@ace-sdk/core 2.3.2 → 2.4.1

package/dist/auth/device-auth.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Device Code Authentication Flow (RFC 8628)
+ *
+ * Implements the OAuth 2.0 Device Authorization Grant for CLI/terminal clients.
+ *
+ * Flow:
+ * 1. Client requests device code: POST /api/v1/auth/device
+ * 2. User visits URL and enters code
+ * 3. Client polls for token: POST /api/v1/auth/device/token
+ * 4. On success, save credentials to config
+ *
+ * @package @ace-sdk/core
+ */
+import type { DeviceCodeResponse, TokenResponse, DeviceAuthError, LoginOptions, CurrentUser } from '../types/auth.js';
+import type { ILogger } from '../logger/index.js';
+/**
+ * Request device code from server
+ * POST /api/v1/auth/device
+ */
+export declare function requestDeviceCode(clientType: string, logger?: ILogger, deviceId?: string): Promise<DeviceCodeResponse>;
+/**
+ * Poll for token after user authorizes
+ * POST /api/v1/auth/device/token
+ */
+export declare function pollForToken(deviceCode: string, _logger?: ILogger): Promise<TokenResponse | DeviceAuthError>;
+/**
+ * Complete device code login flow
+ *
+ * 1. Request device code
+ * 2. Open browser / show code to user
+ * 3. Poll for token
+ * 4. Save credentials
+ */
+export declare function login(options: LoginOptions, logger?: ILogger): Promise<CurrentUser>;
+/**
+ * Logout - clear credentials
+ */
+export declare function logout(logger?: ILogger): void;
+//# sourceMappingURL=device-auth.d.ts.map

package/dist/auth/device-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-auth.d.ts","sourceRoot":"","sources":["../../src/auth/device-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EACV,kBAAkB,EAClB,aAAa,EACb,eAAe,EACf,YAAY,EACZ,WAAW,EACZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAsBlD;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,OAAO,EAChB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,kBAAkB,CAAC,CAwB7B;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,aAAa,GAAG,eAAe,CAAC,CAuB1C;AAgBD;;;;;;;GAOG;AACH,wBAAsB,KAAK,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CA+IzF;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,CAG7C"}

package/dist/auth/device-auth.js

@@ -0,0 +1,219 @@
+/**
+ * Device Code Authentication Flow (RFC 8628)
+ *
+ * Implements the OAuth 2.0 Device Authorization Grant for CLI/terminal clients.
+ *
+ * Flow:
+ * 1. Client requests device code: POST /api/v1/auth/device
+ * 2. User visits URL and enters code
+ * 3. Client polls for token: POST /api/v1/auth/device/token
+ * 4. On success, save credentials to config
+ *
+ * @package @ace-sdk/core
+ */
+import { saveAuthCredentials, clearAuth, getOrCreateDeviceId } from '../config/auth.js';
+import { getEffectiveToken } from './utils.js';
+import { loadConfig } from '../config/loader.js';
+/**
+ * Default server URL
+ */
+const DEFAULT_SERVER_URL = 'https://ace-api.code-engine.app';
+/**
+ * Get server URL from config or default
+ */
+function getServerUrl() {
+    try {
+        const config = loadConfig();
+        return config.serverUrl || DEFAULT_SERVER_URL;
+    }
+    catch {
+        return DEFAULT_SERVER_URL;
+    }
+}
+/**
+ * Request device code from server
+ * POST /api/v1/auth/device
+ */
+export async function requestDeviceCode(clientType, logger, deviceId) {
+    const serverUrl = getServerUrl();
+    const url = `${serverUrl}/api/v1/auth/device`;
+    logger?.debug(`Requesting device code from ${url}`);
+    const response = await fetch(url, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json'
+        },
+        body: JSON.stringify({
+            client_type: clientType,
+            // v4.5.0: Include device_id for device tracking
+            ...(deviceId && { device_id: deviceId })
+        })
+    });
+    if (!response.ok) {
+        const error = await response.text();
+        throw new Error(`Failed to request device code: ${error}`);
+    }
+    return response.json();
+}
+/**
+ * Poll for token after user authorizes
+ * POST /api/v1/auth/device/token
+ */
+export async function pollForToken(deviceCode, _logger) {
+    const serverUrl = getServerUrl();
+    const url = `${serverUrl}/api/v1/auth/device/token`;
+    const response = await fetch(url, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json'
+        },
+        body: JSON.stringify({ device_code: deviceCode })
+    });
+    const rawData = await response.json();
+    // Server wraps error responses in 'detail' object
+    const data = (rawData.detail || rawData);
+    // Check for error response
+    if (data.error) {
+        return data;
+    }
+    return data;
+}
+/**
+ * Check if response is an error
+ */
+function isDeviceAuthError(response) {
+    return 'error' in response;
+}
+/**
+ * Sleep for specified milliseconds
+ */
+function sleep(ms) {
+    return new Promise(resolve => setTimeout(resolve, ms));
+}
+/**
+ * Complete device code login flow
+ *
+ * 1. Request device code
+ * 2. Open browser / show code to user
+ * 3. Poll for token
+ * 4. Save credentials
+ */
+export async function login(options, logger) {
+    const { clientType, onUserCode, onSuccess, onProgress, timeout = 300000, // 5 minutes
+    signal, noBrowser = false } = options;
+    // Check if already logged in
+    const existingToken = getEffectiveToken(logger);
+    if (existingToken) {
+        logger?.warn('Already logged in. Use logout first to switch accounts.');
+    }
+    // v4.5.0: Get or create device ID (persists across logins)
+    const deviceId = getOrCreateDeviceId(logger);
+    onProgress?.('Requesting device code...');
+    // Step 1: Request device code (include device_id)
+    const deviceCode = await requestDeviceCode(clientType, logger, deviceId);
+    logger?.debug(`Device code: ${deviceCode.device_code}`);
+    logger?.debug(`User code: ${deviceCode.user_code}`);
+    logger?.debug(`Verification URL: ${deviceCode.verification_uri}`);
+    // Step 2: Show code to user
+    onUserCode?.(deviceCode.user_code, deviceCode.verification_uri_complete || deviceCode.verification_uri);
+    // Step 3: Open browser (unless noBrowser or SSH mode)
+    if (!noBrowser && deviceCode.verification_uri_complete) {
+        onProgress?.('Opening browser...');
+        try {
+            // Dynamic import for open package
+            const open = (await import('open')).default;
+            await open(deviceCode.verification_uri_complete);
+        }
+        catch (err) {
+            logger?.debug('Could not open browser:', err instanceof Error ? err.message : String(err));
+            onProgress?.('Could not open browser automatically');
+        }
+    }
+    // Step 4: Poll for token
+    onProgress?.('Waiting for authorization...');
+    let interval = deviceCode.interval * 1000; // Convert to ms
+    const startTime = Date.now();
+    const deviceCodeExpiresAt = startTime + (deviceCode.expires_in * 1000);
+    while (true) {
+        // Check abort signal
+        if (signal?.aborted) {
+            throw new Error('Login cancelled');
+        }
+        // Check timeout
+        if (Date.now() > startTime + timeout) {
+            throw new Error('Login timed out');
+        }
+        // Check expiry
+        if (Date.now() > deviceCodeExpiresAt) {
+            throw new Error('Device code expired. Please try again.');
+        }
+        // Wait before polling
+        await sleep(interval);
+        // Poll for token
+        const response = await pollForToken(deviceCode.device_code, logger);
+        if (isDeviceAuthError(response)) {
+            switch (response.error) {
+                case 'authorization_pending':
+                    // User hasn't authorized yet, keep polling
+                    logger?.debug('Authorization pending...');
+                    continue;
+                case 'slow_down':
+                    // Slow down polling (+5 seconds per RFC 8628)
+                    interval += 5000;
+                    logger?.debug(`Slowing down polling to ${interval / 1000}s`);
+                    continue;
+                case 'expired_token':
+                    throw new Error('Device code expired. Please try again.');
+                case 'access_denied':
+                    throw new Error('Authorization denied by user.');
+                default:
+                    throw new Error(response.error_description || `Auth error: ${response.error}`);
+            }
+        }
+        // Success! Save credentials
+        onProgress?.('Saving credentials...');
+        const tokenResponse = response;
+        // Handle both nested and flat response formats
+        // Nested: { user: { user_id, email }, organizations }
+        // Flat: { user_id, email, organizations }
+        const userData = tokenResponse.user || tokenResponse;
+        const orgs = tokenResponse.organizations || [];
+        // v4.5.0: Calculate expiration timestamps from seconds
+        const now = new Date();
+        const tokenExpiresAt = tokenResponse.expires_in
+            ? new Date(now.getTime() + tokenResponse.expires_in * 1000).toISOString()
+            : tokenResponse.token_expires_at;
+        const tokenRefreshExpiresAt = tokenResponse.refresh_expires_in
+            ? new Date(now.getTime() + tokenResponse.refresh_expires_in * 1000).toISOString()
+            : tokenResponse.refresh_expires_at;
+        saveAuthCredentials({
+            token: tokenResponse.access_token,
+            user_id: userData.user_id,
+            email: userData.email,
+            organizations: orgs,
+            authenticated_at: new Date().toISOString(),
+            // v4.5.0: Token expiration and refresh
+            refresh_token: tokenResponse.refresh_token,
+            expires_at: tokenExpiresAt,
+            refresh_expires_at: tokenRefreshExpiresAt
+        }, logger);
+        const currentUser = {
+            user_id: userData.user_id,
+            email: userData.email,
+            name: userData.name,
+            image_url: userData.image_url,
+            organizations: orgs,
+            authenticated_at: new Date().toISOString()
+        };
+        onSuccess?.(currentUser);
+        return currentUser;
+    }
+}
+/**
+ * Logout - clear credentials
+ */
+export function logout(logger) {
+    clearAuth(logger);
+    logger?.info('Logged out successfully');
+}
+//# sourceMappingURL=device-auth.js.map

package/dist/auth/device-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-auth.js","sourceRoot":"","sources":["../../src/auth/device-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAUH,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxF,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD;;GAEG;AACH,MAAM,kBAAkB,GAAG,iCAAiC,CAAC;AAE7D;;GAEG;AACH,SAAS,YAAY;IACnB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,UAAkB,EAClB,MAAgB,EAChB,QAAiB;IAEjB,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,GAAG,SAAS,qBAAqB,CAAC;IAE9C,MAAM,EAAE,KAAK,CAAC,+BAA+B,GAAG,EAAE,CAAC,CAAC;IAEpD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,WAAW,EAAE,UAAU;YACvB,gDAAgD;YAChD,GAAG,CAAC,QAAQ,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;SACzC,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,kCAAkC,KAAK,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,EAAiC,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,UAAkB,EAClB,OAAiB;IAEjB,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,GAAG,SAAS,2BAA2B,CAAC;IAEpD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;KAClD,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAC;IAEjE,kDAAkD;IAClD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAA4B,CAAC;IAEpE,2BAA2B;IAC3B,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,IAAkC,CAAC;IAC5C,CAAC;IAED,OAAO,IAAgC,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,QAAyC;IAClE,OAAO,OAAO,IAAI,QAAQ,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAAqB,EAAE,MAAgB;IACjE,MAAM,EACJ,UAAU,EACV,UAAU,EACV,SAAS,EACT,UAAU,EACV,OAAO,GAAG,MAAM,EAAE,YAAY;IAC9B,MAAM,EACN,SAAS,GAAG,KAAK,EAClB,GAAG,OAAO,CAAC;IAEZ,6BAA6B;IAC7B,MAAM,aAAa,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,EAAE,IAAI,CAAC,yDAAyD,CAAC,CAAC;IAC1E,CAAC;IAED,2DAA2D;IAC3D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAE7C,UAAU,EAAE,CAAC,2BAA2B,CAAC,CAAC;IAE1C,kDAAkD;IAClD,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAEzE,MAAM,EAAE,KAAK,CAAC,gBAAgB,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;IACxD,MAAM,EAAE,KAAK,CAAC,cAAc,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;IACpD,MAAM,EAAE,KAAK,CAAC,qBAAqB,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAElE,4BAA4B;IAC5B,UAAU,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,yBAAyB,IAAI,UAAU,CAAC,gBAAgB,CAAC,CAAC;IAExG,sDAAsD;IACtD,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,yBAAyB,EAAE,CAAC;QACvD,UAAU,EAAE,CAAC,oBAAoB,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,kCAAkC;YAClC,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YAC5C,MAAM,IAAI,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,EAAE,KAAK,CAAC,yBAAyB,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3F,UAAU,EAAE,CAAC,sCAAsC,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,yBAAyB;IACzB,UAAU,EAAE,CAAC,8BAA8B,CAAC,CAAC;IAE7C,IAAI,QAAQ,GAAG,UAAU,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,gBAAgB;IAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,mBAAmB,GAAG,SAAS,GAAG,CAAC,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAEvE,OAAO,IAAI,EAAE,CAAC;QACZ,qBAAqB;QACrB,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACrC,CAAC;QAED,gBAAgB;QAChB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,OAAO,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACrC,CAAC;QAED,eAAe;QACf,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QAED,sBAAsB;QACtB,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEtB,iBAAiB;QACjB,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAEpE,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,QAAQ,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACvB,KAAK,uBAAuB;oBAC1B,2CAA2C;oBAC3C,MAAM,EAAE,KAAK,CAAC,0BAA0B,CAAC,CAAC;oBAC1C,SAAS;gBAEX,KAAK,WAAW;oBACd,8CAA8C;oBAC9C,QAAQ,IAAI,IAAI,CAAC;oBACjB,MAAM,EAAE,KAAK,CAAC,2BAA2B,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC;oBAC7D,SAAS;gBAEX,KAAK,eAAe;oBAClB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;gBAE5D,KAAK,eAAe;oBAClB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;gBAEnD;oBACE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,iBAAiB,IAAI,eAAe,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,UAAU,EAAE,CAAC,uBAAuB,CAAC,CAAC;QAEtC,MAAM,aAAa,GAAG,QAAyB,CAAC;QAEhD,+CAA+C;QAC/C,sDAAsD;QACtD,0CAA0C;QAC1C,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,IAAI,aAAiD,CAAC;QACzF,MAAM,IAAI,GAAG,aAAa,CAAC,aAAa,IAAI,EAAE,CAAC;QAE/C,uDAAuD;QACvD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,cAAc,GAAG,aAAa,CAAC,UAAU;YAC7C,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;YACzE,CAAC,CAAC,aAAa,CAAC,gBAAgB,CAAC;QACnC,MAAM,qBAAqB,GAAG,aAAa,CAAC,kBAAkB;YAC5D,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;YACjF,CAAC,CAAC,aAAa,CAAC,kBAAkB,CAAC;QAErC,mBAAmB,CAAC;YAClB,KAAK,EAAE,aAAa,CAAC,YAAY;YACjC,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,aAAa,EAAE,IAAI;YACnB,gBAAgB,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC1C,uCAAuC;YACvC,aAAa,EAAE,aAAa,CAAC,aAAa;YAC1C,UAAU,EAAE,cAAc;YAC1B,kBAAkB,EAAE,qBAAqB;SAC1C,EAAE,MAAM,CAAC,CAAC;QAEX,MAAM,WAAW,GAAgB;YAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,aAAa,EAAE,IAAI;YACnB,gBAAgB,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAC3C,CAAC;QAEF,SAAS,EAAE,CAAC,WAAW,CAAC,CAAC;QAEzB,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,MAAM,CAAC,MAAgB;IACrC,SAAS,CAAC,MAAM,CAAC,CAAC;IAClB,MAAM,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;AAC1C,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Auth Module Index
+ * @package @ace-sdk/core
+ */
+export { requestDeviceCode, pollForToken, login, logout } from './device-auth.js';
+export { getEffectiveToken, getEffectiveOrgId, isAuthenticated, isUserAuthenticated, getCurrentUser, getTokenType, maskToken } from './utils.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,KAAK,EACL,MAAM,EACP,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,cAAc,EACd,YAAY,EACZ,SAAS,EACV,MAAM,YAAY,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,9 @@
+/**
+ * Auth Module Index
+ * @package @ace-sdk/core
+ */
+// Device code authentication
+export { requestDeviceCode, pollForToken, login, logout } from './device-auth.js';
+// Auth utilities
+export { getEffectiveToken, getEffectiveOrgId, isAuthenticated, isUserAuthenticated, getCurrentUser, getTokenType, maskToken } from './utils.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,6BAA6B;AAC7B,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,KAAK,EACL,MAAM,EACP,MAAM,kBAAkB,CAAC;AAE1B,iBAAiB;AACjB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,cAAc,EACd,YAAY,EACZ,SAAS,EACV,MAAM,YAAY,CAAC"}

package/dist/auth/utils.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Authentication Utilities
+ *
+ * Helper functions for checking auth state and getting effective credentials.
+ *
+ * @package @ace-sdk/core
+ */
+import type { CurrentUser, TokenType } from '../types/auth.js';
+import type { ILogger } from '../logger/index.js';
+/**
+ * Get effective API token (user token takes priority over legacy org token)
+ *
+ * Priority:
+ * 1. Environment: ACE_API_TOKEN
+ * 2. Config: auth.token (user token)
+ * 3. Config: apiToken (legacy org token)
+ */
+export declare function getEffectiveToken(logger?: ILogger): string | null;
+/**
+ * Get effective organization ID
+ *
+ * Priority:
+ * 1. Environment: ACE_ORG_ID
+ * 2. Config: default_org_id
+ * 3. First org in auth.organizations
+ * 4. Extract from legacy org token
+ */
+export declare function getEffectiveOrgId(logger?: ILogger): string | null;
+/**
+ * Check if user is authenticated
+ */
+export declare function isAuthenticated(logger?: ILogger): boolean;
+/**
+ * Check if using user token (vs legacy org token)
+ */
+export declare function isUserAuthenticated(logger?: ILogger): boolean;
+/**
+ * Get current user info from config
+ */
+export declare function getCurrentUser(logger?: ILogger): CurrentUser | null;
+/**
+ * Get token type of current effective token
+ */
+export declare function getTokenType(logger?: ILogger): TokenType;
+/**
+ * Mask token for display (show first 15 chars + ...)
+ */
+export declare function maskToken(token: string): string;
+//# sourceMappingURL=utils.d.ts.map

package/dist/auth/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/auth/utils.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAY,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAEzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAGlD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAiCjE;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CA0CjE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAGzD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAI7D;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,WAAW,GAAG,IAAI,CA2BnE;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAGxD;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAI/C"}

package/dist/auth/utils.js

@@ -0,0 +1,156 @@
+/**
+ * Authentication Utilities
+ *
+ * Helper functions for checking auth state and getting effective credentials.
+ *
+ * @package @ace-sdk/core
+ */
+import { existsSync, readFileSync } from 'fs';
+import { detectTokenType } from '../types/auth.js';
+import { getXdgConfigPath } from '../config/xdg.js';
+/**
+ * Get effective API token (user token takes priority over legacy org token)
+ *
+ * Priority:
+ * 1. Environment: ACE_API_TOKEN
+ * 2. Config: auth.token (user token)
+ * 3. Config: apiToken (legacy org token)
+ */
+export function getEffectiveToken(logger) {
+    // Priority 1: Environment variable
+    if (process.env.ACE_API_TOKEN) {
+        logger?.debug('Using token from ACE_API_TOKEN');
+        return process.env.ACE_API_TOKEN;
+    }
+    // Load config
+    const configPath = getXdgConfigPath();
+    if (!existsSync(configPath)) {
+        return null;
+    }
+    try {
+        const config = JSON.parse(readFileSync(configPath, 'utf8'));
+        // Priority 2: User token (new auth block)
+        if (config.auth?.token) {
+            logger?.debug('Using user token from auth.token');
+            return config.auth.token;
+        }
+        // Priority 3: Legacy org token
+        if (config.apiToken) {
+            logger?.debug('Using legacy token from apiToken');
+            return config.apiToken;
+        }
+        return null;
+    }
+    catch {
+        logger?.warn('Failed to read token from config');
+        return null;
+    }
+}
+/**
+ * Get effective organization ID
+ *
+ * Priority:
+ * 1. Environment: ACE_ORG_ID
+ * 2. Config: default_org_id
+ * 3. First org in auth.organizations
+ * 4. Extract from legacy org token
+ */
+export function getEffectiveOrgId(logger) {
+    // Priority 1: Environment variable
+    if (process.env.ACE_ORG_ID) {
+        logger?.debug('Using org from ACE_ORG_ID');
+        return process.env.ACE_ORG_ID;
+    }
+    // Load config
+    const configPath = getXdgConfigPath();
+    if (!existsSync(configPath)) {
+        return null;
+    }
+    try {
+        const config = JSON.parse(readFileSync(configPath, 'utf8'));
+        // Priority 2: Explicit default_org_id
+        if (config.default_org_id) {
+            logger?.debug('Using default org from config');
+            return config.default_org_id;
+        }
+        // Priority 3: First org from user auth
+        if (config.auth?.organizations?.length > 0) {
+            const firstOrg = config.auth.organizations[0].org_id;
+            logger?.debug(`Using first org: ${firstOrg}`);
+            return firstOrg;
+        }
+        // Priority 4: Extract from legacy token
+        if (config.apiToken && detectTokenType(config.apiToken) === 'org') {
+            // Legacy token format: ace_{orgId8chars}{random}
+            const orgId = config.apiToken.substring(4, 12);
+            logger?.debug(`Extracted org from legacy token: ${orgId}`);
+            return orgId;
+        }
+        return null;
+    }
+    catch {
+        logger?.warn('Failed to read org from config');
+        return null;
+    }
+}
+/**
+ * Check if user is authenticated
+ */
+export function isAuthenticated(logger) {
+    const token = getEffectiveToken(logger);
+    return !!token;
+}
+/**
+ * Check if using user token (vs legacy org token)
+ */
+export function isUserAuthenticated(logger) {
+    const token = getEffectiveToken(logger);
+    if (!token)
+        return false;
+    return detectTokenType(token) === 'user';
+}
+/**
+ * Get current user info from config
+ */
+export function getCurrentUser(logger) {
+    const configPath = getXdgConfigPath();
+    if (!existsSync(configPath)) {
+        return null;
+    }
+    try {
+        const config = JSON.parse(readFileSync(configPath, 'utf8'));
+        if (!config.auth) {
+            return null;
+        }
+        const auth = config.auth;
+        return {
+            user_id: auth.user_id,
+            email: auth.email,
+            organizations: auth.organizations || [],
+            default_org_id: config.default_org_id,
+            authenticated_at: auth.authenticated_at
+        };
+    }
+    catch {
+        logger?.warn('Failed to read current user from config');
+        return null;
+    }
+}
+/**
+ * Get token type of current effective token
+ */
+export function getTokenType(logger) {
+    const token = getEffectiveToken(logger);
+    return token ? detectTokenType(token) : 'unknown';
+}
+/**
+ * Mask token for display (show first 15 chars + ...)
+ */
+export function maskToken(token) {
+    if (!token)
+        return '(none)';
+    if (token.length <= 15)
+        return token;
+    return `${token.substring(0, 15)}...`;
+}
+//# sourceMappingURL=utils.js.map

package/dist/auth/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/auth/utils.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAE9C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAgB;IAChD,mCAAmC;IACnC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;QAC9B,MAAM,EAAE,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAChD,OAAO,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACnC,CAAC;IAED,cAAc;IACd,MAAM,UAAU,GAAG,gBAAgB,EAAE,CAAC;IACtC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QAE5D,0CAA0C;QAC1C,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;YACvB,MAAM,EAAE,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAClD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QAC3B,CAAC;QAED,+BAA+B;QAC/B,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,MAAM,EAAE,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAClD,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,EAAE,IAAI,CAAC,kCAAkC,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAgB;IAChD,mCAAmC;IACnC,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;QAC3B,MAAM,EAAE,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC3C,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IAChC,CAAC;IAED,cAAc;IACd,MAAM,UAAU,GAAG,gBAAgB,EAAE,CAAC;IACtC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QAE5D,sCAAsC;QACtC,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1B,MAAM,EAAE,KAAK,CAAC,+BAA+B,CAAC,CAAC;YAC/C,OAAO,MAAM,CAAC,cAAc,CAAC;QAC/B,CAAC;QAED,uCAAuC;QACvC,IAAI,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YACrD,MAAM,EAAE,KAAK,CAAC,oBAAoB,QAAQ,EAAE,CAAC,CAAC;YAC9C,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,wCAAwC;QACxC,IAAI,MAAM,CAAC,QAAQ,IAAI,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC;YAClE,iDAAiD;YACjD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/C,MAAM,EAAE,KAAK,CAAC,oCAAoC,KAAK,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,EAAE,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,MAAgB;IAC9C,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,CAAC,CAAC,KAAK,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAgB;IAClD,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,OAAO,eAAe,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,MAAgB;IAC7C,MAAM,UAAU,GAAG,gBAAgB,EAAE,CAAC;IAEtC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QAE5D,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAa,MAAM,CAAC,IAAI,CAAC;QAEnC,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,EAAE;YACvC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;SACxC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,EAAE,IAAI,CAAC,yCAAyC,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,MAAgB;IAC3C,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IACrC,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;AACxC,CAAC"}

package/dist/client/ace-client.d.ts

@@ -18,12 +18,16 @@ import { ILogger } from '../logger/index.js';
 export interface AceClientOptions {
     /** Logger for output (optional - defaults to silent) */
     logger?: ILogger;
+    /** Enable auto-refresh of expired tokens (v4.5.0, default: true for user tokens) */
+    autoRefresh?: boolean;
 }
 export declare class AceClient {
     private config;
     private localCache;
     private memoryCache?;
     private logger;
+    private autoRefresh;
+    private currentToken;
     private configCache;
     private CONFIG_CACHE_TTL;
     constructor(config: AceConfig | AceContext, options?: AceClientOptions);

package/dist/client/ace-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ace-client.d.ts","sourceRoot":"","sources":["../../src/client/ace-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,cAAc,EACd,0BAA0B,EAC1B,4BAA4B,EAC5B,gBAAgB,EAChB,iBAAiB,EAEjB,aAAa,EACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAe,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,wDAAwD;IACxD,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,SAAS;IAalB,OAAO,CAAC,MAAM;IAZhB,OAAO,CAAC,UAAU,CAA2B;IAC7C,OAAO,CAAC,WAAW,CAAC,CAAqB;IACzC,OAAO,CAAC,MAAM,CAAsB;IAGpC,OAAO,CAAC,WAAW,CAGc;IACjC,OAAO,CAAC,gBAAgB,CAAkB;gBAGhC,MAAM,EAAE,SAAS,GAAG,UAAU,EACtC,OAAO,CAAC,EAAE,gBAAgB;IAsC5B;;;OAGG;IACH,OAAO,CAAC,YAAY;YAWN,OAAO;IA2DrB;;;OAGG;IACG,YAAY,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAa/D;;;OAGG;IACG,WAAW,CAAC,MAAM,CAAC,EAAE;QACzB,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC5B,GAAG,OAAO,CAAC,4BAA4B,CAAC;IAuDzC;;OAEG;IACH,OAAO,CAAC,YAAY;IASpB;;;OAGG;IACG,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IA+C7D;;;OAGG;IACG,cAAc,CAAC,MAAM,EAAE;QAC3B,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5B,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAoDvC;;;OAGG;IACG,cAAc,CAAC,MAAM,EAAE;QAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAgB7B;;;OAGG;IACG,YAAY,IAAI,OAAO,CAAC,aAAa,CAAC;IAI5C;;;OAGG;IACG,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAKpC;;;OAGG;IACG,UAAU,CAAC,SAAS,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAK1D;;OAEG;IACG,WAAW,CAAC,UAAU,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAM9D;;;OAGG;IACG,mBAAmB,CAAC,KAAK,EAAE,GAAG,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAIhE;;;;;;;;;OASG;IACG,yBAAyB,CAC7B,KAAK,EAAE,GAAG,EACV,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,gBAAgB,CAAC;IAmB5B;;;OAGG;YACW,iBAAiB;IAmD/B;;;OAGG;YACW,cAAc;IA0F5B;;;OAGG;IACH,OAAO,CAAC,8BAA8B;IAYtC;;;OAGG;IACG,SAAS,CAAC,MAAM,EAAE;QACtB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,QAAQ,EAAE;YACR,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;YAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;YACtB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;SAC5B,CAAC;KACH,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAI9B;;;OAGG;IACG,kBAAkB,CAAC,MAAM,EAAE;QAC/B,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,mBAAmB,EAAE,OAAO,CAAC;KAC9B,GAAG,OAAO,CAAC,GAAG,CAAC;IAIhB;;;OAGG;IACG,SAAS,IAAI,OAAO,CAAC,aAAa,CAAC;IAIzC;;OAEG;IACH,eAAe,IAAI,IAAI;IAKvB;;;OAGG;IACG,SAAS,CAAC,QAAQ,UAAO,GAAG,OAAO,CAAC,YAAY,CAAC;IAuBvD;;;OAGG;IACG,WAAW,IAAI,OAAO,CAAC;QAC3B,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,KAAK,CAAC;YACd,UAAU,EAAE,MAAM,CAAC;YACnB,YAAY,EAAE,MAAM,CAAC;SACtB,CAAC,CAAC;KACJ,CAAC;IAIF;;;OAGG;IACG,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QACpD,QAAQ,EAAE,cAAc,EAAE,CAAC;QAC3B,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,EAAE,CAAA;KACpB,CAAC;IAsCF;;;OAGG;IACG,gBAAgB,CAAC,WAAW,EAAE,GAAG,GAAG,OAAO,CAAC;QAChD,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,KAAK,CAAC;YAChB,SAAS,EAAE,MAAM,CAAC;YAClB,IAAI,EAAE,MAAM,CAAC;YACb,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC,CAAC;QACH,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IAIF;;OAEG;IACH,gBAAgB,IAAI,IAAI;IAKxB;;OAEG;IACH,aAAa,IAAI,iBAAiB,GAAG,IAAI;IAIzC;;;OAGG;IACG,YAAY,CAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC7B,KAAK,GAAE,SAAqB,GAC3B,OAAO,CAAC,YAAY,CAAC;IAsBxB;;;OAGG;IACG,WAAW,CAAC,KAAK,GAAE,SAAqB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAoBhG"}
+{"version":3,"file":"ace-client.d.ts","sourceRoot":"","sources":["../../src/client/ace-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,cAAc,EACd,0BAA0B,EAC1B,4BAA4B,EAC5B,gBAAgB,EAChB,iBAAiB,EAEjB,aAAa,EACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAe,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAI7C;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,wDAAwD;IACxD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,oFAAoF;IACpF,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,qBAAa,SAAS;IAelB,OAAO,CAAC,MAAM;IAdhB,OAAO,CAAC,UAAU,CAA2B;IAC7C,OAAO,CAAC,WAAW,CAAC,CAAqB;IACzC,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,WAAW,CAAU;IAC7B,OAAO,CAAC,YAAY,CAAS;IAG7B,OAAO,CAAC,WAAW,CAGc;IACjC,OAAO,CAAC,gBAAgB,CAAkB;gBAGhC,MAAM,EAAE,SAAS,GAAG,UAAU,EACtC,OAAO,CAAC,EAAE,gBAAgB;IA0C5B;;;OAGG;IACH,OAAO,CAAC,YAAY;YAWN,OAAO;IAqFrB;;;OAGG;IACG,YAAY,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAa/D;;;OAGG;IACG,WAAW,CAAC,MAAM,CAAC,EAAE;QACzB,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC5B,GAAG,OAAO,CAAC,4BAA4B,CAAC;IAuDzC;;OAEG;IACH,OAAO,CAAC,YAAY;IASpB;;;OAGG;IACG,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IA+C7D;;;OAGG;IACG,cAAc,CAAC,MAAM,EAAE;QAC3B,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5B,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAoDvC;;;OAGG;IACG,cAAc,CAAC,MAAM,EAAE;QAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAgB7B;;;OAGG;IACG,YAAY,IAAI,OAAO,CAAC,aAAa,CAAC;IAI5C;;;OAGG;IACG,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAKpC;;;OAGG;IACG,UAAU,CAAC,SAAS,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAK1D;;OAEG;IACG,WAAW,CAAC,UAAU,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAM9D;;;OAGG;IACG,mBAAmB,CAAC,KAAK,EAAE,GAAG,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAIhE;;;;;;;;;OASG;IACG,yBAAyB,CAC7B,KAAK,EAAE,GAAG,EACV,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,gBAAgB,CAAC;IAmB5B;;;OAGG;YACW,iBAAiB;IAmD/B;;;OAGG;YACW,cAAc;IA0F5B;;;OAGG;IACH,OAAO,CAAC,8BAA8B;IAYtC;;;OAGG;IACG,SAAS,CAAC,MAAM,EAAE;QACtB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,QAAQ,EAAE;YACR,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;YAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;YACtB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;SAC5B,CAAC;KACH,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAI9B;;;OAGG;IACG,kBAAkB,CAAC,MAAM,EAAE;QAC/B,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,mBAAmB,EAAE,OAAO,CAAC;KAC9B,GAAG,OAAO,CAAC,GAAG,CAAC;IAIhB;;;OAGG;IACG,SAAS,IAAI,OAAO,CAAC,aAAa,CAAC;IAIzC;;OAEG;IACH,eAAe,IAAI,IAAI;IAKvB;;;OAGG;IACG,SAAS,CAAC,QAAQ,UAAO,GAAG,OAAO,CAAC,YAAY,CAAC;IAuBvD;;;OAGG;IACG,WAAW,IAAI,OAAO,CAAC;QAC3B,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,KAAK,CAAC;YACd,UAAU,EAAE,MAAM,CAAC;YACnB,YAAY,EAAE,MAAM,CAAC;SACtB,CAAC,CAAC;KACJ,CAAC;IAIF;;;OAGG;IACG,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QACpD,QAAQ,EAAE,cAAc,EAAE,CAAC;QAC3B,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,EAAE,CAAA;KACpB,CAAC;IAsCF;;;OAGG;IACG,gBAAgB,CAAC,WAAW,EAAE,GAAG,GAAG,OAAO,CAAC;QAChD,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,KAAK,CAAC;YAChB,SAAS,EAAE,MAAM,CAAC;YAClB,IAAI,EAAE,MAAM,CAAC;YACb,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC,CAAC;QACH,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IAIF;;OAEG;IACH,gBAAgB,IAAI,IAAI;IAKxB;;OAEG;IACH,aAAa,IAAI,iBAAiB,GAAG,IAAI;IAIzC;;;OAGG;IACG,YAAY,CAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC7B,KAAK,GAAE,SAAqB,GAC3B,OAAO,CAAC,YAAY,CAAC;IAsBxB;;;OAGG;IACG,WAAW,CAAC,KAAK,GAAE,SAAqB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAoBhG"}

package/dist/client/ace-client.js

@@ -9,11 +9,15 @@
  * @package @ace-sdk/core
  */
 import { LocalCacheService } from '../cache/local-cache.js';
+import { ensureValidToken } from './http.js';
+import { isUserToken } from '../types/auth.js';
 export class AceClient {
     config;
     localCache;
     memoryCache; // RAM cache
     logger;
+    autoRefresh;
+    currentToken; // Tracks potentially refreshed token
     // Config cache (v3.6.0+) - 1-hour TTL (configurable)
     configCache = { data: null, timestamp: 0 };
     CONFIG_CACHE_TTL = 60 * 60 * 1000; // 60 minutes (1 hour)
@@ -26,6 +30,9 @@ export class AceClient {
         const projectId = config.projectId;
         const orgId = 'orgId' in config ? config.orgId : this.extractOrgId(apiToken);
         const cacheTtlMinutes = config.cacheTtlMinutes;
+        // v4.5.0: Auto-refresh enabled by default for user tokens
+        this.currentToken = apiToken;
+        this.autoRefresh = options?.autoRefresh !== false && isUserToken(apiToken);
         // Initialize local SQLite cache (optional - graceful fallback for Node 25+)
         try {
             const cacheConfig = {
@@ -77,14 +84,38 @@ export class AceClient {
                 this.logger.trace(`Request body: ${truncated}`);
             }
         }
+        // v4.5.0: Auto-refresh token if enabled and using user token
+        let token = this.currentToken;
+        if (this.autoRefresh) {
+            try {
+                const result = await ensureValidToken(this.config.serverUrl, this.logger);
+                token = result.token;
+                if (result.wasRefreshed) {
+                    this.currentToken = token;
+                    this.logger?.debug('Token refreshed automatically');
+                }
+            }
+            catch (error) {
+                // If token refresh fails, try with current token anyway
+                // (might work if server hasn't invalidated it yet)
+                this.logger?.debug('Token refresh failed, using current token');
+            }
+        }
         const startTime = Date.now();
+        // Build headers with X-ACE-Org for user tokens
+        const headers = {
+            'Content-Type': 'application/json',
+            'Authorization': `Bearer ${token}`,
+            'X-ACE-Project': this.config.projectId
+        };
+        // Add X-ACE-Org header for user tokens (selects which org per-request)
+        const orgId = 'orgId' in this.config ? this.config.orgId : this.extractOrgId(this.config.apiToken);
+        if (orgId && orgId !== 'default') {
+            headers['X-ACE-Org'] = orgId;
+        }
         const response = await fetch(url, {
             method,
-            headers: {
-                'Content-Type': 'application/json',
-                'Authorization': `Bearer ${this.config.apiToken}`,
-                'X-ACE-Project': this.config.projectId
-            },
+            headers,
             body: body ? JSON.stringify(body) : undefined
         });
         const duration = Date.now() - startTime;