@knowttl/mg-axi 0.1.4 → 0.1.6

package/dist/doctor.js

@@ -1,6 +1,7 @@
 import { AxiError } from "axi-sdk-js";
 import { LEAVES, operationFor } from "./catalogue.js";
 import { listUsers } from "./entra-users.js";
+import { authStatus } from "./auth-status.js";
 // PACK-01: explicit release health check over the reviewed read-only session.
 // Doctor performs one documented bounded read per profile (entra user list
 // with a one-row window) and reports configuration, connectivity,
@@ -8,7 +9,7 @@ import { listUsers } from "./entra-users.js";
 // DelegatedAuth.credential and ApplicationAuth.credential never open a
 // browser or device-code flow, so doctor never signs in interactively.
 // Doctor never auto-installs, changes profiles or enables Graph writes;
-// silent token refresh may update the protected credential cache.
+// silent token refresh stays in memory.
 // See README.md for usage.
 export const DOCTOR_OPERATION = "GET:/users";
 export const DOCTOR_VERSION = "v1.0";
@@ -16,19 +17,18 @@ export const DOCTOR_CHECK = `entra user list --limit 1 (${DOCTOR_VERSION}:${DOCT
 export function doctorTargets(store, flag) {
     if (flag !== undefined)
         return [store.resolve(flag).name];
-    const items = store.list();
-    if (!items.length)
-        return [];
     try {
         return [store.resolve(undefined).name];
     }
-    catch {
-        return items.map(item => item.name);
+    catch (error) {
+        if (!(error instanceof AxiError) || !["PROFILE_REQUIRED", "PROFILE_AMBIGUOUS"].includes(error.code))
+            throw error;
+        return store.list().map(item => item.name);
     }
 }
 export async function runDoctor(args) {
     if (!args.names.length) {
-        throw new AxiError("No profiles are configured", "AUTH_REQUIRED", ["npx -y @knowttl/mg-axi profile create --help", "npx -y @knowttl/mg-axi setup"]);
+        throw new AxiError("No profiles are configured", "PROFILE_REQUIRED", ["npx -y @knowttl/mg-axi profile create --help", "npx -y @knowttl/mg-axi setup"]);
     }
     const leaf = LEAVES.find(item => item.path === "entra user list");
     const operation = leaf === undefined ? undefined : operationFor(leaf, DOCTOR_VERSION);
@@ -39,7 +39,9 @@ export async function runDoctor(args) {
     for (const name of args.names) {
         const rerun = `npx -y @knowttl/mg-axi doctor --profile ${name}`;
         try {
-            const selected = args.store.resolve(name);
+            args.store.verifyPermissions();
+            const selected = args.selected ?? args.store.resolve(name);
+            authStatus(name, selected.profile);
             // The same bounded read the named leaf serves: one fetched page, one
             // surfaced row, remainder buffered in a discarded cursor. Doctor keeps
             // no cursor and accepts none; recovery reruns doctor, not the read.

package/dist/graph-session.js

@@ -2,7 +2,9 @@ import { createHash, randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { setTimeout as delay } from "node:timers/promises";
 import { AxiError } from "axi-sdk-js";
-import { validateApplicationProfile, validateDelegatedProfile, validateProfile, } from "./profiles.js";
+import { redactSecrets } from "./redact.js";
+import { PrivateFiles } from "./private-file.js";
+import { validateProfile, profileName } from "./profiles.js";
 // CORE-01: the single path that owns Graph URL construction, operation
 // authorization, credential attachment and response validation. Command
 // handlers call execute() with a catalogued inventory operation and bound
@@ -138,7 +140,7 @@ export function redactGraphValue(value) {
 }
 function redact(value) {
     if (typeof value === "string")
-        return SECRET_VALUE.some(pattern => pattern.test(value)) ? REDACTED : value;
+        return SECRET_VALUE.some(pattern => pattern.test(value)) ? REDACTED : redactSecrets(value);
     if (Array.isArray(value))
         return value.map(redact);
     if (value === null || typeof value !== "object")
@@ -617,8 +619,10 @@ function valuesOf(operation, body) {
 }
 export class GraphSession {
     deps;
-    constructor(deps) {
+    files;
+    constructor(deps, files = new PrivateFiles()) {
         this.deps = deps;
+        this.files = files;
     }
     cursorQuery(operation, cursor) {
         return decodeCursor(operation, cursor).query;
@@ -633,7 +637,7 @@ export class GraphSession {
                 "Use a route from inventory/operations.json; the session never builds uncatalogued URLs",
             ]);
         }
-        const profile = validateProfile(args.profile);
+        const profile = validateProfile(args.profile, this.files);
         this.authorizePolicy(profile, operation);
         const query = args.query ?? {};
         checkQueryContext(query, args.consistencyLevel);
@@ -645,8 +649,8 @@ export class GraphSession {
         let token;
         try {
             token = await beforeDeadline(async () => profile.mode === "delegated"
-                ? (await this.deps.delegated.credential(validateDelegatedProfile(profile), this.readScopes(args.scopes))).token
-                : (await this.deps.application.credential(validateApplicationProfile(profile), this.applicationScopes(args.scopes))).token, clock, deadline, signal);
+                ? (await this.deps.delegated.credential(profile, this.readScopes(args.scopes))).token
+                : (await this.deps.application.credential(profile, this.applicationScopes(args.scopes))).token, clock, deadline, signal);
         }
         catch (error) {
             signal?.throwIfAborted();
@@ -671,7 +675,7 @@ export class GraphSession {
                 "Use a route from inventory/operations.json; the session never builds uncatalogued URLs",
             ]);
         }
-        const profile = validateProfile(args.profile);
+        const profile = validateProfile(args.profile, this.files);
         this.authorizePolicy(profile, operation);
         checkLimit(args.limit);
         const budget = checkBudget(args.budget);
@@ -690,8 +694,8 @@ export class GraphSession {
         const signal = args.signal;
         const path = buildPath(operation.path, params);
         const context = createHash("sha256").update(JSON.stringify([
-            path, profile.mode, profile.tenantId.toLowerCase(), profile.clientId.toLowerCase(), profile.cloud,
-            profile.credentialRef, [...new Set(args.scopes ?? [])].sort(),
+            path, profileName(profile), profile.mode, profile.tenantId.toLowerCase(), profile.clientId.toLowerCase(), profile.cloud,
+            profile.mode === "delegated" ? profile.token : profile.auth === "certificate" ? [profile.privateKey, profile.thumbprintSha256] : profile.auth === "client-secret" ? profile.clientSecret : profile.token, [...new Set(args.scopes ?? [])].sort(),
         ])).digest("hex");
         if (resumed && resumed.context !== context)
             throw new AxiError("Collection cursor resource or authentication context does not match", "VALIDATION_ERROR", ["Resume under the original resource bindings, profile identity, credential reference and scopes"]);
@@ -733,8 +737,8 @@ export class GraphSession {
         let token;
         try {
             const credential = await beforeDeadline(async () => profile.mode === "delegated"
-                ? this.deps.delegated.credential(validateDelegatedProfile(profile), this.readScopes(args.scopes))
-                : this.deps.application.credential(validateApplicationProfile(profile), this.applicationScopes(args.scopes)), clock, deadline, signal);
+                ? this.deps.delegated.credential(profile, this.readScopes(args.scopes))
+                : this.deps.application.credential(profile, this.applicationScopes(args.scopes)), clock, deadline, signal);
             const acquiredIdentity = createHash("sha256").update(JSON.stringify([
                 profile.mode, credential.tenantId.toLowerCase(), credential.clientId.toLowerCase(),
                 profile.mode === "delegated" && "accountId" in credential ? credential.accountId : null,

package/dist/hook.js

@@ -1,37 +1,14 @@
 import { encode } from "@toon-format/toon";
 import { Profiles } from "./profiles.js";
-// Session-start ambient summary behind the mg-axi-hook entry point.
-// Local configuration state only: every configured profile name with its
-// tenant label, auth-cache presence and effective write posture, plus the
-// package version and one next-step hint. No session, transport, Graph or
-// sign-in call of any kind; every failure collapses to a short record with
-// exit code 0, so a missing or broken config never breaks agent startup.
-//
-// Auth-cache presence reads the OS credential store directly: delegated
-// profiles keep their MSAL session blob under the "mg-axi" service with the
-// session key below, so presence means a previous explicit login happened on
-// this machine. Only presence is reported; tokens and key material never
-// reach the output. Application profiles acquire tokens silently per run, so
-// they report the client-credentials mechanism instead of cache state.
-// Session cache key mirrors MsalProvider.application() in
-// src/msal-provider.ts; change both together.
-function delegatedSessionKey(profile) {
-    return JSON.stringify([profile.credentialRef.key, profile.tenantId, profile.clientId, profile.cloud]);
-}
-async function probeAuthPresence(profile) {
+import { Credentials } from "./credentials.js";
+import { PrivateFiles } from "./private-file.js";
+import { resolveSecret } from "./secrets.js";
+import { redactSecrets } from "./redact.js";
+async function probeAuthPresence(profile, files = new PrivateFiles()) {
     if (profile.mode !== "delegated")
         return "client-credentials";
-    let store;
-    try {
-        store = await import("keytar").then(module => module.default).catch(() => undefined);
-    }
-    catch {
-        return "unknown";
-    }
-    if (!store)
-        return "unknown";
     try {
-        return typeof await store.getPassword("mg-axi", delegatedSessionKey(profile)) === "string" ? "cached" : "sign-in required";
+        return ("stored" in profile.token ? new Credentials(undefined, files).read(profile) : resolveSecret(profile.token, files)) ? "cached" : "sign-in required";
     }
     catch {
         return "unknown";
@@ -44,17 +21,17 @@ const CONFIGURED_HINT = "Run npx -y @knowttl/mg-axi doctor --profile <name> to c
 const SETUP_HINT = "Run npx -y @knowttl/mg-axi setup to find the config path and example";
 export async function hookSummary(options) {
     try {
-        return await renderHookSummary(options);
+        return redactSecrets(await renderHookSummary(options));
     }
     catch {
         return "mg: status unavailable\n";
     }
 }
-async function renderHookSummary({ version, env = process.env, configPath, authPresence = probeAuthPresence }) {
+async function renderHookSummary({ version, env = process.env, configPath, files = new PrivateFiles(), authPresence = profile => probeAuthPresence(profile, files) }) {
     let store;
     let names;
     try {
-        store = new Profiles(configPath ?? env.MG_AXI_CONFIG);
+        store = new Profiles(configPath !== undefined && configPath.trim() !== "" ? configPath.trim() : env.MG_AXI_CONFIG !== undefined && env.MG_AXI_CONFIG.trim() !== "" ? env.MG_AXI_CONFIG.trim() : undefined, files);
         names = store.list().map(item => item.name);
     }
     catch {

package/dist/msal-app-provider.js

@@ -1,19 +1,24 @@
-import { lstatSync, readFileSync } from "node:fs";
 import { ConfidentialClientApplication } from "@azure/msal-node";
 import { AxiError } from "axi-sdk-js";
 import { graphAudience } from "./app-auth.js";
-// Only this adapter touches application credentials; keys and assertions are referenced, never logged.
+import { PrivateFiles } from "./private-file.js";
+import { resolveSecret } from "./secrets.js";
+import { registerSecret } from "./redact.js";
+// Application acquisition has no interactive or persistent credential fallback.
 export class MsalApplicationProvider {
+    files;
     storage = "session-only";
+    constructor(files = new PrivateFiles()) {
+        this.files = files;
+    }
     async acquire(profile, scopes) {
-        const ref = profile.credentialRef;
         const configuration = {
             auth: { clientId: profile.clientId, authority: `https://login.microsoftonline.com/${profile.tenantId}`,
-                ...(ref.provider === "client-secret"
-                    ? { clientSecret: this.clientSecret(ref) }
-                    : ref.provider === "certificate"
-                        ? { clientCertificate: { thumbprint: ref.thumbprint, privateKey: await this.privateKey(ref) } }
-                        : { clientAssertion: () => this.assertion(ref) }) },
+                ...(profile.auth === "client-secret"
+                    ? { clientSecret: resolveSecret(profile.clientSecret, this.files) }
+                    : profile.auth === "certificate"
+                        ? { clientCertificate: { thumbprintSha256: profile.thumbprintSha256, privateKey: this.privateKey(profile) } }
+                        : { clientAssertion: () => Promise.resolve(this.assertion(profile)) }) },
             system: { loggerOptions: { loggerCallback: () => { }, piiLoggingEnabled: false } },
         };
         const result = await new ConfidentialClientApplication(configuration)
@@ -22,104 +27,25 @@ export class MsalApplicationProvider {
             throw new Error("Empty application token response");
         if (result.authority.toLowerCase() !== `${configuration.auth.authority.toLowerCase()}/`)
             throw new Error("Configured application authority mismatch");
-        return { token: result.accessToken, expiresAt: result.expiresOn?.getTime() ?? NaN, tenantId: profile.tenantId, clientId: profile.clientId };
-    }
-    async privateKey(ref) {
-        if (ref.keyFile !== undefined) {
-            this.storage = "session-only";
-            return this.normalizeKey(this.readProtectedFile(ref.keyFile), ref.keyFile);
-        }
-        if (ref.keyEnv !== undefined) {
-            this.storage = "session-only";
-            const material = process.env[ref.keyEnv];
-            if (typeof material !== "string" || !material.trim())
-                throw this.missing(ref.keyEnv);
-            return this.normalizeKey(material, ref.keyEnv);
-        }
-        const store = await import("keytar").then(module => module.default).catch(() => undefined);
-        this.storage = store ? "os-protected" : "session-only";
-        const material = await store?.getPassword("mg-axi", ref.key).catch(() => null);
-        if (typeof material !== "string" || !material.trim())
-            throw new Error("Missing referenced certificate private key");
-        return material;
-    }
-    clientSecret(ref) {
-        this.storage = "session-only";
-        if (ref.secretEnv !== undefined) {
-            const secret = process.env[ref.secretEnv];
-            if (typeof secret !== "string" || !secret.trim())
-                throw this.missing(ref.secretEnv);
-            return secret.trim();
-        }
-        if (ref.secretFile !== undefined)
-            return this.readProtectedFile(ref.secretFile);
-        throw new Error("Missing client-secret credential holder");
+        return { token: registerSecret(result.accessToken), expiresAt: result.expiresOn?.getTime() ?? NaN, tenantId: profile.tenantId, clientId: profile.clientId };
     }
-    async assertion(ref) {
-        this.storage = "session-only";
-        if (ref.tokenFileEnv === undefined) {
-            const file = process.env.AZURE_FEDERATED_TOKEN_FILE;
-            if (!file?.trim())
-                throw new Error("Missing federated token source");
-            // Read on every invocation: projected federated tokens rotate on disk.
-            const assertion = readFileSync(file, "utf8").trim();
-            if (!assertion)
-                throw new Error("Missing federated token source");
-            return assertion;
-        }
-        const file = process.env[ref.tokenFileEnv];
-        if (!file?.trim())
-            throw this.missing(ref.tokenFileEnv);
-        // Read on every invocation: projected federated tokens rotate on disk.
-        try {
-            const assertion = readFileSync(file, "utf8").trim();
-            if (!assertion)
-                throw this.missing(ref.tokenFileEnv);
-            return assertion;
-        }
-        catch (error) {
-            if (error instanceof AxiError)
-                throw error;
-            throw this.missing(ref.tokenFileEnv);
-        }
-    }
-    // Key and secret files hold long-lived material: regular file, owned by the
-    // current user, mode 0600, never a symlink. Relative paths resolve against
-    // the process working directory at acquire time. Windows skips the
-    // ownership and mode checks. Every failure names only the path, never content.
-    readProtectedFile(path) {
-        try {
-            const stat = lstatSync(path);
-            if (stat.isSymbolicLink() || !stat.isFile())
-                throw this.missing(path);
-            if (process.platform !== "win32") {
-                if (typeof process.getuid === "function" && stat.uid !== process.getuid())
-                    throw this.missing(path);
-                if ((stat.mode & 0o777) !== 0o600)
-                    throw this.missing(path);
+    assertion(profile) {
+        if ("env" in profile.token && profile.token.env === "MG_AXI_TOKEN" && !process.env.MG_AXI_TOKEN?.trim()) {
+            const legacy = process.env.AZURE_FEDERATED_TOKEN_FILE?.trim();
+            if (legacy) {
+                process.stderr.write("AZURE_FEDERATED_TOKEN_FILE is deprecated; use MG_AXI_TOKEN instead\n");
+                if (!this.files.absolute(legacy))
+                    throw new AxiError("AZURE_FEDERATED_TOKEN_FILE must name an absolute file path", "CONFIG_INVALID", ["Set MG_AXI_TOKEN to the workload assertion"]);
+                return resolveSecret({ file: legacy }, this.files);
             }
-            const content = readFileSync(path, "utf8").trim();
-            if (!content)
-                throw this.missing(path);
-            return content;
-        }
-        catch (error) {
-            if (error instanceof AxiError)
-                throw error;
-            throw this.missing(path);
         }
+        return resolveSecret(profile.token, this.files);
     }
-    // PEM material from files and env vars; env vars may carry escaped "\n".
-    normalizeKey(material, reference) {
+    privateKey(profile) {
+        const material = resolveSecret(profile.privateKey, this.files);
         const normalized = material.includes("\n") ? material : material.replace(/\\n/g, "\n");
         if (/ENCRYPTED PRIVATE KEY/.test(normalized) || /Proc-Type:\s*4,ENCRYPTED/.test(normalized))
-            throw new AxiError(`Application credential reference ${reference} is passphrase-protected; passphrase-protected keys are unsupported`, "AUTH_REQUIRED", ["mg-axi profile show --profile <name>", "Provision an unencrypted PEM through the referenced environment variable or file"]);
-        if (!normalized.trim())
-            throw this.missing(reference);
-        return normalized;
-    }
-    // Fail-closed holder error: names only the env var name or file path.
-    missing(reference) {
-        return new AxiError(`Application credential unavailable for the configured reference ${reference}; no user or device-code fallback was attempted`, "AUTH_REQUIRED", ["mg-axi profile show --profile <name>", "Supply the referenced credential through the named environment variable or file"]);
+            throw new AxiError("Referenced privateKey is passphrase-protected; passphrase-protected keys are unsupported", "AUTH_REQUIRED", ["Provision an unencrypted PEM through the referenced environment variable or file"]);
+        return registerSecret(normalized);
     }
 }

package/dist/msal-provider.js

@@ -1,82 +1,95 @@
 import { PublicClientApplication } from "@azure/msal-node";
 import open from "open";
-// Only this adapter touches Microsoft authentication and OS credential storage.
+import { AxiError } from "axi-sdk-js";
+import { profileName } from "./profiles.js";
+import { Credentials } from "./credentials.js";
+import { resolveSecret } from "./secrets.js";
+import { redactSecrets, registerCache, registerSecret } from "./redact.js";
 export class MsalProvider {
-    storage = "session-only";
+    store;
+    storage = "protected-file";
     sessions = new Map();
-    async application(profile, fresh = false) {
-        const key = JSON.stringify([profile.credentialRef.key, profile.tenantId, profile.clientId, profile.cloud]);
+    constructor(store = new Credentials()) {
+        this.store = store;
+    }
+    key(profile) { return JSON.stringify([profileName(profile), profile.tenantId, profile.clientId, profile.cloud, profile.token]); }
+    application(profile, login = false) {
+        const key = this.key(profile);
+        this.storage = "stored" in profile.token ? "protected-file" : "session-only";
         const existing = this.sessions.get(key);
-        if (existing && !fresh) {
-            this.storage = existing.store ? "os-protected" : "session-only";
-            return existing.app;
-        }
-        const store = existing ? existing.store : await import("keytar").then(module => module.default).catch(() => undefined);
-        this.storage = store ? "os-protected" : "session-only";
-        if (fresh) {
-            this.sessions.delete(key);
-            if (store) {
-                await store.deletePassword("mg-axi", key);
-                if (await store.getPassword("mg-axi", key) !== null)
-                    throw new Error("Unable to wipe profile cache");
-            }
-        }
-        const configuration = {
+        if (existing && !login)
+            return existing;
+        let loaded = false;
+        let snapshot;
+        const app = new PublicClientApplication({
             auth: { clientId: profile.clientId, authority: `https://login.microsoftonline.com/${profile.tenantId}` },
             system: { loggerOptions: { loggerCallback: () => { }, piiLoggingEnabled: false } },
-        };
-        const app = new PublicClientApplication({
-            ...configuration,
-            cache: store ? { cachePlugin: {
+            cache: { cachePlugin: {
                     beforeCacheAccess: async (context) => {
-                        const saved = await store.getPassword("mg-axi", key);
-                        if (saved)
-                            context.tokenCache.deserialize(saved);
+                        if (!loaded) {
+                            snapshot = "stored" in profile.token ? this.store.read(profile) : resolveSecret(profile.token, this.store.files);
+                            loaded = true;
+                        }
+                        // MSAL overwrites its cache from the plugin snapshot before a silent lookup.
+                        if (snapshot)
+                            context.tokenCache.deserialize(registerCache(snapshot));
                     },
                     afterCacheAccess: async (context) => {
                         if (!context.cacheHasChanged)
                             return;
-                        const saved = context.tokenCache.serialize();
-                        if (process.platform === "win32" && Buffer.byteLength(saved, "utf8") > 2560) {
-                            await store.deletePassword("mg-axi", key);
-                            if (await store.getPassword("mg-axi", key) !== null)
-                                throw new Error("Unable to wipe profile cache");
-                            const session = new PublicClientApplication(configuration);
-                            session.getTokenCache().deserialize(saved);
-                            this.sessions.set(key, { app: session });
-                            this.storage = "session-only";
-                            return;
-                        }
-                        await store.setPassword("mg-axi", key, saved);
+                        snapshot = registerCache(context.tokenCache.serialize());
+                        // Hosted commands keep refreshed tokens only in memory. Explicit login owns persistence.
+                        if (login)
+                            this.store.write(profile, snapshot);
                     },
-                } } : undefined,
+                } },
         });
-        this.sessions.set(key, { app, store });
+        this.sessions.set(key, app);
         return app;
     }
     async login(profile, method, scopes) {
-        // Each explicit login starts with a new client and a verified empty protected cache.
-        const app = await this.application(profile, true);
-        const result = method === "browser"
-            ? await app.acquireTokenInteractive({ scopes, openBrowser: async (url) => { await open(url); }, prompt: "select_account", errorTemplate: "Sign-in failed. Return to mg-axi for recovery guidance." })
-            : await app.acquireTokenByDeviceCode({ scopes, deviceCodeCallback: response => {
-                    if (typeof response.userCode !== "string" || !response.userCode.trim() || typeof response.deviceCode !== "string" || !response.deviceCode.trim() || !Number.isFinite(response.expiresIn) || response.expiresIn <= 0)
-                        throw new Error("Invalid device-code challenge");
-                    // The one-time user challenge belongs only to explicit login stderr.
-                    process.stderr.write(`Open https://microsoft.com/devicelogin and enter ${response.userCode}\n`);
-                } });
-        return this.result(profile, result);
+        if (!("stored" in profile.token))
+            throw new AxiError("auth login requires token: {stored: true}", "CONFIG_INVALID");
+        this.sessions.delete(this.key(profile));
+        this.store.remove(profile);
+        const app = this.application(profile, true);
+        try {
+            const result = method === "browser"
+                ? await app.acquireTokenInteractive({ scopes, openBrowser: async (url) => { await open(url); }, prompt: "select_account", errorTemplate: "Sign-in failed. Return to mg-axi for recovery guidance." })
+                : await app.acquireTokenByDeviceCode({ scopes, deviceCodeCallback: response => {
+                        if (typeof response.userCode !== "string" || !response.userCode.trim() || typeof response.deviceCode !== "string" || !response.deviceCode.trim() || !Number.isFinite(response.expiresIn) || response.expiresIn <= 0)
+                            throw new Error("Invalid device-code challenge");
+                        process.stderr.write(redactSecrets(`Open https://microsoft.com/devicelogin and enter ${response.userCode}\n`));
+                    } });
+            const credential = this.result(profile, result);
+            // Subsequent silent acquisitions must not retain a persistence-enabled plugin.
+            this.sessions.delete(this.key(profile));
+            return credential;
+        }
+        catch (error) {
+            this.sessions.delete(this.key(profile));
+            this.store.remove(profile);
+            throw error;
+        }
     }
     async silent(profile, scopes) {
-        const app = await this.application(profile);
+        const app = this.application(profile);
         const accounts = (await app.getTokenCache().getAllAccounts()).filter(account => account.tenantId.toLowerCase() === profile.tenantId.toLowerCase());
         if (accounts.length !== 1)
             throw new Error("Explicit login required");
-        return this.result(profile, await app.acquireTokenSilent({ scopes, account: accounts[0] }));
+        const credential = this.result(profile, await app.acquireTokenSilent({ scopes, account: accounts[0] }));
+        if (credential.accountId !== accounts[0].homeAccountId)
+            throw new Error("Configured account mismatch");
+        return credential;
+    }
+    async logout(profile) {
+        this.sessions.delete(this.key(profile));
+        if ("stored" in profile.token)
+            this.store.remove(profile);
     }
     result(profile, result) {
         if (!result?.account || result.tenantId.toLowerCase() !== profile.tenantId.toLowerCase())
             throw new Error("Configured tenant mismatch");
-        return { token: result.accessToken, expiresAt: result.expiresOn?.getTime() ?? NaN, tenantId: result.tenantId, clientId: profile.clientId, accountId: result.account.homeAccountId };
+        return { token: registerSecret(result.accessToken), expiresAt: result.expiresOn?.getTime() ?? NaN, tenantId: result.tenantId, clientId: profile.clientId, accountId: result.account.homeAccountId };
     }
 }