@caido/server-auth 0.1.0 → 0.2.0

package/dist/index.mjs

@@ -1,4 +1,5 @@
 import { Client, fetchExchange } from "@urql/core";
+import { print } from "graphql";
 import { createClient } from "graphql-ws";
 import { gql } from "graphql-tag";
 
@@ -13,51 +14,42 @@ var AuthenticationError = class extends Error {
 	}
 };
 /**
-* Error thrown when the authentication flow fails to start.
+* Error thrown for errors coming from the Caido cloud API.
+* Used for device approval and device information operations.
 */
-var AuthenticationFlowError = class extends AuthenticationError {
-	/** Error code from the API */
-	code;
-	constructor(code, message) {
-		super(`${code}: ${message}`);
-		this.name = "AuthenticationFlowError";
-		this.code = code;
-	}
-};
-/**
-* Error thrown when token refresh fails.
-*/
-var TokenRefreshError = class extends AuthenticationError {
-	/** Error code from the API */
-	code;
-	constructor(code, message) {
-		super(`${code}: ${message}`);
-		this.name = "TokenRefreshError";
-		this.code = code;
-	}
-};
-/**
-* Error thrown when device approval fails.
-*/
-var DeviceApprovalError = class extends AuthenticationError {
+var CloudError = class extends AuthenticationError {
 	/** HTTP status code if available */
 	statusCode;
-	constructor(message, statusCode) {
+	/** Error code from the API if available */
+	code;
+	/** Reason for the error if available */
+	reason;
+	constructor(message, options) {
 		super(message);
-		this.name = "DeviceApprovalError";
-		this.statusCode = statusCode;
+		this.name = "CloudError";
+		this.statusCode = options?.statusCode;
+		this.code = options?.code;
+		this.reason = options?.reason;
 	}
 };
 /**
-* Error thrown when fetching device information fails.
+* Error thrown for errors coming from the Caido instance.
+* Used for authentication flow and token refresh operations.
 */
-var DeviceInformationError = class extends AuthenticationError {
-	/** HTTP status code if available */
-	statusCode;
-	constructor(message, statusCode) {
+var InstanceError = class extends AuthenticationError {
+	/** Error code from the API */
+	code;
+	/** Reason for the error if available */
+	reason;
+	/** Error message if available */
+	errorMessage;
+	constructor(code, options) {
+		const message = options?.reason ?? options?.message ?? code;
 		super(message);
-		this.name = "DeviceInformationError";
-		this.statusCode = statusCode;
+		this.name = "InstanceError";
+		this.code = code;
+		this.reason = options?.reason;
+		this.errorMessage = options?.message;
 	}
 };
 
@@ -73,8 +65,21 @@ const START_AUTHENTICATION_FLOW = gql`
         expiresAt
       }
       error {
-        code
-        message
+        ... on AuthenticationUserError {
+          code
+          reason
+        }
+        ... on CloudUserError {
+          code
+          reason
+        }
+        ... on InternalUserError {
+          code
+          message
+        }
+        ... on OtherUserError {
+          code
+        }
       }
     }
   }
@@ -84,27 +89,51 @@ const CREATED_AUTHENTICATION_TOKEN = gql`
     createdAuthenticationToken(requestId: $requestId) {
       token {
         accessToken
-        refreshToken
         expiresAt
+        refreshToken
+        scopes
       }
       error {
-        code
-        message
+        ... on AuthenticationUserError {
+          code
+          reason
+        }
+        ... on InternalUserError {
+          code
+          message
+        }
+        ... on OtherUserError {
+          code
+        }
       }
     }
   }
 `;
 const REFRESH_AUTHENTICATION_TOKEN = gql`
-  mutation RefreshAuthenticationToken($refreshToken: String!) {
+  mutation RefreshAuthenticationToken($refreshToken: Token!) {
     refreshAuthenticationToken(refreshToken: $refreshToken) {
       token {
         accessToken
-        refreshToken
         expiresAt
+        refreshToken
+        scopes
       }
       error {
-        code
-        message
+        ... on AuthenticationUserError {
+          code
+          reason
+        }
+        ... on CloudUserError {
+          code
+          reason
+        }
+        ... on InternalUserError {
+          code
+          message
+        }
+        ... on OtherUserError {
+          code
+        }
       }
     }
   }
@@ -117,48 +146,54 @@ const REFRESH_AUTHENTICATION_TOKEN = gql`
 *
 * @example
 * ```typescript
-* import { CaidoAuth, BrowserApprover } from "@caido/auth";
+* import { AuthClient, BrowserApprover } from "@caido/auth";
 *
-* const auth = new CaidoAuth(
-*   "http://localhost:8080",
-*   new BrowserApprover((request) => {
+* const auth = new AuthClient({
+*   instanceUrl: "http://localhost:8080",
+*   approver: new BrowserApprover((request) => {
 *     console.log(`Visit ${request.verificationUrl}`);
 *   })
-* );
+* });
 *
 * const token = await auth.startAuthenticationFlow();
 * console.log("Access token:", token.accessToken);
 * ```
 */
-var CaidoAuth = class {
+var AuthClient = class {
 	instanceUrl;
 	graphqlUrl;
 	websocketUrl;
 	approver;
 	client;
-	/**
-	* Create a new CaidoAuth client.
-	*
-	* @param instanceUrl - Base URL of the Caido instance (e.g., "http://localhost:8080")
-	* @param approver - The approver to use for the authentication flow
-	*/
-	constructor(instanceUrl, approver) {
-		this.instanceUrl = instanceUrl.replace(/\/$/, "");
+	fetchFn;
+	timeout;
+	constructor(options) {
+		this.instanceUrl = options.instanceUrl.replace(/\/$/, "");
 		this.graphqlUrl = `${this.instanceUrl}/graphql`;
 		this.websocketUrl = this.getWebsocketUrl();
-		this.approver = approver;
+		this.approver = options.approver;
+		this.fetchFn = options.fetch;
+		this.timeout = options.timeout;
 		this.client = new Client({
 			url: this.graphqlUrl,
-			exchanges: [fetchExchange]
+			exchanges: [fetchExchange],
+			fetchOptions: () => {
+				const fetchOptions = {};
+				if (this.timeout !== void 0) fetchOptions.signal = AbortSignal.timeout(this.timeout);
+				return fetchOptions;
+			},
+			fetch: this.fetchFn
 		});
 	}
-	/**
-	* Convert HTTP(S) URL to WS(S) URL for subscriptions.
-	*/
 	getWebsocketUrl() {
 		const url = new URL(this.graphqlUrl);
 		return `${url.protocol === "https:" ? "wss:" : "ws:"}//${url.host}/ws/graphql`;
 	}
+	extractErrorDetails(error) {
+		if ("reason" in error) return { reason: error.reason };
+		if ("message" in error) return { message: error.message };
+		return {};
+	}
 	/**
 	* Start the device code authentication flow.
 	*
@@ -169,16 +204,19 @@ var CaidoAuth = class {
 	* 4. Returns the authentication token once approved
 	*
 	* @returns The authentication token
-	* @throws {AuthenticationFlowError} If the flow fails to start
+	* @throws {InstanceError} If the flow fails to start
 	* @throws {AuthenticationError} If token retrieval fails
 	*/
 	async startAuthenticationFlow() {
 		const result = await this.client.mutation(START_AUTHENTICATION_FLOW, {}).toPromise();
-		if (result.error) throw new AuthenticationFlowError("GRAPHQL_ERROR", result.error.message);
+		if (result.error) throw new InstanceError("GRAPHQL_ERROR", { message: result.error.message });
 		const payload = result.data?.startAuthenticationFlow;
-		if (!payload) throw new AuthenticationFlowError("NO_RESPONSE", "No response from startAuthenticationFlow");
-		if (payload.error) throw new AuthenticationFlowError(payload.error.code, payload.error.message);
-		if (!payload.request) throw new AuthenticationFlowError("NO_REQUEST", "No authentication request returned");
+		if (!payload) throw new InstanceError("NO_RESPONSE", { message: "No response from startAuthenticationFlow" });
+		if (payload.error) {
+			const details = this.extractErrorDetails(payload.error);
+			throw new InstanceError(payload.error.code, details);
+		}
+		if (!payload.request) throw new InstanceError("NO_REQUEST", { message: "No authentication request returned" });
 		const authRequest = {
 			id: payload.request.id,
 			userCode: payload.request.userCode,
@@ -188,23 +226,11 @@ var CaidoAuth = class {
 		await this.approver.approve(authRequest);
 		return await this.waitForToken(authRequest.id);
 	}
-	/**
-	* Subscribe and wait for the authentication token.
-	*
-	* @param requestId - The authentication request ID
-	* @returns The authentication token once the user authorizes
-	* @throws {AuthenticationError} If subscription fails or returns an error
-	*/
 	async waitForToken(requestId) {
 		return new Promise((resolve, reject) => {
 			const wsClient = createClient({ url: this.websocketUrl });
 			const unsubscribe = wsClient.subscribe({
-				query: CREATED_AUTHENTICATION_TOKEN.loc?.source.body ?? `subscription CreatedAuthenticationToken($requestId: ID!) {
-              createdAuthenticationToken(requestId: $requestId) {
-                token { accessToken refreshToken expiresAt }
-                error { code message }
-              }
-            }`,
+				query: print(CREATED_AUTHENTICATION_TOKEN),
 				variables: { requestId }
 			}, {
 				next: (result) => {
@@ -212,7 +238,8 @@ var CaidoAuth = class {
 					if (payload?.error) {
 						unsubscribe();
 						wsClient.dispose();
-						reject(new AuthenticationError(`${payload.error.code}: ${payload.error.message}`));
+						const details = this.extractErrorDetails(payload.error);
+						reject(new InstanceError(payload.error.code, details));
 						return;
 					}
 					if (payload?.token) {
@@ -221,17 +248,18 @@ var CaidoAuth = class {
 						resolve({
 							accessToken: payload.token.accessToken,
 							refreshToken: payload.token.refreshToken,
-							expiresAt: new Date(payload.token.expiresAt)
+							expiresAt: new Date(payload.token.expiresAt),
+							scopes: payload.token.scopes
 						});
 					}
 				},
 				error: (error) => {
 					wsClient.dispose();
-					reject(new AuthenticationError(error instanceof Error ? error.message : String(error)));
+					reject(new InstanceError("SUBSCRIPTION_ERROR", { message: error instanceof Error ? error.message : String(error) }));
 				},
 				complete: () => {
 					wsClient.dispose();
-					reject(new AuthenticationError("Subscription ended without receiving token"));
+					reject(new InstanceError("SUBSCRIPTION_COMPLETE", { message: "Subscription ended without receiving token" }));
 				}
 			});
 		});
@@ -241,19 +269,23 @@ var CaidoAuth = class {
 	*
 	* @param refreshToken - The refresh token from a previous authentication
 	* @returns New authentication token with updated access and refresh tokens
-	* @throws {TokenRefreshError} If the refresh fails
+	* @throws {InstanceError} If the refresh fails
 	*/
 	async refreshToken(refreshToken) {
 		const result = await this.client.mutation(REFRESH_AUTHENTICATION_TOKEN, { refreshToken }).toPromise();
-		if (result.error) throw new TokenRefreshError("GRAPHQL_ERROR", result.error.message);
+		if (result.error) throw new InstanceError("GRAPHQL_ERROR", { message: result.error.message });
 		const payload = result.data?.refreshAuthenticationToken;
-		if (!payload) throw new TokenRefreshError("NO_RESPONSE", "No response from refreshAuthenticationToken");
-		if (payload.error) throw new TokenRefreshError(payload.error.code, payload.error.message);
-		if (!payload.token) throw new TokenRefreshError("NO_TOKEN", "No token returned from refresh");
+		if (!payload) throw new InstanceError("NO_RESPONSE", { message: "No response from refreshAuthenticationToken" });
+		if (payload.error) {
+			const details = this.extractErrorDetails(payload.error);
+			throw new InstanceError(payload.error.code, details);
+		}
+		if (!payload.token) throw new InstanceError("NO_TOKEN", { message: "No token returned from refresh" });
 		return {
 			accessToken: payload.token.accessToken,
 			refreshToken: payload.token.refreshToken,
-			expiresAt: new Date(payload.token.expiresAt)
+			expiresAt: new Date(payload.token.expiresAt),
+			scopes: payload.token.scopes
 		};
 	}
 };
@@ -316,15 +348,14 @@ var PATApprover = class {
 	pat;
 	allowedScopes;
 	apiUrl;
-	/**
-	* Create a new PATApprover.
-	*
-	* @param options - Configuration options for the approver
-	*/
+	fetchFn;
+	timeout;
 	constructor(options) {
 		this.pat = options.pat;
 		this.allowedScopes = options.allowedScopes;
 		this.apiUrl = (options.apiUrl ?? DEFAULT_API_URL).replace(/\/$/, "");
+		this.fetchFn = options.fetch ?? globalThis.fetch;
+		this.timeout = options.timeout;
 	}
 	/**
 	* Approve the authentication request using the PAT.
@@ -333,50 +364,71 @@ var PATApprover = class {
 	* and finally approves the device.
 	*
 	* @param request - The authentication request
-	* @throws {DeviceInformationError} If fetching device information fails
-	* @throws {DeviceApprovalError} If approving the device fails
+	* @throws {CloudError} If fetching device information or approving the device fails
 	*/
 	async approve(request) {
 		let scopesToApprove = (await this.getDeviceInformation(request.userCode)).scopes.map((s) => s.name);
 		if (this.allowedScopes) scopesToApprove = scopesToApprove.filter((scope) => this.allowedScopes.includes(scope));
 		await this.approveDevice(request.userCode, scopesToApprove);
 	}
-	/**
-	* Fetch device information from the API.
-	*
-	* @param userCode - The user code from the authentication request
-	* @returns The device information including available scopes
-	* @throws {DeviceInformationError} If the request fails
-	*/
+	async sendRequest(url, options) {
+		const fetchOptions = {
+			method: options.method,
+			headers: options.headers
+		};
+		if (this.timeout !== void 0) fetchOptions.signal = AbortSignal.timeout(this.timeout);
+		return this.fetchFn(url, fetchOptions);
+	}
+	async parseOAuth2Error(response) {
+		let errorText;
+		let errorCode;
+		let errorDescription;
+		try {
+			const errorData = await response.json();
+			if (typeof errorData === "string") errorText = errorData;
+			else {
+				errorCode = errorData.error;
+				errorDescription = errorData.error_description;
+				errorText = errorDescription ?? errorCode ?? "Unknown error";
+			}
+		} catch {
+			errorText = await response.text().catch(() => "Unknown error");
+		}
+		return {
+			errorText,
+			errorCode,
+			errorDescription
+		};
+	}
 	async getDeviceInformation(userCode) {
 		const params = new URLSearchParams();
 		params.append("user_code", userCode);
 		const url = new URL(`${this.apiUrl}/oauth2/device/information`);
 		url.search = params.toString();
-		const response = await fetch(url, {
+		const response = await this.sendRequest(url, {
 			method: "GET",
 			headers: {
 				Authorization: `Bearer ${this.pat}`,
 				Accept: "application/json"
 			}
 		});
-		if (!response.ok) throw new DeviceInformationError(`Failed to get device information: ${await response.text().catch(() => "Unknown error")}`, response.status);
+		if (!response.ok) {
+			const { errorText, errorCode, errorDescription } = await this.parseOAuth2Error(response);
+			throw new CloudError(`Failed to get device information: ${errorText}`, {
+				statusCode: response.status,
+				code: errorCode,
+				reason: errorDescription
+			});
+		}
 		return await response.json();
 	}
-	/**
-	* Approve the device with the specified scopes.
-	*
-	* @param userCode - The user code from the authentication request
-	* @param scopes - The scopes to approve
-	* @throws {DeviceApprovalError} If the request fails
-	*/
 	async approveDevice(userCode, scopes) {
 		const params = new URLSearchParams();
 		params.append("user_code", userCode);
 		params.append("scope", scopes.join(","));
 		const url = new URL(`${this.apiUrl}/oauth2/device/approve`);
 		url.search = params.toString();
-		const response = await fetch(url, {
+		const response = await this.sendRequest(url, {
 			method: "POST",
 			headers: {
 				Authorization: `Bearer ${this.pat}`,
@@ -384,10 +436,17 @@ var PATApprover = class {
 				Accept: "application/json"
 			}
 		});
-		if (!response.ok) throw new DeviceApprovalError(`Failed to approve device: ${await response.text().catch(() => "Unknown error")}`, response.status);
+		if (!response.ok) {
+			const { errorText, errorCode, errorDescription } = await this.parseOAuth2Error(response);
+			throw new CloudError(`Failed to approve device: ${errorText}`, {
+				statusCode: response.status,
+				code: errorCode,
+				reason: errorDescription
+			});
+		}
 	}
 };
 
 //#endregion
-export { AuthenticationError, AuthenticationFlowError, BrowserApprover, CaidoAuth, DeviceApprovalError, DeviceInformationError, PATApprover, TokenRefreshError };
+export { AuthClient, AuthenticationError, BrowserApprover, CloudError, InstanceError, PATApprover };
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":["createWSClient"],"sources":["../src/errors.ts","../src/queries.ts","../src/client.ts","../src/approvers/browser.ts","../src/approvers/pat.ts"],"sourcesContent":["/**\n * Base error class for authentication-related errors.\n */\nexport class AuthenticationError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"AuthenticationError\";\n  }\n}\n\n/**\n * Error thrown when the authentication flow fails to start.\n */\nexport class AuthenticationFlowError extends AuthenticationError {\n  /** Error code from the API */\n  readonly code: string;\n\n  constructor(code: string, message: string) {\n    super(`${code}: ${message}`);\n    this.name = \"AuthenticationFlowError\";\n    this.code = code;\n  }\n}\n\n/**\n * Error thrown when token refresh fails.\n */\nexport class TokenRefreshError extends AuthenticationError {\n  /** Error code from the API */\n  readonly code: string;\n\n  constructor(code: string, message: string) {\n    super(`${code}: ${message}`);\n    this.name = \"TokenRefreshError\";\n    this.code = code;\n  }\n}\n\n/**\n * Error thrown when device approval fails.\n */\nexport class DeviceApprovalError extends AuthenticationError {\n  /** HTTP status code if available */\n  readonly statusCode: number | undefined;\n\n  constructor(message: string, statusCode?: number) {\n    super(message);\n    this.name = \"DeviceApprovalError\";\n    this.statusCode = statusCode;\n  }\n}\n\n/**\n * Error thrown when fetching device information fails.\n */\nexport class DeviceInformationError extends AuthenticationError {\n  /** HTTP status code if available */\n  readonly statusCode: number | undefined;\n\n  constructor(message: string, statusCode?: number) {\n    super(message);\n    this.name = \"DeviceInformationError\";\n    this.statusCode = statusCode;\n  }\n}\n","import type { DocumentNode } from \"graphql\";\nimport { gql } from \"graphql-tag\";\n\nexport const START_AUTHENTICATION_FLOW: DocumentNode = gql`\n  mutation StartAuthenticationFlow {\n    startAuthenticationFlow {\n      request {\n        id\n        userCode\n        verificationUrl\n        expiresAt\n      }\n      error {\n        code\n        message\n      }\n    }\n  }\n`;\n\nexport const CREATED_AUTHENTICATION_TOKEN: DocumentNode = gql`\n  subscription CreatedAuthenticationToken($requestId: ID!) {\n    createdAuthenticationToken(requestId: $requestId) {\n      token {\n        accessToken\n        refreshToken\n        expiresAt\n      }\n      error {\n        code\n        message\n      }\n    }\n  }\n`;\n\nexport const REFRESH_AUTHENTICATION_TOKEN: DocumentNode = gql`\n  mutation RefreshAuthenticationToken($refreshToken: String!) {\n    refreshAuthenticationToken(refreshToken: $refreshToken) {\n      token {\n        accessToken\n        refreshToken\n        expiresAt\n      }\n      error {\n        code\n        message\n      }\n    }\n  }\n`;\n","import { Client, fetchExchange } from \"@urql/core\";\nimport { createClient as createWSClient } from \"graphql-ws\";\n\nimport type { AuthApprover } from \"./approvers/types.js\";\nimport {\n  AuthenticationError,\n  AuthenticationFlowError,\n  TokenRefreshError,\n} from \"./errors.js\";\nimport {\n  CREATED_AUTHENTICATION_TOKEN,\n  REFRESH_AUTHENTICATION_TOKEN,\n  START_AUTHENTICATION_FLOW,\n} from \"./queries.js\";\nimport type {\n  AuthenticationRequest,\n  AuthenticationToken,\n  CreatedAuthenticationTokenResponse,\n  RefreshAuthenticationTokenResponse,\n  StartAuthenticationFlowResponse,\n} from \"./types.js\";\n\n/**\n * Client for authenticating with a Caido instance.\n *\n * @example\n * ```typescript\n * import { CaidoAuth, BrowserApprover } from \"@caido/auth\";\n *\n * const auth = new CaidoAuth(\n *   \"http://localhost:8080\",\n *   new BrowserApprover((request) => {\n *     console.log(`Visit ${request.verificationUrl}`);\n *   })\n * );\n *\n * const token = await auth.startAuthenticationFlow();\n * console.log(\"Access token:\", token.accessToken);\n * ```\n */\nexport class CaidoAuth {\n  private readonly instanceUrl: string;\n  private readonly graphqlUrl: string;\n  private readonly websocketUrl: string;\n  private readonly approver: AuthApprover;\n  private readonly client: Client;\n\n  /**\n   * Create a new CaidoAuth client.\n   *\n   * @param instanceUrl - Base URL of the Caido instance (e.g., \"http://localhost:8080\")\n   * @param approver - The approver to use for the authentication flow\n   */\n  constructor(instanceUrl: string, approver: AuthApprover) {\n    this.instanceUrl = instanceUrl.replace(/\\/$/, \"\");\n    this.graphqlUrl = `${this.instanceUrl}/graphql`;\n    this.websocketUrl = this.getWebsocketUrl();\n    this.approver = approver;\n\n    this.client = new Client({\n      url: this.graphqlUrl,\n      exchanges: [fetchExchange],\n    });\n  }\n\n  /**\n   * Convert HTTP(S) URL to WS(S) URL for subscriptions.\n   */\n  private getWebsocketUrl(): string {\n    const url = new URL(this.graphqlUrl);\n    const scheme = url.protocol === \"https:\" ? \"wss:\" : \"ws:\";\n    return `${scheme}//${url.host}/ws/graphql`;\n  }\n\n  /**\n   * Start the device code authentication flow.\n   *\n   * This method:\n   * 1. Initiates the authentication flow via GraphQL mutation\n   * 2. Calls the approver with the authentication request\n   * 3. Waits for the user to authorize via WebSocket subscription\n   * 4. Returns the authentication token once approved\n   *\n   * @returns The authentication token\n   * @throws {AuthenticationFlowError} If the flow fails to start\n   * @throws {AuthenticationError} If token retrieval fails\n   */\n  async startAuthenticationFlow(): Promise<AuthenticationToken> {\n    // Step 1: Start the authentication flow\n    const result = await this.client\n      .mutation<StartAuthenticationFlowResponse>(START_AUTHENTICATION_FLOW, {})\n      .toPromise();\n\n    if (result.error) {\n      throw new AuthenticationFlowError(\"GRAPHQL_ERROR\", result.error.message);\n    }\n\n    const payload = result.data?.startAuthenticationFlow;\n    if (!payload) {\n      throw new AuthenticationFlowError(\n        \"NO_RESPONSE\",\n        \"No response from startAuthenticationFlow\",\n      );\n    }\n\n    if (payload.error) {\n      throw new AuthenticationFlowError(\n        payload.error.code,\n        payload.error.message,\n      );\n    }\n\n    if (!payload.request) {\n      throw new AuthenticationFlowError(\n        \"NO_REQUEST\",\n        \"No authentication request returned\",\n      );\n    }\n\n    const authRequest: AuthenticationRequest = {\n      id: payload.request.id,\n      userCode: payload.request.userCode,\n      verificationUrl: payload.request.verificationUrl,\n      expiresAt: new Date(payload.request.expiresAt),\n    };\n\n    // Step 2: Call the approver\n    await this.approver.approve(authRequest);\n\n    // Step 3: Wait for the token via subscription\n    const token = await this.waitForToken(authRequest.id);\n    return token;\n  }\n\n  /**\n   * Subscribe and wait for the authentication token.\n   *\n   * @param requestId - The authentication request ID\n   * @returns The authentication token once the user authorizes\n   * @throws {AuthenticationError} If subscription fails or returns an error\n   */\n  private async waitForToken(requestId: string): Promise<AuthenticationToken> {\n    return new Promise<AuthenticationToken>((resolve, reject) => {\n      const wsClient = createWSClient({\n        url: this.websocketUrl,\n      });\n\n      const unsubscribe =\n        wsClient.subscribe<CreatedAuthenticationTokenResponse>(\n          {\n            query:\n              CREATED_AUTHENTICATION_TOKEN.loc?.source.body ??\n              `subscription CreatedAuthenticationToken($requestId: ID!) {\n              createdAuthenticationToken(requestId: $requestId) {\n                token { accessToken refreshToken expiresAt }\n                error { code message }\n              }\n            }`,\n            variables: { requestId },\n          },\n          {\n            next: (result) => {\n              const payload = result.data?.createdAuthenticationToken;\n\n              if (payload?.error) {\n                unsubscribe();\n                wsClient.dispose();\n                reject(\n                  new AuthenticationError(\n                    `${payload.error.code}: ${payload.error.message}`,\n                  ),\n                );\n                return;\n              }\n\n              if (payload?.token) {\n                unsubscribe();\n                wsClient.dispose();\n                resolve({\n                  accessToken: payload.token.accessToken,\n                  refreshToken: payload.token.refreshToken,\n                  expiresAt: new Date(payload.token.expiresAt),\n                });\n              }\n            },\n            error: (error) => {\n              wsClient.dispose();\n              reject(\n                new AuthenticationError(\n                  error instanceof Error ? error.message : String(error),\n                ),\n              );\n            },\n            complete: () => {\n              wsClient.dispose();\n              reject(\n                new AuthenticationError(\n                  \"Subscription ended without receiving token\",\n                ),\n              );\n            },\n          },\n        );\n    });\n  }\n\n  /**\n   * Refresh an access token using a refresh token.\n   *\n   * @param refreshToken - The refresh token from a previous authentication\n   * @returns New authentication token with updated access and refresh tokens\n   * @throws {TokenRefreshError} If the refresh fails\n   */\n  async refreshToken(refreshToken: string): Promise<AuthenticationToken> {\n    const result = await this.client\n      .mutation<RefreshAuthenticationTokenResponse>(\n        REFRESH_AUTHENTICATION_TOKEN,\n        { refreshToken },\n      )\n      .toPromise();\n\n    if (result.error) {\n      throw new TokenRefreshError(\"GRAPHQL_ERROR\", result.error.message);\n    }\n\n    const payload = result.data?.refreshAuthenticationToken;\n    if (!payload) {\n      throw new TokenRefreshError(\n        \"NO_RESPONSE\",\n        \"No response from refreshAuthenticationToken\",\n      );\n    }\n\n    if (payload.error) {\n      throw new TokenRefreshError(payload.error.code, payload.error.message);\n    }\n\n    if (!payload.token) {\n      throw new TokenRefreshError(\"NO_TOKEN\", \"No token returned from refresh\");\n    }\n\n    return {\n      accessToken: payload.token.accessToken,\n      refreshToken: payload.token.refreshToken,\n      expiresAt: new Date(payload.token.expiresAt),\n    };\n  }\n}\n","import type { AuthenticationRequest } from \"../types.js\";\n\nimport type { AuthApprover } from \"./types.js\";\n\n/**\n * Callback function that receives the authentication request details.\n * Used to display the verification URL and user code to the user.\n */\nexport type OnRequestCallback = (\n  request: AuthenticationRequest,\n) => Promise<void> | void;\n\n/**\n * Browser-based approver that delegates to a callback function.\n * The callback should display the verification URL and user code to the user,\n * who then manually approves the request in their browser.\n *\n * @example\n * ```typescript\n * const approver = new BrowserApprover((request) => {\n *   console.log(`Visit ${request.verificationUrl}`);\n * });\n * ```\n */\nexport class BrowserApprover implements AuthApprover {\n  private readonly onRequest: OnRequestCallback;\n\n  /**\n   * Create a new BrowserApprover.\n   *\n   * @param onRequest - Callback function that will be called with the authentication request\n   */\n  constructor(onRequest: OnRequestCallback) {\n    this.onRequest = onRequest;\n  }\n\n  /**\n   * Approve the authentication request by calling the callback.\n   * The actual approval happens when the user visits the URL and enters the code.\n   *\n   * @param request - The authentication request\n   */\n  async approve(request: AuthenticationRequest): Promise<void> {\n    await this.onRequest(request);\n  }\n}\n","import { DeviceApprovalError, DeviceInformationError } from \"../errors.js\";\nimport type { AuthenticationRequest, DeviceInformation } from \"../types.js\";\n\nimport type { AuthApprover } from \"./types.js\";\n\nconst DEFAULT_API_URL = \"https://api.caido.io\";\n\n/**\n * Options for the PATApprover.\n */\nexport interface PATApproverOptions {\n  /** The Personal Access Token to use for approval */\n  pat: string;\n  /** If provided, only approve these scopes. Others will be filtered out. */\n  allowedScopes?: string[];\n  /** The API URL to use. Defaults to \"https://api.caido.io\" */\n  apiUrl?: string;\n}\n\n/**\n * PAT-based approver that automatically approves device code requests.\n * Uses a Personal Access Token to call the Caido API directly.\n *\n * @example\n * ```typescript\n * // Approve all scopes\n * const approver = new PATApprover({ pat: \"caido_xxxxx\" });\n *\n * // Approve only specific scopes\n * const limitedApprover = new PATApprover({\n *   pat: \"caido_xxxxx\",\n *   allowedScopes: [\"read:projects\", \"write:requests\"],\n * });\n * ```\n */\nexport class PATApprover implements AuthApprover {\n  private readonly pat: string;\n  private readonly allowedScopes: string[] | undefined;\n  private readonly apiUrl: string;\n\n  /**\n   * Create a new PATApprover.\n   *\n   * @param options - Configuration options for the approver\n   */\n  constructor(options: PATApproverOptions) {\n    this.pat = options.pat;\n    this.allowedScopes = options.allowedScopes;\n    this.apiUrl = (options.apiUrl ?? DEFAULT_API_URL).replace(/\\/$/, \"\");\n  }\n\n  /**\n   * Approve the authentication request using the PAT.\n   * First fetches device information to get available scopes,\n   * then filters scopes if allowedScopes is set,\n   * and finally approves the device.\n   *\n   * @param request - The authentication request\n   * @throws {DeviceInformationError} If fetching device information fails\n   * @throws {DeviceApprovalError} If approving the device fails\n   */\n  async approve(request: AuthenticationRequest): Promise<void> {\n    // Step 1: Get device information to retrieve available scopes\n    const deviceInfo = await this.getDeviceInformation(request.userCode);\n\n    // Step 2: Filter scopes if allowedScopes is provided\n    let scopesToApprove = deviceInfo.scopes.map((s) => s.name);\n    if (this.allowedScopes) {\n      scopesToApprove = scopesToApprove.filter((scope) =>\n        this.allowedScopes!.includes(scope),\n      );\n    }\n\n    // Step 3: Approve the device with the filtered scopes\n    await this.approveDevice(request.userCode, scopesToApprove);\n  }\n\n  /**\n   * Fetch device information from the API.\n   *\n   * @param userCode - The user code from the authentication request\n   * @returns The device information including available scopes\n   * @throws {DeviceInformationError} If the request fails\n   */\n  private async getDeviceInformation(\n    userCode: string,\n  ): Promise<DeviceInformation> {\n    const params = new URLSearchParams();\n    params.append(\"user_code\", userCode);\n    const url = new URL(`${this.apiUrl}/oauth2/device/information`);\n    url.search = params.toString();\n\n    const response = await fetch(url, {\n      method: \"GET\",\n      headers: {\n        Authorization: `Bearer ${this.pat}`,\n        Accept: \"application/json\",\n      },\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text().catch(() => \"Unknown error\");\n      throw new DeviceInformationError(\n        `Failed to get device information: ${errorText}`,\n        response.status,\n      );\n    }\n\n    const data = (await response.json()) as DeviceInformation;\n    return data;\n  }\n\n  /**\n   * Approve the device with the specified scopes.\n   *\n   * @param userCode - The user code from the authentication request\n   * @param scopes - The scopes to approve\n   * @throws {DeviceApprovalError} If the request fails\n   */\n  private async approveDevice(\n    userCode: string,\n    scopes: string[],\n  ): Promise<void> {\n    const params = new URLSearchParams();\n    params.append(\"user_code\", userCode);\n    params.append(\"scope\", scopes.join(\",\"));\n    const url = new URL(`${this.apiUrl}/oauth2/device/approve`);\n    url.search = params.toString();\n\n    const response = await fetch(url, {\n      method: \"POST\",\n      headers: {\n        Authorization: `Bearer ${this.pat}`,\n        \"Content-Type\": \"application/json\",\n        Accept: \"application/json\",\n      },\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text().catch(() => \"Unknown error\");\n      throw new DeviceApprovalError(\n        `Failed to approve device: ${errorText}`,\n        response.status,\n      );\n    }\n  }\n}\n"],"mappings":";;;;;;;;AAGA,IAAa,sBAAb,cAAyC,MAAM;CAC7C,YAAY,SAAiB;AAC3B,QAAM,QAAQ;AACd,OAAK,OAAO;;;;;;AAOhB,IAAa,0BAAb,cAA6C,oBAAoB;;CAE/D,AAAS;CAET,YAAY,MAAc,SAAiB;AACzC,QAAM,GAAG,KAAK,IAAI,UAAU;AAC5B,OAAK,OAAO;AACZ,OAAK,OAAO;;;;;;AAOhB,IAAa,oBAAb,cAAuC,oBAAoB;;CAEzD,AAAS;CAET,YAAY,MAAc,SAAiB;AACzC,QAAM,GAAG,KAAK,IAAI,UAAU;AAC5B,OAAK,OAAO;AACZ,OAAK,OAAO;;;;;;AAOhB,IAAa,sBAAb,cAAyC,oBAAoB;;CAE3D,AAAS;CAET,YAAY,SAAiB,YAAqB;AAChD,QAAM,QAAQ;AACd,OAAK,OAAO;AACZ,OAAK,aAAa;;;;;;AAOtB,IAAa,yBAAb,cAA4C,oBAAoB;;CAE9D,AAAS;CAET,YAAY,SAAiB,YAAqB;AAChD,QAAM,QAAQ;AACd,OAAK,OAAO;AACZ,OAAK,aAAa;;;;;;AC3DtB,MAAa,4BAA0C,GAAG;;;;;;;;;;;;;;;;AAiB1D,MAAa,+BAA6C,GAAG;;;;;;;;;;;;;;;AAgB7D,MAAa,+BAA6C,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACI7D,IAAa,YAAb,MAAuB;CACrB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;;;;;;;CAQjB,YAAY,aAAqB,UAAwB;AACvD,OAAK,cAAc,YAAY,QAAQ,OAAO,GAAG;AACjD,OAAK,aAAa,GAAG,KAAK,YAAY;AACtC,OAAK,eAAe,KAAK,iBAAiB;AAC1C,OAAK,WAAW;AAEhB,OAAK,SAAS,IAAI,OAAO;GACvB,KAAK,KAAK;GACV,WAAW,CAAC,cAAc;GAC3B,CAAC;;;;;CAMJ,AAAQ,kBAA0B;EAChC,MAAM,MAAM,IAAI,IAAI,KAAK,WAAW;AAEpC,SAAO,GADQ,IAAI,aAAa,WAAW,SAAS,MACnC,IAAI,IAAI,KAAK;;;;;;;;;;;;;;;CAgBhC,MAAM,0BAAwD;EAE5D,MAAM,SAAS,MAAM,KAAK,OACvB,SAA0C,2BAA2B,EAAE,CAAC,CACxE,WAAW;AAEd,MAAI,OAAO,MACT,OAAM,IAAI,wBAAwB,iBAAiB,OAAO,MAAM,QAAQ;EAG1E,MAAM,UAAU,OAAO,MAAM;AAC7B,MAAI,CAAC,QACH,OAAM,IAAI,wBACR,eACA,2CACD;AAGH,MAAI,QAAQ,MACV,OAAM,IAAI,wBACR,QAAQ,MAAM,MACd,QAAQ,MAAM,QACf;AAGH,MAAI,CAAC,QAAQ,QACX,OAAM,IAAI,wBACR,cACA,qCACD;EAGH,MAAM,cAAqC;GACzC,IAAI,QAAQ,QAAQ;GACpB,UAAU,QAAQ,QAAQ;GAC1B,iBAAiB,QAAQ,QAAQ;GACjC,WAAW,IAAI,KAAK,QAAQ,QAAQ,UAAU;GAC/C;AAGD,QAAM,KAAK,SAAS,QAAQ,YAAY;AAIxC,SADc,MAAM,KAAK,aAAa,YAAY,GAAG;;;;;;;;;CAWvD,MAAc,aAAa,WAAiD;AAC1E,SAAO,IAAI,SAA8B,SAAS,WAAW;GAC3D,MAAM,WAAWA,aAAe,EAC9B,KAAK,KAAK,cACX,CAAC;GAEF,MAAM,cACJ,SAAS,UACP;IACE,OACE,6BAA6B,KAAK,OAAO,QACzC;;;;;;IAMF,WAAW,EAAE,WAAW;IACzB,EACD;IACE,OAAO,WAAW;KAChB,MAAM,UAAU,OAAO,MAAM;AAE7B,SAAI,SAAS,OAAO;AAClB,mBAAa;AACb,eAAS,SAAS;AAClB,aACE,IAAI,oBACF,GAAG,QAAQ,MAAM,KAAK,IAAI,QAAQ,MAAM,UACzC,CACF;AACD;;AAGF,SAAI,SAAS,OAAO;AAClB,mBAAa;AACb,eAAS,SAAS;AAClB,cAAQ;OACN,aAAa,QAAQ,MAAM;OAC3B,cAAc,QAAQ,MAAM;OAC5B,WAAW,IAAI,KAAK,QAAQ,MAAM,UAAU;OAC7C,CAAC;;;IAGN,QAAQ,UAAU;AAChB,cAAS,SAAS;AAClB,YACE,IAAI,oBACF,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CACvD,CACF;;IAEH,gBAAgB;AACd,cAAS,SAAS;AAClB,YACE,IAAI,oBACF,6CACD,CACF;;IAEJ,CACF;IACH;;;;;;;;;CAUJ,MAAM,aAAa,cAAoD;EACrE,MAAM,SAAS,MAAM,KAAK,OACvB,SACC,8BACA,EAAE,cAAc,CACjB,CACA,WAAW;AAEd,MAAI,OAAO,MACT,OAAM,IAAI,kBAAkB,iBAAiB,OAAO,MAAM,QAAQ;EAGpE,MAAM,UAAU,OAAO,MAAM;AAC7B,MAAI,CAAC,QACH,OAAM,IAAI,kBACR,eACA,8CACD;AAGH,MAAI,QAAQ,MACV,OAAM,IAAI,kBAAkB,QAAQ,MAAM,MAAM,QAAQ,MAAM,QAAQ;AAGxE,MAAI,CAAC,QAAQ,MACX,OAAM,IAAI,kBAAkB,YAAY,iCAAiC;AAG3E,SAAO;GACL,aAAa,QAAQ,MAAM;GAC3B,cAAc,QAAQ,MAAM;GAC5B,WAAW,IAAI,KAAK,QAAQ,MAAM,UAAU;GAC7C;;;;;;;;;;;;;;;;;;AC7NL,IAAa,kBAAb,MAAqD;CACnD,AAAiB;;;;;;CAOjB,YAAY,WAA8B;AACxC,OAAK,YAAY;;;;;;;;CASnB,MAAM,QAAQ,SAA+C;AAC3D,QAAM,KAAK,UAAU,QAAQ;;;;;;ACtCjC,MAAM,kBAAkB;;;;;;;;;;;;;;;;;AA8BxB,IAAa,cAAb,MAAiD;CAC/C,AAAiB;CACjB,AAAiB;CACjB,AAAiB;;;;;;CAOjB,YAAY,SAA6B;AACvC,OAAK,MAAM,QAAQ;AACnB,OAAK,gBAAgB,QAAQ;AAC7B,OAAK,UAAU,QAAQ,UAAU,iBAAiB,QAAQ,OAAO,GAAG;;;;;;;;;;;;CAatE,MAAM,QAAQ,SAA+C;EAK3D,IAAI,mBAHe,MAAM,KAAK,qBAAqB,QAAQ,SAAS,EAGnC,OAAO,KAAK,MAAM,EAAE,KAAK;AAC1D,MAAI,KAAK,cACP,mBAAkB,gBAAgB,QAAQ,UACxC,KAAK,cAAe,SAAS,MAAM,CACpC;AAIH,QAAM,KAAK,cAAc,QAAQ,UAAU,gBAAgB;;;;;;;;;CAU7D,MAAc,qBACZ,UAC4B;EAC5B,MAAM,SAAS,IAAI,iBAAiB;AACpC,SAAO,OAAO,aAAa,SAAS;EACpC,MAAM,MAAM,IAAI,IAAI,GAAG,KAAK,OAAO,4BAA4B;AAC/D,MAAI,SAAS,OAAO,UAAU;EAE9B,MAAM,WAAW,MAAM,MAAM,KAAK;GAChC,QAAQ;GACR,SAAS;IACP,eAAe,UAAU,KAAK;IAC9B,QAAQ;IACT;GACF,CAAC;AAEF,MAAI,CAAC,SAAS,GAEZ,OAAM,IAAI,uBACR,qCAFgB,MAAM,SAAS,MAAM,CAAC,YAAY,gBAAgB,IAGlE,SAAS,OACV;AAIH,SADc,MAAM,SAAS,MAAM;;;;;;;;;CAWrC,MAAc,cACZ,UACA,QACe;EACf,MAAM,SAAS,IAAI,iBAAiB;AACpC,SAAO,OAAO,aAAa,SAAS;AACpC,SAAO,OAAO,SAAS,OAAO,KAAK,IAAI,CAAC;EACxC,MAAM,MAAM,IAAI,IAAI,GAAG,KAAK,OAAO,wBAAwB;AAC3D,MAAI,SAAS,OAAO,UAAU;EAE9B,MAAM,WAAW,MAAM,MAAM,KAAK;GAChC,QAAQ;GACR,SAAS;IACP,eAAe,UAAU,KAAK;IAC9B,gBAAgB;IAChB,QAAQ;IACT;GACF,CAAC;AAEF,MAAI,CAAC,SAAS,GAEZ,OAAM,IAAI,oBACR,6BAFgB,MAAM,SAAS,MAAM,CAAC,YAAY,gBAAgB,IAGlE,SAAS,OACV"}
+{"version":3,"file":"index.mjs","names":["createWSClient"],"sources":["../src/errors.ts","../src/queries.ts","../src/client.ts","../src/approvers/browser.ts","../src/approvers/pat.ts"],"sourcesContent":["/**\n * Base error class for authentication-related errors.\n */\nexport class AuthenticationError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"AuthenticationError\";\n  }\n}\n\n/**\n * Error thrown for errors coming from the Caido cloud API.\n * Used for device approval and device information operations.\n */\nexport class CloudError extends AuthenticationError {\n  /** HTTP status code if available */\n  readonly statusCode: number | undefined;\n  /** Error code from the API if available */\n  readonly code: string | undefined;\n  /** Reason for the error if available */\n  readonly reason: string | undefined;\n\n  constructor(\n    message: string,\n    options?: {\n      statusCode?: number;\n      code?: string;\n      reason?: string;\n    },\n  ) {\n    super(message);\n    this.name = \"CloudError\";\n    this.statusCode = options?.statusCode;\n    this.code = options?.code;\n    this.reason = options?.reason;\n  }\n}\n\n/**\n * Error thrown for errors coming from the Caido instance.\n * Used for authentication flow and token refresh operations.\n */\nexport class InstanceError extends AuthenticationError {\n  /** Error code from the API */\n  readonly code: string;\n  /** Reason for the error if available */\n  readonly reason: string | undefined;\n  /** Error message if available */\n  readonly errorMessage: string | undefined;\n\n  constructor(\n    code: string,\n    options?: {\n      reason?: string;\n      message?: string;\n    },\n  ) {\n    const message = options?.reason ?? options?.message ?? code;\n    super(message);\n    this.name = \"InstanceError\";\n    this.code = code;\n    this.reason = options?.reason;\n    this.errorMessage = options?.message;\n  }\n}\n","import type { DocumentNode } from \"graphql\";\nimport { gql } from \"graphql-tag\";\n\nexport const START_AUTHENTICATION_FLOW: DocumentNode = gql`\n  mutation StartAuthenticationFlow {\n    startAuthenticationFlow {\n      request {\n        id\n        userCode\n        verificationUrl\n        expiresAt\n      }\n      error {\n        ... on AuthenticationUserError {\n          code\n          reason\n        }\n        ... on CloudUserError {\n          code\n          reason\n        }\n        ... on InternalUserError {\n          code\n          message\n        }\n        ... on OtherUserError {\n          code\n        }\n      }\n    }\n  }\n`;\n\nexport const CREATED_AUTHENTICATION_TOKEN: DocumentNode = gql`\n  subscription CreatedAuthenticationToken($requestId: ID!) {\n    createdAuthenticationToken(requestId: $requestId) {\n      token {\n        accessToken\n        expiresAt\n        refreshToken\n        scopes\n      }\n      error {\n        ... on AuthenticationUserError {\n          code\n          reason\n        }\n        ... on InternalUserError {\n          code\n          message\n        }\n        ... on OtherUserError {\n          code\n        }\n      }\n    }\n  }\n`;\n\nexport const REFRESH_AUTHENTICATION_TOKEN: DocumentNode = gql`\n  mutation RefreshAuthenticationToken($refreshToken: Token!) {\n    refreshAuthenticationToken(refreshToken: $refreshToken) {\n      token {\n        accessToken\n        expiresAt\n        refreshToken\n        scopes\n      }\n      error {\n        ... on AuthenticationUserError {\n          code\n          reason\n        }\n        ... on CloudUserError {\n          code\n          reason\n        }\n        ... on InternalUserError {\n          code\n          message\n        }\n        ... on OtherUserError {\n          code\n        }\n      }\n    }\n  }\n`;\n","import { Client, fetchExchange } from \"@urql/core\";\nimport { print } from \"graphql\";\nimport { createClient as createWSClient } from \"graphql-ws\";\n\nimport type { AuthApprover } from \"./approvers/types.js\";\nimport { AuthenticationError, InstanceError } from \"./errors.js\";\nimport {\n  CREATED_AUTHENTICATION_TOKEN,\n  REFRESH_AUTHENTICATION_TOKEN,\n  START_AUTHENTICATION_FLOW,\n} from \"./queries.js\";\nimport type {\n  AuthenticationRequest,\n  AuthenticationToken,\n  CreatedAuthenticationTokenError,\n  CreatedAuthenticationTokenResponse,\n  RefreshAuthenticationTokenError,\n  RefreshAuthenticationTokenResponse,\n  StartAuthenticationFlowError,\n  StartAuthenticationFlowResponse,\n} from \"./types.js\";\n\n/**\n * Options for configuring the AuthClient.\n */\nexport interface AuthClientOptions {\n  /** Base URL of the Caido instance (e.g., \"http://localhost:8080\") */\n  instanceUrl: string;\n  /** The approver to use for the authentication flow */\n  approver: AuthApprover;\n  /** Request timeout in milliseconds */\n  timeout?: number;\n  /** Custom fetch implementation */\n  fetch?: typeof globalThis.fetch;\n}\n\ninterface ErrorDetails {\n  reason?: string;\n  message?: string;\n}\n\n/**\n * Client for authenticating with a Caido instance.\n *\n * @example\n * ```typescript\n * import { AuthClient, BrowserApprover } from \"@caido/auth\";\n *\n * const auth = new AuthClient({\n *   instanceUrl: \"http://localhost:8080\",\n *   approver: new BrowserApprover((request) => {\n *     console.log(`Visit ${request.verificationUrl}`);\n *   })\n * });\n *\n * const token = await auth.startAuthenticationFlow();\n * console.log(\"Access token:\", token.accessToken);\n * ```\n */\nexport class AuthClient {\n  private readonly instanceUrl: string;\n  private readonly graphqlUrl: string;\n  private readonly websocketUrl: string;\n  private readonly approver: AuthApprover;\n  private readonly client: Client;\n  private readonly fetchFn: typeof globalThis.fetch | undefined;\n  private readonly timeout: number | undefined;\n\n  constructor(options: AuthClientOptions) {\n    this.instanceUrl = options.instanceUrl.replace(/\\/$/, \"\");\n    this.graphqlUrl = `${this.instanceUrl}/graphql`;\n    this.websocketUrl = this.getWebsocketUrl();\n    this.approver = options.approver;\n    this.fetchFn = options.fetch;\n    this.timeout = options.timeout;\n\n    this.client = new Client({\n      url: this.graphqlUrl,\n      exchanges: [fetchExchange],\n      fetchOptions: () => {\n        const fetchOptions: RequestInit = {};\n        if (this.timeout !== undefined) {\n          fetchOptions.signal = AbortSignal.timeout(this.timeout);\n        }\n        return fetchOptions;\n      },\n      fetch: this.fetchFn,\n    });\n  }\n\n  private getWebsocketUrl(): string {\n    const url = new URL(this.graphqlUrl);\n    const scheme = url.protocol === \"https:\" ? \"wss:\" : \"ws:\";\n    return `${scheme}//${url.host}/ws/graphql`;\n  }\n\n  private extractErrorDetails(\n    error:\n      | StartAuthenticationFlowError\n      | CreatedAuthenticationTokenError\n      | RefreshAuthenticationTokenError,\n  ): ErrorDetails {\n    if (\"reason\" in error) {\n      return { reason: error.reason };\n    }\n    if (\"message\" in error) {\n      return { message: error.message };\n    }\n    return {};\n  }\n\n  /**\n   * Start the device code authentication flow.\n   *\n   * This method:\n   * 1. Initiates the authentication flow via GraphQL mutation\n   * 2. Calls the approver with the authentication request\n   * 3. Waits for the user to authorize via WebSocket subscription\n   * 4. Returns the authentication token once approved\n   *\n   * @returns The authentication token\n   * @throws {InstanceError} If the flow fails to start\n   * @throws {AuthenticationError} If token retrieval fails\n   */\n  async startAuthenticationFlow(): Promise<AuthenticationToken> {\n    // Step 1: Start the authentication flow\n    const result = await this.client\n      .mutation<StartAuthenticationFlowResponse>(START_AUTHENTICATION_FLOW, {})\n      .toPromise();\n\n    if (result.error) {\n      throw new InstanceError(\"GRAPHQL_ERROR\", {\n        message: result.error.message,\n      });\n    }\n\n    const payload = result.data?.startAuthenticationFlow;\n    if (!payload) {\n      throw new InstanceError(\"NO_RESPONSE\", {\n        message: \"No response from startAuthenticationFlow\",\n      });\n    }\n\n    if (payload.error) {\n      const details = this.extractErrorDetails(payload.error);\n      throw new InstanceError(payload.error.code, details);\n    }\n\n    if (!payload.request) {\n      throw new InstanceError(\"NO_REQUEST\", {\n        message: \"No authentication request returned\",\n      });\n    }\n\n    const authRequest: AuthenticationRequest = {\n      id: payload.request.id,\n      userCode: payload.request.userCode,\n      verificationUrl: payload.request.verificationUrl,\n      expiresAt: new Date(payload.request.expiresAt),\n    };\n\n    // Step 2: Call the approver\n    await this.approver.approve(authRequest);\n\n    // Step 3: Wait for the token via subscription\n    const token = await this.waitForToken(authRequest.id);\n    return token;\n  }\n\n  private async waitForToken(requestId: string): Promise<AuthenticationToken> {\n    return new Promise<AuthenticationToken>((resolve, reject) => {\n      const wsClient = createWSClient({\n        url: this.websocketUrl,\n      });\n\n      const unsubscribe =\n        wsClient.subscribe<CreatedAuthenticationTokenResponse>(\n          {\n            query: print(CREATED_AUTHENTICATION_TOKEN),\n            variables: { requestId },\n          },\n          {\n            next: (result) => {\n              const payload = result.data?.createdAuthenticationToken;\n\n              if (payload?.error) {\n                unsubscribe();\n                wsClient.dispose();\n                const details = this.extractErrorDetails(payload.error);\n                reject(new InstanceError(payload.error.code, details));\n                return;\n              }\n\n              if (payload?.token) {\n                unsubscribe();\n                wsClient.dispose();\n                resolve({\n                  accessToken: payload.token.accessToken,\n                  refreshToken: payload.token.refreshToken,\n                  expiresAt: new Date(payload.token.expiresAt),\n                  scopes: payload.token.scopes,\n                });\n              }\n            },\n            error: (error) => {\n              wsClient.dispose();\n              reject(\n                new InstanceError(\"SUBSCRIPTION_ERROR\", {\n                  message:\n                    error instanceof Error ? error.message : String(error),\n                }),\n              );\n            },\n            complete: () => {\n              wsClient.dispose();\n              reject(\n                new InstanceError(\"SUBSCRIPTION_COMPLETE\", {\n                  message: \"Subscription ended without receiving token\",\n                }),\n              );\n            },\n          },\n        );\n    });\n  }\n\n  /**\n   * Refresh an access token using a refresh token.\n   *\n   * @param refreshToken - The refresh token from a previous authentication\n   * @returns New authentication token with updated access and refresh tokens\n   * @throws {InstanceError} If the refresh fails\n   */\n  async refreshToken(refreshToken: string): Promise<AuthenticationToken> {\n    const result = await this.client\n      .mutation<RefreshAuthenticationTokenResponse>(\n        REFRESH_AUTHENTICATION_TOKEN,\n        { refreshToken },\n      )\n      .toPromise();\n\n    if (result.error) {\n      throw new InstanceError(\"GRAPHQL_ERROR\", {\n        message: result.error.message,\n      });\n    }\n\n    const payload = result.data?.refreshAuthenticationToken;\n    if (!payload) {\n      throw new InstanceError(\"NO_RESPONSE\", {\n        message: \"No response from refreshAuthenticationToken\",\n      });\n    }\n\n    if (payload.error) {\n      const details = this.extractErrorDetails(payload.error);\n      throw new InstanceError(payload.error.code, details);\n    }\n\n    if (!payload.token) {\n      throw new InstanceError(\"NO_TOKEN\", {\n        message: \"No token returned from refresh\",\n      });\n    }\n\n    return {\n      accessToken: payload.token.accessToken,\n      refreshToken: payload.token.refreshToken,\n      expiresAt: new Date(payload.token.expiresAt),\n      scopes: payload.token.scopes,\n    };\n  }\n}\n","import type { AuthenticationRequest } from \"../types.js\";\n\nimport type { AuthApprover } from \"./types.js\";\n\n/**\n * Callback function that receives the authentication request details.\n * Used to display the verification URL and user code to the user.\n */\nexport type OnRequestCallback = (\n  request: AuthenticationRequest,\n) => Promise<void> | void;\n\n/**\n * Browser-based approver that delegates to a callback function.\n * The callback should display the verification URL and user code to the user,\n * who then manually approves the request in their browser.\n *\n * @example\n * ```typescript\n * const approver = new BrowserApprover((request) => {\n *   console.log(`Visit ${request.verificationUrl}`);\n * });\n * ```\n */\nexport class BrowserApprover implements AuthApprover {\n  private readonly onRequest: OnRequestCallback;\n\n  /**\n   * Create a new BrowserApprover.\n   *\n   * @param onRequest - Callback function that will be called with the authentication request\n   */\n  constructor(onRequest: OnRequestCallback) {\n    this.onRequest = onRequest;\n  }\n\n  /**\n   * Approve the authentication request by calling the callback.\n   * The actual approval happens when the user visits the URL and enters the code.\n   *\n   * @param request - The authentication request\n   */\n  async approve(request: AuthenticationRequest): Promise<void> {\n    await this.onRequest(request);\n  }\n}\n","import { CloudError } from \"../errors.js\";\nimport type { AuthenticationRequest, DeviceInformation } from \"../types.js\";\n\nimport type { AuthApprover } from \"./types.js\";\n\nconst DEFAULT_API_URL = \"https://api.caido.io\";\n\ninterface OAuth2ErrorResponse {\n  error?: string;\n  error_description?: string;\n}\n\ntype OAuth2ErrorData = OAuth2ErrorResponse | string;\n\ninterface ParsedOAuth2Error {\n  errorText: string;\n  errorCode: string | undefined;\n  errorDescription: string | undefined;\n}\n\ninterface RequestOptions {\n  method: string;\n  headers: Record<string, string>;\n}\n\n/**\n * Options for the PATApprover.\n */\nexport interface PATApproverOptions {\n  /** The Personal Access Token to use for approval */\n  pat: string;\n  /** If provided, only approve these scopes. Others will be filtered out. */\n  allowedScopes?: string[];\n  /** The API URL to use. Defaults to \"https://api.caido.io\" */\n  apiUrl?: string;\n  /** Request timeout in milliseconds */\n  timeout?: number;\n  /** Custom fetch implementation */\n  fetch?: typeof globalThis.fetch;\n}\n\n/**\n * PAT-based approver that automatically approves device code requests.\n * Uses a Personal Access Token to call the Caido API directly.\n *\n * @example\n * ```typescript\n * // Approve all scopes\n * const approver = new PATApprover({ pat: \"caido_xxxxx\" });\n *\n * // Approve only specific scopes\n * const limitedApprover = new PATApprover({\n *   pat: \"caido_xxxxx\",\n *   allowedScopes: [\"read:projects\", \"write:requests\"],\n * });\n * ```\n */\nexport class PATApprover implements AuthApprover {\n  private readonly pat: string;\n  private readonly allowedScopes: string[] | undefined;\n  private readonly apiUrl: string;\n  private readonly fetchFn: typeof globalThis.fetch;\n  private readonly timeout: number | undefined;\n\n  constructor(options: PATApproverOptions) {\n    this.pat = options.pat;\n    this.allowedScopes = options.allowedScopes;\n    this.apiUrl = (options.apiUrl ?? DEFAULT_API_URL).replace(/\\/$/, \"\");\n    this.fetchFn = options.fetch ?? globalThis.fetch;\n    this.timeout = options.timeout;\n  }\n\n  /**\n   * Approve the authentication request using the PAT.\n   * First fetches device information to get available scopes,\n   * then filters scopes if allowedScopes is set,\n   * and finally approves the device.\n   *\n   * @param request - The authentication request\n   * @throws {CloudError} If fetching device information or approving the device fails\n   */\n  async approve(request: AuthenticationRequest): Promise<void> {\n    // Step 1: Get device information to retrieve available scopes\n    const deviceInfo = await this.getDeviceInformation(request.userCode);\n\n    // Step 2: Filter scopes if allowedScopes is provided\n    let scopesToApprove = deviceInfo.scopes.map((s) => s.name);\n    if (this.allowedScopes) {\n      scopesToApprove = scopesToApprove.filter((scope) =>\n        this.allowedScopes!.includes(scope),\n      );\n    }\n\n    // Step 3: Approve the device with the filtered scopes\n    await this.approveDevice(request.userCode, scopesToApprove);\n  }\n\n  private async sendRequest(\n    url: URL,\n    options: RequestOptions,\n  ): Promise<Response> {\n    const fetchOptions: RequestInit = {\n      method: options.method,\n      headers: options.headers,\n    };\n\n    if (this.timeout !== undefined) {\n      fetchOptions.signal = AbortSignal.timeout(this.timeout);\n    }\n\n    return this.fetchFn(url, fetchOptions);\n  }\n\n  private async parseOAuth2Error(\n    response: Response,\n  ): Promise<ParsedOAuth2Error> {\n    let errorText: string;\n    let errorCode: string | undefined;\n    let errorDescription: string | undefined;\n\n    try {\n      const errorData = (await response.json()) as OAuth2ErrorData;\n      if (typeof errorData === \"string\") {\n        errorText = errorData;\n      } else {\n        errorCode = errorData.error;\n        errorDescription = errorData.error_description;\n        errorText = errorDescription ?? errorCode ?? \"Unknown error\";\n      }\n    } catch {\n      errorText = await response.text().catch(() => \"Unknown error\");\n    }\n\n    return { errorText, errorCode, errorDescription };\n  }\n\n  private async getDeviceInformation(\n    userCode: string,\n  ): Promise<DeviceInformation> {\n    const params = new URLSearchParams();\n    params.append(\"user_code\", userCode);\n    const url = new URL(`${this.apiUrl}/oauth2/device/information`);\n    url.search = params.toString();\n\n    const response = await this.sendRequest(url, {\n      method: \"GET\",\n      headers: {\n        Authorization: `Bearer ${this.pat}`,\n        Accept: \"application/json\",\n      },\n    });\n\n    if (!response.ok) {\n      const { errorText, errorCode, errorDescription } =\n        await this.parseOAuth2Error(response);\n\n      throw new CloudError(`Failed to get device information: ${errorText}`, {\n        statusCode: response.status,\n        code: errorCode,\n        reason: errorDescription,\n      });\n    }\n\n    const data = (await response.json()) as DeviceInformation;\n    return data;\n  }\n\n  private async approveDevice(\n    userCode: string,\n    scopes: string[],\n  ): Promise<void> {\n    const params = new URLSearchParams();\n    params.append(\"user_code\", userCode);\n    params.append(\"scope\", scopes.join(\",\"));\n    const url = new URL(`${this.apiUrl}/oauth2/device/approve`);\n    url.search = params.toString();\n\n    const response = await this.sendRequest(url, {\n      method: \"POST\",\n      headers: {\n        Authorization: `Bearer ${this.pat}`,\n        \"Content-Type\": \"application/json\",\n        Accept: \"application/json\",\n      },\n    });\n\n    if (!response.ok) {\n      const { errorText, errorCode, errorDescription } =\n        await this.parseOAuth2Error(response);\n\n      throw new CloudError(`Failed to approve device: ${errorText}`, {\n        statusCode: response.status,\n        code: errorCode,\n        reason: errorDescription,\n      });\n    }\n  }\n}\n"],"mappings":";;;;;;;;;AAGA,IAAa,sBAAb,cAAyC,MAAM;CAC7C,YAAY,SAAiB;AAC3B,QAAM,QAAQ;AACd,OAAK,OAAO;;;;;;;AAQhB,IAAa,aAAb,cAAgC,oBAAoB;;CAElD,AAAS;;CAET,AAAS;;CAET,AAAS;CAET,YACE,SACA,SAKA;AACA,QAAM,QAAQ;AACd,OAAK,OAAO;AACZ,OAAK,aAAa,SAAS;AAC3B,OAAK,OAAO,SAAS;AACrB,OAAK,SAAS,SAAS;;;;;;;AAQ3B,IAAa,gBAAb,cAAmC,oBAAoB;;CAErD,AAAS;;CAET,AAAS;;CAET,AAAS;CAET,YACE,MACA,SAIA;EACA,MAAM,UAAU,SAAS,UAAU,SAAS,WAAW;AACvD,QAAM,QAAQ;AACd,OAAK,OAAO;AACZ,OAAK,OAAO;AACZ,OAAK,SAAS,SAAS;AACvB,OAAK,eAAe,SAAS;;;;;;AC3DjC,MAAa,4BAA0C,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8B1D,MAAa,+BAA6C,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;AA0B7D,MAAa,+BAA6C,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACA7D,IAAa,aAAb,MAAwB;CACtB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAEjB,YAAY,SAA4B;AACtC,OAAK,cAAc,QAAQ,YAAY,QAAQ,OAAO,GAAG;AACzD,OAAK,aAAa,GAAG,KAAK,YAAY;AACtC,OAAK,eAAe,KAAK,iBAAiB;AAC1C,OAAK,WAAW,QAAQ;AACxB,OAAK,UAAU,QAAQ;AACvB,OAAK,UAAU,QAAQ;AAEvB,OAAK,SAAS,IAAI,OAAO;GACvB,KAAK,KAAK;GACV,WAAW,CAAC,cAAc;GAC1B,oBAAoB;IAClB,MAAM,eAA4B,EAAE;AACpC,QAAI,KAAK,YAAY,OACnB,cAAa,SAAS,YAAY,QAAQ,KAAK,QAAQ;AAEzD,WAAO;;GAET,OAAO,KAAK;GACb,CAAC;;CAGJ,AAAQ,kBAA0B;EAChC,MAAM,MAAM,IAAI,IAAI,KAAK,WAAW;AAEpC,SAAO,GADQ,IAAI,aAAa,WAAW,SAAS,MACnC,IAAI,IAAI,KAAK;;CAGhC,AAAQ,oBACN,OAIc;AACd,MAAI,YAAY,MACd,QAAO,EAAE,QAAQ,MAAM,QAAQ;AAEjC,MAAI,aAAa,MACf,QAAO,EAAE,SAAS,MAAM,SAAS;AAEnC,SAAO,EAAE;;;;;;;;;;;;;;;CAgBX,MAAM,0BAAwD;EAE5D,MAAM,SAAS,MAAM,KAAK,OACvB,SAA0C,2BAA2B,EAAE,CAAC,CACxE,WAAW;AAEd,MAAI,OAAO,MACT,OAAM,IAAI,cAAc,iBAAiB,EACvC,SAAS,OAAO,MAAM,SACvB,CAAC;EAGJ,MAAM,UAAU,OAAO,MAAM;AAC7B,MAAI,CAAC,QACH,OAAM,IAAI,cAAc,eAAe,EACrC,SAAS,4CACV,CAAC;AAGJ,MAAI,QAAQ,OAAO;GACjB,MAAM,UAAU,KAAK,oBAAoB,QAAQ,MAAM;AACvD,SAAM,IAAI,cAAc,QAAQ,MAAM,MAAM,QAAQ;;AAGtD,MAAI,CAAC,QAAQ,QACX,OAAM,IAAI,cAAc,cAAc,EACpC,SAAS,sCACV,CAAC;EAGJ,MAAM,cAAqC;GACzC,IAAI,QAAQ,QAAQ;GACpB,UAAU,QAAQ,QAAQ;GAC1B,iBAAiB,QAAQ,QAAQ;GACjC,WAAW,IAAI,KAAK,QAAQ,QAAQ,UAAU;GAC/C;AAGD,QAAM,KAAK,SAAS,QAAQ,YAAY;AAIxC,SADc,MAAM,KAAK,aAAa,YAAY,GAAG;;CAIvD,MAAc,aAAa,WAAiD;AAC1E,SAAO,IAAI,SAA8B,SAAS,WAAW;GAC3D,MAAM,WAAWA,aAAe,EAC9B,KAAK,KAAK,cACX,CAAC;GAEF,MAAM,cACJ,SAAS,UACP;IACE,OAAO,MAAM,6BAA6B;IAC1C,WAAW,EAAE,WAAW;IACzB,EACD;IACE,OAAO,WAAW;KAChB,MAAM,UAAU,OAAO,MAAM;AAE7B,SAAI,SAAS,OAAO;AAClB,mBAAa;AACb,eAAS,SAAS;MAClB,MAAM,UAAU,KAAK,oBAAoB,QAAQ,MAAM;AACvD,aAAO,IAAI,cAAc,QAAQ,MAAM,MAAM,QAAQ,CAAC;AACtD;;AAGF,SAAI,SAAS,OAAO;AAClB,mBAAa;AACb,eAAS,SAAS;AAClB,cAAQ;OACN,aAAa,QAAQ,MAAM;OAC3B,cAAc,QAAQ,MAAM;OAC5B,WAAW,IAAI,KAAK,QAAQ,MAAM,UAAU;OAC5C,QAAQ,QAAQ,MAAM;OACvB,CAAC;;;IAGN,QAAQ,UAAU;AAChB,cAAS,SAAS;AAClB,YACE,IAAI,cAAc,sBAAsB,EACtC,SACE,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,EACzD,CAAC,CACH;;IAEH,gBAAgB;AACd,cAAS,SAAS;AAClB,YACE,IAAI,cAAc,yBAAyB,EACzC,SAAS,8CACV,CAAC,CACH;;IAEJ,CACF;IACH;;;;;;;;;CAUJ,MAAM,aAAa,cAAoD;EACrE,MAAM,SAAS,MAAM,KAAK,OACvB,SACC,8BACA,EAAE,cAAc,CACjB,CACA,WAAW;AAEd,MAAI,OAAO,MACT,OAAM,IAAI,cAAc,iBAAiB,EACvC,SAAS,OAAO,MAAM,SACvB,CAAC;EAGJ,MAAM,UAAU,OAAO,MAAM;AAC7B,MAAI,CAAC,QACH,OAAM,IAAI,cAAc,eAAe,EACrC,SAAS,+CACV,CAAC;AAGJ,MAAI,QAAQ,OAAO;GACjB,MAAM,UAAU,KAAK,oBAAoB,QAAQ,MAAM;AACvD,SAAM,IAAI,cAAc,QAAQ,MAAM,MAAM,QAAQ;;AAGtD,MAAI,CAAC,QAAQ,MACX,OAAM,IAAI,cAAc,YAAY,EAClC,SAAS,kCACV,CAAC;AAGJ,SAAO;GACL,aAAa,QAAQ,MAAM;GAC3B,cAAc,QAAQ,MAAM;GAC5B,WAAW,IAAI,KAAK,QAAQ,MAAM,UAAU;GAC5C,QAAQ,QAAQ,MAAM;GACvB;;;;;;;;;;;;;;;;;;ACtPL,IAAa,kBAAb,MAAqD;CACnD,AAAiB;;;;;;CAOjB,YAAY,WAA8B;AACxC,OAAK,YAAY;;;;;;;;CASnB,MAAM,QAAQ,SAA+C;AAC3D,QAAM,KAAK,UAAU,QAAQ;;;;;;ACtCjC,MAAM,kBAAkB;;;;;;;;;;;;;;;;;AAoDxB,IAAa,cAAb,MAAiD;CAC/C,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAEjB,YAAY,SAA6B;AACvC,OAAK,MAAM,QAAQ;AACnB,OAAK,gBAAgB,QAAQ;AAC7B,OAAK,UAAU,QAAQ,UAAU,iBAAiB,QAAQ,OAAO,GAAG;AACpE,OAAK,UAAU,QAAQ,SAAS,WAAW;AAC3C,OAAK,UAAU,QAAQ;;;;;;;;;;;CAYzB,MAAM,QAAQ,SAA+C;EAK3D,IAAI,mBAHe,MAAM,KAAK,qBAAqB,QAAQ,SAAS,EAGnC,OAAO,KAAK,MAAM,EAAE,KAAK;AAC1D,MAAI,KAAK,cACP,mBAAkB,gBAAgB,QAAQ,UACxC,KAAK,cAAe,SAAS,MAAM,CACpC;AAIH,QAAM,KAAK,cAAc,QAAQ,UAAU,gBAAgB;;CAG7D,MAAc,YACZ,KACA,SACmB;EACnB,MAAM,eAA4B;GAChC,QAAQ,QAAQ;GAChB,SAAS,QAAQ;GAClB;AAED,MAAI,KAAK,YAAY,OACnB,cAAa,SAAS,YAAY,QAAQ,KAAK,QAAQ;AAGzD,SAAO,KAAK,QAAQ,KAAK,aAAa;;CAGxC,MAAc,iBACZ,UAC4B;EAC5B,IAAI;EACJ,IAAI;EACJ,IAAI;AAEJ,MAAI;GACF,MAAM,YAAa,MAAM,SAAS,MAAM;AACxC,OAAI,OAAO,cAAc,SACvB,aAAY;QACP;AACL,gBAAY,UAAU;AACtB,uBAAmB,UAAU;AAC7B,gBAAY,oBAAoB,aAAa;;UAEzC;AACN,eAAY,MAAM,SAAS,MAAM,CAAC,YAAY,gBAAgB;;AAGhE,SAAO;GAAE;GAAW;GAAW;GAAkB;;CAGnD,MAAc,qBACZ,UAC4B;EAC5B,MAAM,SAAS,IAAI,iBAAiB;AACpC,SAAO,OAAO,aAAa,SAAS;EACpC,MAAM,MAAM,IAAI,IAAI,GAAG,KAAK,OAAO,4BAA4B;AAC/D,MAAI,SAAS,OAAO,UAAU;EAE9B,MAAM,WAAW,MAAM,KAAK,YAAY,KAAK;GAC3C,QAAQ;GACR,SAAS;IACP,eAAe,UAAU,KAAK;IAC9B,QAAQ;IACT;GACF,CAAC;AAEF,MAAI,CAAC,SAAS,IAAI;GAChB,MAAM,EAAE,WAAW,WAAW,qBAC5B,MAAM,KAAK,iBAAiB,SAAS;AAEvC,SAAM,IAAI,WAAW,qCAAqC,aAAa;IACrE,YAAY,SAAS;IACrB,MAAM;IACN,QAAQ;IACT,CAAC;;AAIJ,SADc,MAAM,SAAS,MAAM;;CAIrC,MAAc,cACZ,UACA,QACe;EACf,MAAM,SAAS,IAAI,iBAAiB;AACpC,SAAO,OAAO,aAAa,SAAS;AACpC,SAAO,OAAO,SAAS,OAAO,KAAK,IAAI,CAAC;EACxC,MAAM,MAAM,IAAI,IAAI,GAAG,KAAK,OAAO,wBAAwB;AAC3D,MAAI,SAAS,OAAO,UAAU;EAE9B,MAAM,WAAW,MAAM,KAAK,YAAY,KAAK;GAC3C,QAAQ;GACR,SAAS;IACP,eAAe,UAAU,KAAK;IAC9B,gBAAgB;IAChB,QAAQ;IACT;GACF,CAAC;AAEF,MAAI,CAAC,SAAS,IAAI;GAChB,MAAM,EAAE,WAAW,WAAW,qBAC5B,MAAM,KAAK,iBAAiB,SAAS;AAEvC,SAAM,IAAI,WAAW,6BAA6B,aAAa;IAC7D,YAAY,SAAS;IACrB,MAAM;IACN,QAAQ;IACT,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@caido/server-auth",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Authenticate with a Caido instance",
   "author": "Caido Labs Inc. <dev@caido.io>",
   "repository": "https://github.com/caido/sdk-js/",
@@ -24,13 +24,14 @@
   "files": [
     "dist/*"
   ],
-  "scripts": {
-    "build": "tsdown"
-  },
   "dependencies": {
     "@urql/core": "^6.0.0",
     "graphql": "^16.12.0",
     "graphql-tag": "^2.12.0",
     "graphql-ws": "^6.0.0"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "typecheck": "tsc --noEmit"
   }
-}
+}