@bodhiapp/bodhi-js 0.0.23 → 0.0.24

package/dist/bodhi-web.cjs.js

@@ -1 +1 @@
-"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const s=require("@bodhiapp/bodhi-js-core");class p extends s.DirectClientBase{constructor(e,t){const r=s.createStoragePrefixWithBasePath(e.basePath,s.STORAGE_PREFIXES.WEB_DIRECT),o={authClientId:e.authClientId,authServerUrl:e.authServerUrl,userScope:e.userScope,storagePrefix:r,logLevel:e.logLevel,loggerPrefix:"DirectWebClient",apiTimeoutMs:e.apiTimeoutMs};super(o,t),this.redirectUri=e.redirectUri}async login(e){const t=await this.getAuthState();if(t.status==="authenticated")return t;const r=await this.requestResourceAccess(e?.toolsetScopeIds,e?.version);if(s.isApiResultOperationError(r))throw s.createOperationError(r.error.message,r.error.type);if(s.isApiResultError(r)){const{message:S}=r.body.error;throw s.createOperationError(S,"auth_error")}if(!s.isApiResultSuccess(r))throw s.createOperationError(`Unexpected HTTP ${r.status}`,"auth_error");const o=r.body.scope;localStorage.setItem(this.storageKeys.RESOURCE_SCOPE,o);const n=r.body.toolsets||[],a=s.getMissingToolsetScopeIds(e?.toolsetScopeIds,n);if(a.length>0)throw s.createOperationError(`toolsetScopeIds not received back from request-access call: [${a.join(", ")}], check developer console on configuring the toolset scopes correctly`,"auth_error");const h=s.getRequestedToolsetScopes(e?.toolsetScopeIds,n),c=`openid profile email roles ${this.userScope} ${o} ${h}`.trim(),i=s.generateCodeVerifier(),u=await s.generateCodeChallenge(i),g=s.generateCodeVerifier();localStorage.setItem(this.storageKeys.CODE_VERIFIER,i),localStorage.setItem(this.storageKeys.STATE,g);const l=new URL(this.authEndpoints.authorize);throw l.searchParams.set("client_id",this.authClientId),l.searchParams.set("response_type","code"),l.searchParams.set("redirect_uri",this.redirectUri),l.searchParams.set("scope",c),l.searchParams.set("code_challenge",u),l.searchParams.set("code_challenge_method","S256"),l.searchParams.set("state",g),window.location.href=l.toString(),new Error("Redirect initiated")}async handleOAuthCallback(e,t){const r=localStorage.getItem(this.storageKeys.STATE);if(!r||r!==t)throw new Error("Invalid state parameter - possible CSRF attack");await this.exchangeCodeForTokens(e),localStorage.removeItem(this.storageKeys.CODE_VERIFIER),localStorage.removeItem(this.storageKeys.STATE);const o=await this.getAuthState();if(o.status!=="authenticated")throw new Error("Login failed");return this.setAuthState(o),o}async logout(){const e=localStorage.getItem(this.storageKeys.REFRESH_TOKEN);if(e)try{const r=new URLSearchParams({token:e,client_id:this.authClientId,token_type_hint:"refresh_token"});await fetch(this.authEndpoints.revoke,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:r})}catch(r){this.logger.warn("Token revocation failed:",r)}localStorage.removeItem(this.storageKeys.ACCESS_TOKEN),localStorage.removeItem(this.storageKeys.REFRESH_TOKEN),localStorage.removeItem(this.storageKeys.EXPIRES_AT),localStorage.removeItem(this.storageKeys.RESOURCE_SCOPE);const t={status:"unauthenticated",user:null,accessToken:null,error:null};return this.setAuthState(t),t}async exchangeCodeForTokens(e){const t=localStorage.getItem(this.storageKeys.CODE_VERIFIER);if(!t)throw new Error("Code verifier not found");const r=await fetch(this.authEndpoints.token,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:e,redirect_uri:this.redirectUri,client_id:this.authClientId,code_verifier:t})});if(!r.ok){const n=await r.text();throw new Error(`Token exchange failed: ${r.status} ${n}`)}const o=await r.json();if(localStorage.setItem(this.storageKeys.ACCESS_TOKEN,o.access_token),o.refresh_token&&localStorage.setItem(this.storageKeys.REFRESH_TOKEN,o.refresh_token),o.expires_in){const n=Date.now()+o.expires_in*1e3;localStorage.setItem(this.storageKeys.EXPIRES_AT,n.toString())}}async _storageGet(e){return localStorage.getItem(e)}async _storageSet(e){Object.entries(e).forEach(([t,r])=>{localStorage.setItem(t,String(r))})}async _storageRemove(e){e.forEach(t=>localStorage.removeItem(t))}_getRedirectUri(){return this.redirectUri}}const m=500,_=5e3,f=3e4;class y{constructor(e,t,r){this.state=s.EXTENSION_STATE_NOT_INITIALIZED,this.bodhiext=null,this.refreshPromise=null,this.logger=new s.Logger("WindowBodhiextClient",t.logLevel),this.authClientId=e,this.config=t,this.authEndpoints=s.createOAuthEndpoints(this.config.authServerUrl),this.onStateChange=r??s.NOOP_STATE_CALLBACK;const o=s.createStoragePrefixWithBasePath(t.basePath,s.STORAGE_PREFIXES.WEB_EXT);this.storageKeys=s.createStorageKeys(o),this.apiTimeoutMs=t.apiTimeoutMs??f}setState(e){this.state=e,this.logger.info(`{state: ${JSON.stringify(e)}} - Setting client state`),this.onStateChange({type:"client-state",state:e})}setAuthState(e){this.onStateChange({type:"auth-state",state:e})}setStateCallback(e){this.onStateChange=e}ensureBodhiext(){if(!this.bodhiext&&window.bodhiext&&(this.logger.info("Acquiring window.bodhiext reference"),this.bodhiext=window.bodhiext),!this.bodhiext)throw s.createOperationError("Client not initialized","extension_error")}async sendExtRequest(e,t){return this.ensureBodhiext(),this.bodhiext.sendExtRequest(e,t)}async sendApiRequest(e,t,r,o,n){try{this.ensureBodhiext()}catch(a){return{error:{message:a instanceof Error?a.message:String(a),type:"extension_error"}}}try{const a=new Promise((c,i)=>setTimeout(()=>i(new Error(`[bodhi-js-sdk/web] network timeout: api request not completed within configured/default timeout of ${this.apiTimeoutMs}ms`)),this.apiTimeoutMs)),h=(async()=>{let c=o||{};if(n){const i=await this._getAccessTokenRaw();if(!i)return{error:{message:"Not authenticated. Please log in first.",type:"extension_error"}};c={...c,Authorization:`Bearer ${i}`}}return this.bodhiext.sendApiRequest(e,t,r,c)})();return await Promise.race([h,a])}catch(a){const h=a?.error,c=h?.message??(a instanceof Error?a.message:String(a)),i=h?.type||"network_error";return{error:{message:c,type:i}}}}getState(){return this.state}isClientInitialized(){return this.state.extension==="ready"}isServerReady(){return this.isClientInitialized()&&this.state.server.status==="ready"}async init(e={}){if(!e.testConnection&&!e.selectedConnection)return this.logger.info("No testConnection or selectedConnection, returning not-initialized state"),s.EXTENSION_STATE_NOT_INITIALIZED;if(this.bodhiext&&!e.testConnection)return this.logger.debug("Already have bodhiext handle, skipping polling"),this.state;if(!this.bodhiext){const o=e.timeoutMs??this.config.initParams?.extension?.timeoutMs??_,n=e.intervalMs??this.config.initParams?.extension?.intervalMs??m,a=Date.now();if(!await new Promise(c=>{const i=()=>{if(window.bodhiext){this.bodhiext=window.bodhiext,c(!0);return}if(Date.now()-a>=o){c(!1);return}setTimeout(i,n)};i()}))return this.logger.warn("Extension discovery timed out"),this.setState(s.EXTENSION_STATE_NOT_FOUND),this.state}const t=await this.bodhiext.getExtensionId();this.logger.info(`Extension discovered: ${t}`);const r={type:"extension",extension:"ready",extensionId:t,server:s.PENDING_EXTENSION_READY};if(e.testConnection)try{const o=await this.getServerState();this.setState({...r,server:o}),this.logger.info(`Server connectivity tested: ${o.status}`)}catch(o){this.logger.error("Failed to get server state:",o),this.setState({...r,server:s.BACKEND_SERVER_NOT_REACHABLE})}else this.setState(r);return this.state}async requestResourceAccess(e,t){this.ensureBodhiext();const r={app_client_id:this.authClientId,...e&&{toolset_scope_ids:e},...t&&{version:t}};return this.bodhiext.sendApiRequest("POST","/bodhi/v1/apps/request-access",r)}async login(e){const t=await this.getAuthState();if(t.status==="authenticated")return t;this.ensureBodhiext();const r=await this.requestResourceAccess(e?.toolsetScopeIds,e?.version);if(s.isApiResultOperationError(r))throw s.createOperationError(r.error.message,r.error.type);if(s.isApiResultError(r)){const{message:E}=r.body.error;throw s.createOperationError(E,"auth_error")}if(!s.isApiResultSuccess(r))throw s.createOperationError(`Unexpected HTTP ${r.status}`,"auth_error");const o=r.body.scope;localStorage.setItem(this.storageKeys.RESOURCE_SCOPE,o);const n=r.body.toolsets||[],a=s.getMissingToolsetScopeIds(e?.toolsetScopeIds,n);if(a.length>0)throw s.createOperationError(`toolsetScopeIds not received back from request-access call: [${a.join(", ")}], check developer console on configuring the toolset scopes correctly`,"auth_error");const h=s.getRequestedToolsetScopes(e?.toolsetScopeIds,n),c=s.generateCodeVerifier(),i=await s.generateCodeChallenge(c),u=s.generateCodeVerifier();localStorage.setItem(this.storageKeys.CODE_VERIFIER,c),localStorage.setItem(this.storageKeys.STATE,u);const g=["openid","profile","email","roles",this.config.userScope,o,...h?h.split(" "):[]],l=new URLSearchParams({response_type:"code",client_id:this.authClientId,redirect_uri:this.config.redirectUri,scope:g.join(" "),state:u,code_challenge:i,code_challenge_method:"S256"}),S=`${this.authEndpoints.authorize}?${l}`;return window.location.href=S,new Promise(()=>{})}async handleOAuthCallback(e,t){const r=localStorage.getItem(this.storageKeys.STATE);if(!r||r!==t)throw new Error("Invalid state parameter - possible CSRF attack");await this.exchangeCodeForTokens(e),localStorage.removeItem(this.storageKeys.CODE_VERIFIER),localStorage.removeItem(this.storageKeys.STATE);const o=await this.getAuthState();if(o.status!=="authenticated")throw new Error("Login failed");return this.setAuthState(o),o}async exchangeCodeForTokens(e){const t=localStorage.getItem(this.storageKeys.CODE_VERIFIER);if(!t)throw new Error("Code verifier not found");const r=new URLSearchParams({grant_type:"authorization_code",client_id:this.authClientId,code:e,redirect_uri:this.config.redirectUri,code_verifier:t}),o=await fetch(this.authEndpoints.token,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:r});if(!o.ok){const a=await o.text();throw new Error(`Token exchange failed: ${o.status} ${a}`)}const n=await o.json();if(!n.access_token)throw new Error("No access token received");if(localStorage.setItem(this.storageKeys.ACCESS_TOKEN,n.access_token),n.refresh_token&&localStorage.setItem(this.storageKeys.REFRESH_TOKEN,n.refresh_token),n.expires_in){const a=Date.now()+n.expires_in*1e3;localStorage.setItem(this.storageKeys.EXPIRES_AT,a.toString())}}async logout(){const e=localStorage.getItem(this.storageKeys.REFRESH_TOKEN);if(e)try{const r=new URLSearchParams({token:e,client_id:this.authClientId,token_type_hint:"refresh_token"});await fetch(this.authEndpoints.revoke,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:r})}catch(r){this.logger.warn("Token revocation failed:",r)}localStorage.removeItem(this.storageKeys.ACCESS_TOKEN),localStorage.removeItem(this.storageKeys.REFRESH_TOKEN),localStorage.removeItem(this.storageKeys.EXPIRES_AT),localStorage.removeItem(this.storageKeys.CODE_VERIFIER),localStorage.removeItem(this.storageKeys.STATE),localStorage.removeItem(this.storageKeys.RESOURCE_SCOPE);const t={status:"unauthenticated",user:null,accessToken:null,error:null};return this.setAuthState(t),t}async getAuthState(){const e=await this._getAccessTokenRaw();if(!e)return{status:"unauthenticated",user:null,accessToken:null,error:null};try{return{status:"authenticated",user:s.extractUserInfo(e),accessToken:e,error:null}}catch(t){return this.logger.error("Failed to parse token:",t),{status:"unauthenticated",user:null,accessToken:null,error:null}}}async _getAccessTokenRaw(){const e=localStorage.getItem(this.storageKeys.ACCESS_TOKEN),t=localStorage.getItem(this.storageKeys.EXPIRES_AT);if(!e)return null;if(t){const r=parseInt(t,10);if(Date.now()>=r-5*1e3){const o=localStorage.getItem(this.storageKeys.REFRESH_TOKEN);return o?this._tryRefreshToken(o):null}}return e}async _tryRefreshToken(e){if(this.refreshPromise)return this.logger.debug("Refresh already in progress, returning existing promise"),this.refreshPromise;this.refreshPromise=this._doRefreshToken(e);try{return await this.refreshPromise}finally{this.refreshPromise=null}}async _doRefreshToken(e){this.logger.debug("Refreshing access token");try{const t=await s.refreshAccessToken(this.authEndpoints.token,e,this.authClientId);if(t.success){this._storeRefreshedTokens(t.tokens);const r=s.extractUserInfo(t.tokens.access_token);return this.setAuthState({status:"authenticated",user:r,accessToken:t.tokens.access_token,error:null}),this.logger.info("Token refreshed successfully"),t.tokens.access_token}if(t.error==="invalid_grant")return this.logger.warn("Refresh token expired or revoked, clearing tokens and logging out"),this.clearAuthStorage(),this.setAuthState({status:"unauthenticated",user:null,accessToken:null,error:null}),null}catch(t){this.logger.warn("Token refresh failed:",t)}throw this.logger.warn("Token refresh failed, keeping tokens for manual retry"),s.createOperationError("Access token expired and unable to refresh. Try logging out and logging in again.","token_refresh_failed")}clearAuthStorage(){localStorage.removeItem(this.storageKeys.ACCESS_TOKEN),localStorage.removeItem(this.storageKeys.REFRESH_TOKEN),localStorage.removeItem(this.storageKeys.EXPIRES_AT),localStorage.removeItem(this.storageKeys.RESOURCE_SCOPE)}_storeRefreshedTokens(e){const t=Date.now()+e.expires_in*1e3;localStorage.setItem(this.storageKeys.ACCESS_TOKEN,e.access_token),localStorage.setItem(this.storageKeys.EXPIRES_AT,String(t)),e.refresh_token&&localStorage.setItem(this.storageKeys.REFRESH_TOKEN,e.refresh_token)}async pingApi(){return this.sendApiRequest("GET","/ping")}async getServerState(){const e=await this.sendApiRequest("GET","/bodhi/v1/info");if(s.isApiResultOperationError(e)||!s.isApiResultSuccess(e))return s.BACKEND_SERVER_NOT_REACHABLE;const t=e.body;switch(t.status){case"ready":return{status:"ready",version:t.version||"unknown",error:null};case"setup":return s.backendServerNotReady("setup",t.version||"unknown");case"resource-admin":return s.backendServerNotReady("resource-admin",t.version||"unknown");case"error":return s.backendServerNotReady("error",t.version||"unknown",t.error?{message:t.error.message,type:t.error.type}:s.SERVER_ERROR_CODES.SERVER_NOT_READY);default:return s.BACKEND_SERVER_NOT_REACHABLE}}async*stream(e,t,r,o,n=!0){this.ensureBodhiext();let a=o||{};if(n){const i=await this._getAccessTokenRaw();if(!i)throw s.createOperationError("Not authenticated. Please log in first.","auth_error");a={...a,Authorization:`Bearer ${i}`}}const c=this.bodhiext.sendStreamRequest(e,t,r,a).getReader();try{for(;;){const{value:i,done:u}=await c.read();if(u||i?.done)break;yield i.body}}catch(i){if(i instanceof Error){if("response"in i){const u=i;throw s.createApiError(i.message,u.response.status,u.response.body)}throw"error"in i,s.createOperationError(i.message,"extension_error")}throw i}finally{c.releaseLock()}}get chat(){return this._chat??=new s.Chat(this)}get models(){return this._models??=new s.Models(this)}get embeddings(){return this._embeddings??=new s.Embeddings(this)}serialize(){return{extensionId:this.state.type==="extension"&&this.state.extension==="ready"?this.state.extensionId:void 0}}async debug(){return{type:"WindowBodhiextClient",state:this.state,authState:await this.getAuthState(),bodhiextAvailable:this.bodhiext!==null,authClientId:this.authClientId,authServerUrl:this.config.authServerUrl,redirectUri:this.config.redirectUri,userScope:this.config.userScope}}}function T(d){if(typeof window>"u")throw new Error("redirectUri required in non-browser environment");const e=d==="/"?"":d.replace(/\/$/,"");return`${window.location.origin}${e}/callback`}class w extends s.BaseFacadeClient{constructor(e,t,r){const o=t||{},n={basePath:o.basePath||"/",redirectUri:o.redirectUri||T(o.basePath||"/"),authServerUrl:o.authServerUrl||"https://id.getbodhi.app/realms/bodhi",userScope:o.userScope||"scope_user_user",logLevel:o.logLevel||"warn",apiTimeoutMs:o.apiTimeoutMs,initParams:o.initParams};super(e,n,r)}createLogger(e){return new s.Logger("WebUIClient",e.logLevel)}createStoragePrefix(e){return s.createStoragePrefixWithBasePath(e.basePath,s.STORAGE_PREFIXES.WEB)}createExtClient(e,t){return new y(this.authClientId,{authServerUrl:e.authServerUrl,redirectUri:e.redirectUri,userScope:e.userScope,basePath:e.basePath,logLevel:e.logLevel,apiTimeoutMs:e.apiTimeoutMs,initParams:e.initParams},t)}createDirectClient(e,t,r){return new p({authClientId:e,authServerUrl:t.authServerUrl,redirectUri:t.redirectUri,userScope:t.userScope,logLevel:t.logLevel,basePath:t.basePath,apiTimeoutMs:t.apiTimeoutMs},r)}async handleOAuthCallback(e,t){return this.connectionMode==="direct"?this.directClient.handleOAuthCallback(e,t):this.extClient.handleOAuthCallback(e,t)}}const I="production";exports.WEB_BUILD_MODE=I;exports.WebUIClient=w;
+"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const r=require("@bodhiapp/bodhi-js-core");class _ extends r.DirectClientBase{constructor(e,t){const s=r.createStoragePrefixWithBasePath(e.basePath,r.STORAGE_PREFIXES.WEB_DIRECT),o={authClientId:e.authClientId,authServerUrl:e.authServerUrl,userRole:e.userRole,storagePrefix:s,logLevel:e.logLevel,loggerPrefix:"DirectWebClient",apiTimeoutMs:e.apiTimeoutMs};super(o,t),this.redirectUri=e.redirectUri}async login(e){const t=await this.getAuthState();if(t.status==="authenticated")return t;const s=e?.userRole??this.userRole,o=e?.flowType??"popup";e?.onProgress?.("requesting");const i=new r.AccessRequestBuilder(this.authClientId).requestedRole(s).flowType(o);if(e?.requested&&i.requested(e.requested),o==="redirect"){const u=e?.redirectUrl??this.redirectUri;i.redirectUrl(u)}const n=i.build(),c=await this.requestAccess(n);if(r.isApiResultOperationError(c))throw r.createOperationError(c.error.message,c.error.type);if(!r.isApiResultSuccess(c))throw r.createOperationError(`Access request failed: HTTP ${c.status}`,"auth_error");const{id:l,review_url:a}=c.body;e?.onProgress?.("reviewing");let h;if(o==="popup"){const u=async()=>{const p=await this.getAccessRequestStatus(l);if(!r.isApiResultSuccess(p))return null;const{status:E,access_request_scope:S}=p.body;return E==="approved"?{approved:!0,accessRequestScope:S??void 0}:["denied","failed","expired"].includes(E)?{approved:!1}:null},g=await r.openPopupReview(a,u,{intervalMs:e?.pollIntervalMs??r.DEFAULT_POLL_INTERVAL_MS,timeoutMs:e?.pollTimeoutMs??r.DEFAULT_POLL_TIMEOUT_MS});if(!g.approved)throw r.createOperationError("Access request was denied or expired","auth_error");h=g.accessRequestScope}else return localStorage.setItem(this.storageKeys.ACCESS_REQUEST_ID,l),window.location.href=a,new Promise(()=>{});return e?.onProgress?.("authenticating"),this.performOAuthPkce(`openid profile email roles ${h??""}`.trim())}async performOAuthPkce(e){const t=r.generateCodeVerifier(),s=await r.generateCodeChallenge(t),o=r.generateCodeVerifier();localStorage.setItem(this.storageKeys.CODE_VERIFIER,t),localStorage.setItem(this.storageKeys.STATE,o);const i=new URL(this.authEndpoints.authorize);throw i.searchParams.set("client_id",this.authClientId),i.searchParams.set("response_type","code"),i.searchParams.set("redirect_uri",this.redirectUri),i.searchParams.set("scope",e),i.searchParams.set("code_challenge",s),i.searchParams.set("code_challenge_method","S256"),i.searchParams.set("state",o),window.location.href=i.toString(),new Error("Redirect initiated")}async handleOAuthCallback(e,t){const s=localStorage.getItem(this.storageKeys.STATE);if(!s||s!==t)throw new Error("Invalid state parameter - possible CSRF attack");await this.exchangeCodeForTokens(e),localStorage.removeItem(this.storageKeys.CODE_VERIFIER),localStorage.removeItem(this.storageKeys.STATE);const o=await this.getAuthState();if(o.status!=="authenticated")throw new Error("Login failed");return this.setAuthState(o),o}async handleAccessRequestCallback(e){const t=await this.getAccessRequestStatus(e);if(!r.isApiResultSuccess(t))throw r.createOperationError("Failed to get access request status","auth_error");const{status:s,access_request_scope:o}=t.body;if(s!=="approved")throw r.createOperationError(`Access request is not approved: ${s}`,"auth_error");const i=`openid profile email roles ${o??""}`.trim();return localStorage.removeItem(this.storageKeys.ACCESS_REQUEST_ID),this.performOAuthPkce(i)}async logout(){const e=localStorage.getItem(this.storageKeys.REFRESH_TOKEN);if(e)try{const s=new URLSearchParams({token:e,client_id:this.authClientId,token_type_hint:"refresh_token"});await fetch(this.authEndpoints.revoke,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:s})}catch(s){this.logger.warn("Token revocation failed:",s)}localStorage.removeItem(this.storageKeys.ACCESS_TOKEN),localStorage.removeItem(this.storageKeys.REFRESH_TOKEN),localStorage.removeItem(this.storageKeys.EXPIRES_AT);const t={status:"unauthenticated",user:null,accessToken:null,error:null};return this.setAuthState(t),t}async exchangeCodeForTokens(e){const t=localStorage.getItem(this.storageKeys.CODE_VERIFIER);if(!t)throw new Error("Code verifier not found");const s=await fetch(this.authEndpoints.token,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:e,redirect_uri:this.redirectUri,client_id:this.authClientId,code_verifier:t})});if(!s.ok){const i=await s.text();throw new Error(`Token exchange failed: ${s.status} ${i}`)}const o=await s.json();if(localStorage.setItem(this.storageKeys.ACCESS_TOKEN,o.access_token),o.refresh_token&&localStorage.setItem(this.storageKeys.REFRESH_TOKEN,o.refresh_token),o.expires_in){const i=Date.now()+o.expires_in*1e3;localStorage.setItem(this.storageKeys.EXPIRES_AT,i.toString())}}async _storageGet(e){return localStorage.getItem(e)}async _storageSet(e){Object.entries(e).forEach(([t,s])=>{localStorage.setItem(t,String(s))})}async _storageRemove(e){e.forEach(t=>localStorage.removeItem(t))}_getRedirectUri(){return this.redirectUri}}const f=500,m=5e3,R=3e4;class w{constructor(e,t,s){this.state=r.EXTENSION_STATE_NOT_INITIALIZED,this.bodhiext=null,this.refreshPromise=null,this.logger=new r.Logger("WindowBodhiextClient",t.logLevel),this.authClientId=e,this.config=t,this.authEndpoints=r.createOAuthEndpoints(this.config.authServerUrl),this.onStateChange=s??r.NOOP_STATE_CALLBACK;const o=r.createStoragePrefixWithBasePath(t.basePath,r.STORAGE_PREFIXES.WEB_EXT);this.storageKeys=r.createStorageKeys(o),this.apiTimeoutMs=t.apiTimeoutMs??R}setState(e){this.state=e,this.logger.info(`{state: ${JSON.stringify(e)}} - Setting client state`),this.onStateChange({type:"client-state",state:e})}setAuthState(e){this.onStateChange({type:"auth-state",state:e})}setStateCallback(e){this.onStateChange=e}ensureBodhiext(){if(!this.bodhiext&&window.bodhiext&&(this.logger.info("Acquiring window.bodhiext reference"),this.bodhiext=window.bodhiext),!this.bodhiext)throw r.createOperationError("Client not initialized","extension_error")}async sendExtRequest(e,t){return this.ensureBodhiext(),this.bodhiext.sendExtRequest(e,t)}async sendApiRequest(e,t,s,o,i){try{this.ensureBodhiext()}catch(n){return{error:{message:n instanceof Error?n.message:String(n),type:"extension_error"}}}try{const n=new Promise((l,a)=>setTimeout(()=>a(new Error(`[bodhi-js-sdk/web] network timeout: api request not completed within configured/default timeout of ${this.apiTimeoutMs}ms`)),this.apiTimeoutMs)),c=(async()=>{let l=o||{};if(i){const a=await this._getAccessTokenRaw();if(!a)return{error:{message:"Not authenticated. Please log in first.",type:"extension_error"}};l={...l,Authorization:`Bearer ${a}`}}return this.bodhiext.sendApiRequest(e,t,s,l)})();return await Promise.race([c,n])}catch(n){const c=n?.error,l=c?.message??(n instanceof Error?n.message:String(n)),a=c?.type||"network_error";return{error:{message:l,type:a}}}}getState(){return this.state}isClientInitialized(){return this.state.extension==="ready"}isServerReady(){return this.isClientInitialized()&&this.state.server.status==="ready"}async init(e={}){if(!e.testConnection&&!e.selectedConnection)return this.logger.info("No testConnection or selectedConnection, returning not-initialized state"),r.EXTENSION_STATE_NOT_INITIALIZED;if(this.bodhiext&&!e.testConnection)return this.logger.debug("Already have bodhiext handle, skipping polling"),this.state;if(!this.bodhiext){const o=e.timeoutMs??this.config.initParams?.extension?.timeoutMs??m,i=e.intervalMs??this.config.initParams?.extension?.intervalMs??f,n=Date.now();if(!await new Promise(l=>{const a=()=>{if(window.bodhiext){this.bodhiext=window.bodhiext,l(!0);return}if(Date.now()-n>=o){l(!1);return}setTimeout(a,i)};a()}))return this.logger.warn("Extension discovery timed out"),this.setState(r.EXTENSION_STATE_NOT_FOUND),this.state}const t=await this.bodhiext.getExtensionId();this.logger.info(`Extension discovered: ${t}`);const s={type:"extension",extension:"ready",extensionId:t,server:r.PENDING_EXTENSION_READY};if(e.testConnection)try{const o=await this.getServerState();this.setState({...s,server:o}),this.logger.info(`Server connectivity tested: ${o.status}`)}catch(o){this.logger.error("Failed to get server state:",o),this.setState({...s,server:r.BACKEND_SERVER_NOT_REACHABLE})}else this.setState(s);return this.state}async login(e){const t=await this.getAuthState();if(t.status==="authenticated")return t;this.ensureBodhiext();const s=e?.userRole??this.config.userRole,o=e?.flowType??"popup";e?.onProgress?.("requesting");const i=new r.AccessRequestBuilder(this.authClientId).requestedRole(s).flowType(o);if(e?.requested&&i.requested(e.requested),o==="redirect"){const u=e?.redirectUrl??this.config.redirectUri;i.redirectUrl(u)}const n=i.build(),c=await this.requestAccess(n);if(r.isApiResultOperationError(c))throw r.createOperationError(c.error.message,c.error.type);if(!r.isApiResultSuccess(c))throw r.createOperationError(`Access request failed: HTTP ${c.status}`,"auth_error");const{id:l,review_url:a}=c.body;e?.onProgress?.("reviewing");let h;if(o==="popup"){const u=async()=>{const p=await this.getAccessRequestStatus(l);if(!r.isApiResultSuccess(p))return null;const{status:E,access_request_scope:S}=p.body;return E==="approved"?{approved:!0,accessRequestScope:S??void 0}:["denied","failed","expired"].includes(E)?{approved:!1}:null},g=await r.openPopupReview(a,u,{intervalMs:e?.pollIntervalMs??r.DEFAULT_POLL_INTERVAL_MS,timeoutMs:e?.pollTimeoutMs??r.DEFAULT_POLL_TIMEOUT_MS});if(!g.approved)throw r.createOperationError("Access request was denied or expired","auth_error");h=g.accessRequestScope}else return localStorage.setItem(this.storageKeys.ACCESS_REQUEST_ID,l),window.location.href=a,new Promise(()=>{});return e?.onProgress?.("authenticating"),this.performOAuthPkce(`openid profile email roles ${h??""}`.trim())}async handleOAuthCallback(e,t){const s=localStorage.getItem(this.storageKeys.STATE);if(!s||s!==t)throw new Error("Invalid state parameter - possible CSRF attack");await this.exchangeCodeForTokens(e),localStorage.removeItem(this.storageKeys.CODE_VERIFIER),localStorage.removeItem(this.storageKeys.STATE);const o=await this.getAuthState();if(o.status!=="authenticated")throw new Error("Login failed");return this.setAuthState(o),o}async exchangeCodeForTokens(e){const t=localStorage.getItem(this.storageKeys.CODE_VERIFIER);if(!t)throw new Error("Code verifier not found");const s=new URLSearchParams({grant_type:"authorization_code",client_id:this.authClientId,code:e,redirect_uri:this.config.redirectUri,code_verifier:t}),o=await fetch(this.authEndpoints.token,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:s});if(!o.ok){const n=await o.text();throw new Error(`Token exchange failed: ${o.status} ${n}`)}const i=await o.json();if(!i.access_token)throw new Error("No access token received");if(localStorage.setItem(this.storageKeys.ACCESS_TOKEN,i.access_token),i.refresh_token&&localStorage.setItem(this.storageKeys.REFRESH_TOKEN,i.refresh_token),i.expires_in){const n=Date.now()+i.expires_in*1e3;localStorage.setItem(this.storageKeys.EXPIRES_AT,n.toString())}}async logout(){const e=localStorage.getItem(this.storageKeys.REFRESH_TOKEN);if(e)try{const s=new URLSearchParams({token:e,client_id:this.authClientId,token_type_hint:"refresh_token"});await fetch(this.authEndpoints.revoke,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:s})}catch(s){this.logger.warn("Token revocation failed:",s)}localStorage.removeItem(this.storageKeys.ACCESS_TOKEN),localStorage.removeItem(this.storageKeys.REFRESH_TOKEN),localStorage.removeItem(this.storageKeys.EXPIRES_AT),localStorage.removeItem(this.storageKeys.CODE_VERIFIER),localStorage.removeItem(this.storageKeys.STATE);const t={status:"unauthenticated",user:null,accessToken:null,error:null};return this.setAuthState(t),t}async getAuthState(){const e=await this._getAccessTokenRaw();if(!e)return{status:"unauthenticated",user:null,accessToken:null,error:null};try{return{status:"authenticated",user:r.extractUserInfo(e),accessToken:e,error:null}}catch(t){return this.logger.error("Failed to parse token:",t),{status:"unauthenticated",user:null,accessToken:null,error:null}}}async _getAccessTokenRaw(){const e=localStorage.getItem(this.storageKeys.ACCESS_TOKEN),t=localStorage.getItem(this.storageKeys.EXPIRES_AT);if(!e)return null;if(t){const s=parseInt(t,10);if(Date.now()>=s-5*1e3){const o=localStorage.getItem(this.storageKeys.REFRESH_TOKEN);return o?this._tryRefreshToken(o):null}}return e}async _tryRefreshToken(e){if(this.refreshPromise)return this.logger.debug("Refresh already in progress, returning existing promise"),this.refreshPromise;this.refreshPromise=this._doRefreshToken(e);try{return await this.refreshPromise}finally{this.refreshPromise=null}}async _doRefreshToken(e){this.logger.debug("Refreshing access token");try{const t=await r.refreshAccessToken(this.authEndpoints.token,e,this.authClientId);if(t.success){this._storeRefreshedTokens(t.tokens);const s=r.extractUserInfo(t.tokens.access_token);return this.setAuthState({status:"authenticated",user:s,accessToken:t.tokens.access_token,error:null}),this.logger.info("Token refreshed successfully"),t.tokens.access_token}if(t.error==="invalid_grant")return this.logger.warn("Refresh token expired or revoked, clearing tokens and logging out"),this.clearAuthStorage(),this.setAuthState({status:"unauthenticated",user:null,accessToken:null,error:null}),null}catch(t){this.logger.warn("Token refresh failed:",t)}throw this.logger.warn("Token refresh failed, keeping tokens for manual retry"),r.createOperationError("Access token expired and unable to refresh. Try logging out and logging in again.","token_refresh_failed")}clearAuthStorage(){localStorage.removeItem(this.storageKeys.ACCESS_TOKEN),localStorage.removeItem(this.storageKeys.REFRESH_TOKEN),localStorage.removeItem(this.storageKeys.EXPIRES_AT)}_storeRefreshedTokens(e){const t=Date.now()+e.expires_in*1e3;localStorage.setItem(this.storageKeys.ACCESS_TOKEN,e.access_token),localStorage.setItem(this.storageKeys.EXPIRES_AT,String(t)),e.refresh_token&&localStorage.setItem(this.storageKeys.REFRESH_TOKEN,e.refresh_token)}async pingApi(){return this.sendApiRequest("GET","/ping")}async getServerState(){const e=await this.sendApiRequest("GET","/bodhi/v1/info");if(r.isApiResultOperationError(e)||!r.isApiResultSuccess(e))return r.BACKEND_SERVER_NOT_REACHABLE;const t=e.body,s=t.version||"unknown";switch(t.status){case"ready":return{status:"ready",version:s,error:null,deployment:t.deployment??null,client_id:t.client_id??null};case"setup":return r.backendServerNotReady("setup",s,void 0,t.deployment,t.client_id);case"resource_admin":return r.backendServerNotReady("resource_admin",s,void 0,t.deployment,t.client_id);case"tenant_selection":return{status:"tenant_selection",version:s,error:null,deployment:t.deployment??null,client_id:t.client_id??null};case"error":return r.backendServerNotReady("error",s,t.error?{message:t.error.message,type:t.error.type}:r.SERVER_ERROR_CODES.SERVER_NOT_READY,t.deployment,t.client_id);default:return r.BACKEND_SERVER_NOT_REACHABLE}}async*stream(e,t,s,o,i=!0){this.ensureBodhiext();let n=o||{};if(i){const a=await this._getAccessTokenRaw();if(!a)throw r.createOperationError("Not authenticated. Please log in first.","auth_error");n={...n,Authorization:`Bearer ${a}`}}const l=this.bodhiext.sendStreamRequest(e,t,s,n).getReader();try{for(;;){const{value:a,done:h}=await l.read();if(h||a?.done)break;yield a.body}}catch(a){if(a instanceof Error){if("response"in a){const h=a;throw r.createApiError(a.message,h.response.status,h.response.body)}throw"error"in a,r.createOperationError(a.message,"extension_error")}throw a}finally{l.releaseLock()}}get chat(){return this._chat??=new r.Chat(this)}get models(){return this._models??=new r.Models(this)}get embeddings(){return this._embeddings??=new r.Embeddings(this)}get toolsets(){return this._toolsets??=new r.Toolsets(this)}get mcps(){return this._mcps??=new r.Mcps(this)}async requestAccess(e){return this.sendApiRequest("POST","/bodhi/v1/apps/request-access",e,{},!1)}async getAccessRequestStatus(e){return this.sendApiRequest("GET",`/bodhi/v1/apps/access-requests/${e}?app_client_id=${encodeURIComponent(this.authClientId)}`,void 0,{},!1)}async pollAccessRequestStatus(e,t){return r.pollAccessRequestUntilResolved(s=>this.getAccessRequestStatus(s),e,t)}async performOAuthPkce(e){const t=r.generateCodeVerifier(),s=await r.generateCodeChallenge(t),o=r.generateCodeVerifier();localStorage.setItem(this.storageKeys.CODE_VERIFIER,t),localStorage.setItem(this.storageKeys.STATE,o);const i=e.split(" ").filter(Boolean),n=new URLSearchParams({response_type:"code",client_id:this.authClientId,redirect_uri:this.config.redirectUri,scope:i.join(" "),state:o,code_challenge:s,code_challenge_method:"S256"});return window.location.href=`${this.authEndpoints.authorize}?${n}`,new Promise(()=>{})}async handleAccessRequestCallback(e){const t=await this.getAccessRequestStatus(e);if(!r.isApiResultSuccess(t))throw r.createOperationError("Failed to get access request status","auth_error");const{status:s,access_request_scope:o}=t.body;if(s!=="approved")throw r.createOperationError(`Access request is not approved: ${s}`,"auth_error");const i=`openid profile email roles ${o??""}`.trim();return localStorage.removeItem(this.storageKeys.ACCESS_REQUEST_ID),this.performOAuthPkce(i)}serialize(){return{extensionId:this.state.type==="extension"&&this.state.extension==="ready"?this.state.extensionId:void 0}}async debug(){return{type:"WindowBodhiextClient",state:this.state,authState:await this.getAuthState(),bodhiextAvailable:this.bodhiext!==null,authClientId:this.authClientId,authServerUrl:this.config.authServerUrl,redirectUri:this.config.redirectUri,userRole:this.config.userRole}}}function y(d){if(typeof window>"u")throw new Error("redirectUri required in non-browser environment");const e=d==="/"?"":d.replace(/\/$/,"");return`${window.location.origin}${e}/callback`}class T extends r.BaseFacadeClient{constructor(e,t,s){const o=t||{},i={basePath:o.basePath||"/",redirectUri:o.redirectUri||y(o.basePath||"/"),authServerUrl:o.authServerUrl||"https://id.getbodhi.app/realms/bodhi",userRole:o.userRole||"scope_user_user",logLevel:o.logLevel||"warn",apiTimeoutMs:o.apiTimeoutMs,initParams:o.initParams};super(e,i,s)}createLogger(e){return new r.Logger("WebUIClient",e.logLevel)}createStoragePrefix(e){return r.createStoragePrefixWithBasePath(e.basePath,r.STORAGE_PREFIXES.WEB)}createExtClient(e,t){return new w(this.authClientId,{authServerUrl:e.authServerUrl,redirectUri:e.redirectUri,userRole:e.userRole,basePath:e.basePath,logLevel:e.logLevel,apiTimeoutMs:e.apiTimeoutMs,initParams:e.initParams},t)}createDirectClient(e,t,s){return new _({authClientId:e,authServerUrl:t.authServerUrl,redirectUri:t.redirectUri,userRole:t.userRole,logLevel:t.logLevel,basePath:t.basePath,apiTimeoutMs:t.apiTimeoutMs},s)}async handleOAuthCallback(e,t){return this.connectionMode==="direct"?this.directClient.handleOAuthCallback(e,t):this.extClient.handleOAuthCallback(e,t)}async handleAccessRequestCallback(e){return this.connectionMode==="direct"?this.directClient.handleAccessRequestCallback(e):this.extClient.handleAccessRequestCallback(e)}}const A="production";exports.WEB_BUILD_MODE=A;exports.WebUIClient=T;

package/dist/bodhi-web.esm.js

@@ -1,19 +1,19 @@
-import { DirectClientBase as b, createStoragePrefixWithBasePath as w, STORAGE_PREFIXES as y, isApiResultOperationError as f, createOperationError as c, isApiResultError as R, isApiResultSuccess as _, getMissingToolsetScopeIds as C, getRequestedToolsetScopes as k, generateCodeVerifier as E, generateCodeChallenge as x, EXTENSION_STATE_NOT_INITIALIZED as T, Logger as v, createOAuthEndpoints as P, NOOP_STATE_CALLBACK as O, createStorageKeys as K, EXTENSION_STATE_NOT_FOUND as U, PENDING_EXTENSION_READY as N, BACKEND_SERVER_NOT_REACHABLE as S, extractUserInfo as I, refreshAccessToken as L, backendServerNotReady as p, SERVER_ERROR_CODES as D, createApiError as F, Chat as M, Models as B, Embeddings as $, BaseFacadeClient as q } from "@bodhiapp/bodhi-js-core";
-class V extends b {
+import { DirectClientBase as O, createStoragePrefixWithBasePath as R, STORAGE_PREFIXES as T, AccessRequestBuilder as C, isApiResultOperationError as y, createOperationError as l, isApiResultSuccess as u, openPopupReview as v, DEFAULT_POLL_TIMEOUT_MS as k, DEFAULT_POLL_INTERVAL_MS as x, generateCodeVerifier as _, generateCodeChallenge as b, EXTENSION_STATE_NOT_INITIALIZED as I, Logger as P, createOAuthEndpoints as q, NOOP_STATE_CALLBACK as U, createStorageKeys as K, EXTENSION_STATE_NOT_FOUND as L, PENDING_EXTENSION_READY as N, BACKEND_SERVER_NOT_REACHABLE as m, extractUserInfo as A, refreshAccessToken as D, backendServerNotReady as w, SERVER_ERROR_CODES as M, createApiError as F, Chat as B, Models as $, Embeddings as V, Toolsets as H, Mcps as z, pollAccessRequestUntilResolved as W, BaseFacadeClient as X } from "@bodhiapp/bodhi-js-core";
+class j extends O {
   constructor(e, t) {
-    const r = w(
+    const s = R(
       e.basePath,
-      y.WEB_DIRECT
-    ), s = {
+      T.WEB_DIRECT
+    ), r = {
       authClientId: e.authClientId,
       authServerUrl: e.authServerUrl,
-      userScope: e.userScope,
-      storagePrefix: r,
+      userRole: e.userRole,
+      storagePrefix: s,
       logLevel: e.logLevel,
       loggerPrefix: "DirectWebClient",
       apiTimeoutMs: e.apiTimeoutMs
     };
-    super(s, t), this.redirectUri = e.redirectUri;
+    super(r, t), this.redirectUri = e.redirectUri;
   }
   // ============================================================================
   // Authentication (Browser Redirect OAuth)
@@ -22,43 +22,73 @@ class V extends b {
     const t = await this.getAuthState();
     if (t.status === "authenticated")
       return t;
-    const r = await this.requestResourceAccess(e?.toolsetScopeIds, e?.version);
-    if (f(r))
-      throw c(r.error.message, r.error.type);
-    if (R(r)) {
-      const { message: m } = r.body.error;
-      throw c(m, "auth_error");
+    const s = e?.userRole ?? this.userRole, r = e?.flowType ?? "popup";
+    e?.onProgress?.("requesting");
+    const o = new C(this.authClientId).requestedRole(s).flowType(r);
+    if (e?.requested && o.requested(e.requested), r === "redirect") {
+      const g = e?.redirectUrl ?? this.redirectUri;
+      o.redirectUrl(g);
     }
-    if (!_(r))
-      throw c(`Unexpected HTTP ${r.status}`, "auth_error");
-    const s = r.body.scope;
-    localStorage.setItem(this.storageKeys.RESOURCE_SCOPE, s);
-    const a = r.body.toolsets || [], i = C(e?.toolsetScopeIds, a);
-    if (i.length > 0)
-      throw c(
-        `toolsetScopeIds not received back from request-access call: [${i.join(", ")}], check developer console on configuring the toolset scopes correctly`,
+    const a = o.build(), n = await this.requestAccess(a);
+    if (y(n))
+      throw l(n.error.message, n.error.type);
+    if (!u(n))
+      throw l(
+        `Access request failed: HTTP ${n.status}`,
         "auth_error"
       );
-    const h = k(e?.toolsetScopeIds, a), n = `openid profile email roles ${this.userScope} ${s} ${h}`.trim(), o = E(), u = await x(o), g = E();
-    localStorage.setItem(this.storageKeys.CODE_VERIFIER, o), localStorage.setItem(this.storageKeys.STATE, g);
-    const l = new URL(this.authEndpoints.authorize);
-    throw l.searchParams.set("client_id", this.authClientId), l.searchParams.set("response_type", "code"), l.searchParams.set("redirect_uri", this.redirectUri), l.searchParams.set("scope", n), l.searchParams.set("code_challenge", u), l.searchParams.set("code_challenge_method", "S256"), l.searchParams.set("state", g), window.location.href = l.toString(), new Error("Redirect initiated");
+    const { id: c, review_url: i } = n.body;
+    e?.onProgress?.("reviewing");
+    let h;
+    if (r === "popup") {
+      const p = await v(i, async () => {
+        const S = await this.getAccessRequestStatus(c);
+        if (!u(S)) return null;
+        const { status: f, access_request_scope: E } = S.body;
+        return f === "approved" ? { approved: !0, accessRequestScope: E ?? void 0 } : ["denied", "failed", "expired"].includes(f) ? { approved: !1 } : null;
+      }, {
+        intervalMs: e?.pollIntervalMs ?? x,
+        timeoutMs: e?.pollTimeoutMs ?? k
+      });
+      if (!p.approved)
+        throw l("Access request was denied or expired", "auth_error");
+      h = p.accessRequestScope;
+    } else
+      return localStorage.setItem(this.storageKeys.ACCESS_REQUEST_ID, c), window.location.href = i, new Promise(() => {
+      });
+    return e?.onProgress?.("authenticating"), this.performOAuthPkce(`openid profile email roles ${h ?? ""}`.trim());
+  }
+  async performOAuthPkce(e) {
+    const t = _(), s = await b(t), r = _();
+    localStorage.setItem(this.storageKeys.CODE_VERIFIER, t), localStorage.setItem(this.storageKeys.STATE, r);
+    const o = new URL(this.authEndpoints.authorize);
+    throw o.searchParams.set("client_id", this.authClientId), o.searchParams.set("response_type", "code"), o.searchParams.set("redirect_uri", this.redirectUri), o.searchParams.set("scope", e), o.searchParams.set("code_challenge", s), o.searchParams.set("code_challenge_method", "S256"), o.searchParams.set("state", r), window.location.href = o.toString(), new Error("Redirect initiated");
   }
   async handleOAuthCallback(e, t) {
-    const r = localStorage.getItem(this.storageKeys.STATE);
-    if (!r || r !== t)
+    const s = localStorage.getItem(this.storageKeys.STATE);
+    if (!s || s !== t)
       throw new Error("Invalid state parameter - possible CSRF attack");
     await this.exchangeCodeForTokens(e), localStorage.removeItem(this.storageKeys.CODE_VERIFIER), localStorage.removeItem(this.storageKeys.STATE);
-    const s = await this.getAuthState();
-    if (s.status !== "authenticated")
+    const r = await this.getAuthState();
+    if (r.status !== "authenticated")
       throw new Error("Login failed");
-    return this.setAuthState(s), s;
+    return this.setAuthState(r), r;
+  }
+  async handleAccessRequestCallback(e) {
+    const t = await this.getAccessRequestStatus(e);
+    if (!u(t))
+      throw l("Failed to get access request status", "auth_error");
+    const { status: s, access_request_scope: r } = t.body;
+    if (s !== "approved")
+      throw l(`Access request is not approved: ${s}`, "auth_error");
+    const o = `openid profile email roles ${r ?? ""}`.trim();
+    return localStorage.removeItem(this.storageKeys.ACCESS_REQUEST_ID), this.performOAuthPkce(o);
   }
   async logout() {
     const e = localStorage.getItem(this.storageKeys.REFRESH_TOKEN);
     if (e)
       try {
-        const r = new URLSearchParams({
+        const s = new URLSearchParams({
           token: e,
           client_id: this.authClientId,
           token_type_hint: "refresh_token"
@@ -68,12 +98,12 @@ class V extends b {
           headers: {
             "Content-Type": "application/x-www-form-urlencoded"
           },
-          body: r
+          body: s
         });
-      } catch (r) {
-        this.logger.warn("Token revocation failed:", r);
+      } catch (s) {
+        this.logger.warn("Token revocation failed:", s);
       }
-    localStorage.removeItem(this.storageKeys.ACCESS_TOKEN), localStorage.removeItem(this.storageKeys.REFRESH_TOKEN), localStorage.removeItem(this.storageKeys.EXPIRES_AT), localStorage.removeItem(this.storageKeys.RESOURCE_SCOPE);
+    localStorage.removeItem(this.storageKeys.ACCESS_TOKEN), localStorage.removeItem(this.storageKeys.REFRESH_TOKEN), localStorage.removeItem(this.storageKeys.EXPIRES_AT);
     const t = {
       status: "unauthenticated",
       user: null,
@@ -89,7 +119,7 @@ class V extends b {
     const t = localStorage.getItem(this.storageKeys.CODE_VERIFIER);
     if (!t)
       throw new Error("Code verifier not found");
-    const r = await fetch(this.authEndpoints.token, {
+    const s = await fetch(this.authEndpoints.token, {
       method: "POST",
       headers: {
         "Content-Type": "application/x-www-form-urlencoded"
@@ -102,14 +132,14 @@ class V extends b {
         code_verifier: t
       })
     });
-    if (!r.ok) {
-      const a = await r.text();
-      throw new Error(`Token exchange failed: ${r.status} ${a}`);
+    if (!s.ok) {
+      const o = await s.text();
+      throw new Error(`Token exchange failed: ${s.status} ${o}`);
     }
-    const s = await r.json();
-    if (localStorage.setItem(this.storageKeys.ACCESS_TOKEN, s.access_token), s.refresh_token && localStorage.setItem(this.storageKeys.REFRESH_TOKEN, s.refresh_token), s.expires_in) {
-      const a = Date.now() + s.expires_in * 1e3;
-      localStorage.setItem(this.storageKeys.EXPIRES_AT, a.toString());
+    const r = await s.json();
+    if (localStorage.setItem(this.storageKeys.ACCESS_TOKEN, r.access_token), r.refresh_token && localStorage.setItem(this.storageKeys.REFRESH_TOKEN, r.refresh_token), r.expires_in) {
+      const o = Date.now() + r.expires_in * 1e3;
+      localStorage.setItem(this.storageKeys.EXPIRES_AT, o.toString());
     }
   }
   // ============================================================================
@@ -119,8 +149,8 @@ class V extends b {
     return localStorage.getItem(e);
   }
   async _storageSet(e) {
-    Object.entries(e).forEach(([t, r]) => {
-      localStorage.setItem(t, String(r));
+    Object.entries(e).forEach(([t, s]) => {
+      localStorage.setItem(t, String(s));
     });
   }
   async _storageRemove(e) {
@@ -130,12 +160,12 @@ class V extends b {
     return this.redirectUri;
   }
 }
-const H = 500, z = 5e3, W = 3e4;
-class X {
-  constructor(e, t, r) {
-    this.state = T, this.bodhiext = null, this.refreshPromise = null, this.logger = new v("WindowBodhiextClient", t.logLevel), this.authClientId = e, this.config = t, this.authEndpoints = P(this.config.authServerUrl), this.onStateChange = r ?? O;
-    const s = w(t.basePath, y.WEB_EXT);
-    this.storageKeys = K(s), this.apiTimeoutMs = t.apiTimeoutMs ?? W;
+const G = 500, Q = 5e3, Y = 3e4;
+class J {
+  constructor(e, t, s) {
+    this.state = I, this.bodhiext = null, this.refreshPromise = null, this.logger = new P("WindowBodhiextClient", t.logLevel), this.authClientId = e, this.config = t, this.authEndpoints = q(this.config.authServerUrl), this.onStateChange = s ?? U;
+    const r = R(t.basePath, T.WEB_EXT);
+    this.storageKeys = K(r), this.apiTimeoutMs = t.apiTimeoutMs ?? Y;
   }
   /**
    * Set client state and notify callback
@@ -164,7 +194,7 @@ class X {
    */
   ensureBodhiext() {
     if (!this.bodhiext && window.bodhiext && (this.logger.info("Acquiring window.bodhiext reference"), this.bodhiext = window.bodhiext), !this.bodhiext)
-      throw c("Client not initialized", "extension_error");
+      throw l("Client not initialized", "extension_error");
   }
   /**
    * Send extension request via window.bodhiext.sendExtRequest
@@ -176,52 +206,52 @@ class X {
    * Send API message via window.bodhiext.sendApiRequest
    * Converts ApiResponse to ApiResponseResult
    */
-  async sendApiRequest(e, t, r, s, a) {
+  async sendApiRequest(e, t, s, r, o) {
     try {
       this.ensureBodhiext();
-    } catch (i) {
+    } catch (a) {
       return {
         error: {
-          message: i instanceof Error ? i.message : String(i),
+          message: a instanceof Error ? a.message : String(a),
           type: "extension_error"
         }
       };
     }
     try {
-      const i = new Promise(
-        (n, o) => setTimeout(
-          () => o(
+      const a = new Promise(
+        (c, i) => setTimeout(
+          () => i(
             new Error(
               `[bodhi-js-sdk/web] network timeout: api request not completed within configured/default timeout of ${this.apiTimeoutMs}ms`
             )
           ),
           this.apiTimeoutMs
         )
-      ), h = (async () => {
-        let n = s || {};
-        if (a) {
-          const o = await this._getAccessTokenRaw();
-          if (!o)
+      ), n = (async () => {
+        let c = r || {};
+        if (o) {
+          const i = await this._getAccessTokenRaw();
+          if (!i)
             return {
               error: {
                 message: "Not authenticated. Please log in first.",
                 type: "extension_error"
               }
             };
-          n = {
-            ...n,
-            Authorization: `Bearer ${o}`
+          c = {
+            ...c,
+            Authorization: `Bearer ${i}`
           };
         }
-        return this.bodhiext.sendApiRequest(e, t, r, n);
+        return this.bodhiext.sendApiRequest(e, t, s, c);
       })();
-      return await Promise.race([h, i]);
-    } catch (i) {
-      const h = i?.error, n = h?.message ?? (i instanceof Error ? i.message : String(i)), o = h?.type || "network_error";
+      return await Promise.race([n, a]);
+    } catch (a) {
+      const n = a?.error, c = n?.message ?? (a instanceof Error ? a.message : String(a)), i = n?.type || "network_error";
       return {
         error: {
-          message: n,
-          type: o
+          message: c,
+          type: i
         }
       };
     }
@@ -247,30 +277,30 @@ class X {
    */
   async init(e = {}) {
     if (!e.testConnection && !e.selectedConnection)
-      return this.logger.info("No testConnection or selectedConnection, returning not-initialized state"), T;
+      return this.logger.info("No testConnection or selectedConnection, returning not-initialized state"), I;
     if (this.bodhiext && !e.testConnection)
       return this.logger.debug("Already have bodhiext handle, skipping polling"), this.state;
     if (!this.bodhiext) {
-      const s = e.timeoutMs ?? this.config.initParams?.extension?.timeoutMs ?? z, a = e.intervalMs ?? this.config.initParams?.extension?.intervalMs ?? H, i = Date.now();
-      if (!await new Promise((n) => {
-        const o = () => {
+      const r = e.timeoutMs ?? this.config.initParams?.extension?.timeoutMs ?? Q, o = e.intervalMs ?? this.config.initParams?.extension?.intervalMs ?? G, a = Date.now();
+      if (!await new Promise((c) => {
+        const i = () => {
           if (window.bodhiext) {
-            this.bodhiext = window.bodhiext, n(!0);
+            this.bodhiext = window.bodhiext, c(!0);
             return;
           }
-          if (Date.now() - i >= s) {
-            n(!1);
+          if (Date.now() - a >= r) {
+            c(!1);
             return;
           }
-          setTimeout(o, a);
+          setTimeout(i, o);
         };
-        o();
+        i();
       }))
-        return this.logger.warn("Extension discovery timed out"), this.setState(U), this.state;
+        return this.logger.warn("Extension discovery timed out"), this.setState(L), this.state;
     }
     const t = await this.bodhiext.getExtensionId();
     this.logger.info(`Extension discovered: ${t}`);
-    const r = {
+    const s = {
       type: "extension",
       extension: "ready",
       extensionId: t,
@@ -278,83 +308,63 @@ class X {
     };
     if (e.testConnection)
       try {
-        const s = await this.getServerState();
-        this.setState({ ...r, server: s }), this.logger.info(`Server connectivity tested: ${s.status}`);
-      } catch (s) {
-        this.logger.error("Failed to get server state:", s), this.setState({ ...r, server: S });
+        const r = await this.getServerState();
+        this.setState({ ...s, server: r }), this.logger.info(`Server connectivity tested: ${r.status}`);
+      } catch (r) {
+        this.logger.error("Failed to get server state:", r), this.setState({ ...s, server: m });
       }
     else
-      this.setState(r);
+      this.setState(s);
     return this.state;
   }
   // ============================================================================
   // OAuth Methods
   // ============================================================================
   /**
-   * Request resource access scope from backend
-   * Required for authenticated API access
-   */
-  async requestResourceAccess(e, t) {
-    this.ensureBodhiext();
-    const r = {
-      app_client_id: this.authClientId,
-      ...e && { toolset_scope_ids: e },
-      ...t && { version: t }
-    };
-    return this.bodhiext.sendApiRequest(
-      "POST",
-      "/bodhi/v1/apps/request-access",
-      r
-    );
-  }
-  /**
-   * Login via browser redirect OAuth2 + PKCE flow
-   * @param options - Optional login options (toolsetScopeIds, version)
-   * @returns AuthState (though in practice, this redirects and never returns)
+   * Login via access-request flow with popup or redirect
+   * @param options - Optional login options
+   * @returns AuthState
    */
   async login(e) {
     const t = await this.getAuthState();
     if (t.status === "authenticated")
       return t;
     this.ensureBodhiext();
-    const r = await this.requestResourceAccess(e?.toolsetScopeIds, e?.version);
-    if (f(r))
-      throw c(r.error.message, r.error.type);
-    if (R(r)) {
-      const { message: A } = r.body.error;
-      throw c(A, "auth_error");
+    const s = e?.userRole ?? this.config.userRole, r = e?.flowType ?? "popup";
+    e?.onProgress?.("requesting");
+    const o = new C(this.authClientId).requestedRole(s).flowType(r);
+    if (e?.requested && o.requested(e.requested), r === "redirect") {
+      const g = e?.redirectUrl ?? this.config.redirectUri;
+      o.redirectUrl(g);
     }
-    if (!_(r))
-      throw c(`Unexpected HTTP ${r.status}`, "auth_error");
-    const s = r.body.scope;
-    localStorage.setItem(this.storageKeys.RESOURCE_SCOPE, s);
-    const a = r.body.toolsets || [], i = C(e?.toolsetScopeIds, a);
-    if (i.length > 0)
-      throw c(
-        `toolsetScopeIds not received back from request-access call: [${i.join(", ")}], check developer console on configuring the toolset scopes correctly`,
+    const a = o.build(), n = await this.requestAccess(a);
+    if (y(n))
+      throw l(n.error.message, n.error.type);
+    if (!u(n))
+      throw l(
+        `Access request failed: HTTP ${n.status}`,
         "auth_error"
       );
-    const h = k(e?.toolsetScopeIds, a), n = E(), o = await x(n), u = E();
-    localStorage.setItem(this.storageKeys.CODE_VERIFIER, n), localStorage.setItem(this.storageKeys.STATE, u);
-    const g = [
-      "openid",
-      "profile",
-      "email",
-      "roles",
-      this.config.userScope,
-      s,
-      ...h ? h.split(" ") : []
-    ], l = new URLSearchParams({
-      response_type: "code",
-      client_id: this.authClientId,
-      redirect_uri: this.config.redirectUri,
-      scope: g.join(" "),
-      state: u,
-      code_challenge: o,
-      code_challenge_method: "S256"
-    }), m = `${this.authEndpoints.authorize}?${l}`;
-    return window.location.href = m, new Promise(() => {
-    });
+    const { id: c, review_url: i } = n.body;
+    e?.onProgress?.("reviewing");
+    let h;
+    if (r === "popup") {
+      const p = await v(i, async () => {
+        const S = await this.getAccessRequestStatus(c);
+        if (!u(S)) return null;
+        const { status: f, access_request_scope: E } = S.body;
+        return f === "approved" ? { approved: !0, accessRequestScope: E ?? void 0 } : ["denied", "failed", "expired"].includes(f) ? { approved: !1 } : null;
+      }, {
+        intervalMs: e?.pollIntervalMs ?? x,
+        timeoutMs: e?.pollTimeoutMs ?? k
+      });
+      if (!p.approved)
+        throw l("Access request was denied or expired", "auth_error");
+      h = p.accessRequestScope;
+    } else
+      return localStorage.setItem(this.storageKeys.ACCESS_REQUEST_ID, c), window.location.href = i, new Promise(() => {
+      });
+    return e?.onProgress?.("authenticating"), this.performOAuthPkce(`openid profile email roles ${h ?? ""}`.trim());
   }
   /**
    * Handle OAuth callback with authorization code
@@ -362,14 +372,14 @@ class X {
    * @returns AuthState with login state and user info
    */
   async handleOAuthCallback(e, t) {
-    const r = localStorage.getItem(this.storageKeys.STATE);
-    if (!r || r !== t)
+    const s = localStorage.getItem(this.storageKeys.STATE);
+    if (!s || s !== t)
       throw new Error("Invalid state parameter - possible CSRF attack");
     await this.exchangeCodeForTokens(e), localStorage.removeItem(this.storageKeys.CODE_VERIFIER), localStorage.removeItem(this.storageKeys.STATE);
-    const s = await this.getAuthState();
-    if (s.status !== "authenticated")
+    const r = await this.getAuthState();
+    if (r.status !== "authenticated")
       throw new Error("Login failed");
-    return this.setAuthState(s), s;
+    return this.setAuthState(r), r;
   }
   /**
    * Exchange authorization code for tokens
@@ -378,29 +388,29 @@ class X {
     const t = localStorage.getItem(this.storageKeys.CODE_VERIFIER);
     if (!t)
       throw new Error("Code verifier not found");
-    const r = new URLSearchParams({
+    const s = new URLSearchParams({
       grant_type: "authorization_code",
       client_id: this.authClientId,
       code: e,
       redirect_uri: this.config.redirectUri,
       code_verifier: t
-    }), s = await fetch(this.authEndpoints.token, {
+    }), r = await fetch(this.authEndpoints.token, {
       method: "POST",
       headers: {
         "Content-Type": "application/x-www-form-urlencoded"
       },
-      body: r
+      body: s
     });
-    if (!s.ok) {
-      const i = await s.text();
-      throw new Error(`Token exchange failed: ${s.status} ${i}`);
+    if (!r.ok) {
+      const a = await r.text();
+      throw new Error(`Token exchange failed: ${r.status} ${a}`);
     }
-    const a = await s.json();
-    if (!a.access_token)
+    const o = await r.json();
+    if (!o.access_token)
       throw new Error("No access token received");
-    if (localStorage.setItem(this.storageKeys.ACCESS_TOKEN, a.access_token), a.refresh_token && localStorage.setItem(this.storageKeys.REFRESH_TOKEN, a.refresh_token), a.expires_in) {
-      const i = Date.now() + a.expires_in * 1e3;
-      localStorage.setItem(this.storageKeys.EXPIRES_AT, i.toString());
+    if (localStorage.setItem(this.storageKeys.ACCESS_TOKEN, o.access_token), o.refresh_token && localStorage.setItem(this.storageKeys.REFRESH_TOKEN, o.refresh_token), o.expires_in) {
+      const a = Date.now() + o.expires_in * 1e3;
+      localStorage.setItem(this.storageKeys.EXPIRES_AT, a.toString());
     }
   }
   /**
@@ -411,7 +421,7 @@ class X {
     const e = localStorage.getItem(this.storageKeys.REFRESH_TOKEN);
     if (e)
       try {
-        const r = new URLSearchParams({
+        const s = new URLSearchParams({
           token: e,
           client_id: this.authClientId,
           token_type_hint: "refresh_token"
@@ -421,12 +431,12 @@ class X {
           headers: {
             "Content-Type": "application/x-www-form-urlencoded"
           },
-          body: r
+          body: s
         });
-      } catch (r) {
-        this.logger.warn("Token revocation failed:", r);
+      } catch (s) {
+        this.logger.warn("Token revocation failed:", s);
       }
-    localStorage.removeItem(this.storageKeys.ACCESS_TOKEN), localStorage.removeItem(this.storageKeys.REFRESH_TOKEN), localStorage.removeItem(this.storageKeys.EXPIRES_AT), localStorage.removeItem(this.storageKeys.CODE_VERIFIER), localStorage.removeItem(this.storageKeys.STATE), localStorage.removeItem(this.storageKeys.RESOURCE_SCOPE);
+    localStorage.removeItem(this.storageKeys.ACCESS_TOKEN), localStorage.removeItem(this.storageKeys.REFRESH_TOKEN), localStorage.removeItem(this.storageKeys.EXPIRES_AT), localStorage.removeItem(this.storageKeys.CODE_VERIFIER), localStorage.removeItem(this.storageKeys.STATE);
     const t = {
       status: "unauthenticated",
       user: null,
@@ -443,7 +453,7 @@ class X {
     if (!e)
       return { status: "unauthenticated", user: null, accessToken: null, error: null };
     try {
-      return { status: "authenticated", user: I(e), accessToken: e, error: null };
+      return { status: "authenticated", user: A(e), accessToken: e, error: null };
     } catch (t) {
       return this.logger.error("Failed to parse token:", t), { status: "unauthenticated", user: null, accessToken: null, error: null };
     }
@@ -457,10 +467,10 @@ class X {
     if (!e)
       return null;
     if (t) {
-      const r = parseInt(t, 10);
-      if (Date.now() >= r - 5 * 1e3) {
-        const s = localStorage.getItem(this.storageKeys.REFRESH_TOKEN);
-        return s ? this._tryRefreshToken(s) : null;
+      const s = parseInt(t, 10);
+      if (Date.now() >= s - 5 * 1e3) {
+        const r = localStorage.getItem(this.storageKeys.REFRESH_TOKEN);
+        return r ? this._tryRefreshToken(r) : null;
       }
     }
     return e;
@@ -485,17 +495,17 @@ class X {
   async _doRefreshToken(e) {
     this.logger.debug("Refreshing access token");
     try {
-      const t = await L(
+      const t = await D(
         this.authEndpoints.token,
         e,
         this.authClientId
       );
       if (t.success) {
         this._storeRefreshedTokens(t.tokens);
-        const r = I(t.tokens.access_token);
+        const s = A(t.tokens.access_token);
         return this.setAuthState({
           status: "authenticated",
-          user: r,
+          user: s,
           accessToken: t.tokens.access_token,
           error: null
         }), this.logger.info("Token refreshed successfully"), t.tokens.access_token;
@@ -510,13 +520,13 @@ class X {
     } catch (t) {
       this.logger.warn("Token refresh failed:", t);
     }
-    throw this.logger.warn("Token refresh failed, keeping tokens for manual retry"), c(
+    throw this.logger.warn("Token refresh failed, keeping tokens for manual retry"), l(
       "Access token expired and unable to refresh. Try logging out and logging in again.",
       "token_refresh_failed"
     );
   }
   clearAuthStorage() {
-    localStorage.removeItem(this.storageKeys.ACCESS_TOKEN), localStorage.removeItem(this.storageKeys.REFRESH_TOKEN), localStorage.removeItem(this.storageKeys.EXPIRES_AT), localStorage.removeItem(this.storageKeys.RESOURCE_SCOPE);
+    localStorage.removeItem(this.storageKeys.ACCESS_TOKEN), localStorage.removeItem(this.storageKeys.REFRESH_TOKEN), localStorage.removeItem(this.storageKeys.EXPIRES_AT);
   }
   /**
    * Store refreshed tokens
@@ -537,76 +547,157 @@ class X {
    */
   async getServerState() {
     const e = await this.sendApiRequest("GET", "/bodhi/v1/info");
-    if (f(e))
-      return S;
-    if (!_(e))
-      return S;
-    const t = e.body;
+    if (y(e))
+      return m;
+    if (!u(e))
+      return m;
+    const t = e.body, s = t.version || "unknown";
     switch (t.status) {
       case "ready":
-        return { status: "ready", version: t.version || "unknown", error: null };
+        return {
+          status: "ready",
+          version: s,
+          error: null,
+          deployment: t.deployment ?? null,
+          client_id: t.client_id ?? null
+        };
       case "setup":
-        return p("setup", t.version || "unknown");
-      case "resource-admin":
-        return p("resource-admin", t.version || "unknown");
+        return w("setup", s, void 0, t.deployment, t.client_id);
+      case "resource_admin":
+        return w(
+          "resource_admin",
+          s,
+          void 0,
+          t.deployment,
+          t.client_id
+        );
+      case "tenant_selection":
+        return {
+          status: "tenant_selection",
+          version: s,
+          error: null,
+          deployment: t.deployment ?? null,
+          client_id: t.client_id ?? null
+        };
       case "error":
-        return p(
+        return w(
           "error",
-          t.version || "unknown",
-          t.error ? { message: t.error.message, type: t.error.type } : D.SERVER_NOT_READY
+          s,
+          t.error ? { message: t.error.message, type: t.error.type } : M.SERVER_NOT_READY,
+          t.deployment,
+          t.client_id
         );
       default:
-        return S;
+        return m;
     }
   }
   /**
    * Generic streaming via window.bodhiext.sendStreamRequest
    * Wraps ReadableStream as AsyncGenerator
    */
-  async *stream(e, t, r, s, a = !0) {
+  async *stream(e, t, s, r, o = !0) {
     this.ensureBodhiext();
-    let i = s || {};
-    if (a) {
-      const o = await this._getAccessTokenRaw();
-      if (!o)
-        throw c("Not authenticated. Please log in first.", "auth_error");
-      i = {
-        ...i,
-        Authorization: `Bearer ${o}`
+    let a = r || {};
+    if (o) {
+      const i = await this._getAccessTokenRaw();
+      if (!i)
+        throw l("Not authenticated. Please log in first.", "auth_error");
+      a = {
+        ...a,
+        Authorization: `Bearer ${i}`
       };
     }
-    const n = this.bodhiext.sendStreamRequest(e, t, r, i).getReader();
+    const c = this.bodhiext.sendStreamRequest(e, t, s, a).getReader();
     try {
       for (; ; ) {
-        const { value: o, done: u } = await n.read();
-        if (u || o?.done)
+        const { value: i, done: h } = await c.read();
+        if (h || i?.done)
           break;
-        yield o.body;
+        yield i.body;
       }
-    } catch (o) {
-      if (o instanceof Error) {
-        if ("response" in o) {
-          const u = o;
-          throw F(o.message, u.response.status, u.response.body);
+    } catch (i) {
+      if (i instanceof Error) {
+        if ("response" in i) {
+          const h = i;
+          throw F(i.message, h.response.status, h.response.body);
         }
-        throw "error" in o ? c(o.message, "extension_error") : c(o.message, "extension_error");
+        throw "error" in i ? l(i.message, "extension_error") : l(i.message, "extension_error");
       }
-      throw o;
+      throw i;
     } finally {
-      n.releaseLock();
+      c.releaseLock();
     }
   }
   // ============================================================================
   // OpenAI-Compatible Namespaced API
   // ============================================================================
   get chat() {
-    return this._chat ??= new M(this);
+    return this._chat ??= new B(this);
   }
   get models() {
-    return this._models ??= new B(this);
+    return this._models ??= new $(this);
   }
   get embeddings() {
-    return this._embeddings ??= new $(this);
+    return this._embeddings ??= new V(this);
+  }
+  get toolsets() {
+    return this._toolsets ??= new H(this);
+  }
+  get mcps() {
+    return this._mcps ??= new z(this);
+  }
+  // ============================================================================
+  // Access Request Methods
+  // ============================================================================
+  async requestAccess(e) {
+    return this.sendApiRequest(
+      "POST",
+      "/bodhi/v1/apps/request-access",
+      e,
+      {},
+      !1
+    );
+  }
+  async getAccessRequestStatus(e) {
+    return this.sendApiRequest(
+      "GET",
+      `/bodhi/v1/apps/access-requests/${e}?app_client_id=${encodeURIComponent(this.authClientId)}`,
+      void 0,
+      {},
+      !1
+    );
+  }
+  async pollAccessRequestStatus(e, t) {
+    return W(
+      (s) => this.getAccessRequestStatus(s),
+      e,
+      t
+    );
+  }
+  async performOAuthPkce(e) {
+    const t = _(), s = await b(t), r = _();
+    localStorage.setItem(this.storageKeys.CODE_VERIFIER, t), localStorage.setItem(this.storageKeys.STATE, r);
+    const o = e.split(" ").filter(Boolean), a = new URLSearchParams({
+      response_type: "code",
+      client_id: this.authClientId,
+      redirect_uri: this.config.redirectUri,
+      scope: o.join(" "),
+      state: r,
+      code_challenge: s,
+      code_challenge_method: "S256"
+    });
+    return window.location.href = `${this.authEndpoints.authorize}?${a}`, new Promise(() => {
+    });
+  }
+  async handleAccessRequestCallback(e) {
+    const t = await this.getAccessRequestStatus(e);
+    if (!u(t))
+      throw l("Failed to get access request status", "auth_error");
+    const { status: s, access_request_scope: r } = t.body;
+    if (s !== "approved")
+      throw l(`Access request is not approved: ${s}`, "auth_error");
+    const o = `openid profile email roles ${r ?? ""}`.trim();
+    return localStorage.removeItem(this.storageKeys.ACCESS_REQUEST_ID), this.performOAuthPkce(o);
   }
   /**
    * Serialize web extension client state (all transient, nothing to persist)
@@ -628,42 +719,42 @@ class X {
       authClientId: this.authClientId,
       authServerUrl: this.config.authServerUrl,
       redirectUri: this.config.redirectUri,
-      userScope: this.config.userScope
+      userRole: this.config.userRole
     };
   }
 }
-function j(d) {
+function Z(d) {
   if (typeof window > "u")
     throw new Error("redirectUri required in non-browser environment");
   const e = d === "/" ? "" : d.replace(/\/$/, "");
   return `${window.location.origin}${e}/callback`;
 }
-class Y extends q {
-  constructor(e, t, r) {
-    const s = t || {}, a = {
-      basePath: s.basePath || "/",
-      redirectUri: s.redirectUri || j(s.basePath || "/"),
-      authServerUrl: s.authServerUrl || "https://id.getbodhi.app/realms/bodhi",
-      userScope: s.userScope || "scope_user_user",
-      logLevel: s.logLevel || "warn",
-      apiTimeoutMs: s.apiTimeoutMs,
-      initParams: s.initParams
+class te extends X {
+  constructor(e, t, s) {
+    const r = t || {}, o = {
+      basePath: r.basePath || "/",
+      redirectUri: r.redirectUri || Z(r.basePath || "/"),
+      authServerUrl: r.authServerUrl || "https://id.getbodhi.app/realms/bodhi",
+      userRole: r.userRole || "scope_user_user",
+      logLevel: r.logLevel || "warn",
+      apiTimeoutMs: r.apiTimeoutMs,
+      initParams: r.initParams
     };
-    super(e, a, r);
+    super(e, o, s);
   }
   createLogger(e) {
-    return new v("WebUIClient", e.logLevel);
+    return new P("WebUIClient", e.logLevel);
   }
   createStoragePrefix(e) {
-    return w(e.basePath, y.WEB);
+    return R(e.basePath, T.WEB);
   }
   createExtClient(e, t) {
-    return new X(
+    return new J(
       this.authClientId,
       {
         authServerUrl: e.authServerUrl,
         redirectUri: e.redirectUri,
-        userScope: e.userScope,
+        userRole: e.userRole,
         basePath: e.basePath,
         logLevel: e.logLevel,
         apiTimeoutMs: e.apiTimeoutMs,
@@ -672,18 +763,18 @@ class Y extends q {
       t
     );
   }
-  createDirectClient(e, t, r) {
-    return new V(
+  createDirectClient(e, t, s) {
+    return new j(
       {
         authClientId: e,
         authServerUrl: t.authServerUrl,
         redirectUri: t.redirectUri,
-        userScope: t.userScope,
+        userRole: t.userRole,
         logLevel: t.logLevel,
         basePath: t.basePath,
         apiTimeoutMs: t.apiTimeoutMs
       },
-      r
+      s
     );
   }
   // ============================================================================
@@ -692,9 +783,12 @@ class Y extends q {
   async handleOAuthCallback(e, t) {
     return this.connectionMode === "direct" ? this.directClient.handleOAuthCallback(e, t) : this.extClient.handleOAuthCallback(e, t);
   }
+  async handleAccessRequestCallback(e) {
+    return this.connectionMode === "direct" ? this.directClient.handleAccessRequestCallback(e) : this.extClient.handleAccessRequestCallback(e);
+  }
 }
-const J = "production";
+const se = "production";
 export {
-  J as WEB_BUILD_MODE,
-  Y as WebUIClient
+  se as WEB_BUILD_MODE,
+  te as WebUIClient
 };

package/dist/direct-client.d.ts

@@ -1,11 +1,12 @@
 import { DirectClientBase, AuthState, LoginOptions, LogLevel, StateChangeCallback } from '@bodhiapp/bodhi-js-core';
+import { UserScope } from '@bodhiapp/ts-client';
 /**
  * Configuration for DirectWebClient
  */
 export interface DirectWebClientConfig {
     authClientId: string;
     authServerUrl: string;
-    userScope: string;
+    userRole: UserScope;
     basePath: string;
     logLevel: LogLevel;
     redirectUri: string;
@@ -18,7 +19,9 @@ export declare class DirectWebClient extends DirectClientBase {
     private redirectUri;
     constructor(config: DirectWebClientConfig, onStateChange?: StateChangeCallback);
     login(options?: LoginOptions): Promise<AuthState>;
+    protected performOAuthPkce(scope: string): Promise<AuthState>;
     handleOAuthCallback(code: string, state: string): Promise<AuthState>;
+    handleAccessRequestCallback(requestId: string): Promise<AuthState>;
     logout(): Promise<AuthState>;
     protected exchangeCodeForTokens(code: string): Promise<void>;
     protected _storageGet(key: string): Promise<string | null>;

package/dist/ext-client.d.ts

@@ -1,4 +1,5 @@
-import { Chat, Models, Embeddings, ApiResponseResult, AuthState, BackendServerState, ClientState, ExtensionState, IExtensionClient, InitParams, LoginOptions, LogLevel, StateChangeCallback } from '@bodhiapp/bodhi-js-core';
+import { AccessRequestStatusResponse, CreateAccessRequest, CreateAccessRequestResponse, UserScope } from '@bodhiapp/ts-client';
+import { Chat, Models, Embeddings, Toolsets, Mcps, ApiResponseResult, AuthState, BackendServerState, ClientState, ExtensionState, IExtensionClient, InitParams, LoginOptions, LogLevel, StateChangeCallback } from '@bodhiapp/bodhi-js-core';
 export type SerializedWebExtensionState = {
     extensionId?: string;
 };
@@ -9,7 +10,7 @@ export type SerializedWebExtensionState = {
 export interface WindowBodhiextClientConfig {
     authServerUrl: string;
     redirectUri: string;
-    userScope: string;
+    userRole: UserScope;
     basePath: string;
     logLevel: LogLevel;
     apiTimeoutMs?: number;
@@ -43,6 +44,8 @@ export declare class WindowBodhiextClient implements IExtensionClient {
     private _chat;
     private _models;
     private _embeddings;
+    private _toolsets;
+    private _mcps;
     constructor(authClientId: string, config: WindowBodhiextClientConfig, onStateChange?: StateChangeCallback);
     /**
      * Set client state and notify callback
@@ -85,14 +88,9 @@ export declare class WindowBodhiextClient implements IExtensionClient {
      */
     init(params?: InitParams): Promise<ExtensionState>;
     /**
-     * Request resource access scope from backend
-     * Required for authenticated API access
-     */
-    private requestResourceAccess;
-    /**
-     * Login via browser redirect OAuth2 + PKCE flow
-     * @param options - Optional login options (toolsetScopeIds, version)
-     * @returns AuthState (though in practice, this redirects and never returns)
+     * Login via access-request flow with popup or redirect
+     * @param options - Optional login options
+     * @returns AuthState
      */
     login(options?: LoginOptions): Promise<AuthState>;
     /**
@@ -152,6 +150,16 @@ export declare class WindowBodhiextClient implements IExtensionClient {
     get chat(): Chat;
     get models(): Models;
     get embeddings(): Embeddings;
+    get toolsets(): Toolsets;
+    get mcps(): Mcps;
+    requestAccess(body: CreateAccessRequest): Promise<ApiResponseResult<CreateAccessRequestResponse>>;
+    getAccessRequestStatus(requestId: string): Promise<ApiResponseResult<AccessRequestStatusResponse>>;
+    pollAccessRequestStatus(requestId: string, options?: {
+        intervalMs?: number;
+        timeoutMs?: number;
+    }): Promise<AccessRequestStatusResponse>;
+    private performOAuthPkce;
+    handleAccessRequestCallback(requestId: string): Promise<AuthState>;
     /**
      * Serialize web extension client state (all transient, nothing to persist)
      */

package/dist/facade-client.d.ts

@@ -8,7 +8,7 @@ import { WindowBodhiextClient } from './ext-client';
 export interface WebClientConfig {
     authServerUrl: string;
     redirectUri: string;
-    userScope: string;
+    userRole: UserScope;
     basePath: string;
     logLevel: LogLevel;
     apiTimeoutMs?: number;
@@ -26,7 +26,7 @@ export interface WebClientConfig {
 export interface WebUIClientParams {
     redirectUri?: string;
     authServerUrl?: string;
-    userScope?: UserScope;
+    userRole?: UserScope;
     basePath?: string;
     logLevel?: LogLevel;
     apiTimeoutMs?: number;
@@ -50,4 +50,5 @@ export declare class WebUIClient extends BaseFacadeClient<WebClientConfig, Windo
     protected createExtClient(config: WebClientConfig, onStateChange: (change: StateChange) => void): WindowBodhiextClient;
     protected createDirectClient(authClientId: string, config: WebClientConfig, onStateChange: (change: StateChange) => void): DirectWebClient;
     handleOAuthCallback(code: string, state: string): Promise<AuthState>;
+    handleAccessRequestCallback(requestId: string): Promise<AuthState>;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bodhiapp/bodhi-js",
-  "version": "0.0.23",
+  "version": "0.0.24",
   "description": "Web SDK for Bodhi Browser - window.bodhiext communication",
   "type": "module",
   "main": "dist/bodhi-web.cjs.js",
@@ -37,9 +37,9 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@bodhiapp/bodhi-browser-types": "0.0.23",
-    "@bodhiapp/bodhi-js-core": "0.0.23",
-    "@bodhiapp/ts-client": "0.1.16"
+    "@bodhiapp/bodhi-browser-types": "0.0.24",
+    "@bodhiapp/bodhi-js-core": "0.0.24",
+    "@bodhiapp/ts-client": "0.1.19"
   },
   "devDependencies": {
     "@eslint/js": "^9.23.0",