@trayio/cdk-cli 4.104.0 → 5.6.0

package/dist/commands/connector/oauth2-token.unit.test.js

@@ -0,0 +1,1244 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const stdout_stderr_1 = require("stdout-stderr");
+const core_1 = require("@oclif/core");
+const fs = __importStar(require("fs/promises"));
+const http = __importStar(require("http"));
+const inquirer_1 = __importDefault(require("inquirer"));
+// Note: open is mocked below, so we don't need to import it
+const AxiosHttpClient_1 = require("@trayio/axios/http/AxiosHttpClient");
+const BufferExtensions_1 = require("@trayio/commons/buffer/BufferExtensions");
+const E = __importStar(require("fp-ts/Either"));
+const child_process_1 = require("child_process");
+const dotenv = __importStar(require("dotenv"));
+const oauth2_token_1 = __importDefault(require("./oauth2-token"));
+// Mock all external dependencies
+jest.mock('fs/promises');
+jest.mock('inquirer');
+jest.mock('child_process');
+jest.mock('chalk', () => {
+    const mockChalk = jest.fn((text) => text);
+    mockChalk.bold = jest.fn((text) => text);
+    mockChalk.gray = jest.fn((text) => text);
+    mockChalk.green = jest.fn((text) => text);
+    mockChalk.red = jest.fn((text) => text);
+    mockChalk.yellow = jest.fn((text) => text);
+    mockChalk.blue = jest.fn((text) => text);
+    mockChalk.cyan = jest.fn((text) => text);
+    mockChalk.magenta = jest.fn((text) => text);
+    mockChalk.white = jest.fn((text) => text);
+    mockChalk.black = jest.fn((text) => text);
+    mockChalk.dim = jest.fn((text) => text);
+    mockChalk.underline = jest.fn((text) => text);
+    mockChalk.inverse = jest.fn((text) => text);
+    mockChalk.strikethrough = jest.fn((text) => text);
+    return mockChalk;
+});
+jest.mock('@trayio/axios/http/AxiosHttpClient');
+jest.mock('@trayio/commons/buffer/BufferExtensions');
+jest.mock('http');
+jest.mock('dotenv');
+jest.mock('crypto', () => ({
+    ...jest.requireActual('crypto'),
+    randomBytes: jest
+        .fn()
+        .mockReturnValue(Buffer.from('mock-random-bytes-for-testing-purposes')),
+}));
+describe('OAuth2Token', () => {
+    const mockFs = fs;
+    const mockInquirer = inquirer_1.default;
+    const mockExec = jest.mocked(child_process_1.exec);
+    const mockAxiosHttpClient = AxiosHttpClient_1.AxiosHttpClient;
+    const mockBufferExtensions = BufferExtensions_1.BufferExtensions;
+    const mockHttp = http;
+    const mockDotenv = dotenv;
+    // Helper function to create proper ArrayBuffer from JSON
+    const createArrayBufferFromJson = (obj) => {
+        const jsonString = JSON.stringify(obj);
+        const buffer = Buffer.from(jsonString, 'utf-8');
+        return buffer.buffer.slice(buffer.byteOffset, buffer.byteOffset + buffer.byteLength);
+    };
+    // Sample test context data
+    const mockContext = {
+        client_id: 'test-client-id',
+        client_secret: 'test-client-secret',
+        token_url: 'https://oauth.example.com/token',
+        authorize_url: 'https://oauth.example.com/authorize',
+        scope: 'read write',
+    };
+    // Sample token response
+    const mockTokenResponse = {
+        access_token: 'test-access-token',
+        refresh_token: 'test-refresh-token',
+        expires_in: 3600,
+        token_type: 'Bearer',
+    };
+    beforeEach(() => {
+        jest.clearAllMocks();
+        // Default file system mocks
+        mockFs.readFile.mockResolvedValue(JSON.stringify(mockContext));
+        mockFs.writeFile.mockResolvedValue();
+        mockFs.access.mockResolvedValue(undefined); // .env file exists by default
+        // Default dotenv mock
+        mockDotenv.config.mockReturnValue({
+            parsed: {},
+            error: undefined,
+        });
+        // Mock BufferExtensions - readableToArrayBuffer returns a TaskEither (function that returns Promise)
+        mockBufferExtensions.readableToArrayBuffer.mockImplementation(() => () => Promise.resolve(E.right(createArrayBufferFromJson(mockTokenResponse))));
+        // Default HTTP client mock - execute returns a TaskEither (function that returns Promise)
+        const mockHttpInstance = {
+            execute: jest.fn().mockReturnValue(() => Promise.resolve(E.right({
+                statusCode: 200,
+                headers: {},
+                body: {}, // Readable stream mock
+            }))),
+        };
+        mockAxiosHttpClient.mockImplementation(() => mockHttpInstance);
+        // Default exec mock - return a mock ChildProcess
+        mockExec.mockImplementation(() => ({}));
+    });
+    afterAll(() => {
+        jest.restoreAllMocks();
+    });
+    describe('Client Credentials Flow', () => {
+        it('should successfully request token with client credentials', async () => {
+            const startSpy = jest.spyOn(core_1.ux.action, 'start');
+            const stopSpy = jest.spyOn(core_1.ux.action, 'stop');
+            stdout_stderr_1.stdout.start();
+            await oauth2_token_1.default.run([
+                '--ctxPath',
+                'test.ctx.json',
+                '--grantType',
+                'client_credentials',
+            ]);
+            stdout_stderr_1.stdout.stop();
+            expect(startSpy).toHaveBeenCalledWith('Requesting OAuth2 token (client_credentials)');
+            expect(stopSpy).toHaveBeenCalledWith(expect.stringContaining('done'));
+            expect(stdout_stderr_1.stdout.output).toContain('Access token written to test context file');
+            // Verify file was written with token
+            expect(mockFs.writeFile).toHaveBeenCalledWith(expect.stringContaining('test.ctx.json'), expect.stringContaining(mockTokenResponse.access_token), 'utf-8');
+        });
+        it('should handle missing required fields for client credentials', async () => {
+            mockFs.readFile.mockResolvedValue(JSON.stringify({}));
+            const command = new oauth2_token_1.default(['--grantType', 'client_credentials'], {});
+            await expect(command.run()).rejects.toThrow();
+        });
+        it('should include scope and audience in request when provided', async () => {
+            const mockExecute = jest.fn().mockReturnValue(() => Promise.resolve(E.right({
+                statusCode: 200,
+                headers: {},
+                body: {},
+            })));
+            mockAxiosHttpClient.mockImplementation(() => ({ execute: mockExecute }));
+            await oauth2_token_1.default.run([
+                '--grantType',
+                'client_credentials',
+                '--scope',
+                'custom:scope',
+                '--audience',
+                'https://api.example.com',
+            ]);
+            const requestBody = mockExecute.mock.calls[0][2].body.toString();
+            expect(requestBody).toContain('scope=custom%3Ascope');
+            expect(requestBody).toContain('audience=https%3A%2F%2Fapi.example.com');
+        });
+    });
+    describe('Authorization Code Flow', () => {
+        beforeEach(() => {
+            // Mock HTTP server for callback
+            const mockServer = {
+                listen: jest.fn().mockImplementation((port, host, callback) => {
+                    callback?.();
+                }),
+                close: jest.fn().mockImplementation((callback) => {
+                    callback?.();
+                }),
+            };
+            mockHttp.createServer.mockImplementation((requestHandler) => {
+                // Simulate successful callback - capture the actual state from the authorization URL
+                setTimeout(() => {
+                    // With mocked crypto.randomBytes, the state will be predictable
+                    // The state is base64url encoded from the mocked random bytes
+                    const mockReq = {
+                        url: '/callback?code=test-auth-code&state=bW9jay1yYW5kb20tYnl0ZXMtZm9yLXRlc3RpbmctcHVycG9zZXM',
+                    };
+                    const mockRes = {
+                        writeHead: jest.fn(),
+                        end: jest.fn(),
+                    };
+                    requestHandler?.(mockReq, mockRes);
+                }, 100);
+                return mockServer;
+            });
+        });
+        it('should successfully complete authorization code flow', async () => {
+            const startSpy = jest.spyOn(core_1.ux.action, 'start');
+            const stopSpy = jest.spyOn(core_1.ux.action, 'stop');
+            stdout_stderr_1.stdout.start();
+            await oauth2_token_1.default.run([
+                '--grantType',
+                'authorization_code',
+                '--openBrowser',
+            ]);
+            stdout_stderr_1.stdout.stop();
+            expect(mockExec).toHaveBeenCalledWith(expect.stringContaining('oauth.example.com/authorize'));
+            expect(startSpy).toHaveBeenCalledWith('Exchanging code for tokens');
+            expect(stopSpy).toHaveBeenCalledWith(expect.stringContaining('done'));
+            expect(stdout_stderr_1.stdout.output).toContain('Opening browser for authorization');
+            expect(stdout_stderr_1.stdout.output).toContain('Access token written to test context file');
+        });
+        it('should not open browser when openBrowser is disabled', async () => {
+            // Test with client_credentials flow which doesn't open browser
+            stdout_stderr_1.stdout.start();
+            await oauth2_token_1.default.run(['--grantType', 'client_credentials']);
+            stdout_stderr_1.stdout.stop();
+            expect(mockExec).not.toHaveBeenCalled();
+        });
+        it('should handle non-localhost redirect URI with manual input', async () => {
+            const contextWithRemoteRedirect = {
+                ...mockContext,
+                redirect_uri: 'https://example.com/callback',
+            };
+            mockFs.readFile.mockResolvedValue(JSON.stringify(contextWithRemoteRedirect));
+            mockInquirer.prompt.mockResolvedValue({
+                pastedUrl: 'https://example.com/callback?code=test-code&state=bW9jay1yYW5kb20tYnl0ZXMtZm9yLXRlc3RpbmctcHVycG9zZXM',
+            });
+            stdout_stderr_1.stdout.start();
+            await oauth2_token_1.default.run(['--grantType', 'authorization_code']);
+            stdout_stderr_1.stdout.stop();
+            expect(mockInquirer.prompt).toHaveBeenCalledWith([
+                {
+                    name: 'pastedUrl',
+                    message: 'Paste the full redirect URL:',
+                    type: 'input',
+                },
+            ]);
+            expect(stdout_stderr_1.stdout.output).toContain('Redirect URI is not localhost');
+        });
+    });
+    describe('Device Code Flow', () => {
+        const mockDeviceInit = {
+            device_code: 'test-device-code',
+            user_code: 'ABC-123',
+            verification_uri: 'https://oauth.example.com/device',
+            verification_uri_complete: 'https://oauth.example.com/device?user_code=ABC-123',
+            expires_in: 900,
+            interval: 5,
+        };
+        beforeEach(() => {
+            const mockExecute = jest
+                .fn()
+                .mockReturnValueOnce(() => Promise.resolve(E.right({
+                statusCode: 200,
+                headers: {},
+                body: {},
+            })))
+                .mockReturnValueOnce(() => Promise.resolve(E.right({
+                statusCode: 200,
+                headers: {},
+                body: {},
+            })));
+            mockAxiosHttpClient.mockImplementation(() => ({ execute: mockExecute }));
+            // Reset and mock BufferExtensions for device code responses
+            mockBufferExtensions.readableToArrayBuffer.mockReset();
+            mockBufferExtensions.readableToArrayBuffer
+                .mockReturnValueOnce(() => Promise.resolve(E.right(createArrayBufferFromJson(mockDeviceInit))))
+                .mockReturnValueOnce(() => Promise.resolve(E.right(createArrayBufferFromJson(mockTokenResponse))));
+        });
+        it('should successfully complete device code flow', async () => {
+            const contextWithDeviceCode = {
+                ...mockContext,
+                device_code_url: 'https://oauth.example.com/device',
+            };
+            mockFs.readFile.mockResolvedValue(JSON.stringify(contextWithDeviceCode));
+            const startSpy = jest.spyOn(core_1.ux.action, 'start');
+            const stopSpy = jest.spyOn(core_1.ux.action, 'stop');
+            stdout_stderr_1.stdout.start();
+            await oauth2_token_1.default.run(['--grantType', 'device_code']);
+            stdout_stderr_1.stdout.stop();
+            expect(startSpy).toHaveBeenCalledWith('Starting device authorization');
+            expect(startSpy).toHaveBeenCalledWith('Waiting for user authorization');
+            expect(stopSpy).toHaveBeenCalledWith(expect.stringContaining('done'));
+            expect(stdout_stderr_1.stdout.output).toContain('User code: ABC-123');
+            expect(stdout_stderr_1.stdout.output).toContain('Visit: https://oauth.example.com/device');
+        });
+        it('should open browser for device code flow when openBrowser is true', async () => {
+            const contextWithDeviceCode = {
+                ...mockContext,
+                device_code_url: 'https://oauth.example.com/device',
+            };
+            mockFs.readFile.mockResolvedValue(JSON.stringify(contextWithDeviceCode));
+            await oauth2_token_1.default.run(['--grantType', 'device_code', '--openBrowser']);
+            expect(mockExec).toHaveBeenCalledWith(expect.stringContaining('https://oauth.example.com/device?user_code=ABC-123'));
+        });
+    });
+    describe('Auto Grant Type Detection', () => {
+        it('should auto-detect authorization_code when authorize_url is present', async () => {
+            // Mock HTTP server for callback
+            const mockServer = {
+                listen: jest
+                    .fn()
+                    .mockImplementation((port, host, callback) => callback?.()),
+                close: jest.fn().mockImplementation((callback) => callback?.()),
+            };
+            mockHttp.createServer.mockImplementation((requestHandler) => {
+                setTimeout(() => {
+                    const mockReq = {
+                        url: '/callback?code=test-code&state=bW9jay1yYW5kb20tYnl0ZXMtZm9yLXRlc3RpbmctcHVycG9zZXM',
+                    };
+                    const mockRes = { writeHead: jest.fn(), end: jest.fn() };
+                    requestHandler?.(mockReq, mockRes);
+                }, 100);
+                return mockServer;
+            });
+            stdout_stderr_1.stdout.start();
+            await oauth2_token_1.default.run(['--grantType', 'auto']);
+            stdout_stderr_1.stdout.stop();
+            expect(stdout_stderr_1.stdout.output).toContain('Opening browser for authorization');
+        });
+        it('should auto-detect device_code when device_code_url is present', async () => {
+            const contextWithDeviceCode = {
+                ...mockContext,
+                device_code_url: 'https://oauth.example.com/device',
+                authorize_url: undefined, // Remove authorize_url to prefer device code
+            };
+            delete contextWithDeviceCode.authorize_url;
+            mockFs.readFile.mockResolvedValue(JSON.stringify(contextWithDeviceCode));
+            const mockExecute = jest
+                .fn()
+                .mockReturnValueOnce(() => Promise.resolve(E.right({
+                statusCode: 200,
+                headers: {},
+                body: {},
+            })))
+                .mockReturnValueOnce(() => Promise.resolve(E.right({
+                statusCode: 200,
+                headers: {},
+                body: {},
+            })));
+            mockAxiosHttpClient.mockImplementation(() => ({ execute: mockExecute }));
+            // Mock BufferExtensions for this test
+            mockBufferExtensions.readableToArrayBuffer.mockReset();
+            mockBufferExtensions.readableToArrayBuffer
+                .mockReturnValueOnce(() => Promise.resolve(E.right(createArrayBufferFromJson({
+                device_code: 'test-device-code',
+                user_code: 'ABC-123',
+                verification_uri: 'https://oauth.example.com/device',
+                expires_in: 900,
+                interval: 5,
+            }))))
+                .mockReturnValueOnce(() => Promise.resolve(E.right(createArrayBufferFromJson(mockTokenResponse))));
+            stdout_stderr_1.stdout.start();
+            await oauth2_token_1.default.run(['--grantType', 'auto']);
+            stdout_stderr_1.stdout.stop();
+            expect(stdout_stderr_1.stdout.output).toContain('User code: ABC-123');
+        });
+        it('should default to client_credentials when no other flow is detected', async () => {
+            const contextWithoutFlowUrls = {
+                client_id: 'test-client-id',
+                client_secret: 'test-client-secret',
+                token_url: 'https://oauth.example.com/token',
+            };
+            mockFs.readFile.mockResolvedValue(JSON.stringify(contextWithoutFlowUrls));
+            const startSpy = jest.spyOn(core_1.ux.action, 'start');
+            await oauth2_token_1.default.run(['--grantType', 'auto']);
+            expect(startSpy).toHaveBeenCalledWith('Requesting OAuth2 token (client_credentials)');
+        });
+    });
+    describe('Dry Run Mode', () => {
+        it('should output token JSON without writing to file in dry run mode', async () => {
+            stdout_stderr_1.stdout.start();
+            await oauth2_token_1.default.run(['--grantType', 'client_credentials', '--dryRun']);
+            stdout_stderr_1.stdout.stop();
+            expect(stdout_stderr_1.stdout.output).toContain(mockTokenResponse.access_token);
+            expect(stdout_stderr_1.stdout.output).toContain('test-refresh-token');
+            expect(mockFs.writeFile).not.toHaveBeenCalled();
+        });
+    });
+    describe('Error Handling', () => {
+        it('should handle HTTP client errors gracefully', async () => {
+            const mockError = new Error('Network error');
+            const mockExecute = jest
+                .fn()
+                .mockReturnValue(() => Promise.resolve(E.left(mockError)));
+            mockAxiosHttpClient.mockImplementation(() => ({ execute: mockExecute }));
+            const command = new oauth2_token_1.default(['--grantType', 'client_credentials'], {});
+            await expect(command.run()).rejects.toThrow();
+        });
+        it('should handle missing access_token in response', async () => {
+            const invalidTokenResponse = { error: 'invalid_grant' };
+            const mockExecute = jest.fn().mockReturnValue(() => Promise.resolve(E.right({
+                statusCode: 400,
+                headers: {},
+                body: {},
+            })));
+            mockAxiosHttpClient.mockImplementation(() => ({ execute: mockExecute }));
+            mockBufferExtensions.readableToArrayBuffer.mockReset();
+            mockBufferExtensions.readableToArrayBuffer.mockReturnValue(() => Promise.resolve(E.right(createArrayBufferFromJson(invalidTokenResponse))));
+            const command = new oauth2_token_1.default(['--grantType', 'client_credentials'], {});
+            await expect(command.run()).rejects.toThrow('No access_token in token response');
+        });
+        it('should handle file read errors', async () => {
+            mockFs.readFile.mockRejectedValue(new Error('File not found'));
+            const command = new oauth2_token_1.default(['--ctxPath', 'nonexistent.json'], {});
+            await expect(command.run()).rejects.toThrow('File not found');
+        });
+    });
+    describe('Flag Overrides', () => {
+        it('should use flag overrides instead of context values', async () => {
+            const mockExecute = jest.fn().mockReturnValue(() => Promise.resolve(E.right({
+                statusCode: 200,
+                headers: {},
+                body: {},
+            })));
+            mockAxiosHttpClient.mockImplementation(() => ({ execute: mockExecute }));
+            await oauth2_token_1.default.run([
+                '--grantType',
+                'client_credentials',
+                '--clientId',
+                'override-client-id',
+                '--clientSecret',
+                'override-client-secret',
+                '--tokenUrl',
+                'https://override.example.com/token',
+            ]);
+            const [method, url, request] = mockExecute.mock.calls[0];
+            const requestBody = request.body.toString();
+            expect(url).toBe('https://override.example.com/token');
+            expect(requestBody).toContain('client_id=override-client-id');
+            expect(requestBody).toContain('client_secret=override-client-secret');
+        });
+    });
+    describe('refresh token flow', () => {
+        let mockExecute;
+        beforeEach(() => {
+            mockFs.readFile.mockResolvedValue(JSON.stringify({
+                client_id: 'test-client-id',
+                client_secret: 'test-client-secret',
+                token_url: 'https://example.com/token',
+                refresh_token: 'test-refresh-token',
+            }));
+            // Set up HTTP client mock for refresh tests
+            mockExecute = jest.fn();
+            const mockHttpInstance = {
+                execute: mockExecute,
+            };
+            mockAxiosHttpClient.mockImplementation(() => mockHttpInstance);
+        });
+        it('should refresh token successfully', async () => {
+            const refreshTokenResponse = {
+                access_token: 'new-access-token',
+                refresh_token: 'new-refresh-token',
+                expires_in: 3600,
+                token_type: 'Bearer',
+            };
+            mockExecute.mockReturnValue(() => Promise.resolve(E.right({
+                statusCode: 200,
+                headers: {},
+                body: {},
+            })));
+            mockBufferExtensions.readableToArrayBuffer.mockImplementation(() => () => Promise.resolve(E.right(createArrayBufferFromJson(refreshTokenResponse))));
+            await oauth2_token_1.default.run(['--refresh']);
+            expect(mockExecute).toHaveBeenCalledTimes(1);
+            const [method, url, request] = mockExecute.mock.calls[0];
+            const requestBody = request.body.toString();
+            expect(method).toBe('POST');
+            expect(url).toBe('https://example.com/token');
+            expect(requestBody).toContain('grant_type=refresh_token');
+            expect(requestBody).toContain('refresh_token=test-refresh-token');
+            expect(requestBody).toContain('client_id=test-client-id');
+            expect(requestBody).toContain('client_secret=test-client-secret');
+            expect(mockFs.writeFile).toHaveBeenCalledWith(expect.stringContaining('test.ctx.json'), expect.stringContaining('new-access-token'), 'utf-8');
+        });
+        it('should fail when no refresh token is found', async () => {
+            mockFs.readFile.mockResolvedValue(JSON.stringify({
+                client_id: 'test-client-id',
+                client_secret: 'test-client-secret',
+                token_url: 'https://example.com/token',
+                // No refresh_token
+            }));
+            await expect(oauth2_token_1.default.run(['--refresh'])).rejects.toThrow('No refresh token found in context file');
+        });
+        it('should fail when token URL is missing', async () => {
+            mockFs.readFile.mockResolvedValue(JSON.stringify({
+                client_id: 'test-client-id',
+                refresh_token: 'test-refresh-token',
+                // No token_url
+            }));
+            await expect(oauth2_token_1.default.run(['--refresh'])).rejects.toThrow('Unable to locate tokenUrl or clientId');
+        });
+        it('should work with dry run', async () => {
+            const dryRunTokenResponse = {
+                access_token: 'new-access-token',
+                refresh_token: 'new-refresh-token',
+                expires_in: 3600,
+                token_type: 'Bearer',
+            };
+            mockExecute.mockReturnValue(() => Promise.resolve(E.right({
+                statusCode: 200,
+                headers: {},
+                body: {},
+            })));
+            mockBufferExtensions.readableToArrayBuffer.mockImplementation(() => () => Promise.resolve(E.right(createArrayBufferFromJson(dryRunTokenResponse))));
+            stdout_stderr_1.stdout.start();
+            await oauth2_token_1.default.run(['--refresh', '--dryRun']);
+            stdout_stderr_1.stdout.stop();
+            expect(mockExecute).toHaveBeenCalledTimes(1);
+            expect(mockFs.writeFile).not.toHaveBeenCalled();
+            expect(stdout_stderr_1.stdout.output).toContain('new-access-token');
+        });
+        it('should include optional parameters when provided', async () => {
+            mockFs.readFile.mockResolvedValue(JSON.stringify({
+                client_id: 'test-client-id',
+                client_secret: 'test-client-secret',
+                token_url: 'https://example.com/token',
+                refresh_token: 'test-refresh-token',
+                scope: 'read write',
+                audience: 'https://api.example.com',
+            }));
+            const scopeTokenResponse = {
+                access_token: 'new-access-token',
+                expires_in: 3600,
+            };
+            mockExecute.mockReturnValue(() => Promise.resolve(E.right({
+                statusCode: 200,
+                headers: {},
+                body: {},
+            })));
+            mockBufferExtensions.readableToArrayBuffer.mockImplementation(() => () => Promise.resolve(E.right(createArrayBufferFromJson(scopeTokenResponse))));
+            await oauth2_token_1.default.run(['--refresh']);
+            const [method, url, request] = mockExecute.mock.calls[0];
+            const requestBody = request.body.toString();
+            expect(requestBody).toContain('scope=read+write');
+            expect(requestBody).toContain('audience=https%3A%2F%2Fapi.example.com');
+        });
+    });
+    describe('URL utility functions', () => {
+        it('should handle invalid URL in isLocalhostRedirect', async () => {
+            // Test the error case where URL parsing fails
+            const contextWithInvalidRedirect = {
+                ...mockContext,
+                redirect_uri: 'not-a-valid-url',
+            };
+            mockFs.readFile.mockResolvedValue(JSON.stringify(contextWithInvalidRedirect));
+            // Mock inquirer to handle non-localhost redirect
+            mockInquirer.prompt.mockResolvedValue({
+                pastedUrl: 'https://example.com/callback?code=test-code&state=bW9jay1yYW5kb20tYnl0ZXMtZm9yLXRlc3RpbmctcHVycG9zZXM',
+            });
+            stdout_stderr_1.stdout.start();
+            await oauth2_token_1.default.run(['--grantType', 'authorization_code']);
+            stdout_stderr_1.stdout.stop();
+            // Invalid URL should trigger manual paste flow
+            expect(mockInquirer.prompt).toHaveBeenCalled();
+            expect(stdout_stderr_1.stdout.output).toContain('Redirect URI is not localhost');
+        });
+    });
+    describe('Browser utility functions', () => {
+        it('should handle Windows platform browser opening', async () => {
+            const originalPlatform = process.platform;
+            Object.defineProperty(process, 'platform', {
+                value: 'win32',
+                writable: true,
+            });
+            const contextWithDeviceCode = {
+                ...mockContext,
+                device_code_url: 'https://oauth.example.com/device',
+            };
+            mockFs.readFile.mockResolvedValue(JSON.stringify(contextWithDeviceCode));
+            const mockExecute = jest
+                .fn()
+                .mockReturnValueOnce(() => Promise.resolve(E.right({
+                statusCode: 200,
+                headers: {},
+                body: {},
+            })))
+                .mockReturnValueOnce(() => Promise.resolve(E.right({
+                statusCode: 200,
+                headers: {},
+                body: {},
+            })));
+            mockAxiosHttpClient.mockImplementation(() => ({ execute: mockExecute }));
+            mockBufferExtensions.readableToArrayBuffer.mockReset();
+            mockBufferExtensions.readableToArrayBuffer
+                .mockReturnValueOnce(() => Promise.resolve(E.right(createArrayBufferFromJson({
+                device_code: 'test-device-code',
+                user_code: 'ABC-123',
+                verification_uri: 'https://oauth.example.com/device',
+                verification_uri_complete: 'https://oauth.example.com/device?user_code=ABC-123',
+                expires_in: 900,
+                interval: 5,
+            }))))
+                .mockReturnValueOnce(() => Promise.resolve(E.right(createArrayBufferFromJson(mockTokenResponse))));
+            await oauth2_token_1.default.run(['--grantType', 'device_code', '--openBrowser']);
+            expect(mockExec).toHaveBeenCalledWith(expect.stringContaining('start'));
+            Object.defineProperty(process, 'platform', {
+                value: originalPlatform,
+                writable: true,
+            });
+        });
+        it('should handle Linux platform browser opening', async () => {
+            const originalPlatform = process.platform;
+            Object.defineProperty(process, 'platform', {
+                value: 'linux',
+                writable: true,
+            });
+            const contextWithDeviceCode = {
+                ...mockContext,
+                device_code_url: 'https://oauth.example.com/device',
+            };
+            mockFs.readFile.mockResolvedValue(JSON.stringify(contextWithDeviceCode));
+            const mockExecute = jest
+                .fn()
+                .mockReturnValueOnce(() => Promise.resolve(E.right({
+                statusCode: 200,
+                headers: {},
+                body: {},
+            })))
+                .mockReturnValueOnce(() => Promise.resolve(E.right({
+                statusCode: 200,
+                headers: {},
+                body: {},
+            })));
+            mockAxiosHttpClient.mockImplementation(() => ({ execute: mockExecute }));
+            mockBufferExtensions.readableToArrayBuffer.mockReset();
+            mockBufferExtensions.readableToArrayBuffer
+                .mockReturnValueOnce(() => Promise.resolve(E.right(createArrayBufferFromJson({
+                device_code: 'test-device-code',
+                user_code: 'ABC-123',
+                verification_uri: 'https://oauth.example.com/device',
+                verification_uri_complete: 'https://oauth.example.com/device?user_code=ABC-123',
+                expires_in: 900,
+                interval: 5,
+            }))))
+                .mockReturnValueOnce(() => Promise.resolve(E.right(createArrayBufferFromJson(mockTokenResponse))));
+            await oauth2_token_1.default.run(['--grantType', 'device_code', '--openBrowser']);
+            expect(mockExec).toHaveBeenCalledWith(expect.stringContaining('xdg-open'));
+            Object.defineProperty(process, 'platform', {
+                value: originalPlatform,
+                writable: true,
+            });
+        });
+    });
+    describe('Environment variable error handling', () => {
+        it('should handle .env file read errors gracefully', async () => {
+            // Mock dotenv to throw an error
+            mockDotenv.config.mockReturnValue({
+                parsed: {},
+                error: new Error('Permission denied'),
+            });
+            // Should still work with context file
+            await oauth2_token_1.default.run(['--grantType', 'client_credentials']);
+            expect(mockAxiosHttpClient).toHaveBeenCalled();
+        });
+        it('should return empty config when .env parse fails', async () => {
+            mockDotenv.config.mockReturnValue({
+                parsed: undefined,
+                error: new Error('Parse error'),
+            });
+            await oauth2_token_1.default.run(['--grantType', 'client_credentials']);
+            expect(mockAxiosHttpClient).toHaveBeenCalled();
+        });
+    });
+    describe('Device Code Flow Error Handling', () => {
+        beforeEach(() => {
+            const contextWithDeviceCode = {
+                ...mockContext,
+                device_code_url: 'https://oauth.example.com/device',
+            };
+            mockFs.readFile.mockResolvedValue(JSON.stringify(contextWithDeviceCode));
+        });
+        it('should handle missing required parameters in device code flow', async () => {
+            const invalidContext = {
+                client_id: 'test-client-id',
+                token_url: 'https://oauth.example.com/token',
+                // Missing device_code_url
+            };
+            mockFs.readFile.mockResolvedValue(JSON.stringify(invalidContext));
+            await expect(oauth2_token_1.default.run(['--grantType', 'device_code'])).rejects.toThrow('Missing required parameters: tokenUrl, clientId, and deviceCodeUrl are required for device_code flow');
+        });
+        it('should handle HTTP client error during device initialization', async () => {
+            const mockError = new Error('Network error');
+            const mockExecute = jest
+                .fn()
+                .mockReturnValue(() => Promise.resolve(E.left(mockError)));
+            mockAxiosHttpClient.mockImplementation(() => ({ execute: mockExecute }));
+            await expect(oauth2_token_1.default.run(['--grantType', 'device_code'])).rejects.toThrow('Network error');
+        });
+        it('should handle buffer read error during device initialization', async () => {
+            const mockExecute = jest.fn().mockReturnValue(() => Promise.resolve(E.right({
+                statusCode: 200,
+                headers: {},
+                body: {},
+            })));
+            mockAxiosHttpClient.mockImplementation(() => ({ execute: mockExecute }));
+            const bufferError = new Error('Buffer read failed');
+            mockBufferExtensions.readableToArrayBuffer.mockReset();
+            mockBufferExtensions.readableToArrayBuffer.mockReturnValue(() => Promise.resolve(E.left(bufferError)));
+            await expect(oauth2_token_1.default.run(['--grantType', 'device_code'])).rejects.toThrow('Buffer read failed');
+        });
+        it('should handle HTTP client error during device code polling', async () => {
+            const mockExecute = jest
+                .fn()
+                .mockReturnValueOnce(() => Promise.resolve(E.right({
+                statusCode: 200,
+                headers: {},
+                body: {},
+            })))
+                .mockReturnValueOnce(() => Promise.resolve(E.left(new Error('Network error during poll'))));
+            mockAxiosHttpClient.mockImplementation(() => ({ execute: mockExecute }));
+            mockBufferExtensions.readableToArrayBuffer.mockReset();
+            mockBufferExtensions.readableToArrayBuffer.mockReturnValue(() => Promise.resolve(E.right(createArrayBufferFromJson({
+                device_code: 'test-device-code',
+                user_code: 'ABC-123',
+                verification_uri: 'https://oauth.example.com/device',
+                expires_in: 900,
+                interval: 1,
+            }))));
+            await expect(oauth2_token_1.default.run(['--grantType', 'device_code'])).rejects.toThrow('Network error during poll');
+        });
+        it('should handle slow_down error from device code poll', async () => {
+            const mockExecute = jest
+                .fn()
+                .mockReturnValueOnce(() => Promise.resolve(E.right({
+                statusCode: 200,
+                headers: {},
+                body: {},
+            })))
+                .mockReturnValueOnce(() => Promise.resolve(E.right({
+                statusCode: 400,
+                headers: {},
+                body: {},
+            })))
+                .mockReturnValueOnce(() => Promise.resolve(E.right({
+                statusCode: 200,
+                headers: {},
+                body: {},
+            })));
+            mockAxiosHttpClient.mockImplementation(() => ({ execute: mockExecute }));
+            mockBufferExtensions.readableToArrayBuffer.mockReset();
+            mockBufferExtensions.readableToArrayBuffer
+                .mockReturnValueOnce(() => Promise.resolve(E.right(createArrayBufferFromJson({
+                device_code: 'test-device-code',
+                user_code: 'ABC-123',
+                verification_uri: 'https://oauth.example.com/device',
+                expires_in: 900,
+                interval: 1,
+            }))))
+                .mockReturnValueOnce(() => Promise.resolve(E.right(createArrayBufferFromJson({
+                error: 'slow_down',
+            }))))
+                .mockReturnValueOnce(() => Promise.resolve(E.right(createArrayBufferFromJson(mockTokenResponse))));
+            await oauth2_token_1.default.run(['--grantType', 'device_code']);
+            expect(mockExecute).toHaveBeenCalledTimes(3);
+        });
+        it('should handle access_denied error from device code poll', async () => {
+            const mockExecute = jest
+                .fn()
+                .mockReturnValueOnce(() => Promise.resolve(E.right({
+                statusCode: 200,
+                headers: {},
+                body: {},
+            })))
+                .mockReturnValueOnce(() => Promise.resolve(E.right({
+                statusCode: 403,
+                headers: {},
+                body: {},
+            })));
+            mockAxiosHttpClient.mockImplementation(() => ({ execute: mockExecute }));
+            mockBufferExtensions.readableToArrayBuffer.mockReset();
+            mockBufferExtensions.readableToArrayBuffer
+                .mockReturnValueOnce(() => Promise.resolve(E.right(createArrayBufferFromJson({
+                device_code: 'test-device-code',
+                user_code: 'ABC-123',
+                verification_uri: 'https://oauth.example.com/device',
+                expires_in: 900,
+                interval: 1,
+            }))))
+                .mockReturnValueOnce(() => Promise.resolve(E.right(createArrayBufferFromJson({
+                error: 'access_denied',
+            }))));
+            await expect(oauth2_token_1.default.run(['--grantType', 'device_code'])).rejects.toThrow('User denied the request');
+        });
+        it('should handle expired_token error from device code poll', async () => {
+            const mockExecute = jest
+                .fn()
+                .mockReturnValueOnce(() => Promise.resolve(E.right({
+                statusCode: 200,
+                headers: {},
+                body: {},
+            })))
+                .mockReturnValueOnce(() => Promise.resolve(E.right({
+                statusCode: 400,
+                headers: {},
+                body: {},
+            })));
+            mockAxiosHttpClient.mockImplementation(() => ({ execute: mockExecute }));
+            mockBufferExtensions.readableToArrayBuffer.mockReset();
+            mockBufferExtensions.readableToArrayBuffer
+                .mockReturnValueOnce(() => Promise.resolve(E.right(createArrayBufferFromJson({
+                device_code: 'test-device-code',
+                user_code: 'ABC-123',
+                verification_uri: 'https://oauth.example.com/device',
+                expires_in: 900,
+                interval: 1,
+            }))))
+                .mockReturnValueOnce(() => Promise.resolve(E.right(createArrayBufferFromJson({
+                error: 'expired_token',
+            }))));
+            await expect(oauth2_token_1.default.run(['--grantType', 'device_code'])).rejects.toThrow('The device code has expired');
+        });
+        it('should handle expired error from device code poll', async () => {
+            const mockExecute = jest
+                .fn()
+                .mockReturnValueOnce(() => Promise.resolve(E.right({
+                statusCode: 200,
+                headers: {},
+                body: {},
+            })))
+                .mockReturnValueOnce(() => Promise.resolve(E.right({
+                statusCode: 400,
+                headers: {},
+                body: {},
+            })));
+            mockAxiosHttpClient.mockImplementation(() => ({ execute: mockExecute }));
+            mockBufferExtensions.readableToArrayBuffer.mockReset();
+            mockBufferExtensions.readableToArrayBuffer
+                .mockReturnValueOnce(() => Promise.resolve(E.right(createArrayBufferFromJson({
+                device_code: 'test-device-code',
+                user_code: 'ABC-123',
+                verification_uri: 'https://oauth.example.com/device',
+                expires_in: 900,
+                interval: 1,
+            }))))
+                .mockReturnValueOnce(() => Promise.resolve(E.right(createArrayBufferFromJson({
+                error: 'expired',
+            }))));
+            await expect(oauth2_token_1.default.run(['--grantType', 'device_code'])).rejects.toThrow('The device code has expired');
+        });
+        it('should handle unknown error from device code poll', async () => {
+            const mockExecute = jest
+                .fn()
+                .mockReturnValueOnce(() => Promise.resolve(E.right({
+                statusCode: 200,
+                headers: {},
+                body: {},
+            })))
+                .mockReturnValueOnce(() => Promise.resolve(E.right({
+                statusCode: 500,
+                headers: {},
+                body: {},
+            })))
+                .mockReturnValueOnce(() => Promise.resolve(E.right({
+                statusCode: 200,
+                headers: {},
+                body: {},
+            })));
+            mockAxiosHttpClient.mockImplementation(() => ({ execute: mockExecute }));
+            mockBufferExtensions.readableToArrayBuffer.mockReset();
+            mockBufferExtensions.readableToArrayBuffer
+                .mockReturnValueOnce(() => Promise.resolve(E.right(createArrayBufferFromJson({
+                device_code: 'test-device-code',
+                user_code: 'ABC-123',
+                verification_uri: 'https://oauth.example.com/device',
+                expires_in: 900,
+                interval: 1,
+            }))))
+                .mockReturnValueOnce(() => Promise.resolve(E.right(createArrayBufferFromJson({
+                error: 'unknown_error',
+            }))))
+                .mockReturnValueOnce(() => Promise.resolve(E.right(createArrayBufferFromJson(mockTokenResponse))));
+            await oauth2_token_1.default.run(['--grantType', 'device_code']);
+            expect(mockExecute).toHaveBeenCalledTimes(3);
+        });
+        it('should handle device code timeout', async () => {
+            const mockExecute = jest.fn().mockReturnValue(() => Promise.resolve(E.right({
+                statusCode: 400,
+                headers: {},
+                body: {},
+            })));
+            mockAxiosHttpClient.mockImplementation(() => ({ execute: mockExecute }));
+            mockBufferExtensions.readableToArrayBuffer.mockReset();
+            mockBufferExtensions.readableToArrayBuffer
+                .mockReturnValueOnce(() => Promise.resolve(E.right(createArrayBufferFromJson({
+                device_code: 'test-device-code',
+                user_code: 'ABC-123',
+                verification_uri: 'https://oauth.example.com/device',
+                expires_in: 1,
+                interval: 1,
+            }))))
+                .mockReturnValue(() => Promise.resolve(E.right(createArrayBufferFromJson({
+                error: 'authorization_pending',
+            }))));
+            await expect(oauth2_token_1.default.run(['--grantType', 'device_code'])).rejects.toThrow('Timed out waiting for device authorization');
+        });
+        it('should handle buffer read error during device code polling', async () => {
+            const mockExecute = jest
+                .fn()
+                .mockReturnValueOnce(() => Promise.resolve(E.right({
+                statusCode: 200,
+                headers: {},
+                body: {},
+            })))
+                .mockReturnValueOnce(() => Promise.resolve(E.right({
+                statusCode: 200,
+                headers: {},
+                body: {},
+            })));
+            mockAxiosHttpClient.mockImplementation(() => ({ execute: mockExecute }));
+            const bufferError = new Error('Buffer read failed');
+            mockBufferExtensions.readableToArrayBuffer.mockReset();
+            mockBufferExtensions.readableToArrayBuffer
+                .mockReturnValueOnce(() => Promise.resolve(E.right(createArrayBufferFromJson({
+                device_code: 'test-device-code',
+                user_code: 'ABC-123',
+                verification_uri: 'https://oauth.example.com/device',
+                expires_in: 900,
+                interval: 1,
+            }))))
+                .mockReturnValueOnce(() => Promise.resolve(E.left(bufferError)));
+            await expect(oauth2_token_1.default.run(['--grantType', 'device_code'])).rejects.toThrow('Buffer read failed');
+        });
+    });
+    describe('Authorization Code Flow Error Handling', () => {
+        beforeEach(() => {
+            // Mock HTTP server for callback
+            const mockServer = {
+                listen: jest
+                    .fn()
+                    .mockImplementation((port, host, callback) => callback?.()),
+                close: jest.fn().mockImplementation((callback) => callback?.()),
+            };
+            mockHttp.createServer.mockImplementation((requestHandler) => {
+                setTimeout(() => {
+                    const mockReq = {
+                        url: '/callback?code=test-code&state=bW9jay1yYW5kb20tYnl0ZXMtZm9yLXRlc3RpbmctcHVycG9zZXM',
+                    };
+                    const mockRes = { writeHead: jest.fn(), end: jest.fn() };
+                    requestHandler?.(mockReq, mockRes);
+                }, 100);
+                return mockServer;
+            });
+        });
+        it('should handle buffer read error during token exchange', async () => {
+            const mockExecute = jest.fn().mockReturnValue(() => Promise.resolve(E.right({
+                statusCode: 200,
+                headers: {},
+                body: {},
+            })));
+            mockAxiosHttpClient.mockImplementation(() => ({ execute: mockExecute }));
+            const bufferError = new Error('Buffer read failed');
+            mockBufferExtensions.readableToArrayBuffer.mockReset();
+            mockBufferExtensions.readableToArrayBuffer.mockReturnValue(() => Promise.resolve(E.left(bufferError)));
+            await expect(oauth2_token_1.default.run(['--grantType', 'authorization_code'])).rejects.toThrow('Buffer read failed');
+        });
+        it('should handle missing access token in authorization code response', async () => {
+            const mockExecute = jest.fn().mockReturnValue(() => Promise.resolve(E.right({
+                statusCode: 200,
+                headers: {},
+                body: {},
+            })));
+            mockAxiosHttpClient.mockImplementation(() => ({ execute: mockExecute }));
+            mockBufferExtensions.readableToArrayBuffer.mockReset();
+            mockBufferExtensions.readableToArrayBuffer.mockReturnValue(() => Promise.resolve(E.right(createArrayBufferFromJson({
+                error: 'invalid_grant',
+            }))));
+            await expect(oauth2_token_1.default.run(['--grantType', 'authorization_code'])).rejects.toThrow('No access_token in token response');
+        });
+        it('should handle missing tokenUrl in authorization code flow', async () => {
+            const invalidContext = {
+                client_id: 'test-client-id',
+                authorize_url: 'https://oauth.example.com/authorize',
+                // Missing token_url
+            };
+            mockFs.readFile.mockResolvedValue(JSON.stringify(invalidContext));
+            const mockServer = {
+                listen: jest
+                    .fn()
+                    .mockImplementation((port, host, callback) => callback?.()),
+                close: jest.fn().mockImplementation((callback) => callback?.()),
+            };
+            mockHttp.createServer.mockImplementation((requestHandler) => {
+                setTimeout(() => {
+                    const mockReq = {
+                        url: '/callback?code=test-code&state=bW9jay1yYW5kb20tYnl0ZXMtZm9yLXRlc3RpbmctcHVycG9zZXM',
+                    };
+                    const mockRes = { writeHead: jest.fn(), end: jest.fn() };
+                    requestHandler?.(mockReq, mockRes);
+                }, 100);
+                return mockServer;
+            });
+            await expect(oauth2_token_1.default.run(['--grantType', 'authorization_code'])).rejects.toThrow('Missing required parameters: tokenUrl, clientId, and authorizeUrl are required for authorization_code flow');
+        });
+        it('should handle invalid tokenUrl in authorization code flow', async () => {
+            const invalidContext = {
+                ...mockContext,
+                token_url: 'not-a-valid-url',
+            };
+            mockFs.readFile.mockResolvedValue(JSON.stringify(invalidContext));
+            const mockServer = {
+                listen: jest
+                    .fn()
+                    .mockImplementation((port, host, callback) => callback?.()),
+                close: jest.fn().mockImplementation((callback) => callback?.()),
+            };
+            mockHttp.createServer.mockImplementation((requestHandler) => {
+                setTimeout(() => {
+                    const mockReq = {
+                        url: '/callback?code=test-code&state=bW9jay1yYW5kb20tYnl0ZXMtZm9yLXRlc3RpbmctcHVycG9zZXM',
+                    };
+                    const mockRes = { writeHead: jest.fn(), end: jest.fn() };
+                    requestHandler?.(mockReq, mockRes);
+                }, 100);
+                return mockServer;
+            });
+            await expect(oauth2_token_1.default.run(['--grantType', 'authorization_code'])).rejects.toThrow('Invalid tokenUrl');
+        });
+        it('should handle invalid authorizeUrl in authorization code flow', async () => {
+            const invalidContext = {
+                ...mockContext,
+                authorize_url: 'not-a-valid-url',
+            };
+            mockFs.readFile.mockResolvedValue(JSON.stringify(invalidContext));
+            const mockServer = {
+                listen: jest
+                    .fn()
+                    .mockImplementation((port, host, callback) => callback?.()),
+                close: jest.fn().mockImplementation((callback) => callback?.()),
+            };
+            mockHttp.createServer.mockImplementation((requestHandler) => {
+                setTimeout(() => {
+                    const mockReq = {
+                        url: '/callback?code=test-code&state=bW9jay1yYW5kb20tYnl0ZXMtZm9yLXRlc3RpbmctcHVycG9zZXM',
+                    };
+                    const mockRes = { writeHead: jest.fn(), end: jest.fn() };
+                    requestHandler?.(mockReq, mockRes);
+                }, 100);
+                return mockServer;
+            });
+            await expect(oauth2_token_1.default.run(['--grantType', 'authorization_code'])).rejects.toThrow('Invalid authorizeUrl');
+        });
+        it('should handle state mismatch error in authorization code callback', async () => {
+            const mockServer = {
+                listen: jest
+                    .fn()
+                    .mockImplementation((port, host, callback) => callback?.()),
+                close: jest.fn().mockImplementation((callback) => callback?.()),
+            };
+            mockHttp.createServer.mockImplementation((requestHandler) => {
+                setTimeout(() => {
+                    const mockReq = {
+                        url: '/callback?code=test-code&state=wrong-state',
+                    };
+                    const mockRes = { writeHead: jest.fn(), end: jest.fn() };
+                    requestHandler?.(mockReq, mockRes);
+                }, 100);
+                return mockServer;
+            });
+            await expect(oauth2_token_1.default.run(['--grantType', 'authorization_code'])).rejects.toThrow('State mismatch');
+        });
+        it('should handle HTTP client error during token exchange', async () => {
+            const mockError = new Error('Network error');
+            const mockExecute = jest
+                .fn()
+                .mockReturnValue(() => Promise.resolve(E.left(mockError)));
+            mockAxiosHttpClient.mockImplementation(() => ({ execute: mockExecute }));
+            await expect(oauth2_token_1.default.run(['--grantType', 'authorization_code'])).rejects.toThrow('Network error');
+        });
+    });
+    describe('Environment variable support', () => {
+        let mockExecute;
+        beforeEach(() => {
+            // Set up HTTP client mock for env tests
+            mockExecute = jest.fn();
+            const mockHttpInstance = {
+                execute: mockExecute,
+            };
+            mockAxiosHttpClient.mockImplementation(() => mockHttpInstance);
+            mockExecute.mockReturnValue(() => Promise.resolve(E.right({
+                statusCode: 200,
+                headers: {},
+                body: {},
+            })));
+            mockBufferExtensions.readableToArrayBuffer.mockImplementation(() => () => Promise.resolve(E.right(createArrayBufferFromJson(mockTokenResponse))));
+        });
+        it('should read credentials from .env file with OAUTH2_ prefix', async () => {
+            // Mock context file without sensitive data
+            mockFs.readFile.mockResolvedValue(JSON.stringify({
+                token_url: 'https://example.com/token',
+            }));
+            // Mock .env file with OAUTH2_ prefixed variables
+            mockDotenv.config.mockReturnValue({
+                parsed: {
+                    OAUTH2_CLIENT_ID: 'env-client-id',
+                    OAUTH2_CLIENT_SECRET: 'env-client-secret',
+                    OAUTH2_SCOPE: 'read write',
+                    OAUTH2_AUDIENCE: 'https://api.example.com',
+                },
+                error: undefined,
+            });
+            await oauth2_token_1.default.run(['--grantType', 'client_credentials']);
+            expect(mockExecute).toHaveBeenCalledTimes(1);
+            const [method, url, request] = mockExecute.mock.calls[0];
+            const requestBody = request.body.toString();
+            expect(requestBody).toContain('client_id=env-client-id');
+            expect(requestBody).toContain('client_secret=env-client-secret');
+            expect(requestBody).toContain('scope=read+write');
+            expect(requestBody).toContain('audience=https%3A%2F%2Fapi.example.com');
+        });
+        it('should read credentials from .env file without prefix', async () => {
+            mockFs.readFile.mockResolvedValue(JSON.stringify({
+                token_url: 'https://example.com/token',
+            }));
+            // Mock .env file with unprefixed variables
+            mockDotenv.config.mockReturnValue({
+                parsed: {
+                    CLIENT_ID: 'env-client-id-no-prefix',
+                    CLIENT_SECRET: 'env-client-secret-no-prefix',
+                },
+                error: undefined,
+            });
+            await oauth2_token_1.default.run(['--grantType', 'client_credentials']);
+            const [method, url, request] = mockExecute.mock.calls[0];
+            const requestBody = request.body.toString();
+            expect(requestBody).toContain('client_id=env-client-id-no-prefix');
+            expect(requestBody).toContain('client_secret=env-client-secret-no-prefix');
+        });
+        it('should prioritize OAUTH2_ prefix over unprefixed variables', async () => {
+            mockFs.readFile.mockResolvedValue(JSON.stringify({
+                token_url: 'https://example.com/token',
+            }));
+            mockDotenv.config.mockReturnValue({
+                parsed: {
+                    OAUTH2_CLIENT_ID: 'prefixed-client-id',
+                    CLIENT_ID: 'unprefixed-client-id',
+                    OAUTH2_CLIENT_SECRET: 'prefixed-secret',
+                    CLIENT_SECRET: 'unprefixed-secret',
+                },
+                error: undefined,
+            });
+            await oauth2_token_1.default.run(['--grantType', 'client_credentials']);
+            const [method, url, request] = mockExecute.mock.calls[0];
+            const requestBody = request.body.toString();
+            expect(requestBody).toContain('client_id=prefixed-client-id');
+            expect(requestBody).toContain('client_secret=prefixed-secret');
+        });
+        it('should use correct precedence: flags > env > context', async () => {
+            // Context file has some values
+            mockFs.readFile.mockResolvedValue(JSON.stringify({
+                token_url: 'https://example.com/token',
+                client_id: 'context-client-id',
+                client_secret: 'context-client-secret',
+            }));
+            // .env file has some values
+            mockDotenv.config.mockReturnValue({
+                parsed: {
+                    OAUTH2_CLIENT_ID: 'env-client-id',
+                    OAUTH2_SCOPE: 'env-scope',
+                },
+                error: undefined,
+            });
+            // Flag overrides everything
+            await oauth2_token_1.default.run([
+                '--grantType',
+                'client_credentials',
+                '--clientId',
+                'flag-client-id',
+            ]);
+            const [method, url, request] = mockExecute.mock.calls[0];
+            const requestBody = request.body.toString();
+            // Flag takes precedence over env and context
+            expect(requestBody).toContain('client_id=flag-client-id');
+            // Env takes precedence over context
+            expect(requestBody).toContain('scope=env-scope');
+            // Context used when not in flag or env
+            expect(requestBody).toContain('client_secret=context-client-secret');
+        });
+        it('should work with refresh token from .env file', async () => {
+            mockFs.readFile.mockResolvedValue(JSON.stringify({
+                token_url: 'https://example.com/token',
+                client_id: 'test-client-id',
+            }));
+            mockDotenv.config.mockReturnValue({
+                parsed: {
+                    OAUTH2_REFRESH_TOKEN: 'env-refresh-token',
+                    OAUTH2_CLIENT_SECRET: 'env-client-secret',
+                },
+                error: undefined,
+            });
+            await oauth2_token_1.default.run(['--refresh']);
+            const [method, url, request] = mockExecute.mock.calls[0];
+            const requestBody = request.body.toString();
+            expect(requestBody).toContain('grant_type=refresh_token');
+            expect(requestBody).toContain('refresh_token=env-refresh-token');
+            expect(requestBody).toContain('client_secret=env-client-secret');
+        });
+        it('should work when .env file does not exist', async () => {
+            // Mock .env file not existing
+            mockFs.access.mockRejectedValue(new Error('File not found'));
+            mockDotenv.config.mockReturnValue({
+                parsed: {},
+                error: new Error('File not found'),
+            });
+            await oauth2_token_1.default.run(['--grantType', 'client_credentials']);
+            // Should still work with context file values
+            expect(mockExecute).toHaveBeenCalledTimes(1);
+        });
+        it('should use custom .env path when specified', async () => {
+            await oauth2_token_1.default.run([
+                '--grantType',
+                'client_credentials',
+                '--envPath',
+                'custom/.env',
+            ]);
+            expect(mockDotenv.config).toHaveBeenCalledWith({
+                path: expect.stringContaining('custom/.env'),
+            });
+        });
+        it('should read all OAuth2 URLs from .env file', async () => {
+            mockFs.readFile.mockResolvedValue(JSON.stringify({}));
+            mockDotenv.config.mockReturnValue({
+                parsed: {
+                    OAUTH2_TOKEN_URL: 'https://env.example.com/token',
+                    OAUTH2_AUTHORIZE_URL: 'https://env.example.com/authorize',
+                    OAUTH2_DEVICE_CODE_URL: 'https://env.example.com/device',
+                    OAUTH2_REDIRECT_URI: 'http://env.localhost:8080/callback',
+                    OAUTH2_CLIENT_ID: 'env-client-id',
+                    OAUTH2_CLIENT_SECRET: 'env-client-secret',
+                },
+                error: undefined,
+            });
+            await oauth2_token_1.default.run(['--grantType', 'client_credentials']);
+            const [method, url, request] = mockExecute.mock.calls[0];
+            const requestBody = request.body.toString();
+            expect(url).toBe('https://env.example.com/token');
+            expect(requestBody).toContain('client_id=env-client-id');
+        });
+    });
+});