penny-pincher 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Penny Pincher contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,113 @@
+# Penny Pincher
+
+<p align="center">
+  <img src="public/og-image.png" alt="Penny Pincher — OSS personal finance CLI. npx penny-pincher" width="720" />
+</p>
+
+Penny Pincher is an agent-friendly CLI for connecting a bank account with Plaid and reading account data as JSON.
+
+```sh
+npx -p penny-pincher penny-pincher auth
+npx -p penny-pincher penny-pincher accounts
+npx -p penny-pincher penny-pincher balances
+npx -p penny-pincher penny-pincher transactions --days 30
+```
+
+## Setup
+
+The default CLI flow uses the hosted Penny Pincher backend:
+
+```sh
+npx -p penny-pincher penny-pincher auth
+```
+
+The backend creates Plaid Link tokens, exchanges public tokens, and proxies Plaid data requests. The CLI stores an encrypted token envelope and a local signing key at `~/.penny-pincher/config.json`.
+
+If you deploy your own backend, point the CLI at it:
+
+```sh
+export PENNY_PINCHER_API_URL=https://your-vercel-app.vercel.app
+npx -p penny-pincher penny-pincher auth
+```
+
+Production Plaid is the default for the hosted backend. For sandbox testing, pass `--env sandbox`:
+
+```sh
+npx -p penny-pincher penny-pincher auth --env sandbox
+```
+
+## Commands
+
+- `penny-pincher auth` opens Plaid Link, exchanges the public token through the backend, and saves local token metadata.
+- `penny-pincher accounts` prints linked accounts.
+- `penny-pincher balances` prints accounts with balances.
+- `penny-pincher transactions --days 30` prints recent transactions.
+- `penny-pincher identity` prints account owner identity data when the product is enabled.
+- `penny-pincher numbers` prints ACH/routing data when the Plaid `auth` product is enabled.
+- `penny-pincher status` prints local connection metadata without exposing the access token.
+- `penny-pincher logout` removes the saved local token.
+
+All data commands print JSON so another agent or script can parse them directly.
+
+## Security Notes
+
+The hosted backend stores your Plaid app credentials in Vercel environment variables. It does not need to store per-user Plaid access tokens. Instead, it returns an encrypted token envelope to the CLI. Data commands send that envelope back with a signed request; the backend decrypts the envelope just long enough to call Plaid.
+
+Penny Pincher stores the encrypted envelope and a local private signing key in `~/.penny-pincher/config.json` with `0600` file permissions. Treat that file like a password. If someone steals the full file, they can query data until you revoke the Plaid Item or rotate backend encryption keys.
+
+## Vercel Backend
+
+Deploy this repository to Vercel and set:
+
+```sh
+PLAID_CLIENT_ID=your-client-id
+PLAID_SECRET=your-secret
+PLAID_SANDBOX_SECRET=your-sandbox-secret
+PLAID_ENV=production
+PLAID_REDIRECT_URI=https://penny-pincher-cli.vercel.app/oauth-return
+PENNY_PINCHER_ENCRYPTION_KEY=at-least-32-random-bytes
+PENNY_PINCHER_TOKEN_KEY_VERSION=v1
+```
+
+Generate a strong encryption key with:
+
+```sh
+openssl rand -base64 32
+```
+
+The Vercel API exposes:
+
+- `POST /api/link-token`
+- `POST /api/exchange`
+- `POST /api/accounts`
+- `POST /api/balances`
+- `POST /api/transactions`
+- `POST /api/identity`
+- `POST /api/numbers`
+
+## Bring Your Own Plaid App
+
+You can still run the CLI without the hosted broker by using local Plaid credentials:
+
+```sh
+export PLAID_CLIENT_ID=your-client-id
+export PLAID_SECRET=your-secret
+export PLAID_ENV=sandbox
+npx -p penny-pincher penny-pincher auth --direct-plaid
+```
+
+## Development
+
+```sh
+npm install
+npm run typecheck
+npm run build
+npm run dev -- status
+```
+
+Publishing is intentionally left to the package owner:
+
+```sh
+npm login
+npm publish
+```

package/dist/auth.d.ts

@@ -0,0 +1,12 @@
+import { type PennyPincherConfig, type PlaidEnvironment } from "./config.js";
+export interface AuthOptions {
+    environment: PlaidEnvironment;
+    products: string[];
+    countryCodes: string[];
+    port: number;
+    openBrowser: boolean;
+    directPlaid: boolean;
+    backendUrl?: string;
+    onReady?: (url: string) => void;
+}
+export declare function runAuthFlow(options: AuthOptions): Promise<PennyPincherConfig>;

package/dist/auth.js

@@ -0,0 +1,488 @@
+import express from "express";
+import open from "open";
+import { createHostedLinkToken, defaultBackendUrl, exchangeHostedPublicToken, normalizeBackendUrl } from "./backend.js";
+import { loadConfig, saveConfig } from "./config.js";
+import { generateSigningKeyPair } from "./crypto.js";
+import { createPlaidClient } from "./plaid.js";
+export async function runAuthFlow(options) {
+    if (!options.directPlaid) {
+        return runHostedAuthFlow(options);
+    }
+    return runDirectAuthFlow(options);
+}
+async function runHostedAuthFlow(options) {
+    const existingConfig = await loadConfig();
+    const keyPair = existingConfig.publicKeyPem && existingConfig.privateKeyPem
+        ? {
+            publicKeyPem: existingConfig.publicKeyPem,
+            privateKeyPem: existingConfig.privateKeyPem
+        }
+        : generateSigningKeyPair();
+    const backendUrl = normalizeBackendUrl(options.backendUrl
+        ?? process.env.PENNY_PINCHER_API_URL
+        ?? process.env.PENNY_PINCER_API_URL
+        ?? process.env.FINCLAW_API_URL
+        ?? defaultBackendUrl);
+    const redirectUri = new URL("/oauth-return", backendUrl).toString();
+    const link = await createHostedLinkToken(backendUrl, {
+        publicKeyPem: keyPair.publicKeyPem,
+        environment: options.environment,
+        products: options.products,
+        countryCodes: options.countryCodes,
+        redirectUri
+    });
+    return runLocalLinkFlow({
+        ...options,
+        hostedLinkUrl: createHostedLinkUrl(backendUrl, link.linkToken, options.port),
+        linkToken: link.linkToken,
+        exchange: async (publicToken, metadata) => {
+            const exchange = await exchangeHostedPublicToken(backendUrl, {
+                publicToken,
+                publicKeyPem: keyPair.publicKeyPem,
+                environment: options.environment,
+                products: options.products,
+                countryCodes: options.countryCodes,
+                metadata
+            }, keyPair.privateKeyPem);
+            const config = {
+                mode: "hosted",
+                environment: exchange.environment,
+                backendUrl,
+                tokenEnvelope: exchange.tokenEnvelope,
+                publicKeyPem: keyPair.publicKeyPem,
+                privateKeyPem: keyPair.privateKeyPem,
+                itemId: exchange.itemId,
+                institutionName: exchange.institutionName,
+                institutionId: exchange.institutionId,
+                products: exchange.products,
+                countryCodes: exchange.countryCodes
+            };
+            await saveConfig(config);
+            return config;
+        }
+    });
+}
+async function runDirectAuthFlow(options) {
+    const client = createPlaidClient(options.environment);
+    const redirectUri = process.env.PLAID_REDIRECT_URI;
+    const linkTokenResponse = await client.linkTokenCreate({
+        user: {
+            client_user_id: `penny-pincher-${Date.now()}`
+        },
+        client_name: "Penny Pincher",
+        products: options.products,
+        country_codes: options.countryCodes,
+        language: "en",
+        redirect_uri: redirectUri
+    });
+    const linkToken = linkTokenResponse.data.link_token;
+    return runLocalLinkFlow({
+        ...options,
+        linkToken,
+        exchange: async (publicToken, metadata) => {
+            const exchange = await client.itemPublicTokenExchange({
+                public_token: publicToken
+            });
+            const config = {
+                mode: "direct",
+                environment: options.environment,
+                accessToken: exchange.data.access_token,
+                itemId: exchange.data.item_id,
+                institutionName: metadata?.institution?.name,
+                institutionId: metadata?.institution?.institution_id,
+                products: options.products,
+                countryCodes: options.countryCodes
+            };
+            await saveConfig(config);
+            return config;
+        }
+    });
+}
+async function runLocalLinkFlow(options) {
+    const app = express();
+    app.use(express.json());
+    app.use((_request, response, next) => {
+        response.setHeader("access-control-allow-origin", "*");
+        response.setHeader("access-control-allow-methods", "GET,POST,OPTIONS");
+        response.setHeader("access-control-allow-headers", "content-type");
+        if (_request.method === "OPTIONS") {
+            response.status(204).end();
+            return;
+        }
+        next();
+    });
+    let server;
+    const finished = new Promise((resolve, reject) => {
+        const timeout = setTimeout(() => {
+            reject(new Error("Timed out waiting for Plaid Link to finish."));
+        }, 10 * 60 * 1000);
+        app.get("/", (_request, response) => {
+            if (options.hostedLinkUrl) {
+                response.type("html").send(renderHostedWaitingPage(options.hostedLinkUrl));
+                return;
+            }
+            response.type("html").send(renderLinkPage(options.linkToken));
+        });
+        app.get("/oauth-return", (_request, response) => {
+            response.type("html").send(renderLinkPage(options.linkToken));
+        });
+        app.post("/exchange", async (request, response) => {
+            try {
+                const publicToken = request.body?.public_token;
+                const metadata = request.body?.metadata;
+                if (!publicToken || typeof publicToken !== "string") {
+                    response.status(400).json({ error: "Missing public_token" });
+                    return;
+                }
+                const config = await options.exchange(publicToken, metadata);
+                response.json({
+                    ok: true,
+                    configPath: "~/.penny-pincher/config.json",
+                    institutionName: config.institutionName,
+                    environment: config.environment,
+                    mode: config.mode
+                });
+                clearTimeout(timeout);
+                resolve(config);
+            }
+            catch (error) {
+                clearTimeout(timeout);
+                reject(error);
+                response.status(500).json({
+                    error: error instanceof Error ? error.message : "Unknown Plaid exchange error"
+                });
+            }
+        });
+    }).finally(() => {
+        server?.close();
+    });
+    server = await listen(app, options.port);
+    const url = options.hostedLinkUrl ?? `http://localhost:${options.port}`;
+    options.onReady?.(url);
+    if (options.openBrowser) {
+        await open(url);
+    }
+    return finished;
+}
+function createHostedLinkUrl(backendUrl, linkToken, port) {
+    const url = new URL("/connect", backendUrl);
+    url.searchParams.set("link_token", linkToken);
+    url.searchParams.set("callback", `http://localhost:${port}/exchange`);
+    return url.toString();
+}
+function listen(app, port) {
+    return new Promise((resolve, reject) => {
+        const server = app.listen(port, () => resolve(server));
+        server.on("error", reject);
+    });
+}
+const SHARED_AUTH_STYLES = `
+  :root {
+    --paper:#fff; --lattice:#fbf4ec; --bloom:#f0cfab; --pulse:#d08454;
+    --spark:#e04a14; --sovereign:#142a5c; --deep:#08163c;
+    --glyph:#0b0f22; --stone:#757e96;
+  }
+  html, body { background: var(--paper); color: var(--glyph); margin: 0;
+    font-family: "Inter", system-ui, -apple-system, "Helvetica Neue", Arial, sans-serif;
+    -webkit-font-smoothing: antialiased; }
+  #ca-bg { position: fixed; inset: 0; width: 100%; height: 100%; z-index: 0; pointer-events: none; opacity: 0.30; }
+  .stage { position: relative; z-index: 1; min-height: 100vh; display: flex; flex-direction: column; }
+  .top-bar { border-bottom: 1px solid var(--glyph); }
+  .top-bar-inner { max-width: 760px; margin: 0 auto; padding: 16px 24px; display: flex; align-items: center; justify-content: space-between; gap: 16px; }
+  .brand { display: inline-flex; align-items: center; gap: 10px; text-decoration: none; color: var(--glyph); }
+  .brand-mark { font-family: "JetBrains Mono", monospace; text-transform: uppercase; letter-spacing: 0.16em; font-size: 11px; font-weight: 700; }
+  .chip { display: inline-flex; align-items: center; gap: 8px; padding: 5px 10px; border: 1px solid var(--glyph); border-radius: 2px; font-family: "JetBrains Mono", monospace; font-size: 10px; font-weight: 600; letter-spacing: 0.16em; text-transform: uppercase; color: var(--glyph); background: var(--paper); }
+  .chip::before { content: "▪"; color: var(--spark); }
+  main { flex: 1; max-width: 760px; width: 100%; margin: 0 auto; padding: 64px 24px 56px; box-sizing: border-box; }
+  .label-row { display: flex; align-items: baseline; justify-content: space-between; gap: 12px; margin-bottom: 16px; }
+  .label { font-family: "Inter", sans-serif; font-weight: 500; font-size: 11px; letter-spacing: 0.16em; text-transform: uppercase; color: var(--glyph); }
+  .label::before { content: "▪"; color: var(--spark); margin-right: 0.5em; }
+  .label-aux { font-family: "JetBrains Mono", monospace; text-transform: uppercase; letter-spacing: 0.16em; font-size: 10px; color: var(--stone); }
+  .display-lift { font-family: "Archivo Black", "Helvetica Neue", Arial, sans-serif; font-weight: 900; letter-spacing: -0.025em; line-height: 0.9; color: var(--glyph); font-size: clamp(3.5rem, 14vw, 9rem); text-shadow: 5px 5px 0 var(--bloom), 10px 10px 0 rgba(8, 22, 60, 0.22); margin: 0; }
+  .lede { max-width: 560px; margin: 32px 0 0; font-size: 17px; line-height: 1.55; color: var(--glyph); font-weight: 500; }
+  .lede .dim { color: var(--stone); }
+  .actions { margin-top: 28px; display: flex; align-items: center; gap: 14px; flex-wrap: wrap; }
+  .btn-primary { background: linear-gradient(180deg, #142a5c 0%, #08163c 100%); color: #fff; padding: 13px 22px; border: 0; border-radius: 2px; font-family: "JetBrains Mono", monospace; text-transform: uppercase; letter-spacing: 0.16em; font-size: 12px; font-weight: 700; display: inline-flex; align-items: center; gap: 10px; box-shadow: inset 0 1px 0 rgba(255, 255, 255, 0.18), 0 2px 0 var(--bloom); transition: transform 80ms ease, box-shadow 80ms ease, background 80ms ease; cursor: pointer; text-decoration: none; }
+  .btn-primary:hover { background: linear-gradient(180deg, #1f3d7f 0%, #0f2050 100%); }
+  .btn-primary:active { transform: translateY(2px); box-shadow: inset 0 1px 0 rgba(255, 255, 255, 0.18); }
+  .btn-primary:disabled { opacity: 0.5; cursor: not-allowed; transform: none; }
+  .status { display: inline-flex; align-items: center; gap: 10px; padding: 9px 14px; border: 1px solid var(--glyph); border-radius: 2px; background: var(--paper); font-family: "JetBrains Mono", monospace; font-size: 10.5px; letter-spacing: 0.16em; text-transform: uppercase; color: var(--glyph); }
+  .status .dot { display: inline-block; width: 8px; height: 8px; border-radius: 1px; background: var(--spark); animation: pulse 1.4s ease-in-out infinite; }
+  .status.is-success .dot { background: var(--sovereign); animation: none; }
+  .status.is-error   .dot { background: var(--spark); animation: none; }
+  .status.is-idle    .dot { background: var(--stone); animation: none; }
+  @keyframes pulse { 0%,100% { opacity: 1; } 50% { opacity: 0.3; } }
+  @media (prefers-reduced-motion: reduce) { .status .dot { animation: none; } }
+  .telemetry { margin-top: 40px; padding-top: 22px; border-top: 1px solid rgba(11, 15, 34, 0.15); display: flex; gap: 28px; flex-wrap: wrap; font-family: "JetBrains Mono", monospace; font-size: 10.5px; letter-spacing: 0.16em; text-transform: uppercase; }
+  .telemetry .k { color: var(--stone); }
+  .telemetry .v { color: var(--glyph); font-weight: 700; margin-left: 8px; }
+  .ink { margin-top: 28px; background: var(--glyph); border: 1.5px solid var(--glyph); border-radius: 2px; box-shadow: 4px 4px 0 var(--sovereign); padding: 16px 18px; }
+  .ink .ink-label { font-family: "JetBrains Mono", monospace; text-transform: uppercase; letter-spacing: 0.16em; font-size: 10px; font-weight: 700; color: var(--spark); margin-bottom: 8px; }
+  .ink pre { margin: 0; font-family: "JetBrains Mono", monospace; font-size: 12.5px; line-height: 1.6; color: var(--bloom); white-space: pre-wrap; word-break: break-word; max-height: 280px; overflow: auto; }
+  footer { border-top: 1px solid var(--glyph); }
+  .footer-inner { max-width: 760px; margin: 0 auto; padding: 18px 24px; display: flex; gap: 12px; justify-content: space-between; align-items: center; flex-wrap: wrap; font-family: "JetBrains Mono", monospace; text-transform: uppercase; letter-spacing: 0.16em; font-size: 10px; color: var(--stone); }
+  .note { margin-top: 16px; font-family: "JetBrains Mono", monospace; text-transform: uppercase; letter-spacing: 0.16em; font-size: 10px; color: var(--stone); }
+  .note .accent { color: var(--spark); }
+`;
+const FONT_LINKS = `
+  <link rel="preconnect" href="https://fonts.googleapis.com" />
+  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
+  <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Archivo+Black&family=Inter:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500;700&display=swap" />
+`;
+const BRAND_SVG = `
+  <svg viewBox="0 0 36 36" width="22" height="22" aria-hidden="true">
+    <g fill="#F0CFAB">
+      <rect x="0"  y="0"  width="8" height="8" rx="1"/><rect x="9"  y="0"  width="8" height="8" rx="1"/>
+      <rect x="27" y="0"  width="8" height="8" rx="1"/><rect x="18" y="9"  width="8" height="8" rx="1"/>
+      <rect x="0"  y="18" width="8" height="8" rx="1"/><rect x="18" y="18" width="8" height="8" rx="1"/>
+      <rect x="27" y="18" width="8" height="8" rx="1"/><rect x="9"  y="27" width="8" height="8" rx="1"/>
+      <rect x="18" y="27" width="8" height="8" rx="1"/>
+    </g>
+    <g fill="#E04A14">
+      <rect x="18" y="0"  width="8" height="8" rx="1"/><rect x="9"  y="9"  width="8" height="8" rx="1"/>
+      <rect x="9"  y="18" width="8" height="8" rx="1"/><rect x="0"  y="27" width="8" height="8" rx="1"/>
+      <rect x="27" y="27" width="8" height="8" rx="1"/>
+    </g>
+  </svg>
+`;
+const CA_BG_SCRIPT = `
+  (function () {
+    const canvas = document.getElementById("ca-bg");
+    if (!canvas) return;
+    const ctx = canvas.getContext("2d", { alpha: true });
+    const dpr = Math.max(1, Math.min(2, window.devicePixelRatio || 1));
+    const CELL_SIZE = 44, CELL_GAP = 4, STEP_MS = 1200;
+    const EASE_IN = 0.032, EASE_OUT = 0.020, MAX_ALPHA = 0.72;
+    const CELL_RGB = [195, 210, 240];
+    let cols = 0, rows = 0;
+    let grid = new Uint8Array(0), alpha = new Float32Array(0), target = new Float32Array(0);
+    let generation = 0, lastStep = 0;
+    const reducedMotion = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
+    function resize() {
+      const w = window.innerWidth, h = window.innerHeight;
+      canvas.width = Math.floor(w * dpr); canvas.height = Math.floor(h * dpr);
+      canvas.style.width = w + "px"; canvas.style.height = h + "px";
+      ctx.setTransform(dpr, 0, 0, dpr, 0, 0);
+      const pitch = CELL_SIZE + CELL_GAP;
+      cols = Math.ceil(w / pitch) + 1; rows = Math.ceil(h / pitch) + 1;
+      const n = cols * rows;
+      grid = new Uint8Array(n); alpha = new Float32Array(n); target = new Float32Array(n);
+      for (let i = 0; i < n; i++) if (Math.random() < 0.22) grid[i] = 1;
+      for (let i = 0; i < n; i++) target[i] = grid[i] ? MAX_ALPHA : 0;
+    }
+    function idx(x, y) { return ((y + rows) % rows) * cols + ((x + cols) % cols); }
+    function step() {
+      const next = new Uint8Array(grid.length);
+      for (let y = 0; y < rows; y++) for (let x = 0; x < cols; x++) {
+        let n = 0;
+        for (let dy = -1; dy <= 1; dy++) for (let dx = -1; dx <= 1; dx++) {
+          if (dx === 0 && dy === 0) continue;
+          n += grid[idx(x + dx, y + dy)];
+        }
+        const here = grid[idx(x, y)];
+        if (here && (n === 2 || n === 3)) next[idx(x, y)] = 1;
+        else if (!here && n === 3) next[idx(x, y)] = 1;
+      }
+      grid = next; generation++;
+      if (generation %  80 === 0) for (let i = 0; i < grid.length; i++) if (Math.random() < 0.05) grid[i] = 1;
+      if (generation % 320 === 0) for (let i = 0; i < grid.length; i++) if (Math.random() < 0.24) grid[i] = 1;
+      for (let i = 0; i < grid.length; i++) target[i] = grid[i] ? MAX_ALPHA : 0;
+    }
+    function draw() {
+      const w = canvas.width / dpr, h = canvas.height / dpr;
+      ctx.clearRect(0, 0, w, h);
+      const pitch = CELL_SIZE + CELL_GAP;
+      for (let y = 0; y < rows; y++) for (let x = 0; x < cols; x++) {
+        const a = alpha[y * cols + x];
+        if (a <= 0.003) continue;
+        ctx.fillStyle = "rgba(" + CELL_RGB[0] + "," + CELL_RGB[1] + "," + CELL_RGB[2] + "," + a + ")";
+        ctx.fillRect(x * pitch, y * pitch, CELL_SIZE, CELL_SIZE);
+      }
+    }
+    function frame(now) {
+      if (!lastStep) lastStep = now;
+      if (now - lastStep >= STEP_MS) { step(); lastStep = now; }
+      let dirty = false;
+      for (let i = 0; i < alpha.length; i++) {
+        const t = target[i], a = alpha[i];
+        if (a !== t) {
+          const ease = t > a ? EASE_IN : EASE_OUT;
+          const nxt = a + (t - a) * ease;
+          alpha[i] = Math.abs(nxt - t) < 0.002 ? t : nxt;
+          dirty = true;
+        }
+      }
+      if (dirty) draw();
+      requestAnimationFrame(frame);
+    }
+    resize();
+    let raf = 0;
+    window.addEventListener("resize", () => { if (raf) cancelAnimationFrame(raf); raf = requestAnimationFrame(resize); });
+    if (reducedMotion) { for (let i = 0; i < alpha.length; i++) alpha[i] = target[i]; draw(); }
+    else { for (let i = 0; i < alpha.length; i++) alpha[i] = 0; requestAnimationFrame(frame); }
+  })();
+`;
+function renderLinkPage(linkToken) {
+    const serializedLinkToken = JSON.stringify(linkToken);
+    return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Penny-Pincher · Connect bank</title>
+    ${FONT_LINKS}
+    <script src="https://cdn.plaid.com/link/v2/stable/link-initialize.js"></script>
+    <style>${SHARED_AUTH_STYLES}</style>
+  </head>
+  <body>
+    <canvas id="ca-bg" aria-hidden="true"></canvas>
+    <div class="stage">
+      <header class="top-bar">
+        <div class="top-bar-inner">
+          <a href="/" class="brand">${BRAND_SVG}<span class="brand-mark">Penny-Pincher</span></a>
+          <span class="chip">Plaid Link · Direct</span>
+        </div>
+      </header>
+      <main>
+        <div class="label-row">
+          <span class="label">§ Auth · step 01 / 02</span>
+          <span class="label-aux">handshake · plaid → cli</span>
+        </div>
+        <h1 class="display-lift">CONNECT</h1>
+        <p class="lede">
+          Plaid Link should open in a moment.
+          <span class="dim">Pick a bank, sign in, and the CLI will pick up the token automatically. You can close this tab when it's done.</span>
+        </p>
+        <div class="actions">
+          <button type="button" id="open" class="btn-primary">Open Plaid Link →</button>
+          <span id="status" class="status"><span class="dot"></span><span id="status-text">Initialising</span></span>
+        </div>
+        <div class="telemetry">
+          <span><span class="k">Mode</span><span class="v">Direct · local Plaid creds</span></span>
+          <span><span class="k">Tokens</span><span class="v">never persisted</span></span>
+          <span><span class="k">Transport</span><span class="v">localhost · loopback</span></span>
+        </div>
+        <div id="ink" class="ink" hidden>
+          <div class="ink-label" id="ink-label">Diagnostic</div>
+          <pre id="ink-body"></pre>
+        </div>
+        <p class="note">
+          <span class="accent">▪</span> Trouble? Press <code style="text-transform:none;letter-spacing:0;color:var(--glyph);font-weight:700;">Ctrl-C</code> in your terminal and re-run
+          <code style="text-transform:none;letter-spacing:0;color:var(--glyph);font-weight:700;">penny-pincher auth --direct-plaid</code>.
+        </p>
+      </main>
+      <footer>
+        <div class="footer-inner">
+          <span>▪ Penny-Pincher · navy &amp; ember</span>
+          <span>localhost · plaid direct mode</span>
+        </div>
+      </footer>
+    </div>
+    <script>
+      const statusEl  = document.getElementById("status");
+      const statusTxt = document.getElementById("status-text");
+      const openBtn   = document.getElementById("open");
+      const ink       = document.getElementById("ink");
+      const inkLabel  = document.getElementById("ink-label");
+      const inkBody   = document.getElementById("ink-body");
+      function setStatus(text, kind) {
+        statusTxt.textContent = text;
+        statusEl.classList.remove("is-success", "is-error", "is-idle");
+        if (kind) statusEl.classList.add("is-" + kind);
+      }
+      function showInk(label, body) {
+        inkLabel.textContent = label;
+        inkBody.textContent = typeof body === "string" ? body : JSON.stringify(body, null, 2);
+        ink.hidden = false;
+      }
+      setStatus("Opening Plaid Link", null);
+      const handler = Plaid.create({
+        token: ${serializedLinkToken},
+        receivedRedirectUri: window.location.pathname === "/oauth-return" ? window.location.href : undefined,
+        onSuccess: async (public_token, metadata) => {
+          setStatus("Exchanging token", null);
+          try {
+            const response = await fetch("/exchange", {
+              method: "POST",
+              headers: { "content-type": "application/json" },
+              body: JSON.stringify({ public_token, metadata })
+            });
+            const body = await response.json();
+            if (response.ok) {
+              setStatus("Connected · back to your terminal", "success");
+            } else {
+              setStatus("Token exchange failed", "error");
+              showInk("Exchange error", body);
+            }
+          } catch (err) {
+            setStatus("Network error", "error");
+            showInk("Exchange error", String(err && err.message ? err.message : err));
+          }
+        },
+        onExit: (error) => {
+          if (error) {
+            setStatus("Plaid Link error", "error");
+            showInk("Plaid onExit", error);
+          } else {
+            setStatus("Closed · click to reopen", "idle");
+          }
+        }
+      });
+      openBtn.addEventListener("click", () => handler.open());
+      handler.open();
+    </script>
+    <script>${CA_BG_SCRIPT}</script>
+  </body>
+</html>`;
+}
+function renderHostedWaitingPage(hostedLinkUrl) {
+    const serializedHostedLinkUrl = JSON.stringify(hostedLinkUrl);
+    return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Penny-Pincher · Redirecting to Plaid Link</title>
+    ${FONT_LINKS}
+    <style>${SHARED_AUTH_STYLES}</style>
+  </head>
+  <body>
+    <div class="stage">
+      <header class="top-bar">
+        <div class="top-bar-inner">
+          <a href="/" class="brand">${BRAND_SVG}<span class="brand-mark">Penny-Pincher</span></a>
+          <span class="chip">Plaid Link · Hosted</span>
+        </div>
+      </header>
+      <main>
+        <div class="label-row">
+          <span class="label">§ Auth · redirect</span>
+          <span class="label-aux">cli → hosted broker</span>
+        </div>
+        <h1 class="display-lift">REDIRECT</h1>
+        <p class="lede">
+          Sending you to the hosted Penny-Pincher Plaid Link page.
+          <span class="dim">Leave this local callback tab open until auth completes — your terminal will pick up the token as soon as Plaid hands it back.</span>
+        </p>
+        <div class="actions">
+          <a id="link" href="#" class="btn-primary">Open Plaid Link →</a>
+          <span class="status"><span class="dot"></span>Forwarding</span>
+        </div>
+        <p class="note"><span class="accent">▪</span> If nothing happens, use the button above.</p>
+      </main>
+      <footer>
+        <div class="footer-inner">
+          <span>▪ Penny-Pincher · navy &amp; ember</span>
+          <span>localhost · hosted broker mode</span>
+        </div>
+      </footer>
+    </div>
+    <script>
+      const url = ${serializedHostedLinkUrl};
+      document.getElementById("link").href = url;
+      window.location.href = url;
+    </script>
+  </body>
+</html>`;
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AACA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,EACpB,MAAM,cAAc,CAAC;AACtB,OAAO,EAA2B,UAAU,EAAyB,UAAU,EAAE,MAAM,aAAa,CAAC;AACrG,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAoB/C,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAoB;IACpD,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,OAAoB;IACnD,MAAM,cAAc,GAAG,MAAM,UAAU,EAAE,CAAC;IAC1C,MAAM,OAAO,GACX,cAAc,CAAC,YAAY,IAAI,cAAc,CAAC,aAAa;QACzD,CAAC,CAAC;YACE,YAAY,EAAE,cAAc,CAAC,YAAY;YACzC,aAAa,EAAE,cAAc,CAAC,aAAa;SAC5C;QACH,CAAC,CAAC,sBAAsB,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,mBAAmB,CACpC,OAAO,CAAC,UAAU;WACb,OAAO,CAAC,GAAG,CAAC,qBAAqB;WACjC,OAAO,CAAC,GAAG,CAAC,oBAAoB;WAChC,OAAO,CAAC,GAAG,CAAC,eAAe;WAC3B,iBAAiB,CACvB,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;IACpE,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,UAAU,EAAE;QACnD,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW;KACZ,CAAC,CAAC;IAEH,OAAO,gBAAgB,CAAC;QACtB,GAAG,OAAO;QACV,aAAa,EAAE,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC;QAC5E,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE;YACxC,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAC9C,UAAU,EACV;gBACE,WAAW;gBACX,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,QAAQ;aACT,EACD,OAAO,CAAC,aAAa,CACtB,CAAC;YACF,MAAM,MAAM,GAAuB;gBACjC,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,UAAU;gBACV,aAAa,EAAE,QAAQ,CAAC,aAAa;gBACrC,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,eAAe,EAAE,QAAQ,CAAC,eAAe;gBACzC,aAAa,EAAE,QAAQ,CAAC,aAAa;gBACrC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,YAAY,EAAE,QAAQ,CAAC,YAAY;aACpC,CAAC;YAEF,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;YACzB,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,OAAoB;IACnD,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IACnD,MAAM,iBAAiB,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC;QACrD,IAAI,EAAE;YACJ,cAAc,EAAE,iBAAiB,IAAI,CAAC,GAAG,EAAE,EAAE;SAC9C;QACD,WAAW,EAAE,eAAe;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAiB;QACnC,aAAa,EAAE,OAAO,CAAC,YAAqB;QAC5C,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,WAAW;KAC1B,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC;IAEpD,OAAO,gBAAgB,CAAC;QACtB,GAAG,OAAO;QACV,SAAS;QACT,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE;YACxC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC;gBACpD,YAAY,EAAE,WAAW;aAC1B,CAAC,CAAC;YACH,MAAM,MAAM,GAAuB;gBACjC,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,YAAY;gBACvC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,OAAO;gBAC7B,eAAe,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI;gBAC5C,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc;gBACpD,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;aACnC,CAAC;YAEF,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;YACzB,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,OAI/B;IACC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACxB,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QACnC,QAAQ,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;QACvD,QAAQ,CAAC,SAAS,CAAC,8BAA8B,EAAE,kBAAkB,CAAC,CAAC;QACvE,QAAQ,CAAC,SAAS,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;QACnE,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAClC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,IAAI,MAA0B,CAAC;IAC/B,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnE,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,MAAM,CAAC,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC,CAAC;QACnE,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAEnB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE;YAClC,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC1B,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;gBAC3E,OAAO;YACT,CAAC;YAED,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE;YAC9C,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;YAChD,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC;gBAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,QAAoC,CAAC;gBAEpE,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;oBACpD,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;oBAC7D,OAAO;gBACT,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;gBAC7D,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,IAAI;oBACR,UAAU,EAAE,8BAA8B;oBAC1C,eAAe,EAAE,MAAM,CAAC,eAAe;oBACvC,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;iBAClB,CAAC,CAAC;gBACH,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,MAAM,CAAC,KAAK,CAAC,CAAC;gBACd,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACxB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B;iBAC/E,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;QACd,MAAM,EAAE,KAAK,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,IAAI,oBAAoB,OAAO,CAAC,IAAI,EAAE,CAAC;IACxE,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IAEvB,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAkB,EAAE,SAAiB,EAAE,IAAY;IAC9E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC5C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,oBAAoB,IAAI,WAAW,CAAC,CAAC;IACtE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,MAAM,CAAC,GAAoB,EAAE,IAAY;IAChD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+C1B,CAAC;AAEF,MAAM,UAAU,GAAG;;;;CAIlB,CAAC;AAEF,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;CAejB,CAAC;AAEF,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4EpB,CAAC;AAEF,SAAS,cAAc,CAAC,SAAiB;IACvC,MAAM,mBAAmB,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAEtD,OAAO;;;;;;MAMH,UAAU;;aAEH,kBAAkB;;;;;;;sCAOO,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0D9B,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAkCtB,YAAY;;QAElB,CAAC;AACT,CAAC;AAED,SAAS,uBAAuB,CAAC,aAAqB;IACpD,MAAM,uBAAuB,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IAE9D,OAAO;;;;;;MAMH,UAAU;aACH,kBAAkB;;;;;;sCAMO,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBA4B3B,uBAAuB;;;;;QAKnC,CAAC;AACT,CAAC"}