@iwas/mcp 1.0.0 → 1.0.2

package/dist/auth/index.js

@@ -1,2451 +1,25 @@
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __commonJS = (cb, mod) => function __require() {
-  try {
-    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
-  } catch (e) {
-    throw mod = 0, e;
-  }
-};
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// ../auth/dist/rbac/permissions.js
-var require_permissions = __commonJS({
-  "../auth/dist/rbac/permissions.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.MCP_OAUTH_SCOPES = exports2.OFFLINE_ACCESS_SCOPE = exports2.MCP_ELIGIBLE_PERMISSION_SET = exports2.MCP_ELIGIBLE_PERMISSIONS = exports2.SENSITIVE_MCP_RESOURCES = exports2.PERMISSION_SET = exports2.ALL_PERMISSIONS = exports2.CATALOG_DEFINITIONS = void 0;
-    exports2.isPermissionString = isPermissionString;
-    exports2.parsePermissionString = parsePermissionString;
-    exports2.isSensitiveMcpResource = isSensitiveMcpResource;
-    exports2.isMcpEligiblePermission = isMcpEligiblePermission;
-    exports2.partitionMcpScopes = partitionMcpScopes;
-    exports2.CATALOG_DEFINITIONS = {
-      organization: {
-        tier: "T",
-        actions: ["update", "delete"],
-        description: "Organization tenant profile and settings",
-        models: ["Organization", "OrganizationSetting", "OrganizationSubscription"],
-        mcpEligible: true
-      },
-      member: {
-        tier: "T",
-        actions: ["create", "update", "delete"],
-        description: "Organization member management",
-        models: ["Member"],
-        mcpEligible: true
-      },
-      invitation: {
-        tier: "T",
-        actions: ["create", "cancel"],
-        description: "Organization membership invitations",
-        models: ["Invitation"],
-        mcpEligible: true
-      },
-      location: {
-        tier: "T",
-        actions: ["read", "write", "delete"],
-        description: "Physical hotspot location management",
-        models: ["Location"],
-        mcpEligible: true
-      },
-      router: {
-        tier: "T",
-        actions: ["read", "write", "delete", "control"],
-        description: "Gateway router inventory, provisioning and control",
-        models: ["Router", "ZtpToken", "CoaQueue", "IpamAllocationCursor"],
-        mcpEligible: true
-      },
-      package: {
-        tier: "S",
-        actions: ["read", "write", "delete", "publish"],
-        description: "WiFi access package catalog (tenant + shared)",
-        models: ["Package", "VoucherPackage"],
-        mcpEligible: true
-      },
-      voucher: {
-        tier: "S",
-        actions: ["read", "write", "publish", "issue", "revoke"],
-        description: "Prepaid voucher codes and issuance (tenant + shared)",
-        models: ["Voucher", "VoucherIssuance", "VoucherUser"],
-        mcpEligible: true
-      },
-      session: {
-        tier: "T",
-        actions: ["read", "control"],
-        description: "Active and historical WiFi guest sessions",
-        models: ["WifiSession", "RadiusAccounting", "DeviceToken"],
-        mcpEligible: true
-      },
-      wallet: {
-        tier: "T",
-        actions: ["read", "topup", "charge", "refund", "freeze"],
-        description: "Prepaid wallet balances, topups and ledger transactions (SENSITIVE - MCP EXCLUDED)",
-        models: ["Wallet", "WalletTransaction", "TopupRequest"],
-        hasOwnQualifier: true,
-        mcpEligible: false
-      },
-      payment: {
-        tier: "T",
-        actions: ["read", "approve", "refund"],
-        description: "Inbound payment transactions and gateway integrations (SENSITIVE - MCP EXCLUDED)",
-        models: ["PaymentTransaction", "PaymentGatewayIntegration"],
-        hasOwnQualifier: true,
-        mcpEligible: false
-      },
-      subscription: {
-        tier: "T",
-        actions: ["read", "manage"],
-        description: "SaaS organization plan subscription and entitlements",
-        models: ["OrganizationSubscription"],
-        mcpEligible: true
-      },
-      partner: {
-        tier: "T",
-        actions: ["read", "manage", "payout:approve"],
-        description: "Affiliate/partner programs and payout requests",
-        models: ["Partner", "PartnerPayoutRequest"],
-        mcpEligible: true
-      },
-      campaign: {
-        tier: "T",
-        actions: ["read", "write"],
-        description: "Captive portal ad campaigns and lead capture",
-        models: ["AdCampaign", "LeadCapture"],
-        mcpEligible: true
-      },
-      notification: {
-        tier: "T",
-        actions: ["read", "send", "template:write"],
-        description: "Multi-channel notifications, templates and logs",
-        models: ["NotificationItem", "NotificationTemplate", "DeliveryLog"],
-        hasOwnQualifier: true,
-        mcpEligible: true
-      },
-      store: {
-        tier: "P",
-        actions: ["read", "write"],
-        description: "Public hardware/affiliate store catalog",
-        models: ["StoreProduct", "AffiliateClick"],
-        mcpEligible: true
-      },
-      blog: {
-        tier: "P",
-        actions: ["read", "write", "publish"],
-        description: "Company-wide editorial articles and CDN media",
-        models: ["BlogPost", "Media"],
-        hasOwnQualifier: true,
-        mcpEligible: true
-      },
-      analytics: {
-        tier: "D",
-        actions: ["read"],
-        description: "Aggregated usage, session and revenue metrics",
-        models: ["WifiSession", "Package", "PaymentTransaction"],
-        mcpEligible: true
-      },
-      diagnostics: {
-        tier: "P",
-        actions: ["read", "write"],
-        description: "System error events, MCP tool execution spans, flow events, issue triage and audit logs",
-        models: ["ErrorEvent", "McpToolSpan", "AuditLog", "SystemSetting", "FlowEvent", "IssueState"],
-        mcpEligible: true
-      }
-    };
-    exports2.ALL_PERMISSIONS = [
-      "organization:update",
-      "organization:delete",
-      "member:create",
-      "member:update",
-      "member:delete",
-      "invitation:create",
-      "invitation:cancel",
-      "location:read",
-      "location:write",
-      "location:delete",
-      "router:read",
-      "router:write",
-      "router:delete",
-      "router:control",
-      "package:read",
-      "package:write",
-      "package:delete",
-      "package:publish",
-      "voucher:read",
-      "voucher:write",
-      "voucher:publish",
-      "voucher:issue",
-      "voucher:revoke",
-      "session:read",
-      "session:control",
-      "wallet:read",
-      "wallet:topup",
-      "wallet:charge",
-      "wallet:refund",
-      "wallet:freeze",
-      "payment:read",
-      "payment:approve",
-      "payment:refund",
-      "subscription:read",
-      "subscription:manage",
-      "partner:read",
-      "partner:manage",
-      "partner:payout:approve",
-      "campaign:read",
-      "campaign:write",
-      "notification:read",
-      "notification:send",
-      "notification:template:write",
-      "store:read",
-      "store:write",
-      "blog:read",
-      "blog:write",
-      "blog:publish",
-      "analytics:read",
-      "diagnostics:read",
-      "diagnostics:write"
-    ];
-    exports2.PERMISSION_SET = new Set(exports2.ALL_PERMISSIONS);
-    function isPermissionString(value) {
-      return typeof value === "string" && exports2.PERMISSION_SET.has(value);
-    }
-    function parsePermissionString(value) {
-      if (!isPermissionString(value)) {
-        return null;
-      }
-      const colonIndex = value.indexOf(":");
-      const resource = value.slice(0, colonIndex);
-      const action = value.slice(colonIndex + 1);
-      return { resource, action };
-    }
-    exports2.SENSITIVE_MCP_RESOURCES = ["payment", "wallet"];
-    function isSensitiveMcpResource(resource) {
-      return resource === "payment" || resource === "wallet";
-    }
-    function isMcpEligiblePermission(permission) {
-      const parsed = parsePermissionString(permission);
-      if (!parsed)
-        return false;
-      return !isSensitiveMcpResource(parsed.resource);
-    }
-    exports2.MCP_ELIGIBLE_PERMISSIONS = exports2.ALL_PERMISSIONS.filter(isMcpEligiblePermission);
-    exports2.MCP_ELIGIBLE_PERMISSION_SET = new Set(exports2.MCP_ELIGIBLE_PERMISSIONS);
-    exports2.OFFLINE_ACCESS_SCOPE = "offline_access";
-    exports2.MCP_OAUTH_SCOPES = [
-      ...exports2.MCP_ELIGIBLE_PERMISSIONS,
-      exports2.OFFLINE_ACCESS_SCOPE
-    ];
-    function partitionMcpScopes(scopes) {
-      return {
-        permissionScopes: scopes.filter((scope) => scope !== exports2.OFFLINE_ACCESS_SCOPE),
-        offlineAccessRequested: scopes.includes(exports2.OFFLINE_ACCESS_SCOPE)
-      };
-    }
-  }
-});
-
-// src/auth/index.ts
-var auth_exports = {};
-__export(auth_exports, {
-  CredentialVault: () => CredentialVault,
-  DEFAULT_CLI_CLIENT_ID: () => DEFAULT_CLI_CLIENT_ID,
-  DEFAULT_KEYCHAIN_SERVICE: () => DEFAULT_KEYCHAIN_SERVICE,
-  DEFAULT_READ_ONLY_SCOPES: () => DEFAULT_READ_ONLY_SCOPES,
-  DEFAULT_SCOPES: () => DEFAULT_SCOPES,
-  DEFAULT_SERVER_URL: () => DEFAULT_SERVER_URL,
-  DEVICE_CODE_GRANT_TYPE: () => DEVICE_CODE_GRANT_TYPE,
-  DefaultKeychainRunner: () => DefaultKeychainRunner,
-  HttpError: () => HttpError,
-  KeychainService: () => KeychainService,
-  ReauthenticationRequiredError: () => ReauthenticationRequiredError,
-  TokenRefreshManager: () => TokenRefreshManager,
-  VaultLock: () => VaultLock,
-  VaultLockError: () => VaultLockError,
-  VaultLockTimeoutError: () => VaultLockTimeoutError,
-  decodeJwtPayload: () => decodeJwtPayload,
-  defaultIsProcessAlive: () => defaultIsProcessAlive,
-  executeLogin: () => executeLogin,
-  executeLogout: () => executeLogout,
-  executeStatus: () => executeStatus,
-  isCredentialExpired: () => isCredentialExpired,
-  isLocalhost: () => isLocalhost,
-  isValidStoredCredentials: () => isValidStoredCredentials,
-  normalizeProfileKey: () => normalizeProfileKey,
-  openBrowser: () => openBrowser,
-  pollDeviceToken: () => pollDeviceToken,
-  redactCredentials: () => redactCredentials,
-  requestDeviceCode: () => requestDeviceCode,
-  resolveAuthServerUrl: () => resolveAuthServerUrl,
-  resolveMcpResourceUrl: () => resolveMcpResourceUrl,
-  sanitizeSecretString: () => sanitizeSecretString,
-  sendRequest: () => sendRequest,
-  validateScopes: () => validateScopes,
-  withVaultLock: () => withVaultLock
-});
-module.exports = __toCommonJS(auth_exports);
-
-// src/auth/types.ts
-function isValidStoredCredentials(obj) {
-  if (!obj || typeof obj !== "object" || Array.isArray(obj)) {
-    return false;
-  }
-  const record = obj;
-  if (typeof record.serverUrl !== "string" || typeof record.clientId !== "string" || typeof record.accessToken !== "string" || typeof record.tokenType !== "string" || typeof record.expiresAt !== "number" || !Number.isFinite(record.expiresAt)) {
-    return false;
-  }
-  if (!("organizationId" in record) || record.organizationId !== null && typeof record.organizationId !== "string") {
-    return false;
-  }
-  if (record.refreshToken !== void 0 && typeof record.refreshToken !== "string") {
-    return false;
-  }
-  if (record.scope !== void 0 && typeof record.scope !== "string") {
-    return false;
-  }
-  if (record.resource !== void 0 && typeof record.resource !== "string") {
-    return false;
-  }
-  if (record.updatedAt !== void 0 && (typeof record.updatedAt !== "number" || !Number.isFinite(record.updatedAt))) {
-    return false;
-  }
-  return true;
-}
-function normalizeProfileKey(serverUrl, clientId) {
-  const cleanClient = (clientId || "").trim();
-  let urlToParse = (serverUrl || "").trim();
-  if (!/^https?:\/\//i.test(urlToParse)) {
-    urlToParse = `https://${urlToParse}`;
-  }
-  try {
-    const parsed = new URL(urlToParse);
-    const origin = parsed.origin.toLowerCase();
-    return `${origin}::${cleanClient}`;
-  } catch {
-    const cleanUrl = urlToParse.replace(/\/+$/, "").toLowerCase();
-    return `${cleanUrl}::${cleanClient}`;
-  }
-}
-function redactCredentials(creds) {
-  const result = { ...creds };
-  if ("accessToken" in result && typeof result.accessToken === "string") {
-    result.accessToken = "[REDACTED]";
-  }
-  if ("refreshToken" in result && typeof result.refreshToken === "string") {
-    result.refreshToken = "[REDACTED]";
-  }
-  return result;
-}
-function sanitizeSecretString(input, secrets) {
-  let sanitized = input;
-  for (const secret of secrets) {
-    if (secret && typeof secret === "string" && secret.length >= 4) {
-      sanitized = sanitized.split(secret).join("[REDACTED]");
-    }
-  }
-  return sanitized;
-}
-function isCredentialExpired(creds, skewSeconds = 60) {
-  if (!creds.expiresAt) {
-    return false;
-  }
-  const expiresAtMs = creds.expiresAt > 1e11 ? creds.expiresAt : creds.expiresAt * 1e3;
-  return Date.now() + skewSeconds * 1e3 >= expiresAtMs;
-}
-
-// src/auth/keychain.ts
-var import_node_child_process = require("child_process");
-var DefaultKeychainRunner = class {
-  defaultTimeoutMs;
-  constructor(defaultTimeoutMs = 5e3) {
-    this.defaultTimeoutMs = defaultTimeoutMs;
-  }
-  spawn(command, args, options) {
-    return new Promise((resolve) => {
-      let child;
-      try {
-        child = (0, import_node_child_process.spawn)(command, args, {
-          shell: false,
-          stdio: ["pipe", "pipe", "pipe"]
-        });
-      } catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        return resolve({ stdout: "", stderr: message, exitCode: -1 });
-      }
-      let stdout = "";
-      let stderr = "";
-      let isSettled = false;
-      const timeoutMs = options?.timeoutMs ?? this.defaultTimeoutMs;
-      const timer = setTimeout(() => {
-        if (!isSettled) {
-          isSettled = true;
-          try {
-            child.kill("SIGKILL");
-          } catch {
-          }
-          resolve({
-            stdout,
-            stderr: `Keychain operation timed out after ${timeoutMs}ms`,
-            exitCode: -1
-          });
-        }
-      }, timeoutMs);
-      child.stdout?.on("data", (chunk) => {
-        stdout += chunk.toString();
-      });
-      child.stderr?.on("data", (chunk) => {
-        stderr += chunk.toString();
-      });
-      child.on("error", (err) => {
-        stderr += err.message;
-      });
-      child.on("close", (code) => {
-        if (!isSettled) {
-          isSettled = true;
-          clearTimeout(timer);
-          resolve({
-            stdout,
-            stderr,
-            exitCode: code ?? -1
-          });
-        }
-      });
-      if (options?.input !== void 0 && child.stdin) {
-        try {
-          child.stdin.write(options.input);
-          child.stdin.end();
-        } catch {
-        }
-      }
-    });
-  }
-};
-var DEFAULT_KEYCHAIN_SERVICE = "iwas-cli";
-var KeychainService = class {
-  service;
-  runner;
-  platform;
-  constructor(options) {
-    this.service = options?.serviceName || DEFAULT_KEYCHAIN_SERVICE;
-    this.runner = options?.runner || new DefaultKeychainRunner();
-    this.platform = options?.platform || process.platform;
-  }
-  availableCache = null;
-  /**
-   * Returns the configured OS platform.
-   */
-  getPlatform() {
-    return this.platform;
-  }
-  /**
-   * Probes whether the host environment has an operable keychain utility.
-   * Results are cached when available to avoid unnecessary subprocess spawns (n7 fix).
-   */
-  async isAvailable(forceProbe = false) {
-    if (!forceProbe && this.availableCache === true) {
-      return true;
-    }
-    if (this.platform === "darwin") {
-      const res = await this.runner.spawn("/usr/bin/security", ["help"]);
-      const isAvail = res.exitCode === 0 || res.stdout.includes("security") || res.stderr.includes("security");
-      if (isAvail) {
-        this.availableCache = true;
-      }
-      return isAvail;
-    }
-    if (this.platform === "linux") {
-      const res = await this.runner.spawn("which", ["secret-tool"]);
-      const isAvail = res.exitCode === 0;
-      if (isAvail) {
-        this.availableCache = true;
-      }
-      return isAvail;
-    }
-    return false;
-  }
-  /**
-   * Clears the cached isAvailable probe result. Useful for testing and environment shifts.
-   */
-  clearAvailabilityCache() {
-    this.availableCache = null;
-  }
-  /**
-   * Retrieves a secret password string by account identifier.
-   */
-  async getSecret(account) {
-    if (this.platform === "darwin") {
-      const res = await this.runner.spawn("/usr/bin/security", [
-        "find-generic-password",
-        "-s",
-        this.service,
-        "-a",
-        account,
-        "-w"
-      ]);
-      if (res.exitCode === 0) {
-        const raw = res.stdout.trim();
-        if (raw.length > 0 && raw.length % 2 === 0 && /^[0-9a-fA-F]+$/.test(raw)) {
-          if (raw.startsWith("7b") || raw.startsWith("7B") || raw.startsWith("5b") || raw.startsWith("5B")) {
-            try {
-              const decoded = Buffer.from(raw, "hex").toString("utf8");
-              if (!decoded.includes("\uFFFD")) {
-                return decoded;
-              }
-            } catch {
-            }
-          }
-        }
-        return raw;
-      }
-      if (res.exitCode === 44 || res.stderr.includes("could not be found") || res.stderr.includes("The specified item could not be found")) {
-        return null;
-      }
-      throw new Error(`Keychain read failed: ${res.stderr.trim() || `exit code ${res.exitCode}`}`);
-    }
-    if (this.platform === "linux") {
-      const res = await this.runner.spawn("secret-tool", [
-        "lookup",
-        "service",
-        this.service,
-        "account",
-        account
-      ]);
-      if (res.exitCode === 0) {
-        return res.stdout.length > 0 ? res.stdout.trim() : null;
-      }
-      const err = res.stderr.trim();
-      if (res.exitCode === 1 && (err === "" || err.toLowerCase().includes("not found") || err.toLowerCase().includes("no such secret"))) {
-        return null;
-      }
-      throw new Error(`Secret-tool read failed: ${err || `exit code ${res.exitCode}`}`);
-    }
-    throw new Error(`OS keychain not supported on platform: ${this.platform}`);
-  }
-  /**
-   * Stores a secret password under the given account identifier.
-   */
-  async setSecret(account, secret, label) {
-    const itemLabel = label || `${this.service} (${account})`;
-    const secretsToRedact = [secret];
-    try {
-      const parsed = JSON.parse(secret);
-      if (typeof parsed === "object" && parsed !== null) {
-        for (const val of Object.values(parsed)) {
-          if (typeof val === "string" && val.length >= 4) {
-            secretsToRedact.push(val);
-          }
-        }
-      }
-    } catch {
-    }
-    if (this.platform === "darwin") {
-      const res = await this.runner.spawn("/usr/bin/security", [
-        "add-generic-password",
-        "-U",
-        "-s",
-        this.service,
-        "-a",
-        account,
-        "-l",
-        itemLabel,
-        "-w",
-        secret
-      ]);
-      if (res.exitCode !== 0) {
-        const errorMsg = sanitizeSecretString(res.stderr.trim(), secretsToRedact);
-        throw new Error(`Keychain write failed: ${errorMsg || `exit code ${res.exitCode}`}`);
-      }
-      return;
-    }
-    if (this.platform === "linux") {
-      const res = await this.runner.spawn(
-        "secret-tool",
-        ["store", `--label=${itemLabel}`, "service", this.service, "account", account],
-        { input: secret }
-      );
-      if (res.exitCode !== 0) {
-        const errorMsg = sanitizeSecretString(res.stderr.trim(), secretsToRedact);
-        throw new Error(`Secret-tool write failed: ${errorMsg || `exit code ${res.exitCode}`}`);
-      }
-      return;
-    }
-    throw new Error(`OS keychain not supported on platform: ${this.platform}`);
-  }
-  /**
-   * Deletes a secret from the keychain. Operation is strictly idempotent.
-   */
-  async deleteSecret(account) {
-    if (this.platform === "darwin") {
-      const res = await this.runner.spawn("/usr/bin/security", [
-        "delete-generic-password",
-        "-s",
-        this.service,
-        "-a",
-        account
-      ]);
-      if (res.exitCode === 0 || res.exitCode === 44 || res.stderr.includes("could not be found")) {
-        return;
-      }
-      throw new Error(`Keychain delete failed: ${res.stderr.trim() || `exit code ${res.exitCode}`}`);
-    }
-    if (this.platform === "linux") {
-      const res = await this.runner.spawn("secret-tool", [
-        "clear",
-        "service",
-        this.service,
-        "account",
-        account
-      ]);
-      if (res.exitCode === 0 || res.exitCode === 1) {
-        return;
-      }
-      throw new Error(`Secret-tool clear failed: ${res.stderr.trim() || `exit code ${res.exitCode}`}`);
-    }
-    throw new Error(`OS keychain not supported on platform: ${this.platform}`);
-  }
-};
-
-// src/auth/credentials-vault.ts
-var import_node_fs = __toESM(require("fs"));
-var import_node_path = __toESM(require("path"));
-var import_os = __toESM(require("os"));
-var KEYCHAIN_PROFILES_INDEX_ACCOUNT = "__profiles__";
-var CredentialVault = class {
-  vaultType;
-  configDir;
-  credentialsFilePath;
-  keychain;
-  constructor(options) {
-    const rawEnvVault = process.env.IWAS_MCP_VAULT;
-    if (rawEnvVault && !["auto", "keychain", "file"].includes(rawEnvVault)) {
-      throw new Error(
-        `Invalid IWAS_MCP_VAULT value: "${rawEnvVault}". Supported values are "auto", "keychain", or "file".`
-      );
-    }
-    const envVault = rawEnvVault;
-    this.vaultType = options?.vaultType || envVault || "auto";
-    const baseConfigDir = options?.configDir || process.env.XDG_CONFIG_HOME || import_node_path.default.join(import_os.default.homedir(), ".config");
-    this.configDir = options?.configDir ? options.configDir : import_node_path.default.join(baseConfigDir, "iwas");
-    this.credentialsFilePath = import_node_path.default.join(this.configDir, "credentials.json");
-    this.keychain = options?.keychainService || new KeychainService({
-      serviceName: options?.serviceName || DEFAULT_KEYCHAIN_SERVICE,
-      runner: options?.keychainRunner
-    });
-  }
-  /**
-   * Returns the configuration directory for this vault (~/.config/iwas).
-   */
-  getConfigDir() {
-    return this.configDir;
-  }
-  /**
-   * Returns the credentials file path (~/.config/iwas/credentials.json).
-   */
-  getCredentialsFilePath() {
-    return this.credentialsFilePath;
-  }
-  /**
-   * Returns the resolved vault mode: 'keychain' or 'file'.
-   * In strict 'keychain' mode, throws if OS keychain is unavailable.
-   */
-  async getEffectiveBackend() {
-    if (this.vaultType === "file") {
-      return "file";
-    }
-    const available = await this.keychain.isAvailable().catch(() => false);
-    const platform = this.keychain.getPlatform();
-    if (this.vaultType === "keychain") {
-      if (!available) {
-        throw new Error(
-          `Keychain vault requested (IWAS_MCP_VAULT="keychain") but OS keychain is unavailable on platform: ${platform}`
-        );
-      }
-      return "keychain";
-    }
-    return available ? "keychain" : "file";
-  }
-  /**
-   * Retrieves stored credentials by profile key.
-   * In auto mode, checks keychain first; falls back to file if missing or failed.
-   * Compares timestamps if both exist and migrates newer file credentials to keychain (Medium fix).
-   */
-  async load(profileKey) {
-    const backend = await this.getEffectiveBackend();
-    if (backend === "keychain") {
-      let kcCreds = null;
-      try {
-        const raw = await this.keychain.getSecret(profileKey);
-        if (raw) {
-          try {
-            const parsed = JSON.parse(raw);
-            if (isValidStoredCredentials(parsed)) {
-              kcCreds = parsed;
-            } else if (this.vaultType === "keychain") {
-              throw new Error(`Corrupt credentials stored in keychain for profile: ${profileKey}`);
-            }
-          } catch (parseErr) {
-            if (this.vaultType === "keychain") {
-              const msg = parseErr instanceof Error ? parseErr.message : String(parseErr);
-              throw new Error(`Corrupt credentials JSON in keychain for profile ${profileKey}: ${msg}`);
-            }
-          }
-        }
-      } catch (err) {
-        if (this.vaultType === "keychain") {
-          throw err;
-        }
-      }
-      if (this.vaultType === "keychain") {
-        return kcCreds;
-      }
-      const fileCreds = this.loadFromFile(profileKey);
-      if (!kcCreds) {
-        if (fileCreds) {
-          try {
-            await this.keychain.setSecret(
-              profileKey,
-              JSON.stringify(fileCreds),
-              `IWAS MCP Profile (${profileKey})`
-            );
-            await this.addProfileToKeychainIndex(profileKey);
-            this.deleteFromFile(profileKey);
-          } catch {
-          }
-        }
-        return fileCreds;
-      }
-      if (!fileCreds) {
-        return kcCreds;
-      }
-      const kcTime = kcCreds.updatedAt ?? kcCreds.expiresAt ?? 0;
-      const fileTime = fileCreds.updatedAt ?? fileCreds.expiresAt ?? 0;
-      if (fileTime > kcTime) {
-        try {
-          await this.keychain.setSecret(
-            profileKey,
-            JSON.stringify(fileCreds),
-            `IWAS MCP Profile (${profileKey})`
-          );
-          await this.addProfileToKeychainIndex(profileKey);
-          this.deleteFromFile(profileKey);
-        } catch {
-        }
-        return fileCreds;
-      } else {
-        this.deleteFromFile(profileKey);
-        return kcCreds;
-      }
-    }
-    return this.loadFromFile(profileKey);
-  }
-  /**
-   * Persists credentials for the given profile key.
-   * When saving to keychain, purges any stale copy from the file fallback (Major 1).
-   */
-  async save(profileKey, credentials) {
-    const backend = await this.getEffectiveBackend();
-    const toSave = {
-      ...credentials,
-      updatedAt: credentials.updatedAt ?? Date.now()
-    };
-    if (backend === "keychain") {
-      let secretSaved = false;
-      try {
-        const secret = JSON.stringify(toSave);
-        await this.keychain.setSecret(
-          profileKey,
-          secret,
-          `IWAS MCP Profile (${profileKey})`
-        );
-        secretSaved = true;
-        try {
-          await this.addProfileToKeychainIndex(profileKey);
-        } catch (indexErr) {
-          const message = indexErr instanceof Error ? indexErr.message : String(indexErr);
-          const sanitized = sanitizeSecretString(message, [
-            toSave.accessToken,
-            toSave.refreshToken
-          ]);
-          throw new Error(`Keychain index update failed: ${sanitized}`);
-        }
-        this.deleteFromFile(profileKey);
-        return;
-      } catch (err) {
-        if (this.vaultType === "keychain" || secretSaved) {
-          const message = err instanceof Error ? err.message : String(err);
-          const sanitized = sanitizeSecretString(message, [
-            toSave.accessToken,
-            toSave.refreshToken
-          ]);
-          throw err instanceof Error && err.message.startsWith("Keychain") ? err : new Error(`Keychain save failed: ${sanitized}`);
-        }
-      }
-    }
-    this.saveToFile(profileKey, toSave);
-  }
-  /**
-   * Removes credentials for the given profile key.
-   * Cleanses BOTH Keychain and File fallback to prevent plaintext leakage (Major 1).
-   * In auto mode, throws if keychain is available but secret deletion fails (Major fix).
-   */
-  async delete(profileKey) {
-    let keychainError = null;
-    let isAvailable = false;
-    if (this.vaultType === "file") {
-      this.deleteFromFile(profileKey);
-      return;
-    }
-    try {
-      isAvailable = await this.keychain.isAvailable().catch(() => false);
-      if (this.vaultType === "keychain" && !isAvailable) {
-        throw new Error(
-          `Keychain vault requested (IWAS_MCP_VAULT="keychain") but OS keychain is unavailable on platform: ${this.keychain.getPlatform()}`
-        );
-      }
-      if (isAvailable) {
-        await this.keychain.deleteSecret(profileKey);
-        await this.removeProfileFromKeychainIndex(profileKey);
-      }
-    } catch (err) {
-      keychainError = err;
-    }
-    this.deleteFromFile(profileKey);
-    if (keychainError) {
-      if (this.vaultType === "keychain" || this.vaultType === "auto" && isAvailable) {
-        throw keychainError;
-      }
-    }
-  }
-  /**
-   * Lists all stored profile keys.
-   * In auto mode, merges profiles from both Keychain and File.
-   */
-  async listProfiles() {
-    if (this.vaultType === "file") {
-      return this.listProfilesFromFile();
-    }
-    if (this.vaultType === "keychain") {
-      return this.readKeychainIndex();
-    }
-    const profiles = /* @__PURE__ */ new Set();
-    try {
-      const isAvailable = await this.keychain.isAvailable();
-      if (isAvailable) {
-        const kcProfiles = await this.readKeychainIndex();
-        for (const p of kcProfiles) {
-          profiles.add(p);
-        }
-      }
-    } catch {
-    }
-    for (const p of this.listProfilesFromFile()) {
-      profiles.add(p);
-    }
-    return Array.from(profiles);
-  }
-  // --- Internal Keychain Index (Major 2: Safe read & abort on error) ---
-  async readKeychainIndex() {
-    const rawIndex = await this.keychain.getSecret(KEYCHAIN_PROFILES_INDEX_ACCOUNT);
-    if (!rawIndex) {
-      return [];
-    }
-    try {
-      const parsed = JSON.parse(rawIndex);
-      return Array.isArray(parsed) ? parsed.filter((item) => typeof item === "string") : [];
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      throw new Error(`Corrupt keychain profile index at ${KEYCHAIN_PROFILES_INDEX_ACCOUNT}: ${message}`);
-    }
-  }
-  async addProfileToKeychainIndex(profileKey) {
-    const current = await this.readKeychainIndex();
-    if (!current.includes(profileKey)) {
-      current.push(profileKey);
-      await this.keychain.setSecret(
-        KEYCHAIN_PROFILES_INDEX_ACCOUNT,
-        JSON.stringify(current),
-        "IWAS MCP Profiles Index"
-      );
-    }
-  }
-  async removeProfileFromKeychainIndex(profileKey) {
-    const current = await this.readKeychainIndex();
-    if (current.includes(profileKey)) {
-      const updated = current.filter((k) => k !== profileKey);
-      await this.keychain.setSecret(
-        KEYCHAIN_PROFILES_INDEX_ACCOUNT,
-        JSON.stringify(updated),
-        "IWAS MCP Profiles Index"
-      );
-    }
-  }
-  // --- Internal File Storage Backend (dir 0700, file 0600, atomic replace) ---
-  ensureConfigDirectory() {
-    if (!import_node_fs.default.existsSync(this.configDir)) {
-      import_node_fs.default.mkdirSync(this.configDir, { recursive: true, mode: 448 });
-    }
-    try {
-      import_node_fs.default.chmodSync(this.configDir, 448);
-    } catch {
-    }
-  }
-  readAllFromFile() {
-    if (!import_node_fs.default.existsSync(this.credentialsFilePath)) {
-      return {};
-    }
-    if (process.platform !== "win32") {
-      try {
-        import_node_fs.default.chmodSync(this.credentialsFilePath, 384);
-      } catch {
-      }
-    }
-    const content = import_node_fs.default.readFileSync(this.credentialsFilePath, "utf8").trim();
-    if (!content) {
-      return {};
-    }
-    try {
-      const parsed = JSON.parse(content);
-      if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-        throw new Error("Root credentials object must be a JSON record");
-      }
-      for (const [key, item] of Object.entries(parsed)) {
-        if (!isValidStoredCredentials(item)) {
-          throw new Error(`Profile "${key}" contains invalid or missing credential fields`);
-        }
-      }
-      return parsed;
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      throw new Error(
-        `Corrupt credentials file at ${this.credentialsFilePath}: ${message}. Will not overwrite.`
-      );
-    }
-  }
-  writeAllToFile(data) {
-    this.ensureConfigDirectory();
-    const content = JSON.stringify(data, null, 2) + "\n";
-    const tmpFilePath = import_node_path.default.join(
-      this.configDir,
-      `.credentials.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`
-    );
-    let fd = null;
-    try {
-      fd = import_node_fs.default.openSync(tmpFilePath, "w", 384);
-      import_node_fs.default.writeSync(fd, content, void 0, "utf8");
-      import_node_fs.default.fsyncSync(fd);
-      import_node_fs.default.closeSync(fd);
-      fd = null;
-      try {
-        import_node_fs.default.chmodSync(tmpFilePath, 384);
-      } catch {
-      }
-      import_node_fs.default.renameSync(tmpFilePath, this.credentialsFilePath);
-      try {
-        import_node_fs.default.chmodSync(this.credentialsFilePath, 384);
-      } catch {
-      }
-      if (process.platform !== "win32") {
-        try {
-          const dirFd = import_node_fs.default.openSync(this.configDir, "r");
-          import_node_fs.default.fsyncSync(dirFd);
-          import_node_fs.default.closeSync(dirFd);
-        } catch {
-        }
-      }
-    } catch (err) {
-      if (fd !== null) {
-        try {
-          import_node_fs.default.closeSync(fd);
-        } catch {
-        }
-      }
-      if (import_node_fs.default.existsSync(tmpFilePath)) {
-        try {
-          import_node_fs.default.unlinkSync(tmpFilePath);
-        } catch {
-        }
-      }
-      throw err;
-    }
-  }
-  loadFromFile(profileKey) {
-    const all = this.readAllFromFile();
-    return all[profileKey] ?? null;
-  }
-  saveToFile(profileKey, credentials) {
-    const all = this.readAllFromFile();
-    all[profileKey] = credentials;
-    this.writeAllToFile(all);
-  }
-  deleteFromFile(profileKey) {
-    if (!import_node_fs.default.existsSync(this.credentialsFilePath)) {
-      return;
-    }
-    const all = this.readAllFromFile();
-    if (profileKey in all) {
-      delete all[profileKey];
-      this.writeAllToFile(all);
-    }
-  }
-  listProfilesFromFile() {
-    if (!import_node_fs.default.existsSync(this.credentialsFilePath)) {
-      return [];
-    }
-    const all = this.readAllFromFile();
-    return Object.keys(all);
-  }
-};
-
-// src/auth/http.ts
-var HttpError = class extends Error {
-  status;
-  data;
-  constructor(message, status, data) {
-    super(message);
-    this.name = "HttpError";
-    this.status = status;
-    this.data = data;
-  }
-};
-var DEFAULT_TIMEOUT_MS = 15e3;
-var DEFAULT_RETRIES = 2;
-async function sendRequest(url, options) {
-  const method = options?.method || "GET";
-  const timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  const maxRetries = options?.retries ?? DEFAULT_RETRIES;
-  const headers = {
-    Accept: "application/json",
-    ...options?.headers || {}
-  };
-  let serializedBody;
-  if (options?.body) {
-    if (typeof options.body === "string") {
-      serializedBody = options.body;
-    } else if (options.body instanceof URLSearchParams) {
-      serializedBody = options.body.toString();
-      if (!headers["Content-Type"]) {
-        headers["Content-Type"] = "application/x-www-form-urlencoded";
-      }
-    } else {
-      serializedBody = JSON.stringify(options.body);
-      if (!headers["Content-Type"]) {
-        headers["Content-Type"] = "application/json";
-      }
-    }
-  }
-  let attempt = 0;
-  let lastError = null;
-  while (attempt <= maxRetries) {
-    attempt++;
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), timeoutMs);
-    try {
-      const fetchImpl = options?.fetchFn || fetch;
-      const res = await fetchImpl(url, {
-        method,
-        headers,
-        body: serializedBody,
-        signal: controller.signal
-      });
-      clearTimeout(timer);
-      const contentType = res.headers.get("content-type") || "";
-      let parsedData;
-      if (contentType.includes("application/json")) {
-        try {
-          parsedData = await res.json();
-        } catch {
-          parsedData = null;
-        }
-      } else {
-        parsedData = await res.text();
-      }
-      if (res.status >= 500 && res.status <= 504 && attempt <= maxRetries) {
-        const backoffMs = Math.min(1e3 * Math.pow(2, attempt - 1) + Math.random() * 200, 5e3);
-        await new Promise((resolve) => setTimeout(resolve, backoffMs));
-        continue;
-      }
-      return {
-        status: res.status,
-        ok: res.ok,
-        headers: res.headers,
-        data: parsedData
-      };
-    } catch (err) {
-      clearTimeout(timer);
-      const isAbort = err instanceof Error && err.name === "AbortError";
-      const errMsg = isAbort ? `Request timed out after ${timeoutMs}ms` : err instanceof Error ? err.message : String(err);
-      lastError = new Error(`Network request failed for ${method} ${url}: ${errMsg}`);
-      if (attempt <= maxRetries) {
-        const backoffMs = Math.min(500 * Math.pow(2, attempt - 1) + Math.random() * 200, 3e3);
-        await new Promise((resolve) => setTimeout(resolve, backoffMs));
-        continue;
-      }
-    }
-  }
-  throw lastError || new Error(`Network request failed after ${attempt} attempts`);
-}
-
-// src/auth/device-flow.ts
-var import_node_child_process2 = require("child_process");
-var import_permissions = __toESM(require_permissions());
-
-// src/auth/logout.ts
-async function executeLogout(options) {
-  const log = options?.logger || ((msg) => process.stdout.write(`${msg}
-`));
-  const errLog = options?.errorLogger || ((msg) => process.stderr.write(`${msg}
-`));
-  const serverUrl = resolveAuthServerUrl(options?.server);
-  const clientId = (options?.clientId || DEFAULT_CLI_CLIENT_ID).trim();
-  const profileKey = normalizeProfileKey(serverUrl, clientId);
-  const vault = options?.vault || new CredentialVault();
-  const force = options?.force === true;
-  const credentials = await vault.load(profileKey);
-  if (!credentials) {
-    const result2 = {
-      success: true,
-      profileKey,
-      serverRevoked: false,
-      refreshTokenRevoked: false,
-      localCleared: false,
-      message: `No stored credentials found for profile: ${profileKey}`
-    };
-    if (options?.json) {
-      log(
-        JSON.stringify({
-          event: "logout",
-          success: true,
-          loggedOut: true,
-          profileKey,
-          serverRevoked: false,
-          refreshTokenRevoked: false,
-          localCleared: false,
-          message: result2.message
-        })
-      );
-    } else {
-      log(`\u2139\uFE0F  No stored credentials found for profile: ${profileKey}`);
-    }
-    return result2;
-  }
-  let serverRevoked = false;
-  let serverError = null;
-  const sessionLogoutUrl = `${serverUrl.replace(/\/+$/, "")}/api/v1/mcp-session/logout`;
-  try {
-    const authScheme = credentials.tokenType || "Bearer";
-    const res = await sendRequest(sessionLogoutUrl, {
-      method: "POST",
-      headers: {
-        Authorization: `${authScheme} ${credentials.accessToken}`
-      },
-      fetchFn: options?.fetchFn
-    });
-    if (res.status === 204 || res.status === 200) {
-      serverRevoked = true;
-    } else if (res.status === 401 || res.status === 403) {
-      serverRevoked = true;
-    } else if (res.status === 400) {
-      const data = res.data;
-      throw new Error(data?.message || "Server rejected logout request (HTTP 400).");
-    } else {
-      throw new HttpError(
-        `Server returned status ${res.status} during logout`,
-        res.status,
-        res.data
-      );
-    }
-  } catch (err) {
-    serverError = err instanceof Error ? err : new Error(String(err));
-  }
-  if (serverError && !force) {
-    const errorMsg = `Server revocation failed: ${serverError.message}. Local credentials preserved. Use --force to clear local credentials anyway if the server is permanently offline.`;
-    throw new Error(errorMsg);
-  }
-  let refreshTokenRevoked = false;
-  if (credentials.refreshToken) {
-    try {
-      const revokeUrl = `${serverUrl.replace(/\/+$/, "")}/api/auth/oauth2/revoke`;
-      const body = new URLSearchParams({
-        token: credentials.refreshToken,
-        token_type_hint: "refresh_token",
-        client_id: clientId
-      });
-      const res = await sendRequest(revokeUrl, {
-        method: "POST",
-        body,
-        fetchFn: options?.fetchFn
-      });
-      if (res.ok || res.status === 200 || res.status === 204 || res.status === 401 || res.status === 400) {
-        refreshTokenRevoked = true;
-      }
-    } catch {
-    }
-  }
-  await vault.delete(profileKey);
-  const result = {
-    success: true,
-    profileKey,
-    serverRevoked,
-    refreshTokenRevoked,
-    localCleared: true,
-    message: serverError ? `Local credentials cleared with --force (server unreachable: ${serverError.message})` : "Successfully logged out and revoked all grants server-side"
-  };
-  if (options?.json) {
-    log(
-      JSON.stringify({
-        event: "logout",
-        success: true,
-        loggedOut: true,
-        profileKey,
-        serverRevoked,
-        refreshTokenRevoked,
-        localCleared: true,
-        forced: force && !!serverError
-      })
-    );
-  } else {
-    if (serverError) {
-      errLog(`\u26A0\uFE0F  Warning: Server revocation failed (${serverError.message})`);
-      log(`\u2705 Local credentials cleared for profile: ${profileKey} (--force)
-`);
-    } else {
-      log(`
-\u2705 Successfully logged out from profile: ${profileKey}`);
-      log("   \u2022 Server session & OAuth grants: Revoked");
-      log("   \u2022 Local credentials: Removed\n");
-    }
-  }
-  return result;
-}
-
-// src/auth/device-flow.ts
-var DEFAULT_CLI_CLIENT_ID = "iwas-cli";
-var DEFAULT_SERVER_URL = "https://getiwas.com";
-var DEFAULT_READ_ONLY_SCOPES = import_permissions.MCP_ELIGIBLE_PERMISSIONS.filter(
-  (perm) => perm.endsWith(":read")
-);
-var DEFAULT_SCOPES = [
-  ...DEFAULT_READ_ONLY_SCOPES,
-  import_permissions.OFFLINE_ACCESS_SCOPE
-].join(" ");
-var DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
-function validateScopes(scopesString) {
-  const requested = scopesString.split(/\s+/).filter(Boolean);
-  if (requested.length === 0) {
-    return {
-      valid: false,
-      invalidScopes: [],
-      error: "At least one OAuth scope must be requested."
-    };
-  }
-  const allowedSet = new Set(import_permissions.MCP_OAUTH_SCOPES);
-  const invalidScopes = requested.filter((s) => !allowedSet.has(s));
-  if (invalidScopes.length > 0) {
-    return {
-      valid: false,
-      invalidScopes,
-      error: `Invalid OAuth scope(s) requested: [${invalidScopes.join(", ")}]. Supported scopes are: [${import_permissions.MCP_OAUTH_SCOPES.join(", ")}]`
-    };
-  }
-  const capabilityScopes = requested.filter((s) => s !== import_permissions.OFFLINE_ACCESS_SCOPE);
-  if (capabilityScopes.length === 0) {
-    return {
-      valid: false,
-      invalidScopes: [],
-      error: "At least one MCP capability scope besides offline_access must be requested."
-    };
-  }
-  return { valid: true, invalidScopes: [] };
-}
-function isLocalhost(hostname) {
-  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
-}
-function resolveAuthServerUrl(input) {
-  let urlStr = (input || process.env.IWAS_SERVER_URL || DEFAULT_SERVER_URL).trim();
-  urlStr = urlStr.replace(/\/+$/, "");
-  if (urlStr.toLowerCase().endsWith("/mcp")) {
-    throw new Error(
-      `Invalid --server value: "${urlStr}". The server argument must be the auth/web origin (e.g. "https://getiwas.com"), not the MCP resource endpoint. Use --resource for "${urlStr}".`
-    );
-  }
-  if (!/^https?:\/\//i.test(urlStr)) {
-    urlStr = `https://${urlStr}`;
-  }
-  let parsed;
-  try {
-    parsed = new URL(urlStr);
-  } catch {
-    throw new Error(`Invalid server URL: "${urlStr}"`);
-  }
-  if (parsed.pathname && parsed.pathname !== "/") {
-    const originStr = parsed.origin;
-    const label = input ? `--server value: "${input}"` : `IWAS_SERVER_URL: "${urlStr}"`;
-    throw new Error(
-      `Invalid ${label}. The server argument must be an origin without a path component (e.g. "${originStr}").`
-    );
-  }
-  if (!isLocalhost(parsed.hostname) && parsed.protocol !== "https:") {
-    throw new Error(
-      `Insecure server protocol: "${urlStr}". Non-localhost servers require HTTPS per OAuth 2.1 specifications.`
-    );
-  }
-  return parsed.origin.toLowerCase();
-}
-function resolveMcpResourceUrl(serverUrl, input) {
-  if (input && input.trim()) {
-    let clean = input.trim();
-    if (!/^https?:\/\//i.test(clean)) {
-      const isLoopbackCandidate = clean.startsWith("localhost") || clean.startsWith("127.0.0.1") || clean.startsWith("[::1]") || clean.startsWith("::1");
-      clean = isLoopbackCandidate ? `http://${clean}` : `https://${clean}`;
-    }
-    let parsed;
-    try {
-      parsed = new URL(clean);
-    } catch {
-      throw new Error(`Invalid resource URL: "${clean}"`);
-    }
-    if (!isLocalhost(parsed.hostname) && parsed.protocol !== "https:") {
-      throw new Error(
-        `Insecure resource protocol: "${clean}". Non-localhost resource endpoints require HTTPS.`
-      );
-    }
-    return parsed.href.replace(/\/+$/, "");
-  }
-  return `${serverUrl}/mcp`;
-}
-function decodeJwtPayload(token) {
-  const parts = token.split(".");
-  if (parts.length !== 3) {
-    return {};
-  }
-  try {
-    const jsonStr = Buffer.from(parts[1], "base64url").toString("utf8");
-    const parsed = JSON.parse(jsonStr);
-    return typeof parsed === "object" && parsed !== null ? parsed : {};
-  } catch {
-    return {};
-  }
-}
-function openBrowser(url, spawnFn = import_node_child_process2.spawn, onWarning) {
-  try {
-    let parsed;
-    try {
-      parsed = new URL(url);
-    } catch {
-      onWarning?.(`Invalid verification URL: "${url}". Please open manually.`);
-      return false;
-    }
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-      onWarning?.(`Insecure verification URL protocol: "${parsed.protocol}". Expected http: or https:.`);
-      return false;
-    }
-    const platform = process.platform;
-    let child;
-    if (platform === "darwin") {
-      child = spawnFn("open", [parsed.href], { detached: true, stdio: "ignore" });
-    } else if (platform === "win32") {
-      child = spawnFn("explorer.exe", [parsed.href], { detached: true, stdio: "ignore" });
-    } else {
-      child = spawnFn("xdg-open", [parsed.href], { detached: true, stdio: "ignore" });
-    }
-    child.on("error", (err) => {
-      const msg = err instanceof Error ? err.message : String(err);
-      onWarning?.(`Could not launch browser automatically (${msg}). Please open the verification URL manually.`);
-    });
-    child.unref();
-    return true;
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    onWarning?.(`Could not launch browser (${msg}). Please open the verification URL manually.`);
-    return false;
-  }
-}
-async function requestDeviceCode(serverUrl, params) {
-  const endpoint = `${serverUrl}/api/auth/device/code`;
-  const res = await sendRequest(endpoint, {
-    method: "POST",
-    body: {
-      client_id: params.clientId,
-      scope: params.scope,
-      resource: params.resource
-    },
-    retries: 0
-    // Zero retries to guarantee single-use device_code creation
-  });
-  if (!res.ok || !res.data || typeof res.data !== "object") {
-    throw new HttpError(
-      `Failed to initiate device authorization with ${endpoint}: HTTP ${res.status}`,
-      res.status,
-      res.data
-    );
-  }
-  const data = res.data;
-  if (!data.device_code || !data.user_code || !data.verification_uri) {
-    throw new Error(
-      `Malformed device code response from ${endpoint}: missing required RFC 8628 fields`
-    );
-  }
-  return {
-    device_code: data.device_code,
-    user_code: data.user_code,
-    verification_uri: data.verification_uri,
-    verification_uri_complete: data.verification_uri_complete || `${data.verification_uri}?user_code=${encodeURIComponent(data.user_code)}`,
-    expires_in: data.expires_in || 600,
-    interval: data.interval || 5
-  };
-}
-async function pollDeviceToken(serverUrl, params, onPollTick) {
-  const tokenEndpoint = `${serverUrl}/api/auth/oauth2/token`;
-  let intervalSec = Math.max(params.initialInterval || 5, 1);
-  const timeoutMs = params.timeoutMs || 3e5;
-  const startTime = Date.now();
-  while (Date.now() - startTime < timeoutMs) {
-    await new Promise((resolve) => setTimeout(resolve, intervalSec * 1e3));
-    if (Date.now() - startTime >= timeoutMs) {
-      break;
-    }
-    onPollTick?.("polling");
-    const formBody = new URLSearchParams({
-      grant_type: DEVICE_CODE_GRANT_TYPE,
-      client_id: params.clientId,
-      device_code: params.deviceCode,
-      resource: params.resource
-    });
-    const res = await sendRequest(
-      tokenEndpoint,
-      {
-        method: "POST",
-        body: formBody,
-        retries: 0
-        // Zero retries to guarantee single-use device_code is never double-consumed
-      }
-    );
-    if (res.status === 200) {
-      const tokenData = res.data;
-      if (!tokenData.access_token) {
-        throw new Error("Token endpoint returned HTTP 200 without access_token");
-      }
-      return tokenData;
-    }
-    if (res.status === 429) {
-      const retryAfterHeader = res.headers?.get?.("retry-after");
-      let retrySeconds = intervalSec + 5;
-      if (retryAfterHeader) {
-        const parsedSec = parseInt(retryAfterHeader, 10);
-        if (!isNaN(parsedSec) && parsedSec > 0) {
-          retrySeconds = parsedSec;
-        } else {
-          const parsedDate = Date.parse(retryAfterHeader);
-          if (!isNaN(parsedDate)) {
-            const diffSec = Math.ceil((parsedDate - Date.now()) / 1e3);
-            if (diffSec > 0) {
-              retrySeconds = diffSec;
-            }
-          }
-        }
-      }
-      const remainingMs = Math.max(0, timeoutMs - (Date.now() - startTime));
-      const remainingSec = Math.ceil(remainingMs / 1e3);
-      intervalSec = remainingSec > 0 ? Math.min(retrySeconds, 60, remainingSec) : 0;
-      onPollTick?.(`slow_down (rate_limited, retry-after: ${intervalSec}s)`);
-      continue;
-    }
-    const errorData = res.data || {};
-    const errorCode = errorData.error || "unknown_error";
-    const errorDesc = errorData.error_description || errorCode;
-    switch (errorCode) {
-      case "authorization_pending":
-        continue;
-      case "slow_down":
-        intervalSec += 5;
-        onPollTick?.(`slow_down (interval: ${intervalSec}s)`);
-        continue;
-      case "expired_token":
-        throw new Error(
-          "Device code has expired. Please run `iwas login` again to obtain a new code."
-        );
-      case "access_denied":
-        throw new Error("Authorization was denied by the user.");
-      case "invalid_grant":
-        throw new Error(
-          `Invalid grant: ${errorDesc}. The device code may have already been used or revoked.`
-        );
-      case "invalid_client":
-        throw new Error(`Invalid OAuth client: ${errorDesc}. Check your --client-id.`);
-      default:
-        if (res.status >= 500) {
-          intervalSec = Math.min(intervalSec + 2, 30);
-          continue;
-        }
-        throw new Error(`Device authorization failed: ${errorDesc} (HTTP ${res.status})`);
-    }
-  }
-  throw new Error("Device login timed out waiting for user authorization.");
-}
-async function executeLogin(options) {
-  const log = options?.logger || ((msg) => process.stdout.write(`${msg}
-`));
-  const errLog = options?.errorLogger || ((msg) => process.stderr.write(`${msg}
-`));
-  const serverUrl = resolveAuthServerUrl(options?.server);
-  const resourceUrl = resolveMcpResourceUrl(serverUrl, options?.resource);
-  const clientId = (options?.clientId || DEFAULT_CLI_CLIENT_ID).trim();
-  const scopes = (options?.scopes || DEFAULT_SCOPES).trim();
-  const vault = options?.vault || new CredentialVault();
-  const scopeValidation = validateScopes(scopes);
-  if (!scopeValidation.valid) {
-    throw new Error(scopeValidation.error || "Invalid OAuth scopes requested.");
-  }
-  const authResponse = await requestDeviceCode(serverUrl, {
-    clientId,
-    scope: scopes,
-    resource: resourceUrl
-  });
-  if (options?.json) {
-    const initEvent = {
-      event: "device_authorization",
-      user_code: authResponse.user_code,
-      verification_uri: authResponse.verification_uri,
-      verification_uri_complete: authResponse.verification_uri_complete,
-      expires_in: authResponse.expires_in,
-      interval: authResponse.interval
-    };
-    log(JSON.stringify(initEvent));
-    errLog(`
-\u{1F449} USER CODE: ${authResponse.user_code}`);
-    errLog(`\u{1F517} To verify, open: ${authResponse.verification_uri_complete}
-`);
-  } else {
-    log("\n============================================================");
-    log("               IWAS MCP Device Authorization                ");
-    log("============================================================\n");
-    log(`First, enter this code on the verification page:`);
-    log(`
-    \u{1F449}  USER CODE:  \x1B[1m\x1B[32m${authResponse.user_code}\x1B[0m
-`);
-    log(`To verify, open:`);
-    log(`    \u{1F517}  ${authResponse.verification_uri_complete}
-`);
-    log("Waiting for approval in browser...");
-  }
-  const spawnFn = options?.spawnFn || import_node_child_process2.spawn;
-  const opener = options?.browserOpener || ((url) => openBrowser(url, spawnFn, (warning) => {
-    if (!options?.json) {
-      log(`\u26A0\uFE0F  ${warning}`);
-    } else {
-      errLog(`\u26A0\uFE0F  ${warning}`);
-    }
-  }));
-  if (!options?.noBrowser) {
-    opener(authResponse.verification_uri_complete);
-  }
-  const pollTimeoutMs = options?.pollTimeoutMs ?? authResponse.expires_in * 1e3;
-  const tokenResponse = await pollDeviceToken(
-    serverUrl,
-    {
-      clientId,
-      deviceCode: authResponse.device_code,
-      resource: resourceUrl,
-      initialInterval: authResponse.interval,
-      timeoutMs: pollTimeoutMs
-    },
-    (status) => {
-      if (!options?.json && status.startsWith("slow_down")) {
-        log(`Rate limit reached: slowing poll interval.`);
-      }
-    }
-  );
-  const payload = decodeJwtPayload(tokenResponse.access_token);
-  if (!payload || Object.keys(payload).length === 0) {
-    throw new Error(
-      "Server returned an opaque or non-JWT access token. Expected a JWT access token targeted for MCP resource."
-    );
-  }
-  const tokenAud = Array.isArray(payload.aud) ? payload.aud : typeof payload.aud === "string" ? [payload.aud] : [];
-  const normalizedResourceUrl = resourceUrl.replace(/\/+$/, "").toLowerCase();
-  const hasResourceAud = tokenAud.some((aud) => {
-    try {
-      return new URL(String(aud)).href.replace(/\/+$/, "").toLowerCase() === normalizedResourceUrl;
-    } catch {
-      return String(aud).toLowerCase() === normalizedResourceUrl;
-    }
-  });
-  if (!hasResourceAud) {
-    throw new Error(
-      `Access token audience [${tokenAud.join(", ")}] does not match MCP resource URL "${resourceUrl}".`
-    );
-  }
-  const grantedScopesStr = typeof tokenResponse.scope === "string" && tokenResponse.scope || typeof payload.scope === "string" && payload.scope || "";
-  const grantedList = grantedScopesStr.split(/\s+/).filter(Boolean);
-  const requestedList = scopes.split(/\s+/).filter(Boolean);
-  const matchedScopes = requestedList.filter((s) => grantedList.includes(s));
-  const matchedCapabilities = matchedScopes.filter((s) => s !== import_permissions.OFFLINE_ACCESS_SCOPE);
-  if (matchedCapabilities.length === 0) {
-    throw new Error(
-      `Access token lacks granted capability scopes (requested: [${requestedList.join(", ")}], granted: [${grantedList.join(", ")}]). At least one permission scope besides offline_access must be granted.`
-    );
-  }
-  const organizationId = typeof payload.organizationId === "string" ? payload.organizationId : null;
-  const expiresAtMs = tokenResponse.expires_in ? Date.now() + tokenResponse.expires_in * 1e3 : typeof payload.exp === "number" ? payload.exp * 1e3 : Date.now() + 36e5;
-  const credentials = {
-    serverUrl,
-    clientId,
-    accessToken: tokenResponse.access_token,
-    refreshToken: tokenResponse.refresh_token,
-    tokenType: tokenResponse.token_type || "Bearer",
-    scope: tokenResponse.scope || scopes,
-    resource: resourceUrl,
-    organizationId,
-    expiresAt: expiresAtMs,
-    updatedAt: Date.now()
-  };
-  const profileKey = normalizeProfileKey(serverUrl, clientId);
-  await vault.save(profileKey, credentials);
-  const result = {
-    profileKey,
-    serverUrl,
-    clientId,
-    organizationId,
-    scope: credentials.scope,
-    resource: credentials.resource,
-    expiresAt: expiresAtMs
-  };
-  if (options?.json) {
-    const successEvent = {
-      event: "login_success",
-      success: true,
-      ...result
-    };
-    log(JSON.stringify(successEvent));
-  } else {
-    log("\n\u2705 Login successful!");
-    log(`- Profile:       ${profileKey}`);
-    log(`- Server:        ${serverUrl}`);
-    log(`- Client ID:     ${clientId}`);
-    log(`- Organization:  ${organizationId || "(none / platform scope)"}`);
-    log(`- Scopes:        ${credentials.scope || "none"}`);
-    log(`- Resource:      ${resourceUrl}`);
-    log(`- Expires:       ${new Date(expiresAtMs).toISOString()}
-`);
-  }
-  return result;
-}
-async function executeStatus(options) {
-  const log = options?.logger || ((msg) => process.stdout.write(`${msg}
-`));
-  const serverUrl = resolveAuthServerUrl(options?.server);
-  const clientId = (options?.clientId || DEFAULT_CLI_CLIENT_ID).trim();
-  const profileKey = normalizeProfileKey(serverUrl, clientId);
-  const vault = options?.vault || new CredentialVault();
-  const creds = await vault.load(profileKey);
-  if (!creds) {
-    if (options?.json) {
-      log(JSON.stringify({ authenticated: false, profileKey, serverUrl, clientId }));
-    } else {
-      log(`No active session found for profile: ${profileKey}`);
-      log(`Run \`iwas login --server ${serverUrl}\` to authenticate.
-`);
-    }
-    return;
-  }
-  const isExpired = isCredentialExpired(creds, 60);
-  const statusData = {
-    authenticated: !isExpired,
-    expired: isExpired,
-    profileKey,
-    serverUrl: creds.serverUrl,
-    clientId: creds.clientId,
-    organizationId: creds.organizationId,
-    scope: creds.scope,
-    resource: creds.resource,
-    expiresAt: new Date(creds.expiresAt).toISOString(),
-    expiresInSeconds: Math.max(0, Math.round((creds.expiresAt - Date.now()) / 1e3))
-  };
-  if (options?.json) {
-    log(JSON.stringify(statusData));
-  } else {
-    log("\n============================================================");
-    log("                   IWAS MCP Auth Status                     ");
-    log("============================================================\n");
-    log(`- Profile:       ${profileKey}`);
-    log(`- Server:        ${creds.serverUrl}`);
-    log(`- Client ID:     ${creds.clientId}`);
-    log(`- Status:        ${isExpired ? "\u{1F534} Expired" : "\u{1F7E2} Active"}`);
-    log(`- Organization:  ${creds.organizationId || "(none / platform scope)"}`);
-    log(`- Scopes:        ${creds.scope || "none"}`);
-    if (creds.resource) {
-      log(`- Resource:      ${creds.resource}`);
-    }
-    log(`- Expires:       ${statusData.expiresAt} (${statusData.expiresInSeconds}s remaining)
-`);
-  }
-}
-
-// src/auth/vault-lock.ts
-var import_node_fs2 = __toESM(require("fs"));
-var import_node_path2 = __toESM(require("path"));
-var import_node_os = __toESM(require("os"));
-var import_node_crypto = require("crypto");
-var VaultLockError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "VaultLockError";
-  }
-};
-var VaultLockTimeoutError = class extends VaultLockError {
-  lockPath;
-  timeoutMs;
-  constructor(lockPath, timeoutMs) {
-    super(`Timed out waiting to acquire credentials lock at "${lockPath}" after ${timeoutMs}ms.`);
-    this.name = "VaultLockTimeoutError";
-    this.lockPath = lockPath;
-    this.timeoutMs = timeoutMs;
-  }
-};
-var DEFAULT_TIMEOUT_MS2 = 6e4;
-var DEFAULT_STALE_TIMEOUT_MS = 6e4;
-var DEFAULT_RETRY_INTERVAL_MS = 50;
-function defaultIsProcessAlive(pid) {
-  if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0) {
-    return false;
-  }
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (err) {
-    const code = err?.code;
-    if (code === "ESRCH") {
-      return false;
-    }
-    if (code === "EPERM") {
-      return true;
-    }
-    return false;
-  }
-}
-var VaultLock = class {
-  lockPath;
-  isCustomLockPath;
-  timeoutMs;
-  staleTimeoutMs;
-  corruptLockGraceMs;
-  retryIntervalMs;
-  isProcessAlive;
-  currentLockId = null;
-  currentLockIno;
-  constructor(options) {
-    if (options?.lockPath) {
-      this.lockPath = options.lockPath;
-      this.isCustomLockPath = true;
-    } else {
-      const baseConfigDir = options?.configDir || process.env.XDG_CONFIG_HOME || import_node_path2.default.join(import_node_os.default.homedir(), ".config");
-      const dir = options?.configDir ? options.configDir : import_node_path2.default.join(baseConfigDir, "iwas");
-      this.lockPath = import_node_path2.default.join(dir, "credentials.lock");
-      this.isCustomLockPath = Boolean(options?.configDir);
-    }
-    this.timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
-    this.staleTimeoutMs = options?.staleTimeoutMs ?? DEFAULT_STALE_TIMEOUT_MS;
-    this.corruptLockGraceMs = options?.corruptLockGraceMs ?? Math.min(this.staleTimeoutMs, 1e4);
-    this.retryIntervalMs = options?.retryIntervalMs ?? DEFAULT_RETRY_INTERVAL_MS;
-    this.isProcessAlive = options?.isProcessAliveFn ?? defaultIsProcessAlive;
-  }
-  /**
-   * Returns whether this instance currently holds the active lock.
-   */
-  isHeld() {
-    return this.currentLockId !== null;
-  }
-  /**
-   * Returns the current lock ID if held.
-   */
-  getCurrentLockId() {
-    return this.currentLockId;
-  }
-  /**
-   * Acquires the lock exclusively.
-   * Retries with bounded exponential backoff and jitter if held by another process.
-   * Recovers automatically if the lock is determined to be stale.
-   */
-  async acquire() {
-    if (this.currentLockId) {
-      return;
-    }
-    const parentDir = import_node_path2.default.dirname(this.lockPath);
-    let createdParent = false;
-    if (!import_node_fs2.default.existsSync(parentDir)) {
-      try {
-        import_node_fs2.default.mkdirSync(parentDir, { recursive: true, mode: 448 });
-        createdParent = true;
-      } catch {
-      }
-    }
-    if (!this.isCustomLockPath || createdParent) {
-      try {
-        import_node_fs2.default.chmodSync(parentDir, 448);
-      } catch {
-      }
-    }
-    const startTime = Date.now();
-    const lockId = (0, import_node_crypto.randomUUID)();
-    let currentDelay = this.retryIntervalMs;
-    while (true) {
-      let fd = null;
-      let acquiredIno;
-      try {
-        fd = import_node_fs2.default.openSync(this.lockPath, "wx", 384);
-        const stat = import_node_fs2.default.fstatSync(fd);
-        acquiredIno = stat.ino;
-        const lockData = {
-          pid: process.pid,
-          createdAt: Date.now(),
-          lockId,
-          hostname: import_node_os.default.hostname()
-        };
-        import_node_fs2.default.writeFileSync(fd, JSON.stringify(lockData), "utf8");
-        import_node_fs2.default.closeSync(fd);
-        fd = null;
-        this.currentLockId = lockId;
-        this.currentLockIno = acquiredIno;
-        return;
-      } catch (err) {
-        if (fd !== null) {
-          try {
-            import_node_fs2.default.closeSync(fd);
-          } catch {
-          }
-          try {
-            const curStat = import_node_fs2.default.statSync(this.lockPath);
-            if ((acquiredIno === void 0 || curStat.ino === acquiredIno) && curStat.size === 0) {
-              import_node_fs2.default.unlinkSync(this.lockPath);
-            }
-          } catch {
-          }
-        }
-        const code = err?.code;
-        if (code !== "EEXIST") {
-          throw err;
-        }
-      }
-      this.tryCleanStaleLock();
-      const elapsed = Date.now() - startTime;
-      if (elapsed >= this.timeoutMs) {
-        throw new VaultLockTimeoutError(this.lockPath, this.timeoutMs);
-      }
-      const jitter = Math.floor(Math.random() * 25);
-      const sleepMs = Math.min(currentDelay + jitter, 250);
-      currentDelay = Math.min(currentDelay * 1.5, 200);
-      await new Promise((resolve) => setTimeout(resolve, sleepMs));
-    }
-  }
-  /**
-   * Releases the lock file safely.
-   * Strictly enforces ownership and inode integrity: Never deletes a lock file owned by a different process.
-   */
-  async release() {
-    this.releaseSync();
-  }
-  /**
-   * Synchronous release helper for process exit handlers.
-   *
-   * Uses a hardlink guard so the inode we verified cannot be swapped for another
-   * process's lock between the check and the unlink. If hardlinks are unavailable,
-   * falls back to the stat-verified path (safe for the owner in practice).
-   */
-  releaseSync() {
-    if (!this.currentLockId) {
-      return;
-    }
-    const lockIdToRelease = this.currentLockId;
-    const lockInoToRelease = this.currentLockIno;
-    this.currentLockId = null;
-    this.currentLockIno = void 0;
-    const parentDir = import_node_path2.default.dirname(this.lockPath);
-    const guardPath = import_node_path2.default.join(parentDir, `.credentials.lock.release.${Date.now()}.${(0, import_node_crypto.randomUUID)()}`);
-    let guardCreated = false;
-    try {
-      if (!import_node_fs2.default.existsSync(this.lockPath)) {
-        return;
-      }
-      try {
-        import_node_fs2.default.linkSync(this.lockPath, guardPath);
-        guardCreated = true;
-      } catch {
-        this.releaseSyncLoose(lockIdToRelease, lockInoToRelease);
-        return;
-      }
-      const guardStat = import_node_fs2.default.statSync(guardPath);
-      if (lockInoToRelease !== void 0 && guardStat.ino !== lockInoToRelease) {
-        return;
-      }
-      const content = import_node_fs2.default.readFileSync(guardPath, "utf8");
-      let data = null;
-      try {
-        data = JSON.parse(content);
-      } catch {
-        return;
-      }
-      if (data && data.lockId === lockIdToRelease && data.pid === process.pid) {
-        const curStat = import_node_fs2.default.statSync(this.lockPath);
-        if (curStat.ino === guardStat.ino && curStat.nlink >= 2) {
-          try {
-            import_node_fs2.default.unlinkSync(this.lockPath);
-          } catch {
-          }
-        }
-      }
-    } catch {
-    } finally {
-      if (guardCreated) {
-        try {
-          import_node_fs2.default.unlinkSync(guardPath);
-        } catch {
-        }
-      }
-    }
-  }
-  /**
-   * Fallback release for filesystems without hardlink support.
-   *
-   * Hardlink creation can fail on filesystems lacking link support (e.g. FAT32, certain network mounts).
-   * In this fallback, the owner verifies that:
-   * 1. The lock file exists and matches the inode recorded at acquisition time.
-   * 2. The JSON payload matches lockIdToRelease and process.pid.
-   * 3. A post-read stat confirms the path still points to the same inode before unlinking.
-   *
-   * Note on TOCTOU: While a theoretical micro-window exists between post-read stat and unlinkSync,
-   * in practice only the legitimate owner releases an active, unexpired lock. If the lock was already
-   * unlinked or replaced by another inode, unlink is safely skipped.
-   */
-  releaseSyncLoose(lockIdToRelease, lockInoToRelease) {
-    try {
-      if (!import_node_fs2.default.existsSync(this.lockPath)) {
-        return;
-      }
-      const stat = import_node_fs2.default.statSync(this.lockPath);
-      if (lockInoToRelease !== void 0 && stat.ino !== lockInoToRelease) {
-        return;
-      }
-      const content = import_node_fs2.default.readFileSync(this.lockPath, "utf8");
-      let data = null;
-      try {
-        data = JSON.parse(content);
-      } catch {
-        return;
-      }
-      if (data && data.lockId === lockIdToRelease && data.pid === process.pid) {
-        const postStat = import_node_fs2.default.statSync(this.lockPath);
-        if (postStat.ino === stat.ino && postStat.mtimeMs === stat.mtimeMs) {
-          try {
-            import_node_fs2.default.unlinkSync(this.lockPath);
-          } catch {
-          }
-        }
-      }
-    } catch {
-    }
-  }
-  /**
-   * Sweeps orphan temporary guard files (.credentials.lock.release.*, .stale.*, .corrupt.*)
-   * left behind if a previous process crashed between linkSync and unlinkSync.
-   *
-   * Hardlink safety:
-   * 1. Hardlinks share `mtime` with the primary lock file. If a lock was held for > 60s,
-   *    a newly created release/quarantine hardlink will have an old `mtime`.
-   *    Therefore, age is strictly calculated from the timestamp embedded in the guard filename,
-   *    NOT from `stat.mtimeMs`.
-   * 2. A guard still hardlinked to the current `lockPath` inode (nlink > 1 and
-   *    the same inode) is active and is NEVER deleted.
-   * 3. Only timestamped-UUID guard names are considered. Guards from a replaced or
-   *    removed lock (different inode / missing lockPath) are swept once their embedded
-   *    timestamp exceeds `staleTimeoutMs`.
-   */
-  cleanOrphanGuards() {
-    try {
-      const parentDir = import_node_path2.default.dirname(this.lockPath);
-      if (!import_node_fs2.default.existsSync(parentDir)) {
-        return;
-      }
-      const lockFileName = import_node_path2.default.basename(this.lockPath);
-      const prefix = `.${lockFileName}.`;
-      const entries = import_node_fs2.default.readdirSync(parentDir);
-      const guardNamePattern = /^(release|stale|corrupt)\.(\d+)\.([0-9a-fA-F-]{36})$/;
-      let lockStat = null;
-      try {
-        lockStat = import_node_fs2.default.statSync(this.lockPath);
-      } catch {
-      }
-      const now = Date.now();
-      for (const entry of entries) {
-        if (!entry.startsWith(prefix)) {
-          continue;
-        }
-        const match = guardNamePattern.exec(entry.slice(prefix.length));
-        if (!match) {
-          continue;
-        }
-        const createdAt = Number(match[2]);
-        const fullPath = import_node_path2.default.join(parentDir, entry);
-        try {
-          const stat = import_node_fs2.default.statSync(fullPath);
-          if (!stat.isFile()) {
-            continue;
-          }
-          if (stat.nlink > 1 && lockStat && stat.ino === lockStat.ino) {
-            continue;
-          }
-          if (now - createdAt > this.staleTimeoutMs) {
-            import_node_fs2.default.unlinkSync(fullPath);
-          }
-        } catch {
-        }
-      }
-    } catch {
-    }
-  }
-  /**
-   * Executes an async operation within an exclusive vault lock.
-   * Guarantees that release() is called in finally.
-   */
-  async withLock(fn) {
-    await this.acquire();
-    try {
-      return await fn();
-    } finally {
-      await this.release();
-    }
-  }
-  /**
-   * Inspects existing lock file and safely reclaims it if stale.
-   *
-   * Hardened rules (M1 & TOCTOU fix):
-   * 1. Same-host lock: Only reclaimed if the holding process is confirmed DEAD (!isProcessAlive).
-   *    If the process is ALIVE, the lock is NEVER deleted regardless of age.
-   * 2. Remote-host lock: Reclaimed only if age exceeds staleTimeoutMs (since cross-host PID is untestable).
-   * 3. TOCTOU prevention: Uses hardlink + nlink verification and non-overwriting semantics.
-   *    Never replaces or destroys an active lock file acquired by a racing process.
-   */
-  tryCleanStaleLock() {
-    try {
-      this.cleanOrphanGuards();
-      if (!import_node_fs2.default.existsSync(this.lockPath)) {
-        return;
-      }
-      const initialStat = import_node_fs2.default.statSync(this.lockPath);
-      let data = null;
-      try {
-        const content = import_node_fs2.default.readFileSync(this.lockPath, "utf8");
-        data = JSON.parse(content);
-      } catch {
-        const ageMs = Date.now() - initialStat.mtimeMs;
-        if (ageMs > this.corruptLockGraceMs) {
-          this.reclaimCorruptLock(initialStat);
-        }
-        return;
-      }
-      if (!data || typeof data.createdAt !== "number") {
-        return;
-      }
-      const currentHostname = import_node_os.default.hostname();
-      const isSameHost = !data.hostname || data.hostname === currentHostname;
-      let isStale = false;
-      if (isSameHost) {
-        const isAlive = typeof data.pid === "number" && this.isProcessAlive(data.pid);
-        isStale = !isAlive;
-      } else {
-        const ageMs = Date.now() - data.createdAt;
-        isStale = ageMs > this.staleTimeoutMs;
-      }
-      if (isStale) {
-        this.reclaimStaleLock(data.lockId, initialStat);
-      }
-    } catch {
-    }
-  }
-  /**
-   * TOCTOU-safe stale lock removal using hardlink + nlink verification.
-   * Ensures that if another process acquires this.lockPath before or during cleanup,
-   * its active lock is never deleted or overwritten.
-   */
-  reclaimStaleLock(expectedLockId, initialStat) {
-    const parentDir = import_node_path2.default.dirname(this.lockPath);
-    const quarantinePath = import_node_path2.default.join(parentDir, `.credentials.lock.stale.${Date.now()}.${(0, import_node_crypto.randomUUID)()}`);
-    try {
-      import_node_fs2.default.linkSync(this.lockPath, quarantinePath);
-      try {
-        const qContent = import_node_fs2.default.readFileSync(quarantinePath, "utf8");
-        const qData = JSON.parse(qContent);
-        if (qData.lockId !== expectedLockId) {
-          return;
-        }
-        const curStat = import_node_fs2.default.statSync(this.lockPath);
-        if (curStat.ino === initialStat.ino && curStat.nlink >= 2) {
-          import_node_fs2.default.unlinkSync(this.lockPath);
-        }
-      } finally {
-        try {
-          import_node_fs2.default.unlinkSync(quarantinePath);
-        } catch {
-        }
-      }
-    } catch {
-    }
-  }
-  /**
-   * TOCTOU-safe corrupt lock removal with inode, size, and mtime verification.
-   */
-  reclaimCorruptLock(initialStat) {
-    const parentDir = import_node_path2.default.dirname(this.lockPath);
-    const quarantinePath = import_node_path2.default.join(parentDir, `.credentials.lock.corrupt.${Date.now()}.${(0, import_node_crypto.randomUUID)()}`);
-    try {
-      import_node_fs2.default.linkSync(this.lockPath, quarantinePath);
-      try {
-        const qStat = import_node_fs2.default.statSync(quarantinePath);
-        if (qStat.ino !== initialStat.ino || qStat.size !== initialStat.size || qStat.mtimeMs !== initialStat.mtimeMs) {
-          return;
-        }
-        try {
-          const qContent = import_node_fs2.default.readFileSync(quarantinePath, "utf8");
-          JSON.parse(qContent);
-          return;
-        } catch {
-        }
-        const curStat = import_node_fs2.default.statSync(this.lockPath);
-        if (curStat.ino === initialStat.ino && curStat.nlink >= 2) {
-          import_node_fs2.default.unlinkSync(this.lockPath);
-        }
-      } finally {
-        try {
-          import_node_fs2.default.unlinkSync(quarantinePath);
-        } catch {
-        }
-      }
-    } catch {
-    }
-  }
-};
-async function withVaultLock(lockPath, fn, options) {
-  const lock = new VaultLock({ lockPath, ...options });
-  return await lock.withLock(fn);
-}
-
-// src/auth/token-refresh.ts
-var import_node_path3 = __toESM(require("path"));
-var ReauthenticationRequiredError = class extends Error {
-  profileKey;
-  reason;
-  terminalError;
-  constructor(profileKey, reason, terminalError) {
-    const errorSuffix = terminalError ? ` (${terminalError})` : "";
-    super(`Re-authentication required for profile "${profileKey}": ${reason}${errorSuffix}`);
-    this.name = "ReauthenticationRequiredError";
-    this.profileKey = profileKey;
-    this.reason = reason;
-    this.terminalError = terminalError;
-  }
-};
-var DEFAULT_SAFETY_MARGIN_SECONDS = 60;
-var DEFAULT_LOCK_TIMEOUT_MS = 6e4;
-var DEFAULT_STALE_LOCK_TIMEOUT_MS = 6e4;
-var TokenRefreshManager = class {
-  vault;
-  safetyMarginSeconds;
-  lockTimeoutMs;
-  staleLockTimeoutMs;
-  lockPath;
-  fetchFn;
-  logger;
-  errorLogger;
-  inFlightRefreshes = /* @__PURE__ */ new Map();
-  constructor(options) {
-    this.vault = options?.vault || new CredentialVault();
-    this.safetyMarginSeconds = options?.safetyMarginSeconds ?? DEFAULT_SAFETY_MARGIN_SECONDS;
-    this.lockTimeoutMs = options?.lockTimeoutMs ?? DEFAULT_LOCK_TIMEOUT_MS;
-    this.staleLockTimeoutMs = options?.staleLockTimeoutMs ?? options?.staleTimeoutMs ?? DEFAULT_STALE_LOCK_TIMEOUT_MS;
-    this.lockPath = options?.lockPath;
-    this.fetchFn = options?.fetchFn;
-    this.logger = options?.logger;
-    this.errorLogger = options?.errorLogger;
-  }
-  /**
-   * Returns a valid access token for the given profile key.
-   * If the current access token is within the safety margin or expired, refreshes
-   * transparently using the stored refresh token behind a cross-process lock.
-   */
-  async getValidAccessToken(profileKey) {
-    const creds = await this.getValidCredentials(profileKey);
-    return creds.accessToken;
-  }
-  /**
-   * Returns valid stored credentials for the profile key, refreshing if necessary.
-   */
-  async getValidCredentials(profileKey) {
-    const creds = await this.vault.load(profileKey);
-    if (!creds) {
-      throw new ReauthenticationRequiredError(profileKey, "No credentials found in vault.");
-    }
-    if (!isCredentialExpired(creds, this.safetyMarginSeconds)) {
-      return creds;
-    }
-    return await this.refreshWithSingleFlight(
-      profileKey,
-      false
-      /* not forced */
-    );
-  }
-  /**
-   * Explicitly forces a token refresh regardless of current expiry time.
-   * Reuses an in-flight refresh promise if one is already active (m7 fix).
-   */
-  async refresh(profileKey) {
-    const existing = this.inFlightRefreshes.get(profileKey);
-    if (existing) {
-      return await existing;
-    }
-    return await this.refreshWithSingleFlight(
-      profileKey,
-      true
-      /* forced */
-    );
-  }
-  /**
-   * Collapses concurrent in-process calls for the same profileKey to a single execution.
-   */
-  async refreshWithSingleFlight(profileKey, force) {
-    const existing = this.inFlightRefreshes.get(profileKey);
-    if (existing && !force) {
-      return await existing;
-    }
-    const refreshPromise = this.executeRefreshWithLock(profileKey, force);
-    this.inFlightRefreshes.set(profileKey, refreshPromise);
-    try {
-      return await refreshPromise;
-    } finally {
-      this.inFlightRefreshes.delete(profileKey);
-    }
-  }
-  /**
-   * Acquires the cross-process lock, double-checks if another process already refreshed,
-   * and invokes the server refresh endpoint if still needed.
-   */
-  async executeRefreshWithLock(profileKey, force) {
-    const resolvedLockPath = this.lockPath || import_node_path3.default.join(this.vault.getConfigDir(), "credentials.lock");
-    const lock = new VaultLock({
-      lockPath: resolvedLockPath,
-      timeoutMs: this.lockTimeoutMs,
-      staleTimeoutMs: this.staleLockTimeoutMs
-    });
-    return await lock.withLock(async () => {
-      const current = await this.vault.load(profileKey);
-      if (!current) {
-        throw new ReauthenticationRequiredError(profileKey, "Credentials missing from vault.");
-      }
-      if (!force && !isCredentialExpired(current, this.safetyMarginSeconds)) {
-        this.logger?.(`Token for profile "${profileKey}" was already refreshed by another process.`);
-        return current;
-      }
-      return await this.performTokenExchange(profileKey, current);
-    });
-  }
-  /**
-   * Performs the HTTP refresh exchange with the OAuth2 token endpoint.
-   */
-  async performTokenExchange(profileKey, current) {
-    if (!current.refreshToken) {
-      throw new ReauthenticationRequiredError(
-        profileKey,
-        "Cannot refresh access token: No refresh token stored in credentials."
-      );
-    }
-    const tokenUrl = `${current.serverUrl}/api/auth/oauth2/token`;
-    const bodyParams = new URLSearchParams();
-    bodyParams.set("grant_type", "refresh_token");
-    bodyParams.set("refresh_token", current.refreshToken);
-    bodyParams.set("client_id", current.clientId);
-    if (current.resource) {
-      bodyParams.set("resource", current.resource);
-    }
-    let tokenResponse;
-    try {
-      const res = await sendRequest(tokenUrl, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded",
-          Accept: "application/json"
-        },
-        body: bodyParams,
-        retries: 1,
-        fetchFn: this.fetchFn
-      });
-      if (!res.ok) {
-        throw new HttpError(
-          `Token refresh request failed with HTTP ${res.status}`,
-          res.status,
-          res.data
-        );
-      }
-      tokenResponse = res.data;
-    } catch (err) {
-      if (err instanceof HttpError) {
-        const errorData = err.data && typeof err.data === "object" ? err.data : {};
-        const errorCode = typeof errorData.error === "string" ? errorData.error : "";
-        const errorDesc = typeof errorData.error_description === "string" ? errorData.error_description : err.message;
-        const isTerminal = errorCode === "invalid_grant" || errorCode === "invalid_client";
-        const sanitizedMsg = sanitizeSecretString(errorDesc, [
-          current.refreshToken,
-          current.accessToken
-        ]);
-        this.errorLogger?.(
-          `Token refresh rejected (${err.status}, ${errorCode || "unknown"}): ${sanitizedMsg}`
-        );
-        if (isTerminal) {
-          try {
-            await this.vault.delete(profileKey);
-          } catch {
-          }
-          throw new ReauthenticationRequiredError(
-            profileKey,
-            `Refresh token rejected by authorization server: ${sanitizedMsg}`,
-            errorCode
-          );
-        }
-        throw new HttpError(
-          `Token refresh rejected (${err.status}): ${sanitizedMsg}`,
-          err.status,
-          err.data
-        );
-      }
-      this.errorLogger?.(
-        `Token refresh network/transient error for profile "${profileKey}": 
-        ${err instanceof Error ? err.message : String(err)}`
-      );
-      throw err;
-    }
-    if (!tokenResponse || !tokenResponse.access_token) {
-      const errCode = tokenResponse?.error || "unknown_error";
-      const rawDesc = tokenResponse?.error_description || "Missing access_token in token response.";
-      const sanitizedDesc = sanitizeSecretString(rawDesc, [
-        current.refreshToken,
-        current.accessToken
-      ]);
-      this.errorLogger?.(`Token response invalid for profile "${profileKey}": ${sanitizedDesc}`);
-      if (errCode === "invalid_grant" || errCode === "invalid_client") {
-        try {
-          await this.vault.delete(profileKey);
-        } catch {
-        }
-        throw new ReauthenticationRequiredError(profileKey, sanitizedDesc, errCode);
-      }
-      throw new Error(`Token refresh failed: ${sanitizedDesc}`);
-    }
-    const payload = decodeJwtPayload(tokenResponse.access_token);
-    let organizationId;
-    if ("organizationId" in payload) {
-      if (typeof payload.organizationId === "string") {
-        organizationId = payload.organizationId;
-      } else if (payload.organizationId === null) {
-        organizationId = null;
-      } else {
-        organizationId = current.organizationId ?? null;
-      }
-    } else {
-      organizationId = current.organizationId ?? null;
-    }
-    const expiresAtMs = tokenResponse.expires_in ? Date.now() + tokenResponse.expires_in * 1e3 : typeof payload.exp === "number" ? payload.exp * 1e3 : Date.now() + 3600 * 1e3;
-    const newRefreshToken = tokenResponse.refresh_token || current.refreshToken;
-    const updatedCreds = {
-      serverUrl: current.serverUrl,
-      clientId: current.clientId,
-      accessToken: tokenResponse.access_token,
-      refreshToken: newRefreshToken,
-      tokenType: tokenResponse.token_type || current.tokenType || "Bearer",
-      scope: tokenResponse.scope || current.scope,
-      resource: current.resource,
-      organizationId,
-      expiresAt: expiresAtMs,
-      updatedAt: Date.now()
-    };
-    try {
-      await this.vault.save(profileKey, updatedCreds);
-    } catch (saveErr) {
-      try {
-        await this.vault.delete(profileKey);
-      } catch {
-      }
-      const msg = saveErr instanceof Error ? saveErr.message : String(saveErr);
-      this.errorLogger?.(
-        `Failed to persist refreshed credentials for profile "${profileKey}": ${msg}`
-      );
-      throw new ReauthenticationRequiredError(
-        profileKey,
-        `Failed to persist refreshed credentials to vault: ${msg}`,
-        "persistence_failure"
-      );
-    }
-    this.logger?.(
-      `Successfully refreshed credentials for profile "${profileKey}"
-       (expires: ${new Date(expiresAtMs).toISOString()}).`
-    );
-    return updatedCreds;
-  }
-};
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  CredentialVault,
-  DEFAULT_CLI_CLIENT_ID,
-  DEFAULT_KEYCHAIN_SERVICE,
-  DEFAULT_READ_ONLY_SCOPES,
-  DEFAULT_SCOPES,
-  DEFAULT_SERVER_URL,
-  DEVICE_CODE_GRANT_TYPE,
-  DefaultKeychainRunner,
-  HttpError,
-  KeychainService,
-  ReauthenticationRequiredError,
-  TokenRefreshManager,
-  VaultLock,
-  VaultLockError,
-  VaultLockTimeoutError,
-  decodeJwtPayload,
-  defaultIsProcessAlive,
-  executeLogin,
-  executeLogout,
-  executeStatus,
-  isCredentialExpired,
-  isLocalhost,
-  isValidStoredCredentials,
-  normalizeProfileKey,
-  openBrowser,
-  pollDeviceToken,
-  redactCredentials,
-  requestDeviceCode,
-  resolveAuthServerUrl,
-  resolveMcpResourceUrl,
-  sanitizeSecretString,
-  sendRequest,
-  validateScopes,
-  withVaultLock
-});
+"use strict";var be=Object.create;var N=Object.defineProperty;var _e=Object.getOwnPropertyDescriptor;var Ie=Object.getOwnPropertyNames;var xe=Object.getPrototypeOf,Me=Object.prototype.hasOwnProperty;var Le=(i,e)=>()=>{try{return e||i((e={exports:{}}).exports,e),e.exports}catch(t){throw e=0,t}},Ae=(i,e)=>{for(var t in e)N(i,t,{get:e[t],enumerable:!0})},se=(i,e,t,r)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of Ie(e))!Me.call(i,n)&&n!==t&&N(i,n,{get:()=>e[n],enumerable:!(r=_e(e,n))||r.enumerable});return i};var I=(i,e,t)=>(t=i!=null?be(xe(i)):{},se(e||!i||!i.__esModule?N(t,"default",{value:i,enumerable:!0}):t,i)),$e=i=>se(N({},"__esModule",{value:!0}),i);var he=Le(g=>{"use strict";Object.defineProperty(g,"__esModule",{value:!0});g.MCP_OAUTH_SCOPES=g.OFFLINE_ACCESS_SCOPE=g.MCP_ELIGIBLE_PERMISSION_SET=g.MCP_ELIGIBLE_PERMISSIONS=g.SENSITIVE_MCP_RESOURCES=g.PERMISSION_SET=g.ALL_PERMISSIONS=g.CATALOG_DEFINITIONS=void 0;g.isPermissionString=ce;g.parsePermissionString=le;g.isSensitiveMcpResource=ue;g.isMcpEligiblePermission=de;g.partitionMcpScopes=De;g.CATALOG_DEFINITIONS={organization:{tier:"T",actions:["update","delete"],description:"Organization tenant profile and settings",models:["Organization","OrganizationSetting","OrganizationSubscription"],mcpEligible:!0},member:{tier:"T",actions:["create","update","delete"],description:"Organization member management",models:["Member"],mcpEligible:!0},invitation:{tier:"T",actions:["create","cancel"],description:"Organization membership invitations",models:["Invitation"],mcpEligible:!0},location:{tier:"T",actions:["read","write","delete"],description:"Physical hotspot location management",models:["Location"],mcpEligible:!0},router:{tier:"T",actions:["read","write","delete","control"],description:"Gateway router inventory, provisioning and control",models:["Router","ZtpToken","CoaQueue","IpamAllocationCursor"],mcpEligible:!0},package:{tier:"S",actions:["read","write","delete","publish"],description:"WiFi access package catalog (tenant + shared)",models:["Package","VoucherPackage"],mcpEligible:!0},voucher:{tier:"S",actions:["read","write","publish","issue","revoke"],description:"Prepaid voucher codes and issuance (tenant + shared)",models:["Voucher","VoucherIssuance","VoucherUser"],mcpEligible:!0},session:{tier:"T",actions:["read","control"],description:"Active and historical WiFi guest sessions",models:["WifiSession","RadiusAccounting","DeviceToken"],mcpEligible:!0},wallet:{tier:"T",actions:["read","topup","charge","refund","freeze"],description:"Prepaid wallet balances, topups and ledger transactions (SENSITIVE - MCP EXCLUDED)",models:["Wallet","WalletTransaction","TopupRequest"],hasOwnQualifier:!0,mcpEligible:!1},payment:{tier:"T",actions:["read","approve","refund"],description:"Inbound payment transactions and gateway integrations (SENSITIVE - MCP EXCLUDED)",models:["PaymentTransaction","PaymentGatewayIntegration"],hasOwnQualifier:!0,mcpEligible:!1},subscription:{tier:"T",actions:["read","manage"],description:"SaaS organization plan subscription and entitlements",models:["OrganizationSubscription"],mcpEligible:!0},partner:{tier:"T",actions:["read","manage","payout:approve"],description:"Affiliate/partner programs and payout requests",models:["Partner","PartnerPayoutRequest"],mcpEligible:!0},campaign:{tier:"T",actions:["read","write"],description:"Captive portal ad campaigns and lead capture",models:["AdCampaign","LeadCapture"],mcpEligible:!0},notification:{tier:"T",actions:["read","send","template:write"],description:"Multi-channel notifications, templates and logs",models:["NotificationItem","NotificationTemplate","DeliveryLog"],hasOwnQualifier:!0,mcpEligible:!0},store:{tier:"P",actions:["read","write"],description:"Public hardware/affiliate store catalog",models:["StoreProduct","AffiliateClick"],mcpEligible:!0},blog:{tier:"P",actions:["read","write","publish"],description:"Company-wide editorial articles and CDN media",models:["BlogPost","Media"],hasOwnQualifier:!0,mcpEligible:!0},analytics:{tier:"D",actions:["read"],description:"Aggregated usage, session and revenue metrics",models:["WifiSession","Package","PaymentTransaction"],mcpEligible:!0},diagnostics:{tier:"P",actions:["read","write"],description:"System error events, MCP tool execution spans, flow events, issue triage and audit logs",models:["ErrorEvent","McpToolSpan","AuditLog","SystemSetting","FlowEvent","IssueState"],mcpEligible:!0}};g.ALL_PERMISSIONS=["organization:update","organization:delete","member:create","member:update","member:delete","invitation:create","invitation:cancel","location:read","location:write","location:delete","router:read","router:write","router:delete","router:control","package:read","package:write","package:delete","package:publish","voucher:read","voucher:write","voucher:publish","voucher:issue","voucher:revoke","session:read","session:control","wallet:read","wallet:topup","wallet:charge","wallet:refund","wallet:freeze","payment:read","payment:approve","payment:refund","subscription:read","subscription:manage","partner:read","partner:manage","partner:payout:approve","campaign:read","campaign:write","notification:read","notification:send","notification:template:write","store:read","store:write","blog:read","blog:write","blog:publish","analytics:read","diagnostics:read","diagnostics:write"];g.PERMISSION_SET=new Set(g.ALL_PERMISSIONS);function ce(i){return typeof i=="string"&&g.PERMISSION_SET.has(i)}function le(i){if(!ce(i))return null;let e=i.indexOf(":"),t=i.slice(0,e),r=i.slice(e+1);return{resource:t,action:r}}g.SENSITIVE_MCP_RESOURCES=["payment","wallet"];function ue(i){return i==="payment"||i==="wallet"}function de(i){let e=le(i);return e?!ue(e.resource):!1}g.MCP_ELIGIBLE_PERMISSIONS=g.ALL_PERMISSIONS.filter(de);g.MCP_ELIGIBLE_PERMISSION_SET=new Set(g.MCP_ELIGIBLE_PERMISSIONS);g.OFFLINE_ACCESS_SCOPE="offline_access";g.MCP_OAUTH_SCOPES=[...g.MCP_ELIGIBLE_PERMISSIONS,g.OFFLINE_ACCESS_SCOPE];function De(i){return{permissionScopes:i.filter(e=>e!==g.OFFLINE_ACCESS_SCOPE),offlineAccessRequested:i.includes(g.OFFLINE_ACCESS_SCOPE)}}});var Ge={};Ae(Ge,{CredentialVault:()=>P,DEFAULT_CLI_CLIENT_ID:()=>R,DEFAULT_KEYCHAIN_SERVICE:()=>j,DEFAULT_READ_ONLY_SCOPES:()=>ge,DEFAULT_SCOPES:()=>me,DEFAULT_SERVER_URL:()=>pe,DEVICE_CODE_GRANT_TYPE:()=>ye,DefaultKeychainRunner:()=>z,HttpError:()=>T,KeychainService:()=>A,ReauthenticationRequiredError:()=>_,TokenRefreshManager:()=>ee,VaultLock:()=>L,VaultLockError:()=>J,VaultLockTimeoutError:()=>B,decodeJwtPayload:()=>q,defaultIsProcessAlive:()=>Pe,executeLogin:()=>Ne,executeLogout:()=>fe,executeStatus:()=>Ue,formatRemainingDuration:()=>Ee,isCredentialExpired:()=>M,isLocalhost:()=>Z,isValidStoredCredentials:()=>U,normalizeProfileKey:()=>x,openBrowser:()=>ve,pollDeviceToken:()=>Te,redactCredentials:()=>Re,requestDeviceCode:()=>ke,resolveAuthServerUrl:()=>O,resolveMcpResourceUrl:()=>Se,sanitizeSecretString:()=>E,sendRequest:()=>C,validateScopes:()=>we,withVaultLock:()=>qe});module.exports=$e(Ge);function U(i){if(!i||typeof i!="object"||Array.isArray(i))return!1;let e=i;return!(typeof e.serverUrl!="string"||typeof e.clientId!="string"||typeof e.accessToken!="string"||typeof e.tokenType!="string"||typeof e.expiresAt!="number"||!Number.isFinite(e.expiresAt)||!("organizationId"in e)||e.organizationId!==null&&typeof e.organizationId!="string"||e.refreshToken!==void 0&&typeof e.refreshToken!="string"||e.scope!==void 0&&typeof e.scope!="string"||e.resource!==void 0&&typeof e.resource!="string"||e.updatedAt!==void 0&&(typeof e.updatedAt!="number"||!Number.isFinite(e.updatedAt)))}function x(i,e){let t=(e||"").trim(),r=(i||"").trim();/^https?:\/\//i.test(r)||(r=`https://${r}`);try{return`${new URL(r).origin.toLowerCase()}::${t}`}catch{return`${r.replace(/\/+$/,"").toLowerCase()}::${t}`}}function Re(i){let e={...i};return"accessToken"in e&&typeof e.accessToken=="string"&&(e.accessToken="[REDACTED]"),"refreshToken"in e&&typeof e.refreshToken=="string"&&(e.refreshToken="[REDACTED]"),e}function E(i,e){let t=i;for(let r of e)r&&typeof r=="string"&&r.length>=4&&(t=t.split(r).join("[REDACTED]"));return t}function M(i,e=60){if(!i.expiresAt)return!1;let t=i.expiresAt>1e11?i.expiresAt:i.expiresAt*1e3;return Date.now()+e*1e3>=t}var oe=require("child_process");var z=class{defaultTimeoutMs;constructor(e=5e3){this.defaultTimeoutMs=e}spawn(e,t,r){return new Promise(n=>{let s;try{s=(0,oe.spawn)(e,t,{shell:!1,stdio:["pipe","pipe","pipe"]})}catch(a){let d=a instanceof Error?a.message:String(a);return n({stdout:"",stderr:d,exitCode:-1})}let o="",c="",l=!1,u=r?.timeoutMs??this.defaultTimeoutMs,m=setTimeout(()=>{if(!l){l=!0;try{s.kill("SIGKILL")}catch{}n({stdout:o,stderr:`Keychain operation timed out after ${u}ms`,exitCode:-1})}},u);if(s.stdout?.on("data",a=>{o+=a.toString()}),s.stderr?.on("data",a=>{c+=a.toString()}),s.on("error",a=>{c+=a.message}),s.on("close",a=>{l||(l=!0,clearTimeout(m),n({stdout:o,stderr:c,exitCode:a??-1}))}),r?.input!==void 0&&s.stdin)try{s.stdin.write(r.input),s.stdin.end()}catch{}})}},j="iwas-cli",A=class{service;runner;platform;constructor(e){this.service=e?.serviceName||j,this.runner=e?.runner||new z,this.platform=e?.platform||process.platform}availableCache=null;getPlatform(){return this.platform}async isAvailable(e=!1){if(!e&&this.availableCache===!0)return!0;if(this.platform==="darwin"){let t=await this.runner.spawn("/usr/bin/security",["help"]),r=t.exitCode===0||t.stdout.includes("security")||t.stderr.includes("security");return r&&(this.availableCache=!0),r}if(this.platform==="linux"){let r=(await this.runner.spawn("which",["secret-tool"])).exitCode===0;return r&&(this.availableCache=!0),r}return!1}clearAvailabilityCache(){this.availableCache=null}async getSecret(e){if(this.platform==="darwin"){let t=await this.runner.spawn("/usr/bin/security",["find-generic-password","-s",this.service,"-a",e,"-w"]);if(t.exitCode===0){let r=t.stdout.trim();if(r.length>0&&r.length%2===0&&/^[0-9a-fA-F]+$/.test(r)&&(r.startsWith("7b")||r.startsWith("7B")||r.startsWith("5b")||r.startsWith("5B")))try{let n=Buffer.from(r,"hex").toString("utf8");if(!n.includes("\uFFFD"))return n}catch{}return r}if(t.exitCode===44||t.stderr.includes("could not be found")||t.stderr.includes("The specified item could not be found"))return null;throw new Error(`Keychain read failed: ${t.stderr.trim()||`exit code ${t.exitCode}`}`)}if(this.platform==="linux"){let t=await this.runner.spawn("secret-tool",["lookup","service",this.service,"account",e]);if(t.exitCode===0)return t.stdout.length>0?t.stdout.trim():null;let r=t.stderr.trim();if(t.exitCode===1&&(r===""||r.toLowerCase().includes("not found")||r.toLowerCase().includes("no such secret")))return null;throw new Error(`Secret-tool read failed: ${r||`exit code ${t.exitCode}`}`)}throw new Error(`OS keychain not supported on platform: ${this.platform}`)}async setSecret(e,t,r){let n=r||`${this.service} (${e})`,s=[t];try{let o=JSON.parse(t);if(typeof o=="object"&&o!==null)for(let c of Object.values(o))typeof c=="string"&&c.length>=4&&s.push(c)}catch{}if(this.platform==="darwin"){let o=await this.runner.spawn("/usr/bin/security",["add-generic-password","-U","-s",this.service,"-a",e,"-l",n,"-w",t]);if(o.exitCode!==0){let c=E(o.stderr.trim(),s);throw new Error(`Keychain write failed: ${c||`exit code ${o.exitCode}`}`)}return}if(this.platform==="linux"){let o=await this.runner.spawn("secret-tool",["store",`--label=${n}`,"service",this.service,"account",e],{input:t});if(o.exitCode!==0){let c=E(o.stderr.trim(),s);throw new Error(`Secret-tool write failed: ${c||`exit code ${o.exitCode}`}`)}return}throw new Error(`OS keychain not supported on platform: ${this.platform}`)}async deleteSecret(e){if(this.platform==="darwin"){let t=await this.runner.spawn("/usr/bin/security",["delete-generic-password","-s",this.service,"-a",e]);if(t.exitCode===0||t.exitCode===44||t.stderr.includes("could not be found"))return;throw new Error(`Keychain delete failed: ${t.stderr.trim()||`exit code ${t.exitCode}`}`)}if(this.platform==="linux"){let t=await this.runner.spawn("secret-tool",["clear","service",this.service,"account",e]);if(t.exitCode===0||t.exitCode===1)return;throw new Error(`Secret-tool clear failed: ${t.stderr.trim()||`exit code ${t.exitCode}`}`)}throw new Error(`OS keychain not supported on platform: ${this.platform}`)}};var w=I(require("fs")),$=I(require("path")),ae=I(require("os"));var V="__profiles__",P=class{vaultType;configDir;credentialsFilePath;keychain;constructor(e){let t=process.env.IWAS_MCP_VAULT;if(t&&!["auto","keychain","file"].includes(t))throw new Error(`Invalid IWAS_MCP_VAULT value: "${t}". Supported values are "auto", "keychain", or "file".`);let r=t;this.vaultType=e?.vaultType||r||"auto";let n=e?.configDir||process.env.XDG_CONFIG_HOME||$.default.join(ae.default.homedir(),".config");this.configDir=e?.configDir?e.configDir:$.default.join(n,"iwas"),this.credentialsFilePath=$.default.join(this.configDir,"credentials.json"),this.keychain=e?.keychainService||new A({serviceName:e?.serviceName||j,runner:e?.keychainRunner})}getConfigDir(){return this.configDir}getCredentialsFilePath(){return this.credentialsFilePath}async getEffectiveBackend(){if(this.vaultType==="file")return"file";let e=await this.keychain.isAvailable().catch(()=>!1),t=this.keychain.getPlatform();if(this.vaultType==="keychain"){if(!e)throw new Error(`Keychain vault requested (IWAS_MCP_VAULT="keychain") but OS keychain is unavailable on platform: ${t}`);return"keychain"}return e?"keychain":"file"}async load(e){if(await this.getEffectiveBackend()==="keychain"){let r=null;try{let c=await this.keychain.getSecret(e);if(c)try{let l=JSON.parse(c);if(U(l))r=l;else if(this.vaultType==="keychain")throw new Error(`Corrupt credentials stored in keychain for profile: ${e}`)}catch(l){if(this.vaultType==="keychain"){let u=l instanceof Error?l.message:String(l);throw new Error(`Corrupt credentials JSON in keychain for profile ${e}: ${u}`)}}}catch(c){if(this.vaultType==="keychain")throw c}if(this.vaultType==="keychain")return r;let n=this.loadFromFile(e);if(!r){if(n)try{await this.keychain.setSecret(e,JSON.stringify(n),`IWAS MCP Profile (${e})`),await this.addProfileToKeychainIndex(e),this.deleteFromFile(e)}catch{}return n}if(!n)return r;let s=r.updatedAt??r.expiresAt??0;if((n.updatedAt??n.expiresAt??0)>s){try{await this.keychain.setSecret(e,JSON.stringify(n),`IWAS MCP Profile (${e})`),await this.addProfileToKeychainIndex(e),this.deleteFromFile(e)}catch{}return n}else return this.deleteFromFile(e),r}return this.loadFromFile(e)}async save(e,t){let r=await this.getEffectiveBackend(),n={...t,updatedAt:t.updatedAt??Date.now()};if(r==="keychain"){let s=!1;try{let o=JSON.stringify(n);await this.keychain.setSecret(e,o,`IWAS MCP Profile (${e})`),s=!0;try{await this.addProfileToKeychainIndex(e)}catch(c){let l=c instanceof Error?c.message:String(c),u=E(l,[n.accessToken,n.refreshToken]);throw new Error(`Keychain index update failed: ${u}`)}this.deleteFromFile(e);return}catch(o){if(this.vaultType==="keychain"||s){let c=o instanceof Error?o.message:String(o),l=E(c,[n.accessToken,n.refreshToken]);throw o instanceof Error&&o.message.startsWith("Keychain")?o:new Error(`Keychain save failed: ${l}`)}}}this.saveToFile(e,n)}async delete(e){let t=null,r=!1;if(this.vaultType==="file"){this.deleteFromFile(e);return}try{if(r=await this.keychain.isAvailable().catch(()=>!1),this.vaultType==="keychain"&&!r)throw new Error(`Keychain vault requested (IWAS_MCP_VAULT="keychain") but OS keychain is unavailable on platform: ${this.keychain.getPlatform()}`);r&&(await this.keychain.deleteSecret(e),await this.removeProfileFromKeychainIndex(e))}catch(n){t=n}if(this.deleteFromFile(e),t&&(this.vaultType==="keychain"||this.vaultType==="auto"&&r))throw t}async listProfiles(){if(this.vaultType==="file")return this.listProfilesFromFile();if(this.vaultType==="keychain")return this.readKeychainIndex();let e=new Set;try{if(await this.keychain.isAvailable()){let r=await this.readKeychainIndex();for(let n of r)e.add(n)}}catch{}for(let t of this.listProfilesFromFile())e.add(t);return Array.from(e)}async readKeychainIndex(){let e=await this.keychain.getSecret(V);if(!e)return[];try{let t=JSON.parse(e);return Array.isArray(t)?t.filter(r=>typeof r=="string"):[]}catch(t){let r=t instanceof Error?t.message:String(t);throw new Error(`Corrupt keychain profile index at ${V}: ${r}`)}}async addProfileToKeychainIndex(e){let t=await this.readKeychainIndex();t.includes(e)||(t.push(e),await this.keychain.setSecret(V,JSON.stringify(t),"IWAS MCP Profiles Index"))}async removeProfileFromKeychainIndex(e){let t=await this.readKeychainIndex();if(t.includes(e)){let r=t.filter(n=>n!==e);await this.keychain.setSecret(V,JSON.stringify(r),"IWAS MCP Profiles Index")}}ensureConfigDirectory(){w.default.existsSync(this.configDir)||w.default.mkdirSync(this.configDir,{recursive:!0,mode:448});try{w.default.chmodSync(this.configDir,448)}catch{}}readAllFromFile(){if(!w.default.existsSync(this.credentialsFilePath))return{};if(process.platform!=="win32")try{w.default.chmodSync(this.credentialsFilePath,384)}catch{}let e=w.default.readFileSync(this.credentialsFilePath,"utf8").trim();if(!e)return{};try{let t=JSON.parse(e);if(typeof t!="object"||t===null||Array.isArray(t))throw new Error("Root credentials object must be a JSON record");for(let[r,n]of Object.entries(t))if(!U(n))throw new Error(`Profile "${r}" contains invalid or missing credential fields`);return t}catch(t){let r=t instanceof Error?t.message:String(t);throw new Error(`Corrupt credentials file at ${this.credentialsFilePath}: ${r}. Will not overwrite.`)}}writeAllToFile(e){this.ensureConfigDirectory();let t=JSON.stringify(e,null,2)+`
+`,r=$.default.join(this.configDir,`.credentials.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`),n=null;try{n=w.default.openSync(r,"w",384),w.default.writeSync(n,t,void 0,"utf8"),w.default.fsyncSync(n),w.default.closeSync(n),n=null;try{w.default.chmodSync(r,384)}catch{}w.default.renameSync(r,this.credentialsFilePath);try{w.default.chmodSync(this.credentialsFilePath,384)}catch{}if(process.platform!=="win32")try{let s=w.default.openSync(this.configDir,"r");w.default.fsyncSync(s),w.default.closeSync(s)}catch{}}catch(s){if(n!==null)try{w.default.closeSync(n)}catch{}if(w.default.existsSync(r))try{w.default.unlinkSync(r)}catch{}throw s}}loadFromFile(e){return this.readAllFromFile()[e]??null}saveToFile(e,t){let r=this.readAllFromFile();r[e]=t,this.writeAllToFile(r)}deleteFromFile(e){if(!w.default.existsSync(this.credentialsFilePath))return;let t=this.readAllFromFile();e in t&&(delete t[e],this.writeAllToFile(t))}listProfilesFromFile(){if(!w.default.existsSync(this.credentialsFilePath))return[];let e=this.readAllFromFile();return Object.keys(e)}};var T=class extends Error{status;data;constructor(e,t,r){super(e),this.name="HttpError",this.status=t,this.data=r}},Oe=15e3,Fe=2;async function C(i,e){let t=e?.method||"GET",r=e?.timeoutMs??Oe,n=e?.retries??Fe,s={Accept:"application/json",...e?.headers||{}},o;e?.body&&(typeof e.body=="string"?o=e.body:e.body instanceof URLSearchParams?(o=e.body.toString(),s["Content-Type"]||(s["Content-Type"]="application/x-www-form-urlencoded")):(o=JSON.stringify(e.body),s["Content-Type"]||(s["Content-Type"]="application/json")));let c=0,l=null;for(;c<=n;){c++;let u=new AbortController,m=setTimeout(()=>u.abort(),r);try{let d=await(e?.fetchFn||fetch)(i,{method:t,headers:s,body:o,signal:u.signal});clearTimeout(m);let p=d.headers.get("content-type")||"",f;if(p.includes("application/json"))try{f=await d.json()}catch{f=null}else f=await d.text();if(d.status>=500&&d.status<=504&&c<=n){let y=Math.min(1e3*Math.pow(2,c-1)+Math.random()*200,5e3);await new Promise(S=>setTimeout(S,y));continue}return{status:d.status,ok:d.ok,headers:d.headers,data:f}}catch(a){clearTimeout(m);let p=a instanceof Error&&a.name==="AbortError"?`Request timed out after ${r}ms`:a instanceof Error?a.message:String(a);if(l=new Error(`Network request failed for ${t} ${i}: ${p}`),c<=n){let f=Math.min(500*Math.pow(2,c-1)+Math.random()*200,3e3);await new Promise(y=>setTimeout(y,f));continue}}}throw l||new Error(`Network request failed after ${c} attempts`)}var K=require("child_process"),b=I(he());async function fe(i){let e=i?.logger||(f=>process.stdout.write(`${f}
+`)),t=i?.errorLogger||(f=>process.stderr.write(`${f}
+`)),r=O(i?.server),n=(i?.clientId||R).trim(),s=x(r,n),o=i?.vault||new P,c=i?.force===!0,l=await o.load(s);if(!l){let f={success:!0,profileKey:s,serverRevoked:!1,refreshTokenRevoked:!1,localCleared:!1,message:`No stored credentials found for profile: ${s}`};return i?.json?e(JSON.stringify({event:"logout",success:!0,loggedOut:!0,profileKey:s,serverRevoked:!1,refreshTokenRevoked:!1,localCleared:!1,message:f.message})):e(`\u2139\uFE0F  No stored credentials found for profile: ${s}`),f}let u=!1,m=null,a=`${r.replace(/\/+$/,"")}/api/v1/mcp-session/logout`;try{let f=l.tokenType||"Bearer",y=await C(a,{method:"POST",headers:{Authorization:`${f} ${l.accessToken}`},fetchFn:i?.fetchFn});if(y.status===204||y.status===200)u=!0;else if(y.status===401||y.status===403)u=!0;else if(y.status===400){let S=y.data;throw new Error(S?.message||"Server rejected logout request (HTTP 400).")}else throw new T(`Server returned status ${y.status} during logout`,y.status,y.data)}catch(f){m=f instanceof Error?f:new Error(String(f))}if(m&&!c){let f=`Server revocation failed: ${m.message}. Local credentials preserved. Use --force to clear local credentials anyway if the server is permanently offline.`;throw new Error(f)}let d=!1;if(l.refreshToken)try{let f=`${r.replace(/\/+$/,"")}/api/auth/oauth2/revoke`,y=new URLSearchParams({token:l.refreshToken,token_type_hint:"refresh_token",client_id:n}),S=await C(f,{method:"POST",body:y,fetchFn:i?.fetchFn});(S.ok||S.status===200||S.status===204||S.status===401||S.status===400)&&(d=!0)}catch{}await o.delete(s);let p={success:!0,profileKey:s,serverRevoked:u,refreshTokenRevoked:d,localCleared:!0,message:m?`Local credentials cleared with --force (server unreachable: ${m.message})`:"Successfully logged out and revoked all grants server-side"};return i?.json?e(JSON.stringify({event:"logout",success:!0,loggedOut:!0,profileKey:s,serverRevoked:u,refreshTokenRevoked:d,localCleared:!0,forced:c&&!!m})):m?(t(`\u26A0\uFE0F  Warning: Server revocation failed (${m.message})`),e(`\u2705 Local credentials cleared for profile: ${s} (--force)
+`)):(e(`
+\u2705 Successfully logged out from profile: ${s}`),e("   \u2022 Server session & OAuth grants: Revoked"),e(`   \u2022 Local credentials: Removed
+`)),p}var R="iwas-cli",pe="https://getiwas.com",ge=b.MCP_ELIGIBLE_PERMISSIONS.filter(i=>i.endsWith(":read")),me=[...ge,b.OFFLINE_ACCESS_SCOPE].join(" "),ye="urn:ietf:params:oauth:grant-type:device_code";function we(i){let e=i.split(/\s+/).filter(Boolean);if(e.length===0)return{valid:!1,invalidScopes:[],error:"At least one OAuth scope must be requested."};let t=new Set(b.MCP_OAUTH_SCOPES),r=e.filter(s=>!t.has(s));return r.length>0?{valid:!1,invalidScopes:r,error:`Invalid OAuth scope(s) requested: [${r.join(", ")}]. Supported scopes are: [${b.MCP_OAUTH_SCOPES.join(", ")}]`}:e.filter(s=>s!==b.OFFLINE_ACCESS_SCOPE).length===0?{valid:!1,invalidScopes:[],error:"At least one MCP capability scope besides offline_access must be requested."}:{valid:!0,invalidScopes:[]}}function Z(i){return i==="localhost"||i==="127.0.0.1"||i==="::1"||i==="[::1]"}function O(i){let e=(i||process.env.IWAS_SERVER_URL||pe).trim();if(e=e.replace(/\/+$/,""),e.toLowerCase().endsWith("/mcp"))throw new Error(`Invalid --server value: "${e}". The server argument must be the auth/web origin (e.g. "https://getiwas.com"), not the MCP resource endpoint. Use --resource for "${e}".`);/^https?:\/\//i.test(e)||(e=`https://${e}`);let t;try{t=new URL(e)}catch{throw new Error(`Invalid server URL: "${e}"`)}if(t.pathname&&t.pathname!=="/"){let r=t.origin,n=i?`--server value: "${i}"`:`IWAS_SERVER_URL: "${e}"`;throw new Error(`Invalid ${n}. The server argument must be an origin without a path component (e.g. "${r}").`)}if(!Z(t.hostname)&&t.protocol!=="https:")throw new Error(`Insecure server protocol: "${e}". Non-localhost servers require HTTPS per OAuth 2.1 specifications.`);return t.origin.toLowerCase()}function Se(i,e){if(e&&e.trim()){let t=e.trim();/^https?:\/\//i.test(t)||(t=t.startsWith("localhost")||t.startsWith("127.0.0.1")||t.startsWith("[::1]")||t.startsWith("::1")?`http://${t}`:`https://${t}`);let r;try{r=new URL(t)}catch{throw new Error(`Invalid resource URL: "${t}"`)}if(!Z(r.hostname)&&r.protocol!=="https:")throw new Error(`Insecure resource protocol: "${t}". Non-localhost resource endpoints require HTTPS.`);return r.href.replace(/\/+$/,"")}return`${i}/mcp`}function q(i){let e=i.split(".");if(e.length!==3)return{};try{let t=Buffer.from(e[1],"base64url").toString("utf8"),r=JSON.parse(t);return typeof r=="object"&&r!==null?r:{}}catch{return{}}}function ve(i,e=K.spawn,t){try{let r;try{r=new URL(i)}catch{return t?.(`Invalid verification URL: "${i}". Please open manually.`),!1}if(r.protocol!=="http:"&&r.protocol!=="https:")return t?.(`Insecure verification URL protocol: "${r.protocol}". Expected http: or https:.`),!1;let n=process.platform,s;return n==="darwin"?s=e("open",[r.href],{detached:!0,stdio:"ignore"}):n==="win32"?s=e("explorer.exe",[r.href],{detached:!0,stdio:"ignore"}):s=e("xdg-open",[r.href],{detached:!0,stdio:"ignore"}),s.on("error",o=>{let c=o instanceof Error?o.message:String(o);t?.(`Could not launch browser automatically (${c}). Please open the verification URL manually.`)}),s.unref(),!0}catch(r){let n=r instanceof Error?r.message:String(r);return t?.(`Could not launch browser (${n}). Please open the verification URL manually.`),!1}}async function ke(i,e){let t=`${i}/api/auth/device/code`,r=await C(t,{method:"POST",body:{client_id:e.clientId,scope:e.scope,resource:e.resource},retries:0});if(!r.ok||!r.data||typeof r.data!="object")throw new T(`Failed to initiate device authorization with ${t}: HTTP ${r.status}`,r.status,r.data);let n=r.data;if(!n.device_code||!n.user_code||!n.verification_uri)throw new Error(`Malformed device code response from ${t}: missing required RFC 8628 fields`);return{device_code:n.device_code,user_code:n.user_code,verification_uri:n.verification_uri,verification_uri_complete:n.verification_uri_complete||`${n.verification_uri}?user_code=${encodeURIComponent(n.user_code)}`,expires_in:n.expires_in||600,interval:n.interval||5}}async function Te(i,e,t){let r=`${i}/api/auth/oauth2/token`,n=Math.max(e.initialInterval||5,1),s=e.timeoutMs||3e5,o=Date.now();for(;Date.now()-o<s&&(await new Promise(d=>setTimeout(d,n*1e3)),!(Date.now()-o>=s));){t?.("polling");let c=new URLSearchParams({grant_type:ye,client_id:e.clientId,device_code:e.deviceCode,resource:e.resource}),l=await C(r,{method:"POST",body:c,retries:0});if(l.status===200){let d=l.data;if(!d.access_token)throw new Error("Token endpoint returned HTTP 200 without access_token");return d}if(l.status===429){let d=l.headers?.get?.("retry-after"),p=n+5;if(d){let S=parseInt(d,10);if(!isNaN(S)&&S>0)p=S;else{let G=Date.parse(d);if(!isNaN(G)){let H=Math.ceil((G-Date.now())/1e3);H>0&&(p=H)}}}let f=Math.max(0,s-(Date.now()-o)),y=Math.ceil(f/1e3);n=y>0?Math.min(p,60,y):0,t?.(`slow_down (rate_limited, retry-after: ${n}s)`);continue}let u=l.data||{},m=u.error||"unknown_error",a=u.error_description||m;switch(m){case"authorization_pending":continue;case"slow_down":n+=5,t?.(`slow_down (interval: ${n}s)`);continue;case"expired_token":throw new Error("Device code has expired. Please run `iwas login` again to obtain a new code.");case"access_denied":throw new Error("Authorization was denied by the user.");case"invalid_grant":throw new Error(`Invalid grant: ${a}. The device code may have already been used or revoked.`);case"invalid_client":throw new Error(`Invalid OAuth client: ${a}. Check your --client-id.`);default:if(l.status>=500){n=Math.min(n+2,30);continue}throw new Error(`Device authorization failed: ${a} (HTTP ${l.status})`)}}throw new Error("Device login timed out waiting for user authorization.")}async function Ne(i){let e=i?.logger||(v=>process.stdout.write(`${v}
+`)),t=i?.errorLogger||(v=>process.stderr.write(`${v}
+`)),r=O(i?.server),n=Se(r,i?.resource),s=(i?.clientId||R).trim(),o=(i?.scopes||me).trim(),c=i?.vault||new P,l=we(o);if(!l.valid)throw new Error(l.error||"Invalid OAuth scopes requested.");let u=await ke(r,{clientId:s,scope:o,resource:n});if(i?.json){let v={event:"device_authorization",user_code:u.user_code,verification_uri:u.verification_uri,verification_uri_complete:u.verification_uri_complete,expires_in:u.expires_in,interval:u.interval};e(JSON.stringify(v)),t(`
+\u{1F449} USER CODE: ${u.user_code}`),t(`\u{1F517} To verify, open: ${u.verification_uri_complete}
+`)}else e(`
+============================================================`),e("               IWAS MCP Device Authorization                "),e(`============================================================
+`),e("First, enter this code on the verification page:"),e(`
+    \u{1F449}  USER CODE:  \x1B[1m\x1B[32m${u.user_code}\x1B[0m
+`),e("To verify, open:"),e(`    \u{1F517}  ${u.verification_uri_complete}
+`),e("Waiting for approval in browser...");let m=i?.spawnFn||K.spawn,a=i?.browserOpener||(v=>ve(v,m,ie=>{i?.json?t(`\u26A0\uFE0F  ${ie}`):e(`\u26A0\uFE0F  ${ie}`)}));i?.noBrowser||a(u.verification_uri_complete);let d=i?.pollTimeoutMs??u.expires_in*1e3,p=await Te(r,{clientId:s,deviceCode:u.device_code,resource:n,initialInterval:u.interval,timeoutMs:d},v=>{!i?.json&&v.startsWith("slow_down")&&e("Rate limit reached: slowing poll interval.")}),f=q(p.access_token);if(!f||Object.keys(f).length===0)throw new Error("Server returned an opaque or non-JWT access token. Expected a JWT access token targeted for MCP resource.");let y=Array.isArray(f.aud)?f.aud:typeof f.aud=="string"?[f.aud]:[],S=n.replace(/\/+$/,"").toLowerCase();if(!y.some(v=>{try{return new URL(String(v)).href.replace(/\/+$/,"").toLowerCase()===S}catch{return String(v).toLowerCase()===S}}))throw new Error(`Access token audience [${y.join(", ")}] does not match MCP resource URL "${n}".`);let te=(typeof p.scope=="string"&&p.scope||typeof f.scope=="string"&&f.scope||"").split(/\s+/).filter(Boolean),re=o.split(/\s+/).filter(Boolean);if(re.filter(v=>te.includes(v)).filter(v=>v!==b.OFFLINE_ACCESS_SCOPE).length===0)throw new Error(`Access token lacks granted capability scopes (requested: [${re.join(", ")}], granted: [${te.join(", ")}]). At least one permission scope besides offline_access must be granted.`);let Y=typeof f.organizationId=="string"?f.organizationId:null,X=p.expires_in?Date.now()+p.expires_in*1e3:typeof f.exp=="number"?f.exp*1e3:Date.now()+36e5,D={serverUrl:r,clientId:s,accessToken:p.access_token,refreshToken:p.refresh_token,tokenType:p.token_type||"Bearer",scope:p.scope||o,resource:n,organizationId:Y,expiresAt:X,updatedAt:Date.now()},Q=x(r,s);await c.save(Q,D);let ne={profileKey:Q,serverUrl:r,clientId:s,organizationId:Y,scope:D.scope,resource:D.resource,expiresAt:X};if(i?.json){let v={event:"login_success",success:!0,...ne};e(JSON.stringify(v))}else e(`
+\u2705 Login successful!`),e(`- Profile:       ${Q}`),e(`- Server:        ${r}`),e(`- Client ID:     ${s}`),e(`- Organization:  ${Y||"(none / platform scope)"}`),e(`- Scopes:        ${D.scope||"none"}`),e(`- Resource:      ${n}`),e(`- Expires:       ${new Date(X).toISOString()}
+`);return ne}function Ee(i){if(i<=0)return"0s";let e=Math.floor(i/86400),t=Math.floor(i%86400/3600),r=Math.floor(i%3600/60),n=i%60,s=[];return e>0&&s.push(`${e}d`),t>0&&s.push(`${t}h`),r>0&&s.push(`${r}m`),(n>0||s.length===0)&&s.push(`${n}s`),s.join(" ")}async function Ue(i){let e=i?.logger||(a=>process.stdout.write(`${a}
+`)),t=O(i?.server),r=(i?.clientId||R).trim(),n=x(t,r),o=await(i?.vault||new P).load(n);if(!o){i?.json?e(JSON.stringify({authenticated:!1,profileKey:n,serverUrl:t,clientId:r})):(e(`No active session found for profile: ${n}`),e(`Run \`iwas login --server ${t}\` to authenticate.
+`));return}let c=M(o,60),l=Math.max(0,Math.round((o.expiresAt-Date.now())/1e3)),u=Ee(l),m={authenticated:!c,expired:c,profileKey:n,serverUrl:o.serverUrl,clientId:o.clientId,organizationId:o.organizationId,scope:o.scope,resource:o.resource,expiresAt:new Date(o.expiresAt).toISOString(),expiresInSeconds:l,expiresInFormatted:u};i?.json?e(JSON.stringify(m)):(e(`
+============================================================`),e("                   IWAS MCP Auth Status                     "),e(`============================================================
+`),e(`- Profile:       ${n}`),e(`- Server:        ${o.serverUrl}`),e(`- Client ID:     ${o.clientId}`),e(`- Status:        ${c?"\u{1F534} Expired":"\u{1F7E2} Active"}`),e(`- Organization:  ${o.organizationId||"(none / platform scope)"}`),e(`- Scopes:        ${o.scope||"none"}`),o.resource&&e(`- Resource:      ${o.resource}`),e(`- Expires:       ${m.expiresAt} (${u} remaining)
+`))}var h=I(require("fs")),k=I(require("path")),W=I(require("os")),F=require("crypto"),J=class extends Error{constructor(e){super(e),this.name="VaultLockError"}},B=class extends J{lockPath;timeoutMs;constructor(e,t){super(`Timed out waiting to acquire credentials lock at "${e}" after ${t}ms.`),this.name="VaultLockTimeoutError",this.lockPath=e,this.timeoutMs=t}},ze=6e4,je=6e4,Ve=50;function Pe(i){if(typeof i!="number"||!Number.isInteger(i)||i<=0)return!1;try{return process.kill(i,0),!0}catch(e){let t=e?.code;return t==="ESRCH"?!1:t==="EPERM"}}var L=class{lockPath;isCustomLockPath;timeoutMs;staleTimeoutMs;corruptLockGraceMs;retryIntervalMs;isProcessAlive;currentLockId=null;currentLockIno;constructor(e){if(e?.lockPath)this.lockPath=e.lockPath,this.isCustomLockPath=!0;else{let t=e?.configDir||process.env.XDG_CONFIG_HOME||k.default.join(W.default.homedir(),".config"),r=e?.configDir?e.configDir:k.default.join(t,"iwas");this.lockPath=k.default.join(r,"credentials.lock"),this.isCustomLockPath=!!e?.configDir}this.timeoutMs=e?.timeoutMs??ze,this.staleTimeoutMs=e?.staleTimeoutMs??je,this.corruptLockGraceMs=e?.corruptLockGraceMs??Math.min(this.staleTimeoutMs,1e4),this.retryIntervalMs=e?.retryIntervalMs??Ve,this.isProcessAlive=e?.isProcessAliveFn??Pe}isHeld(){return this.currentLockId!==null}getCurrentLockId(){return this.currentLockId}async acquire(){if(this.currentLockId)return;let e=k.default.dirname(this.lockPath),t=!1;if(!h.default.existsSync(e))try{h.default.mkdirSync(e,{recursive:!0,mode:448}),t=!0}catch{}if(!this.isCustomLockPath||t)try{h.default.chmodSync(e,448)}catch{}let r=Date.now(),n=(0,F.randomUUID)(),s=this.retryIntervalMs;for(;;){let o=null,c;try{o=h.default.openSync(this.lockPath,"wx",384),c=h.default.fstatSync(o).ino;let d={pid:process.pid,createdAt:Date.now(),lockId:n,hostname:W.default.hostname()};h.default.writeFileSync(o,JSON.stringify(d),"utf8"),h.default.closeSync(o),o=null,this.currentLockId=n,this.currentLockIno=c;return}catch(a){if(o!==null){try{h.default.closeSync(o)}catch{}try{let p=h.default.statSync(this.lockPath);(c===void 0||p.ino===c)&&p.size===0&&h.default.unlinkSync(this.lockPath)}catch{}}if(a?.code!=="EEXIST")throw a}if(this.tryCleanStaleLock(),Date.now()-r>=this.timeoutMs)throw new B(this.lockPath,this.timeoutMs);let u=Math.floor(Math.random()*25),m=Math.min(s+u,250);s=Math.min(s*1.5,200),await new Promise(a=>setTimeout(a,m))}}async release(){this.releaseSync()}releaseSync(){if(!this.currentLockId)return;let e=this.currentLockId,t=this.currentLockIno;this.currentLockId=null,this.currentLockIno=void 0;let r=k.default.dirname(this.lockPath),n=k.default.join(r,`.credentials.lock.release.${Date.now()}.${(0,F.randomUUID)()}`),s=!1;try{if(!h.default.existsSync(this.lockPath))return;try{h.default.linkSync(this.lockPath,n),s=!0}catch{this.releaseSyncLoose(e,t);return}let o=h.default.statSync(n);if(t!==void 0&&o.ino!==t)return;let c=h.default.readFileSync(n,"utf8"),l=null;try{l=JSON.parse(c)}catch{return}if(l&&l.lockId===e&&l.pid===process.pid){let u=h.default.statSync(this.lockPath);if(u.ino===o.ino&&u.nlink>=2)try{h.default.unlinkSync(this.lockPath)}catch{}}}catch{}finally{if(s)try{h.default.unlinkSync(n)}catch{}}}releaseSyncLoose(e,t){try{if(!h.default.existsSync(this.lockPath))return;let r=h.default.statSync(this.lockPath);if(t!==void 0&&r.ino!==t)return;let n=h.default.readFileSync(this.lockPath,"utf8"),s=null;try{s=JSON.parse(n)}catch{return}if(s&&s.lockId===e&&s.pid===process.pid){let o=h.default.statSync(this.lockPath);if(o.ino===r.ino&&o.mtimeMs===r.mtimeMs)try{h.default.unlinkSync(this.lockPath)}catch{}}}catch{}}cleanOrphanGuards(){try{let e=k.default.dirname(this.lockPath);if(!h.default.existsSync(e))return;let r=`.${k.default.basename(this.lockPath)}.`,n=h.default.readdirSync(e),s=/^(release|stale|corrupt)\.(\d+)\.([0-9a-fA-F-]{36})$/,o=null;try{o=h.default.statSync(this.lockPath)}catch{}let c=Date.now();for(let l of n){if(!l.startsWith(r))continue;let u=s.exec(l.slice(r.length));if(!u)continue;let m=Number(u[2]),a=k.default.join(e,l);try{let d=h.default.statSync(a);if(!d.isFile()||d.nlink>1&&o&&d.ino===o.ino)continue;c-m>this.staleTimeoutMs&&h.default.unlinkSync(a)}catch{}}}catch{}}async withLock(e){await this.acquire();try{return await e()}finally{await this.release()}}tryCleanStaleLock(){try{if(this.cleanOrphanGuards(),!h.default.existsSync(this.lockPath))return;let e=h.default.statSync(this.lockPath),t=null;try{let o=h.default.readFileSync(this.lockPath,"utf8");t=JSON.parse(o)}catch{Date.now()-e.mtimeMs>this.corruptLockGraceMs&&this.reclaimCorruptLock(e);return}if(!t||typeof t.createdAt!="number")return;let r=W.default.hostname(),n=!t.hostname||t.hostname===r,s=!1;n?s=!(typeof t.pid=="number"&&this.isProcessAlive(t.pid)):s=Date.now()-t.createdAt>this.staleTimeoutMs,s&&this.reclaimStaleLock(t.lockId,e)}catch{}}reclaimStaleLock(e,t){let r=k.default.dirname(this.lockPath),n=k.default.join(r,`.credentials.lock.stale.${Date.now()}.${(0,F.randomUUID)()}`);try{h.default.linkSync(this.lockPath,n);try{let s=h.default.readFileSync(n,"utf8");if(JSON.parse(s).lockId!==e)return;let c=h.default.statSync(this.lockPath);c.ino===t.ino&&c.nlink>=2&&h.default.unlinkSync(this.lockPath)}finally{try{h.default.unlinkSync(n)}catch{}}}catch{}}reclaimCorruptLock(e){let t=k.default.dirname(this.lockPath),r=k.default.join(t,`.credentials.lock.corrupt.${Date.now()}.${(0,F.randomUUID)()}`);try{h.default.linkSync(this.lockPath,r);try{let n=h.default.statSync(r);if(n.ino!==e.ino||n.size!==e.size||n.mtimeMs!==e.mtimeMs)return;try{let o=h.default.readFileSync(r,"utf8");JSON.parse(o);return}catch{}let s=h.default.statSync(this.lockPath);s.ino===e.ino&&s.nlink>=2&&h.default.unlinkSync(this.lockPath)}finally{try{h.default.unlinkSync(r)}catch{}}}catch{}}};async function qe(i,e,t){return await new L({lockPath:i,...t}).withLock(e)}var Ce=I(require("path"));var _=class extends Error{profileKey;reason;terminalError;constructor(e,t,r){let n=r?` (${r})`:"";super(`Re-authentication required for profile "${e}": ${t}${n}`),this.name="ReauthenticationRequiredError",this.profileKey=e,this.reason=t,this.terminalError=r}},We=60,Je=6e4,Be=6e4,ee=class{vault;safetyMarginSeconds;lockTimeoutMs;staleLockTimeoutMs;lockPath;fetchFn;logger;errorLogger;inFlightRefreshes=new Map;constructor(e){this.vault=e?.vault||new P,this.safetyMarginSeconds=e?.safetyMarginSeconds??We,this.lockTimeoutMs=e?.lockTimeoutMs??Je,this.staleLockTimeoutMs=e?.staleLockTimeoutMs??e?.staleTimeoutMs??Be,this.lockPath=e?.lockPath,this.fetchFn=e?.fetchFn,this.logger=e?.logger,this.errorLogger=e?.errorLogger}async getValidAccessToken(e){return(await this.getValidCredentials(e)).accessToken}async getValidCredentials(e){let t=await this.vault.load(e);if(!t)throw new _(e,"No credentials found in vault.");return M(t,this.safetyMarginSeconds)?await this.refreshWithSingleFlight(e,!1):t}async refresh(e){let t=this.inFlightRefreshes.get(e);return t?await t:await this.refreshWithSingleFlight(e,!0)}async refreshWithSingleFlight(e,t){let r=this.inFlightRefreshes.get(e);if(r&&!t)return await r;let n=this.executeRefreshWithLock(e,t);this.inFlightRefreshes.set(e,n);try{return await n}finally{this.inFlightRefreshes.delete(e)}}async executeRefreshWithLock(e,t){let r=this.lockPath||Ce.default.join(this.vault.getConfigDir(),"credentials.lock");return await new L({lockPath:r,timeoutMs:this.lockTimeoutMs,staleTimeoutMs:this.staleLockTimeoutMs}).withLock(async()=>{let s=await this.vault.load(e);if(!s)throw new _(e,"Credentials missing from vault.");return!t&&!M(s,this.safetyMarginSeconds)?(this.logger?.(`Token for profile "${e}" was already refreshed by another process.`),s):await this.performTokenExchange(e,s)})}async performTokenExchange(e,t){if(!t.refreshToken)throw new _(e,"Cannot refresh access token: No refresh token stored in credentials.");let r=`${t.serverUrl}/api/auth/oauth2/token`,n=new URLSearchParams;n.set("grant_type","refresh_token"),n.set("refresh_token",t.refreshToken),n.set("client_id",t.clientId),t.resource&&n.set("resource",t.resource);let s;try{let a=await C(r,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:n,retries:1,fetchFn:this.fetchFn});if(!a.ok)throw new T(`Token refresh request failed with HTTP ${a.status}`,a.status,a.data);s=a.data}catch(a){if(a instanceof T){let d=a.data&&typeof a.data=="object"?a.data:{},p=typeof d.error=="string"?d.error:"",f=typeof d.error_description=="string"?d.error_description:a.message,y=p==="invalid_grant"||p==="invalid_client",S=E(f,[t.refreshToken,t.accessToken]);if(this.errorLogger?.(`Token refresh rejected (${a.status}, ${p||"unknown"}): ${S}`),y){try{await this.vault.delete(e)}catch{}throw new _(e,`Refresh token rejected by authorization server: ${S}`,p)}throw new T(`Token refresh rejected (${a.status}): ${S}`,a.status,a.data)}throw this.errorLogger?.(`Token refresh network/transient error for profile "${e}": 
+        ${a instanceof Error?a.message:String(a)}`),a}if(!s||!s.access_token){let a=s?.error||"unknown_error",d=s?.error_description||"Missing access_token in token response.",p=E(d,[t.refreshToken,t.accessToken]);if(this.errorLogger?.(`Token response invalid for profile "${e}": ${p}`),a==="invalid_grant"||a==="invalid_client"){try{await this.vault.delete(e)}catch{}throw new _(e,p,a)}throw new Error(`Token refresh failed: ${p}`)}let o=q(s.access_token),c;"organizationId"in o?typeof o.organizationId=="string"?c=o.organizationId:o.organizationId===null?c=null:c=t.organizationId??null:c=t.organizationId??null;let l=s.expires_in?Date.now()+s.expires_in*1e3:typeof o.exp=="number"?o.exp*1e3:Date.now()+3600*1e3,u=s.refresh_token||t.refreshToken,m={serverUrl:t.serverUrl,clientId:t.clientId,accessToken:s.access_token,refreshToken:u,tokenType:s.token_type||t.tokenType||"Bearer",scope:s.scope||t.scope,resource:t.resource,organizationId:c,expiresAt:l,updatedAt:Date.now()};try{await this.vault.save(e,m)}catch(a){try{await this.vault.delete(e)}catch{}let d=a instanceof Error?a.message:String(a);throw this.errorLogger?.(`Failed to persist refreshed credentials for profile "${e}": ${d}`),new _(e,`Failed to persist refreshed credentials to vault: ${d}`,"persistence_failure")}return this.logger?.(`Successfully refreshed credentials for profile "${e}"
+       (expires: ${new Date(l).toISOString()}).`),m}};0&&(module.exports={CredentialVault,DEFAULT_CLI_CLIENT_ID,DEFAULT_KEYCHAIN_SERVICE,DEFAULT_READ_ONLY_SCOPES,DEFAULT_SCOPES,DEFAULT_SERVER_URL,DEVICE_CODE_GRANT_TYPE,DefaultKeychainRunner,HttpError,KeychainService,ReauthenticationRequiredError,TokenRefreshManager,VaultLock,VaultLockError,VaultLockTimeoutError,decodeJwtPayload,defaultIsProcessAlive,executeLogin,executeLogout,executeStatus,formatRemainingDuration,isCredentialExpired,isLocalhost,isValidStoredCredentials,normalizeProfileKey,openBrowser,pollDeviceToken,redactCredentials,requestDeviceCode,resolveAuthServerUrl,resolveMcpResourceUrl,sanitizeSecretString,sendRequest,validateScopes,withVaultLock});