@deque/axe-auth 1.1.0-next.907ffbd7 → 1.1.0-next.9bc60204

package/dist/index.js

@@ -1,47 +1,139 @@
 #!/usr/bin/env node
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-const node_util_1 = require("node:util");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
+const node_util_1 = require("node:util");
+const commonArgs_1 = require("./cli/commonArgs");
+const tokenStore_1 = require("./oauth/tokenStore");
+const login_1 = __importDefault(require("./commands/login"));
+const logout_1 = __importDefault(require("./commands/logout"));
+const token_1 = __importDefault(require("./commands/token"));
+const errors_1 = require("./cli/errors");
 const pkg = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(__dirname, "..", "package.json"), "utf-8"));
-const helpText = `${pkg.name} v${pkg.version}
+// Iteration order is the order verbs appear in `axe-auth --help`.
+const COMMANDS = [
+    login_1.default,
+    logout_1.default,
+    token_1.default,
+];
+function findCommand(verb) {
+    return COMMANDS.find((c) => c.name === verb);
+}
+function topLevelHelp() {
+    const width = Math.max(...COMMANDS.map((c) => c.name.length));
+    const verbList = COMMANDS.map((c) => `  ${c.name.padEnd(width)}  ${c.summary}`).join("\n");
+    return `${pkg.name} v${pkg.version}
 
 ${pkg.description}
 
 Usage:
-  axe-auth [options]
+  axe-auth <command> [options]
 
-Options:
-  -v, --version  Show version number
-  -h, --help     Show this help message`;
-const main = async () => {
-    let values;
+Commands:
+${verbList}
+
+Run \`axe-auth <command> --help\` for command-specific options.
+
+Top-level options:
+  -v, --version  Show version number.
+  -h, --help     Show this help.`;
+}
+async function dispatch(argv) {
+    const [first, ...rest] = argv;
+    if (first === undefined || first === "-h" || first === "--help") {
+        process.stdout.write(`${topLevelHelp()}\n`);
+        return 0;
+    }
+    if (first === "-v" || first === "--version") {
+        process.stdout.write(`${pkg.version}\n`);
+        return 0;
+    }
+    if (first.startsWith("-")) {
+        process.stderr.write(`Unknown option: ${first}. Run \`axe-auth --help\` for usage.\n`);
+        return 2;
+    }
+    const command = findCommand(first);
+    if (!command) {
+        process.stderr.write(`Unknown command: ${first}. Run \`axe-auth --help\` for usage.\n`);
+        return 2;
+    }
+    let parsed;
     try {
-        ({ values } = (0, node_util_1.parseArgs)({
+        parsed = (0, node_util_1.parseArgs)({
+            args: rest,
             options: {
-                version: { type: "boolean", short: "v" },
+                ...commonArgs_1.COMMON_OPTIONS,
+                ...command.options,
                 help: { type: "boolean", short: "h" },
             },
             strict: true,
-        }));
+            allowPositionals: false,
+        });
     }
     catch (err) {
-        console.error(err.message);
-        return 1;
+        process.stderr.write(`${(0, errors_1.describeError)(err)}\n`);
+        return 2;
     }
-    if (values.version) {
-        console.log(pkg.version);
+    if (parsed.values.help) {
+        process.stdout.write(`${command.helpText}\n`);
         return 0;
     }
-    if (values.help) {
-        console.log(helpText);
+    // Best-effort load of the stored entry. Used to (a) supply the
+    // `allowInsecureIssuer` fallback on flag-free invocations, and (b)
+    // hand the entry to the verb via `deps.loadedEntry` so a single
+    // `axe-auth token` invocation hits the keychain once instead of
+    // twice. A read failure here is non-fatal — `parseCommonArgs`
+    // always succeeds (the SaaS prod default fills any unsupplied
+    // walnut URL), and verbs that need a stored entry have their own
+    // empty/corrupt-entry handling.
+    let defaults = null;
+    let loadedEntry;
+    try {
+        loadedEntry = await new tokenStore_1.KeyringTokenStore().load();
+        if (loadedEntry.ok) {
+            defaults = {
+                walnutURL: loadedEntry.entry.walnutURL,
+                allowInsecureIssuer: loadedEntry.entry.allowInsecureIssuer,
+            };
+        }
+    }
+    catch {
+        // Keychain unavailable: leave defaults null. login will fail at
+        // `tokenStore.save()` with a clearer error than we can produce
+        // here; token / logout's own empty-entry path handles it.
+    }
+    let common;
+    try {
+        common = (0, commonArgs_1.parseCommonArgs)(parsed.values, process.env, defaults);
+    }
+    catch (err) {
+        process.stderr.write(`${(0, errors_1.describeError)(err)}\n`);
+        return 2;
+    }
+    const deps = {
+        stdin: process.stdin,
+        stdout: process.stdout,
+        stderr: process.stderr,
+        loadedEntry,
+    };
+    try {
+        await command.run({ ...common, ...parsed.values }, deps);
         return 0;
     }
-    console.log("No arguments provided. Use --help for usage information.");
-    return 1;
-};
-main().then((code) => process.exit(code), (err) => {
-    console.error(err);
+    catch (err) {
+        if (err instanceof errors_1.CLIError) {
+            process.stderr.write(`${err.message}\n`);
+            return err.exitCode;
+        }
+        process.stderr.write(`${(0, errors_1.describeError)(err)}\n`);
+        return 2;
+    }
+}
+dispatch(process.argv.slice(2)).then((code) => process.exit(code), (err) => {
+    process.stderr.write(`${err instanceof Error ? (err.stack ?? err.message) : String(err)}\n`);
     process.exit(1);
 });

package/dist/oauth/authorize.d.ts

@@ -1,4 +1,4 @@
-import { type TokenSet } from "./tokenExchange";
+import type { TokenSet } from "./tokenResponse";
 import { type TokenStore } from "./tokenStore";
 /** Options for `authorize`. */
 export interface AuthorizeOptions {
@@ -11,6 +11,13 @@ export interface AuthorizeOptions {
     issuerURL: string;
     /** OAuth client ID registered with the authorization server. */
     clientId: string;
+    /**
+     * Originating walnut (axe server) URL the user supplied (or the
+     * SaaS prod default) at login. Persisted in the stored entry
+     * alongside the OAuth coordinates so future verbs can re-discover
+     * `/api/sso-config` without user-supplied flags.
+     */
+    walnutURL: string;
     /**
      * OAuth scopes to request. Required — this library has no opinion
      * about which scopes your provider expects. Keycloak callers who
@@ -25,8 +32,9 @@ export interface AuthorizeOptions {
     /** Aborts the in-flight discovery, callback wait, and token exchange. */
     signal?: AbortSignal;
     /**
-     * Override for the token persistence layer. Defaults to
-     * `KeyringTokenStore` keyed by the normalized issuer URL.
+     * Override for the token persistence layer. Defaults to a fresh
+     * `KeyringTokenStore()` (single keychain entry per machine; the
+     * blob carries its own issuer/client coordinates).
      */
     tokenStore?: TokenStore;
     /** Override for the system browser launcher. Injected for tests. */

package/dist/oauth/authorize.js

@@ -38,7 +38,7 @@ function defaultOnWarning(message) {
  * @throws {OAuthCallbackError} For loopback/callback-server failures.
  */
 async function authorize(options) {
-    const { issuerURL, clientId, scopes, timeoutMs, signal, tokenStore = new tokenStore_1.KeyringTokenStore(issuerURL), openBrowser = openBrowser_1.openBrowser, onAuthorizationUrl = defaultOnAuthorizationUrl, onWarning = defaultOnWarning, allowInsecureIssuer, } = options;
+    const { issuerURL, clientId, walnutURL, scopes, timeoutMs, signal, tokenStore = new tokenStore_1.KeyringTokenStore(), openBrowser = openBrowser_1.openBrowser, onAuthorizationUrl = defaultOnAuthorizationUrl, onWarning = defaultOnWarning, allowInsecureIssuer, } = options;
     // Discovery first. If the auth server is unreachable we want to fail
     // *before* opening a browser — a rejected discovery throw is
     // strictly more useful than a browser tab pointing at a
@@ -98,14 +98,19 @@ async function authorize(options) {
         // came back, warn. Prefer the server's reported `grantedScope`
         // when present (RFC 6749 §5.1) since the provider's consent
         // screen may have dropped the scope.
-        if (scopes.includes("offline_access") &&
-            tokens.refreshToken === undefined) {
+        if (scopes.includes("offline_access") && !tokens.refreshToken) {
             const grantedSuffix = tokens.grantedScope
                 ? ` (server granted: ${tokens.grantedScope})`
                 : "";
             onWarning(`'offline_access' was requested but no refresh_token was returned${grantedSuffix}. Cross-session refresh will not be available.`);
         }
-        await tokenStore.save(tokens);
+        await tokenStore.save({
+            tokens,
+            issuerURL,
+            clientId,
+            allowInsecureIssuer: allowInsecureIssuer ?? false,
+            walnutURL,
+        });
         return tokens;
     }
     finally {

package/dist/oauth/discoverOIDC.js

@@ -3,12 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.discoverOIDC = discoverOIDC;
 const errors_1 = require("./errors");
 const issuerURL_1 = require("./issuerURL");
+const predicates_1 = require("./predicates");
+const userAgent_1 = require("../userAgent");
 const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
-function isNonEmptyString(v) {
-    return typeof v === "string" && v.length > 0;
-}
 function optionalString(v) {
-    return isNonEmptyString(v) ? v : undefined;
+    return (0, predicates_1.isNonEmptyString)(v) ? v : undefined;
 }
 /**
  * Throws `DISCOVERY_FAILED` if `url` is not safe to transmit OAuth
@@ -53,12 +52,12 @@ function buildDiscoveryURL(issuerURL) {
 }
 function parseConfiguration(body, url) {
     const missing = [];
-    if (!isNonEmptyString(body.issuer))
+    if (!(0, predicates_1.isNonEmptyString)(body.issuer))
         missing.push("issuer");
-    if (!isNonEmptyString(body.authorization_endpoint)) {
+    if (!(0, predicates_1.isNonEmptyString)(body.authorization_endpoint)) {
         missing.push("authorization_endpoint");
     }
-    if (!isNonEmptyString(body.token_endpoint))
+    if (!(0, predicates_1.isNonEmptyString)(body.token_endpoint))
         missing.push("token_endpoint");
     if (missing.length > 0) {
         throw new errors_1.OAuthFlowError("DISCOVERY_FAILED", `OpenID configuration at ${url} is missing required field(s): ${missing.join(", ")}`);
@@ -71,6 +70,31 @@ function parseConfiguration(body, url) {
         endSessionEndpoint: optionalString(body.end_session_endpoint),
     };
 }
+/**
+ * `code_challenge_methods_supported` is OPTIONAL in OIDC discovery, so its
+ * absence proves nothing — older providers may support PKCE without
+ * advertising it. But when the list IS present and does not include
+ * `S256` (the only method this CLI uses, per RFC 7636), the server has
+ * explicitly declared it does not support the flow we need. Fail fast
+ * with an actionable message instead of letting the user hit a generic
+ * OAuth error several steps deeper into the flow.
+ *
+ * An empty list (`[]`) is treated the same as a populated list missing
+ * `S256`: the server has explicitly advertised zero supported methods,
+ * which is incompatible.
+ *
+ * Called from `discoverOIDC` after issuer verification so that a
+ * tampered discovery doc surfaces the more security-critical issuer
+ * mismatch first.
+ */
+function assertPKCESupport(body, url) {
+    const methods = body.code_challenge_methods_supported;
+    if (!Array.isArray(methods))
+        return;
+    if (methods.includes("S256"))
+        return;
+    throw new errors_1.OAuthFlowError("DISCOVERY_FAILED", `OpenID configuration at ${url} advertises code_challenge_methods_supported = ${JSON.stringify(methods)}, but axe-auth requires S256 (PKCE per RFC 7636). The OAuth client used by axe-auth needs PKCE enabled, or you may be on an axe server version that predates OAuth-based MCP authentication.`);
+}
 /**
  * Fetches and parses the OpenID Connect discovery document for a given
  * issuer. Fails fast (no retry) so the caller does not open a browser
@@ -100,7 +124,10 @@ async function discoverOIDC(issuerURL, options = {}) {
     const url = buildDiscoveryURL(issuerURL);
     let response;
     try {
-        response = await fetch(url, { signal: options.signal });
+        response = await fetch(url, {
+            headers: { "User-Agent": userAgent_1.USER_AGENT },
+            signal: options.signal,
+        });
     }
     catch (cause) {
         throw new errors_1.OAuthFlowError("DISCOVERY_FAILED", `Could not reach the authentication server at ${url}. Check the URL and your network connection.`, { cause });
@@ -141,5 +168,6 @@ async function discoverOIDC(issuerURL, options = {}) {
     if (config.endSessionEndpoint) {
         assertSecureURL(config.endSessionEndpoint, "end_session_endpoint", allowInsecure);
     }
+    assertPKCESupport(body, url);
     return config;
 }

package/dist/oauth/discoverSSOConfig.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Subset of the axe server's `/api/sso-config` response that this
+ * package consumes. The full response may carry additional fields
+ * (e.g. `publicClientId` for the SPA frontend); we ignore everything
+ * except what the CLI needs to drive its OAuth flow.
+ */
+export interface SSOConfig {
+    /** Keycloak base URL, e.g. `https://auth.example.com`. */
+    url: string;
+    /** Keycloak realm name. */
+    realm: string;
+    /** OAuth client ID for the axe-auth CLI. */
+    mcpClientId: string;
+}
+/** Options for `discoverSSOConfig`. */
+export interface DiscoverSSOConfigOptions {
+    /** Aborts the underlying fetch when fired. */
+    signal?: AbortSignal;
+    /**
+     * Permit non-HTTPS axe server URLs whose host is not a loopback
+     * literal. Loopback hosts (`localhost`, `127.0.0.1`, `[::1]`) are
+     * always allowed over http; this flag is the opt-in for non-loopback
+     * http (corporate dev / reverse-proxy setups). Default `false`.
+     */
+    allowInsecure?: boolean;
+}
+/**
+ * Fetches and parses the axe server's `/api/sso-config` discovery
+ * endpoint. Used by `axe-auth login` to derive the OAuth issuer URL,
+ * realm, and CLI-specific client ID from the axe server URL the user
+ * supplied (or the SaaS prod default), so users no longer have to know
+ * the underlying Keycloak coordinates.
+ *
+ * Distinguishes three failure shapes for the operator-relevant cases:
+ *
+ * - `mcpClientId` field absent: the axe server deployment predates the
+ *   field entirely. Surfaces as "needs upgrading".
+ * - `mcpClientId` is `null`: the axe server version supports the field
+ *   but the operator has not configured `KEYCLOAK_MCP_PUBLIC_CLIENT_ID`.
+ *   Surfaces as "ask the operator to configure".
+ * - any non-empty string: returned as-is.
+ *
+ * Other failure modes (unreachable, non-2xx, malformed JSON, missing
+ * `url` / `realm`) all map to `DISCOVERY_FAILED` with a descriptive
+ * message. The caller is expected to surface these errors verbatim.
+ */
+export declare function discoverSSOConfig(serverURL: string, options?: DiscoverSSOConfigOptions): Promise<SSOConfig>;

package/dist/oauth/discoverSSOConfig.js

@@ -0,0 +1,105 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.discoverSSOConfig = discoverSSOConfig;
+const errors_1 = require("./errors");
+const predicates_1 = require("./predicates");
+const userAgent_1 = require("../userAgent");
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
+function assertSecureServerURL(serverURL, allowInsecure) {
+    let parsed;
+    try {
+        parsed = new URL(serverURL);
+    }
+    catch {
+        throw new errors_1.OAuthFlowError("DISCOVERY_FAILED", `axe server URL is not a valid URL: ${serverURL}`);
+    }
+    if (parsed.protocol === "https:")
+        return parsed;
+    if (parsed.protocol === "http:") {
+        const hostname = parsed.host.toLowerCase().replace(/:\d+$/, "");
+        if (LOOPBACK_HOSTS.has(hostname))
+            return parsed;
+        if (allowInsecure)
+            return parsed;
+        throw new errors_1.OAuthFlowError("DISCOVERY_FAILED", `Refusing to use axe server URL over http:// against non-loopback host ${parsed.host}. Use https:// or pass --allow-insecure-issuer to override (only do this on trusted networks).`);
+    }
+    throw new errors_1.OAuthFlowError("DISCOVERY_FAILED", `Unsupported axe server URL scheme '${parsed.protocol}'; expected https: or http: (loopback only).`);
+}
+function buildSSOConfigURL(parsed) {
+    const copy = new URL(parsed.toString());
+    copy.search = "";
+    copy.hash = "";
+    copy.pathname = `${copy.pathname.replace(/\/+$/, "")}/api/sso-config`;
+    return copy.toString();
+}
+/**
+ * Fetches and parses the axe server's `/api/sso-config` discovery
+ * endpoint. Used by `axe-auth login` to derive the OAuth issuer URL,
+ * realm, and CLI-specific client ID from the axe server URL the user
+ * supplied (or the SaaS prod default), so users no longer have to know
+ * the underlying Keycloak coordinates.
+ *
+ * Distinguishes three failure shapes for the operator-relevant cases:
+ *
+ * - `mcpClientId` field absent: the axe server deployment predates the
+ *   field entirely. Surfaces as "needs upgrading".
+ * - `mcpClientId` is `null`: the axe server version supports the field
+ *   but the operator has not configured `KEYCLOAK_MCP_PUBLIC_CLIENT_ID`.
+ *   Surfaces as "ask the operator to configure".
+ * - any non-empty string: returned as-is.
+ *
+ * Other failure modes (unreachable, non-2xx, malformed JSON, missing
+ * `url` / `realm`) all map to `DISCOVERY_FAILED` with a descriptive
+ * message. The caller is expected to surface these errors verbatim.
+ */
+async function discoverSSOConfig(serverURL, options = {}) {
+    const allowInsecure = options.allowInsecure ?? false;
+    const parsed = assertSecureServerURL(serverURL, allowInsecure);
+    const url = buildSSOConfigURL(parsed);
+    let response;
+    try {
+        response = await fetch(url, {
+            headers: { "User-Agent": userAgent_1.USER_AGENT },
+            signal: options.signal,
+        });
+    }
+    catch (cause) {
+        throw new errors_1.OAuthFlowError("DISCOVERY_FAILED", `Could not reach the axe server at ${url}. Check the --server URL and your network connection.`, { cause });
+    }
+    if (!response.ok) {
+        throw new errors_1.OAuthFlowError("DISCOVERY_FAILED", `axe server at ${url} responded with HTTP ${response.status}. Check the --server URL.`);
+    }
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch (cause) {
+        throw new errors_1.OAuthFlowError("DISCOVERY_FAILED", `axe server at ${url} did not return valid JSON.`, { cause });
+    }
+    if (body === null || typeof body !== "object" || Array.isArray(body)) {
+        throw new errors_1.OAuthFlowError("DISCOVERY_FAILED", `axe server at ${url} returned a non-object response body.`);
+    }
+    const raw = body;
+    const missing = [];
+    if (!(0, predicates_1.isNonEmptyString)(raw.url))
+        missing.push("url");
+    if (!(0, predicates_1.isNonEmptyString)(raw.realm))
+        missing.push("realm");
+    if (missing.length > 0) {
+        throw new errors_1.OAuthFlowError("DISCOVERY_FAILED", `${url} is missing required field(s): ${missing.join(", ")}`);
+    }
+    if (!("mcpClientId" in raw)) {
+        throw new errors_1.OAuthFlowError("DISCOVERY_FAILED", `axe server at ${serverURL} does not advertise OAuth-based MCP authentication. The deployment may need to be upgraded to a version that supports the axe-auth CLI.`);
+    }
+    if (raw.mcpClientId === null) {
+        throw new errors_1.OAuthFlowError("DISCOVERY_FAILED", `axe server at ${serverURL} has not been configured for OAuth-based MCP authentication. Ask your operator to set the KEYCLOAK_MCP_PUBLIC_CLIENT_ID environment variable on the axe server.`);
+    }
+    if (!(0, predicates_1.isNonEmptyString)(raw.mcpClientId)) {
+        throw new errors_1.OAuthFlowError("DISCOVERY_FAILED", `axe server at ${serverURL} returned a malformed mcpClientId (expected a non-empty string).`);
+    }
+    return {
+        url: raw.url,
+        realm: raw.realm,
+        mcpClientId: raw.mcpClientId,
+    };
+}

package/dist/oauth/errors.d.ts

@@ -42,7 +42,9 @@ export type OAuthFlowErrorCode =
 /** System keychain is unavailable (e.g. no D-Bus secret service on Linux). */
  | "KEYRING_UNAVAILABLE"
 /** Authorization endpoint returned by discovery cannot be used (e.g. already carries an OAuth-required param). Server misconfiguration. */
- | "INVALID_AUTHORIZATION_ENDPOINT";
+ | "INVALID_AUTHORIZATION_ENDPOINT"
+/** No usable stored credentials; the user needs to run `login` to re-authenticate. Covers empty / corrupt / version-mismatched store and refresh tokens the authorization server has revoked. */
+ | "NOT_AUTHENTICATED";
 /** Options for `OAuthFlowError`. */
 export interface OAuthFlowErrorOptions {
     /** Structured metadata for callers that want to surface specific fields. */

package/dist/oauth/getValidAccessToken.d.ts

@@ -0,0 +1,89 @@
+import { type LoadResult, type TokenStore } from "./tokenStore";
+/** Options for `getValidAccessToken`. */
+export interface GetValidAccessTokenOptions {
+    /**
+     * OIDC issuer URL (same value passed to `authorize`). Must match
+     * the stored entry's `issuerURL`; mismatch throws
+     * `OAuthFlowError("NOT_AUTHENTICATED", ...)` rather than refreshing
+     * the wrong issuer's tokens at the requested endpoint.
+     */
+    issuerURL: string;
+    /**
+     * OAuth client identifier. Must match the stored entry's
+     * `clientId`; see the note on `issuerURL` for the mismatch
+     * behavior.
+     */
+    clientId: string;
+    /**
+     * How close to expiry we start preemptively refreshing, in
+     * milliseconds. Defaults to 60_000 (60s). The buffer gives headroom
+     * between our "still fresh enough" check and the server's view of
+     * expiry (which may differ by a few seconds of clock skew) and
+     * prevents a token from expiring mid-request after we hand it out.
+     *
+     * Assumes the access-token TTL is much larger than the buffer. With
+     * TTLs ≤ `expiryBufferMs`, every call will trigger a refresh.
+     */
+    expiryBufferMs?: number;
+    /**
+     * Override for the token store. Defaults to a fresh
+     * `KeyringTokenStore()` (single keychain entry per machine).
+     */
+    tokenStore?: TokenStore;
+    /**
+     * Pre-loaded result of `tokenStore.load()`. When provided, the
+     * function skips its own keychain read and uses this value
+     * instead — lets a caller that already loaded the entry (the CLI
+     * dispatcher does, to derive `parseCommonArgs` defaults) avoid a
+     * redundant second read on the hot path. The same `tokenStore` is
+     * still used for the post-refresh `save()` and the
+     * `invalid_grant` `clear()`.
+     */
+    loadedEntry?: LoadResult;
+    /** Aborts discovery + the refresh POST when fired. */
+    signal?: AbortSignal;
+    /**
+     * Forwarded to discovery. Loopback issuers are always permitted
+     * over http; this flag is the opt-in for non-loopback http.
+     */
+    allowInsecureIssuer?: boolean;
+    /**
+     * Called for soft warnings that are not errors but warrant user
+     * attention (e.g. a fresh `TokenSet` could not be written to the
+     * keychain, stranding the rotated refresh token — see the hazard
+     * note in the body of `getValidAccessToken`). The default prints
+     * to stderr only when stderr is a TTY. Pass a custom handler to
+     * route warnings through your own UI, or `() => {}` to suppress.
+     */
+    onWarning?: (message: string) => void;
+    /** Source of `now`. Defaults to `Date.now`. Injected for test determinism. */
+    now?: () => number;
+}
+/**
+ * Returns a currently-valid access token string for the given issuer,
+ * refreshing via the stored refresh token if the cached access token
+ * is within `expiryBufferMs` of expiring (or already expired).
+ *
+ * Throws `OAuthFlowError("NOT_AUTHENTICATED", ...)` when the user
+ * must re-run `axe-auth login` — covers an empty / corrupt /
+ * version-mismatched store, an expired access token with no refresh
+ * token to rotate with, and a refresh attempt rejected with
+ * `invalid_grant` (which also clears the stored tokens).
+ *
+ * Throws `OAuthFlowError("TOKEN_EXCHANGE_FAILED", ...)` for transient
+ * failures during refresh (network errors, 5xx, malformed responses)
+ * and leaves the stored tokens intact so a retry is possible.
+ *
+ * Throws `OAuthFlowError("DISCOVERY_FAILED", ...)` when the issuer
+ * URL cannot be reached or parsed at refresh time.
+ *
+ * **Concurrency note.** Not safe against parallel invocations for
+ * the same issuer. Keycloak rotates refresh tokens by default; if
+ * two parallel calls both land on the refresh path, only one
+ * winner's rotated refresh token will be persisted and the loser's
+ * rotated token is stranded. The intended consumer is the
+ * `axe-auth token` CLI (a one-shot), so this is fine in context;
+ * per-request callers should wrap in an in-flight-Promise singleton
+ * keyed by issuer.
+ */
+export declare function getValidAccessToken(options: GetValidAccessTokenOptions): Promise<string>;