@deque/axe-auth 1.1.0-next.40bb9b53 → 1.1.0-next.5c407e02

package/dist/oauth/testUtils.js

@@ -0,0 +1,61 @@
+"use strict";
+// Shared helpers for the oauth test files. Not a `.test.ts` itself so
+// the test runner doesn't pick it up directly, and excluded from c8
+// coverage in `.c8rc.json` since nothing in here is production code.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KEYCLOAK_ISSUER = exports.FIXED_NOW = void 0;
+exports.withFetch = withFetch;
+exports.jsonResponse = jsonResponse;
+exports.tokenResponseBody = tokenResponseBody;
+/**
+ * A fixed "now" timestamp used by token-endpoint tests that need
+ * determinism for `expiresAt` assertions. Any constant would do;
+ * choosing one value keeps the arithmetic trivial to eyeball
+ * (2023-11-14T22:13:20.000Z).
+ */
+exports.FIXED_NOW = 1_700_000_000_000;
+/**
+ * Swaps `globalThis.fetch` for `mock` while `fn` runs, then restores.
+ * Use in tests that mock *every* fetch the subject under test makes.
+ * (Tests that want pass-through-on-miss behavior should keep their
+ * own router — see `authorize.test.ts`.)
+ */
+function withFetch(mock, fn) {
+    const original = globalThis.fetch;
+    globalThis.fetch = mock;
+    return fn().finally(() => {
+        globalThis.fetch = original;
+    });
+}
+/**
+ * JSON-serialized `Response` with `Content-Type: application/json`
+ * already set. Any headers in `init.headers` merge on top.
+ */
+function jsonResponse(body, init = { status: 200 }) {
+    return new Response(JSON.stringify(body), {
+        ...init,
+        headers: { "Content-Type": "application/json", ...(init.headers ?? {}) },
+    });
+}
+/**
+ * Canonical local Keycloak issuer URL used across tests — matches
+ * walnut's dev setup (`http://localhost:8080/auth/realms/local`).
+ * Use this anywhere a test needs "the Keycloak issuer" rather than
+ * a test-specific URL (e.g. `http://auth.test.invalid`).
+ */
+exports.KEYCLOAK_ISSUER = "http://localhost:8080/auth/realms/local";
+/**
+ * Standard OAuth 2.0 token-endpoint success body. Returns a fresh
+ * plain object on each call so tests can safely mutate it after.
+ * Override any field via `overrides`; the happy-path defaults
+ * (Bearer, positive `expires_in`) are what most tests want.
+ */
+function tokenResponseBody(overrides = {}) {
+    return {
+        access_token: "at",
+        refresh_token: "rt",
+        expires_in: 300,
+        token_type: "Bearer",
+        ...overrides,
+    };
+}

package/dist/oauth/tokenExchange.d.ts

@@ -0,0 +1,26 @@
+import { type TokenSet } from "./tokenResponse";
+/** Options for `exchangeCodeForTokens`. */
+export interface ExchangeCodeForTokensOptions {
+    /** Token endpoint resolved from OIDC discovery. */
+    tokenEndpoint: string;
+    /** OAuth client identifier. */
+    clientId: string;
+    /** Authorization code received via the loopback callback. */
+    code: string;
+    /** PKCE verifier paired with the `code_challenge` sent at auth time. */
+    codeVerifier: string;
+    /** Redirect URI originally sent to the authorization endpoint. */
+    redirectUri: string;
+    /** Source of `now`. Injected for test determinism; defaults to `Date.now`. */
+    now?: () => number;
+    /** Aborts the underlying fetch when fired. */
+    signal?: AbortSignal;
+}
+/**
+ * Exchanges an authorization code for a `TokenSet` via the
+ * authorization server's token endpoint (RFC 6749 §4.1.3 + RFC 7636
+ * §4.5). Rejects with `OAuthFlowError("TOKEN_EXCHANGE_FAILED", ...)`
+ * for any failure mode, surfacing the OAuth `error` /
+ * `error_description` when available.
+ */
+export declare function exchangeCodeForTokens(options: ExchangeCodeForTokensOptions): Promise<TokenSet>;

package/dist/oauth/tokenExchange.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exchangeCodeForTokens = exchangeCodeForTokens;
+const errors_1 = require("./errors");
+const tokenResponse_1 = require("./tokenResponse");
+/**
+ * Exchanges an authorization code for a `TokenSet` via the
+ * authorization server's token endpoint (RFC 6749 §4.1.3 + RFC 7636
+ * §4.5). Rejects with `OAuthFlowError("TOKEN_EXCHANGE_FAILED", ...)`
+ * for any failure mode, surfacing the OAuth `error` /
+ * `error_description` when available.
+ */
+async function exchangeCodeForTokens(options) {
+    const now = options.now ?? Date.now;
+    const body = new URLSearchParams({
+        grant_type: "authorization_code",
+        client_id: options.clientId,
+        code: options.code,
+        code_verifier: options.codeVerifier,
+        redirect_uri: options.redirectUri,
+    });
+    const issuedAt = now();
+    let response;
+    try {
+        response = await fetch(options.tokenEndpoint, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/x-www-form-urlencoded",
+                Accept: "application/json",
+            },
+            body,
+            signal: options.signal,
+        });
+    }
+    catch (cause) {
+        throw new errors_1.OAuthFlowError("TOKEN_EXCHANGE_FAILED", `Could not reach the token endpoint at ${options.tokenEndpoint}. Check your network connection.`, { cause });
+    }
+    if (!response.ok) {
+        await (0, tokenResponse_1.throwTokenEndpointError)(response, "Token exchange");
+    }
+    return (0, tokenResponse_1.parseTokenResponse)(response, issuedAt, options.tokenEndpoint);
+}

package/dist/oauth/tokenResponse.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Tokens returned by a successful token-endpoint call (authorization
+ * code exchange, refresh-token grant, etc.).
+ *
+ * `refreshToken` is optional because not all flows return one. On
+ * authorization-code exchange it's absent if the caller did not
+ * request `offline_access` (or the provider equivalent); on refresh
+ * some providers rotate tokens (return a new one) while others don't
+ * (the caller should keep the existing refresh token).
+ *
+ * `grantedScope` reflects the authorization server's `scope` response
+ * field when present. RFC 6749 §5.1 says `scope` is required in the
+ * response when the granted set differs from the requested set; many
+ * servers send it unconditionally.
+ */
+export interface TokenSet {
+    /** Access token for authenticated API calls. */
+    accessToken: string;
+    /** Long-lived token used to mint new access tokens without re-auth. Absent if the flow did not return one. */
+    refreshToken?: string;
+    /** Absolute timestamp (ms since epoch) when the access token expires. */
+    expiresAt: number;
+    /** Space-delimited scopes the server actually granted, if reported. */
+    grantedScope?: string;
+}
+/**
+ * Reads a non-2xx response body and throws
+ * `OAuthFlowError("TOKEN_EXCHANGE_FAILED", …)` with the OAuth
+ * `error` / `error_description` surfaced in both message and details
+ * when present. Shared by both the authorization-code exchange and
+ * refresh-token paths since the error contract is identical.
+ *
+ * @param context Short human-readable description of which call
+ *   failed ("Token exchange", "Token refresh", etc.). Appears in the
+ *   error message.
+ */
+export declare function throwTokenEndpointError(response: Response, context: string): Promise<never>;
+/**
+ * Parses a 2xx response body from an RFC 6749 §5.1 token endpoint
+ * (authorization-code exchange, refresh-token grant, etc.) into a
+ * `TokenSet`. Validates the required shape (`access_token`,
+ * `expires_in`, Bearer `token_type`) and converts the relative
+ * `expires_in` into an absolute `expiresAt` using `issuedAt`.
+ *
+ * @param response The HTTP response (must be 2xx; caller handles
+ *   error statuses via `throwTokenEndpointError`).
+ * @param issuedAt The timestamp captured just before the network
+ *   call. Slightly conservative — the token actually expires
+ *   `expires_in` seconds from when the server issued it, so the
+ *   effective usable window is `expires_in - RTT`, which errs toward
+ *   "expires sooner" rather than "expires later."
+ * @param endpointURL URL used for error messages.
+ */
+export declare function parseTokenResponse(response: Response, issuedAt: number, endpointURL: string): Promise<TokenSet>;

package/dist/oauth/tokenResponse.js

@@ -0,0 +1,121 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.throwTokenEndpointError = throwTokenEndpointError;
+exports.parseTokenResponse = parseTokenResponse;
+const errors_1 = require("./errors");
+const predicates_1 = require("./predicates");
+// RFC 6749 §5.1 describes `expires_in` as "the lifetime in seconds"
+// without pinning the JSON type, and some providers historically send
+// numeric strings. Accept both; reject anything non-positive or
+// non-finite.
+function parseExpiresIn(v) {
+    if (typeof v === "number" && Number.isFinite(v) && v > 0)
+        return v;
+    if (typeof v === "string") {
+        const n = Number(v);
+        if (Number.isFinite(n) && n > 0)
+            return n;
+    }
+    return null;
+}
+function parseErrorBody(body) {
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return {};
+    }
+    if (parsed === null || typeof parsed !== "object")
+        return {};
+    const raw = parsed;
+    return {
+        error: (0, predicates_1.isNonEmptyString)(raw.error) ? raw.error : undefined,
+        description: (0, predicates_1.isNonEmptyString)(raw.error_description)
+            ? raw.error_description
+            : undefined,
+    };
+}
+/**
+ * Reads a non-2xx response body and throws
+ * `OAuthFlowError("TOKEN_EXCHANGE_FAILED", …)` with the OAuth
+ * `error` / `error_description` surfaced in both message and details
+ * when present. Shared by both the authorization-code exchange and
+ * refresh-token paths since the error contract is identical.
+ *
+ * @param context Short human-readable description of which call
+ *   failed ("Token exchange", "Token refresh", etc.). Appears in the
+ *   error message.
+ */
+async function throwTokenEndpointError(response, context) {
+    const body = await response.text().catch(() => "");
+    const { error, description } = parseErrorBody(body);
+    const suffix = error
+        ? description
+            ? `: ${error}: ${description}`
+            : `: ${error}`
+        : "";
+    const details = {};
+    if (error)
+        details.error = error;
+    if (description)
+        details.error_description = description;
+    throw new errors_1.OAuthFlowError("TOKEN_EXCHANGE_FAILED", `${context} failed with HTTP ${response.status}${suffix}`, Object.keys(details).length > 0 ? { details } : undefined);
+}
+/**
+ * Parses a 2xx response body from an RFC 6749 §5.1 token endpoint
+ * (authorization-code exchange, refresh-token grant, etc.) into a
+ * `TokenSet`. Validates the required shape (`access_token`,
+ * `expires_in`, Bearer `token_type`) and converts the relative
+ * `expires_in` into an absolute `expiresAt` using `issuedAt`.
+ *
+ * @param response The HTTP response (must be 2xx; caller handles
+ *   error statuses via `throwTokenEndpointError`).
+ * @param issuedAt The timestamp captured just before the network
+ *   call. Slightly conservative — the token actually expires
+ *   `expires_in` seconds from when the server issued it, so the
+ *   effective usable window is `expires_in - RTT`, which errs toward
+ *   "expires sooner" rather than "expires later."
+ * @param endpointURL URL used for error messages.
+ */
+async function parseTokenResponse(response, issuedAt, endpointURL) {
+    let parsed;
+    try {
+        parsed = await response.json();
+    }
+    catch (cause) {
+        throw new errors_1.OAuthFlowError("TOKEN_EXCHANGE_FAILED", `Token endpoint at ${endpointURL} returned a non-JSON response`, { cause });
+    }
+    if (parsed === null || typeof parsed !== "object") {
+        throw new errors_1.OAuthFlowError("TOKEN_EXCHANGE_FAILED", `Token endpoint at ${endpointURL} returned a non-object response`);
+    }
+    const raw = parsed;
+    if (!(0, predicates_1.isNonEmptyString)(raw.access_token)) {
+        throw new errors_1.OAuthFlowError("TOKEN_EXCHANGE_FAILED", `Token response missing 'access_token'`);
+    }
+    const expiresIn = parseExpiresIn(raw.expires_in);
+    if (expiresIn === null) {
+        throw new errors_1.OAuthFlowError("TOKEN_EXCHANGE_FAILED", `Token response missing or has invalid 'expires_in'`);
+    }
+    // RFC 6749 §5.1: token_type is REQUIRED. We only speak Bearer;
+    // DPoP / MAC / other proof-of-possession types need request-side
+    // support we don't implement, and silently treating them as Bearer
+    // would send tokens in the wrong header with unclear semantics.
+    if (!(0, predicates_1.isNonEmptyString)(raw.token_type)) {
+        throw new errors_1.OAuthFlowError("TOKEN_EXCHANGE_FAILED", `Token response missing required 'token_type'`);
+    }
+    if (raw.token_type.toLowerCase() !== "bearer") {
+        throw new errors_1.OAuthFlowError("TOKEN_EXCHANGE_FAILED", `Unsupported token_type '${raw.token_type}'; this library only handles Bearer.`);
+    }
+    const tokens = {
+        accessToken: raw.access_token,
+        expiresAt: issuedAt + expiresIn * 1000,
+    };
+    if ((0, predicates_1.isNonEmptyString)(raw.refresh_token)) {
+        tokens.refreshToken = raw.refresh_token;
+    }
+    if ((0, predicates_1.isNonEmptyString)(raw.scope)) {
+        tokens.grantedScope = raw.scope;
+    }
+    return tokens;
+}

package/dist/oauth/tokenStore.d.ts

@@ -0,0 +1,78 @@
+import type { TokenSet } from "./tokenResponse";
+/**
+ * Current on-disk blob schema version. Exported so consumers can
+ * display "stored v:N, expected v:M" diagnostics when `load()` returns
+ * a `version-mismatch` result.
+ */
+export declare const STORED_BLOB_VERSION = 1;
+/**
+ * Outcome of a `TokenStore.load()` call.
+ *
+ * Note on downgrades: the migrator chain only walks *forward*. A user
+ * who downgrades `axe-auth` to a release that predates a schema bump
+ * will see `version-mismatch` on any blob written by the newer
+ * release, even if the change was strictly additive. That is the safe
+ * default for a credentials blob — the older version cannot vouch for
+ * the meaning of fields it has never seen. Callers hitting this case
+ * should treat it as "re-authenticate" rather than attempting to
+ * parse an unknown future shape.
+ */
+export type LoadResult = {
+    ok: true;
+    tokens: TokenSet;
+} | {
+    ok: false;
+    reason: "empty";
+} | {
+    ok: false;
+    reason: "corrupt";
+} | {
+    ok: false;
+    reason: "version-mismatch";
+    storedVersion: number;
+};
+/** Persistence layer for an OAuth `TokenSet`. */
+export interface TokenStore {
+    /** Write-through save. Replaces any previously stored tokens. */
+    save(tokens: TokenSet): Promise<void>;
+    /**
+     * Reads the stored tokens and returns a structured result.
+     *
+     * Callers should branch on `result.ok` first. When `ok` is `false`,
+     * `reason` tells them *why* there is no usable `TokenSet`: `empty`
+     * (nothing stored), `corrupt` (unparseable or shape-invalid), or
+     * `version-mismatch` (stored under a schema we cannot migrate from).
+     * The library does not emit output on these cases — surfacing them
+     * to the user is the caller's responsibility.
+     */
+    load(): Promise<LoadResult>;
+    /** Removes any stored tokens. No-op if none are present. */
+    clear(): Promise<void>;
+}
+/** Minimal keyring-entry surface consumed by `KeyringTokenStore`. */
+export interface KeyringEntry {
+    /** Writes the password for this entry. */
+    setPassword(password: string): void;
+    /** Reads the current password, or returns `null` if none is set. */
+    getPassword(): string | null;
+    /** Deletes the password and returns `true` if one existed. */
+    deletePassword(): boolean;
+}
+/**
+ * Factory for `KeyringEntry` values. Injection seam for tests;
+ * production callers use the default that constructs
+ * `@napi-rs/keyring` entries lazily.
+ */
+export type KeyringEntryFactory = (service: string, account: string) => KeyringEntry;
+/**
+ * `TokenStore` backed by the operating system's native keychain via
+ * `@napi-rs/keyring` (macOS Keychain, Windows Credential Manager, Linux
+ * Secret Service). Account is keyed by the normalized issuer URL.
+ */
+export declare class KeyringTokenStore implements TokenStore {
+    #private;
+    constructor(issuerURL: string, entryFactory?: KeyringEntryFactory);
+    save(tokens: TokenSet): Promise<void>;
+    load(): Promise<LoadResult>;
+    clear(): Promise<void>;
+}

package/dist/oauth/tokenStore.js

@@ -0,0 +1,176 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KeyringTokenStore = exports.STORED_BLOB_VERSION = void 0;
+const node_module_1 = require("node:module");
+const errors_1 = require("./errors");
+const issuerURL_1 = require("./issuerURL");
+const requireFromHere = (0, node_module_1.createRequire)(__filename);
+// On macOS: Keychain generic password item with the service name below.
+// On Windows: Credential Manager entry. On Linux: Secret Service / libsecret.
+// Exposed as a human-readable string because these all surface the service
+// name in OS UIs (Keychain Access, credmgr.exe, seahorse).
+const SERVICE_NAME = "axe-auth";
+/**
+ * Current on-disk blob schema version. Exported so consumers can
+ * display "stored v:N, expected v:M" diagnostics when `load()` returns
+ * a `version-mismatch` result.
+ */
+exports.STORED_BLOB_VERSION = 1;
+/**
+ * Migrators upgrade an older blob to the next version up. Walked by
+ * `load()` until the stored blob reaches `STORED_BLOB_VERSION`.
+ *
+ * A migrator returns `null` when the bump cannot be inferred from the
+ * old shape (e.g. a new required field with no derivable default); the
+ * caller then sees `{ ok: false, reason: "version-mismatch" }` and
+ * decides whether to re-auth, prompt, or preserve the old blob.
+ *
+ * Each migrator is responsible for taking `vN` → `vN+1`. To skip a
+ * version deliberately, register a migrator that returns `null` for
+ * that `fromVersion`.
+ */
+const MIGRATORS = new Map([
+// [1, (v1) => migrateV1ToV2(v1 as StoredBlobV1)],
+]);
+// Lazy-resolved Entry constructor. Importing @napi-rs/keyring at the
+// top of this module would run its native binding loader at
+// module-load time, throwing before any of our OAuthFlowError code
+// catches it and preventing the module from being imported at all on
+// platforms without a prebuilt. We defer the require into
+// `defaultEntryFactory`, which turns that import-time failure into a
+// `KEYRING_UNAVAILABLE` surfaced on the first `new
+// KeyringTokenStore(...)` call — not on first save/load/clear, since
+// `authorize()` (and similar callers) construct the store eagerly as
+// a default-arg expression. Runtime keychain errors (missing D-Bus
+// Secret Service, macOS Keychain denial, etc.) are a separate
+// concern and surface later, inside save/load/clear.
+let cachedEntryCtor = null;
+function resolveEntryCtor() {
+    if (cachedEntryCtor)
+        return cachedEntryCtor;
+    try {
+        const mod = requireFromHere("@napi-rs/keyring");
+        cachedEntryCtor = mod.Entry;
+        return cachedEntryCtor;
+    }
+    catch (cause) {
+        throw new errors_1.OAuthFlowError("KEYRING_UNAVAILABLE", `Could not load @napi-rs/keyring. A prebuilt native binding for this platform may be missing.`, { cause });
+    }
+}
+const defaultEntryFactory = (service, account) => {
+    const Ctor = resolveEntryCtor();
+    return new Ctor(service, account);
+};
+function getStoredVersion(blob) {
+    if (blob === null || typeof blob !== "object")
+        return null;
+    const v = blob.v;
+    return typeof v === "number" && Number.isInteger(v) && v > 0 ? v : null;
+}
+function isLatestBlob(blob) {
+    if (blob === null || typeof blob !== "object")
+        return false;
+    const b = blob;
+    return (b.v === exports.STORED_BLOB_VERSION &&
+        typeof b.accessToken === "string" &&
+        typeof b.expiresAt === "number" &&
+        (b.refreshToken === undefined || typeof b.refreshToken === "string"));
+}
+function blobToTokens(blob) {
+    const tokens = {
+        accessToken: blob.accessToken,
+        expiresAt: blob.expiresAt,
+    };
+    if (blob.refreshToken !== undefined)
+        tokens.refreshToken = blob.refreshToken;
+    return tokens;
+}
+function tokensToBlob(tokens) {
+    const blob = {
+        v: exports.STORED_BLOB_VERSION,
+        accessToken: tokens.accessToken,
+        expiresAt: tokens.expiresAt,
+    };
+    if (tokens.refreshToken !== undefined)
+        blob.refreshToken = tokens.refreshToken;
+    return blob;
+}
+function wrapKeyringError(op, cause) {
+    throw new errors_1.OAuthFlowError("KEYRING_UNAVAILABLE", `System keychain ${op} failed. On Linux this usually means no D-Bus Secret Service is running.`, { cause });
+}
+/**
+ * `TokenStore` backed by the operating system's native keychain via
+ * `@napi-rs/keyring` (macOS Keychain, Windows Credential Manager, Linux
+ * Secret Service). Account is keyed by the normalized issuer URL.
+ */
+class KeyringTokenStore {
+    #entry;
+    constructor(issuerURL, entryFactory = defaultEntryFactory) {
+        this.#entry = entryFactory(SERVICE_NAME, (0, issuerURL_1.normalizeIssuerURL)(issuerURL));
+    }
+    async save(tokens) {
+        try {
+            this.#entry.setPassword(JSON.stringify(tokensToBlob(tokens)));
+        }
+        catch (cause) {
+            wrapKeyringError("write", cause);
+        }
+    }
+    async load() {
+        let raw;
+        try {
+            raw = this.#entry.getPassword();
+        }
+        catch (cause) {
+            wrapKeyringError("read", cause);
+        }
+        if (raw === null)
+            return { ok: false, reason: "empty" };
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            return { ok: false, reason: "corrupt" };
+        }
+        const storedVersion = getStoredVersion(parsed);
+        if (storedVersion === null)
+            return { ok: false, reason: "corrupt" };
+        // Walk the migrator chain until we reach the current version. A
+        // missing or null-returning migrator means the old blob cannot be
+        // upgraded; surface that so callers can prompt re-auth with a
+        // clear signal instead of silently returning `empty`.
+        let current = parsed;
+        let currentVersion = storedVersion;
+        while (currentVersion !== exports.STORED_BLOB_VERSION) {
+            const migrator = MIGRATORS.get(currentVersion);
+            if (!migrator) {
+                return { ok: false, reason: "version-mismatch", storedVersion };
+            }
+            const next = migrator(current);
+            if (next === null) {
+                return { ok: false, reason: "version-mismatch", storedVersion };
+            }
+            const nextVersion = getStoredVersion(next);
+            if (nextVersion === null || nextVersion <= currentVersion) {
+                // Migrator output is malformed or didn't advance. Treat the
+                // stored blob as un-migratable rather than loop forever.
+                return { ok: false, reason: "version-mismatch", storedVersion };
+            }
+            current = next;
+            currentVersion = nextVersion;
+        }
+        if (!isLatestBlob(current))
+            return { ok: false, reason: "corrupt" };
+        return { ok: true, tokens: blobToTokens(current) };
+    }
+    async clear() {
+        try {
+            this.#entry.deletePassword();
+        }
+        catch (cause) {
+            wrapKeyringError("delete", cause);
+        }
+    }
+}
+exports.KeyringTokenStore = KeyringTokenStore;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deque/axe-auth",
-  "version": "1.1.0-next.40bb9b53",
+  "version": "1.1.0-next.5c407e02",
   "description": "CLI authentication utility for Deque services",
   "license": "SEE LICENSE IN LICENSE",
   "type": "commonjs",
@@ -20,13 +20,21 @@
   "engines": {
     "node": ">=22.13.0"
   },
+  "dependencies": {
+    "@napi-rs/keyring": "^1.2.0"
+  },
   "devDependencies": {
     "@types/node": "^22.13.10",
+    "c8": "^10.1.3",
     "tsx": "^4.20.6",
     "typescript": "^5.9.3"
   },
   "scripts": {
     "build": "tsc",
-    "test": "tsx --test 'src/**/*.test.ts'"
+    "test": "tsx --test 'src/**/*.test.ts'",
+    "coverage": "c8 pnpm test",
+    "register-dev-client": "tsx scripts/registerDevClient.ts",
+    "smoke-authorize": "tsx scripts/smokeAuthorize.ts",
+    "manual-authorize": "tsx scripts/manualAuthorize.ts"
   }
 }