@payloadcms/figma 0.0.1-alpha.62 → 0.0.1-alpha.63

package/dist/auth/crypto-utils.d.ts

@@ -36,4 +36,15 @@ export declare function deriveEncryptionKey(): string;
  * without exposing the actual key.
  */
 export declare function getEncryptionKeyHash(): string;
+/**
+ * Write decrypted versions of all encrypted store files for debugging.
+ *
+ * For each .json file in the store directory, creates a neighboring .decrypted.json
+ * file containing the decrypted contents. Useful for debugging token storage issues.
+ *
+ * @param rootDir - Root directory of the token store (e.g., ~/Library/Preferences/payloadcms-figma-nodejs)
+ * @param encryptionKey - The encryption key used by Conf
+ * @returns Array of paths to decrypted files created
+ */
+export declare function exportDecryptedStoreFiles(rootDir: string, encryptionKey: string): string[];
 //# sourceMappingURL=crypto-utils.d.ts.map

package/dist/auth/crypto-utils.js

@@ -1,6 +1,8 @@
 import Conf from 'conf';
 import crypto from 'crypto';
+import fsSync from 'node:fs';
 import os from 'os';
+import path from 'path';
 /**
  * Get or generate a random salt for key derivation
  *
@@ -94,5 +96,54 @@ import os from 'os';
     const key = deriveEncryptionKey();
     return crypto.createHash('sha256').update(key).digest('hex').substring(0, 8);
 }
+/**
+ * Write decrypted versions of all encrypted store files for debugging.
+ *
+ * For each .json file in the store directory, creates a neighboring .decrypted.json
+ * file containing the decrypted contents. Useful for debugging token storage issues.
+ *
+ * @param rootDir - Root directory of the token store (e.g., ~/Library/Preferences/payloadcms-figma-nodejs)
+ * @param encryptionKey - The encryption key used by Conf
+ * @returns Array of paths to decrypted files created
+ */ export function exportDecryptedStoreFiles(rootDir, encryptionKey) {
+    const decryptedFiles = [];
+    function processDirectory(dir) {
+        if (!fsSync.existsSync(dir)) {
+            return;
+        }
+        const entries = fsSync.readdirSync(dir, {
+            withFileTypes: true
+        });
+        for (const entry of entries){
+            const fullPath = path.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                processDirectory(fullPath);
+            } else if (entry.name.endsWith('.json') && !entry.name.endsWith('.decrypted.json') && !entry.name.includes('.corrupt-')) {
+                try {
+                    // Extract configName from filename (remove .json extension)
+                    const configName = entry.name.replace(/\.json$/, '');
+                    // Create a Conf instance to read/decrypt the file
+                    const config = new Conf({
+                        clearInvalidConfig: false,
+                        configName,
+                        cwd: dir,
+                        encryptionKey,
+                        projectName: 'payloadcms-figma'
+                    });
+                    // Read all data from the store (Conf decrypts it)
+                    const data = config.store;
+                    // Write decrypted content to neighboring file
+                    const decryptedPath = fullPath.replace(/\.json$/, '.decrypted.json');
+                    fsSync.writeFileSync(decryptedPath, JSON.stringify(data, null, 2));
+                    decryptedFiles.push(decryptedPath);
+                } catch  {
+                // Skip files that can't be decrypted (e.g., crypto config, already unencrypted)
+                }
+            }
+        }
+    }
+    processDirectory(rootDir);
+    return decryptedFiles;
+}
 
 //# sourceMappingURL=crypto-utils.js.map

package/dist/auth/oauth-flow.js

@@ -147,15 +147,15 @@ import { exchangeCodeForTokens, refreshAccessToken, TokenRefreshError } from './
  * @throws OAuthFlowError if refresh fails
  */ export async function getValidOAuthAccessToken(tokenStore) {
     // Check if we have valid tokens
-    if (tokenStore.hasValidTokens()) {
-        const token = tokenStore.getAccessToken();
+    if (tokenStore.hasValidOauthToken()) {
+        const token = tokenStore.getCurrentOauthToken();
         return token ? {
             type: 'oauth',
             token
         } : null;
     }
     // Check if we have a refresh token
-    const refreshToken = tokenStore.getRefreshToken();
+    const refreshToken = tokenStore.getCurrentRefreshToken();
     if (!refreshToken) {
         return null;
     }

package/dist/auth/project-token.d.ts

@@ -6,6 +6,7 @@
  * and have a shorter lifespan (15-30 minutes) than OAuth tokens.
  */
 import type { TokenStore } from './token-store.js';
+import type { ProjectStoreScope } from './types.js';
 /**
  * Error during project token operations
  */
@@ -26,22 +27,32 @@ export declare class ProjectTokenError extends Error {
  * The project token is used by local Payload instances to authenticate
  * requests to the Content API without requiring a round-trip to Sinatra.
  *
- * @param tokenStore - Token store for persisting tokens
- * @param tenantId - The tenant/CMS ID to get a token for
+ * @param params.tokenStore - Token store for persisting tokens
+ * @param params.tenantId - Optional tenant/CMS ID; resolved from stored bootstrap data when omitted
+ * @param params.projectInfo - Optional project scope (defaults to env vars)
  * @returns Promise resolving to JWT token string or null if failed
  * @throws {ProjectTokenError} If token generation fails
  */
-export declare function getValidProjectToken(tokenStore: TokenStore, tenantId: string): Promise<null | string>;
+export declare function getValidProjectToken({ projectInfo, tenantId, tokenStore, }: {
+    projectInfo?: ProjectStoreScope;
+    tenantId?: string;
+    tokenStore: TokenStore;
+}): Promise<null | string>;
 /**
  * Refresh a project token for a tenant
  *
  * Forces a refresh of the project token even if the current one is still valid.
  * Useful for testing or when you want to ensure you have the freshest token.
  *
- * @param tokenStore - Token store for persisting tokens
- * @param tenantId - The tenant/CMS ID to refresh token for
+ * @param params.tokenStore - Token store for persisting tokens
+ * @param params.tenantId - Optional tenant/CMS ID; resolved from stored bootstrap data when omitted
+ * @param params.projectInfo - Optional project scope (defaults to env vars)
  * @returns Promise resolving to JWT token string or null if failed
  * @throws {ProjectTokenError} If token refresh fails
  */
-export declare function refreshProjectToken(tokenStore: TokenStore, tenantId: string): Promise<null | string>;
+export declare function refreshProjectToken(params: {
+    projectInfo?: ProjectStoreScope;
+    tenantId?: string;
+    tokenStore: TokenStore;
+}): Promise<null | string>;
 //# sourceMappingURL=project-token.d.ts.map

package/dist/auth/project-token.js

@@ -55,18 +55,29 @@ import { getValidCredential } from './oauth-flow.js';
  * The project token is used by local Payload instances to authenticate
  * requests to the Content API without requiring a round-trip to Sinatra.
  *
- * @param tokenStore - Token store for persisting tokens
- * @param tenantId - The tenant/CMS ID to get a token for
+ * @param params.tokenStore - Token store for persisting tokens
+ * @param params.tenantId - Optional tenant/CMS ID; resolved from stored bootstrap data when omitted
+ * @param params.projectInfo - Optional project scope (defaults to env vars)
  * @returns Promise resolving to JWT token string or null if failed
  * @throws {ProjectTokenError} If token generation fails
- */ export async function getValidProjectToken(tokenStore, tenantId) {
+ */ export async function getValidProjectToken({ projectInfo, tenantId, tokenStore }) {
     if (process.env.FIGMA_CONTENT_API_ACCESS_KEY) {
         log.debug('FIGMA_CONTENT_API_ACCESS_KEY is set; skipping project token retrieval from API');
         return null;
     }
+    const resolvedTenantId = tenantId ?? tokenStore.getTenantId({
+        projectInfo
+    });
+    if (!resolvedTenantId) {
+        throw new ProjectTokenError('tenantId was not provided and could not be resolved from bootstrap data');
+    }
     // Check for existing valid project token
-    if (tokenStore.hasValidProjectToken(tenantId)) {
-        const projectToken = tokenStore.getProjectToken(tenantId);
+    if (tokenStore.hasValidProjectToken({
+        projectInfo
+    })) {
+        const projectToken = tokenStore.getProjectToken({
+            projectInfo
+        });
         return projectToken?.token || null;
     }
     // We need to refresh the project token
@@ -82,7 +93,7 @@ import { getValidCredential } from './oauth-flow.js';
         return null;
     }
     // Fetch a new project token from the Figma API
-    const projectToken = await fetchProjectToken(credential, tenantId);
+    const fetchedToken = await fetchProjectToken(credential, resolvedTenantId);
     // Validate the JWT signature and claims (skip for mocks)
     const hasEnvToken = !!process.env.FIGMA_MOCK_PROJECT_TOKEN_VALUE;
     const shouldMock = process.env.FIGMA_MOCK_PROJECT_TOKEN !== 'false';
@@ -90,11 +101,11 @@ import { getValidCredential } from './oauth-flow.js';
     if (hasEnvToken || shouldMock) {
         // MOCK: Skip JWT validation and parse claims directly
         log.debug('Skipping JWT validation for mock/env project token');
-        validatedClaims = parseJWTClaims(projectToken.token);
+        validatedClaims = parseJWTClaims(fetchedToken.token);
     } else {
         // REAL: Validate JWT signature against JWKS
         try {
-            validatedClaims = await validateProjectToken(projectToken.token, getInfraEnvironment());
+            validatedClaims = await validateProjectToken(fetchedToken.token, getInfraEnvironment());
         } catch (validationError) {
             // Handle validation errors
             if (validationError instanceof JWTValidationError) {
@@ -108,13 +119,16 @@ import { getValidCredential } from './oauth-flow.js';
         throw new ProjectTokenError('Project token missing expiration (exp) claim');
     }
     // Store the project token with validated expiration and claims
-    tokenStore.setProjectToken(tenantId, {
-        claims: validatedClaims,
-        expiresAt: validatedClaims.exp * 1000,
-        tenantId,
-        token: projectToken.token
+    tokenStore.setProjectToken({
+        projectInfo,
+        token: {
+            claims: validatedClaims,
+            expiresAt: validatedClaims.exp * 1000,
+            tenantId: resolvedTenantId,
+            token: fetchedToken.token
+        }
     });
-    return projectToken.token;
+    return fetchedToken.token;
 }
 /**
  * Refresh a project token for a tenant
@@ -122,15 +136,19 @@ import { getValidCredential } from './oauth-flow.js';
  * Forces a refresh of the project token even if the current one is still valid.
  * Useful for testing or when you want to ensure you have the freshest token.
  *
- * @param tokenStore - Token store for persisting tokens
- * @param tenantId - The tenant/CMS ID to refresh token for
+ * @param params.tokenStore - Token store for persisting tokens
+ * @param params.tenantId - Optional tenant/CMS ID; resolved from stored bootstrap data when omitted
+ * @param params.projectInfo - Optional project scope (defaults to env vars)
  * @returns Promise resolving to JWT token string or null if failed
  * @throws {ProjectTokenError} If token refresh fails
- */ export async function refreshProjectToken(tokenStore, tenantId) {
+ */ export async function refreshProjectToken(params) {
+    const { projectInfo, tokenStore } = params;
     // Clear the existing project token to force a refresh
-    tokenStore.clearProjectToken(tenantId);
+    tokenStore.clearProjectToken({
+        projectInfo
+    });
     // Get a new token (which will fetch from API since we just cleared it)
-    return getValidProjectToken(tokenStore, tenantId);
+    return getValidProjectToken(params);
 }
 
 //# sourceMappingURL=project-token.js.map

package/dist/auth/token-store-migration.d.ts

@@ -0,0 +1,58 @@
+import type { BootstrapData, FigmaTokens, ProjectToken } from './types.js';
+export type LegacyStoreSchema = {
+    bootstrapData?: Record<string, BootstrapData>;
+    projectTokens?: Record<string, ProjectToken>;
+    tokens?: FigmaTokens;
+};
+export type MigrationCheckParams = {
+    checkFileExists?: (filePath: string) => boolean;
+    legacyFilePath: string;
+    newOAuthFilePath: string;
+};
+export type MigrateOAuthParams = {
+    encryptionKey: string;
+    legacyConfigName: string;
+    legacyCwd?: string;
+    newOAuthConfigName: string;
+    newOAuthCwd: string;
+    projectName: string;
+};
+/**
+ * Check if migration is needed.
+ * Returns true only when legacy file exists AND new oauth file does not.
+ */
+export declare function needsMigration(params: MigrationCheckParams): boolean;
+/**
+ * Migrate OAuth tokens from legacy store to new oauth store.
+ * Reads from legacy location, writes to new location with root-level keys.
+ *
+ * `clearInvalidConfig` is deliberately OFF so a transient decrypt error does
+ * not wipe the legacy file — older CLI versions elsewhere on disk still read
+ * it. If we cannot open the file, we log and skip migration.
+ */
+export declare function migrateOAuth(params: MigrateOAuthParams): void;
+export type ResolveProjectStorePath = (scope: {
+    environmentName: string;
+    projectId: string;
+}) => {
+    configName: string;
+    cwd: string;
+};
+export type MigrateProjectDataParams = {
+    encryptionKey: string;
+    legacyConfigName: string;
+    legacyCwd?: string;
+    projectName: string;
+    resolveProjectStorePath: ResolveProjectStorePath;
+};
+/**
+ * Migrate per-project bootstrap data and project tokens from the legacy
+ * combined store into individual per-project stores.
+ *
+ * Walks legacy `bootstrapData` (keyed by `projectId:environmentName`), writes
+ * each entry into its own project store file, and stashes the matching
+ * `projectToken` (looked up by `bootstrapData.contentSystemId`) alongside it.
+ * Target files that already exist are left alone.
+ */
+export declare function migrateProjectData(params: MigrateProjectDataParams): void;
+//# sourceMappingURL=token-store-migration.d.ts.map

package/dist/auth/token-store-migration.js

@@ -0,0 +1,156 @@
+import Conf from 'conf';
+import fsSync from 'node:fs';
+import path from 'node:path';
+import * as log from '../utils/log.js';
+const OAUTH_STORE_SCHEMA_VERSION = 1;
+const PROJECT_STORE_SCHEMA_VERSION = 1;
+/**
+ * Check if migration is needed.
+ * Returns true only when legacy file exists AND new oauth file does not.
+ */ export function needsMigration(params) {
+    const checkExists = params.checkFileExists ?? fsSync.existsSync;
+    const newExists = checkExists(params.newOAuthFilePath);
+    if (newExists) {
+        return false;
+    }
+    return checkExists(params.legacyFilePath);
+}
+/**
+ * Migrate OAuth tokens from legacy store to new oauth store.
+ * Reads from legacy location, writes to new location with root-level keys.
+ *
+ * `clearInvalidConfig` is deliberately OFF so a transient decrypt error does
+ * not wipe the legacy file — older CLI versions elsewhere on disk still read
+ * it. If we cannot open the file, we log and skip migration.
+ */ export function migrateOAuth(params) {
+    const legacyConfig = openLegacyConfig({
+        encryptionKey: params.encryptionKey,
+        legacyConfigName: params.legacyConfigName,
+        legacyCwd: params.legacyCwd,
+        projectName: params.projectName
+    });
+    if (!legacyConfig) {
+        return;
+    }
+    const legacyTokens = safeGet(legacyConfig, 'tokens');
+    if (!legacyTokens) {
+        return;
+    }
+    // Ensure target directory exists
+    if (!fsSync.existsSync(params.newOAuthCwd)) {
+        fsSync.mkdirSync(params.newOAuthCwd, {
+            recursive: true
+        });
+    }
+    const newOAuthConfig = new Conf({
+        configName: params.newOAuthConfigName,
+        cwd: params.newOAuthCwd,
+        encryptionKey: params.encryptionKey,
+        projectName: params.projectName
+    });
+    // Write root-level keys
+    newOAuthConfig.set('_schemaVersion', OAUTH_STORE_SCHEMA_VERSION);
+    newOAuthConfig.set('accessToken', legacyTokens.accessToken);
+    newOAuthConfig.set('expiresAt', legacyTokens.expiresAt);
+    newOAuthConfig.set('refreshToken', legacyTokens.refreshToken);
+    if (legacyTokens.scopes) {
+        newOAuthConfig.set('scopes', legacyTokens.scopes);
+    }
+    if (legacyTokens.tokenType) {
+        newOAuthConfig.set('tokenType', legacyTokens.tokenType);
+    }
+    if (legacyTokens.userId) {
+        newOAuthConfig.set('userId', legacyTokens.userId);
+    }
+// Leave the legacy file untouched so older CLI versions installed in other
+// projects on the same machine can keep reading their last known state.
+}
+/**
+ * Migrate per-project bootstrap data and project tokens from the legacy
+ * combined store into individual per-project stores.
+ *
+ * Walks legacy `bootstrapData` (keyed by `projectId:environmentName`), writes
+ * each entry into its own project store file, and stashes the matching
+ * `projectToken` (looked up by `bootstrapData.contentSystemId`) alongside it.
+ * Target files that already exist are left alone.
+ */ export function migrateProjectData(params) {
+    const legacyConfig = openLegacyConfig({
+        encryptionKey: params.encryptionKey,
+        legacyConfigName: params.legacyConfigName,
+        legacyCwd: params.legacyCwd,
+        projectName: params.projectName
+    });
+    if (!legacyConfig) {
+        return;
+    }
+    const bootstrapData = safeGet(legacyConfig, 'bootstrapData') || {};
+    const projectTokens = safeGet(legacyConfig, 'projectTokens') || {};
+    if (Object.keys(bootstrapData).length === 0 && Object.keys(projectTokens).length === 0) {
+        return;
+    }
+    for (const [key, bootstrap] of Object.entries(bootstrapData)){
+        const separatorIdx = key.indexOf(':');
+        if (separatorIdx === -1) {
+            continue;
+        }
+        const projectId = key.slice(0, separatorIdx);
+        const environmentName = key.slice(separatorIdx + 1);
+        if (!projectId || !environmentName) {
+            continue;
+        }
+        const { configName, cwd } = params.resolveProjectStorePath({
+            environmentName,
+            projectId
+        });
+        const targetPath = path.join(cwd, `${configName}.json`);
+        if (fsSync.existsSync(targetPath)) {
+            continue;
+        }
+        if (!fsSync.existsSync(cwd)) {
+            fsSync.mkdirSync(cwd, {
+                recursive: true
+            });
+        }
+        const projectConfig = new Conf({
+            configName,
+            cwd,
+            encryptionKey: params.encryptionKey,
+            projectName: params.projectName
+        });
+        projectConfig.set('_schemaVersion', PROJECT_STORE_SCHEMA_VERSION);
+        projectConfig.set('bootstrapData', bootstrap);
+        const legacyProjectToken = bootstrap.contentSystemId ? projectTokens[bootstrap.contentSystemId] : undefined;
+        if (legacyProjectToken) {
+            projectConfig.set('projectToken', legacyProjectToken);
+        }
+    }
+// Leave the legacy file untouched so older CLI versions installed in other
+// projects on the same machine can keep reading their last known state.
+}
+function safeGet(config, key) {
+    try {
+        return config.get(key);
+    } catch (error) {
+        log.warning(`Migration read failed (key: ${String(key)}). ` + `File: ${config.path}. ` + `Error: ${error instanceof Error ? error.message : 'Unknown'}`);
+        return undefined;
+    }
+}
+/**
+ * Open the legacy Conf store without `clearInvalidConfig`, so a decrypt
+ * error does not destroy the file. Returns null when the file cannot be
+ * opened — callers treat that as "nothing to migrate, leave file alone".
+ */ function openLegacyConfig(params) {
+    try {
+        return new Conf({
+            configName: params.legacyConfigName,
+            cwd: params.legacyCwd,
+            encryptionKey: params.encryptionKey,
+            projectName: params.projectName
+        });
+    } catch (error) {
+        log.warning(`Legacy token store could not be opened; skipping migration and leaving file intact. ` + `Error: ${error instanceof Error ? error.message : 'Unknown'}`);
+        return null;
+    }
+}
+
+//# sourceMappingURL=token-store-migration.js.map

package/dist/auth/token-store.d.ts

@@ -1,151 +1,74 @@
 import type { Environment } from '../constants.js';
-import type { BootstrapData, FigmaTokens, JWTPayload, ProjectToken, TokenStoreConfig } from './types.js';
+import type { BootstrapData, FigmaTokens, ProjectStoreScope, ProjectToken, TokenStoreConfig } from './types.js';
 /**
- * Get the singleton TokenStore instance for an environment
- * Use this for all production code to ensure a single shared instance per environment
- *
- * @param environment - The environment to get the token store for
- * @returns The singleton TokenStore instance for that environment
+ * Get the singleton TokenStore instance for an environment.
  */
 export declare function getTokenStore(environment?: Environment): TokenStore;
 /**
- * Secure storage manager for Figma OAuth2 tokens
- *
- * Uses the `conf` library to store tokens in an OS-specific secure location:
- * - macOS: ~/Library/Preferences/payloadcms-figma
- * - Linux: ~/.config/payloadcms-figma or $XDG_CONFIG_HOME/payloadcms-figma
- * - Windows: %APPDATA%/payloadcms-figma/Config
- *
- * Tokens are encrypted at rest with a machine-specific key and file permissions
- * are set to 0600 (owner read/write only)
+ * Secure storage manager for OAuth tokens and project-scoped bootstrap/token data.
  *
  * For production code, use getTokenStore() to get the singleton instance.
  * The constructor is still exported for test isolation.
  */
 export declare class TokenStore {
-    private config;
+    private baseConfigName;
+    private encryptionKey;
     private environment;
+    private legacyRootDir;
+    private oauthConfig;
+    private projectName;
+    private projectStoreConfigs;
     constructor(options?: TokenStoreConfig);
-    private safeGet;
-    /**
-     * Retrieve stored tokens
-     * @returns FigmaTokens if stored, null otherwise
-     */
-    getTokens(): FigmaTokens | null;
-    /**
-     * Store OAuth2 tokens securely
-     * @param tokens - Figma OAuth2 tokens to store
-     */
+    getOauthInfo(): FigmaTokens | null;
     setTokens(tokens: FigmaTokens): void;
-    /**
-     * Clear all stored tokens (used for logout)
-     */
     clearTokens(): void;
-    /**
-     * Check if valid (non-expired) tokens exist
-     * @returns true if tokens exist and are not expired
-     */
-    hasValidTokens(): boolean;
-    /**
-     * Check if the current access token is expired
-     * Includes a buffer time to avoid using tokens that are about to expire
-     * @returns true if token is expired or will expire within buffer time
-     */
-    isExpired(): boolean;
-    /**
-     * Get the access token if it exists and is valid
-     * @returns Access token string or null if expired/missing
-     */
-    getAccessToken(): null | string;
-    /**
-     * Get the refresh token if it exists
-     * @returns Refresh token string or null if missing
-     */
-    getRefreshToken(): null | string;
-    /**
-     * Update just the access token after a refresh
-     * Preserves the existing refresh token and other metadata
-     * @param accessToken - New access token
-     * @param expiresIn - Expiration time in seconds
-     */
+    hasValidOauthToken(): boolean;
+    isOauthExpired(): boolean;
+    getCurrentOauthToken(): null | string;
+    getCurrentRefreshToken(): null | string;
     updateAccessToken(accessToken: string, expiresIn: number): void;
     /**
-     * Get the path to the config file (useful for debugging)
-     * @returns Absolute path to the token storage file
+     * Returns the OAuth storage file path.
      */
     getStoragePath(): string;
-    /**
-     * Retrieve a project token for a specific tenant
-     * Automatically removes expired tokens from storage
-     * @param tenantId - The tenant/CMS ID
-     * @returns ProjectToken if stored and valid, null otherwise
-     */
-    getProjectToken(tenantId: string): null | ProjectToken;
-    /**
-     * Store a project token for a specific tenant
-     * @param tenantId - The tenant/CMS ID
-     * @param projectToken - The project token to store
-     */
-    setProjectToken(tenantId: string, projectToken: ProjectToken): void;
-    /**
-     * Clear a project token for a specific tenant
-     * @param tenantId - The tenant/CMS ID
-     */
-    clearProjectToken(tenantId: string): void;
-    /**
-     * Clear all project tokens
-     */
-    clearAllProjectTokens(): void;
-    /**
-     * Check if a project token is expired
-     * Includes a buffer time to avoid using tokens that are about to expire
-     * @param projectToken - The project token to check
-     * @returns true if token is expired or will expire within buffer time
-     */
-    isProjectTokenExpired(projectToken: ProjectToken): boolean;
-    /**
-     * Check if a valid (non-expired) project token exists for a tenant
-     * @param tenantId - The tenant/CMS ID
-     * @returns true if token exists and is not expired
-     */
-    hasValidProjectToken(tenantId: string): boolean;
-    /**
-     * Get validated JWT claims from a project token
-     * @param tenantId - The tenant/CMS ID
-     * @returns JWT payload claims or null if token not found or has no claims
-     */
-    getProjectTokenClaims(tenantId: string): JWTPayload | null;
-    /**
-     * Get all tenant IDs that have stored project tokens
-     * @returns Array of tenant IDs
-     */
-    getAllProjectTokenTenantIds(): string[];
-    /**
-     * Build the composite key for bootstrap data storage
-     * @param projectId - The CMS resource/project ID
-     * @param environmentName - The environment name (e.g. 'production', 'staging')
-     * @returns Composite key string
-     */
-    private bootstrapKey;
-    /**
-     * Retrieve bootstrap data for a project + environment
-     * @param projectId - The CMS resource/project ID
-     * @param environmentName - The environment name
-     * @returns BootstrapData if stored, null otherwise
-     */
+    getProjectToken({ projectInfo, }?: {
+        projectInfo?: ProjectStoreScope;
+    }): null | ProjectToken;
+    setProjectToken({ projectInfo, token, }: {
+        projectInfo?: ProjectStoreScope;
+        token: ProjectToken;
+    }): void;
+    clearProjectToken({ projectInfo }?: {
+        projectInfo?: ProjectStoreScope;
+    }): void;
+    isProjectTokenExpired(token: ProjectToken): boolean;
+    hasValidProjectToken({ projectInfo }?: {
+        projectInfo?: ProjectStoreScope;
+    }): boolean;
+    /**
+     * Get the tenantId (contentSystemId) for the project scope.
+     * Returns null if bootstrap data is not available.
+     */
+    getTenantId({ projectInfo }?: {
+        projectInfo?: ProjectStoreScope;
+    }): null | string;
+    /**
+     * Derive project info from environment variables.
+     * Returns null if either FIGMA_PROJECT_ID or FIGMA_ENVIRONMENT_NAME is not set.
+     */
+    private getProjectInfoFromEnv;
     getBootstrapData(projectId: string, environmentName: string): BootstrapData | null;
-    /**
-     * Store bootstrap data for a project + environment
-     * @param projectId - The CMS resource/project ID
-     * @param environmentName - The environment name
-     * @param data - The bootstrap data to store
-     */
     setBootstrapData(projectId: string, environmentName: string, data: BootstrapData): void;
-    /**
-     * Clear bootstrap data for a project + environment
-     * @param projectId - The CMS resource/project ID
-     * @param environmentName - The environment name
-     */
     clearBootstrapData(projectId: string, environmentName: string): void;
+    private buildOAuthConfigName;
+    private buildOAuthStoreCwd;
+    private buildProjectStoreConfigName;
+    private buildProjectStoreCwd;
+    private sanitizeConfigSegment;
+    private projectInfoKey;
+    private getLegacyRootDir;
+    private getProjectStore;
+    private createConfig;
+    private safeGet;
 }
 //# sourceMappingURL=token-store.d.ts.map