@payloadcms/figma 0.0.1-alpha.6 → 0.0.1-alpha.60

package/dist/auth/callback-server.js

@@ -2,6 +2,7 @@ import { readFileSync } from 'fs';
 import { createServer } from 'http';
 import path from 'path';
 import { fileURLToPath } from 'url';
+import { DEFAULT_CALLBACK_PORT } from '../config/oauth.js';
 const filename = fileURLToPath(import.meta.url);
 const dirname = path.dirname(filename);
 /**
@@ -27,7 +28,7 @@ const dirname = path.dirname(filename);
     server = null;
     timeoutMs;
     constructor(options = {}){
-        this.preferredPort = options.port || 3000;
+        this.preferredPort = options.port || DEFAULT_CALLBACK_PORT;
         this.timeoutMs = options.timeoutMs || 120000; // 2 minutes default
         this.server = createServer();
     }

package/dist/auth/credentials.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Auth Access Tokens types for CLI authentication
+ *
+ * Distinguishes between OAuth tokens (Authorization: Bearer) and
+ * Plan Access Tokens (X-Figma-Token header).
+ */
+/**
+ * Represents an authenticated credential — either OAuth or PAT
+ */
+export type AuthCredential = {
+    token: string;
+    type: 'oauth';
+} | {
+    token: string;
+    type: 'plan_access_token';
+};
+/**
+ * Build the correct auth headers for a credential
+ */
+export declare function getAuthHeaders(credential: AuthCredential): Record<string, string>;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/auth/credentials.js

@@ -0,0 +1,21 @@
+/**
+ * Auth Access Tokens types for CLI authentication
+ *
+ * Distinguishes between OAuth tokens (Authorization: Bearer) and
+ * Plan Access Tokens (X-Figma-Token header).
+ */ /**
+ * Represents an authenticated credential — either OAuth or PAT
+ */ /**
+ * Build the correct auth headers for a credential
+ */ export function getAuthHeaders(credential) {
+    if (credential.type === 'plan_access_token') {
+        return {
+            'X-Figma-Token': credential.token
+        };
+    }
+    return {
+        Authorization: `Bearer ${credential.token}`
+    };
+}
+
+//# sourceMappingURL=credentials.js.map

package/dist/auth/crypto-utils.d.ts

@@ -30,4 +30,10 @@
  * @throws Error if unable to derive key due to missing machine information
  */
 export declare function deriveEncryptionKey(): string;
+/**
+ * Get a short hash of the encryption key for diagnostics.
+ * Returns first 8 chars of SHA-256 hash — enough to compare across invocations
+ * without exposing the actual key.
+ */
+export declare function getEncryptionKeyHash(): string;
 //# sourceMappingURL=crypto-utils.d.ts.map

package/dist/auth/crypto-utils.js

@@ -1,11 +1,6 @@
 import Conf from 'conf';
 import crypto from 'crypto';
 import os from 'os';
-// Configuration store for cryptographic salt
-const cryptoConf = new Conf({
-    configName: 'payloadcms-figma-crypto',
-    projectName: 'payloadcms-figma'
-});
 /**
  * Get or generate a random salt for key derivation
  *
@@ -15,6 +10,11 @@ const cryptoConf = new Conf({
  *
  * @returns 32-byte hex string (64 characters)
  */ function getOrCreateSalt() {
+    // Configuration store for cryptographic salt
+    const cryptoConf = new Conf({
+        configName: 'payloadcms-figma-crypto',
+        projectName: 'payloadcms-figma'
+    });
     let salt = cryptoConf.get('salt');
     if (!salt) {
         // Generate cryptographically secure random salt (32 bytes = 256 bits)
@@ -33,19 +33,13 @@ const cryptoConf = new Conf({
  * @throws Error if unable to gather sufficient entropy
  */ function gatherMachineEntropy() {
     try {
-        const userInfo = os.userInfo();
-        const networkInterfaces = os.networkInterfaces();
-        // Get MAC address from first available network interface (if available)
-        const macAddress = Object.values(networkInterfaces).flat().find((iface)=>iface && !iface.internal && iface.mac !== '00:00:00:00:00:00')?.mac;
         const entropy = [
             os.hostname(),
             os.homedir(),
-            userInfo.username,
+            os.userInfo().username,
             os.platform(),
-            os.arch(),
-            macAddress
-        ].filter(Boolean) // Remove any undefined values
-        ;
+            os.arch()
+        ];
         if (entropy.length < 4) {
             throw new Error('Insufficient machine entropy available');
         }
@@ -92,5 +86,13 @@ const cryptoConf = new Conf({
     const key = crypto.pbkdf2Sync(machineId, salt, 100000, 32, 'sha256');
     return key.toString('hex');
 }
+/**
+ * Get a short hash of the encryption key for diagnostics.
+ * Returns first 8 chars of SHA-256 hash — enough to compare across invocations
+ * without exposing the actual key.
+ */ export function getEncryptionKeyHash() {
+    const key = deriveEncryptionKey();
+    return crypto.createHash('sha256').update(key).digest('hex').substring(0, 8);
+}
 
 //# sourceMappingURL=crypto-utils.js.map

package/dist/auth/jwt-validator.d.ts

@@ -1,3 +1,4 @@
+import type { Environment } from '../constants.js';
 import type { JWTPayload } from './types.js';
 /**
  * JWT validation error with specific error codes
@@ -27,7 +28,7 @@ export declare class JWTValidationError extends Error {
  * @returns Promise resolving to validated JWT payload
  * @throws {JWTValidationError} If validation fails
  */
-export declare function validateProjectToken(token: string, environment: 'production' | 'staging'): Promise<JWTPayload>;
+export declare function validateProjectToken(token: string, environment: Environment): Promise<JWTPayload>;
 /**
  * Clear JWKS cache (useful for testing or forcing refresh)
  *

package/dist/auth/jwt-validator.js

@@ -1,6 +1,6 @@
 import { createRemoteJWKSet, jwtVerify } from 'jose';
 import { JWKSMultipleMatchingKeys, JWKSNoMatchingKey, JWSInvalid, JWSSignatureVerificationFailed, JWTExpired } from 'jose/errors';
-import { getJWKSUri } from '../constants.js';
+import { ENV_CONFIG } from '../constants.js';
 /**
  * JWT validation error with specific error codes
  */ export class JWTValidationError extends Error {
@@ -28,7 +28,7 @@ import { getJWKSUri } from '../constants.js';
  * @param environment - Figma environment ('production' or 'staging')
  * @returns JWKS resolver function
  */ function getJWKSResolver(environment) {
-    const jwksUri = getJWKSUri(environment);
+    const jwksUri = ENV_CONFIG[environment].jwksUri;
     if (!jwksResolvers.has(jwksUri)) {
         jwksResolvers.set(jwksUri, createRemoteJWKSet(new URL(jwksUri), {
             cacheMaxAge: 24 * 60 * 60 * 1000,

package/dist/auth/oauth-flow.d.ts

@@ -1,3 +1,4 @@
+import type { AuthCredential } from './credentials.js';
 import type { TokenStore } from './token-store.js';
 import type { FigmaTokens } from './types.js';
 /**
@@ -13,7 +14,7 @@ export declare class OAuthFlowError extends Error {
 export interface OAuthFlowOptions {
     /** OAuth2 client ID (defaults to config) */
     clientId?: string;
-    /** Callback server port (defaults to 3000) */
+    /** Callback server port (defaults to DEFAULT_CALLBACK_PORT) */
     port?: number;
     /** Redirect URI (defaults to config) */
     redirectUri?: string;
@@ -55,8 +56,21 @@ export declare function executeOAuthFlow(tokenStore: TokenStore, options?: OAuth
  * refreshes using the refresh token. If no tokens exist, returns null.
  *
  * @param tokenStore - Token store to use
- * @returns Promise resolving to access token or null if no valid tokens
+ * @returns Promise resolving to AuthCredential (wrapped access token) or null if no valid tokens
  * @throws OAuthFlowError if refresh fails
  */
-export declare function getValidAccessToken(tokenStore: TokenStore): Promise<null | string>;
+export declare function getValidOAuthAccessToken(tokenStore: TokenStore): Promise<AuthCredential | null>;
+/**
+ * Get a valid auth credential, checking process.env for plan access token
+ * first before checking tokenStore for OAuth tokens.
+ * *
+ * @param tokenStore - Token store to use for OAuth tokens
+ * @returns Promise resolving to AuthCredential or null
+ */
+export declare function getValidCredential(tokenStore: TokenStore): Promise<AuthCredential | null>;
+/**
+ * Like getValidCredential but returns null instead of throwing on refresh failure.
+ * Use in commands that want to fall through to a login prompt on failure.
+ */
+export declare function tryGetCredential(tokenStore: TokenStore): Promise<AuthCredential | null>;
 //# sourceMappingURL=oauth-flow.d.ts.map

package/dist/auth/oauth-flow.js

@@ -1,11 +1,11 @@
 import * as p from '@clack/prompts';
 import crypto from 'crypto';
-import { OAUTH_CONFIG } from '../config/oauth.js';
+import { DEFAULT_CALLBACK_PORT, getOAuthConfig } from '../config/oauth.js';
 import * as log from '../utils/log.js';
 import { buildAuthorizationUrl, openBrowser } from './browser.js';
 import { CallbackServer } from './callback-server.js';
 import { generatePKCEPair } from './pkce.js';
-import { exchangeCodeForTokens, refreshAccessToken } from './refresh.js';
+import { exchangeCodeForTokens, refreshAccessToken, TokenRefreshError } from './refresh.js';
 /**
  * Error during OAuth flow
  */ export class OAuthFlowError extends Error {
@@ -32,16 +32,17 @@ import { exchangeCodeForTokens, refreshAccessToken } from './refresh.js';
  * @throws OAuthFlowError if any step fails
  */ export async function executeOAuthFlow(tokenStore, options = {}) {
     // Check if OAuth flow should be mocked
-    // Default to true for OAuth (allow testing without real authentication by default)
-    const shouldMock = process.env.FIGMA_MOCK_OAUTH !== 'false';
+    // Default to false for OAuth
+    const shouldMock = process.env.FIGMA_MOCK_OAUTH === 'true';
+    const oauthConfig = getOAuthConfig();
     if (shouldMock) {
         // MOCK IMPLEMENTATION: Return mock tokens for testing
-        log.debug('Using mock OAuth flow (FIGMA_MOCK_OAUTH != "false")');
+        log.debug('Using mock OAuth flow (FIGMA_MOCK_OAUTH = true)');
         const mockTokens = {
             accessToken: 'figt_mock_access_token_' + crypto.randomBytes(16).toString('hex'),
             expiresAt: Date.now() + 2 * 60 * 60 * 1000,
             refreshToken: 'figt_mock_refresh_token_' + crypto.randomBytes(16).toString('hex'),
-            scopes: options.scopes || OAUTH_CONFIG.scopes,
+            scopes: options.scopes || oauthConfig.scopes,
             tokenType: 'Bearer'
         };
         // Store mock tokens
@@ -52,7 +53,7 @@ import { exchangeCodeForTokens, refreshAccessToken } from './refresh.js';
         };
     }
     // REAL OAUTH IMPLEMENTATION
-    const { clientId = OAUTH_CONFIG.clientId, port = 3000, redirectUri = OAUTH_CONFIG.redirectUri, scopes = OAUTH_CONFIG.scopes, timeoutMs = 120000 } = options;
+    const { clientId = oauthConfig.clientId, port = DEFAULT_CALLBACK_PORT, redirectUri = oauthConfig.redirectUri, scopes = oauthConfig.scopes, timeoutMs = 120000 } = options;
     // Generate PKCE pair for enhanced security
     const { codeChallenge, codeChallengeMethod, codeVerifier } = generatePKCEPair();
     // Generate random state for CSRF protection
@@ -73,7 +74,7 @@ import { exchangeCodeForTokens, refreshAccessToken } from './refresh.js';
         const actualRedirectUri = redirectUri.replace(/:\d+/, `:${actualPort}`);
         // Build authorization URL
         const authUrl = buildAuthorizationUrl({
-            authorizationUrl: OAUTH_CONFIG.authorizationUrl,
+            authorizationUrl: oauthConfig.authorizationUrl,
             clientId,
             codeChallenge,
             codeChallengeMethod,
@@ -84,7 +85,7 @@ import { exchangeCodeForTokens, refreshAccessToken } from './refresh.js';
         // Prompt user to open browser
         const shouldOpenBrowser = await p.confirm({
             initialValue: true,
-            message: 'Log in or create Figma account in your browser?'
+            message: 'Authenticate with Figma in your browser?'
         });
         if (p.isCancel(shouldOpenBrowser)) {
             throw new OAuthFlowError('Authentication cancelled by user');
@@ -142,28 +143,74 @@ import { exchangeCodeForTokens, refreshAccessToken } from './refresh.js';
  * refreshes using the refresh token. If no tokens exist, returns null.
  *
  * @param tokenStore - Token store to use
- * @returns Promise resolving to access token or null if no valid tokens
+ * @returns Promise resolving to AuthCredential (wrapped access token) or null if no valid tokens
  * @throws OAuthFlowError if refresh fails
- */ export async function getValidAccessToken(tokenStore) {
+ */ export async function getValidOAuthAccessToken(tokenStore) {
     // Check if we have valid tokens
     if (tokenStore.hasValidTokens()) {
-        return tokenStore.getAccessToken();
+        const token = tokenStore.getAccessToken();
+        return token ? {
+            type: 'oauth',
+            token
+        } : null;
     }
     // Check if we have a refresh token
     const refreshToken = tokenStore.getRefreshToken();
     if (!refreshToken) {
         return null;
     }
-    // Try to refresh
+    // Try to refresh (with one retry for transient auth errors)
     try {
         const tokens = await refreshAccessToken(refreshToken);
         tokenStore.setTokens(tokens);
-        return tokens.accessToken;
+        return {
+            type: 'oauth',
+            token: tokens.accessToken
+        };
     } catch (error) {
-        // Refresh failed - clear invalid tokens
-        tokenStore.clearTokens();
+        const isAuthFailure = error instanceof TokenRefreshError && (error.statusCode === 401 || error.statusCode === 403 || error.statusCode === 400 && error.errorCode === 'invalid_grant');
+        if (isAuthFailure) {
+            // Retry once — a transient 401 (e.g. misconfigured proxy) shouldn't wipe tokens
+            try {
+                const tokens = await refreshAccessToken(refreshToken);
+                tokenStore.setTokens(tokens);
+                return {
+                    type: 'oauth',
+                    token: tokens.accessToken
+                };
+            } catch  {
+                // Retry also failed — token is genuinely revoked
+                tokenStore.clearTokens();
+            }
+        }
         throw new OAuthFlowError('Failed to refresh access token', error instanceof Error ? error : undefined);
     }
 }
+/**
+ * Get a valid auth credential, checking process.env for plan access token
+ * first before checking tokenStore for OAuth tokens.
+ * *
+ * @param tokenStore - Token store to use for OAuth tokens
+ * @returns Promise resolving to AuthCredential or null
+ */ export async function getValidCredential(tokenStore) {
+    const envFigmaAccessToken = process.env.FIGMA_ACCESS_TOKEN;
+    if (envFigmaAccessToken) {
+        return {
+            type: 'plan_access_token',
+            token: envFigmaAccessToken
+        };
+    }
+    return getValidOAuthAccessToken(tokenStore);
+}
+/**
+ * Like getValidCredential but returns null instead of throwing on refresh failure.
+ * Use in commands that want to fall through to a login prompt on failure.
+ */ export async function tryGetCredential(tokenStore) {
+    try {
+        return await getValidCredential(tokenStore);
+    } catch  {
+        return null;
+    }
+}
 
 //# sourceMappingURL=oauth-flow.js.map

package/dist/auth/project-token.js

@@ -5,10 +5,10 @@
  * to the Content API. Project tokens are scoped to a specific tenant/CMS
  * and have a shorter lifespan (15-30 minutes) than OAuth tokens.
  */ import { getProjectToken as fetchProjectToken } from '../api/figma-api.js';
-import { getEnvironment } from '../constants.js';
+import { getInfraEnvironment } from '../constants.js';
 import * as log from '../utils/log.js';
 import { JWTValidationError, validateProjectToken } from './jwt-validator.js';
-import { getValidAccessToken } from './oauth-flow.js';
+import { getValidCredential } from './oauth-flow.js';
 /**
  * Error during project token operations
  */ export class ProjectTokenError extends Error {
@@ -60,36 +60,41 @@ import { getValidAccessToken } from './oauth-flow.js';
  * @returns Promise resolving to JWT token string or null if failed
  * @throws {ProjectTokenError} If token generation fails
  */ export async function getValidProjectToken(tokenStore, tenantId) {
-    // Check if we have a valid project token already
+    if (process.env.FIGMA_CONTENT_API_ACCESS_KEY) {
+        log.debug('FIGMA_CONTENT_API_ACCESS_KEY is set; skipping project token retrieval from API');
+        return null;
+    }
+    // Check for existing valid project token
     if (tokenStore.hasValidProjectToken(tenantId)) {
         const projectToken = tokenStore.getProjectToken(tenantId);
         return projectToken?.token || null;
     }
     // We need to refresh the project token
-    // First, get a valid user access token (will auto-refresh if needed)
-    let accessToken;
+    // An oauth access token is required for the call
+    let credential;
     try {
-        accessToken = await getValidAccessToken(tokenStore);
+        credential = await getValidCredential(tokenStore);
     } catch (error) {
         throw new ProjectTokenError('Failed to get valid access token for project token refresh', error instanceof Error ? error : undefined);
     }
-    if (!accessToken) {
+    if (!credential) {
         // No valid user tokens available - user needs to authenticate
         return null;
     }
     // Fetch a new project token from the Figma API
-    const projectToken = await fetchProjectToken(accessToken, tenantId);
+    const projectToken = await fetchProjectToken(credential, tenantId);
     // Validate the JWT signature and claims (skip for mocks)
+    const hasEnvToken = !!process.env.FIGMA_MOCK_PROJECT_TOKEN_VALUE;
     const shouldMock = process.env.FIGMA_MOCK_PROJECT_TOKEN !== 'false';
     let validatedClaims;
-    if (shouldMock) {
+    if (hasEnvToken || shouldMock) {
         // MOCK: Skip JWT validation and parse claims directly
-        log.debug('Skipping JWT validation for mock project token');
+        log.debug('Skipping JWT validation for mock/env project token');
         validatedClaims = parseJWTClaims(projectToken.token);
     } else {
         // REAL: Validate JWT signature against JWKS
         try {
-            validatedClaims = await validateProjectToken(projectToken.token, getEnvironment());
+            validatedClaims = await validateProjectToken(projectToken.token, getInfraEnvironment());
         } catch (validationError) {
             // Handle validation errors
             if (validationError instanceof JWTValidationError) {

package/dist/auth/refresh.d.ts

@@ -4,7 +4,8 @@ import type { FigmaTokens } from './types.js';
  */
 export declare class TokenRefreshError extends Error {
     statusCode?: number | undefined;
-    constructor(message: string, statusCode?: number | undefined);
+    errorCode?: string | undefined;
+    constructor(message: string, statusCode?: number | undefined, errorCode?: string | undefined);
 }
 /**
  * Refresh an expired OAuth2 access token using a refresh token

package/dist/auth/refresh.js

@@ -1,11 +1,12 @@
-/* eslint-disable perfectionist/sort-objects */ import { OAUTH_CONFIG } from '../config/oauth.js';
+/* eslint-disable perfectionist/sort-objects */ import { getOAuthConfig } from '../config/oauth.js';
 import * as log from '../utils/log.js';
 /**
  * Error thrown when token refresh fails
  */ export class TokenRefreshError extends Error {
     statusCode;
-    constructor(message, statusCode){
-        super(message), this.statusCode = statusCode;
+    errorCode;
+    constructor(message, statusCode, errorCode){
+        super(message), this.statusCode = statusCode, this.errorCode = errorCode;
         this.name = 'TokenRefreshError';
     }
 }
@@ -19,15 +20,17 @@ import * as log from '../utils/log.js';
  * @param clientId - OAuth2 client ID (defaults to config)
  * @returns Promise resolving to new tokens
  * @throws TokenRefreshError if refresh fails
- */ export async function refreshAccessToken(refreshToken, clientId = OAUTH_CONFIG.clientId) {
+ */ export async function refreshAccessToken(refreshToken, clientId) {
+    const oauthConfig = getOAuthConfig();
+    const resolvedClientId = clientId ?? oauthConfig.clientId;
     // Prepare form data for token refresh request (public client)
     const params = new URLSearchParams({
-        client_id: clientId,
+        client_id: resolvedClientId,
         grant_type: 'refresh_token',
         refresh_token: refreshToken
     });
     try {
-        const response = await fetch(OAUTH_CONFIG.refreshUrl, {
+        const response = await fetch(oauthConfig.refreshUrl, {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/x-www-form-urlencoded'
@@ -36,7 +39,14 @@ import * as log from '../utils/log.js';
         });
         if (!response.ok) {
             const errorText = await response.text();
-            throw new TokenRefreshError(`Token refresh failed: ${response.statusText}. ${errorText}`, response.status);
+            let errorCode;
+            try {
+                const parsed = JSON.parse(errorText);
+                errorCode = parsed.error;
+            } catch  {
+            // Not JSON, leave errorCode undefined
+            }
+            throw new TokenRefreshError(`Token refresh failed: ${response.statusText}. ${errorText}`, response.status, errorCode);
         }
         const data = await response.json();
         // Validate response contains required fields
@@ -71,14 +81,17 @@ import * as log from '../utils/log.js';
  * @param clientId - OAuth2 client ID (defaults to config)
  * @returns Promise resolving to tokens
  * @throws TokenRefreshError if exchange fails
- */ export async function exchangeCodeForTokens(code, codeVerifier, redirectUri = OAUTH_CONFIG.redirectUri, clientId = OAUTH_CONFIG.clientId) {
+ */ export async function exchangeCodeForTokens(code, codeVerifier, redirectUri, clientId) {
+    const oauthConfig = getOAuthConfig();
+    const resolvedRedirectUri = redirectUri ?? oauthConfig.redirectUri;
+    const resolvedClientId = clientId ?? oauthConfig.clientId;
     // Prepare form data for token exchange (public client with PKCE)
     const params = new URLSearchParams({
-        client_id: clientId,
+        client_id: resolvedClientId,
         code,
         code_verifier: codeVerifier,
         grant_type: 'authorization_code',
-        redirect_uri: redirectUri
+        redirect_uri: resolvedRedirectUri
     });
     try {
         // Public client - no client secret or Basic Auth header needed
@@ -88,11 +101,11 @@ import * as log from '../utils/log.js';
         };
         // Debug logging
         log.debug(`Token exchange request: ${JSON.stringify({
-            url: OAUTH_CONFIG.tokenUrl,
+            url: oauthConfig.tokenUrl,
             headers,
             body: params.toString()
         })}`);
-        const response = await fetch(OAUTH_CONFIG.tokenUrl, {
+        const response = await fetch(oauthConfig.tokenUrl, {
             method: 'POST',
             headers,
             body: params.toString()

package/dist/auth/token-store.d.ts

@@ -1,4 +1,13 @@
-import type { FigmaTokens, JWTPayload, ProjectToken, TokenStoreConfig } from './types.js';
+import type { Environment } from '../constants.js';
+import type { BootstrapData, FigmaTokens, JWTPayload, ProjectToken, TokenStoreConfig } from './types.js';
+/**
+ * Get the singleton TokenStore instance for an environment
+ * Use this for all production code to ensure a single shared instance per environment
+ *
+ * @param environment - The environment to get the token store for
+ * @returns The singleton TokenStore instance for that environment
+ */
+export declare function getTokenStore(environment?: Environment): TokenStore;
 /**
  * Secure storage manager for Figma OAuth2 tokens
  *
@@ -9,10 +18,15 @@ import type { FigmaTokens, JWTPayload, ProjectToken, TokenStoreConfig } from './
  *
  * Tokens are encrypted at rest with a machine-specific key and file permissions
  * are set to 0600 (owner read/write only)
+ *
+ * For production code, use getTokenStore() to get the singleton instance.
+ * The constructor is still exported for test isolation.
  */
 export declare class TokenStore {
     private config;
+    private environment;
     constructor(options?: TokenStoreConfig);
+    private safeGet;
     /**
      * Retrieve stored tokens
      * @returns FigmaTokens if stored, null otherwise
@@ -106,5 +120,32 @@ export declare class TokenStore {
      * @returns Array of tenant IDs
      */
     getAllProjectTokenTenantIds(): string[];
+    /**
+     * Build the composite key for bootstrap data storage
+     * @param projectId - The CMS resource/project ID
+     * @param environmentName - The environment name (e.g. 'production', 'staging')
+     * @returns Composite key string
+     */
+    private bootstrapKey;
+    /**
+     * Retrieve bootstrap data for a project + environment
+     * @param projectId - The CMS resource/project ID
+     * @param environmentName - The environment name
+     * @returns BootstrapData if stored, null otherwise
+     */
+    getBootstrapData(projectId: string, environmentName: string): BootstrapData | null;
+    /**
+     * Store bootstrap data for a project + environment
+     * @param projectId - The CMS resource/project ID
+     * @param environmentName - The environment name
+     * @param data - The bootstrap data to store
+     */
+    setBootstrapData(projectId: string, environmentName: string, data: BootstrapData): void;
+    /**
+     * Clear bootstrap data for a project + environment
+     * @param projectId - The CMS resource/project ID
+     * @param environmentName - The environment name
+     */
+    clearBootstrapData(projectId: string, environmentName: string): void;
 }
 //# sourceMappingURL=token-store.d.ts.map