@burdenoff/mcp-libs 2026.1008.2 → 2026.1008.4

package/dist/{chunk-QQYJVKJE.js.map → chunk-SX6IGKZH.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/modules/auth/legacy-auth.ts"],"names":[],"mappings":";;;AA6EA,IAAM,OAAA,uBAAc,OAAA,EAAgC;AAE7C,SAAS,QAAQ,GAAA,EAA6B;AACnD,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAC9B,EAAA,IAAI,QAAQ,OAAO,MAAA;AACnB,EAAA,MAAM,MAAA,GAAS,iBAAiB,GAAG,CAAA;AACnC,EAAA,OAAA,CAAQ,GAAA,CAAI,KAAK,MAAM,CAAA;AACvB,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,iBAAiB,GAAA,EAA6B;AACrD,EAAA,IAAI,OAAA,GAAoC,IAAA;AACxC,EAAA,IAAI,eAAA,GAAuC,IAAA;AAC3C,EAAA,IAAI,iBAAA,GAA0C,IAAA;AAE9C,EAAA,SAAS,MAAA,GAAe;AACtB,IAAA,eAAA,IAAkB;AAAA,EACpB;AAEA,EAAA,eAAe,UAAA,GAAwC;AACrD,IAAA,MAAM,EAAE,UAAA,EAAY,QAAA,EAAS,GAAI,GAAA,CAAI,OAAO,WAAA,EAAY;AACxD,IAAA,MAAM,aAAA,GAAgB,GAAG,UAAU,CAAA,iBAAA,CAAA;AACnC,IAAA,MAAM,QAAA,GAAW,GAAG,UAAU,CAAA,mBAAA,CAAA;AAE9B,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,aAAA,EAAe;AAAA,MAC1C,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,SAAA,EAAW,QAAA;AAAA,QACX,KAAA,EAAO;AAAA,OACR,EAAE,QAAA;AAAS,KACb,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,OAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,eAAe,CAAA;AAC9D,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,4BAAA,EAA+B,SAAS,MAAM,CAAA,GAAA,EAAM,IAAI,CAAA,CAAE,CAAA;AAAA,IAC5E;AAEA,IAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAClC,IAAA,MAAM,UAAA,GAAa,KAAK,aAAa,CAAA;AACrC,IAAA,MAAM,QAAA,GAAW,KAAK,WAAW,CAAA;AACjC,IAAA,MAAM,eAAA,GAAkB,KAAK,kBAAkB,CAAA;AAC/C,IAAA,MAAM,uBAAA,GAA2B,IAAA,CAAK,2BAA2B,CAAA,IAAgB,IAAA;AACjF,IAAA,MAAM,SAAA,GAAa,IAAA,CAAK,YAAY,CAAA,IAAgB,GAAA;AACpD,IAAA,MAAM,QAAA,GAAY,IAAA,CAAK,UAAU,CAAA,IAAgB,CAAA;AAEjD,IAAA,OAAA,GAAU;AAAA,MACR,UAAA;AAAA,MACA,QAAA;AAAA,MACA,eAAA;AAAA,MACA,uBAAA;AAAA,MACA,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA,GAAY,GAAA;AAAA,MACpC,QAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,oBAAA;AAAA,MACR,eAAA;AAAA,MACA,uBAAA;AAAA,MACA,QAAA;AAAA,MACA,SAAA;AAAA,MACA,OAAA,EAAS,QAAQ,uBAAA,IAA2B,eAAe,iCAAiC,QAAQ,CAAA,YAAA,EAAe,IAAI,WAAW,CAAA,wCAAA;AAAA,KACpI;AAAA,EACF;AAEA,EAAA,eAAe,aAAA,GAA8C;AAC3D,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,4BAAA,EAA+B,IAAI,WAAW,CAAA,gDAAA;AAAA,OAChD;AAAA,IACF;AAEA,IAAA,MAAM,CAAA,GAAI,OAAA;AACV,IAAA,IAAI,IAAA,CAAK,GAAA,EAAI,IAAK,CAAA,CAAE,SAAA,EAAW;AAC7B,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,SAAA;AAAA,QACR,OAAA,EAAS,CAAA,8BAAA,EAAiC,GAAA,CAAI,WAAW,CAAA,oCAAA;AAAA,OAC3D;AAAA,IACF;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,CAAA,CAAE,QAAA,EAAU;AAAA,MACvC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,UAAA,EAAY,8CAAA;AAAA,QACZ,aAAa,CAAA,CAAE,UAAA;AAAA,QACf,WAAW,CAAA,CAAE;AAAA,OACd,EAAE,QAAA;AAAS,KACb,CAAA;AAED,IAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAElC,IAAA,IAAI,QAAA,CAAS,EAAA,IAAM,IAAA,CAAK,cAAc,CAAA,EAAG;AACvC,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,MAAM,SAAA,GAAa,IAAA,CAAK,YAAY,CAAA,IAAgB,IAAA;AACpD,MAAA,MAAM,IAAA,GAAO,IAAI,IAAA,CAAK,IAAA,MAAU,EAAE,WAAA,EAAa,EAAA,EAAI,YAAA,EAAc,EAAA,EAAG;AACpE,MAAA,GAAA,CAAI,KAAK,KAAA,CAAM;AAAA,QACb,GAAG,IAAA;AAAA,QACH,WAAA,EAAa,KAAK,cAAc,CAAA;AAAA,QAChC,YAAA,EAAe,IAAA,CAAK,eAAe,CAAA,IAAgB,EAAA;AAAA,QACnD,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA,GAAY,GAAA;AAAA,QACpC,UAAA,EAAY;AAAA,OACb,CAAA;AACD,MAAA,GAAA,CAAI,IAAI,KAAA,EAAM;AACd,MAAA,OAAO,MAAM,eAAA,EAAgB;AAAA,IAC/B;AAEA,IAAA,MAAM,SAAA,GAAY,KAAK,OAAO,CAAA;AAC9B,IAAA,IAAI,cAAc,uBAAA,EAAyB;AACzC,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,SAAA;AAAA,QACR,OAAA,EAAS,CAAA,0CAAA,EAA6C,CAAA,CAAE,uBAAA,IAA2B,CAAA,CAAE,eAAe,CAAA,iBAAA,EAAoB,CAAA,CAAE,QAAQ,CAAA,YAAA,EAAe,GAAA,CAAI,WAAW,CAAA,qBAAA;AAAA,OAClK;AAAA,IACF,CAAA,MAAA,IAAW,cAAc,WAAA,EAAa;AACpC,MAAA,CAAA,CAAE,QAAA,IAAY,CAAA;AACd,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,SAAA;AAAA,QACR,OAAA,EAAS,CAAA,kEAAA,EAAqE,GAAA,CAAI,WAAW,CAAA,qBAAA;AAAA,OAC/F;AAAA,IACF,CAAA,MAAA,IAAW,cAAc,eAAA,EAAiB;AACxC,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,SAAA;AAAA,QACR,OAAA,EAAS,CAAA,8BAAA,EAAiC,GAAA,CAAI,WAAW,CAAA,kBAAA;AAAA,OAC3D;AAAA,IACF,CAAA,MAAA,IAAW,cAAc,eAAA,EAAiB;AACxC,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,IACzD,CAAA,MAAO;AACL,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,mBAAA,EAAuB,IAAA,CAAK,mBAAmB,CAAA,IAAgB,aAAa,SAAS,CAAA;AAAA,OACvF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,eAAe,eAAA,GAAgD;AAC7D,IAAA,IAAI;AACF,MAAA,MAAM,UAAA,GAAa,MAAM,cAAA,EAAe;AACxC,MAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAC3B,QAAA,MAAA,EAAO;AACP,QAAA,GAAA,CAAI,MAAA,CAAO,KAAK,oDAAoD,CAAA;AACpE,QAAA,OAAO;AAAA,UACL,MAAA,EAAQ,eAAA;AAAA,UACR,OAAA,EAAS,CAAA,0DAAA,EAAwD,GAAA,CAAI,WAAW,CAAA,6CAAA;AAAA,SAClF;AAAA,MACF;AACA,MAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAC3B,QAAA,MAAM,EAAA,GAAK,WAAW,CAAC,CAAA;AACvB,QAAA,IAAI,CAAC,EAAA;AACH,UAAA,MAAM,IAAI,MAAM,oEAAoE,CAAA;AACtF,QAAA,MAAM,2BAAA,CAA4B,EAAA,CAAG,EAAA,EAAI,EAAA,CAAG,cAAc,CAAA;AAC1D,QAAA,GAAA,CAAI,MAAA,CAAO,KAAK,8BAAA,EAAgC;AAAA,UAC9C,aAAa,EAAA,CAAG,EAAA;AAAA,UAChB,eAAe,EAAA,CAAG;AAAA,SACnB,CAAA;AACD,QAAA,OAAO;AAAA,UACL,MAAA,EAAQ,eAAA;AAAA,UACR,OAAA,EAAS,CAAA,sCAAA,EAAyC,EAAA,CAAG,IAAI,CAAA,yBAAA;AAAA,SAC3D;AAAA,MACF;AACA,MAAA,MAAA,EAAO;AACP,MAAA,GAAA,CAAI,MAAA,CAAO,KAAK,0DAA0D,CAAA;AAC1E,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,8BAAA;AAAA,QACR,SAAS,CAAA,2BAAA,EAA8B,UAAA,CAAW,MAAM,CAAA,kCAAA,EAAgC,IAAI,WAAW,CAAA,qCAAA,CAAA;AAAA,QACvG;AAAA,OACF;AAAA,IACF,SAAS,OAAA,EAAS;AAChB,MAAA,MAAA,EAAO;AACP,MAAA,GAAA,CAAI,MAAA,CAAO,KAAK,wCAAA,EAA0C;AAAA,QACxD,OAAO,OAAA,YAAmB,KAAA,GAAQ,OAAA,CAAQ,OAAA,GAAU,OAAO,OAAO;AAAA,OACnE,CAAA;AACD,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,eAAA;AAAA,QACR,OAAA,EAAS,0DAA0D,OAAA,YAAmB,KAAA,GAAQ,QAAQ,OAAA,GAAU,MAAA,CAAO,OAAO,CAAC,CAAA;AAAA,OACjI;AAAA,IACF;AAAA,EACF;AAEA,EAAA,eAAe,cAAA,GAA2C;AACxD,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,IAAI,CAAC,IAAA,EAAM,WAAA,EAAa,MAAM,IAAI,MAAM,wCAAwC,CAAA;AAChF,IAAA,OAAO,gBAAgB,GAAA,CAAI,MAAA,CAAO,MAAK,CAAE,cAAA,EAAgB,KAAK,WAAW,CAAA;AAAA,EAC3E;AAEA,EAAA,eAAe,2BAAA,CACb,aACA,cAAA,EACe;AACf,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,IAAI,CAAC,IAAA,EAAM,WAAA,EAAa,MAAM,IAAI,MAAM,oBAAoB,CAAA;AAC5D,IAAA,MAAM,SAAS,MAAM,mBAAA;AAAA,MACnB,GAAA,CAAI,MAAA,CAAO,IAAA,EAAK,CAAE,iBAAA;AAAA,MAClB,IAAA,CAAK,WAAA;AAAA,MACL,WAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,GAAA,CAAI,KAAK,KAAA,CAAM;AAAA,MACb,GAAG,IAAA;AAAA,MACH,gBAAgB,MAAA,CAAO,KAAA;AAAA,MACvB,yBAAyB,IAAI,IAAA,CAAK,MAAA,CAAO,SAAS,EAAE,OAAA,EAAQ;AAAA,MAC5D,WAAA;AAAA,MACA;AAAA,KACD,CAAA;AACD,IAAA,GAAA,CAAI,IAAI,KAAA,EAAM;AACd,IAAA,MAAA,EAAO;AAAA,EACT;AAEA,EAAA,eAAe,eAAA,CAAgB,aAAqB,cAAA,EAAuC;AACzF,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,IAAI,CAAC,IAAA,EAAM,WAAA,EAAa,MAAM,IAAI,MAAM,wCAAwC,CAAA;AAChF,IAAA,MAAM,2BAAA,CAA4B,aAAa,cAAc,CAAA;AAC7D,IAAA,GAAA,CAAI,MAAA,CAAO,IAAA,CAAK,oBAAA,EAAsB,EAAE,aAAa,CAAA;AAAA,EACvD;AAEA,EAAA,eAAe,mBAAA,GAAqC;AAClD,IAAA,IAAI,iBAAA,EAAmB;AACrB,MAAA,MAAM,iBAAA;AACN,MAAA;AAAA,IACF;AACA,IAAA,MAAM,WAAW,YAA2B;AAC1C,MAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,MAAA,IAAI,MAAM,MAAA,EAAQ;AAClB,MAAA,IAAI,CAAC,MAAM,WAAA,EAAa;AACtB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,wBAAA,EAA2B,GAAA,CAAI,WAAW,CAAA,0CAAA,EAA6C,IAAI,WAAW,CAAA,gDAAA;AAAA,SACxG;AAAA,MACF;AAAA,IAKF,CAAA;AACA,IAAA,iBAAA,GAAoB,QAAA,EAAS,CAAE,OAAA,CAAQ,MAAM;AAC3C,MAAA,iBAAA,GAAoB,IAAA;AAAA,IACtB,CAAC,CAAA;AACD,IAAA,MAAM,iBAAA;AAAA,EACR;AAEA,EAAA,SAAS,SAAA,GASN;AACD,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,OAAO,QAAQ,OAAA,CAAQ;AAAA,MACrB,aAAA,EAAe,CAAC,EAAE,IAAA,EAAM,eAAe,IAAA,EAAM,MAAA,CAAA;AAAA,MAC7C,QAAQ,IAAA,EAAM,MAAA,GAAS,SAAA,GAAY,IAAA,EAAM,cAAc,aAAA,GAAgB,MAAA;AAAA,MACvE,SAAA,EAAW,MAAM,SAAA,GAAY,IAAI,KAAK,IAAA,CAAK,SAAS,CAAA,CAAE,WAAA,EAAY,GAAI,IAAA;AAAA,MACtE,WAAA,EAAa,MAAM,WAAA,IAAe,IAAA;AAAA,MAClC,cAAA,EAAgB,MAAM,cAAA,IAAkB,IAAA;AAAA,MACxC,uBAAA,EAAyB,MAAM,uBAAA,GAC3B,IAAI,KAAK,IAAA,CAAK,uBAAuB,CAAA,CAAE,WAAA,EAAY,GACnD,IAAA;AAAA,MACJ,iBAAA,EAAmB,CAAC,CAAC,IAAA,EAAM,cAAA;AAAA,MAC3B,eAAA,EAAiB,CAAC,CAAC;AAAA,KACpB,CAAA;AAAA,EACH;AAEA,EAAA,eAAe,MAAA,GAAwB;AACrC,IAAA,OAAA,GAAU,IAAA;AACV,IAAA,GAAA,CAAI,KAAK,KAAA,EAAM;AACf,IAAA,GAAA,CAAI,IAAI,KAAA,EAAM;AACd,IAAA,MAAA,EAAO;AACP,IAAA,GAAA,CAAI,MAAA,CAAO,KAAK,sCAAsC,CAAA;AAAA,EACxD;AAEA,EAAA,SAAS,UAAA,GAAqC;AAC5C,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,MAAM,UAAkC,EAAC;AACzC,IAAA,IAAI,IAAA,EAAM,MAAA,EAAQ,OAAA,CAAQ,WAAW,IAAI,IAAA,CAAK,MAAA;AAC9C,IAAA,IAAI,MAAM,WAAA,EAAa,OAAA,CAAQ,eAAe,CAAA,GAAI,CAAA,OAAA,EAAU,KAAK,WAAW,CAAA,CAAA;AAC5E,IAAA,IAAI,IAAA,EAAM,cAAA;AACR,MAAA,OAAA,CAAQ,2BAA2B,CAAA,GAAI,CAAA,OAAA,EAAU,IAAA,CAAK,cAAc,CAAA,CAAA;AACtE,IAAA,IAAI,IAAA,EAAM,cAAA,EAAgB,OAAA,CAAQ,UAAU,IAAI,IAAA,CAAK,cAAA;AACrD,IAAA,IAAI,IAAA,EAAM,WAAA,EAAa,OAAA,CAAQ,gBAAgB,IAAI,IAAA,CAAK,WAAA;AACxD,IAAA,OAAO,OAAA;AAAA,EACT;AAEA,EAAA,SAAS,UAAA,GAAsB;AAC7B,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,OAAO,CAAC,EAAE,IAAA,EAAM,WAAA,IAAe,IAAA,EAAM,MAAA,CAAA;AAAA,EACvC;AAEA,EAAA,SAAS,mBAAmB,EAAA,EAAsB;AAChD,IAAA,eAAA,GAAkB,EAAA;AAAA,EACpB;AAEA,EAAA,OAAO;AAAA,IACL,UAAA;AAAA,IACA,aAAA;AAAA,IACA,eAAA;AAAA,IACA,cAAA;AAAA,IACA,mBAAA;AAAA,IACA,SAAA;AAAA,IACA,MAAA;AAAA,IACA,UAAA;AAAA,IACA,UAAA;AAAA,IACA;AAAA,GACF;AACF","file":"chunk-QQYJVKJE.js","sourcesContent":["/**\n * Auth helper for the auth module — ports VibeControlsMCPAuth from\n * vibecontrols-mcp/src/auth/index.ts to a ctx-aware factory.\n *\n * Differences from the legacy class:\n * - Per-ctx instance (no module-level singleton; each product MCP gets its own)\n * - Token persistence delegated to ctx.auth (StoredAuth file)\n * - Endpoints + clientId resolved via ctx.config.resolveOIDC + ctx.config.read\n * - pendingDeviceCode kept in closure scope (alive for the MCP server process,\n *   suitable for stdio's lifetime; HTTP's per-session servers each get their own\n *   pending state)\n *\n * Public surface mirrors the legacy class so the lifted auth/tools.ts works\n * without modification: startLogin / completeLogin / selectWorkspace /\n * listWorkspaces / getStatus / logout / ensureAuthenticated / getHeaders /\n * isLoggedIn / setOnTokensChanged.\n */\n\nimport type { McpContext } from '../../core/index.js';\nimport { fetchWorkspaces, issueWorkspaceToken } from '../../core/auth/device-code.js';\n\ninterface PendingDeviceCode {\n  deviceCode: string;\n  userCode: string;\n  verificationUri: string;\n  verificationUriComplete: string | null;\n  expiresAt: number;\n  interval: number;\n  clientId: string;\n  tokenUrl: string;\n}\n\nexport interface WorkspaceInfo {\n  id: string;\n  name: string;\n  slug: string;\n  tenantId: string;\n  organizationId: string;\n}\n\nexport interface LoginStartResult {\n  status: 'device_code_issued';\n  verificationUri: string;\n  verificationUriComplete: string | null;\n  userCode: string;\n  expiresIn: number;\n  message: string;\n}\n\nexport interface LoginCompleteResult {\n  status: 'authenticated' | 'workspace_selection_required' | 'pending' | 'expired';\n  message: string;\n  workspaces?: WorkspaceInfo[];\n}\n\nexport interface AuthHelper {\n  startLogin(): Promise<LoginStartResult>;\n  completeLogin(): Promise<LoginCompleteResult>;\n  selectWorkspace(workspaceId: string, organizationId: string): Promise<void>;\n  listWorkspaces(): Promise<WorkspaceInfo[]>;\n  ensureAuthenticated(): Promise<void>;\n  getStatus(): Promise<{\n    authenticated: boolean;\n    method: string;\n    expiresAt: string | null;\n    workspaceId: string | null;\n    organizationId: string | null;\n    workspaceTokenExpiresAt: string | null;\n    hasWorkspaceToken: boolean;\n    hasPendingLogin: boolean;\n  }>;\n  logout(): Promise<void>;\n  getHeaders(): Record<string, string>;\n  isLoggedIn(): boolean;\n  setOnTokensChanged(cb: () => void): void;\n}\n\nconst helpers = new WeakMap<McpContext, AuthHelper>();\n\nexport function getAuth(ctx: McpContext): AuthHelper {\n  const cached = helpers.get(ctx);\n  if (cached) return cached;\n  const helper = createAuthHelper(ctx);\n  helpers.set(ctx, helper);\n  return helper;\n}\n\nfunction createAuthHelper(ctx: McpContext): AuthHelper {\n  let pending: PendingDeviceCode | null = null;\n  let onTokensChanged: (() => void) | null = null;\n  let refreshInProgress: Promise<void> | null = null;\n\n  function notify(): void {\n    onTokensChanged?.();\n  }\n\n  async function startLogin(): Promise<LoginStartResult> {\n    const { oidcIssuer, clientId } = ctx.config.resolveOIDC();\n    const deviceCodeUrl = `${oidcIssuer}/oidc/device/code`;\n    const tokenUrl = `${oidcIssuer}/oauth/device/token`;\n\n    const response = await fetch(deviceCodeUrl, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        client_id: clientId,\n        scope: 'openid profile email offline_access',\n      }).toString(),\n    });\n\n    if (!response.ok) {\n      const text = await response.text().catch(() => 'Unknown error');\n      throw new Error(`Device code request failed (${response.status}): ${text}`);\n    }\n\n    const data = (await response.json()) as Record<string, unknown>;\n    const deviceCode = data['device_code'] as string;\n    const userCode = data['user_code'] as string;\n    const verificationUri = data['verification_uri'] as string;\n    const verificationUriComplete = (data['verification_uri_complete'] as string) ?? null;\n    const expiresIn = (data['expires_in'] as number) ?? 900;\n    const interval = (data['interval'] as number) ?? 5;\n\n    pending = {\n      deviceCode,\n      userCode,\n      verificationUri,\n      verificationUriComplete,\n      expiresAt: Date.now() + expiresIn * 1000,\n      interval,\n      clientId,\n      tokenUrl,\n    };\n\n    return {\n      status: 'device_code_issued',\n      verificationUri,\n      verificationUriComplete,\n      userCode,\n      expiresIn,\n      message: `Open ${verificationUriComplete ?? verificationUri} in a browser and enter code: ${userCode}. Then call ${ctx.productName}_auth_complete to finish authentication.`,\n    };\n  }\n\n  async function completeLogin(): Promise<LoginCompleteResult> {\n    if (!pending) {\n      throw new Error(\n        `No pending login flow. Call ${ctx.productName}_auth_login first to start the device code flow.`,\n      );\n    }\n\n    const p = pending;\n    if (Date.now() >= p.expiresAt) {\n      pending = null;\n      return {\n        status: 'expired',\n        message: `Device code has expired. Call ${ctx.productName}_auth_login again to get a new code.`,\n      };\n    }\n\n    const response = await fetch(p.tokenUrl, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        grant_type: 'urn:ietf:params:oauth:grant-type:device_code',\n        device_code: p.deviceCode,\n        client_id: p.clientId,\n      }).toString(),\n    });\n\n    const data = (await response.json()) as Record<string, unknown>;\n\n    if (response.ok && data['access_token']) {\n      pending = null;\n      const expiresIn = (data['expires_in'] as number) ?? 3600;\n      const auth = ctx.auth.read() ?? { accessToken: '', refreshToken: '' };\n      ctx.auth.write({\n        ...auth,\n        accessToken: data['access_token'] as string,\n        refreshToken: (data['refresh_token'] as string) ?? '',\n        expiresAt: Date.now() + expiresIn * 1000,\n        authMethod: 'device_code',\n      });\n      ctx.gql.reset();\n      return await handlePostLogin();\n    }\n\n    const errorCode = data['error'] as string | undefined;\n    if (errorCode === 'authorization_pending') {\n      return {\n        status: 'pending',\n        message: `Still waiting for user to authorize. Open ${p.verificationUriComplete ?? p.verificationUri} and enter code: ${p.userCode}. Then call ${ctx.productName}_auth_complete again.`,\n      };\n    } else if (errorCode === 'slow_down') {\n      p.interval += 5;\n      return {\n        status: 'pending',\n        message: `Authorization server asked to slow down. Wait a moment, then call ${ctx.productName}_auth_complete again.`,\n      };\n    } else if (errorCode === 'expired_token') {\n      pending = null;\n      return {\n        status: 'expired',\n        message: `Device code has expired. Call ${ctx.productName}_auth_login again.`,\n      };\n    } else if (errorCode === 'access_denied') {\n      pending = null;\n      throw new Error('Authorization was denied by the user.');\n    } else {\n      pending = null;\n      throw new Error(\n        `Device code error: ${(data['error_description'] as string) ?? errorCode ?? 'Unknown'}`,\n      );\n    }\n  }\n\n  async function handlePostLogin(): Promise<LoginCompleteResult> {\n    try {\n      const workspaces = await listWorkspaces();\n      if (workspaces.length === 0) {\n        notify();\n        ctx.logger.info('Device code login successful (no workspaces found)');\n        return {\n          status: 'authenticated',\n          message: `Authentication successful. No workspaces found — use ${ctx.productName}_auth_select_workspace when one is available.`,\n        };\n      }\n      if (workspaces.length === 1) {\n        const ws = workspaces[0];\n        if (!ws)\n          throw new Error('Unexpected: workspaces.length === 1 but workspaces[0] is undefined');\n        await issueAndStoreWorkspaceToken(ws.id, ws.organizationId);\n        ctx.logger.info('Device code login successful', {\n          workspaceId: ws.id,\n          workspaceName: ws.name,\n        });\n        return {\n          status: 'authenticated',\n          message: `Authentication successful. Workspace \"${ws.name}\" selected automatically.`,\n        };\n      }\n      notify();\n      ctx.logger.info('Device code login successful, workspace selection needed');\n      return {\n        status: 'workspace_selection_required',\n        message: `Authentication successful. ${workspaces.length} workspaces available — call ${ctx.productName}_auth_select_workspace to choose one.`,\n        workspaces,\n      };\n    } catch (wsError) {\n      notify();\n      ctx.logger.warn('Workspace discovery failed after login', {\n        error: wsError instanceof Error ? wsError.message : String(wsError),\n      });\n      return {\n        status: 'authenticated',\n        message: `Authentication successful. Workspace discovery failed: ${wsError instanceof Error ? wsError.message : String(wsError)}`,\n      };\n    }\n  }\n\n  async function listWorkspaces(): Promise<WorkspaceInfo[]> {\n    const auth = ctx.auth.read();\n    if (!auth?.accessToken) throw new Error('Not authenticated. Please login first.');\n    return fetchWorkspaces(ctx.config.read().globalEndpoint, auth.accessToken);\n  }\n\n  async function issueAndStoreWorkspaceToken(\n    workspaceId: string,\n    organizationId: string,\n  ): Promise<void> {\n    const auth = ctx.auth.read();\n    if (!auth?.accessToken) throw new Error('Not authenticated.');\n    const result = await issueWorkspaceToken(\n      ctx.config.read().workspaceEndpoint,\n      auth.accessToken,\n      workspaceId,\n      organizationId,\n    );\n    ctx.auth.write({\n      ...auth,\n      workspaceToken: result.token,\n      workspaceTokenExpiresAt: new Date(result.expiresAt).getTime(),\n      workspaceId,\n      organizationId,\n    });\n    ctx.gql.reset();\n    notify();\n  }\n\n  async function selectWorkspace(workspaceId: string, organizationId: string): Promise<void> {\n    const auth = ctx.auth.read();\n    if (!auth?.accessToken) throw new Error('Not authenticated. Please login first.');\n    await issueAndStoreWorkspaceToken(workspaceId, organizationId);\n    ctx.logger.info('Workspace selected', { workspaceId });\n  }\n\n  async function ensureAuthenticated(): Promise<void> {\n    if (refreshInProgress) {\n      await refreshInProgress;\n      return;\n    }\n    const doEnsure = async (): Promise<void> => {\n      const auth = ctx.auth.read();\n      if (auth?.apiKey) return;\n      if (!auth?.accessToken) {\n        throw new Error(\n          `Not authenticated. Call ${ctx.productName}_auth_login to start the login flow, then ${ctx.productName}_auth_complete after authorizing in the browser.`,\n        );\n      }\n      // The shared gql client handles refresh via isTokenExpiringSoon + isWorkspaceTokenExpiringSoon —\n      // trigger by issuing a no-op request that goes through the workspace client's refresh path.\n      // We simulate a no-op via a cheap query if needed; today the gql wrapper does it lazily,\n      // so we just delegate to it on the next request. Nothing to do here.\n    };\n    refreshInProgress = doEnsure().finally(() => {\n      refreshInProgress = null;\n    });\n    await refreshInProgress;\n  }\n\n  function getStatus(): Promise<{\n    authenticated: boolean;\n    method: string;\n    expiresAt: string | null;\n    workspaceId: string | null;\n    organizationId: string | null;\n    workspaceTokenExpiresAt: string | null;\n    hasWorkspaceToken: boolean;\n    hasPendingLogin: boolean;\n  }> {\n    const auth = ctx.auth.read();\n    return Promise.resolve({\n      authenticated: !!(auth?.accessToken || auth?.apiKey),\n      method: auth?.apiKey ? 'api_key' : auth?.accessToken ? 'oauth_token' : 'none',\n      expiresAt: auth?.expiresAt ? new Date(auth.expiresAt).toISOString() : null,\n      workspaceId: auth?.workspaceId ?? null,\n      organizationId: auth?.organizationId ?? null,\n      workspaceTokenExpiresAt: auth?.workspaceTokenExpiresAt\n        ? new Date(auth.workspaceTokenExpiresAt).toISOString()\n        : null,\n      hasWorkspaceToken: !!auth?.workspaceToken,\n      hasPendingLogin: !!pending,\n    });\n  }\n\n  async function logout(): Promise<void> {\n    pending = null;\n    ctx.auth.clear();\n    ctx.gql.reset();\n    notify();\n    ctx.logger.info('Logged out and cleared stored tokens');\n  }\n\n  function getHeaders(): Record<string, string> {\n    const auth = ctx.auth.read();\n    const headers: Record<string, string> = {};\n    if (auth?.apiKey) headers['X-API-Key'] = auth.apiKey;\n    if (auth?.accessToken) headers['Authorization'] = `Bearer ${auth.accessToken}`;\n    if (auth?.workspaceToken)\n      headers['X-Workspace-Authorization'] = `Bearer ${auth.workspaceToken}`;\n    if (auth?.organizationId) headers['x-org-id'] = auth.organizationId;\n    if (auth?.workspaceId) headers['x-workspace-id'] = auth.workspaceId;\n    return headers;\n  }\n\n  function isLoggedIn(): boolean {\n    const auth = ctx.auth.read();\n    return !!(auth?.accessToken || auth?.apiKey);\n  }\n\n  function setOnTokensChanged(cb: () => void): void {\n    onTokensChanged = cb;\n  }\n\n  return {\n    startLogin,\n    completeLogin,\n    selectWorkspace,\n    listWorkspaces,\n    ensureAuthenticated,\n    getStatus,\n    logout,\n    getHeaders,\n    isLoggedIn,\n    setOnTokensChanged,\n  };\n}\n"]}
+{"version":3,"sources":["../src/modules/auth/legacy-auth.ts"],"names":[],"mappings":";;;AA6EA,IAAM,OAAA,uBAAc,OAAA,EAAgC;AAE7C,SAAS,QAAQ,GAAA,EAA6B;AACnD,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAC9B,EAAA,IAAI,QAAQ,OAAO,MAAA;AACnB,EAAA,MAAM,MAAA,GAAS,iBAAiB,GAAG,CAAA;AACnC,EAAA,OAAA,CAAQ,GAAA,CAAI,KAAK,MAAM,CAAA;AACvB,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,iBAAiB,GAAA,EAA6B;AACrD,EAAA,IAAI,OAAA,GAAoC,IAAA;AACxC,EAAA,IAAI,eAAA,GAAuC,IAAA;AAC3C,EAAA,IAAI,iBAAA,GAA0C,IAAA;AAE9C,EAAA,SAAS,MAAA,GAAe;AACtB,IAAA,eAAA,IAAkB;AAAA,EACpB;AAEA,EAAA,eAAe,UAAA,GAAwC;AACrD,IAAA,MAAM,EAAE,UAAA,EAAY,QAAA,EAAS,GAAI,GAAA,CAAI,OAAO,WAAA,EAAY;AACxD,IAAA,MAAM,aAAA,GAAgB,GAAG,UAAU,CAAA,iBAAA,CAAA;AACnC,IAAA,MAAM,QAAA,GAAW,GAAG,UAAU,CAAA,mBAAA,CAAA;AAE9B,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,aAAA,EAAe;AAAA,MAC1C,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,SAAA,EAAW,QAAA;AAAA,QACX,KAAA,EAAO;AAAA,OACR,EAAE,QAAA;AAAS,KACb,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,OAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,eAAe,CAAA;AAC9D,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,4BAAA,EAA+B,SAAS,MAAM,CAAA,GAAA,EAAM,IAAI,CAAA,CAAE,CAAA;AAAA,IAC5E;AAEA,IAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAClC,IAAA,MAAM,UAAA,GAAa,KAAK,aAAa,CAAA;AACrC,IAAA,MAAM,QAAA,GAAW,KAAK,WAAW,CAAA;AACjC,IAAA,MAAM,eAAA,GAAkB,KAAK,kBAAkB,CAAA;AAC/C,IAAA,MAAM,uBAAA,GAA2B,IAAA,CAAK,2BAA2B,CAAA,IAAgB,IAAA;AACjF,IAAA,MAAM,SAAA,GAAa,IAAA,CAAK,YAAY,CAAA,IAAgB,GAAA;AACpD,IAAA,MAAM,QAAA,GAAY,IAAA,CAAK,UAAU,CAAA,IAAgB,CAAA;AAEjD,IAAA,OAAA,GAAU;AAAA,MACR,UAAA;AAAA,MACA,QAAA;AAAA,MACA,eAAA;AAAA,MACA,uBAAA;AAAA,MACA,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA,GAAY,GAAA;AAAA,MACpC,QAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,oBAAA;AAAA,MACR,eAAA;AAAA,MACA,uBAAA;AAAA,MACA,QAAA;AAAA,MACA,SAAA;AAAA,MACA,OAAA,EAAS,QAAQ,uBAAA,IAA2B,eAAe,iCAAiC,QAAQ,CAAA,YAAA,EAAe,IAAI,WAAW,CAAA,wCAAA;AAAA,KACpI;AAAA,EACF;AAEA,EAAA,eAAe,aAAA,GAA8C;AAC3D,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,4BAAA,EAA+B,IAAI,WAAW,CAAA,gDAAA;AAAA,OAChD;AAAA,IACF;AAEA,IAAA,MAAM,CAAA,GAAI,OAAA;AACV,IAAA,IAAI,IAAA,CAAK,GAAA,EAAI,IAAK,CAAA,CAAE,SAAA,EAAW;AAC7B,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,SAAA;AAAA,QACR,OAAA,EAAS,CAAA,8BAAA,EAAiC,GAAA,CAAI,WAAW,CAAA,oCAAA;AAAA,OAC3D;AAAA,IACF;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,CAAA,CAAE,QAAA,EAAU;AAAA,MACvC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,UAAA,EAAY,8CAAA;AAAA,QACZ,aAAa,CAAA,CAAE,UAAA;AAAA,QACf,WAAW,CAAA,CAAE;AAAA,OACd,EAAE,QAAA;AAAS,KACb,CAAA;AAED,IAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAElC,IAAA,IAAI,QAAA,CAAS,EAAA,IAAM,IAAA,CAAK,cAAc,CAAA,EAAG;AACvC,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,MAAM,SAAA,GAAa,IAAA,CAAK,YAAY,CAAA,IAAgB,IAAA;AACpD,MAAA,MAAM,IAAA,GAAO,IAAI,IAAA,CAAK,IAAA,MAAU,EAAE,WAAA,EAAa,EAAA,EAAI,YAAA,EAAc,EAAA,EAAG;AACpE,MAAA,GAAA,CAAI,KAAK,KAAA,CAAM;AAAA,QACb,GAAG,IAAA;AAAA,QACH,WAAA,EAAa,KAAK,cAAc,CAAA;AAAA,QAChC,YAAA,EAAe,IAAA,CAAK,eAAe,CAAA,IAAgB,EAAA;AAAA,QACnD,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA,GAAY,GAAA;AAAA,QACpC,UAAA,EAAY;AAAA,OACb,CAAA;AACD,MAAA,GAAA,CAAI,IAAI,KAAA,EAAM;AACd,MAAA,OAAO,MAAM,eAAA,EAAgB;AAAA,IAC/B;AAEA,IAAA,MAAM,SAAA,GAAY,KAAK,OAAO,CAAA;AAC9B,IAAA,IAAI,cAAc,uBAAA,EAAyB;AACzC,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,SAAA;AAAA,QACR,OAAA,EAAS,CAAA,0CAAA,EAA6C,CAAA,CAAE,uBAAA,IAA2B,CAAA,CAAE,eAAe,CAAA,iBAAA,EAAoB,CAAA,CAAE,QAAQ,CAAA,YAAA,EAAe,GAAA,CAAI,WAAW,CAAA,qBAAA;AAAA,OAClK;AAAA,IACF,CAAA,MAAA,IAAW,cAAc,WAAA,EAAa;AACpC,MAAA,CAAA,CAAE,QAAA,IAAY,CAAA;AACd,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,SAAA;AAAA,QACR,OAAA,EAAS,CAAA,kEAAA,EAAqE,GAAA,CAAI,WAAW,CAAA,qBAAA;AAAA,OAC/F;AAAA,IACF,CAAA,MAAA,IAAW,cAAc,eAAA,EAAiB;AACxC,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,SAAA;AAAA,QACR,OAAA,EAAS,CAAA,8BAAA,EAAiC,GAAA,CAAI,WAAW,CAAA,kBAAA;AAAA,OAC3D;AAAA,IACF,CAAA,MAAA,IAAW,cAAc,eAAA,EAAiB;AACxC,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,IACzD,CAAA,MAAO;AACL,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,mBAAA,EAAuB,IAAA,CAAK,mBAAmB,CAAA,IAAgB,aAAa,SAAS,CAAA;AAAA,OACvF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,eAAe,eAAA,GAAgD;AAC7D,IAAA,IAAI;AACF,MAAA,MAAM,UAAA,GAAa,MAAM,cAAA,EAAe;AACxC,MAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAC3B,QAAA,MAAA,EAAO;AACP,QAAA,GAAA,CAAI,MAAA,CAAO,KAAK,oDAAoD,CAAA;AACpE,QAAA,OAAO;AAAA,UACL,MAAA,EAAQ,eAAA;AAAA,UACR,OAAA,EAAS,CAAA,0DAAA,EAAwD,GAAA,CAAI,WAAW,CAAA,6CAAA;AAAA,SAClF;AAAA,MACF;AACA,MAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAC3B,QAAA,MAAM,EAAA,GAAK,WAAW,CAAC,CAAA;AACvB,QAAA,IAAI,CAAC,EAAA;AACH,UAAA,MAAM,IAAI,MAAM,oEAAoE,CAAA;AACtF,QAAA,MAAM,2BAAA,CAA4B,EAAA,CAAG,EAAA,EAAI,EAAA,CAAG,cAAc,CAAA;AAC1D,QAAA,GAAA,CAAI,MAAA,CAAO,KAAK,8BAAA,EAAgC;AAAA,UAC9C,aAAa,EAAA,CAAG,EAAA;AAAA,UAChB,eAAe,EAAA,CAAG;AAAA,SACnB,CAAA;AACD,QAAA,OAAO;AAAA,UACL,MAAA,EAAQ,eAAA;AAAA,UACR,OAAA,EAAS,CAAA,sCAAA,EAAyC,EAAA,CAAG,IAAI,CAAA,yBAAA;AAAA,SAC3D;AAAA,MACF;AACA,MAAA,MAAA,EAAO;AACP,MAAA,GAAA,CAAI,MAAA,CAAO,KAAK,0DAA0D,CAAA;AAC1E,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,8BAAA;AAAA,QACR,SAAS,CAAA,2BAAA,EAA8B,UAAA,CAAW,MAAM,CAAA,kCAAA,EAAgC,IAAI,WAAW,CAAA,qCAAA,CAAA;AAAA,QACvG;AAAA,OACF;AAAA,IACF,SAAS,OAAA,EAAS;AAChB,MAAA,MAAA,EAAO;AACP,MAAA,GAAA,CAAI,MAAA,CAAO,KAAK,wCAAA,EAA0C;AAAA,QACxD,OAAO,OAAA,YAAmB,KAAA,GAAQ,OAAA,CAAQ,OAAA,GAAU,OAAO,OAAO;AAAA,OACnE,CAAA;AACD,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,eAAA;AAAA,QACR,OAAA,EAAS,0DAA0D,OAAA,YAAmB,KAAA,GAAQ,QAAQ,OAAA,GAAU,MAAA,CAAO,OAAO,CAAC,CAAA;AAAA,OACjI;AAAA,IACF;AAAA,EACF;AAEA,EAAA,eAAe,cAAA,GAA2C;AACxD,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,IAAI,CAAC,IAAA,EAAM,WAAA,EAAa,MAAM,IAAI,MAAM,wCAAwC,CAAA;AAChF,IAAA,OAAO,gBAAgB,GAAA,CAAI,MAAA,CAAO,MAAK,CAAE,cAAA,EAAgB,KAAK,WAAW,CAAA;AAAA,EAC3E;AAEA,EAAA,eAAe,2BAAA,CACb,aACA,cAAA,EACe;AACf,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,IAAI,CAAC,IAAA,EAAM,WAAA,EAAa,MAAM,IAAI,MAAM,oBAAoB,CAAA;AAC5D,IAAA,MAAM,SAAS,MAAM,mBAAA;AAAA,MACnB,GAAA,CAAI,MAAA,CAAO,IAAA,EAAK,CAAE,iBAAA;AAAA,MAClB,IAAA,CAAK,WAAA;AAAA,MACL,WAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,GAAA,CAAI,KAAK,KAAA,CAAM;AAAA,MACb,GAAG,IAAA;AAAA,MACH,gBAAgB,MAAA,CAAO,KAAA;AAAA,MACvB,yBAAyB,IAAI,IAAA,CAAK,MAAA,CAAO,SAAS,EAAE,OAAA,EAAQ;AAAA,MAC5D,WAAA;AAAA,MACA;AAAA,KACD,CAAA;AACD,IAAA,GAAA,CAAI,IAAI,KAAA,EAAM;AACd,IAAA,MAAA,EAAO;AAAA,EACT;AAEA,EAAA,eAAe,eAAA,CAAgB,aAAqB,cAAA,EAAuC;AACzF,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,IAAI,CAAC,IAAA,EAAM,WAAA,EAAa,MAAM,IAAI,MAAM,wCAAwC,CAAA;AAChF,IAAA,MAAM,2BAAA,CAA4B,aAAa,cAAc,CAAA;AAC7D,IAAA,GAAA,CAAI,MAAA,CAAO,IAAA,CAAK,oBAAA,EAAsB,EAAE,aAAa,CAAA;AAAA,EACvD;AAEA,EAAA,eAAe,mBAAA,GAAqC;AAClD,IAAA,IAAI,iBAAA,EAAmB;AACrB,MAAA,MAAM,iBAAA;AACN,MAAA;AAAA,IACF;AACA,IAAA,MAAM,WAAW,YAA2B;AAC1C,MAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,MAAA,IAAI,MAAM,MAAA,EAAQ;AAClB,MAAA,IAAI,CAAC,MAAM,WAAA,EAAa;AACtB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,wBAAA,EAA2B,GAAA,CAAI,WAAW,CAAA,0CAAA,EAA6C,IAAI,WAAW,CAAA,gDAAA;AAAA,SACxG;AAAA,MACF;AAAA,IAKF,CAAA;AACA,IAAA,iBAAA,GAAoB,QAAA,EAAS,CAAE,OAAA,CAAQ,MAAM;AAC3C,MAAA,iBAAA,GAAoB,IAAA;AAAA,IACtB,CAAC,CAAA;AACD,IAAA,MAAM,iBAAA;AAAA,EACR;AAEA,EAAA,SAAS,SAAA,GASN;AACD,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,OAAO,QAAQ,OAAA,CAAQ;AAAA,MACrB,aAAA,EAAe,CAAC,EAAE,IAAA,EAAM,eAAe,IAAA,EAAM,MAAA,CAAA;AAAA,MAC7C,QAAQ,IAAA,EAAM,MAAA,GAAS,SAAA,GAAY,IAAA,EAAM,cAAc,aAAA,GAAgB,MAAA;AAAA,MACvE,SAAA,EAAW,MAAM,SAAA,GAAY,IAAI,KAAK,IAAA,CAAK,SAAS,CAAA,CAAE,WAAA,EAAY,GAAI,IAAA;AAAA,MACtE,WAAA,EAAa,MAAM,WAAA,IAAe,IAAA;AAAA,MAClC,cAAA,EAAgB,MAAM,cAAA,IAAkB,IAAA;AAAA,MACxC,uBAAA,EAAyB,MAAM,uBAAA,GAC3B,IAAI,KAAK,IAAA,CAAK,uBAAuB,CAAA,CAAE,WAAA,EAAY,GACnD,IAAA;AAAA,MACJ,iBAAA,EAAmB,CAAC,CAAC,IAAA,EAAM,cAAA;AAAA,MAC3B,eAAA,EAAiB,CAAC,CAAC;AAAA,KACpB,CAAA;AAAA,EACH;AAEA,EAAA,eAAe,MAAA,GAAwB;AACrC,IAAA,OAAA,GAAU,IAAA;AACV,IAAA,GAAA,CAAI,KAAK,KAAA,EAAM;AACf,IAAA,GAAA,CAAI,IAAI,KAAA,EAAM;AACd,IAAA,MAAA,EAAO;AACP,IAAA,GAAA,CAAI,MAAA,CAAO,KAAK,sCAAsC,CAAA;AAAA,EACxD;AAEA,EAAA,SAAS,UAAA,GAAqC;AAC5C,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,MAAM,UAAkC,EAAC;AACzC,IAAA,IAAI,IAAA,EAAM,MAAA,EAAQ,OAAA,CAAQ,WAAW,IAAI,IAAA,CAAK,MAAA;AAC9C,IAAA,IAAI,MAAM,WAAA,EAAa,OAAA,CAAQ,eAAe,CAAA,GAAI,CAAA,OAAA,EAAU,KAAK,WAAW,CAAA,CAAA;AAC5E,IAAA,IAAI,IAAA,EAAM,cAAA;AACR,MAAA,OAAA,CAAQ,2BAA2B,CAAA,GAAI,CAAA,OAAA,EAAU,IAAA,CAAK,cAAc,CAAA,CAAA;AACtE,IAAA,IAAI,IAAA,EAAM,cAAA,EAAgB,OAAA,CAAQ,UAAU,IAAI,IAAA,CAAK,cAAA;AACrD,IAAA,IAAI,IAAA,EAAM,WAAA,EAAa,OAAA,CAAQ,gBAAgB,IAAI,IAAA,CAAK,WAAA;AACxD,IAAA,OAAO,OAAA;AAAA,EACT;AAEA,EAAA,SAAS,UAAA,GAAsB;AAC7B,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,OAAO,CAAC,EAAE,IAAA,EAAM,WAAA,IAAe,IAAA,EAAM,MAAA,CAAA;AAAA,EACvC;AAEA,EAAA,SAAS,mBAAmB,EAAA,EAAsB;AAChD,IAAA,eAAA,GAAkB,EAAA;AAAA,EACpB;AAEA,EAAA,OAAO;AAAA,IACL,UAAA;AAAA,IACA,aAAA;AAAA,IACA,eAAA;AAAA,IACA,cAAA;AAAA,IACA,mBAAA;AAAA,IACA,SAAA;AAAA,IACA,MAAA;AAAA,IACA,UAAA;AAAA,IACA,UAAA;AAAA,IACA;AAAA,GACF;AACF","file":"chunk-SX6IGKZH.js","sourcesContent":["/**\n * Auth helper for the auth module — ports VibeControlsMCPAuth from\n * vibecontrols-mcp/src/auth/index.ts to a ctx-aware factory.\n *\n * Differences from the legacy class:\n * - Per-ctx instance (no module-level singleton; each product MCP gets its own)\n * - Token persistence delegated to ctx.auth (StoredAuth file)\n * - Endpoints + clientId resolved via ctx.config.resolveOIDC + ctx.config.read\n * - pendingDeviceCode kept in closure scope (alive for the MCP server process,\n *   suitable for stdio's lifetime; HTTP's per-session servers each get their own\n *   pending state)\n *\n * Public surface mirrors the legacy class so the lifted auth/tools.ts works\n * without modification: startLogin / completeLogin / selectWorkspace /\n * listWorkspaces / getStatus / logout / ensureAuthenticated / getHeaders /\n * isLoggedIn / setOnTokensChanged.\n */\n\nimport type { McpContext } from '../../core/index.js';\nimport { fetchWorkspaces, issueWorkspaceToken } from '../../core/auth/device-code.js';\n\ninterface PendingDeviceCode {\n  deviceCode: string;\n  userCode: string;\n  verificationUri: string;\n  verificationUriComplete: string | null;\n  expiresAt: number;\n  interval: number;\n  clientId: string;\n  tokenUrl: string;\n}\n\nexport interface WorkspaceInfo {\n  id: string;\n  name: string;\n  slug: string;\n  tenantId: string;\n  organizationId: string;\n}\n\nexport interface LoginStartResult {\n  status: 'device_code_issued';\n  verificationUri: string;\n  verificationUriComplete: string | null;\n  userCode: string;\n  expiresIn: number;\n  message: string;\n}\n\nexport interface LoginCompleteResult {\n  status: 'authenticated' | 'workspace_selection_required' | 'pending' | 'expired';\n  message: string;\n  workspaces?: WorkspaceInfo[];\n}\n\nexport interface AuthHelper {\n  startLogin(): Promise<LoginStartResult>;\n  completeLogin(): Promise<LoginCompleteResult>;\n  selectWorkspace(workspaceId: string, organizationId: string): Promise<void>;\n  listWorkspaces(): Promise<WorkspaceInfo[]>;\n  ensureAuthenticated(): Promise<void>;\n  getStatus(): Promise<{\n    authenticated: boolean;\n    method: string;\n    expiresAt: string | null;\n    workspaceId: string | null;\n    organizationId: string | null;\n    workspaceTokenExpiresAt: string | null;\n    hasWorkspaceToken: boolean;\n    hasPendingLogin: boolean;\n  }>;\n  logout(): Promise<void>;\n  getHeaders(): Record<string, string>;\n  isLoggedIn(): boolean;\n  setOnTokensChanged(cb: () => void): void;\n}\n\nconst helpers = new WeakMap<McpContext, AuthHelper>();\n\nexport function getAuth(ctx: McpContext): AuthHelper {\n  const cached = helpers.get(ctx);\n  if (cached) return cached;\n  const helper = createAuthHelper(ctx);\n  helpers.set(ctx, helper);\n  return helper;\n}\n\nfunction createAuthHelper(ctx: McpContext): AuthHelper {\n  let pending: PendingDeviceCode | null = null;\n  let onTokensChanged: (() => void) | null = null;\n  let refreshInProgress: Promise<void> | null = null;\n\n  function notify(): void {\n    onTokensChanged?.();\n  }\n\n  async function startLogin(): Promise<LoginStartResult> {\n    const { oidcIssuer, clientId } = ctx.config.resolveOIDC();\n    const deviceCodeUrl = `${oidcIssuer}/oidc/device/code`;\n    const tokenUrl = `${oidcIssuer}/oauth/device/token`;\n\n    const response = await fetch(deviceCodeUrl, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        client_id: clientId,\n        scope: 'openid profile email offline_access',\n      }).toString(),\n    });\n\n    if (!response.ok) {\n      const text = await response.text().catch(() => 'Unknown error');\n      throw new Error(`Device code request failed (${response.status}): ${text}`);\n    }\n\n    const data = (await response.json()) as Record<string, unknown>;\n    const deviceCode = data['device_code'] as string;\n    const userCode = data['user_code'] as string;\n    const verificationUri = data['verification_uri'] as string;\n    const verificationUriComplete = (data['verification_uri_complete'] as string) ?? null;\n    const expiresIn = (data['expires_in'] as number) ?? 900;\n    const interval = (data['interval'] as number) ?? 5;\n\n    pending = {\n      deviceCode,\n      userCode,\n      verificationUri,\n      verificationUriComplete,\n      expiresAt: Date.now() + expiresIn * 1000,\n      interval,\n      clientId,\n      tokenUrl,\n    };\n\n    return {\n      status: 'device_code_issued',\n      verificationUri,\n      verificationUriComplete,\n      userCode,\n      expiresIn,\n      message: `Open ${verificationUriComplete ?? verificationUri} in a browser and enter code: ${userCode}. Then call ${ctx.productName}_auth_complete to finish authentication.`,\n    };\n  }\n\n  async function completeLogin(): Promise<LoginCompleteResult> {\n    if (!pending) {\n      throw new Error(\n        `No pending login flow. Call ${ctx.productName}_auth_login first to start the device code flow.`,\n      );\n    }\n\n    const p = pending;\n    if (Date.now() >= p.expiresAt) {\n      pending = null;\n      return {\n        status: 'expired',\n        message: `Device code has expired. Call ${ctx.productName}_auth_login again to get a new code.`,\n      };\n    }\n\n    const response = await fetch(p.tokenUrl, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        grant_type: 'urn:ietf:params:oauth:grant-type:device_code',\n        device_code: p.deviceCode,\n        client_id: p.clientId,\n      }).toString(),\n    });\n\n    const data = (await response.json()) as Record<string, unknown>;\n\n    if (response.ok && data['access_token']) {\n      pending = null;\n      const expiresIn = (data['expires_in'] as number) ?? 3600;\n      const auth = ctx.auth.read() ?? { accessToken: '', refreshToken: '' };\n      ctx.auth.write({\n        ...auth,\n        accessToken: data['access_token'] as string,\n        refreshToken: (data['refresh_token'] as string) ?? '',\n        expiresAt: Date.now() + expiresIn * 1000,\n        authMethod: 'device_code',\n      });\n      ctx.gql.reset();\n      return await handlePostLogin();\n    }\n\n    const errorCode = data['error'] as string | undefined;\n    if (errorCode === 'authorization_pending') {\n      return {\n        status: 'pending',\n        message: `Still waiting for user to authorize. Open ${p.verificationUriComplete ?? p.verificationUri} and enter code: ${p.userCode}. Then call ${ctx.productName}_auth_complete again.`,\n      };\n    } else if (errorCode === 'slow_down') {\n      p.interval += 5;\n      return {\n        status: 'pending',\n        message: `Authorization server asked to slow down. Wait a moment, then call ${ctx.productName}_auth_complete again.`,\n      };\n    } else if (errorCode === 'expired_token') {\n      pending = null;\n      return {\n        status: 'expired',\n        message: `Device code has expired. Call ${ctx.productName}_auth_login again.`,\n      };\n    } else if (errorCode === 'access_denied') {\n      pending = null;\n      throw new Error('Authorization was denied by the user.');\n    } else {\n      pending = null;\n      throw new Error(\n        `Device code error: ${(data['error_description'] as string) ?? errorCode ?? 'Unknown'}`,\n      );\n    }\n  }\n\n  async function handlePostLogin(): Promise<LoginCompleteResult> {\n    try {\n      const workspaces = await listWorkspaces();\n      if (workspaces.length === 0) {\n        notify();\n        ctx.logger.info('Device code login successful (no workspaces found)');\n        return {\n          status: 'authenticated',\n          message: `Authentication successful. No workspaces found — use ${ctx.productName}_auth_select_workspace when one is available.`,\n        };\n      }\n      if (workspaces.length === 1) {\n        const ws = workspaces[0];\n        if (!ws)\n          throw new Error('Unexpected: workspaces.length === 1 but workspaces[0] is undefined');\n        await issueAndStoreWorkspaceToken(ws.id, ws.organizationId);\n        ctx.logger.info('Device code login successful', {\n          workspaceId: ws.id,\n          workspaceName: ws.name,\n        });\n        return {\n          status: 'authenticated',\n          message: `Authentication successful. Workspace \"${ws.name}\" selected automatically.`,\n        };\n      }\n      notify();\n      ctx.logger.info('Device code login successful, workspace selection needed');\n      return {\n        status: 'workspace_selection_required',\n        message: `Authentication successful. ${workspaces.length} workspaces available — call ${ctx.productName}_auth_select_workspace to choose one.`,\n        workspaces,\n      };\n    } catch (wsError) {\n      notify();\n      ctx.logger.warn('Workspace discovery failed after login', {\n        error: wsError instanceof Error ? wsError.message : String(wsError),\n      });\n      return {\n        status: 'authenticated',\n        message: `Authentication successful. Workspace discovery failed: ${wsError instanceof Error ? wsError.message : String(wsError)}`,\n      };\n    }\n  }\n\n  async function listWorkspaces(): Promise<WorkspaceInfo[]> {\n    const auth = ctx.auth.read();\n    if (!auth?.accessToken) throw new Error('Not authenticated. Please login first.');\n    return fetchWorkspaces(ctx.config.read().globalEndpoint, auth.accessToken);\n  }\n\n  async function issueAndStoreWorkspaceToken(\n    workspaceId: string,\n    organizationId: string,\n  ): Promise<void> {\n    const auth = ctx.auth.read();\n    if (!auth?.accessToken) throw new Error('Not authenticated.');\n    const result = await issueWorkspaceToken(\n      ctx.config.read().workspaceEndpoint,\n      auth.accessToken,\n      workspaceId,\n      organizationId,\n    );\n    ctx.auth.write({\n      ...auth,\n      workspaceToken: result.token,\n      workspaceTokenExpiresAt: new Date(result.expiresAt).getTime(),\n      workspaceId,\n      organizationId,\n    });\n    ctx.gql.reset();\n    notify();\n  }\n\n  async function selectWorkspace(workspaceId: string, organizationId: string): Promise<void> {\n    const auth = ctx.auth.read();\n    if (!auth?.accessToken) throw new Error('Not authenticated. Please login first.');\n    await issueAndStoreWorkspaceToken(workspaceId, organizationId);\n    ctx.logger.info('Workspace selected', { workspaceId });\n  }\n\n  async function ensureAuthenticated(): Promise<void> {\n    if (refreshInProgress) {\n      await refreshInProgress;\n      return;\n    }\n    const doEnsure = async (): Promise<void> => {\n      const auth = ctx.auth.read();\n      if (auth?.apiKey) return;\n      if (!auth?.accessToken) {\n        throw new Error(\n          `Not authenticated. Call ${ctx.productName}_auth_login to start the login flow, then ${ctx.productName}_auth_complete after authorizing in the browser.`,\n        );\n      }\n      // The shared gql client handles refresh via isTokenExpiringSoon + isWorkspaceTokenExpiringSoon —\n      // trigger by issuing a no-op request that goes through the workspace client's refresh path.\n      // We simulate a no-op via a cheap query if needed; today the gql wrapper does it lazily,\n      // so we just delegate to it on the next request. Nothing to do here.\n    };\n    refreshInProgress = doEnsure().finally(() => {\n      refreshInProgress = null;\n    });\n    await refreshInProgress;\n  }\n\n  function getStatus(): Promise<{\n    authenticated: boolean;\n    method: string;\n    expiresAt: string | null;\n    workspaceId: string | null;\n    organizationId: string | null;\n    workspaceTokenExpiresAt: string | null;\n    hasWorkspaceToken: boolean;\n    hasPendingLogin: boolean;\n  }> {\n    const auth = ctx.auth.read();\n    return Promise.resolve({\n      authenticated: !!(auth?.accessToken || auth?.apiKey),\n      method: auth?.apiKey ? 'api_key' : auth?.accessToken ? 'oauth_token' : 'none',\n      expiresAt: auth?.expiresAt ? new Date(auth.expiresAt).toISOString() : null,\n      workspaceId: auth?.workspaceId ?? null,\n      organizationId: auth?.organizationId ?? null,\n      workspaceTokenExpiresAt: auth?.workspaceTokenExpiresAt\n        ? new Date(auth.workspaceTokenExpiresAt).toISOString()\n        : null,\n      hasWorkspaceToken: !!auth?.workspaceToken,\n      hasPendingLogin: !!pending,\n    });\n  }\n\n  async function logout(): Promise<void> {\n    pending = null;\n    ctx.auth.clear();\n    ctx.gql.reset();\n    notify();\n    ctx.logger.info('Logged out and cleared stored tokens');\n  }\n\n  function getHeaders(): Record<string, string> {\n    const auth = ctx.auth.read();\n    const headers: Record<string, string> = {};\n    if (auth?.apiKey) headers['X-API-Key'] = auth.apiKey;\n    if (auth?.accessToken) headers['Authorization'] = `Bearer ${auth.accessToken}`;\n    if (auth?.workspaceToken)\n      headers['X-Workspace-Authorization'] = `Bearer ${auth.workspaceToken}`;\n    if (auth?.organizationId) headers['x-org-id'] = auth.organizationId;\n    if (auth?.workspaceId) headers['x-workspace-id'] = auth.workspaceId;\n    return headers;\n  }\n\n  function isLoggedIn(): boolean {\n    const auth = ctx.auth.read();\n    return !!(auth?.accessToken || auth?.apiKey);\n  }\n\n  function setOnTokensChanged(cb: () => void): void {\n    onTokensChanged = cb;\n  }\n\n  return {\n    startLogin,\n    completeLogin,\n    selectWorkspace,\n    listWorkspaces,\n    ensureAuthenticated,\n    getStatus,\n    logout,\n    getHeaders,\n    isLoggedIn,\n    setOnTokensChanged,\n  };\n}\n"]}

package/dist/{context-1jV4NsLv.d.cts → context-DGO4h-Pd.d.cts}

@@ -25,6 +25,7 @@ interface AuthStore {
     isWorkspaceTokenExpired(): boolean;
     isWorkspaceTokenExpiringSoon(): boolean;
     isAuthenticated(): boolean;
+    getActorUserId(): string | null;
 }
 declare function createAuthStore(configDir: string, authFileName?: string): AuthStore;
 

package/dist/{context-1jV4NsLv.d.ts → context-DGO4h-Pd.d.ts}

@@ -25,6 +25,7 @@ interface AuthStore {
     isWorkspaceTokenExpired(): boolean;
     isWorkspaceTokenExpiringSoon(): boolean;
     isAuthenticated(): boolean;
+    getActorUserId(): string | null;
 }
 declare function createAuthStore(configDir: string, authFileName?: string): AuthStore;
 

package/dist/core/index.cjs

@@ -71,6 +71,21 @@ function createAuthStore(configDir, authFileName2 = "auth.json") {
     if (!auth?.accessToken) return false;
     return !isTokenExpired();
   }
+  function getActorUserId() {
+    const auth = read();
+    const token = auth?.accessToken;
+    if (!token) return null;
+    const parts = token.split(".");
+    if (parts.length !== 3) return null;
+    try {
+      const payload = JSON.parse(
+        Buffer.from(parts[1].replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8")
+      );
+      return typeof payload.sub === "string" ? payload.sub : null;
+    } catch {
+      return null;
+    }
+  }
   return {
     read,
     write,
@@ -79,7 +94,8 @@ function createAuthStore(configDir, authFileName2 = "auth.json") {
     isTokenExpiringSoon,
     isWorkspaceTokenExpired,
     isWorkspaceTokenExpiringSoon,
-    isAuthenticated
+    isAuthenticated,
+    getActorUserId
   };
 }
 function envOr(prefix, key, fallback) {