@getbrevo/cli 0.0.1-alpha.1

package/dist/services/app.js

@@ -0,0 +1,117 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAppService = createAppService;
+const inquirer_1 = __importDefault(require("inquirer"));
+const constants_1 = require("../lib/constants");
+const errors_1 = require("../lib/errors");
+const exit_codes_1 = require("../lib/exit-codes");
+const logger_1 = require("../lib/logger");
+const ui_1 = require("../lib/ui");
+const en_1 = require("../lang/en");
+const config_1 = require("../lib/config");
+const normalize_app_id_1 = require("./normalize-app-id");
+/**
+ * Check apps exist and throw with user-facing message if empty.
+ */
+function logEmptyAndThrow() {
+    (0, logger_1.logInfo)(`\n  ${en_1.messages.APP_LIST_EMPTY}\n`);
+    throw new errors_1.CliError(en_1.messages.APP_LIST_EMPTY, exit_codes_1.EXIT_CODES.ERROR);
+}
+function createAppService(client) {
+    async function fetchAppsList() {
+        const apps = await client.get(constants_1.ENDPOINTS.OAUTH_APPS);
+        return (apps || []).map(normalize_app_id_1.normalizeAppId);
+    }
+    return {
+        fetchAppsList,
+        async fetchApp(appId) {
+            const app = await client.get(constants_1.ENDPOINTS.OAUTH_APP(appId));
+            return app ? (0, normalize_app_id_1.normalizeAppId)(app) : null;
+        },
+        async pickApp(promptMessage, formatChoice) {
+            const spinner = (0, ui_1.createSpinner)('Loading apps...');
+            const apps = await fetchAppsList();
+            spinner.stop();
+            if (apps.length === 0) {
+                logEmptyAndThrow();
+            }
+            const { selectedApp } = await inquirer_1.default.prompt([
+                {
+                    type: 'rawlist',
+                    name: 'selectedApp',
+                    message: promptMessage,
+                    choices: apps.map((a) => {
+                        const appName = a.name || 'App ' + a.app_id;
+                        return {
+                            name: formatChoice
+                                ? formatChoice(a)
+                                : `${appName}  (App ID: ${a.app_id}, Client ID: ${a.client_id})`,
+                            value: a.app_id,
+                        };
+                    }),
+                },
+            ]);
+            return selectedApp;
+        },
+        /**
+         * Fetch app from API and merge with local cache.
+         * The GET endpoint may not return client_secret (only shown at creation),
+         * so we fall back to the locally cached value.
+         */
+        async resolveAppCredentials(appId) {
+            const raw = await client.get(constants_1.ENDPOINTS.OAUTH_APP(appId));
+            if (!raw)
+                return null;
+            const app = (0, normalize_app_id_1.normalizeAppId)(raw);
+            const local = (0, config_1.getAppCredentials)(appId);
+            const diffs = [];
+            // Merge: prefer remote values, fall back to local cache for missing fields
+            if (local) {
+                if (!app.client_id && local.clientId) {
+                    app.client_id = local.clientId;
+                }
+                else if (local.clientId && local.clientId !== app.client_id) {
+                    diffs.push('client_id');
+                }
+                if (!app.client_secret && local.clientSecret) {
+                    app.client_secret = local.clientSecret;
+                }
+                else if (local.clientSecret && local.clientSecret !== app.client_secret) {
+                    diffs.push('client_secret');
+                }
+            }
+            return { app, diffs };
+        },
+        /**
+         * Save credentials to local cache.
+         * Preserves existing local values when the app has missing fields
+         * (e.g. GET endpoint doesn't return client_secret).
+         */
+        syncAppCredentials(appId, app) {
+            const existing = (0, config_1.getAppCredentials)(appId);
+            const clientId = app.client_id || existing?.clientId;
+            const clientSecret = app.client_secret || existing?.clientSecret;
+            // Only write if we have at least a client ID and a non-empty secret
+            if (clientId && clientSecret) {
+                (0, config_1.saveAppCredentials)(appId, { clientId, clientSecret });
+            }
+        },
+        async createApp(payload) {
+            const raw = await client.post(constants_1.ENDPOINTS.OAUTH_APPS, {
+                ...payload,
+                source: 'cli',
+            });
+            return (0, normalize_app_id_1.normalizeAppId)(raw);
+        },
+        async updateApp(appId, body) {
+            await client.put(constants_1.ENDPOINTS.APP_STORE_APP_UPDATE(appId), body);
+        },
+        async deleteApp(appId) {
+            await client.delete(constants_1.ENDPOINTS.OAUTH_APP(appId));
+        },
+    };
+}
+//# sourceMappingURL=app.js.map

package/dist/services/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../../src/services/app.ts"],"names":[],"mappings":";;;;;AAoBA,4CAiHC;AArID,wDAAgC;AAEhC,gDAA6C;AAC7C,0CAAyC;AACzC,kDAA+C;AAC/C,0CAAwC;AACxC,kCAA0C;AAC1C,mCAAsC;AAEtC,0CAAsE;AACtE,yDAAoD;AAEpD;;GAEG;AACH,SAAS,gBAAgB;IACvB,IAAA,gBAAO,EAAC,OAAO,aAAQ,CAAC,cAAc,IAAI,CAAC,CAAC;IAC5C,MAAM,IAAI,iBAAQ,CAAC,aAAQ,CAAC,cAAc,EAAE,uBAAU,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,SAAgB,gBAAgB,CAAC,MAAiB;IAChD,KAAK,UAAU,aAAa;QAC1B,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAa,qBAAS,CAAC,UAAU,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,iCAAc,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO;QACL,aAAa;QAEb,KAAK,CAAC,QAAQ,CAAC,KAAa;YAC1B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAW,qBAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;YACnE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAA,iCAAc,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1C,CAAC;QAED,KAAK,CAAC,OAAO,CACX,aAAqB,EACrB,YAAwC;YAExC,MAAM,OAAO,GAAG,IAAA,kBAAa,EAAC,iBAAiB,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,MAAM,aAAa,EAAE,CAAC;YACnC,OAAO,CAAC,IAAI,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,gBAAgB,EAAE,CAAC;YACrB,CAAC;YAED,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,kBAAQ,CAAC,MAAM,CAAC;gBAC5C;oBACE,IAAI,EAAE,SAAS;oBACf,IAAI,EAAE,aAAa;oBACnB,OAAO,EAAE,aAAa;oBACtB,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;wBACtB,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;wBAC5C,OAAO;4BACL,IAAI,EAAE,YAAY;gCAChB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;gCACjB,CAAC,CAAC,GAAG,OAAO,cAAc,CAAC,CAAC,MAAM,gBAAgB,CAAC,CAAC,SAAS,GAAG;4BAClE,KAAK,EAAE,CAAC,CAAC,MAAM;yBAChB,CAAC;oBACJ,CAAC,CAAC;iBACH;aACF,CAAC,CAAC;YACH,OAAO,WAAqB,CAAC;QAC/B,CAAC;QAED;;;;WAIG;QACH,KAAK,CAAC,qBAAqB,CAAC,KAAa;YACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAW,qBAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;YACnE,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,MAAM,GAAG,GAAG,IAAA,iCAAc,EAAC,GAAG,CAAC,CAAC;YAEhC,MAAM,KAAK,GAAG,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;YACvC,MAAM,KAAK,GAAa,EAAE,CAAC;YAE3B,2EAA2E;YAC3E,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;oBACrC,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC;gBACjC,CAAC;qBAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,GAAG,CAAC,SAAS,EAAE,CAAC;oBAC9D,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC1B,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;oBAC7C,GAAG,CAAC,aAAa,GAAG,KAAK,CAAC,YAAY,CAAC;gBACzC,CAAC;qBAAM,IAAI,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,KAAK,GAAG,CAAC,aAAa,EAAE,CAAC;oBAC1E,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC;YAED,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QACxB,CAAC;QAED;;;;WAIG;QACH,kBAAkB,CAAC,KAAa,EAAE,GAAa;YAC7C,MAAM,QAAQ,GAAG,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;YAC1C,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,IAAI,QAAQ,EAAE,QAAQ,CAAC;YACrD,MAAM,YAAY,GAAG,GAAG,CAAC,aAAa,IAAI,QAAQ,EAAE,YAAY,CAAC;YACjE,oEAAoE;YACpE,IAAI,QAAQ,IAAI,YAAY,EAAE,CAAC;gBAC7B,IAAA,2BAAkB,EAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,OAKf;YACC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAoB,qBAAS,CAAC,UAAU,EAAE;gBACrE,GAAG,OAAO;gBACV,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;YACH,OAAO,IAAA,iCAAc,EAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAED,KAAK,CAAC,SAAS,CACb,KAAa,EACb,IAAgD;YAEhD,MAAM,MAAM,CAAC,GAAG,CAAC,qBAAS,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;QAChE,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,KAAa;YAC3B,MAAM,MAAM,CAAC,MAAM,CAAC,qBAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAClD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/services/browser-auth.d.ts

@@ -0,0 +1,15 @@
+export interface OAuthTokens {
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+    tokenType: string;
+    scope?: string;
+}
+export interface RunBrowserLoginOptions {
+    proxyUrl: string;
+    timeoutMs?: number;
+    openBrowser?: (url: string) => void;
+    onWaiting?: (loginUrl: string) => void;
+}
+export declare function runBrowserLoginFlow(opts: RunBrowserLoginOptions): Promise<OAuthTokens>;
+//# sourceMappingURL=browser-auth.d.ts.map

package/dist/services/browser-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-auth.d.ts","sourceRoot":"","sources":["../../src/services/browser-auth.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;CACxC;AAsCD,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,WAAW,CAAC,CAkI5F"}

package/dist/services/browser-auth.js

@@ -0,0 +1,187 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runBrowserLoginFlow = runBrowserLoginFlow;
+const http = __importStar(require("node:http"));
+const node_crypto_1 = require("node:crypto");
+const logger_1 = require("../lib/logger");
+const errors_1 = require("../lib/errors");
+const en_1 = require("../lang/en");
+const MAX_BODY_BYTES = 16 * 1024;
+// 5 minutes — accommodates SSO/2FA flows where the user may need to fetch a
+// code from another device. 120s was too tight and routinely timed out mid-2FA.
+const DEFAULT_TIMEOUT_MS = 300_000;
+function normalizeTokens(raw) {
+    if (typeof raw.access_token !== 'string' ||
+        !raw.access_token ||
+        typeof raw.refresh_token !== 'string' ||
+        !raw.refresh_token ||
+        typeof raw.expires_in !== 'number' ||
+        !Number.isFinite(raw.expires_in) ||
+        raw.expires_in <= 0 ||
+        typeof raw.token_type !== 'string' ||
+        !raw.token_type) {
+        return null;
+    }
+    return {
+        accessToken: raw.access_token,
+        refreshToken: raw.refresh_token,
+        expiresIn: raw.expires_in,
+        tokenType: raw.token_type,
+        scope: typeof raw.scope === 'string' ? raw.scope : undefined,
+    };
+}
+async function runBrowserLoginFlow(opts) {
+    const proxyOrigin = new URL(opts.proxyUrl).origin;
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const openBrowser = opts.openBrowser ?? (() => { });
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const settle = (fn) => {
+            if (settled)
+                return;
+            settled = true;
+            fn();
+        };
+        const server = http.createServer((req, res) => {
+            const pathname = new URL(req.url ?? '/', 'http://127.0.0.1').pathname;
+            const origin = req.headers.origin;
+            (0, logger_1.logDebug)('loopback request', { method: req.method, url: req.url, pathname, origin });
+            if (req.method === 'OPTIONS' && pathname === '/callback') {
+                if (origin !== proxyOrigin) {
+                    (0, logger_1.logDebug)('loopback OPTIONS rejected: origin mismatch', { origin, expected: proxyOrigin });
+                    res.writeHead(403).end();
+                    return;
+                }
+                res
+                    .writeHead(204, {
+                    'Access-Control-Allow-Origin': proxyOrigin,
+                    'Access-Control-Allow-Methods': 'POST, OPTIONS',
+                    'Access-Control-Allow-Headers': 'Content-Type',
+                    'Access-Control-Max-Age': '600',
+                })
+                    .end();
+                return;
+            }
+            if (req.method === 'POST' && pathname === '/callback') {
+                if (origin !== proxyOrigin) {
+                    (0, logger_1.logDebug)('loopback POST rejected: origin mismatch', { origin, expected: proxyOrigin });
+                    res.writeHead(403).end();
+                    return;
+                }
+                let bytes = 0;
+                const chunks = [];
+                req.on('data', (chunk) => {
+                    bytes += chunk.length;
+                    if (bytes > MAX_BODY_BYTES) {
+                        (0, logger_1.logDebug)('loopback POST rejected: body too large', { bytes, max: MAX_BODY_BYTES });
+                        res.writeHead(413, { Connection: 'close' }).end();
+                        req.destroy();
+                        return;
+                    }
+                    chunks.push(chunk);
+                });
+                req.on('end', () => {
+                    let parsed = null;
+                    try {
+                        parsed = JSON.parse(Buffer.concat(chunks).toString('utf-8'));
+                    }
+                    catch {
+                        parsed = null;
+                    }
+                    const tokens = parsed ? normalizeTokens(parsed) : null;
+                    if (!tokens) {
+                        (0, logger_1.logDebug)('loopback POST rejected: bad payload shape', {
+                            hasParsed: parsed !== null,
+                            keys: parsed ? Object.keys(parsed) : null,
+                        });
+                        res
+                            .writeHead(400, {
+                            'Access-Control-Allow-Origin': proxyOrigin,
+                            'Content-Type': 'text/plain',
+                        })
+                            .end('Bad payload');
+                        return;
+                    }
+                    (0, logger_1.logDebug)('loopback POST accepted', { hasScope: tokens.scope !== undefined });
+                    res.writeHead(204, { 'Access-Control-Allow-Origin': proxyOrigin }).end();
+                    settle(() => {
+                        server.close();
+                        resolve(tokens);
+                    });
+                });
+                return;
+            }
+            if (req.method === 'GET' && (pathname === '/' || pathname === '/callback')) {
+                res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+                res.end('<!doctype html><meta charset="utf-8"><title>Brevo CLI login</title>' +
+                    '<p>Waiting for login to complete — you can close this tab once the CLI confirms success.</p>');
+                return;
+            }
+            (0, logger_1.logDebug)('loopback request not matched', { method: req.method, pathname });
+            res.writeHead(404).end();
+        });
+        server.on('error', (err) => {
+            (0, logger_1.logDebug)('loopback server error', { message: err.message });
+            settle(() => reject(err));
+        });
+        server.listen(0, '127.0.0.1', () => {
+            const port = server.address().port;
+            // Unique per-attempt token. If a previous attempt timed out mid-flow,
+            // the browser may still have a tab open at the proxy showing an error;
+            // a unique URL forces a fresh navigation instead of reusing that tab,
+            // and prevents the proxy/browser from serving a cached response.
+            const attemptToken = (0, node_crypto_1.randomUUID)();
+            const loginUrl = `${opts.proxyUrl}/login?port=${port}&t=${attemptToken}`;
+            (0, logger_1.logDebug)('loopback listening', { host: '127.0.0.1', port, proxyOrigin });
+            opts.onWaiting?.(loginUrl);
+            try {
+                openBrowser(loginUrl);
+            }
+            catch {
+                // best-effort — URL already surfaced via onWaiting
+            }
+        });
+        const timer = setTimeout(() => {
+            settle(() => {
+                server.close();
+                reject(new errors_1.CliError(en_1.messages.AUTH_BROWSER_TIMEOUT));
+            });
+        }, timeoutMs);
+        timer.unref?.();
+        server.on('close', () => clearTimeout(timer));
+    });
+}
+//# sourceMappingURL=browser-auth.js.map

package/dist/services/browser-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-auth.js","sourceRoot":"","sources":["../../src/services/browser-auth.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0DA,kDAkIC;AA5LD,gDAAkC;AAClC,6CAAyC;AAEzC,0CAAyC;AACzC,0CAAyC;AACzC,mCAAsC;AAiBtC,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC;AACjC,4EAA4E;AAC5E,gFAAgF;AAChF,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAUnC,SAAS,eAAe,CAAC,GAAoB;IAC3C,IACE,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;QACpC,CAAC,GAAG,CAAC,YAAY;QACjB,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ;QACrC,CAAC,GAAG,CAAC,aAAa;QAClB,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ;QAClC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC;QAChC,GAAG,CAAC,UAAU,IAAI,CAAC;QACnB,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ;QAClC,CAAC,GAAG,CAAC,UAAU,EACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,KAAK,EAAE,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;KAC7D,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,mBAAmB,CAAC,IAA4B;IACpE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAEnD,OAAO,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAClD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,EAAc,EAAE,EAAE;YAChC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,EAAE,EAAE,CAAC;QACP,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC;YACtE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;YAClC,IAAA,iBAAQ,EAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAErF,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACzD,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;oBAC3B,IAAA,iBAAQ,EAAC,4CAA4C,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;oBAC1F,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;oBACzB,OAAO;gBACT,CAAC;gBACD,GAAG;qBACA,SAAS,CAAC,GAAG,EAAE;oBACd,6BAA6B,EAAE,WAAW;oBAC1C,8BAA8B,EAAE,eAAe;oBAC/C,8BAA8B,EAAE,cAAc;oBAC9C,wBAAwB,EAAE,KAAK;iBAChC,CAAC;qBACD,GAAG,EAAE,CAAC;gBACT,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACtD,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;oBAC3B,IAAA,iBAAQ,EAAC,yCAAyC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;oBACvF,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;oBACzB,OAAO;gBACT,CAAC;gBAED,IAAI,KAAK,GAAG,CAAC,CAAC;gBACd,MAAM,MAAM,GAAa,EAAE,CAAC;gBAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;oBAC/B,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;oBACtB,IAAI,KAAK,GAAG,cAAc,EAAE,CAAC;wBAC3B,IAAA,iBAAQ,EAAC,wCAAwC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,CAAC;wBACnF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;wBAClD,GAAG,CAAC,OAAO,EAAE,CAAC;wBACd,OAAO;oBACT,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC,CAAC,CAAC;gBACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACjB,IAAI,MAAM,GAA2B,IAAI,CAAC;oBAC1C,IAAI,CAAC;wBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAoB,CAAC;oBAClF,CAAC;oBAAC,MAAM,CAAC;wBACP,MAAM,GAAG,IAAI,CAAC;oBAChB,CAAC;oBACD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;oBACvD,IAAI,CAAC,MAAM,EAAE,CAAC;wBACZ,IAAA,iBAAQ,EAAC,2CAA2C,EAAE;4BACpD,SAAS,EAAE,MAAM,KAAK,IAAI;4BAC1B,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;yBAC1C,CAAC,CAAC;wBACH,GAAG;6BACA,SAAS,CAAC,GAAG,EAAE;4BACd,6BAA6B,EAAE,WAAW;4BAC1C,cAAc,EAAE,YAAY;yBAC7B,CAAC;6BACD,GAAG,CAAC,aAAa,CAAC,CAAC;wBACtB,OAAO;oBACT,CAAC;oBACD,IAAA,iBAAQ,EAAC,wBAAwB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC,CAAC;oBAC7E,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,6BAA6B,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;oBACzE,MAAM,CAAC,GAAG,EAAE;wBACV,MAAM,CAAC,KAAK,EAAE,CAAC;wBACf,OAAO,CAAC,MAAM,CAAC,CAAC;oBAClB,CAAC,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,WAAW,CAAC,EAAE,CAAC;gBAC3E,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;gBACnE,GAAG,CAAC,GAAG,CACL,qEAAqE;oBACnE,8FAA8F,CACjG,CAAC;gBACF,OAAO;YACT,CAAC;YAED,IAAA,iBAAQ,EAAC,8BAA8B,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC3E,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,IAAA,iBAAQ,EAAC,uBAAuB,EAAE,EAAE,OAAO,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACvE,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,CAAC;YACpD,sEAAsE;YACtE,uEAAuE;YACvE,sEAAsE;YACtE,iEAAiE;YACjE,MAAM,YAAY,GAAG,IAAA,wBAAU,GAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,QAAQ,eAAe,IAAI,MAAM,YAAY,EAAE,CAAC;YACzE,IAAA,iBAAQ,EAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;YACzE,IAAI,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,CAAC;YAC3B,IAAI,CAAC;gBACH,WAAW,CAAC,QAAQ,CAAC,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,mDAAmD;YACrD,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,GAAG,EAAE;gBACV,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,iBAAQ,CAAC,aAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC;YACtD,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAEhB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/services/normalize-app-id.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Coerce `app_id` on an API response object to a string.
+ * Defensive boundary in case the server still returns a number for a legacy app.
+ * Fails fast on unexpected types so invalid server responses never propagate as
+ * bogus IDs (e.g. "undefined", "[object Object]") into requests or credential keys.
+ */
+export declare function normalizeAppId<T extends {
+    app_id: unknown;
+}>(raw: T): Omit<T, 'app_id'> & {
+    app_id: string;
+};
+//# sourceMappingURL=normalize-app-id.d.ts.map

package/dist/services/normalize-app-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize-app-id.d.ts","sourceRoot":"","sources":["../../src/services/normalize-app-id.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,EAC1D,GAAG,EAAE,CAAC,GACL,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAkBxC"}

package/dist/services/normalize-app-id.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeAppId = normalizeAppId;
+const errors_1 = require("../lib/errors");
+/**
+ * Coerce `app_id` on an API response object to a string.
+ * Defensive boundary in case the server still returns a number for a legacy app.
+ * Fails fast on unexpected types so invalid server responses never propagate as
+ * bogus IDs (e.g. "undefined", "[object Object]") into requests or credential keys.
+ */
+function normalizeAppId(raw) {
+    const { app_id } = raw;
+    if (typeof app_id === 'string') {
+        const trimmed = app_id.trim();
+        if (trimmed.length === 0) {
+            throw new errors_1.CliError('Invalid app_id in API response: expected non-empty string, received empty string.');
+        }
+        return { ...raw, app_id: trimmed };
+    }
+    if (typeof app_id === 'number' && Number.isFinite(app_id)) {
+        return { ...raw, app_id: String(app_id) };
+    }
+    const received = describeAppId(app_id);
+    throw new errors_1.CliError(`Invalid app_id in API response: expected string or finite number, received ${received}.`);
+}
+function describeAppId(value) {
+    if (value === null)
+        return 'null';
+    if (typeof value === 'number') {
+        if (Number.isNaN(value))
+            return 'number (NaN)';
+        if (!Number.isFinite(value))
+            return `number (${value > 0 ? 'Infinity' : '-Infinity'})`;
+        return 'number';
+    }
+    return typeof value;
+}
+//# sourceMappingURL=normalize-app-id.js.map

package/dist/services/normalize-app-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize-app-id.js","sourceRoot":"","sources":["../../src/services/normalize-app-id.ts"],"names":[],"mappings":";;AAQA,wCAoBC;AA5BD,0CAAyC;AAEzC;;;;;GAKG;AACH,SAAgB,cAAc,CAC5B,GAAM;IAEN,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IACvB,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,iBAAQ,CAChB,mFAAmF,CACpF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACrC,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,IAAI,iBAAQ,CAChB,8EAA8E,QAAQ,GAAG,CAC1F,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;YAAE,OAAO,cAAc,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,WAAW,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC;QACvF,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,OAAO,KAAK,CAAC;AACtB,CAAC"}

package/dist/services/oauth-refresh.d.ts

@@ -0,0 +1,14 @@
+export interface RefreshedTokens {
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+    tokenType: string;
+    scope?: string;
+}
+export declare class RefreshError extends Error {
+    readonly unauthorized: boolean;
+    readonly cause?: unknown | undefined;
+    constructor(message: string, unauthorized: boolean, cause?: unknown | undefined);
+}
+export declare function refreshAccessToken(refreshToken: string, proxyUrl: string): Promise<RefreshedTokens>;
+//# sourceMappingURL=oauth-refresh.d.ts.map

package/dist/services/oauth-refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-refresh.d.ts","sourceRoot":"","sources":["../../src/services/oauth-refresh.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,YAAa,SAAQ,KAAK;aAGnB,YAAY,EAAE,OAAO;aACrB,KAAK,CAAC,EAAE,OAAO;gBAF/B,OAAO,EAAE,MAAM,EACC,YAAY,EAAE,OAAO,EACrB,KAAK,CAAC,EAAE,OAAO,YAAA;CAKlC;AAED,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,eAAe,CAAC,CAgE1B"}

package/dist/services/oauth-refresh.js

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RefreshError = void 0;
+exports.refreshAccessToken = refreshAccessToken;
+class RefreshError extends Error {
+    unauthorized;
+    cause;
+    constructor(message, unauthorized, cause) {
+        super(message);
+        this.unauthorized = unauthorized;
+        this.cause = cause;
+        this.name = 'RefreshError';
+    }
+}
+exports.RefreshError = RefreshError;
+async function refreshAccessToken(refreshToken, proxyUrl) {
+    let res;
+    try {
+        res = await fetch(`${proxyUrl}/refresh`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Accept: 'application/json',
+            },
+            body: JSON.stringify({ refresh_token: refreshToken }),
+            signal: AbortSignal.timeout(15_000),
+        });
+    }
+    catch (err) {
+        throw new RefreshError('Could not reach the Brevo login service.', false, err);
+    }
+    if (!res.ok) {
+        throw new RefreshError(`Token refresh failed (${res.status}).`, res.status === 401);
+    }
+    let body;
+    try {
+        body = (await res.json());
+    }
+    catch (err) {
+        throw new RefreshError('Malformed refresh response from login service.', false, err);
+    }
+    if (!body.access_token ||
+        typeof body.access_token !== 'string' ||
+        typeof body.expires_in !== 'number' ||
+        !Number.isFinite(body.expires_in) ||
+        body.expires_in <= 0 ||
+        !body.token_type ||
+        typeof body.token_type !== 'string') {
+        throw new RefreshError('Malformed refresh response from login service.', false);
+    }
+    // refresh_token rotation is optional (proxies often only mint a new one
+    // when the old one is close to expiry). When the field is present it must
+    // be a non-empty string — `??` would let an empty string slip through and
+    // get persisted as a permanently-broken refresh token.
+    let resolvedRefreshToken = refreshToken;
+    if (body.refresh_token !== undefined) {
+        if (typeof body.refresh_token !== 'string' || body.refresh_token.length === 0) {
+            throw new RefreshError('Malformed refresh response from login service.', false);
+        }
+        resolvedRefreshToken = body.refresh_token;
+    }
+    return {
+        accessToken: body.access_token,
+        refreshToken: resolvedRefreshToken,
+        expiresIn: body.expires_in,
+        tokenType: body.token_type,
+        scope: body.scope,
+    };
+}
+//# sourceMappingURL=oauth-refresh.js.map

package/dist/services/oauth-refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-refresh.js","sourceRoot":"","sources":["../../src/services/oauth-refresh.ts"],"names":[],"mappings":";;;AAmBA,gDAmEC;AA9ED,MAAa,YAAa,SAAQ,KAAK;IAGnB;IACA;IAHlB,YACE,OAAe,EACC,YAAqB,EACrB,KAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,iBAAY,GAAZ,YAAY,CAAS;QACrB,UAAK,GAAL,KAAK,CAAU;QAG/B,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AATD,oCASC;AAEM,KAAK,UAAU,kBAAkB,CACtC,YAAoB,EACpB,QAAgB;IAEhB,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,UAAU,EAAE;YACvC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;YACrD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,YAAY,CAAC,0CAA0C,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,YAAY,CAAC,yBAAyB,GAAG,CAAC,MAAM,IAAI,EAAE,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;IACtF,CAAC;IAED,IAAI,IAMH,CAAC;IACF,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAgB,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,YAAY,CAAC,gDAAgD,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACvF,CAAC;IAED,IACE,CAAC,IAAI,CAAC,YAAY;QAClB,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ;QACrC,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;QACnC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;QACjC,IAAI,CAAC,UAAU,IAAI,CAAC;QACpB,CAAC,IAAI,CAAC,UAAU;QAChB,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,EACnC,CAAC;QACD,MAAM,IAAI,YAAY,CAAC,gDAAgD,EAAE,KAAK,CAAC,CAAC;IAClF,CAAC;IAED,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,uDAAuD;IACvD,IAAI,oBAAoB,GAAG,YAAY,CAAC;IACxC,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACrC,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,YAAY,CAAC,gDAAgD,EAAE,KAAK,CAAC,CAAC;QAClF,CAAC;QACD,oBAAoB,GAAG,IAAI,CAAC,aAAa,CAAC;IAC5C,CAAC;IAED,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,YAAY,EAAE,oBAAoB;QAClC,SAAS,EAAE,IAAI,CAAC,UAAU;QAC1B,SAAS,EAAE,IAAI,CAAC,UAAU;QAC1B,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC;AACJ,CAAC"}

package/dist/templates/files/AGENTS.md.tmpl

@@ -0,0 +1,41 @@
+# {{APP_NAME}} — Agent Context
+
+This project is a Brevo OAuth 2.0 integration scaffolded with the Brevo CLI.
+
+> **This is a test app** for local OAuth testing. Not for production use.
+
+## What this does
+Implements the authorization code flow to obtain access tokens for the Brevo API.
+
+## Project structure
+```
+src/
+  oauth/               Self-contained OAuth test feature
+    package.json            Dependencies and scripts
+    server.js               Test server — Express app + dotenv + routes
+    handler.js              OAuth routes (/auth/login, /auth/callback)
+    token-store.js          In-memory token management (swap for DB in production)
+    .env.example            Credential template (safe to commit)
+    .env.local              Local credentials (gitignored — never commit)
+app-config.json             App metadata (app ID, redirect URIs, permissions)
+```
+
+## OAuth server
+- OAuth uses realm-based paths: `/realms/{realm}/oauth/...`
+- Default realm: `partner`
+- Token endpoint expects `application/x-www-form-urlencoded` body (not query params)
+- Supported grant types: `authorization_code`, `refresh_token`, `client_credentials`
+
+## OAuth flow
+1. `/auth/login` — generates CSRF state, redirects user to `{OAUTH_BASE}/realms/{realm}/oauth/authorize`
+2. User authorizes -> OAuth server redirects to `/auth/callback` with an auth code
+3. Server validates state, exchanges code for access + refresh tokens via `POST /realms/{realm}/oauth/token`
+4. Verifies connection via `GET /realms/{realm}/oauth/userinfo`
+5. `/auth/refresh` — refreshes tokens using `refresh_token` grant
+
+## Development
+```bash
+yarn --cwd src/oauth
+# or: npm --prefix src/oauth install
+brevo app start oauth        # http://localhost:3009
+```

package/dist/templates/files/CLAUDE.md.tmpl

@@ -0,0 +1,50 @@
+# CLAUDE.md — {{APP_NAME}}
+
+## Project
+Brevo OAuth integration for app `{{CLIENT_ID}}`.
+Scaffolded with the [Brevo CLI](https://github.com/getbrevo/brevo-cli).
+
+> **This is a test app** scaffolded by the Brevo CLI to help you test your OAuth integration locally.
+
+## Run
+```bash
+yarn --cwd src/oauth
+# or: npm --prefix src/oauth install
+brevo app start oauth        # starts OAuth test server on http://localhost:3009
+```
+
+## Structure
+```
+src/
+  oauth/               Self-contained OAuth test feature
+    package.json            Dependencies and scripts
+    server.js               Test server entry point
+    handler.js              OAuth routes (/auth/login, /auth/callback)
+    token-store.js          In-memory token store
+    .env.example            Credential template (committed)
+    .env.local              Local credentials (gitignored — never commit)
+app-config.json             App metadata
+```
+
+## OAuth server
+- OAuth endpoints use realm-based paths: `/realms/{realm}/oauth/...`
+- Default realm: `partner`
+- Env vars `OAUTH_BASE` and `OAUTH_REALM` control the OAuth server and realm
+
+### Endpoints used
+| Endpoint | Purpose |
+|----------|---------|
+| `GET /realms/{realm}/oauth/authorize` | Authorization (redirect user here) |
+| `POST /realms/{realm}/oauth/token` | Exchange code or refresh token for access token |
+| `GET /realms/{realm}/oauth/userinfo` | Fetch user profile with Bearer token |
+| `POST /realms/{realm}/oauth/revoke` | Revoke a token |
+| `POST /realms/{realm}/oauth/introspect` | Token introspection (RFC 7662) |
+| `GET /realms/{realm}/.well-known/openid-configuration` | OIDC discovery |
+
+## Key flows
+- `/auth/login` — generates random CSRF state, redirects to OAuth authorize endpoint
+- `/auth/callback` — validates state, POSTs code to `/realms/{realm}/oauth/token`, stores tokens
+- `/auth/refresh` — refreshes tokens using `refresh_token` grant
+
+## Next steps
+- Replace in-memory token store with a real database