# Changelog

## [Unreleased]

Changes yet to be released are documented here.

## v0.1.3

- Improve `status` for server use by detecting service-account mode from config
- Detect whether the current token is a service-account token and validate it matches configured `client_id`
- Add explicit `status` health states for service-account mode (`OK`, `WARNING`, `EXPIRED`)
- Make `status` exit non-zero for `WARNING` and `EXPIRED` states
- Add unit tests for status mode/token detection helpers

## v0.1.2

- Fix path expansion when running in systemd
- Fix bug in netrc writing
- Add nixos, home-manager, and darwin-nix modules

## v0.1.0

Initial release.

- `login` — browser-based Authorization Code + PKCE flow
- `refresh` — refresh access token using stored refresh token
- `service-account` — headless client credentials flow for servers
- `status` — decode JWT from netrc, show expiry info
- `logout` — revoke tokens and clean up netrc
- TOML config with environment variable expansion
- netrc read/write preserving other entries
- Nix flake with package, app, checks, and devShell