flowstate-auth-core Package Skill

Package: @epicdm/flowstate-auth-core Repository: epic-flowstate-community Path: packages/flowstate-auth-core Version: 1.0.8

Use this published Dojo skill as the package-level entrypoint. For detailed workflows, use the package-local skills listed below.

Primary Package Workflow

CLI Profile Auth

Use this skill when changing CLIAuthService, ConfigManager, StoredAuth, server profiles, or getValidAccessToken.

ConfigManager

ConfigManager reads and writes:

~/.flowstate/config.json

The directory is created with 0700 and config file with 0600.

Tests and examples should inject new ConfigManager(tempDir) instead of writing to the real home directory.

ServerProfile Fields

Important fields include:

• url
• domainId
• authUrl for api_token grant
• oauthTokenUrl and oauthClientId for OAuth refresh
• mcpUrl
• auth

getValidAccessToken

Refresh order:

1. Return current access token when it has at least 60 seconds remaining.
2. Exchange serviceToken at authUrl with grant_type=api_token.
3. Exchange OAuth refreshToken at oauthTokenUrl with form-encoded grant_type=refresh_token.
4. Use legacy local {profile.url}/auth/refresh JSON body when only local refresh material exists.

The legacy path intentionally does not migrate the profile to OAuth token URL because local deployments may reject the OAuth client.

Watch Outs

• Error messages include login hints; keep them user-facing.
• Persist refreshed auth back to the same server profile.
• Do not flatten all refresh flows into one generic refresh-token path.

Package Skill Inventory

Package Skill Inventory: @epicdm/flowstate-auth-core

Package path: packages/flowstate-auth-core.

Skill Map

Anti-Sprawl Decision

Do not create one skill per schema, helper, error class, or adapter method. The real workflows are token management, storage adapter contracts, CLI profile auth, and contract lookup.

Review Gate

Package Skill Review: @epicdm/flowstate-auth-core

Package path: packages/flowstate-auth-core.

Review Result

Status: drafted, source-backed, verified, pending publication.

The skillset is workflow-shaped around token workflows, storage adapter contracts, CLI profile auth, and auth contract references.

Checks

• Source review: completed from exports, token manager, storage adapter interface, config manager, token refresh helper, downstream references, and generated artifact drift.
• Skill inventory: completed.
• Skill files: completed.
• ASCII/frontmatter scan: passed.
• Package tests: passed, 18 suites and 261 tests.
• Package typecheck: passed.
• Package build: passed.
• Package lint: passed with 244 existing warnings.
• Generated Dojo replacement: pending.
• Cloud Dojo publication: pending.

Verification Commands

Run before publication:

yarn workspace @epicdm/flowstate-auth-core test
yarn workspace @epicdm/flowstate-auth-core typecheck
yarn workspace @epicdm/flowstate-auth-core build
yarn workspace @epicdm/flowstate-auth-core lint

Publication Gate

Do not publish existing .flowstate/dojo artifacts until they are rebuilt from reviewed package skills.

Start with this skill to understand the package purpose, then use the package-local focused skills for specific workflows. Keep this Dojo version aligned with packages/flowstate-auth-core/package.json. Do not treat generated feature lists as lessons; use workflow evidence from CODE-REVIEW.md, SKILL-INVENTORY.md, and REVIEW.md.