/** * Tiny desktop-main copy of the local bearer-token file contract. * * Keep this module free of @executor-js/local imports. The Electron main * process only needs to mint/read/rotate auth.json so it can pass the bearer * to the sidecar and inject it into the renderer session; importing the local * server package here drags the whole server/native LibSQL graph into app.asar. */import { randomBytes } from "node:crypto";import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";import { homedir } from "node:os";import { join, resolve } from "node:path"; const resolveExecutorDataDir = (): string =>  resolve(process.env.EXECUTOR_DATA_DIR ?? join(homedir(), ".executor")); const serverControlDir = (dataDir: string): string => join(dataDir, "server-control"); const localAuthTokenPath = (dataDir: string = resolveExecutorDataDir()): string =>  join(serverControlDir(dataDir), "auth.json"); const mintToken = (): string => randomBytes(32).toString("base64url"); const readToken = (path: string): string | null => {  // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: optional on-disk secret may be absent or malformed  try {    // oxlint-disable-next-line executor/no-json-parse -- boundary: auth.json is a tiny local boot secret outside the Effect graph    const parsed = JSON.parse(readFileSync(path, "utf8")) as { readonly token?: unknown };    return typeof parsed.token === "string" && parsed.token.length > 0 ? parsed.token : null;  } catch {    return null;  }}; const writeToken = (dataDir: string, token: string): string => {  const dir = serverControlDir(dataDir);  mkdirSync(dir, { recursive: true });  const path = join(dir, "auth.json");  writeFileSync(path, `${JSON.stringify({ token }, null, 2)}\n`, { mode: 0o600 });  chmodSync(path, 0o600);  return token;}; export const loadOrMintLocalAuthToken = (dataDir: string = resolveExecutorDataDir()): string =>  readToken(localAuthTokenPath(dataDir)) ?? writeToken(dataDir, mintToken()); export const rotateLocalAuthToken = (dataDir: string = resolveExecutorDataDir()): string =>  writeToken(dataDir, mintToken());