/**
 * Task 576 — auth-snapshot.
 *
 * Read-only, no-dependency snapshot of the OAuth credentials file used
 * by the http-server spawn-failure path to surface `reason=auth-refresh-failed`
 * to the operator instead of the generic `pid-file-timeout`. Lives in
 * claude-session-manager so the failure path stays in one tree; the
 * authoritative refresh + lock logic continues to live in
 * `platform/ui/app/lib/claude-auth.ts`.
 *
 * Returns one of:
 *  - `dead`    — token expired AND no refresh token available
 *  - `expired` — token expired but a refresh token is on disk
 *  - `unknown` — token still valid, or the file is missing / unreadable
 *                (not auth's fault — let the original failure reason stand)
 */
import { readFileSync } from 'node:fs';
import { resolve } from 'node:path';
export function credentialsPathForConfigDir(claudeConfigDir) {
    return resolve(claudeConfigDir, '.credentials.json');
}
export function snapshotAuthForFailureReason(credentialsPath) {
    if (!credentialsPath)
        return 'unknown';
    let raw;
    try {
        raw = readFileSync(credentialsPath, 'utf-8');
    }
    catch {
        return 'unknown';
    }
    let parsed;
    try {
        parsed = JSON.parse(raw);
    }
    catch {
        return 'unknown';
    }
    const oauth = parsed.claudeAiOauth;
    if (!oauth || typeof oauth !== 'object')
        return 'unknown';
    const expiresAt = oauth.expiresAt;
    if (typeof expiresAt !== 'number' || !Number.isFinite(expiresAt))
        return 'unknown';
    if (expiresAt > Date.now())
        return 'unknown'; // not the auth path's fault
    const refreshToken = oauth.refreshToken;
    return typeof refreshToken === 'string' && refreshToken.length > 0 ? 'expired' : 'dead';
}
//# sourceMappingURL=auth-snapshot.js.map