@payloadcms/figma 0.0.1-alpha.9 → 0.1.0-alpha.1

package/dist/auth/project-token.js

@@ -5,10 +5,11 @@
  * to the Content API. Project tokens are scoped to a specific tenant/CMS
  * and have a shorter lifespan (15-30 minutes) than OAuth tokens.
  */ import { getProjectToken as fetchProjectToken } from '../api/figma-api.js';
-import { getEnvironment } from '../constants.js';
+import { PROJECT_TOKEN_EXPIRY_BUFFER_SECONDS } from '../config/oauth.js';
+import { getInfraEnvironment } from '../constants.js';
 import * as log from '../utils/log.js';
-import { JWTValidationError, validateProjectToken } from './jwt-validator.js';
-import { getValidAccessToken } from './oauth-flow.js';
+import { JWTValidationError, validateContentApiToken } from './jwt-validator.js';
+import { getValidCredential } from './oauth-flow.js';
 /**
  * Error during project token operations
  */ export class ProjectTokenError extends Error {
@@ -18,6 +19,21 @@ import { getValidAccessToken } from './oauth-flow.js';
         this.name = 'ProjectTokenError';
     }
 }
+const projectTokenCache = new Map();
+const inFlightRefreshes = new Map();
+function buildCacheKey(params) {
+    const projectId = params.projectInfo?.projectId ?? '';
+    const environmentName = params.projectInfo?.environmentName ?? '';
+    return `${params.tenantId}::${projectId}::${environmentName}`;
+}
+function isCachedTokenValid(entry) {
+    const bufferMs = PROJECT_TOKEN_EXPIRY_BUFFER_SECONDS * 1000;
+    return Date.now() < entry.expiresAt - bufferMs;
+}
+/** Test-only: clears the in-memory token cache and any in-flight refresh promises. */ export function __resetProjectTokenCacheForTests() {
+    projectTokenCache.clear();
+    inFlightRefreshes.clear();
+}
 /**
  * Parse JWT claims from token without validation
  * Used for mock tokens where signature validation is not needed
@@ -43,89 +59,181 @@ import { getValidAccessToken } from './oauth-flow.js';
     }
 }
 /**
- * Get a valid project token for a tenant, refreshing if necessary
+ * Get a valid project token for a tenant, refreshing if necessary.
  *
- * This function:
- * 1. Checks if a stored project token exists and is valid (not expired)
- * 2. If expired or missing, gets a valid user access token
- * 3. Calls the Figma API to generate a new project token
- * 4. Stores the new project token in encrypted storage
- * 5. Returns the JWT string
+ * Lookup order:
+ * 1. Module-level in-memory cache (no I/O on hits).
+ * 2. In-flight refresh map — concurrent callers with no cached entry share a single
+ *    refresh promise, so the project-token endpoint is only hit once per cache key.
+ * 3. Persisted (`conf`-backed) token store — picks up tokens minted by sibling processes.
+ * 4. Figma API — fetch + JWT validation, then write to both the persisted store and
+ *    the in-memory cache.
  *
  * The project token is used by local Payload instances to authenticate
  * requests to the Content API without requiring a round-trip to Sinatra.
  *
- * @param tokenStore - Token store for persisting tokens
- * @param tenantId - The tenant/CMS ID to get a token for
+ * @param params.tokenStore - Token store for persisting tokens
+ * @param params.tenantId - Optional tenant/CMS ID; resolved from stored bootstrap data when omitted
+ * @param params.projectInfo - Optional project scope (defaults to env vars)
  * @returns Promise resolving to JWT token string or null if failed
  * @throws {ProjectTokenError} If token generation fails
- */ export async function getValidProjectToken(tokenStore, tenantId) {
-    // Check if we have a valid project token already
-    if (tokenStore.hasValidProjectToken(tenantId)) {
-        const projectToken = tokenStore.getProjectToken(tenantId);
-        return projectToken?.token || null;
+ */ export async function getValidProjectToken({ projectInfo, tenantId, tokenStore }) {
+    if (process.env.FIGMA_CONTENT_API_ACCESS_KEY) {
+        log.debug('FIGMA_CONTENT_API_ACCESS_KEY is set; skipping project token retrieval from API');
+        return null;
     }
-    // We need to refresh the project token
-    // First, get a valid user access token (will auto-refresh if needed)
-    let accessToken;
-    try {
-        accessToken = await getValidAccessToken(tokenStore);
-    } catch (error) {
-        throw new ProjectTokenError('Failed to get valid access token for project token refresh', error instanceof Error ? error : undefined);
+    const resolvedTenantId = tenantId ?? tokenStore.getTenantId({
+        projectInfo
+    });
+    if (!resolvedTenantId) {
+        throw new ProjectTokenError('tenantId was not provided and could not be resolved from bootstrap data');
     }
-    if (!accessToken) {
-        // No valid user tokens available - user needs to authenticate
-        return null;
+    const cacheKey = buildCacheKey({
+        projectInfo,
+        tenantId: resolvedTenantId
+    });
+    const cached = projectTokenCache.get(cacheKey);
+    if (cached && isCachedTokenValid(cached)) {
+        return cached.token;
     }
-    // Fetch a new project token from the Figma API
-    const projectToken = await fetchProjectToken(accessToken, tenantId);
-    // Validate the JWT signature and claims (skip for mocks)
-    const shouldMock = process.env.FIGMA_MOCK_PROJECT_TOKEN !== 'false';
-    let validatedClaims;
-    if (shouldMock) {
-        // MOCK: Skip JWT validation and parse claims directly
-        log.debug('Skipping JWT validation for mock project token');
-        validatedClaims = parseJWTClaims(projectToken.token);
-    } else {
-        // REAL: Validate JWT signature against JWKS
+    const inFlight = inFlightRefreshes.get(cacheKey);
+    if (inFlight) {
+        return inFlight;
+    }
+    // The IIFE references this holder so it can check whether it is still the
+    // active refresh before writing back to the caches. Without this guard a
+    // stale in-flight refresh could clobber a fresh token written by a later
+    // refresh (e.g. one triggered by `refreshProjectToken`).
+    const handle = {};
+    handle.promise = (async ()=>{
+        if (tokenStore.hasValidProjectToken({
+            projectInfo
+        })) {
+            const stored = tokenStore.getProjectToken({
+                projectInfo
+            });
+            if (stored?.token && inFlightRefreshes.get(cacheKey) === handle.promise) {
+                projectTokenCache.set(cacheKey, {
+                    expiresAt: stored.expiresAt,
+                    token: stored.token
+                });
+                return stored.token;
+            }
+            if (stored?.token) {
+                return stored.token;
+            }
+            // hasValidProjectToken said yes but getProjectToken returned no token —
+            // store was likely cleared by another process between calls. Fall through
+            // to fetch so the caller still gets a token.
+            log.warning(`Stored project token vanished between hasValidProjectToken and getProjectToken (cacheKey=${cacheKey}); re-fetching`);
+        }
+        let credential;
+        try {
+            credential = await getValidCredential(tokenStore);
+        } catch (error) {
+            throw new ProjectTokenError('Failed to get valid access token for project token refresh', error instanceof Error ? error : undefined);
+        }
+        if (!credential) {
+            return null;
+        }
+        let fetchedToken;
         try {
-            validatedClaims = await validateProjectToken(projectToken.token, getEnvironment());
-        } catch (validationError) {
-            // Handle validation errors
-            if (validationError instanceof JWTValidationError) {
-                throw new ProjectTokenError(`Project token validation failed: ${validationError.message}`, validationError);
+            fetchedToken = await fetchProjectToken(credential, resolvedTenantId);
+        } catch (error) {
+            // Let API errors (e.g. FigmaApiError) propagate raw so callers can
+            // branch on status codes — but log context for debugging.
+            log.debug(`fetchProjectToken failed (cacheKey=${cacheKey}, tenantId=${resolvedTenantId}): ${error instanceof Error ? error.message : 'Unknown error'}`);
+            throw error;
+        }
+        const hasEnvToken = !!process.env.FIGMA_MOCK_PROJECT_TOKEN_VALUE;
+        const shouldMock = process.env.FIGMA_MOCK_PROJECT_TOKEN !== 'false';
+        let validatedClaims;
+        if (hasEnvToken || shouldMock) {
+            log.debug('Skipping JWT validation for mock/env project token');
+            validatedClaims = parseJWTClaims(fetchedToken.token);
+        } else {
+            try {
+                validatedClaims = await validateContentApiToken({
+                    audience: resolvedTenantId,
+                    environment: getInfraEnvironment(),
+                    token: fetchedToken.token
+                });
+            } catch (validationError) {
+                if (validationError instanceof JWTValidationError) {
+                    throw new ProjectTokenError(`Project token validation failed: ${validationError.message}`, validationError);
+                }
+                throw validationError;
             }
-            throw validationError;
+        }
+        if (typeof validatedClaims.exp !== 'number' || !Number.isFinite(validatedClaims.exp)) {
+            throw new ProjectTokenError('Project token missing or invalid expiration (exp) claim');
+        }
+        const expiresAt = validatedClaims.exp * 1000;
+        if (inFlightRefreshes.get(cacheKey) !== handle.promise) {
+            log.debug(`Project token refresh superseded; not persisting (cacheKey=${cacheKey})`);
+            return fetchedToken.token;
+        }
+        try {
+            tokenStore.setProjectToken({
+                projectInfo,
+                token: {
+                    claims: validatedClaims,
+                    expiresAt,
+                    tenantId: resolvedTenantId,
+                    token: fetchedToken.token
+                }
+            });
+        } catch (error) {
+            // Persistence is best-effort: a failure here (disk full, permissions,
+            // corrupt conf entry) shouldn't lose the freshly-minted token. Log and
+            // populate the in-memory cache so this process can still use it.
+            log.error(`Failed to persist project token to store (cacheKey=${cacheKey}): ${error instanceof Error ? error.message : 'Unknown error'}`);
+        }
+        projectTokenCache.set(cacheKey, {
+            expiresAt,
+            token: fetchedToken.token
+        });
+        return fetchedToken.token;
+    })();
+    inFlightRefreshes.set(cacheKey, handle.promise);
+    try {
+        return await handle.promise;
+    } finally{
+        if (inFlightRefreshes.get(cacheKey) === handle.promise) {
+            inFlightRefreshes.delete(cacheKey);
         }
     }
-    // Ensure exp claim is present
-    if (!validatedClaims.exp) {
-        throw new ProjectTokenError('Project token missing expiration (exp) claim');
-    }
-    // Store the project token with validated expiration and claims
-    tokenStore.setProjectToken(tenantId, {
-        claims: validatedClaims,
-        expiresAt: validatedClaims.exp * 1000,
-        tenantId,
-        token: projectToken.token
-    });
-    return projectToken.token;
 }
 /**
- * Refresh a project token for a tenant
+ * Force-refresh a project token, bypassing all cache layers.
  *
- * Forces a refresh of the project token even if the current one is still valid.
- * Useful for testing or when you want to ensure you have the freshest token.
+ * Invalidates the in-memory cache entry, the in-flight refresh promise (so a
+ * concurrently-running refresh that may already be returning a soon-to-be-stale
+ * token is dropped from the dedup map), and the persisted token store. Then
+ * delegates to {@link getValidProjectToken} to mint a fresh token.
  *
- * @param tokenStore - Token store for persisting tokens
- * @param tenantId - The tenant/CMS ID to refresh token for
+ * @param params.tokenStore - Token store for persisting tokens
+ * @param params.tenantId - Optional tenant/CMS ID; resolved from stored bootstrap data when omitted
+ * @param params.projectInfo - Optional project scope (defaults to env vars)
  * @returns Promise resolving to JWT token string or null if failed
  * @throws {ProjectTokenError} If token refresh fails
- */ export async function refreshProjectToken(tokenStore, tenantId) {
-    // Clear the existing project token to force a refresh
-    tokenStore.clearProjectToken(tenantId);
-    // Get a new token (which will fetch from API since we just cleared it)
-    return getValidProjectToken(tokenStore, tenantId);
+ */ export async function refreshProjectToken(params) {
+    const { projectInfo, tenantId, tokenStore } = params;
+    const resolvedTenantId = tenantId ?? tokenStore.getTenantId({
+        projectInfo
+    });
+    if (resolvedTenantId) {
+        const cacheKey = buildCacheKey({
+            projectInfo,
+            tenantId: resolvedTenantId
+        });
+        projectTokenCache.delete(cacheKey);
+        // Drop any in-flight refresh so getValidProjectToken below cannot return
+        // a soon-to-be-stale token via the dedup map.
+        inFlightRefreshes.delete(cacheKey);
+    }
+    tokenStore.clearProjectToken({
+        projectInfo
+    });
+    return getValidProjectToken(params);
 }
-
-//# sourceMappingURL=project-token.js.map

package/dist/auth/refresh.d.ts

@@ -4,7 +4,8 @@ import type { FigmaTokens } from './types.js';
  */
 export declare class TokenRefreshError extends Error {
     statusCode?: number | undefined;
-    constructor(message: string, statusCode?: number | undefined);
+    errorCode?: string | undefined;
+    constructor(message: string, statusCode?: number | undefined, errorCode?: string | undefined);
 }
 /**
  * Refresh an expired OAuth2 access token using a refresh token
@@ -32,4 +33,3 @@ export declare function refreshAccessToken(refreshToken: string, clientId?: stri
  * @throws TokenRefreshError if exchange fails
  */
 export declare function exchangeCodeForTokens(code: string, codeVerifier: string, redirectUri?: string, clientId?: string): Promise<FigmaTokens>;
-//# sourceMappingURL=refresh.d.ts.map

package/dist/auth/refresh.js

@@ -1,11 +1,12 @@
-/* eslint-disable perfectionist/sort-objects */ import { OAUTH_CONFIG } from '../config/oauth.js';
+/* eslint-disable perfectionist/sort-objects */ import { getOAuthConfig } from '../config/oauth.js';
 import * as log from '../utils/log.js';
 /**
  * Error thrown when token refresh fails
  */ export class TokenRefreshError extends Error {
     statusCode;
-    constructor(message, statusCode){
-        super(message), this.statusCode = statusCode;
+    errorCode;
+    constructor(message, statusCode, errorCode){
+        super(message), this.statusCode = statusCode, this.errorCode = errorCode;
         this.name = 'TokenRefreshError';
     }
 }
@@ -19,15 +20,17 @@ import * as log from '../utils/log.js';
  * @param clientId - OAuth2 client ID (defaults to config)
  * @returns Promise resolving to new tokens
  * @throws TokenRefreshError if refresh fails
- */ export async function refreshAccessToken(refreshToken, clientId = OAUTH_CONFIG.clientId) {
+ */ export async function refreshAccessToken(refreshToken, clientId) {
+    const oauthConfig = getOAuthConfig();
+    const resolvedClientId = clientId ?? oauthConfig.clientId;
     // Prepare form data for token refresh request (public client)
     const params = new URLSearchParams({
-        client_id: clientId,
+        client_id: resolvedClientId,
         grant_type: 'refresh_token',
         refresh_token: refreshToken
     });
     try {
-        const response = await fetch(OAUTH_CONFIG.refreshUrl, {
+        const response = await fetch(oauthConfig.refreshUrl, {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/x-www-form-urlencoded'
@@ -36,7 +39,14 @@ import * as log from '../utils/log.js';
         });
         if (!response.ok) {
             const errorText = await response.text();
-            throw new TokenRefreshError(`Token refresh failed: ${response.statusText}. ${errorText}`, response.status);
+            let errorCode;
+            try {
+                const parsed = JSON.parse(errorText);
+                errorCode = parsed.error;
+            } catch  {
+            // Not JSON, leave errorCode undefined
+            }
+            throw new TokenRefreshError(`Token refresh failed: ${response.statusText}. ${errorText}`, response.status, errorCode);
         }
         const data = await response.json();
         // Validate response contains required fields
@@ -71,14 +81,17 @@ import * as log from '../utils/log.js';
  * @param clientId - OAuth2 client ID (defaults to config)
  * @returns Promise resolving to tokens
  * @throws TokenRefreshError if exchange fails
- */ export async function exchangeCodeForTokens(code, codeVerifier, redirectUri = OAUTH_CONFIG.redirectUri, clientId = OAUTH_CONFIG.clientId) {
+ */ export async function exchangeCodeForTokens(code, codeVerifier, redirectUri, clientId) {
+    const oauthConfig = getOAuthConfig();
+    const resolvedRedirectUri = redirectUri ?? oauthConfig.redirectUri;
+    const resolvedClientId = clientId ?? oauthConfig.clientId;
     // Prepare form data for token exchange (public client with PKCE)
     const params = new URLSearchParams({
-        client_id: clientId,
+        client_id: resolvedClientId,
         code,
         code_verifier: codeVerifier,
         grant_type: 'authorization_code',
-        redirect_uri: redirectUri
+        redirect_uri: resolvedRedirectUri
     });
     try {
         // Public client - no client secret or Basic Auth header needed
@@ -88,11 +101,11 @@ import * as log from '../utils/log.js';
         };
         // Debug logging
         log.debug(`Token exchange request: ${JSON.stringify({
-            url: OAUTH_CONFIG.tokenUrl,
+            url: oauthConfig.tokenUrl,
             headers,
             body: params.toString()
         })}`);
-        const response = await fetch(OAUTH_CONFIG.tokenUrl, {
+        const response = await fetch(oauthConfig.tokenUrl, {
             method: 'POST',
             headers,
             body: params.toString()
@@ -136,5 +149,3 @@ import * as log from '../utils/log.js';
         throw new TokenRefreshError(`Failed to exchange code for tokens: ${error instanceof Error ? error.message : 'Unknown error'}`);
     }
 }
-
-//# sourceMappingURL=refresh.js.map

package/dist/auth/token-store-migration.d.ts

@@ -0,0 +1,57 @@
+import type { BootstrapData, FigmaTokens, ProjectToken } from './types.js';
+export type LegacyStoreSchema = {
+    bootstrapData?: Record<string, BootstrapData>;
+    projectTokens?: Record<string, ProjectToken>;
+    tokens?: FigmaTokens;
+};
+export type MigrationCheckParams = {
+    checkFileExists?: (filePath: string) => boolean;
+    legacyFilePath: string;
+    newOAuthFilePath: string;
+};
+export type MigrateOAuthParams = {
+    encryptionKey: string;
+    legacyConfigName: string;
+    legacyCwd?: string;
+    newOAuthConfigName: string;
+    newOAuthCwd: string;
+    projectName: string;
+};
+/**
+ * Check if migration is needed.
+ * Returns true only when legacy file exists AND new oauth file does not.
+ */
+export declare function needsMigration(params: MigrationCheckParams): boolean;
+/**
+ * Migrate OAuth tokens from legacy store to new oauth store.
+ * Reads from legacy location, writes to new location with root-level keys.
+ *
+ * `clearInvalidConfig` is deliberately OFF so a transient decrypt error does
+ * not wipe the legacy file — older CLI versions elsewhere on disk still read
+ * it. If we cannot open the file, we log and skip migration.
+ */
+export declare function migrateOAuth(params: MigrateOAuthParams): void;
+export type ResolveProjectStorePath = (scope: {
+    environmentName: string;
+    projectId: string;
+}) => {
+    configName: string;
+    cwd: string;
+};
+export type MigrateProjectDataParams = {
+    encryptionKey: string;
+    legacyConfigName: string;
+    legacyCwd?: string;
+    projectName: string;
+    resolveProjectStorePath: ResolveProjectStorePath;
+};
+/**
+ * Migrate per-project bootstrap data and project tokens from the legacy
+ * combined store into individual per-project stores.
+ *
+ * Walks legacy `bootstrapData` (keyed by `projectId:environmentName`), writes
+ * each entry into its own project store file, and stashes the matching
+ * `projectToken` (looked up by `bootstrapData.contentSystemId`) alongside it.
+ * Target files that already exist are left alone.
+ */
+export declare function migrateProjectData(params: MigrateProjectDataParams): void;

package/dist/auth/token-store-migration.js

@@ -0,0 +1,154 @@
+import Conf from 'conf';
+import fsSync from 'node:fs';
+import path from 'node:path';
+import * as log from '../utils/log.js';
+const OAUTH_STORE_SCHEMA_VERSION = 1;
+const PROJECT_STORE_SCHEMA_VERSION = 1;
+/**
+ * Check if migration is needed.
+ * Returns true only when legacy file exists AND new oauth file does not.
+ */ export function needsMigration(params) {
+    const checkExists = params.checkFileExists ?? fsSync.existsSync;
+    const newExists = checkExists(params.newOAuthFilePath);
+    if (newExists) {
+        return false;
+    }
+    return checkExists(params.legacyFilePath);
+}
+/**
+ * Migrate OAuth tokens from legacy store to new oauth store.
+ * Reads from legacy location, writes to new location with root-level keys.
+ *
+ * `clearInvalidConfig` is deliberately OFF so a transient decrypt error does
+ * not wipe the legacy file — older CLI versions elsewhere on disk still read
+ * it. If we cannot open the file, we log and skip migration.
+ */ export function migrateOAuth(params) {
+    const legacyConfig = openLegacyConfig({
+        encryptionKey: params.encryptionKey,
+        legacyConfigName: params.legacyConfigName,
+        legacyCwd: params.legacyCwd,
+        projectName: params.projectName
+    });
+    if (!legacyConfig) {
+        return;
+    }
+    const legacyTokens = safeGet(legacyConfig, 'tokens');
+    if (!legacyTokens) {
+        return;
+    }
+    // Ensure target directory exists
+    if (!fsSync.existsSync(params.newOAuthCwd)) {
+        fsSync.mkdirSync(params.newOAuthCwd, {
+            recursive: true
+        });
+    }
+    const newOAuthConfig = new Conf({
+        configName: params.newOAuthConfigName,
+        cwd: params.newOAuthCwd,
+        encryptionKey: params.encryptionKey,
+        projectName: params.projectName
+    });
+    // Write root-level keys
+    newOAuthConfig.set('_schemaVersion', OAUTH_STORE_SCHEMA_VERSION);
+    newOAuthConfig.set('accessToken', legacyTokens.accessToken);
+    newOAuthConfig.set('expiresAt', legacyTokens.expiresAt);
+    newOAuthConfig.set('refreshToken', legacyTokens.refreshToken);
+    if (legacyTokens.scopes) {
+        newOAuthConfig.set('scopes', legacyTokens.scopes);
+    }
+    if (legacyTokens.tokenType) {
+        newOAuthConfig.set('tokenType', legacyTokens.tokenType);
+    }
+    if (legacyTokens.userId) {
+        newOAuthConfig.set('userId', legacyTokens.userId);
+    }
+// Leave the legacy file untouched so older CLI versions installed in other
+// projects on the same machine can keep reading their last known state.
+}
+/**
+ * Migrate per-project bootstrap data and project tokens from the legacy
+ * combined store into individual per-project stores.
+ *
+ * Walks legacy `bootstrapData` (keyed by `projectId:environmentName`), writes
+ * each entry into its own project store file, and stashes the matching
+ * `projectToken` (looked up by `bootstrapData.contentSystemId`) alongside it.
+ * Target files that already exist are left alone.
+ */ export function migrateProjectData(params) {
+    const legacyConfig = openLegacyConfig({
+        encryptionKey: params.encryptionKey,
+        legacyConfigName: params.legacyConfigName,
+        legacyCwd: params.legacyCwd,
+        projectName: params.projectName
+    });
+    if (!legacyConfig) {
+        return;
+    }
+    const bootstrapData = safeGet(legacyConfig, 'bootstrapData') || {};
+    const projectTokens = safeGet(legacyConfig, 'projectTokens') || {};
+    if (Object.keys(bootstrapData).length === 0 && Object.keys(projectTokens).length === 0) {
+        return;
+    }
+    for (const [key, bootstrap] of Object.entries(bootstrapData)){
+        const separatorIdx = key.indexOf(':');
+        if (separatorIdx === -1) {
+            continue;
+        }
+        const projectId = key.slice(0, separatorIdx);
+        const environmentName = key.slice(separatorIdx + 1);
+        if (!projectId || !environmentName) {
+            continue;
+        }
+        const { configName, cwd } = params.resolveProjectStorePath({
+            environmentName,
+            projectId
+        });
+        const targetPath = path.join(cwd, `${configName}.json`);
+        if (fsSync.existsSync(targetPath)) {
+            continue;
+        }
+        if (!fsSync.existsSync(cwd)) {
+            fsSync.mkdirSync(cwd, {
+                recursive: true
+            });
+        }
+        const projectConfig = new Conf({
+            configName,
+            cwd,
+            encryptionKey: params.encryptionKey,
+            projectName: params.projectName
+        });
+        projectConfig.set('_schemaVersion', PROJECT_STORE_SCHEMA_VERSION);
+        projectConfig.set('bootstrapData', bootstrap);
+        const legacyProjectToken = bootstrap.contentSystemId ? projectTokens[bootstrap.contentSystemId] : undefined;
+        if (legacyProjectToken) {
+            projectConfig.set('projectToken', legacyProjectToken);
+        }
+    }
+// Leave the legacy file untouched so older CLI versions installed in other
+// projects on the same machine can keep reading their last known state.
+}
+function safeGet(config, key) {
+    try {
+        return config.get(key);
+    } catch (error) {
+        log.debug(`Migration read failed (key: ${String(key)}). ` + `File: ${config.path}. ` + `Error: ${error instanceof Error ? error.message : 'Unknown'}`);
+        return undefined;
+    }
+}
+/**
+ * Open the legacy Conf store without `clearInvalidConfig`, so a decrypt
+ * error does not destroy the file. Returns null when the file cannot be
+ * opened — callers treat that as "nothing to migrate, leave file alone".
+ */ function openLegacyConfig(params) {
+    try {
+        return new Conf({
+            configName: params.legacyConfigName,
+            cwd: params.legacyCwd,
+            encryptionKey: params.encryptionKey,
+            projectName: params.projectName
+        });
+    } catch (error) {
+        log.debug(`Legacy token store could not be opened; skipping migration and leaving file intact. ` + `Error: ${error instanceof Error ? error.message : 'Unknown'}`);
+        return null;
+    }
+}