@waishnav/devspace 1.0.0 → 1.0.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Waishnav
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,6 +1,6 @@
 <p align="center">
   <picture>
-    <img src="docs/assets/devspace-logo-light.png" alt="DevSpace logo" width="140">
+    <img src="https://raw.githubusercontent.com/Waishnav/devspace/main/docs/assets/devspace-logo-light.png" alt="DevSpace logo" width="140">
   </picture>
 </p>
 
@@ -14,16 +14,66 @@
   <a href="https://github.com/Waishnav/devspace/blob/main/LICENSE"><img alt="License" src="https://img.shields.io/npm/l/%40waishnav%2Fdevspace?style=flat-square" /></a>
 </p>
 
-[![DevSpace connected to ChatGPT](docs/assets/devspace-screenshot.png)](docs/assets/devspace-screenshot.png)
+[![DevSpace connected to ChatGPT](https://raw.githubusercontent.com/Waishnav/devspace/main/docs/assets/devspace-screenshot.png)](https://raw.githubusercontent.com/Waishnav/devspace/main/docs/assets/devspace-screenshot.png)
 
 **Give ChatGPT a secure connection to your own machine and Turn ChatGPT into Codex**
 
 DevSpace is a self-hosted MCP server that lets ChatGPT read, edit, search, and run code in your real local projects — your files, your tools, your terminal — without uploading anything to a third party. You run it on your machine, expose it through a tunnel you control, and approve the connection with a password only you have.
 
-## Quick Start
+## Sponsors and Special Thanks
+
+<table>
+  <thead>
+    <tr>
+      <th>Sponsor</th>
+      <th>About</th>
+    </tr>
+  </thead>
+  <tbody>
+    <tr>
+      <td align="center" width="220">
+        <a href="https://rebates.ai/">
+          <img
+            src="https://app.rebates.ai/brand/rebates-lockup.svg"
+            alt="Rebates"
+            width="170"
+          >
+        </a>
+      </td>
+      <td>
+        <strong>The ads in your terminal pay you.</strong><br><br>
+        <a href="https://rebates.ai/">Rebates</a> adds one optional
+        sponsored footer to your coding agent and pays you cash back for every
+        session in which it is shown. Turn it off at any time.
+      </td>
+    </tr>
+  </tbody>
+</table>
+
+<p align="center">
+  DevSpace is open to new sponsors.
+  <a href="https://x.com/wshxnv">Get in touch to become one.</a>
+</p>
+
+## Installation
 
 DevSpace requires Node `>=20.12 <27`. Node 22 LTS is recommended.
 
+Install the DevSpace CLI:
+
+```bash
+npm install -g @waishnav/devspace
+```
+
+Then initialize and start the server:
+
+```bash
+devspace init
+devspace serve
+```
+
+Or run it without a global install:
+
 ```bash
 npx @waishnav/devspace init
 npx @waishnav/devspace serve
@@ -42,11 +92,7 @@ Use the public origin without `/mcp` during setup:
 https://your-tunnel-host.example.com
 ```
 
-Then configure your MCP client with:
-
-```text
-https://your-tunnel-host.example.com/mcp
-```
+You will configure your MCP client with the public `/mcp` URL after setup.
 
 When the client connects, DevSpace opens an Owner password approval page. Enter
 the Owner password printed by `devspace init`. It is also stored in:
@@ -57,20 +103,7 @@ the Owner password printed by `devspace init`. It is also stored in:
 
 Keep that password private.
 
-## What ChatGPT Gets
-
-After the MCP client connects, ChatGPT can open a project with
-`open_workspace` and then reuse the returned `workspaceId` for later calls.
-
-DevSpace provides tools for:
-
-- reading, writing, and editing files inside the opened workspace
-- searching files and listing directories
-- running shell commands for tests, builds, git, and package scripts
-- opening isolated Git worktrees when you want parallel work
-- loading `AGENTS.md` and `CLAUDE.md` instructions
-- exposing local agent skills from your skill folders
-- showing ChatGPT Apps review cards for aggregate diffs
+## Connect Your MCP Client
 
 The default local endpoint is:
 
@@ -84,6 +117,22 @@ Most users should connect through a public HTTPS tunnel:
 https://your-tunnel-host.example.com/mcp
 ```
 
+## What ChatGPT Can Do
+
+Once connected, ChatGPT can open one of your approved project folders as a
+workspace. From there, it can inspect the repo, make scoped edits, run commands,
+and show you what changed.
+
+DevSpace gives ChatGPT tools to:
+
+- read, write, and edit files inside the opened workspace
+- search code and inspect directories
+- run shell commands for tests, builds, git, and package scripts
+- use isolated Git worktrees for parallel coding sessions
+- follow project instructions from `AGENTS.md` and `CLAUDE.md`
+- discover local agent skills from your skill folders
+- show tool cards and optional change summaries in ChatGPT Apps-compatible hosts
+
 ## Mental Model
 
 DevSpace is remote access to selected local folders.
@@ -95,7 +144,7 @@ connected client like a trusted coding partner with access to your machine.
 For a normal ChatGPT coding session:
 
 1. Start your tunnel.
-2. Run `npx @waishnav/devspace serve`.
+2. Run `devspace serve`.
 3. Connect the MCP client to your public `/mcp` URL.
 4. Approve the connection with the Owner password.
 5. Ask ChatGPT to open a project inside one of your allowed roots.
@@ -115,16 +164,41 @@ shell.
 Run this to inspect your local setup:
 
 ```bash
-npx @waishnav/devspace doctor
+devspace doctor
 ```
 
 ## Documentation
 
-- [Setup Guide](docs/setup.md)
-- [ChatGPT Coding Workflow](docs/chatgpt-coding-workflow.md)
-- [Configuration Reference](docs/configuration.md)
-- [Security Model](docs/security.md)
-- [Troubleshooting Gotchas](docs/gotchas.md)
+- [Setup Guide](https://github.com/Waishnav/devspace/blob/main/docs/setup.md)
+- [ChatGPT Coding Workflow](https://github.com/Waishnav/devspace/blob/main/docs/chatgpt-coding-workflow.md)
+- [Configuration Reference](https://github.com/Waishnav/devspace/blob/main/docs/configuration.md)
+- [Security Model](https://github.com/Waishnav/devspace/blob/main/docs/security.md)
+- [Troubleshooting Gotchas](https://github.com/Waishnav/devspace/blob/main/docs/gotchas.md)
+
+## Philosophy
+
+Every piece of software is becoming conversational. Natural language is
+redefining how we interact with tools, workflows, and systems.
+
+My bet is that ChatGPT becomes the operating system for everything. Once we
+reach AGI, we will simply talk to ChatGPT, and it will prompt, coordinate, and
+orchestrate sub-agents that set up the right loops for us.
+
+We are not there yet.
+
+DevSpace is one attempt to fast-forward that future: a way for MCP-capable
+hosts like ChatGPT and Claude to work directly with local project files through
+explicit, inspectable tools.
+
+## Built by Waishnav
+
+I'm Waishnav, the creator of [GitCMS](https://gitcms.dev/), a Git-backed CMS
+for markdown sites.
+
+I like building opinionated products, and DevSpace is another example of that.
+I'm on a journey to build a single-person company doing multiple millions in
+revenue. If you want to watch the failures, wins, lessons, and everything in
+between, come hang out with me on [X](https://x.com/wshxnv).
 
 ## Local Development
 
@@ -132,15 +206,9 @@ For working on DevSpace itself:
 
 ```bash
 npm install --include=dev
+npm run dev
 npm run typecheck
 npm test
 npm run build
 npm run start
 ```
-
-For long-running local server processes, build an immutable release copy:
-
-```bash
-npm run release:build
-npm run release:start
-```

package/dist/cli.js

@@ -149,7 +149,7 @@ async function serve() {
     }
     const { createServer } = await import("./server.js");
     const config = loadConfig();
-    const { app } = createServer(config);
+    const { app, close } = createServer(config);
     const httpServer = app.listen(config.port, config.host, () => {
         console.log(`devspace listening on http://${config.host}:${config.port}/mcp`);
         console.log(`public base url: ${config.publicBaseUrl}`);
@@ -162,7 +162,10 @@ async function serve() {
         console.log(`logging: ${config.logging.level} ${config.logging.format}`);
     });
     const shutdown = () => {
-        httpServer.close(() => process.exit(0));
+        httpServer.close(() => {
+            close();
+            process.exit(0);
+        });
     };
     process.once("SIGINT", shutdown);
     process.once("SIGTERM", shutdown);

package/dist/config.js

@@ -45,7 +45,16 @@ function parseBoolean(value) {
     return ["1", "true", "yes", "on"].includes(value?.toLowerCase() ?? "");
 }
 function parseMinimalTools(env) {
-    return env.DEVSPACE_TOOL_MODE === "minimal" || parseBoolean(env.DEVSPACE_MINIMAL_TOOLS);
+    if (env.DEVSPACE_TOOL_MODE === "minimal")
+        return true;
+    if (env.DEVSPACE_TOOL_MODE === "full")
+        return false;
+    if (env.DEVSPACE_TOOL_MODE) {
+        throw new Error(`Invalid DEVSPACE_TOOL_MODE: ${env.DEVSPACE_TOOL_MODE}`);
+    }
+    if (env.DEVSPACE_MINIMAL_TOOLS !== undefined)
+        return parseBoolean(env.DEVSPACE_MINIMAL_TOOLS);
+    return true;
 }
 function parseLogLevel(value) {
     if (!value || value === "info")
@@ -85,10 +94,10 @@ function parsePositiveInteger(value, fallback, name) {
     return parsed;
 }
 function parseToolNaming(value) {
-    if (!value || value === "legacy")
-        return "legacy";
-    if (value === "short")
+    if (!value || value === "short")
         return "short";
+    if (value === "legacy")
+        return "legacy";
     throw new Error(`Invalid DEVSPACE_TOOL_NAMING: ${value}`);
 }
 function parseLoggingConfig(env) {
@@ -103,9 +112,9 @@ function parseLoggingConfig(env) {
     };
 }
 function parseWidgetMode(value) {
-    if (!value || value === "changes")
-        return "changes";
-    if (value === "off" || value === "full")
+    if (!value || value === "full")
+        return "full";
+    if (value === "off" || value === "changes")
         return value;
     throw new Error(`Invalid DEVSPACE_WIDGETS: ${value}`);
 }

package/dist/db/client.js

@@ -1,16 +1,23 @@
-import { mkdirSync } from "node:fs";
+import { chmodSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import Database from "better-sqlite3";
 import { drizzle } from "drizzle-orm/better-sqlite3";
 import * as schema from "./schema.js";
+import { migrateDatabase } from "./migrations.js";
 export function databasePath(stateDir) {
     return join(stateDir, "devspace.sqlite");
 }
 export function openDatabase(stateDir) {
-    mkdirSync(stateDir, { recursive: true });
-    const sqlite = new Database(databasePath(stateDir));
+    mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+    chmodSync(stateDir, 0o700);
+    const path = databasePath(stateDir);
+    const sqlite = new Database(path);
+    chmodSync(path, 0o600);
     sqlite.pragma("journal_mode = WAL");
+    sqlite.pragma("synchronous = NORMAL");
+    sqlite.pragma("busy_timeout = 5000");
     sqlite.pragma("foreign_keys = ON");
+    migrateDatabase(sqlite);
     return {
         sqlite,
         db: createDrizzleDatabase(sqlite),

package/dist/db/migrations.js

@@ -0,0 +1,123 @@
+const migrations = [
+    {
+        version: 1,
+        name: "workspace-state",
+        up: migrateWorkspaceState,
+    },
+    {
+        version: 2,
+        name: "oauth-state",
+        up: migrateOAuthState,
+    },
+];
+export function migrateDatabase(sqlite) {
+    const migrate = sqlite.transaction(() => {
+        sqlite.exec(`
+      create table if not exists devspace_schema_migrations (
+        version integer primary key,
+        name text not null,
+        applied_at text not null
+      );
+    `);
+        const applied = new Set(sqlite.prepare("select version from devspace_schema_migrations").all().map((row) => row.version));
+        const recordMigration = sqlite.prepare("insert into devspace_schema_migrations (version, name, applied_at) values (?, ?, ?)");
+        for (const migration of migrations) {
+            if (applied.has(migration.version))
+                continue;
+            migration.up(sqlite);
+            recordMigration.run(migration.version, migration.name, new Date().toISOString());
+        }
+    });
+    migrate.immediate();
+}
+function migrateWorkspaceState(sqlite) {
+    sqlite.exec(`
+    create table if not exists workspace_sessions (
+      id text primary key,
+      root text not null,
+      status text not null default 'active',
+      mode text not null default 'checkout',
+      source_root text,
+      base_ref text,
+      base_sha text,
+      managed text not null default 'false',
+      created_at text not null,
+      last_used_at text not null
+    );
+
+    create index if not exists workspace_sessions_root_idx
+      on workspace_sessions(root, last_used_at desc);
+
+    create index if not exists workspace_sessions_status_idx
+      on workspace_sessions(status, last_used_at desc);
+
+    create table if not exists loaded_agent_files (
+      workspace_session_id text not null,
+      path text not null,
+      content_hash text not null,
+      content text not null,
+      loaded_at text not null,
+      last_seen_at text not null,
+      primary key (workspace_session_id, path),
+      foreign key (workspace_session_id)
+        references workspace_sessions(id)
+        on delete cascade
+    );
+
+    create index if not exists loaded_agent_files_path_idx
+      on loaded_agent_files(path);
+  `);
+    addColumnIfMissing(sqlite, "workspace_sessions", "mode", "text not null default 'checkout'");
+    addColumnIfMissing(sqlite, "workspace_sessions", "source_root", "text");
+    addColumnIfMissing(sqlite, "workspace_sessions", "base_ref", "text");
+    addColumnIfMissing(sqlite, "workspace_sessions", "base_sha", "text");
+    addColumnIfMissing(sqlite, "workspace_sessions", "managed", "text not null default 'false'");
+}
+function migrateOAuthState(sqlite) {
+    sqlite.exec(`
+    create table if not exists oauth_clients (
+      client_id text primary key,
+      client_json text not null,
+      issued_at integer not null
+    );
+
+    create index if not exists oauth_clients_issued_at_idx
+      on oauth_clients(issued_at desc);
+
+    create table if not exists oauth_access_tokens (
+      token_hash text primary key,
+      client_id text not null,
+      scopes_json text not null,
+      expires_at integer not null,
+      resource text,
+      foreign key (client_id) references oauth_clients(client_id) on delete cascade
+    );
+
+    create index if not exists oauth_access_tokens_client_id_idx
+      on oauth_access_tokens(client_id);
+
+    create index if not exists oauth_access_tokens_expires_at_idx
+      on oauth_access_tokens(expires_at);
+
+    create table if not exists oauth_refresh_tokens (
+      token_hash text primary key,
+      client_id text not null,
+      scopes_json text not null,
+      expires_at integer not null,
+      resource text,
+      foreign key (client_id) references oauth_clients(client_id) on delete cascade
+    );
+
+    create index if not exists oauth_refresh_tokens_client_id_idx
+      on oauth_refresh_tokens(client_id);
+
+    create index if not exists oauth_refresh_tokens_expires_at_idx
+      on oauth_refresh_tokens(expires_at);
+  `);
+}
+function addColumnIfMissing(sqlite, table, column, definition) {
+    const columns = sqlite.prepare(`pragma table_info(${table})`).all();
+    if (columns.some((existingColumn) => existingColumn.name === column))
+        return;
+    sqlite.exec(`alter table ${table} add column ${column} ${definition}`);
+}

package/dist/db/schema.js

@@ -1,4 +1,4 @@
-import { index, primaryKey, sqliteTable, text } from "drizzle-orm/sqlite-core";
+import { index, integer, primaryKey, sqliteTable, text } from "drizzle-orm/sqlite-core";
 export const workspaceSessions = sqliteTable("workspace_sessions", {
     id: text("id").primaryKey(),
     root: text("root").notNull(),
@@ -27,3 +27,26 @@ export const loadedAgentFiles = sqliteTable("loaded_agent_files", {
     primaryKey({ columns: [table.workspaceSessionId, table.path] }),
     index("loaded_agent_files_path_idx").on(table.path),
 ]);
+export const oauthClients = sqliteTable("oauth_clients", {
+    clientId: text("client_id").primaryKey(),
+    clientJson: text("client_json").notNull(),
+    issuedAt: integer("issued_at").notNull(),
+});
+export const oauthAccessTokens = sqliteTable("oauth_access_tokens", {
+    tokenHash: text("token_hash").primaryKey(),
+    clientId: text("client_id")
+        .notNull()
+        .references(() => oauthClients.clientId, { onDelete: "cascade" }),
+    scopesJson: text("scopes_json").notNull(),
+    expiresAt: integer("expires_at").notNull(),
+    resource: text("resource"),
+});
+export const oauthRefreshTokens = sqliteTable("oauth_refresh_tokens", {
+    tokenHash: text("token_hash").primaryKey(),
+    clientId: text("client_id")
+        .notNull()
+        .references(() => oauthClients.clientId, { onDelete: "cascade" }),
+    scopesJson: text("scopes_json").notNull(),
+    expiresAt: integer("expires_at").notNull(),
+    resource: text("resource"),
+});

package/dist/oauth-provider.js

@@ -1,6 +1,7 @@
 import { timingSafeEqual, randomBytes, randomUUID, createHash } from "node:crypto";
 import { AccessDeniedError, InvalidGrantError, InvalidRequestError, InvalidTokenError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
 import { checkResourceAllowed, resourceUrlFromServerUrl } from "@modelcontextprotocol/sdk/shared/auth-utils.js";
+import { SqliteOAuthClientsStore, SqliteOAuthStore } from "./oauth-store.js";
 const CODE_TTL_MS = 5 * 60 * 1000;
 function randomToken() {
     return randomBytes(32).toString("base64url");
@@ -74,55 +75,17 @@ ${hiddenFields}
 function requestedScopesAllowed(requested, supported) {
     return requested.every((scope) => supported.includes(scope));
 }
-function redirectHostAllowed(redirectUri, allowedHosts) {
-    let parsed;
-    try {
-        parsed = new URL(redirectUri);
-    }
-    catch {
-        return false;
-    }
-    if (["localhost", "127.0.0.1", "[::1]"].includes(parsed.hostname))
-        return true;
-    return allowedHosts.includes(parsed.hostname);
-}
-export class InMemoryOAuthClientsStore {
-    allowedRedirectHosts;
-    clients = new Map();
-    constructor(allowedRedirectHosts) {
-        this.allowedRedirectHosts = allowedRedirectHosts;
-    }
-    getClient(clientId) {
-        return this.clients.get(clientId);
-    }
-    registerClient(client) {
-        if (!client.redirect_uris.every((uri) => redirectHostAllowed(uri, this.allowedRedirectHosts))) {
-            throw new InvalidRequestError("Client redirect_uri is not allowed for this DevSpace server");
-        }
-        const now = Math.floor(Date.now() / 1000);
-        const registered = {
-            ...client,
-            client_id: `devspace-${randomUUID()}`,
-            client_id_issued_at: now,
-            token_endpoint_auth_method: client.token_endpoint_auth_method ?? "none",
-            grant_types: client.grant_types ?? ["authorization_code", "refresh_token"],
-            response_types: client.response_types ?? ["code"],
-        };
-        this.clients.set(registered.client_id, registered);
-        return registered;
-    }
-}
 export class SingleUserOAuthProvider {
     config;
     clientsStore;
     codes = new Map();
-    accessTokens = new Map();
-    refreshTokens = new Map();
+    oauthStore;
     resourceServerUrl;
-    constructor(config, resourceServerUrl) {
+    constructor(config, resourceServerUrl, stateDir) {
         this.config = config;
         this.resourceServerUrl = resourceUrlFromServerUrl(resourceServerUrl);
-        this.clientsStore = new InMemoryOAuthClientsStore(config.allowedRedirectHosts);
+        this.oauthStore = new SqliteOAuthStore(stateDir);
+        this.clientsStore = new SqliteOAuthClientsStore(this.oauthStore, config.allowedRedirectHosts);
     }
     async authorize(client, params, res) {
         if (!params.resource || !checkResourceAllowed({ requestedResource: params.resource, configuredResource: this.resourceServerUrl })) {
@@ -181,7 +144,8 @@ export class SingleUserOAuthProvider {
         return this.issueTokens(client.client_id, record.params.scopes ?? this.config.scopes, record.params.resource);
     }
     async exchangeRefreshToken(client, refreshToken, scopes, resource) {
-        const record = this.refreshTokens.get(hashToken(refreshToken));
+        const refreshTokenHash = hashToken(refreshToken);
+        const record = this.oauthStore.getRefreshToken(refreshTokenHash);
         if (!record || record.clientId !== client.client_id || record.expiresAt < Math.floor(Date.now() / 1000)) {
             throw new InvalidGrantError("Invalid refresh token");
         }
@@ -192,11 +156,10 @@ export class SingleUserOAuthProvider {
         if (!requestedScopes.every((scope) => record.scopes.includes(scope))) {
             throw new AccessDeniedError("Refresh token cannot grant requested scopes");
         }
-        this.refreshTokens.delete(hashToken(refreshToken));
-        return this.issueTokens(client.client_id, requestedScopes, resource ?? record.resource);
+        return this.issueTokens(client.client_id, requestedScopes, resource ?? (record.resource ? new URL(record.resource) : undefined), refreshTokenHash);
     }
     async verifyAccessToken(token) {
-        const record = this.accessTokens.get(hashToken(token));
+        const record = this.oauthStore.getAccessToken(hashToken(token));
         if (!record || record.expiresAt < Math.floor(Date.now() / 1000)) {
             throw new InvalidTokenError("Invalid or expired access token");
         }
@@ -205,13 +168,16 @@ export class SingleUserOAuthProvider {
             clientId: record.clientId,
             scopes: record.scopes,
             expiresAt: record.expiresAt,
-            resource: record.resource,
+            resource: record.resource ? new URL(record.resource) : undefined,
         };
     }
     async revokeToken(_client, request) {
         const hashed = hashToken(request.token);
-        this.accessTokens.delete(hashed);
-        this.refreshTokens.delete(hashed);
+        this.oauthStore.deleteAccessToken(hashed);
+        this.oauthStore.deleteRefreshToken(hashed);
+    }
+    close() {
+        this.oauthStore.close();
     }
     validCodeRecord(client, authorizationCode) {
         const record = this.codes.get(authorizationCode);
@@ -220,26 +186,31 @@ export class SingleUserOAuthProvider {
         }
         return record;
     }
-    issueTokens(clientId, scopes, resource) {
+    issueTokens(clientId, scopes, resource, consumedRefreshTokenHash) {
         const now = Math.floor(Date.now() / 1000);
         const accessToken = randomToken();
         const refreshToken = randomToken();
         const accessExpiresAt = now + this.config.accessTokenTtlSeconds;
         const refreshExpiresAt = now + this.config.refreshTokenTtlSeconds;
-        this.accessTokens.set(hashToken(accessToken), {
-            token: accessToken,
-            clientId,
-            scopes,
-            expiresAt: accessExpiresAt,
-            resource,
-        });
-        this.refreshTokens.set(hashToken(refreshToken), {
-            token: refreshToken,
-            clientId,
-            scopes,
-            expiresAt: refreshExpiresAt,
-            resource,
-        });
+        const saved = this.oauthStore.saveTokenPair({
+            accessTokenHash: hashToken(accessToken),
+            accessToken: {
+                clientId,
+                scopes,
+                expiresAt: accessExpiresAt,
+                resource: resource?.href,
+            },
+            refreshTokenHash: hashToken(refreshToken),
+            refreshToken: {
+                clientId,
+                scopes,
+                expiresAt: refreshExpiresAt,
+                resource: resource?.href,
+            },
+        }, consumedRefreshTokenHash);
+        if (!saved) {
+            throw new InvalidGrantError("Invalid refresh token");
+        }
         return {
             access_token: accessToken,
             token_type: "bearer",