@dataflint/mcp-server 1.0.15 → 1.0.17

package/dist/standalone/config.js

@@ -1,317 +1,1424 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJS = (cb, mod) => function __require() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// dist/auth/customer-auth-configs.js
+var require_customer_auth_configs = __commonJS({
+  "dist/auth/customer-auth-configs.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.customerAuthConfigs = void 0;
+    exports2.customerAuthConfigs = {
+      // Customer domain hash → Auth0 configuration
+      "857064adfec4e0e5e37be8afef397155db006bb6009d1b395388d9174eb40795": {
+        clientId: "CWvpqujjEV2aoRSDVWFSh1U6HQALygB0",
+        domainProducer: (customerDomain) => `https://dataflint-${customerDomain}.us.auth0.com/`
+      },
+      cafe6e0af028d729afd3c4a386482621af90e8e117b1216f2bbc08e86a5e9445: {
+        clientId: "HRLICLhE0BP4AeZ8dSPAoDHFmMZVacxi"
+      },
+      "1613f29ea956158d2ad56a10780feb45d78755819565e76c4bf0d9069d17aab9": {
+        clientId: "CnyJJKVqes0Y0uU57GreAeaPbJlm4l4w"
+      },
+      eae8e3404182477f008479b38a6629ee86b23cefe2c418c5dc5c2f0d02af5475: {
+        clientId: "etY3z44ssWohe77PEBIMPzktW4BmvWGT"
+      },
+      // dataflint-demo (added from commit f38928c)
+      cc1677626e05d82b301cc83c22a850eac849555e704f288083108d79f600cea1: {
+        clientId: "u9W23NGvlV58W2N9WXMMhsM12bKK8oGI"
+      }
+    };
+  }
 });
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
+
+// dist/auth/types.js
+var require_types = __commonJS({
+  "dist/auth/types.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.M2MType = exports2.AuthStrategyType = void 0;
+    var AuthStrategyType;
+    (function(AuthStrategyType2) {
+      AuthStrategyType2["SERVICE_ACCOUNT"] = "service_account";
+      AuthStrategyType2["AUTH0_M2M"] = "auth0_m2m";
+      AuthStrategyType2["AUTH0_USER"] = "auth0_user";
+    })(AuthStrategyType || (exports2.AuthStrategyType = AuthStrategyType = {}));
+    var M2MType;
+    (function(M2MType2) {
+      M2MType2["NONE"] = "none";
+      M2MType2["SERVICE_ACCOUNT"] = "service_account";
+      M2MType2["AUTH0_M2M"] = "auth0_m2m";
+    })(M2MType || (exports2.M2MType = M2MType = {}));
+  }
+});
+
+// dist/auth/auth0-service.js
+var require_auth0_service = __commonJS({
+  "dist/auth/auth0-service.js"(exports2) {
+    "use strict";
+    var __createBinding2 = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __setModuleDefault2 = exports2 && exports2.__setModuleDefault || (Object.create ? (function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    }) : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar2 = exports2 && exports2.__importStar || /* @__PURE__ */ (function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
+          return ar;
         };
         return ownKeys(o);
-    };
-    return function (mod) {
+      };
+      return function(mod) {
         if (mod && mod.__esModule) return mod;
         var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
+        if (mod != null) {
+          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding2(result, mod, k[i]);
+        }
+        __setModuleDefault2(result, mod);
         return result;
+      };
+    })();
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.Auth0Service = void 0;
+    var http = __importStar2(require("http"));
+    var openid_client_1 = require("openid-client");
+    var url_1 = require("url");
+    var AUTH_DISCOVERY_TIMEOUT_MS = 1e4;
+    openid_client_1.custom.setHttpOptionsDefaults({
+      timeout: AUTH_DISCOVERY_TIMEOUT_MS
+    });
+    var noopLogger = {
+      info: () => {
+      },
+      warn: () => {
+      },
+      error: () => {
+      },
+      debug: () => {
+      }
     };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.StandaloneConfigService = void 0;
-const fs = __importStar(require("node:fs"));
-const fsPromises = __importStar(require("node:fs/promises"));
-const path = __importStar(require("node:path"));
-const os = __importStar(require("node:os"));
-const crypto = __importStar(require("node:crypto"));
-const zod_1 = require("zod");
-const types_1 = require("../types");
-const index_js_1 = require("../auth/index.js");
-const logger_1 = require("../logger");
-// Constants
-const DEFAULT_CLIENT_ID_FOR_HASH = "default";
-const HASH_PREFIX_LENGTH = 8;
-const DEFAULT_ADMIN_COMPANY_DOMAIN = "none";
-const DEFAULT_SERVER_URL = "https://api.dataflint.io";
-const DEFAULT_AUTH_DOMAIN = "https://dataflint.us.auth0.com/";
-const DEFAULT_AUDIENCE = "https://api.dataflint.io";
-const DEFAULT_SCOPE = "openid profile email offline_access";
-const DEFAULT_PUBLIC_CLIENT_ID = "1NdbhkYoLyqQWtevBNal1BozB9pSZe3g";
-const CREDENTIALS_DIR_MODE = 0o700;
-const CREDENTIALS_FILE_MODE = 0o600;
-// Zod schema for config file validation
-const StandaloneConfigSchema = zod_1.z
-    .object({
-    serverUrl: zod_1.z.string().url().optional(),
-    authDomain: zod_1.z.string().optional(),
-    clientId: zod_1.z.string().optional(),
-    audience: zod_1.z.string().optional(),
-    scope: zod_1.z.string().optional(),
-    credentialsPath: zod_1.z.string().optional(),
-    adminCompanyDomain: zod_1.z.string().optional(),
-    customerDomain: zod_1.z.string().optional(),
-    m2mTokenPath: zod_1.z.string().optional(),
-    m2mSecretName: zod_1.z.string().optional(),
-    tenantId: zod_1.z.string().optional(),
-})
-    .strict();
-class StandaloneConfigService {
-    config;
-    credentialsPath;
-    m2mMode;
-    constructor(config = {}) {
-        this.config = this.mergeWithDefaults(config);
-        this.m2mMode = this.detectM2MMode();
-        this.validateM2MConfig();
-        this.credentialsPath =
-            config.credentialsPath || this.defaultCredentialsPath();
-        this.ensureDataflintDirectory();
-    }
-    defaultCredentialsPath() {
-        const hash = crypto
-            .createHash("sha256")
-            .update(this.config.clientId || DEFAULT_CLIENT_ID_FOR_HASH)
-            .digest("hex")
-            .substring(0, HASH_PREFIX_LENGTH);
-        return path.join(os.homedir(), ".dataflint", `credentials-${hash}.json`);
-    }
-    ensureDataflintDirectory() {
-        const dir = path.dirname(this.credentialsPath);
-        if (!fs.existsSync(dir)) {
-            fs.mkdirSync(dir, { recursive: true, mode: CREDENTIALS_DIR_MODE });
+    var Auth0Service = class {
+      config;
+      redirectUri;
+      callbackPort;
+      client = null;
+      issuer = null;
+      initialized = false;
+      openUrlHandler;
+      logger;
+      constructor(openUrlHandler, configProvider, logger, callbackPort = 11334) {
+        this.logger = logger || noopLogger;
+        this.openUrlHandler = openUrlHandler;
+        this.config = {
+          ...configProvider(),
+          scope: configProvider().scope || "openid profile email"
+        };
+        this.callbackPort = callbackPort;
+        this.redirectUri = `http://localhost:${callbackPort}/callback`;
+        this.logger.info(`Auth0Service initialized for domain: ${this.config.domain}`);
+      }
+      /**
+       * Initialize the Auth0 client by discovering the issuer metadata
+       */
+      async initialize() {
+        if (this.initialized) {
+          this.logger.debug("Auth0 client already initialized");
+          return;
         }
-    }
-    detectM2MMode() {
-        const tokenPath = this.config.m2mTokenPath;
-        const secretName = this.config.m2mSecretName;
-        const tenantId = this.config.tenantId;
-        const logger = logger_1.Logger.getInstance();
-        if (tokenPath) {
-            logger.info("M2M mode: Service Account");
-            return { type: types_1.M2MType.SERVICE_ACCOUNT, tokenPath, tenantId };
-        }
-        if (secretName) {
-            logger.info("M2M mode: Auth0 M2M");
-            return { type: types_1.M2MType.AUTH0_M2M, secretName, tenantId };
-        }
-        return { type: types_1.M2MType.NONE };
-    }
-    validateM2MConfig() {
-        if (this.m2mMode.type !== types_1.M2MType.NONE && !this.config.serverUrl) {
-            throw new Error("DATAFLINT_SERVER_URL is required in M2M mode");
+        try {
+          const issuerUrl = this.config.domain.startsWith("http") ? this.config.domain : `https://${this.config.domain}`;
+          this.logger.info(`Attempting to discover Auth0 issuer at: ${issuerUrl}`);
+          this.logger.debug(`Discovery URL will be: ${issuerUrl}`);
+          this.issuer = await openid_client_1.Issuer.discover(issuerUrl);
+          this.logger.info(`Auth0 issuer discovered successfully: ${this.issuer.issuer}`);
+          this.client = new this.issuer.Client({
+            client_id: this.config.clientId,
+            redirect_uris: [this.redirectUri],
+            response_types: ["code"],
+            token_endpoint_auth_method: "none"
+            // Public client, no client secret required
+          });
+          this.initialized = true;
+          this.logger.info("Auth0 client initialized successfully");
+        } catch (error) {
+          this.logger.error("Failed to initialize Auth0 client", error);
+          this.logger.error(`Auth0 domain: ${this.config.domain}`);
+          this.logger.error(`Client ID: ${this.config.clientId}`);
+          this.logger.error(`Constructed issuer URL: ${this.config.domain.startsWith("http") ? this.config.domain : `https://${this.config.domain}`}`);
+          if (error instanceof Error) {
+            if (error.message.includes("404") || error.message.includes("Not Found")) {
+              throw new Error(`Auth0 domain '${this.config.domain}' not found. Please verify your Auth0 domain configuration. The discovery endpoint ${this.config.domain} returned 404.`);
+            } else if (error.message.includes("ENOTFOUND") || error.message.includes("getaddrinfo")) {
+              throw new Error(`Cannot connect to Auth0 domain '${this.config.domain}'. Please check your internet connection and verify the domain is correct.`);
+            }
+          }
+          throw new Error(`Auth0 initialization failed: ${error}`);
         }
-    }
-    loadFileConfig() {
-        const configFilePath = path.join(os.homedir(), ".dataflint", "config.json");
-        if (!fs.existsSync(configFilePath)) {
-            return {};
+      }
+      /**
+       * Start the authentication flow
+       */
+      async authenticate() {
+        if (!this.client) {
+          await this.initialize();
+        }
+        if (!this.client) {
+          throw new Error("Auth0 client not initialized");
         }
-        const logger = logger_1.Logger.getInstance();
+        const codeVerifier = openid_client_1.generators.codeVerifier();
+        const codeChallenge = openid_client_1.generators.codeChallenge(codeVerifier);
+        const authUrl = this.client.authorizationUrl({
+          scope: this.config.scope,
+          code_challenge: codeChallenge,
+          code_challenge_method: "S256",
+          ...this.config.audience && { audience: this.config.audience }
+        });
+        this.logger.info("Opening browser for authentication...");
         try {
-            const rawContent = JSON.parse(fs.readFileSync(configFilePath, "utf8"));
-            const result = StandaloneConfigSchema.safeParse(rawContent);
-            if (!result.success) {
-                logger.warn(`Invalid config file format at ${configFilePath}: ${result.error.issues.map((i) => i.message).join(", ")}`);
-                return {};
+          await this.openUrlHandler(authUrl);
+        } catch (error) {
+          this.logger.error("Failed to open browser", error);
+          this.logger.info(`Please manually navigate to: ${authUrl}`);
+        }
+        return new Promise((resolve, reject) => {
+          const server = http.createServer(async (req, res) => {
+            var _a;
+            try {
+              if (!((_a = req.url) == null ? void 0 : _a.startsWith("/callback"))) {
+                res.writeHead(404, { "Content-Type": "text/plain" });
+                res.end("Not Found");
+                return;
+              }
+              const callbackUrl = new url_1.URL(`http://localhost:${this.callbackPort}${req.url}`);
+              const params = this.client.callbackParams(callbackUrl.toString());
+              const tokenSet = await this.client.callback(this.redirectUri, params, {
+                code_verifier: codeVerifier
+              });
+              const authResult = this.processTokenSet(tokenSet);
+              res.writeHead(200, { "Content-Type": "text/html" });
+              res.end(`
+            <html>
+              <body style="font-family: Arial, sans-serif; text-align: center; padding: 50px;">
+                <h2 style="color: #4CAF50;">Authentication Successful!</h2>
+                <p>You can now close this tab and return to VS Code/Cursor.</p>
+                <script>
+                  setTimeout(() => {
+                    window.close();
+                  }, 3000);
+                </script>
+              </body>
+            </html>
+          `);
+              server.close();
+              resolve(authResult);
+            } catch (error) {
+              this.logger.error("Authentication callback error", error);
+              res.writeHead(400, { "Content-Type": "text/html" });
+              res.end(`
+            <html>
+              <body style="font-family: Arial, sans-serif; text-align: center; padding: 50px;">
+                <h2 style="color: #f44336;">Authentication Failed</h2>
+                <p>Error: ${error}</p>
+                <p>Please try again.</p>
+              </body>
+            </html>
+          `);
+              server.close();
+              reject(error);
             }
-            return result.data;
+          });
+          server.listen(this.callbackPort, () => {
+            this.logger.info(`Listening for Auth0 callback on http://localhost:${this.callbackPort}/callback`);
+          });
+          setTimeout(() => {
+            server.close();
+            reject(new Error("Authentication timeout - no response received within 5 minutes"));
+          }, 3e5);
+        });
+      }
+      /**
+       * Get user information using the access token
+       */
+      async getUserInfo(accessToken) {
+        if (!this.client) {
+          throw new Error("Auth0 client not initialized");
         }
-        catch (error) {
-            logger.warn(`Failed to parse config file at ${configFilePath}: ${error instanceof Error ? error.message : String(error)}`);
-            return {};
+        try {
+          this.logger.info("Fetching user information...");
+          const userInfo = await this.client.userinfo(accessToken);
+          this.logger.info("User information retrieved successfully");
+          this.logger.debug(`User ID: ${userInfo.sub}`);
+          return userInfo;
+        } catch (error) {
+          this.logger.error("Failed to get user info", error);
+          throw error;
         }
-    }
-    mergeWithDefaults(config) {
-        const envConfig = {
-            serverUrl: process.env.DATAFLINT_SERVER_URL,
-            authDomain: process.env.DATAFLINT_AUTH_DOMAIN,
-            clientId: process.env.DATAFLINT_CLIENT_ID,
-            audience: process.env.DATAFLINT_AUDIENCE,
-            scope: process.env.DATAFLINT_SCOPE,
-            adminCompanyDomain: process.env.DATAFLINT_ADMIN_COMPANY_DOMAIN,
-            customerDomain: process.env.DATAFLINT_CUSTOMER_DOMAIN,
-            m2mTokenPath: process.env.M2M_SA_TOKEN_PATH,
-            m2mSecretName: process.env.M2M_AUTH0_SECRET_NAME,
-            tenantId: process.env.TENANT_ID,
+      }
+      /**
+       * Refresh the access token using refresh token
+       */
+      async refreshToken(refreshToken) {
+        if (!this.client) {
+          throw new Error("Auth0 client not initialized");
+        }
+        try {
+          this.logger.info("Refreshing access token...");
+          const tokenSet = await this.client.refresh(refreshToken);
+          const result = this.processTokenSet(tokenSet);
+          this.logger.info("Token refresh completed successfully");
+          return result;
+        } catch (error) {
+          this.logger.error("Token refresh failed", error);
+          throw error;
+        }
+      }
+      /**
+       * Process token set and return structured result
+       */
+      processTokenSet(tokenSet) {
+        var _a;
+        const result = {
+          accessToken: tokenSet.access_token,
+          idToken: tokenSet.id_token,
+          refreshToken: tokenSet.refresh_token
         };
-        const fileConfig = this.loadFileConfig();
-        const logger = logger_1.Logger.getInstance();
-        const customerDomain = config.customerDomain ||
-            envConfig.customerDomain ||
-            fileConfig.customerDomain;
-        if (customerDomain) {
-            // Customer domain provided - resolve customer-specific config
-            logger.info(`Customer domain detected: ${customerDomain}`);
-            const customerConfig = (0, index_js_1.getCustomerAuthConfig)(customerDomain);
-            if (!customerConfig) {
-                logger.error(`Unknown customer domain: ${customerDomain}`);
-                throw new Error(`Unknown customer domain: "${customerDomain}". ` +
-                    `This customer is not registered in the system. ` +
-                    `Please check the domain name or contact support.`);
-            }
-            logger.info(`Using customer-specific configuration:`);
-            logger.info(`Server URL: ${customerConfig.serverUrl}`);
-            logger.info(`Auth0 Domain: ${customerConfig.domain}`);
-            logger.info(`Client ID: ${customerConfig.clientId.substring(0, 8)}...`);
-            // Return customer-specific configuration
-            // Customer config takes precedence over everything else
-            return {
-                serverUrl: customerConfig.serverUrl,
-                authDomain: customerConfig.domain,
-                clientId: customerConfig.clientId,
-                audience: customerConfig.audience,
-                scope: DEFAULT_SCOPE,
-                // Credentials path only configurable via CLI argument for security
-                credentialsPath: config.credentialsPath,
-                adminCompanyDomain: config.adminCompanyDomain ||
-                    envConfig.adminCompanyDomain ||
-                    fileConfig.adminCompanyDomain ||
-                    DEFAULT_ADMIN_COMPANY_DOMAIN,
-                customerDomain: customerDomain,
-                m2mTokenPath: config.m2mTokenPath ||
-                    envConfig.m2mTokenPath ||
-                    fileConfig.m2mTokenPath,
-                m2mSecretName: config.m2mSecretName ||
-                    envConfig.m2mSecretName ||
-                    fileConfig.m2mSecretName,
-                tenantId: config.tenantId ||
-                    envConfig.tenantId ||
-                    fileConfig.tenantId,
-            };
+        if (tokenSet.expires_at) {
+          result.expiresAt = new Date(tokenSet.expires_at * 1e3);
+        }
+        this.logger.info("Authentication tokens processed successfully");
+        this.logger.debug(`Access Token: ${(_a = result.accessToken) == null ? void 0 : _a.substring(0, 20)}...`);
+        this.logger.debug(`ID Token: ${result.idToken ? "Present" : "Not provided"}`);
+        this.logger.debug(`Refresh Token: ${result.refreshToken ? "Present" : "Not provided"}`);
+        this.logger.debug(`Expires At: ${result.expiresAt}`);
+        return result;
+      }
+      /**
+       * Check if a token is expired
+       */
+      isTokenExpired(authResult) {
+        if (!authResult.expiresAt) {
+          this.logger.debug("No expiration time available, considering token valid");
+          return false;
         }
-        // No customer domain - use existing merge logic
-        logger.info(`No customer domain - using default/explicit configuration`);
+        const expiresAt = authResult.expiresAt instanceof Date ? authResult.expiresAt : new Date(authResult.expiresAt);
+        const now = /* @__PURE__ */ new Date();
+        const buffer = 5 * 60 * 1e3;
+        const isExpired = expiresAt.getTime() - buffer < now.getTime();
+        if (isExpired) {
+          this.logger.warn("Access token is expired or will expire soon");
+        } else {
+          this.logger.debug("Access token is still valid");
+        }
+        return isExpired;
+      }
+      /**
+       * Logout (revoke tokens if supported)
+       */
+      async logout(accessToken) {
+        if (!this.client) {
+          throw new Error("Auth0 client not initialized");
+        }
+        try {
+          await this.client.revoke(accessToken);
+          this.logger.info("Token revoked successfully");
+        } catch (error) {
+          this.logger.error("Failed to revoke token", error);
+        }
+      }
+    };
+    exports2.Auth0Service = Auth0Service;
+  }
+});
+
+// dist/auth/auth0-m2m-service.js
+var require_auth0_m2m_service = __commonJS({
+  "dist/auth/auth0-m2m-service.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.Auth0M2MService = void 0;
+    var types_1 = require_types();
+    var noopLogger = {
+      info: () => {
+      },
+      warn: () => {
+      },
+      error: () => {
+      },
+      debug: () => {
+      }
+    };
+    var Auth0M2MService = class _Auth0M2MService {
+      credentials;
+      tenantId;
+      tokenCache = null;
+      logger;
+      initialized = false;
+      /**
+       * Token expiry buffer in milliseconds (5 minutes)
+       * Tokens will be refreshed this long before actual expiration
+       */
+      static EXPIRY_BUFFER_MS = 5 * 60 * 1e3;
+      constructor(credentials, tenantId, logger) {
+        this.credentials = credentials;
+        this.tenantId = tenantId;
+        this.logger = logger || noopLogger;
+        const clientIdPrefix = credentials.client_id.substring(0, 8);
+        this.logger.info(`Auth0M2MService created for client: ${clientIdPrefix}...`);
+      }
+      /**
+       * Get the strategy type identifier
+       */
+      getType() {
+        return types_1.AuthStrategyType.AUTH0_M2M;
+      }
+      /**
+       * Initialize the M2M service
+       * Validates credentials format and performs initial token fetch
+       */
+      async initialize() {
+        if (this.initialized) {
+          this.logger.debug("Auth0M2MService already initialized");
+          return;
+        }
+        this.logger.info("Initializing Auth0M2MService...");
+        if (!this.credentials.client_id || !this.credentials.client_secret) {
+          throw new Error("M2M credentials missing client_id or client_secret");
+        }
+        if (!this.credentials.domain) {
+          throw new Error("M2M credentials missing domain");
+        }
+        if (!this.credentials.audience) {
+          throw new Error("M2M credentials missing audience");
+        }
+        await this.fetchNewToken();
+        this.initialized = true;
+        this.logger.info("Auth0M2MService initialized successfully");
+      }
+      /**
+       * Get a valid access token, fetching a new one if cache is expired
+       */
+      async getToken() {
+        const now = Date.now();
+        if (this.tokenCache && now < this.tokenCache.expiresAt - _Auth0M2MService.EXPIRY_BUFFER_MS) {
+          this.logger.debug("Using cached M2M token");
+          return this.tokenCache.accessToken;
+        }
+        this.logger.info("M2M token expired or not cached, fetching new token...");
+        await this.fetchNewToken();
+        return this.tokenCache.accessToken;
+      }
+      /**
+       * Force refresh the token by clearing cache and fetching a new one
+       */
+      async refreshToken() {
+        this.logger.info("Force refreshing M2M token...");
+        this.tokenCache = null;
+        await this.fetchNewToken();
+        this.logger.info("M2M token refreshed");
+      }
+      /**
+       * Check if currently authenticated (credentials are valid)
+       */
+      async isAuthenticated() {
+        try {
+          await this.getToken();
+          return true;
+        } catch {
+          return false;
+        }
+      }
+      /**
+       * Get user information for the M2M client
+       * Returns synthetic user info since M2M clients don't have traditional user profiles
+       */
+      async getUserInfo() {
+        const clientIdPrefix = this.credentials.client_id.substring(0, 8);
         return {
-            serverUrl: config.serverUrl ||
-                envConfig.serverUrl ||
-                fileConfig.serverUrl ||
-                DEFAULT_SERVER_URL,
-            authDomain: config.authDomain ||
-                envConfig.authDomain ||
-                fileConfig.authDomain ||
-                DEFAULT_AUTH_DOMAIN,
-            clientId: config.clientId ||
-                envConfig.clientId ||
-                fileConfig.clientId ||
-                DEFAULT_PUBLIC_CLIENT_ID,
-            audience: config.audience ||
-                envConfig.audience ||
-                fileConfig.audience ||
-                DEFAULT_AUDIENCE,
-            scope: config.scope ||
-                envConfig.scope ||
-                fileConfig.scope ||
-                DEFAULT_SCOPE,
-            adminCompanyDomain: config.adminCompanyDomain ||
-                envConfig.adminCompanyDomain ||
-                fileConfig.adminCompanyDomain ||
-                DEFAULT_ADMIN_COMPANY_DOMAIN,
-            // Credentials path only configurable via CLI argument for security
-            credentialsPath: config.credentialsPath,
-            customerDomain: undefined,
-            m2mTokenPath: config.m2mTokenPath ||
-                envConfig.m2mTokenPath ||
-                fileConfig.m2mTokenPath,
-            m2mSecretName: config.m2mSecretName ||
-                envConfig.m2mSecretName ||
-                fileConfig.m2mSecretName,
-            tenantId: config.tenantId || envConfig.tenantId || fileConfig.tenantId,
+          sub: `m2m-client-${clientIdPrefix}`,
+          name: "M2M Client",
+          ...this.tenantId && { tenant_id: this.tenantId }
         };
-    }
-    // IConfigService interface implementation
-    getServerUrl() {
-        if (!this.config.serverUrl) {
-            throw new Error("Server URL not configured. Set DATAFLINT_SERVER_URL environment variable or configure in ~/.dataflint/config.json");
+      }
+      /**
+       * Get the tenant ID associated with this M2M client
+       */
+      getTenantId() {
+        return this.tenantId;
+      }
+      /**
+       * Fetch a new token from Auth0 using client credentials grant
+       */
+      async fetchNewToken() {
+        const domain = this.credentials.domain.startsWith("http") ? this.credentials.domain : `https://${this.credentials.domain}`;
+        const tokenUrl = `${domain.replace(/\/$/, "")}/oauth/token`;
+        this.logger.debug(`Fetching M2M token from: ${tokenUrl}`);
+        const requestBody = {
+          grant_type: "client_credentials",
+          client_id: this.credentials.client_id,
+          client_secret: this.credentials.client_secret,
+          audience: this.credentials.audience
+        };
+        try {
+          const response = await fetch(tokenUrl, {
+            method: "POST",
+            headers: {
+              "Content-Type": "application/json"
+            },
+            body: JSON.stringify(requestBody)
+          });
+          if (!response.ok) {
+            this.logger.error(`M2M token request failed: ${response.status}`);
+            throw new Error(`Auth0 M2M token request failed with status ${response.status}`);
+          }
+          const tokenResponse = await response.json();
+          if (!tokenResponse.access_token) {
+            throw new Error("Auth0 response missing access_token");
+          }
+          const expiresIn = tokenResponse.expires_in || 3600;
+          const expiresAt = Date.now() + expiresIn * 1e3;
+          this.tokenCache = {
+            accessToken: tokenResponse.access_token,
+            expiresAt
+          };
+          const expiresInMinutes = Math.floor(expiresIn / 60);
+          this.logger.info(`M2M token obtained${this.tenantId ? ` for tenant ${this.tenantId}` : ""}: expires in ${expiresInMinutes} minutes`);
+        } catch (error) {
+          this.tokenCache = null;
+          if (error instanceof Error) {
+            this.logger.error("Failed to fetch M2M token", error);
+            throw error;
+          }
+          throw new Error(`Failed to fetch M2M token: ${error}`);
         }
-        return this.config.serverUrl;
-    }
-    getEnvironment() {
-        return "prod";
-    }
-    getCustomerDomain() {
-        return this.config.customerDomain ?? null;
-    }
-    getAdminCompanyDomain() {
-        return this.config.adminCompanyDomain ?? DEFAULT_ADMIN_COMPANY_DOMAIN;
-    }
-    getAuthConfig() {
-        if (!this.config.authDomain) {
-            throw new Error("Auth domain not configured. Set DATAFLINT_AUTH_DOMAIN environment variable or configure in ~/.dataflint/config.json");
+      }
+    };
+    exports2.Auth0M2MService = Auth0M2MService;
+  }
+});
+
+// dist/auth/service-account-service.js
+var require_service_account_service = __commonJS({
+  "dist/auth/service-account-service.js"(exports2) {
+    "use strict";
+    var __createBinding2 = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __setModuleDefault2 = exports2 && exports2.__setModuleDefault || (Object.create ? (function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    }) : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar2 = exports2 && exports2.__importStar || /* @__PURE__ */ (function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding2(result, mod, k[i]);
+        }
+        __setModuleDefault2(result, mod);
+        return result;
+      };
+    })();
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.ServiceAccountService = void 0;
+    var fs2 = __importStar2(require("fs"));
+    var types_1 = require_types();
+    var noopLogger = {
+      info: () => {
+      },
+      warn: () => {
+      },
+      error: () => {
+      },
+      debug: () => {
+      }
+    };
+    var ServiceAccountService = class {
+      tokenPath;
+      tenantId;
+      tokenCache = null;
+      logger;
+      constructor(tokenPath, tenantId, logger) {
+        this.tokenPath = tokenPath;
+        this.tenantId = tenantId;
+        this.logger = logger || noopLogger;
+      }
+      /**
+       * Get the strategy type identifier
+       */
+      getType() {
+        return types_1.AuthStrategyType.SERVICE_ACCOUNT;
+      }
+      /**
+       * Initialize the service account strategy
+       * Validates that the token file exists and is readable
+       */
+      async initialize() {
+        this.logger.info(`Initializing ServiceAccountService with token path: ${this.tokenPath}`);
+        if (!fs2.existsSync(this.tokenPath)) {
+          throw new Error(`Service account token file not found: ${this.tokenPath}`);
         }
-        if (!this.config.clientId) {
-            throw new Error("Client ID not configured. Set DATAFLINT_CLIENT_ID environment variable or configure in ~/.dataflint/config.json");
+        await this.getToken();
+        this.logger.info("ServiceAccountService initialized successfully");
+      }
+      /**
+       * Get a valid access token, reading from file if cache is expired
+       */
+      async getToken() {
+        const now = Date.now();
+        const bufferMs = 5 * 60 * 1e3;
+        if (this.tokenCache && now < this.tokenCache.expiresAt - bufferMs) {
+          this.logger.debug("Using cached service account token");
+          return this.tokenCache.token;
         }
-        if (!this.config.audience) {
-            throw new Error("Audience not configured. Set DATAFLINT_AUDIENCE environment variable or configure in ~/.dataflint/config.json");
+        const rawToken = this.readTokenFromFile();
+        this.validateAndCacheToken(rawToken);
+        return this.tokenCache.token;
+      }
+      /**
+       * Force refresh the token by clearing cache and re-reading from file
+       */
+      async refreshToken() {
+        this.logger.info("Refreshing service account token...");
+        this.tokenCache = null;
+        await this.getToken();
+        this.logger.info("Service account token refreshed");
+      }
+      /**
+       * Check if currently authenticated (token file exists and is valid)
+       */
+      async isAuthenticated() {
+        try {
+          await this.getToken();
+          return true;
+        } catch {
+          return false;
         }
+      }
+      /**
+       * Get user information for the service account
+       * Returns synthetic user info since service accounts don't have traditional user profiles
+       */
+      async getUserInfo() {
         return {
-            domain: this.config.authDomain,
-            clientId: this.config.clientId,
-            audience: this.config.audience,
-            scope: this.config.scope ?? DEFAULT_SCOPE,
+          sub: "m2m-service-account",
+          name: "M2M Service Account",
+          ...this.tenantId && { tenant_id: this.tenantId }
         };
-    }
-    async getAuthSecret() {
+      }
+      /**
+       * Get the tenant ID associated with this service account
+       */
+      getTenantId() {
+        return this.tenantId;
+      }
+      /**
+       * Read the token from the file system
+       */
+      readTokenFromFile() {
+        return fs2.readFileSync(this.tokenPath, "utf8");
+      }
+      /**
+       * Validate the token format and cache it with expiration
+       */
+      validateAndCacheToken(rawToken) {
+        const token = rawToken.trim();
+        if (!token) {
+          throw new Error("Service account token is empty");
+        }
+        const parts = token.split(".");
+        if (parts.length !== 3) {
+          throw new Error(`Invalid JWT format: expected 3 parts, got ${parts.length}`);
+        }
+        const expiresAt = this.extractExpiration(token);
+        const now = Date.now();
+        const expiresIn = Math.floor((expiresAt - now) / 1e3);
+        if (expiresAt <= now) {
+          throw new Error("Service account token is expired");
+        }
+        this.logger.info(`Service account token loaded${this.tenantId ? ` for tenant ${this.tenantId}` : ""}: expires in ${expiresIn}s (${new Date(expiresAt).toISOString()})`);
+        this.tokenCache = {
+          token,
+          expiresAt
+        };
+      }
+      /**
+       * Extract expiration time from JWT payload
+       */
+      extractExpiration(token) {
+        const parts = token.split(".");
         try {
-            return await fsPromises.readFile(this.credentialsPath, "utf8");
+          const payload = parts[1];
+          const decoded = Buffer.from(payload, "base64url").toString("utf8");
+          const parsed = JSON.parse(decoded);
+          if (typeof parsed.exp === "number") {
+            return parsed.exp * 1e3;
+          }
+          this.logger.warn("JWT missing 'exp' field, using fallback expiration");
+          return Date.now() + 3e5;
+        } catch (error) {
+          this.logger.warn(`Failed to parse JWT expiration: ${error}, using fallback expiration`);
+          return Date.now() + 3e5;
         }
-        catch (error) {
-            const nodeError = error;
-            if (nodeError.code === "ENOENT") {
-                // File doesn't exist - this is expected, not an error
-                return undefined;
+      }
+    };
+    exports2.ServiceAccountService = ServiceAccountService;
+  }
+});
+
+// dist/auth/secrets/aws-secrets-provider.js
+var require_aws_secrets_provider = __commonJS({
+  "dist/auth/secrets/aws-secrets-provider.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.AWSSecretsProvider = void 0;
+    var noopLogger = {
+      info: () => {
+      },
+      warn: () => {
+      },
+      error: () => {
+      },
+      debug: () => {
+      }
+    };
+    var AWSSecretsProvider = class {
+      logger;
+      region;
+      constructor(logger) {
+        this.logger = logger || noopLogger;
+        this.region = process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION;
+      }
+      /**
+       * Get the provider name for logging
+       */
+      getName() {
+        return "AWS Secrets Manager";
+      }
+      /**
+       * Check if running in AWS environment with credentials available
+       */
+      async isAvailable() {
+        const hasRegion = !!(process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION);
+        const hasExecutionEnv = !!process.env.AWS_EXECUTION_ENV;
+        const hasCredentials = !!(process.env.AWS_ACCESS_KEY_ID || process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI || process.env.AWS_WEB_IDENTITY_TOKEN_FILE);
+        const isAWSEnvironment = hasRegion && (hasExecutionEnv || hasCredentials);
+        if (isAWSEnvironment) {
+          this.logger.debug("AWS environment detected");
+        } else {
+          this.logger.debug("Not in AWS environment");
+        }
+        return isAWSEnvironment;
+      }
+      /**
+       * Load Auth0 M2M credentials from AWS Secrets Manager
+       *
+       * @param secretName - The name or ARN of the secret in Secrets Manager
+       * @returns M2M credentials or null if not found
+       */
+      async loadAuth0M2MCredentials(secretName) {
+        this.logger.info(`Loading M2M credentials from AWS Secrets Manager: ${secretName}`);
+        try {
+          const { SecretsManagerClient, GetSecretValueCommand } = (
+            // @ts-expect-error - @aws-sdk/client-secrets-manager is an optional runtime dependency
+            await import("@aws-sdk/client-secrets-manager")
+          );
+          const client = new SecretsManagerClient({
+            region: this.region
+          });
+          const command = new GetSecretValueCommand({
+            SecretId: secretName
+          });
+          const response = await client.send(command);
+          if (!response.SecretString) {
+            this.logger.error("Secret value is empty or binary");
+            return null;
+          }
+          const secretValue = JSON.parse(response.SecretString);
+          if (!secretValue.client_id || !secretValue.client_secret || !secretValue.audience || !secretValue.domain) {
+            this.logger.error("Secret missing required fields (client_id, client_secret, audience, domain)");
+            return null;
+          }
+          this.logger.info("M2M credentials loaded from AWS Secrets Manager");
+          return {
+            client_id: secretValue.client_id,
+            client_secret: secretValue.client_secret,
+            audience: secretValue.audience,
+            domain: secretValue.domain
+          };
+        } catch (error) {
+          if (error instanceof Error) {
+            if (error.name === "ResourceNotFoundException") {
+              this.logger.warn(`Secret not found: ${secretName}`);
+              return null;
+            }
+            if (error.message.includes("Cannot find module")) {
+              this.logger.warn("AWS SDK not available - @aws-sdk/client-secrets-manager not installed");
+              return null;
             }
-            logger_1.Logger.getInstance().warn(`Failed to read credentials from ${this.credentialsPath}: ${nodeError.message}`);
-            return undefined;
+            this.logger.error("Failed to load secret from AWS", error);
+          }
+          return null;
         }
-    }
-    async setAuthSecret(value) {
-        // Ensure directory exists
-        this.ensureDataflintDirectory();
-        // Write with restricted permissions (600)
-        await fsPromises.writeFile(this.credentialsPath, value, {
-            mode: CREDENTIALS_FILE_MODE,
-            encoding: "utf8",
-        });
-    }
-    async deleteAuthSecret() {
+      }
+    };
+    exports2.AWSSecretsProvider = AWSSecretsProvider;
+  }
+});
+
+// dist/auth/secrets/local-file-secrets-provider.js
+var require_local_file_secrets_provider = __commonJS({
+  "dist/auth/secrets/local-file-secrets-provider.js"(exports2) {
+    "use strict";
+    var __createBinding2 = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __setModuleDefault2 = exports2 && exports2.__setModuleDefault || (Object.create ? (function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    }) : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar2 = exports2 && exports2.__importStar || /* @__PURE__ */ (function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding2(result, mod, k[i]);
+        }
+        __setModuleDefault2(result, mod);
+        return result;
+      };
+    })();
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.LocalFileSecretsProvider = void 0;
+    var fs2 = __importStar2(require("fs"));
+    var path2 = __importStar2(require("path"));
+    var os2 = __importStar2(require("os"));
+    var noopLogger = {
+      info: () => {
+      },
+      warn: () => {
+      },
+      error: () => {
+      },
+      debug: () => {
+      }
+    };
+    var LocalFileSecretsProvider = class {
+      logger;
+      environment;
+      secretFilePath;
+      constructor(environment, logger) {
+        this.logger = logger || noopLogger;
+        this.environment = environment;
+        this.secretFilePath = path2.join(os2.homedir(), ".dataflint", `m2m_secret.${environment}.json`);
+      }
+      /**
+       * Get the provider name for logging
+       */
+      getName() {
+        return "Local File";
+      }
+      /**
+       * Check if the local secret file exists
+       */
+      async isAvailable() {
+        const exists = fs2.existsSync(this.secretFilePath);
+        if (exists) {
+          this.logger.debug(`Local M2M secret file found: ${this.secretFilePath}`);
+        } else {
+          this.logger.debug(`Local M2M secret file not found: ${this.secretFilePath}`);
+        }
+        return exists;
+      }
+      /**
+       * Load Auth0 M2M credentials from local file
+       *
+       * @param _secretName - Ignored, uses environment-based file path
+       * @returns M2M credentials or null if not found or invalid
+       */
+      async loadAuth0M2MCredentials(_secretName) {
+        this.logger.info(`Loading M2M credentials from local file: ${this.secretFilePath}`);
         try {
-            await fsPromises.unlink(this.credentialsPath);
+          if (!fs2.existsSync(this.secretFilePath)) {
+            this.logger.debug("Local secret file does not exist");
+            return null;
+          }
+          const stats = fs2.statSync(this.secretFilePath);
+          const mode = stats.mode & 511;
+          if (mode !== 384) {
+            this.logger.warn(`Secret file has insecure permissions: ${mode.toString(8)}. Should be 600.`);
+          }
+          const content = fs2.readFileSync(this.secretFilePath, "utf8");
+          const secretValue = JSON.parse(content);
+          if (!secretValue.client_id || !secretValue.client_secret || !secretValue.audience || !secretValue.domain) {
+            this.logger.error("Local secret file missing required fields (client_id, client_secret, audience, domain)");
+            return null;
+          }
+          this.logger.info("M2M credentials loaded from local file");
+          return {
+            client_id: secretValue.client_id,
+            client_secret: secretValue.client_secret,
+            audience: secretValue.audience,
+            domain: secretValue.domain
+          };
+        } catch (error) {
+          if (error instanceof SyntaxError) {
+            this.logger.error("Failed to parse local secret file as JSON");
+          } else {
+            this.logger.error("Failed to load local secret file", error);
+          }
+          return null;
         }
-        catch (error) {
-            const nodeError = error;
-            if (nodeError.code === "ENOENT") {
-                // File doesn't exist - nothing to delete
-                return;
-            }
-            logger_1.Logger.getInstance().warn(`Failed to delete credentials at ${this.credentialsPath}: ${nodeError.message}`);
+      }
+      /**
+       * Get the path to the secret file (for diagnostics)
+       */
+      getSecretFilePath() {
+        return this.secretFilePath;
+      }
+    };
+    exports2.LocalFileSecretsProvider = LocalFileSecretsProvider;
+  }
+});
+
+// dist/auth/secrets/secrets-provider.js
+var require_secrets_provider = __commonJS({
+  "dist/auth/secrets/secrets-provider.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.SecretsProvider = void 0;
+    var aws_secrets_provider_1 = require_aws_secrets_provider();
+    var local_file_secrets_provider_1 = require_local_file_secrets_provider();
+    var noopLogger = {
+      info: () => {
+      },
+      warn: () => {
+      },
+      error: () => {
+      },
+      debug: () => {
+      }
+    };
+    var SecretsProvider = class {
+      logger;
+      providers;
+      environment;
+      constructor(environment, logger) {
+        this.logger = logger || noopLogger;
+        this.environment = environment;
+        this.providers = [
+          new aws_secrets_provider_1.AWSSecretsProvider(logger),
+          new local_file_secrets_provider_1.LocalFileSecretsProvider(environment, logger)
+        ];
+      }
+      /**
+       * Get the provider name for logging
+       */
+      getName() {
+        return "Composite Secrets Provider";
+      }
+      /**
+       * Check if any provider is available
+       */
+      async isAvailable() {
+        for (const provider of this.providers) {
+          if (await provider.isAvailable()) {
+            this.logger.debug(`Secrets provider available: ${provider.getName()}`);
+            return true;
+          }
+        }
+        this.logger.debug("No secrets providers available");
+        return false;
+      }
+      /**
+       * Load Auth0 M2M credentials from the first available provider
+       *
+       * @param secretName - The name of the secret (used for AWS, ignored for local file)
+       * @returns M2M credentials or null if not found in any provider
+       */
+      async loadAuth0M2MCredentials(secretName) {
+        this.logger.info("Attempting to load M2M credentials...");
+        for (const provider of this.providers) {
+          const providerName = provider.getName();
+          if (!await provider.isAvailable()) {
+            this.logger.debug(`Provider not available: ${providerName}`);
+            continue;
+          }
+          this.logger.info(`Trying provider: ${providerName}`);
+          const credentials = await provider.loadAuth0M2MCredentials(secretName);
+          if (credentials) {
+            this.logger.info(`M2M credentials loaded from: ${providerName}`);
+            return credentials;
+          }
+          this.logger.debug(`No credentials found in provider: ${providerName}`);
         }
+        this.logger.info("No M2M credentials found in any provider");
+        return null;
+      }
+      /**
+       * Get the default secret name for M2M credentials based on environment
+       *
+       * @param environment - The environment (prod, staging, local)
+       * @returns The default secret name
+       */
+      static getDefaultSecretName(environment) {
+        return `auth0_m2m_databricks_loader_${environment}`;
+      }
+    };
+    exports2.SecretsProvider = SecretsProvider;
+  }
+});
+
+// dist/auth/secrets/index.js
+var require_secrets = __commonJS({
+  "dist/auth/secrets/index.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.SecretsProvider = exports2.LocalFileSecretsProvider = exports2.AWSSecretsProvider = void 0;
+    var aws_secrets_provider_1 = require_aws_secrets_provider();
+    Object.defineProperty(exports2, "AWSSecretsProvider", { enumerable: true, get: function() {
+      return aws_secrets_provider_1.AWSSecretsProvider;
+    } });
+    var local_file_secrets_provider_1 = require_local_file_secrets_provider();
+    Object.defineProperty(exports2, "LocalFileSecretsProvider", { enumerable: true, get: function() {
+      return local_file_secrets_provider_1.LocalFileSecretsProvider;
+    } });
+    var secrets_provider_1 = require_secrets_provider();
+    Object.defineProperty(exports2, "SecretsProvider", { enumerable: true, get: function() {
+      return secrets_provider_1.SecretsProvider;
+    } });
+  }
+});
+
+// dist/auth/auth-strategy-factory.js
+var require_auth_strategy_factory = __commonJS({
+  "dist/auth/auth-strategy-factory.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.AuthStrategyFactory = void 0;
+    var types_1 = require_types();
+    var service_account_service_1 = require_service_account_service();
+    var auth0_m2m_service_1 = require_auth0_m2m_service();
+    var secrets_1 = require_secrets();
+    var noopLogger = {
+      info: () => {
+      },
+      warn: () => {
+      },
+      error: () => {
+      },
+      debug: () => {
+      }
+    };
+    var AuthStrategyFactory = class {
+      configProvider;
+      logger;
+      constructor(configProvider, logger) {
+        this.configProvider = configProvider;
+        this.logger = logger || noopLogger;
+      }
+      async createStrategy() {
+        const m2mMode = this.configProvider.getM2MMode();
+        switch (m2mMode.type) {
+          case types_1.M2MType.SERVICE_ACCOUNT:
+            return this.buildServiceAccountStrategy(m2mMode);
+          case types_1.M2MType.AUTH0_M2M:
+            return await this.buildAuth0M2MStrategy(m2mMode);
+          default:
+            this.logger.info("Using interactive OAuth flow");
+            return {
+              strategy: null,
+              strategyType: types_1.AuthStrategyType.AUTH0_USER
+            };
+        }
+      }
+      buildServiceAccountStrategy(mode) {
+        this.logger.info(`Service Account mode: ${mode.tokenPath}`);
+        return {
+          strategy: new service_account_service_1.ServiceAccountService(mode.tokenPath, mode.tenantId, this.logger),
+          strategyType: types_1.AuthStrategyType.SERVICE_ACCOUNT
+        };
+      }
+      async buildAuth0M2MStrategy(mode) {
+        const secretsProvider = new secrets_1.SecretsProvider(this.configProvider.getEnvironment(), this.logger);
+        if (!await secretsProvider.isAvailable()) {
+          throw new Error(`Auth0 M2M mode requires a secrets provider. M2M_AUTH0_SECRET_NAME is set to "${mode.secretName}" but no secrets provider is available. Ensure AWS credentials are configured or use Service Account mode instead.`);
+        }
+        const credentials = await secretsProvider.loadAuth0M2MCredentials(mode.secretName);
+        if (!credentials) {
+          throw new Error(`Auth0 M2M credentials not found: "${mode.secretName}". Ensure the secret exists and contains valid Auth0 M2M credentials.`);
+        }
+        this.logger.info(`Auth0 M2M mode: ${mode.secretName}`);
+        return {
+          strategy: new auth0_m2m_service_1.Auth0M2MService(credentials, mode.tenantId, this.logger),
+          strategyType: types_1.AuthStrategyType.AUTH0_M2M
+        };
+      }
+      async isM2MAvailable() {
+        const mode = this.configProvider.getM2MMode();
+        if (mode.type === types_1.M2MType.SERVICE_ACCOUNT) {
+          return true;
+        }
+        if (mode.type === types_1.M2MType.AUTH0_M2M) {
+          const secretsProvider = new secrets_1.SecretsProvider(this.configProvider.getEnvironment(), this.logger);
+          return secretsProvider.isAvailable();
+        }
+        return false;
+      }
+    };
+    exports2.AuthStrategyFactory = AuthStrategyFactory;
+  }
+});
+
+// dist/auth/index.js
+var require_auth = __commonJS({
+  "dist/auth/index.js"(exports2) {
+    "use strict";
+    var __createBinding2 = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __setModuleDefault2 = exports2 && exports2.__setModuleDefault || (Object.create ? (function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    }) : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar2 = exports2 && exports2.__importStar || /* @__PURE__ */ (function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding2(result, mod, k[i]);
+        }
+        __setModuleDefault2(result, mod);
+        return result;
+      };
+    })();
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.SecretsProvider = exports2.LocalFileSecretsProvider = exports2.AWSSecretsProvider = exports2.AuthStrategyFactory = exports2.ServiceAccountService = exports2.Auth0M2MService = exports2.Auth0Service = exports2.M2MType = exports2.AuthStrategyType = exports2.customerAuthConfigs = void 0;
+    exports2.getCustomerAuthConfig = getCustomerAuthConfig;
+    var crypto2 = __importStar2(require("node:crypto"));
+    var customer_auth_configs_1 = require_customer_auth_configs();
+    Object.defineProperty(exports2, "customerAuthConfigs", { enumerable: true, get: function() {
+      return customer_auth_configs_1.customerAuthConfigs;
+    } });
+    function getCustomerAuthConfig(customerDomain) {
+      var _a;
+      const customerHash = crypto2.createHash("sha256").update(customerDomain).digest("hex");
+      const customerConfig = customer_auth_configs_1.customerAuthConfigs[customerHash];
+      if (!customerConfig) {
+        return null;
+      }
+      return {
+        // Use custom Auth0 domain if domainProducer is defined, otherwise use default
+        domain: ((_a = customerConfig.domainProducer) == null ? void 0 : _a.call(customerConfig, customerDomain)) || "https://dataflint.us.auth0.com/",
+        // Customer-specific Auth0 client ID
+        clientId: customerConfig.clientId,
+        // Customer-specific API audience
+        audience: `https://api.${customerDomain}.dataflint.io`,
+        // Customer-specific server URL
+        serverUrl: `https://api.${customerDomain}.dataflint.io`
+      };
     }
-    getSendSourceCode() {
-        const envValue = process.env.DATAFLINT_SEND_SOURCE_CODE;
-        return envValue?.toLowerCase() === "true";
+    var types_1 = require_types();
+    Object.defineProperty(exports2, "AuthStrategyType", { enumerable: true, get: function() {
+      return types_1.AuthStrategyType;
+    } });
+    Object.defineProperty(exports2, "M2MType", { enumerable: true, get: function() {
+      return types_1.M2MType;
+    } });
+    var auth0_service_1 = require_auth0_service();
+    Object.defineProperty(exports2, "Auth0Service", { enumerable: true, get: function() {
+      return auth0_service_1.Auth0Service;
+    } });
+    var auth0_m2m_service_1 = require_auth0_m2m_service();
+    Object.defineProperty(exports2, "Auth0M2MService", { enumerable: true, get: function() {
+      return auth0_m2m_service_1.Auth0M2MService;
+    } });
+    var service_account_service_1 = require_service_account_service();
+    Object.defineProperty(exports2, "ServiceAccountService", { enumerable: true, get: function() {
+      return service_account_service_1.ServiceAccountService;
+    } });
+    var auth_strategy_factory_1 = require_auth_strategy_factory();
+    Object.defineProperty(exports2, "AuthStrategyFactory", { enumerable: true, get: function() {
+      return auth_strategy_factory_1.AuthStrategyFactory;
+    } });
+    var secrets_1 = require_secrets();
+    Object.defineProperty(exports2, "AWSSecretsProvider", { enumerable: true, get: function() {
+      return secrets_1.AWSSecretsProvider;
+    } });
+    Object.defineProperty(exports2, "LocalFileSecretsProvider", { enumerable: true, get: function() {
+      return secrets_1.LocalFileSecretsProvider;
+    } });
+    Object.defineProperty(exports2, "SecretsProvider", { enumerable: true, get: function() {
+      return secrets_1.SecretsProvider;
+    } });
+  }
+});
+
+// dist/standalone/config.js
+var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {
+  if (k2 === void 0) k2 = k;
+  var desc = Object.getOwnPropertyDescriptor(m, k);
+  if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+    desc = { enumerable: true, get: function() {
+      return m[k];
+    } };
+  }
+  Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+  if (k2 === void 0) k2 = k;
+  o[k2] = m[k];
+}));
+var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v) {
+  Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+  o["default"] = v;
+});
+var __importStar = exports && exports.__importStar || /* @__PURE__ */ (function() {
+  var ownKeys = function(o) {
+    ownKeys = Object.getOwnPropertyNames || function(o2) {
+      var ar = [];
+      for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
+      return ar;
+    };
+    return ownKeys(o);
+  };
+  return function(mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) {
+      for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+    }
+    __setModuleDefault(result, mod);
+    return result;
+  };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StandaloneConfigService = void 0;
+var fs = __importStar(require("fs"));
+var path = __importStar(require("path"));
+var os = __importStar(require("os"));
+var crypto = __importStar(require("crypto"));
+var index_js_1 = require_auth();
+var StandaloneConfigService = class {
+  config;
+  credentialsPath;
+  constructor(config = {}) {
+    this.config = this.mergeWithDefaults(config);
+    if (config.credentialsPath) {
+      this.credentialsPath = config.credentialsPath;
+    } else {
+      const clientIdHash = crypto.createHash("sha256").update(this.config.clientId).digest("hex").substring(0, 8);
+      this.credentialsPath = path.join(os.homedir(), ".dataflint", `credentials-${clientIdHash}.json`);
+    }
+    this.ensureDataflintDirectory();
+  }
+  ensureDataflintDirectory() {
+    const dataflintDir = path.dirname(this.credentialsPath);
+    if (!fs.existsSync(dataflintDir)) {
+      fs.mkdirSync(dataflintDir, { recursive: true, mode: 448 });
+    }
+  }
+  mergeWithDefaults(config) {
+    const envConfig = {
+      serverUrl: process.env.DATAFLINT_SERVER_URL,
+      authDomain: process.env.DATAFLINT_AUTH_DOMAIN,
+      clientId: process.env.DATAFLINT_CLIENT_ID,
+      audience: process.env.DATAFLINT_AUDIENCE,
+      scope: process.env.DATAFLINT_SCOPE,
+      adminCompanyDomain: process.env.DATAFLINT_ADMIN_COMPANY_DOMAIN,
+      customerDomain: process.env.DATAFLINT_CUSTOMER_DOMAIN
+    };
+    const configFilePath = path.join(os.homedir(), ".dataflint", "config.json");
+    let fileConfig = {};
+    if (fs.existsSync(configFilePath)) {
+      try {
+        const fileContent = fs.readFileSync(configFilePath, "utf8");
+        fileConfig = JSON.parse(fileContent);
+      } catch (error) {
+      }
+    }
+    const customerDomain = config.customerDomain || envConfig.customerDomain || fileConfig.customerDomain;
+    if (customerDomain) {
+      console.error(`[CONFIG] Customer domain detected: ${customerDomain}`);
+      const customerConfig = (0, index_js_1.getCustomerAuthConfig)(customerDomain);
+      if (!customerConfig) {
+        console.error(`[CONFIG] ERROR: Unknown customer domain: ${customerDomain}`);
+        throw new Error(`Unknown customer domain: "${customerDomain}". This customer is not registered in the system. Please check the domain name or contact support.`);
+      }
+      console.error(`[CONFIG] Using customer-specific configuration:`);
+      console.error(`[CONFIG]   - Server URL: ${customerConfig.serverUrl}`);
+      console.error(`[CONFIG]   - Auth0 Domain: ${customerConfig.domain}`);
+      console.error(`[CONFIG]   - Client ID: ${customerConfig.clientId.substring(0, 8)}...`);
+      return {
+        serverUrl: customerConfig.serverUrl,
+        authDomain: customerConfig.domain,
+        clientId: customerConfig.clientId,
+        audience: customerConfig.audience,
+        scope: "openid profile email offline_access",
+        // Credentials path only configurable via CLI argument for security
+        credentialsPath: config.credentialsPath,
+        adminCompanyDomain: config.adminCompanyDomain || envConfig.adminCompanyDomain || fileConfig.adminCompanyDomain || "none",
+        customerDomain
+      };
     }
-    getM2MMode() {
-        return this.m2mMode;
+    console.error(`[CONFIG] No customer domain - using default/explicit configuration`);
+    return {
+      serverUrl: config.serverUrl || envConfig.serverUrl || fileConfig.serverUrl || "https://api.dataflint.io",
+      authDomain: config.authDomain || envConfig.authDomain || fileConfig.authDomain || "https://dataflint.us.auth0.com/",
+      clientId: config.clientId || envConfig.clientId || fileConfig.clientId || "1NdbhkYoLyqQWtevBNal1BozB9pSZe3g",
+      audience: config.audience || envConfig.audience || fileConfig.audience || "https://api.dataflint.io",
+      scope: config.scope || envConfig.scope || fileConfig.scope || "openid profile email offline_access",
+      adminCompanyDomain: config.adminCompanyDomain || envConfig.adminCompanyDomain || fileConfig.adminCompanyDomain || "none",
+      // Credentials path only configurable via CLI argument for security
+      credentialsPath: config.credentialsPath,
+      customerDomain: void 0
+    };
+  }
+  // IConfigService interface implementation
+  getServerUrl() {
+    return this.config.serverUrl;
+  }
+  getEnvironment() {
+    return "prod";
+  }
+  getCustomerDomain() {
+    return this.config.customerDomain || null;
+  }
+  getAdminCompanyDomain() {
+    return this.config.adminCompanyDomain || "none";
+  }
+  getAuthConfig() {
+    return {
+      domain: this.config.authDomain,
+      clientId: this.config.clientId,
+      audience: this.config.audience,
+      scope: this.config.scope || "openid profile email offline_access"
+    };
+  }
+  async getAuthSecret() {
+    try {
+      if (fs.existsSync(this.credentialsPath)) {
+        const content = fs.readFileSync(this.credentialsPath, "utf8");
+        return content;
+      }
+      return void 0;
+    } catch (error) {
+      return void 0;
     }
-    getTenantId() {
-        return this.config.tenantId;
+  }
+  async setAuthSecret(value) {
+    this.ensureDataflintDirectory();
+    fs.writeFileSync(this.credentialsPath, value, {
+      mode: 384,
+      encoding: "utf8"
+    });
+  }
+  async deleteAuthSecret() {
+    try {
+      if (fs.existsSync(this.credentialsPath)) {
+        fs.unlinkSync(this.credentialsPath);
+      }
+    } catch (error) {
     }
-}
+  }
+  getSendSourceCode() {
+    const envValue = process.env.DATAFLINT_SEND_SOURCE_CODE;
+    return (envValue == null ? void 0 : envValue.toLowerCase()) === "true";
+  }
+};
 exports.StandaloneConfigService = StandaloneConfigService;
-//# sourceMappingURL=config.js.map
+//# sourceMappingURL=config.js.map