@databasin/mcp-client 0.2.0-beta.1 → 0.2.1

package/dist/auth.js

@@ -1,234 +1,22 @@
-import { InteractionRequiredAuthError } from '@azure/msal-node';
-import { openSystemBrowser } from './browser.js';
-import { createSecurePublicClient } from './credential-store.js';
-import { DataBasinError, LoginRequiredError } from './errors.js';
-import { projectDevicePrompt, validateInteractiveLoginUrl } from './login-url.js';
-import { accountMatchesProfile, validateAccessTokenResult } from './token-validation.js';
+import { Auth0Manager } from './auth0.js';
+import { EntraAuthManager } from './entra-auth.js';
+export { createSecurePublicClient } from './credential-store.js';
+/** Use the configured provider. Never treat a cached Entra login as an Auth0 session. */
 export class AuthManager {
     profile;
-    clientPromise;
-    tokenPromise;
-    activeLogin;
-    lastLoginFailed = false;
-    createClient;
-    openBrowser;
-    now;
+    provider;
     constructor(profile, options = {}) {
         this.profile = profile;
-        this.createClient = options.createClient ?? (() => createSecurePublicClient(profile));
-        this.openBrowser = options.openBrowser ?? openSystemBrowser;
-        this.now = options.now ?? Date.now;
-    }
-    async getAccessToken() {
-        this.tokenPromise ??= this.acquireSilent().finally(() => {
-            this.tokenPromise = undefined;
-        });
-        return this.tokenPromise;
-    }
-    async login() {
-        return this.performInteractiveLogin(this.openBrowser);
-    }
-    async startLogin() {
-        const status = await this.getLoginStatus();
-        if (status.status === 'authenticated' || status.status === 'pending')
-            return status;
-        const login = this.beginDeviceLogin();
-        const outcome = await Promise.race([
-            login.prompted.then((prompt) => ({ state: 'prompted', prompt })),
-            login.completion.then(() => ({ state: 'completed' }), () => ({ state: 'failed' }))
-        ]);
-        if (outcome.state === 'completed') {
-            return this.assistantResult('authenticated', null, `DataBasin ${this.profile.label} sign-in is complete.`);
-        }
-        if (outcome.state === 'failed') {
-            return this.assistantResult('failed', null, `DataBasin ${this.profile.label} sign-in did not complete. Call databasin_login to try again.`);
-        }
-        return this.assistantResult('pending', outcome.prompt.verificationUri, `Open the Microsoft sign-in URL on any device and enter code ${outcome.prompt.userCode}. Then call databasin_auth_status.`, outcome.prompt.userCode, login.expiresAt);
-    }
-    cancelPendingLogin() {
-        this.activeLogin?.cancel();
-    }
-    async getLoginStatus() {
-        if (this.activeLogin)
-            return this.pendingAssistantResult(this.activeLogin);
-        const authenticated = await this.cachedAssistantResult();
-        if (authenticated)
-            return authenticated;
-        if (this.lastLoginFailed)
-            return this.failedAssistantResult();
-        return this.assistantResult('not_authenticated', null, `DataBasin ${this.profile.label} is not signed in. Call databasin_login to begin.`);
-    }
-    pendingAssistantResult(login) {
-        const message = login.prompt
-            ? `Open the Microsoft sign-in URL on any device and enter code ${login.prompt.userCode}.`
-            : 'Microsoft is preparing the device sign-in instructions.';
-        return this.assistantResult('pending', login.prompt?.verificationUri ?? null, message, login.prompt?.userCode, login.expiresAt);
-    }
-    async cachedAssistantResult() {
-        const cachedStatus = await this.status();
-        if (!cachedStatus.authenticated)
-            return undefined;
-        try {
-            await this.getAccessToken();
-            return this.assistantResult('authenticated', null, `DataBasin ${this.profile.label} is signed in.`);
-        }
-        catch (error) {
-            if (error instanceof DataBasinError && error.code === 'UNAUTHENTICATED')
-                return undefined;
-            throw error;
-        }
-    }
-    failedAssistantResult() {
-        return this.assistantResult('failed', null, `DataBasin ${this.profile.label} sign-in did not complete. Call databasin_login to try again.`);
-    }
-    beginDeviceLogin() {
-        if (this.activeLogin)
-            return this.activeLogin;
-        this.lastLoginFailed = false;
-        let resolvePrompted = () => undefined;
-        let cancelRequested = false;
-        let deviceRequest;
-        const login = {
-            prompted: new Promise((resolve) => {
-                resolvePrompted = resolve;
-            }),
-            completion: Promise.resolve({ authenticated: false, environment: this.profile.environment }),
-            prompt: undefined,
-            expiresAt: undefined,
-            cancel: () => {
-                cancelRequested = true;
-                if (deviceRequest)
-                    deviceRequest.cancel = true;
-            }
-        };
-        login.completion = this.performDeviceLogin((prompt) => {
-            login.prompt = prompt;
-            login.expiresAt = new Date(this.now() + prompt.expiresIn * 1_000).toISOString();
-            resolvePrompted(prompt);
-        }, (request) => {
-            deviceRequest = request;
-            if (cancelRequested)
-                request.cancel = true;
-        }).catch((error) => {
-            this.lastLoginFailed = true;
-            throw error;
-        }).finally(() => {
-            if (this.activeLogin === login)
-                this.activeLogin = undefined;
-        });
-        this.activeLogin = login;
-        void login.completion.catch(() => undefined);
-        return login;
-    }
-    async performDeviceLogin(onPrompt, onRequest) {
-        const client = await this.client();
-        let result;
-        try {
-            const request = {
-                scopes: [...this.profile.scopes],
-                timeout: 900,
-                cancel: false,
-                deviceCodeCallback: (response) => onPrompt(projectDevicePrompt(response))
-            };
-            onRequest(request);
-            result = await client.acquireTokenByDeviceCode(request);
-        }
-        catch {
-            throw new DataBasinError('UNAUTHENTICATED', `DataBasin ${this.profile.label} sign-in did not complete.`);
-        }
-        return this.completeLogin(client, result);
-    }
-    async performInteractiveLogin(openBrowser) {
-        const client = await this.client();
-        let result;
-        try {
-            result = await client.acquireTokenInteractive({
-                scopes: [...this.profile.scopes],
-                openBrowser: async (url) => openBrowser(validateInteractiveLoginUrl(url, this.profile)),
-                prompt: 'select_account',
-                successTemplate: successPage(this.profile.label),
-                errorTemplate: errorPage()
-            });
-        }
-        catch {
-            throw new DataBasinError('UNAUTHENTICATED', `DataBasin ${this.profile.label} sign-in did not complete.`);
-        }
-        return this.completeLogin(client, result);
-    }
-    async completeLogin(client, result) {
-        validateAccessTokenResult(result, this.profile, this.now());
-        const account = result.account;
-        const accounts = await client.getAllAccounts();
-        await Promise.all(accounts
-            .filter((cachedAccount) => cachedAccount.homeAccountId !== account.homeAccountId)
-            .map((account) => client.signOut({ account })));
-        return {
-            authenticated: true,
-            environment: this.profile.environment,
-            username: account.username
-        };
-    }
-    assistantResult(status, loginUrl, message, userCode, expiresAt) {
-        if (status !== 'pending') {
-            return { status, environment: this.profile.environment, loginUrl: null, message };
-        }
-        return {
-            status,
-            environment: this.profile.environment,
-            loginUrl,
-            ...(userCode ? { userCode } : {}),
-            ...(expiresAt ? { expiresAt } : {}),
-            message
-        };
-    }
-    async logout() {
-        const client = await this.client();
-        const accounts = await client.getAllAccounts();
-        await Promise.all(accounts.map((account) => client.signOut({ account })));
-        return accounts.length;
-    }
-    async status() {
-        const accounts = await (await this.client()).getAllAccounts();
-        const account = selectAccount(accounts, this.profile);
-        return account
-            ? { authenticated: true, environment: this.profile.environment, username: account.username }
-            : { authenticated: false, environment: this.profile.environment };
-    }
-    async acquireSilent() {
-        const client = await this.client();
-        const account = selectAccount(await client.getAllAccounts(), this.profile);
-        if (!account)
-            throw new LoginRequiredError(this.profile.environment);
-        try {
-            const result = await client.acquireTokenSilent({ account, scopes: [...this.profile.scopes] });
-            return validateAccessTokenResult(result, this.profile, this.now());
-        }
-        catch (error) {
-            if (error instanceof InteractionRequiredAuthError) {
-                throw new LoginRequiredError(this.profile.environment);
-            }
-            throw new DataBasinError('UNAUTHENTICATED', `The DataBasin ${this.profile.label} session could not be refreshed. Sign in again.`);
-        }
-    }
-    client() {
-        this.clientPromise ??= this.createClient().catch((error) => {
-            this.clientPromise = undefined;
-            const detail = error instanceof Error && error.message.includes('libsecret')
-                ? ' Install or unlock the system keyring and try again.'
-                : '';
-            throw new DataBasinError('UNAUTHENTICATED', `Secure DataBasin credential storage is unavailable.${detail}`);
-        });
-        return this.clientPromise;
-    }
-}
-function selectAccount(accounts, profile) {
-    return accounts.find((account) => accountMatchesProfile(account, profile));
-}
-function successPage(label) {
-    return `<!doctype html><html><body><h1>DataBasin sign-in complete</h1><p>You are signed in to ${label}. You can close this window.</p></body></html>`;
+        this.provider = profile.auth0
+            ? new Auth0Manager(profile, profile.auth0, options.auth0)
+            : new EntraAuthManager(profile, options.entra);
+    }
+    getAccessToken() { return this.provider.getAccessToken(); }
+    login() { return this.provider.login(); }
+    startLogin() { return this.provider.startLogin(); }
+    getLoginStatus() { return this.provider.getLoginStatus(); }
+    cancelPendingLogin() { this.provider.cancelPendingLogin(); }
+    logout() { return this.provider.logout(); }
+    status() { return this.provider.status(); }
 }
-function errorPage() {
-    return '<!doctype html><html><body><h1>DataBasin sign-in failed</h1><p>Return to your assistant or terminal and try again.</p></body></html>';
-}
-export { createSecurePublicClient } from './credential-store.js';
 //# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAG7B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EACL,mBAAmB,EACnB,2BAA2B,EAG5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAiEzF,MAAM,OAAO,WAAW;IAUX;IATH,aAAa,CAAwC;IACrD,YAAY,CAA8B;IAC1C,WAAW,CAA0B;IACrC,eAAe,GAAG,KAAK,CAAC;IACf,YAAY,CAAkC;IAC9C,WAAW,CAAiC;IAC5C,GAAG,CAAe;IAEnC,YACW,OAAyB,EAClC,UAA8B,EAAE;QADvB,YAAO,GAAP,OAAO,CAAkB;QAGlC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,iBAAiB,CAAC;QAC5D,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACtD,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;QAChC,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,KAAK;QACT,OAAO,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QAEpF,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YACjC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,UAAmB,EAAE,MAAM,EAAE,CAAC,CAAC;YACzE,KAAK,CAAC,UAAU,CAAC,IAAI,CACnB,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,WAAoB,EAAE,CAAC,EACvC,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,QAAiB,EAAE,CAAC,CACrC;SACF,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,eAAe,CACzB,eAAe,EACf,IAAI,EACJ,aAAa,IAAI,CAAC,OAAO,CAAC,KAAK,uBAAuB,CACvD,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,eAAe,CACzB,QAAQ,EACR,IAAI,EACJ,aAAa,IAAI,CAAC,OAAO,CAAC,KAAK,+DAA+D,CAC/F,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CACzB,SAAS,EACT,OAAO,CAAC,MAAM,CAAC,eAAe,EAC9B,+DAA+D,OAAO,CAAC,MAAM,CAAC,QAAQ,oCAAoC,EAC1H,OAAO,CAAC,MAAM,CAAC,QAAQ,EACvB,KAAK,CAAC,SAAS,CAChB,CAAC;IACJ,CAAC;IAED,kBAAkB;QAChB,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3E,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACzD,IAAI,aAAa;YAAE,OAAO,aAAa,CAAC;QACxC,IAAI,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC,eAAe,CACzB,mBAAmB,EACnB,IAAI,EACJ,aAAa,IAAI,CAAC,OAAO,CAAC,KAAK,mDAAmD,CACnF,CAAC;IACJ,CAAC;IAEO,sBAAsB,CAAC,KAAkB;QAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM;YAC1B,CAAC,CAAC,+DAA+D,KAAK,CAAC,MAAM,CAAC,QAAQ,GAAG;YACzF,CAAC,CAAC,yDAAyD,CAAC;QAC9D,OAAO,IAAI,CAAC,eAAe,CACzB,SAAS,EACT,KAAK,CAAC,MAAM,EAAE,eAAe,IAAI,IAAI,EACrC,OAAO,EACP,KAAK,CAAC,MAAM,EAAE,QAAQ,EACtB,KAAK,CAAC,SAAS,CAChB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,qBAAqB;QACjC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACzC,IAAI,CAAC,YAAY,CAAC,aAAa;YAAE,OAAO,SAAS,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,eAAe,CACzB,eAAe,EACf,IAAI,EACJ,aAAa,IAAI,CAAC,OAAO,CAAC,KAAK,gBAAgB,CAChD,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,cAAc,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB;gBAAE,OAAO,SAAS,CAAC;YAC1F,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,qBAAqB;QAC3B,OAAO,IAAI,CAAC,eAAe,CACzB,QAAQ,EACR,IAAI,EACJ,aAAa,IAAI,CAAC,OAAO,CAAC,KAAK,+DAA+D,CAC/F,CAAC;IACJ,CAAC;IAEO,gBAAgB;QACtB,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC;QAE9C,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;QAC7B,IAAI,eAAe,GAAuC,GAAG,EAAE,CAAC,SAAS,CAAC;QAC1E,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,IAAI,aAA+C,CAAC;QACpD,MAAM,KAAK,GAAgB;YACzB,QAAQ,EAAE,IAAI,OAAO,CAAmB,CAAC,OAAO,EAAE,EAAE;gBAClD,eAAe,GAAG,OAAO,CAAC;YAC5B,CAAC,CAAC;YACF,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YAC5F,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,SAAS;YACpB,MAAM,EAAE,GAAG,EAAE;gBACX,eAAe,GAAG,IAAI,CAAC;gBACvB,IAAI,aAAa;oBAAE,aAAa,CAAC,MAAM,GAAG,IAAI,CAAC;YACjD,CAAC;SACF,CAAC;QAEF,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC,MAAM,EAAE,EAAE;YACpD,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;YACtB,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;YAChF,eAAe,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE;YACb,aAAa,GAAG,OAAO,CAAC;YACxB,IAAI,eAAe;gBAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;QAC7C,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC1B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;YAC5B,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACd,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK;gBAAE,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC/D,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QACzB,KAAK,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,QAA4C,EAC5C,SAAkD;QAElD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACnC,IAAI,MAAmC,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG;gBACd,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;gBAChC,OAAO,EAAE,GAAG;gBACZ,MAAM,EAAE,KAAK;gBACb,kBAAkB,EAAE,CAAC,QAA+B,EAAE,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;aACjG,CAAC;YACF,SAAS,CAAC,OAAO,CAAC,CAAC;YACnB,MAAM,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,cAAc,CAAC,iBAAiB,EAAE,aAAa,IAAI,CAAC,OAAO,CAAC,KAAK,4BAA4B,CAAC,CAAC;QAC3G,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAEO,KAAK,CAAC,uBAAuB,CAAC,WAA2C;QAC/E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACnC,IAAI,MAA4B,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC;gBAC5C,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;gBAChC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,2BAA2B,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBACvF,MAAM,EAAE,gBAAgB;gBACxB,eAAe,EAAE,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;gBAChD,aAAa,EAAE,SAAS,EAAE;aAC3B,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,cAAc,CAAC,iBAAiB,EAAE,aAAa,IAAI,CAAC,OAAO,CAAC,KAAK,4BAA4B,CAAC,CAAC;QAC3G,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,MAAwB,EACxB,MAAmC;QAEnC,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,MAAO,CAAC,OAAQ,CAAC;QAEjC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,cAAc,EAAE,CAAC;QAC/C,MAAM,OAAO,CAAC,GAAG,CACf,QAAQ;aACL,MAAM,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa,CAAC;aAChF,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CACjD,CAAC;QACF,OAAO;YACL,aAAa,EAAE,IAAI;YACnB,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACrC,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC;IACJ,CAAC;IAEO,eAAe,CACrB,MAA0B,EAC1B,QAAuB,EACvB,OAAe,EACf,QAAiB,EACjB,SAAkB;QAElB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACpF,CAAC;QACD,OAAO;YACL,MAAM;YACN,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACrC,QAAQ;YACR,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,OAAO;SACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,cAAc,EAAE,CAAC;QAC/C,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1E,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACtD,OAAO,OAAO;YACZ,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;YAC5F,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IACtE,CAAC;IAEO,KAAK,CAAC,aAAa;QACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,MAAM,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC9F,OAAO,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;gBAClD,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YACzD,CAAC;YACD,MAAM,IAAI,cAAc,CAAC,iBAAiB,EAAE,iBAAiB,IAAI,CAAC,OAAO,CAAC,KAAK,iDAAiD,CAAC,CAAC;QACpI,CAAC;IACH,CAAC;IAEO,MAAM;QACZ,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAClE,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;YAC/B,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAC1E,CAAC,CAAC,sDAAsD;gBACxD,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,cAAc,CAAC,iBAAiB,EAAE,sDAAsD,MAAM,EAAE,CAAC,CAAC;QAC9G,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,SAAS,aAAa,CAAC,QAAuB,EAAE,OAAyB;IACvE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,yFAAyF,KAAK,gDAAgD,CAAC;AACxJ,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,sIAAsI,CAAC;AAChJ,CAAC;AAED,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAqB,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAA2C,MAAM,iBAAiB,CAAC;AAI5F,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAGjE,yFAAyF;AACzF,MAAM,OAAO,WAAW;IAED;IADJ,QAAQ,CAAkC;IAC3D,YAAqB,OAAyB,EAAE,UAA8B,EAAE;QAA3D,YAAO,GAAP,OAAO,CAAkB;QAC5C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,KAAK;YAC3B,CAAC,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC;YACzD,CAAC,CAAC,IAAI,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC;IACD,cAAc,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;IAC3D,KAAK,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACzC,UAAU,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACnD,cAAc,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;IAC3D,kBAAkB,KAAK,IAAI,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC;IAC5D,MAAM,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3C,MAAM,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;CAC5C"}

package/dist/auth0-store.d.ts

@@ -0,0 +1,14 @@
+import { z } from 'zod';
+import type { DataBasinEnvironment } from './config.js';
+export declare const Auth0SessionSchema: z.ZodObject<{
+    accessToken: z.ZodString;
+    refreshToken: z.ZodOptional<z.ZodString>;
+    expiresAt: z.ZodNumber;
+}, z.core.$strict>;
+export type Auth0Session = z.infer<typeof Auth0SessionSchema>;
+export interface Auth0Store {
+    transact<T>(operation: (session: Auth0Session | null, save: (next: Auth0Session | null) => Promise<void>) => Promise<T>): Promise<T>;
+}
+/** Separate OS-protected records and cross-process locks for each provider/client/environment. */
+export declare function createAuth0Store(environment: DataBasinEnvironment, issuer: string, clientId: string, audience: string): Promise<Auth0Store>;
+//# sourceMappingURL=auth0-store.d.ts.map

package/dist/auth0-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth0-store.d.ts","sourceRoot":"","sources":["../src/auth0-store.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAExD,eAAO,MAAM,kBAAkB;;;;kBAIpB,CAAC;AACZ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACtI;AAED,kGAAkG;AAClG,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,oBAAoB,EACjC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC,CAwDrB"}

package/dist/auth0-store.js

@@ -0,0 +1,78 @@
+import { createHash } from 'node:crypto';
+import { mkdir } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { DataProtectionScope, PersistenceCreator } from '@azure/msal-node-extensions';
+import lockfile from 'proper-lockfile';
+import { z } from 'zod';
+export const Auth0SessionSchema = z.object({
+    accessToken: z.string().min(1).max(65536),
+    refreshToken: z.string().min(1).max(65536).optional(),
+    expiresAt: z.number().finite().positive()
+}).strict();
+/** Separate OS-protected records and cross-process locks for each provider/client/environment. */
+export async function createAuth0Store(environment, issuer, clientId, audience) {
+    const identity = createHash('sha256').update(JSON.stringify([issuer, clientId, audience])).digest('hex');
+    const authDirectory = join(homedir(), '.databasin', 'mcp', 'auth');
+    const directory = join(authDirectory, environment, `auth0-${identity}`);
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    // The library probes a fixed validation key, shared across profiles and processes.
+    // Serialize initialization separately from session transactions to avoid one
+    // starting host deleting another host's probe before it can be read.
+    let initializationCompromised = false;
+    const releaseInitialization = await lockfile.lock(authDirectory, {
+        stale: 120000, update: 10000,
+        retries: { retries: 20, minTimeout: 100, maxTimeout: 1000 },
+        onCompromised: () => { initializationCompromised = true; }
+    });
+    let persistence;
+    try {
+        persistence = await PersistenceCreator.createPersistence({
+            cachePath: join(directory, 'cache'),
+            dataProtectionScope: DataProtectionScope.CurrentUser,
+            serviceName: 'com.databasin.mcp.auth0',
+            accountName: `${environment}:${identity}`,
+            usePlaintextFileOnLinux: false
+        });
+        if (initializationCompromised)
+            throw new Error('Credential initialization lock was lost.');
+    }
+    finally {
+        await releaseInitialization();
+    }
+    return {
+        async transact(operation) {
+            // Keep refresh-token rotation atomic across Claude, Codex, and CLI processes.
+            let compromised = false;
+            const release = await lockfile.lock(directory, {
+                stale: 120000,
+                update: 10000,
+                retries: { retries: 20, minTimeout: 100, maxTimeout: 1000 },
+                onCompromised: () => { compromised = true; }
+            });
+            try {
+                let raw;
+                try {
+                    raw = await persistence.load();
+                }
+                catch (error) {
+                    if (error.code !== 'ENOENT')
+                        throw error;
+                    raw = null;
+                }
+                const decoded = raw ? JSON.parse(raw) : null;
+                const session = decoded === null ? null : Auth0SessionSchema.parse(decoded);
+                return await operation(session, async (next) => {
+                    if (compromised)
+                        throw new Error('Credential storage lock was lost.');
+                    // Keytar rejects empty passwords. Store an OS-protected JSON null tombstone.
+                    await persistence.save(JSON.stringify(next === null ? null : Auth0SessionSchema.parse(next)));
+                });
+            }
+            finally {
+                await release();
+            }
+        }
+    };
+}
+//# sourceMappingURL=auth0-store.js.map

package/dist/auth0-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth0-store.js","sourceRoot":"","sources":["../src/auth0-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,QAAQ,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;IACzC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;IACrD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC,MAAM,EAAE,CAAC;AAMZ,kGAAkG;AAClG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAAiC,EACjC,MAAc,EACd,QAAgB,EAChB,QAAgB;IAEhB,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzG,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,SAAS,QAAQ,EAAE,CAAC,CAAC;IACxE,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,mFAAmF;IACnF,6EAA6E;IAC7E,qEAAqE;IACrE,IAAI,yBAAyB,GAAG,KAAK,CAAC;IACtC,MAAM,qBAAqB,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE;QAC/D,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;QAC5B,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE;QAC3D,aAAa,EAAE,GAAG,EAAE,GAAG,yBAAyB,GAAG,IAAI,CAAC,CAAC,CAAC;KAC3D,CAAC,CAAC;IACH,IAAI,WAAW,CAAC;IAChB,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,CAAC;YACvD,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC;YACnC,mBAAmB,EAAE,mBAAmB,CAAC,WAAW;YACpD,WAAW,EAAE,yBAAyB;YACtC,WAAW,EAAE,GAAG,WAAW,IAAI,QAAQ,EAAE;YACzC,uBAAuB,EAAE,KAAK;SAC/B,CAAC,CAAC;QACH,IAAI,yBAAyB;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC7F,CAAC;YAAS,CAAC;QACT,MAAM,qBAAqB,EAAE,CAAC;IAChC,CAAC;IACD,OAAO;QACL,KAAK,CAAC,QAAQ,CAAC,SAAS;YACtB,8EAA8E;YAC9E,IAAI,WAAW,GAAG,KAAK,CAAC;YACxB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE;gBAC7C,KAAK,EAAE,MAAM;gBACb,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE;gBAC3D,aAAa,EAAE,GAAG,EAAE,GAAG,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC;aAC7C,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,IAAI,GAAkB,CAAC;gBACvB,IAAI,CAAC;oBAAC,GAAG,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;gBAAC,CAAC;gBACvC,OAAO,KAAK,EAAE,CAAC;oBACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;wBAAE,MAAM,KAAK,CAAC;oBACpE,GAAG,GAAG,IAAI,CAAC;gBACb,CAAC;gBACD,MAAM,OAAO,GAAY,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACtD,MAAM,OAAO,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC5E,OAAO,MAAM,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;oBAC7C,IAAI,WAAW;wBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;oBACtE,6EAA6E;oBAC7E,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChG,CAAC,CAAC,CAAC;YACL,CAAC;oBAAS,CAAC;gBACT,MAAM,OAAO,EAAE,CAAC;YAClB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth0-token.d.ts

@@ -0,0 +1,3 @@
+import { type JWTVerifyGetKey } from 'jose';
+export declare function createAuth0TokenVerifier(issuer: string, audience: string, clientId: string, now: () => number, keys?: JWTVerifyGetKey): (token: string) => Promise<number>;
+//# sourceMappingURL=auth0-token.d.ts.map

package/dist/auth0-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth0-token.d.ts","sourceRoot":"","sources":["../src/auth0-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiC,KAAK,eAAe,EAAE,MAAM,MAAM,CAAC;AAE3E,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,MAAM,EACrE,IAAI,GAAE,eAA0G,GAC/G,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CASpC"}

package/dist/auth0-token.js

@@ -0,0 +1,13 @@
+import { createRemoteJWKSet, jwtVerify } from 'jose';
+export function createAuth0TokenVerifier(issuer, audience, clientId, now, keys = createRemoteJWKSet(new URL('.well-known/jwks.json', issuer), { timeoutDuration: 10000 })) {
+    return async (token) => {
+        const { payload } = await jwtVerify(token, keys, {
+            algorithms: ['RS256'], issuer, audience,
+            requiredClaims: ['sub', 'exp', 'iat'], currentDate: new Date(now())
+        });
+        if (!payload.sub || payload.azp !== clientId || !payload.exp)
+            throw new Error('Invalid DataBasin token.');
+        return payload.exp * 1000;
+    };
+}
+//# sourceMappingURL=auth0-token.js.map

package/dist/auth0-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth0-token.js","sourceRoot":"","sources":["../src/auth0-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAwB,MAAM,MAAM,CAAC;AAE3E,MAAM,UAAU,wBAAwB,CACtC,MAAc,EAAE,QAAgB,EAAE,QAAgB,EAAE,GAAiB,EACrE,OAAwB,kBAAkB,CAAC,IAAI,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IAEhH,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;YAC/C,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ;YACvC,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;SACpE,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC1G,OAAO,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAC5B,CAAC,CAAC;AACJ,CAAC"}

package/dist/auth0.d.ts

@@ -0,0 +1,41 @@
+import type { AssistantAuthResult, AuthStatus } from './auth.js';
+import { type Auth0Store } from './auth0-store.js';
+import type { DataBasinProfile } from './config.js';
+export interface Auth0Configuration {
+    domain: string;
+    clientId: string;
+    audience: string;
+}
+export interface Auth0Options {
+    fetch?: typeof fetch;
+    now?: () => number;
+    wait?: (ms: number, signal: AbortSignal) => Promise<void>;
+    openBrowser?: (url: string) => Promise<void>;
+    createStore?: () => Promise<Auth0Store>;
+    verify?: (token: string) => Promise<number>;
+    writePrompt?: (message: string) => void;
+}
+/** Public native-client device authorization; never requests a client secret or user password. */
+export declare class Auth0Manager {
+    #private;
+    readonly profile: DataBasinProfile;
+    readonly configuration: Auth0Configuration;
+    private options;
+    readonly issuer: string;
+    constructor(profile: DataBasinProfile, configuration: Auth0Configuration, options?: Auth0Options);
+    getAccessToken(): Promise<string>;
+    status(): Promise<AuthStatus>;
+    getLoginStatus(): Promise<AssistantAuthResult>;
+    startLogin(): Promise<AssistantAuthResult>;
+    private begin;
+    login(): Promise<AuthStatus>;
+    cancelPendingLogin(): void;
+    logout(): Promise<number>;
+    private poll;
+    private session;
+    private verify;
+    private post;
+    private withStore;
+    private result;
+}
+//# sourceMappingURL=auth0.d.ts.map

package/dist/auth0.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth0.d.ts","sourceRoot":"","sources":["../src/auth0.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAAuC,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAExF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAIpD,MAAM,WAAW,kBAAkB;IAAG,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AAC1F,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC;IACxC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACzC;AAeD,kGAAkG;AAClG,qBAAa,YAAY;;IAWX,QAAQ,CAAC,OAAO,EAAE,gBAAgB;IAAE,QAAQ,CAAC,aAAa,EAAE,kBAAkB;IAAE,OAAO,CAAC,OAAO;IAF3G,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEH,OAAO,EAAE,gBAAgB,EAAW,aAAa,EAAE,kBAAkB,EAAU,OAAO,GAAE,YAAiB;IAWxH,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC;IAqBjC,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC;IAY7B,cAAc,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAM9C,UAAU,IAAI,OAAO,CAAC,mBAAmB,CAAC;YAKlC,KAAK;IA8Bb,KAAK,IAAI,OAAO,CAAC,UAAU,CAAC;IAalC,kBAAkB,IAAI,IAAI;IAEpB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;YASjB,IAAI;YAsBJ,OAAO;YAUP,MAAM;YAIN,IAAI;YAiBJ,SAAS;IAYvB,OAAO,CAAC,MAAM;CAIf"}