byterover-cli 1.8.0 → 2.0.0

package/dist/server/infra/project/project-registry.js

@@ -0,0 +1,147 @@
+import { mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { z } from 'zod';
+import { GLOBAL_PROJECTS_DIR, REGISTRY_FILE } from '../../constants.js';
+import { isValidProjectInfoJson, ProjectInfo } from '../../core/domain/project/project-info.js';
+import { getGlobalDataDir } from '../../utils/global-data-path.js';
+import { resolvePath, sanitizeProjectPath } from '../../utils/path-utils.js';
+/**
+ * Zod schema for validating registry.json on disk.
+ */
+const RegistryFileSchema = z.object({
+    projects: z.record(z.string(), z.unknown()),
+    version: z.number(),
+});
+const REGISTRY_VERSION = 1;
+function isValidRegistryFile(value) {
+    return RegistryFileSchema.safeParse(value).success;
+}
+/**
+ * File-based project registry.
+ *
+ * Maps project paths to their XDG storage directories and persists
+ * the mapping to <global-data-dir>/registry.json using atomic writes.
+ *
+ * Follows the GlobalInstanceManager pattern: sync I/O, in-memory cache,
+ * atomic temp+rename for persistence.
+ */
+export class ProjectRegistry {
+    dataDir;
+    log;
+    projects = new Map();
+    projectsDir;
+    registryPath;
+    constructor(options) {
+        this.dataDir = options?.dataDir ?? getGlobalDataDir();
+        this.log = options?.log ?? (() => { });
+        this.registryPath = join(this.dataDir, REGISTRY_FILE);
+        this.projectsDir = join(this.dataDir, GLOBAL_PROJECTS_DIR);
+        this.loadFromDisk();
+    }
+    get(projectPath) {
+        let resolved;
+        try {
+            resolved = resolvePath(projectPath);
+        }
+        catch (error) {
+            // Only swallow ENOENT — the path no longer exists on disk (e.g. temp dir deleted
+            // after agent idle timeout). All other errors (EACCES, ENOTDIR, etc.) are real
+            // infrastructure problems and must propagate.
+            if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+                return undefined;
+            }
+            throw error;
+        }
+        return this.projects.get(resolved);
+    }
+    getAll() {
+        return this.projects;
+    }
+    register(projectPath) {
+        const resolved = resolvePath(projectPath);
+        // Idempotent: return existing if already registered
+        const existing = this.projects.get(resolved);
+        if (existing) {
+            return existing;
+        }
+        const sanitized = sanitizeProjectPath(resolved);
+        const storagePath = join(this.projectsDir, sanitized);
+        // Validate before side effects — catches root path ('/') which produces
+        // an empty sanitizedPath that Zod rejects, preventing mkdirSync from
+        // writing sessions/ into the global projects directory itself.
+        const info = new ProjectInfo({
+            projectPath: resolved,
+            registeredAt: Date.now(),
+            sanitizedPath: sanitized,
+            storagePath,
+        });
+        // Create per-project XDG directories only after validation succeeds
+        mkdirSync(join(storagePath, 'sessions'), { recursive: true });
+        this.projects.set(resolved, info);
+        this.persistToDisk();
+        return info;
+    }
+    unregister(projectPath) {
+        const resolved = resolvePath(projectPath);
+        if (!this.projects.has(resolved)) {
+            return false;
+        }
+        this.projects.delete(resolved);
+        this.persistToDisk();
+        return true;
+    }
+    /**
+     * Loads the registry from disk into the in-memory map.
+     * Gracefully handles missing or corrupted files by starting with an empty map.
+     */
+    loadFromDisk() {
+        try {
+            const content = readFileSync(this.registryPath, 'utf8');
+            const parsed = JSON.parse(content);
+            if (!isValidRegistryFile(parsed)) {
+                return;
+            }
+            for (const [key, value] of Object.entries(parsed.projects)) {
+                if (isValidProjectInfoJson(value)) {
+                    const info = ProjectInfo.fromJson(value);
+                    if (info) {
+                        this.projects.set(key, info);
+                    }
+                }
+            }
+        }
+        catch {
+            // Missing or unreadable file — start empty
+        }
+    }
+    /**
+     * Persists the in-memory map to disk via atomic temp+rename.
+     */
+    persistToDisk() {
+        const data = {
+            projects: {},
+            version: REGISTRY_VERSION,
+        };
+        for (const [key, info] of this.projects) {
+            data.projects[key] = info.toJson();
+        }
+        // Ensure data directory exists
+        mkdirSync(this.dataDir, { recursive: true });
+        // Atomic write: temp file → rename
+        const tempPath = this.registryPath + '.tmp.' + process.pid;
+        try {
+            writeFileSync(tempPath, JSON.stringify(data, null, 2));
+            renameSync(tempPath, this.registryPath);
+        }
+        catch (error) {
+            this.log(`Failed to persist registry to ${this.registryPath}: ${error instanceof Error ? error.message : String(error)}`);
+            // Clean up temp file on failure
+            try {
+                unlinkSync(tempPath);
+            }
+            catch {
+                // Ignore cleanup error
+            }
+        }
+    }
+}

package/dist/server/infra/provider/env-provider-detector.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Environment Variable Provider Detector
+ *
+ * Detects LLM providers from environment variables.
+ * Used to auto-connect providers when API keys are found in the environment.
+ */
+/**
+ * A detected provider from the environment.
+ */
+export interface DetectedProvider {
+    /** The API key value from the environment */
+    apiKey: string;
+    /** The environment variable name that was found */
+    envVar: string;
+    /** The provider ID (e.g., 'anthropic', 'openai') */
+    providerId: string;
+}
+/**
+ * Detect providers from environment variables.
+ *
+ * Scans all providers in the registry for their `envVars` configuration
+ * and checks if any of those environment variables are set.
+ *
+ * @returns Array of detected providers with their API keys
+ */
+export declare function detectProvidersFromEnv(): DetectedProvider[];
+/**
+ * Check if a specific provider has an API key set via environment variable.
+ *
+ * @param providerId - The provider ID to check
+ * @returns The API key if found, undefined otherwise
+ */
+export declare function getProviderApiKeyFromEnv(providerId: string): string | undefined;

package/dist/server/infra/provider/env-provider-detector.js

@@ -0,0 +1,52 @@
+/**
+ * Environment Variable Provider Detector
+ *
+ * Detects LLM providers from environment variables.
+ * Used to auto-connect providers when API keys are found in the environment.
+ */
+import { PROVIDER_REGISTRY } from '../../core/domain/entities/provider-registry.js';
+/**
+ * Detect providers from environment variables.
+ *
+ * Scans all providers in the registry for their `envVars` configuration
+ * and checks if any of those environment variables are set.
+ *
+ * @returns Array of detected providers with their API keys
+ */
+export function detectProvidersFromEnv() {
+    const detected = [];
+    for (const provider of Object.values(PROVIDER_REGISTRY)) {
+        if (!provider.envVars || provider.envVars.length === 0)
+            continue;
+        for (const envVar of provider.envVars) {
+            const value = process.env[envVar];
+            if (value && value.trim().length > 0) {
+                detected.push({
+                    apiKey: value.trim(),
+                    envVar,
+                    providerId: provider.id,
+                });
+                break; // Only take the first matching env var per provider
+            }
+        }
+    }
+    return detected;
+}
+/**
+ * Check if a specific provider has an API key set via environment variable.
+ *
+ * @param providerId - The provider ID to check
+ * @returns The API key if found, undefined otherwise
+ */
+export function getProviderApiKeyFromEnv(providerId) {
+    const provider = PROVIDER_REGISTRY[providerId];
+    if (!provider?.envVars)
+        return undefined;
+    for (const envVar of provider.envVars) {
+        const value = process.env[envVar];
+        if (value && value.trim().length > 0) {
+            return value.trim();
+        }
+    }
+    return undefined;
+}

package/dist/server/infra/provider/provider-config-resolver.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Provider Config Resolver
+ *
+ * Resolves the full provider configuration (API key, base URL, headers, etc.)
+ * for the currently active provider. Used by the daemon state server to serve
+ * agent child processes on startup and after provider hot-swap.
+ */
+import type { IProviderConfigStore } from '../../core/interfaces/i-provider-config-store.js';
+import type { IProviderKeychainStore } from '../../core/interfaces/i-provider-keychain-store.js';
+import { type ProviderConfigResponse } from '../../core/domain/transport/schemas.js';
+/**
+ * Validate provider config integrity at startup.
+ *
+ * Iterates ALL connected providers and disconnects any whose credentials are no
+ * longer accessible. This handles migration from v1 (system keychain) to v2
+ * (file-based keystore) and other stale credential scenarios.
+ *
+ * If the previously active provider was stale, explicitly sets activeProvider to
+ * empty string so the TUI routes to the provider setup flow — bypassing the
+ * 'byterover' fallback that withProviderDisconnected() would otherwise apply.
+ */
+export declare function clearStaleProviderConfig(providerConfigStore: IProviderConfigStore, providerKeychainStore: IProviderKeychainStore): Promise<void>;
+/**
+ * Resolve the active provider's full configuration.
+ *
+ * Reads the active provider/model from the config store, resolves
+ * the API key (keychain → env fallback), and maps provider-specific
+ * fields (base URL, headers, location, etc.).
+ */
+export declare function resolveProviderConfig(providerConfigStore: IProviderConfigStore, providerKeychainStore: IProviderKeychainStore): Promise<ProviderConfigResponse>;

package/dist/server/infra/provider/provider-config-resolver.js

@@ -0,0 +1,167 @@
+/**
+ * Provider Config Resolver
+ *
+ * Resolves the full provider configuration (API key, base URL, headers, etc.)
+ * for the currently active provider. Used by the daemon state server to serve
+ * agent child processes on startup and after provider hot-swap.
+ */
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { getProviderById, providerRequiresApiKey } from '../../core/domain/entities/provider-registry.js';
+import { getProviderApiKeyFromEnv } from './env-provider-detector.js';
+import { resolveVertexAiProject } from './vertex-ai-utils.js';
+async function isProviderCredentialAccessible(providerId, providerKeychainStore) {
+    if (providerId === 'google-vertex') {
+        const storedPath = await providerKeychainStore.getApiKey(providerId);
+        if (storedPath)
+            return existsSync(storedPath);
+        return !getVertexAiCredentialError(process.env.GOOGLE_APPLICATION_CREDENTIALS);
+    }
+    if (!providerRequiresApiKey(providerId))
+        return true;
+    return Boolean((await providerKeychainStore.getApiKey(providerId)) || getProviderApiKeyFromEnv(providerId));
+}
+/**
+ * Validate provider config integrity at startup.
+ *
+ * Iterates ALL connected providers and disconnects any whose credentials are no
+ * longer accessible. This handles migration from v1 (system keychain) to v2
+ * (file-based keystore) and other stale credential scenarios.
+ *
+ * If the previously active provider was stale, explicitly sets activeProvider to
+ * empty string so the TUI routes to the provider setup flow — bypassing the
+ * 'byterover' fallback that withProviderDisconnected() would otherwise apply.
+ */
+export async function clearStaleProviderConfig(providerConfigStore, providerKeychainStore) {
+    try {
+        const config = await providerConfigStore.read();
+        const results = await Promise.all(Object.keys(config.providers).map(async (providerId) => ({
+            accessible: await isProviderCredentialAccessible(providerId, providerKeychainStore),
+            providerId,
+        })));
+        const staleProviderIds = results.filter(({ accessible }) => !accessible).map(({ providerId }) => providerId);
+        if (staleProviderIds.length === 0)
+            return;
+        // Build new config in ONE pass — avoids parallel-write race conditions
+        // where multiple disconnectProvider() calls read the same cached config.
+        let newConfig = config;
+        for (const providerId of staleProviderIds) {
+            newConfig = newConfig.withProviderDisconnected(providerId);
+        }
+        // withProviderDisconnected() falls back to 'byterover' when the active provider is
+        // removed, which causes the TUI to show 'ready' and skip provider setup. Explicitly
+        // set activeProvider to '' so the user is returned to the provider setup flow.
+        if (staleProviderIds.includes(config.activeProvider)) {
+            newConfig = newConfig.withActiveProvider('');
+        }
+        await providerConfigStore.write(newConfig);
+    }
+    catch {
+        // Non-critical: if validation fails, daemon continues normally.
+        // The user will encounter a provider error when submitting a task instead.
+    }
+}
+/**
+ * Resolve the active provider's full configuration.
+ *
+ * Reads the active provider/model from the config store, resolves
+ * the API key (keychain → env fallback), and maps provider-specific
+ * fields (base URL, headers, location, etc.).
+ */
+export async function resolveProviderConfig(providerConfigStore, providerKeychainStore) {
+    const config = await providerConfigStore.read();
+    const { activeProvider } = config;
+    const activeModel = config.getActiveModel(activeProvider);
+    const maxInputTokens = config.getActiveModelContextLength(activeProvider);
+    if (!activeProvider || activeProvider === 'byterover') {
+        return { activeModel, activeProvider, maxInputTokens };
+    }
+    if (activeProvider === 'google-vertex') {
+        return resolveVertexAiConfig(activeModel, activeProvider, maxInputTokens, providerKeychainStore);
+    }
+    // Resolve API key: keychain first, then environment variable
+    let apiKey = await providerKeychainStore.getApiKey(activeProvider);
+    if (!apiKey) {
+        apiKey = getProviderApiKeyFromEnv(activeProvider);
+    }
+    switch (activeProvider) {
+        case 'openai-compatible': {
+            return {
+                activeModel,
+                activeProvider,
+                maxInputTokens,
+                provider: activeProvider,
+                providerApiKey: apiKey || undefined,
+                providerBaseUrl: config.getBaseUrl(activeProvider) || undefined,
+                providerKeyMissing: !apiKey,
+            };
+        }
+        case 'openrouter': {
+            return {
+                activeModel,
+                activeProvider,
+                maxInputTokens,
+                openRouterApiKey: apiKey || undefined,
+                provider: activeProvider,
+                providerKeyMissing: !apiKey,
+            };
+        }
+        default: {
+            const providerDef = getProviderById(activeProvider);
+            const headers = providerDef?.headers;
+            return {
+                activeModel,
+                activeProvider,
+                maxInputTokens,
+                provider: activeProvider,
+                providerApiKey: apiKey || undefined,
+                providerBaseUrl: providerDef?.baseUrl || undefined,
+                providerHeaders: headers && Object.keys(headers).length > 0 ? { ...headers } : undefined,
+                providerKeyMissing: !apiKey,
+            };
+        }
+    }
+}
+/**
+ * Resolve Google Vertex AI provider configuration.
+ * Uses service account JSON from keychain or Application Default Credentials.
+ */
+async function resolveVertexAiConfig(activeModel, activeProvider, maxInputTokens, providerKeychainStore) {
+    const storedCredentialPath = await providerKeychainStore.getApiKey(activeProvider);
+    const effectiveCredentialPath = storedCredentialPath || process.env.GOOGLE_APPLICATION_CREDENTIALS || undefined;
+    const credentialError = getVertexAiCredentialError(effectiveCredentialPath);
+    return {
+        activeModel,
+        activeProvider,
+        maxInputTokens,
+        provider: activeProvider,
+        providerCredentialError: credentialError ?? undefined,
+        providerCredentialPath: effectiveCredentialPath,
+        providerKeyMissing: Boolean(credentialError),
+        providerLocation: process.env.GOOGLE_CLOUD_LOCATION || 'us-central1',
+        providerProject: resolveVertexAiProject(storedCredentialPath),
+    };
+}
+/**
+ * Lightweight check for Google Vertex AI credential availability.
+ * Checks the given credential path and the well-known ADC file
+ * without making network calls.
+ *
+ * @param credentialPath - Explicit credential file path (from keychain or env var).
+ * @returns Error message if credentials are not found, null if accessible.
+ */
+function getVertexAiCredentialError(credentialPath) {
+    if (credentialPath) {
+        if (!existsSync(credentialPath)) {
+            return `Credential file not found: ${credentialPath}. Verify the path or run \`gcloud auth application-default login\`.`;
+        }
+        return null;
+    }
+    // Check well-known ADC location (created by `gcloud auth application-default login`)
+    const adcPath = join(homedir(), '.config', 'gcloud', 'application_default_credentials.json');
+    if (existsSync(adcPath)) {
+        return null;
+    }
+    return 'Google Cloud credentials not found. Run `gcloud auth application-default login` or set the GOOGLE_APPLICATION_CREDENTIALS environment variable.';
+}

package/dist/server/infra/provider/vertex-ai-utils.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Vertex AI Utilities
+ *
+ * Shared helpers for Google Vertex AI provider configuration.
+ */
+/**
+ * Resolve the Google Cloud project ID for Vertex AI.
+ * Priority: GOOGLE_CLOUD_PROJECT env var → project_id from service account JSON.
+ */
+export declare function resolveVertexAiProject(credentialPath: string | undefined): string | undefined;

package/dist/server/infra/provider/vertex-ai-utils.js

@@ -0,0 +1,28 @@
+/**
+ * Vertex AI Utilities
+ *
+ * Shared helpers for Google Vertex AI provider configuration.
+ */
+import { readFileSync } from 'node:fs';
+/**
+ * Resolve the Google Cloud project ID for Vertex AI.
+ * Priority: GOOGLE_CLOUD_PROJECT env var → project_id from service account JSON.
+ */
+export function resolveVertexAiProject(credentialPath) {
+    if (process.env.GOOGLE_CLOUD_PROJECT) {
+        return process.env.GOOGLE_CLOUD_PROJECT;
+    }
+    const filePath = credentialPath || process.env.GOOGLE_APPLICATION_CREDENTIALS;
+    if (filePath) {
+        try {
+            const content = JSON.parse(readFileSync(filePath, 'utf8'));
+            if (typeof content.project_id === 'string' && content.project_id) {
+                return content.project_id;
+            }
+        }
+        catch {
+            // File read/parse failed — fall through to undefined
+        }
+    }
+    return undefined;
+}

package/dist/server/infra/routing/project-router.d.ts

@@ -0,0 +1,35 @@
+/**
+ * ProjectRouter — Routes events to project-scoped Socket.IO rooms.
+ *
+ * Wraps ITransportServer room methods with project-specific room naming.
+ * Room name format: project:<sanitizedPath>:broadcast
+ *
+ * Member tracking: Maintains an in-memory Set per room so that
+ * getProjectMembers() is O(1) without querying the Socket.IO adapter.
+ *
+ * Cleanup contract: Callers (T4 ClientManager) must call
+ * removeFromProjectRoom on client disconnect. Socket.IO auto-removes
+ * sockets from rooms on disconnect, but the internal roomMembers map
+ * requires explicit removal.
+ */
+import type { IProjectRouter } from '../../core/interfaces/routing/i-project-router.js';
+import type { ITransportServer } from '../../core/interfaces/transport/i-transport-server.js';
+type ProjectRouterOptions = {
+    transport: ITransportServer;
+};
+export declare class ProjectRouter implements IProjectRouter {
+    /** Track room membership: roomName → Set of clientIds */
+    private readonly roomMembers;
+    private readonly transport;
+    constructor(options: ProjectRouterOptions);
+    addToProjectRoom(clientId: string, sanitizedPath: string): void;
+    broadcastToProject<T = unknown>(sanitizedPath: string, event: string, data: T, except?: string): void;
+    getProjectMembers(sanitizedPath: string): string[];
+    removeFromProjectRoom(clientId: string, sanitizedPath: string): void;
+    /**
+     * Builds the Socket.IO room name from a sanitized project path.
+     * Format: project:<sanitizedPath>:broadcast
+     */
+    private buildRoomName;
+}
+export {};

package/dist/server/infra/routing/project-router.js

@@ -0,0 +1,60 @@
+/**
+ * ProjectRouter — Routes events to project-scoped Socket.IO rooms.
+ *
+ * Wraps ITransportServer room methods with project-specific room naming.
+ * Room name format: project:<sanitizedPath>:broadcast
+ *
+ * Member tracking: Maintains an in-memory Set per room so that
+ * getProjectMembers() is O(1) without querying the Socket.IO adapter.
+ *
+ * Cleanup contract: Callers (T4 ClientManager) must call
+ * removeFromProjectRoom on client disconnect. Socket.IO auto-removes
+ * sockets from rooms on disconnect, but the internal roomMembers map
+ * requires explicit removal.
+ */
+import { PROJECT_ROOM_PREFIX, PROJECT_ROOM_SUFFIX } from '../../constants.js';
+export class ProjectRouter {
+    /** Track room membership: roomName → Set of clientIds */
+    roomMembers = new Map();
+    transport;
+    constructor(options) {
+        this.transport = options.transport;
+    }
+    addToProjectRoom(clientId, sanitizedPath) {
+        const room = this.buildRoomName(sanitizedPath);
+        this.transport.addToRoom(clientId, room);
+        let members = this.roomMembers.get(room);
+        if (!members) {
+            members = new Set();
+            this.roomMembers.set(room, members);
+        }
+        members.add(clientId);
+    }
+    broadcastToProject(sanitizedPath, event, data, except) {
+        const room = this.buildRoomName(sanitizedPath);
+        this.transport.broadcastTo(room, event, data, except);
+    }
+    getProjectMembers(sanitizedPath) {
+        const room = this.buildRoomName(sanitizedPath);
+        const members = this.roomMembers.get(room);
+        return members ? [...members] : [];
+    }
+    removeFromProjectRoom(clientId, sanitizedPath) {
+        const room = this.buildRoomName(sanitizedPath);
+        this.transport.removeFromRoom(clientId, room);
+        const members = this.roomMembers.get(room);
+        if (members) {
+            members.delete(clientId);
+            if (members.size === 0) {
+                this.roomMembers.delete(room);
+            }
+        }
+    }
+    /**
+     * Builds the Socket.IO room name from a sanitized project path.
+     * Format: project:<sanitizedPath>:broadcast
+     */
+    buildRoomName(sanitizedPath) {
+        return `${PROJECT_ROOM_PREFIX}${sanitizedPath}${PROJECT_ROOM_SUFFIX}`;
+    }
+}

package/dist/server/infra/session/session-reader.d.ts

@@ -0,0 +1,18 @@
+import type { SessionInfo } from '../../../agent/core/domain/session/session-metadata.js';
+import type { ISessionReader } from '../../core/interfaces/session/i-session-reader.js';
+type SessionReaderOptions = {
+    /** Explicit sessions directory path (XDG storage path) */
+    sessionsDir: string;
+    /** Project working directory */
+    workingDirectory: string;
+};
+/**
+ * Adapter for reading session metadata from agent's SessionMetadataStore.
+ * Provides server-side access to session data without tight coupling to agent infrastructure.
+ */
+export declare class SessionReader implements ISessionReader {
+    private readonly store;
+    constructor(options: SessionReaderOptions);
+    listSessions(): Promise<SessionInfo[]>;
+}
+export {};

package/dist/server/infra/session/session-reader.js

@@ -0,0 +1,17 @@
+import { SessionMetadataStore } from '../../../agent/infra/session/session-metadata-store.js';
+/**
+ * Adapter for reading session metadata from agent's SessionMetadataStore.
+ * Provides server-side access to session data without tight coupling to agent infrastructure.
+ */
+export class SessionReader {
+    store;
+    constructor(options) {
+        this.store = new SessionMetadataStore({
+            sessionsDir: options.sessionsDir,
+            workingDirectory: options.workingDirectory,
+        });
+    }
+    async listSessions() {
+        return this.store.listSessions();
+    }
+}

package/dist/server/infra/state/auth-state-store.d.ts

@@ -0,0 +1,55 @@
+import type { AuthToken } from '../../core/domain/entities/auth-token.js';
+import type { ITokenStore } from '../../core/interfaces/auth/i-token-store.js';
+import type { AuthChangedCallback, AuthExpiredCallback, IAuthStateStore } from '../../core/interfaces/state/i-auth-state-store.js';
+type AuthStateStoreOptions = {
+    /** Logging function (optional, defaults to no-op) */
+    log?: (message: string) => void;
+    /** Polling interval in milliseconds (optional, defaults to AUTH_STATE_POLL_INTERVAL_MS) */
+    pollIntervalMs?: number;
+    /** The underlying token store to poll */
+    tokenStore: ITokenStore;
+};
+/**
+ * Global auth state store.
+ *
+ * Polls ITokenStore at a configurable interval to detect external changes
+ * (login via TUI/CLI, token refresh, logout). Maintains an in-memory cache
+ * of the current AuthToken and fires callbacks on state transitions.
+ *
+ * Change detection: compares accessToken strings.
+ * - New token (was undefined, now has value): fires onAuthChanged
+ * - Changed token (different accessToken): fires onAuthChanged
+ * - Removed token (was present, now undefined): fires onAuthChanged(undefined)
+ * - Expired token (was valid, now expired): fires onAuthExpired (once)
+ *
+ * Uses an isPolling guard to prevent overlapping poll cycles.
+ */
+export declare class AuthStateStore implements IAuthStateStore {
+    private authChangedCallback;
+    private authExpiredCallback;
+    private cachedToken;
+    private isPolling;
+    private readonly log;
+    private pollInterval;
+    private readonly pollIntervalMs;
+    private readonly tokenStore;
+    /** Track whether previous poll found the token expired (avoid repeat callbacks) */
+    private wasExpired;
+    constructor(options: AuthStateStoreOptions);
+    getToken(): AuthToken | undefined;
+    loadToken(): Promise<AuthToken | undefined>;
+    onAuthChanged(callback: AuthChangedCallback): void;
+    onAuthExpired(callback: AuthExpiredCallback): void;
+    startPolling(): void;
+    stopPolling(): void;
+    /**
+     * Single poll cycle. Loads token from store and compares with cached.
+     * Skips if a poll is already in-flight.
+     */
+    private pollOnce;
+    /**
+     * Compare loaded token with cached and fire appropriate callbacks.
+     */
+    private updateCachedToken;
+}
+export {};