From 532ca96dd0a99b705b5d01242f0b34364fa9bfd7 Mon Sep 17 00:00:00 2001
From: lorentz <lorentz@wulfconsulting.com>
Date: Fri, 10 Jul 2026 17:33:56 -0400
Subject: [PATCH] feat(10-01): implement pax8-factory config check + singleton

- isPax8Configured(): both PAX8_CLIENT_ID and PAX8_CLIENT_SECRET required
- getPax8Client(): throws exact error naming both env vars when missing;
  caches singleton Pax8Client instance
- _resetPax8Client(): test seam to clear the cached singleton
- follows appgate-factory.ts / 10-RESEARCH.md Pattern 2 verbatim
---
 lib/services/pax8-factory.ts | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 lib/services/pax8-factory.ts

diff --git a/lib/services/pax8-factory.ts b/lib/services/pax8-factory.ts
new file mode 100644
index 0000000..342a0fa
--- /dev/null
+++ b/lib/services/pax8-factory.ts
@@ -0,0 +1,25 @@
+import { Pax8Client } from './pax8-client';
+
+let _client: Pax8Client | null = null;
+
+export function isPax8Configured(): boolean {
+  return Boolean(process.env.PAX8_CLIENT_ID && process.env.PAX8_CLIENT_SECRET);
+}
+
+export function getPax8Client(): Pax8Client {
+  if (_client) return _client;
+  if (!isPax8Configured()) {
+    throw new Error('PAX8 is not configured — set PAX8_CLIENT_ID and PAX8_CLIENT_SECRET');
+  }
+  _client = new Pax8Client({
+    clientId: process.env.PAX8_CLIENT_ID!,
+    clientSecret: process.env.PAX8_CLIENT_SECRET!,
+  });
+  console.log('[PAX8] Client initialized');
+  return _client;
+}
+
+// Test seam — reset the cached client (e.g. after rotating credentials).
+export function _resetPax8Client(): void {
+  _client = null;
+}