@aaronsb/kg-cli 0.6.1

package/dist/lib/auth/auth-client.js

@@ -0,0 +1,305 @@
+"use strict";
+/**
+ * Authentication Client
+ *
+ * HTTP client for authentication endpoints.
+ * Wraps REST API calls to /auth/* endpoints.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthClient = void 0;
+const axios_1 = __importDefault(require("axios"));
+// Note: OAuthTokenResponse is imported from './oauth-types.js'
+// ========== Auth Client Class ==========
+class AuthClient {
+    constructor(baseUrl) {
+        this.client = axios_1.default.create({
+            baseURL: baseUrl,
+            headers: {
+                'Content-Type': 'application/json'
+            }
+        });
+    }
+    // ========== Public Endpoints (No Auth) ==========
+    /**
+     * Login with username/password (OAuth2 password flow)
+     *
+     * @deprecated Use createPersonalOAuthClient() instead (ADR-054 unified OAuth)
+     * @param request Username and password
+     * @returns JWT token and user details
+     * @throws 401 if credentials invalid, 400 if validation fails
+     */
+    async login(request) {
+        // OAuth2 password flow requires application/x-www-form-urlencoded
+        const formData = new URLSearchParams();
+        formData.append('username', request.username);
+        formData.append('password', request.password);
+        const response = await this.client.post('/auth/login', formData, {
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded'
+            }
+        });
+        return response.data;
+    }
+    /**
+     * Create a personal OAuth client (ADR-054 - GitHub CLI-style authentication)
+     *
+     * This is the preferred authentication method for CLI tools.
+     * Flow:
+     * 1. User provides username + password
+     * 2. Server creates long-lived OAuth client credentials
+     * 3. Client stores client_id + client_secret
+     * 4. Future requests use client credentials grant
+     *
+     * @param request Username, password, and optional client name/scope
+     * @returns OAuth client credentials (client_secret shown only once!)
+     * @throws 401 if credentials invalid, 400 if validation fails
+     */
+    async createPersonalOAuthClient(request) {
+        // OAuth endpoint requires application/x-www-form-urlencoded
+        const formData = new URLSearchParams();
+        formData.append('username', request.username);
+        formData.append('password', request.password);
+        if (request.client_name) {
+            formData.append('client_name', request.client_name);
+        }
+        if (request.scope) {
+            formData.append('scope', request.scope);
+        }
+        const response = await this.client.post('/auth/oauth/clients/personal', formData, {
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded'
+            }
+        });
+        return response.data;
+    }
+    /**
+     * Get OAuth access token using client credentials grant (ADR-054)
+     *
+     * Use this after creating a personal OAuth client to get access tokens.
+     * Access tokens are short-lived and should be refreshed as needed.
+     *
+     * @param request Client credentials (client_id, client_secret)
+     * @returns OAuth access token
+     * @throws 401 if client credentials invalid
+     */
+    async getOAuthToken(request) {
+        const formData = new URLSearchParams();
+        formData.append('grant_type', 'client_credentials');
+        formData.append('client_id', request.client_id);
+        formData.append('client_secret', request.client_secret);
+        if (request.scope) {
+            formData.append('scope', request.scope);
+        }
+        const response = await this.client.post('/auth/oauth/token', formData, {
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded'
+            }
+        });
+        return response.data;
+    }
+    /**
+     * Delete a personal OAuth client (ADR-054)
+     *
+     * Called by `kg logout` to revoke OAuth credentials.
+     * Requires authentication with a valid access token.
+     *
+     * @param token Access token for authentication
+     * @param clientId Client ID to delete
+     * @throws 401 if token invalid, 403 if not owner, 404 if client not found
+     */
+    async deletePersonalOAuthClient(token, clientId) {
+        await this.client.delete(`/auth/oauth/clients/personal/${clientId}`, {
+            headers: {
+                Authorization: `Bearer ${token}`
+            }
+        });
+    }
+    /**
+     * Register new user
+     *
+     * Note: In production, this endpoint may be restricted to admins.
+     * For now, it's public to allow initial user creation.
+     *
+     * @param request User creation details
+     * @returns Created user details
+     * @throws 400 if validation fails, 409 if username taken
+     */
+    async register(request) {
+        const response = await this.client.post('/auth/register', request);
+        return response.data;
+    }
+    // ========== Authenticated Endpoints (JWT Required) ==========
+    /**
+     * Validate current token and get user profile
+     *
+     * @param token JWT access token
+     * @returns Current user details
+     * @throws 401 if token invalid/expired
+     */
+    async validateToken(token) {
+        const response = await this.client.get('/auth/me', {
+            headers: {
+                Authorization: `Bearer ${token}`
+            }
+        });
+        return response.data;
+    }
+    /**
+     * Update current user profile
+     *
+     * @param token JWT access token
+     * @param updates Fields to update (username, password)
+     * @returns Updated user details
+     * @throws 401 if token invalid/expired, 400 if validation fails
+     */
+    async updateCurrentUser(token, updates) {
+        const response = await this.client.put('/auth/me', updates, {
+            headers: {
+                Authorization: `Bearer ${token}`
+            }
+        });
+        return response.data;
+    }
+    // ========== API Key Management ==========
+    /**
+     * Create API key for current user
+     *
+     * @param token JWT access token
+     * @param request API key details
+     * @returns API key response (includes plaintext key, shown only once!)
+     * @throws 401 if token invalid/expired
+     */
+    async createAPIKey(token, request) {
+        const response = await this.client.post('/auth/api-keys', request, {
+            headers: {
+                Authorization: `Bearer ${token}`
+            }
+        });
+        return response.data;
+    }
+    /**
+     * List API keys for current user
+     *
+     * @param token JWT access token
+     * @returns List of API keys
+     * @throws 401 if token invalid/expired
+     */
+    async listAPIKeys(token) {
+        const response = await this.client.get('/auth/api-keys', {
+            headers: {
+                Authorization: `Bearer ${token}`
+            }
+        });
+        return response.data;
+    }
+    /**
+     * Revoke API key
+     *
+     * @param token JWT access token
+     * @param keyId API key ID to revoke
+     * @throws 401 if token invalid/expired, 404 if key not found
+     */
+    async revokeAPIKey(token, keyId) {
+        await this.client.delete(`/auth/api-keys/${keyId}`, {
+            headers: {
+                Authorization: `Bearer ${token}`
+            }
+        });
+    }
+    // ========== Admin Endpoints (Role Check) ==========
+    /**
+     * List all users (admin only)
+     *
+     * @param token JWT access token (must be admin role)
+     * @param skip Number of users to skip (pagination)
+     * @param limit Maximum number of users to return
+     * @param role Filter by role
+     * @returns Paginated list of users
+     * @throws 401 if token invalid/expired, 403 if not admin
+     */
+    async listUsers(token, skip = 0, limit = 50, role) {
+        const params = { skip, limit };
+        if (role) {
+            params.role = role;
+        }
+        const response = await this.client.get('/users', {
+            params,
+            headers: {
+                Authorization: `Bearer ${token}`
+            }
+        });
+        return response.data;
+    }
+    /**
+     * Get user by ID (admin only)
+     *
+     * @param token JWT access token (must be admin role)
+     * @param userId User ID
+     * @returns User details
+     * @throws 401 if token invalid/expired, 403 if not admin, 404 if user not found
+     */
+    async getUser(token, userId) {
+        const response = await this.client.get(`/users/${userId}`, {
+            headers: {
+                Authorization: `Bearer ${token}`
+            }
+        });
+        return response.data;
+    }
+    /**
+     * Create user (admin only)
+     *
+     * Note: Uses /auth/register endpoint since there's no dedicated admin create endpoint.
+     * Admins can create users with any role.
+     *
+     * @param token JWT access token (must be admin role)
+     * @param request User creation details
+     * @returns Created user details
+     * @throws 401 if token invalid/expired, 403 if not admin, 400 if validation fails
+     */
+    async createUser(token, request) {
+        const response = await this.client.post('/auth/register', request, {
+            headers: {
+                Authorization: `Bearer ${token}`
+            }
+        });
+        return response.data;
+    }
+    /**
+     * Update user (admin only)
+     *
+     * @param token JWT access token (must be admin role)
+     * @param userId User ID to update
+     * @param request Fields to update
+     * @returns Updated user details
+     * @throws 401 if token invalid/expired, 403 if not admin, 404 if user not found
+     */
+    async updateUser(token, userId, request) {
+        const response = await this.client.put(`/users/${userId}`, request, {
+            headers: {
+                Authorization: `Bearer ${token}`
+            }
+        });
+        return response.data;
+    }
+    /**
+     * Delete user (admin only, cannot delete self)
+     *
+     * @param token JWT access token (must be admin role)
+     * @param userId User ID to delete
+     * @throws 401 if token invalid/expired, 403 if not admin, 404 if user not found
+     * @throws 400 if trying to delete self
+     */
+    async deleteUser(token, userId) {
+        await this.client.delete(`/users/${userId}`, {
+            headers: {
+                Authorization: `Bearer ${token}`
+            }
+        });
+    }
+}
+exports.AuthClient = AuthClient;
+//# sourceMappingURL=auth-client.js.map

package/dist/lib/auth/auth-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-client.js","sourceRoot":"","sources":["../../../src/lib/auth/auth-client.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;AAEH,kDAA6C;AAqG7C,+DAA+D;AAE/D,0CAA0C;AAE1C,MAAa,UAAU;IAGrB,YAAY,OAAe;QACzB,IAAI,CAAC,MAAM,GAAG,eAAK,CAAC,MAAM,CAAC;YACzB,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;SACF,CAAC,CAAC;IACL,CAAC;IAED,mDAAmD;IAEnD;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,CAAC,OAAqB;QAC/B,kEAAkE;QAClE,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAC;QACvC,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9C,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAE9C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAgB,aAAa,EAAE,QAAQ,EAAE;YAC9E,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;aACpD;SACF,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,yBAAyB,CAAC,OAAiC;QAC/D,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAC;QACvC,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9C,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAE9C,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACrC,8BAA8B,EAC9B,QAAQ,EACR;YACE,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;aACpD;SACF,CACF,CAAC;QAEF,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,aAAa,CAAC,OAA0B;QAC5C,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAC;QACvC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QACpD,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAChD,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QAExD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACrC,mBAAmB,EACnB,QAAQ,EACR;YACE,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;aACpD;SACF,CACF,CAAC;QAEF,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,yBAAyB,CAAC,KAAa,EAAE,QAAgB;QAC7D,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,gCAAgC,QAAQ,EAAE,EAAE;YACnE,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;aACjC;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,QAAQ,CAAC,OAA0B;QACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAe,gBAAgB,EAAE,OAAO,CAAC,CAAC;QACjF,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,+DAA+D;IAE/D;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAe,UAAU,EAAE;YAC/D,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;aACjC;SACF,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,iBAAiB,CACrB,KAAa,EACb,OAAiD;QAEjD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAe,UAAU,EAAE,OAAO,EAAE;YACxE,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;aACjC;SACF,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,2CAA2C;IAE3C;;;;;;;OAOG;IACH,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,OAA4B;QAC5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAiB,gBAAgB,EAAE,OAAO,EAAE;YACjF,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;aACjC;SACF,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAqB,gBAAgB,EAAE;YAC3E,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;aACjC;SACF,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,KAAa;QAC7C,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,KAAK,EAAE,EAAE;YAClD,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;aACjC;SACF,CAAC,CAAC;IACL,CAAC;IAED,qDAAqD;IAErD;;;;;;;;;OASG;IACH,KAAK,CAAC,SAAS,CACb,KAAa,EACb,OAAe,CAAC,EAChB,QAAgB,EAAE,EAClB,IAAa;QAEb,MAAM,MAAM,GAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACpC,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;QACrB,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAmB,QAAQ,EAAE;YACjE,MAAM;YACN,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;aACjC;SACF,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,MAAc;QACzC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAe,UAAU,MAAM,EAAE,EAAE;YACvE,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;aACjC;SACF,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,OAA0B;QACxD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAe,gBAAgB,EAAE,OAAO,EAAE;YAC/E,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;aACjC;SACF,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,UAAU,CACd,KAAa,EACb,MAAc,EACd,OAA0B;QAE1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CACpC,UAAU,MAAM,EAAE,EAClB,OAAO,EACP;YACE,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;aACjC;SACF,CACF,CAAC;QAEF,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,MAAc;QAC5C,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,MAAM,EAAE,EAAE;YAC3C,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;aACjC;SACF,CAAC,CAAC;IACL,CAAC;CACF;AA9VD,gCA8VC"}

package/dist/lib/auth/challenge.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Authentication Challenge
+ *
+ * Re-authentication prompt for sensitive operations (e.g., delete user, reset database).
+ * Requires user to re-enter password before proceeding.
+ */
+import { AuthClient } from './auth-client.js';
+import { TokenManager, TokenInfo } from './token-manager.js';
+export interface ChallengeOptions {
+    reason: string;
+    username?: string;
+    allowCancel?: boolean;
+}
+export declare class AuthChallenge {
+    private authClient;
+    private tokenManager;
+    constructor(authClient: AuthClient, tokenManager: TokenManager);
+    /**
+     * Prompt user to re-authenticate for sensitive operation
+     *
+     * @param options Challenge options
+     * @returns New token on success, null on cancel
+     * @throws Error if authentication fails
+     */
+    challenge(options: ChallengeOptions): Promise<TokenInfo | null>;
+    /**
+     * Prompt for username
+     */
+    private promptUsername;
+    /**
+     * Prompt for password (hidden input)
+     */
+    private promptPassword;
+    /**
+     * Prompt to retry after failed authentication
+     */
+    private promptRetry;
+}
+//# sourceMappingURL=challenge.d.ts.map

package/dist/lib/auth/challenge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/challenge.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,UAAU,EAAgB,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE7D,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,qBAAa,aAAa;IAEtB,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,YAAY;gBADZ,UAAU,EAAE,UAAU,EACtB,YAAY,EAAE,YAAY;IAGpC;;;;;;OAMG;IACG,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAsDrE;;OAEG;YACW,cAAc;IAgB5B;;OAEG;YACW,cAAc;IAgB5B;;OAEG;YACW,WAAW;CAe1B"}

package/dist/lib/auth/challenge.js

@@ -0,0 +1,125 @@
+"use strict";
+/**
+ * Authentication Challenge
+ *
+ * Re-authentication prompt for sensitive operations (e.g., delete user, reset database).
+ * Requires user to re-enter password before proceeding.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthChallenge = void 0;
+const prompts_1 = __importDefault(require("prompts"));
+const token_manager_js_1 = require("./token-manager.js");
+class AuthChallenge {
+    constructor(authClient, tokenManager) {
+        this.authClient = authClient;
+        this.tokenManager = tokenManager;
+    }
+    /**
+     * Prompt user to re-authenticate for sensitive operation
+     *
+     * @param options Challenge options
+     * @returns New token on success, null on cancel
+     * @throws Error if authentication fails
+     */
+    async challenge(options) {
+        const allowCancel = options.allowCancel !== false;
+        console.log('');
+        console.log(`\x1b[33m⚠️  Authentication Challenge\x1b[0m`);
+        console.log(`   Reason: ${options.reason}`);
+        console.log('');
+        console.log('   For security, please re-enter your password to continue.');
+        if (allowCancel) {
+            console.log('   Press Ctrl+C to cancel.');
+        }
+        console.log('');
+        // Get username (use provided or prompt)
+        let username = options.username;
+        if (!username) {
+            username = await this.promptUsername();
+        }
+        else {
+            console.log(`   Username: ${username}`);
+        }
+        // Get password (always prompt, never pre-fill for security)
+        const password = await this.promptPassword();
+        // Validate credentials
+        try {
+            const loginResponse = await this.authClient.login({ username, password });
+            const tokenInfo = token_manager_js_1.TokenManager.fromLoginResponse(loginResponse);
+            console.log('   \x1b[32m✅ Authentication successful\x1b[0m');
+            console.log('');
+            return tokenInfo;
+        }
+        catch (error) {
+            if (error.response?.status === 401) {
+                console.error('   \x1b[31m❌ Authentication failed: Invalid username or password\x1b[0m');
+                console.log('');
+                // Allow retry
+                if (allowCancel) {
+                    const retry = await this.promptRetry();
+                    if (retry) {
+                        return this.challenge(options);
+                    }
+                }
+            }
+            else {
+                console.error('   \x1b[31m❌ Authentication failed:', error.message, '\x1b[0m');
+                console.log('');
+            }
+            return null;
+        }
+    }
+    /**
+     * Prompt for username
+     */
+    async promptUsername() {
+        const response = await (0, prompts_1.default)({
+            type: 'text',
+            name: 'username',
+            message: 'Username',
+        });
+        // Handle Ctrl+C
+        if (response.username === undefined) {
+            console.log('\nChallenge cancelled.');
+            process.exit(0);
+        }
+        return response.username;
+    }
+    /**
+     * Prompt for password (hidden input)
+     */
+    async promptPassword() {
+        const response = await (0, prompts_1.default)({
+            type: 'password',
+            name: 'password',
+            message: 'Password',
+        });
+        // Handle Ctrl+C
+        if (response.password === undefined) {
+            console.log('\nChallenge cancelled.');
+            process.exit(0);
+        }
+        return response.password;
+    }
+    /**
+     * Prompt to retry after failed authentication
+     */
+    async promptRetry() {
+        const response = await (0, prompts_1.default)({
+            type: 'confirm',
+            name: 'retry',
+            message: 'Retry?',
+            initial: false,
+        });
+        // Handle Ctrl+C
+        if (response.retry === undefined) {
+            return false;
+        }
+        return response.retry;
+    }
+}
+exports.AuthChallenge = AuthChallenge;
+//# sourceMappingURL=challenge.js.map

package/dist/lib/auth/challenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge.js","sourceRoot":"","sources":["../../../src/lib/auth/challenge.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;AAEH,sDAA8B;AAE9B,yDAA6D;AAQ7D,MAAa,aAAa;IACxB,YACU,UAAsB,EACtB,YAA0B;QAD1B,eAAU,GAAV,UAAU,CAAY;QACtB,iBAAY,GAAZ,YAAY,CAAc;IACjC,CAAC;IAEJ;;;;;;OAMG;IACH,KAAK,CAAC,SAAS,CAAC,OAAyB;QACvC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC;QAElD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,cAAc,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;QAC3E,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,wCAAwC;QACxC,IAAI,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,gBAAgB,QAAQ,EAAE,CAAC,CAAC;QAC1C,CAAC;QAED,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAE7C,uBAAuB;QACvB,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC1E,MAAM,SAAS,GAAG,+BAAY,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;YAEhE,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;YAC7D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAEhB,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,IAAI,KAAK,CAAC,QAAQ,EAAE,MAAM,KAAK,GAAG,EAAE,CAAC;gBACnC,OAAO,CAAC,KAAK,CAAC,yEAAyE,CAAC,CAAC;gBACzF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAEhB,cAAc;gBACd,IAAI,WAAW,EAAE,CAAC;oBAChB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;oBACvC,IAAI,KAAK,EAAE,CAAC;wBACV,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;oBACjC,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;gBAC/E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClB,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,cAAc;QAC1B,MAAM,QAAQ,GAAG,MAAM,IAAA,iBAAO,EAAC;YAC7B,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,UAAU;SACpB,CAAC,CAAC;QAEH,gBAAgB;QAChB,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,OAAO,QAAQ,CAAC,QAAQ,CAAC;IAC3B,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,cAAc;QAC1B,MAAM,QAAQ,GAAG,MAAM,IAAA,iBAAO,EAAC;YAC7B,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,UAAU;SACpB,CAAC,CAAC;QAEH,gBAAgB;QAChB,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,OAAO,QAAQ,CAAC,QAAQ,CAAC;IAC3B,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,WAAW;QACvB,MAAM,QAAQ,GAAG,MAAM,IAAA,iBAAO,EAAC;YAC7B,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QAEH,gBAAgB;QAChB,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,QAAQ,CAAC,KAAK,CAAC;IACxB,CAAC;CACF;AA3HD,sCA2HC"}

package/dist/lib/auth/client-credentials-flow.d.ts

@@ -0,0 +1,58 @@
+/**
+ * OAuth Client Credentials Grant Flow (ADR-054)
+ *
+ * Implements RFC 6749 Client Credentials Grant for machine-to-machine authentication (MCP server).
+ *
+ * Flow:
+ * 1. Exchange client_id + client_secret for access token
+ * 2. Use access token for API requests
+ * 3. Re-authenticate when token expires (no refresh token)
+ *
+ * Usage:
+ *   const flow = new ClientCredentialsFlow(apiUrl, clientId, clientSecret);
+ *   const tokenInfo = await flow.authenticate();
+ *   // Use tokenInfo.access_token for API requests
+ */
+import type { OAuthTokenInfo } from './oauth-types';
+export interface ClientCredentialsCallbacks {
+    onSuccess?: (tokenInfo: OAuthTokenInfo) => void;
+    onError?: (error: Error) => void;
+}
+export declare class ClientCredentialsFlow {
+    private client;
+    private clientId;
+    private clientSecret;
+    constructor(apiUrl: string, clientId: string | undefined, clientSecret: string);
+    /**
+     * Authenticate using client credentials
+     *
+     * POST /auth/oauth/token
+     * Body: grant_type=client_credentials&client_id=kg-mcp&client_secret=<secret>&scope=read:* write:*
+     *
+     * Returns access token (no refresh token for client_credentials grant)
+     *
+     * @param scope - OAuth scopes to request (default: "read:* write:*")
+     * @param callbacks - Optional callbacks for success/error handling
+     * @returns OAuth token information
+     */
+    authenticate(scope?: string, callbacks?: ClientCredentialsCallbacks): Promise<OAuthTokenInfo>;
+    /**
+     * Check if client credentials are valid
+     *
+     * Attempts to authenticate with the provided credentials.
+     * Returns true if successful, false otherwise.
+     *
+     * @returns true if credentials are valid
+     */
+    validateCredentials(): Promise<boolean>;
+    /**
+     * Set new client secret
+     *
+     * Use this after rotating the client secret via:
+     * POST /auth/oauth/clients/{client_id}/rotate-secret
+     *
+     * @param newSecret - The new client secret
+     */
+    setClientSecret(newSecret: string): void;
+}
+//# sourceMappingURL=client-credentials-flow.d.ts.map

package/dist/lib/auth/client-credentials-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-credentials-flow.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/client-credentials-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAsB,cAAc,EAAsB,MAAM,eAAe,CAAC;AAG5F,MAAM,WAAW,0BAA0B;IACzC,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,cAAc,KAAK,IAAI,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CAClC;AAED,qBAAa,qBAAqB;IAChC,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,YAAY,CAAS;gBAEjB,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,YAAW,EAAE,YAAY,EAAE,MAAM;IAgB7E;;;;;;;;;;;OAWG;IACG,YAAY,CAChB,KAAK,GAAE,MAAyB,EAChC,SAAS,CAAC,EAAE,0BAA0B,GACrC,OAAO,CAAC,cAAc,CAAC;IA2C1B;;;;;;;OAOG;IACG,mBAAmB,IAAI,OAAO,CAAC,OAAO,CAAC;IAS7C;;;;;;;OAOG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;CAMzC"}

package/dist/lib/auth/client-credentials-flow.js

@@ -0,0 +1,118 @@
+"use strict";
+/**
+ * OAuth Client Credentials Grant Flow (ADR-054)
+ *
+ * Implements RFC 6749 Client Credentials Grant for machine-to-machine authentication (MCP server).
+ *
+ * Flow:
+ * 1. Exchange client_id + client_secret for access token
+ * 2. Use access token for API requests
+ * 3. Re-authenticate when token expires (no refresh token)
+ *
+ * Usage:
+ *   const flow = new ClientCredentialsFlow(apiUrl, clientId, clientSecret);
+ *   const tokenInfo = await flow.authenticate();
+ *   // Use tokenInfo.access_token for API requests
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClientCredentialsFlow = void 0;
+const axios_1 = __importDefault(require("axios"));
+const oauth_utils_1 = require("./oauth-utils");
+class ClientCredentialsFlow {
+    constructor(apiUrl, clientId = 'kg-mcp', clientSecret) {
+        if (!clientSecret) {
+            throw new Error('Client secret is required for client credentials flow');
+        }
+        this.clientId = clientId;
+        this.clientSecret = clientSecret;
+        this.client = axios_1.default.create({
+            baseURL: apiUrl,
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+            timeout: 10000, // 10 seconds
+        });
+    }
+    /**
+     * Authenticate using client credentials
+     *
+     * POST /auth/oauth/token
+     * Body: grant_type=client_credentials&client_id=kg-mcp&client_secret=<secret>&scope=read:* write:*
+     *
+     * Returns access token (no refresh token for client_credentials grant)
+     *
+     * @param scope - OAuth scopes to request (default: "read:* write:*")
+     * @param callbacks - Optional callbacks for success/error handling
+     * @returns OAuth token information
+     */
+    async authenticate(scope = 'read:* write:*', callbacks) {
+        try {
+            const params = new URLSearchParams({
+                grant_type: 'client_credentials',
+                client_id: this.clientId,
+                client_secret: this.clientSecret,
+                scope: scope,
+            });
+            const response = await this.client.post('/auth/oauth/token', params.toString());
+            const tokenInfo = (0, oauth_utils_1.convertTokenResponse)(response.data, this.clientId);
+            callbacks?.onSuccess?.(tokenInfo);
+            return tokenInfo;
+        }
+        catch (error) {
+            if (axios_1.default.isAxiosError(error)) {
+                const axiosError = error;
+                const errorMessage = axiosError.response?.data?.error_description ||
+                    axiosError.response?.data?.error ||
+                    axiosError.message;
+                // Check for authentication failure
+                if (axiosError.response?.status === 401) {
+                    const err = new Error(`Authentication failed: Invalid client credentials`);
+                    callbacks?.onError?.(err);
+                    throw err;
+                }
+                const err = new Error(`Client credentials authentication failed: ${errorMessage}`);
+                callbacks?.onError?.(err);
+                throw err;
+            }
+            const err = error instanceof Error ? error : new Error('Unknown authentication error');
+            callbacks?.onError?.(err);
+            throw err;
+        }
+    }
+    /**
+     * Check if client credentials are valid
+     *
+     * Attempts to authenticate with the provided credentials.
+     * Returns true if successful, false otherwise.
+     *
+     * @returns true if credentials are valid
+     */
+    async validateCredentials() {
+        try {
+            await this.authenticate();
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Set new client secret
+     *
+     * Use this after rotating the client secret via:
+     * POST /auth/oauth/clients/{client_id}/rotate-secret
+     *
+     * @param newSecret - The new client secret
+     */
+    setClientSecret(newSecret) {
+        if (!newSecret) {
+            throw new Error('Client secret cannot be empty');
+        }
+        this.clientSecret = newSecret;
+    }
+}
+exports.ClientCredentialsFlow = ClientCredentialsFlow;
+//# sourceMappingURL=client-credentials-flow.js.map

package/dist/lib/auth/client-credentials-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-credentials-flow.js","sourceRoot":"","sources":["../../../src/lib/auth/client-credentials-flow.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;;;;AAEH,kDAAyD;AAEzD,+CAAqD;AAOrD,MAAa,qBAAqB;IAKhC,YAAY,MAAc,EAAE,WAAmB,QAAQ,EAAE,YAAoB;QAC3E,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,eAAK,CAAC,MAAM,CAAC;YACzB,OAAO,EAAE,MAAM;YACf,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;aACpD;YACD,OAAO,EAAE,KAAK,EAAG,aAAa;SAC/B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,YAAY,CAChB,QAAgB,gBAAgB,EAChC,SAAsC;QAEtC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;gBACjC,UAAU,EAAE,oBAAoB;gBAChC,SAAS,EAAE,IAAI,CAAC,QAAQ;gBACxB,aAAa,EAAE,IAAI,CAAC,YAAY;gBAChC,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACrC,mBAAmB,EACnB,MAAM,CAAC,QAAQ,EAAE,CAClB,CAAC;YAEF,MAAM,SAAS,GAAG,IAAA,kCAAoB,EAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrE,SAAS,EAAE,SAAS,EAAE,CAAC,SAAS,CAAC,CAAC;YAClC,OAAO,SAAS,CAAC;QAEnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,eAAK,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9B,MAAM,UAAU,GAAG,KAAuC,CAAC;gBAC3D,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,iBAAiB;oBAC7C,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK;oBAChC,UAAU,CAAC,OAAO,CAAC;gBAEvC,mCAAmC;gBACnC,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,KAAK,GAAG,EAAE,CAAC;oBACxC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;oBAC3E,SAAS,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;oBAC1B,MAAM,GAAG,CAAC;gBACZ,CAAC;gBAED,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,6CAA6C,YAAY,EAAE,CAAC,CAAC;gBACnF,SAAS,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;gBAC1B,MAAM,GAAG,CAAC;YACZ,CAAC;YAED,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YACvF,SAAS,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;YAC1B,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,mBAAmB;QACvB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,eAAe,CAAC,SAAiB;QAC/B,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;IAChC,CAAC;CACF;AA9GD,sDA8GC"}