@bubltec/mycota-tokens 0.2.0

package/dist/encrypted.store.d.ts

@@ -0,0 +1,17 @@
+import type { SecretBox, TokenRecord, TokenStore } from './ports.js';
+/**
+ * Encrypts `tokens` at rest. Metadata (provider, subject, health) stays
+ * plaintext so Connections can list `needs_reauth` without opening the box.
+ */
+export declare class EncryptedTokenStore implements TokenStore {
+    private readonly inner;
+    private readonly box;
+    constructor(inner: TokenStore, box: SecretBox);
+    get(provider: string, subjectId: string): Promise<TokenRecord | undefined>;
+    put(record: TokenRecord): Promise<void>;
+    delete(provider: string, subjectId: string): Promise<void>;
+    listByProvider(provider: string): Promise<TokenRecord[]>;
+    private seal;
+    private open;
+}
+//# sourceMappingURL=encrypted.store.d.ts.map

package/dist/encrypted.store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted.store.d.ts","sourceRoot":"","sources":["../src/encrypted.store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAKrE;;;GAGG;AACH,qBAAa,mBAAoB,YAAW,UAAU;IAElD,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBADH,KAAK,EAAE,UAAU,EACjB,GAAG,EAAE,SAAS;IAG3B,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAM1E,GAAG,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1D,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;YAKhD,IAAI;YAKJ,IAAI;CAInB"}

package/dist/encrypted.store.js

@@ -0,0 +1,39 @@
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+/**
+ * Encrypts `tokens` at rest. Metadata (provider, subject, health) stays
+ * plaintext so Connections can list `needs_reauth` without opening the box.
+ */
+export class EncryptedTokenStore {
+    inner;
+    box;
+    constructor(inner, box) {
+        this.inner = inner;
+        this.box = box;
+    }
+    async get(provider, subjectId) {
+        const record = await this.inner.get(provider, subjectId);
+        if (!record)
+            return undefined;
+        return this.open(record);
+    }
+    async put(record) {
+        await this.inner.put(await this.seal(record));
+    }
+    async delete(provider, subjectId) {
+        await this.inner.delete(provider, subjectId);
+    }
+    async listByProvider(provider) {
+        const records = await this.inner.listByProvider(provider);
+        return Promise.all(records.map((record) => this.open(record)));
+    }
+    async seal(record) {
+        const sealed = await this.box.seal(encoder.encode(JSON.stringify(record.tokens)));
+        return { ...record, tokens: { accessToken: Buffer.from(sealed).toString('base64') } };
+    }
+    async open(record) {
+        const opened = await this.box.open(Buffer.from(record.tokens.accessToken, 'base64'));
+        return { ...record, tokens: JSON.parse(decoder.decode(opened)) };
+    }
+}
+//# sourceMappingURL=encrypted.store.js.map

package/dist/encrypted.store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted.store.js","sourceRoot":"","sources":["../src/encrypted.store.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC;;;GAGG;AACH,MAAM,OAAO,mBAAmB;IAEX;IACA;IAFnB,YACmB,KAAiB,EACjB,GAAc;QADd,UAAK,GAAL,KAAK,CAAY;QACjB,QAAG,GAAH,GAAG,CAAW;IAC9B,CAAC;IAEJ,KAAK,CAAC,GAAG,CAAC,QAAgB,EAAE,SAAiB;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAAmB;QAC3B,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,SAAiB;QAC9C,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB;QACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC1D,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,MAAmB;QACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAClF,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;IACxF,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,MAAmB;QACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;QACrF,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAA0B,EAAE,CAAC;IAC5F,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export type { AccessTokenResult, SecretBox, TokenHealth, TokenRecord, TokenRefresher, TokenSet, TokenStore, } from './ports.js';
+export { MemoryTokenStore } from './memory.store.js';
+export { AesGcmSecretBox, PlainSecretBox } from './secret-box.js';
+export { EncryptedTokenStore } from './encrypted.store.js';
+export { ReauthRequiredError, TokenVault, type TokenVaultOptions } from './vault.js';
+export { metaTokenRefresher, tiktokTokenRefresher, xTokenRefresher, type FetchLike, type OAuthAppConfig, } from './oauth-refresh.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,iBAAiB,EACjB,SAAS,EACT,WAAW,EACX,WAAW,EACX,cAAc,EACd,QAAQ,EACR,UAAU,GACX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACrF,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,KAAK,SAAS,EACd,KAAK,cAAc,GACpB,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -0,0 +1,6 @@
+export { MemoryTokenStore } from './memory.store.js';
+export { AesGcmSecretBox, PlainSecretBox } from './secret-box.js';
+export { EncryptedTokenStore } from './encrypted.store.js';
+export { ReauthRequiredError, TokenVault } from './vault.js';
+export { metaTokenRefresher, tiktokTokenRefresher, xTokenRefresher, } from './oauth-refresh.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAA0B,MAAM,YAAY,CAAC;AACrF,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,GAGhB,MAAM,oBAAoB,CAAC"}

package/dist/memory.store.d.ts

@@ -0,0 +1,9 @@
+import type { TokenRecord, TokenStore } from './ports.js';
+export declare class MemoryTokenStore implements TokenStore {
+    private readonly records;
+    get(provider: string, subjectId: string): Promise<TokenRecord | undefined>;
+    put(record: TokenRecord): Promise<void>;
+    delete(provider: string, subjectId: string): Promise<void>;
+    listByProvider(provider: string): Promise<TokenRecord[]>;
+}
+//# sourceMappingURL=memory.store.d.ts.map

package/dist/memory.store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.store.d.ts","sourceRoot":"","sources":["../src/memory.store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAM1D,qBAAa,gBAAiB,YAAW,UAAU;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;IAEpD,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAK1E,GAAG,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1D,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;CAK/D"}

package/dist/memory.store.js

@@ -0,0 +1,22 @@
+function key(provider, subjectId) {
+    return `${provider}:${subjectId}`;
+}
+export class MemoryTokenStore {
+    records = new Map();
+    async get(provider, subjectId) {
+        const record = this.records.get(key(provider, subjectId));
+        return record ? structuredClone(record) : undefined;
+    }
+    async put(record) {
+        this.records.set(key(record.provider, record.subjectId), structuredClone(record));
+    }
+    async delete(provider, subjectId) {
+        this.records.delete(key(provider, subjectId));
+    }
+    async listByProvider(provider) {
+        return [...this.records.values()]
+            .filter((record) => record.provider === provider)
+            .map((record) => structuredClone(record));
+    }
+}
+//# sourceMappingURL=memory.store.js.map

package/dist/memory.store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.store.js","sourceRoot":"","sources":["../src/memory.store.ts"],"names":[],"mappings":"AAEA,SAAS,GAAG,CAAC,QAAgB,EAAE,SAAiB;IAC9C,OAAO,GAAG,QAAQ,IAAI,SAAS,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,OAAO,gBAAgB;IACV,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE1D,KAAK,CAAC,GAAG,CAAC,QAAgB,EAAE,SAAiB;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1D,OAAO,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAAmB;QAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IACpF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,SAAiB;QAC9C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB;QACnC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;aAC9B,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;aAChD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9C,CAAC;CACF"}

package/dist/oauth-refresh.d.ts

@@ -0,0 +1,19 @@
+import type { TokenRefresher } from './ports.js';
+export type FetchLike = (url: string, init?: RequestInit) => Promise<Response>;
+export interface OAuthAppConfig {
+    clientId: string;
+    clientSecret: string;
+}
+export declare function metaTokenRefresher(config: OAuthAppConfig, options?: {
+    fetch?: FetchLike;
+    graphBaseUrl?: string;
+}): TokenRefresher;
+export declare function tiktokTokenRefresher(config: OAuthAppConfig, options?: {
+    fetch?: FetchLike;
+    tokenUrl?: string;
+}): TokenRefresher;
+export declare function xTokenRefresher(config: OAuthAppConfig, options?: {
+    fetch?: FetchLike;
+    tokenUrl?: string;
+}): TokenRefresher;
+//# sourceMappingURL=oauth-refresh.d.ts.map

package/dist/oauth-refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-refresh.d.ts","sourceRoot":"","sources":["../src/oauth-refresh.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAY,MAAM,YAAY,CAAC;AAE3D,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE/E,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAmBD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,SAAS,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAO,GACzD,cAAc,CAmBhB;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GACrD,cAAc,CA0BhB;AAED,wBAAgB,eAAe,CAC7B,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GACrD,cAAc,CA2BhB"}

package/dist/oauth-refresh.js

@@ -0,0 +1,89 @@
+async function readJson(response) {
+    const text = await response.text();
+    if (!response.ok)
+        throw new Error(`oauth ${response.status}: ${text}`);
+    return JSON.parse(text);
+}
+function requireRefreshToken(tokens) {
+    if (!tokens.refreshToken)
+        throw new Error('refresh token missing');
+    return tokens.refreshToken;
+}
+function expiryFromExpiresIn(expiresIn) {
+    const seconds = Number(expiresIn);
+    if (!Number.isFinite(seconds) || seconds <= 0)
+        return undefined;
+    return new Date(Date.now() + seconds * 1000).toISOString();
+}
+export function metaTokenRefresher(config, options = {}) {
+    const fetchFn = options.fetch ?? globalThis.fetch.bind(globalThis);
+    const base = options.graphBaseUrl ?? 'https://graph.facebook.com/v22.0';
+    return {
+        async refresh(tokens) {
+            const params = new URLSearchParams({
+                grant_type: 'fb_exchange_token',
+                client_id: config.clientId,
+                client_secret: config.clientSecret,
+                fb_exchange_token: tokens.accessToken,
+            });
+            const body = await readJson(await fetchFn(`${base}/oauth/access_token?${params}`));
+            return {
+                accessToken: String(body.access_token ?? ''),
+                refreshToken: tokens.refreshToken,
+                expiresAt: expiryFromExpiresIn(body.expires_in),
+            };
+        },
+    };
+}
+export function tiktokTokenRefresher(config, options = {}) {
+    const fetchFn = options.fetch ?? globalThis.fetch.bind(globalThis);
+    const tokenUrl = options.tokenUrl ?? 'https://open.tiktokapis.com/v2/oauth/token/';
+    return {
+        async refresh(tokens) {
+            const refreshToken = requireRefreshToken(tokens);
+            const body = await readJson(await fetchFn(tokenUrl, {
+                method: 'POST',
+                headers: { 'content-type': 'application/x-www-form-urlencoded' },
+                body: new URLSearchParams({
+                    client_key: config.clientId,
+                    client_secret: config.clientSecret,
+                    grant_type: 'refresh_token',
+                    refresh_token: refreshToken,
+                }),
+            }));
+            const data = body.data ?? body;
+            return {
+                accessToken: String(data.access_token ?? ''),
+                refreshToken: String(data.refresh_token ?? refreshToken),
+                expiresAt: expiryFromExpiresIn(data.expires_in),
+            };
+        },
+    };
+}
+export function xTokenRefresher(config, options = {}) {
+    const fetchFn = options.fetch ?? globalThis.fetch.bind(globalThis);
+    const tokenUrl = options.tokenUrl ?? 'https://api.x.com/2/oauth2/token';
+    const basic = Buffer.from(`${config.clientId}:${config.clientSecret}`).toString('base64');
+    return {
+        async refresh(tokens) {
+            const refreshToken = requireRefreshToken(tokens);
+            const body = await readJson(await fetchFn(tokenUrl, {
+                method: 'POST',
+                headers: {
+                    authorization: `Basic ${basic}`,
+                    'content-type': 'application/x-www-form-urlencoded',
+                },
+                body: new URLSearchParams({
+                    grant_type: 'refresh_token',
+                    refresh_token: refreshToken,
+                }),
+            }));
+            return {
+                accessToken: String(body.access_token ?? ''),
+                refreshToken: String(body.refresh_token ?? refreshToken),
+                expiresAt: expiryFromExpiresIn(body.expires_in),
+            };
+        },
+    };
+}
+//# sourceMappingURL=oauth-refresh.js.map

package/dist/oauth-refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-refresh.js","sourceRoot":"","sources":["../src/oauth-refresh.ts"],"names":[],"mappings":"AASA,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACxC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,QAAQ,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;AACrD,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAgB;IAC3C,IAAI,CAAC,MAAM,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,YAAY,CAAC;AAC7B,CAAC;AAED,SAAS,mBAAmB,CAAC,SAAkB;IAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAChE,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,MAAsB,EACtB,UAAwD,EAAE;IAE1D,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,IAAI,kCAAkC,CAAC;IACxE,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,MAAgB;YAC5B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;gBACjC,UAAU,EAAE,mBAAmB;gBAC/B,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;gBAClC,iBAAiB,EAAE,MAAM,CAAC,WAAW;aACtC,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,OAAO,CAAC,GAAG,IAAI,uBAAuB,MAAM,EAAE,CAAC,CAAC,CAAC;YACnF,OAAO;gBACL,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;gBAC5C,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,SAAS,EAAE,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC;aAChD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,MAAsB,EACtB,UAAoD,EAAE;IAEtD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,6CAA6C,CAAC;IACnF,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,MAAgB;YAC5B,MAAM,YAAY,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,MAAM,OAAO,CAAC,QAAQ,EAAE;gBACtB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,UAAU,EAAE,MAAM,CAAC,QAAQ;oBAC3B,aAAa,EAAE,MAAM,CAAC,YAAY;oBAClC,UAAU,EAAE,eAAe;oBAC3B,aAAa,EAAE,YAAY;iBAC5B,CAAC;aACH,CAAC,CACH,CAAC;YACF,MAAM,IAAI,GAAI,IAAI,CAAC,IAA4C,IAAI,IAAI,CAAC;YACxE,OAAO;gBACL,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;gBAC5C,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,YAAY,CAAC;gBACxD,SAAS,EAAE,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC;aAChD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,MAAsB,EACtB,UAAoD,EAAE;IAEtD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,kCAAkC,CAAC;IACxE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC1F,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,MAAgB;YAC5B,MAAM,YAAY,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,MAAM,OAAO,CAAC,QAAQ,EAAE;gBACtB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,SAAS,KAAK,EAAE;oBAC/B,cAAc,EAAE,mCAAmC;iBACpD;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,UAAU,EAAE,eAAe;oBAC3B,aAAa,EAAE,YAAY;iBAC5B,CAAC;aACH,CAAC,CACH,CAAC;YACF,OAAO;gBACL,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;gBAC5C,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,YAAY,CAAC;gBACxD,SAAS,EAAE,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC;aAChD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/ports.d.ts

@@ -0,0 +1,33 @@
+export type TokenHealth = 'ok' | 'needs_reauth' | 'degraded';
+export interface TokenSet {
+    accessToken: string;
+    refreshToken?: string;
+    expiresAt?: string;
+}
+export interface TokenRecord {
+    provider: string;
+    subjectId: string;
+    displayName?: string;
+    tokens: TokenSet;
+    health: TokenHealth;
+    updatedAt: string;
+}
+export interface TokenStore {
+    get(provider: string, subjectId: string): Promise<TokenRecord | undefined>;
+    put(record: TokenRecord): Promise<void>;
+    delete(provider: string, subjectId: string): Promise<void>;
+    listByProvider(provider: string): Promise<TokenRecord[]>;
+}
+export interface TokenRefresher {
+    refresh(tokens: TokenSet): Promise<TokenSet>;
+}
+export interface SecretBox {
+    seal(plaintext: Uint8Array): Promise<Uint8Array>;
+    open(ciphertext: Uint8Array): Promise<Uint8Array>;
+}
+export interface AccessTokenResult {
+    accessToken: string;
+    health: TokenHealth;
+    record: TokenRecord;
+}
+//# sourceMappingURL=ports.d.ts.map

package/dist/ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.d.ts","sourceRoot":"","sources":["../src/ports.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,WAAW,GAAG,IAAI,GAAG,cAAc,GAAG,UAAU,CAAC;AAE7D,MAAM,WAAW,QAAQ;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,QAAQ,CAAC;IACjB,MAAM,EAAE,WAAW,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IAC3E,GAAG,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,WAAW,CAAC;CACrB"}

package/dist/ports.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../src/ports.ts"],"names":[],"mappings":""}

package/dist/secret-box.d.ts

@@ -0,0 +1,17 @@
+import type { SecretBox } from './ports.js';
+/**
+ * AES-256-GCM. Ciphertext is iv (12) + tag (16) + ciphertext. The consuming
+ * app supplies the 32-byte key from SSM — this package does not read env.
+ */
+export declare class AesGcmSecretBox implements SecretBox {
+    private readonly key;
+    constructor(key: Uint8Array);
+    seal(plaintext: Uint8Array): Promise<Uint8Array>;
+    open(ciphertext: Uint8Array): Promise<Uint8Array>;
+}
+/** Identity box for tests. Not for production. */
+export declare class PlainSecretBox implements SecretBox {
+    seal(plaintext: Uint8Array): Promise<Uint8Array>;
+    open(ciphertext: Uint8Array): Promise<Uint8Array>;
+}
+//# sourceMappingURL=secret-box.d.ts.map

package/dist/secret-box.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-box.d.ts","sourceRoot":"","sources":["../src/secret-box.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C;;;GAGG;AACH,qBAAa,eAAgB,YAAW,SAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,UAAU;IAItC,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAQhD,IAAI,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;CASxD;AAED,kDAAkD;AAClD,qBAAa,cAAe,YAAW,SAAS;IACxC,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAIhD,IAAI,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;CAGxD"}

package/dist/secret-box.js

@@ -0,0 +1,39 @@
+import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
+/**
+ * AES-256-GCM. Ciphertext is iv (12) + tag (16) + ciphertext. The consuming
+ * app supplies the 32-byte key from SSM — this package does not read env.
+ */
+export class AesGcmSecretBox {
+    key;
+    constructor(key) {
+        this.key = key;
+        if (key.byteLength !== 32)
+            throw new Error('AES-256-GCM key must be 32 bytes');
+    }
+    async seal(plaintext) {
+        const iv = randomBytes(12);
+        const cipher = createCipheriv('aes-256-gcm', this.key, iv);
+        const encrypted = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        return Buffer.concat([iv, tag, encrypted]);
+    }
+    async open(ciphertext) {
+        const buf = Buffer.from(ciphertext);
+        const iv = buf.subarray(0, 12);
+        const tag = buf.subarray(12, 28);
+        const encrypted = buf.subarray(28);
+        const decipher = createDecipheriv('aes-256-gcm', this.key, iv);
+        decipher.setAuthTag(tag);
+        return Buffer.concat([decipher.update(encrypted), decipher.final()]);
+    }
+}
+/** Identity box for tests. Not for production. */
+export class PlainSecretBox {
+    async seal(plaintext) {
+        return plaintext;
+    }
+    async open(ciphertext) {
+        return ciphertext;
+    }
+}
+//# sourceMappingURL=secret-box.js.map

package/dist/secret-box.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-box.js","sourceRoot":"","sources":["../src/secret-box.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG5E;;;GAGG;AACH,MAAM,OAAO,eAAe;IACG;IAA7B,YAA6B,GAAe;QAAf,QAAG,GAAH,GAAG,CAAY;QAC1C,IAAI,GAAG,CAAC,UAAU,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACjF,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,SAAqB;QAC9B,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,UAAsB;QAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpC,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC/D,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;CACF;AAED,kDAAkD;AAClD,MAAM,OAAO,cAAc;IACzB,KAAK,CAAC,IAAI,CAAC,SAAqB;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,UAAsB;QAC/B,OAAO,UAAU,CAAC;IACpB,CAAC;CACF"}

package/dist/tokens.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=tokens.spec.d.ts.map

package/dist/tokens.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.spec.d.ts","sourceRoot":"","sources":["../src/tokens.spec.ts"],"names":[],"mappings":""}

package/dist/tokens.spec.js

@@ -0,0 +1,86 @@
+import { describe, expect, it, vi } from 'vitest';
+import { EncryptedTokenStore } from './encrypted.store.js';
+import { MemoryTokenStore } from './memory.store.js';
+import { tiktokTokenRefresher } from './oauth-refresh.js';
+import { AesGcmSecretBox, PlainSecretBox } from './secret-box.js';
+import { ReauthRequiredError, TokenVault } from './vault.js';
+describe('TokenVault', () => {
+    it('refreshes before expiry and stores the new access token', async () => {
+        const store = new MemoryTokenStore();
+        const refresher = { refresh: vi.fn(async () => ({ accessToken: 'new', refreshToken: 'r2', expiresAt: '2026-09-02T00:00:00.000Z' })) };
+        const vault = new TokenVault({
+            store,
+            refreshers: { tiktok: refresher },
+            clock: () => new Date('2026-09-01T00:00:00.000Z'),
+            refreshSkewMs: 60_000,
+        });
+        await vault.put({
+            provider: 'tiktok',
+            subjectId: 'acct_1',
+            tokens: {
+                accessToken: 'old',
+                refreshToken: 'r1',
+                expiresAt: '2026-09-01T00:00:30.000Z',
+            },
+        });
+        const result = await vault.accessToken('tiktok', 'acct_1');
+        expect(result.accessToken).toBe('new');
+        expect(refresher.refresh).toHaveBeenCalled();
+    });
+    it('marks needs_reauth when refresh fails', async () => {
+        const store = new MemoryTokenStore();
+        const vault = new TokenVault({
+            store,
+            refreshers: {
+                instagram: { refresh: async () => { throw new Error('invalid_grant'); } },
+            },
+            clock: () => new Date('2026-09-01T00:00:00.000Z'),
+        });
+        await vault.put({
+            provider: 'instagram',
+            subjectId: 'ig_1',
+            tokens: { accessToken: 'old', refreshToken: 'r', expiresAt: '2026-09-01T00:00:00.000Z' },
+        });
+        await expect(vault.accessToken('instagram', 'ig_1')).rejects.toBeInstanceOf(ReauthRequiredError);
+        expect((await vault.get('instagram', 'ig_1'))?.health).toBe('needs_reauth');
+    });
+});
+describe('EncryptedTokenStore', () => {
+    it('round-trips through AES-GCM without leaving the raw access token in the inner store', async () => {
+        const inner = new MemoryTokenStore();
+        const key = new Uint8Array(32).fill(7);
+        const store = new EncryptedTokenStore(inner, new AesGcmSecretBox(key));
+        await store.put({
+            provider: 'x',
+            subjectId: 'acct_x',
+            tokens: { accessToken: 'secret-token', refreshToken: 'rt' },
+            health: 'ok',
+            updatedAt: '2026-09-01T00:00:00.000Z',
+        });
+        const raw = await inner.get('x', 'acct_x');
+        expect(raw?.tokens.accessToken).not.toBe('secret-token');
+        expect((await store.get('x', 'acct_x'))?.tokens.accessToken).toBe('secret-token');
+    });
+    it('plain box is identity (tests only)', async () => {
+        const store = new EncryptedTokenStore(new MemoryTokenStore(), new PlainSecretBox());
+        await store.put({
+            provider: 'facebook',
+            subjectId: 'p1',
+            tokens: { accessToken: 'a' },
+            health: 'ok',
+            updatedAt: '2026-09-01T00:00:00.000Z',
+        });
+        expect((await store.get('facebook', 'p1'))?.tokens.accessToken).toBe('a');
+    });
+});
+describe('tiktokTokenRefresher', () => {
+    it('posts refresh_token and maps expires_in', async () => {
+        const fetchFn = vi.fn(async () => new Response(JSON.stringify({ access_token: 'n', refresh_token: 'nr', expires_in: 3600 }), { status: 200 }));
+        const refresher = tiktokTokenRefresher({ clientId: 'id', clientSecret: 'sec' }, { fetch: fetchFn });
+        const next = await refresher.refresh({ accessToken: 'old', refreshToken: 'r' });
+        expect(next.accessToken).toBe('n');
+        expect(next.refreshToken).toBe('nr');
+        expect(fetchFn).toHaveBeenCalled();
+    });
+});
+//# sourceMappingURL=tokens.spec.js.map

package/dist/tokens.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.spec.js","sourceRoot":"","sources":["../src/tokens.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7D,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,KAAK,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,0BAA0B,EAAE,CAAC,CAAC,EAAE,CAAC;QACtI,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC;YAC3B,KAAK;YACL,UAAU,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;YACjC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,CAAC,0BAA0B,CAAC;YACjD,aAAa,EAAE,MAAM;SACtB,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,CAAC;YACd,QAAQ,EAAE,QAAQ;YAClB,SAAS,EAAE,QAAQ;YACnB,MAAM,EAAE;gBACN,WAAW,EAAE,KAAK;gBAClB,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,0BAA0B;aACtC;SACF,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,KAAK,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC;YAC3B,KAAK;YACL,UAAU,EAAE;gBACV,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE;aAC1E;YACD,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,CAAC,0BAA0B,CAAC;SAClD,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,CAAC;YACd,QAAQ,EAAE,WAAW;YACrB,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,SAAS,EAAE,0BAA0B,EAAE;SACzF,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;QACjG,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;QACnG,MAAM,KAAK,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,IAAI,mBAAmB,CAAC,KAAK,EAAE,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;QACvE,MAAM,KAAK,CAAC,GAAG,CAAC;YACd,QAAQ,EAAE,GAAG;YACb,SAAS,EAAE,QAAQ;YACnB,MAAM,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,IAAI,EAAE;YAC3D,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,0BAA0B;SACtC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACzD,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,KAAK,GAAG,IAAI,mBAAmB,CAAC,IAAI,gBAAgB,EAAE,EAAE,IAAI,cAAc,EAAE,CAAC,CAAC;QACpF,MAAM,KAAK,CAAC,GAAG,CAAC;YACd,QAAQ,EAAE,UAAU;YACpB,SAAS,EAAE,IAAI;YACf,MAAM,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE;YAC5B,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,0BAA0B;SACtC,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAC/B,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAC5G,CAAC;QACF,MAAM,SAAS,GAAG,oBAAoB,CACpC,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,EACvC,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;QAChF,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,CAAC,OAAO,CAAC,CAAC,gBAAgB,EAAE,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/vault.d.ts

@@ -0,0 +1,40 @@
+import type { AccessTokenResult, TokenRecord, TokenRefresher, TokenSet, TokenStore } from './ports.js';
+export interface TokenVaultOptions {
+    store: TokenStore;
+    refreshers?: Record<string, TokenRefresher>;
+    clock?: () => Date;
+    /** Refresh this many ms before `expiresAt`. Default 60s. */
+    refreshSkewMs?: number;
+}
+/**
+ * Stores OAuth tokens, refreshes them before expiry, and marks
+ * `needs_reauth` when refresh fails — the Zoho/Buffer silent-drop counter.
+ */
+export declare class TokenVault {
+    private readonly options;
+    constructor(options: TokenVaultOptions);
+    put(input: {
+        provider: string;
+        subjectId: string;
+        tokens: TokenSet;
+        displayName?: string;
+    }): Promise<TokenRecord>;
+    get(provider: string, subjectId: string): Promise<TokenRecord | undefined>;
+    delete(provider: string, subjectId: string): Promise<void>;
+    list(provider: string): Promise<TokenRecord[]>;
+    /**
+     * Returns a usable access token, refreshing when close to expiry. On
+     * refresh failure the record is `needs_reauth` and this throws.
+     */
+    accessToken(provider: string, subjectId: string): Promise<AccessTokenResult>;
+    private needsRefresh;
+    private mark;
+    private now;
+}
+export declare class ReauthRequiredError extends Error {
+    readonly provider: string;
+    readonly subjectId: string;
+    readonly code = "needs_reauth";
+    constructor(provider: string, subjectId: string);
+}
+//# sourceMappingURL=vault.d.ts.map

package/dist/vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../src/vault.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEvG,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC5C,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IACnB,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,qBAAa,UAAU;IACT,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,iBAAiB;IAEjD,GAAG,CAAC,KAAK,EAAE;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,QAAQ,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,WAAW,CAAC;IAalB,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAI1E,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1D,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAIpD;;;OAGG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAgClF,OAAO,CAAC,YAAY;YAMN,IAAI;IAIlB,OAAO,CAAC,GAAG;CAGZ;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAI1C,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM;IAJ5B,QAAQ,CAAC,IAAI,kBAAkB;gBAGpB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM;CAK7B"}

package/dist/vault.js

@@ -0,0 +1,90 @@
+/**
+ * Stores OAuth tokens, refreshes them before expiry, and marks
+ * `needs_reauth` when refresh fails — the Zoho/Buffer silent-drop counter.
+ */
+export class TokenVault {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    async put(input) {
+        const record = {
+            provider: input.provider,
+            subjectId: input.subjectId,
+            displayName: input.displayName,
+            tokens: input.tokens,
+            health: 'ok',
+            updatedAt: this.now().toISOString(),
+        };
+        await this.options.store.put(record);
+        return record;
+    }
+    async get(provider, subjectId) {
+        return this.options.store.get(provider, subjectId);
+    }
+    async delete(provider, subjectId) {
+        await this.options.store.delete(provider, subjectId);
+    }
+    async list(provider) {
+        return this.options.store.listByProvider(provider);
+    }
+    /**
+     * Returns a usable access token, refreshing when close to expiry. On
+     * refresh failure the record is `needs_reauth` and this throws.
+     */
+    async accessToken(provider, subjectId) {
+        const record = await this.options.store.get(provider, subjectId);
+        if (!record)
+            throw new Error(`no tokens for ${provider}:${subjectId}`);
+        if (record.health === 'needs_reauth') {
+            throw new ReauthRequiredError(provider, subjectId);
+        }
+        if (!this.needsRefresh(record.tokens)) {
+            return { accessToken: record.tokens.accessToken, health: record.health, record };
+        }
+        const refresher = this.options.refreshers?.[provider];
+        if (!refresher || !record.tokens.refreshToken) {
+            await this.mark(record, 'needs_reauth');
+            throw new ReauthRequiredError(provider, subjectId);
+        }
+        try {
+            const nextTokens = await refresher.refresh(record.tokens);
+            const next = {
+                ...record,
+                tokens: nextTokens,
+                health: 'ok',
+                updatedAt: this.now().toISOString(),
+            };
+            await this.options.store.put(next);
+            return { accessToken: nextTokens.accessToken, health: 'ok', record: next };
+        }
+        catch {
+            await this.mark(record, 'needs_reauth');
+            throw new ReauthRequiredError(provider, subjectId);
+        }
+    }
+    needsRefresh(tokens) {
+        if (!tokens.expiresAt)
+            return false;
+        const skew = this.options.refreshSkewMs ?? 60_000;
+        return new Date(tokens.expiresAt).getTime() - this.now().getTime() <= skew;
+    }
+    async mark(record, health) {
+        await this.options.store.put({ ...record, health, updatedAt: this.now().toISOString() });
+    }
+    now() {
+        return this.options.clock?.() ?? new Date();
+    }
+}
+export class ReauthRequiredError extends Error {
+    provider;
+    subjectId;
+    code = 'needs_reauth';
+    constructor(provider, subjectId) {
+        super(`${provider}:${subjectId} needs reauth`);
+        this.provider = provider;
+        this.subjectId = subjectId;
+        this.name = 'ReauthRequiredError';
+    }
+}
+//# sourceMappingURL=vault.js.map

package/dist/vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../src/vault.ts"],"names":[],"mappings":"AAUA;;;GAGG;AACH,MAAM,OAAO,UAAU;IACQ;IAA7B,YAA6B,OAA0B;QAA1B,YAAO,GAAP,OAAO,CAAmB;IAAG,CAAC;IAE3D,KAAK,CAAC,GAAG,CAAC,KAKT;QACC,MAAM,MAAM,GAAgB;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,QAAgB,EAAE,SAAiB;QAC3C,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,SAAiB;QAC9C,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAgB;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACrD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,QAAgB,EAAE,SAAiB;QACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,QAAQ,IAAI,SAAS,EAAE,CAAC,CAAC;QACvE,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YACrC,MAAM,IAAI,mBAAmB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QACnF,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,CAAC;QACtD,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC9C,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;YACxC,MAAM,IAAI,mBAAmB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC1D,MAAM,IAAI,GAAgB;gBACxB,GAAG,MAAM;gBACT,MAAM,EAAE,UAAU;gBAClB,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;YACF,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACnC,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;YACxC,MAAM,IAAI,mBAAmB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,MAAgB;QACnC,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC;QAClD,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC;IAC7E,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,MAAmB,EAAE,MAA6B;QACnE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC3F,CAAC;IAEO,GAAG;QACT,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAIjC;IACA;IAJF,IAAI,GAAG,cAAc,CAAC;IAE/B,YACW,QAAgB,EAChB,SAAiB;QAE1B,KAAK,CAAC,GAAG,QAAQ,IAAI,SAAS,eAAe,CAAC,CAAC;QAHtC,aAAQ,GAAR,QAAQ,CAAQ;QAChB,cAAS,GAAT,SAAS,CAAQ;QAG1B,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF"}

package/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "@bubltec/mycota-tokens",
+  "version": "0.2.0",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "typecheck": "tsc -b --noEmit",
+    "lint": "oxlint -c ../../.oxlintrc.json src",
+    "test": "vitest run"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "typescript": "^5.8.0",
+    "vitest": "^2.1.0"
+  }
+}