@payloadcms/figma 0.0.1-alpha.1 → 0.0.1-alpha.11

package/dist/auth/callback-server.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/auth/callback-server.spec.ts"],"sourcesContent":["import { describe, expect, it } from 'vitest'\n\nimport { CallbackError, CallbackServer } from './callback-server.js'\n\ndescribe('CallbackServer', () => {\n  describe('waitForCallback', () => {\n    it('should resolve with code and state on successful callback', async () => {\n      const server = new CallbackServer({ port: 3001, timeoutMs: 5000 })\n      const expectedState = 'test-state-123'\n\n      // Start waiting for callback\n      const callbackPromise = server.waitForCallback(expectedState)\n\n      // Simulate OAuth callback\n      await fetch(`http://localhost:3001/callback?code=auth-code-123&state=${expectedState}`)\n\n      const result = await callbackPromise\n      expect(result.code).toBe('auth-code-123')\n      expect(result.state).toBe(expectedState)\n\n      server.stop()\n    })\n\n    it('should reject with CallbackError on state mismatch', async () => {\n      const server = new CallbackServer({ port: 3002, timeoutMs: 5000 })\n      const expectedState = 'test-state-123'\n\n      const callbackPromise = server.waitForCallback(expectedState)\n\n      // Send wrong state\n      const fetchPromise = fetch(\n        `http://localhost:3002/callback?code=auth-code-123&state=wrong-state`,\n      )\n\n      await expect(callbackPromise).rejects.toThrow(CallbackError)\n      await expect(callbackPromise).rejects.toThrow('State mismatch')\n\n      // Wait for fetch to complete\n      await fetchPromise\n\n      server.stop()\n    })\n\n    it('should reject with CallbackError on OAuth error', async () => {\n      const server = new CallbackServer({ port: 3003, timeoutMs: 5000 })\n      const expectedState = 'test-state-123'\n\n      const callbackPromise = server.waitForCallback(expectedState)\n\n      // Send OAuth error\n      const fetchPromise = fetch(\n        `http://localhost:3003/callback?error=access_denied&error_description=User+denied`,\n      )\n\n      await expect(callbackPromise).rejects.toThrow(CallbackError)\n      await expect(callbackPromise).rejects.toThrow('access_denied')\n\n      // Wait for fetch to complete\n      await fetchPromise\n\n      server.stop()\n    })\n\n    it('should reject with CallbackError on timeout', async () => {\n      const server = new CallbackServer({ port: 3005, timeoutMs: 100 })\n      const expectedState = 'test-state-123'\n\n      const callbackPromise = server.waitForCallback(expectedState)\n\n      // Don't send callback - let it timeout\n      await expect(callbackPromise).rejects.toThrow(CallbackError)\n      await expect(callbackPromise).rejects.toThrow('timed out')\n\n      server.stop()\n    }, 1000)\n\n    it('should return 404 for non-callback paths', async () => {\n      const server = new CallbackServer({ port: 3006, timeoutMs: 200 })\n      const expectedState = 'test-state-123'\n\n      // Start server\n      const callbackPromise = server.waitForCallback(expectedState).catch(() => {\n        // Ignore timeout error\n      })\n\n      // Wait a bit for server to start\n      await new Promise((resolve) => setTimeout(resolve, 50))\n\n      // Try to access wrong path\n      const response = await fetch('http://localhost:3006/not-callback')\n      expect(response.status).toBe(404)\n\n      // Clean up\n      server.stop()\n\n      // Wait for promise to complete\n      await callbackPromise\n    }, 2000)\n  })\n})\n"],"names":["describe","expect","it","CallbackError","CallbackServer","server","port","timeoutMs","expectedState","callbackPromise","waitForCallback","fetch","result","code","toBe","state","stop","fetchPromise","rejects","toThrow","catch","Promise","resolve","setTimeout","response","status"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAE7C,SAASC,aAAa,EAAEC,cAAc,QAAQ,uBAAsB;AAEpEJ,SAAS,kBAAkB;IACzBA,SAAS,mBAAmB;QAC1BE,GAAG,6DAA6D;YAC9D,MAAMG,SAAS,IAAID,eAAe;gBAAEE,MAAM;gBAAMC,WAAW;YAAK;YAChE,MAAMC,gBAAgB;YAEtB,6BAA6B;YAC7B,MAAMC,kBAAkBJ,OAAOK,eAAe,CAACF;YAE/C,0BAA0B;YAC1B,MAAMG,MAAM,CAAC,wDAAwD,EAAEH,eAAe;YAEtF,MAAMI,SAAS,MAAMH;YACrBR,OAAOW,OAAOC,IAAI,EAAEC,IAAI,CAAC;YACzBb,OAAOW,OAAOG,KAAK,EAAED,IAAI,CAACN;YAE1BH,OAAOW,IAAI;QACb;QAEAd,GAAG,sDAAsD;YACvD,MAAMG,SAAS,IAAID,eAAe;gBAAEE,MAAM;gBAAMC,WAAW;YAAK;YAChE,MAAMC,gBAAgB;YAEtB,MAAMC,kBAAkBJ,OAAOK,eAAe,CAACF;YAE/C,mBAAmB;YACnB,MAAMS,eAAeN,MACnB,CAAC,mEAAmE,CAAC;YAGvE,MAAMV,OAAOQ,iBAAiBS,OAAO,CAACC,OAAO,CAAChB;YAC9C,MAAMF,OAAOQ,iBAAiBS,OAAO,CAACC,OAAO,CAAC;YAE9C,6BAA6B;YAC7B,MAAMF;YAENZ,OAAOW,IAAI;QACb;QAEAd,GAAG,mDAAmD;YACpD,MAAMG,SAAS,IAAID,eAAe;gBAAEE,MAAM;gBAAMC,WAAW;YAAK;YAChE,MAAMC,gBAAgB;YAEtB,MAAMC,kBAAkBJ,OAAOK,eAAe,CAACF;YAE/C,mBAAmB;YACnB,MAAMS,eAAeN,MACnB,CAAC,gFAAgF,CAAC;YAGpF,MAAMV,OAAOQ,iBAAiBS,OAAO,CAACC,OAAO,CAAChB;YAC9C,MAAMF,OAAOQ,iBAAiBS,OAAO,CAACC,OAAO,CAAC;YAE9C,6BAA6B;YAC7B,MAAMF;YAENZ,OAAOW,IAAI;QACb;QAEAd,GAAG,+CAA+C;YAChD,MAAMG,SAAS,IAAID,eAAe;gBAAEE,MAAM;gBAAMC,WAAW;YAAI;YAC/D,MAAMC,gBAAgB;YAEtB,MAAMC,kBAAkBJ,OAAOK,eAAe,CAACF;YAE/C,uCAAuC;YACvC,MAAMP,OAAOQ,iBAAiBS,OAAO,CAACC,OAAO,CAAChB;YAC9C,MAAMF,OAAOQ,iBAAiBS,OAAO,CAACC,OAAO,CAAC;YAE9Cd,OAAOW,IAAI;QACb,GAAG;QAEHd,GAAG,4CAA4C;YAC7C,MAAMG,SAAS,IAAID,eAAe;gBAAEE,MAAM;gBAAMC,WAAW;YAAI;YAC/D,MAAMC,gBAAgB;YAEtB,eAAe;YACf,MAAMC,kBAAkBJ,OAAOK,eAAe,CAACF,eAAeY,KAAK,CAAC;YAClE,uBAAuB;YACzB;YAEA,iCAAiC;YACjC,MAAM,IAAIC,QAAQ,CAACC,UAAYC,WAAWD,SAAS;YAEnD,2BAA2B;YAC3B,MAAME,WAAW,MAAMb,MAAM;YAC7BV,OAAOuB,SAASC,MAAM,EAAEX,IAAI,CAAC;YAE7B,WAAW;YACXT,OAAOW,IAAI;YAEX,+BAA+B;YAC/B,MAAMP;QACR,GAAG;IACL;AACF"}

package/dist/auth/crypto-utils.spec.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=crypto-utils.spec.d.ts.map

package/dist/auth/crypto-utils.spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"crypto-utils.spec.d.ts","sourceRoot":"","sources":["../../src/auth/crypto-utils.spec.ts"],"names":[],"mappings":""}

package/dist/auth/crypto-utils.spec.js

@@ -1,36 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { deriveEncryptionKey } from './crypto-utils.js';
-describe('crypto-utils', ()=>{
-    describe('deriveEncryptionKey', ()=>{
-        it('should return the same key on multiple calls (deterministic)', ()=>{
-            const key1 = deriveEncryptionKey();
-            const key2 = deriveEncryptionKey();
-            const key3 = deriveEncryptionKey();
-            expect(key1).toBe(key2);
-            expect(key2).toBe(key3);
-        });
-        it('should produce keys suitable for AES-256 encryption', ()=>{
-            const key = deriveEncryptionKey();
-            // AES-256 requires 256 bits = 32 bytes = 64 hex characters
-            expect(key.length).toBe(64);
-            // Should be valid hex (can be converted to Buffer)
-            expect(()=>Buffer.from(key, 'hex')).not.toThrow();
-            const buffer = Buffer.from(key, 'hex');
-            expect(buffer.length).toBe(32); // 32 bytes
-        });
-        it('should complete key derivation in reasonable time', ()=>{
-            // Test that 100k PBKDF2 iterations complete quickly enough for CLI use
-            const startTime = Date.now();
-            // Run multiple times to get average
-            for(let i = 0; i < 5; i++){
-                deriveEncryptionKey();
-            }
-            const endTime = Date.now();
-            const avgTime = (endTime - startTime) / 5;
-            // Each call should take less than 2 seconds on average
-            expect(avgTime).toBeLessThan(2000);
-        });
-    });
-});
-
-//# sourceMappingURL=crypto-utils.spec.js.map

package/dist/auth/crypto-utils.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/auth/crypto-utils.spec.ts"],"sourcesContent":["import { describe, expect, it } from 'vitest'\n\nimport { deriveEncryptionKey } from './crypto-utils.js'\n\ndescribe('crypto-utils', () => {\n  describe('deriveEncryptionKey', () => {\n    it('should return the same key on multiple calls (deterministic)', () => {\n      const key1 = deriveEncryptionKey()\n      const key2 = deriveEncryptionKey()\n      const key3 = deriveEncryptionKey()\n\n      expect(key1).toBe(key2)\n      expect(key2).toBe(key3)\n    })\n\n    it('should produce keys suitable for AES-256 encryption', () => {\n      const key = deriveEncryptionKey()\n\n      // AES-256 requires 256 bits = 32 bytes = 64 hex characters\n      expect(key.length).toBe(64)\n\n      // Should be valid hex (can be converted to Buffer)\n      expect(() => Buffer.from(key, 'hex')).not.toThrow()\n\n      const buffer = Buffer.from(key, 'hex')\n      expect(buffer.length).toBe(32) // 32 bytes\n    })\n\n    it('should complete key derivation in reasonable time', () => {\n      // Test that 100k PBKDF2 iterations complete quickly enough for CLI use\n      const startTime = Date.now()\n\n      // Run multiple times to get average\n      for (let i = 0; i < 5; i++) {\n        deriveEncryptionKey()\n      }\n\n      const endTime = Date.now()\n      const avgTime = (endTime - startTime) / 5\n\n      // Each call should take less than 2 seconds on average\n      expect(avgTime).toBeLessThan(2000)\n    })\n  })\n})\n"],"names":["describe","expect","it","deriveEncryptionKey","key1","key2","key3","toBe","key","length","Buffer","from","not","toThrow","buffer","startTime","Date","now","i","endTime","avgTime","toBeLessThan"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAE7C,SAASC,mBAAmB,QAAQ,oBAAmB;AAEvDH,SAAS,gBAAgB;IACvBA,SAAS,uBAAuB;QAC9BE,GAAG,gEAAgE;YACjE,MAAME,OAAOD;YACb,MAAME,OAAOF;YACb,MAAMG,OAAOH;YAEbF,OAAOG,MAAMG,IAAI,CAACF;YAClBJ,OAAOI,MAAME,IAAI,CAACD;QACpB;QAEAJ,GAAG,uDAAuD;YACxD,MAAMM,MAAML;YAEZ,2DAA2D;YAC3DF,OAAOO,IAAIC,MAAM,EAAEF,IAAI,CAAC;YAExB,mDAAmD;YACnDN,OAAO,IAAMS,OAAOC,IAAI,CAACH,KAAK,QAAQI,GAAG,CAACC,OAAO;YAEjD,MAAMC,SAASJ,OAAOC,IAAI,CAACH,KAAK;YAChCP,OAAOa,OAAOL,MAAM,EAAEF,IAAI,CAAC,KAAI,WAAW;QAC5C;QAEAL,GAAG,qDAAqD;YACtD,uEAAuE;YACvE,MAAMa,YAAYC,KAAKC,GAAG;YAE1B,oCAAoC;YACpC,IAAK,IAAIC,IAAI,GAAGA,IAAI,GAAGA,IAAK;gBAC1Bf;YACF;YAEA,MAAMgB,UAAUH,KAAKC,GAAG;YACxB,MAAMG,UAAU,AAACD,CAAAA,UAAUJ,SAAQ,IAAK;YAExC,uDAAuD;YACvDd,OAAOmB,SAASC,YAAY,CAAC;QAC/B;IACF;AACF"}

package/dist/auth/jwt-validator.spec.d.ts

@@ -1,10 +0,0 @@
-/**
- * Unit tests for JWT validator
- *
- * Tests our wrapper logic around jose's JWT validation:
- * - Cache management (clearJWKSCache)
- * - Environment-based JWKS URI routing
- * - Error mapping from jose errors to our custom error codes
- */
-export {};
-//# sourceMappingURL=jwt-validator.spec.d.ts.map

package/dist/auth/jwt-validator.spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwt-validator.spec.d.ts","sourceRoot":"","sources":["../../src/auth/jwt-validator.spec.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/auth/jwt-validator.spec.js

@@ -1,236 +0,0 @@
-/**
- * Unit tests for JWT validator
- *
- * Tests our wrapper logic around jose's JWT validation:
- * - Cache management (clearJWKSCache)
- * - Environment-based JWKS URI routing
- * - Error mapping from jose errors to our custom error codes
- */ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { clearJWKSCache, JWTValidationError, validateProjectToken } from './jwt-validator.js';
-// Helper to create a simple test JWT (will fail validation but tests the flow)
-function createTestJWT(payload, kid = 'test-key-id') {
-    const header = Buffer.from(JSON.stringify({
-        alg: 'RS256',
-        kid,
-        typ: 'JWT'
-    })).toString('base64url');
-    const payloadStr = Buffer.from(JSON.stringify(payload)).toString('base64url');
-    const signature = 'fake_signature';
-    return `${header}.${payloadStr}.${signature}`;
-}
-describe('JWT Validator', ()=>{
-    // Mock JWKS with RSA key
-    const mockJWKS = {
-        keys: [
-            {
-                alg: 'RS256',
-                e: 'AQAB',
-                kid: 'test-key-id',
-                kty: 'RSA',
-                n: 'xGOr-H7A-PWO8VcD4sqDpCciAuqYDPq8zKWb4Vh6YhP8Ny3KcJaJhLMDEBJB3fKVvT-pPlkHPFBv7L7iHzRrJMXz8uDJVK-FTYmTQhcvKPyMWUDGDPNlVXEGkBLdj3DZqKjJ8iVChSh5DzKJvzr-RyGnH8Z7nLqBa91zxWfm7ztJxqP0qPRKz6vb4h8QyN-5X4Gh8gU7ZcLLnqLqJ6FhPvqKVcBhfN3KjM6h8hLXz6pPzKqJ8z6r8-9KcZXlWvR',
-                use: 'sig'
-            }
-        ]
-    };
-    beforeEach(()=>{
-        clearJWKSCache();
-        vi.restoreAllMocks();
-    });
-    afterEach(()=>{
-        clearJWKSCache();
-    });
-    describe('Cache Management', ()=>{
-        it('should clear resolver cache when clearJWKSCache is called', async ()=>{
-            const fetchMock = vi.fn().mockResolvedValue({
-                json: ()=>Promise.resolve(mockJWKS),
-                ok: true,
-                status: 200
-            });
-            global.fetch = fetchMock;
-            const token = createTestJWT({
-                exp: Math.floor(Date.now() / 1000) + 3600
-            });
-            // First validation - creates and caches resolver
-            try {
-                await validateProjectToken(token, 'staging');
-            } catch (_error) {
-            // Expected to fail on signature
-            }
-            const firstCallCount = fetchMock.mock.calls.length;
-            expect(firstCallCount).toBeGreaterThanOrEqual(1);
-            // Clear the cache - this is OUR logic
-            clearJWKSCache();
-            // Second validation after clearing cache - should create new resolver
-            try {
-                await validateProjectToken(token, 'staging');
-            } catch (_error) {
-            // Expected to fail on signature
-            }
-            // Verify fetch was called again after cache clear
-            expect(fetchMock.mock.calls.length).toBeGreaterThan(firstCallCount);
-        });
-    });
-    describe('Error Code Mapping', ()=>{
-        it('should map network errors to JWKS_FETCH_FAILED code', async ()=>{
-            global.fetch = vi.fn().mockRejectedValue(new Error('ENOTFOUND'));
-            const token = createTestJWT({
-                exp: Math.floor(Date.now() / 1000) + 3600
-            });
-            try {
-                await validateProjectToken(token, 'staging');
-                expect.fail('Should have thrown an error');
-            } catch (error) {
-                expect(error).toBeInstanceOf(JWTValidationError);
-                if (error instanceof JWTValidationError) {
-                    // Verify our error mapping logic
-                    expect(error.code).toBe('JWKS_FETCH_FAILED');
-                    expect(error.message).toContain('Failed to fetch JWKS');
-                }
-            }
-        });
-        it('should map jose signature errors to SIGNATURE_INVALID code', async ()=>{
-            global.fetch = vi.fn().mockResolvedValue({
-                json: ()=>Promise.resolve(mockJWKS),
-                ok: true,
-                status: 200
-            });
-            const badToken = 'eyJhbGciOiJSUzI1NiIsImtpZCI6InRlc3Qta2V5LWlkIn0.e30.bad_signature';
-            try {
-                await validateProjectToken(badToken, 'staging');
-                expect.fail('Should have thrown an error');
-            } catch (error) {
-                expect(error).toBeInstanceOf(JWTValidationError);
-                if (error instanceof JWTValidationError) {
-                    // Verify our error mapping logic - invalid tokens may fail at different stages
-                    // The important thing is that signature-related errors map to either SIGNATURE_INVALID or MISSING_KID
-                    expect([
-                        'SIGNATURE_INVALID',
-                        'MISSING_KID'
-                    ]).toContain(error.code);
-                }
-            }
-        });
-        it('should map expired token errors to EXPIRED code', async ()=>{
-            global.fetch = vi.fn().mockResolvedValue({
-                json: ()=>Promise.resolve(mockJWKS),
-                ok: true,
-                status: 200
-            });
-            // Create token that expired 1 hour ago
-            const expiredToken = createTestJWT({
-                exp: Math.floor(Date.now() / 1000) - 3600,
-                iat: Math.floor(Date.now() / 1000) - 7200
-            });
-            try {
-                await validateProjectToken(expiredToken, 'staging');
-                expect.fail('Should have thrown an error');
-            } catch (error) {
-                expect(error).toBeInstanceOf(JWTValidationError);
-                if (error instanceof JWTValidationError) {
-                    // Verify our error mapping logic
-                    // Note: Mock tokens with bad signatures may fail signature validation before expiry check
-                    // In real scenarios with valid signatures, EXPIRED would be returned
-                    expect([
-                        'EXPIRED',
-                        'SIGNATURE_INVALID',
-                        'MISSING_KID'
-                    ]).toContain(error.code);
-                }
-            }
-        });
-        it('should map missing kid errors to MISSING_KID code', async ()=>{
-            global.fetch = vi.fn().mockResolvedValue({
-                json: ()=>Promise.resolve(mockJWKS),
-                ok: true,
-                status: 200
-            });
-            // Create token without kid in header
-            const header = Buffer.from(JSON.stringify({
-                alg: 'RS256',
-                typ: 'JWT'
-            })).toString('base64url');
-            const payload = Buffer.from(JSON.stringify({
-                exp: Math.floor(Date.now() / 1000) + 3600
-            })).toString('base64url');
-            const tokenWithoutKid = `${header}.${payload}.fake_signature`;
-            try {
-                await validateProjectToken(tokenWithoutKid, 'staging');
-                expect.fail('Should have thrown an error');
-            } catch (error) {
-                expect(error).toBeInstanceOf(JWTValidationError);
-                if (error instanceof JWTValidationError) {
-                    // Verify our error mapping logic - tokens without kid may fail at various stages
-                    expect([
-                        'MISSING_KID',
-                        'SIGNATURE_INVALID'
-                    ]).toContain(error.code);
-                }
-            }
-        });
-        it('should map no matching key errors to SIGNATURE_INVALID code', async ()=>{
-            global.fetch = vi.fn().mockResolvedValue({
-                json: ()=>Promise.resolve(mockJWKS),
-                ok: true,
-                status: 200
-            });
-            // Create token with a kid that doesn't exist in JWKS
-            const tokenWithWrongKid = createTestJWT({
-                exp: Math.floor(Date.now() / 1000) + 3600
-            }, 'non-existent-key-id');
-            try {
-                await validateProjectToken(tokenWithWrongKid, 'staging');
-                expect.fail('Should have thrown an error');
-            } catch (error) {
-                expect(error).toBeInstanceOf(JWTValidationError);
-                if (error instanceof JWTValidationError) {
-                    // Verify our error mapping logic
-                    expect(error.code).toBe('SIGNATURE_INVALID');
-                    expect(error.message).toContain('Key not found in JWKS');
-                }
-            }
-        });
-        it('should handle multiple network error formats', async ()=>{
-            const networkErrors = [
-                new Error('fetch failed'),
-                new Error('network error'),
-                new Error('ECONNREFUSED')
-            ];
-            for (const networkError of networkErrors){
-                clearJWKSCache();
-                global.fetch = vi.fn().mockRejectedValue(networkError);
-                const token = createTestJWT({
-                    exp: Math.floor(Date.now() / 1000) + 3600
-                });
-                try {
-                    await validateProjectToken(token, 'staging');
-                    expect.fail('Should have thrown an error');
-                } catch (error) {
-                    expect(error).toBeInstanceOf(JWTValidationError);
-                    if (error instanceof JWTValidationError) {
-                        expect(error.code).toBe('JWKS_FETCH_FAILED');
-                    }
-                }
-            }
-        });
-        it('should handle generic errors with fallback', async ()=>{
-            // Mock an unexpected error type
-            global.fetch = vi.fn().mockRejectedValue('string error');
-            const token = createTestJWT({
-                exp: Math.floor(Date.now() / 1000) + 3600
-            });
-            try {
-                await validateProjectToken(token, 'staging');
-                expect.fail('Should have thrown an error');
-            } catch (error) {
-                expect(error).toBeInstanceOf(JWTValidationError);
-                if (error instanceof JWTValidationError) {
-                    // Generic errors fall back to SIGNATURE_INVALID
-                    expect(error.code).toBe('SIGNATURE_INVALID');
-                    expect(error.message).toContain('JWT validation failed');
-                }
-            }
-        });
-    });
-});
-
-//# sourceMappingURL=jwt-validator.spec.js.map

package/dist/auth/jwt-validator.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/auth/jwt-validator.spec.ts"],"sourcesContent":["/**\n * Unit tests for JWT validator\n *\n * Tests our wrapper logic around jose's JWT validation:\n * - Cache management (clearJWKSCache)\n * - Environment-based JWKS URI routing\n * - Error mapping from jose errors to our custom error codes\n */\n\nimport { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'\n\nimport { clearJWKSCache, JWTValidationError, validateProjectToken } from './jwt-validator.js'\n\n// Helper to create a simple test JWT (will fail validation but tests the flow)\nfunction createTestJWT(payload: Record<string, unknown>, kid = 'test-key-id'): string {\n  const header = Buffer.from(JSON.stringify({ alg: 'RS256', kid, typ: 'JWT' })).toString(\n    'base64url',\n  )\n  const payloadStr = Buffer.from(JSON.stringify(payload)).toString('base64url')\n  const signature = 'fake_signature'\n  return `${header}.${payloadStr}.${signature}`\n}\n\ndescribe('JWT Validator', () => {\n  // Mock JWKS with RSA key\n  const mockJWKS = {\n    keys: [\n      {\n        alg: 'RS256',\n        e: 'AQAB',\n        kid: 'test-key-id',\n        kty: 'RSA',\n        n: 'xGOr-H7A-PWO8VcD4sqDpCciAuqYDPq8zKWb4Vh6YhP8Ny3KcJaJhLMDEBJB3fKVvT-pPlkHPFBv7L7iHzRrJMXz8uDJVK-FTYmTQhcvKPyMWUDGDPNlVXEGkBLdj3DZqKjJ8iVChSh5DzKJvzr-RyGnH8Z7nLqBa91zxWfm7ztJxqP0qPRKz6vb4h8QyN-5X4Gh8gU7ZcLLnqLqJ6FhPvqKVcBhfN3KjM6h8hLXz6pPzKqJ8z6r8-9KcZXlWvR',\n        use: 'sig',\n      },\n    ],\n  }\n\n  beforeEach(() => {\n    clearJWKSCache()\n    vi.restoreAllMocks()\n  })\n\n  afterEach(() => {\n    clearJWKSCache()\n  })\n\n  describe('Cache Management', () => {\n    it('should clear resolver cache when clearJWKSCache is called', async () => {\n      const fetchMock = vi.fn().mockResolvedValue({\n        json: () => Promise.resolve(mockJWKS),\n        ok: true,\n        status: 200,\n      })\n      global.fetch = fetchMock\n\n      const token = createTestJWT({ exp: Math.floor(Date.now() / 1000) + 3600 })\n\n      // First validation - creates and caches resolver\n      try {\n        await validateProjectToken(token, 'staging')\n      } catch (_error) {\n        // Expected to fail on signature\n      }\n\n      const firstCallCount = fetchMock.mock.calls.length\n      expect(firstCallCount).toBeGreaterThanOrEqual(1)\n\n      // Clear the cache - this is OUR logic\n      clearJWKSCache()\n\n      // Second validation after clearing cache - should create new resolver\n      try {\n        await validateProjectToken(token, 'staging')\n      } catch (_error) {\n        // Expected to fail on signature\n      }\n\n      // Verify fetch was called again after cache clear\n      expect(fetchMock.mock.calls.length).toBeGreaterThan(firstCallCount)\n    })\n  })\n\n  describe('Error Code Mapping', () => {\n    it('should map network errors to JWKS_FETCH_FAILED code', async () => {\n      global.fetch = vi.fn().mockRejectedValue(new Error('ENOTFOUND'))\n\n      const token = createTestJWT({ exp: Math.floor(Date.now() / 1000) + 3600 })\n\n      try {\n        await validateProjectToken(token, 'staging')\n        expect.fail('Should have thrown an error')\n      } catch (error) {\n        expect(error).toBeInstanceOf(JWTValidationError)\n        if (error instanceof JWTValidationError) {\n          // Verify our error mapping logic\n          expect(error.code).toBe('JWKS_FETCH_FAILED')\n          expect(error.message).toContain('Failed to fetch JWKS')\n        }\n      }\n    })\n\n    it('should map jose signature errors to SIGNATURE_INVALID code', async () => {\n      global.fetch = vi.fn().mockResolvedValue({\n        json: () => Promise.resolve(mockJWKS),\n        ok: true,\n        status: 200,\n      })\n\n      const badToken = 'eyJhbGciOiJSUzI1NiIsImtpZCI6InRlc3Qta2V5LWlkIn0.e30.bad_signature'\n\n      try {\n        await validateProjectToken(badToken, 'staging')\n        expect.fail('Should have thrown an error')\n      } catch (error) {\n        expect(error).toBeInstanceOf(JWTValidationError)\n        if (error instanceof JWTValidationError) {\n          // Verify our error mapping logic - invalid tokens may fail at different stages\n          // The important thing is that signature-related errors map to either SIGNATURE_INVALID or MISSING_KID\n          expect(['SIGNATURE_INVALID', 'MISSING_KID']).toContain(error.code)\n        }\n      }\n    })\n\n    it('should map expired token errors to EXPIRED code', async () => {\n      global.fetch = vi.fn().mockResolvedValue({\n        json: () => Promise.resolve(mockJWKS),\n        ok: true,\n        status: 200,\n      })\n\n      // Create token that expired 1 hour ago\n      const expiredToken = createTestJWT({\n        exp: Math.floor(Date.now() / 1000) - 3600,\n        iat: Math.floor(Date.now() / 1000) - 7200,\n      })\n\n      try {\n        await validateProjectToken(expiredToken, 'staging')\n        expect.fail('Should have thrown an error')\n      } catch (error) {\n        expect(error).toBeInstanceOf(JWTValidationError)\n        if (error instanceof JWTValidationError) {\n          // Verify our error mapping logic\n          // Note: Mock tokens with bad signatures may fail signature validation before expiry check\n          // In real scenarios with valid signatures, EXPIRED would be returned\n          expect(['EXPIRED', 'SIGNATURE_INVALID', 'MISSING_KID']).toContain(error.code)\n        }\n      }\n    })\n\n    it('should map missing kid errors to MISSING_KID code', async () => {\n      global.fetch = vi.fn().mockResolvedValue({\n        json: () => Promise.resolve(mockJWKS),\n        ok: true,\n        status: 200,\n      })\n\n      // Create token without kid in header\n      const header = Buffer.from(JSON.stringify({ alg: 'RS256', typ: 'JWT' })).toString('base64url')\n      const payload = Buffer.from(\n        JSON.stringify({ exp: Math.floor(Date.now() / 1000) + 3600 }),\n      ).toString('base64url')\n      const tokenWithoutKid = `${header}.${payload}.fake_signature`\n\n      try {\n        await validateProjectToken(tokenWithoutKid, 'staging')\n        expect.fail('Should have thrown an error')\n      } catch (error) {\n        expect(error).toBeInstanceOf(JWTValidationError)\n        if (error instanceof JWTValidationError) {\n          // Verify our error mapping logic - tokens without kid may fail at various stages\n          expect(['MISSING_KID', 'SIGNATURE_INVALID']).toContain(error.code)\n        }\n      }\n    })\n\n    it('should map no matching key errors to SIGNATURE_INVALID code', async () => {\n      global.fetch = vi.fn().mockResolvedValue({\n        json: () => Promise.resolve(mockJWKS),\n        ok: true,\n        status: 200,\n      })\n\n      // Create token with a kid that doesn't exist in JWKS\n      const tokenWithWrongKid = createTestJWT(\n        { exp: Math.floor(Date.now() / 1000) + 3600 },\n        'non-existent-key-id',\n      )\n\n      try {\n        await validateProjectToken(tokenWithWrongKid, 'staging')\n        expect.fail('Should have thrown an error')\n      } catch (error) {\n        expect(error).toBeInstanceOf(JWTValidationError)\n        if (error instanceof JWTValidationError) {\n          // Verify our error mapping logic\n          expect(error.code).toBe('SIGNATURE_INVALID')\n          expect(error.message).toContain('Key not found in JWKS')\n        }\n      }\n    })\n\n    it('should handle multiple network error formats', async () => {\n      const networkErrors = [\n        new Error('fetch failed'),\n        new Error('network error'),\n        new Error('ECONNREFUSED'),\n      ]\n\n      for (const networkError of networkErrors) {\n        clearJWKSCache()\n        global.fetch = vi.fn().mockRejectedValue(networkError)\n\n        const token = createTestJWT({ exp: Math.floor(Date.now() / 1000) + 3600 })\n\n        try {\n          await validateProjectToken(token, 'staging')\n          expect.fail('Should have thrown an error')\n        } catch (error) {\n          expect(error).toBeInstanceOf(JWTValidationError)\n          if (error instanceof JWTValidationError) {\n            expect(error.code).toBe('JWKS_FETCH_FAILED')\n          }\n        }\n      }\n    })\n\n    it('should handle generic errors with fallback', async () => {\n      // Mock an unexpected error type\n      global.fetch = vi.fn().mockRejectedValue('string error')\n\n      const token = createTestJWT({ exp: Math.floor(Date.now() / 1000) + 3600 })\n\n      try {\n        await validateProjectToken(token, 'staging')\n        expect.fail('Should have thrown an error')\n      } catch (error) {\n        expect(error).toBeInstanceOf(JWTValidationError)\n        if (error instanceof JWTValidationError) {\n          // Generic errors fall back to SIGNATURE_INVALID\n          expect(error.code).toBe('SIGNATURE_INVALID')\n          expect(error.message).toContain('JWT validation failed')\n        }\n      }\n    })\n  })\n})\n"],"names":["afterEach","beforeEach","describe","expect","it","vi","clearJWKSCache","JWTValidationError","validateProjectToken","createTestJWT","payload","kid","header","Buffer","from","JSON","stringify","alg","typ","toString","payloadStr","signature","mockJWKS","keys","e","kty","n","use","restoreAllMocks","fetchMock","fn","mockResolvedValue","json","Promise","resolve","ok","status","global","fetch","token","exp","Math","floor","Date","now","_error","firstCallCount","mock","calls","length","toBeGreaterThanOrEqual","toBeGreaterThan","mockRejectedValue","Error","fail","error","toBeInstanceOf","code","toBe","message","toContain","badToken","expiredToken","iat","tokenWithoutKid","tokenWithWrongKid","networkErrors","networkError"],"mappings":"AAAA;;;;;;;CAOC,GAED,SAASA,SAAS,EAAEC,UAAU,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAQ;AAExE,SAASC,cAAc,EAAEC,kBAAkB,EAAEC,oBAAoB,QAAQ,qBAAoB;AAE7F,+EAA+E;AAC/E,SAASC,cAAcC,OAAgC,EAAEC,MAAM,aAAa;IAC1E,MAAMC,SAASC,OAAOC,IAAI,CAACC,KAAKC,SAAS,CAAC;QAAEC,KAAK;QAASN;QAAKO,KAAK;IAAM,IAAIC,QAAQ,CACpF;IAEF,MAAMC,aAAaP,OAAOC,IAAI,CAACC,KAAKC,SAAS,CAACN,UAAUS,QAAQ,CAAC;IACjE,MAAME,YAAY;IAClB,OAAO,GAAGT,OAAO,CAAC,EAAEQ,WAAW,CAAC,EAAEC,WAAW;AAC/C;AAEAnB,SAAS,iBAAiB;IACxB,yBAAyB;IACzB,MAAMoB,WAAW;QACfC,MAAM;YACJ;gBACEN,KAAK;gBACLO,GAAG;gBACHb,KAAK;gBACLc,KAAK;gBACLC,GAAG;gBACHC,KAAK;YACP;SACD;IACH;IAEA1B,WAAW;QACTK;QACAD,GAAGuB,eAAe;IACpB;IAEA5B,UAAU;QACRM;IACF;IAEAJ,SAAS,oBAAoB;QAC3BE,GAAG,6DAA6D;YAC9D,MAAMyB,YAAYxB,GAAGyB,EAAE,GAAGC,iBAAiB,CAAC;gBAC1CC,MAAM,IAAMC,QAAQC,OAAO,CAACZ;gBAC5Ba,IAAI;gBACJC,QAAQ;YACV;YACAC,OAAOC,KAAK,GAAGT;YAEf,MAAMU,QAAQ9B,cAAc;gBAAE+B,KAAKC,KAAKC,KAAK,CAACC,KAAKC,GAAG,KAAK,QAAQ;YAAK;YAExE,iDAAiD;YACjD,IAAI;gBACF,MAAMpC,qBAAqB+B,OAAO;YACpC,EAAE,OAAOM,QAAQ;YACf,gCAAgC;YAClC;YAEA,MAAMC,iBAAiBjB,UAAUkB,IAAI,CAACC,KAAK,CAACC,MAAM;YAClD9C,OAAO2C,gBAAgBI,sBAAsB,CAAC;YAE9C,sCAAsC;YACtC5C;YAEA,sEAAsE;YACtE,IAAI;gBACF,MAAME,qBAAqB+B,OAAO;YACpC,EAAE,OAAOM,QAAQ;YACf,gCAAgC;YAClC;YAEA,kDAAkD;YAClD1C,OAAO0B,UAAUkB,IAAI,CAACC,KAAK,CAACC,MAAM,EAAEE,eAAe,CAACL;QACtD;IACF;IAEA5C,SAAS,sBAAsB;QAC7BE,GAAG,uDAAuD;YACxDiC,OAAOC,KAAK,GAAGjC,GAAGyB,EAAE,GAAGsB,iBAAiB,CAAC,IAAIC,MAAM;YAEnD,MAAMd,QAAQ9B,cAAc;gBAAE+B,KAAKC,KAAKC,KAAK,CAACC,KAAKC,GAAG,KAAK,QAAQ;YAAK;YAExE,IAAI;gBACF,MAAMpC,qBAAqB+B,OAAO;gBAClCpC,OAAOmD,IAAI,CAAC;YACd,EAAE,OAAOC,OAAO;gBACdpD,OAAOoD,OAAOC,cAAc,CAACjD;gBAC7B,IAAIgD,iBAAiBhD,oBAAoB;oBACvC,iCAAiC;oBACjCJ,OAAOoD,MAAME,IAAI,EAAEC,IAAI,CAAC;oBACxBvD,OAAOoD,MAAMI,OAAO,EAAEC,SAAS,CAAC;gBAClC;YACF;QACF;QAEAxD,GAAG,8DAA8D;YAC/DiC,OAAOC,KAAK,GAAGjC,GAAGyB,EAAE,GAAGC,iBAAiB,CAAC;gBACvCC,MAAM,IAAMC,QAAQC,OAAO,CAACZ;gBAC5Ba,IAAI;gBACJC,QAAQ;YACV;YAEA,MAAMyB,WAAW;YAEjB,IAAI;gBACF,MAAMrD,qBAAqBqD,UAAU;gBACrC1D,OAAOmD,IAAI,CAAC;YACd,EAAE,OAAOC,OAAO;gBACdpD,OAAOoD,OAAOC,cAAc,CAACjD;gBAC7B,IAAIgD,iBAAiBhD,oBAAoB;oBACvC,+EAA+E;oBAC/E,sGAAsG;oBACtGJ,OAAO;wBAAC;wBAAqB;qBAAc,EAAEyD,SAAS,CAACL,MAAME,IAAI;gBACnE;YACF;QACF;QAEArD,GAAG,mDAAmD;YACpDiC,OAAOC,KAAK,GAAGjC,GAAGyB,EAAE,GAAGC,iBAAiB,CAAC;gBACvCC,MAAM,IAAMC,QAAQC,OAAO,CAACZ;gBAC5Ba,IAAI;gBACJC,QAAQ;YACV;YAEA,uCAAuC;YACvC,MAAM0B,eAAerD,cAAc;gBACjC+B,KAAKC,KAAKC,KAAK,CAACC,KAAKC,GAAG,KAAK,QAAQ;gBACrCmB,KAAKtB,KAAKC,KAAK,CAACC,KAAKC,GAAG,KAAK,QAAQ;YACvC;YAEA,IAAI;gBACF,MAAMpC,qBAAqBsD,cAAc;gBACzC3D,OAAOmD,IAAI,CAAC;YACd,EAAE,OAAOC,OAAO;gBACdpD,OAAOoD,OAAOC,cAAc,CAACjD;gBAC7B,IAAIgD,iBAAiBhD,oBAAoB;oBACvC,iCAAiC;oBACjC,0FAA0F;oBAC1F,qEAAqE;oBACrEJ,OAAO;wBAAC;wBAAW;wBAAqB;qBAAc,EAAEyD,SAAS,CAACL,MAAME,IAAI;gBAC9E;YACF;QACF;QAEArD,GAAG,qDAAqD;YACtDiC,OAAOC,KAAK,GAAGjC,GAAGyB,EAAE,GAAGC,iBAAiB,CAAC;gBACvCC,MAAM,IAAMC,QAAQC,OAAO,CAACZ;gBAC5Ba,IAAI;gBACJC,QAAQ;YACV;YAEA,qCAAqC;YACrC,MAAMxB,SAASC,OAAOC,IAAI,CAACC,KAAKC,SAAS,CAAC;gBAAEC,KAAK;gBAASC,KAAK;YAAM,IAAIC,QAAQ,CAAC;YAClF,MAAMT,UAAUG,OAAOC,IAAI,CACzBC,KAAKC,SAAS,CAAC;gBAAEwB,KAAKC,KAAKC,KAAK,CAACC,KAAKC,GAAG,KAAK,QAAQ;YAAK,IAC3DzB,QAAQ,CAAC;YACX,MAAM6C,kBAAkB,GAAGpD,OAAO,CAAC,EAAEF,QAAQ,eAAe,CAAC;YAE7D,IAAI;gBACF,MAAMF,qBAAqBwD,iBAAiB;gBAC5C7D,OAAOmD,IAAI,CAAC;YACd,EAAE,OAAOC,OAAO;gBACdpD,OAAOoD,OAAOC,cAAc,CAACjD;gBAC7B,IAAIgD,iBAAiBhD,oBAAoB;oBACvC,iFAAiF;oBACjFJ,OAAO;wBAAC;wBAAe;qBAAoB,EAAEyD,SAAS,CAACL,MAAME,IAAI;gBACnE;YACF;QACF;QAEArD,GAAG,+DAA+D;YAChEiC,OAAOC,KAAK,GAAGjC,GAAGyB,EAAE,GAAGC,iBAAiB,CAAC;gBACvCC,MAAM,IAAMC,QAAQC,OAAO,CAACZ;gBAC5Ba,IAAI;gBACJC,QAAQ;YACV;YAEA,qDAAqD;YACrD,MAAM6B,oBAAoBxD,cACxB;gBAAE+B,KAAKC,KAAKC,KAAK,CAACC,KAAKC,GAAG,KAAK,QAAQ;YAAK,GAC5C;YAGF,IAAI;gBACF,MAAMpC,qBAAqByD,mBAAmB;gBAC9C9D,OAAOmD,IAAI,CAAC;YACd,EAAE,OAAOC,OAAO;gBACdpD,OAAOoD,OAAOC,cAAc,CAACjD;gBAC7B,IAAIgD,iBAAiBhD,oBAAoB;oBACvC,iCAAiC;oBACjCJ,OAAOoD,MAAME,IAAI,EAAEC,IAAI,CAAC;oBACxBvD,OAAOoD,MAAMI,OAAO,EAAEC,SAAS,CAAC;gBAClC;YACF;QACF;QAEAxD,GAAG,gDAAgD;YACjD,MAAM8D,gBAAgB;gBACpB,IAAIb,MAAM;gBACV,IAAIA,MAAM;gBACV,IAAIA,MAAM;aACX;YAED,KAAK,MAAMc,gBAAgBD,cAAe;gBACxC5D;gBACA+B,OAAOC,KAAK,GAAGjC,GAAGyB,EAAE,GAAGsB,iBAAiB,CAACe;gBAEzC,MAAM5B,QAAQ9B,cAAc;oBAAE+B,KAAKC,KAAKC,KAAK,CAACC,KAAKC,GAAG,KAAK,QAAQ;gBAAK;gBAExE,IAAI;oBACF,MAAMpC,qBAAqB+B,OAAO;oBAClCpC,OAAOmD,IAAI,CAAC;gBACd,EAAE,OAAOC,OAAO;oBACdpD,OAAOoD,OAAOC,cAAc,CAACjD;oBAC7B,IAAIgD,iBAAiBhD,oBAAoB;wBACvCJ,OAAOoD,MAAME,IAAI,EAAEC,IAAI,CAAC;oBAC1B;gBACF;YACF;QACF;QAEAtD,GAAG,8CAA8C;YAC/C,gCAAgC;YAChCiC,OAAOC,KAAK,GAAGjC,GAAGyB,EAAE,GAAGsB,iBAAiB,CAAC;YAEzC,MAAMb,QAAQ9B,cAAc;gBAAE+B,KAAKC,KAAKC,KAAK,CAACC,KAAKC,GAAG,KAAK,QAAQ;YAAK;YAExE,IAAI;gBACF,MAAMpC,qBAAqB+B,OAAO;gBAClCpC,OAAOmD,IAAI,CAAC;YACd,EAAE,OAAOC,OAAO;gBACdpD,OAAOoD,OAAOC,cAAc,CAACjD;gBAC7B,IAAIgD,iBAAiBhD,oBAAoB;oBACvC,gDAAgD;oBAChDJ,OAAOoD,MAAME,IAAI,EAAEC,IAAI,CAAC;oBACxBvD,OAAOoD,MAAMI,OAAO,EAAEC,SAAS,CAAC;gBAClC;YACF;QACF;IACF;AACF"}

package/dist/auth/oauth-flow.spec.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=oauth-flow.spec.d.ts.map

package/dist/auth/oauth-flow.spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-flow.spec.d.ts","sourceRoot":"","sources":["../../src/auth/oauth-flow.spec.ts"],"names":[],"mappings":""}

package/dist/auth/oauth-flow.spec.js

@@ -1,134 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest';
-import { CallbackServer } from './callback-server.js';
-import { executeOAuthFlow, getValidAccessToken, OAuthFlowError } from './oauth-flow.js';
-import { refreshAccessToken } from './refresh.js';
-import { TokenStore } from './token-store.js';
-// Mock the refresh module
-vi.mock('./refresh.js', ()=>({
-        exchangeCodeForTokens: vi.fn(),
-        refreshAccessToken: vi.fn()
-    }));
-// Mock browser and callback server
-vi.mock('./browser.js', ()=>({
-        buildAuthorizationUrl: vi.fn(()=>'https://www.figma.com/oauth?...'),
-        openBrowser: vi.fn()
-    }));
-// Mock @clack/prompts
-vi.mock('@clack/prompts', ()=>({
-        confirm: vi.fn().mockResolvedValue(true),
-        isCancel: vi.fn().mockReturnValue(false)
-    }));
-// Create mock factory for CallbackServer
-const createMockCallbackServer = ()=>{
-    const mock = {
-        getActualPort: vi.fn().mockReturnValue(3000),
-        stop: vi.fn(),
-        waitForCallback: vi.fn()
-    };
-    return mock;
-};
-vi.mock('./callback-server.js', ()=>({
-        CallbackServer: vi.fn()
-    }));
-describe('oauth-flow', ()=>{
-    describe('getValidAccessToken', ()=>{
-        let tokenStore;
-        beforeEach(()=>{
-            tokenStore = new TokenStore({
-                configName: 'test-payloadcms-figma-oauth-flow'
-            });
-            tokenStore.clearTokens();
-        });
-        it('should return access token if valid tokens exist', async ()=>{
-            const mockTokens = {
-                accessToken: 'valid-token',
-                expiresAt: Date.now() + 3600000,
-                refreshToken: 'refresh-token'
-            };
-            tokenStore.setTokens(mockTokens);
-            const token = await getValidAccessToken(tokenStore);
-            expect(token).toBe('valid-token');
-        });
-        it('should refresh expired tokens', async ()=>{
-            const expiredTokens = {
-                accessToken: 'expired-token',
-                expiresAt: Date.now() - 1000,
-                refreshToken: 'refresh-token'
-            };
-            tokenStore.setTokens(expiredTokens);
-            const newTokens = {
-                accessToken: 'new-token',
-                expiresAt: Date.now() + 3600000,
-                refreshToken: 'new-refresh-token'
-            };
-            // Mock the refresh function
-            vi.mocked(refreshAccessToken).mockResolvedValueOnce(newTokens);
-            const token = await getValidAccessToken(tokenStore);
-            expect(token).toBe('new-token');
-            // Verify tokens were stored
-            const storedTokens = tokenStore.getTokens();
-            expect(storedTokens?.accessToken).toBe('new-token');
-        });
-        it('should clear tokens and throw on refresh failure', async ()=>{
-            const expiredTokens = {
-                accessToken: 'expired-token',
-                expiresAt: Date.now() - 1000,
-                refreshToken: 'refresh-token'
-            };
-            tokenStore.setTokens(expiredTokens);
-            // Mock refresh to fail
-            vi.mocked(refreshAccessToken).mockRejectedValueOnce(new Error('Refresh failed'));
-            await expect(getValidAccessToken(tokenStore)).rejects.toThrow(OAuthFlowError);
-            // Verify tokens were cleared
-            expect(tokenStore.getTokens()).toBeNull();
-        });
-    });
-    describe('executeOAuthFlow', ()=>{
-        let tokenStore;
-        let mockServer;
-        beforeEach(()=>{
-            tokenStore = new TokenStore({
-                configName: 'test-payloadcms-figma-oauth-execute'
-            });
-            tokenStore.clearTokens();
-            vi.clearAllMocks();
-            // Setup mock server with default pending callback
-            mockServer = createMockCallbackServer();
-            mockServer.waitForCallback.mockReturnValue(new Promise(()=>{
-            /* pending forever by default */ }));
-            vi.mocked(CallbackServer).mockImplementation(()=>mockServer);
-        });
-        it('should execute mock OAuth flow successfully (default behavior)', async ()=>{
-            const result = await executeOAuthFlow(tokenStore);
-            // Verify mock tokens were generated and stored
-            const storedTokens = tokenStore.getTokens();
-            expect(storedTokens).toBeDefined();
-            expect(storedTokens?.accessToken).toMatch(/^figt_mock_access_token_/);
-            expect(storedTokens?.refreshToken).toMatch(/^figt_mock_refresh_token_/);
-            expect(storedTokens?.tokenType).toBe('Bearer');
-            expect(storedTokens?.expiresAt).toBeGreaterThan(Date.now());
-            // Verify result
-            expect(result.tokens).toEqual(storedTokens);
-            expect(result.userId).toBe('mock_user_123');
-            // Verify callback server was NOT started (mock flow skips it)
-            expect(mockServer.waitForCallback).not.toHaveBeenCalled();
-        });
-        it('should handle callback timeout (real OAuth flow)', async ()=>{
-            // Temporarily disable mocking to test real OAuth flow error handling
-            const originalEnv = process.env.FIGMA_MOCK_OAUTH;
-            process.env.FIGMA_MOCK_OAUTH = 'false';
-            mockServer.waitForCallback.mockRejectedValueOnce(new Error('Callback timed out'));
-            await expect(executeOAuthFlow(tokenStore)).rejects.toThrow(OAuthFlowError);
-            // Server should be stopped
-            expect(mockServer.stop).toHaveBeenCalled();
-            // Restore original environment
-            if (originalEnv === undefined) {
-                delete process.env.FIGMA_MOCK_OAUTH;
-            } else {
-                process.env.FIGMA_MOCK_OAUTH = originalEnv;
-            }
-        });
-    });
-});
-
-//# sourceMappingURL=oauth-flow.spec.js.map

package/dist/auth/oauth-flow.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/auth/oauth-flow.spec.ts"],"sourcesContent":["import { beforeEach, describe, expect, it, vi } from 'vitest'\n\nimport type { FigmaTokens } from './types.js'\n\nimport { CallbackServer } from './callback-server.js'\nimport { executeOAuthFlow, getValidAccessToken, OAuthFlowError } from './oauth-flow.js'\nimport { refreshAccessToken } from './refresh.js'\nimport { TokenStore } from './token-store.js'\n\n// Mock the refresh module\nvi.mock('./refresh.js', () => ({\n  exchangeCodeForTokens: vi.fn(),\n  refreshAccessToken: vi.fn(),\n}))\n\n// Mock browser and callback server\nvi.mock('./browser.js', () => ({\n  buildAuthorizationUrl: vi.fn(() => 'https://www.figma.com/oauth?...'),\n  openBrowser: vi.fn(),\n}))\n\n// Mock @clack/prompts\nvi.mock('@clack/prompts', () => ({\n  confirm: vi.fn().mockResolvedValue(true),\n  isCancel: vi.fn().mockReturnValue(false),\n}))\n\n// Create mock factory for CallbackServer\nconst createMockCallbackServer = () => {\n  const mock = {\n    getActualPort: vi.fn().mockReturnValue(3000),\n    stop: vi.fn(),\n    waitForCallback: vi.fn(),\n  }\n  return mock\n}\n\nvi.mock('./callback-server.js', () => ({\n  CallbackServer: vi.fn(),\n}))\n\ndescribe('oauth-flow', () => {\n  describe('getValidAccessToken', () => {\n    let tokenStore: TokenStore\n\n    beforeEach(() => {\n      tokenStore = new TokenStore({ configName: 'test-payloadcms-figma-oauth-flow' })\n      tokenStore.clearTokens()\n    })\n\n    it('should return access token if valid tokens exist', async () => {\n      const mockTokens: FigmaTokens = {\n        accessToken: 'valid-token',\n        expiresAt: Date.now() + 3600000, // 1 hour from now\n        refreshToken: 'refresh-token',\n      }\n\n      tokenStore.setTokens(mockTokens)\n\n      const token = await getValidAccessToken(tokenStore)\n      expect(token).toBe('valid-token')\n    })\n\n    it('should refresh expired tokens', async () => {\n      const expiredTokens: FigmaTokens = {\n        accessToken: 'expired-token',\n        expiresAt: Date.now() - 1000, // Expired\n        refreshToken: 'refresh-token',\n      }\n\n      tokenStore.setTokens(expiredTokens)\n\n      const newTokens: FigmaTokens = {\n        accessToken: 'new-token',\n        expiresAt: Date.now() + 3600000,\n        refreshToken: 'new-refresh-token',\n      }\n\n      // Mock the refresh function\n      vi.mocked(refreshAccessToken).mockResolvedValueOnce(newTokens)\n\n      const token = await getValidAccessToken(tokenStore)\n      expect(token).toBe('new-token')\n\n      // Verify tokens were stored\n      const storedTokens = tokenStore.getTokens()\n      expect(storedTokens?.accessToken).toBe('new-token')\n    })\n\n    it('should clear tokens and throw on refresh failure', async () => {\n      const expiredTokens: FigmaTokens = {\n        accessToken: 'expired-token',\n        expiresAt: Date.now() - 1000,\n        refreshToken: 'refresh-token',\n      }\n\n      tokenStore.setTokens(expiredTokens)\n\n      // Mock refresh to fail\n      vi.mocked(refreshAccessToken).mockRejectedValueOnce(new Error('Refresh failed'))\n\n      await expect(getValidAccessToken(tokenStore)).rejects.toThrow(OAuthFlowError)\n\n      // Verify tokens were cleared\n      expect(tokenStore.getTokens()).toBeNull()\n    })\n  })\n\n  describe('executeOAuthFlow', () => {\n    let tokenStore: TokenStore\n    let mockServer: ReturnType<typeof createMockCallbackServer>\n\n    beforeEach(() => {\n      tokenStore = new TokenStore({ configName: 'test-payloadcms-figma-oauth-execute' })\n      tokenStore.clearTokens()\n      vi.clearAllMocks()\n\n      // Setup mock server with default pending callback\n      mockServer = createMockCallbackServer()\n      mockServer.waitForCallback.mockReturnValue(\n        new Promise(() => {\n          /* pending forever by default */\n        }),\n      )\n      vi.mocked(CallbackServer).mockImplementation(() => mockServer as unknown as CallbackServer)\n    })\n\n    it('should execute mock OAuth flow successfully (default behavior)', async () => {\n      const result = await executeOAuthFlow(tokenStore)\n\n      // Verify mock tokens were generated and stored\n      const storedTokens = tokenStore.getTokens()\n      expect(storedTokens).toBeDefined()\n      expect(storedTokens?.accessToken).toMatch(/^figt_mock_access_token_/)\n      expect(storedTokens?.refreshToken).toMatch(/^figt_mock_refresh_token_/)\n      expect(storedTokens?.tokenType).toBe('Bearer')\n      expect(storedTokens?.expiresAt).toBeGreaterThan(Date.now())\n\n      // Verify result\n      expect(result.tokens).toEqual(storedTokens)\n      expect(result.userId).toBe('mock_user_123')\n\n      // Verify callback server was NOT started (mock flow skips it)\n      expect(mockServer.waitForCallback).not.toHaveBeenCalled()\n    })\n\n    it('should handle callback timeout (real OAuth flow)', async () => {\n      // Temporarily disable mocking to test real OAuth flow error handling\n      const originalEnv = process.env.FIGMA_MOCK_OAUTH\n      process.env.FIGMA_MOCK_OAUTH = 'false'\n\n      mockServer.waitForCallback.mockRejectedValueOnce(new Error('Callback timed out'))\n\n      await expect(executeOAuthFlow(tokenStore)).rejects.toThrow(OAuthFlowError)\n\n      // Server should be stopped\n      expect(mockServer.stop).toHaveBeenCalled()\n\n      // Restore original environment\n      if (originalEnv === undefined) {\n        delete process.env.FIGMA_MOCK_OAUTH\n      } else {\n        process.env.FIGMA_MOCK_OAUTH = originalEnv\n      }\n    })\n  })\n})\n"],"names":["beforeEach","describe","expect","it","vi","CallbackServer","executeOAuthFlow","getValidAccessToken","OAuthFlowError","refreshAccessToken","TokenStore","mock","exchangeCodeForTokens","fn","buildAuthorizationUrl","openBrowser","confirm","mockResolvedValue","isCancel","mockReturnValue","createMockCallbackServer","getActualPort","stop","waitForCallback","tokenStore","configName","clearTokens","mockTokens","accessToken","expiresAt","Date","now","refreshToken","setTokens","token","toBe","expiredTokens","newTokens","mocked","mockResolvedValueOnce","storedTokens","getTokens","mockRejectedValueOnce","Error","rejects","toThrow","toBeNull","mockServer","clearAllMocks","Promise","mockImplementation","result","toBeDefined","toMatch","tokenType","toBeGreaterThan","tokens","toEqual","userId","not","toHaveBeenCalled","originalEnv","process","env","FIGMA_MOCK_OAUTH","undefined"],"mappings":"AAAA,SAASA,UAAU,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAQ;AAI7D,SAASC,cAAc,QAAQ,uBAAsB;AACrD,SAASC,gBAAgB,EAAEC,mBAAmB,EAAEC,cAAc,QAAQ,kBAAiB;AACvF,SAASC,kBAAkB,QAAQ,eAAc;AACjD,SAASC,UAAU,QAAQ,mBAAkB;AAE7C,0BAA0B;AAC1BN,GAAGO,IAAI,CAAC,gBAAgB,IAAO,CAAA;QAC7BC,uBAAuBR,GAAGS,EAAE;QAC5BJ,oBAAoBL,GAAGS,EAAE;IAC3B,CAAA;AAEA,mCAAmC;AACnCT,GAAGO,IAAI,CAAC,gBAAgB,IAAO,CAAA;QAC7BG,uBAAuBV,GAAGS,EAAE,CAAC,IAAM;QACnCE,aAAaX,GAAGS,EAAE;IACpB,CAAA;AAEA,sBAAsB;AACtBT,GAAGO,IAAI,CAAC,kBAAkB,IAAO,CAAA;QAC/BK,SAASZ,GAAGS,EAAE,GAAGI,iBAAiB,CAAC;QACnCC,UAAUd,GAAGS,EAAE,GAAGM,eAAe,CAAC;IACpC,CAAA;AAEA,yCAAyC;AACzC,MAAMC,2BAA2B;IAC/B,MAAMT,OAAO;QACXU,eAAejB,GAAGS,EAAE,GAAGM,eAAe,CAAC;QACvCG,MAAMlB,GAAGS,EAAE;QACXU,iBAAiBnB,GAAGS,EAAE;IACxB;IACA,OAAOF;AACT;AAEAP,GAAGO,IAAI,CAAC,wBAAwB,IAAO,CAAA;QACrCN,gBAAgBD,GAAGS,EAAE;IACvB,CAAA;AAEAZ,SAAS,cAAc;IACrBA,SAAS,uBAAuB;QAC9B,IAAIuB;QAEJxB,WAAW;YACTwB,aAAa,IAAId,WAAW;gBAAEe,YAAY;YAAmC;YAC7ED,WAAWE,WAAW;QACxB;QAEAvB,GAAG,oDAAoD;YACrD,MAAMwB,aAA0B;gBAC9BC,aAAa;gBACbC,WAAWC,KAAKC,GAAG,KAAK;gBACxBC,cAAc;YAChB;YAEAR,WAAWS,SAAS,CAACN;YAErB,MAAMO,QAAQ,MAAM3B,oBAAoBiB;YACxCtB,OAAOgC,OAAOC,IAAI,CAAC;QACrB;QAEAhC,GAAG,iCAAiC;YAClC,MAAMiC,gBAA6B;gBACjCR,aAAa;gBACbC,WAAWC,KAAKC,GAAG,KAAK;gBACxBC,cAAc;YAChB;YAEAR,WAAWS,SAAS,CAACG;YAErB,MAAMC,YAAyB;gBAC7BT,aAAa;gBACbC,WAAWC,KAAKC,GAAG,KAAK;gBACxBC,cAAc;YAChB;YAEA,4BAA4B;YAC5B5B,GAAGkC,MAAM,CAAC7B,oBAAoB8B,qBAAqB,CAACF;YAEpD,MAAMH,QAAQ,MAAM3B,oBAAoBiB;YACxCtB,OAAOgC,OAAOC,IAAI,CAAC;YAEnB,4BAA4B;YAC5B,MAAMK,eAAehB,WAAWiB,SAAS;YACzCvC,OAAOsC,cAAcZ,aAAaO,IAAI,CAAC;QACzC;QAEAhC,GAAG,oDAAoD;YACrD,MAAMiC,gBAA6B;gBACjCR,aAAa;gBACbC,WAAWC,KAAKC,GAAG,KAAK;gBACxBC,cAAc;YAChB;YAEAR,WAAWS,SAAS,CAACG;YAErB,uBAAuB;YACvBhC,GAAGkC,MAAM,CAAC7B,oBAAoBiC,qBAAqB,CAAC,IAAIC,MAAM;YAE9D,MAAMzC,OAAOK,oBAAoBiB,aAAaoB,OAAO,CAACC,OAAO,CAACrC;YAE9D,6BAA6B;YAC7BN,OAAOsB,WAAWiB,SAAS,IAAIK,QAAQ;QACzC;IACF;IAEA7C,SAAS,oBAAoB;QAC3B,IAAIuB;QACJ,IAAIuB;QAEJ/C,WAAW;YACTwB,aAAa,IAAId,WAAW;gBAAEe,YAAY;YAAsC;YAChFD,WAAWE,WAAW;YACtBtB,GAAG4C,aAAa;YAEhB,kDAAkD;YAClDD,aAAa3B;YACb2B,WAAWxB,eAAe,CAACJ,eAAe,CACxC,IAAI8B,QAAQ;YACV,8BAA8B,GAChC;YAEF7C,GAAGkC,MAAM,CAACjC,gBAAgB6C,kBAAkB,CAAC,IAAMH;QACrD;QAEA5C,GAAG,kEAAkE;YACnE,MAAMgD,SAAS,MAAM7C,iBAAiBkB;YAEtC,+CAA+C;YAC/C,MAAMgB,eAAehB,WAAWiB,SAAS;YACzCvC,OAAOsC,cAAcY,WAAW;YAChClD,OAAOsC,cAAcZ,aAAayB,OAAO,CAAC;YAC1CnD,OAAOsC,cAAcR,cAAcqB,OAAO,CAAC;YAC3CnD,OAAOsC,cAAcc,WAAWnB,IAAI,CAAC;YACrCjC,OAAOsC,cAAcX,WAAW0B,eAAe,CAACzB,KAAKC,GAAG;YAExD,gBAAgB;YAChB7B,OAAOiD,OAAOK,MAAM,EAAEC,OAAO,CAACjB;YAC9BtC,OAAOiD,OAAOO,MAAM,EAAEvB,IAAI,CAAC;YAE3B,8DAA8D;YAC9DjC,OAAO6C,WAAWxB,eAAe,EAAEoC,GAAG,CAACC,gBAAgB;QACzD;QAEAzD,GAAG,oDAAoD;YACrD,qEAAqE;YACrE,MAAM0D,cAAcC,QAAQC,GAAG,CAACC,gBAAgB;YAChDF,QAAQC,GAAG,CAACC,gBAAgB,GAAG;YAE/BjB,WAAWxB,eAAe,CAACmB,qBAAqB,CAAC,IAAIC,MAAM;YAE3D,MAAMzC,OAAOI,iBAAiBkB,aAAaoB,OAAO,CAACC,OAAO,CAACrC;YAE3D,2BAA2B;YAC3BN,OAAO6C,WAAWzB,IAAI,EAAEsC,gBAAgB;YAExC,+BAA+B;YAC/B,IAAIC,gBAAgBI,WAAW;gBAC7B,OAAOH,QAAQC,GAAG,CAACC,gBAAgB;YACrC,OAAO;gBACLF,QAAQC,GAAG,CAACC,gBAAgB,GAAGH;YACjC;QACF;IACF;AACF"}

package/dist/auth/pkce.spec.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=pkce.spec.d.ts.map

package/dist/auth/pkce.spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"pkce.spec.d.ts","sourceRoot":"","sources":["../../src/auth/pkce.spec.ts"],"names":[],"mappings":""}

package/dist/auth/pkce.spec.js

@@ -1,32 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { generateCodeChallenge, generatePKCEPair } from './pkce.js';
-describe('generateCodeChallenge', ()=>{
-    it('should generate consistent challenge for same verifier', ()=>{
-        const verifier = 'test-verifier-123456789012345678901234567890';
-        const challenge1 = generateCodeChallenge(verifier);
-        const challenge2 = generateCodeChallenge(verifier);
-        expect(challenge1).toBe(challenge2);
-    });
-    it('should generate different challenges for different verifiers', ()=>{
-        const verifier1 = 'test-verifier-1';
-        const verifier2 = 'test-verifier-2';
-        const challenge1 = generateCodeChallenge(verifier1);
-        const challenge2 = generateCodeChallenge(verifier2);
-        expect(challenge1).not.toBe(challenge2);
-    });
-});
-describe('generatePKCEPair', ()=>{
-    it('should generate a complete PKCE pair', ()=>{
-        const pair = generatePKCEPair();
-        expect(pair).toHaveProperty('codeVerifier');
-        expect(pair).toHaveProperty('codeChallenge');
-        expect(pair).toHaveProperty('codeChallengeMethod');
-    });
-    it('should generate challenge derived from verifier', ()=>{
-        const pair = generatePKCEPair();
-        const derivedChallenge = generateCodeChallenge(pair.codeVerifier);
-        expect(pair.codeChallenge).toBe(derivedChallenge);
-    });
-});
-
-//# sourceMappingURL=pkce.spec.js.map

package/dist/auth/pkce.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/auth/pkce.spec.ts"],"sourcesContent":["import { describe, expect, it } from 'vitest'\n\nimport { generateCodeChallenge, generatePKCEPair } from './pkce.js'\n\ndescribe('generateCodeChallenge', () => {\n  it('should generate consistent challenge for same verifier', () => {\n    const verifier = 'test-verifier-123456789012345678901234567890'\n    const challenge1 = generateCodeChallenge(verifier)\n    const challenge2 = generateCodeChallenge(verifier)\n    expect(challenge1).toBe(challenge2)\n  })\n\n  it('should generate different challenges for different verifiers', () => {\n    const verifier1 = 'test-verifier-1'\n    const verifier2 = 'test-verifier-2'\n    const challenge1 = generateCodeChallenge(verifier1)\n    const challenge2 = generateCodeChallenge(verifier2)\n    expect(challenge1).not.toBe(challenge2)\n  })\n})\n\ndescribe('generatePKCEPair', () => {\n  it('should generate a complete PKCE pair', () => {\n    const pair = generatePKCEPair()\n\n    expect(pair).toHaveProperty('codeVerifier')\n    expect(pair).toHaveProperty('codeChallenge')\n    expect(pair).toHaveProperty('codeChallengeMethod')\n  })\n\n  it('should generate challenge derived from verifier', () => {\n    const pair = generatePKCEPair()\n    const derivedChallenge = generateCodeChallenge(pair.codeVerifier)\n    expect(pair.codeChallenge).toBe(derivedChallenge)\n  })\n})\n"],"names":["describe","expect","it","generateCodeChallenge","generatePKCEPair","verifier","challenge1","challenge2","toBe","verifier1","verifier2","not","pair","toHaveProperty","derivedChallenge","codeVerifier","codeChallenge"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAE7C,SAASC,qBAAqB,EAAEC,gBAAgB,QAAQ,YAAW;AAEnEJ,SAAS,yBAAyB;IAChCE,GAAG,0DAA0D;QAC3D,MAAMG,WAAW;QACjB,MAAMC,aAAaH,sBAAsBE;QACzC,MAAME,aAAaJ,sBAAsBE;QACzCJ,OAAOK,YAAYE,IAAI,CAACD;IAC1B;IAEAL,GAAG,gEAAgE;QACjE,MAAMO,YAAY;QAClB,MAAMC,YAAY;QAClB,MAAMJ,aAAaH,sBAAsBM;QACzC,MAAMF,aAAaJ,sBAAsBO;QACzCT,OAAOK,YAAYK,GAAG,CAACH,IAAI,CAACD;IAC9B;AACF;AAEAP,SAAS,oBAAoB;IAC3BE,GAAG,wCAAwC;QACzC,MAAMU,OAAOR;QAEbH,OAAOW,MAAMC,cAAc,CAAC;QAC5BZ,OAAOW,MAAMC,cAAc,CAAC;QAC5BZ,OAAOW,MAAMC,cAAc,CAAC;IAC9B;IAEAX,GAAG,mDAAmD;QACpD,MAAMU,OAAOR;QACb,MAAMU,mBAAmBX,sBAAsBS,KAAKG,YAAY;QAChEd,OAAOW,KAAKI,aAAa,EAAER,IAAI,CAACM;IAClC;AACF"}

package/dist/auth/project-token.spec.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=project-token.spec.d.ts.map

package/dist/auth/project-token.spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"project-token.spec.d.ts","sourceRoot":"","sources":["../../src/auth/project-token.spec.ts"],"names":[],"mappings":""}