@fruggr/zendesk-mcp-server 3.0.3 → 3.1.0

package/dist/token-store-CLtwRaxI.js

@@ -0,0 +1,972 @@
+#!/usr/bin/env node
+import { c as getOAuthUrls, r as silentLogger } from "./index.js";
+import { a as saveToken, c as grantCovers, d as escapeHtml, i as resolveTokenPath, l as requestedScope, o as generateCodeChallenge, r as loadToken, s as generateCodeVerifier, t as clearToken } from "./token-persistence-BeetFqPF.js";
+import { promisify } from "node:util";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import process$1 from "node:process";
+import { createServer } from "node:http";
+import { Buffer } from "node:buffer";
+import fs, { constants } from "node:fs/promises";
+import fs$1, { readFileSync } from "node:fs";
+import os, { release } from "node:os";
+import childProcess, { execFile } from "node:child_process";
+//#region node_modules/.pnpm/is-docker@3.0.0/node_modules/is-docker/index.js
+let isDockerCached;
+function hasDockerEnv() {
+	try {
+		fs$1.statSync("/.dockerenv");
+		return true;
+	} catch {
+		return false;
+	}
+}
+function hasDockerCGroup() {
+	try {
+		return fs$1.readFileSync("/proc/self/cgroup", "utf8").includes("docker");
+	} catch {
+		return false;
+	}
+}
+function isDocker() {
+	if (isDockerCached === void 0) isDockerCached = hasDockerEnv() || hasDockerCGroup();
+	return isDockerCached;
+}
+//#endregion
+//#region node_modules/.pnpm/is-inside-container@1.0.0/node_modules/is-inside-container/index.js
+let cachedResult;
+const hasContainerEnv = () => {
+	try {
+		fs$1.statSync("/run/.containerenv");
+		return true;
+	} catch {
+		return false;
+	}
+};
+function isInsideContainer() {
+	if (cachedResult === void 0) cachedResult = hasContainerEnv() || isDocker();
+	return cachedResult;
+}
+//#endregion
+//#region node_modules/.pnpm/is-wsl@3.1.1/node_modules/is-wsl/index.js
+const isWsl = () => {
+	if (process$1.platform !== "linux") return false;
+	if (os.release().toLowerCase().includes("microsoft")) {
+		if (isInsideContainer()) return false;
+		return true;
+	}
+	try {
+		if (fs$1.readFileSync("/proc/version", "utf8").toLowerCase().includes("microsoft")) return !isInsideContainer();
+	} catch {}
+	if (fs$1.existsSync("/proc/sys/fs/binfmt_misc/WSLInterop") || fs$1.existsSync("/run/WSL")) return !isInsideContainer();
+	return false;
+};
+var is_wsl_default = process$1.env.__IS_WSL_TEST__ ? isWsl : isWsl();
+//#endregion
+//#region node_modules/.pnpm/powershell-utils@0.1.0/node_modules/powershell-utils/index.js
+const execFile$3 = promisify(childProcess.execFile);
+const powerShellPath$2 = () => `${process$1.env.SYSTEMROOT || process$1.env.windir || String.raw`C:\Windows`}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`;
+const executePowerShell$1 = async (command, options = {}) => {
+	const { powerShellPath: psPath, ...execFileOptions } = options;
+	const encodedCommand = executePowerShell$1.encodeCommand(command);
+	return execFile$3(psPath ?? powerShellPath$2(), [...executePowerShell$1.argumentsPrefix, encodedCommand], {
+		encoding: "utf8",
+		...execFileOptions
+	});
+};
+executePowerShell$1.argumentsPrefix = [
+	"-NoProfile",
+	"-NonInteractive",
+	"-ExecutionPolicy",
+	"Bypass",
+	"-EncodedCommand"
+];
+executePowerShell$1.encodeCommand = (command) => Buffer.from(command, "utf16le").toString("base64");
+executePowerShell$1.escapeArgument = (value) => `'${String(value).replaceAll("'", "''")}'`;
+//#endregion
+//#region node_modules/.pnpm/wsl-utils@1.0.0/node_modules/wsl-utils/utilities.js
+function parseMountPointFromConfig(content) {
+	for (const line of content.split("\n")) {
+		if (/^\s*#/.test(line)) continue;
+		const match = /^\s*root\s*=\s*(?<mountPoint>"[^"]*"|'[^']*'|[^#]*)/.exec(line);
+		if (!match) continue;
+		return match.groups.mountPoint.trim().replaceAll(/^["']|["']$/g, "");
+	}
+}
+//#endregion
+//#region node_modules/.pnpm/wsl-utils@1.0.0/node_modules/wsl-utils/index.js
+const execFile$2 = promisify(childProcess.execFile);
+const wslDrivesMountPoint = (() => {
+	const defaultMountPoint = "/mnt/";
+	let mountPoint;
+	return async function() {
+		if (mountPoint) return mountPoint;
+		const configFilePath = "/etc/wsl.conf";
+		let isConfigFileExists = false;
+		try {
+			await fs.access(configFilePath, constants.F_OK);
+			isConfigFileExists = true;
+		} catch {}
+		if (!isConfigFileExists) return defaultMountPoint;
+		const parsedMountPoint = parseMountPointFromConfig(await fs.readFile(configFilePath, { encoding: "utf8" }));
+		if (parsedMountPoint === void 0) return defaultMountPoint;
+		mountPoint = parsedMountPoint;
+		mountPoint = mountPoint.endsWith("/") ? mountPoint : `${mountPoint}/`;
+		return mountPoint;
+	};
+})();
+const powerShellPathFromWsl = async () => {
+	return `${await wslDrivesMountPoint()}c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe`;
+};
+const powerShellPath$1 = is_wsl_default ? powerShellPathFromWsl : powerShellPath$2;
+let canAccessPowerShellPromise;
+const canAccessPowerShell = async () => {
+	canAccessPowerShellPromise ??= (async () => {
+		try {
+			const psPath = await powerShellPath$1();
+			await fs.access(psPath, constants.X_OK);
+			return true;
+		} catch {
+			return false;
+		}
+	})();
+	return canAccessPowerShellPromise;
+};
+const wslDefaultBrowser = async () => {
+	const psPath = await powerShellPath$1();
+	const command = String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`;
+	const { stdout } = await executePowerShell$1(command, {
+		powerShellPath: psPath,
+		cwd: path.dirname(psPath)
+	});
+	return stdout.trim();
+};
+const isUrl = (path) => /^[a-z]+:\/\//i.test(path);
+const convertWslPathToWindows = async (paths) => {
+	const isBatch = Array.isArray(paths);
+	const pathArray = isBatch ? paths : [paths];
+	const indicesToConvert = [];
+	const pathsToConvert = [];
+	for (const [index, path] of pathArray.entries()) if (!isUrl(path)) {
+		indicesToConvert.push(index);
+		pathsToConvert.push(path);
+	}
+	const results = [...pathArray];
+	if (pathsToConvert.length > 0) try {
+		const { stdout } = await execFile$2("wslpath", ["-aw", ...pathsToConvert], { encoding: "utf8" });
+		const convertedPaths = stdout.split(/\r?\n/).filter(Boolean);
+		for (const [index, originalIndex] of indicesToConvert.entries()) results[originalIndex] = convertedPaths[index] ?? pathArray[originalIndex];
+	} catch {}
+	return isBatch ? results : results[0];
+};
+//#endregion
+//#region node_modules/.pnpm/powershell-utils@0.2.1/node_modules/powershell-utils/index.js
+const execFile$1 = promisify(childProcess.execFile);
+const powerShellPath = () => `${process$1.env.SYSTEMROOT || process$1.env.windir || String.raw`C:\Windows`}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`;
+const argumentsPrefix = [
+	"-NoProfile",
+	"-NonInteractive",
+	"-ExecutionPolicy",
+	"Bypass",
+	"-EncodedCommand"
+];
+const encodeCommand = (command) => Buffer.from(command, "utf16le").toString("base64");
+const escapeArgument = (value) => `'${String(value).replaceAll(/['‘’‚‛]/g, (match) => match + match)}'`;
+const createArguments = (command) => [...argumentsPrefix, encodeCommand(command)];
+const createExecFileOptions = (options) => ({
+	encoding: "utf8",
+	...options,
+	shell: false
+});
+const executePowerShell = async (command, options = {}) => {
+	const { powerShellPath: psPath, ...execFileOptions } = options;
+	return execFile$1(psPath ?? powerShellPath(), createArguments(command), createExecFileOptions(execFileOptions));
+};
+executePowerShell.argumentsPrefix = argumentsPrefix;
+executePowerShell.encodeCommand = encodeCommand;
+executePowerShell.escapeArgument = escapeArgument;
+executePowerShell.createArguments = createArguments;
+//#endregion
+//#region node_modules/.pnpm/define-lazy-prop@3.0.0/node_modules/define-lazy-prop/index.js
+function defineLazyProperty(object, propertyName, valueGetter) {
+	const define = (value) => Object.defineProperty(object, propertyName, {
+		value,
+		enumerable: true,
+		writable: true
+	});
+	Object.defineProperty(object, propertyName, {
+		configurable: true,
+		enumerable: true,
+		get() {
+			const result = valueGetter();
+			define(result);
+			return result;
+		},
+		set(value) {
+			define(value);
+		}
+	});
+	return object;
+}
+//#endregion
+//#region node_modules/.pnpm/default-browser-id@5.0.1/node_modules/default-browser-id/index.js
+const execFileAsync$3 = promisify(execFile);
+async function defaultBrowserId() {
+	if (process$1.platform !== "darwin") throw new Error("macOS only");
+	const { stdout } = await execFileAsync$3("defaults", [
+		"read",
+		"com.apple.LaunchServices/com.apple.launchservices.secure",
+		"LSHandlers"
+	]);
+	const browserId = /LSHandlerRoleAll = "(?!-)(?<id>[^"]+?)";\s+?LSHandlerURLScheme = (?:http|https);/.exec(stdout)?.groups.id ?? "com.apple.Safari";
+	if (browserId === "com.apple.safari") return "com.apple.Safari";
+	return browserId;
+}
+//#endregion
+//#region node_modules/.pnpm/run-applescript@7.1.0/node_modules/run-applescript/index.js
+const execFileAsync$2 = promisify(execFile);
+async function runAppleScript(script, { humanReadableOutput = true, signal } = {}) {
+	if (process$1.platform !== "darwin") throw new Error("macOS only");
+	const outputArguments = humanReadableOutput ? [] : ["-ss"];
+	const execOptions = {};
+	if (signal) execOptions.signal = signal;
+	const { stdout } = await execFileAsync$2("osascript", [
+		"-e",
+		script,
+		outputArguments
+	], execOptions);
+	return stdout.trim();
+}
+//#endregion
+//#region node_modules/.pnpm/bundle-name@4.1.1/node_modules/bundle-name/index.js
+const bundleIdentifierPattern = /^[^\n\r"\\]+$/u;
+async function bundleName(bundleId) {
+	if (typeof bundleId !== "string") throw new TypeError("Expected a string bundle identifier");
+	if (!bundleIdentifierPattern.test(bundleId)) throw new TypeError(`Invalid bundle identifier: ${JSON.stringify(bundleId)}`);
+	return runAppleScript(`tell application "Finder" to set app_path to application file id "${bundleId}" as string\ntell application "System Events" to get value of property list item "CFBundleName" of property list file (app_path & ":Contents:Info.plist")`);
+}
+//#endregion
+//#region node_modules/.pnpm/default-browser@5.5.1/node_modules/default-browser/windows.js
+const execFileAsync$1 = promisify(execFile);
+const windowsBrowserProgIds = {
+	MSEdgeHTM: {
+		name: "Edge",
+		id: "com.microsoft.edge"
+	},
+	MSEdgeBHTML: {
+		name: "Edge Beta",
+		id: "com.microsoft.edge.beta"
+	},
+	MSEdgeDHTML: {
+		name: "Edge Dev",
+		id: "com.microsoft.edge.dev"
+	},
+	AppXq0fevzme2pys62n3e0fbqa7peapykr8v: {
+		name: "Edge",
+		id: "com.microsoft.edge.old"
+	},
+	ChromeHTML: {
+		name: "Chrome",
+		id: "com.google.chrome"
+	},
+	ChromeBHTML: {
+		name: "Chrome Beta",
+		id: "com.google.chrome.beta"
+	},
+	ChromeDHTML: {
+		name: "Chrome Dev",
+		id: "com.google.chrome.dev"
+	},
+	ChromiumHTM: {
+		name: "Chromium",
+		id: "org.chromium.Chromium"
+	},
+	BraveHTML: {
+		name: "Brave",
+		id: "com.brave.Browser"
+	},
+	BraveBHTML: {
+		name: "Brave Beta",
+		id: "com.brave.Browser.beta"
+	},
+	BraveDHTML: {
+		name: "Brave Dev",
+		id: "com.brave.Browser.dev"
+	},
+	BraveSSHTM: {
+		name: "Brave Nightly",
+		id: "com.brave.Browser.nightly"
+	},
+	FirefoxURL: {
+		name: "Firefox",
+		id: "org.mozilla.firefox"
+	},
+	OperaStable: {
+		name: "Opera",
+		id: "com.operasoftware.Opera"
+	},
+	VivaldiHTM: {
+		name: "Vivaldi",
+		id: "com.vivaldi.Vivaldi"
+	},
+	"IE.HTTP": {
+		name: "Internet Explorer",
+		id: "com.microsoft.ie"
+	}
+};
+const _windowsBrowserProgIdMap = new Map(Object.entries(windowsBrowserProgIds));
+var UnknownBrowserError = class extends Error {};
+async function defaultBrowser$1(_execFileAsync = execFileAsync$1) {
+	const { stdout } = await _execFileAsync(`${process$1.env.SYSTEMROOT ?? process$1.env.windir ?? "C:\\Windows"}\\System32\\reg.exe`, [
+		"QUERY",
+		" HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\http\\UserChoice",
+		"/v",
+		"ProgId"
+	]);
+	const match = /ProgId\s*REG_SZ\s*(?<id>\S+)/.exec(stdout);
+	if (!match) throw new UnknownBrowserError(`Cannot find Windows browser in stdout: ${JSON.stringify(stdout)}`);
+	const { id } = match.groups;
+	const dotIndex = id.lastIndexOf(".");
+	const hyphenIndex = id.lastIndexOf("-");
+	const baseIdByDot = dotIndex === -1 ? void 0 : id.slice(0, dotIndex);
+	const baseIdByHyphen = hyphenIndex === -1 ? void 0 : id.slice(0, hyphenIndex);
+	return windowsBrowserProgIds[id] ?? windowsBrowserProgIds[baseIdByDot] ?? windowsBrowserProgIds[baseIdByHyphen] ?? {
+		name: id,
+		id
+	};
+}
+//#endregion
+//#region node_modules/.pnpm/default-browser@5.5.1/node_modules/default-browser/index.js
+const execFileAsync = promisify(execFile);
+const titleize = (string) => string.toLowerCase().replaceAll(/(?:^|\s|-)\S/g, (x) => x.toUpperCase());
+async function defaultBrowser() {
+	if (process$1.platform === "darwin") {
+		const id = await defaultBrowserId();
+		return {
+			name: await bundleName(id),
+			id
+		};
+	}
+	if (process$1.platform === "linux") {
+		const { stdout } = await execFileAsync("xdg-mime", [
+			"query",
+			"default",
+			"x-scheme-handler/http"
+		]);
+		const id = stdout.trim();
+		return {
+			name: titleize(id.replace(/.desktop$/, "").replace("-", " ")),
+			id
+		};
+	}
+	if (process$1.platform === "win32") return defaultBrowser$1();
+	throw new Error("Only macOS, Linux, and Windows are supported");
+}
+//#endregion
+//#region node_modules/.pnpm/is-in-ssh@1.0.0/node_modules/is-in-ssh/index.js
+const isInSsh = Boolean(process$1.env.SSH_CONNECTION || process$1.env.SSH_CLIENT || process$1.env.SSH_TTY);
+//#endregion
+//#region node_modules/.pnpm/open@11.0.4/node_modules/open/index.js
+const fallbackAttemptSymbol = Symbol("fallbackAttempt");
+const __dirname = import.meta.url ? path.dirname(fileURLToPath(import.meta.url)) : "";
+const localXdgOpenPath = path.join(__dirname, "xdg-open");
+const { platform, arch } = process$1;
+const tryEachApp = async (apps, opener) => {
+	if (apps.length === 0) return;
+	const errors = [];
+	for (const app of apps) try {
+		return await opener(app);
+	} catch (error) {
+		errors.push(error);
+	}
+	throw new AggregateError(errors, "Failed to open in all supported apps");
+};
+const baseOpen = async (options) => {
+	options = {
+		wait: false,
+		background: false,
+		newInstance: false,
+		allowNonzeroExitCode: false,
+		...options
+	};
+	const isFallbackAttempt = options[fallbackAttemptSymbol] === true;
+	delete options[fallbackAttemptSymbol];
+	if (Array.isArray(options.app)) return tryEachApp(options.app, (singleApp) => baseOpen({
+		...options,
+		app: singleApp,
+		[fallbackAttemptSymbol]: true
+	}));
+	let { name: app, arguments: appArguments = [] } = options.app ?? {};
+	appArguments = [...appArguments];
+	if (Array.isArray(app)) return tryEachApp(app, (appName) => baseOpen({
+		...options,
+		app: {
+			name: appName,
+			arguments: appArguments
+		},
+		[fallbackAttemptSymbol]: true
+	}));
+	if (app === "browser" || app === "browserPrivate") {
+		const ids = {
+			"com.google.chrome": "chrome",
+			"google-chrome.desktop": "chrome",
+			"com.brave.browser": "brave",
+			"org.mozilla.firefox": "firefox",
+			"firefox.desktop": "firefox",
+			"com.microsoft.msedge": "edge",
+			"com.microsoft.edge": "edge",
+			"com.microsoft.edgemac": "edge",
+			"microsoft-edge.desktop": "edge",
+			"com.apple.safari": "safari"
+		};
+		const flags = {
+			chrome: "--incognito",
+			brave: "--incognito",
+			firefox: "--private-window",
+			edge: "--inPrivate"
+		};
+		let browser;
+		if (is_wsl_default) {
+			const progId = await wslDefaultBrowser();
+			browser = _windowsBrowserProgIdMap.get(progId) ?? {};
+		} else browser = await defaultBrowser();
+		const browserId = browser.id?.toLowerCase();
+		if (Object.hasOwn(ids, browserId)) {
+			const browserName = ids[browserId];
+			if (app === "browserPrivate") {
+				if (browserName === "safari") throw new Error("Safari doesn't support opening in private mode via command line");
+				appArguments.push(flags[browserName]);
+			}
+			return baseOpen({
+				...options,
+				app: {
+					name: apps[browserName],
+					arguments: appArguments
+				}
+			});
+		}
+		throw new Error(`${browser.name} is not supported as a default browser`);
+	}
+	let command;
+	const cliArguments = [];
+	const childProcessOptions = {};
+	let shouldUseWindowsInWsl = false;
+	if (is_wsl_default && !isInsideContainer() && !isInSsh && !app) shouldUseWindowsInWsl = await canAccessPowerShell();
+	if (platform === "darwin") {
+		command = "open";
+		if (options.wait) cliArguments.push("--wait-apps");
+		if (options.background) cliArguments.push("--background");
+		if (options.newInstance) cliArguments.push("--new");
+		if (app) cliArguments.push("-a", app);
+	} else if (platform === "win32" || shouldUseWindowsInWsl) {
+		command = await powerShellPath$1();
+		cliArguments.push(...executePowerShell.argumentsPrefix);
+		if (!is_wsl_default) childProcessOptions.windowsVerbatimArguments = true;
+		if (is_wsl_default && options.target) options.target = await convertWslPathToWindows(options.target);
+		const encodedArguments = ["$ProgressPreference = 'SilentlyContinue';", "Start"];
+		if (options.wait) encodedArguments.push("-Wait");
+		if (app) {
+			encodedArguments.push(executePowerShell.escapeArgument(app));
+			if (options.target) appArguments.push(options.target);
+		} else if (options.target) encodedArguments.push(executePowerShell.escapeArgument(options.target));
+		if (appArguments.length > 0) {
+			appArguments = appArguments.map((argument) => executePowerShell.escapeArgument(argument));
+			encodedArguments.push("-ArgumentList", appArguments.join(","));
+		}
+		options.target = executePowerShell.encodeCommand(encodedArguments.join(" "));
+		if (!options.wait) childProcessOptions.stdio = "ignore";
+		if (is_wsl_default) childProcessOptions.cwd = path.dirname(command);
+	} else {
+		if (app) command = app;
+		else {
+			const isBundled = !__dirname || __dirname === "/";
+			let exeLocalXdgOpen = false;
+			try {
+				await fs.access(localXdgOpenPath, constants.X_OK);
+				exeLocalXdgOpen = true;
+			} catch {}
+			command = process$1.versions.electron ?? (platform === "android" || isBundled || !exeLocalXdgOpen) ? "xdg-open" : localXdgOpenPath;
+		}
+		if (appArguments.length > 0) cliArguments.push(...appArguments);
+		if (!options.wait) {
+			childProcessOptions.stdio = "ignore";
+			childProcessOptions.detached = true;
+		}
+	}
+	if (platform === "darwin" && appArguments.length > 0) cliArguments.push("--args", ...appArguments);
+	if (options.target) cliArguments.push(options.target);
+	const subprocess = childProcess.spawn(command, cliArguments, childProcessOptions);
+	if (options.wait) return new Promise((resolve, reject) => {
+		subprocess.once("error", reject);
+		subprocess.once("close", (exitCode) => {
+			if (!options.allowNonzeroExitCode && exitCode !== 0) {
+				reject(/* @__PURE__ */ new Error(`Exited with code ${exitCode}`));
+				return;
+			}
+			resolve(subprocess);
+		});
+	});
+	if (isFallbackAttempt || platform === "win32" || shouldUseWindowsInWsl) return new Promise((resolve, reject) => {
+		subprocess.once("error", reject);
+		subprocess.once("spawn", () => {
+			subprocess.once("close", (exitCode) => {
+				subprocess.off("error", reject);
+				if (isFallbackAttempt && exitCode !== 0) {
+					reject(/* @__PURE__ */ new Error(`Exited with code ${exitCode}`));
+					return;
+				}
+				subprocess.unref();
+				resolve(subprocess);
+			});
+		});
+	});
+	subprocess.unref();
+	return new Promise((resolve, reject) => {
+		subprocess.once("error", reject);
+		subprocess.once("spawn", () => {
+			subprocess.off("error", reject);
+			resolve(subprocess);
+		});
+	});
+};
+const open = (target, options) => {
+	if (typeof target !== "string") throw new TypeError("Expected a `target`");
+	return baseOpen({
+		...options,
+		target
+	});
+};
+function detectArchBinary(binary) {
+	if (typeof binary === "string" || Array.isArray(binary)) return binary;
+	const { [arch]: archBinary } = binary;
+	if (!archBinary) throw new Error(`${arch} is not supported`);
+	return archBinary;
+}
+function detectPlatformBinary({ [platform]: platformBinary }, { wsl } = {}) {
+	if (wsl && is_wsl_default) return detectArchBinary(wsl);
+	if (!platformBinary) throw new Error(`${platform} is not supported`);
+	return detectArchBinary(platformBinary);
+}
+const apps = {
+	browser: "browser",
+	browserPrivate: "browserPrivate"
+};
+defineLazyProperty(apps, "chrome", () => detectPlatformBinary({
+	darwin: "google chrome",
+	win32: "chrome",
+	linux: [
+		"google-chrome",
+		"google-chrome-stable",
+		"chromium",
+		"chromium-browser"
+	]
+}, { wsl: {
+	ia32: "/mnt/c/Program Files (x86)/Google/Chrome/Application/chrome.exe",
+	x64: ["/mnt/c/Program Files/Google/Chrome/Application/chrome.exe", "/mnt/c/Program Files (x86)/Google/Chrome/Application/chrome.exe"]
+} }));
+defineLazyProperty(apps, "brave", () => detectPlatformBinary({
+	darwin: "brave browser",
+	win32: "brave",
+	linux: ["brave-browser", "brave"]
+}, { wsl: {
+	ia32: "/mnt/c/Program Files (x86)/BraveSoftware/Brave-Browser/Application/brave.exe",
+	x64: ["/mnt/c/Program Files/BraveSoftware/Brave-Browser/Application/brave.exe", "/mnt/c/Program Files (x86)/BraveSoftware/Brave-Browser/Application/brave.exe"]
+} }));
+defineLazyProperty(apps, "firefox", () => detectPlatformBinary({
+	darwin: "firefox",
+	win32: String.raw`C:\Program Files\Mozilla Firefox\firefox.exe`,
+	linux: "firefox"
+}, { wsl: "/mnt/c/Program Files/Mozilla Firefox/firefox.exe" }));
+defineLazyProperty(apps, "edge", () => detectPlatformBinary({
+	darwin: "microsoft edge",
+	win32: "msedge",
+	linux: ["microsoft-edge", "microsoft-edge-dev"]
+}, { wsl: "/mnt/c/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" }));
+defineLazyProperty(apps, "safari", () => detectPlatformBinary({ darwin: "Safari" }));
+//#endregion
+//#region src/auth/browser-oauth.ts
+const AUTH_TIMEOUT_MS = 3e5;
+/** Best-effort WSL detection: WSL kernels carry "microsoft" in /proc/version. */
+const detectWsl = () => {
+	if (process.platform !== "linux") return false;
+	try {
+		return readFileSync("/proc/version", "utf8").toLowerCase().includes("microsoft");
+	} catch {
+		return false;
+	}
+};
+/**
+* Build an actionable error for a callback port that's already taken. The raw
+* Node `EADDRINUSE` is opaque to both the user and the LLM. The port is also
+* the mutex between instances, so retrying once the other sign-in ends comes
+* first and the free-port escape hatch second
+* (`docs/decisions/token-file-keying.md`). The `(EADDRINUSE)` marker and `code`
+* are kept for diagnostics/tests.
+*/
+const callbackPortInUseError = (port, cause) => Object.assign(/* @__PURE__ */ new Error(`Cannot start the Zendesk OAuth sign-in: local callback port ${port} is already in use. Another instance of this server is most likely signing in right now: finish that browser window, then retry. If an unrelated program holds the port, set OAUTH_CALLBACK_PORT (or --callback-port) to a free port, then register http://localhost:<port>/callback as a redirect URL in your Zendesk OAuth client. (EADDRINUSE)`), {
+	code: "EADDRINUSE",
+	cause
+});
+const errorPage = (title, detail) => `<html><body><h1>${escapeHtml(title)}</h1>${detail === void 0 ? "" : `<p>${escapeHtml(detail)}</p>`}</body></html>`;
+const SUCCESS_PAGE = "<html><body><h1>Authentication successful!</h1><p>You can close this tab and return to your AI assistant.</p><p>This tab will auto-close in <span id=\"t\">10</span>s.</p><script>let n=10;const el=document.getElementById(\"t\");const i=setInterval(()=>{n--;el.textContent=n;if(n<=0){clearInterval(i);window.close();}},1000);<\/script></body></html>";
+/**
+* Begin the OAuth 2.1 PKCE flow: start the local callback server, attempt to
+* open the browser, and return as soon as the server is listening with the
+* authorize URL plus a promise that settles when the callback arrives.
+*
+* Splitting "start" from "await the token" lets callers stay non-blocking: they
+* can hand the URL back to the user immediately instead of holding a request
+* open for up to the 5-minute timeout.
+*/
+const startBrowserAuth = (config, logger = silentLogger) => {
+	const { subdomain, oauthClientId, readOnly } = config;
+	const { authorizeUrl: authorizeBase, tokenUrl } = getOAuthUrls(subdomain);
+	const codeVerifier = generateCodeVerifier();
+	const codeChallenge = generateCodeChallenge(codeVerifier);
+	return new Promise((resolveStarted, rejectStarted) => {
+		let resolveToken;
+		let rejectToken;
+		const tokenPromise = new Promise((resolve, reject) => {
+			resolveToken = resolve;
+			rejectToken = reject;
+		});
+		let authTimeout;
+		let callbackServer;
+		const exchangeCodeForToken = async (code) => {
+			const callbackPort = callbackServer.address().port;
+			const tokenBody = new URLSearchParams({
+				grant_type: "authorization_code",
+				code,
+				client_id: oauthClientId,
+				redirect_uri: `http://localhost:${callbackPort}/callback`,
+				code_verifier: codeVerifier
+			});
+			const tokenResponse = await fetch(tokenUrl, {
+				method: "POST",
+				headers: { "Content-Type": "application/x-www-form-urlencoded" },
+				body: tokenBody.toString()
+			});
+			logger.debug("oauth_token_exchange", { status: tokenResponse.status });
+			if (!tokenResponse.ok) {
+				const errorBody = await tokenResponse.text();
+				throw new Error(`Token exchange failed (${tokenResponse.status}): ${errorBody}`);
+			}
+			return await tokenResponse.json();
+		};
+		const finishRequest = (res, { status, html, outcome }) => {
+			res.writeHead(status, { "Content-Type": "text/html" });
+			res.end(html);
+			clearTimeout(authTimeout);
+			callbackServer.close();
+			if (outcome.ok) resolveToken(outcome.token);
+			else rejectToken(outcome.error);
+		};
+		const resolveCallback = async (url) => {
+			const error = url.searchParams.get("error");
+			const code = url.searchParams.get("code");
+			logger.debug("oauth_callback_received", {
+				hasCode: Boolean(code),
+				hasError: Boolean(error)
+			});
+			if (error) {
+				const desc = url.searchParams.get("error_description") ?? error;
+				return {
+					status: 400,
+					html: errorPage("Authentication failed", desc),
+					outcome: {
+						ok: false,
+						error: /* @__PURE__ */ new Error(`OAuth error: ${desc}`)
+					}
+				};
+			}
+			if (!code) return {
+				status: 400,
+				html: errorPage("Missing authorization code"),
+				outcome: {
+					ok: false,
+					error: /* @__PURE__ */ new Error("Missing authorization code in callback")
+				}
+			};
+			try {
+				const token = await exchangeCodeForToken(code);
+				logger.info("oauth_authenticated");
+				return {
+					status: 200,
+					html: SUCCESS_PAGE,
+					outcome: {
+						ok: true,
+						token
+					}
+				};
+			} catch (err) {
+				const detail = err instanceof Error ? err.message : String(err);
+				return {
+					status: 500,
+					html: errorPage("Token exchange failed", detail),
+					outcome: {
+						ok: false,
+						error: err
+					}
+				};
+			}
+		};
+		callbackServer = createServer(async (req, res) => {
+			const url = new URL(req.url ?? "/", `http://localhost`);
+			if (url.pathname !== "/callback") {
+				res.writeHead(404);
+				res.end("Not found");
+				return;
+			}
+			finishRequest(res, await resolveCallback(url));
+		});
+		const requestedPort = config.callbackPort ?? 27439;
+		const onStartError = (err) => {
+			const code = err.code;
+			logger.error("oauth_callback_listen_failed", {
+				port: requestedPort,
+				errorCode: code
+			});
+			rejectStarted(code === "EADDRINUSE" ? callbackPortInUseError(requestedPort, err) : err);
+		};
+		callbackServer.once("error", onStartError);
+		callbackServer.listen(requestedPort, () => {
+			callbackServer.off("error", onStartError);
+			callbackServer.once("error", (err) => {
+				clearTimeout(authTimeout);
+				callbackServer.close();
+				rejectToken(err);
+			});
+			const port = callbackServer.address().port;
+			const redirectUri = `http://localhost:${port}/callback`;
+			const params = new URLSearchParams({
+				response_type: "code",
+				client_id: oauthClientId,
+				redirect_uri: redirectUri,
+				scope: requestedScope(readOnly),
+				code_challenge: codeChallenge,
+				code_challenge_method: "S256"
+			});
+			const authUrl = `${authorizeBase}?${params.toString()}`;
+			logger.debug("oauth_callback_listening", {
+				port,
+				redirectUri
+			});
+			logger.info("oauth_browser_opening");
+			logger.debug("oauth_authorize_url", { url: authUrl });
+			console.error(`Opening browser for Zendesk authentication...`);
+			console.error(`If the browser doesn't open, visit: ${authUrl}`);
+			open(authUrl).then(() => {
+				logger.debug("oauth_browser_opened");
+			}).catch((err) => {
+				logger.error("oauth_browser_open_failed", {
+					error: err instanceof Error ? err.message : String(err),
+					errorCode: err?.code,
+					platform: process.platform,
+					release: release(),
+					isWsl: detectWsl(),
+					hasSystemRoot: Boolean(process.env["SYSTEMROOT"]),
+					hasWindir: Boolean(process.env["WINDIR"]),
+					hasComSpec: Boolean(process.env["ComSpec"]),
+					hasPath: Boolean(process.env["PATH"]),
+					hasDisplay: Boolean(process.env["DISPLAY"])
+				});
+			});
+			authTimeout = setTimeout(() => {
+				logger.error("oauth_timeout", { timeoutMs: AUTH_TIMEOUT_MS });
+				callbackServer.close();
+				rejectToken(/* @__PURE__ */ new Error("OAuth authentication timed out (5 min). Please try again."));
+			}, AUTH_TIMEOUT_MS);
+			authTimeout.unref();
+			resolveStarted({
+				authorizeUrl: authUrl,
+				tokenPromise
+			});
+		});
+	});
+};
+/**
+* Exchange a refresh token for a fresh access token (and a rotated refresh token)
+* without any browser interaction. Public PKCE clients send no `client_secret`.
+* Zendesk refresh tokens are single-use: the caller MUST persist the new
+* `refresh_token` from the response. Throws on a non-2xx (expired/invalid
+* refresh token) so the caller can fall back to the full browser flow.
+*/
+const refreshAccessToken = async (config, logger = silentLogger) => {
+	const { tokenUrl } = getOAuthUrls(config.subdomain);
+	const body = new URLSearchParams({
+		grant_type: "refresh_token",
+		refresh_token: config.refreshToken,
+		client_id: config.oauthClientId
+	});
+	const response = await fetch(tokenUrl, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: body.toString()
+	});
+	logger.debug("oauth_token_refresh", { status: response.status });
+	if (!response.ok) {
+		const errorBody = await response.text();
+		throw new Error(`Token refresh failed (${response.status}): ${errorBody}`);
+	}
+	const tokenData = await response.json();
+	logger.info("oauth_token_refreshed");
+	return tokenData;
+};
+//#endregion
+//#region src/auth/token-store.ts
+const EXPIRY_SKEW_MS = 6e4;
+const SCHEDULED_REFRESH_MS = 144e5;
+const createAuthRequiredError = (authorizeUrl) => Object.assign(/* @__PURE__ */ new Error("Zendesk authentication required. A browser window should have opened for you to sign in. If it did not, open this URL in your browser, then retry your request:\n" + authorizeUrl), {
+	name: "AuthRequiredError",
+	authorizeUrl
+});
+const expiryFrom = (expiresIn) => typeof expiresIn === "number" ? Date.now() + expiresIn * 1e3 : void 0;
+const createTokenStore = (config, logger = silentLogger) => {
+	const requested = requestedScope(config.readOnly);
+	const tokenPath = resolveTokenPath({
+		subdomain: config.subdomain,
+		oauthClientId: config.oauthClientId,
+		scope: requested
+	});
+	let token = loadToken(tokenPath);
+	if (token) {
+		if (grantCovers(token.scope, requested)) logger.debug("oauth_token_loaded_from_disk");
+		else {
+			logger.warn("oauth_token_scope_insufficient", {
+				requested,
+				granted: token.scope
+			});
+			token = void 0;
+		}
+	}
+	let authorizeUrl;
+	let starting;
+	let refreshing;
+	let probedUnknownExpiry = false;
+	const persist = (t) => saveToken(tokenPath, t, logger);
+	const setToken = (accessToken, refreshToken) => {
+		token = {
+			accessToken,
+			refreshToken,
+			scope: requested
+		};
+		probedUnknownExpiry = false;
+		persist(token);
+	};
+	const needsRefresh = (t) => typeof t.expiresAt === "number" ? Date.now() >= t.expiresAt - EXPIRY_SKEW_MS : t.refreshToken !== void 0 && !probedUnknownExpiry;
+	const noteGrant = (granted) => {
+		if (!grantCovers(granted, requested)) logger.warn("oauth_token_grant_narrowed", {
+			requested,
+			granted
+		});
+		return granted;
+	};
+	const tryRefresh = async (current, { dropOnFailure = true } = {}) => {
+		if (!current.refreshToken) return void 0;
+		try {
+			const result = await refreshAccessToken({
+				subdomain: config.subdomain,
+				oauthClientId: config.oauthClientId,
+				refreshToken: current.refreshToken
+			}, logger);
+			token = {
+				accessToken: result.access_token,
+				refreshToken: result.refresh_token ?? current.refreshToken,
+				expiresAt: expiryFrom(result.expires_in),
+				scope: noteGrant(result.scope || current.scope)
+			};
+			probedUnknownExpiry = true;
+			persist(token);
+			logger.info("oauth_token_refreshed_cached");
+			return token.accessToken;
+		} catch (err) {
+			logger.warn("oauth_token_refresh_failed", { error: err instanceof Error ? err.message : String(err) });
+			if (dropOnFailure) {
+				token = void 0;
+				clearToken(tokenPath, logger);
+			}
+			return;
+		}
+	};
+	const beginAuth = () => {
+		logger.info("oauth_auth_start");
+		return startBrowserAuth({
+			subdomain: config.subdomain,
+			oauthClientId: config.oauthClientId,
+			callbackPort: config.callbackPort,
+			readOnly: config.readOnly
+		}, logger).then((started) => {
+			authorizeUrl = started.authorizeUrl;
+			started.tokenPromise.then((result) => {
+				token = {
+					accessToken: result.access_token,
+					refreshToken: result.refresh_token,
+					expiresAt: expiryFrom(result.expires_in),
+					scope: noteGrant(result.scope || requested)
+				};
+				probedUnknownExpiry = true;
+				persist(token);
+				logger.info("oauth_token_cached");
+			}).catch((err) => {
+				logger.warn("oauth_auth_failed", { error: err instanceof Error ? err.message : String(err) });
+			}).finally(() => {
+				starting = void 0;
+				authorizeUrl = void 0;
+			});
+			return started.authorizeUrl;
+		}).catch((err) => {
+			starting = void 0;
+			throw err;
+		});
+	};
+	const refreshIfPossible = async () => {
+		const current = token;
+		if (!current?.refreshToken) return void 0;
+		if (refreshing === void 0) refreshing = tryRefresh(current).finally(() => {
+			refreshing = void 0;
+		});
+		return refreshing;
+	};
+	const getToken = async () => {
+		if (refreshing !== void 0) await refreshing;
+		if (token && !needsRefresh(token)) {
+			logger.debug("oauth_token_cache_hit");
+			return token.accessToken;
+		}
+		const refreshed = await refreshIfPossible();
+		if (refreshed) return refreshed;
+		if (starting === void 0) starting = beginAuth();
+		const url = authorizeUrl ?? await starting;
+		throw createAuthRequiredError(url);
+	};
+	const invalidate = () => {
+		if (token?.refreshToken) {
+			token = {
+				accessToken: token.accessToken,
+				refreshToken: token.refreshToken,
+				expiresAt: 0,
+				scope: token.scope
+			};
+			persist(token);
+		} else {
+			token = void 0;
+			clearToken(tokenPath, logger);
+		}
+		logger.info("oauth_token_invalidated");
+	};
+	const scheduledRefresh = setInterval(() => {
+		if (token?.refreshToken && !refreshing) refreshing = tryRefresh(token, { dropOnFailure: false }).finally(() => {
+			refreshing = void 0;
+		});
+	}, SCHEDULED_REFRESH_MS);
+	scheduledRefresh.unref?.();
+	const dispose = () => clearInterval(scheduledRefresh);
+	return {
+		getToken,
+		setToken,
+		invalidate,
+		dispose
+	};
+};
+//#endregion
+export { createTokenStore };