@aimee.shop/sdk 0.26.0

package/dist/core/auth/api-key.authenticator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.authenticator.d.ts","sourceRoot":"","sources":["../../../../../src/core/auth/api-key.authenticator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD;;;GAGG;AACH,qBAAa,mBAAoB,YAAW,aAAa;IACvD,QAAQ,CAAC,IAAI,aAAa;IAC1B,QAAQ,CAAC,QAAQ,KAAK;IAEtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,MAAM,EAAE,MAAM;IAI1B,eAAe,IAAI,OAAO;IAIpB,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAMvD,SAAS,IAAI,OAAO;IAKd,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAG/B"}

package/dist/core/auth/api-key.authenticator.js

@@ -0,0 +1,28 @@
+/**
+ * API Key authenticator - highest priority in the chain.
+ * Simply adds the API key to request headers.
+ */
+export class ApiKeyAuthenticator {
+    name = 'api-key';
+    priority = 1; // Highest priority - tried first
+    apiKey;
+    constructor(apiKey) {
+        this.apiKey = apiKey;
+    }
+    canAuthenticate() {
+        return this.apiKey.length > 0;
+    }
+    async getAuthHeaders() {
+        return {
+            'x-api-key': this.apiKey,
+        };
+    }
+    isExpired() {
+        // API keys don't expire on their own (server-side expiration)
+        return false;
+    }
+    async refresh() {
+        // No-op for API keys - nothing to refresh
+    }
+}
+//# sourceMappingURL=api-key.authenticator.js.map

package/dist/core/auth/api-key.authenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.authenticator.js","sourceRoot":"","sources":["../../../../../src/core/auth/api-key.authenticator.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,OAAO,mBAAmB;IACrB,IAAI,GAAG,SAAS,CAAC;IACjB,QAAQ,GAAG,CAAC,CAAC,CAAC,iCAAiC;IAEvC,MAAM,CAAS;IAEhC,YAAY,MAAc;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,eAAe;QACb,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,MAAM;SACzB,CAAC;IACJ,CAAC;IAED,SAAS;QACP,8DAA8D;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,OAAO;QACX,0CAA0C;IAC5C,CAAC;CACF"}

package/dist/core/auth/auth-chain.d.ts

@@ -0,0 +1,33 @@
+import type { Authenticator } from './authenticator.js';
+/**
+ * Manages a chain of authenticators using the Chain of Responsibility pattern.
+ * Authenticators are tried in priority order (lowest priority number first).
+ */
+export declare class AuthChain {
+    private authenticators;
+    private activeAuthenticator;
+    /**
+     * Add an authenticator to the chain.
+     * Authenticators are automatically sorted by priority.
+     */
+    add(authenticator: Authenticator): void;
+    /**
+     * Check if any authenticator in the chain can authenticate.
+     */
+    canAuthenticate(): boolean;
+    /**
+     * Get auth headers from the first authenticator that can authenticate.
+     * If an authenticator returns empty headers, falls through to the next one.
+     * @throws AuthenticationError if no authenticator can provide valid headers
+     */
+    getAuthHeaders(): Promise<Record<string, string>>;
+    /**
+     * Get the currently active authenticator (last one that provided headers).
+     */
+    getActiveAuthenticator(): Authenticator | null;
+    /**
+     * Get the name of the active authenticator.
+     */
+    getActiveAuthenticatorName(): string | null;
+}
+//# sourceMappingURL=auth-chain.d.ts.map

package/dist/core/auth/auth-chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-chain.d.ts","sourceRoot":"","sources":["../../../../../src/core/auth/auth-chain.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGxD;;;GAGG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,cAAc,CAAuB;IAC7C,OAAO,CAAC,mBAAmB,CAA8B;IAEzD;;;OAGG;IACH,GAAG,CAAC,aAAa,EAAE,aAAa,GAAG,IAAI;IAKvC;;OAEG;IACH,eAAe,IAAI,OAAO;IAI1B;;;;OAIG;IACG,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IA6BvD;;OAEG;IACH,sBAAsB,IAAI,aAAa,GAAG,IAAI;IAI9C;;OAEG;IACH,0BAA0B,IAAI,MAAM,GAAG,IAAI;CAG5C"}

package/dist/core/auth/auth-chain.js

@@ -0,0 +1,65 @@
+import { AuthenticationError } from '../errors/index.js';
+/**
+ * Manages a chain of authenticators using the Chain of Responsibility pattern.
+ * Authenticators are tried in priority order (lowest priority number first).
+ */
+export class AuthChain {
+    authenticators = [];
+    activeAuthenticator = null;
+    /**
+     * Add an authenticator to the chain.
+     * Authenticators are automatically sorted by priority.
+     */
+    add(authenticator) {
+        this.authenticators.push(authenticator);
+        this.authenticators.sort((a, b) => a.priority - b.priority);
+    }
+    /**
+     * Check if any authenticator in the chain can authenticate.
+     */
+    canAuthenticate() {
+        return this.authenticators.some((auth) => auth.canAuthenticate());
+    }
+    /**
+     * Get auth headers from the first authenticator that can authenticate.
+     * If an authenticator returns empty headers, falls through to the next one.
+     * @throws AuthenticationError if no authenticator can provide valid headers
+     */
+    async getAuthHeaders() {
+        for (const auth of this.authenticators) {
+            if (auth.canAuthenticate()) {
+                if (auth.isExpired()) {
+                    await auth.refresh();
+                }
+                const headers = await auth.getAuthHeaders();
+                // If headers are empty (e.g., TokenAuthenticator with no token),
+                // fall through to the next authenticator
+                if (Object.keys(headers).length > 0) {
+                    this.activeAuthenticator = auth;
+                    return headers;
+                }
+                // Continue to next authenticator
+            }
+        }
+        throw new AuthenticationError('No authentication credentials available. Options:\n' +
+            '  - apiKey: Pass an API key in config\n' +
+            '  - email/password: Pass Cognito credentials in config\n' +
+            '  - getAccessToken: Pass a token getter for browser auth\n' +
+            '  - ZIFTR_API_KEY: Set environment variable\n' +
+            '  - ZIFTR_EMAIL/ZIFTR_PASSWORD: Set environment variables\n' +
+            '\nIf using browser auth, ensure the user is logged in.');
+    }
+    /**
+     * Get the currently active authenticator (last one that provided headers).
+     */
+    getActiveAuthenticator() {
+        return this.activeAuthenticator;
+    }
+    /**
+     * Get the name of the active authenticator.
+     */
+    getActiveAuthenticatorName() {
+        return this.activeAuthenticator?.name ?? null;
+    }
+}
+//# sourceMappingURL=auth-chain.js.map

package/dist/core/auth/auth-chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-chain.js","sourceRoot":"","sources":["../../../../../src/core/auth/auth-chain.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD;;;GAGG;AACH,MAAM,OAAO,SAAS;IACZ,cAAc,GAAoB,EAAE,CAAC;IACrC,mBAAmB,GAAyB,IAAI,CAAC;IAEzD;;;OAGG;IACH,GAAG,CAAC,aAA4B;QAC9B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACxC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC9D,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;IACpE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc;QAClB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;gBAC3B,IAAI,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;oBACrB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;gBACvB,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;gBAE5C,iEAAiE;gBACjE,yCAAyC;gBACzC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACpC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;oBAChC,OAAO,OAAO,CAAC;gBACjB,CAAC;gBACD,iCAAiC;YACnC,CAAC;QACH,CAAC;QAED,MAAM,IAAI,mBAAmB,CAC3B,qDAAqD;YACnD,yCAAyC;YACzC,0DAA0D;YAC1D,4DAA4D;YAC5D,+CAA+C;YAC/C,6DAA6D;YAC7D,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,sBAAsB;QACpB,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,0BAA0B;QACxB,OAAO,IAAI,CAAC,mBAAmB,EAAE,IAAI,IAAI,IAAI,CAAC;IAChD,CAAC;CACF"}

package/dist/core/auth/authenticator.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Base interface for all authenticators in the auth chain.
+ * Implements the Chain of Responsibility pattern.
+ */
+export interface Authenticator {
+    /** Unique name for this authenticator (for debugging/logging) */
+    readonly name: string;
+    /** Priority in the chain (lower = higher priority, tried first) */
+    readonly priority: number;
+    /** Check if this authenticator has the required credentials to authenticate */
+    canAuthenticate(): boolean;
+    /** Get authorization headers for requests */
+    getAuthHeaders(): Promise<Record<string, string>>;
+    /** Check if current credentials/tokens are expired */
+    isExpired(): boolean;
+    /** Refresh credentials if possible (e.g., refresh token flow) */
+    refresh(): Promise<void>;
+}
+//# sourceMappingURL=authenticator.d.ts.map

package/dist/core/auth/authenticator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticator.d.ts","sourceRoot":"","sources":["../../../../../src/core/auth/authenticator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,+EAA+E;IAC/E,eAAe,IAAI,OAAO,CAAC;IAE3B,6CAA6C;IAC7C,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAElD,sDAAsD;IACtD,SAAS,IAAI,OAAO,CAAC;IAErB,iEAAiE;IACjE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B"}

package/dist/core/auth/authenticator.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=authenticator.js.map

package/dist/core/auth/authenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticator.js","sourceRoot":"","sources":["../../../../../src/core/auth/authenticator.ts"],"names":[],"mappings":""}

package/dist/core/auth/cognito.authenticator.d.ts

@@ -0,0 +1,28 @@
+import type { Authenticator } from './authenticator.js';
+/**
+ * Credentials for Cognito authentication
+ */
+export interface CognitoCredentials {
+    email: string;
+    password: string;
+}
+/**
+ * Cognito authenticator - uses AWS Cognito for JWT-based auth.
+ * Cognito pool configuration is baked in at build time per environment.
+ */
+export declare class CognitoAuthenticator implements Authenticator {
+    readonly name = "cognito";
+    readonly priority = 2;
+    private accessToken;
+    private refreshToken;
+    private expiresAt;
+    private readonly client;
+    private readonly credentials;
+    constructor(credentials: CognitoCredentials);
+    canAuthenticate(): boolean;
+    isExpired(): boolean;
+    getAuthHeaders(): Promise<Record<string, string>>;
+    refresh(): Promise<void>;
+    private authenticate;
+}
+//# sourceMappingURL=cognito.authenticator.d.ts.map

package/dist/core/auth/cognito.authenticator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cognito.authenticator.d.ts","sourceRoot":"","sources":["../../../../../src/core/auth/cognito.authenticator.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAIxD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,qBAAa,oBAAqB,YAAW,aAAa;IACxD,QAAQ,CAAC,IAAI,aAAa;IAC1B,QAAQ,CAAC,QAAQ,KAAK;IAEtB,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,SAAS,CAAK;IAEtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;IACvD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;gBAErC,WAAW,EAAE,kBAAkB;IAO3C,eAAe,IAAI,OAAO;IAI1B,SAAS,IAAI,OAAO;IAKd,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAUjD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;YA6BhB,YAAY;CA4B3B"}

package/dist/core/auth/cognito.authenticator.js

@@ -0,0 +1,89 @@
+import { CognitoIdentityProviderClient, InitiateAuthCommand, AuthFlowType, } from '@aws-sdk/client-cognito-identity-provider';
+import { COGNITO_CONFIG } from '../config.js';
+import { AuthenticationError } from '../errors/index.js';
+/**
+ * Cognito authenticator - uses AWS Cognito for JWT-based auth.
+ * Cognito pool configuration is baked in at build time per environment.
+ */
+export class CognitoAuthenticator {
+    name = 'cognito';
+    priority = 2; // After API key
+    accessToken = null;
+    refreshToken = null;
+    expiresAt = 0;
+    client;
+    credentials;
+    constructor(credentials) {
+        this.credentials = credentials;
+        this.client = new CognitoIdentityProviderClient({
+            region: COGNITO_CONFIG.region,
+        });
+    }
+    canAuthenticate() {
+        return !!(this.credentials.email && this.credentials.password);
+    }
+    isExpired() {
+        // 60 second buffer for network latency
+        return Date.now() >= this.expiresAt - 60000;
+    }
+    async getAuthHeaders() {
+        if (!this.accessToken || this.isExpired()) {
+            await this.authenticate();
+        }
+        return {
+            Authorization: `Bearer ${this.accessToken}`,
+        };
+    }
+    async refresh() {
+        if (!this.refreshToken) {
+            await this.authenticate();
+            return;
+        }
+        try {
+            const command = new InitiateAuthCommand({
+                AuthFlow: AuthFlowType.REFRESH_TOKEN_AUTH,
+                ClientId: COGNITO_CONFIG.clientId,
+                AuthParameters: {
+                    REFRESH_TOKEN: this.refreshToken,
+                },
+            });
+            const response = await this.client.send(command);
+            if (!response.AuthenticationResult?.AccessToken) {
+                throw new Error('No access token in refresh response');
+            }
+            this.accessToken = response.AuthenticationResult.AccessToken;
+            this.expiresAt = Date.now() + (response.AuthenticationResult.ExpiresIn ?? 3600) * 1000;
+        }
+        catch (_error) {
+            // Refresh failed, try full authentication
+            await this.authenticate();
+        }
+    }
+    async authenticate() {
+        try {
+            const command = new InitiateAuthCommand({
+                AuthFlow: AuthFlowType.USER_PASSWORD_AUTH,
+                ClientId: COGNITO_CONFIG.clientId,
+                AuthParameters: {
+                    USERNAME: this.credentials.email,
+                    PASSWORD: this.credentials.password,
+                },
+            });
+            const response = await this.client.send(command);
+            if (!response.AuthenticationResult?.AccessToken) {
+                throw new AuthenticationError('Authentication failed: No access token received');
+            }
+            this.accessToken = response.AuthenticationResult.AccessToken;
+            this.refreshToken = response.AuthenticationResult.RefreshToken ?? null;
+            this.expiresAt = Date.now() + (response.AuthenticationResult.ExpiresIn ?? 3600) * 1000;
+        }
+        catch (error) {
+            if (error instanceof AuthenticationError) {
+                throw error;
+            }
+            const message = error instanceof Error ? error.message : String(error);
+            throw new AuthenticationError(`Cognito authentication failed: ${message}`);
+        }
+    }
+}
+//# sourceMappingURL=cognito.authenticator.js.map

package/dist/core/auth/cognito.authenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cognito.authenticator.js","sourceRoot":"","sources":["../../../../../src/core/auth/cognito.authenticator.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,6BAA6B,EAC7B,mBAAmB,EACnB,YAAY,GACb,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAUzD;;;GAGG;AACH,MAAM,OAAO,oBAAoB;IACtB,IAAI,GAAG,SAAS,CAAC;IACjB,QAAQ,GAAG,CAAC,CAAC,CAAC,gBAAgB;IAE/B,WAAW,GAAkB,IAAI,CAAC;IAClC,YAAY,GAAkB,IAAI,CAAC;IACnC,SAAS,GAAG,CAAC,CAAC;IAEL,MAAM,CAAgC;IACtC,WAAW,CAAqB;IAEjD,YAAY,WAA+B;QACzC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,6BAA6B,CAAC;YAC9C,MAAM,EAAE,cAAc,CAAC,MAAM;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,eAAe;QACb,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACjE,CAAC;IAED,SAAS;QACP,uCAAuC;QACvC,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YAC1C,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5B,CAAC;QAED,OAAO;YACL,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE;SAC5C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC;gBACtC,QAAQ,EAAE,YAAY,CAAC,kBAAkB;gBACzC,QAAQ,EAAE,cAAc,CAAC,QAAQ;gBACjC,cAAc,EAAE;oBACd,aAAa,EAAE,IAAI,CAAC,YAAY;iBACjC;aACF,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAEjD,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,WAAW,EAAE,CAAC;gBAChD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACzD,CAAC;YAED,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC,oBAAoB,CAAC,WAAW,CAAC;YAC7D,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC;QACzF,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,0CAA0C;YAC1C,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC;gBACtC,QAAQ,EAAE,YAAY,CAAC,kBAAkB;gBACzC,QAAQ,EAAE,cAAc,CAAC,QAAQ;gBACjC,cAAc,EAAE;oBACd,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK;oBAChC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ;iBACpC;aACF,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAEjD,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,WAAW,EAAE,CAAC;gBAChD,MAAM,IAAI,mBAAmB,CAAC,iDAAiD,CAAC,CAAC;YACnF,CAAC;YAED,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC,oBAAoB,CAAC,WAAW,CAAC;YAC7D,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC,oBAAoB,CAAC,YAAY,IAAI,IAAI,CAAC;YACvE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC;QACzF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;gBACzC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,IAAI,mBAAmB,CAAC,kCAAkC,OAAO,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;CACF"}

package/dist/core/auth/index.d.ts

@@ -0,0 +1,8 @@
+export type { Authenticator } from './authenticator.js';
+export { ApiKeyAuthenticator } from './api-key.authenticator.js';
+export { CognitoAuthenticator } from './cognito.authenticator.js';
+export type { CognitoCredentials } from './cognito.authenticator.js';
+export { TokenAuthenticator } from './token.authenticator.js';
+export { LazyInteractiveAuthenticator } from './lazy-interactive.authenticator.js';
+export { AuthChain } from './auth-chain.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,YAAY,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AACnF,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/core/auth/index.js

@@ -0,0 +1,6 @@
+export { ApiKeyAuthenticator } from './api-key.authenticator.js';
+export { CognitoAuthenticator } from './cognito.authenticator.js';
+export { TokenAuthenticator } from './token.authenticator.js';
+export { LazyInteractiveAuthenticator } from './lazy-interactive.authenticator.js';
+export { AuthChain } from './auth-chain.js';
+//# sourceMappingURL=index.js.map

package/dist/core/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/core/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAElE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AACnF,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/core/auth/interactive.authenticator.d.ts

@@ -0,0 +1,22 @@
+import { Authenticator } from './authenticator.js';
+/**
+ * Interactive authenticator that prompts for credentials in a TTY environment.
+ * Only works when running in a terminal (process.stdout.isTTY).
+ *
+ * This authenticator delegates actual authentication to CognitoAuthenticator
+ * after collecting credentials from the user.
+ */
+export declare class InteractiveAuthenticator implements Authenticator {
+    readonly name = "interactive";
+    readonly priority = 3;
+    private cognitoAuth;
+    private promptedCredentials;
+    private promptPromise;
+    canAuthenticate(): boolean;
+    isExpired(): boolean;
+    getAuthHeaders(): Promise<Record<string, string>>;
+    refresh(): Promise<void>;
+    private isTTY;
+    private promptForCredentials;
+}
+//# sourceMappingURL=interactive.authenticator.d.ts.map

package/dist/core/auth/interactive.authenticator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interactive.authenticator.d.ts","sourceRoot":"","sources":["../../../../../src/core/auth/interactive.authenticator.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAInD;;;;;;GAMG;AACH,qBAAa,wBAAyB,YAAW,aAAa;IAC5D,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,QAAQ,KAAK;IAEtB,OAAO,CAAC,WAAW,CAAqC;IACxD,OAAO,CAAC,mBAAmB,CAAoD;IAC/E,OAAO,CAAC,aAAa,CAA8B;IAEnD,eAAe,IAAI,OAAO;IAK1B,SAAS,IAAI,OAAO;IAId,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAuBjD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAM9B,OAAO,CAAC,KAAK;YAIC,oBAAoB;CAyFnC"}

package/dist/core/auth/interactive.authenticator.js

@@ -0,0 +1,126 @@
+import { CognitoAuthenticator } from './cognito.authenticator.js';
+import { AuthenticationError } from '../errors/index.js';
+/**
+ * Interactive authenticator that prompts for credentials in a TTY environment.
+ * Only works when running in a terminal (process.stdout.isTTY).
+ *
+ * This authenticator delegates actual authentication to CognitoAuthenticator
+ * after collecting credentials from the user.
+ */
+export class InteractiveAuthenticator {
+    name = 'interactive';
+    priority = 3; // Lowest priority - only used if no other auth available
+    cognitoAuth = null;
+    promptedCredentials = null;
+    promptPromise = null;
+    canAuthenticate() {
+        // Can only authenticate in TTY environments
+        return this.isTTY();
+    }
+    isExpired() {
+        return this.cognitoAuth?.isExpired() ?? true;
+    }
+    async getAuthHeaders() {
+        // If we already have credentials, use them
+        if (this.cognitoAuth) {
+            return this.cognitoAuth.getAuthHeaders();
+        }
+        // Prompt for credentials if we haven't already
+        if (!this.promptedCredentials) {
+            if (!this.promptPromise) {
+                this.promptPromise = this.promptForCredentials();
+            }
+            await this.promptPromise;
+        }
+        if (!this.promptedCredentials) {
+            throw new AuthenticationError('Failed to collect credentials');
+        }
+        // Create cognito authenticator with collected credentials
+        this.cognitoAuth = new CognitoAuthenticator(this.promptedCredentials);
+        return this.cognitoAuth.getAuthHeaders();
+    }
+    async refresh() {
+        if (this.cognitoAuth) {
+            await this.cognitoAuth.refresh();
+        }
+    }
+    isTTY() {
+        return !!(process.stdout.isTTY && process.stdin.isTTY);
+    }
+    async promptForCredentials() {
+        if (!this.isTTY()) {
+            throw new AuthenticationError('Interactive authentication requires a TTY environment. ' +
+                'Please provide credentials via config or environment variables.');
+        }
+        // Dynamic import to avoid bundling Node.js built-in in browser builds
+        const readline = await import('readline');
+        const rl = readline.createInterface({
+            input: process.stdin,
+            output: process.stdout,
+        });
+        const question = (prompt) => {
+            return new Promise((resolve) => {
+                rl.question(prompt, (answer) => {
+                    resolve(answer);
+                });
+            });
+        };
+        const questionHidden = (prompt) => {
+            return new Promise((resolve) => {
+                process.stdout.write(prompt);
+                const stdin = process.stdin;
+                const originalRawMode = stdin.isRaw;
+                if (stdin.setRawMode) {
+                    stdin.setRawMode(true);
+                }
+                stdin.resume();
+                let password = '';
+                const onData = (char) => {
+                    const c = char.toString();
+                    switch (c) {
+                        case '\n':
+                        case '\r':
+                        case '\u0004': // Ctrl+D
+                            if (stdin.setRawMode) {
+                                stdin.setRawMode(originalRawMode ?? false);
+                            }
+                            stdin.pause();
+                            stdin.removeListener('data', onData);
+                            process.stdout.write('\n');
+                            resolve(password);
+                            break;
+                        case '\u0003': // Ctrl+C
+                            process.exit();
+                            break;
+                        case '\u007F': // Backspace
+                            if (password.length > 0) {
+                                password = password.slice(0, -1);
+                                process.stdout.write('\b \b');
+                            }
+                            break;
+                        default:
+                            password += c;
+                            process.stdout.write('*');
+                    }
+                };
+                stdin.on('data', onData);
+            });
+        };
+        try {
+            console.log('\n🔐 Ziftr SDK Authentication\n');
+            const email = await question('Email: ');
+            if (!email) {
+                throw new AuthenticationError('Email is required');
+            }
+            const password = await questionHidden('Password: ');
+            if (!password) {
+                throw new AuthenticationError('Password is required');
+            }
+            this.promptedCredentials = { email, password };
+        }
+        finally {
+            rl.close();
+        }
+    }
+}
+//# sourceMappingURL=interactive.authenticator.js.map

package/dist/core/auth/interactive.authenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interactive.authenticator.js","sourceRoot":"","sources":["../../../../../src/core/auth/interactive.authenticator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,OAAO,wBAAwB;IAC1B,IAAI,GAAG,aAAa,CAAC;IACrB,QAAQ,GAAG,CAAC,CAAC,CAAC,yDAAyD;IAExE,WAAW,GAAgC,IAAI,CAAC;IAChD,mBAAmB,GAA+C,IAAI,CAAC;IACvE,aAAa,GAAyB,IAAI,CAAC;IAEnD,eAAe;QACb,4CAA4C;QAC5C,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,2CAA2C;QAC3C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC;QAC3C,CAAC;QAED,+CAA+C;QAC/C,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBACxB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;YACnD,CAAC;YACD,MAAM,IAAI,CAAC,aAAa,CAAC;QAC3B,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC9B,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,CAAC,CAAC;QACjE,CAAC;QAED,0DAA0D;QAC1D,IAAI,CAAC,WAAW,GAAG,IAAI,oBAAoB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACtE,OAAO,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QACnC,CAAC;IACH,CAAC;IAEO,KAAK;QACX,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC;IAEO,KAAK,CAAC,oBAAoB;QAChC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,mBAAmB,CAC3B,yDAAyD;gBACvD,iEAAiE,CACpE,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,EAAE,GAAsB,QAAQ,CAAC,eAAe,CAAC;YACrD,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAmB,EAAE;YACnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;gBAC7B,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;oBAC7B,OAAO,CAAC,MAAM,CAAC,CAAC;gBAClB,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,MAAM,cAAc,GAAG,CAAC,MAAc,EAAmB,EAAE;YACzD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;gBAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAE7B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;gBAC5B,MAAM,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC;gBAEpC,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;oBACrB,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBACzB,CAAC;gBACD,KAAK,CAAC,MAAM,EAAE,CAAC;gBAEf,IAAI,QAAQ,GAAG,EAAE,CAAC;gBAElB,MAAM,MAAM,GAAG,CAAC,IAAY,EAAQ,EAAE;oBACpC,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAE1B,QAAQ,CAAC,EAAE,CAAC;wBACV,KAAK,IAAI,CAAC;wBACV,KAAK,IAAI,CAAC;wBACV,KAAK,QAAQ,EAAE,SAAS;4BACtB,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;gCACrB,KAAK,CAAC,UAAU,CAAC,eAAe,IAAI,KAAK,CAAC,CAAC;4BAC7C,CAAC;4BACD,KAAK,CAAC,KAAK,EAAE,CAAC;4BACd,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;4BACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;4BAC3B,OAAO,CAAC,QAAQ,CAAC,CAAC;4BAClB,MAAM;wBACR,KAAK,QAAQ,EAAE,SAAS;4BACtB,OAAO,CAAC,IAAI,EAAE,CAAC;4BACf,MAAM;wBACR,KAAK,QAAQ,EAAE,YAAY;4BACzB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gCACxB,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gCACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;4BAChC,CAAC;4BACD,MAAM;wBACR;4BACE,QAAQ,IAAI,CAAC,CAAC;4BACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBAC9B,CAAC;gBACH,CAAC,CAAC;gBAEF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC3B,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;YAE/C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;YACxC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;YACrD,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,YAAY,CAAC,CAAC;YACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,mBAAmB,CAAC,sBAAsB,CAAC,CAAC;YACxD,CAAC;YAED,IAAI,CAAC,mBAAmB,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QACjD,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,CAAC;IACH,CAAC;CACF"}

package/dist/core/auth/lazy-interactive.authenticator.d.ts

@@ -0,0 +1,51 @@
+import type { Authenticator } from './authenticator.js';
+/**
+ * Lazy-loading wrapper for InteractiveAuthenticator.
+ *
+ * Uses dynamic import() to load the real InteractiveAuthenticator only when needed,
+ * avoiding static imports of Node.js built-ins (readline) that break browser builds.
+ *
+ * In browser environments, this authenticator:
+ * - Returns false from canAuthenticate()
+ * - Throws AuthenticationError if getAuthHeaders() is called
+ */
+export declare class LazyInteractiveAuthenticator implements Authenticator {
+    readonly name = "interactive";
+    readonly priority = 3;
+    private realAuthenticator;
+    private loadPromise;
+    private loadError;
+    /**
+     * Check if this authenticator can authenticate.
+     * Returns false in browser environments or non-TTY terminals.
+     */
+    canAuthenticate(): boolean;
+    /**
+     * Check if current credentials/tokens are expired.
+     * Returns true until real authenticator is loaded.
+     */
+    isExpired(): boolean;
+    /**
+     * Get authorization headers. Triggers lazy load of InteractiveAuthenticator.
+     */
+    getAuthHeaders(): Promise<Record<string, string>>;
+    /**
+     * Refresh credentials if possible.
+     */
+    refresh(): Promise<void>;
+    /**
+     * Lazily load the real InteractiveAuthenticator.
+     * Caches the result to avoid repeated imports.
+     */
+    private loadAuthenticator;
+    private doLoad;
+    /**
+     * Check if running in a Node.js environment.
+     */
+    private isNodeEnvironment;
+    /**
+     * Check if running in a TTY environment.
+     */
+    private isTTY;
+}
+//# sourceMappingURL=lazy-interactive.authenticator.d.ts.map

package/dist/core/auth/lazy-interactive.authenticator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lazy-interactive.authenticator.d.ts","sourceRoot":"","sources":["../../../../../src/core/auth/lazy-interactive.authenticator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGxD;;;;;;;;;GASG;AACH,qBAAa,4BAA6B,YAAW,aAAa;IAChE,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,QAAQ,KAAK;IAEtB,OAAO,CAAC,iBAAiB,CAA8B;IACvD,OAAO,CAAC,WAAW,CAAuC;IAC1D,OAAO,CAAC,SAAS,CAAsB;IAEvC;;;OAGG;IACH,eAAe,IAAI,OAAO;IAc1B;;;OAGG;IACH,SAAS,IAAI,OAAO;IAIpB;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAiBvD;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAM9B;;;OAGG;YACW,iBAAiB;YAuBjB,MAAM;IAKpB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAMzB;;OAEG;IACH,OAAO,CAAC,KAAK;CAMd"}