@mcp-z/oauth-microsoft 1.0.0

package/dist/cjs/providers/device-code.js

@@ -0,0 +1,896 @@
+/**
+ * Device Code OAuth Implementation for Microsoft
+ *
+ * Implements OAuth 2.0 Device Authorization Grant (RFC 8628) for headless/limited-input devices.
+ * Designed for scenarios where interactive browser flows are impractical (SSH sessions, CI/CD, etc.).
+ *
+ * Flow:
+ * 1. Request device code from Microsoft endpoint
+ * 2. Display user_code and verification_uri to user
+ * 3. Poll token endpoint until user completes authentication
+ * 4. Cache access token + refresh token to storage
+ * 5. Refresh tokens when expired
+ *
+ * Similar to service accounts in usage pattern: single static identity, minimal account management.
+ */ "use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "DeviceCodeProvider", {
+    enumerable: true,
+    get: function() {
+        return DeviceCodeProvider;
+    }
+});
+var _oauth = require("@mcp-z/oauth");
+var _open = /*#__PURE__*/ _interop_require_default(require("open"));
+var _fetchwithtimeoutts = require("../lib/fetch-with-timeout.js");
+function _array_like_to_array(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_without_holes(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array(arr);
+}
+function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
+    }
+}
+function _async_to_generator(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _class_call_check(instance, Constructor) {
+    if (!(instance instanceof Constructor)) {
+        throw new TypeError("Cannot call a class as a function");
+    }
+}
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _instanceof(left, right) {
+    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
+        return !!right[Symbol.hasInstance](left);
+    } else {
+        return left instanceof right;
+    }
+}
+function _interop_require_default(obj) {
+    return obj && obj.__esModule ? obj : {
+        default: obj
+    };
+}
+function _iterable_to_array(iter) {
+    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
+}
+function _non_iterable_spread() {
+    throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _object_spread(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property(target, key, source[key]);
+        });
+    }
+    return target;
+}
+function ownKeys(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        if (enumerableOnly) {
+            symbols = symbols.filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(object, sym).enumerable;
+            });
+        }
+        keys.push.apply(keys, symbols);
+    }
+    return keys;
+}
+function _object_spread_props(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) {
+        Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    } else {
+        ownKeys(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+        });
+    }
+    return target;
+}
+function _to_consumable_array(arr) {
+    return _array_without_holes(arr) || _iterable_to_array(arr) || _unsupported_iterable_to_array(arr) || _non_iterable_spread();
+}
+function _unsupported_iterable_to_array(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array(o, minLen);
+}
+function _ts_generator(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
+        }
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+var DeviceCodeProvider = /*#__PURE__*/ function() {
+    "use strict";
+    function DeviceCodeProvider(config) {
+        _class_call_check(this, DeviceCodeProvider);
+        this.config = config;
+    }
+    var _proto = DeviceCodeProvider.prototype;
+    /**
+   * Start device code flow and poll for token
+   *
+   * 1. POST to /devicecode endpoint to get device_code and user_code
+   * 2. Display verification instructions to user
+   * 3. Poll /token endpoint every interval seconds
+   * 4. Handle authorization_pending, slow_down, expired_token errors
+   * 5. Return token when user completes authentication
+   */ _proto.startDeviceCodeFlow = function startDeviceCodeFlow(accountId) {
+        return _async_to_generator(function() {
+            var _this_config, clientId, tenantId, scope, logger, headless, deviceCodeEndpoint, deviceCodeResponse, errorText, deviceCodeData, device_code, user_code, verification_uri, verification_uri_complete, expires_in, interval, urlToOpen, error;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        _this_config = this.config, clientId = _this_config.clientId, tenantId = _this_config.tenantId, scope = _this_config.scope, logger = _this_config.logger, headless = _this_config.headless;
+                        // Step 1: Request device code
+                        deviceCodeEndpoint = "https://login.microsoftonline.com/".concat(tenantId, "/oauth2/v2.0/devicecode");
+                        logger.debug('Requesting device code', {
+                            endpoint: deviceCodeEndpoint
+                        });
+                        return [
+                            4,
+                            (0, _fetchwithtimeoutts.fetchWithTimeout)(deviceCodeEndpoint, {
+                                method: 'POST',
+                                headers: {
+                                    'Content-Type': 'application/x-www-form-urlencoded'
+                                },
+                                body: new URLSearchParams({
+                                    client_id: clientId,
+                                    scope: scope
+                                })
+                            })
+                        ];
+                    case 1:
+                        deviceCodeResponse = _state.sent();
+                        if (!!deviceCodeResponse.ok) return [
+                            3,
+                            3
+                        ];
+                        return [
+                            4,
+                            deviceCodeResponse.text()
+                        ];
+                    case 2:
+                        errorText = _state.sent();
+                        throw new Error("Device code request failed (HTTP ".concat(deviceCodeResponse.status, "): ").concat(errorText));
+                    case 3:
+                        return [
+                            4,
+                            deviceCodeResponse.json()
+                        ];
+                    case 4:
+                        deviceCodeData = _state.sent();
+                        device_code = deviceCodeData.device_code, user_code = deviceCodeData.user_code, verification_uri = deviceCodeData.verification_uri, verification_uri_complete = deviceCodeData.verification_uri_complete, expires_in = deviceCodeData.expires_in, interval = deviceCodeData.interval;
+                        // Step 2: Display instructions to user
+                        logger.info('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
+                        logger.info('Device code authentication required');
+                        logger.info('');
+                        logger.info("Please visit: ".concat(verification_uri_complete || verification_uri));
+                        logger.info("And enter code: ".concat(user_code));
+                        logger.info('');
+                        logger.info("Code expires in ".concat(expires_in, " seconds"));
+                        logger.info('Waiting for authentication...');
+                        logger.info('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
+                        if (!!headless) return [
+                            3,
+                            8
+                        ];
+                        urlToOpen = verification_uri_complete || verification_uri;
+                        _state.label = 5;
+                    case 5:
+                        _state.trys.push([
+                            5,
+                            7,
+                            ,
+                            8
+                        ]);
+                        return [
+                            4,
+                            (0, _open.default)(urlToOpen)
+                        ];
+                    case 6:
+                        _state.sent();
+                        logger.debug('Opened browser to verification URL', {
+                            url: urlToOpen
+                        });
+                        return [
+                            3,
+                            8
+                        ];
+                    case 7:
+                        error = _state.sent();
+                        logger.debug('Failed to open browser', {
+                            error: _instanceof(error, Error) ? error.message : String(error)
+                        });
+                        return [
+                            3,
+                            8
+                        ];
+                    case 8:
+                        return [
+                            4,
+                            this.pollForToken(device_code, interval || 5, accountId)
+                        ];
+                    case 9:
+                        // Step 3: Poll token endpoint
+                        return [
+                            2,
+                            _state.sent()
+                        ];
+                }
+            });
+        }).call(this);
+    };
+    /**
+   * Poll Microsoft token endpoint until user completes authentication
+   *
+   * Handles Microsoft-specific error codes:
+   * - authorization_pending: User hasn't completed auth yet, keep polling
+   * - slow_down: Increase polling interval by 5 seconds
+   * - authorization_declined: User denied authorization
+   * - expired_token: Device code expired (typically after 15 minutes)
+   */ _proto.pollForToken = function pollForToken(deviceCode, intervalSeconds, accountId) {
+        return _async_to_generator(function() {
+            var _this_config, clientId, tenantId, logger, service, tokenStore, tokenEndpoint, currentInterval, startTime, response, responseData, tokenData, token, error, errorDescription;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        _this_config = this.config, clientId = _this_config.clientId, tenantId = _this_config.tenantId, logger = _this_config.logger, service = _this_config.service, tokenStore = _this_config.tokenStore;
+                        tokenEndpoint = "https://login.microsoftonline.com/".concat(tenantId, "/oauth2/v2.0/token");
+                        currentInterval = intervalSeconds;
+                        startTime = Date.now();
+                        _state.label = 1;
+                    case 1:
+                        if (!true) return [
+                            3,
+                            7
+                        ];
+                        // Wait for polling interval
+                        return [
+                            4,
+                            new Promise(function(resolve) {
+                                return setTimeout(resolve, currentInterval * 1000);
+                            })
+                        ];
+                    case 2:
+                        _state.sent();
+                        logger.debug('Polling for token', {
+                            elapsed: Math.floor((Date.now() - startTime) / 1000),
+                            interval: currentInterval
+                        });
+                        return [
+                            4,
+                            (0, _fetchwithtimeoutts.fetchWithTimeout)(tokenEndpoint, {
+                                method: 'POST',
+                                headers: {
+                                    'Content-Type': 'application/x-www-form-urlencoded'
+                                },
+                                body: new URLSearchParams({
+                                    grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+                                    client_id: clientId,
+                                    device_code: deviceCode
+                                })
+                            })
+                        ];
+                    case 3:
+                        response = _state.sent();
+                        return [
+                            4,
+                            response.json()
+                        ];
+                    case 4:
+                        responseData = _state.sent();
+                        if (!response.ok) return [
+                            3,
+                            6
+                        ];
+                        // Success! Convert to CachedToken and store
+                        tokenData = responseData;
+                        token = _object_spread(_object_spread_props(_object_spread({
+                            accessToken: tokenData.access_token
+                        }, tokenData.refresh_token && {
+                            refreshToken: tokenData.refresh_token
+                        }), {
+                            expiresAt: Date.now() + (tokenData.expires_in - 60) * 1000
+                        }), tokenData.scope && {
+                            scope: tokenData.scope
+                        });
+                        // Cache token to storage
+                        return [
+                            4,
+                            (0, _oauth.setToken)(tokenStore, {
+                                accountId: accountId,
+                                service: service
+                            }, token)
+                        ];
+                    case 5:
+                        _state.sent();
+                        logger.info('Device code authentication successful', {
+                            accountId: accountId
+                        });
+                        return [
+                            2,
+                            token
+                        ];
+                    case 6:
+                        // Handle error responses
+                        error = responseData.error;
+                        errorDescription = responseData.error_description || '';
+                        if (error === 'authorization_pending') {
+                            // User hasn't completed auth yet - continue polling
+                            logger.debug('Authorization pending, waiting for user...');
+                            return [
+                                3,
+                                1
+                            ];
+                        }
+                        if (error === 'slow_down') {
+                            // Microsoft wants us to slow down polling
+                            currentInterval += 5;
+                            logger.debug('Received slow_down, increasing interval', {
+                                newInterval: currentInterval
+                            });
+                            return [
+                                3,
+                                1
+                            ];
+                        }
+                        if (error === 'authorization_declined') {
+                            throw new Error('User declined authorization. Please restart the authentication flow.');
+                        }
+                        if (error === 'expired_token') {
+                            throw new Error('Device code expired. Please restart the authentication flow.');
+                        }
+                        // Unknown error
+                        throw new Error("Device code flow failed: ".concat(error, " - ").concat(errorDescription));
+                    case 7:
+                        return [
+                            2
+                        ];
+                }
+            });
+        }).call(this);
+    };
+    /**
+   * Refresh expired access token using refresh token
+   *
+   * @param refreshToken - Refresh token from previous authentication
+   * @returns New cached token with fresh access token
+   */ _proto.refreshAccessToken = function refreshAccessToken(refreshToken) {
+        return _async_to_generator(function() {
+            var _this_config, clientId, tenantId, scope, logger, tokenEndpoint, response, errorText, tokenData;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        _this_config = this.config, clientId = _this_config.clientId, tenantId = _this_config.tenantId, scope = _this_config.scope, logger = _this_config.logger;
+                        tokenEndpoint = "https://login.microsoftonline.com/".concat(tenantId, "/oauth2/v2.0/token");
+                        logger.debug('Refreshing access token');
+                        return [
+                            4,
+                            (0, _fetchwithtimeoutts.fetchWithTimeout)(tokenEndpoint, {
+                                method: 'POST',
+                                headers: {
+                                    'Content-Type': 'application/x-www-form-urlencoded'
+                                },
+                                body: new URLSearchParams({
+                                    grant_type: 'refresh_token',
+                                    client_id: clientId,
+                                    refresh_token: refreshToken,
+                                    scope: scope
+                                })
+                            })
+                        ];
+                    case 1:
+                        response = _state.sent();
+                        if (!!response.ok) return [
+                            3,
+                            3
+                        ];
+                        return [
+                            4,
+                            response.text()
+                        ];
+                    case 2:
+                        errorText = _state.sent();
+                        throw new Error("Token refresh failed (HTTP ".concat(response.status, "): ").concat(errorText));
+                    case 3:
+                        return [
+                            4,
+                            response.json()
+                        ];
+                    case 4:
+                        tokenData = _state.sent();
+                        return [
+                            2,
+                            {
+                                accessToken: tokenData.access_token,
+                                refreshToken: tokenData.refresh_token || refreshToken,
+                                expiresAt: Date.now() + (tokenData.expires_in - 60) * 1000,
+                                scope: tokenData.scope || scope
+                            }
+                        ];
+                }
+            });
+        }).call(this);
+    };
+    /**
+   * Check if token is still valid (not expired)
+   */ _proto.isTokenValid = function isTokenValid(token) {
+        return token.expiresAt !== undefined && token.expiresAt > Date.now();
+    };
+    /**
+   * Get access token for Microsoft Graph API
+   *
+   * Flow:
+   * 1. Check token storage
+   * 2. If valid token exists, return it
+   * 3. If expired but has refresh token, try refresh
+   * 4. Otherwise, start new device code flow
+   *
+   * @param accountId - Account identifier. Defaults to 'device-code' (fixed identifier for device code flow).
+   * @returns Access token for API requests
+   */ _proto.getAccessToken = function getAccessToken(accountId) {
+        return _async_to_generator(function() {
+            var _this_config, logger, service, tokenStore, effectiveAccountId, storedToken, refreshedToken, error, token;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        _this_config = this.config, logger = _this_config.logger, service = _this_config.service, tokenStore = _this_config.tokenStore;
+                        effectiveAccountId = accountId !== null && accountId !== void 0 ? accountId : 'device-code';
+                        logger.debug('Getting access token', {
+                            service: service,
+                            accountId: effectiveAccountId
+                        });
+                        return [
+                            4,
+                            (0, _oauth.getToken)(tokenStore, {
+                                accountId: effectiveAccountId,
+                                service: service
+                            })
+                        ];
+                    case 1:
+                        storedToken = _state.sent();
+                        if (storedToken && this.isTokenValid(storedToken)) {
+                            logger.debug('Using stored access token', {
+                                accountId: effectiveAccountId
+                            });
+                            return [
+                                2,
+                                storedToken.accessToken
+                            ];
+                        }
+                        if (!(storedToken === null || storedToken === void 0 ? void 0 : storedToken.refreshToken)) return [
+                            3,
+                            6
+                        ];
+                        _state.label = 2;
+                    case 2:
+                        _state.trys.push([
+                            2,
+                            5,
+                            ,
+                            6
+                        ]);
+                        logger.info('Refreshing expired access token', {
+                            accountId: effectiveAccountId
+                        });
+                        return [
+                            4,
+                            this.refreshAccessToken(storedToken.refreshToken)
+                        ];
+                    case 3:
+                        refreshedToken = _state.sent();
+                        return [
+                            4,
+                            (0, _oauth.setToken)(tokenStore, {
+                                accountId: effectiveAccountId,
+                                service: service
+                            }, refreshedToken)
+                        ];
+                    case 4:
+                        _state.sent();
+                        return [
+                            2,
+                            refreshedToken.accessToken
+                        ];
+                    case 5:
+                        error = _state.sent();
+                        logger.info('Token refresh failed', {
+                            accountId: effectiveAccountId,
+                            error: _instanceof(error, Error) ? error.message : String(error)
+                        });
+                        // In headless mode, cannot start interactive device code flow
+                        if (this.config.headless) {
+                            throw new Error("Token refresh failed in headless mode. Cannot start interactive device code flow. Error: ".concat(_instanceof(error, Error) ? error.message : String(error)));
+                        }
+                        return [
+                            3,
+                            6
+                        ];
+                    case 6:
+                        // No valid token - check if we can start device code flow
+                        if (this.config.headless) {
+                            throw new Error('No valid token available in headless mode. Device code flow requires user interaction. ' + 'Please run authentication flow interactively first or provide valid tokens.');
+                        }
+                        // Interactive mode - start device code flow
+                        logger.info('Starting device code flow', {
+                            accountId: effectiveAccountId
+                        });
+                        return [
+                            4,
+                            this.startDeviceCodeFlow(effectiveAccountId)
+                        ];
+                    case 7:
+                        token = _state.sent();
+                        return [
+                            2,
+                            token.accessToken
+                        ];
+                }
+            });
+        }).call(this);
+    };
+    /**
+   * Get user email from Microsoft Graph /me endpoint (pure query)
+   *
+   * @param accountId - Account identifier
+   * @returns User's email address (userPrincipalName or mail field)
+   */ _proto.getUserEmail = function getUserEmail(accountId) {
+        return _async_to_generator(function() {
+            var logger, token, response, errorText, userData, email;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        logger = this.config.logger;
+                        return [
+                            4,
+                            this.getAccessToken(accountId)
+                        ];
+                    case 1:
+                        token = _state.sent();
+                        logger.debug('Fetching user email from Microsoft Graph');
+                        return [
+                            4,
+                            (0, _fetchwithtimeoutts.fetchWithTimeout)('https://graph.microsoft.com/v1.0/me', {
+                                headers: {
+                                    Authorization: "Bearer ".concat(token)
+                                }
+                            })
+                        ];
+                    case 2:
+                        response = _state.sent();
+                        if (!!response.ok) return [
+                            3,
+                            4
+                        ];
+                        return [
+                            4,
+                            response.text()
+                        ];
+                    case 3:
+                        errorText = _state.sent();
+                        throw new Error("Failed to get user email (HTTP ".concat(response.status, "): ").concat(errorText));
+                    case 4:
+                        return [
+                            4,
+                            response.json()
+                        ];
+                    case 5:
+                        userData = _state.sent();
+                        email = userData.userPrincipalName || userData.mail;
+                        if (!email) {
+                            throw new Error('User email not found in Microsoft Graph response');
+                        }
+                        return [
+                            2,
+                            email
+                        ];
+                }
+            });
+        }).call(this);
+    };
+    /**
+   * Create auth provider for Microsoft Graph SDK integration
+   *
+   * Device code provider ALWAYS uses fixed accountId='device-code'
+   * This is by design - device code is a single static identity pattern
+   *
+   * @param accountId - Account identifier (must be 'device-code' or undefined, otherwise throws error)
+   * @returns Auth provider with getAccessToken method
+   */ _proto.toAuthProvider = function toAuthProvider(accountId) {
+        var _this = this;
+        // Device code ONLY works with 'device-code' account ID
+        if (accountId !== undefined && accountId !== 'device-code') {
+            throw new Error("DeviceCodeProvider only supports accountId='device-code', got '".concat(accountId, "'. Device code uses a single static identity pattern."));
+        }
+        // ALWAYS use fixed 'device-code' account ID
+        var getToken = function() {
+            return _this.getAccessToken('device-code');
+        };
+        return {
+            getAccessToken: getToken
+        };
+    };
+    /**
+   * Create Microsoft Graph AuthenticationProvider for SDK usage
+   *
+   * @param accountId - Account identifier
+   * @returns AuthenticationProvider that provides access tokens
+   */ _proto.createAuthProvider = function createAuthProvider(accountId) {
+        var _this = this;
+        return {
+            getAccessToken: function() {
+                return _async_to_generator(function() {
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                return [
+                                    4,
+                                    this.getAccessToken(accountId)
+                                ];
+                            case 1:
+                                return [
+                                    2,
+                                    _state.sent()
+                                ];
+                        }
+                    });
+                }).call(_this);
+            }
+        };
+    };
+    /**
+   * Create middleware wrapper for single-user authentication
+   *
+   * Middleware wraps tool, resource, and prompt handlers and injects authContext into extra parameter.
+   * Handlers receive MicrosoftAuthProvider via extra.authContext.auth for API calls.
+   *
+   * @returns Object with withToolAuth, withResourceAuth, withPromptAuth methods
+   *
+   * @example
+   * ```typescript
+   * // Server registration
+   * const middleware = provider.authMiddleware();
+   * const tools = toolFactories.map(f => f()).map(middleware.withToolAuth);
+   * const resources = resourceFactories.map(f => f()).map(middleware.withResourceAuth);
+   * const prompts = promptFactories.map(f => f()).map(middleware.withPromptAuth);
+   *
+   * // Tool handler receives auth
+   * async function handler({ id }: In, extra: EnrichedExtra) {
+   *   // extra.authContext.auth is MicrosoftAuthProvider (from middleware)
+   *   const graph = Client.initWithMiddleware({ authProvider: extra.authContext.auth });
+   * }
+   * ```
+   */ _proto.authMiddleware = function authMiddleware() {
+        var _this = this;
+        // Shared wrapper logic - extracts extra parameter from specified position
+        // Generic T captures the actual module type; handler is cast from unknown to callable
+        var wrapAtPosition = function(module, extraPosition) {
+            var _this1 = _this;
+            var originalHandler = module.handler;
+            var wrappedHandler = function() {
+                for(var _len = arguments.length, allArgs = new Array(_len), _key = 0; _key < _len; _key++){
+                    allArgs[_key] = arguments[_key];
+                }
+                return _async_to_generator(function() {
+                    var extra, accountId, auth, error;
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                if (allArgs.length <= extraPosition) {
+                                    // Arg-less tool pattern: single argument is both args and extra
+                                    extra = allArgs[0] || {};
+                                    allArgs[0] = extra;
+                                    allArgs[extraPosition] = extra;
+                                } else {
+                                    extra = allArgs[extraPosition] || {};
+                                    allArgs[extraPosition] = extra;
+                                }
+                                _state.label = 1;
+                            case 1:
+                                _state.trys.push([
+                                    1,
+                                    3,
+                                    ,
+                                    4
+                                ]);
+                                // Use fixed accountId for storage isolation (like service-account pattern)
+                                accountId = 'device-code';
+                                // Create Microsoft Graph authentication provider
+                                auth = this.createAuthProvider(accountId);
+                                // Inject authContext and logger into extra parameter
+                                extra.authContext = {
+                                    auth: auth,
+                                    accountId: accountId
+                                };
+                                extra.logger = this.config.logger;
+                                return [
+                                    4,
+                                    originalHandler.apply(void 0, _to_consumable_array(allArgs))
+                                ];
+                            case 2:
+                                // Call original handler with all args
+                                return [
+                                    2,
+                                    _state.sent()
+                                ];
+                            case 3:
+                                error = _state.sent();
+                                // Wrap auth errors with helpful context
+                                throw new Error("Device code authentication failed: ".concat(_instanceof(error, Error) ? error.message : String(error)));
+                            case 4:
+                                return [
+                                    2
+                                ];
+                        }
+                    });
+                }).call(_this1);
+            };
+            return _object_spread_props(_object_spread({}, module), {
+                handler: wrappedHandler
+            });
+        };
+        return {
+            // Use structural constraints to avoid contravariance check on handler type.
+            // wrapAtPosition is now generic and returns T directly.
+            withToolAuth: function(module) {
+                return wrapAtPosition(module, 1);
+            },
+            withResourceAuth: function(module) {
+                return wrapAtPosition(module, 2);
+            },
+            withPromptAuth: function(module) {
+                return wrapAtPosition(module, 0);
+            }
+        };
+    };
+    return DeviceCodeProvider;
+}();
+/* CJS INTEROP */ if (exports.__esModule && exports.default) { try { Object.defineProperty(exports.default, '__esModule', { value: true }); for (var key in exports) { exports.default[key] = exports[key]; } } catch (_) {}; module.exports = exports.default; }