@levr-one/auth 1.0.0

package/dist/token-store.js

@@ -0,0 +1,299 @@
+/**
+ * Secure token storage for OAuth tokens
+ *
+ * Stores tokens in ~/.tq/oauth-tokens.json as a map keyed by backend URL:
+ * {
+ *   "https://api.levr.now": { accessToken, refreshToken, expiresAt, apiBaseUrl },
+ *   "http://localhost:8080": { ... }
+ * }
+ *
+ * Backward-compatible: if the file contains the legacy single-token format
+ * (flat object with accessToken at the top level), it is migrated in-place
+ * to the new map format on first read.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+/**
+ * Token storage directory and file path
+ */
+const TQ_DIR = path.join(os.homedir(), '.tq');
+const TOKEN_FILE = path.join(TQ_DIR, 'oauth-tokens.json');
+/**
+ * Map of environment names to their backend URLs.
+ */
+// internal D15: unified levr.* origins. Legacy testquality.* URLs are
+// retired during the DEC-11 7-day window; tokens minted under the
+// legacy URLs are migrated by the legacy-key fallback in readTokenMap()
+// (the apiBaseUrl on the StoredTokens itself was set when the token
+// was originally issued, so old token files keep working transparently).
+const ENV_URLS = {
+    local: 'http://localhost:8080',
+    staging: 'https://api.levr.now',
+    production: 'https://api.levr.one',
+};
+/**
+ * Resolve an environment name from a backend URL.
+ * Returns undefined if the URL doesn't match any known preset.
+ */
+export function resolveEnvFromUrl(url) {
+    const normalized = url.replace(/\/+$/, '');
+    for (const [env, envUrl] of Object.entries(ENV_URLS)) {
+        if (envUrl === normalized)
+            return env;
+    }
+    return undefined;
+}
+/**
+ * Resolve a backend URL from an environment name.
+ */
+export function resolveUrlFromEnv(env) {
+    return ENV_URLS[env];
+}
+// ---------------------------------------------------------------------------
+// Internal: read/write the token map
+// ---------------------------------------------------------------------------
+/**
+ * Read the raw token map from disk.
+ * Handles migration from legacy single-token format.
+ */
+function readTokenMap() {
+    try {
+        if (!fs.existsSync(TOKEN_FILE))
+            return {};
+        const content = fs.readFileSync(TOKEN_FILE, 'utf-8');
+        const parsed = JSON.parse(content);
+        // Detect legacy single-token format (has accessToken at top level)
+        if ('accessToken' in parsed && 'refreshToken' in parsed) {
+            const legacy = parsed;
+            const key = legacy.apiBaseUrl ?? 'https://api.levr.now';
+            const map = { [key]: legacy };
+            // Migrate in place
+            writeTokenMap(map);
+            return map;
+        }
+        return parsed;
+    }
+    catch (error) {
+        console.error('[tq-oauth] Failed to load stored tokens:', error);
+        return {};
+    }
+}
+/**
+ * Write the full token map to disk with atomic write.
+ */
+function writeTokenMap(map) {
+    if (!fs.existsSync(TQ_DIR)) {
+        fs.mkdirSync(TQ_DIR, { recursive: true, mode: 0o700 });
+    }
+    const tempPath = TOKEN_FILE + '.tmp';
+    fs.writeFileSync(tempPath, JSON.stringify(map, null, 2), {
+        mode: 0o600,
+    });
+    fs.renameSync(tempPath, TOKEN_FILE);
+}
+function isValidToken(t) {
+    const obj = t;
+    return !!(obj?.accessToken && obj?.refreshToken && obj?.expiresAt);
+}
+// ---------------------------------------------------------------------------
+// Public API — drop-in compatible with the old single-token interface
+// ---------------------------------------------------------------------------
+/**
+ * Load the token for the current environment.
+ * Reads the config to determine which backend URL is active,
+ * then returns the matching entry from the token map.
+ *
+ * Falls back to first token in the map ONLY when no config exists
+ * (backward compat for first-time migration). When the user has
+ * explicitly set an environment, only that environment's token is returned.
+ */
+export function loadTokens() {
+    const map = readTokenMap();
+    const keys = Object.keys(map);
+    if (keys.length === 0)
+        return null;
+    // Try to match the current environment
+    const currentUrl = getCurrentApiUrl();
+    if (currentUrl) {
+        const entry = map[currentUrl];
+        if (entry && isValidToken(entry))
+            return entry;
+        // Config is set but no token for this env — don't fall back
+        return null;
+    }
+    // No config at all — fall back to first valid entry (backward compat)
+    for (const key of keys) {
+        if (isValidToken(map[key]))
+            return map[key];
+    }
+    return null;
+}
+/**
+ * Load tokens for a specific environment by name.
+ */
+export function loadTokensForEnv(env) {
+    const map = readTokenMap();
+    const url = ENV_URLS[env];
+    const entry = map[url];
+    if (entry && isValidToken(entry))
+        return entry;
+    return null;
+}
+/**
+ * Load tokens for an arbitrary backend URL (custom URL not in ENV_URLS).
+ *
+ * Used by the qinetic sync setup command, which needs to talk to a remote
+ * backend that may not be one of the named presets — the operator passes
+ * `--target <url>` and the CLI fetches the matching token entry by URL.
+ */
+export function loadTokensForUrl(url) {
+    const map = readTokenMap();
+    const normalized = url.replace(/\/$/, '');
+    // Try exact match first, then trailing-slash variant.
+    const entry = map[url] ?? map[normalized] ?? map[`${normalized}/`];
+    if (entry && isValidToken(entry))
+        return entry;
+    return null;
+}
+/**
+ * Save tokens for the current environment.
+ * Upserts the entry keyed by the token's apiBaseUrl.
+ */
+export function saveTokens(tokens) {
+    try {
+        const map = readTokenMap();
+        const key = tokens.apiBaseUrl ?? getCurrentApiUrl() ?? ENV_URLS.staging;
+        map[key] = tokens;
+        writeTokenMap(map);
+    }
+    catch (error) {
+        console.error('[tq-oauth] Failed to save tokens:', error);
+        throw error;
+    }
+}
+/**
+ * Save tokens for a specific environment by name.
+ */
+export function saveTokensForEnv(env, tokens) {
+    const map = readTokenMap();
+    map[ENV_URLS[env]] = tokens;
+    writeTokenMap(map);
+}
+/**
+ * Clear stored tokens for the current environment.
+ * Moves the entire file to .bak before removing the entry.
+ */
+export function clearTokens() {
+    try {
+        if (!fs.existsSync(TOKEN_FILE))
+            return;
+        // Backup entire file before modifying
+        const backupPath = TOKEN_FILE + '.bak';
+        try {
+            fs.copyFileSync(TOKEN_FILE, backupPath);
+            fs.chmodSync(backupPath, 0o600);
+        }
+        catch {
+            // Backup failed — still proceed with clear
+        }
+        const map = readTokenMap();
+        const currentUrl = getCurrentApiUrl();
+        if (currentUrl && map[currentUrl]) {
+            delete map[currentUrl];
+            if (Object.keys(map).length === 0) {
+                fs.unlinkSync(TOKEN_FILE);
+            }
+            else {
+                writeTokenMap(map);
+            }
+        }
+        else if (!currentUrl) {
+            // No current URL known — clear entire file (legacy behavior)
+            fs.unlinkSync(TOKEN_FILE);
+        }
+    }
+    catch (error) {
+        console.error('[tq-oauth] Failed to clear tokens:', error);
+    }
+}
+/**
+ * Attempt to restore tokens from backup (.bak file)
+ * Returns true if backup was restored successfully.
+ */
+export function restoreTokensFromBackup() {
+    const backupPath = TOKEN_FILE + '.bak';
+    try {
+        if (fs.existsSync(backupPath) && !fs.existsSync(TOKEN_FILE)) {
+            const content = fs.readFileSync(backupPath, 'utf-8');
+            const parsed = JSON.parse(content);
+            // Handle both legacy and map format in backup
+            if ('accessToken' in parsed && parsed.refreshToken) {
+                const legacy = parsed;
+                const key = legacy.apiBaseUrl ?? ENV_URLS.staging;
+                writeTokenMap({ [key]: legacy });
+                console.error('[tq-oauth] Restored tokens from backup — refresh token recovered');
+                return true;
+            }
+            // Map format — write as-is if it has any entry with a refresh token
+            const map = parsed;
+            const hasRefresh = Object.values(map).some((t) => t.refreshToken);
+            if (hasRefresh) {
+                writeTokenMap(map);
+                console.error('[tq-oauth] Restored tokens from backup — refresh token recovered');
+                return true;
+            }
+        }
+    }
+    catch (error) {
+        console.error('[tq-oauth] Failed to restore tokens from backup:', error);
+    }
+    return false;
+}
+/**
+ * Check if token file exists and has any entries
+ */
+export function hasStoredTokens() {
+    if (!fs.existsSync(TOKEN_FILE))
+        return false;
+    const map = readTokenMap();
+    return Object.keys(map).length > 0;
+}
+/**
+ * Get token file path (for debugging and watching)
+ */
+export function getTokenFilePath() {
+    return TOKEN_FILE;
+}
+/**
+ * Get TQ directory path
+ */
+export function getTqDir() {
+    return TQ_DIR;
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/**
+ * Read the current API URL from ~/.tq/config.json without importing
+ * config.ts (avoids circular dependency since config.ts imports us).
+ */
+function getCurrentApiUrl() {
+    try {
+        // Env var takes precedence
+        if (process.env.TQ_BACKEND_URL) {
+            return process.env.TQ_BACKEND_URL.replace(/\/+$/, '');
+        }
+        const configPath = path.join(TQ_DIR, 'config.json');
+        if (fs.existsSync(configPath)) {
+            const raw = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
+            if (raw.apiUrl)
+                return raw.apiUrl.replace(/\/+$/, '');
+        }
+    }
+    catch {
+        // Fall through
+    }
+    return undefined;
+}
+//# sourceMappingURL=token-store.js.map

package/dist/token-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../src/token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAKzB;;GAEG;AACH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC;AAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;AAE1D;;GAEG;AACH,sEAAsE;AACtE,kEAAkE;AAClE,wEAAwE;AACxE,oEAAoE;AACpE,yEAAyE;AACzE,MAAM,QAAQ,GAA4B;IACxC,KAAK,EAAE,uBAAuB;IAC9B,OAAO,EAAE,sBAAsB;IAC/B,UAAU,EAAE,sBAAsB;CACnC,CAAC;AAKF;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,IAAI,MAAM,KAAK,UAAU;YAAE,OAAO,GAAc,CAAC;IACnD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,8EAA8E;AAC9E,qCAAqC;AACrC,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,YAAY;IACnB,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;QAE9D,mEAAmE;QACnE,IAAI,aAAa,IAAI,MAAM,IAAI,cAAc,IAAI,MAAM,EAAE,CAAC;YACxD,MAAM,MAAM,GAAG,MAAiC,CAAC;YACjD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,IAAI,sBAAsB,CAAC;YACxD,MAAM,GAAG,GAAa,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;YACxC,mBAAmB;YACnB,aAAa,CAAC,GAAG,CAAC,CAAC;YACnB,OAAO,GAAG,CAAC;QACb,CAAC;QAED,OAAO,MAA6B,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;QACjE,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,GAAa;IAClC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAC;IACrC,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QACvD,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,YAAY,CAAC,CAAU;IAC9B,MAAM,GAAG,GAAG,CAA4B,CAAC;IACzC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,WAAW,IAAI,GAAG,EAAE,YAAY,IAAI,GAAG,EAAE,SAAS,CAAC,CAAC;AACrE,CAAC;AAED,8EAA8E;AAC9E,sEAAsE;AACtE,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU;IACxB,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnC,uCAAuC;IACvC,MAAM,UAAU,GAAG,gBAAgB,EAAE,CAAC;IACtC,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9B,IAAI,KAAK,IAAI,YAAY,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,4DAA4D;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sEAAsE;IACtE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,IAAI,KAAK,IAAI,YAAY,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1C,sDAAsD;IACtD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC;IACnE,IAAI,KAAK,IAAI,YAAY,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,MAAoB;IAC7C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,IAAI,gBAAgB,EAAE,IAAI,QAAQ,CAAC,OAAO,CAAC;QACxE,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;QAClB,aAAa,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;QAC1D,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY,EAAE,MAAoB;IACjE,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC;IAC5B,aAAa,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW;IACzB,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO;QAEvC,sCAAsC;QACtC,MAAM,UAAU,GAAG,UAAU,GAAG,MAAM,CAAC;QACvC,IAAI,CAAC;YACH,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YACxC,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,2CAA2C;QAC7C,CAAC;QAED,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,gBAAgB,EAAE,CAAC;QACtC,IAAI,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAClC,OAAO,GAAG,CAAC,UAAU,CAAC,CAAC;YACvB,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,aAAa,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACvB,6DAA6D;YAC7D,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,UAAU,GAAG,UAAU,GAAG,MAAM,CAAC;IACvC,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5D,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;YAE9D,8CAA8C;YAC9C,IAAI,aAAa,IAAI,MAAM,IAAK,MAAuB,CAAC,YAAY,EAAE,CAAC;gBACrE,MAAM,MAAM,GAAG,MAAsB,CAAC;gBACtC,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,IAAI,QAAQ,CAAC,OAAO,CAAC;gBAClD,aAAa,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;gBACjC,OAAO,CAAC,KAAK,CACX,kEAAkE,CACnE,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YAED,oEAAoE;YACpE,MAAM,GAAG,GAAG,MAAkB,CAAC;YAC/B,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;YAClE,IAAI,UAAU,EAAE,CAAC;gBACf,aAAa,CAAC,GAAG,CAAC,CAAC;gBACnB,OAAO,CAAC,KAAK,CACX,kEAAkE,CACnE,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,kDAAkD,EAAE,KAAK,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe;IAC7B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ;IACtB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,gBAAgB;IACvB,IAAI,CAAC;QACH,2BAA2B;QAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YAC/B,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACpD,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAE1D,CAAC;YACF,IAAI,GAAG,CAAC,MAAM;gBAAE,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/token-store.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=token-store.test.d.ts.map

package/dist/token-store.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.test.d.ts","sourceRoot":"","sources":["../src/token-store.test.ts"],"names":[],"mappings":""}

package/dist/token-store.test.js

@@ -0,0 +1,239 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+// Mutable ref so the mock can read the current tmpDir
+const state = vi.hoisted(() => ({ tmpDir: '' }));
+// Mock os.homedir() so token-store's module-level TQ_DIR uses our temp dir
+vi.mock('os', async (importOriginal) => {
+    const original = await importOriginal();
+    return { ...original, homedir: () => state.tmpDir };
+});
+// Re-import the module each test so module-level constants re-evaluate
+let loadTokens;
+let loadTokensForEnv;
+let saveTokens;
+let saveTokensForEnv;
+let clearTokens;
+let hasStoredTokens;
+let getTqDir;
+let getTokenFilePath;
+let resolveEnvFromUrl;
+let resolveUrlFromEnv;
+const stagingTokens = {
+    accessToken: 'staging-access',
+    refreshToken: 'staging-refresh',
+    expiresAt: Date.now() + 3600000,
+    apiBaseUrl: 'https://api.levr.now',
+};
+const localTokens = {
+    accessToken: 'local-access',
+    refreshToken: 'local-refresh',
+    expiresAt: Date.now() + 3600000,
+    apiBaseUrl: 'http://localhost:8080',
+};
+beforeEach(async () => {
+    state.tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tq-oauth-test-'));
+    // Reset module cache so TQ_DIR re-evaluates with the new homedir mock
+    vi.resetModules();
+    const mod = await import('./token-store.js');
+    loadTokens = mod.loadTokens;
+    loadTokensForEnv = mod.loadTokensForEnv;
+    saveTokens = mod.saveTokens;
+    saveTokensForEnv = mod.saveTokensForEnv;
+    clearTokens = mod.clearTokens;
+    hasStoredTokens = mod.hasStoredTokens;
+    getTqDir = mod.getTqDir;
+    getTokenFilePath = mod.getTokenFilePath;
+    resolveEnvFromUrl = mod.resolveEnvFromUrl;
+    resolveUrlFromEnv = mod.resolveUrlFromEnv;
+});
+afterEach(() => {
+    delete process.env.TQ_BACKEND_URL;
+    fs.rmSync(state.tmpDir, { recursive: true, force: true });
+});
+describe('getTqDir', () => {
+    it('returns ~/.tq path based on homedir', () => {
+        expect(getTqDir()).toBe(path.join(state.tmpDir, '.tq'));
+    });
+});
+describe('getTokenFilePath', () => {
+    it('returns path to oauth-tokens.json', () => {
+        expect(getTokenFilePath()).toBe(path.join(state.tmpDir, '.tq', 'oauth-tokens.json'));
+    });
+});
+describe('resolveEnvFromUrl', () => {
+    it('resolves local URL', () => {
+        expect(resolveEnvFromUrl('http://localhost:8080')).toBe('local');
+    });
+    it('resolves staging URL', () => {
+        expect(resolveEnvFromUrl('https://api.levr.now')).toBe('staging');
+    });
+    it('resolves production URL', () => {
+        expect(resolveEnvFromUrl('https://api.levr.one')).toBe('production');
+    });
+    it('strips trailing slashes', () => {
+        expect(resolveEnvFromUrl('http://localhost:8080/')).toBe('local');
+    });
+    it('returns undefined for unknown URLs', () => {
+        expect(resolveEnvFromUrl('https://custom.example.com')).toBeUndefined();
+    });
+});
+describe('resolveUrlFromEnv', () => {
+    it('returns correct URL for each env', () => {
+        expect(resolveUrlFromEnv('local')).toBe('http://localhost:8080');
+        expect(resolveUrlFromEnv('staging')).toBe('https://api.levr.now');
+        expect(resolveUrlFromEnv('production')).toBe('https://api.levr.one');
+    });
+});
+describe('saveTokens + loadTokens roundtrip', () => {
+    it('saves and loads tokens correctly', () => {
+        saveTokens(stagingTokens);
+        // loadTokens reads the entry matching the current env;
+        // without config.json it falls back to first entry
+        const loaded = loadTokens();
+        expect(loaded).toEqual(stagingTokens);
+    });
+    it('creates ~/.tq directory if missing', () => {
+        expect(fs.existsSync(path.join(state.tmpDir, '.tq'))).toBe(false);
+        saveTokens(stagingTokens);
+        expect(fs.existsSync(path.join(state.tmpDir, '.tq'))).toBe(true);
+    });
+    it('overwrites existing tokens for the same env', () => {
+        saveTokens(stagingTokens);
+        const updated = {
+            ...stagingTokens,
+            accessToken: 'new-token',
+        };
+        saveTokens(updated);
+        const loaded = loadTokensForEnv('staging');
+        expect(loaded?.accessToken).toBe('new-token');
+    });
+});
+describe('token map: multiple environments', () => {
+    it('stores tokens for multiple environments in one file', () => {
+        saveTokens(stagingTokens);
+        saveTokens(localTokens);
+        expect(loadTokensForEnv('staging')?.accessToken).toBe('staging-access');
+        expect(loadTokensForEnv('local')?.accessToken).toBe('local-access');
+        expect(loadTokensForEnv('production')).toBeNull();
+    });
+    it('loadTokens returns entry matching current env via TQ_BACKEND_URL', () => {
+        saveTokens(stagingTokens);
+        saveTokens(localTokens);
+        process.env.TQ_BACKEND_URL = 'http://localhost:8080';
+        const loaded = loadTokens();
+        expect(loaded?.accessToken).toBe('local-access');
+    });
+    it('loadTokens returns entry matching config.json', () => {
+        saveTokens(stagingTokens);
+        saveTokens(localTokens);
+        // Write a config.json pointing to staging
+        const tqDir = path.join(state.tmpDir, '.tq');
+        fs.writeFileSync(path.join(tqDir, 'config.json'), JSON.stringify({ apiUrl: 'https://api.levr.now' }));
+        const loaded = loadTokens();
+        expect(loaded?.accessToken).toBe('staging-access');
+    });
+    it('loadTokens falls back to first entry when no config', () => {
+        saveTokens(stagingTokens);
+        const loaded = loadTokens();
+        expect(loaded?.accessToken).toBe('staging-access');
+    });
+});
+describe('backward compatibility: legacy single-token format', () => {
+    it('migrates legacy format on first read', () => {
+        const tqDir = path.join(state.tmpDir, '.tq');
+        fs.mkdirSync(tqDir, { recursive: true });
+        // Write legacy format (flat object)
+        fs.writeFileSync(path.join(tqDir, 'oauth-tokens.json'), JSON.stringify(stagingTokens));
+        const loaded = loadTokens();
+        expect(loaded?.accessToken).toBe('staging-access');
+        // File should now be in map format
+        const raw = JSON.parse(fs.readFileSync(path.join(tqDir, 'oauth-tokens.json'), 'utf-8'));
+        expect(raw['https://api.levr.now']).toBeDefined();
+        expect(raw['https://api.levr.now'].accessToken).toBe('staging-access');
+    });
+    it('migrates legacy format without apiBaseUrl using staging default', () => {
+        const tqDir = path.join(state.tmpDir, '.tq');
+        fs.mkdirSync(tqDir, { recursive: true });
+        const legacy = {
+            accessToken: 'a',
+            refreshToken: 'r',
+            expiresAt: 9999999999999,
+        };
+        fs.writeFileSync(path.join(tqDir, 'oauth-tokens.json'), JSON.stringify(legacy));
+        const loaded = loadTokens();
+        expect(loaded?.accessToken).toBe('a');
+    });
+});
+describe('loadTokens', () => {
+    it('returns null when no token file exists', () => {
+        expect(loadTokens()).toBeNull();
+    });
+    it('returns null for malformed JSON', () => {
+        const tqDir = path.join(state.tmpDir, '.tq');
+        fs.mkdirSync(tqDir, { recursive: true });
+        fs.writeFileSync(path.join(tqDir, 'oauth-tokens.json'), 'not-json');
+        expect(loadTokens()).toBeNull();
+    });
+});
+describe('loadTokensForEnv', () => {
+    it('returns null when no matching token exists', () => {
+        saveTokens(stagingTokens);
+        expect(loadTokensForEnv('local')).toBeNull();
+    });
+    it('returns the correct env token', () => {
+        saveTokens(stagingTokens);
+        saveTokens(localTokens);
+        expect(loadTokensForEnv('staging')?.accessToken).toBe('staging-access');
+        expect(loadTokensForEnv('local')?.accessToken).toBe('local-access');
+    });
+});
+describe('clearTokens', () => {
+    it('removes the token for the current environment', () => {
+        saveTokens(stagingTokens);
+        saveTokens(localTokens);
+        // Clear staging (current env via TQ_BACKEND_URL)
+        process.env.TQ_BACKEND_URL = 'https://api.levr.now';
+        clearTokens();
+        expect(loadTokensForEnv('staging')).toBeNull();
+        expect(loadTokensForEnv('local')?.accessToken).toBe('local-access');
+    });
+    it('removes entire file when last token cleared', () => {
+        saveTokens(stagingTokens);
+        process.env.TQ_BACKEND_URL = 'https://api.levr.now';
+        clearTokens();
+        expect(hasStoredTokens()).toBe(false);
+    });
+    it('does not throw when no token file exists', () => {
+        expect(() => clearTokens()).not.toThrow();
+    });
+    it('creates a backup before clearing', () => {
+        saveTokens(stagingTokens);
+        process.env.TQ_BACKEND_URL = 'https://api.levr.now';
+        clearTokens();
+        const backupPath = getTokenFilePath() + '.bak';
+        expect(fs.existsSync(backupPath)).toBe(true);
+    });
+});
+describe('hasStoredTokens', () => {
+    it('returns false when no file exists', () => {
+        expect(hasStoredTokens()).toBe(false);
+    });
+    it('returns true after saving tokens', () => {
+        saveTokens(stagingTokens);
+        expect(hasStoredTokens()).toBe(true);
+    });
+});
+describe('saveTokensForEnv', () => {
+    it('saves and retrieves by env name', () => {
+        saveTokensForEnv('production', {
+            ...stagingTokens,
+            accessToken: 'prod-access',
+            apiBaseUrl: 'https://api.levr.one',
+        });
+        const loaded = loadTokensForEnv('production');
+        expect(loaded?.accessToken).toBe('prod-access');
+    });
+});
+//# sourceMappingURL=token-store.test.js.map

package/dist/token-store.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.test.js","sourceRoot":"","sources":["../src/token-store.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAGzB,sDAAsD;AACtD,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAEjD,2EAA2E;AAC3E,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACrC,MAAM,QAAQ,GAAG,MAAM,cAAc,EAAuB,CAAC;IAC7D,OAAO,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;AACtD,CAAC,CAAC,CAAC;AAEH,uEAAuE;AACvE,IAAI,UAAwD,CAAC;AAC7D,IAAI,gBAAoE,CAAC;AACzE,IAAI,UAAwD,CAAC;AAC7D,IAAI,gBAAoE,CAAC;AACzE,IAAI,WAA0D,CAAC;AAC/D,IAAI,eAAkE,CAAC;AACvE,IAAI,QAAoD,CAAC;AACzD,IAAI,gBAAoE,CAAC;AACzE,IAAI,iBAAsE,CAAC;AAC3E,IAAI,iBAAsE,CAAC;AAE3E,MAAM,aAAa,GAAiB;IAClC,WAAW,EAAE,gBAAgB;IAC7B,YAAY,EAAE,iBAAiB;IAC/B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;IAC/B,UAAU,EAAE,sBAAsB;CACnC,CAAC;AAEF,MAAM,WAAW,GAAiB;IAChC,WAAW,EAAE,cAAc;IAC3B,YAAY,EAAE,eAAe;IAC7B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;IAC/B,UAAU,EAAE,uBAAuB;CACpC,CAAC;AAEF,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACxE,sEAAsE;IACtE,EAAE,CAAC,YAAY,EAAE,CAAC;IAClB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC7C,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;IAC5B,gBAAgB,GAAG,GAAG,CAAC,gBAAgB,CAAC;IACxC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;IAC5B,gBAAgB,GAAG,GAAG,CAAC,gBAAgB,CAAC;IACxC,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;IAC9B,eAAe,GAAG,GAAG,CAAC,eAAe,CAAC;IACtC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IACxB,gBAAgB,GAAG,GAAG,CAAC,gBAAgB,CAAC;IACxC,iBAAiB,GAAG,GAAG,CAAC,iBAAiB,CAAC;IAC1C,iBAAiB,GAAG,GAAG,CAAC,iBAAiB,CAAC;AAC5C,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,EAAE;IACb,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAClC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE;IACxB,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAC7B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,mBAAmB,CAAC,CACpD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAC5B,MAAM,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,iBAAiB,CAAC,4BAA4B,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACjE,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAClE,MAAM,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;IACjD,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,UAAU,CAAC,aAAa,CAAC,CAAC;QAC1B,uDAAuD;QACvD,mDAAmD;QACnD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClE,UAAU,CAAC,aAAa,CAAC,CAAC;QAC1B,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,UAAU,CAAC,aAAa,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAiB;YAC5B,GAAG,aAAa;YAChB,WAAW,EAAE,WAAW;SACzB,CAAC;QACF,UAAU,CAAC,OAAO,CAAC,CAAC;QACpB,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;IAChD,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,UAAU,CAAC,aAAa,CAAC,CAAC;QAC1B,UAAU,CAAC,WAAW,CAAC,CAAC;QAExB,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACxE,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACpE,MAAM,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,UAAU,CAAC,aAAa,CAAC,CAAC;QAC1B,UAAU,CAAC,WAAW,CAAC,CAAC;QAExB,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,uBAAuB,CAAC;QACrD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,UAAU,CAAC,aAAa,CAAC,CAAC;QAC1B,UAAU,CAAC,WAAW,CAAC,CAAC;QAExB,0CAA0C;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC7C,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,EAC/B,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CACnD,CAAC;QAEF,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,UAAU,CAAC,aAAa,CAAC,CAAC;QAC1B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oDAAoD,EAAE,GAAG,EAAE;IAClE,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC7C,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,oCAAoC;QACpC,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,mBAAmB,CAAC,EACrC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAC9B,CAAC;QAEF,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAEnD,mCAAmC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CACpB,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,mBAAmB,CAAC,EAAE,OAAO,CAAC,CAChC,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAClD,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC7C,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,MAAM,MAAM,GAAiB;YAC3B,WAAW,EAAE,GAAG;YAChB,YAAY,EAAE,GAAG;YACjB,SAAS,EAAE,aAAa;SACzB,CAAC;QACF,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,mBAAmB,CAAC,EACrC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CACvB,CAAC;QAEF,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC7C,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,mBAAmB,CAAC,EAAE,UAAU,CAAC,CAAC;QACpE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,UAAU,CAAC,aAAa,CAAC,CAAC;QAC1B,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,UAAU,CAAC,aAAa,CAAC,CAAC;QAC1B,UAAU,CAAC,WAAW,CAAC,CAAC;QACxB,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACxE,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,UAAU,CAAC,aAAa,CAAC,CAAC;QAC1B,UAAU,CAAC,WAAW,CAAC,CAAC;QAExB,iDAAiD;QACjD,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,sBAAsB,CAAC;QACpD,WAAW,EAAE,CAAC;QAEd,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC/C,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,UAAU,CAAC,aAAa,CAAC,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,sBAAsB,CAAC;QACpD,WAAW,EAAE,CAAC;QACd,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,UAAU,CAAC,aAAa,CAAC,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,sBAAsB,CAAC;QACpD,WAAW,EAAE,CAAC;QACd,MAAM,UAAU,GAAG,gBAAgB,EAAE,GAAG,MAAM,CAAC;QAC/C,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,UAAU,CAAC,aAAa,CAAC,CAAC;QAC1B,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,gBAAgB,CAAC,YAAY,EAAE;YAC7B,GAAG,aAAa;YAChB,WAAW,EAAE,aAAa;YAC1B,UAAU,EAAE,sBAAsB;SACnC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;QAC9C,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/token-watcher.d.ts

@@ -0,0 +1,82 @@
+/**
+ * TokenWatcher - Self-Healing Token Management
+ *
+ * Watches the token file for changes and notifies subscribers.
+ * This enables MCP servers to auto-recover when:
+ * - Tokens appear after startup (user runs authorize)
+ * - Tokens are refreshed externally
+ * - Token file is fixed after corruption
+ */
+import type { StoredTokens, TokenChangeCallback, AuthStatus } from './types.js';
+/**
+ * Options for TokenWatcher
+ */
+export interface TokenWatcherOptions {
+    /** Polling interval in milliseconds (backup if fs.watch misses events) */
+    pollInterval?: number;
+    /** Minutes before expiration to consider token as expiring soon */
+    expirationWarningMinutes?: number;
+}
+/**
+ * TokenWatcher for self-healing token management
+ *
+ * Usage:
+ * ```typescript
+ * const watcher = new TokenWatcher();
+ * watcher.onTokenChange((tokens) => {
+ *   if (tokens) {
+ *     console.log('Tokens available:', tokens.expiresAt > Date.now() ? 'valid' : 'expired');
+ *   } else {
+ *     console.log('No tokens available');
+ *   }
+ * });
+ * watcher.start();
+ * ```
+ */
+export declare class TokenWatcher {
+    private watcher;
+    private pollInterval;
+    private lastTokens;
+    private lastTokensJson;
+    private callbacks;
+    private options;
+    private isRunning;
+    constructor(options?: TokenWatcherOptions);
+    /**
+     * Start watching for token changes
+     */
+    start(): void;
+    /**
+     * Stop watching for token changes
+     */
+    stop(): void;
+    /**
+     * Register a callback for token changes
+     */
+    onTokenChange(callback: TokenChangeCallback): void;
+    /**
+     * Remove a token change callback
+     */
+    offTokenChange(callback: TokenChangeCallback): void;
+    /**
+     * Get current tokens (synchronous)
+     */
+    getCurrentTokens(): StoredTokens | null;
+    /**
+     * Get current auth status based on tokens
+     */
+    getAuthStatus(): AuthStatus;
+    /**
+     * Check if tokens are valid (not expired)
+     */
+    isTokenValid(): boolean;
+    /**
+     * Force a token check (useful after manual refresh)
+     */
+    forceCheck(): void;
+    /**
+     * Internal: Check tokens and notify if changed
+     */
+    private checkTokens;
+}
+//# sourceMappingURL=token-watcher.d.ts.map

package/dist/token-watcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-watcher.d.ts","sourceRoot":"","sources":["../src/token-watcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EAAE,YAAY,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC;AAOD;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,OAAO,CAA6B;IAC5C,OAAO,CAAC,YAAY,CAA+B;IACnD,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,cAAc,CAAc;IACpC,OAAO,CAAC,SAAS,CAAuC;IACxD,OAAO,CAAC,OAAO,CAAgC;IAC/C,OAAO,CAAC,SAAS,CAAkB;gBAEvB,OAAO,CAAC,EAAE,mBAAmB;IAIzC;;OAEG;IACH,KAAK,IAAI,IAAI;IA+Cb;;OAEG;IACH,IAAI,IAAI,IAAI;IAcZ;;OAEG;IACH,aAAa,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI;IASlD;;OAEG;IACH,cAAc,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI;IAInD;;OAEG;IACH,gBAAgB,IAAI,YAAY,GAAG,IAAI;IAIvC;;OAEG;IACH,aAAa,IAAI,UAAU;IAoB3B;;OAEG;IACH,YAAY,IAAI,OAAO;IAIvB;;OAEG;IACH,UAAU,IAAI,IAAI;IAIlB;;OAEG;IACH,OAAO,CAAC,WAAW;CA2BpB"}