@vybestack/llxprt-code-mcp 0.10.0-nightly.260613.1adad3b34

package/dist/auth/src/auth-precedence-resolver.d.ts

@@ -0,0 +1,147 @@
+/**
+ * @license
+ * Copyright 2025 Vybestack LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { ISettingsService } from './interfaces/settings-service.js';
+import type { GetActiveRuntimeContext } from './interfaces/runtime-context.js';
+import type { IDebugLogger } from './interfaces/debug-logger.js';
+import type { IProviderKeyStorage } from './interfaces/provider-key-storage.js';
+import type { AuthPrecedenceConfig, OAuthManager } from './precedence.js';
+interface ResolveAuthOptions {
+    settingsService?: ISettingsService | null;
+    includeOAuth?: boolean;
+}
+export declare class AuthPrecedenceResolver {
+    private static readonly NO_OP_LOGGER;
+    private config;
+    private oauthManager?;
+    private settingsService?;
+    private providerKeyStorage?;
+    private logger;
+    private getActiveRuntimeContextFn?;
+    /**
+     * Constructs an AuthPrecedenceResolver.
+     *
+     * If callers expect resolveAuthentication() to resolve named auth keys itself,
+     * providerKeyStorage must be injected. CLI profile handling normally resolves
+     * named keys to concrete provider apiKey values before provider construction;
+     * direct consumers should pass providerKeyStorage or use core's
+     * createAuthPrecedenceResolver() factory.
+     */
+    constructor(config: AuthPrecedenceConfig, options?: {
+        oauthManager?: OAuthManager;
+        settingsService?: ISettingsService;
+        providerKeyStorage?: IProviderKeyStorage;
+        logger?: IDebugLogger;
+        getActiveRuntimeContext?: GetActiveRuntimeContext;
+    });
+    /**
+     * @plan PLAN-20251018-STATELESSPROVIDER2.P06
+     * @requirement REQ-SP2-001
+     * @pseudocode base-provider-call-contract.md lines 1-2
+     */
+    setSettingsService(settingsService: ISettingsService | null | undefined): void;
+    /**
+     * Get the active runtime context via injected function.
+     * Returns null if no function was injected or if it returns null/undefined.
+     */
+    private getActiveRuntimeContext;
+    /**
+     * @plan PLAN-20251018-STATELESSPROVIDER2.P06
+     * @requirement REQ-SP2-001
+     * @pseudocode base-provider-call-contract.md lines 1-2
+     */
+    private resolveSettingsService;
+    /**
+     * @plan PLAN-20251018-STATELESSPROVIDER2.P06
+     * @requirement REQ-SP2-001
+     * @pseudocode base-provider-call-contract.md lines 1-3
+     * Resolves authentication using the full precedence chain
+     * Returns the first available authentication method or null if none found
+     */
+    resolveAuthentication(options?: ResolveAuthOptions): Promise<string | null>;
+    private resolveNonOAuthAuthentication;
+    private resolveDirectAuthentication;
+    private resolveProviderAuthentication;
+    private resolveGlobalAuthentication;
+    private resolveKeyFileAuth;
+    private resolveEnvironmentAuthentication;
+    private canResolveOAuth;
+    private resolveOAuthAuthentication;
+    private buildOAuthContext;
+    private tryGetRuntimeState;
+    private isOAuthDisabledByManager;
+    private debugOAuthEnablementError;
+    private invalidateDisabledOAuthEntry;
+    private getCachedOAuthToken;
+    private fetchAndCacheOAuthToken;
+    private buildOAuthRequestMetadata;
+    private extractRuntimeMetadata;
+    private storeOAuthTokenMetadata;
+    private tryGetOAuthTokenMetadata;
+    private debugOAuthTokenError;
+    /**
+     * @plan PLAN-20251018-STATELESSPROVIDER2.P06
+     * @requirement REQ-SP2-001
+     * @pseudocode base-provider-call-contract.md lines 1-3
+     * Check if any authentication method is available without triggering OAuth
+     */
+    hasNonOAuthAuthentication(options?: ResolveAuthOptions): Promise<boolean>;
+    /**
+     * @plan PLAN-20251018-STATELESSPROVIDER2.P06
+     * @requirement REQ-SP2-001
+     * @pseudocode base-provider-call-contract.md lines 1-3
+     * Check if OAuth is the only available authentication method
+     */
+    isOAuthOnlyAvailable(options?: ResolveAuthOptions): Promise<boolean>;
+    /**
+     * @plan PLAN-20251018-STATELESSPROVIDER2.P06
+     * @requirement REQ-SP2-001
+     * @pseudocode base-provider-call-contract.md lines 1-3
+     * Get authentication method name for debugging/logging
+     */
+    getAuthMethodName(options?: ResolveAuthOptions): Promise<string | null>;
+    private getGlobalAuthMethodName;
+    private getKeyFileMethodName;
+    private getConfigAuthMethodName;
+    private getEnvironmentAuthMethodName;
+    private getOAuthMethodName;
+    private normalizeAuthValue;
+    private normalizeProviderId;
+    private resolveProviderIdentifier;
+    private shouldUseGlobalAuth;
+    private resolveNamedKey;
+    /**
+     * Reads API key from a file path, handling tilde expansion, absolute and relative paths
+     */
+    private readKeyFile;
+    /**
+     * Updates the configuration
+     */
+    updateConfig(newConfig: Partial<AuthPrecedenceConfig>): void;
+    /**
+     * Updates the OAuth manager
+     */
+    updateOAuthManager(oauthManager: OAuthManager): void;
+    /**
+     * Invalidates the cached OAuth tokens for this resolver.
+     * This should be called during logout to ensure fresh tokens are fetched
+     * on the next authentication attempt.
+     *
+     * @plan PLAN-20251023-STATELESS-HARDENING
+     * @requirement Issue #975 - OAuth logout cache invalidation
+     */
+    invalidateCache(): void;
+    /**
+     * Invalidates cached OAuth tokens for a specific provider.
+     * This enables surgical cache invalidation for a single provider rather than
+     * the all-or-nothing invalidateCache() behavior.
+     *
+     * @param providerId - The provider ID to invalidate cache entries for
+     * @param profileId - Optional profile ID to invalidate only that specific profile
+     * @fix issue1861 - Token revocation handling
+     */
+    invalidateProviderCache(providerId: string, profileId?: string): void;
+}
+export {};

package/dist/auth/src/auth-precedence-resolver.js

@@ -0,0 +1,542 @@
+/**
+ * @license
+ * Copyright 2025 Vybestack LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { buildCacheKey, ensureRuntimeState, flushRuntimeAuthScope, getValidCachedEntry, invalidateEntry, invalidateMatchingEntries, recordCacheHit, recordCacheMiss, registerSettingsSubscriptions, resolveProfileId, runtimeScopedStates, storeRuntimeScopedToken, } from './precedence.js';
+function isAuthOnlyEnabled(value) {
+    if (typeof value === 'boolean')
+        return value;
+    if (typeof value === 'string') {
+        const normalized = value.trim().toLowerCase();
+        if (normalized === 'true')
+            return true;
+        if (normalized === 'false')
+            return false;
+    }
+    return false;
+}
+export class AuthPrecedenceResolver {
+    static NO_OP_LOGGER = {
+        debug: () => { },
+        error: () => { },
+        warn: () => { },
+        log: () => { },
+    };
+    config;
+    oauthManager;
+    settingsService;
+    providerKeyStorage;
+    logger;
+    getActiveRuntimeContextFn;
+    /**
+     * Constructs an AuthPrecedenceResolver.
+     *
+     * If callers expect resolveAuthentication() to resolve named auth keys itself,
+     * providerKeyStorage must be injected. CLI profile handling normally resolves
+     * named keys to concrete provider apiKey values before provider construction;
+     * direct consumers should pass providerKeyStorage or use core's
+     * createAuthPrecedenceResolver() factory.
+     */
+    constructor(config, options) {
+        this.config = config;
+        this.oauthManager = options?.oauthManager;
+        this.settingsService = options?.settingsService;
+        this.providerKeyStorage = options?.providerKeyStorage;
+        this.logger = options?.logger ?? AuthPrecedenceResolver.NO_OP_LOGGER;
+        this.getActiveRuntimeContextFn = options?.getActiveRuntimeContext;
+    }
+    /**
+     * @plan PLAN-20251018-STATELESSPROVIDER2.P06
+     * @requirement REQ-SP2-001
+     * @pseudocode base-provider-call-contract.md lines 1-2
+     */
+    setSettingsService(settingsService) {
+        this.settingsService = settingsService ?? undefined;
+    }
+    /**
+     * Get the active runtime context via injected function.
+     * Returns null if no function was injected or if it returns null/undefined.
+     */
+    getActiveRuntimeContext() {
+        if (typeof this.getActiveRuntimeContextFn !== 'function')
+            return null;
+        return this.getActiveRuntimeContextFn() ?? null;
+    }
+    /**
+     * @plan PLAN-20251018-STATELESSPROVIDER2.P06
+     * @requirement REQ-SP2-001
+     * @pseudocode base-provider-call-contract.md lines 1-2
+     */
+    resolveSettingsService(override) {
+        if (override != null)
+            return override;
+        if (this.settingsService != null)
+            return this.settingsService;
+        const context = this.getActiveRuntimeContext();
+        const settingsService = context.settingsService;
+        if (settingsService == null) {
+            throw new Error('Active provider runtime context not available');
+        }
+        this.settingsService = settingsService;
+        return settingsService;
+    }
+    /**
+     * @plan PLAN-20251018-STATELESSPROVIDER2.P06
+     * @requirement REQ-SP2-001
+     * @pseudocode base-provider-call-contract.md lines 1-3
+     * Resolves authentication using the full precedence chain
+     * Returns the first available authentication method or null if none found
+     */
+    async resolveAuthentication(options) {
+        const includeOAuth = options?.includeOAuth ?? false;
+        const settingsService = this.resolveSettingsService(options?.settingsService ?? undefined);
+        const providerKey = this.normalizeProviderId(this.config.providerId);
+        if (!isAuthOnlyEnabled(settingsService.get('authOnly'))) {
+            const nonOAuthAuth = await this.resolveNonOAuthAuthentication(settingsService, providerKey);
+            if (nonOAuthAuth !== null)
+                return nonOAuthAuth;
+        }
+        if (!this.canResolveOAuth(includeOAuth))
+            return null;
+        return this.resolveOAuthAuthentication(settingsService, providerKey);
+    }
+    async resolveNonOAuthAuthentication(settingsService, providerKey) {
+        const directAuth = await this.resolveDirectAuthentication(settingsService, providerKey);
+        if (directAuth !== null)
+            return directAuth;
+        const envAuth = this.resolveEnvironmentAuthentication();
+        return envAuth ?? null;
+    }
+    async resolveDirectAuthentication(settingsService, providerKey) {
+        const providerAuth = await this.resolveProviderAuthentication(settingsService, providerKey);
+        if (providerAuth !== null)
+            return providerAuth;
+        const configAuth = this.normalizeAuthValue(this.config.apiKey ?? null);
+        if (configAuth !== undefined)
+            return configAuth;
+        return this.resolveGlobalAuthentication(settingsService, providerKey);
+    }
+    async resolveProviderAuthentication(settingsService, providerKey) {
+        const providerSettings = providerKey !== undefined &&
+            typeof settingsService.getProviderSettings === 'function'
+            ? settingsService.getProviderSettings(providerKey)
+            : undefined;
+        const providerAuthKey = this.normalizeAuthValue(providerSettings?.['auth-key']);
+        if (providerAuthKey !== undefined)
+            return providerAuthKey;
+        const providerAuthKeyfile = this.normalizeAuthValue(providerSettings?.['auth-keyfile']);
+        return this.resolveKeyFileAuth(providerAuthKeyfile);
+    }
+    async resolveGlobalAuthentication(settingsService, providerKey) {
+        if (!this.shouldUseGlobalAuth(settingsService, providerKey))
+            return null;
+        const authKey = this.normalizeAuthValue(settingsService.get('auth-key'));
+        if (authKey !== undefined)
+            return authKey;
+        const authKeyName = this.normalizeAuthValue(settingsService.get('auth-key-name'));
+        if (authKeyName !== undefined)
+            return this.resolveNamedKey(authKeyName);
+        const authKeyfile = this.normalizeAuthValue(settingsService.get('auth-keyfile'));
+        return this.resolveKeyFileAuth(authKeyfile);
+    }
+    async resolveKeyFileAuth(keyFile) {
+        if (keyFile === undefined)
+            return null;
+        const keyFromFile = await this.readKeyFile(keyFile);
+        return keyFromFile ?? null;
+    }
+    resolveEnvironmentAuthentication() {
+        if (this.config.envKeyNames == null ||
+            this.config.envKeyNames.length === 0) {
+            return undefined;
+        }
+        for (const envVarName of this.config.envKeyNames) {
+            const envValue = this.normalizeAuthValue(process.env[envVarName]);
+            if (envValue !== undefined)
+                return envValue;
+        }
+        return undefined;
+    }
+    canResolveOAuth(includeOAuth) {
+        if (!includeOAuth)
+            return false;
+        if (this.config.isOAuthEnabled !== true)
+            return false;
+        if (this.config.supportsOAuth !== true)
+            return false;
+        return this.oauthManager != null && this.config.oauthProvider != null;
+    }
+    async resolveOAuthAuthentication(settingsService, providerKey) {
+        const context = this.buildOAuthContext(settingsService, providerKey);
+        if ((await this.isOAuthDisabledByManager()) === true) {
+            this.invalidateDisabledOAuthEntry(context);
+            return null;
+        }
+        const cachedToken = this.getCachedOAuthToken(context);
+        if (cachedToken !== null)
+            return cachedToken;
+        return this.fetchAndCacheOAuthToken(context);
+    }
+    buildOAuthContext(settingsService, providerKey) {
+        const providerId = this.resolveProviderIdentifier(providerKey);
+        const profileId = resolveProfileId(settingsService);
+        const runtime = this.tryGetRuntimeState(settingsService, providerId);
+        return {
+            settingsService,
+            providerKey,
+            providerId,
+            profileId,
+            profileScopeId: profileId ?? 'no-profile',
+            runtimeContext: runtime.runtimeContext,
+            runtimeState: runtime.runtimeState,
+        };
+    }
+    tryGetRuntimeState(settingsService, providerId) {
+        try {
+            const runtimeContext = this.getActiveRuntimeContext();
+            if (!runtimeContext) {
+                return { runtimeContext: null, runtimeState: null };
+            }
+            const runtimeState = ensureRuntimeState(runtimeContext, this.logger);
+            registerSettingsSubscriptions(runtimeState, settingsService, providerId, this.logger);
+            return { runtimeContext, runtimeState };
+        }
+        catch {
+            return { runtimeContext: null, runtimeState: null };
+        }
+    }
+    async isOAuthDisabledByManager() {
+        const managerWithCheck = this.oauthManager;
+        if (typeof managerWithCheck?.isOAuthEnabled !== 'function')
+            return false;
+        try {
+            const enabledResult = managerWithCheck.isOAuthEnabled(this.config.oauthProvider);
+            return (await enabledResult) === false;
+        }
+        catch (error) {
+            this.debugOAuthEnablementError(error);
+            return false;
+        }
+    }
+    debugOAuthEnablementError(error) {
+        if (process.env.DEBUG) {
+            this.logger.debug(`Failed to determine OAuth enablement for ${this.config.oauthProvider}:`, error);
+        }
+    }
+    invalidateDisabledOAuthEntry(context) {
+        const runtimeState = context.runtimeState;
+        if (runtimeState == null)
+            return;
+        const cacheKey = buildCacheKey(runtimeState.runtimeAuthScopeId, context.providerId, context.profileScopeId);
+        if (runtimeState.entries.has(cacheKey)) {
+            invalidateEntry(runtimeState, cacheKey, 'oauth-disabled');
+        }
+    }
+    getCachedOAuthToken(context) {
+        const runtimeState = context.runtimeState;
+        if (runtimeState == null)
+            return null;
+        const cachedEntry = getValidCachedEntry(runtimeState, context.providerId, context.profileScopeId);
+        if (cachedEntry !== null) {
+            recordCacheHit(runtimeState);
+            return cachedEntry.token;
+        }
+        recordCacheMiss(runtimeState);
+        return null;
+    }
+    async fetchAndCacheOAuthToken(context) {
+        try {
+            const requestMetadata = this.buildOAuthRequestMetadata(context);
+            const token = await this.oauthManager.getToken(this.config.oauthProvider, requestMetadata);
+            if (token == null || token === '')
+                return null;
+            const oauthToken = await this.tryGetOAuthTokenMetadata(requestMetadata);
+            this.storeOAuthTokenMetadata(context, token, oauthToken);
+            return token;
+        }
+        catch (error) {
+            this.debugOAuthTokenError(error);
+            return null;
+        }
+    }
+    buildOAuthRequestMetadata(context) {
+        const runtimeMetadata = this.extractRuntimeMetadata(context.runtimeContext);
+        return {
+            runtimeAuthScopeId: context.runtimeState?.runtimeAuthScopeId ?? 'no-runtime',
+            providerId: context.providerId,
+            profileId: context.profileId ?? undefined,
+            cliScope: runtimeMetadata,
+            runtimeMetadata,
+        };
+    }
+    extractRuntimeMetadata(runtimeContext) {
+        const metadata = runtimeContext?.metadata;
+        return metadata != null && typeof metadata === 'object'
+            ? metadata
+            : undefined;
+    }
+    storeOAuthTokenMetadata(context, token, oauthToken) {
+        const runtimeState = context.runtimeState;
+        if (runtimeState == null)
+            return;
+        storeRuntimeScopedToken(runtimeState, context.providerId, context.profileScopeId, token, oauthToken);
+    }
+    async tryGetOAuthTokenMetadata(requestMetadata) {
+        if (typeof this.oauthManager?.getOAuthToken !== 'function')
+            return null;
+        try {
+            return await this.oauthManager.getOAuthToken(this.config.oauthProvider, requestMetadata);
+        }
+        catch (tokenError) {
+            if (process.env.DEBUG) {
+                this.logger.debug(`Failed to fetch OAuth token metadata for ${this.config.oauthProvider}:`, tokenError);
+            }
+            return null;
+        }
+    }
+    debugOAuthTokenError(error) {
+        if (process.env.DEBUG) {
+            this.logger.warn(`Failed to get OAuth token for ${this.config.oauthProvider}:`, error);
+        }
+    }
+    /**
+     * @plan PLAN-20251018-STATELESSPROVIDER2.P06
+     * @requirement REQ-SP2-001
+     * @pseudocode base-provider-call-contract.md lines 1-3
+     * Check if any authentication method is available without triggering OAuth
+     */
+    async hasNonOAuthAuthentication(options) {
+        const auth = await this.resolveAuthentication({
+            ...options,
+            includeOAuth: false,
+        });
+        return auth !== null;
+    }
+    /**
+     * @plan PLAN-20251018-STATELESSPROVIDER2.P06
+     * @requirement REQ-SP2-001
+     * @pseudocode base-provider-call-contract.md lines 1-3
+     * Check if OAuth is the only available authentication method
+     */
+    async isOAuthOnlyAvailable(options) {
+        const hasNonOAuth = await this.hasNonOAuthAuthentication(options);
+        return (!hasNonOAuth &&
+            this.config.isOAuthEnabled === true &&
+            this.config.supportsOAuth === true);
+    }
+    /**
+     * @plan PLAN-20251018-STATELESSPROVIDER2.P06
+     * @requirement REQ-SP2-001
+     * @pseudocode base-provider-call-contract.md lines 1-3
+     * Get authentication method name for debugging/logging
+     */
+    async getAuthMethodName(options) {
+        const settingsService = this.resolveSettingsService(options?.settingsService ?? undefined);
+        const globalMethod = await this.getGlobalAuthMethodName(settingsService);
+        if (globalMethod !== null)
+            return globalMethod;
+        const configMethod = this.getConfigAuthMethodName();
+        if (configMethod !== null)
+            return configMethod;
+        return this.getOAuthMethodName();
+    }
+    async getGlobalAuthMethodName(settingsService) {
+        const authKey = settingsService.get('auth-key');
+        if (typeof authKey === 'string' && authKey.trim() !== '') {
+            return 'command-key';
+        }
+        if (this.normalizeAuthValue(settingsService.get('auth-key-name')) !==
+            undefined) {
+            return 'named-key';
+        }
+        return this.getKeyFileMethodName(settingsService.get('auth-keyfile'));
+    }
+    async getKeyFileMethodName(value) {
+        if (typeof value !== 'string' || value === '')
+            return null;
+        try {
+            const keyFromFile = await this.readKeyFile(value);
+            return keyFromFile !== null ? 'command-keyfile' : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    getConfigAuthMethodName() {
+        if (typeof this.config.apiKey === 'string' &&
+            this.config.apiKey.trim() !== '') {
+            return 'constructor-apikey';
+        }
+        const envAuthName = this.getEnvironmentAuthMethodName();
+        return envAuthName ?? null;
+    }
+    getEnvironmentAuthMethodName() {
+        if (this.config.envKeyNames == null ||
+            this.config.envKeyNames.length === 0) {
+            return undefined;
+        }
+        for (const envVarName of this.config.envKeyNames) {
+            const envValue = process.env[envVarName];
+            if (typeof envValue === 'string' && envValue.trim() !== '') {
+                return `env-${envVarName.toLowerCase()}`;
+            }
+        }
+        return undefined;
+    }
+    async getOAuthMethodName() {
+        if (!this.canResolveOAuth(true))
+            return null;
+        try {
+            const isAuthenticated = await this.oauthManager.isAuthenticated(this.config.oauthProvider);
+            return isAuthenticated ? `oauth-${this.config.oauthProvider}` : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    normalizeAuthValue(value) {
+        if (typeof value !== 'string')
+            return undefined;
+        const trimmed = value.trim();
+        return trimmed === '' || trimmed.toLowerCase() === 'none'
+            ? undefined
+            : trimmed;
+    }
+    normalizeProviderId(value) {
+        if (typeof value !== 'string')
+            return undefined;
+        const trimmed = value.trim();
+        return trimmed === '' ? undefined : trimmed;
+    }
+    resolveProviderIdentifier(preferredProviderId) {
+        const providerId = this.normalizeProviderId(preferredProviderId);
+        if (providerId !== undefined)
+            return providerId;
+        const oauthProvider = this.normalizeProviderId(this.config.oauthProvider);
+        if (oauthProvider !== undefined)
+            return oauthProvider;
+        return this.config.envKeyNames?.[0] ?? 'unknown-provider';
+    }
+    shouldUseGlobalAuth(settingsService, providerId) {
+        if (providerId === undefined)
+            return true;
+        const activeProvider = settingsService.get('activeProvider');
+        if (typeof activeProvider !== 'string')
+            return true;
+        const trimmed = activeProvider.trim();
+        return trimmed === '' || trimmed === providerId;
+    }
+    async resolveNamedKey(name) {
+        const trimmedName = this.normalizeAuthValue(name);
+        if (trimmedName === undefined) {
+            throw new Error('Named key reference is empty');
+        }
+        const storage = this.providerKeyStorage;
+        if (!storage) {
+            throw new Error('Provider key storage is required to resolve named auth keys. ' +
+                'Pass providerKeyStorage to AuthPrecedenceResolver or use createAuthPrecedenceResolver() from core.');
+        }
+        const key = this.normalizeAuthValue(await storage.getKey(trimmedName));
+        if (key === undefined) {
+            throw new Error(`Named key '${trimmedName}' not found. Save it with /key save ${trimmedName} <api-key> before retrying.`);
+        }
+        return key;
+    }
+    /**
+     * Reads API key from a file path, handling tilde expansion, absolute and relative paths
+     */
+    async readKeyFile(filePath) {
+        try {
+            const expandedPath = filePath.startsWith('~')
+                ? path.join(os.homedir(), filePath.slice(1))
+                : filePath;
+            const resolvedPath = path.isAbsolute(expandedPath)
+                ? expandedPath
+                : path.resolve(process.cwd(), expandedPath);
+            const content = await fs.readFile(resolvedPath, 'utf-8');
+            const key = content.trim();
+            if (key === '') {
+                if (process.env.DEBUG) {
+                    this.logger.warn(`Key file ${filePath} is empty`);
+                }
+                return null;
+            }
+            return key;
+        }
+        catch (error) {
+            if (process.env.DEBUG) {
+                this.logger.warn(`Failed to read key file ${filePath}:`, error);
+            }
+            return null;
+        }
+    }
+    /**
+     * Updates the configuration
+     */
+    updateConfig(newConfig) {
+        this.config = { ...this.config, ...newConfig };
+    }
+    /**
+     * Updates the OAuth manager
+     */
+    updateOAuthManager(oauthManager) {
+        this.oauthManager = oauthManager;
+    }
+    /**
+     * Invalidates the cached OAuth tokens for this resolver.
+     * This should be called during logout to ensure fresh tokens are fetched
+     * on the next authentication attempt.
+     *
+     * @plan PLAN-20251023-STATELESS-HARDENING
+     * @requirement Issue #975 - OAuth logout cache invalidation
+     */
+    invalidateCache() {
+        const knownRuntimeIds = ['legacy-singleton', 'provider-manager-singleton'];
+        try {
+            const ctx = this.getActiveRuntimeContext();
+            const runtimeId = ctx?.runtimeId;
+            if (typeof runtimeId === 'string' &&
+                runtimeId !== '' &&
+                !knownRuntimeIds.includes(runtimeId)) {
+                knownRuntimeIds.push(runtimeId);
+            }
+        }
+        catch {
+            // Context not available, proceed with known IDs
+        }
+        for (const runtimeId of knownRuntimeIds) {
+            try {
+                flushRuntimeAuthScope(runtimeId);
+            }
+            catch (error) {
+                this.logger.debug(`Failed to flush runtime auth scope ${runtimeId}: ${error}`);
+            }
+        }
+    }
+    /**
+     * Invalidates cached OAuth tokens for a specific provider.
+     * This enables surgical cache invalidation for a single provider rather than
+     * the all-or-nothing invalidateCache() behavior.
+     *
+     * @param providerId - The provider ID to invalidate cache entries for
+     * @param profileId - Optional profile ID to invalidate only that specific profile
+     * @fix issue1861 - Token revocation handling
+     */
+    invalidateProviderCache(providerId, profileId) {
+        for (const [, state] of runtimeScopedStates) {
+            invalidateMatchingEntries(state, (entry) => {
+                if (entry.providerId !== providerId)
+                    return false;
+                if (profileId !== undefined && entry.profileId !== profileId) {
+                    return false;
+                }
+                return true;
+            }, 'token-revoked');
+        }
+    }
+}
+//# sourceMappingURL=auth-precedence-resolver.js.map