" },
+					{ "$ref": "#/components/parameters/OAuthRedirectURI" },
+					{ "$ref": "#/components/parameters/OAuthState" },
+					{ "$ref": "#/components/parameters/OAuthCodeChallenge" },
+					{ "$ref": "#/components/parameters/OAuthCodeChallengeMethod" }
+				],
+				"responses": {
+					"200": {
+						"description": "The client name and callback host shown on the consent page.",
+						"headers": { "Cache-Control": {
+							"description": "Always `no-store`.",
+							"schema": { "type": "string" }
+						} },
+						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/OAuthAuthorizationPreview" } } }
+					},
+					"400": { "$ref": "#/components/responses/OAuthProblem" },
+					"401": { "$ref": "#/components/responses/OAuthProblem" },
+					"default": { "$ref": "#/components/responses/OAuthProblem" }
+				}
+			},
+			"post": {
+				"operationId": "decideOAuthAuthorizationRequest",
+				"summary": "Approve or deny an authorization request.",
+				"description": "Session-only and CSRF protected. Repeats the authorization request's\nparameters plus `decision`. Approval issues a single-use ten-minute\ncode and answers with the client redirect carrying `code` and `state`;\ndenial answers with `error=access_denied` and `state`. The redirect\npreserves any query already present on the registered redirect URI.\nAn invalid request answers 400 and never redirects.\n",
+				"security": [{ "sessionCookie": [] }],
+				"requestBody": {
+					"required": true,
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/DecideOAuthAuthorizationRequest" } } }
+				},
+				"responses": {
+					"200": {
+						"description": "The URL the consent page navigates to.",
+						"headers": { "Cache-Control": {
+							"description": "Always `no-store`.",
+							"schema": { "type": "string" }
+						} },
+						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/OAuthAuthorizationDecision" } } }
+					},
+					"400": { "$ref": "#/components/responses/OAuthProblem" },
+					"401": { "$ref": "#/components/responses/OAuthProblem" },
+					"403": { "$ref": "#/components/responses/OAuthProblem" },
+					"413": { "$ref": "#/components/responses/OAuthProblem" },
+					"default": { "$ref": "#/components/responses/OAuthProblem" }
+				}
+			}
+		},
 		"/api/v1/principals/{principal_id}/tokens": {
 			"parameters": [{ "$ref": "#/components/parameters/PrincipalID" }],
 			"get": {
@@ -928,10 +1035,10 @@ const COMMANDS = deriveCommands({
 			"delete": {
 				"operationId": "revokePrincipalAccessToken",
 				"summary": "Revoke one of a Principal's Access Tokens.",
-				"description": "Allowed for the Principal itself, and for a Platform Admin when the Principal is an Agent.",
+				"description": "Allowed for the Principal itself, and for a Platform Admin when the\nPrincipal is an Agent. When the token belongs to an OAuth grant, every\naccess token and refresh token sharing its `grant_id` is revoked in\nthe same transaction.\n",
 				"security": [{ "sessionCookie": [] }, { "bearerToken": [] }],
 				"responses": {
-					"204": { "description": "Revoked. The token stops authenticating immediately." },
+					"204": { "description": "Revoked. The token and, when it belongs to a grant, its siblings stop authenticating immediately." },
 					"400": { "$ref": "#/components/responses/Problem" },
 					"401": { "$ref": "#/components/responses/Problem" },
 					"403": { "$ref": "#/components/responses/Problem" },
@@ -1192,7 +1299,7 @@ const COMMANDS = deriveCommands({
 				"operationId": "createCapability",
 				"summary": "Create a Capability together with its first Version.",
 				"description": "An `application/json` body creates an MCP Capability; a\n`multipart/form-data` body creates a Skill Capability from its\nCapability Package. The Capability, its first Version and the Audit\nEvent are committed in one transaction. A rejected package returns 400\nwith a `detail` that names what to fix. The caller must manage the\ntarget Namespace: a Platform Admin for system, a member User of the Team for a Team Namespace, and\nthe owner for a principal Namespace. A live Capability with the same\nkind and name in the Namespace returns 409.\n",
-				"security": [{ "sessionCookie": [] }],
+				"security": [{ "sessionCookie": [] }, { "bearerToken": [] }],
 				"parameters": [{ "$ref": "#/components/parameters/IdempotencyKey" }],
 				"requestBody": {
 					"required": true,
@@ -1312,7 +1419,7 @@ const COMMANDS = deriveCommands({
 				"operationId": "publishCapabilityVersion",
 				"summary": "Publish a new Version of a Capability and make it current.",
 				"description": "The media type must match the Capability's kind: `application/json`\nfor MCP and `multipart/form-data` for Skill; the other one returns\n400. The Version, the new current version and the Audit Event are\ncommitted in one transaction, and concurrent publishes each receive\ntheir own CalVer. The caller must manage the Capability's Namespace,\nunder the same rules as `createCapability`. A deleted or unavailable\nCapability, one in an unusable Namespace, and a private one the\ncaller does not manage return 404.\n",
-				"security": [{ "sessionCookie": [] }],
+				"security": [{ "sessionCookie": [] }, { "bearerToken": [] }],
 				"parameters": [{ "$ref": "#/components/parameters/IdempotencyKey" }],
 				"requestBody": {
 					"required": true,
@@ -2109,6 +2216,55 @@ const COMMANDS = deriveCommands({
 					"type": "string",
 					"format": "uuid"
 				}
+			},
+			"OAuthResponseType": {
+				"name": "response_type",
+				"in": "query",
+				"required": true,
+				"description": "Must be `code`.",
+				"schema": {
+					"type": "string",
+					"enum": ["code"]
+				}
+			},
+			"OAuthClientID": {
+				"name": "client_id",
+				"in": "query",
+				"required": true,
+				"schema": { "type": "string" }
+			},
+			"OAuthRedirectURI": {
+				"name": "redirect_uri",
+				"in": "query",
+				"required": true,
+				"description": "Must exactly match a URI registered for the client.",
+				"schema": {
+					"type": "string",
+					"format": "uri"
+				}
+			},
+			"OAuthState": {
+				"name": "state",
+				"in": "query",
+				"required": false,
+				"description": "Opaque value echoed on the client redirect.",
+				"schema": { "type": "string" }
+			},
+			"OAuthCodeChallenge": {
+				"name": "code_challenge",
+				"in": "query",
+				"required": true,
+				"schema": { "type": "string" }
+			},
+			"OAuthCodeChallengeMethod": {
+				"name": "code_challenge_method",
+				"in": "query",
+				"required": true,
+				"description": "Must be `S256`.",
+				"schema": {
+					"type": "string",
+					"enum": ["S256"]
+				}
 			}
 		},
 		"requestBodies": { "CreateAccessToken": {
@@ -2153,27 +2309,59 @@ const COMMANDS = deriveCommands({
 			"ReplayedAccessToken": {
 				"description": "A replayed creation under `Idempotency-Key`: the first created Access Token's metadata, never its value.",
 				"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ReplayedAccessToken" } } }
+			},
+			"OAuthError": {
+				"description": "An RFC 6749 error. `Cache-Control` is always `no-store`.",
+				"headers": { "Cache-Control": {
+					"description": "Always `no-store`.",
+					"schema": { "type": "string" }
+				} },
+				"content": { "application/json": { "schema": { "$ref": "#/components/schemas/OAuthError" } } }
+			},
+			"OAuthProblem": {
+				"description": "An RFC 9457 problem detail. `Cache-Control` is always `no-store`.",
+				"headers": { "Cache-Control": {
+					"description": "Always `no-store`.",
+					"schema": { "type": "string" }
+				} },
+				"content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } }
 			}
 		},
 		"schemas": {
 			"CreateAccessTokenRequest": {
 				"type": "object",
 				"required": ["name"],
-				"properties": { "name": {
-					"type": "string",
-					"minLength": 1,
-					"maxLength": 64
-				} },
+				"properties": {
+					"name": {
+						"type": "string",
+						"minLength": 1,
+						"maxLength": 64
+					},
+					"audience": {
+						"type": "string",
+						"enum": ["management", "mcp"],
+						"default": "management",
+						"description": "The surface the token may authenticate. `management` (the default)\nworks against `/api/v1`; `mcp` works against Native MCP and is\nrejected by every `/api/v1` operation.\n"
+					}
+				},
 				"additionalProperties": false
 			},
+			"AccessTokenAudience": {
+				"type": "string",
+				"enum": ["management", "mcp"],
+				"description": "The surface the token authenticates. Each surface rejects the other's\ntokens.\n"
+			},
 			"AccessToken": {
 				"type": "object",
 				"required": [
 					"id",
 					"name",
 					"token_prefix",
+					"audience",
 					"created_at",
-					"last_used_at"
+					"last_used_at",
+					"expires_at",
+					"client_name"
 				],
 				"properties": {
 					"id": {
@@ -2185,6 +2373,7 @@ const COMMANDS = deriveCommands({
 						"type": "string",
 						"description": "The first 8 characters after `hng_`, for recognising a token. Not a credential."
 					},
+					"audience": { "$ref": "#/components/schemas/AccessTokenAudience" },
 					"created_at": {
 						"type": "string",
 						"format": "date-time"
@@ -2193,6 +2382,15 @@ const COMMANDS = deriveCommands({
 						"type": ["string", "null"],
 						"format": "date-time",
 						"description": "Recorded at most once every 5 minutes; null until first use."
+					},
+					"expires_at": {
+						"type": ["string", "null"],
+						"format": "date-time",
+						"description": "Null for static tokens, which never expire and are revoked instead."
+					},
+					"client_name": {
+						"type": ["string", "null"],
+						"description": "The OAuth client that obtained the token; null for static tokens."
 					}
 				}
 			},
@@ -2204,6 +2402,192 @@ const COMMANDS = deriveCommands({
 					"items": { "$ref": "#/components/schemas/AccessToken" }
 				} }
 			},
+			"OAuthClientRegistrationRequest": {
+				"type": "object",
+				"required": ["client_name", "redirect_uris"],
+				"properties": {
+					"client_name": {
+						"type": "string",
+						"minLength": 1,
+						"maxLength": 100
+					},
+					"redirect_uris": {
+						"type": "array",
+						"minItems": 1,
+						"maxItems": 10,
+						"items": {
+							"type": "string",
+							"maxLength": 2048
+						}
+					},
+					"token_endpoint_auth_method": {
+						"type": "string",
+						"enum": ["none"],
+						"default": "none",
+						"description": "The only accepted value; omitted means `none`."
+					},
+					"grant_types": {
+						"type": "array",
+						"items": {
+							"type": "string",
+							"enum": ["authorization_code", "refresh_token"]
+						},
+						"default": ["authorization_code"],
+						"description": "Omitted means `[\"authorization_code\"]`; `refresh_token` may accompany it."
+					},
+					"response_types": {
+						"type": "array",
+						"items": {
+							"type": "string",
+							"enum": ["code"]
+						},
+						"default": ["code"],
+						"description": "Omitted means `[\"code\"]`."
+					}
+				},
+				"additionalProperties": false
+			},
+			"OAuthClientRegistration": {
+				"type": "object",
+				"required": [
+					"client_id",
+					"client_id_issued_at",
+					"client_name",
+					"redirect_uris",
+					"token_endpoint_auth_method",
+					"grant_types",
+					"response_types"
+				],
+				"properties": {
+					"client_id": {
+						"type": "string",
+						"description": "`hngc_` plus at least 20 characters."
+					},
+					"client_id_issued_at": {
+						"type": "integer",
+						"description": "Unix time in seconds."
+					},
+					"client_name": { "type": "string" },
+					"redirect_uris": {
+						"type": "array",
+						"items": { "type": "string" }
+					},
+					"token_endpoint_auth_method": {
+						"type": "string",
+						"enum": ["none"]
+					},
+					"grant_types": {
+						"type": "array",
+						"items": { "type": "string" }
+					},
+					"response_types": {
+						"type": "array",
+						"items": { "type": "string" }
+					}
+				}
+			},
+			"ExchangeOAuthTokenRequest": {
+				"type": "object",
+				"properties": {
+					"grant_type": {
+						"type": "string",
+						"enum": ["authorization_code", "refresh_token"]
+					},
+					"code": { "type": "string" },
+					"redirect_uri": { "type": "string" },
+					"client_id": { "type": "string" },
+					"code_verifier": { "type": "string" },
+					"refresh_token": { "type": "string" }
+				}
+			},
+			"OAuthToken": {
+				"type": "object",
+				"required": [
+					"access_token",
+					"token_type",
+					"expires_in",
+					"refresh_token"
+				],
+				"properties": {
+					"access_token": {
+						"type": "string",
+						"description": "An `hng_<value>` MCP token. Use it as `Authorization: Bearer <token>`."
+					},
+					"token_type": {
+						"type": "string",
+						"enum": ["Bearer"]
+					},
+					"expires_in": {
+						"type": "integer",
+						"description": "Access token lifetime in seconds."
+					},
+					"refresh_token": { "type": "string" }
+				}
+			},
+			"OAuthError": {
+				"type": "object",
+				"required": ["error", "error_description"],
+				"properties": {
+					"error": {
+						"type": "string",
+						"enum": [
+							"invalid_request",
+							"invalid_grant",
+							"unsupported_grant_type"
+						]
+					},
+					"error_description": { "type": "string" }
+				}
+			},
+			"OAuthAuthorizationPreview": {
+				"type": "object",
+				"required": ["client_name", "redirect_host"],
+				"properties": {
+					"client_name": { "type": "string" },
+					"redirect_host": {
+						"type": "string",
+						"description": "The host of the registered redirect URI; the URI itself is never exposed."
+					}
+				}
+			},
+			"OAuthAuthorizationDecision": {
+				"type": "object",
+				"required": ["redirect_to"],
+				"properties": { "redirect_to": {
+					"type": "string",
+					"description": "The client redirect carrying `code` or `error=access_denied`, plus `state`."
+				} }
+			},
+			"DecideOAuthAuthorizationRequest": {
+				"type": "object",
+				"required": [
+					"response_type",
+					"client_id",
+					"redirect_uri",
+					"code_challenge",
+					"code_challenge_method",
+					"decision"
+				],
+				"properties": {
+					"response_type": {
+						"type": "string",
+						"enum": ["code"]
+					},
+					"client_id": { "type": "string" },
+					"redirect_uri": { "type": "string" },
+					"state": { "type": "string" },
+					"code_challenge": { "type": "string" },
+					"code_challenge_method": {
+						"type": "string",
+						"enum": ["S256"]
+					},
+					"decision": {
+						"type": "string",
+						"enum": ["approve", "deny"]
+					}
+				},
+				"additionalProperties": false
+			},
 			"CreatedAccessToken": {
 				"type": "object",
 				"required": [
@@ -2774,7 +3158,7 @@ const COMMANDS = deriveCommands({
 			},
 			"Readme": {
 				"type": ["string", "null"],
-				"description": "Markdown, at most 1 MiB of UTF-8. Omitted or null means no README; an\nempty string is kept as an empty README.\n"
+				"description": "Markdown, at most 1 MiB of UTF-8. Omitted or null means no README was\nattached; an empty string is kept as an empty README. A Skill Version\nwithout one reports its package's `SKILL.md` in place of a README.\n"
 			},
 			"MCPConfig": {
 				"type": "object",
@@ -2828,7 +3212,7 @@ const COMMANDS = deriveCommands({
 					"visibility": { "$ref": "#/components/schemas/Visibility" },
 					"readme": {
 						"type": "string",
-						"description": "Markdown, at most 1 MiB of UTF-8. Omitted means no README."
+						"description": "Markdown, at most 1 MiB of UTF-8. Omitted means the package's\n`SKILL.md` is reported as the Version's README.\n"
 					},
 					"category": {
 						"type": "string",
@@ -2886,7 +3270,7 @@ const COMMANDS = deriveCommands({
 				"properties": {
 					"readme": {
 						"type": "string",
-						"description": "Markdown, at most 1 MiB of UTF-8. Omitted means no README."
+						"description": "Markdown, at most 1 MiB of UTF-8. Omitted means the package's\n`SKILL.md` is reported as the Version's README.\n"
 					},
 					"package": {
 						"type": "string",
@@ -3122,7 +3506,11 @@ const COMMANDS = deriveCommands({
 					"version": { "$ref": "#/components/schemas/CalVer" },
 					"readme": {
 						"type": ["string", "null"],
-						"description": "The Version's Markdown README, or null when it has none."
+						"description": "The Version's Markdown README. A Skill Version that was published\nwithout one reports the package's `SKILL.md`, or null when the\nmanifest cannot be read as text within the README limit.\n"
+					},
+					"readme_from_manifest": {
+						"type": "boolean",
+						"description": "True when `readme` was derived from the package's `SKILL.md`\nbecause the Version has no attached README. Omitted otherwise.\n"
 					},
 					"created_at": {
 						"type": "string",
@@ -3567,7 +3955,7 @@ function workflowCatalog() {
 		},
 		{
 			name: "auth status",
-			summary: "Show credential source, server, principal and token prefix",
+			summary: "Show credential source, server, principal, token prefix and audience",
 			group: "auth",
 			args: [],
 			flags: [{
@@ -3583,7 +3971,11 @@ function workflowCatalog() {
 			summary: "Print the access token to stdout and nothing else",
 			group: "auth",
 			args: [],
-			flags: [],
+			flags: [{
+				name: "audience",
+				type: "string",
+				description: "management prints the stored token; mcp mints a new MCP token that can read and write the catalog content you have access to"
+			}],
 			destructive: false,
 			dryRun: false
 		},

package/dist/{commands-BHXSZ04F.mjs → commands-CLqLwQHY.mjs}

@@ -1,4 +1,4 @@
-import { t as commandCatalog } from "./catalog-DbGLqQ8a.mjs";
+import { t as commandCatalog } from "./catalog-Bv304SXJ.mjs";
 // src/commands/commands.ts
 function run(ctx) {
 	const catalog = commandCatalog();

package/dist/{http-2HWxLIOq.mjs → http-DgHX7Fux.mjs}

@@ -86,18 +86,16 @@ async function writeFileAtomically(path, content, options = {}) {
 }
 /**
 * Writes a directory through "temp → rename": the destination is either
-* absent or complete, never half-written. With `force`, the old directory is
-* moved aside before the rename so a failed swap puts it back.
+* absent or complete, never half-written. An existing directory is moved
+* aside before the rename so a failed swap puts it back.
 */
-async function writeDirectoryAtomically(dest, writeTemp, options) {
+async function writeDirectoryAtomically(dest, writeTemp, options = {}) {
 	const parent = dirname(dest);
 	await mkdir(parent, { recursive: true });
 	const temp = resolve(parent, `.hngr-${basename(dest)}-${randomUUID()}.tmp`);
 	try {
 		await writeTemp(temp);
-		const exists = await lstat(dest).then(() => true, () => false);
-		if (exists && !options.force) throw options.existsError();
-		if (!exists) {
+		if (!await lstat(dest).then(() => true, () => false)) {
 			await rename(temp, dest);
 			return;
 		}
@@ -127,6 +125,14 @@ async function writeDirectoryAtomically(dest, writeTemp, options) {
 	}
 }
 // src/config.ts
+/**
+* The stored token's audience. Config files written before audiences existed
+* hold a management token by definition, so a missing field reads as
+* `management` instead of failing to load.
+*/
+function storedAudience(config) {
+	return config?.audience === "mcp" ? "mcp" : "management";
+}
 /** `$XDG_CONFIG_HOME/hngr/config.json`, falling back to `~/.config/hngr/config.json`. */
 function configFilePath(env) {
 	const xdg = env.XDG_CONFIG_HOME;
@@ -456,4 +462,4 @@ async function apiFetch(connection, options) {
 		signal: options.signal
 	});
 }
-export { renderError as C, HngrError as S, scrubCredentials as _, toHngrError as a, writeFileAtomically as b, redactUrlForDisplay as c, configFilePath as d, deleteStoredConfig as f, resolveConnection as g, redactUrl as h, buildRequestUrl as i, apiErrorFromResponse as l, readStoredConfig as m, apiGet as n, redactQuery as o, normalizeServerUrl as p, apiRequest as r, redactSensitive as s, apiFetch as t, DEFAULT_SERVER_URL as u, writeStoredConfig as v, CancelledError as x, writeDirectoryAtomically as y };
+export { HngrError as C, CancelledError as S, scrubCredentials as _, toHngrError as a, writeDirectoryAtomically as b, redactUrlForDisplay as c, configFilePath as d, deleteStoredConfig as f, resolveConnection as g, redactUrl as h, buildRequestUrl as i, apiErrorFromResponse as l, readStoredConfig as m, apiGet as n, redactQuery as o, normalizeServerUrl as p, apiRequest as r, redactSensitive as s, apiFetch as t, DEFAULT_SERVER_URL as u, storedAudience as v, renderError as w, writeFileAtomically as x, writeStoredConfig as y };