@alwaysmeticulous/client 2.308.0 → 2.311.0

package/dist/oauth/__tests__/oauth-device-login.spec.js

@@ -0,0 +1,310 @@
+"use strict";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="4c9291f6-ed20-5fe9-8a45-7d2690d55b38")}catch(e){}}();
+
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const oauth_pkce_1 = require("../oauth-pkce");
+// Real performDeviceLogin() calls storeOAuthTokens() on success, which writes
+// to ~/.meticulous/oauth-tokens.json. Mock it so the success-path tests below
+// can't overwrite a developer's real login or fail with EPERM in locked-down CI.
+vitest_1.vi.mock("../oauth-token-store", () => ({
+    storeOAuthTokens: vitest_1.vi.fn(),
+}));
+const DEVICE_AUTHORIZATION_ENDPOINT = "https://issuer.example/device";
+const TOKEN_ENDPOINT = "https://issuer.example/token";
+const jsonResponse = (status, body) => ({
+    ok: status >= 200 && status < 300,
+    status,
+    text: () => Promise.resolve(JSON.stringify(body)),
+    json: () => Promise.resolve(body),
+});
+const discoveryResponse = ({ omitDeviceAuthorizationEndpoint = false, } = {}) => jsonResponse(200, {
+    token_endpoint: TOKEN_ENDPOINT,
+    ...(omitDeviceAuthorizationEndpoint
+        ? {}
+        : { device_authorization_endpoint: DEVICE_AUTHORIZATION_ENDPOINT }),
+});
+const deviceAuthorizationResponse = ({ interval, expiresIn = 600, } = {}) => jsonResponse(200, {
+    device_code: "device-code-1",
+    user_code: "ABCD-EFGH",
+    verification_uri: DEVICE_AUTHORIZATION_ENDPOINT,
+    expires_in: expiresIn,
+    ...(interval !== undefined ? { interval } : {}),
+});
+(0, vitest_1.describe)("performDeviceLogin", () => {
+    let fetchMock;
+    (0, vitest_1.beforeEach)(() => {
+        vitest_1.vi.resetModules();
+        vitest_1.vi.useFakeTimers();
+        fetchMock = vitest_1.vi.fn();
+        vitest_1.vi.stubGlobal("fetch", fetchMock);
+    });
+    (0, vitest_1.afterEach)(() => {
+        vitest_1.vi.useRealTimers();
+        vitest_1.vi.unstubAllGlobals();
+    });
+    const importPerformDeviceLogin = async () => {
+        const module = await Promise.resolve().then(() => __importStar(require("../oauth-device-login")));
+        return module.performDeviceLogin;
+    };
+    (0, vitest_1.it)("succeeds after a couple of pending polls", async () => {
+        fetchMock
+            .mockResolvedValueOnce(discoveryResponse())
+            .mockResolvedValueOnce(deviceAuthorizationResponse({ interval: 5 }))
+            .mockResolvedValueOnce(jsonResponse(400, { error: "authorization_pending" }))
+            .mockResolvedValueOnce(jsonResponse(400, { error: "authorization_pending" }))
+            .mockResolvedValueOnce(jsonResponse(200, {
+            access_token: "access-1",
+            refresh_token: "refresh-1",
+            expires_in: 300,
+            id_token: "id-1",
+        }));
+        const performDeviceLogin = await importPerformDeviceLogin();
+        const resultPromise = performDeviceLogin();
+        await vitest_1.vi.advanceTimersByTimeAsync(5000);
+        await vitest_1.vi.advanceTimersByTimeAsync(5000);
+        await vitest_1.vi.advanceTimersByTimeAsync(5000);
+        const tokens = await resultPromise;
+        (0, vitest_1.expect)(tokens.accessToken).toBe("access-1");
+        (0, vitest_1.expect)(tokens.refreshToken).toBe("refresh-1");
+        (0, vitest_1.expect)(tokens.idToken).toBe("id-1");
+        (0, vitest_1.expect)(fetchMock).toHaveBeenCalledTimes(5);
+        const deviceAuthCall = fetchMock.mock.calls[1];
+        (0, vitest_1.expect)(deviceAuthCall?.[0]).toBe(DEVICE_AUTHORIZATION_ENDPOINT);
+        const deviceAuthBody = new URLSearchParams(deviceAuthCall?.[1]?.body);
+        const codeChallenge = deviceAuthBody.get("code_challenge");
+        (0, vitest_1.expect)(codeChallenge).toBeTruthy();
+        (0, vitest_1.expect)(deviceAuthBody.get("code_challenge_method")).toBe("S256");
+        const tokenCall = fetchMock.mock.calls[2];
+        (0, vitest_1.expect)(tokenCall?.[0]).toBe(TOKEN_ENDPOINT);
+        const tokenCallBody = new URLSearchParams(tokenCall?.[1]?.body);
+        (0, vitest_1.expect)(tokenCallBody.get("grant_type")).toBe("urn:ietf:params:oauth:grant-type:device_code");
+        const codeVerifier = tokenCallBody.get("code_verifier");
+        (0, vitest_1.expect)(codeVerifier).toBeTruthy();
+        (0, vitest_1.expect)((0, oauth_pkce_1.generateCodeChallenge)(codeVerifier ?? "")).toBe(codeChallenge);
+    });
+    (0, vitest_1.it)("increases the interval by 5s on slow_down and keeps polling", async () => {
+        fetchMock
+            .mockResolvedValueOnce(discoveryResponse())
+            .mockResolvedValueOnce(deviceAuthorizationResponse({ interval: 5 }))
+            .mockResolvedValueOnce(jsonResponse(400, { error: "slow_down" }))
+            .mockResolvedValueOnce(jsonResponse(200, {
+            access_token: "access-2",
+            refresh_token: "refresh-2",
+            expires_in: 300,
+        }));
+        const performDeviceLogin = await importPerformDeviceLogin();
+        const resultPromise = performDeviceLogin();
+        // First poll fires at t=5s (the initial interval) and returns slow_down,
+        // bumping the interval to 10s.
+        await vitest_1.vi.advanceTimersByTimeAsync(5000);
+        (0, vitest_1.expect)(fetchMock).toHaveBeenCalledTimes(3);
+        // A poll at the old 5s cadence (t=10s) must NOT have fired yet, since the
+        // interval grew to 10s after the slow_down response.
+        await vitest_1.vi.advanceTimersByTimeAsync(5000);
+        (0, vitest_1.expect)(fetchMock).toHaveBeenCalledTimes(3);
+        // The next poll happens once the full 10s interval has elapsed (t=15s).
+        await vitest_1.vi.advanceTimersByTimeAsync(5000);
+        (0, vitest_1.expect)(fetchMock).toHaveBeenCalledTimes(4);
+        const tokens = await resultPromise;
+        (0, vitest_1.expect)(tokens.accessToken).toBe("access-2");
+    });
+    (0, vitest_1.it)("does not grow the interval on authorization_pending", async () => {
+        fetchMock
+            .mockResolvedValueOnce(discoveryResponse())
+            .mockResolvedValueOnce(deviceAuthorizationResponse({ interval: 5 }))
+            .mockResolvedValueOnce(jsonResponse(400, { error: "authorization_pending" }))
+            .mockResolvedValueOnce(jsonResponse(200, {
+            access_token: "access-3",
+            refresh_token: "refresh-3",
+            expires_in: 300,
+        }));
+        const performDeviceLogin = await importPerformDeviceLogin();
+        const resultPromise = performDeviceLogin();
+        // First poll fires at t=5s (the initial interval) and returns pending.
+        await vitest_1.vi.advanceTimersByTimeAsync(5000);
+        (0, vitest_1.expect)(fetchMock).toHaveBeenCalledTimes(3);
+        // A poll at t=9s must NOT have fired yet, since a pending response leaves
+        // the 5s interval unchanged (unlike slow_down, which grows it).
+        await vitest_1.vi.advanceTimersByTimeAsync(4000);
+        (0, vitest_1.expect)(fetchMock).toHaveBeenCalledTimes(3);
+        // The next poll happens once the unchanged 5s interval has elapsed (t=10s).
+        await vitest_1.vi.advanceTimersByTimeAsync(1000);
+        (0, vitest_1.expect)(fetchMock).toHaveBeenCalledTimes(4);
+        const tokens = await resultPromise;
+        (0, vitest_1.expect)(tokens.accessToken).toBe("access-3");
+    });
+    (0, vitest_1.it)("throws a clear error when the user denies the login", async () => {
+        fetchMock
+            .mockResolvedValueOnce(discoveryResponse())
+            .mockResolvedValueOnce(deviceAuthorizationResponse({ interval: 5 }))
+            .mockResolvedValueOnce(jsonResponse(400, { error: "access_denied" }));
+        const performDeviceLogin = await importPerformDeviceLogin();
+        const resultPromise = performDeviceLogin();
+        const expectation = (0, vitest_1.expect)(resultPromise).rejects.toThrow("Login was denied.");
+        await vitest_1.vi.advanceTimersByTimeAsync(5000);
+        await expectation;
+    });
+    (0, vitest_1.it)("throws a clear error when the server reports the device code expired", async () => {
+        fetchMock
+            .mockResolvedValueOnce(discoveryResponse())
+            .mockResolvedValueOnce(deviceAuthorizationResponse({ interval: 5 }))
+            .mockResolvedValueOnce(jsonResponse(400, { error: "expired_token" }));
+        const performDeviceLogin = await importPerformDeviceLogin();
+        const resultPromise = performDeviceLogin();
+        const expectation = (0, vitest_1.expect)(resultPromise).rejects.toThrow("Device code expired, run login again.");
+        await vitest_1.vi.advanceTimersByTimeAsync(5000);
+        await expectation;
+    });
+    (0, vitest_1.it)("makes a final poll at the deadline before giving up locally", async () => {
+        fetchMock
+            .mockResolvedValueOnce(discoveryResponse())
+            .mockResolvedValueOnce(deviceAuthorizationResponse({ interval: 5, expiresIn: 8 }))
+            .mockResolvedValueOnce(jsonResponse(400, { error: "authorization_pending" }))
+            .mockResolvedValueOnce(jsonResponse(400, { error: "authorization_pending" }));
+        const performDeviceLogin = await importPerformDeviceLogin();
+        const resultPromise = performDeviceLogin();
+        const expectation = (0, vitest_1.expect)(resultPromise).rejects.toThrow("Device code expired, run login again.");
+        // First poll at t=5s: still within the 8s deadline.
+        await vitest_1.vi.advanceTimersByTimeAsync(5000);
+        (0, vitest_1.expect)(fetchMock).toHaveBeenCalledTimes(3);
+        // Remaining lifetime is 3s, so the sleep is capped to that instead of the
+        // full 5s interval, and a final poll fires right at the t=8s deadline.
+        await vitest_1.vi.advanceTimersByTimeAsync(3000);
+        await expectation;
+        (0, vitest_1.expect)(fetchMock).toHaveBeenCalledTimes(4);
+    });
+    (0, vitest_1.it)("succeeds when approval arrives after the last pending poll but before expiry", async () => {
+        fetchMock
+            .mockResolvedValueOnce(discoveryResponse())
+            .mockResolvedValueOnce(deviceAuthorizationResponse({ interval: 5, expiresIn: 8 }))
+            .mockResolvedValueOnce(jsonResponse(400, { error: "authorization_pending" }))
+            .mockResolvedValueOnce(jsonResponse(200, {
+            access_token: "access-late",
+            refresh_token: "refresh-late",
+            expires_in: 300,
+        }));
+        const performDeviceLogin = await importPerformDeviceLogin();
+        const resultPromise = performDeviceLogin();
+        await vitest_1.vi.advanceTimersByTimeAsync(5000);
+        await vitest_1.vi.advanceTimersByTimeAsync(3000);
+        const tokens = await resultPromise;
+        (0, vitest_1.expect)(tokens.accessToken).toBe("access-late");
+        (0, vitest_1.expect)(fetchMock).toHaveBeenCalledTimes(4);
+    });
+    (0, vitest_1.it)("throws a clear error when the device authorization grant is not enabled on the realm", async () => {
+        fetchMock.mockResolvedValueOnce(discoveryResponse({ omitDeviceAuthorizationEndpoint: true }));
+        const performDeviceLogin = await importPerformDeviceLogin();
+        await (0, vitest_1.expect)(performDeviceLogin()).rejects.toThrow(/device_authorization_endpoint/);
+        (0, vitest_1.expect)(fetchMock).toHaveBeenCalledTimes(1);
+    });
+    (0, vitest_1.it)("throws a clear error when Keycloak rejects the client as unauthorized for the device grant", async () => {
+        // Verified against a real Keycloak 26.2.5: discovery still advertises
+        // `device_authorization_endpoint` even when the grant is disabled on this
+        // specific client (it's realm-level, not per-client) — Keycloak instead
+        // rejects the device-authorization POST itself with `unauthorized_client`.
+        fetchMock.mockResolvedValueOnce(discoveryResponse()).mockResolvedValueOnce(jsonResponse(400, {
+            error: "unauthorized_client",
+            error_description: "Client is not allowed to initiate OAuth 2.0 Device Authorization Grant. The flow is disabled for the client.",
+        }));
+        const performDeviceLogin = await importPerformDeviceLogin();
+        await (0, vitest_1.expect)(performDeviceLogin()).rejects.toThrow(/not enabled for the meticulous-cli client/);
+        (0, vitest_1.expect)(fetchMock).toHaveBeenCalledTimes(2);
+    });
+    (0, vitest_1.it)("throws a clear error when the device authorization response is missing expires_in", async () => {
+        fetchMock.mockResolvedValueOnce(discoveryResponse()).mockResolvedValueOnce(jsonResponse(200, {
+            device_code: "device-code-1",
+            user_code: "ABCD-EFGH",
+            verification_uri: DEVICE_AUTHORIZATION_ENDPOINT,
+            // expires_in omitted
+        }));
+        const performDeviceLogin = await importPerformDeviceLogin();
+        await (0, vitest_1.expect)(performDeviceLogin()).rejects.toThrow(/expires_in/);
+        (0, vitest_1.expect)(fetchMock).toHaveBeenCalledTimes(2);
+    });
+    (0, vitest_1.it)("throws a clear error when the device authorization response is missing user_code", async () => {
+        fetchMock.mockResolvedValueOnce(discoveryResponse()).mockResolvedValueOnce(jsonResponse(200, {
+            device_code: "device-code-1",
+            verification_uri: DEVICE_AUTHORIZATION_ENDPOINT,
+            expires_in: 600,
+        }));
+        const performDeviceLogin = await importPerformDeviceLogin();
+        await (0, vitest_1.expect)(performDeviceLogin()).rejects.toThrow(/user_code/);
+        (0, vitest_1.expect)(fetchMock).toHaveBeenCalledTimes(2);
+    });
+    (0, vitest_1.it)("tolerates a transient network error while polling and keeps going", async () => {
+        fetchMock
+            .mockResolvedValueOnce(discoveryResponse())
+            .mockResolvedValueOnce(deviceAuthorizationResponse({ interval: 5 }))
+            .mockRejectedValueOnce(new Error("network blip"))
+            .mockResolvedValueOnce(jsonResponse(200, {
+            access_token: "access-4",
+            refresh_token: "refresh-4",
+            expires_in: 300,
+        }));
+        const performDeviceLogin = await importPerformDeviceLogin();
+        const resultPromise = performDeviceLogin();
+        // The network error at t=5s doesn't grow the interval or abort the flow,
+        // so the next poll still fires at the unchanged 5s cadence (t=10s).
+        await vitest_1.vi.advanceTimersByTimeAsync(5000);
+        (0, vitest_1.expect)(fetchMock).toHaveBeenCalledTimes(3);
+        await vitest_1.vi.advanceTimersByTimeAsync(5000);
+        (0, vitest_1.expect)(fetchMock).toHaveBeenCalledTimes(4);
+        const tokens = await resultPromise;
+        (0, vitest_1.expect)(tokens.accessToken).toBe("access-4");
+    });
+    (0, vitest_1.it)("tolerates a transient 5xx from the token endpoint and keeps polling", async () => {
+        fetchMock
+            .mockResolvedValueOnce(discoveryResponse())
+            .mockResolvedValueOnce(deviceAuthorizationResponse({ interval: 5 }))
+            .mockResolvedValueOnce(jsonResponse(503, "Service Unavailable"))
+            .mockResolvedValueOnce(jsonResponse(200, {
+            access_token: "access-5",
+            refresh_token: "refresh-5",
+            expires_in: 300,
+        }));
+        const performDeviceLogin = await importPerformDeviceLogin();
+        const resultPromise = performDeviceLogin();
+        await vitest_1.vi.advanceTimersByTimeAsync(5000);
+        (0, vitest_1.expect)(fetchMock).toHaveBeenCalledTimes(3);
+        await vitest_1.vi.advanceTimersByTimeAsync(5000);
+        (0, vitest_1.expect)(fetchMock).toHaveBeenCalledTimes(4);
+        const tokens = await resultPromise;
+        (0, vitest_1.expect)(tokens.accessToken).toBe("access-5");
+    });
+});
+//# sourceMappingURL=oauth-device-login.spec.js.map
+//# debugId=4c9291f6-ed20-5fe9-8a45-7d2690d55b38

package/dist/oauth/__tests__/oauth-device-login.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-device-login.spec.js","sources":["../../../src/oauth/__tests__/oauth-device-login.spec.ts"],"sourceRoot":"","names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,mCAQgB;AAChB,8CAAsD;AAEtD,8EAA8E;AAC9E,8EAA8E;AAC9E,iFAAiF;AACjF,WAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC;IACrC,gBAAgB,EAAE,WAAE,CAAC,EAAE,EAAE;CAC1B,CAAC,CAAC,CAAC;AAEJ,MAAM,6BAA6B,GAAG,+BAA+B,CAAC;AACtE,MAAM,cAAc,GAAG,8BAA8B,CAAC;AAEtD,MAAM,YAAY,GAAG,CAAC,MAAc,EAAE,IAAa,EAAY,EAAE,CAC/D,CAAC;IACC,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG;IACjC,MAAM;IACN,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;CAClC,CAAa,CAAC;AAEjB,MAAM,iBAAiB,GAAG,CAAC,EACzB,+BAA+B,GAAG,KAAK,MACU,EAAE,EAAE,EAAE,CACvD,YAAY,CAAC,GAAG,EAAE;IAChB,cAAc,EAAE,cAAc;IAC9B,GAAG,CAAC,+BAA+B;QACjC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,EAAE,6BAA6B,EAAE,6BAA6B,EAAE,CAAC;CACtE,CAAC,CAAC;AAEL,MAAM,2BAA2B,GAAG,CAAC,EACnC,QAAQ,EACR,SAAS,GAAG,GAAG,MAC8B,EAAE,EAAE,EAAE,CACnD,YAAY,CAAC,GAAG,EAAE;IAChB,WAAW,EAAE,eAAe;IAC5B,SAAS,EAAE,WAAW;IACtB,gBAAgB,EAAE,6BAA6B;IAC/C,UAAU,EAAE,SAAS;IACrB,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CAChD,CAAC,CAAC;AAEL,IAAA,iBAAQ,EAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,IAAI,SAAuC,CAAC;IAE5C,IAAA,mBAAU,EAAC,GAAG,EAAE;QACd,WAAE,CAAC,YAAY,EAAE,CAAC;QAClB,WAAE,CAAC,aAAa,EAAE,CAAC;QACnB,SAAS,GAAG,WAAE,CAAC,EAAE,EAAE,CAAC;QACpB,WAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,IAAA,kBAAS,EAAC,GAAG,EAAE;QACb,WAAE,CAAC,aAAa,EAAE,CAAC;QACnB,WAAE,CAAC,gBAAgB,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,MAAM,wBAAwB,GAAG,KAAK,IAAI,EAAE;QAC1C,MAAM,MAAM,GAAG,wDAAa,uBAAuB,GAAC,CAAC;QACrD,OAAO,MAAM,CAAC,kBAAkB,CAAC;IACnC,CAAC,CAAC;IAEF,IAAA,WAAE,EAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,SAAS;aACN,qBAAqB,CAAC,iBAAiB,EAAE,CAAC;aAC1C,qBAAqB,CAAC,2BAA2B,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;aACnE,qBAAqB,CACpB,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CACtD;aACA,qBAAqB,CACpB,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CACtD;aACA,qBAAqB,CACpB,YAAY,CAAC,GAAG,EAAE;YAChB,YAAY,EAAE,UAAU;YACxB,aAAa,EAAE,WAAW;YAC1B,UAAU,EAAE,GAAG;YACf,QAAQ,EAAE,MAAM;SACjB,CAAC,CACH,CAAC;QAEJ,MAAM,kBAAkB,GAAG,MAAM,wBAAwB,EAAE,CAAC;QAC5D,MAAM,aAAa,GAAG,kBAAkB,EAAE,CAAC;QAE3C,MAAM,WAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,WAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,WAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAExC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;QAEnC,IAAA,eAAM,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAA,eAAM,EAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAA,eAAM,EAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,IAAA,eAAM,EAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAE3C,MAAM,cAAc,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/C,IAAA,eAAM,EAAC,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAChE,MAAM,cAAc,GAAG,IAAI,eAAe,CACxC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,IAAc,CACpC,CAAC;QACF,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC3D,IAAA,eAAM,EAAC,aAAa,CAAC,CAAC,UAAU,EAAE,CAAC;QACnC,IAAA,eAAM,EAAC,cAAc,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEjE,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAA,eAAM,EAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC5C,MAAM,aAAa,GAAG,IAAI,eAAe,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,IAAc,CAAC,CAAC;QAC1E,IAAA,eAAM,EAAC,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAC1C,8CAA8C,CAC/C,CAAC;QACF,MAAM,YAAY,GAAG,aAAa,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACxD,IAAA,eAAM,EAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC;QAClC,IAAA,eAAM,EAAC,IAAA,kCAAqB,EAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,SAAS;aACN,qBAAqB,CAAC,iBAAiB,EAAE,CAAC;aAC1C,qBAAqB,CAAC,2BAA2B,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;aACnE,qBAAqB,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;aAChE,qBAAqB,CACpB,YAAY,CAAC,GAAG,EAAE;YAChB,YAAY,EAAE,UAAU;YACxB,aAAa,EAAE,WAAW;YAC1B,UAAU,EAAE,GAAG;SAChB,CAAC,CACH,CAAC;QAEJ,MAAM,kBAAkB,GAAG,MAAM,wBAAwB,EAAE,CAAC;QAC5D,MAAM,aAAa,GAAG,kBAAkB,EAAE,CAAC;QAE3C,yEAAyE;QACzE,+BAA+B;QAC/B,MAAM,WAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAA,eAAM,EAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAE3C,0EAA0E;QAC1E,qDAAqD;QACrD,MAAM,WAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAA,eAAM,EAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAE3C,wEAAwE;QACxE,MAAM,WAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAA,eAAM,EAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAE3C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;QACnC,IAAA,eAAM,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,SAAS;aACN,qBAAqB,CAAC,iBAAiB,EAAE,CAAC;aAC1C,qBAAqB,CAAC,2BAA2B,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;aACnE,qBAAqB,CACpB,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CACtD;aACA,qBAAqB,CACpB,YAAY,CAAC,GAAG,EAAE;YAChB,YAAY,EAAE,UAAU;YACxB,aAAa,EAAE,WAAW;YAC1B,UAAU,EAAE,GAAG;SAChB,CAAC,CACH,CAAC;QAEJ,MAAM,kBAAkB,GAAG,MAAM,wBAAwB,EAAE,CAAC;QAC5D,MAAM,aAAa,GAAG,kBAAkB,EAAE,CAAC;QAE3C,uEAAuE;QACvE,MAAM,WAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAA,eAAM,EAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAE3C,0EAA0E;QAC1E,gEAAgE;QAChE,MAAM,WAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAA,eAAM,EAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAE3C,4EAA4E;QAC5E,MAAM,WAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAA,eAAM,EAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAE3C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;QACnC,IAAA,eAAM,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,SAAS;aACN,qBAAqB,CAAC,iBAAiB,EAAE,CAAC;aAC1C,qBAAqB,CAAC,2BAA2B,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;aACnE,qBAAqB,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;QAExE,MAAM,kBAAkB,GAAG,MAAM,wBAAwB,EAAE,CAAC;QAC5D,MAAM,aAAa,GAAG,kBAAkB,EAAE,CAAC;QAC3C,MAAM,WAAW,GACf,IAAA,eAAM,EAAC,aAAa,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAE7D,MAAM,WAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,WAAW,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,SAAS;aACN,qBAAqB,CAAC,iBAAiB,EAAE,CAAC;aAC1C,qBAAqB,CAAC,2BAA2B,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;aACnE,qBAAqB,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;QAExE,MAAM,kBAAkB,GAAG,MAAM,wBAAwB,EAAE,CAAC;QAC5D,MAAM,aAAa,GAAG,kBAAkB,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAG,IAAA,eAAM,EAAC,aAAa,CAAC,CAAC,OAAO,CAAC,OAAO,CACvD,uCAAuC,CACxC,CAAC;QAEF,MAAM,WAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,WAAW,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,SAAS;aACN,qBAAqB,CAAC,iBAAiB,EAAE,CAAC;aAC1C,qBAAqB,CACpB,2BAA2B,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAC3D;aACA,qBAAqB,CACpB,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CACtD;aACA,qBAAqB,CACpB,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CACtD,CAAC;QAEJ,MAAM,kBAAkB,GAAG,MAAM,wBAAwB,EAAE,CAAC;QAC5D,MAAM,aAAa,GAAG,kBAAkB,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAG,IAAA,eAAM,EAAC,aAAa,CAAC,CAAC,OAAO,CAAC,OAAO,CACvD,uCAAuC,CACxC,CAAC;QAEF,oDAAoD;QACpD,MAAM,WAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAA,eAAM,EAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAE3C,0EAA0E;QAC1E,uEAAuE;QACvE,MAAM,WAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,WAAW,CAAC;QAClB,IAAA,eAAM,EAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,SAAS;aACN,qBAAqB,CAAC,iBAAiB,EAAE,CAAC;aAC1C,qBAAqB,CACpB,2BAA2B,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAC3D;aACA,qBAAqB,CACpB,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CACtD;aACA,qBAAqB,CACpB,YAAY,CAAC,GAAG,EAAE;YAChB,YAAY,EAAE,aAAa;YAC3B,aAAa,EAAE,cAAc;YAC7B,UAAU,EAAE,GAAG;SAChB,CAAC,CACH,CAAC;QAEJ,MAAM,kBAAkB,GAAG,MAAM,wBAAwB,EAAE,CAAC;QAC5D,MAAM,aAAa,GAAG,kBAAkB,EAAE,CAAC;QAE3C,MAAM,WAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,WAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAExC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;QACnC,IAAA,eAAM,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC/C,IAAA,eAAM,EAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;QACpG,SAAS,CAAC,qBAAqB,CAC7B,iBAAiB,CAAC,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAC7D,CAAC;QAEF,MAAM,kBAAkB,GAAG,MAAM,wBAAwB,EAAE,CAAC;QAE5D,MAAM,IAAA,eAAM,EAAC,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAChD,+BAA+B,CAChC,CAAC;QACF,IAAA,eAAM,EAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,4FAA4F,EAAE,KAAK,IAAI,EAAE;QAC1G,sEAAsE;QACtE,0EAA0E;QAC1E,wEAAwE;QACxE,2EAA2E;QAC3E,SAAS,CAAC,qBAAqB,CAAC,iBAAiB,EAAE,CAAC,CAAC,qBAAqB,CACxE,YAAY,CAAC,GAAG,EAAE;YAChB,KAAK,EAAE,qBAAqB;YAC5B,iBAAiB,EACf,8GAA8G;SACjH,CAAC,CACH,CAAC;QAEF,MAAM,kBAAkB,GAAG,MAAM,wBAAwB,EAAE,CAAC;QAE5D,MAAM,IAAA,eAAM,EAAC,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAChD,2CAA2C,CAC5C,CAAC;QACF,IAAA,eAAM,EAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;QACjG,SAAS,CAAC,qBAAqB,CAAC,iBAAiB,EAAE,CAAC,CAAC,qBAAqB,CACxE,YAAY,CAAC,GAAG,EAAE;YAChB,WAAW,EAAE,eAAe;YAC5B,SAAS,EAAE,WAAW;YACtB,gBAAgB,EAAE,6BAA6B;YAC/C,qBAAqB;SACtB,CAAC,CACH,CAAC;QAEF,MAAM,kBAAkB,GAAG,MAAM,wBAAwB,EAAE,CAAC;QAE5D,MAAM,IAAA,eAAM,EAAC,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACjE,IAAA,eAAM,EAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,SAAS,CAAC,qBAAqB,CAAC,iBAAiB,EAAE,CAAC,CAAC,qBAAqB,CACxE,YAAY,CAAC,GAAG,EAAE;YAChB,WAAW,EAAE,eAAe;YAC5B,gBAAgB,EAAE,6BAA6B;YAC/C,UAAU,EAAE,GAAG;SAChB,CAAC,CACH,CAAC;QAEF,MAAM,kBAAkB,GAAG,MAAM,wBAAwB,EAAE,CAAC;QAE5D,MAAM,IAAA,eAAM,EAAC,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAChE,IAAA,eAAM,EAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,SAAS;aACN,qBAAqB,CAAC,iBAAiB,EAAE,CAAC;aAC1C,qBAAqB,CAAC,2BAA2B,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;aACnE,qBAAqB,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;aAChD,qBAAqB,CACpB,YAAY,CAAC,GAAG,EAAE;YAChB,YAAY,EAAE,UAAU;YACxB,aAAa,EAAE,WAAW;YAC1B,UAAU,EAAE,GAAG;SAChB,CAAC,CACH,CAAC;QAEJ,MAAM,kBAAkB,GAAG,MAAM,wBAAwB,EAAE,CAAC;QAC5D,MAAM,aAAa,GAAG,kBAAkB,EAAE,CAAC;QAE3C,yEAAyE;QACzE,oEAAoE;QACpE,MAAM,WAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAA,eAAM,EAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,WAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAA,eAAM,EAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAE3C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;QACnC,IAAA,eAAM,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,SAAS;aACN,qBAAqB,CAAC,iBAAiB,EAAE,CAAC;aAC1C,qBAAqB,CAAC,2BAA2B,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;aACnE,qBAAqB,CAAC,YAAY,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;aAC/D,qBAAqB,CACpB,YAAY,CAAC,GAAG,EAAE;YAChB,YAAY,EAAE,UAAU;YACxB,aAAa,EAAE,WAAW;YAC1B,UAAU,EAAE,GAAG;SAChB,CAAC,CACH,CAAC;QAEJ,MAAM,kBAAkB,GAAG,MAAM,wBAAwB,EAAE,CAAC;QAC5D,MAAM,aAAa,GAAG,kBAAkB,EAAE,CAAC;QAE3C,MAAM,WAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAA,eAAM,EAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,WAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAA,eAAM,EAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAE3C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;QACnC,IAAA,eAAM,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","debugId":"4c9291f6-ed20-5fe9-8a45-7d2690d55b38"}

package/dist/oauth/oauth-constants.d.ts

@@ -2,5 +2,6 @@ export declare const KEYCLOAK_ISSUER_URL: string;
 export declare const CLI_CLIENT_ID = "meticulous-cli";
 export declare const OAUTH_SCOPES = "openid email profile offline_access";
 export declare const getTokenEndpoint: () => Promise<string>;
+export declare const getDeviceAuthorizationEndpoint: () => Promise<string>;
 export declare const getWebappBaseUrl: () => string;
 //# sourceMappingURL=oauth-constants.d.ts.map

package/dist/oauth/oauth-constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-constants.d.ts","sourceRoot":"","sources":["../../src/oauth/oauth-constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,mBAAmB,QAEoB,CAAC;AAErD,eAAO,MAAM,aAAa,mBAAmB,CAAC;AAE9C,eAAO,MAAM,YAAY,wCAAwC,CAAC;AAMlE,eAAO,MAAM,gBAAgB,QAAa,OAAO,CAAC,MAAM,CAmBvD,CAAC;AAIF,eAAO,MAAM,gBAAgB,QAAO,MAenC,CAAC"}
+{"version":3,"file":"oauth-constants.d.ts","sourceRoot":"","sources":["../../src/oauth/oauth-constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,mBAAmB,QAEoB,CAAC;AAErD,eAAO,MAAM,aAAa,mBAAmB,CAAC;AAE9C,eAAO,MAAM,YAAY,wCAAwC,CAAC;AAgClE,eAAO,MAAM,gBAAgB,QAAa,OAAO,CAAC,MAAM,CAGvD,CAAC;AAEF,eAAO,MAAM,8BAA8B,QAAa,OAAO,CAAC,MAAM,CAUrE,CAAC;AAIF,eAAO,MAAM,gBAAgB,QAAO,MAenC,CAAC"}

package/dist/oauth/oauth-constants.js

@@ -1,17 +1,17 @@
 "use strict";
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8523fdc7-abca-5e6f-b527-a8df73477508")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="4836117c-ca38-52ca-af60-a97d89220835")}catch(e){}}();
 
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getWebappBaseUrl = exports.getTokenEndpoint = exports.OAUTH_SCOPES = exports.CLI_CLIENT_ID = exports.KEYCLOAK_ISSUER_URL = void 0;
+exports.getWebappBaseUrl = exports.getDeviceAuthorizationEndpoint = exports.getTokenEndpoint = exports.OAUTH_SCOPES = exports.CLI_CLIENT_ID = exports.KEYCLOAK_ISSUER_URL = void 0;
 exports.KEYCLOAK_ISSUER_URL = process.env["METICULOUS_OAUTH_ISSUER_URL"] ||
     "https://app.meticulous.ai/auth/realms/meticulous";
 exports.CLI_CLIENT_ID = "meticulous-cli";
 exports.OAUTH_SCOPES = "openid email profile offline_access";
 const WELL_KNOWN_PATH = "/.well-known/openid-configuration";
-let cachedTokenEndpoint = null;
-const getTokenEndpoint = async () => {
-    if (cachedTokenEndpoint) {
-        return cachedTokenEndpoint;
+let cachedOidcConfiguration = null;
+const getOidcConfiguration = async () => {
+    if (cachedOidcConfiguration) {
+        return cachedOidcConfiguration;
     }
     const response = await fetch(`${exports.KEYCLOAK_ISSUER_URL}${WELL_KNOWN_PATH}`);
     if (!response.ok) {
@@ -21,10 +21,24 @@ const getTokenEndpoint = async () => {
     if (!config.token_endpoint) {
         throw new Error("OpenID configuration missing token_endpoint");
     }
-    cachedTokenEndpoint = config.token_endpoint;
-    return cachedTokenEndpoint;
+    cachedOidcConfiguration = config;
+    return cachedOidcConfiguration;
+};
+const getTokenEndpoint = async () => {
+    const config = await getOidcConfiguration();
+    return config.token_endpoint;
 };
 exports.getTokenEndpoint = getTokenEndpoint;
+const getDeviceAuthorizationEndpoint = async () => {
+    const config = await getOidcConfiguration();
+    if (!config.device_authorization_endpoint) {
+        throw new Error("OpenID configuration missing device_authorization_endpoint. " +
+            "The OAuth 2.0 Device Authorization Grant is not enabled for the " +
+            `meticulous-cli client on this realm (${exports.KEYCLOAK_ISSUER_URL}).`);
+    }
+    return config.device_authorization_endpoint;
+};
+exports.getDeviceAuthorizationEndpoint = getDeviceAuthorizationEndpoint;
 const DEFAULT_WEBAPP_BASE_URL = "https://app.meticulous.ai";
 const getWebappBaseUrl = () => {
     const apiUrlFromEnv = process.env["METICULOUS_API_URL"];
@@ -39,4 +53,4 @@ const getWebappBaseUrl = () => {
 };
 exports.getWebappBaseUrl = getWebappBaseUrl;
 //# sourceMappingURL=oauth-constants.js.map
-//# debugId=8523fdc7-abca-5e6f-b527-a8df73477508
+//# debugId=4836117c-ca38-52ca-af60-a97d89220835

package/dist/oauth/oauth-constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-constants.js","sources":["../../src/oauth/oauth-constants.ts"],"sourceRoot":"","names":[],"mappings":";;;;;AAAa,QAAA,mBAAmB,GAC9B,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;IAC1C,kDAAkD,CAAC;AAExC,QAAA,aAAa,GAAG,gBAAgB,CAAC;AAEjC,QAAA,YAAY,GAAG,qCAAqC,CAAC;AAElE,MAAM,eAAe,GAAG,mCAAmC,CAAC;AAE5D,IAAI,mBAAmB,GAAkB,IAAI,CAAC;AAEvC,MAAM,gBAAgB,GAAG,KAAK,IAAqB,EAAE;IAC1D,IAAI,mBAAmB,EAAE,CAAC;QACxB,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,2BAAmB,GAAG,eAAe,EAAE,CAAC,CAAC;IACzE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,yCAAyC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAClF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA+B,CAAC;IACrE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,mBAAmB,GAAG,MAAM,CAAC,cAAc,CAAC;IAC5C,OAAO,mBAAmB,CAAC;AAC7B,CAAC,CAAC;AAnBW,QAAA,gBAAgB,oBAmB3B;AAEF,MAAM,uBAAuB,GAAG,2BAA2B,CAAC;AAErD,MAAM,gBAAgB,GAAG,GAAW,EAAE;IAC3C,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAExD,IAAI,aAAa,IAAI,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACzD,yEAAyE;QACzE,mCAAmC;QACnC,OAAO,aAAa;aACjB,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;aACxB,OAAO,CACN,iBAAiB,EACjB,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,aAAa,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAClD,CAAC;IACN,CAAC;IAED,OAAO,uBAAuB,CAAC;AACjC,CAAC,CAAC;AAfW,QAAA,gBAAgB,oBAe3B","debugId":"8523fdc7-abca-5e6f-b527-a8df73477508"}
+{"version":3,"file":"oauth-constants.js","sources":["../../src/oauth/oauth-constants.ts"],"sourceRoot":"","names":[],"mappings":";;;;;AAAa,QAAA,mBAAmB,GAC9B,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;IAC1C,kDAAkD,CAAC;AAExC,QAAA,aAAa,GAAG,gBAAgB,CAAC;AAEjC,QAAA,YAAY,GAAG,qCAAqC,CAAC;AAElE,MAAM,eAAe,GAAG,mCAAmC,CAAC;AAO5D,IAAI,uBAAuB,GAA6B,IAAI,CAAC;AAE7D,MAAM,oBAAoB,GAAG,KAAK,IAAgC,EAAE;IAClE,IAAI,uBAAuB,EAAE,CAAC;QAC5B,OAAO,uBAAuB,CAAC;IACjC,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,2BAAmB,GAAG,eAAe,EAAE,CAAC,CAAC;IACzE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,yCAAyC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAClF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAsB,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,uBAAuB,GAAG,MAAM,CAAC;IACjC,OAAO,uBAAuB,CAAC;AACjC,CAAC,CAAC;AAEK,MAAM,gBAAgB,GAAG,KAAK,IAAqB,EAAE;IAC1D,MAAM,MAAM,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC5C,OAAO,MAAM,CAAC,cAAc,CAAC;AAC/B,CAAC,CAAC;AAHW,QAAA,gBAAgB,oBAG3B;AAEK,MAAM,8BAA8B,GAAG,KAAK,IAAqB,EAAE;IACxE,MAAM,MAAM,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,6BAA6B,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,8DAA8D;YAC5D,kEAAkE;YAClE,wCAAwC,2BAAmB,IAAI,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,6BAA6B,CAAC;AAC9C,CAAC,CAAC;AAVW,QAAA,8BAA8B,kCAUzC;AAEF,MAAM,uBAAuB,GAAG,2BAA2B,CAAC;AAErD,MAAM,gBAAgB,GAAG,GAAW,EAAE;IAC3C,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAExD,IAAI,aAAa,IAAI,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACzD,yEAAyE;QACzE,mCAAmC;QACnC,OAAO,aAAa;aACjB,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;aACxB,OAAO,CACN,iBAAiB,EACjB,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,aAAa,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAClD,CAAC;IACN,CAAC;IAED,OAAO,uBAAuB,CAAC;AACjC,CAAC,CAAC;AAfW,QAAA,gBAAgB,oBAe3B","debugId":"4836117c-ca38-52ca-af60-a97d89220835"}

package/dist/oauth/oauth-device-login.d.ts

@@ -0,0 +1,3 @@
+import type { StoredOAuthTokens } from "./oauth-token-store";
+export declare const performDeviceLogin: () => Promise<StoredOAuthTokens>;
+//# sourceMappingURL=oauth-device-login.d.ts.map

package/dist/oauth/oauth-device-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-device-login.d.ts","sourceRoot":"","sources":["../../src/oauth/oauth-device-login.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AA2B7D,eAAO,MAAM,kBAAkB,QAAa,OAAO,CAAC,iBAAiB,CA+BpE,CAAC"}

package/dist/oauth/oauth-device-login.js

@@ -0,0 +1,169 @@
+"use strict";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="c23e572f-3089-543e-a18d-04649f6856ee")}catch(e){}}();
+
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.performDeviceLogin = void 0;
+const common_1 = require("@alwaysmeticulous/common");
+const oauth_constants_1 = require("./oauth-constants");
+const oauth_pkce_1 = require("./oauth-pkce");
+const oauth_token_store_1 = require("./oauth-token-store");
+const DEFAULT_POLL_INTERVAL_SECONDS = 5;
+const SLOW_DOWN_INCREMENT_SECONDS = 5;
+const performDeviceLogin = async () => {
+    const logger = (0, common_1.initLogger)();
+    // PKCE binds the token poll to this process: Keycloak enforces the client's
+    // PKCE policy on the device authorization endpoint too.
+    const codeVerifier = (0, oauth_pkce_1.generateCodeVerifier)();
+    const authorization = await requestDeviceAuthorization({
+        codeChallenge: (0, oauth_pkce_1.generateCodeChallenge)(codeVerifier),
+    });
+    const webappBaseUrl = (0, oauth_constants_1.getWebappBaseUrl)();
+    const cliLoginParams = new URLSearchParams({
+        user_code: authorization.user_code,
+        issuer: oauth_constants_1.KEYCLOAK_ISSUER_URL,
+    });
+    logger.info(`On any device, open: ${webappBaseUrl}/cli-device-login?${cliLoginParams.toString()} ` +
+        `and confirm the code: ${authorization.user_code}`);
+    logger.info(authorization.verification_uri_complete
+        ? `If that doesn't work, open ${authorization.verification_uri_complete}`
+        : `If that doesn't work, open ${authorization.verification_uri} and enter the code manually: ${authorization.user_code}`);
+    const tokens = await pollForTokens({ authorization, codeVerifier });
+    (0, oauth_token_store_1.storeOAuthTokens)(tokens);
+    logger.info("Authentication successful.");
+    return tokens;
+};
+exports.performDeviceLogin = performDeviceLogin;
+const requestDeviceAuthorization = async ({ codeChallenge, }) => {
+    const deviceAuthorizationEndpoint = await (0, oauth_constants_1.getDeviceAuthorizationEndpoint)();
+    const body = new URLSearchParams({
+        client_id: oauth_constants_1.CLI_CLIENT_ID,
+        scope: oauth_constants_1.OAUTH_SCOPES,
+        code_challenge: codeChallenge,
+        code_challenge_method: "S256",
+    });
+    const response = await fetch(deviceAuthorizationEndpoint, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: body.toString(),
+    });
+    const bodyText = await response.text();
+    if (!response.ok) {
+        // Discovery advertises `device_authorization_endpoint` at the realm level
+        // regardless of whether the grant is enabled on this specific client, so
+        // disabling it only on `meticulous-cli` isn't caught by
+        // `getDeviceAuthorizationEndpoint()`. Keycloak instead rejects the request
+        // itself with `unauthorized_client` — catch that here for the same clear
+        // message.
+        if (parseOAuthErrorCode(bodyText) === "unauthorized_client") {
+            throw new Error("The OAuth 2.0 Device Authorization Grant is not enabled for the " +
+                `meticulous-cli client on this realm (${oauth_constants_1.KEYCLOAK_ISSUER_URL}).`);
+        }
+        throw new Error(`Device authorization request failed: ${response.status} ${bodyText}`);
+    }
+    return parseDeviceAuthorizationResponse(bodyText);
+};
+const REQUIRED_DEVICE_AUTHORIZATION_STRING_FIELDS = [
+    "device_code",
+    "user_code",
+    "verification_uri",
+];
+const parseDeviceAuthorizationResponse = (bodyText) => {
+    const data = JSON.parse(bodyText);
+    for (const field of REQUIRED_DEVICE_AUTHORIZATION_STRING_FIELDS) {
+        if (typeof data[field] !== "string" || data[field].length === 0) {
+            throw new Error(`Device authorization response missing required field "${field}".`);
+        }
+    }
+    if (typeof data.expires_in !== "number" ||
+        !Number.isFinite(data.expires_in)) {
+        throw new Error('Device authorization response missing a valid "expires_in".');
+    }
+    return data;
+};
+const pollForTokens = async ({ authorization, codeVerifier, }) => {
+    const tokenEndpoint = await (0, oauth_constants_1.getTokenEndpoint)();
+    const deadline = Date.now() + authorization.expires_in * 1000;
+    let intervalSeconds = authorization.interval ?? DEFAULT_POLL_INTERVAL_SECONDS;
+    for (;;) {
+        const remainingMs = deadline - Date.now();
+        if (remainingMs <= 0) {
+            throw new Error("Device code expired, run login again.");
+        }
+        // Cap the sleep to the remaining lifetime so a final token request still
+        // fires before the local deadline, instead of giving up one interval early.
+        await sleep(Math.min(intervalSeconds * 1000, remainingMs));
+        const result = await requestDeviceToken({
+            tokenEndpoint,
+            deviceCode: authorization.device_code,
+            codeVerifier,
+        });
+        if (result.kind === "success") {
+            return result.tokens;
+        }
+        if (result.kind === "slow_down") {
+            intervalSeconds += SLOW_DOWN_INCREMENT_SECONDS;
+        }
+    }
+};
+const requestDeviceToken = async ({ tokenEndpoint, deviceCode, codeVerifier, }) => {
+    const body = new URLSearchParams({
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        device_code: deviceCode,
+        client_id: oauth_constants_1.CLI_CLIENT_ID,
+        code_verifier: codeVerifier,
+    });
+    let response;
+    let bodyText;
+    try {
+        response = await fetch(tokenEndpoint, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: body.toString(),
+        });
+        bodyText = await response.text();
+    }
+    catch {
+        // Transient network blip: keep polling until the local deadline instead
+        // of aborting an otherwise-valid, in-progress login.
+        return { kind: "pending" };
+    }
+    if (response.ok) {
+        const data = JSON.parse(bodyText);
+        return { kind: "success", tokens: mapTokenResponse(data) };
+    }
+    if (response.status >= 500) {
+        // Transient server error (5xx): same reasoning as the network-error case.
+        return { kind: "pending" };
+    }
+    const errorCode = parseOAuthErrorCode(bodyText);
+    if (errorCode === "authorization_pending") {
+        return { kind: "pending" };
+    }
+    if (errorCode === "slow_down") {
+        return { kind: "slow_down" };
+    }
+    if (errorCode === "access_denied") {
+        throw new Error("Login was denied.");
+    }
+    if (errorCode === "expired_token") {
+        throw new Error("Device code expired, run login again.");
+    }
+    throw new Error(`Device token request failed: ${response.status} ${bodyText}`);
+};
+const parseOAuthErrorCode = (bodyText) => {
+    try {
+        return JSON.parse(bodyText).error;
+    }
+    catch {
+        return undefined;
+    }
+};
+const mapTokenResponse = (data) => ({
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token,
+    expiresAt: Math.floor(Date.now() / 1000) + data.expires_in,
+    idToken: data.id_token,
+});
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+//# sourceMappingURL=oauth-device-login.js.map
+//# debugId=c23e572f-3089-543e-a18d-04649f6856ee

package/dist/oauth/oauth-device-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-device-login.js","sources":["../../src/oauth/oauth-device-login.ts"],"sourceRoot":"","names":[],"mappings":";;;;;AAAA,qDAAsD;AACtD,uDAO2B;AAC3B,6CAA2E;AAE3E,2DAAuD;AAEvD,MAAM,6BAA6B,GAAG,CAAC,CAAC;AACxC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAuB/B,MAAM,kBAAkB,GAAG,KAAK,IAAgC,EAAE;IACvE,MAAM,MAAM,GAAG,IAAA,mBAAU,GAAE,CAAC;IAE5B,4EAA4E;IAC5E,wDAAwD;IACxD,MAAM,YAAY,GAAG,IAAA,iCAAoB,GAAE,CAAC;IAC5C,MAAM,aAAa,GAAG,MAAM,0BAA0B,CAAC;QACrD,aAAa,EAAE,IAAA,kCAAqB,EAAC,YAAY,CAAC;KACnD,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,IAAA,kCAAgB,GAAE,CAAC;IACzC,MAAM,cAAc,GAAG,IAAI,eAAe,CAAC;QACzC,SAAS,EAAE,aAAa,CAAC,SAAS;QAClC,MAAM,EAAE,qCAAmB;KAC5B,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CACT,wBAAwB,aAAa,qBAAqB,cAAc,CAAC,QAAQ,EAAE,GAAG;QACpF,yBAAyB,aAAa,CAAC,SAAS,EAAE,CACrD,CAAC;IACF,MAAM,CAAC,IAAI,CACT,aAAa,CAAC,yBAAyB;QACrC,CAAC,CAAC,8BAA8B,aAAa,CAAC,yBAAyB,EAAE;QACzE,CAAC,CAAC,8BAA8B,aAAa,CAAC,gBAAgB,iCAAiC,aAAa,CAAC,SAAS,EAAE,CAC3H,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC;IAEpE,IAAA,oCAAgB,EAAC,MAAM,CAAC,CAAC;IACzB,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAE1C,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AA/BW,QAAA,kBAAkB,sBA+B7B;AAEF,MAAM,0BAA0B,GAAG,KAAK,EAAE,EACxC,aAAa,GAGd,EAAwC,EAAE;IACzC,MAAM,2BAA2B,GAAG,MAAM,IAAA,gDAA8B,GAAE,CAAC;IAE3E,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,SAAS,EAAE,+BAAa;QACxB,KAAK,EAAE,8BAAY;QACnB,cAAc,EAAE,aAAa;QAC7B,qBAAqB,EAAE,MAAM;KAC9B,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,2BAA2B,EAAE;QACxD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;KACtB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,0EAA0E;QAC1E,yEAAyE;QACzE,wDAAwD;QACxD,2EAA2E;QAC3E,yEAAyE;QACzE,WAAW;QACX,IAAI,mBAAmB,CAAC,QAAQ,CAAC,KAAK,qBAAqB,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CACb,kEAAkE;gBAChE,wCAAwC,qCAAmB,IAAI,CAClE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,wCAAwC,QAAQ,CAAC,MAAM,IAAI,QAAQ,EAAE,CACtE,CAAC;IACJ,CAAC;IAED,OAAO,gCAAgC,CAAC,QAAQ,CAAC,CAAC;AACpD,CAAC,CAAC;AAEF,MAAM,2CAA2C,GAAG;IAClD,aAAa;IACb,WAAW;IACX,kBAAkB;CACV,CAAC;AAEX,MAAM,gCAAgC,GAAG,CACvC,QAAgB,EACa,EAAE;IAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAyC,CAAC;IAE1E,KAAK,MAAM,KAAK,IAAI,2CAA2C,EAAE,CAAC;QAChE,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CACb,yDAAyD,KAAK,IAAI,CACnE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IACE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;QACnC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EACjC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,OAAO,IAAmC,CAAC;AAC7C,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,KAAK,EAAE,EAC3B,aAAa,EACb,YAAY,GAIb,EAA8B,EAAE;IAC/B,MAAM,aAAa,GAAG,MAAM,IAAA,kCAAgB,GAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,UAAU,GAAG,IAAI,CAAC;IAC9D,IAAI,eAAe,GAAG,aAAa,CAAC,QAAQ,IAAI,6BAA6B,CAAC;IAE9E,SAAS,CAAC;QACR,MAAM,WAAW,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1C,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QAED,yEAAyE;QACzE,4EAA4E;QAC5E,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,GAAG,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;QAE3D,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;YACtC,aAAa;YACb,UAAU,EAAE,aAAa,CAAC,WAAW;YACrC,YAAY;SACb,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,MAAM,CAAC,MAAM,CAAC;QACvB,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,eAAe,IAAI,2BAA2B,CAAC;QACjD,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,KAAK,EAAE,EAChC,aAAa,EACb,UAAU,EACV,YAAY,GAKb,EAAkC,EAAE;IACnC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,8CAA8C;QAC1D,WAAW,EAAE,UAAU;QACvB,SAAS,EAAE,+BAAa;QACxB,aAAa,EAAE,YAAY;KAC5B,CAAC,CAAC;IAEH,IAAI,QAAkB,CAAC;IACvB,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAC;QACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,qDAAqD;QACrD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IAED,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA+B,CAAC;QAChE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;IAC7D,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC3B,0EAA0E;QAC1E,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM,SAAS,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAEhD,IAAI,SAAS,KAAK,uBAAuB,EAAE,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC/B,CAAC;IACD,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,IAAI,KAAK,CACb,gCAAgC,QAAQ,CAAC,MAAM,IAAI,QAAQ,EAAE,CAC9D,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAAC,QAAgB,EAAsB,EAAE;IACnE,IAAI,CAAC;QACH,OAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAwB,CAAC,KAAK,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CACvB,IAAgC,EACb,EAAE,CAAC,CAAC;IACvB,WAAW,EAAE,IAAI,CAAC,YAAY;IAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;IAChC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU;IAC1D,OAAO,EAAE,IAAI,CAAC,QAAQ;CACvB,CAAC,CAAC;AAEH,MAAM,KAAK,GAAG,CAAC,EAAU,EAAiB,EAAE,CAC1C,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC","debugId":"c23e572f-3089-543e-a18d-04649f6856ee"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "2.308.0";
+export declare const VERSION = "2.311.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -5,6 +5,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.VERSION = void 0;
 // AUTO-GENERATED by scripts/generate-version.mjs — do not edit by hand.
 // Regenerated from package.json on every build.
-exports.VERSION = "2.308.0";
+exports.VERSION = "2.311.0";
 //# sourceMappingURL=version.js.map
 //# debugId=ac10f4cc-7a38-5615-8b9d-956b50ad79da

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alwaysmeticulous/client",
-  "version": "2.308.0",
+  "version": "2.311.0",
   "description": "Helper methods for using the Meticulous backend API",
   "license": "ISC",
   "main": "dist/index.js",
@@ -12,8 +12,8 @@
     "loglevel": "^1.8.0",
     "proxy-agent": "^6.4.0",
     "undici": "^6.24.1",
-    "@alwaysmeticulous/api": "2.307.0",
-    "@alwaysmeticulous/common": "2.301.0"
+    "@alwaysmeticulous/common": "2.310.0",
+    "@alwaysmeticulous/api": "2.310.0"
   },
   "author": {
     "name": "The Meticulous Team",