@danj/audible-auth

@danj/audible-auth — agent notes

This package is the only code that handles Audible credentials. It is publish-locked: a push waits for the owner's Promote this commit click. What it offers callers, and its security posture, live in README.md.

Rules

• Handle secrets as packageSecrets.get placeholders only. Return, log, and throw nothing but metadata: no token, key, refresh response, Audible error body, or maplanding URL.
• src/policy.ts is the allowlist of Audible calls. Adding a call is a security change: name it in the commit subject so the owner sees it in review.
• Keep ARCHIVE_ENABLED false until the owner asks for NAS archive.
• Send the bearer token with no client-id header; Audible rejects this device's token when one is present.
• After each promote, republish the packages that use this one: each bundles a snapshot of it. Then run communityPublish for this package, so its public listing moves to the promoted commit.
• In the README, link only to absolute URLs outside Kody user scopes. Kody's renderer shows links to relative targets and to /@… or /packages/… paths as plain text, so name packages and files in code instead.
• Connect lives only in this package's app (src/app.ts). Login URLs and maplanding URLs never cross an export.

Smoke test

./status returns ready: true, then one call: audibleRequest({ path: '/1.0/library', query: { num_results: 1 } }).

Local checks

npm test and npm run typecheck (TypeScript 7, Node 26).