wotann 0.5.0

package/dist/auth/auth-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-mode.js","sourceRoot":"","sources":["../../src/auth/auth-mode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AA2BH;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAItC;IACC,IAAI,IAAI,CAAC,cAAc,KAAK,UAAU;QAAE,OAAO,gBAAgB,CAAC;IAChE,IAAI,IAAI,CAAC,cAAc,KAAK,UAAU;QAAE,OAAO,kBAAkB,CAAC;IAElE,kEAAkE;IAClE,IAAI,IAAI,CAAC,kBAAkB,IAAI,CAAC,IAAI,CAAC,iBAAiB;QAAE,OAAO,kBAAkB,CAAC;IAClF,IAAI,IAAI,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,kBAAkB;QAAE,OAAO,gBAAgB,CAAC;IAEhF,gEAAgE;IAChE,kEAAkE;IAClE,kCAAkC;IAClC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAc;IAC9C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,gBAAgB;YACnB,OAAO,CACL,oEAAoE;gBACpE,iEAAiE;gBACjE,qEAAqE;gBACrE,2CAA2C,CAC5C,CAAC;QACJ,KAAK,kBAAkB;YACrB,OAAO,CACL,yDAAyD;gBACzD,4DAA4D;gBAC5D,4EAA4E,CAC7E,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAc;IAC/C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,gBAAgB;YACnB,OAAO,kCAAkC,CAAC;QAC5C,KAAK,kBAAkB;YACrB,OAAO,8BAA8B,CAAC;IAC1C,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAc;IAC9C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,gBAAgB;YACnB,yDAAyD;YACzD,OAAO,QAAQ,CAAC;QAClB,KAAK,kBAAkB;YACrB,yCAAyC;YACzC,OAAO,OAAO,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAIpC;IACC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE;KAChC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAInC;IACC,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACjE,OAAO,CACL,+CAA+C;YAC/C,+EAA+E;YAC/E,6EAA6E;YAC7E,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/auth/login.d.ts

@@ -0,0 +1,72 @@
+/**
+ * `wotann login` — unified provider authentication.
+ *
+ * Supports 6 auth flows:
+ * 1. Anthropic: delegates to `claude login` (subscription) OR direct OAuth (API)
+ * 2. Codex/ChatGPT: PKCE browser flow via auth.openai.com, stores to ~/.codex/auth.json
+ * 3. GitHub Copilot: device code flow (shows code, user enters in browser)
+ * 4. Gemini: opens browser to AI Studio API key page (user copies key)
+ * 5. Ollama: no login needed — verifies server and suggests models
+ * 6. OpenAI: env var check + instructions
+ *
+ * PORT FALLBACK: If the OAuth callback port is taken (18920-18930),
+ * the browser flow falls back to device code flow automatically.
+ */
+import { type AuthMode, type AuthModeConfig } from "./auth-mode.js";
+export type LoginProvider = "anthropic" | "codex" | "copilot" | "openai" | "gemini" | "ollama";
+export interface LoginResult {
+    readonly provider: LoginProvider;
+    readonly success: boolean;
+    readonly message: string;
+    readonly method: string;
+}
+/**
+ * --mode parameter accepted by `wotann login`. Maps directly onto
+ * AuthMode minus a third "ask" sentinel for the interactive prompt.
+ * Per V9 SB-07 dual-auth: personal = OAuth-via-CC, business = API key.
+ */
+export type LoginModeArg = "personal" | "business";
+/**
+ * Path on disk where the AuthModeConfig is persisted. Single source
+ * of truth — exported so tests can stub `homedir()` and assert path.
+ */
+export declare const AUTH_MODE_CONFIG_PATH: string;
+/**
+ * Persist an AuthModeConfig to ~/.wotann/auth-mode.json with mode-0600
+ * perms (user-only read/write). Centralised so the wizard + the CLI
+ * verb call the same write path.
+ *
+ * Returns the absolute path written to so callers can log it.
+ */
+export declare function persistAuthModeConfig(config: AuthModeConfig, configPath?: string): string;
+/**
+ * Run the dual-auth gate before we touch any provider login. Returns
+ * { ok: true } when the user's chosen mode is compatible with their
+ * available creds, or { ok: false, reason } when business mode was
+ * picked with no API key (the policy-rejected combo).
+ */
+export declare function checkAuthModeGate(opts: {
+    readonly mode: AuthMode;
+    readonly env?: NodeJS.ProcessEnv;
+}): {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};
+/**
+ * Convert the CLI-flag form ("personal" | "business") into the
+ * canonical AuthMode used everywhere else. Kept as a pure function
+ * so tests don't need to mount commander.
+ */
+export declare function authModeFromCliArg(arg: LoginModeArg): AuthMode;
+export interface RunLoginOptions {
+    /**
+     * Dual-auth mode the user picked via `--mode personal|business`.
+     * Omitted → interactive prompt (or inferred from invocation flag).
+     * Per V9 SB-07: no silent default — we'd rather refuse than guess.
+     */
+    readonly mode?: LoginModeArg;
+}
+export declare function runLogin(provider?: string, options?: RunLoginOptions): Promise<void>;
+//# sourceMappingURL=login.d.ts.map

package/dist/auth/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/auth/login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AASH,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,cAAc,EAIpB,MAAM,gBAAgB,CAAC;AAExB,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE/F,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,UAAU,CAAC;AAEnD;;;GAGG;AACH,eAAO,MAAM,qBAAqB,QAA4C,CAAC;AAE/E;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,cAAc,EACtB,UAAU,GAAE,MAA8B,GACzC,MAAM,CAeR;AAsBD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CAClC,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAS1E;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,YAAY,GAAG,QAAQ,CAE9D;AAoRD,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;CAC9B;AAED,wBAAsB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoE9F"}

package/dist/auth/login.js

@@ -0,0 +1,414 @@
+/**
+ * `wotann login` — unified provider authentication.
+ *
+ * Supports 6 auth flows:
+ * 1. Anthropic: delegates to `claude login` (subscription) OR direct OAuth (API)
+ * 2. Codex/ChatGPT: PKCE browser flow via auth.openai.com, stores to ~/.codex/auth.json
+ * 3. GitHub Copilot: device code flow (shows code, user enters in browser)
+ * 4. Gemini: opens browser to AI Studio API key page (user copies key)
+ * 5. Ollama: no login needed — verifies server and suggests models
+ * 6. OpenAI: env var check + instructions
+ *
+ * PORT FALLBACK: If the OAuth callback port is taken (18920-18930),
+ * the browser flow falls back to device code flow automatically.
+ */
+import { existsSync, mkdirSync, chmodSync } from "node:fs";
+import { writeFileAtomic } from "./../utils/atomic-io.js";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { resolveWotannHome, resolveWotannHomeSubdir } from "../utils/wotann-home.js";
+import chalk from "chalk";
+import { runDeviceCodeFlow, getGitHubDeviceCodeConfig } from "./oauth-server.js";
+import { createAuthModeConfig, refuseReasonForMode, bannerLabelForMode, } from "./auth-mode.js";
+/**
+ * Path on disk where the AuthModeConfig is persisted. Single source
+ * of truth — exported so tests can stub `homedir()` and assert path.
+ */
+export const AUTH_MODE_CONFIG_PATH = resolveWotannHomeSubdir("auth-mode.json");
+/**
+ * Persist an AuthModeConfig to ~/.wotann/auth-mode.json with mode-0600
+ * perms (user-only read/write). Centralised so the wizard + the CLI
+ * verb call the same write path.
+ *
+ * Returns the absolute path written to so callers can log it.
+ */
+export function persistAuthModeConfig(config, configPath = AUTH_MODE_CONFIG_PATH) {
+    const dir = join(configPath, "..");
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+    // Wave 6.5-UU (H-22) — auth config holds the active mode + provider
+    // selection. writeFileAtomic survives crashes mid-write.
+    writeFileAtomic(configPath, JSON.stringify(config, null, 2), { mode: 0o600 });
+    // Defensive chmod — writeFileSync's mode arg only applies on file
+    // *creation*, so an overwrite of an existing file with looser perms
+    // would silently keep the looser bits. Re-set explicitly.
+    try {
+        chmodSync(configPath, 0o600);
+    }
+    catch {
+        // chmod can fail on Windows or odd FS — non-fatal; file is still written.
+    }
+    return configPath;
+}
+/**
+ * Detect whether Anthropic Claude Code OAuth credentials are present.
+ * Looks for ~/.claude/.credentials.json which is what the official
+ * Claude Code CLI writes after `claude login`. Pure read — no probe
+ * to Anthropic's servers.
+ */
+function hasClaudeCliCreds() {
+    return existsSync(join(homedir(), ".claude", ".credentials.json"));
+}
+/**
+ * Detect whether the user has a real ANTHROPIC_API_KEY in env. Used
+ * by the dual-auth gate — business mode requires this; OAuth alone
+ * is not enough since 2026-01-09.
+ */
+function hasAnthropicApiKey(env = process.env) {
+    const key = env["ANTHROPIC_API_KEY"];
+    return typeof key === "string" && key.trim().length > 0;
+}
+/**
+ * Run the dual-auth gate before we touch any provider login. Returns
+ * { ok: true } when the user's chosen mode is compatible with their
+ * available creds, or { ok: false, reason } when business mode was
+ * picked with no API key (the policy-rejected combo).
+ */
+export function checkAuthModeGate(opts) {
+    const env = opts.env ?? process.env;
+    const reason = refuseReasonForMode({
+        mode: opts.mode,
+        hasClaudeCliCreds: hasClaudeCliCreds(),
+        hasAnthropicApiKey: hasAnthropicApiKey(env),
+    });
+    if (reason !== null)
+        return { ok: false, reason };
+    return { ok: true };
+}
+/**
+ * Convert the CLI-flag form ("personal" | "business") into the
+ * canonical AuthMode used everywhere else. Kept as a pure function
+ * so tests don't need to mount commander.
+ */
+export function authModeFromCliArg(arg) {
+    return arg === "personal" ? "personal-oauth" : "business-api-key";
+}
+// ── Anthropic Login ────────────────────────────────────────
+async function loginAnthropic() {
+    // Only path: delegate to Claude Code CLI. Per V9 T0.1, WOTANN must not
+    // hold its own copy of a Claude subscription OAuth token — the `claude`
+    // binary is the credential holder, WOTANN just invokes it.
+    try {
+        const { execFileSync } = await import("node:child_process");
+        try {
+            execFileSync("claude", ["--version"], { stdio: "pipe", timeout: 5000 });
+            console.log(chalk.dim("  Found Claude Code CLI. Delegating login..."));
+            execFileSync("claude", ["login"], { stdio: "inherit", timeout: 120_000 });
+            return {
+                provider: "anthropic",
+                success: true,
+                message: "Logged in via Claude Code CLI. Your subscription is now active.",
+                method: "cli-delegation",
+            };
+        }
+        catch {
+            // Claude CLI not installed — fall through to API-key instructions.
+        }
+    }
+    catch {
+        // Module import failed — fall through.
+    }
+    // CLI unavailable: print actionable instructions. Subscription auth
+    // requires the Claude CLI (WOTANN cannot legally hold a Claude Pro/Max
+    // OAuth token itself); pay-per-token auth uses ANTHROPIC_API_KEY.
+    console.log(chalk.dim("\n  Claude Code CLI not found."));
+    console.log(chalk.dim("  For your Claude Max/Pro subscription, install the CLI:"));
+    console.log(chalk.dim("    npm i -g @anthropic-ai/claude-code"));
+    console.log(chalk.dim("    claude login"));
+    console.log(chalk.dim("    wotann login anthropic   # re-run after install\n"));
+    console.log(chalk.dim("  For pay-per-token access, set your API key manually:"));
+    console.log(chalk.dim("    export ANTHROPIC_API_KEY=sk-ant-..."));
+    console.log(chalk.dim("    (get a key at https://console.anthropic.com/settings/keys)\n"));
+    return {
+        provider: "anthropic",
+        success: false,
+        message: "Install Claude Code CLI (npm i -g @anthropic-ai/claude-code) for subscription access, or set ANTHROPIC_API_KEY for pay-per-token.",
+        method: "manual",
+    };
+}
+// ── Codex/ChatGPT Login ────────────────────────────────────
+async function loginCodex() {
+    // Only path: delegate to Codex CLI. Per V9 T0.2, WOTANN no longer runs
+    // its own PKCE flow against auth.openai.com with Codex CLI's public
+    // client_id — that would masquerade as the official CLI. The Codex
+    // CLI is the legitimate credential holder.
+    console.log(chalk.dim("  Delegating to Codex CLI...\n"));
+    console.log(chalk.dim("  This uses your ChatGPT Plus/Pro/Team subscription."));
+    console.log(chalk.dim("  Codex models (codexplan, codexspark) require a ChatGPT subscription.\n"));
+    try {
+        const { execFileSync } = await import("node:child_process");
+        execFileSync("npx", ["@openai/codex", "login"], {
+            stdio: "inherit",
+            timeout: 180_000,
+        });
+        return {
+            provider: "codex",
+            success: true,
+            message: "Authenticated via Codex CLI. Tokens saved by the CLI to ~/.codex/auth.json.",
+            method: "cli-delegation",
+        };
+    }
+    catch {
+        console.log(chalk.dim("\n  Codex CLI delegation failed."));
+        console.log(chalk.dim("  Install and run the Codex CLI directly:"));
+        console.log(chalk.dim("    npm i -g @openai/codex"));
+        console.log(chalk.dim("    codex login"));
+        console.log(chalk.dim("    wotann login codex   # re-run after login\n"));
+        return {
+            provider: "codex",
+            success: false,
+            message: "Install and run: npm i -g @openai/codex && codex login. WOTANN detects existing ~/.codex/auth.json.",
+            method: "manual",
+        };
+    }
+}
+// ── GitHub Copilot Login ───────────────────────────────────
+async function loginCopilot() {
+    console.log(chalk.dim("  Starting GitHub device code flow...\n"));
+    console.log(chalk.dim("  This uses your GitHub Copilot subscription."));
+    console.log(chalk.dim("  Free: GPT-4.1-mini, Claude 3.5 Haiku (2K completions/mo)"));
+    console.log(chalk.dim("  Pro ($10/mo): GPT-4.1, Claude Sonnet 4, Gemini 2.5 Pro"));
+    console.log(chalk.dim("  Pro+ ($39/mo): GPT-5, Claude Opus 4, o3, unlimited\n"));
+    const config = getGitHubDeviceCodeConfig();
+    const result = await runDeviceCodeFlow(config, (response) => {
+        console.log();
+        console.log(chalk.bold("  Enter this code at GitHub:"));
+        console.log(chalk.cyan(`  ${response.userCode}`));
+        console.log(chalk.dim(`  URL: ${response.verificationUri}`));
+        console.log(chalk.dim("  Waiting for authorization..."));
+        console.log();
+    });
+    if (!result.success || !result.tokens) {
+        return {
+            provider: "copilot",
+            success: false,
+            message: result.error ?? "Device code flow failed. Try: export GH_TOKEN=$(gh auth token)",
+            method: "device-code",
+        };
+    }
+    // Save the token for use as GH_TOKEN
+    const wotannConfigDir = resolveWotannHome();
+    if (!existsSync(wotannConfigDir))
+        mkdirSync(wotannConfigDir, { recursive: true });
+    const tokenData = {
+        provider: "copilot",
+        token: result.tokens.accessToken,
+        refresh_token: result.tokens.refreshToken,
+        expires_in: result.tokens.expiresIn,
+        scope: result.tokens.scope,
+        saved_at: new Date().toISOString(),
+    };
+    // Wave 6.5-UU (H-22) — Copilot OAuth tokens. Atomic write so a crash
+    // mid-write doesn't leave the user with a corrupt token file (forcing
+    // a full re-auth instead of a normal session restart).
+    writeFileAtomic(join(wotannConfigDir, "copilot-token.json"), JSON.stringify(tokenData, null, 2), {
+        mode: 0o600,
+    });
+    return {
+        provider: "copilot",
+        success: true,
+        message: "GitHub Copilot authenticated. Token saved to ~/.wotann/copilot-token.json",
+        method: "device-code",
+    };
+}
+// ── Gemini Login ───────────────────────────────────────────
+async function loginGemini() {
+    console.log(chalk.dim("  Opening Google AI Studio for API key...\n"));
+    console.log(chalk.dim("  Gemini has a generous free tier:"));
+    console.log(chalk.dim("  - Flash: 1.5M tokens/day, 1000 RPM"));
+    console.log(chalk.dim("  - Pro: 50 requests/day (free), unlimited with billing\n"));
+    const { execFileSync } = await import("node:child_process");
+    const { platform: osPlatform } = await import("node:os");
+    const url = "https://aistudio.google.com/app/apikey";
+    try {
+        if (osPlatform() === "darwin") {
+            execFileSync("open", [url], { stdio: "pipe" });
+        }
+        else {
+            execFileSync("xdg-open", [url], { stdio: "pipe" });
+        }
+    }
+    catch {
+        console.log(chalk.dim(`  Open this URL: ${url}`));
+    }
+    console.log(chalk.bold("  Get your free API key from Google AI Studio."));
+    console.log(chalk.dim("  Then set it: export GEMINI_API_KEY=<your-key>"));
+    console.log(chalk.dim("  Or add to .wotann/config.yaml:\n"));
+    console.log(chalk.dim("  providers:"));
+    console.log(chalk.dim("    gemini:"));
+    console.log(chalk.dim("      enabled: true"));
+    console.log(chalk.dim("      apiKey: AI...\n"));
+    return {
+        provider: "gemini",
+        success: true,
+        message: "Opened AI Studio. Set GEMINI_API_KEY after getting your key.",
+        method: "manual",
+    };
+}
+// ── Ollama Check ───────────────────────────────────────────
+async function loginOllama() {
+    console.log(chalk.dim("  Checking Ollama status...\n"));
+    try {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), 3000);
+        const { ollamaUrl } = await import("../providers/ollama-host.js");
+        const response = await fetch(ollamaUrl("/api/tags"), { signal: controller.signal });
+        clearTimeout(timeout);
+        if (response.ok) {
+            const data = (await response.json());
+            const models = data.models ?? [];
+            const modelCount = models.length;
+            console.log(chalk.green(`  Ollama is running with ${modelCount} model(s):`));
+            for (const m of models.slice(0, 10)) {
+                const sizeGB = (m.size / 1e9).toFixed(1);
+                console.log(chalk.dim(`    - ${m.name} (${sizeGB}GB)`));
+            }
+            if (modelCount === 0) {
+                console.log(chalk.yellow("\n  No models installed. Recommended for coding:"));
+                console.log(chalk.dim("    ollama pull qwen3-coder-next    # 80B MoE, best coding (18GB VRAM)"));
+                console.log(chalk.dim("    ollama pull qwen3.5:27b         # multimodal, 256K context (20GB)"));
+                console.log(chalk.dim("    ollama pull devstral:24b         # fast coding agent (16GB)"));
+                console.log(chalk.dim("    ollama pull qwen3-coder:7b       # entry level (5GB)"));
+            }
+            return {
+                provider: "ollama",
+                success: true,
+                message: `Ollama is running with ${modelCount} model(s). No login needed.`,
+                method: "local-check",
+            };
+        }
+    }
+    catch {
+        // Not running
+    }
+    console.log(chalk.yellow("  Ollama is not running."));
+    console.log(chalk.dim("\n  Install:  https://ollama.ai"));
+    console.log(chalk.dim("  Start:    ollama serve"));
+    console.log(chalk.dim("  Pull:     ollama pull qwen3-coder-next"));
+    console.log(chalk.dim("  Verify:   ollama list\n"));
+    return {
+        provider: "ollama",
+        success: false,
+        message: "Ollama is not running. Install from https://ollama.ai, then: ollama serve && ollama pull qwen3-coder-next",
+        method: "local-check",
+    };
+}
+// ── OpenAI API Key ─────────────────────────────────────────
+async function loginOpenAI() {
+    if (process.env["OPENAI_API_KEY"]) {
+        return {
+            provider: "openai",
+            success: true,
+            message: "OPENAI_API_KEY is already set.",
+            method: "env-var",
+        };
+    }
+    console.log(chalk.bold("  Set your OpenAI API key:"));
+    console.log(chalk.dim("  export OPENAI_API_KEY=sk-..."));
+    console.log(chalk.dim("  Get a key at: https://platform.openai.com/api-keys"));
+    console.log(chalk.dim("  Note: OpenAI API models (GPT-5.x, o-series) require API billing."));
+    console.log(chalk.dim("  For ChatGPT subscription models (Codex), use: wotann login codex\n"));
+    return {
+        provider: "openai",
+        success: false,
+        message: "OPENAI_API_KEY not set. Set it in your shell profile.",
+        method: "manual",
+    };
+}
+export async function runLogin(provider, options = {}) {
+    console.log(chalk.bold("\nWOTANN Login\n"));
+    // ── SB-07 dual-auth gate ────────────────────────────────
+    // If the user passed --mode, persist it BEFORE any provider login.
+    // This ensures business-mode rejection happens up front rather than
+    // halfway through a CLI-delegation flow.
+    if (options.mode) {
+        const mode = authModeFromCliArg(options.mode);
+        const gate = checkAuthModeGate({ mode });
+        if (!gate.ok) {
+            console.log(chalk.red("  Cannot proceed in business mode:"));
+            console.log(chalk.yellow(`  ${gate.reason}\n`));
+            // Do not persist a mode the user couldn't actually use.
+            return;
+        }
+        const config = createAuthModeConfig({ mode, userAcknowledgedTos: true });
+        const written = persistAuthModeConfig(config);
+        console.log(chalk.green(`  Auth mode set to: ${bannerLabelForMode(mode)}`));
+        console.log(chalk.dim(`  Saved to ${written} (mode 0600)\n`));
+        if (mode === "personal-oauth") {
+            // QB#1 honest one-line warning — no vendor-biased silent fallback.
+            console.log(chalk.yellow("  WARNING: personal-oauth mode is for personal experimentation only."));
+            console.log(chalk.dim("  Anthropic rejects non-Claude-Code OAuth tokens server-side since 2026-01-09."));
+            console.log(chalk.dim("  For products/business use --mode business with an ANTHROPIC_API_KEY.\n"));
+        }
+    }
+    if (provider) {
+        const result = await loginSingleProvider(provider);
+        printLoginResult(result);
+        return;
+    }
+    // Interactive: show all providers with status
+    const providers = [
+        {
+            name: "anthropic",
+            label: "Anthropic Claude (subscription or API key)",
+            cost: "subscription / pay-per-use",
+        },
+        { name: "codex", label: "OpenAI Codex (ChatGPT subscription)", cost: "ChatGPT Plus $20/mo" },
+        { name: "copilot", label: "GitHub Copilot (free tier available)", cost: "Free / $10 / $39/mo" },
+        { name: "gemini", label: "Google Gemini (generous free tier)", cost: "free" },
+        { name: "ollama", label: "Ollama (local, free, private)", cost: "free" },
+        { name: "openai", label: "OpenAI API (pay-per-use)", cost: "pay-per-use" },
+    ];
+    console.log(chalk.dim("  Select a provider to authenticate:\n"));
+    for (let i = 0; i < providers.length; i++) {
+        const p = providers[i];
+        if (p)
+            console.log(`  ${chalk.cyan(`${i + 1}`)}. ${p.label} ${chalk.dim(`[${p.cost}]`)}`);
+    }
+    console.log();
+    console.log(chalk.dim("  Usage: wotann login <provider>"));
+    console.log(chalk.dim("  Example: wotann login anthropic"));
+    console.log(chalk.dim("           wotann login codex"));
+    console.log(chalk.dim("           wotann login copilot"));
+    console.log(chalk.dim("           wotann login gemini"));
+    console.log(chalk.dim("           wotann login ollama\n"));
+}
+async function loginSingleProvider(provider) {
+    switch (provider) {
+        case "anthropic":
+            return loginAnthropic();
+        case "codex":
+            return loginCodex();
+        case "copilot":
+            return loginCopilot();
+        case "gemini":
+            return loginGemini();
+        case "ollama":
+            return loginOllama();
+        case "openai":
+            return loginOpenAI();
+        default:
+            return {
+                provider,
+                success: false,
+                message: `Unknown provider: ${provider}. Available: anthropic, codex, copilot, gemini, ollama, openai`,
+                method: "none",
+            };
+    }
+}
+function printLoginResult(result) {
+    const icon = result.success ? chalk.green("ok") : chalk.red("--");
+    const msg = result.success ? chalk.green(result.message) : chalk.yellow(result.message);
+    console.log(`  ${icon} ${msg}\n`);
+}
+//# sourceMappingURL=login.js.map

package/dist/auth/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/auth/login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACrF,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AACjF,OAAO,EAGL,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AAkBxB;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;AAE/E;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAsB,EACtB,aAAqB,qBAAqB;IAE1C,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,oEAAoE;IACpE,yDAAyD;IACzD,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9E,kEAAkE;IAClE,oEAAoE;IACpE,0DAA0D;IAC1D,IAAI,CAAC;QACH,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB;IACxB,OAAO,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC9D,MAAM,GAAG,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACrC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAGjC;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,mBAAmB,CAAC;QACjC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,iBAAiB,EAAE,iBAAiB,EAAE;QACtC,kBAAkB,EAAE,kBAAkB,CAAC,GAAG,CAAC;KAC5C,CAAC,CAAC;IACH,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAClD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAiB;IAClD,OAAO,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,kBAAkB,CAAC;AACpE,CAAC;AAED,8DAA8D;AAE9D,KAAK,UAAU,cAAc;IAC3B,uEAAuE;IACvE,wEAAwE;IACxE,2DAA2D;IAC3D,IAAI,CAAC;QACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAC5D,IAAI,CAAC;YACH,YAAY,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACxE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC,CAAC;YACvE,YAAY,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YAC1E,OAAO;gBACL,QAAQ,EAAE,WAAW;gBACrB,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,iEAAiE;gBAC1E,MAAM,EAAE,gBAAgB;aACzB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;QACrE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;IAED,oEAAoE;IACpE,uEAAuE;IACvE,kEAAkE;IAClE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC,CAAC;IAE3F,OAAO;QACL,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,KAAK;QACd,OAAO,EACL,mIAAmI;QACrI,MAAM,EAAE,QAAQ;KACjB,CAAC;AACJ,CAAC;AAED,8DAA8D;AAE9D,KAAK,UAAU,UAAU;IACvB,uEAAuE;IACvE,oEAAoE;IACpE,mEAAmE;IACnE,2CAA2C;IAC3C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,0EAA0E,CAAC,CACtF,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAC5D,YAAY,CAAC,KAAK,EAAE,CAAC,eAAe,EAAE,OAAO,CAAC,EAAE;YAC9C,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,OAAO;SACjB,CAAC,CAAC;QACH,OAAO;YACL,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,6EAA6E;YACtF,MAAM,EAAE,gBAAgB;SACzB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC,CAAC;QAE1E,OAAO;YACL,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,KAAK;YACd,OAAO,EACL,qGAAqG;YACvG,MAAM,EAAE,QAAQ;SACjB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,8DAA8D;AAE9D,KAAK,UAAU,YAAY;IACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC,CAAC;IACrF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC,CAAC;IAEjF,MAAM,MAAM,GAAG,yBAAyB,EAAE,CAAC;IAE3C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE;QAC1D,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACtC,OAAO;YACL,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,MAAM,CAAC,KAAK,IAAI,gEAAgE;YACzF,MAAM,EAAE,aAAa;SACtB,CAAC;IACJ,CAAC;IAED,qCAAqC;IACrC,MAAM,eAAe,GAAG,iBAAiB,EAAE,CAAC;IAC5C,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;QAAE,SAAS,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAElF,MAAM,SAAS,GAAG;QAChB,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW;QAChC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY;QACzC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS;QACnC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK;QAC1B,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACnC,CAAC;IAEF,qEAAqE;IACrE,sEAAsE;IACtE,uDAAuD;IACvD,eAAe,CAAC,IAAI,CAAC,eAAe,EAAE,oBAAoB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QAC/F,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,2EAA2E;QACpF,MAAM,EAAE,aAAa;KACtB,CAAC;AACJ,CAAC;AAED,8DAA8D;AAE9D,KAAK,UAAU,WAAW;IACxB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC,CAAC;IAEpF,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC5D,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAEzD,MAAM,GAAG,GAAG,wCAAwC,CAAC;IACrD,IAAI,CAAC;QACH,IAAI,UAAU,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC9B,YAAY,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,oBAAoB,GAAG,EAAE,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC,CAAC;IAC1E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC,CAAC;IAC1E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IACtC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAEhD,OAAO;QACL,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,8DAA8D;QACvE,MAAM,EAAE,QAAQ;KACjB,CAAC;AACJ,CAAC;AAED,8DAA8D;AAE9D,KAAK,UAAU,WAAW;IACxB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC,CAAC;IAExD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QACpF,YAAY,CAAC,OAAO,CAAC,CAAC;QAEtB,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAElC,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;YACjC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;YAEjC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,4BAA4B,UAAU,YAAY,CAAC,CAAC,CAAC;YAC7E,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;gBACpC,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,MAAM,KAAK,CAAC,CAAC,CAAC;YAC1D,CAAC;YAED,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;gBACrB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,kDAAkD,CAAC,CAAC,CAAC;gBAC9E,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,wEAAwE,CAAC,CACpF,CAAC;gBACF,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,uEAAuE,CAAC,CACnF,CAAC;gBACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC,CAAC;gBAC1F,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC,CAAC;YACrF,CAAC;YAED,OAAO;gBACL,QAAQ,EAAE,QAAQ;gBAClB,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,0BAA0B,UAAU,6BAA6B;gBAC1E,MAAM,EAAE,aAAa;aACtB,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC,CAAC;IAC1D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAEpD,OAAO;QACL,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,KAAK;QACd,OAAO,EACL,2GAA2G;QAC7G,MAAM,EAAE,aAAa;KACtB,CAAC;AACJ,CAAC;AAED,8DAA8D;AAE9D,KAAK,UAAU,WAAW;IACxB,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAClC,OAAO;YACL,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,gCAAgC;YACzC,MAAM,EAAE,SAAS;SAClB,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC,CAAC;IAC7F,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,sEAAsE,CAAC,CAAC,CAAC;IAE/F,OAAO;QACL,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,uDAAuD;QAChE,MAAM,EAAE,QAAQ;KACjB,CAAC;AACJ,CAAC;AAaD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,QAAiB,EAAE,UAA2B,EAAE;IAC7E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAE5C,2DAA2D;IAC3D,mEAAmE;IACnE,oEAAoE;IACpE,yCAAyC;IACzC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC,CAAC;YAC7D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;YAChD,wDAAwD;YACxD,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,uBAAuB,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,OAAO,gBAAgB,CAAC,CAAC,CAAC;QAE9D,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAC9B,mEAAmE;YACnE,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CAAC,sEAAsE,CAAC,CACrF,CAAC;YACF,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAC5F,CAAC;YACF,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,0EAA0E,CAAC,CACtF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,QAAyB,CAAC,CAAC;QACpE,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACzB,OAAO;IACT,CAAC;IAED,8CAA8C;IAC9C,MAAM,SAAS,GAAoE;QACjF;YACE,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,4CAA4C;YACnD,IAAI,EAAE,4BAA4B;SACnC;QACD,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,qCAAqC,EAAE,IAAI,EAAE,qBAAqB,EAAE;QAC5F,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,sCAAsC,EAAE,IAAI,EAAE,qBAAqB,EAAE;QAC/F,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,oCAAoC,EAAE,IAAI,EAAE,MAAM,EAAE;QAC7E,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,+BAA+B,EAAE,IAAI,EAAE,MAAM,EAAE;QACxE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,0BAA0B,EAAE,IAAI,EAAE,aAAa,EAAE;KAC3E,CAAC;IAEF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC,CAAC;IACjE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC,CAAC;IAC1D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,QAAuB;IACxD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,WAAW;YACd,OAAO,cAAc,EAAE,CAAC;QAC1B,KAAK,OAAO;YACV,OAAO,UAAU,EAAE,CAAC;QACtB,KAAK,SAAS;YACZ,OAAO,YAAY,EAAE,CAAC;QACxB,KAAK,QAAQ;YACX,OAAO,WAAW,EAAE,CAAC;QACvB,KAAK,QAAQ;YACX,OAAO,WAAW,EAAE,CAAC;QACvB,KAAK,QAAQ;YACX,OAAO,WAAW,EAAE,CAAC;QACvB;YACE,OAAO;gBACL,QAAQ;gBACR,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,qBAAqB,QAAQ,gEAAgE;gBACtG,MAAM,EAAE,MAAM;aACf,CAAC;IACN,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAmB;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,GAAG,IAAI,CAAC,CAAC;AACpC,CAAC"}

package/dist/auth/oauth-rotator.d.ts

@@ -0,0 +1,60 @@
+/**
+ * oauth-rotator.ts — H-K4 fix: proactive OAuth token rotation.
+ *
+ * Without proactive rotation, `refreshOAuthToken` only fires on a stream
+ * mid-flight 401 — the user sees a query stall while the refresh races
+ * the request. This module sweeps the credential pool on a fixed interval,
+ * refreshing any token whose `expiresAt` is within `WINDOW_MS` of now so
+ * the next request always lands on a fresh credential.
+ *
+ * Designed dependency-injection-style so the credential pool implementation
+ * stays decoupled from this rotator. Wire from a composition root (typically
+ * kairos.ts after credential pool init) by calling `startOAuthRotator(...)`.
+ *
+ * Honest fallbacks (QB#6):
+ *   - Unknown / malformed expiresAt → skip (don't crash the sweep loop)
+ *   - Refresh throws → log and continue with the next entry
+ *   - Empty credential pool → no-op tick, never errors
+ */
+export interface RotatableCredential {
+    readonly id: string;
+    readonly provider: string;
+    readonly refreshToken: string;
+    /** ms-since-epoch when the access token expires. */
+    readonly expiresAt: number;
+}
+export interface OAuthRotatorOptions {
+    /**
+     * How often to sweep (ms). Default 60_000 (one minute).
+     * Tighter intervals catch shorter expiry windows; looser intervals reduce
+     * background-CPU on idle daemons.
+     */
+    readonly sweepIntervalMs?: number;
+    /**
+     * Refresh any token whose expiresAt is within this many ms of now.
+     * Default 300_000 (5 minutes per H-K4 audit recommendation).
+     */
+    readonly windowMs?: number;
+    /**
+     * Enumerate all known credentials. The rotator filters for those nearing
+     * expiry — callers don't need to pre-filter.
+     */
+    readonly listCredentials: () => readonly RotatableCredential[] | Promise<readonly RotatableCredential[]>;
+    /**
+     * Refresh a single credential. Should call refreshOAuthToken under the
+     * hood and persist the new token + expiresAt back into the credential pool.
+     */
+    readonly refresh: (cred: RotatableCredential) => Promise<void>;
+    /**
+     * Optional logger. Default: silent.
+     */
+    readonly log?: (level: "info" | "warn" | "error", msg: string) => void;
+}
+export interface OAuthRotatorHandle {
+    /** Stop the sweep loop. Idempotent. */
+    readonly stop: () => void;
+    /** Trigger a sweep immediately (in addition to the periodic loop). */
+    readonly sweepNow: () => Promise<void>;
+}
+export declare function startOAuthRotator(opts: OAuthRotatorOptions): OAuthRotatorHandle;
+//# sourceMappingURL=oauth-rotator.d.ts.map

package/dist/auth/oauth-rotator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-rotator.d.ts","sourceRoot":"","sources":["../../src/auth/oauth-rotator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,oDAAoD;IACpD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,eAAe,EAAE,MACtB,SAAS,mBAAmB,EAAE,GAC9B,OAAO,CAAC,SAAS,mBAAmB,EAAE,CAAC,CAAC;IAC5C;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,mBAAmB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D;;OAEG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACxE;AAED,MAAM,WAAW,kBAAkB;IACjC,uCAAuC;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC;AAKD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,mBAAmB,GAAG,kBAAkB,CAmD/E"}

package/dist/auth/oauth-rotator.js

@@ -0,0 +1,71 @@
+/**
+ * oauth-rotator.ts — H-K4 fix: proactive OAuth token rotation.
+ *
+ * Without proactive rotation, `refreshOAuthToken` only fires on a stream
+ * mid-flight 401 — the user sees a query stall while the refresh races
+ * the request. This module sweeps the credential pool on a fixed interval,
+ * refreshing any token whose `expiresAt` is within `WINDOW_MS` of now so
+ * the next request always lands on a fresh credential.
+ *
+ * Designed dependency-injection-style so the credential pool implementation
+ * stays decoupled from this rotator. Wire from a composition root (typically
+ * kairos.ts after credential pool init) by calling `startOAuthRotator(...)`.
+ *
+ * Honest fallbacks (QB#6):
+ *   - Unknown / malformed expiresAt → skip (don't crash the sweep loop)
+ *   - Refresh throws → log and continue with the next entry
+ *   - Empty credential pool → no-op tick, never errors
+ */
+const DEFAULT_SWEEP_MS = 60_000;
+const DEFAULT_WINDOW_MS = 5 * 60_000;
+export function startOAuthRotator(opts) {
+    const sweepIntervalMs = opts.sweepIntervalMs ?? DEFAULT_SWEEP_MS;
+    const windowMs = opts.windowMs ?? DEFAULT_WINDOW_MS;
+    const log = opts.log ?? (() => { });
+    let stopped = false;
+    async function sweepOnce() {
+        if (stopped)
+            return;
+        let creds;
+        try {
+            creds = await opts.listCredentials();
+        }
+        catch (err) {
+            log("error", `oauth-rotator: listCredentials failed — ${err.message}`);
+            return;
+        }
+        const now = Date.now();
+        const due = creds.filter((c) => {
+            if (typeof c.expiresAt !== "number" || !Number.isFinite(c.expiresAt))
+                return false;
+            return c.expiresAt - now <= windowMs;
+        });
+        if (due.length === 0)
+            return;
+        log("info", `oauth-rotator: refreshing ${due.length} credential(s) nearing expiry`);
+        for (const cred of due) {
+            try {
+                await opts.refresh(cred);
+            }
+            catch (err) {
+                log("warn", `oauth-rotator: refresh failed for ${cred.provider}/${cred.id} — ${err.message}`);
+            }
+        }
+    }
+    // Run the first sweep immediately so a freshly-started daemon doesn't wait
+    // the full sweep interval before catching an already-expiring token.
+    void sweepOnce();
+    const handle = setInterval(() => {
+        void sweepOnce();
+    }, sweepIntervalMs);
+    // unref so the timer doesn't keep the process alive on shutdown.
+    handle.unref();
+    return {
+        stop: () => {
+            stopped = true;
+            clearInterval(handle);
+        },
+        sweepNow: () => sweepOnce(),
+    };
+}
+//# sourceMappingURL=oauth-rotator.js.map