Profiles and credentials

Classes

ProfileManager: Named server configuration shared by command-line and MCP consumers. Config and credential I/O rejects with T3StorageError (code: storage); transport failures retain connection and rejected credentials retain auth_invalid.

Functions

Create an isolated in-memory credential store.

export function memoryCredentialStore(initial: StoredCredentials = {}): CredentialStore;

fileCredentialStore()

Create an atomic JSON credential store with 0600 files; the parent directory must exist.

export function fileCredentialStore(path: string): CredentialStore;

ProfileManager

Named server configuration shared by command-line and MCP consumers. Config and credential I/O rejects with T3StorageError (code: storage); transport failures retain connection and rejected credentials retain auth_invalid.

Kind: global class

ProfileManager

profileManager.list()

List configured servers without loading their credentials.

async list(): Promise<Profile[]>;

Kind: instance method of ProfileManager

profileManager.getCurrent()

Return the current profile, or undefined before one is selected.

async getCurrent(): Promise<Profile | undefined>;

Kind: instance method of ProfileManager

profileManager.resolveProfile()

Resolve one exact named profile without applying flag or environment overrides.

async resolveProfile(name: string): Promise<ResolvedProfile>;

Kind: instance method of ProfileManager
Throws:

T3NotFoundError The named profile does not exist.

profileManager.resolve()

Resolve flags, environment and current profile into connection options.

async resolve(options: ProfileResolveOptions = {}): Promise<ResolvedProfile>;

Kind: instance method of ProfileManager

profileManager.pair()

Exchange a pairing token, then register its profile; first success selects current.

async pair(
    profile: Profile,
    pairingToken: string,
    options?: ExchangePairingTokenOptions,
  ): Promise<Profile>;

Kind: instance method of ProfileManager

profileManager.setAccessToken()

Validate an issued session token, then register its profile.

async setAccessToken(profile: Profile, token: string): Promise<Profile>;

Kind: instance method of ProfileManager

profileManager.switch()

Select an existing profile without changing its credentials.

async switch(name: string): Promise<void>;

Kind: instance method of ProfileManager

profileManager.logout()

Remove a profile and clear its local credential; does not revoke the server session.

async logout(name?: string): Promise<void>;

Kind: instance method of ProfileManager

memoryCredentialStore()

Create an isolated in-memory credential store.

export function memoryCredentialStore(initial: StoredCredentials = {}): CredentialStore;

Kind: global function

fileCredentialStore()

Create an atomic JSON credential store with 0600 files; the parent directory must exist.

export function fileCredentialStore(path: string): CredentialStore;

Kind: global function

Profile and credential types

export interface CredentialStore {
  /** Read the saved credential, or an empty object when absent. */
  load(): Promise<StoredCredentials>;
  /** Persist validated credential metadata. */
  save(credentials: StoredCredentials): Promise<void>;
  /** Forget the local credential without revoking the server session. */
  clear(): Promise<void>;
}

export interface StoredCredentials {
  accessToken?: string;
  /** As granted by the server; may include a scope this client does not know. */
  scopes?: AuthGrantedScopeType[];
  expiresAt?: string;
  sessionMethod?: ServerAuthSessionMethodType;
  /** Present for a proof-bound session: every request signs a DPoP proof with this key. */
  dpopKey?: DpopPrivateJwkType;
}

export interface ProfileManagerOptions {
  readonly configDir?: string;
  readonly credentialSource?: CredentialSource;
  readonly clientOptions?: Omit<T3ClientOptions, "baseUrl" | "credentials" | "accessToken">;
}

export interface ProfileResolveOptions {
  readonly server?: string;
  readonly credentialsFile?: string;
  readonly env?: NodeJS.ProcessEnv;
}

export interface ResolvedProfile {
  readonly baseUrl: string;
  readonly credentials: CredentialStore;
  readonly profile?: Profile;
  readonly sources: {
    readonly server: "flag" | "environment" | "profile";
    readonly credentials: "file" | "environment" | "profile" | "none";
  };
}

export type CredentialSource = (
  profile: Profile,
  defaultCredentialPath: string,
) => CredentialStore | Promise<CredentialStore>;

export interface Profile {
  readonly name: string;
  readonly url: string;
}

export interface ProfileConfig {
  servers: Record<string, { url: string }>;
  current?: string;
}