@mcp-abap-adt/auth-providers 1.2.0 → 2.2.0

package/dist/providers/AuthorizationCodeProvider.js

@@ -7,12 +7,11 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthorizationCodeProvider = void 0;
-const interfaces_1 = require("@mcp-abap-adt/interfaces");
+const interfaces_auth_1 = require("@mcp-abap-adt/interfaces-auth");
 const browserAuth_1 = require("../auth/browserAuth");
 const tokenRefresher_1 = require("../auth/tokenRefresher");
+const strategies_1 = require("../strategies");
 const BaseTokenProvider_1 = require("./BaseTokenProvider");
-/** How long an interactive login may wait for its callback. */
-const LOGIN_TIMEOUT_MS = 30 * 1000;
 /**
  * Authorization Code token provider
  *
@@ -32,8 +31,6 @@ class AuthorizationCodeProvider extends BaseTokenProvider_1.BaseTokenProvider {
             hasRefreshToken: !!config.refreshToken,
             accessToken: this.formatToken(config.accessToken),
             refreshToken: this.formatToken(config.refreshToken),
-            browser: config.browser || 'none',
-            redirectPort: config.redirectPort || 3001,
         });
         const missingFields = [];
         if (!config.uaaUrl) {
@@ -75,56 +72,70 @@ class AuthorizationCodeProvider extends BaseTokenProvider_1.BaseTokenProvider {
         return super.getTokens();
     }
     getAuthType() {
-        return interfaces_1.AUTH_TYPE_AUTHORIZATION_CODE;
+        return interfaces_auth_1.AUTH_TYPE_AUTHORIZATION_CODE;
     }
     async performLogin() {
-        // Build authorization config
-        // If authorizationUrl is provided, use it; otherwise startBrowserAuth will build it from uaaUrl + clientId
         const authConfig = {
             uaaUrl: this.config.uaaUrl,
             uaaClientId: this.config.clientId,
             uaaClientSecret: this.config.clientSecret,
         };
-        // If pre-built URL provided, use it
-        if (this.config.authorizationUrl) {
-            authConfig.authorizationUrl = this.config.authorizationUrl;
+        const prebuilt = this.config.authorizationUrl;
+        const declaredRedirect = prebuilt
+            ? new URL(prebuilt).searchParams.get('redirect_uri')
+            : null;
+        const mismatch = (redirectUri) => `Pre-built authorizationUrl declares redirect_uri ${declaredRedirect}, ` +
+            `but the authorization strategy used ${redirectUri}, which does not match. ` +
+            'An ephemeral port cannot be used with a pre-built URL.';
+        // The provider owns the URL; the strategy owns where it is answered. The
+        // guard lives here rather than after the fact because a mismatched redirect
+        // produces no callback at all — checking the outcome would mean waiting for
+        // a timeout that explains nothing.
+        const request = {
+            logger: this.logger,
+            buildAuthorizationUrl: async (redirectUri) => {
+                if (prebuilt) {
+                    if (declaredRedirect && declaredRedirect !== redirectUri) {
+                        throw new Error(mismatch(redirectUri));
+                    }
+                    return prebuilt;
+                }
+                return (0, browserAuth_1.getJwtAuthorizationUrl)(authConfig, redirectUri);
+            },
+        };
+        // Constructed here means disposed here: whoever constructs, disposes.
+        const supplied = this.config.authorization;
+        const strategy = supplied ?? (0, strategies_1.browserCallbackStrategy)();
+        let outcome;
+        try {
+            outcome = await strategy.authorize(request);
         }
-        // Use provided browser or default to 'none' (prints URL to console)
-        const browser = this.config.browser || 'none';
-        const redirectPort = this.config.redirectPort || 3001;
-        // Build authorization URL for logging (same logic as in startBrowserAuth)
-        const authorizationUrl = authConfig.authorizationUrl ??
-            `${authConfig.uaaUrl}/oauth/authorize?client_id=${encodeURIComponent(authConfig.uaaClientId)}&redirect_uri=${encodeURIComponent(`http://localhost:${redirectPort}/callback`)}&response_type=code`;
-        this.logger?.info('[AuthorizationCodeProvider] Performing login via browser', {
-            browser,
-            redirectPort,
-            authorizationUrl,
-            uaaUrl: authConfig.uaaUrl,
-            clientId: authConfig.uaaClientId,
-        });
-        // One timeout, owned by whoever owns the socket.
-        //
-        // This used to race startBrowserAuth against a second timer of the same
-        // 30 seconds, so which fired was down to scheduling — and when the outer
-        // one won, the provider rejected while the callback port was still bound.
-        // That timer was never cleared either, keeping the event loop alive for the
-        // rest of the window after a login that succeeded in a second.
-        const result = await (0, browserAuth_1.startBrowserAuth)(authConfig, browser, this.logger || undefined, // Pass logger to browserAuth
-        redirectPort, LOGIN_TIMEOUT_MS);
-        this.logger?.info('[AuthorizationCodeProvider] Login completed', {
-            hasAccessToken: !!result.accessToken,
-            hasRefreshToken: !!result.refreshToken,
-            accessToken: this.formatToken(result.accessToken),
-            refreshToken: this.formatToken(result.refreshToken),
-            accessTokenLength: result.accessToken?.length || 0,
+        finally {
+            if (!supplied) {
+                // A cleanup failure must not replace the reason the login failed.
+                await strategy.dispose?.().catch((error) => {
+                    this.logger?.warn('[AuthorizationCodeProvider] dispose failed', {
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                });
+            }
+        }
+        // The second net. A strategy that never called the builder — `staticCodeStrategy`
+        // holds its payload already — passed the first check by not participating in
+        // it, and would otherwise reach the exchange with a redirect_uri the
+        // pre-built URL never advertised, earning an opaque `invalid_grant`.
+        if (declaredRedirect && declaredRedirect !== outcome.redirectUri) {
+            throw new Error(mismatch(outcome.redirectUri));
+        }
+        this.logger?.info('[AuthorizationCodeProvider] Code received', {
+            redirectUri: outcome.redirectUri,
         });
-        // Parse expiration from JWT
-        const expiresIn = this.calculateExpiresIn(result.accessToken);
+        const result = await (0, browserAuth_1.exchangeCodeForToken)(authConfig, outcome.payload, outcome.redirectUri, this.logger);
         return {
             authorizationToken: result.accessToken,
             refreshToken: result.refreshToken,
-            authType: interfaces_1.AUTH_TYPE_AUTHORIZATION_CODE,
-            expiresIn,
+            authType: interfaces_auth_1.AUTH_TYPE_AUTHORIZATION_CODE,
+            expiresIn: this.calculateExpiresIn(result.accessToken),
         };
     }
     async performRefresh() {
@@ -146,7 +157,7 @@ class AuthorizationCodeProvider extends BaseTokenProvider_1.BaseTokenProvider {
             return {
                 authorizationToken: result.accessToken,
                 refreshToken: result.refreshToken || this.refreshToken, // Keep old if new not provided
-                authType: interfaces_1.AUTH_TYPE_AUTHORIZATION_CODE,
+                authType: interfaces_auth_1.AUTH_TYPE_AUTHORIZATION_CODE,
                 expiresIn,
             };
         }

package/dist/providers/BaseTokenProvider.d.ts

@@ -7,7 +7,8 @@
  * - Expiration checking
  * - Automatic refresh/relogin
  */
-import type { ILogger, ITokenProvider, ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces';
+import type { ITokenProvider, ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces-auth';
+import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
 /**
  * Abstract base class for token providers
  *

package/dist/providers/BaseTokenProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BaseTokenProvider.d.ts","sourceRoot":"","sources":["../../src/providers/BaseTokenProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,OAAO,EACP,cAAc,EACd,YAAY,EACZ,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC;;;;;;;;GAQG;AACH,8BAAsB,iBAAkB,YAAW,cAAc;IAC/D,SAAS,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACtC,SAAS,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAChC,SAAS,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;IAChD,SAAS,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAE3B;;;;OAIG;IACH,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAWzD;;OAEG;IACH,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAMzD;;;OAGG;IACH,SAAS,CAAC,YAAY,IAAI,OAAO;IAyBjC;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;IAExD;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;IAE1D;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,WAAW,IAAI,eAAe;IAEjD;;;;;;;;OAQG;IACG,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC;IAyElC,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoC3E;;;OAGG;IACH,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IA0BlD;;;;OAIG;IACH,SAAS,CAAC,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IA0BnE;;;;OAIG;IACH,SAAS,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;CAShE"}
+{"version":3,"file":"BaseTokenProvider.d.ts","sourceRoot":"","sources":["../../src/providers/BaseTokenProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,YAAY,EACZ,eAAe,EAChB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D;;;;;;;;GAQG;AACH,8BAAsB,iBAAkB,YAAW,cAAc;IAC/D,SAAS,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACtC,SAAS,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAChC,SAAS,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;IAChD,SAAS,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAE3B;;;;OAIG;IACH,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAWzD;;OAEG;IACH,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAMzD;;;OAGG;IACH,SAAS,CAAC,YAAY,IAAI,OAAO;IAyBjC;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;IAExD;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;IAE1D;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,WAAW,IAAI,eAAe;IAEjD;;;;;;;;OAQG;IACG,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC;IAyElC,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoC3E;;;OAGG;IACH,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IA0BlD;;;;OAIG;IACH,SAAS,CAAC,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IA0BnE;;;;OAIG;IACH,SAAS,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;CAShE"}

package/dist/providers/ClientCredentialsProvider.d.ts

@@ -4,7 +4,7 @@
  * Uses client_credentials grant type for service-to-service authentication.
  * No browser required, no refresh token provided.
  */
-import type { ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces';
+import type { ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces-auth';
 import { BaseTokenProvider } from './BaseTokenProvider';
 export interface ClientCredentialsProviderConfig {
     uaaUrl: string;

package/dist/providers/ClientCredentialsProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ClientCredentialsProvider.d.ts","sourceRoot":"","sources":["../../src/providers/ClientCredentialsProvider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAG9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,+BAA+B;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,iBAAiB;IAC9D,OAAO,CAAC,MAAM,CAAkC;gBAEpC,MAAM,EAAE,+BAA+B;IAuB7C,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC;IAIxC,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAerC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAIxD"}
+{"version":3,"file":"ClientCredentialsProvider.d.ts","sourceRoot":"","sources":["../../src/providers/ClientCredentialsProvider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,+BAA+B;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,iBAAiB;IAC9D,OAAO,CAAC,MAAM,CAAkC;gBAEpC,MAAM,EAAE,+BAA+B;IAuB7C,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC;IAIxC,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAerC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAIxD"}

package/dist/providers/ClientCredentialsProvider.js

@@ -7,7 +7,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ClientCredentialsProvider = void 0;
-const interfaces_1 = require("@mcp-abap-adt/interfaces");
+const interfaces_auth_1 = require("@mcp-abap-adt/interfaces-auth");
 const clientCredentialsAuth_1 = require("../auth/clientCredentialsAuth");
 const BaseTokenProvider_1 = require("./BaseTokenProvider");
 /**
@@ -42,14 +42,14 @@ class ClientCredentialsProvider extends BaseTokenProvider_1.BaseTokenProvider {
         return super.getTokens();
     }
     getAuthType() {
-        return interfaces_1.AUTH_TYPE_CLIENT_CREDENTIALS;
+        return interfaces_auth_1.AUTH_TYPE_CLIENT_CREDENTIALS;
     }
     async performLogin() {
         const result = await (0, clientCredentialsAuth_1.getTokenWithClientCredentials)(this.config.uaaUrl, this.config.clientId, this.config.clientSecret);
         return {
             authorizationToken: result.accessToken,
             refreshToken: undefined, // client_credentials doesn't provide refresh token
-            authType: interfaces_1.AUTH_TYPE_CLIENT_CREDENTIALS,
+            authType: interfaces_auth_1.AUTH_TYPE_CLIENT_CREDENTIALS,
             expiresIn: result.expiresIn,
         };
     }

package/dist/providers/DeviceFlowProvider.d.ts

@@ -4,7 +4,8 @@
  * Uses OAuth2 Device Flow for devices without browser or input capabilities.
  * User authorizes on another device by entering a code.
  */
-import type { ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces';
+import type { ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces-auth';
+import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
 import { BaseTokenProvider } from './BaseTokenProvider';
 export interface DeviceFlowProviderConfig {
     uaaUrl: string;
@@ -13,6 +14,7 @@ export interface DeviceFlowProviderConfig {
     scope?: string;
     accessToken?: string;
     refreshToken?: string;
+    logger?: ILogger;
 }
 /**
  * Device Flow token provider

package/dist/providers/DeviceFlowProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DeviceFlowProvider.d.ts","sourceRoot":"","sources":["../../src/providers/DeviceFlowProvider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAO9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,iBAAiB;IACvD,OAAO,CAAC,MAAM,CAA2B;gBAE7B,MAAM,EAAE,wBAAwB;IAa5C,SAAS,CAAC,WAAW,IAAI,eAAe;cAOxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cA0CrC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CA2BxD"}
+{"version":3,"file":"DeviceFlowProvider.d.ts","sourceRoot":"","sources":["../../src/providers/DeviceFlowProvider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAO9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,iBAAiB;IACvD,OAAO,CAAC,MAAM,CAA2B;gBAE7B,MAAM,EAAE,wBAAwB;IAc5C,SAAS,CAAC,WAAW,IAAI,eAAe;cAOxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAyCrC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CA2BxD"}

package/dist/providers/DeviceFlowProvider.js

@@ -7,7 +7,8 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DeviceFlowProvider = void 0;
-const interfaces_1 = require("@mcp-abap-adt/interfaces");
+const interfaces_auth_1 = require("@mcp-abap-adt/interfaces-auth");
+const announce_1 = require("../auth/announce");
 const deviceFlowAuth_1 = require("../auth/deviceFlowAuth");
 const tokenRefresher_1 = require("../auth/tokenRefresher");
 const BaseTokenProvider_1 = require("./BaseTokenProvider");
@@ -22,6 +23,7 @@ class DeviceFlowProvider extends BaseTokenProvider_1.BaseTokenProvider {
     constructor(config) {
         super();
         this.config = config;
+        this.logger = config.logger;
         if (config.accessToken) {
             this.authorizationToken = config.accessToken;
             this.expiresAt = this.parseExpirationFromJWT(config.accessToken);
@@ -34,28 +36,29 @@ class DeviceFlowProvider extends BaseTokenProvider_1.BaseTokenProvider {
         // Device Flow is not a standard grant type in OAuth2 spec
         // We'll use a custom type or map it to authorization_code
         // For now, using authorization_code as it's similar
-        return interfaces_1.AUTH_TYPE_AUTHORIZATION_CODE;
+        return interfaces_auth_1.AUTH_TYPE_AUTHORIZATION_CODE;
     }
     async performLogin() {
         // Initiate device flow
-        const deviceFlow = await (0, deviceFlowAuth_1.initiateDeviceFlow)(this.config.uaaUrl, this.config.clientId, this.config.scope, undefined);
-        // Display user code and verification URI
-        console.log('\n🔐 Device Flow Authorization');
-        console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
-        console.log(`📱 Go to: ${deviceFlow.verificationUri}`);
+        const deviceFlow = await (0, deviceFlowAuth_1.initiateDeviceFlow)(this.config.uaaUrl, this.config.clientId, this.config.scope, this.logger);
+        // Display user code and verification URI. This is a prompt the user must
+        // see to complete the flow, not a log line — it goes to the logger when
+        // there is one and to stderr otherwise, never to stdout.
+        const announce = (0, announce_1.announcer)(this.logger);
+        announce('Device Flow Authorization');
+        announce(`Go to: ${deviceFlow.verificationUri}`);
         if (deviceFlow.verificationUriComplete) {
-            console.log(`   Or use complete URL: ${deviceFlow.verificationUriComplete}`);
+            announce(`Or use complete URL: ${deviceFlow.verificationUriComplete}`);
         }
-        console.log(`🔑 Enter code: ${deviceFlow.userCode}`);
-        console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
-        console.log('⏳ Waiting for authorization...\n');
+        announce(`Enter code: ${deviceFlow.userCode}`);
+        announce('Waiting for authorization...');
         // Poll for tokens
-        const result = await (0, deviceFlowAuth_1.pollForDeviceTokens)(this.config.uaaUrl, this.config.clientId, this.config.clientSecret, deviceFlow.deviceCode, deviceFlow.interval, undefined);
+        const result = await (0, deviceFlowAuth_1.pollForDeviceTokens)(this.config.uaaUrl, this.config.clientId, this.config.clientSecret, deviceFlow.deviceCode, deviceFlow.interval, this.logger);
         const expiresIn = this.calculateExpiresIn(result.accessToken);
         return {
             authorizationToken: result.accessToken,
             refreshToken: result.refreshToken,
-            authType: interfaces_1.AUTH_TYPE_AUTHORIZATION_CODE, // Device flow maps to authorization_code
+            authType: interfaces_auth_1.AUTH_TYPE_AUTHORIZATION_CODE, // Device flow maps to authorization_code
             expiresIn,
         };
     }
@@ -70,7 +73,7 @@ class DeviceFlowProvider extends BaseTokenProvider_1.BaseTokenProvider {
             return {
                 authorizationToken: result.accessToken,
                 refreshToken: result.refreshToken || this.refreshToken,
-                authType: interfaces_1.AUTH_TYPE_AUTHORIZATION_CODE,
+                authType: interfaces_auth_1.AUTH_TYPE_AUTHORIZATION_CODE,
                 expiresIn,
             };
         }

package/dist/providers/OidcBrowserProvider.d.ts

@@ -1,20 +1,19 @@
 /**
  * OIDC Authorization Code Provider (with PKCE)
  */
-import type { ILogger, ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces';
+import type { IAuthorizationStrategy, ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces-auth';
+import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
+import type { OidcCallbackResult } from '../auth/oidcBrowserAuth';
 import { BaseTokenProvider } from './BaseTokenProvider';
 export interface OidcBrowserProviderConfig {
     issuerUrl?: string;
     clientId: string;
     clientSecret?: string;
     scopes?: string[];
-    browser?: string;
-    redirectPort?: number;
-    redirectUri?: string;
-    authorizationCode?: string;
-    authorizationCodeProvider?: () => Promise<string>;
     authorizationEndpoint?: string;
     tokenEndpoint?: string;
+    /** How the login is conducted. Omitted means a browser callback on the default port. */
+    authorization?: IAuthorizationStrategy<OidcCallbackResult>;
     accessToken?: string;
     refreshToken?: string;
     logger?: ILogger;
@@ -25,6 +24,5 @@ export declare class OidcBrowserProvider extends BaseTokenProvider {
     protected getAuthType(): OAuth2GrantType;
     protected performLogin(): Promise<ITokenResult>;
     protected performRefresh(): Promise<ITokenResult>;
-    private resolveAuthorizationCode;
 }
 //# sourceMappingURL=OidcBrowserProvider.d.ts.map

package/dist/providers/OidcBrowserProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OidcBrowserProvider.d.ts","sourceRoot":"","sources":["../../src/providers/OidcBrowserProvider.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,OAAO,EACP,YAAY,EACZ,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAMlC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,yBAAyB;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yBAAyB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,mBAAoB,SAAQ,iBAAiB;IACxD,OAAO,CAAC,MAAM,CAA4B;gBAE9B,MAAM,EAAE,yBAAyB;IAc7C,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAsFrC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;YAoCzC,wBAAwB;CA8BvC"}
+{"version":3,"file":"OidcBrowserProvider.d.ts","sourceRoot":"","sources":["../../src/providers/OidcBrowserProvider.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,sBAAsB,EACtB,YAAY,EACZ,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAKlE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,yBAAyB;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wFAAwF;IACxF,aAAa,CAAC,EAAE,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,mBAAoB,SAAQ,iBAAiB;IACxD,OAAO,CAAC,MAAM,CAA4B;gBAE9B,MAAM,EAAE,yBAAyB;IAc7C,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAyFrC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAsCxD"}

package/dist/providers/OidcBrowserProvider.js

@@ -4,11 +4,11 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OidcBrowserProvider = void 0;
-const interfaces_1 = require("@mcp-abap-adt/interfaces");
-const oidcBrowserAuth_1 = require("../auth/oidcBrowserAuth");
+const interfaces_auth_1 = require("@mcp-abap-adt/interfaces-auth");
 const oidcDiscovery_1 = require("../auth/oidcDiscovery");
 const oidcPkce_1 = require("../auth/oidcPkce");
 const oidcToken_1 = require("../auth/oidcToken");
+const strategies_1 = require("../strategies");
 const BaseTokenProvider_1 = require("./BaseTokenProvider");
 class OidcBrowserProvider extends BaseTokenProvider_1.BaseTokenProvider {
     config;
@@ -25,57 +25,69 @@ class OidcBrowserProvider extends BaseTokenProvider_1.BaseTokenProvider {
         }
     }
     getAuthType() {
-        return interfaces_1.AUTH_TYPE_AUTHORIZATION_CODE_PKCE;
+        return interfaces_auth_1.AUTH_TYPE_AUTHORIZATION_CODE_PKCE;
     }
     async performLogin() {
-        const needsAuthorizationEndpoint = !this.config.authorizationCode && !this.config.authorizationCodeProvider;
-        const requiresDiscovery = (needsAuthorizationEndpoint && !this.config.authorizationEndpoint) ||
-            !this.config.tokenEndpoint;
+        // One memoised discovery per login, started on first use rather than up
+        // front: a strategy that already holds a code must not drag in a request —
+        // nor the `issuerUrl` requirement that comes with it.
         let discovery = null;
-        if (requiresDiscovery) {
-            if (!this.config.issuerUrl) {
-                throw new Error('OIDC issuerUrl is required when discovery is used');
+        const discover = () => {
+            if (!discovery) {
+                if (!this.config.issuerUrl) {
+                    throw new Error('OIDC issuerUrl is required when discovery is used');
+                }
+                discovery = (0, oidcDiscovery_1.discoverOidc)(this.config.issuerUrl, this.logger);
             }
-            discovery = await (0, oidcDiscovery_1.discoverOidc)(this.config.issuerUrl, this.logger);
+            return discovery;
+        };
+        const verifier = (0, oidcPkce_1.generatePkceVerifier)();
+        const challenge = (0, oidcPkce_1.generatePkceChallenge)(verifier);
+        const scope = (this.config.scopes && this.config.scopes.length > 0
+            ? this.config.scopes
+            : ['openid', 'profile', 'email']).join(' ');
+        const request = {
+            logger: this.logger,
+            buildAuthorizationUrl: async (redirectUri) => {
+                const endpoint = this.config.authorizationEndpoint ??
+                    (await discover()).authorization_endpoint;
+                if (!endpoint) {
+                    throw new Error('OIDC authorization endpoint is required (authorizationEndpoint or discovery)');
+                }
+                const params = new URLSearchParams();
+                params.append('response_type', 'code');
+                params.append('client_id', this.config.clientId);
+                params.append('redirect_uri', redirectUri);
+                params.append('scope', scope);
+                params.append('code_challenge', challenge);
+                params.append('code_challenge_method', 'S256');
+                return `${endpoint}?${params.toString()}`;
+            },
+        };
+        const supplied = this.config.authorization;
+        const strategy = supplied ?? (0, strategies_1.oidcCallbackStrategy)();
+        let outcome;
+        try {
+            outcome = await strategy.authorize(request);
         }
-        const authorizationEndpoint = needsAuthorizationEndpoint
-            ? this.config.authorizationEndpoint || discovery?.authorization_endpoint
-            : undefined;
-        const tokenEndpoint = this.config.tokenEndpoint || discovery?.token_endpoint;
-        if (needsAuthorizationEndpoint && !authorizationEndpoint) {
-            throw new Error('OIDC authorization endpoint is required (authorizationEndpoint or discovery)');
+        finally {
+            if (!supplied) {
+                await strategy.dispose?.().catch((error) => {
+                    this.logger?.warn('[OidcBrowserProvider] dispose failed', {
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                });
+            }
         }
+        const tokenEndpoint = this.config.tokenEndpoint ?? (await discover()).token_endpoint;
         if (!tokenEndpoint) {
             throw new Error('OIDC token endpoint is required (tokenEndpoint or discovery)');
         }
-        const redirectPort = this.config.redirectPort || 3001;
-        const redirectUri = this.config.redirectUri || `http://localhost:${redirectPort}/callback`;
-        if (needsAuthorizationEndpoint && this.config.redirectUri) {
-            if (!redirectUri.startsWith('http://localhost:')) {
-                throw new Error('OIDC redirectUri must be localhost for browser callback flow');
-            }
-        }
-        const scope = (this.config.scopes && this.config.scopes.length > 0
-            ? this.config.scopes
-            : ['openid', 'profile', 'email']).join(' ');
-        const verifier = (0, oidcPkce_1.generatePkceVerifier)();
-        const challenge = (0, oidcPkce_1.generatePkceChallenge)(verifier);
-        const params = new URLSearchParams();
-        params.append('response_type', 'code');
-        params.append('client_id', this.config.clientId);
-        params.append('redirect_uri', redirectUri);
-        params.append('scope', scope);
-        params.append('code_challenge', challenge);
-        params.append('code_challenge_method', 'S256');
-        const authorizationUrl = needsAuthorizationEndpoint
-            ? `${authorizationEndpoint}?${params.toString()}`
-            : undefined;
-        const code = await this.resolveAuthorizationCode(authorizationUrl, redirectPort);
-        const tokens = await (0, oidcToken_1.exchangeAuthorizationCode)(tokenEndpoint, this.config.clientId, this.config.clientSecret, code, redirectUri, verifier, this.logger);
+        const tokens = await (0, oidcToken_1.exchangeAuthorizationCode)(tokenEndpoint, this.config.clientId, this.config.clientSecret, outcome.payload.code, outcome.redirectUri, verifier, this.logger);
         return {
             authorizationToken: tokens.accessToken,
             refreshToken: tokens.refreshToken,
-            authType: interfaces_1.AUTH_TYPE_AUTHORIZATION_CODE_PKCE,
+            authType: interfaces_auth_1.AUTH_TYPE_AUTHORIZATION_CODE_PKCE,
             expiresIn: tokens.expiresIn,
             tokenType: 'jwt',
         };
@@ -91,7 +103,10 @@ class OidcBrowserProvider extends BaseTokenProvider_1.BaseTokenProvider {
             }
             discovery = await (0, oidcDiscovery_1.discoverOidc)(this.config.issuerUrl, this.logger);
         }
-        const tokenEndpoint = this.config.tokenEndpoint || discovery?.token_endpoint;
+        // `??`, matching the `=== undefined` gate above and the login path: `||`
+        // treated a configured-but-empty endpoint as absent while the gate had
+        // already decided it was present, so the two disagreed about the same value.
+        const tokenEndpoint = this.config.tokenEndpoint ?? discovery?.token_endpoint;
         if (!tokenEndpoint) {
             throw new Error('OIDC token endpoint is required (tokenEndpoint or discovery)');
         }
@@ -99,28 +114,10 @@ class OidcBrowserProvider extends BaseTokenProvider_1.BaseTokenProvider {
         return {
             authorizationToken: tokens.accessToken,
             refreshToken: tokens.refreshToken || this.refreshToken,
-            authType: interfaces_1.AUTH_TYPE_AUTHORIZATION_CODE_PKCE,
+            authType: interfaces_auth_1.AUTH_TYPE_AUTHORIZATION_CODE_PKCE,
             expiresIn: tokens.expiresIn,
             tokenType: 'jwt',
         };
     }
-    async resolveAuthorizationCode(authorizationUrl, redirectPort) {
-        if (this.config.authorizationCode) {
-            return this.config.authorizationCode;
-        }
-        if (this.config.authorizationCodeProvider) {
-            const code = await this.config.authorizationCodeProvider();
-            if (!code) {
-                throw new Error('Authorization code provider returned empty value');
-            }
-            return code;
-        }
-        if (!authorizationUrl) {
-            throw new Error('OIDC authorization URL is required when using browser flow');
-        }
-        const browser = this.config.browser || 'auto';
-        const { code } = await (0, oidcBrowserAuth_1.startOidcBrowserAuth)(authorizationUrl, browser, this.logger, redirectPort);
-        return code;
-    }
 }
 exports.OidcBrowserProvider = OidcBrowserProvider;

package/dist/providers/OidcDeviceFlowProvider.d.ts

@@ -1,7 +1,8 @@
 /**
  * OIDC Device Flow Provider
  */
-import type { ILogger, ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces';
+import type { ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces-auth';
+import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
 import { BaseTokenProvider } from './BaseTokenProvider';
 export interface OidcDeviceFlowProviderConfig {
     issuerUrl?: string;

package/dist/providers/OidcDeviceFlowProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OidcDeviceFlowProvider.d.ts","sourceRoot":"","sources":["../../src/providers/OidcDeviceFlowProvider.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,OAAO,EACP,YAAY,EACZ,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAQlC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,4BAA4B;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,sBAAuB,SAAQ,iBAAiB;IAC3D,OAAO,CAAC,MAAM,CAA+B;gBAEjC,MAAM,EAAE,4BAA4B;IAchD,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAuErC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAqCxD"}
+{"version":3,"file":"OidcDeviceFlowProvider.d.ts","sourceRoot":"","sources":["../../src/providers/OidcDeviceFlowProvider.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAQ9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,4BAA4B;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,sBAAuB,SAAQ,iBAAiB;IAC3D,OAAO,CAAC,MAAM,CAA+B;gBAEjC,MAAM,EAAE,4BAA4B;IAchD,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAwErC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAqCxD"}

package/dist/providers/OidcDeviceFlowProvider.js

@@ -4,7 +4,8 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OidcDeviceFlowProvider = void 0;
-const interfaces_1 = require("@mcp-abap-adt/interfaces");
+const interfaces_auth_1 = require("@mcp-abap-adt/interfaces-auth");
+const announce_1 = require("../auth/announce");
 const oidcDiscovery_1 = require("../auth/oidcDiscovery");
 const oidcToken_1 = require("../auth/oidcToken");
 const BaseTokenProvider_1 = require("./BaseTokenProvider");
@@ -23,7 +24,7 @@ class OidcDeviceFlowProvider extends BaseTokenProvider_1.BaseTokenProvider {
         }
     }
     getAuthType() {
-        return interfaces_1.AUTH_TYPE_AUTHORIZATION_CODE;
+        return interfaces_auth_1.AUTH_TYPE_AUTHORIZATION_CODE;
     }
     async performLogin() {
         if (!this.config.deviceAuthorizationEndpoint &&
@@ -50,20 +51,21 @@ class OidcDeviceFlowProvider extends BaseTokenProvider_1.BaseTokenProvider {
         }
         const scope = this.config.scopes?.join(' ');
         const deviceFlow = await (0, oidcToken_1.initiateDeviceAuthorization)(deviceAuthorizationEndpoint, this.config.clientId, scope, this.logger);
-        // Manual user guidance
-        console.log('');
-        console.log('OIDC device authorization');
-        console.log('Go to:', deviceFlow.verificationUri);
+        // Manual user guidance. This is a prompt the user must see to complete
+        // the flow, not a log line — it goes to the logger when there is one and
+        // to stderr otherwise, never to stdout.
+        const announce = (0, announce_1.announcer)(this.logger);
+        announce('OIDC device authorization');
+        announce(`Go to: ${deviceFlow.verificationUri}`);
         if (deviceFlow.verificationUriComplete) {
-            console.log('Or use:', deviceFlow.verificationUriComplete);
+            announce(`Or use: ${deviceFlow.verificationUriComplete}`);
         }
-        console.log('Enter code:', deviceFlow.userCode);
-        console.log('');
+        announce(`Enter code: ${deviceFlow.userCode}`);
         const tokens = await (0, oidcToken_1.pollDeviceTokens)(tokenEndpoint, this.config.clientId, this.config.clientSecret, deviceFlow.deviceCode, deviceFlow.interval || 5, this.logger);
         return {
             authorizationToken: tokens.accessToken,
             refreshToken: tokens.refreshToken,
-            authType: interfaces_1.AUTH_TYPE_AUTHORIZATION_CODE,
+            authType: interfaces_auth_1.AUTH_TYPE_AUTHORIZATION_CODE,
             expiresIn: tokens.expiresIn,
             tokenType: 'jwt',
         };
@@ -90,7 +92,7 @@ class OidcDeviceFlowProvider extends BaseTokenProvider_1.BaseTokenProvider {
         return {
             authorizationToken: tokens.accessToken,
             refreshToken: tokens.refreshToken || this.refreshToken,
-            authType: interfaces_1.AUTH_TYPE_AUTHORIZATION_CODE,
+            authType: interfaces_auth_1.AUTH_TYPE_AUTHORIZATION_CODE,
             expiresIn: tokens.expiresIn,
             tokenType: 'jwt',
         };

package/dist/providers/OidcPasswordProvider.d.ts

@@ -1,7 +1,8 @@
 /**
  * OIDC Password Grant Provider
  */
-import type { ILogger, ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces';
+import type { ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces-auth';
+import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
 import { BaseTokenProvider } from './BaseTokenProvider';
 export interface OidcPasswordProviderConfig {
     issuerUrl?: string;

package/dist/providers/OidcPasswordProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OidcPasswordProvider.d.ts","sourceRoot":"","sources":["../../src/providers/OidcPasswordProvider.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,OAAO,EACP,YAAY,EACZ,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,0BAA0B;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,oBAAqB,SAAQ,iBAAiB;IACzD,OAAO,CAAC,MAAM,CAA6B;gBAE/B,MAAM,EAAE,0BAA0B;IAc9C,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAsCrC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAsCxD"}
+{"version":3,"file":"OidcPasswordProvider.d.ts","sourceRoot":"","sources":["../../src/providers/OidcPasswordProvider.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAG9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,0BAA0B;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,oBAAqB,SAAQ,iBAAiB;IACzD,OAAO,CAAC,MAAM,CAA6B;gBAE/B,MAAM,EAAE,0BAA0B;IAc9C,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAsCrC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAsCxD"}