@dbx-tools/auth 0.9.32 → 0.9.36

package/README.md

@@ -1,122 +1,74 @@
 # `@dbx-tools/auth`
 
-Persistent Databricks authentication for Node.js and Bun without a native
-binding requirement.
+Databricks profile resolution and token or authentication-header production for
+Node.js and Bun.
 
-Outside Databricks Apps, the package reads PAT credentials directly, uses direct
-client credentials for service principals, and delegates U2M authentication to
-the Databricks CLI. CLI resolution is lazy: the package checks the installed CLI
-only when U2M reaches token acquisition, then checksum-verifies and installs the
-pinned build asset through `@dbx-tools/core/bin` when needed. Inside Databricks
-Apps, it accepts request-scoped App OBO headers or App SP environment
-credentials. No browser OAuth flow is implemented.
+The package resolves profile configuration, selects PAT, M2M, CLI U2M, App
+service-principal, or App OBO authentication, and coordinates token acquisition
+in process memory. It does not own workspace HTTP APIs or construct Databricks
+SDK clients.
 
 ## Features
 
-- Lazy, version-checked CLI U2M outside Databricks Apps.
-- Direct PAT and M2M/App SP credentials.
-- Request-scoped App OBO authentication inside Databricks Apps.
-- Databricks profile parsing with `__settings__.default_profile`, `DEFAULT`, and
-  sole-profile selection.
-- Optional preference for one matching CLI U2M profile over an implicit M2M
-  default. Explicit profiles are never remapped.
-- Check-lock-recheck token acquisition and rejected-token refresh.
-- Process-memory credential storage by default, with explicit file or
-  caller-defined storage and lock adapters.
-- Same-origin authorization headers and one rejected-token retry in the bundled
-  fetch client.
-- Secret-free profile enumeration with explicit cache refresh.
-
-When a cached U2M credential is missing or cannot refresh, the shared lifecycle
-holds the credential lock, runs `databricks auth login`, and then re-reads the
-CLI token. Passing `false` to token or header acquisition disables this
-interactive fallback.
-
-## Relationship to the Databricks Python SDK
-
-The default provider shape intentionally follows the official Python SDK:
-
-| Concern            | Python SDK behavior                                                                                                   | `@dbx-tools/auth` behavior                                                                                                                                                                             |
-| ------------------ | --------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| PAT                | Reads the configured token directly.                                                                                  | Same.                                                                                                                                                                                                  |
-| Service principal  | Uses direct OAuth client credentials.                                                                                 | Same, including account and workspace targets.                                                                                                                                                         |
-| U2M                | Delegates token acquisition to `databricks auth token`.                                                               | Same token command, but automatically runs `databricks auth login` under the credential lock when acquisition or refresh fails and login is allowed.                                                   |
-| Configuration      | Parses `.databrickscfg` with a standard INI parser.                                                                   | Uses the maintained `ini` package, caches each absolute config path, and exposes explicit invalidation.                                                                                                |
-| Implicit profile   | Uses `__settings__.default_profile`, `DEFAULT`, or a sole profile.                                                    | Same, plus an optional unique matching CLI-U2M profile preference when the selected implicit default is M2M. Explicit profiles are never remapped.                                                     |
-| Token coordination | Providers manage their own acquisition behavior.                                                                      | Adds memory/file caching and check-lock-recheck coordination shared by Node and PythonMonkey callers.                                                                                                  |
-| CLI availability   | Requires a compatible CLI already installed.                                                                          | Resolves lazily, reuses a compatible installed or managed CLI, and can checksum-install a pinned build outside Apps.                                                                                   |
-| Databricks Apps    | Earlier App credentials normally prevent reaching the CLI; the default chain can still reach it when they are absent. | App OBO and App SP remain preferred. Standard profile/PAT/M2M/U2M resolution continues when they are absent. CLI lookup stays lazy and never installs in an App unless `installCliInApp: true` is set. |
-
-Unlike the Python SDK, this package does not implement a separate native
-external-browser provider. Interactive U2M remains CLI-owned so login, token
-format, and credential persistence stay consistent with Databricks tooling.
+- Standard `.databrickscfg` parsing and default-profile selection.
+- Secret-free configured profile enumeration.
+- CLI-backed U2M token and login commands.
+- Direct PAT, M2M, App service-principal, and request-scoped App OBO tokens.
+- Check-lock-recheck token acquisition and explicit token refresh.
+- Authentication headers with the resolved workspace ID when available.
+- No SDK, generic HTTP client, executable installer, or persistent token cache.
+
+CLI-backed U2M requires an available `databricks` executable or an explicit
+`DATABRICKS_CLI_PATH`. The Databricks CLI remains responsible for its own login
+and credential persistence.
 
 ## Basic use
 
 ```ts
-import { createAuthClient } from "@dbx-tools/auth";
+import { client, profile } from "@dbx-tools/auth";
 
-const auth = await createAuthClient();
-const headers = await auth.authenticate();
-const profile = auth.profile();
-const namedProfile = auth.profile("DEFAULT");
-const profiles = auth.listProfiles();
+const auth = await client.createAuthClient({ profile: "DEFAULT" });
+const token = await auth.token();
+const headers = await auth.headers();
+const host = auth.host;
+const profiles = profile.listProfiles();
 ```
 
-`createAuthClient()` is the package's public factory. The returned client owns
-token and header acquisition, the selected secret-free profile, configured
-profile listing, lifecycle status, refresh, logout, and same-origin request
-headers.
-
-`authenticate()` returns the complete request header record, including
-`authorization` and `x-databricks-workspace-id` when the selected profile has a
-`workspace_id`. It allows login when a credential is missing or cannot refresh.
-Pass `false` to keep the call non-interactive:
-
-```ts
-const headers = await auth.authenticate(false);
-```
+`headers()` returns the authorization header and
+`x-databricks-workspace-id` when the selected profile has a workspace ID. Pass
+`{ login: false }` to token or authentication acquisition to disable
+interactive login. Pass `{ refresh: true }` to bypass a reusable cached token.
 
-`token()` remains available when only the token record is needed.
+Browser and UI code should import auth-type values, target values, profile
+summaries, profile selections, and client-configuration schemas from
+`@dbx-tools/shared-auth`.
 
-## Portable storage
+## Consumer-owned clients
 
-`createAuthClient()` keeps acquired credentials in process memory by default for
-CLI U2M, PAT, M2M, App SP, and App OBO flows. Pass `Storage.File` as the second
-argument when disk persistence is explicitly required.
+Capability packages should use the returned `AuthClient` directly:
 
 ```ts
-import { createAuthClient, DatabricksAuthOptions, Storage } from "@dbx-tools/auth";
-
-const auth = await createAuthClient(
-  DatabricksAuthOptions.create({ profile: "DEFAULT" }),
-  Storage.File,
-);
+const auth = await client.createAuthClient({ profile: "DEFAULT" });
+const headers = await auth.headers();
 ```
 
-The opt-in file store uses `node:fs` with `@dbx-tools/core/file-lock` and
-preserves unrelated entries in `~/.databricks/token-cache.json`.
+Use those headers in a capability-specific request, or inject the token and host
+into an AppKit or Databricks SDK workspace client. Keep request paths, payloads,
+response parsing, and retry policy in the consuming package.
 
-## Debug logging
-
-Set `LOG_LEVEL=debug` to trace profile selection, configuration caching, CLI
-resolution, provider choice, credential locks, cache reuse, refresh/login
-fallback, OAuth discovery, same-origin header decisions, and HTTP retry state.
+## Public modules
 
-```sh
-LOG_LEVEL=debug bun run my-auth-command
-```
+- `client` owns `createAuthClient`, `AuthClient`, access-token results, and
+  token lifecycle operations.
+- `config` owns secret-bearing profile options, lifecycle timing, and canonical
+  header names.
+- `profile` owns profile resolution and listing operations.
 
-Debug records include profile and host metadata, storage/backend choices,
-header names, token expiry state, and scope counts. They never include access
-tokens, refresh tokens, client secrets, authorization values, raw request
-headers, token-cache contents, or request/response bodies.
+Provider, lifecycle, lock, and storage types are private implementation details.
 
-## Modules
+## Debug logging
 
-- `databricksAuth` provides `PersistentAuth` and Databricks provider construction.
-- `profile` parses and resolves Databricks configuration.
-- `lifecycle` implements provider-neutral token coordination.
-- `storage` and `nodeStorage` provide memory and file adapters.
-- `servicePrincipal` provides Databricks client-credentials authentication.
-- `httpClient` provides a small fetch-based Databricks JSON client.
+Set `LOG_LEVEL=debug` to trace profile selection, provider choice, credential
+locks, cache reuse, token refresh, and login fallback. Logs never include access
+tokens, refresh tokens, client secrets, authorization values, raw request
+headers, or request bodies.

package/index.ts

@@ -3,29 +3,11 @@
 // Hand edits are overwritten on the next watch; this file is read-only.
 
 export const PACKAGE_IDENTIFIER = "@dbx-tools/auth";
-export const PACKAGE_VERSION = "0.9.32";
-export * as databricksAuth from "./src/databricks-auth.ts";
-export * as databricksCli from "./src/databricks-cli.ts";
-export * as errors from "./src/errors.ts";
-export * as fileStorage from "./src/file-storage.ts";
-export * as httpClient from "./src/http-client.ts";
-export * as lifecycle from "./src/lifecycle.ts";
-export * as personalAccessToken from "./src/personal-access-token.ts";
-export * as servicePrincipal from "./src/service-principal.ts";
-export * as storage from "./src/storage.ts";
-export * as types from "./src/types.ts";
-export type { DatabricksAuthDependencies } from "./src/databricks-auth.ts";
-export { DatabricksCliProvider } from "./src/databricks-cli.ts";
-export type { DatabricksCliResolver, DatabricksCliResolutionOptions } from "./src/databricks-cli.ts";
-export { AuthError } from "./src/errors.ts";
-export { FileCredentialStore } from "./src/file-storage.ts";
-export { DatabricksClient } from "./src/http-client.ts";
-export type { DatabricksRequestOptions } from "./src/http-client.ts";
-export { TokenLifecycle } from "./src/lifecycle.ts";
-export { DatabricksPersonalAccessTokenProvider } from "./src/personal-access-token.ts";
-export { DatabricksServicePrincipalProvider } from "./src/service-principal.ts";
-export type { DatabricksServicePrincipalConfig } from "./src/service-principal.ts";
-export { MemoryLockAdapter, MemoryCredentialStore } from "./src/storage.ts";
-export { AuthKind, TargetKind, Storage, FileLayout, DEFAULT_CLIENT_ID, DEFAULT_CONFIG_FILE, DEFAULT_ACCOUNTS_HOST, DEFAULT_ACCESS_TOKEN_HEADER, WORKSPACE_ID_HEADER, AUTH_TYPE_APP_OBO, AUTH_TYPE_APP_SP } from "./src/types.ts";
-export type { Token, AccessToken, DatabricksProfileSummary, DatabricksAuthStatus, DatabricksProfile, LockAdapter, CredentialStore, TokenProvider, AuthClient } from "./src/types.ts";
-export * from "./exports.ts";
+export const PACKAGE_VERSION = "0.9.36";
+export * as client from "./src/client.ts";
+export * as config from "./src/config.ts";
+export * as profile from "./src/profile.ts";
+export type { AccessToken, TokenOptions, AuthClient, DatabricksAuthDependencies } from "./src/client.ts";
+export { AUTH_DEFAULTS, DEFAULT_CLIENT_ID, DEFAULT_CONFIG_FILE, DEFAULT_ACCESS_TOKEN_HEADER, WORKSPACE_ID_HEADER } from "./src/config.ts";
+export type { AuthOptions, DatabricksAuthOptions } from "./src/config.ts";
+export type { ListProfilesOptions } from "./src/profile.ts";

package/lib/index.d.ts

@@ -1,27 +1,9 @@
 export declare const PACKAGE_IDENTIFIER = "@dbx-tools/auth";
-export declare const PACKAGE_VERSION = "0.9.32";
-export * as databricksAuth from "./src/databricks-auth.ts";
-export * as databricksCli from "./src/databricks-cli.ts";
-export * as errors from "./src/errors.ts";
-export * as fileStorage from "./src/file-storage.ts";
-export * as httpClient from "./src/http-client.ts";
-export * as lifecycle from "./src/lifecycle.ts";
-export * as personalAccessToken from "./src/personal-access-token.ts";
-export * as servicePrincipal from "./src/service-principal.ts";
-export * as storage from "./src/storage.ts";
-export * as types from "./src/types.ts";
-export type { DatabricksAuthDependencies } from "./src/databricks-auth.ts";
-export { DatabricksCliProvider } from "./src/databricks-cli.ts";
-export type { DatabricksCliResolver, DatabricksCliResolutionOptions } from "./src/databricks-cli.ts";
-export { AuthError } from "./src/errors.ts";
-export { FileCredentialStore } from "./src/file-storage.ts";
-export { DatabricksClient } from "./src/http-client.ts";
-export type { DatabricksRequestOptions } from "./src/http-client.ts";
-export { TokenLifecycle } from "./src/lifecycle.ts";
-export { DatabricksPersonalAccessTokenProvider } from "./src/personal-access-token.ts";
-export { DatabricksServicePrincipalProvider } from "./src/service-principal.ts";
-export type { DatabricksServicePrincipalConfig } from "./src/service-principal.ts";
-export { MemoryLockAdapter, MemoryCredentialStore } from "./src/storage.ts";
-export { AuthKind, TargetKind, Storage, FileLayout, DEFAULT_CLIENT_ID, DEFAULT_CONFIG_FILE, DEFAULT_ACCOUNTS_HOST, DEFAULT_ACCESS_TOKEN_HEADER, WORKSPACE_ID_HEADER, AUTH_TYPE_APP_OBO, AUTH_TYPE_APP_SP } from "./src/types.ts";
-export type { Token, AccessToken, DatabricksProfileSummary, DatabricksAuthStatus, DatabricksProfile, LockAdapter, CredentialStore, TokenProvider, AuthClient } from "./src/types.ts";
-export * from "./exports.ts";
+export declare const PACKAGE_VERSION = "0.9.36";
+export * as client from "./src/client.ts";
+export * as config from "./src/config.ts";
+export * as profile from "./src/profile.ts";
+export type { AccessToken, TokenOptions, AuthClient, DatabricksAuthDependencies } from "./src/client.ts";
+export { AUTH_DEFAULTS, DEFAULT_CLIENT_ID, DEFAULT_CONFIG_FILE, DEFAULT_ACCESS_TOKEN_HEADER, WORKSPACE_ID_HEADER } from "./src/config.ts";
+export type { AuthOptions, DatabricksAuthOptions } from "./src/config.ts";
+export type { ListProfilesOptions } from "./src/profile.ts";

package/lib/index.js

@@ -2,25 +2,9 @@
 // Regenerated from the exporting modules in ./src.
 // Hand edits are overwritten on the next watch; this file is read-only.
 export const PACKAGE_IDENTIFIER = "@dbx-tools/auth";
-export const PACKAGE_VERSION = "0.9.32";
-export * as databricksAuth from "./src/databricks-auth.js";
-export * as databricksCli from "./src/databricks-cli.js";
-export * as errors from "./src/errors.js";
-export * as fileStorage from "./src/file-storage.js";
-export * as httpClient from "./src/http-client.js";
-export * as lifecycle from "./src/lifecycle.js";
-export * as personalAccessToken from "./src/personal-access-token.js";
-export * as servicePrincipal from "./src/service-principal.js";
-export * as storage from "./src/storage.js";
-export * as types from "./src/types.js";
-export { DatabricksCliProvider } from "./src/databricks-cli.js";
-export { AuthError } from "./src/errors.js";
-export { FileCredentialStore } from "./src/file-storage.js";
-export { DatabricksClient } from "./src/http-client.js";
-export { TokenLifecycle } from "./src/lifecycle.js";
-export { DatabricksPersonalAccessTokenProvider } from "./src/personal-access-token.js";
-export { DatabricksServicePrincipalProvider } from "./src/service-principal.js";
-export { MemoryLockAdapter, MemoryCredentialStore } from "./src/storage.js";
-export { AuthKind, TargetKind, Storage, FileLayout, DEFAULT_CLIENT_ID, DEFAULT_CONFIG_FILE, DEFAULT_ACCOUNTS_HOST, DEFAULT_ACCESS_TOKEN_HEADER, WORKSPACE_ID_HEADER, AUTH_TYPE_APP_OBO, AUTH_TYPE_APP_SP } from "./src/types.js";
-export * from "./exports.js";
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwyQ0FBMkM7QUFDM0MsbURBQW1EO0FBQ25ELHdFQUF3RTtBQUV4RSxNQUFNLENBQUMsTUFBTSxrQkFBa0IsR0FBRyxpQkFBaUIsQ0FBQztBQUNwRCxNQUFNLENBQUMsTUFBTSxlQUFlLEdBQUcsUUFBUSxDQUFDO0FBQ3hDLE9BQU8sS0FBSyxjQUFjLE1BQU0sMEJBQTBCLENBQUM7QUFDM0QsT0FBTyxLQUFLLGFBQWEsTUFBTSx5QkFBeUIsQ0FBQztBQUN6RCxPQUFPLEtBQUssTUFBTSxNQUFNLGlCQUFpQixDQUFDO0FBQzFDLE9BQU8sS0FBSyxXQUFXLE1BQU0sdUJBQXVCLENBQUM7QUFDckQsT0FBTyxLQUFLLFVBQVUsTUFBTSxzQkFBc0IsQ0FBQztBQUNuRCxPQUFPLEtBQUssU0FBUyxNQUFNLG9CQUFvQixDQUFDO0FBQ2hELE9BQU8sS0FBSyxtQkFBbUIsTUFBTSxnQ0FBZ0MsQ0FBQztBQUN0RSxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sNEJBQTRCLENBQUM7QUFDL0QsT0FBTyxLQUFLLE9BQU8sTUFBTSxrQkFBa0IsQ0FBQztBQUM1QyxPQUFPLEtBQUssS0FBSyxNQUFNLGdCQUFnQixDQUFDO0FBRXhDLE9BQU8sRUFBRSxxQkFBcUIsRUFBRSxNQUFNLHlCQUF5QixDQUFDO0FBRWhFLE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxpQkFBaUIsQ0FBQztBQUM1QyxPQUFPLEVBQUUsbUJBQW1CLEVBQUUsTUFBTSx1QkFBdUIsQ0FBQztBQUM1RCxPQUFPLEVBQUUsZ0JBQWdCLEVBQUUsTUFBTSxzQkFBc0IsQ0FBQztBQUV4RCxPQUFPLEVBQUUsY0FBYyxFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFDcEQsT0FBTyxFQUFFLHFDQUFxQyxFQUFFLE1BQU0sZ0NBQWdDLENBQUM7QUFDdkYsT0FBTyxFQUFFLGtDQUFrQyxFQUFFLE1BQU0sNEJBQTRCLENBQUM7QUFFaEYsT0FBTyxFQUFFLGlCQUFpQixFQUFFLHFCQUFxQixFQUFFLE1BQU0sa0JBQWtCLENBQUM7QUFDNUUsT0FBTyxFQUFFLFFBQVEsRUFBRSxVQUFVLEVBQUUsT0FBTyxFQUFFLFVBQVUsRUFBRSxpQkFBaUIsRUFBRSxtQkFBbUIsRUFBRSxxQkFBcUIsRUFBRSwyQkFBMkIsRUFBRSxtQkFBbUIsRUFBRSxpQkFBaUIsRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLGdCQUFnQixDQUFDO0FBRWpPLGNBQWMsY0FBYyxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gR0VORVJBVEVEIGJ5IHByb2plbiB3YXRjaCAtIERPIE5PVCBFRElULlxuLy8gUmVnZW5lcmF0ZWQgZnJvbSB0aGUgZXhwb3J0aW5nIG1vZHVsZXMgaW4gLi9zcmMuXG4vLyBIYW5kIGVkaXRzIGFyZSBvdmVyd3JpdHRlbiBvbiB0aGUgbmV4dCB3YXRjaDsgdGhpcyBmaWxlIGlzIHJlYWQtb25seS5cblxuZXhwb3J0IGNvbnN0IFBBQ0tBR0VfSURFTlRJRklFUiA9IFwiQGRieC10b29scy9hdXRoXCI7XG5leHBvcnQgY29uc3QgUEFDS0FHRV9WRVJTSU9OID0gXCIwLjkuMzJcIjtcbmV4cG9ydCAqIGFzIGRhdGFicmlja3NBdXRoIGZyb20gXCIuL3NyYy9kYXRhYnJpY2tzLWF1dGgudHNcIjtcbmV4cG9ydCAqIGFzIGRhdGFicmlja3NDbGkgZnJvbSBcIi4vc3JjL2RhdGFicmlja3MtY2xpLnRzXCI7XG5leHBvcnQgKiBhcyBlcnJvcnMgZnJvbSBcIi4vc3JjL2Vycm9ycy50c1wiO1xuZXhwb3J0ICogYXMgZmlsZVN0b3JhZ2UgZnJvbSBcIi4vc3JjL2ZpbGUtc3RvcmFnZS50c1wiO1xuZXhwb3J0ICogYXMgaHR0cENsaWVudCBmcm9tIFwiLi9zcmMvaHR0cC1jbGllbnQudHNcIjtcbmV4cG9ydCAqIGFzIGxpZmVjeWNsZSBmcm9tIFwiLi9zcmMvbGlmZWN5Y2xlLnRzXCI7XG5leHBvcnQgKiBhcyBwZXJzb25hbEFjY2Vzc1Rva2VuIGZyb20gXCIuL3NyYy9wZXJzb25hbC1hY2Nlc3MtdG9rZW4udHNcIjtcbmV4cG9ydCAqIGFzIHNlcnZpY2VQcmluY2lwYWwgZnJvbSBcIi4vc3JjL3NlcnZpY2UtcHJpbmNpcGFsLnRzXCI7XG5leHBvcnQgKiBhcyBzdG9yYWdlIGZyb20gXCIuL3NyYy9zdG9yYWdlLnRzXCI7XG5leHBvcnQgKiBhcyB0eXBlcyBmcm9tIFwiLi9zcmMvdHlwZXMudHNcIjtcbmV4cG9ydCB0eXBlIHsgRGF0YWJyaWNrc0F1dGhEZXBlbmRlbmNpZXMgfSBmcm9tIFwiLi9zcmMvZGF0YWJyaWNrcy1hdXRoLnRzXCI7XG5leHBvcnQgeyBEYXRhYnJpY2tzQ2xpUHJvdmlkZXIgfSBmcm9tIFwiLi9zcmMvZGF0YWJyaWNrcy1jbGkudHNcIjtcbmV4cG9ydCB0eXBlIHsgRGF0YWJyaWNrc0NsaVJlc29sdmVyLCBEYXRhYnJpY2tzQ2xpUmVzb2x1dGlvbk9wdGlvbnMgfSBmcm9tIFwiLi9zcmMvZGF0YWJyaWNrcy1jbGkudHNcIjtcbmV4cG9ydCB7IEF1dGhFcnJvciB9IGZyb20gXCIuL3NyYy9lcnJvcnMudHNcIjtcbmV4cG9ydCB7IEZpbGVDcmVkZW50aWFsU3RvcmUgfSBmcm9tIFwiLi9zcmMvZmlsZS1zdG9yYWdlLnRzXCI7XG5leHBvcnQgeyBEYXRhYnJpY2tzQ2xpZW50IH0gZnJvbSBcIi4vc3JjL2h0dHAtY2xpZW50LnRzXCI7XG5leHBvcnQgdHlwZSB7IERhdGFicmlja3NSZXF1ZXN0T3B0aW9ucyB9IGZyb20gXCIuL3NyYy9odHRwLWNsaWVudC50c1wiO1xuZXhwb3J0IHsgVG9rZW5MaWZlY3ljbGUgfSBmcm9tIFwiLi9zcmMvbGlmZWN5Y2xlLnRzXCI7XG5leHBvcnQgeyBEYXRhYnJpY2tzUGVyc29uYWxBY2Nlc3NUb2tlblByb3ZpZGVyIH0gZnJvbSBcIi4vc3JjL3BlcnNvbmFsLWFjY2Vzcy10b2tlbi50c1wiO1xuZXhwb3J0IHsgRGF0YWJyaWNrc1NlcnZpY2VQcmluY2lwYWxQcm92aWRlciB9IGZyb20gXCIuL3NyYy9zZXJ2aWNlLXByaW5jaXBhbC50c1wiO1xuZXhwb3J0IHR5cGUgeyBEYXRhYnJpY2tzU2VydmljZVByaW5jaXBhbENvbmZpZyB9IGZyb20gXCIuL3NyYy9zZXJ2aWNlLXByaW5jaXBhbC50c1wiO1xuZXhwb3J0IHsgTWVtb3J5TG9ja0FkYXB0ZXIsIE1lbW9yeUNyZWRlbnRpYWxTdG9yZSB9IGZyb20gXCIuL3NyYy9zdG9yYWdlLnRzXCI7XG5leHBvcnQgeyBBdXRoS2luZCwgVGFyZ2V0S2luZCwgU3RvcmFnZSwgRmlsZUxheW91dCwgREVGQVVMVF9DTElFTlRfSUQsIERFRkFVTFRfQ09ORklHX0ZJTEUsIERFRkFVTFRfQUNDT1VOVFNfSE9TVCwgREVGQVVMVF9BQ0NFU1NfVE9LRU5fSEVBREVSLCBXT1JLU1BBQ0VfSURfSEVBREVSLCBBVVRIX1RZUEVfQVBQX09CTywgQVVUSF9UWVBFX0FQUF9TUCB9IGZyb20gXCIuL3NyYy90eXBlcy50c1wiO1xuZXhwb3J0IHR5cGUgeyBUb2tlbiwgQWNjZXNzVG9rZW4sIERhdGFicmlja3NQcm9maWxlU3VtbWFyeSwgRGF0YWJyaWNrc0F1dGhTdGF0dXMsIERhdGFicmlja3NQcm9maWxlLCBMb2NrQWRhcHRlciwgQ3JlZGVudGlhbFN0b3JlLCBUb2tlblByb3ZpZGVyLCBBdXRoQ2xpZW50IH0gZnJvbSBcIi4vc3JjL3R5cGVzLnRzXCI7XG5leHBvcnQgKiBmcm9tIFwiLi9leHBvcnRzLnRzXCI7XG4iXX0=
+export const PACKAGE_VERSION = "0.9.36";
+export * as client from "./src/client.js";
+export * as config from "./src/config.js";
+export * as profile from "./src/profile.js";
+export { AUTH_DEFAULTS, DEFAULT_CLIENT_ID, DEFAULT_CONFIG_FILE, DEFAULT_ACCESS_TOKEN_HEADER, WORKSPACE_ID_HEADER } from "./src/config.js";
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwyQ0FBMkM7QUFDM0MsbURBQW1EO0FBQ25ELHdFQUF3RTtBQUV4RSxNQUFNLENBQUMsTUFBTSxrQkFBa0IsR0FBRyxpQkFBaUIsQ0FBQztBQUNwRCxNQUFNLENBQUMsTUFBTSxlQUFlLEdBQUcsUUFBUSxDQUFDO0FBQ3hDLE9BQU8sS0FBSyxNQUFNLE1BQU0saUJBQWlCLENBQUM7QUFDMUMsT0FBTyxLQUFLLE1BQU0sTUFBTSxpQkFBaUIsQ0FBQztBQUMxQyxPQUFPLEtBQUssT0FBTyxNQUFNLGtCQUFrQixDQUFDO0FBRTVDLE9BQU8sRUFBRSxhQUFhLEVBQUUsaUJBQWlCLEVBQUUsbUJBQW1CLEVBQUUsMkJBQTJCLEVBQUUsbUJBQW1CLEVBQUUsTUFBTSxpQkFBaUIsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIEdFTkVSQVRFRCBieSBwcm9qZW4gd2F0Y2ggLSBETyBOT1QgRURJVC5cbi8vIFJlZ2VuZXJhdGVkIGZyb20gdGhlIGV4cG9ydGluZyBtb2R1bGVzIGluIC4vc3JjLlxuLy8gSGFuZCBlZGl0cyBhcmUgb3ZlcndyaXR0ZW4gb24gdGhlIG5leHQgd2F0Y2g7IHRoaXMgZmlsZSBpcyByZWFkLW9ubHkuXG5cbmV4cG9ydCBjb25zdCBQQUNLQUdFX0lERU5USUZJRVIgPSBcIkBkYngtdG9vbHMvYXV0aFwiO1xuZXhwb3J0IGNvbnN0IFBBQ0tBR0VfVkVSU0lPTiA9IFwiMC45LjM2XCI7XG5leHBvcnQgKiBhcyBjbGllbnQgZnJvbSBcIi4vc3JjL2NsaWVudC50c1wiO1xuZXhwb3J0ICogYXMgY29uZmlnIGZyb20gXCIuL3NyYy9jb25maWcudHNcIjtcbmV4cG9ydCAqIGFzIHByb2ZpbGUgZnJvbSBcIi4vc3JjL3Byb2ZpbGUudHNcIjtcbmV4cG9ydCB0eXBlIHsgQWNjZXNzVG9rZW4sIFRva2VuT3B0aW9ucywgQXV0aENsaWVudCwgRGF0YWJyaWNrc0F1dGhEZXBlbmRlbmNpZXMgfSBmcm9tIFwiLi9zcmMvY2xpZW50LnRzXCI7XG5leHBvcnQgeyBBVVRIX0RFRkFVTFRTLCBERUZBVUxUX0NMSUVOVF9JRCwgREVGQVVMVF9DT05GSUdfRklMRSwgREVGQVVMVF9BQ0NFU1NfVE9LRU5fSEVBREVSLCBXT1JLU1BBQ0VfSURfSEVBREVSIH0gZnJvbSBcIi4vc3JjL2NvbmZpZy50c1wiO1xuZXhwb3J0IHR5cGUgeyBBdXRoT3B0aW9ucywgRGF0YWJyaWNrc0F1dGhPcHRpb25zIH0gZnJvbSBcIi4vc3JjL2NvbmZpZy50c1wiO1xuZXhwb3J0IHR5cGUgeyBMaXN0UHJvZmlsZXNPcHRpb25zIH0gZnJvbSBcIi4vc3JjL3Byb2ZpbGUudHNcIjtcbiJdfQ==

package/lib/src/{databricks-cli.d.ts → _databricks-cli.d.ts}

@@ -1,12 +1,8 @@
-import type { Token, TokenProvider } from "./types.ts";
+import type { Token, TokenProvider } from "./_types.ts";
 /** Deferred Databricks CLI lookup used by U2M token acquisition. */
 export type DatabricksCliResolver = () => Promise<string | undefined>;
-/** Controls whether CLI resolution may install the pinned managed executable. */
-export interface DatabricksCliResolutionOptions {
-    install?: boolean;
-}
-/** Resolve a compatible Databricks CLI, installing the pinned build asset when needed. */
-export declare function resolveDatabricksCli(environment?: Readonly<Record<string, string | undefined>>, options?: DatabricksCliResolutionOptions): Promise<string | undefined>;
+/** Resolve an available Databricks CLI without installing executables. */
+export declare function resolveDatabricksCli(environment?: Readonly<Record<string, string | undefined>>): Promise<string | undefined>;
 /** Clear cached CLI resolution, primarily after installation or environment changes. */
 export declare function resetDatabricksCliResolution(): void;
 /** Run interactive Databricks CLI login for one profile. */

package/lib/src/_databricks-cli.js

@@ -0,0 +1,172 @@
+import * as exec from "@dbx-tools/core/exec";
+import * as stringUtils from "@dbx-tools/shared-core/string-utils";
+import { AuthError } from "./_errors.js";
+import { authLogger, failureMetadata, tokenMetadata } from "./_logging.js";
+const resolutionCache = new Map();
+const logger = authLogger("cli");
+/** Resolve an available Databricks CLI without installing executables. */
+export function resolveDatabricksCli(environment = process.env) {
+    const candidate = stringValue(environment.DATABRICKS_CLI_PATH) ?? "databricks";
+    const cached = resolutionCache.get(candidate);
+    if (cached) {
+        logger.debug("reused Databricks CLI resolution", { candidate });
+        return cached;
+    }
+    logger.debug("resolving Databricks CLI", { candidate });
+    const resolved = compatibleDatabricksCli(candidate)
+        .then((compatible) => (compatible ? candidate : undefined))
+        .catch((error) => {
+        resolutionCache.delete(candidate);
+        throw error;
+    });
+    resolutionCache.set(candidate, resolved);
+    return resolved;
+}
+/** Clear cached CLI resolution, primarily after installation or environment changes. */
+export function resetDatabricksCliResolution() {
+    resolutionCache.clear();
+    logger.debug("cleared Databricks CLI resolution cache");
+}
+async function compatibleDatabricksCli(executable) {
+    try {
+        const result = await runProcess(executable, ["--version"], {}, 10_000);
+        if (result.exitCode !== 0) {
+            logger.debug("Databricks CLI version probe failed", {
+                executable,
+                exitCode: result.exitCode,
+            });
+            return false;
+        }
+        logger.debug("selected installed Databricks CLI", { executable });
+        return true;
+    }
+    catch (cause) {
+        logger.debug("Databricks CLI version probe unavailable", {
+            executable,
+            error: failureMetadata(cause),
+        });
+        return false;
+    }
+}
+/** Run interactive Databricks CLI login for one profile. */
+export async function databricksCliLogin(profile, timeoutMs, executable = process.env.DATABRICKS_CLI_PATH ?? "databricks", environment = {}) {
+    logger.debug("starting Databricks CLI login", { profile, executable, timeoutMs });
+    const result = await runProcess(executable, ["auth", "login", "--profile", profile, "--timeout", `${Math.ceil(timeoutMs / 1000)}s`], environment);
+    if (result.exitCode !== 0) {
+        throw new AuthError("cli", result.stderr || `databricks auth login exited ${result.exitCode}`);
+    }
+    logger.debug("Databricks CLI login completed", { profile, executable });
+}
+/** Request one profile token from the Databricks CLI. */
+export async function databricksCliToken(profile, forceRefresh = false, executable = process.env.DATABRICKS_CLI_PATH ?? "databricks", environment = {}) {
+    logger.debug("requesting Databricks CLI token", { profile, executable, forceRefresh });
+    const args = ["auth", "token", "--profile", profile, "--output", "json"];
+    if (forceRefresh)
+        args.push("--force-refresh");
+    const result = await runProcess(executable, args, environment);
+    if (result.exitCode !== 0) {
+        throw new AuthError("cli", result.stderr || `databricks auth token exited ${result.exitCode}`);
+    }
+    let value;
+    try {
+        value = JSON.parse(result.stdout ?? "");
+    }
+    catch (cause) {
+        throw new AuthError("cli", "Databricks CLI token output was not JSON", { cause });
+    }
+    const accessToken = stringValue(value.access_token ?? value.accessToken);
+    if (!accessToken)
+        throw new AuthError("cli", "Databricks CLI token output had no access token");
+    const token = {
+        accessToken,
+        tokenType: stringValue(value.token_type ?? value.tokenType) ?? "Bearer",
+        ...(stringValue(value.refresh_token ?? value.refreshToken)
+            ? { refreshToken: stringValue(value.refresh_token ?? value.refreshToken) }
+            : {}),
+        ...(stringValue(value.expiry ?? value.expires_at)
+            ? { expiry: stringValue(value.expiry ?? value.expires_at) }
+            : {}),
+        scopes: Array.isArray(value.scopes)
+            ? value.scopes.filter((scope) => typeof scope === "string")
+            : [],
+    };
+    logger.debug("received Databricks CLI token", {
+        profile,
+        forceRefresh,
+        token: tokenMetadata(token),
+    });
+    return token;
+}
+async function runProcess(command, args, environment, timeoutMs) {
+    const controller = timeoutMs === undefined ? undefined : new AbortController();
+    const timeout = controller ? setTimeout(() => controller.abort(), timeoutMs) : undefined;
+    try {
+        return await exec.spawn(command, args, {
+            env: { ...process.env, ...environment },
+            stdin: "ignore",
+            stdout: "capture",
+            stderr: "capture",
+            signal: controller?.signal,
+        });
+    }
+    finally {
+        if (timeout)
+            clearTimeout(timeout);
+    }
+}
+/** Provider that lazily delegates U2M credentials to the Databricks CLI. */
+export class DatabricksCliProvider {
+    profile;
+    executableOrResolver;
+    environment;
+    resolution;
+    constructor(profile, executableOrResolver = () => resolveDatabricksCli(), environment = {}) {
+        this.profile = profile;
+        this.executableOrResolver = executableOrResolver;
+        this.environment = environment;
+    }
+    async authenticate(_timeoutMs) {
+        return databricksCliToken(this.profile, false, await this.resolveExecutable(), this.environment);
+    }
+    async login(timeoutMs) {
+        const executable = await this.resolveExecutable();
+        await databricksCliLogin(this.profile, timeoutMs, executable, this.environment);
+        return databricksCliToken(this.profile, false, executable, this.environment);
+    }
+    async refresh(_token) {
+        return databricksCliToken(this.profile, true, await this.resolveExecutable(), this.environment);
+    }
+    canAuthenticateSilently() {
+        return true;
+    }
+    resolveExecutable() {
+        if (typeof this.executableOrResolver === "string") {
+            logger.debug("using configured Databricks CLI executable", {
+                profile: this.profile,
+                executable: this.executableOrResolver,
+            });
+            return Promise.resolve(this.executableOrResolver);
+        }
+        if (this.resolution) {
+            logger.debug("reused provider CLI resolution", { profile: this.profile });
+            return this.resolution;
+        }
+        logger.debug("resolving provider CLI lazily", { profile: this.profile });
+        this.resolution = this.executableOrResolver()
+            .then((executable) => {
+            if (!executable) {
+                throw new AuthError("cli", "Databricks CLI is unavailable on this platform");
+            }
+            return executable;
+        })
+            .catch((error) => {
+            this.resolution = undefined;
+            throw error;
+        });
+        return this.resolution;
+    }
+}
+function stringValue(value) {
+    return stringUtils.trimToNull(value) ?? undefined;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiX2RhdGFicmlja3MtY2xpLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL19kYXRhYnJpY2tzLWNsaS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssSUFBSSxNQUFNLHNCQUFzQixDQUFDO0FBQzdDLE9BQU8sS0FBSyxXQUFXLE1BQU0scUNBQXFDLENBQUM7QUFFbkUsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLGNBQWMsQ0FBQztBQUN6QyxPQUFPLEVBQUUsVUFBVSxFQUFFLGVBQWUsRUFBRSxhQUFhLEVBQUUsTUFBTSxlQUFlLENBQUM7QUFHM0UsTUFBTSxlQUFlLEdBQUcsSUFBSSxHQUFHLEVBQXVDLENBQUM7QUFDdkUsTUFBTSxNQUFNLEdBQUcsVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDO0FBS2pDLDBFQUEwRTtBQUMxRSxNQUFNLFVBQVUsb0JBQW9CLENBQ2xDLGNBQTRELE9BQU8sQ0FBQyxHQUFHO0lBRXZFLE1BQU0sU0FBUyxHQUFHLFdBQVcsQ0FBQyxXQUFXLENBQUMsbUJBQW1CLENBQUMsSUFBSSxZQUFZLENBQUM7SUFDL0UsTUFBTSxNQUFNLEdBQUcsZUFBZSxDQUFDLEdBQUcsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUM5QyxJQUFJLE1BQU0sRUFBRSxDQUFDO1FBQ1gsTUFBTSxDQUFDLEtBQUssQ0FBQyxrQ0FBa0MsRUFBRSxFQUFFLFNBQVMsRUFBRSxDQUFDLENBQUM7UUFDaEUsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUNELE1BQU0sQ0FBQyxLQUFLLENBQUMsMEJBQTBCLEVBQUUsRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDO0lBQ3hELE1BQU0sUUFBUSxHQUFHLHVCQUF1QixDQUFDLFNBQVMsQ0FBQztTQUNoRCxJQUFJLENBQUMsQ0FBQyxVQUFVLEVBQUUsRUFBRSxDQUFDLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDO1NBQzFELEtBQUssQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFO1FBQ2YsZUFBZSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUNsQyxNQUFNLEtBQUssQ0FBQztJQUNkLENBQUMsQ0FBQyxDQUFDO0lBQ0wsZUFBZSxDQUFDLEdBQUcsQ0FBQyxTQUFTLEVBQUUsUUFBUSxDQUFDLENBQUM7SUFDekMsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQztBQUVELHdGQUF3RjtBQUN4RixNQUFNLFVBQVUsNEJBQTRCO0lBQzFDLGVBQWUsQ0FBQyxLQUFLLEVBQUUsQ0FBQztJQUN4QixNQUFNLENBQUMsS0FBSyxDQUFDLHlDQUF5QyxDQUFDLENBQUM7QUFDMUQsQ0FBQztBQUVELEtBQUssVUFBVSx1QkFBdUIsQ0FBQyxVQUFrQjtJQUN2RCxJQUFJLENBQUM7UUFDSCxNQUFNLE1BQU0sR0FBRyxNQUFNLFVBQVUsQ0FBQyxVQUFVLEVBQUUsQ0FBQyxXQUFXLENBQUMsRUFBRSxFQUFFLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDdkUsSUFBSSxNQUFNLENBQUMsUUFBUSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzFCLE1BQU0sQ0FBQyxLQUFLLENBQUMscUNBQXFDLEVBQUU7Z0JBQ2xELFVBQVU7Z0JBQ1YsUUFBUSxFQUFFLE1BQU0sQ0FBQyxRQUFRO2FBQzFCLENBQUMsQ0FBQztZQUNILE9BQU8sS0FBSyxDQUFDO1FBQ2YsQ0FBQztRQUNELE1BQU0sQ0FBQyxLQUFLLENBQUMsbUNBQW1DLEVBQUUsRUFBRSxVQUFVLEVBQUUsQ0FBQyxDQUFDO1FBQ2xFLE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixNQUFNLENBQUMsS0FBSyxDQUFDLDBDQUEwQyxFQUFFO1lBQ3ZELFVBQVU7WUFDVixLQUFLLEVBQUUsZUFBZSxDQUFDLEtBQUssQ0FBQztTQUM5QixDQUFDLENBQUM7UUFDSCxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7QUFDSCxDQUFDO0FBRUQsNERBQTREO0FBQzVELE1BQU0sQ0FBQyxLQUFLLFVBQVUsa0JBQWtCLENBQ3RDLE9BQWUsRUFDZixTQUFpQixFQUNqQixVQUFVLEdBQUcsT0FBTyxDQUFDLEdBQUcsQ0FBQyxtQkFBbUIsSUFBSSxZQUFZLEVBQzVELGNBQXNDLEVBQUU7SUFFeEMsTUFBTSxDQUFDLEtBQUssQ0FBQywrQkFBK0IsRUFBRSxFQUFFLE9BQU8sRUFBRSxVQUFVLEVBQUUsU0FBUyxFQUFFLENBQUMsQ0FBQztJQUNsRixNQUFNLE1BQU0sR0FBRyxNQUFNLFVBQVUsQ0FDN0IsVUFBVSxFQUNWLENBQUMsTUFBTSxFQUFFLE9BQU8sRUFBRSxXQUFXLEVBQUUsT0FBTyxFQUFFLFdBQVcsRUFBRSxHQUFHLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxHQUFHLElBQUksQ0FBQyxHQUFHLENBQUMsRUFDdkYsV0FBVyxDQUNaLENBQUM7SUFDRixJQUFJLE1BQU0sQ0FBQyxRQUFRLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDMUIsTUFBTSxJQUFJLFNBQVMsQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLE1BQU0sSUFBSSxnQ0FBZ0MsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFDakcsQ0FBQztJQUNELE1BQU0sQ0FBQyxLQUFLLENBQUMsZ0NBQWdDLEVBQUUsRUFBRSxPQUFPLEVBQUUsVUFBVSxFQUFFLENBQUMsQ0FBQztBQUMxRSxDQUFDO0FBRUQseURBQXlEO0FBQ3pELE1BQU0sQ0FBQyxLQUFLLFVBQVUsa0JBQWtCLENBQ3RDLE9BQWUsRUFDZixZQUFZLEdBQUcsS0FBSyxFQUNwQixVQUFVLEdBQUcsT0FBTyxDQUFDLEdBQUcsQ0FBQyxtQkFBbUIsSUFBSSxZQUFZLEVBQzVELGNBQXNDLEVBQUU7SUFFeEMsTUFBTSxDQUFDLEtBQUssQ0FBQyxpQ0FBaUMsRUFBRSxFQUFFLE9BQU8sRUFBRSxVQUFVLEVBQUUsWUFBWSxFQUFFLENBQUMsQ0FBQztJQUN2RixNQUFNLElBQUksR0FBRyxDQUFDLE1BQU0sRUFBRSxPQUFPLEVBQUUsV0FBVyxFQUFFLE9BQU8sRUFBRSxVQUFVLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDekUsSUFBSSxZQUFZO1FBQUUsSUFBSSxDQUFDLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO0lBQy9DLE1BQU0sTUFBTSxHQUFHLE1BQU0sVUFBVSxDQUFDLFVBQVUsRUFBRSxJQUFJLEVBQUUsV0FBVyxDQUFDLENBQUM7SUFDL0QsSUFBSSxNQUFNLENBQUMsUUFBUSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQzFCLE1BQU0sSUFBSSxTQUFTLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxNQUFNLElBQUksZ0NBQWdDLE1BQU0sQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDO0lBQ2pHLENBQUM7SUFDRCxJQUFJLEtBQThCLENBQUM7SUFDbkMsSUFBSSxDQUFDO1FBQ0gsS0FBSyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLE1BQU0sSUFBSSxFQUFFLENBQTRCLENBQUM7SUFDckUsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixNQUFNLElBQUksU0FBUyxDQUFDLEtBQUssRUFBRSwwQ0FBMEMsRUFBRSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7SUFDcEYsQ0FBQztJQUNELE1BQU0sV0FBVyxHQUFHLFdBQVcsQ0FBQyxLQUFLLENBQUMsWUFBWSxJQUFJLEtBQUssQ0FBQyxXQUFXLENBQUMsQ0FBQztJQUN6RSxJQUFJLENBQUMsV0FBVztRQUFFLE1BQU0sSUFBSSxTQUFTLENBQUMsS0FBSyxFQUFFLGlEQUFpRCxDQUFDLENBQUM7SUFDaEcsTUFBTSxLQUFLLEdBQUc7UUFDWixXQUFXO1FBQ1gsU0FBUyxFQUFFLFdBQVcsQ0FBQyxLQUFLLENBQUMsVUFBVSxJQUFJLEtBQUssQ0FBQyxTQUFTLENBQUMsSUFBSSxRQUFRO1FBQ3ZFLEdBQUcsQ0FBQyxXQUFXLENBQUMsS0FBSyxDQUFDLGFBQWEsSUFBSSxLQUFLLENBQUMsWUFBWSxDQUFDO1lBQ3hELENBQUMsQ0FBQyxFQUFFLFlBQVksRUFBRSxXQUFXLENBQUMsS0FBSyxDQUFDLGFBQWEsSUFBSSxLQUFLLENBQUMsWUFBWSxDQUFDLEVBQUU7WUFDMUUsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNQLEdBQUcsQ0FBQyxXQUFXLENBQUMsS0FBSyxDQUFDLE1BQU0sSUFBSSxLQUFLLENBQUMsVUFBVSxDQUFDO1lBQy9DLENBQUMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxXQUFXLENBQUMsS0FBSyxDQUFDLE1BQU0sSUFBSSxLQUFLLENBQUMsVUFBVSxDQUFDLEVBQUU7WUFDM0QsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNQLE1BQU0sRUFBRSxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUM7WUFDakMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsS0FBSyxFQUFtQixFQUFFLENBQUMsT0FBTyxLQUFLLEtBQUssUUFBUSxDQUFDO1lBQzVFLENBQUMsQ0FBQyxFQUFFO0tBQ1AsQ0FBQztJQUNGLE1BQU0sQ0FBQyxLQUFLLENBQUMsK0JBQStCLEVBQUU7UUFDNUMsT0FBTztRQUNQLFlBQVk7UUFDWixLQUFLLEVBQUUsYUFBYSxDQUFDLEtBQUssQ0FBQztLQUM1QixDQUFDLENBQUM7SUFDSCxPQUFPLEtBQUssQ0FBQztBQUNmLENBQUM7QUFFRCxLQUFLLFVBQVUsVUFBVSxDQUN2QixPQUFlLEVBQ2YsSUFBYyxFQUNkLFdBQW1DLEVBQ25DLFNBQWtCO0lBRWxCLE1BQU0sVUFBVSxHQUFHLFNBQVMsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsSUFBSSxlQUFlLEVBQUUsQ0FBQztJQUMvRSxNQUFNLE9BQU8sR0FBRyxVQUFVLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxVQUFVLENBQUMsS0FBSyxFQUFFLEVBQUUsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztJQUN6RixJQUFJLENBQUM7UUFDSCxPQUFPLE1BQU0sSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLEVBQUUsSUFBSSxFQUFFO1lBQ3JDLEdBQUcsRUFBRSxFQUFFLEdBQUcsT0FBTyxDQUFDLEdBQUcsRUFBRSxHQUFHLFdBQVcsRUFBRTtZQUN2QyxLQUFLLEVBQUUsUUFBUTtZQUNmLE1BQU0sRUFBRSxTQUFTO1lBQ2pCLE1BQU0sRUFBRSxTQUFTO1lBQ2pCLE1BQU0sRUFBRSxVQUFVLEVBQUUsTUFBTTtTQUMzQixDQUFDLENBQUM7SUFDTCxDQUFDO1lBQVMsQ0FBQztRQUNULElBQUksT0FBTztZQUFFLFlBQVksQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUNyQyxDQUFDO0FBQ0gsQ0FBQztBQUVELDRFQUE0RTtBQUM1RSxNQUFNLE9BQU8scUJBQXFCO0lBSWI7SUFDQTtJQUVBO0lBTlgsVUFBVSxDQUFtQjtJQUVyQyxZQUNtQixPQUFlLEVBQ2YsdUJBQXVELEdBQUcsRUFBRSxDQUMzRSxvQkFBb0IsRUFBRSxFQUNQLGNBQXNDLEVBQUU7UUFIeEMsWUFBTyxHQUFQLE9BQU8sQ0FBUTtRQUNmLHlCQUFvQixHQUFwQixvQkFBb0IsQ0FDYjtRQUNQLGdCQUFXLEdBQVgsV0FBVyxDQUE2QjtJQUN4RCxDQUFDO0lBRUosS0FBSyxDQUFDLFlBQVksQ0FBQyxVQUFrQjtRQUNuQyxPQUFPLGtCQUFrQixDQUN2QixJQUFJLENBQUMsT0FBTyxFQUNaLEtBQUssRUFDTCxNQUFNLElBQUksQ0FBQyxpQkFBaUIsRUFBRSxFQUM5QixJQUFJLENBQUMsV0FBVyxDQUNqQixDQUFDO0lBQ0osQ0FBQztJQUVELEtBQUssQ0FBQyxLQUFLLENBQUMsU0FBaUI7UUFDM0IsTUFBTSxVQUFVLEdBQUcsTUFBTSxJQUFJLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztRQUNsRCxNQUFNLGtCQUFrQixDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsU0FBUyxFQUFFLFVBQVUsRUFBRSxJQUFJLENBQUMsV0FBVyxDQUFDLENBQUM7UUFDaEYsT0FBTyxrQkFBa0IsQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUUsSUFBSSxDQUFDLFdBQVcsQ0FBQyxDQUFDO0lBQy9FLENBQUM7SUFFRCxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQWE7UUFDekIsT0FBTyxrQkFBa0IsQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLElBQUksRUFBRSxNQUFNLElBQUksQ0FBQyxpQkFBaUIsRUFBRSxFQUFFLElBQUksQ0FBQyxXQUFXLENBQUMsQ0FBQztJQUNsRyxDQUFDO0lBRUQsdUJBQXVCO1FBQ3JCLE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUVPLGlCQUFpQjtRQUN2QixJQUFJLE9BQU8sSUFBSSxDQUFDLG9CQUFvQixLQUFLLFFBQVEsRUFBRSxDQUFDO1lBQ2xELE1BQU0sQ0FBQyxLQUFLLENBQUMsNENBQTRDLEVBQUU7Z0JBQ3pELE9BQU8sRUFBRSxJQUFJLENBQUMsT0FBTztnQkFDckIsVUFBVSxFQUFFLElBQUksQ0FBQyxvQkFBb0I7YUFDdEMsQ0FBQyxDQUFDO1lBQ0gsT0FBTyxPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDO1FBQ3BELENBQUM7UUFDRCxJQUFJLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQztZQUNwQixNQUFNLENBQUMsS0FBSyxDQUFDLGdDQUFnQyxFQUFFLEVBQUUsT0FBTyxFQUFFLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO1lBQzFFLE9BQU8sSUFBSSxDQUFDLFVBQVUsQ0FBQztRQUN6QixDQUFDO1FBQ0QsTUFBTSxDQUFDLEtBQUssQ0FBQywrQkFBK0IsRUFBRSxFQUFFLE9BQU8sRUFBRSxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQztRQUN6RSxJQUFJLENBQUMsVUFBVSxHQUFHLElBQUksQ0FBQyxvQkFBb0IsRUFBRTthQUMxQyxJQUFJLENBQUMsQ0FBQyxVQUFVLEVBQUUsRUFBRTtZQUNuQixJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7Z0JBQ2hCLE1BQU0sSUFBSSxTQUFTLENBQUMsS0FBSyxFQUFFLGdEQUFnRCxDQUFDLENBQUM7WUFDL0UsQ0FBQztZQUNELE9BQU8sVUFBVSxDQUFDO1FBQ3BCLENBQUMsQ0FBQzthQUNELEtBQUssQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFO1lBQ2YsSUFBSSxDQUFDLFVBQVUsR0FBRyxTQUFTLENBQUM7WUFDNUIsTUFBTSxLQUFLLENBQUM7UUFDZCxDQUFDLENBQUMsQ0FBQztRQUNMLE9BQU8sSUFBSSxDQUFDLFVBQVUsQ0FBQztJQUN6QixDQUFDO0NBQ0Y7QUFFRCxTQUFTLFdBQVcsQ0FBQyxLQUFjO0lBQ2pDLE9BQU8sV0FBVyxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUMsSUFBSSxTQUFTLENBQUM7QUFDcEQsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCAqIGFzIGV4ZWMgZnJvbSBcIkBkYngtdG9vbHMvY29yZS9leGVjXCI7XG5pbXBvcnQgKiBhcyBzdHJpbmdVdGlscyBmcm9tIFwiQGRieC10b29scy9zaGFyZWQtY29yZS9zdHJpbmctdXRpbHNcIjtcblxuaW1wb3J0IHsgQXV0aEVycm9yIH0gZnJvbSBcIi4vX2Vycm9ycy50c1wiO1xuaW1wb3J0IHsgYXV0aExvZ2dlciwgZmFpbHVyZU1ldGFkYXRhLCB0b2tlbk1ldGFkYXRhIH0gZnJvbSBcIi4vX2xvZ2dpbmcudHNcIjtcbmltcG9ydCB0eXBlIHsgVG9rZW4sIFRva2VuUHJvdmlkZXIgfSBmcm9tIFwiLi9fdHlwZXMudHNcIjtcblxuY29uc3QgcmVzb2x1dGlvbkNhY2hlID0gbmV3IE1hcDxzdHJpbmcsIFByb21pc2U8c3RyaW5nIHwgdW5kZWZpbmVkPj4oKTtcbmNvbnN0IGxvZ2dlciA9IGF1dGhMb2dnZXIoXCJjbGlcIik7XG5cbi8qKiBEZWZlcnJlZCBEYXRhYnJpY2tzIENMSSBsb29rdXAgdXNlZCBieSBVMk0gdG9rZW4gYWNxdWlzaXRpb24uICovXG5leHBvcnQgdHlwZSBEYXRhYnJpY2tzQ2xpUmVzb2x2ZXIgPSAoKSA9PiBQcm9taXNlPHN0cmluZyB8IHVuZGVmaW5lZD47XG5cbi8qKiBSZXNvbHZlIGFuIGF2YWlsYWJsZSBEYXRhYnJpY2tzIENMSSB3aXRob3V0IGluc3RhbGxpbmcgZXhlY3V0YWJsZXMuICovXG5leHBvcnQgZnVuY3Rpb24gcmVzb2x2ZURhdGFicmlja3NDbGkoXG4gIGVudmlyb25tZW50OiBSZWFkb25seTxSZWNvcmQ8c3RyaW5nLCBzdHJpbmcgfCB1bmRlZmluZWQ+PiA9IHByb2Nlc3MuZW52LFxuKTogUHJvbWlzZTxzdHJpbmcgfCB1bmRlZmluZWQ+IHtcbiAgY29uc3QgY2FuZGlkYXRlID0gc3RyaW5nVmFsdWUoZW52aXJvbm1lbnQuREFUQUJSSUNLU19DTElfUEFUSCkgPz8gXCJkYXRhYnJpY2tzXCI7XG4gIGNvbnN0IGNhY2hlZCA9IHJlc29sdXRpb25DYWNoZS5nZXQoY2FuZGlkYXRlKTtcbiAgaWYgKGNhY2hlZCkge1xuICAgIGxvZ2dlci5kZWJ1ZyhcInJldXNlZCBEYXRhYnJpY2tzIENMSSByZXNvbHV0aW9uXCIsIHsgY2FuZGlkYXRlIH0pO1xuICAgIHJldHVybiBjYWNoZWQ7XG4gIH1cbiAgbG9nZ2VyLmRlYnVnKFwicmVzb2x2aW5nIERhdGFicmlja3MgQ0xJXCIsIHsgY2FuZGlkYXRlIH0pO1xuICBjb25zdCByZXNvbHZlZCA9IGNvbXBhdGlibGVEYXRhYnJpY2tzQ2xpKGNhbmRpZGF0ZSlcbiAgICAudGhlbigoY29tcGF0aWJsZSkgPT4gKGNvbXBhdGlibGUgPyBjYW5kaWRhdGUgOiB1bmRlZmluZWQpKVxuICAgIC5jYXRjaCgoZXJyb3IpID0+IHtcbiAgICAgIHJlc29sdXRpb25DYWNoZS5kZWxldGUoY2FuZGlkYXRlKTtcbiAgICAgIHRocm93IGVycm9yO1xuICAgIH0pO1xuICByZXNvbHV0aW9uQ2FjaGUuc2V0KGNhbmRpZGF0ZSwgcmVzb2x2ZWQpO1xuICByZXR1cm4gcmVzb2x2ZWQ7XG59XG5cbi8qKiBDbGVhciBjYWNoZWQgQ0xJIHJlc29sdXRpb24sIHByaW1hcmlseSBhZnRlciBpbnN0YWxsYXRpb24gb3IgZW52aXJvbm1lbnQgY2hhbmdlcy4gKi9cbmV4cG9ydCBmdW5jdGlvbiByZXNldERhdGFicmlja3NDbGlSZXNvbHV0aW9uKCk6IHZvaWQge1xuICByZXNvbHV0aW9uQ2FjaGUuY2xlYXIoKTtcbiAgbG9nZ2VyLmRlYnVnKFwiY2xlYXJlZCBEYXRhYnJpY2tzIENMSSByZXNvbHV0aW9uIGNhY2hlXCIpO1xufVxuXG5hc3luYyBmdW5jdGlvbiBjb21wYXRpYmxlRGF0YWJyaWNrc0NsaShleGVjdXRhYmxlOiBzdHJpbmcpOiBQcm9taXNlPGJvb2xlYW4+IHtcbiAgdHJ5IHtcbiAgICBjb25zdCByZXN1bHQgPSBhd2FpdCBydW5Qcm9jZXNzKGV4ZWN1dGFibGUsIFtcIi0tdmVyc2lvblwiXSwge30sIDEwXzAwMCk7XG4gICAgaWYgKHJlc3VsdC5leGl0Q29kZSAhPT0gMCkge1xuICAgICAgbG9nZ2VyLmRlYnVnKFwiRGF0YWJyaWNrcyBDTEkgdmVyc2lvbiBwcm9iZSBmYWlsZWRcIiwge1xuICAgICAgICBleGVjdXRhYmxlLFxuICAgICAgICBleGl0Q29kZTogcmVzdWx0LmV4aXRDb2RlLFxuICAgICAgfSk7XG4gICAgICByZXR1cm4gZmFsc2U7XG4gICAgfVxuICAgIGxvZ2dlci5kZWJ1ZyhcInNlbGVjdGVkIGluc3RhbGxlZCBEYXRhYnJpY2tzIENMSVwiLCB7IGV4ZWN1dGFibGUgfSk7XG4gICAgcmV0dXJuIHRydWU7XG4gIH0gY2F0Y2ggKGNhdXNlKSB7XG4gICAgbG9nZ2VyLmRlYnVnKFwiRGF0YWJyaWNrcyBDTEkgdmVyc2lvbiBwcm9iZSB1bmF2YWlsYWJsZVwiLCB7XG4gICAgICBleGVjdXRhYmxlLFxuICAgICAgZXJyb3I6IGZhaWx1cmVNZXRhZGF0YShjYXVzZSksXG4gICAgfSk7XG4gICAgcmV0dXJuIGZhbHNlO1xuICB9XG59XG5cbi8qKiBSdW4gaW50ZXJhY3RpdmUgRGF0YWJyaWNrcyBDTEkgbG9naW4gZm9yIG9uZSBwcm9maWxlLiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIGRhdGFicmlja3NDbGlMb2dpbihcbiAgcHJvZmlsZTogc3RyaW5nLFxuICB0aW1lb3V0TXM6IG51bWJlcixcbiAgZXhlY3V0YWJsZSA9IHByb2Nlc3MuZW52LkRBVEFCUklDS1NfQ0xJX1BBVEggPz8gXCJkYXRhYnJpY2tzXCIsXG4gIGVudmlyb25tZW50OiBSZWNvcmQ8c3RyaW5nLCBzdHJpbmc+ID0ge30sXG4pOiBQcm9taXNlPHZvaWQ+IHtcbiAgbG9nZ2VyLmRlYnVnKFwic3RhcnRpbmcgRGF0YWJyaWNrcyBDTEkgbG9naW5cIiwgeyBwcm9maWxlLCBleGVjdXRhYmxlLCB0aW1lb3V0TXMgfSk7XG4gIGNvbnN0IHJlc3VsdCA9IGF3YWl0IHJ1blByb2Nlc3MoXG4gICAgZXhlY3V0YWJsZSxcbiAgICBbXCJhdXRoXCIsIFwibG9naW5cIiwgXCItLXByb2ZpbGVcIiwgcHJvZmlsZSwgXCItLXRpbWVvdXRcIiwgYCR7TWF0aC5jZWlsKHRpbWVvdXRNcyAvIDEwMDApfXNgXSxcbiAgICBlbnZpcm9ubWVudCxcbiAgKTtcbiAgaWYgKHJlc3VsdC5leGl0Q29kZSAhPT0gMCkge1xuICAgIHRocm93IG5ldyBBdXRoRXJyb3IoXCJjbGlcIiwgcmVzdWx0LnN0ZGVyciB8fCBgZGF0YWJyaWNrcyBhdXRoIGxvZ2luIGV4aXRlZCAke3Jlc3VsdC5leGl0Q29kZX1gKTtcbiAgfVxuICBsb2dnZXIuZGVidWcoXCJEYXRhYnJpY2tzIENMSSBsb2dpbiBjb21wbGV0ZWRcIiwgeyBwcm9maWxlLCBleGVjdXRhYmxlIH0pO1xufVxuXG4vKiogUmVxdWVzdCBvbmUgcHJvZmlsZSB0b2tlbiBmcm9tIHRoZSBEYXRhYnJpY2tzIENMSS4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBkYXRhYnJpY2tzQ2xpVG9rZW4oXG4gIHByb2ZpbGU6IHN0cmluZyxcbiAgZm9yY2VSZWZyZXNoID0gZmFsc2UsXG4gIGV4ZWN1dGFibGUgPSBwcm9jZXNzLmVudi5EQVRBQlJJQ0tTX0NMSV9QQVRIID8/IFwiZGF0YWJyaWNrc1wiLFxuICBlbnZpcm9ubWVudDogUmVjb3JkPHN0cmluZywgc3RyaW5nPiA9IHt9LFxuKTogUHJvbWlzZTxUb2tlbj4ge1xuICBsb2dnZXIuZGVidWcoXCJyZXF1ZXN0aW5nIERhdGFicmlja3MgQ0xJIHRva2VuXCIsIHsgcHJvZmlsZSwgZXhlY3V0YWJsZSwgZm9yY2VSZWZyZXNoIH0pO1xuICBjb25zdCBhcmdzID0gW1wiYXV0aFwiLCBcInRva2VuXCIsIFwiLS1wcm9maWxlXCIsIHByb2ZpbGUsIFwiLS1vdXRwdXRcIiwgXCJqc29uXCJdO1xuICBpZiAoZm9yY2VSZWZyZXNoKSBhcmdzLnB1c2goXCItLWZvcmNlLXJlZnJlc2hcIik7XG4gIGNvbnN0IHJlc3VsdCA9IGF3YWl0IHJ1blByb2Nlc3MoZXhlY3V0YWJsZSwgYXJncywgZW52aXJvbm1lbnQpO1xuICBpZiAocmVzdWx0LmV4aXRDb2RlICE9PSAwKSB7XG4gICAgdGhyb3cgbmV3IEF1dGhFcnJvcihcImNsaVwiLCByZXN1bHQuc3RkZXJyIHx8IGBkYXRhYnJpY2tzIGF1dGggdG9rZW4gZXhpdGVkICR7cmVzdWx0LmV4aXRDb2RlfWApO1xuICB9XG4gIGxldCB2YWx1ZTogUmVjb3JkPHN0cmluZywgdW5rbm93bj47XG4gIHRyeSB7XG4gICAgdmFsdWUgPSBKU09OLnBhcnNlKHJlc3VsdC5zdGRvdXQgPz8gXCJcIikgYXMgUmVjb3JkPHN0cmluZywgdW5rbm93bj47XG4gIH0gY2F0Y2ggKGNhdXNlKSB7XG4gICAgdGhyb3cgbmV3IEF1dGhFcnJvcihcImNsaVwiLCBcIkRhdGFicmlja3MgQ0xJIHRva2VuIG91dHB1dCB3YXMgbm90IEpTT05cIiwgeyBjYXVzZSB9KTtcbiAgfVxuICBjb25zdCBhY2Nlc3NUb2tlbiA9IHN0cmluZ1ZhbHVlKHZhbHVlLmFjY2Vzc190b2tlbiA/PyB2YWx1ZS5hY2Nlc3NUb2tlbik7XG4gIGlmICghYWNjZXNzVG9rZW4pIHRocm93IG5ldyBBdXRoRXJyb3IoXCJjbGlcIiwgXCJEYXRhYnJpY2tzIENMSSB0b2tlbiBvdXRwdXQgaGFkIG5vIGFjY2VzcyB0b2tlblwiKTtcbiAgY29uc3QgdG9rZW4gPSB7XG4gICAgYWNjZXNzVG9rZW4sXG4gICAgdG9rZW5UeXBlOiBzdHJpbmdWYWx1ZSh2YWx1ZS50b2tlbl90eXBlID8/IHZhbHVlLnRva2VuVHlwZSkgPz8gXCJCZWFyZXJcIixcbiAgICAuLi4oc3RyaW5nVmFsdWUodmFsdWUucmVmcmVzaF90b2tlbiA/PyB2YWx1ZS5yZWZyZXNoVG9rZW4pXG4gICAgICA/IHsgcmVmcmVzaFRva2VuOiBzdHJpbmdWYWx1ZSh2YWx1ZS5yZWZyZXNoX3Rva2VuID8/IHZhbHVlLnJlZnJlc2hUb2tlbikgfVxuICAgICAgOiB7fSksXG4gICAgLi4uKHN0cmluZ1ZhbHVlKHZhbHVlLmV4cGlyeSA/PyB2YWx1ZS5leHBpcmVzX2F0KVxuICAgICAgPyB7IGV4cGlyeTogc3RyaW5nVmFsdWUodmFsdWUuZXhwaXJ5ID8/IHZhbHVlLmV4cGlyZXNfYXQpIH1cbiAgICAgIDoge30pLFxuICAgIHNjb3BlczogQXJyYXkuaXNBcnJheSh2YWx1ZS5zY29wZXMpXG4gICAgICA/IHZhbHVlLnNjb3Blcy5maWx0ZXIoKHNjb3BlKTogc2NvcGUgaXMgc3RyaW5nID0+IHR5cGVvZiBzY29wZSA9PT0gXCJzdHJpbmdcIilcbiAgICAgIDogW10sXG4gIH07XG4gIGxvZ2dlci5kZWJ1ZyhcInJlY2VpdmVkIERhdGFicmlja3MgQ0xJIHRva2VuXCIsIHtcbiAgICBwcm9maWxlLFxuICAgIGZvcmNlUmVmcmVzaCxcbiAgICB0b2tlbjogdG9rZW5NZXRhZGF0YSh0b2tlbiksXG4gIH0pO1xuICByZXR1cm4gdG9rZW47XG59XG5cbmFzeW5jIGZ1bmN0aW9uIHJ1blByb2Nlc3MoXG4gIGNvbW1hbmQ6IHN0cmluZyxcbiAgYXJnczogc3RyaW5nW10sXG4gIGVudmlyb25tZW50OiBSZWNvcmQ8c3RyaW5nLCBzdHJpbmc+LFxuICB0aW1lb3V0TXM/OiBudW1iZXIsXG4pOiBQcm9taXNlPHsgZXhpdENvZGU6IG51bWJlcjsgc3Rkb3V0OiBzdHJpbmc7IHN0ZGVycjogc3RyaW5nIH0+IHtcbiAgY29uc3QgY29udHJvbGxlciA9IHRpbWVvdXRNcyA9PT0gdW5kZWZpbmVkID8gdW5kZWZpbmVkIDogbmV3IEFib3J0Q29udHJvbGxlcigpO1xuICBjb25zdCB0aW1lb3V0ID0gY29udHJvbGxlciA/IHNldFRpbWVvdXQoKCkgPT4gY29udHJvbGxlci5hYm9ydCgpLCB0aW1lb3V0TXMpIDogdW5kZWZpbmVkO1xuICB0cnkge1xuICAgIHJldHVybiBhd2FpdCBleGVjLnNwYXduKGNvbW1hbmQsIGFyZ3MsIHtcbiAgICAgIGVudjogeyAuLi5wcm9jZXNzLmVudiwgLi4uZW52aXJvbm1lbnQgfSxcbiAgICAgIHN0ZGluOiBcImlnbm9yZVwiLFxuICAgICAgc3Rkb3V0OiBcImNhcHR1cmVcIixcbiAgICAgIHN0ZGVycjogXCJjYXB0dXJlXCIsXG4gICAgICBzaWduYWw6IGNvbnRyb2xsZXI/LnNpZ25hbCxcbiAgICB9KTtcbiAgfSBmaW5hbGx5IHtcbiAgICBpZiAodGltZW91dCkgY2xlYXJUaW1lb3V0KHRpbWVvdXQpO1xuICB9XG59XG5cbi8qKiBQcm92aWRlciB0aGF0IGxhemlseSBkZWxlZ2F0ZXMgVTJNIGNyZWRlbnRpYWxzIHRvIHRoZSBEYXRhYnJpY2tzIENMSS4gKi9cbmV4cG9ydCBjbGFzcyBEYXRhYnJpY2tzQ2xpUHJvdmlkZXIgaW1wbGVtZW50cyBUb2tlblByb3ZpZGVyIHtcbiAgcHJpdmF0ZSByZXNvbHV0aW9uPzogUHJvbWlzZTxzdHJpbmc+O1xuXG4gIGNvbnN0cnVjdG9yKFxuICAgIHByaXZhdGUgcmVhZG9ubHkgcHJvZmlsZTogc3RyaW5nLFxuICAgIHByaXZhdGUgcmVhZG9ubHkgZXhlY3V0YWJsZU9yUmVzb2x2ZXI6IHN0cmluZyB8IERhdGFicmlja3NDbGlSZXNvbHZlciA9ICgpID0+XG4gICAgICByZXNvbHZlRGF0YWJyaWNrc0NsaSgpLFxuICAgIHByaXZhdGUgcmVhZG9ubHkgZW52aXJvbm1lbnQ6IFJlY29yZDxzdHJpbmcsIHN0cmluZz4gPSB7fSxcbiAgKSB7fVxuXG4gIGFzeW5jIGF1dGhlbnRpY2F0ZShfdGltZW91dE1zOiBudW1iZXIpOiBQcm9taXNlPFRva2VuPiB7XG4gICAgcmV0dXJuIGRhdGFicmlja3NDbGlUb2tlbihcbiAgICAgIHRoaXMucHJvZmlsZSxcbiAgICAgIGZhbHNlLFxuICAgICAgYXdhaXQgdGhpcy5yZXNvbHZlRXhlY3V0YWJsZSgpLFxuICAgICAgdGhpcy5lbnZpcm9ubWVudCxcbiAgICApO1xuICB9XG5cbiAgYXN5bmMgbG9naW4odGltZW91dE1zOiBudW1iZXIpOiBQcm9taXNlPFRva2VuPiB7XG4gICAgY29uc3QgZXhlY3V0YWJsZSA9IGF3YWl0IHRoaXMucmVzb2x2ZUV4ZWN1dGFibGUoKTtcbiAgICBhd2FpdCBkYXRhYnJpY2tzQ2xpTG9naW4odGhpcy5wcm9maWxlLCB0aW1lb3V0TXMsIGV4ZWN1dGFibGUsIHRoaXMuZW52aXJvbm1lbnQpO1xuICAgIHJldHVybiBkYXRhYnJpY2tzQ2xpVG9rZW4odGhpcy5wcm9maWxlLCBmYWxzZSwgZXhlY3V0YWJsZSwgdGhpcy5lbnZpcm9ubWVudCk7XG4gIH1cblxuICBhc3luYyByZWZyZXNoKF90b2tlbjogVG9rZW4pOiBQcm9taXNlPFRva2VuPiB7XG4gICAgcmV0dXJuIGRhdGFicmlja3NDbGlUb2tlbih0aGlzLnByb2ZpbGUsIHRydWUsIGF3YWl0IHRoaXMucmVzb2x2ZUV4ZWN1dGFibGUoKSwgdGhpcy5lbnZpcm9ubWVudCk7XG4gIH1cblxuICBjYW5BdXRoZW50aWNhdGVTaWxlbnRseSgpOiBib29sZWFuIHtcbiAgICByZXR1cm4gdHJ1ZTtcbiAgfVxuXG4gIHByaXZhdGUgcmVzb2x2ZUV4ZWN1dGFibGUoKTogUHJvbWlzZTxzdHJpbmc+IHtcbiAgICBpZiAodHlwZW9mIHRoaXMuZXhlY3V0YWJsZU9yUmVzb2x2ZXIgPT09IFwic3RyaW5nXCIpIHtcbiAgICAgIGxvZ2dlci5kZWJ1ZyhcInVzaW5nIGNvbmZpZ3VyZWQgRGF0YWJyaWNrcyBDTEkgZXhlY3V0YWJsZVwiLCB7XG4gICAgICAgIHByb2ZpbGU6IHRoaXMucHJvZmlsZSxcbiAgICAgICAgZXhlY3V0YWJsZTogdGhpcy5leGVjdXRhYmxlT3JSZXNvbHZlcixcbiAgICAgIH0pO1xuICAgICAgcmV0dXJuIFByb21pc2UucmVzb2x2ZSh0aGlzLmV4ZWN1dGFibGVPclJlc29sdmVyKTtcbiAgICB9XG4gICAgaWYgKHRoaXMucmVzb2x1dGlvbikge1xuICAgICAgbG9nZ2VyLmRlYnVnKFwicmV1c2VkIHByb3ZpZGVyIENMSSByZXNvbHV0aW9uXCIsIHsgcHJvZmlsZTogdGhpcy5wcm9maWxlIH0pO1xuICAgICAgcmV0dXJuIHRoaXMucmVzb2x1dGlvbjtcbiAgICB9XG4gICAgbG9nZ2VyLmRlYnVnKFwicmVzb2x2aW5nIHByb3ZpZGVyIENMSSBsYXppbHlcIiwgeyBwcm9maWxlOiB0aGlzLnByb2ZpbGUgfSk7XG4gICAgdGhpcy5yZXNvbHV0aW9uID0gdGhpcy5leGVjdXRhYmxlT3JSZXNvbHZlcigpXG4gICAgICAudGhlbigoZXhlY3V0YWJsZSkgPT4ge1xuICAgICAgICBpZiAoIWV4ZWN1dGFibGUpIHtcbiAgICAgICAgICB0aHJvdyBuZXcgQXV0aEVycm9yKFwiY2xpXCIsIFwiRGF0YWJyaWNrcyBDTEkgaXMgdW5hdmFpbGFibGUgb24gdGhpcyBwbGF0Zm9ybVwiKTtcbiAgICAgICAgfVxuICAgICAgICByZXR1cm4gZXhlY3V0YWJsZTtcbiAgICAgIH0pXG4gICAgICAuY2F0Y2goKGVycm9yKSA9PiB7XG4gICAgICAgIHRoaXMucmVzb2x1dGlvbiA9IHVuZGVmaW5lZDtcbiAgICAgICAgdGhyb3cgZXJyb3I7XG4gICAgICB9KTtcbiAgICByZXR1cm4gdGhpcy5yZXNvbHV0aW9uO1xuICB9XG59XG5cbmZ1bmN0aW9uIHN0cmluZ1ZhbHVlKHZhbHVlOiB1bmtub3duKTogc3RyaW5nIHwgdW5kZWZpbmVkIHtcbiAgcmV0dXJuIHN0cmluZ1V0aWxzLnRyaW1Ub051bGwodmFsdWUpID8/IHVuZGVmaW5lZDtcbn1cbiJdfQ==

package/lib/src/_errors.d.ts

@@ -0,0 +1,5 @@
+/** Authentication failure with a stable category for callers and language shims. */
+export declare class AuthError extends Error {
+    readonly kind: "config" | "oauth" | "cli";
+    constructor(kind: "config" | "oauth" | "cli", message: string, options?: ErrorOptions);
+}

package/lib/src/_errors.js

@@ -0,0 +1,10 @@
+/** Authentication failure with a stable category for callers and language shims. */
+export class AuthError extends Error {
+    kind;
+    constructor(kind, message, options) {
+        super(message, options);
+        this.kind = kind;
+        this.name = "AuthError";
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiX2Vycm9ycy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9fZXJyb3JzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLG9GQUFvRjtBQUNwRixNQUFNLE9BQU8sU0FBVSxTQUFRLEtBQUs7SUFFdkI7SUFEWCxZQUNXLElBQWdDLEVBQ3pDLE9BQWUsRUFDZixPQUFzQjtRQUV0QixLQUFLLENBQUMsT0FBTyxFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBSmYsU0FBSSxHQUFKLElBQUksQ0FBNEI7UUFLekMsSUFBSSxDQUFDLElBQUksR0FBRyxXQUFXLENBQUM7SUFDMUIsQ0FBQztDQUNGIiwic291cmNlc0NvbnRlbnQiOlsiLyoqIEF1dGhlbnRpY2F0aW9uIGZhaWx1cmUgd2l0aCBhIHN0YWJsZSBjYXRlZ29yeSBmb3IgY2FsbGVycyBhbmQgbGFuZ3VhZ2Ugc2hpbXMuICovXG5leHBvcnQgY2xhc3MgQXV0aEVycm9yIGV4dGVuZHMgRXJyb3Ige1xuICBjb25zdHJ1Y3RvcihcbiAgICByZWFkb25seSBraW5kOiBcImNvbmZpZ1wiIHwgXCJvYXV0aFwiIHwgXCJjbGlcIixcbiAgICBtZXNzYWdlOiBzdHJpbmcsXG4gICAgb3B0aW9ucz86IEVycm9yT3B0aW9ucyxcbiAgKSB7XG4gICAgc3VwZXIobWVzc2FnZSwgb3B0aW9ucyk7XG4gICAgdGhpcy5uYW1lID0gXCJBdXRoRXJyb3JcIjtcbiAgfVxufVxuIl19

package/lib/src/{lifecycle.d.ts → _lifecycle.d.ts}

@@ -1,4 +1,6 @@
-import type { AccessToken, AuthOptions, CredentialStore, Token, TokenProvider } from "./types.ts";
+import type { CredentialStore, Token, TokenProvider } from "./_types.ts";
+import type { AccessToken } from "./client.ts";
+import type { AuthOptions } from "./config.ts";
 /** Provider-neutral check-lock-check authentication and persistent token lifecycle. */
 export declare class TokenLifecycle {
     private readonly key;
@@ -6,17 +8,15 @@ export declare class TokenLifecycle {
     private readonly store;
     private readonly options;
     private readonly now;
-    constructor(key: string, provider: TokenProvider, store: CredentialStore, options: AuthOptions, now?: () => Date);
-    storeName(): string;
+    constructor(key: string, provider: TokenProvider, store: CredentialStore, options: Required<AuthOptions>, now?: () => Date);
     login(): Promise<AccessToken>;
     token(): Promise<AccessToken>;
     tokenOrLogin(): Promise<AccessToken>;
     tokenWithLogin(login?: boolean): Promise<AccessToken>;
     forceRefresh(login?: boolean): Promise<AccessToken>;
-    refreshRejectedToken(staleAccessToken: string, login?: boolean): Promise<AccessToken>;
     logout(): Promise<void>;
     private loadToken;
-    private refreshRejected;
+    private refresh;
     private renew;
     private canReuse;
     private withLock;