@cybedefend/vibedefend 1.5.0 → 1.7.0

package/dist/login.js

@@ -16,6 +16,8 @@
  *     (Linux/Windows).
  *  9. Pre-seed the guards cache for a warm first hook call.
  * 10. Decode the id_token to extract the user email for the confirmation line.
+ * 11. Select the organization this machine works under (`src/org.ts`): the
+ *     MCP verification routes are org-scoped, so a login says which one.
  *
  * The --token <jwt> flag has been removed. Use `vibedefend login` interactively
  * or obtain a token via the dashboard PAT flow (see PatUsageGuide).
@@ -26,13 +28,16 @@ import { join } from 'node:path';
 import { existsSync, readFileSync } from 'node:fs';
 import kleur from 'kleur';
 import { deriveLogtoEndpoint } from './endpoints.js';
-import { resolveToken } from './hooks/runtime/resolve.js';
 import { log } from './utils.js';
 import { randomBase64url, pkceChallenge } from './auth/pkce.js';
 import { startCallbackServer } from './auth/callback-server.js';
 import { exchangeCodeForTokens } from './auth/token-exchange.js';
 import { loadAuth, storeAuth } from './auth/auth-store.js';
-import { isAuthFrom } from './auth/auth.js';
+import { liftViolationHolds } from './hooks/runtime/guard-violations-buffer.js';
+import { hasUsableStoredAuth, isAuthFrom } from './auth/auth.js';
+import { listOrganizations as listOrganizationsImpl } from './api/projects.js';
+import { saveRuntimeOrganization } from './hooks/runtime/config.js';
+import { chooseOrganization, formatOrganizationList } from './org.js';
 /**
  * Fetch the CLI OAuth client_id and API resource URL from the public
  * GET /client-apps gateway endpoint.
@@ -220,15 +225,23 @@ function loadRuntimeConfigForLogin() {
  * Exported for testing and for the install chain.
  */
 export async function runLogin(opts) {
-    const { mcpName, mcpUrl, apiBase, logtoEndpoint, force, fetchImpl = globalThis.fetch, openBrowserFn = openBrowser, callbackServerFn = startCallbackServer, } = opts;
-    // 1. Already logged in — to THIS region? EU and US store their bundle under
-    //    the same MCP name: after a region switch, the bundle on disk was issued
-    //    by the previous region's Logto and is no session here.
+    const { mcpName, mcpUrl, apiBase, logtoEndpoint, force, fetchImpl = globalThis.fetch, openBrowserFn = openBrowser, callbackServerFn = startCallbackServer, liftViolationHoldsFn = liftViolationHolds, } = opts;
+    // 1. Already logged in?
+    //
+    // ONE source of truth, for every region: VibeDefend's own OAuth store. The
+    // agent keychain (Claude Code / Codex MCP OAuth, read by the legacy
+    // `resolveToken`) must NOT answer this question: those tokens belong to the
+    // agent and carry no refresh_token we can use.
+    //
+    // "Logged in" means USABLE (a refresh token, or an access token not yet
+    // expired) AND issued by THIS region's Logto: EU and US store their bundle
+    // under the same MCP name, so after a region switch the bundle on disk was
+    // issued by the previous region and is no session here.
     const stored = loadAuth(mcpName);
-    const existingToken = stored !== null && !isAuthFrom(stored, logtoEndpoint)
-        ? null
-        : resolveToken(mcpName, { mcpUrl });
-    if (existingToken && !force) {
+    if (stored !== null &&
+        isAuthFrom(stored, logtoEndpoint) &&
+        hasUsableStoredAuth(mcpName) &&
+        !force) {
         log.warn('Already logged in. Use `vibedefend login --force` to re-authenticate.');
         return { email: 'unknown' };
     }
@@ -310,6 +323,10 @@ export async function runLogin(opts) {
         logtoResource,
     };
     storeAuth(mcpName, authBundle);
+    // 10b. A new login may be the user's fix for a refused audit push (wrong
+    // account, new role): let the next hook post the held-back violations at
+    // once instead of waiting out the hour (BACK-240 L2).
+    liftViolationHoldsFn();
     // 11. Pre-seed the guards cache (best-effort).
     try {
         await seedGuardsCache(apiBase, tokens.access_token, fetchImpl);
@@ -321,7 +338,55 @@ export async function runLogin(opts) {
     // 12. Confirm.
     const email = decodeIdTokenEmail(tokens.id_token);
     log.ok(`Logged in as ${kleur.bold(email)}`);
-    return { email };
+    // 13. Which organization this machine works under.
+    const organization = await selectOrganizationAfterLogin(opts, apiBase, tokens.access_token, fetchImpl);
+    return { email, organization };
+}
+/**
+ * The organization selection that ends a login. Never fails the login: a
+ * list that cannot be obtained, or a choice that cannot be made here, is
+ * said in one line with the command that makes it later (`vibedefend org`).
+ */
+async function selectOrganizationAfterLogin(opts, apiBase, token, fetchImpl) {
+    const listOrganizations = opts.listOrganizationsFn ?? ((base, bearer) => listOrganizationsImpl(base, bearer, { fetchImpl }));
+    const save = opts.saveOrganizationFn ?? saveRuntimeOrganization;
+    let organizations;
+    try {
+        organizations = await listOrganizations(apiBase, token);
+    }
+    catch {
+        organizations = null;
+    }
+    const choice = await chooseOrganization(organizations, {
+        requestedId: opts.organization,
+        isTTY: opts.isTTY ?? Boolean(process.stdin.isTTY && process.stdout.isTTY),
+        selectFn: opts.selectOrganizationFn,
+    });
+    switch (choice.kind) {
+        case 'selected': {
+            if (save(choice.organization)) {
+                log.ok(`Organization: ${kleur.bold(choice.organization.name)}`);
+            }
+            else {
+                log.warn(`Could not record the organization "${choice.organization.name}" — run \`vibedefend org ${choice.organization.id}\` after \`vibedefend install\`.`);
+            }
+            return choice.organization;
+        }
+        case 'ambiguous':
+            log.warn('You belong to several organizations. Re-run `vibedefend login --organization <id>` (or `vibedefend org <id>`) with one of:');
+            console.log(formatOrganizationList(choice.organizations));
+            return null;
+        case 'unknown-id':
+            log.warn(`No organization "${choice.requested}" among yours. Pick one with \`vibedefend org <id>\`:`);
+            console.log(formatOrganizationList(choice.organizations));
+            return null;
+        case 'unavailable':
+            log.warn('Could not list your organizations — select one later with `vibedefend org <id>`.');
+            return null;
+        case 'none':
+            // The install's own organization gate takes it from here.
+            return null;
+    }
 }
 // ─── CLI entry point ──────────────────────────────────────────────────────────
 /**
@@ -344,6 +409,7 @@ export async function runLoginCommand(opts) {
             apiBase: regionCfg.apiBase,
             logtoEndpoint,
             force: opts.force,
+            organization: opts.organization,
         });
     }
     catch (e) {

package/dist/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAqC5C;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAe,EACf,YAAqC,UAAU,CAAC,KAAK;IAErD,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,cAAc,EAAE;YAC9C,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,kCAAkC,OAAO,KAAM,CAAW,CAAC,OAAO,EAAE,CACrE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,iCAAiC,GAAG,CAAC,MAAM,EAAE,CAC9C,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAA0C,CAAC;IAC5D,MAAM,QAAQ,GAAI,GAAG,EAAE,KAAgB,IAAI,EAAE,CAAC;IAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,8CAA8C;YAC9C,kCAAkC,CACnC,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,uBAAuB;IACvB,MAAM,aAAa,GAChB,IAAI,CAAC,aAAoC;QACzC,GAAG,EAAE,QAA+B;QACrC,kCAAkC,EAAE;QACpC,EAAE,CAAC;IAEL,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,8CAA8C;YAC9C,gFAAgF,CACjF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;AACrC,CAAC;AAED,8DAA8D;AAC9D,SAAS,kCAAkC;IACzC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,qBAAqB,CAAC,CAAC;IAChE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAA4B,CAAC;QAC3E,OAAQ,GAAG,CAAC,aAAoC,IAAI,IAAI,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAAW,EACX,WAA4B,OAAO,CAAC,QAAQ;IAE5C,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/D,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,6BAA6B,EAAE,GAAG,CAAC,EAAE,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE;YACtB,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,YAAY,CAAC,EAAU;IAC9B,IAAI,MAAiD,CAAC;IACtD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QAC/C,MAAM,GAAG,UAAU,CACjB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,EAAE,GAAG,MAAM,kCAAkC,CAAC,CAAC,EAC/F,EAAE,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO;QACL,OAAO;QACP,MAAM,EAAE,GAAG,EAAE;YACX,IAAI,MAAM,KAAK,SAAS;gBAAE,YAAY,CAAC,MAAM,CAAC,CAAC;QACjD,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACzB,CAAC;QAC7B,OAAO,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF;;;GAGG;AACH,KAAK,UAAU,eAAe,CAC5B,OAAe,EACf,KAAa,EACb,YAAqC,UAAU,CAAC,KAAK;IAErD,MAAM,SAAS,GAAG,wBAAwB,EAAE,CAAC;IAC7C,IAAI,CAAC,SAAS;QAAE,OAAO;IAEvB,MAAM,EAAE,8BAA8B,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAC1E,sCAAsC,CACvC,CAAC;IAEF,MAAM,KAAK,GAAG,mBAAmB,CAAC;QAChC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CACf,8BAA8B,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC;KACrD,CAAC,CAAC;IAEH,MAAM,KAAK,CAAC,cAAc,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,0DAA0D;AAC1D,SAAS,wBAAwB;IAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;IACrE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAEtD,CAAC;QACF,OAAO,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAWD,SAAS,yBAAyB;IAChC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,qBAAqB,CAAC,CAAC;IACzE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CASzB,CAAC;QACF,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,EAAE,OAAO;YAAE,OAAO,IAAI,CAAC;QAEtD,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,aAAa,EACX,MAAM,CAAC,aAAa;gBACpB,GAAG,CAAC,aAAa;gBACjB,SAAS;SACZ,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAkB;IAC/C,MAAM,EACJ,OAAO,EACP,MAAM,EACN,OAAO,EACP,aAAa,EACb,KAAK,EACL,SAAS,GAAG,UAAU,CAAC,KAAK,EAC5B,aAAa,GAAG,WAAW,EAC3B,gBAAgB,GAAG,mBAAmB,GACvC,GAAG,IAAI,CAAC;IAET,4EAA4E;IAC5E,6EAA6E;IAC7E,4DAA4D;IAC5D,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,aAAa,GACjB,MAAM,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC;QACnD,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACxC,IAAI,aAAa,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5B,GAAG,CAAC,IAAI,CACN,uEAAuE,CACxE,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;IAED,yDAAyD;IACzD,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,MAAM,qBAAqB,CAC7D,OAAO,EACP,SAAS,CACV,CAAC;IAEF,gBAAgB;IAChB,MAAM,YAAY,GAAG,eAAe,CAAC,EAAE,CAAC,CAAC;IACzC,MAAM,aAAa,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,CAAC,CAAC;IAElC,kCAAkC;IAClC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxE,MAAM,WAAW,GAAG,oBAAoB,IAAI,WAAW,CAAC;IAExD,qBAAqB;IACrB,MAAM,OAAO,GACX,GAAG,aAAa,aAAa;QAC7B,IAAI,eAAe,CAAC;YAClB,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,qCAAqC;YAC5C,qEAAqE;YACrE,0EAA0E;YAC1E,yEAAyE;YACzE,0EAA0E;YAC1E,wEAAwE;YACxE,uEAAuE;YACvE,yEAAyE;YACzE,0BAA0B;YAC1B,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,aAAa;YACvB,YAAY,EAAE,WAAW;YACzB,cAAc,EAAE,aAAa;YAC7B,qBAAqB,EAAE,MAAM;YAC7B,KAAK;SACN,CAAC,CAAC,QAAQ,EAAE,CAAC;IAEhB,mBAAmB;IACnB,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,EAAE,CAAC;IAEd,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,6CAA6C,CAAC,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,uCAAuC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,wCAAwC,CAAC,CACpD,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC,CAAC;IAE1D,wCAAwC;IACxC,IAAI,IAAY,CAAC;IACjB,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,UAAU,EAAE,CAAC;IACrB,CAAC;IAED,+CAA+C;IAC/C,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC;QACzC,aAAa;QACb,QAAQ,EAAE,QAAQ;QAClB,IAAI;QACJ,YAAY;QACZ,WAAW;QACX,QAAQ,EAAE,aAAa;QACvB,SAAS;KACV,CAAC,CAAC;IAEH,2DAA2D;IAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;IAE/D,wBAAwB;IACxB,MAAM,UAAU,GAAe;QAC7B,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,YAAY,EAAE,MAAM,CAAC,aAAa;QAClC,OAAO,EAAE,MAAM,CAAC,QAAQ;QACxB,SAAS;QACT,aAAa;QACb,QAAQ;QACR,aAAa;KACd,CAAC;IACF,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAE/B,+CAA+C;IAC/C,IAAI,CAAC;QACH,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC/D,GAAG,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,aAAa;IACf,CAAC;IAED,eAAe;IACf,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClD,GAAG,CAAC,EAAE,CAAC,gBAAgB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAE5C,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED,iFAAiF;AAEjF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAErC;IACC,MAAM,SAAS,GAAG,yBAAyB,EAAE,CAAC;IAC9C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,aAAa,GACjB,SAAS,CAAC,aAAa;QACvB,mBAAmB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC;YACb,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,aAAa;YACb,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,iCAAiC;IACjC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAEhF,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,iBAAiB,IAAI,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC/E,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAqB,MAAM,UAAU,CAAC;AAmDzF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAe,EACf,YAAqC,UAAU,CAAC,KAAK;IAErD,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,cAAc,EAAE;YAC9C,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,kCAAkC,OAAO,KAAM,CAAW,CAAC,OAAO,EAAE,CACrE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,iCAAiC,GAAG,CAAC,MAAM,EAAE,CAC9C,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAA0C,CAAC;IAC5D,MAAM,QAAQ,GAAI,GAAG,EAAE,KAAgB,IAAI,EAAE,CAAC;IAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,8CAA8C;YAC9C,kCAAkC,CACnC,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,uBAAuB;IACvB,MAAM,aAAa,GAChB,IAAI,CAAC,aAAoC;QACzC,GAAG,EAAE,QAA+B;QACrC,kCAAkC,EAAE;QACpC,EAAE,CAAC;IAEL,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,8CAA8C;YAC9C,gFAAgF,CACjF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;AACrC,CAAC;AAED,8DAA8D;AAC9D,SAAS,kCAAkC;IACzC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,qBAAqB,CAAC,CAAC;IAChE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAA4B,CAAC;QAC3E,OAAQ,GAAG,CAAC,aAAoC,IAAI,IAAI,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAAW,EACX,WAA4B,OAAO,CAAC,QAAQ;IAE5C,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/D,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,6BAA6B,EAAE,GAAG,CAAC,EAAE,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE;YACtB,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,YAAY,CAAC,EAAU;IAC9B,IAAI,MAAiD,CAAC;IACtD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QAC/C,MAAM,GAAG,UAAU,CACjB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,EAAE,GAAG,MAAM,kCAAkC,CAAC,CAAC,EAC/F,EAAE,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO;QACL,OAAO;QACP,MAAM,EAAE,GAAG,EAAE;YACX,IAAI,MAAM,KAAK,SAAS;gBAAE,YAAY,CAAC,MAAM,CAAC,CAAC;QACjD,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACzB,CAAC;QAC7B,OAAO,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF;;;GAGG;AACH,KAAK,UAAU,eAAe,CAC5B,OAAe,EACf,KAAa,EACb,YAAqC,UAAU,CAAC,KAAK;IAErD,MAAM,SAAS,GAAG,wBAAwB,EAAE,CAAC;IAC7C,IAAI,CAAC,SAAS;QAAE,OAAO;IAEvB,MAAM,EAAE,8BAA8B,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAC1E,sCAAsC,CACvC,CAAC;IAEF,MAAM,KAAK,GAAG,mBAAmB,CAAC;QAChC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CACf,8BAA8B,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC;KACrD,CAAC,CAAC;IAEH,MAAM,KAAK,CAAC,cAAc,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,0DAA0D;AAC1D,SAAS,wBAAwB;IAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;IACrE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAEtD,CAAC;QACF,OAAO,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAWD,SAAS,yBAAyB;IAChC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,qBAAqB,CAAC,CAAC;IACzE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CASzB,CAAC;QACF,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,EAAE,OAAO;YAAE,OAAO,IAAI,CAAC;QAEtD,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,aAAa,EACX,MAAM,CAAC,aAAa;gBACpB,GAAG,CAAC,aAAa;gBACjB,SAAS;SACZ,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAkB;IAC/C,MAAM,EACJ,OAAO,EACP,MAAM,EACN,OAAO,EACP,aAAa,EACb,KAAK,EACL,SAAS,GAAG,UAAU,CAAC,KAAK,EAC5B,aAAa,GAAG,WAAW,EAC3B,gBAAgB,GAAG,mBAAmB,EACtC,oBAAoB,GAAG,kBAAkB,GAC1C,GAAG,IAAI,CAAC;IAET,wBAAwB;IACxB,EAAE;IACF,2EAA2E;IAC3E,oEAAoE;IACpE,4EAA4E;IAC5E,+CAA+C;IAC/C,EAAE;IACF,wEAAwE;IACxE,2EAA2E;IAC3E,2EAA2E;IAC3E,wDAAwD;IACxD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjC,IACE,MAAM,KAAK,IAAI;QACf,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC;QACjC,mBAAmB,CAAC,OAAO,CAAC;QAC5B,CAAC,KAAK,EACN,CAAC;QACD,GAAG,CAAC,IAAI,CACN,uEAAuE,CACxE,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;IAED,yDAAyD;IACzD,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,MAAM,qBAAqB,CAC7D,OAAO,EACP,SAAS,CACV,CAAC;IAEF,gBAAgB;IAChB,MAAM,YAAY,GAAG,eAAe,CAAC,EAAE,CAAC,CAAC;IACzC,MAAM,aAAa,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,CAAC,CAAC;IAElC,kCAAkC;IAClC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxE,MAAM,WAAW,GAAG,oBAAoB,IAAI,WAAW,CAAC;IAExD,qBAAqB;IACrB,MAAM,OAAO,GACX,GAAG,aAAa,aAAa;QAC7B,IAAI,eAAe,CAAC;YAClB,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,qCAAqC;YAC5C,qEAAqE;YACrE,0EAA0E;YAC1E,yEAAyE;YACzE,0EAA0E;YAC1E,wEAAwE;YACxE,uEAAuE;YACvE,yEAAyE;YACzE,0BAA0B;YAC1B,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,aAAa;YACvB,YAAY,EAAE,WAAW;YACzB,cAAc,EAAE,aAAa;YAC7B,qBAAqB,EAAE,MAAM;YAC7B,KAAK;SACN,CAAC,CAAC,QAAQ,EAAE,CAAC;IAEhB,mBAAmB;IACnB,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,EAAE,CAAC;IAEd,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,6CAA6C,CAAC,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,uCAAuC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,wCAAwC,CAAC,CACpD,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC,CAAC;IAE1D,wCAAwC;IACxC,IAAI,IAAY,CAAC;IACjB,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,UAAU,EAAE,CAAC;IACrB,CAAC;IAED,+CAA+C;IAC/C,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC;QACzC,aAAa;QACb,QAAQ,EAAE,QAAQ;QAClB,IAAI;QACJ,YAAY;QACZ,WAAW;QACX,QAAQ,EAAE,aAAa;QACvB,SAAS;KACV,CAAC,CAAC;IAEH,2DAA2D;IAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;IAE/D,wBAAwB;IACxB,MAAM,UAAU,GAAe;QAC7B,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,YAAY,EAAE,MAAM,CAAC,aAAa;QAClC,OAAO,EAAE,MAAM,CAAC,QAAQ;QACxB,SAAS;QACT,aAAa;QACb,QAAQ;QACR,aAAa;KACd,CAAC;IACF,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAE/B,yEAAyE;IACzE,yEAAyE;IACzE,sDAAsD;IACtD,oBAAoB,EAAE,CAAC;IAEvB,+CAA+C;IAC/C,IAAI,CAAC;QACH,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC/D,GAAG,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,aAAa;IACf,CAAC;IAED,eAAe;IACf,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClD,GAAG,CAAC,EAAE,CAAC,gBAAgB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAE5C,mDAAmD;IACnD,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAEvG,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,4BAA4B,CACzC,IAAkB,EAClB,OAAe,EACf,KAAa,EACb,SAAuB;IAEvB,MAAM,iBAAiB,GAAG,IAAI,CAAC,mBAAmB,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAC7H,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,IAAI,uBAAuB,CAAC;IAChE,IAAI,aAAoC,CAAC;IACzC,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,aAAa,GAAG,IAAI,CAAC;IACvB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE;QACrD,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QACzE,QAAQ,EAAE,IAAI,CAAC,oBAAoB;KACpC,CAAC,CAAC;IAEH,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC9B,GAAG,CAAC,EAAE,CAAC,iBAAiB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClE,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,IAAI,CAAC,sCAAsC,MAAM,CAAC,YAAY,CAAC,IAAI,4BAA4B,MAAM,CAAC,YAAY,CAAC,EAAE,kCAAkC,CAAC,CAAC;YAC/J,CAAC;YACD,OAAO,MAAM,CAAC,YAAY,CAAC;QAC7B,CAAC;QACD,KAAK,WAAW;YACd,GAAG,CAAC,IAAI,CAAC,4HAA4H,CAAC,CAAC;YACvI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC;QACd,KAAK,YAAY;YACf,GAAG,CAAC,IAAI,CAAC,oBAAoB,MAAM,CAAC,SAAS,uDAAuD,CAAC,CAAC;YACtG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC;QACd,KAAK,aAAa;YAChB,GAAG,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;YAC7F,OAAO,IAAI,CAAC;QACd,KAAK,MAAM;YACT,0DAA0D;YAC1D,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAGrC;IACC,MAAM,SAAS,GAAG,yBAAyB,EAAE,CAAC;IAC9C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,aAAa,GACjB,SAAS,CAAC,aAAa;QACvB,mBAAmB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC;YACb,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,aAAa;YACb,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,iCAAiC;IACjC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}

package/dist/mcp/auth/agent-sign-ins.js

@@ -0,0 +1,174 @@
+/**
+ * The sign-ins the user's agents already hold for an MCP server.
+ *
+ * Putting the proxy in front of a server used to cost a second OAuth sign-in
+ * in the browser, for every server Claude Code or Codex was already signed in
+ * to. `vibedefend connect` now takes over the agent's sign-in first: once the
+ * entry is wrapped, the agent reaches that server through the proxy and no
+ * longer uses its own copy.
+ *
+ * What is read, and only for the EXACT server asked for (canonical URL, as
+ * the proxy's own store is keyed):
+ *
+ *  - Claude Code: the `mcpOAuth` map of the `Claude Code-credentials` macOS
+ *    keychain item, and of `~/.claude/.credentials.json` (where Claude Code
+ *    keeps it off macOS; `CLAUDE_CONFIG_DIR` moves it). Claude Code writes
+ *    that item with the `security` tool, so reading it asks nothing.
+ *  - Codex: its file store, `$CODEX_HOME/.credentials.json` (default
+ *    `~/.codex`). Never its keychain items: Codex writes them through the
+ *    native keychain API, so `security` cannot read them without macOS asking
+ *    the user, once per server (measured 2026-10-20: errSecUserCanceled).
+ *
+ * Cursor and Windsurf keep theirs in their own databases: not read.
+ *
+ * `VIBEDEFEND_AGENT_SIGN_INS=off` reads none of it (the test suite sets it:
+ * no test may read the developer's credentials). `vibedefend connect
+ * --no-reuse` does the same for one run.
+ *
+ * Never throws, never logs: an unreadable store is an empty one, and what is
+ * read is a credential.
+ */
+import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { homedir, userInfo } from 'node:os';
+import { join } from 'node:path';
+import { canonicalMcpUrl } from './oauth.js';
+/** How each agent is named to the user. */
+export const AGENT_SIGN_IN_LABELS = {
+    'claude-code': 'Claude Code',
+    codex: 'Codex',
+};
+const CLAUDE_CODE_KEYCHAIN_SERVICE = 'Claude Code-credentials';
+/** Every sign-in the agents hold for `serverUrl`, Claude Code first. */
+export function findAgentSignIns(serverUrl, deps = {}) {
+    const wanted = canonicalMcpUrl(serverUrl);
+    if (!wanted)
+        return [];
+    const env = deps.env ?? process.env;
+    if (env.VIBEDEFEND_AGENT_SIGN_INS === 'off')
+        return [];
+    const home = env.HOME ?? env.USERPROFILE ?? homedir();
+    const found = [];
+    const add = (signIn) => {
+        if (!signIn)
+            return;
+        const duplicate = found.some((known) => known.clientId === signIn.clientId &&
+            known.accessToken === signIn.accessToken &&
+            known.refreshToken === signIn.refreshToken);
+        if (!duplicate)
+            found.push(signIn);
+    };
+    if ((deps.platform ?? process.platform) === 'darwin') {
+        const read = deps.readKeychain ?? readMacOSKeychain;
+        const blob = quietly(() => read(CLAUDE_CODE_KEYCHAIN_SERVICE, deps.username ?? loginName()));
+        for (const signIn of claudeCodeSignIns(blob, wanted))
+            add(signIn);
+    }
+    const claudeDir = env.CLAUDE_CONFIG_DIR ?? join(home, '.claude');
+    for (const signIn of claudeCodeSignIns(readQuietly(join(claudeDir, '.credentials.json')), wanted))
+        add(signIn);
+    const codexDir = env.CODEX_HOME ?? join(home, '.codex');
+    for (const signIn of codexSignIns(readQuietly(join(codexDir, '.credentials.json')), wanted))
+        add(signIn);
+    return found;
+}
+function claudeCodeSignIns(blob, wanted) {
+    const data = parseObject(blob);
+    const entries = data && isObject(data.mcpOAuth) ? Object.values(data.mcpOAuth) : [];
+    return entries.flatMap((entry) => {
+        if (!isObject(entry) || !sameServer(entry.serverUrl, wanted))
+            return [];
+        const signIn = signInFrom('claude-code', {
+            accessToken: entry.accessToken,
+            refreshToken: entry.refreshToken,
+            expiresAt: entry.expiresAt,
+            clientId: entry.clientId,
+            clientSecret: entry.clientSecret,
+            issuer: entry.issuer,
+        });
+        return signIn ? [signIn] : [];
+    });
+}
+function codexSignIns(blob, wanted) {
+    const data = parseObject(blob);
+    return Object.values(data ?? {}).flatMap((entry) => {
+        if (!isObject(entry) || !sameServer(entry.server_url ?? entry.url, wanted))
+            return [];
+        const response = isObject(entry.token_response) ? entry.token_response : {};
+        const signIn = signInFrom('codex', {
+            accessToken: entry.access_token ?? response.access_token,
+            refreshToken: entry.refresh_token ?? response.refresh_token,
+            expiresAt: entry.expires_at,
+            clientId: entry.client_id,
+            clientSecret: entry.client_secret,
+            issuer: null,
+        });
+        return signIn ? [signIn] : [];
+    });
+}
+function signInFrom(source, raw) {
+    const clientId = text(raw.clientId);
+    const accessToken = text(raw.accessToken);
+    const refreshToken = text(raw.refreshToken);
+    if (!clientId || (!accessToken && !refreshToken))
+        return null;
+    return {
+        source,
+        accessToken,
+        refreshToken,
+        expiresAt: epochMs(raw.expiresAt),
+        clientId,
+        clientSecret: text(raw.clientSecret),
+        issuer: text(raw.issuer),
+    };
+}
+function sameServer(url, wanted) {
+    return typeof url === 'string' && canonicalMcpUrl(url) === wanted;
+}
+/** Claude Code and Codex record milliseconds; a value below 1e11 can only be seconds. */
+function epochMs(value) {
+    if (typeof value !== 'number' || !Number.isFinite(value) || value <= 0)
+        return null;
+    return value < 1e11 ? value * 1000 : value;
+}
+function text(value) {
+    return typeof value === 'string' && value !== '' ? value : null;
+}
+function isObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function parseObject(blob) {
+    if (!blob)
+        return null;
+    try {
+        const parsed = JSON.parse(blob);
+        return isObject(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function quietly(read) {
+    try {
+        return read();
+    }
+    catch {
+        return null;
+    }
+}
+function readQuietly(path) {
+    return quietly(() => readFileSync(path, 'utf8'));
+}
+function loginName() {
+    try {
+        return userInfo().username;
+    }
+    catch {
+        return undefined;
+    }
+}
+function readMacOSKeychain(service, account) {
+    const blob = execFileSync('security', ['find-generic-password', '-s', service, ...(account === undefined ? [] : ['-a', account]), '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 2000 }).trim();
+    return blob === '' ? null : blob;
+}
+//# sourceMappingURL=agent-sign-ins.js.map

package/dist/mcp/auth/agent-sign-ins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-sign-ins.js","sourceRoot":"","sources":["../../../src/mcp/auth/agent-sign-ins.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAI7C,2CAA2C;AAC3C,MAAM,CAAC,MAAM,oBAAoB,GAAsC;IACrE,aAAa,EAAE,aAAa;IAC5B,KAAK,EAAE,OAAO;CACf,CAAC;AA4BF,MAAM,4BAA4B,GAAG,yBAAyB,CAAC;AAE/D,wEAAwE;AACxE,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,OAAwB,EAAE;IAC5E,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,IAAI,GAAG,CAAC,yBAAyB,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IACvD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,WAAW,IAAI,OAAO,EAAE,CAAC;IAEtD,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,CAAC,MAA0B,EAAQ,EAAE;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAC1B,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;YAClC,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;YACxC,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,CAC7C,CAAC;QACF,IAAI,CAAC,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,IAAI,iBAAiB,CAAC;QACpD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,4BAA4B,EAAE,IAAI,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC;QAC7F,KAAK,MAAM,MAAM,IAAI,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC;YAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACjE,KAAK,MAAM,MAAM,IAAI,iBAAiB,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,EAAE,MAAM,CAAC;QAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAE/G,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACxD,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC,EAAE,MAAM,CAAC;QAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAEzG,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAmB,EAAE,MAAc;IAC5D,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QAC/B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACxE,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,EAAE;YACvC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,IAAmB,EAAE,MAAc;IACvD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QACjD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACtF,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,EAAE;YACjC,WAAW,EAAE,KAAK,CAAC,YAAY,IAAI,QAAQ,CAAC,YAAY;YACxD,YAAY,EAAE,KAAK,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa;YAC3D,SAAS,EAAE,KAAK,CAAC,UAAU;YAC3B,QAAQ,EAAE,KAAK,CAAC,SAAS;YACzB,YAAY,EAAE,KAAK,CAAC,aAAa;YACjC,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CACjB,MAAyB,EACzB,GAA2G;IAE3G,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO;QACL,MAAM;QACN,WAAW;QACX,YAAY;QACZ,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QACjC,QAAQ;QACR,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;QACpC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;KACzB,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,GAAY,EAAE,MAAc;IAC9C,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC;AACpE,CAAC;AAED,yFAAyF;AACzF,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpF,OAAO,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AAC7C,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAClE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,WAAW,CAAC,IAAmB;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,IAAyB;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,SAAS;IAChB,IAAI,CAAC;QACH,OAAO,QAAQ,EAAE,CAAC,QAAQ,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,OAAgB;IAC1D,MAAM,IAAI,GAAG,YAAY,CACvB,UAAU,EACV,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,EACjG,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CACzE,CAAC,IAAI,EAAE,CAAC;IACT,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACnC,CAAC"}

package/dist/mcp/auth/callback.js

@@ -0,0 +1,200 @@
+/**
+ * The loopback callback server of the MCP authorization flow (RFC 8252).
+ *
+ * ─── Why `state` and `iss` are checked HERE ─────────────────────────────────
+ *
+ * `discovery.ts` binds the authorization server's metadata to the MCP server
+ * being asked. That check closes an INSTANCE of the mix-up, not the class:
+ * the attacker only has to host a 302 on THEIR OWN `authorization_endpoint`
+ * — an endpoint that opens in the BROWSER, never fetched by us, so
+ * structurally invisible to anything we could check on the metadata. The
+ * browser then lands on the REAL consent page of a genuine third party, with
+ * THEIR `client_id` and OUR `code_challenge`; that third party redirects to
+ * our loopback with a code that is VALID AT THEIR END. Without a further
+ * defence the exchange would send that code — and our `code_verifier` — to
+ * the attacker's SELF-DECLARED `token_endpoint`.
+ *
+ * Two standard defences answer that:
+ *
+ *   • `state` — random, single-use, bound to THIS attempt. A response
+ *     carrying an unknown or ALREADY CONSUMED state is rejected. It closes
+ *     the class UNCONDITIONALLY as an anti-CSRF measure, and depends on no
+ *     capability of the third party.
+ *   • `iss` (RFC 9207) — the issuer announced BY THE AUTHORIZATION RESPONSE
+ *     ITSELF, so by the REAL third party that handled it and never by a
+ *     document the attacker controls, must be exactly the one discovery kept
+ *     for this MCP server.
+ *
+ * `iss` only closes the class if the real third party actually sends `iss`,
+ * which nothing guarantees: most authorization servers deployed today do not
+ * implement RFC 9207. And `issParameterSupported` is itself read from the
+ * metadata of the authorization server the HOSTILE server designated — the
+ * attacker only has to OMIT the field for the guarantee never to arm, then
+ * aim at a genuine non-RFC-9207 third party. `state` does not cover that
+ * case either: the attacker's `authorization_endpoint` SEES our `state`
+ * before redirecting and can simply pass it along.
+ *
+ * There is therefore **no purely technical client-side check that closes this
+ * class when the AS does not emit `iss`** — which is precisely why RFC 9207
+ * exists. The decision is one of POLICY, taken in `connect.ts`: by default
+ * the flow warns and goes on when `issParameterSupported !== true` (RFC 9207
+ * is absent from nearly every public server measured, and the issuer is
+ * still the one discovery bound to the resource); `strictIssuer` — the
+ * `--strict-issuer` flag, or the organisation's policy (`strictIssuer`,
+ * served by the backend) — turns that into a refusal before any browser
+ * opens.
+ *
+ * Both checks live in this file, BEFORE the redirect promise resolves:
+ * `code` and `code_verifier` structurally CANNOT reach the exchange until
+ * they have passed. It is not a question of call order in the caller — the
+ * code does not exist anywhere else before that.
+ *
+ * Moved from `682d413:src/mcp/login.ts:194-396` and translated.
+ */
+import { createServer } from 'node:http';
+/**
+ * Raised by the loopback callback server. Never a free-form string: a closed
+ * `kind`, so the caller can tell `issuer-mismatch` — the heart of the RFC
+ * 9207 defence — from the rest without parsing a message.
+ */
+export class AuthorizationRedirectError extends Error {
+    kind;
+    constructor(kind, message) {
+        super(message);
+        this.kind = kind;
+        this.name = 'AuthorizationRedirectError';
+    }
+}
+const CALLBACK_PATH = '/mcp-oauth-callback';
+/**
+ * Strips one or more trailing slashes. RFC 9207 and RFC 8414 both tolerate an
+ * issuer with or without a trailing `/` (the same normalisation `issuerId`
+ * applies in `discovery.ts`), and conforming third parties — Auth0 among
+ * others — commonly emit one. The CASE is left alone: RFC 9207 §2.4 mandates
+ * simple string comparison.
+ */
+function stripTrailingSlash(value) {
+    return value.replace(/\/+$/, '');
+}
+const SUCCESS_PAGE = '<!DOCTYPE html><html><head><meta charset="utf-8"><title>VibeDefend</title></head>' +
+    '<body style="font-family: system-ui, sans-serif; padding: 3rem; text-align: center">' +
+    '<h1>Authentication successful</h1>' +
+    '<p>VibeDefend has the token for this MCP server. You can close this tab.</p>' +
+    '</body></html>';
+/**
+ * The real implementation: a loopback HTTP server (127.0.0.1 only, never
+ * 0.0.0.0) on a port the OS assigns. RFC 8252 recommends a random port for a
+ * native client, and `registerMcpClient` registers THIS exact `redirect_uri`
+ * dynamically, so no fixed port is needed — unlike `vibedefend login`, which
+ * targets a client pre-registered with Logto.
+ *
+ * Single use: once the response has been consumed, any further request — even
+ * with the right `state` — is refused rather than replayed.
+ */
+export async function startMcpAuthorizationCallbackServer(expectedState, expectedIssuer, issParameterRequired, options = {}) {
+    let settled = false;
+    let resolveRedirect;
+    let rejectRedirect;
+    const redirectPromise = new Promise((res, rej) => {
+        resolveRedirect = res;
+        rejectRedirect = rej;
+    });
+    const server = createServer((req, res) => {
+        const url = new URL(req.url ?? '/', 'http://127.0.0.1');
+        if (url.pathname !== CALLBACK_PATH) {
+            res.writeHead(404).end();
+            return;
+        }
+        if (settled) {
+            res
+                .writeHead(400, { 'Content-Type': 'text/plain' })
+                .end('This authorization response was already used.');
+            return;
+        }
+        // 1) `state` — anti-CSRF, single use. Checked BEFORE `error`: RFC 6749
+        // §4.1.2.1 requires `state` on an error response too, and a hostile MCP
+        // server could otherwise pass an anonymous `?error=access_denied` off as
+        // an EXPLICIT refusal by the user.
+        //
+        // What this ordering is NOT: protection against a third party denying a
+        // login in progress. Any page open in the browser that knows the port —
+        // and the port is in `redirect_uri` — burns the attempt identically with
+        // or without it; only the LABEL changes, and the real callback that
+        // follows gets a 400 "already used" either way. Continuing to listen
+        // after a suspicious request would widen the window rather than close it:
+        // an unknown `state` on this ephemeral port is already either a mistake
+        // or a probe, never something to give a second chance. What the ordering
+        // does buy is a CORRECT diagnosis (`state-mismatch`, not `denied`) when
+        // the request that burned the attempt never knew the state.
+        const state = url.searchParams.get('state');
+        if (!state || state !== expectedState) {
+            settled = true;
+            res.writeHead(400, { 'Content-Type': 'text/plain' }).end('Invalid or already-consumed state.');
+            rejectRedirect(new AuthorizationRedirectError('state-mismatch', 'authorization response carried an unknown or already-consumed state'));
+            return;
+        }
+        const error = url.searchParams.get('error');
+        if (error) {
+            settled = true;
+            res.writeHead(400, { 'Content-Type': 'text/plain' }).end('Authorization was not granted.');
+            rejectRedirect(new AuthorizationRedirectError('denied', 'the user denied authorization, or the authorization server refused'));
+            return;
+        }
+        // 2) `iss` (RFC 9207) — see the module header. An `iss` that is PRESENT
+        // and does not match is ALWAYS a rejection; an `iss` that is ABSENT is
+        // one only when the AS announced it would always send one. Compared on
+        // the NORMALISED form: a CONFORMING RFC 9207 issuer ending in `/` (the
+        // Auth0 pattern, `https://tenant.eu.auth0.com/`) was refused by an exact
+        // comparison, reproducing on this axis the flaw that condemned the origin
+        // check — refusing conforming deployments. The CASE stays compared as is:
+        // RFC 9207 §2.4 mandates simple string comparison, and `issuerId` in
+        // `discovery.ts` does not normalise it either.
+        const iss = url.searchParams.get('iss');
+        if (iss !== null) {
+            if (stripTrailingSlash(iss) !== stripTrailingSlash(expectedIssuer)) {
+                settled = true;
+                res.writeHead(400, { 'Content-Type': 'text/plain' }).end('Issuer mismatch.');
+                rejectRedirect(new AuthorizationRedirectError('issuer-mismatch', 'authorization response `iss` does not match the issuer discovered for this MCP server'));
+                return;
+            }
+        }
+        else if (issParameterRequired) {
+            settled = true;
+            res
+                .writeHead(400, { 'Content-Type': 'text/plain' })
+                .end('Missing required issuer parameter.');
+            rejectRedirect(new AuthorizationRedirectError('issuer-mismatch', 'authorization server declares RFC 9207 support but the response is missing `iss`'));
+            return;
+        }
+        const code = url.searchParams.get('code');
+        if (!code) {
+            settled = true;
+            res.writeHead(400, { 'Content-Type': 'text/plain' }).end('Missing authorization code.');
+            rejectRedirect(new AuthorizationRedirectError('missing-code', 'authorization response is missing the authorization code'));
+            return;
+        }
+        settled = true;
+        res.writeHead(200, { 'Content-Type': 'text/html' }).end(SUCCESS_PAGE);
+        resolveRedirect({ code, iss });
+    });
+    const port = options.port ?? 0;
+    await new Promise((resolve, reject) => {
+        server.once('error', (error) => {
+            reject(port === 0
+                ? error
+                : new Error(`cannot listen on 127.0.0.1:${port} for the authorization callback: ${error.message}`));
+        });
+        server.listen(port, '127.0.0.1', resolve);
+    });
+    const addr = server.address();
+    const stop = () => new Promise((resolve) => {
+        server.closeAllConnections?.();
+        server.close(() => resolve());
+    });
+    return { port: addr.port, redirectPromise, stop };
+}
+/** The `redirect_uri` for a callback server listening on `port`. */
+export function callbackRedirectUri(port) {
+    return `http://127.0.0.1:${port}${CALLBACK_PATH}`;
+}
+//# sourceMappingURL=callback.js.map

package/dist/mcp/auth/callback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback.js","sourceRoot":"","sources":["../../../src/mcp/auth/callback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAoCzC;;;;GAIG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAExC;IADX,YACW,IAAsE,EAC/E,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,SAAI,GAAJ,IAAI,CAAkE;QAI/E,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,aAAa,GAAG,qBAAqB,CAAC;AAE5C;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,YAAY,GAChB,mFAAmF;IACnF,sFAAsF;IACtF,oCAAoC;IACpC,8EAA8E;IAC9E,gBAAgB,CAAC;AAEnB;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,aAAqB,EACrB,cAAsB,EACtB,oBAA6B,EAC7B,UAAiC,EAAE;IAEnC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,eAAoD,CAAC;IACzD,IAAI,cAAmC,CAAC;IACxC,MAAM,eAAe,GAAG,IAAI,OAAO,CAAwB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACtE,eAAe,GAAG,GAAG,CAAC;QACtB,cAAc,GAAG,GAAG,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;YACnC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,GAAG;iBACA,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;iBAChD,GAAG,CAAC,+CAA+C,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,yEAAyE;QACzE,mCAAmC;QACnC,EAAE;QACF,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,oEAAoE;QACpE,qEAAqE;QACrE,0EAA0E;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,4DAA4D;QAC5D,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;YACtC,OAAO,GAAG,IAAI,CAAC;YACf,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;YAC/F,cAAc,CACZ,IAAI,0BAA0B,CAC5B,gBAAgB,EAChB,qEAAqE,CACtE,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,GAAG,IAAI,CAAC;YACf,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;YAC3F,cAAc,CACZ,IAAI,0BAA0B,CAC5B,QAAQ,EACR,oEAAoE,CACrE,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,wEAAwE;QACxE,uEAAuE;QACvE,uEAAuE;QACvE,uEAAuE;QACvE,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,qEAAqE;QACrE,+CAA+C;QAC/C,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,kBAAkB,CAAC,cAAc,CAAC,EAAE,CAAC;gBACnE,OAAO,GAAG,IAAI,CAAC;gBACf,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;gBAC7E,cAAc,CACZ,IAAI,0BAA0B,CAC5B,iBAAiB,EACjB,uFAAuF,CACxF,CACF,CAAC;gBACF,OAAO;YACT,CAAC;QACH,CAAC;aAAM,IAAI,oBAAoB,EAAE,CAAC;YAChC,OAAO,GAAG,IAAI,CAAC;YACf,GAAG;iBACA,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;iBAChD,GAAG,CAAC,oCAAoC,CAAC,CAAC;YAC7C,cAAc,CACZ,IAAI,0BAA0B,CAC5B,iBAAiB,EACjB,kFAAkF,CACnF,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,GAAG,IAAI,CAAC;YACf,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;YACxF,cAAc,CACZ,IAAI,0BAA0B,CAC5B,cAAc,EACd,0DAA0D,CAC3D,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,OAAO,GAAG,IAAI,CAAC;QACf,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACtE,eAAe,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;IAC/B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;YACpC,MAAM,CACJ,IAAI,KAAK,CAAC;gBACR,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,IAAI,KAAK,CAAC,8BAA8B,IAAI,oCAAoC,KAAK,CAAC,OAAO,EAAE,CAAC,CACrG,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAsB,CAAC;IAClD,MAAM,IAAI,GAAG,GAAkB,EAAE,CAC/B,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACtB,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC;QAC/B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEL,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,oBAAoB,IAAI,GAAG,aAAa,EAAE,CAAC;AACpD,CAAC"}