@iwas/mcp 0.0.0-stage → 1.0.1

package/dist/auth/index.d.ts

@@ -0,0 +1,631 @@
+/**
+ * MCP Authentication & Credential Types
+ *
+ * Implements StoredMcpCredentials, profile key normalization,
+ * and security-hardened credential redaction (DEV-08 / RFC 8628).
+ */
+interface McpCredentials {
+    accessToken: string;
+    refreshToken?: string;
+    expiresAt?: number;
+    tokenType?: string;
+    scope?: string;
+}
+interface StoredMcpCredentials {
+    serverUrl: string;
+    clientId: string;
+    accessToken: string;
+    refreshToken?: string;
+    tokenType: string;
+    scope?: string;
+    resource?: string;
+    organizationId: string | null;
+    expiresAt: number;
+    updatedAt?: number;
+}
+type VaultBackendType = 'keychain' | 'file' | 'auto';
+/**
+ * Validates that an object conforms to the StoredMcpCredentials contract.
+ */
+declare function isValidStoredCredentials(obj: unknown): obj is StoredMcpCredentials;
+/**
+ * Normalizes a server URL and client ID into a canonical profile key.
+ * Format: `<canonical_origin>::<client_id>`
+ * Example: `https://getiwas.com::iwas-cli`
+ *
+ * Notes:
+ * - Scheme check is case-insensitive per RFC 3986 (n1 fix).
+ * - Server origin is lowercased and stripped of trailing slashes.
+ * - Client ID is case-preserving per OAuth 2.1 (RFC 6749 §2.2).
+ * - Never includes tokens or sensitive parameters in the key.
+ */
+declare function normalizeProfileKey(serverUrl: string, clientId: string): string;
+/**
+ * Redacts secret token material from credential objects for safe logging & diagnostics.
+ * Completely replaces access and refresh tokens with '[REDACTED]' to avoid leaking prefixes.
+ */
+declare function redactCredentials(creds: StoredMcpCredentials | McpCredentials): Record<string, unknown>;
+/**
+ * Strips secret tokens from error messages or arbitrary strings.
+ * Requires minimum length >= 4 to avoid corrupting short message substrings (n5 fix).
+ */
+declare function sanitizeSecretString(input: string, secrets: (string | undefined)[]): string;
+/**
+ * Checks whether credentials have expired or are within a clock-skew window.
+ * Supports both epoch milliseconds and epoch seconds.
+ */
+declare function isCredentialExpired(creds: StoredMcpCredentials, skewSeconds?: number): boolean;
+
+/**
+ * OS Keychain Integration
+ *
+ * Implements native credential storage on macOS (security) and Linux (secret-tool).
+ * Windows and headless fallback environments defer to file vault (DEV-08).
+ *
+ * Security considerations:
+ * - Commands executed with `spawn` (shell: false, no string interpolation).
+ * - On Linux, secrets are piped via stdin to prevent `ps` argument visibility.
+ * - Errors sanitize and redact all secret strings before throwing.
+ * - Subprocesses bounded by default 5000ms timeout to prevent hanging CLI.
+ */
+interface KeychainRunResult {
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+}
+interface KeychainCommandRunner {
+    spawn(command: string, args: string[], options?: {
+        input?: string;
+        timeoutMs?: number;
+    }): Promise<KeychainRunResult>;
+}
+declare class DefaultKeychainRunner implements KeychainCommandRunner {
+    private readonly defaultTimeoutMs;
+    constructor(defaultTimeoutMs?: number);
+    spawn(command: string, args: string[], options?: {
+        input?: string;
+        timeoutMs?: number;
+    }): Promise<KeychainRunResult>;
+}
+interface KeychainOptions {
+    serviceName?: string;
+    runner?: KeychainCommandRunner;
+    platform?: NodeJS.Platform;
+}
+declare const DEFAULT_KEYCHAIN_SERVICE = "iwas-cli";
+declare class KeychainService {
+    private readonly service;
+    private readonly runner;
+    private readonly platform;
+    constructor(options?: KeychainOptions);
+    private availableCache;
+    /**
+     * Returns the configured OS platform.
+     */
+    getPlatform(): NodeJS.Platform;
+    /**
+     * Probes whether the host environment has an operable keychain utility.
+     * Results are cached when available to avoid unnecessary subprocess spawns (n7 fix).
+     */
+    isAvailable(forceProbe?: boolean): Promise<boolean>;
+    /**
+     * Clears the cached isAvailable probe result. Useful for testing and environment shifts.
+     */
+    clearAvailabilityCache(): void;
+    /**
+     * Retrieves a secret password string by account identifier.
+     */
+    getSecret(account: string): Promise<string | null>;
+    /**
+     * Stores a secret password under the given account identifier.
+     */
+    setSecret(account: string, secret: string, label?: string): Promise<void>;
+    /**
+     * Deletes a secret from the keychain. Operation is strictly idempotent.
+     */
+    deleteSecret(account: string): Promise<void>;
+}
+
+/**
+ * MCP Credential Vault
+ *
+ * Implements secure storage for RFC 8628 Device Flow credentials with:
+ * - Native OS Keychain support (macOS security & Linux secret-tool)
+ * - Atomic filesystem fallback (~/.config/iwas/credentials.json, dir 0700, file 0600)
+ * - Strict vs Auto backend synchronization (DEV-08, Major 1 & 2 fixes)
+ * - Fail-closed corrupt JSON protection & token redaction
+ */
+
+interface CredentialVaultOptions {
+    vaultType?: VaultBackendType;
+    serviceName?: string;
+    configDir?: string;
+    keychainRunner?: KeychainCommandRunner;
+    keychainService?: KeychainService;
+}
+declare class CredentialVault {
+    private readonly vaultType;
+    private readonly configDir;
+    private readonly credentialsFilePath;
+    private readonly keychain;
+    constructor(options?: CredentialVaultOptions);
+    /**
+     * Returns the configuration directory for this vault (~/.config/iwas).
+     */
+    getConfigDir(): string;
+    /**
+     * Returns the credentials file path (~/.config/iwas/credentials.json).
+     */
+    getCredentialsFilePath(): string;
+    /**
+     * Returns the resolved vault mode: 'keychain' or 'file'.
+     * In strict 'keychain' mode, throws if OS keychain is unavailable.
+     */
+    getEffectiveBackend(): Promise<'keychain' | 'file'>;
+    /**
+     * Retrieves stored credentials by profile key.
+     * In auto mode, checks keychain first; falls back to file if missing or failed.
+     * Compares timestamps if both exist and migrates newer file credentials to keychain (Medium fix).
+     */
+    load(profileKey: string): Promise<StoredMcpCredentials | null>;
+    /**
+     * Persists credentials for the given profile key.
+     * When saving to keychain, purges any stale copy from the file fallback (Major 1).
+     */
+    save(profileKey: string, credentials: StoredMcpCredentials): Promise<void>;
+    /**
+     * Removes credentials for the given profile key.
+     * Cleanses BOTH Keychain and File fallback to prevent plaintext leakage (Major 1).
+     * In auto mode, throws if keychain is available but secret deletion fails (Major fix).
+     */
+    delete(profileKey: string): Promise<void>;
+    /**
+     * Lists all stored profile keys.
+     * In auto mode, merges profiles from both Keychain and File.
+     */
+    listProfiles(): Promise<string[]>;
+    private readKeychainIndex;
+    private addProfileToKeychainIndex;
+    private removeProfileFromKeychainIndex;
+    private ensureConfigDirectory;
+    private readAllFromFile;
+    private writeAllToFile;
+    private loadFromFile;
+    private saveToFile;
+    private deleteFromFile;
+    private listProfilesFromFile;
+}
+
+/**
+ * HTTP Client & RFC 8628 Network Utilities
+ *
+ * Implements bounded timeouts, exponential backoff with jitter for transient errors,
+ * structured JSON/Form serialization, and strict secret redaction (DEV-09).
+ */
+interface RequestOptions {
+    method?: 'GET' | 'POST' | 'DELETE' | 'PUT';
+    headers?: Record<string, string>;
+    body?: string | URLSearchParams | Record<string, unknown>;
+    timeoutMs?: number;
+    retries?: number;
+    fetchFn?: typeof fetch;
+}
+interface HttpResponse<T = unknown> {
+    status: number;
+    ok: boolean;
+    headers: Headers;
+    data: T;
+}
+declare class HttpError extends Error {
+    readonly status: number;
+    readonly data: unknown;
+    constructor(message: string, status: number, data?: unknown);
+}
+/**
+ * Executes an HTTP fetch with timeout and bounded exponential retries for transient 5xx errors.
+ */
+declare function sendRequest<T = unknown>(url: string, options?: RequestOptions): Promise<HttpResponse<T>>;
+
+/**
+ * MCP CLI Logout & Server Grant Revocation (DEV-11)
+ *
+ * Implements server-side session and OAuth grant revocation for RFC 8628 Device Flow:
+ * 1. Resolves stored credentials for the server profile.
+ * 2. Calls POST /api/v1/mcp-session/logout with bearer/DPoP credentials to atomically
+ *    revoke all user consents and live tokens server-side.
+ * 3. Calls POST /api/auth/oauth2/revoke with refresh_token (defense-in-depth RFC 7009).
+ * 4. Clears local vault credentials only after successful server revocation (or with --force).
+ * 5. Strictly protects against token leakage in log or error output.
+ */
+
+interface LogoutOptions {
+    server?: string;
+    clientId?: string;
+    force?: boolean;
+    json?: boolean;
+    vault?: CredentialVault;
+    fetchFn?: typeof fetch;
+    logger?: (msg: string) => void;
+    errorLogger?: (msg: string) => void;
+}
+interface LogoutResult {
+    success: boolean;
+    profileKey: string;
+    serverRevoked: boolean;
+    refreshTokenRevoked: boolean;
+    localCleared: boolean;
+    message: string;
+}
+/**
+ * Logs out from the specified server profile:
+ * - Revokes user session and OAuth consent at /api/v1/mcp-session/logout
+ * - Revokes refresh token at /api/auth/oauth2/revoke (RFC 7009)
+ * - Removes local credentials from the vault on success or with --force
+ */
+declare function executeLogout(options?: LogoutOptions): Promise<LogoutResult>;
+
+/**
+ * RFC 8628 OAuth 2.0 Device Authorization Grant CLI Client
+ *
+ * Implements end-to-end device authorization flow:
+ * - Safe URL resolution (auth origin vs MCP resource)
+ * - Device code acquisition & user code display (device_code never logged)
+ * - RFC 8628 polling state machine (slow_down +5s, authorization_pending, expiry, denial)
+ * - In-memory JWT payload decoding for metadata and audience/scope verification
+ * - Persistence to OS Keychain via CredentialVault (DEV-08)
+ */
+
+declare const DEFAULT_CLI_CLIENT_ID = "iwas-cli";
+declare const DEFAULT_SERVER_URL = "https://getiwas.com";
+/**
+ * Canonical read-only scopes eligible for MCP tool usage.
+ * Derived dynamically from MCP_ELIGIBLE_PERMISSIONS to maintain a single source of truth.
+ * Mutating/destructive actions (:create, :update, :delete, :control, :manage, :issue, :revoke, :publish, :write)
+ * are excluded from default scopes to enforce strict least-privilege.
+ * Role-based permission boundaries (such as platform vs tenant scopes) are strictly enforced by the server's RBAC engine.
+ */
+declare const DEFAULT_READ_ONLY_SCOPES: readonly string[];
+/**
+ * Least-privilege default scopes: all read-only capability scopes plus offline_access for refresh grants.
+ */
+declare const DEFAULT_SCOPES: string;
+declare const DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+interface DeviceAuthorizationResponse {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete: string;
+    expires_in: number;
+    interval: number;
+}
+interface OAuthTokenSuccessResponse {
+    access_token: string;
+    token_type: string;
+    expires_in: number;
+    refresh_token?: string;
+    scope?: string;
+}
+interface OAuthTokenErrorResponse {
+    error: string;
+    error_description?: string;
+}
+interface DeviceLoginOptions {
+    server?: string;
+    resource?: string;
+    clientId?: string;
+    scopes?: string;
+    noBrowser?: boolean;
+    json?: boolean;
+    vault?: CredentialVault;
+    logger?: (msg: string) => void;
+    errorLogger?: (msg: string) => void;
+    pollTimeoutMs?: number;
+    browserOpener?: (url: string) => boolean;
+    spawnFn?: SpawnFunction;
+}
+interface DeviceLoginResult {
+    profileKey: string;
+    serverUrl: string;
+    clientId: string;
+    organizationId: string | null;
+    scope?: string;
+    resource?: string;
+    expiresAt: number;
+}
+/**
+ * Validates that candidate scopes are all supported in MCP_OAUTH_SCOPES
+ * and that at least one capability scope besides offline_access is requested.
+ */
+declare function validateScopes(scopesString: string): {
+    valid: boolean;
+    invalidScopes: string[];
+    error?: string;
+};
+/**
+ * Checks whether a hostname corresponds to loopback/localhost (IPv4 or IPv6).
+ */
+declare function isLocalhost(hostname: string): boolean;
+/**
+ * Resolves and validates the Auth Server Origin.
+ * Strips trailing slashes, ensures HTTPS outside localhost, rejects non-root paths,
+ * and strictly rejects resource URLs ending in /mcp as the server base.
+ */
+declare function resolveAuthServerUrl(input?: string): string;
+/**
+ * Resolves the target MCP OAuth resource URL (default: `${server}/mcp`).
+ * Enforces HTTPS outside localhost matching server origin validation rules.
+ */
+declare function resolveMcpResourceUrl(serverUrl: string, input?: string): string;
+/**
+ * Decodes a JWT payload locally for display and metadata extraction.
+ * Does NOT perform signature validation (that is solely the server's responsibility).
+ */
+declare function decodeJwtPayload(token: string): Record<string, unknown>;
+type SpawnFunction = (command: string, args: readonly string[], options: {
+    detached?: boolean;
+    stdio?: string;
+}) => {
+    on: (event: string, listener: (...args: unknown[]) => void) => unknown;
+    unref: () => void;
+};
+/**
+ * Best-effort cross-platform browser launch.
+ * Handles process errors safely to prevent uncaught ENOENT crashes on headless environments.
+ */
+declare function openBrowser(url: string, spawnFn?: SpawnFunction, onWarning?: (msg: string) => void): boolean;
+/**
+ * Step 1: Obtains a device authorization code from the server.
+ */
+declare function requestDeviceCode(serverUrl: string, params: {
+    clientId: string;
+    scope: string;
+    resource: string;
+}): Promise<DeviceAuthorizationResponse>;
+/**
+ * Step 2: Polls the OAuth2 token endpoint until user approves or flow terminates.
+ */
+declare function pollDeviceToken(serverUrl: string, params: {
+    clientId: string;
+    deviceCode: string;
+    resource: string;
+    initialInterval?: number;
+    timeoutMs?: number;
+}, onPollTick?: (status: string) => void): Promise<OAuthTokenSuccessResponse>;
+/**
+ * Orchestrates the full login flow, saves credentials in vault, and formats output.
+ */
+declare function executeLogin(options?: DeviceLoginOptions): Promise<DeviceLoginResult>;
+/**
+ * Checks and outputs stored authentication status for the given profile.
+ */
+declare function executeStatus(options?: {
+    server?: string;
+    clientId?: string;
+    json?: boolean;
+    vault?: CredentialVault;
+    logger?: (msg: string) => void;
+}): Promise<void>;
+
+/**
+ * MCP Vault Cross-Process Lock
+ *
+ * Implements atomic cross-process file locking for credential operations (DEV-10).
+ * Prevents race conditions and refresh-token family destruction when multiple CLI
+ * commands or agent processes refresh tokens concurrently.
+ *
+ * Key guarantees:
+ * - Atomic acquisition via 'wx' flag (O_CREAT | O_EXCL) with mode 0600.
+ * - Stale lock detection via process liveness probe: Never reclaims a lock held by a live process.
+ * - TOCTOU-safe stale reclamation via hardlink + nlink verification (fail-closed without hardlinks).
+ * - Ownership & inode verification: Never unlinks or overwrites a lock owned by another process.
+ * - Non-intrusive parent directory permissions: Only restricts dedicated app directories, never arbitrary caller paths.
+ * - Guaranteed release in finally block on all paths.
+ */
+declare class VaultLockError extends Error {
+    constructor(message: string);
+}
+declare class VaultLockTimeoutError extends VaultLockError {
+    readonly lockPath: string;
+    readonly timeoutMs: number;
+    constructor(lockPath: string, timeoutMs: number);
+}
+interface VaultLockData {
+    pid: number;
+    createdAt: number;
+    lockId: string;
+    hostname?: string;
+}
+interface VaultLockOptions {
+    lockPath?: string;
+    configDir?: string;
+    timeoutMs?: number;
+    staleTimeoutMs?: number;
+    corruptLockGraceMs?: number;
+    retryIntervalMs?: number;
+    isProcessAliveFn?: (pid: number) => boolean;
+}
+/**
+ * Checks whether a process with the given PID is alive on the current system.
+ */
+declare function defaultIsProcessAlive(pid: number): boolean;
+declare class VaultLock {
+    readonly lockPath: string;
+    readonly isCustomLockPath: boolean;
+    readonly timeoutMs: number;
+    readonly staleTimeoutMs: number;
+    readonly corruptLockGraceMs: number;
+    readonly retryIntervalMs: number;
+    private readonly isProcessAlive;
+    private currentLockId;
+    private currentLockIno?;
+    constructor(options?: VaultLockOptions);
+    /**
+     * Returns whether this instance currently holds the active lock.
+     */
+    isHeld(): boolean;
+    /**
+     * Returns the current lock ID if held.
+     */
+    getCurrentLockId(): string | null;
+    /**
+     * Acquires the lock exclusively.
+     * Retries with bounded exponential backoff and jitter if held by another process.
+     * Recovers automatically if the lock is determined to be stale.
+     */
+    acquire(): Promise<void>;
+    /**
+     * Releases the lock file safely.
+     * Strictly enforces ownership and inode integrity: Never deletes a lock file owned by a different process.
+     */
+    release(): Promise<void>;
+    /**
+     * Synchronous release helper for process exit handlers.
+     *
+     * Uses a hardlink guard so the inode we verified cannot be swapped for another
+     * process's lock between the check and the unlink. If hardlinks are unavailable,
+     * falls back to the stat-verified path (safe for the owner in practice).
+     */
+    releaseSync(): void;
+    /**
+     * Fallback release for filesystems without hardlink support.
+     *
+     * Hardlink creation can fail on filesystems lacking link support (e.g. FAT32, certain network mounts).
+     * In this fallback, the owner verifies that:
+     * 1. The lock file exists and matches the inode recorded at acquisition time.
+     * 2. The JSON payload matches lockIdToRelease and process.pid.
+     * 3. A post-read stat confirms the path still points to the same inode before unlinking.
+     *
+     * Note on TOCTOU: While a theoretical micro-window exists between post-read stat and unlinkSync,
+     * in practice only the legitimate owner releases an active, unexpired lock. If the lock was already
+     * unlinked or replaced by another inode, unlink is safely skipped.
+     */
+    releaseSyncLoose(lockIdToRelease: string, lockInoToRelease?: number): void;
+    /**
+     * Sweeps orphan temporary guard files (.credentials.lock.release.*, .stale.*, .corrupt.*)
+     * left behind if a previous process crashed between linkSync and unlinkSync.
+     *
+     * Hardlink safety:
+     * 1. Hardlinks share `mtime` with the primary lock file. If a lock was held for > 60s,
+     *    a newly created release/quarantine hardlink will have an old `mtime`.
+     *    Therefore, age is strictly calculated from the timestamp embedded in the guard filename,
+     *    NOT from `stat.mtimeMs`.
+     * 2. A guard still hardlinked to the current `lockPath` inode (nlink > 1 and
+     *    the same inode) is active and is NEVER deleted.
+     * 3. Only timestamped-UUID guard names are considered. Guards from a replaced or
+     *    removed lock (different inode / missing lockPath) are swept once their embedded
+     *    timestamp exceeds `staleTimeoutMs`.
+     */
+    cleanOrphanGuards(): void;
+    /**
+     * Executes an async operation within an exclusive vault lock.
+     * Guarantees that release() is called in finally.
+     */
+    withLock<T>(fn: () => Promise<T>): Promise<T>;
+    /**
+     * Inspects existing lock file and safely reclaims it if stale.
+     *
+     * Hardened rules (M1 & TOCTOU fix):
+     * 1. Same-host lock: Only reclaimed if the holding process is confirmed DEAD (!isProcessAlive).
+     *    If the process is ALIVE, the lock is NEVER deleted regardless of age.
+     * 2. Remote-host lock: Reclaimed only if age exceeds staleTimeoutMs (since cross-host PID is untestable).
+     * 3. TOCTOU prevention: Uses hardlink + nlink verification and non-overwriting semantics.
+     *    Never replaces or destroys an active lock file acquired by a racing process.
+     */
+    private tryCleanStaleLock;
+    /**
+     * TOCTOU-safe stale lock removal using hardlink + nlink verification.
+     * Ensures that if another process acquires this.lockPath before or during cleanup,
+     * its active lock is never deleted or overwritten.
+     */
+    private reclaimStaleLock;
+    /**
+     * TOCTOU-safe corrupt lock removal with inode, size, and mtime verification.
+     */
+    private reclaimCorruptLock;
+}
+/**
+ * Executes a function within an exclusive vault lock.
+ */
+declare function withVaultLock<T>(lockPath: string, fn: () => Promise<T>, options?: Omit<VaultLockOptions, 'lockPath'>): Promise<T>;
+
+/**
+ * MCP Token Refresh Manager
+ *
+ * Implements transparent, concurrent-safe token refresh for RFC 8628 (DEV-10).
+ *
+ * Key guarantees:
+ * - In-process single-flight collapsing concurrent refresh calls for the same profile.
+ * - Cross-process mutual exclusion via VaultLock (credentials.lock) to protect token family.
+ * - Double-checked locking pattern: Avoids redundant server requests if a concurrent
+ *   process already refreshed the token family.
+ * - Terminal error handling: ONLY invalid_grant / invalid_client clears vault and raises
+ *   ReauthenticationRequiredError. Non-terminal 4xx errors preserve vault credentials.
+ * - Transient error handling: 5xx and network failures retry with bounded backoff and
+ *   never wipe local credentials. Single retry on POST is protected by the provider's
+ *   30s reuse grace window (MCP-OAUTH-04).
+ * - Persistence failure treated as terminal: Clears vault and raises ReauthenticationRequiredError
+ *   to avoid reusing now-rotated refresh tokens.
+ * - Atomic persistence before lock release.
+ * - Zero token leakage in logs or error messages.
+ */
+
+declare class ReauthenticationRequiredError extends Error {
+    readonly profileKey: string;
+    readonly reason: string;
+    readonly terminalError?: string;
+    constructor(profileKey: string, reason: string, terminalError?: string);
+}
+interface TokenRefreshManagerOptions {
+    vault?: CredentialVault;
+    safetyMarginSeconds?: number;
+    lockTimeoutMs?: number;
+    staleLockTimeoutMs?: number;
+    staleTimeoutMs?: number;
+    lockPath?: string;
+    fetchFn?: typeof fetch;
+    logger?: (msg: string) => void;
+    errorLogger?: (msg: string) => void;
+}
+declare class TokenRefreshManager {
+    private readonly vault;
+    private readonly safetyMarginSeconds;
+    private readonly lockTimeoutMs;
+    private readonly staleLockTimeoutMs;
+    private readonly lockPath?;
+    private readonly fetchFn?;
+    private readonly logger?;
+    private readonly errorLogger?;
+    private readonly inFlightRefreshes;
+    constructor(options?: TokenRefreshManagerOptions);
+    /**
+     * Returns a valid access token for the given profile key.
+     * If the current access token is within the safety margin or expired, refreshes
+     * transparently using the stored refresh token behind a cross-process lock.
+     */
+    getValidAccessToken(profileKey: string): Promise<string>;
+    /**
+     * Returns valid stored credentials for the profile key, refreshing if necessary.
+     */
+    getValidCredentials(profileKey: string): Promise<StoredMcpCredentials>;
+    /**
+     * Explicitly forces a token refresh regardless of current expiry time.
+     * Reuses an in-flight refresh promise if one is already active (m7 fix).
+     */
+    refresh(profileKey: string): Promise<StoredMcpCredentials>;
+    /**
+     * Collapses concurrent in-process calls for the same profileKey to a single execution.
+     */
+    private refreshWithSingleFlight;
+    /**
+     * Acquires the cross-process lock, double-checks if another process already refreshed,
+     * and invokes the server refresh endpoint if still needed.
+     */
+    private executeRefreshWithLock;
+    /**
+     * Performs the HTTP refresh exchange with the OAuth2 token endpoint.
+     */
+    private performTokenExchange;
+}
+
+export { CredentialVault, DEFAULT_CLI_CLIENT_ID, DEFAULT_KEYCHAIN_SERVICE, DEFAULT_READ_ONLY_SCOPES, DEFAULT_SCOPES, DEFAULT_SERVER_URL, DEVICE_CODE_GRANT_TYPE, DefaultKeychainRunner, HttpError, KeychainService, ReauthenticationRequiredError, TokenRefreshManager, VaultLock, VaultLockError, VaultLockTimeoutError, decodeJwtPayload, defaultIsProcessAlive, executeLogin, executeLogout, executeStatus, isCredentialExpired, isLocalhost, isValidStoredCredentials, normalizeProfileKey, openBrowser, pollDeviceToken, redactCredentials, requestDeviceCode, resolveAuthServerUrl, resolveMcpResourceUrl, sanitizeSecretString, sendRequest, validateScopes, withVaultLock };
+export type { CredentialVaultOptions, DeviceAuthorizationResponse, DeviceLoginOptions, DeviceLoginResult, HttpResponse, KeychainCommandRunner, KeychainOptions, KeychainRunResult, LogoutOptions, LogoutResult, McpCredentials, OAuthTokenErrorResponse, OAuthTokenSuccessResponse, RequestOptions, SpawnFunction, StoredMcpCredentials, TokenRefreshManagerOptions, VaultBackendType, VaultLockData, VaultLockOptions };