mcp-meta-ads-incrementality 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 drak-marketing
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,131 @@
+# mcp-meta-ads-incrementality
+
+> An MCP server for Meta Marketing API insights, built around incrementality.
+> The default attribution window is `incrementality`, not `7d_click + 1d_view`.
+
+Most agency reports today use Meta's default 7-day-click + 1-day-view attributed conversions. That number systematically overstates ad impact: it credits clicks that would have converted anyway and gives view-credit for impressions that didn't change behavior. Meta exposes an `incrementality` breakdown on its insights API that returns the actual incremental conversion count.
+
+This MCP server makes that the default, and lets you ask for the standard windows in the same call to quantify the gap.
+
+## Status
+
+`v0.1.0` — early. One tool today (`meta_ads_insights_incrementality`). Comprehensive unit-test coverage of the incrementality math, attribution-window handling, and Meta SDK request shape (120+ tests). Real-API integration is unverified at this version — we recommend running it against a sandboxed account first.
+
+This package is not affiliated with, endorsed by, or sponsored by Meta Platforms, Inc. "Meta" and "Facebook" are trademarks of Meta Platforms, Inc.
+
+## Install
+
+```bash
+npm install -g mcp-meta-ads-incrementality
+```
+
+Or run directly via `npx`:
+
+```bash
+npx mcp-meta-ads-incrementality --help
+```
+
+## Auth
+
+Set `META_ACCESS_TOKEN` to a Meta Marketing API access token. A **System User token** from Business Manager is strongly recommended — it doesn't expire and is scoped to the ad accounts the System User has access to.
+
+To create one:
+
+1. Open [Business Manager](https://business.facebook.com/) → Business Settings → Users → System Users.
+2. Create a new System User and assign it to the ad accounts you want to manage.
+3. Generate a token with `ads_read` and `ads_management` permissions.
+4. Export it: `export META_ACCESS_TOKEN=EAAB...`
+
+User access tokens (60-day) also work. For agency use, get **Advanced Access** to the Marketing API via App Review — Standard Access only works against ad accounts the developer owns.
+
+## Configure in your MCP client
+
+Claude Desktop or Claude Code, in `.mcp.json`:
+
+```json
+{
+  "mcpServers": {
+    "meta-ads-incrementality": {
+      "command": "npx",
+      "args": ["-y", "mcp-meta-ads-incrementality"],
+      "env": {
+        "META_ACCESS_TOKEN": "EAAB..."
+      }
+    }
+  }
+}
+```
+
+## Tools
+
+### `meta_ads_insights_incrementality`
+
+Pull Meta Ads insights for a date range with one or more attribution windows. Returns per-row conversion counts and a summary.
+
+**Inputs:**
+
+| field | required | default | notes |
+|---|---|---|---|
+| `ad_account_id` | yes | — | with or without `act_` prefix |
+| `date_range` | yes | — | `{ since: "YYYY-MM-DD", until: "YYYY-MM-DD" }` |
+| `conversion_event_name` | yes | — | e.g. `offsite_conversion.fb_pixel_purchase` |
+| `attribution_windows` | no | `["incrementality"]` | array of valid windows |
+| `level` | no | `"campaign"` | `account`, `campaign`, `adset`, `ad` |
+| `campaign_id` | no | — | restrict to a single campaign |
+| `adset_id` | no | — | restrict to a single ad set |
+| `breakdowns` | no | — | Meta breakdown fields |
+
+**Valid attribution windows:** `incrementality`, `1d_click`, `7d_click`, `28d_click`, `1d_view`, `1d_ev`, `dda`, `skan_view`, `skan_click`. (Note: `7d_view` and `28d_view` were deprecated by Meta on Jan 12, 2026 and are not accepted.)
+
+**Output shape:**
+
+```jsonc
+{
+  "meta": {
+    "ad_account_id": "act_123",
+    "date_range": { "since": "2026-03-01", "until": "2026-03-31" },
+    "level": "campaign",
+    "conversion_event_name": "offsite_conversion.fb_pixel_purchase",
+    "attribution_windows": ["incrementality", "7d_click", "1d_view"]
+  },
+  "rows": [
+    {
+      "campaign_id": "...",
+      "campaign_name": "Brand",
+      "spend": 5000,
+      "conversions": { "incrementality": 40, "7d_click": 80, "1d_view": 20 },
+      "default_attributed": 100,
+      "inflation_factor": 2.5,
+      "overstatement_pct": 60
+    }
+  ],
+  "summary": {
+    "total_spend": 5000,
+    "total_conversions": { "incrementality": 40, "7d_click": 80, "1d_view": 20 },
+    "cpa": { "incrementality": 125, "7d_click": 62.5, "1d_view": 250 },
+    "inflation_factor": 2.5
+  }
+}
+```
+
+When `incrementality` and at least one of `7d_click` / `1d_view` are both requested, every row gets:
+
+- `default_attributed` — sum of `7d_click` + `1d_view` (the standard agency number)
+- `inflation_factor` — `default_attributed / incrementality` (how much larger the reported number is)
+- `overstatement_pct` — `(default - incrementality) / default × 100`
+
+## Pitch for agencies
+
+Most agency reports show the default 7d-click + 1d-view conversion number. That number is systematically inflated. Meta's own `incrementality` breakdown is the true incremental count — and if you put both numbers next to each other in a client report, the gap is usually large. The `inflation_factor` field in this MCP's output is the headline metric: "the number you've been reporting is X× the actual incremental impact."
+
+Use this MCP as the data source for your AI-driven reporting workflows. The defaults are set up so that the right number leads.
+
+## Caveats
+
+- The `incrementality` attribution window is referenced in Meta's Breakdowns documentation but is not in the canonical `action_attribution_windows` enum on the Ad Account Insights reference page. We've defaulted to it because it's the right thing to report — but if Meta changes the API, this MCP will need to follow. Pin the version if stability matters more than correctness.
+- For agencies running campaigns where true incrementality matters at the dollar level, **Conversion Lift studies** (set up in advance with a randomized holdout group) remain the gold standard. This MCP does not yet expose those — that's planned for v0.2.
+- Built on `facebook-nodejs-business-sdk` (Meta's official Node SDK). Inherits any quirks of that SDK including a known appsecret_proof pagination bug.
+
+## License
+
+MIT. See [LICENSE](./LICENSE).

package/dist/auth-cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export declare function run(argv?: string[]): Promise<void>;
+//# sourceMappingURL=auth-cli.d.ts.map

package/dist/auth-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-cli.d.ts","sourceRoot":"","sources":["../src/auth-cli.ts"],"names":[],"mappings":";AAgUA,wBAAsB,GAAG,CAAC,IAAI,GAAE,MAAM,EAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CA4E/E"}

package/dist/auth-cli.js

@@ -0,0 +1,342 @@
+#!/usr/bin/env node
+// ============================================
+// mcp-meta-ads-auth -- one-time Meta OAuth + long-lived token exchange
+// ============================================
+// Flow:
+//   1. Loopback HTTP listener on a free port
+//   2. Open browser to Facebook OAuth dialog (implicit flow, response_type=token)
+//   3. Callback page uses JS to extract token from URL fragment, POSTs to local server
+//   4. Exchange short-lived token for long-lived token (60 days) using app_secret
+//   5. Write credentials to ~/.config/mcp-meta-ads-nodejs/credentials.json
+//
+// Priority chain at runtime:
+//   1. META_ACCESS_TOKEN env var (System User token -- never expires, recommended)
+//   2. Cached OAuth token from this CLI (long-lived, ~60 days)
+import http from "http";
+import { URL } from "url";
+import { writeStoredCredentials, credentialsFilePath, CREDENTIALS_FILE_VERSION } from "./credentials.js";
+import { findFreeLoopbackPort, openBrowser } from "./platform.js";
+const META_GRAPH_VERSION = "v24.0";
+const META_AUTH_URL = `https://www.facebook.com/${META_GRAPH_VERSION}/dialog/oauth`;
+const META_GRAPH_URL = `https://graph.facebook.com/${META_GRAPH_VERSION}`;
+const AUTH_SCOPE = "business_management,ads_read,ads_management,pages_show_list,pages_read_engagement";
+function parseArgs(argv) {
+    return { help: argv.includes("--help") || argv.includes("-h") };
+}
+function printHelp() {
+    process.stdout.write([
+        "mcp-meta-ads-auth -- authorize Claude to access your Meta ad accounts",
+        "",
+        "Usage:",
+        "  npx -p mcp-meta-ads-incrementality mcp-meta-ads-auth",
+        "",
+        "Options:",
+        "  -h, --help    Show this help",
+        "",
+        `Credentials are written to: ${credentialsFilePath}`,
+        "",
+        "Note: Meta long-lived tokens expire after ~60 days.",
+        "      Re-run this command when your token expires.",
+        "      For permanent access, use a System User token from Business Manager",
+        "      and set META_ACCESS_TOKEN in your environment.",
+        "",
+    ].join("\n"));
+}
+// ============================================
+// OAUTH: IMPLICIT FLOW WITH JS FRAGMENT EXTRACTION
+// ============================================
+function buildAuthUrl(appId, redirectUri, state) {
+    const params = new URLSearchParams({
+        client_id: appId,
+        redirect_uri: redirectUri,
+        response_type: "token",
+        scope: AUTH_SCOPE,
+        state,
+    });
+    return `${META_AUTH_URL}?${params.toString()}`;
+}
+/**
+ * Meta's implicit OAuth puts the token in the URL fragment (#access_token=...).
+ * Fragments are never sent to the server, so the callback page needs JavaScript
+ * to extract it and POST it to us.
+ */
+function renderCallbackPage(port) {
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <title>Meta Authentication</title>
+  <style>
+    body { font: 15px -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+           max-width: 480px; margin: 80px auto; padding: 0 24px; color: #222; }
+    h1 { font-size: 22px; margin-bottom: 12px; }
+    p { line-height: 1.5; }
+    .success { color: #16a34a; }
+    .error { color: #dc2626; }
+  </style>
+</head>
+<body>
+  <h1 id="title">Authenticating...</h1>
+  <p id="message">Processing your login...</p>
+  <script>
+    (function() {
+      var hash = window.location.hash.substring(1);
+      var params = new URLSearchParams(hash);
+      var token = params.get('access_token');
+      var state = params.get('state');
+      var error = params.get('error');
+      var errorDesc = params.get('error_description');
+
+      if (error) {
+        document.getElementById('title').textContent = 'Authorization denied';
+        document.getElementById('title').className = 'error';
+        document.getElementById('message').textContent = errorDesc || error;
+        return;
+      }
+
+      if (!token) {
+        document.getElementById('title').textContent = 'No token received';
+        document.getElementById('title').className = 'error';
+        document.getElementById('message').textContent = 'Facebook did not return an access token. Please try again.';
+        return;
+      }
+
+      // POST the token to our local server
+      fetch('http://127.0.0.1:${port}/token', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ access_token: token, state: state })
+      }).then(function(resp) {
+        if (resp.ok) {
+          document.getElementById('title').textContent = 'Signed in successfully';
+          document.getElementById('title').className = 'success';
+          document.getElementById('message').textContent = 'You can close this tab and return to the terminal.';
+        } else {
+          document.getElementById('title').textContent = 'Error';
+          document.getElementById('title').className = 'error';
+          document.getElementById('message').textContent = 'Failed to send token to local server.';
+        }
+      }).catch(function() {
+        document.getElementById('title').textContent = 'Error';
+        document.getElementById('title').className = 'error';
+        document.getElementById('message').textContent = 'Could not connect to local server.';
+      });
+    })();
+  </script>
+</body>
+</html>`;
+}
+function renderSimplePage(title, message, isError) {
+    const cls = isError ? "error" : "success";
+    return `<!DOCTYPE html>
+<html><head><meta charset="utf-8"><title>${escapeHtml(title)}</title>
+<style>body{font:15px -apple-system,sans-serif;max-width:480px;margin:80px auto;padding:0 24px;color:#222}h1{font-size:22px}.success{color:#16a34a}.error{color:#dc2626}</style>
+</head><body><h1 class="${cls}">${escapeHtml(title)}</h1><p>${escapeHtml(message)}</p></body></html>`;
+}
+function escapeHtml(s) {
+    return s.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+}
+async function waitForToken(port, expectedState, authUrl) {
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const finish = (fn) => { if (settled)
+            return; settled = true; fn(); };
+        const callbackHtml = renderCallbackPage(port);
+        const server = http.createServer((req, res) => {
+            if (!req.url) {
+                res.writeHead(404).end();
+                return;
+            }
+            const parsed = new URL(req.url, `http://127.0.0.1:${port}`);
+            // Serve the callback page (Facebook redirects here with #access_token=...)
+            if (parsed.pathname === "/callback" || parsed.pathname === "/") {
+                res.writeHead(200, {
+                    "Content-Type": "text/html; charset=utf-8",
+                    "Access-Control-Allow-Origin": "*",
+                });
+                res.end(callbackHtml);
+                return;
+            }
+            // CORS preflight for the POST
+            if (req.method === "OPTIONS" && parsed.pathname === "/token") {
+                res.writeHead(200, {
+                    "Access-Control-Allow-Origin": "*",
+                    "Access-Control-Allow-Methods": "POST",
+                    "Access-Control-Allow-Headers": "Content-Type",
+                });
+                res.end();
+                return;
+            }
+            // Receive the token POSTed by the callback page's JavaScript
+            if (req.method === "POST" && parsed.pathname === "/token") {
+                let body = "";
+                req.on("data", (chunk) => { body += chunk; });
+                req.on("end", () => {
+                    try {
+                        const data = JSON.parse(body);
+                        if (!data.access_token) {
+                            res.writeHead(400, { "Content-Type": "text/plain", "Access-Control-Allow-Origin": "*" });
+                            res.end("Missing access_token");
+                            return;
+                        }
+                        if (data.state !== expectedState) {
+                            res.writeHead(400, { "Content-Type": "text/plain", "Access-Control-Allow-Origin": "*" });
+                            res.end("State mismatch");
+                            finish(() => { server.close(); reject(new Error("OAuth state mismatch")); });
+                            return;
+                        }
+                        res.writeHead(200, { "Content-Type": "text/plain", "Access-Control-Allow-Origin": "*" });
+                        res.end("OK");
+                        finish(() => {
+                            setTimeout(() => server.close(), 200);
+                            resolve({ access_token: data.access_token, state: data.state || "" });
+                        });
+                    }
+                    catch {
+                        res.writeHead(400, { "Content-Type": "text/plain", "Access-Control-Allow-Origin": "*" });
+                        res.end("Invalid JSON");
+                    }
+                });
+                return;
+            }
+            res.writeHead(404).end();
+        });
+        server.on("error", (err) => {
+            finish(() => reject(new Error(`Loopback server failed: ${err.message}`)));
+        });
+        server.listen(port, "127.0.0.1", () => {
+            process.stderr.write(`\nOpening your browser to sign in with Facebook...\n`);
+            process.stderr.write(`If it doesn't open automatically, visit:\n  ${authUrl}\n\n`);
+            openBrowser(authUrl).catch(() => { });
+        });
+        setTimeout(() => {
+            finish(() => { server.close(); reject(new Error("Timed out waiting for OAuth callback (5 minutes).")); });
+        }, 5 * 60 * 1000);
+    });
+}
+async function exchangeForLongLivedToken(shortLivedToken, appId, appSecret) {
+    const params = new URLSearchParams({
+        grant_type: "fb_exchange_token",
+        client_id: appId,
+        client_secret: appSecret,
+        fb_exchange_token: shortLivedToken,
+    });
+    const res = await fetch(`${META_GRAPH_URL}/oauth/access_token?${params.toString()}`);
+    const json = (await res.json());
+    if (!res.ok || json.error) {
+        const errMsg = json.error?.message || json.error || res.statusText;
+        throw new Error(`Long-lived token exchange failed: ${errMsg}`);
+    }
+    if (!json.access_token) {
+        throw new Error("No access_token in exchange response");
+    }
+    return {
+        access_token: json.access_token,
+        token_type: json.token_type || "bearer",
+        expires_in: json.expires_in || 5184000,
+    };
+}
+// ============================================
+// VERIFY TOKEN + GET USER INFO
+// ============================================
+async function verifyToken(token) {
+    const res = await fetch(`${META_GRAPH_URL}/me?access_token=${encodeURIComponent(token)}`);
+    const json = (await res.json());
+    if (!res.ok || json.error) {
+        throw new Error(`Token verification failed: ${json.error?.message || json.error || res.statusText}`);
+    }
+    return { name: json.name || "Unknown", id: json.id || "" };
+}
+async function listAdAccounts(token) {
+    const res = await fetch(`${META_GRAPH_URL}/me/adaccounts?fields=name,account_id&limit=100&access_token=${encodeURIComponent(token)}`);
+    const json = (await res.json());
+    if (!res.ok || json.error) {
+        throw new Error(`Failed to list ad accounts: ${json.error?.message || res.statusText}`);
+    }
+    return (json.data || []).map((a) => ({
+        id: a.id,
+        name: a.name || `(unnamed ${a.account_id})`,
+        account_id: a.account_id,
+    }));
+}
+// ============================================
+// MAIN
+// ============================================
+export async function run(argv = process.argv.slice(2)) {
+    const args = parseArgs(argv);
+    if (args.help) {
+        printHelp();
+        return;
+    }
+    const appId = (process.env.META_APP_ID ?? "").trim();
+    const appSecret = (process.env.META_APP_SECRET ?? "").trim();
+    if (!appId) {
+        process.stderr.write("META_APP_ID environment variable is required.\n" +
+            "Get your App ID from https://developers.facebook.com/apps/\n");
+        process.exit(2);
+    }
+    if (!appSecret) {
+        process.stderr.write("META_APP_SECRET environment variable is required for long-lived token exchange.\n" +
+            "Find it in your Facebook App settings under App Secret.\n");
+        process.exit(2);
+    }
+    const port = await findFreeLoopbackPort();
+    const redirectUri = `http://127.0.0.1:${port}/callback`;
+    const state = randomState();
+    const authUrl = buildAuthUrl(appId, redirectUri, state);
+    process.stderr.write("\n=== Meta Ads authentication ===\n");
+    const { access_token: shortLivedToken } = await waitForToken(port, state, authUrl);
+    process.stderr.write("Short-lived token received. Exchanging for long-lived token...\n");
+    const longLived = await exchangeForLongLivedToken(shortLivedToken, appId, appSecret);
+    const expiryDays = Math.round(longLived.expires_in / 86400);
+    process.stderr.write(`Long-lived token obtained (expires in ~${expiryDays} days).\n`);
+    process.stderr.write("Verifying token...\n");
+    const user = await verifyToken(longLived.access_token);
+    process.stderr.write("Fetching accessible ad accounts...\n");
+    const accounts = await listAdAccounts(longLived.access_token);
+    const stored = {
+        version: CREDENTIALS_FILE_VERSION,
+        access_token: longLived.access_token,
+        expires_in: longLived.expires_in,
+        obtained_at: new Date().toISOString(),
+        created_at: Math.floor(Date.now() / 1000),
+        user_name: user.name,
+        user_id: user.id,
+        ad_accounts: accounts.map((a) => ({ id: a.id, name: a.name, account_id: a.account_id })),
+    };
+    writeStoredCredentials(stored);
+    const expiryDate = new Date(Date.now() + longLived.expires_in * 1000).toISOString().slice(0, 10);
+    process.stderr.write([
+        "",
+        "Done.",
+        "",
+        `  User:        ${user.name} (${user.id})`,
+        `  Ad accounts: ${accounts.length} accessible`,
+        ...accounts.slice(0, 5).map((a) => `               - ${a.name} (${a.account_id})`),
+        accounts.length > 5 ? `               ... and ${accounts.length - 5} more` : "",
+        `  Expires:     ~${expiryDate} (${expiryDays} days)`,
+        `  Saved to:    ${credentialsFilePath}`,
+        "",
+        "Next step: fully quit Claude Desktop (Cmd+Q / File > Exit) and reopen it.",
+        'Then try: "Get Meta ad performance for last 7 days"',
+        "",
+        `Note: This token expires in ~${expiryDays} days. Re-run this command to refresh.`,
+        "For permanent access, use a System User token and set META_ACCESS_TOKEN.",
+        "",
+    ].filter(Boolean).join("\n"));
+}
+function randomState() {
+    const bytes = new Uint8Array(16);
+    globalThis.crypto.getRandomValues(bytes);
+    return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+const isMain = import.meta.url === `file://${process.argv[1]}` ||
+    process.argv[1]?.endsWith("/auth-cli.js") ||
+    process.argv[1]?.endsWith("\\auth-cli.js");
+if (isMain) {
+    run().catch((err) => {
+        process.stderr.write(`\n${err.message}\n`);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=auth-cli.js.map

package/dist/auth-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-cli.js","sourceRoot":"","sources":["../src/auth-cli.ts"],"names":[],"mappings":";AACA,+CAA+C;AAC/C,uEAAuE;AACvE,+CAA+C;AAC/C,QAAQ;AACR,6CAA6C;AAC7C,kFAAkF;AAClF,uFAAuF;AACvF,kFAAkF;AAClF,2EAA2E;AAC3E,EAAE;AACF,6BAA6B;AAC7B,mFAAmF;AACnF,+DAA+D;AAE/D,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC;AAC1B,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,wBAAwB,EAA0B,MAAM,kBAAkB,CAAC;AACjI,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAElE,MAAM,kBAAkB,GAAG,OAAO,CAAC;AACnC,MAAM,aAAa,GAAG,4BAA4B,kBAAkB,eAAe,CAAC;AACpF,MAAM,cAAc,GAAG,8BAA8B,kBAAkB,EAAE,CAAC;AAC1E,MAAM,UAAU,GAAG,mFAAmF,CAAC;AAEvG,SAAS,SAAS,CAAC,IAAc;IAC/B,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB;QACE,uEAAuE;QACvE,EAAE;QACF,QAAQ;QACR,wDAAwD;QACxD,EAAE;QACF,UAAU;QACV,gCAAgC;QAChC,EAAE;QACF,+BAA+B,mBAAmB,EAAE;QACpD,EAAE;QACF,qDAAqD;QACrD,oDAAoD;QACpD,2EAA2E;QAC3E,sDAAsD;QACtD,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;AACJ,CAAC;AAED,+CAA+C;AAC/C,mDAAmD;AACnD,+CAA+C;AAE/C,SAAS,YAAY,CAAC,KAAa,EAAE,WAAmB,EAAE,KAAa;IACrE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,SAAS,EAAE,KAAK;QAChB,YAAY,EAAE,WAAW;QACzB,aAAa,EAAE,OAAO;QACtB,KAAK,EAAE,UAAU;QACjB,KAAK;KACN,CAAC,CAAC;IACH,OAAO,GAAG,aAAa,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAyCuB,IAAI;;;;;;;;;;;;;;;;;;;;;;QAsB5B,CAAC;AACT,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,OAAe,EAAE,OAAgB;IACxE,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1C,OAAO;2CACkC,UAAU,CAAC,KAAK,CAAC;;0BAElC,GAAG,KAAK,UAAU,CAAC,KAAK,CAAC,WAAW,UAAU,CAAC,OAAO,CAAC,oBAAoB,CAAC;AACtG,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;AACrH,CAAC;AAOD,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,aAAqB,EAAE,OAAe;IAC9E,OAAO,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACpD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,EAAc,EAAE,EAAE,GAAG,IAAI,OAAO;YAAE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAClF,MAAM,YAAY,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAE9C,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5C,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;gBAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBAAC,OAAO;YAAC,CAAC;YACnD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;YAE5D,2EAA2E;YAC3E,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;gBAC/D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;oBACjB,cAAc,EAAE,0BAA0B;oBAC1C,6BAA6B,EAAE,GAAG;iBACnC,CAAC,CAAC;gBACH,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBACtB,OAAO;YACT,CAAC;YAED,8BAA8B;YAC9B,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC7D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;oBACjB,6BAA6B,EAAE,GAAG;oBAClC,8BAA8B,EAAE,MAAM;oBACtC,8BAA8B,EAAE,cAAc;iBAC/C,CAAC,CAAC;gBACH,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YAED,6DAA6D;YAC7D,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1D,IAAI,IAAI,GAAG,EAAE,CAAC;gBACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACjB,IAAI,CAAC;wBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA8C,CAAC;wBAC3E,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;4BACvB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,6BAA6B,EAAE,GAAG,EAAE,CAAC,CAAC;4BACzF,GAAG,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;4BAChC,OAAO;wBACT,CAAC;wBACD,IAAI,IAAI,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;4BACjC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,6BAA6B,EAAE,GAAG,EAAE,CAAC,CAAC;4BACzF,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;4BAC1B,MAAM,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;4BAC7E,OAAO;wBACT,CAAC;wBACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,6BAA6B,EAAE,GAAG,EAAE,CAAC,CAAC;wBACzF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;wBACd,MAAM,CAAC,GAAG,EAAE;4BACV,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;4BACtC,OAAO,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAa,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC;wBACzE,CAAC,CAAC,CAAC;oBACL,CAAC;oBAAC,MAAM,CAAC;wBACP,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,6BAA6B,EAAE,GAAG,EAAE,CAAC,CAAC;wBACzF,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;oBAC1B,CAAC;gBACH,CAAC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;YACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;YAC7E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,OAAO,MAAM,CAAC,CAAC;YACnF,WAAW,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,UAAU,CAAC,GAAG,EAAE;YACd,MAAM,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5G,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC;AAYD,KAAK,UAAU,yBAAyB,CACtC,eAAuB,EACvB,KAAa,EACb,SAAiB;IAEjB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,UAAU,EAAE,mBAAmB;QAC/B,SAAS,EAAE,KAAK;QAChB,aAAa,EAAE,SAAS;QACxB,iBAAiB,EAAE,eAAe;KACnC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,cAAc,uBAAuB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACrF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;IAE3D,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAI,IAAI,CAAC,KAAa,EAAE,OAAO,IAAI,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAsB;QACzC,UAAU,EAAG,IAAI,CAAC,UAAqB,IAAI,QAAQ;QACnD,UAAU,EAAG,IAAI,CAAC,UAAqB,IAAI,OAAO;KACnD,CAAC;AACJ,CAAC;AAED,+CAA+C;AAC/C,+BAA+B;AAC/B,+CAA+C;AAE/C,KAAK,UAAU,WAAW,CAAC,KAAa;IACtC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,cAAc,oBAAoB,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC3D,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,8BAA+B,IAAI,CAAC,KAAa,EAAE,OAAO,IAAI,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAChH,CAAC;IACD,OAAO,EAAE,IAAI,EAAG,IAAI,CAAC,IAAe,IAAI,SAAS,EAAE,EAAE,EAAG,IAAI,CAAC,EAAa,IAAI,EAAE,EAAE,CAAC;AACrF,CAAC;AAYD,KAAK,UAAU,cAAc,CAAC,KAAa;IACzC,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,cAAc,gEAAgE,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAC7G,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC3D,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,+BAAgC,IAAI,CAAC,KAAa,EAAE,OAAO,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,CAAE,IAAI,CAAC,IAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9C,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,YAAY,CAAC,CAAC,UAAU,GAAG;QAC3C,UAAU,EAAE,CAAC,CAAC,UAAU;KACzB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,+CAA+C;AAC/C,OAAO;AACP,+CAA+C;AAE/C,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAiB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAAC,SAAS,EAAE,CAAC;QAAC,OAAO;IAAC,CAAC;IAEvC,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAE7D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iDAAiD;YAC/C,8DAA8D,CACjE,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mFAAmF;YACjF,2DAA2D,CAC9D,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC1C,MAAM,WAAW,GAAG,oBAAoB,IAAI,WAAW,CAAC;IACxD,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IAExD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAE5D,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACnF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;IAEzF,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,eAAe,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACrF,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,GAAG,KAAK,CAAC,CAAC;IAC5D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,UAAU,WAAW,CAAC,CAAC;IAEtF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAEvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAE9D,MAAM,MAAM,GAAsB;QAChC,OAAO,EAAE,wBAAwB;QACjC,YAAY,EAAE,SAAS,CAAC,YAAY;QACpC,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QACzC,SAAS,EAAE,IAAI,CAAC,IAAI;QACpB,OAAO,EAAE,IAAI,CAAC,EAAE;QAChB,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;KACzF,CAAC;IACF,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEjG,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB;QACE,EAAE;QACF,OAAO;QACP,EAAE;QACF,kBAAkB,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,GAAG;QAC1C,kBAAkB,QAAQ,CAAC,MAAM,aAAa;QAC9C,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,UAAU,GAAG,CAAC;QAClF,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,0BAA0B,QAAQ,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;QAC/E,mBAAmB,UAAU,KAAK,UAAU,QAAQ;QACpD,kBAAkB,mBAAmB,EAAE;QACvC,EAAE;QACF,2EAA2E;QAC3E,qDAAqD;QACrD,EAAE;QACF,gCAAgC,UAAU,wCAAwC;QAClF,0EAA0E;QAC1E,EAAE;KACH,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC7B,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,MAAM,GACV,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,cAAc,CAAC;IACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC;AAE7C,IAAI,MAAM,EAAE,CAAC;IACX,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/credentials.d.ts

@@ -0,0 +1,25 @@
+export declare const CREDENTIALS_FILE_VERSION = 1;
+export interface StoredCredentials {
+    version: number;
+    access_token: string;
+    expires_in: number;
+    obtained_at: string;
+    created_at: number;
+    user_name?: string;
+    user_id?: string;
+    ad_accounts?: Array<{
+        id: string;
+        name: string;
+        account_id: string;
+    }>;
+}
+export interface ResolvedCredentials {
+    access_token: string;
+    source: "env" | "file";
+    expires_at?: number;
+}
+export declare function readStoredCredentials(filePath?: string): StoredCredentials | null;
+export declare function writeStoredCredentials(creds: StoredCredentials, filePath?: string): void;
+export declare function resolveCredentials(credsFilePath?: string): ResolvedCredentials;
+export { configDir, credentialsFilePath } from "./platform.js";
+//# sourceMappingURL=credentials.d.ts.map

package/dist/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAE1C,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACvE;AAED,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AASD,wBAAgB,qBAAqB,CAAC,QAAQ,GAAE,MAA4B,GAAG,iBAAiB,GAAG,IAAI,CAUtG;AAED,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,iBAAiB,EACxB,QAAQ,GAAE,MAA4B,GACrC,IAAI,CAON;AAMD,wBAAgB,kBAAkB,CAChC,aAAa,GAAE,MAA4B,GAC1C,mBAAmB,CAqCrB;AA6BD,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC"}

package/dist/credentials.js

@@ -0,0 +1,101 @@
+// ============================================
+// CREDENTIAL LOADING & PERSISTENCE
+// ============================================
+// Priority order:
+//   1. META_ACCESS_TOKEN env var (System User token -- never expires, recommended)
+//   2. Cached OAuth token from mcp-meta-ads-auth (long-lived, ~60 days)
+//
+// System User tokens are preferred for production. OAuth is the fallback
+// for users who don't have Business Manager admin access.
+import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from "fs";
+import path from "path";
+import { credentialsFilePath } from "./platform.js";
+export const CREDENTIALS_FILE_VERSION = 1;
+const envTrimmed = (key) => (process.env[key] || "").trim().replace(/^["']|["']$/g, "");
+// ============================================
+// FILE I/O
+// ============================================
+export function readStoredCredentials(filePath = credentialsFilePath) {
+    if (!existsSync(filePath))
+        return null;
+    try {
+        const raw = readFileSync(filePath, "utf-8");
+        const parsed = JSON.parse(raw);
+        if (parsed.version !== CREDENTIALS_FILE_VERSION)
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+export function writeStoredCredentials(creds, filePath = credentialsFilePath) {
+    const dir = path.dirname(filePath);
+    if (!existsSync(dir)) {
+        mkdirSync(dir, { recursive: true });
+    }
+    writeFileSync(filePath, JSON.stringify(creds, null, 2), { encoding: "utf-8" });
+    try {
+        chmodSync(filePath, 0o600);
+    }
+    catch { }
+}
+// ============================================
+// RESOLVE (read-time priority chain)
+// ============================================
+export function resolveCredentials(credsFilePath = credentialsFilePath) {
+    // 1. Environment variable takes absolute priority (System User token)
+    const envToken = envTrimmed("META_ACCESS_TOKEN");
+    if (envToken) {
+        return { access_token: envToken, source: "env" };
+    }
+    // 2. Cached OAuth token from auth CLI
+    const stored = readStoredCredentials(credsFilePath);
+    if (stored?.access_token) {
+        const expiresAt = stored.created_at + stored.expires_in;
+        const now = Math.floor(Date.now() / 1000);
+        if (now >= expiresAt) {
+            // Token expired
+            throw new Error(buildExpiredMessage(stored));
+        }
+        const daysLeft = Math.round((expiresAt - now) / 86400);
+        if (daysLeft <= 7) {
+            process.stderr.write(`[warning] Meta OAuth token expires in ${daysLeft} day(s). ` +
+                `Re-run: npx -p mcp-meta-ads-incrementality mcp-meta-ads-auth\n`);
+        }
+        return {
+            access_token: stored.access_token,
+            source: "file",
+            expires_at: expiresAt,
+        };
+    }
+    // 3. Nothing found
+    throw new Error(buildMissingMessage());
+}
+function buildExpiredMessage(stored) {
+    return [
+        `Meta OAuth token has expired (obtained ${stored.obtained_at}).`,
+        ``,
+        `To re-authenticate, run:`,
+        `    npx -p mcp-meta-ads-incrementality mcp-meta-ads-auth`,
+        ``,
+        `Or for permanent access, set META_ACCESS_TOKEN to a System User token`,
+        `from Meta Business Manager (never expires).`,
+    ].join("\n");
+}
+function buildMissingMessage() {
+    return [
+        `No Meta access token found.`,
+        ``,
+        `Option 1 (recommended): System User token`,
+        `  Create one at business.facebook.com > Business Settings > System Users`,
+        `  Then set META_ACCESS_TOKEN in your environment.`,
+        ``,
+        `Option 2: Browser sign-in (expires in ~60 days)`,
+        `  Run: npx -p mcp-meta-ads-incrementality mcp-meta-ads-auth`,
+        ``,
+        `Credentials are stored at: ${credentialsFilePath}`,
+    ].join("\n");
+}
+export { configDir, credentialsFilePath } from "./platform.js";
+//# sourceMappingURL=credentials.js.map