@openziti/ziti-mcp-server 0.6.0 → 0.8.0

package/dist/auth/device-auth-flow.js

@@ -4,21 +4,42 @@ import { startSpinner, stopSpinner, getTenantFromToken, cliOutput, promptForBrow
 import { log, logError } from '../utils/logger.js';
 import { keychain } from '../utils/keychain.js';
 import { DEFAULT_SCOPES } from '../utils/scopes.js';
-function getConfig(selectedScopes, idpDomain, idpClientId, idpAudience) {
-    // If selectedScopes is provided, use those scopes
-    // If not provided or empty, use DEFAULT_SCOPES (which is now empty by default)
+import { fetchOIDCDiscoveryDocument, getTokenEndpoint, getRevocationEndpoint, } from './oidc-discovery.js';
+function buildConfig(selectedScopes, idpDomain, idpClientId, idpAudience) {
+    if (!idpDomain) {
+        throw new Error('IdP domain is required. Please provide --idp-domain parameter.');
+    }
+    if (!idpClientId) {
+        throw new Error('IdP client ID is required. Please provide --idp-client-id parameter.');
+    }
     const scopes = selectedScopes && selectedScopes.length > 0
         ? selectedScopes.join(' ')
         : DEFAULT_SCOPES.join(' ');
     return {
-        tenant: idpDomain || 'auth0.auth0.com',
-        clientId: idpClientId || '12345678`90abcdef1234', // Placeholder client ID for device auth flow
-        audience: idpAudience || 'foo-api', // Placeholder audience for device auth flow
+        idpDomain,
+        clientId: idpClientId,
+        audience: idpAudience,
         scopes,
     };
 }
 async function requestAuthorization(selectedScopes, idpDomain, idpClientId, idpAudience) {
-    const config = getConfig(selectedScopes, idpDomain, idpClientId, idpAudience);
+    const config = buildConfig(selectedScopes, idpDomain, idpClientId, idpAudience);
+    // Fetch OIDC discovery document to get endpoints
+    log(`Discovering OIDC endpoints for ${config.idpDomain}...`);
+    let discovery;
+    try {
+        discovery = await fetchOIDCDiscoveryDocument(config.idpDomain);
+    }
+    catch (error) {
+        logError('Failed to fetch OIDC discovery document:', error);
+        process.exit(1);
+    }
+    const deviceAuthEndpoint = discovery.device_authorization_endpoint;
+    if (!deviceAuthEndpoint) {
+        logError('Error', `IdP ${config.idpDomain} does not support device authorization flow. ` +
+            'The device_authorization_endpoint is not present in the discovery document.');
+        process.exit(1);
+    }
     const body = {
         client_id: config.clientId,
     };
@@ -29,7 +50,8 @@ async function requestAuthorization(selectedScopes, idpDomain, idpClientId, idpA
         body.scope = config.scopes;
     }
     try {
-        const response = await fetch(`https://${config.tenant}/oauth/device/code`, {
+        log(`Requesting device code from ${deviceAuthEndpoint}`);
+        const response = await fetch(deviceAuthEndpoint, {
             method: 'POST',
             body: new URLSearchParams(body),
             headers: {
@@ -40,10 +62,10 @@ async function requestAuthorization(selectedScopes, idpDomain, idpClientId, idpA
         const jsonRes = await response.json();
         if (!jsonRes.error) {
             cliOutput(`\nVerify this code on screen: ${chalk.bold.green(jsonRes.user_code)}\n`);
-            // Wait for user to press Enter to open browser
+            cliOutput(`\nVerify at this URL: ${chalk.bold.green(jsonRes.verification_uri_complete || jsonRes.verification_uri)}\n`);
             await promptForBrowserPermission();
-            openBrowser(jsonRes.verification_uri_complete);
-            await exchangeDeviceCodeForToken(jsonRes, selectedScopes);
+            openBrowser(jsonRes.verification_uri_complete || jsonRes.verification_uri);
+            await exchangeDeviceCodeForToken(jsonRes, config, discovery.token_endpoint);
         }
         else {
             logError('Error', jsonRes);
@@ -61,7 +83,6 @@ function wait(ms) {
 function isValidUrl(url) {
     try {
         const parsedUrl = new URL(url);
-        // Check for safe protocols
         return ['http:', 'https:'].includes(parsedUrl.protocol);
     }
     catch (error) {
@@ -82,48 +103,62 @@ function openBrowser(url) {
         logError('Failed to open browser:', err);
     });
 }
-async function exchangeDeviceCodeForToken(deviceCode, selectedScopes) {
-    const config = getConfig(selectedScopes);
-    startSpinner('Waiting for authorization...');
+async function exchangeDeviceCodeForToken(deviceCode, config, tokenEndpoint) {
+    startSpinner('\nWaiting for authorization...\n');
     while (true) {
+        await wait(deviceCode.interval * 1000);
         try {
-            const response = await fetch(`https://${config.tenant}/oauth/token`, {
+            log(`Polling token endpoint: ${tokenEndpoint}`);
+            const response = await fetch(tokenEndpoint, {
                 method: 'POST',
-                body: new URLSearchParams({
-                    client_id: config.clientId,
-                    device_code: deviceCode.device_code,
-                    grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
-                }),
                 headers: {
                     Accept: 'application/json',
                     'Content-Type': 'application/x-www-form-urlencoded',
                 },
+                body: new URLSearchParams({
+                    grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+                    device_code: deviceCode.device_code,
+                    client_id: config.clientId,
+                }),
             });
             const jsonRes = await response.json();
             if (!jsonRes.error) {
-                fetchUserInfo(jsonRes); // Success case
-                break; // Exit loop once successful
+                await storeTokens(jsonRes);
+                stopSpinner();
+                cliOutput(`\n${chalk.green('✓')} Successfully authenticated!\n`);
+                break;
             }
             else if (['authorization_pending', 'slow_down'].includes(jsonRes.error)) {
-                await wait(5000); // Wait before polling again
+                // Continue polling - user hasn't authorized yet
+                if (jsonRes.error === 'slow_down') {
+                    await wait(deviceCode.interval * 1000);
+                }
+            }
+            else if (jsonRes.error === 'access_denied') {
+                stopSpinner();
+                logError('Access denied:', jsonRes.error_description || 'User denied authorization or IdP configuration issue');
+                break;
+            }
+            else if (jsonRes.error === 'expired_token') {
+                stopSpinner();
+                logError('Device code expired:', 'Please try again');
+                break;
             }
             else {
                 stopSpinner();
-                logError('Unexpected error:', jsonRes.error);
-                break; // Exit loop on unknown error
+                logError('Unexpected error:', `${jsonRes.error}: ${jsonRes.error_description || ''}`);
+                break;
             }
         }
         catch (err) {
             stopSpinner();
             logError('Error in token exchange:', err);
-            break; // Exit loop on fetch failure
+            break;
         }
     }
-    stopSpinner();
 }
-async function fetchUserInfo(tokenSet) {
+async function storeTokens(tokenSet) {
     const tenantName = getTenantFromToken(tokenSet.access_token);
-    // Store tokens in keychain
     await keychain.setToken(tokenSet.access_token);
     await keychain.setDomain(tenantName);
     if (tokenSet.refresh_token) {
@@ -136,7 +171,7 @@ async function fetchUserInfo(tokenSet) {
         log(`Token expires at: ${new Date(expiresAt).toISOString()}`);
     }
 }
-export async function refreshAccessToken(selectedScopes) {
+export async function refreshAccessToken(idpDomain, idpClientId) {
     try {
         log('Attempting to refresh access token');
         const refreshToken = await keychain.getRefreshToken();
@@ -144,12 +179,22 @@ export async function refreshAccessToken(selectedScopes) {
             log('No refresh token found in keychain');
             return null;
         }
-        const config = getConfig(selectedScopes);
-        const response = await fetch(`https://${config.tenant}/oauth/token`, {
+        // Get IdP domain from keychain if not provided
+        const domain = idpDomain || (await keychain.getDomain());
+        if (!domain) {
+            log('No IdP domain available for token refresh');
+            return null;
+        }
+        if (!idpClientId) {
+            log('Client ID is required for token refresh');
+            return null;
+        }
+        const tokenEndpoint = await getTokenEndpoint(domain);
+        const response = await fetch(tokenEndpoint, {
             method: 'POST',
             body: new URLSearchParams({
                 grant_type: 'refresh_token',
-                client_id: config.clientId,
+                client_id: idpClientId,
                 refresh_token: refreshToken,
             }),
             headers: {
@@ -161,17 +206,7 @@ export async function refreshAccessToken(selectedScopes) {
             log(`Error refreshing token: ${tokenSet.error}`);
             return null;
         }
-        // Store new tokens
-        const tenantName = getTenantFromToken(tokenSet.access_token);
-        await keychain.setToken(tokenSet.access_token);
-        await keychain.setDomain(tenantName);
-        if (tokenSet.refresh_token) {
-            await keychain.setRefreshToken(tokenSet.refresh_token);
-        }
-        if (tokenSet.expires_in) {
-            const expiresAt = Date.now() + tokenSet.expires_in * 1000;
-            await keychain.setTokenExpiresAt(expiresAt);
-        }
+        await storeTokens(tokenSet);
         log('Successfully refreshed access token');
         return tokenSet.access_token;
     }
@@ -181,11 +216,10 @@ export async function refreshAccessToken(selectedScopes) {
     }
 }
 /**
- * Revokes the refresh token that is previously set within keychain when offline_access is requested.
- * Returns true if the call is successful or if the refresh token does not exist.
- * @returns {Promise<boolean>}
+ * Revokes the refresh token stored in the keychain.
+ * Returns true if successful or if no refresh token exists.
  */
-export async function revokeRefreshToken() {
+export async function revokeRefreshToken(idpDomain, idpClientId) {
     try {
         log('Attempting to revoke refresh token');
         const refreshToken = await keychain.getRefreshToken();
@@ -193,23 +227,40 @@ export async function revokeRefreshToken() {
             log('No refresh token found in keychain');
             return true;
         }
-        const config = getConfig();
-        const response = await fetch(`https://${config.tenant}/oauth/revoke`, {
+        const domain = idpDomain || (await keychain.getDomain());
+        if (!domain) {
+            log('No IdP domain available for token revocation');
+            return false;
+        }
+        if (!idpClientId) {
+            log('Client ID is required for token revocation');
+            return false;
+        }
+        const revocationEndpoint = await getRevocationEndpoint(domain);
+        if (!revocationEndpoint) {
+            log(`IdP ${domain} does not support token revocation`);
+            // Consider this a success since we can't revoke anyway
+            return true;
+        }
+        const response = await fetch(revocationEndpoint, {
             method: 'POST',
             body: new URLSearchParams({
-                client_id: config.clientId,
+                client_id: idpClientId,
                 token: refreshToken,
             }),
             headers: {
                 'Content-Type': 'application/x-www-form-urlencoded',
             },
         });
+        // RFC 7009: The authorization server responds with HTTP status code 200
+        // if the token has been revoked successfully or if the client submitted
+        // an invalid token.
         if (response.status === 200) {
             log('Refresh token successfully revoked');
             return true;
         }
         else {
-            log('Error calling revoke API: ', response.statusText);
+            log('Error calling revoke API:', response.statusText);
             return false;
         }
     }
@@ -220,23 +271,6 @@ export async function revokeRefreshToken() {
 }
 /**
  * Determines if the current access token is expired or will expire soon.
- *
- * This security check is crucial for maintaining continuous authenticated access
- * to Auth0 APIs. It includes a configurable buffer time to proactively detect
- * tokens that will expire soon, preventing potential disruptions during operations
- * that might span multiple API calls. This proactive approach allows the system to
- * initiate refresh flows before actual expiration occurs.
- *
- * The function considers a token expired in the following cases:
- * - No expiration time is found in the keychain via `keychain.getTokenExpiresAt()`
- * - Current time + buffer exceeds the token's expiration time
- * - Error occurs during expiration check (fails secure)
- *
- * This function is used both by `validateAuthorization()` in `run.ts` for user-friendly
- * startup validation and by `validateConfig()` for continuous runtime validation.
- *
- * @param {number} bufferSeconds - Seconds before actual expiration to consider token expired (default: 300s/5min)
- * @returns {Promise<boolean>} True if token is expired or will expire within the buffer period
  */
 export async function isTokenExpired(bufferSeconds = 300) {
     try {
@@ -258,20 +292,7 @@ export async function isTokenExpired(bufferSeconds = 300) {
     }
 }
 /**
- * Retrieves a valid access token for OpenZiti Controller Management API operations.
- *
- * This function serves as the main entry point for credential retrieval,
- * ensuring that only valid, non-expired tokens are provided to API operations.
- * It implements a critical security checkpoint that prevents operations from
- * proceeding with invalid authentication, which could lead to API failures
- * or unpredictable behavior.
- *
- * The function performs these key security checks:
- * 1. Verifies token expiration status using isTokenExpired
- * 2. Provides clear guidance to users when re-authentication is needed
- * 3. Handles errors gracefully with a fail-secure approach
- *
- * @returns {Promise<string|null>} A valid access token, or null if no valid token is available
+ * Retrieves a valid access token for API operations.
  */
 export async function getValidAccessToken() {
     try {

package/dist/auth/device-auth-flow.js.map

@@ -1 +1 @@
-{"version":3,"file":"device-auth-flow.js","sourceRoot":"","sources":["../../src/auth/device-auth-flow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EACL,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,SAAS,EACT,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,SAAS,SAAS,CAChB,cAAyB,EACzB,SAAkB,EAClB,WAAoB,EACpB,WAAoB;IAEpB,kDAAkD;IAClD,+EAA+E;IAC/E,MAAM,MAAM,GACV,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC;QACzC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QAC1B,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE/B,OAAO;QACL,MAAM,EAAE,SAAS,IAAI,iBAAiB;QACtC,QAAQ,EAAE,WAAW,IAAI,uBAAuB,EAAE,6CAA6C;QAC/F,QAAQ,EAAE,WAAW,IAAI,SAAS,EAAE,4CAA4C;QAChF,MAAM;KACP,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,cAAyB,EACzB,SAAkB,EAClB,WAAoB,EACpB,WAAoB;IAEpB,MAAM,MAAM,GAAG,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAQ;QAChB,SAAS,EAAE,MAAM,CAAC,QAAQ;KAC3B,CAAC;IAEF,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IAClC,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,MAAM,CAAC,MAAM,oBAAoB,EAAE;YACzE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC;YAC/B,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,mCAAmC;aACpD;SACF,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,SAAS,CAAC,iCAAiC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACpF,+CAA+C;YAC/C,MAAM,0BAA0B,EAAE,CAAC;YACnC,WAAW,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;YAC/C,MAAM,0BAA0B,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,EAAU;IACtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,2BAA2B;QAC3B,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,QAAQ,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;QACvC,OAAO;IACT,CAAC;IAED,IAAI,CAAC,GAAG,CAAC;SACN,IAAI,CAAC,GAAG,EAAE;QACT,GAAG,CAAC,6BAA6B,CAAC,CAAC;IACrC,CAAC,CAAC;SACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACb,QAAQ,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACP,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,UAAe,EAAE,cAAyB;IAClF,MAAM,MAAM,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC;IACzC,YAAY,CAAC,8BAA8B,CAAC,CAAC;IAC7C,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,MAAM,CAAC,MAAM,cAAc,EAAE;gBACnE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,SAAS,EAAE,MAAM,CAAC,QAAQ;oBAC1B,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,UAAU,EAAE,8CAA8C;iBAC3D,CAAC;gBACF,OAAO,EAAE;oBACP,MAAM,EAAE,kBAAkB;oBAC1B,cAAc,EAAE,mCAAmC;iBACpD;aACF,CAAC,CAAC;YAEH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAEtC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACnB,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;gBACvC,MAAM,CAAC,4BAA4B;YACrC,CAAC;iBAAM,IAAI,CAAC,uBAAuB,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1E,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,4BAA4B;YAChD,CAAC;iBAAM,CAAC;gBACN,WAAW,EAAE,CAAC;gBACd,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC7C,MAAM,CAAC,6BAA6B;YACtC,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,EAAE,CAAC;YACd,QAAQ,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;YAC1C,MAAM,CAAC,6BAA6B;QACtC,CAAC;IACH,CAAC;IACD,WAAW,EAAE,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,QAAa;IACxC,MAAM,UAAU,GAAG,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAE7D,2BAA2B;IAC3B,MAAM,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAErC,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;QAC3B,MAAM,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QACvD,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC;QAC1D,MAAM,QAAQ,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC5C,GAAG,CAAC,qBAAqB,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,cAAyB;IAChE,IAAI,CAAC;QACH,GAAG,CAAC,oCAAoC,CAAC,CAAC;QAE1C,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,eAAe,EAAE,CAAC;QACtD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,GAAG,CAAC,oCAAoC,CAAC,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,MAAM,CAAC,MAAM,cAAc,EAAE;YACnE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,eAAe;gBAC3B,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,aAAa,EAAE,YAAY;aAC5B,CAAC;YACF,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;aACpD;SACF,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEvC,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,GAAG,CAAC,2BAA2B,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;YACjD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,mBAAmB;QACnB,MAAM,UAAU,GAAG,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC7D,MAAM,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC/C,MAAM,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAErC,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;YAC3B,MAAM,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC;YAC1D,MAAM,QAAQ,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC9C,CAAC;QAED,GAAG,CAAC,qCAAqC,CAAC,CAAC;QAC3C,OAAO,QAAQ,CAAC,YAAY,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,IAAI,CAAC;QACH,GAAG,CAAC,oCAAoC,CAAC,CAAC;QAE1C,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,eAAe,EAAE,CAAC;QACtD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,GAAG,CAAC,oCAAoC,CAAC,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,MAAM,CAAC,MAAM,eAAe,EAAE;YACpE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,KAAK,EAAE,YAAY;aACpB,CAAC;YACF,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;aACpD;SACF,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,GAAG,CAAC,oCAAoC,CAAC,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,4BAA4B,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;YACvD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,aAAa,GAAG,GAAG;IACtD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QACrD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,GAAG,CAAC,gCAAgC,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,GAAG,GAAG,aAAa,GAAG,IAAI,IAAI,SAAS,CAAC;QAE1D,IAAI,SAAS,EAAE,CAAC;YACd,GAAG,CAAC,qDAAqD,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAChG,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,cAAc,EAAE,CAAC;QAEvC,IAAI,OAAO,EAAE,CAAC;YACZ,GAAG,CAAC,wFAAwF,CAAC,CAAC;YAC9F,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,MAAM,QAAQ,CAAC,QAAQ,EAAE,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,OAAO,EAAE,oBAAoB,EAAE,CAAC"}
+{"version":3,"file":"device-auth-flow.js","sourceRoot":"","sources":["../../src/auth/device-auth-flow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EACL,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,SAAS,EACT,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,qBAAqB,GAEtB,MAAM,qBAAqB,CAAC;AAS7B,SAAS,WAAW,CAClB,cAAyB,EACzB,SAAkB,EAClB,WAAoB,EACpB,WAAoB;IAEpB,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,MAAM,GACV,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC;QACzC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QAC1B,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE/B,OAAO;QACL,SAAS;QACT,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,WAAW;QACrB,MAAM;KACP,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,cAAyB,EACzB,SAAkB,EAClB,WAAoB,EACpB,WAAoB;IAEpB,MAAM,MAAM,GAAG,WAAW,CAAC,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IAEhF,iDAAiD;IACjD,GAAG,CAAC,kCAAkC,MAAM,CAAC,SAAS,KAAK,CAAC,CAAC;IAC7D,IAAI,SAAgC,CAAC;IACrC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,0BAA0B,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,kBAAkB,GAAG,SAAS,CAAC,6BAA6B,CAAC;IACnE,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,QAAQ,CACN,OAAO,EACP,OAAO,MAAM,CAAC,SAAS,+CAA+C;YACpE,6EAA6E,CAChF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAA2B;QACnC,SAAS,EAAE,MAAM,CAAC,QAAQ;KAC3B,CAAC;IAEF,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IAClC,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,CAAC;IAED,IAAI,CAAC;QACH,GAAG,CAAC,+BAA+B,kBAAkB,EAAE,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,kBAAkB,EAAE;YAC/C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC;YAC/B,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,mCAAmC;aACpD;SACF,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,SAAS,CAAC,iCAAiC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACpF,SAAS,CACP,yBAAyB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,IAAI,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAC7G,CAAC;YACF,MAAM,0BAA0B,EAAE,CAAC;YACnC,WAAW,CAAC,OAAO,CAAC,yBAAyB,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAC;YAC3E,MAAM,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC;QAC9E,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,EAAU;IACtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,QAAQ,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;QACvC,OAAO;IACT,CAAC;IAED,IAAI,CAAC,GAAG,CAAC;SACN,IAAI,CAAC,GAAG,EAAE;QACT,GAAG,CAAC,6BAA6B,CAAC,CAAC;IACrC,CAAC,CAAC;SACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACb,QAAQ,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACP,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,UAAqD,EACrD,MAAwB,EACxB,aAAqB;IAErB,YAAY,CAAC,kCAAkC,CAAC,CAAC;IACjD,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC;YACH,GAAG,CAAC,2BAA2B,aAAa,EAAE,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;gBAC1C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,MAAM,EAAE,kBAAkB;oBAC1B,cAAc,EAAE,mCAAmC;iBACpD;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,UAAU,EAAE,8CAA8C;oBAC1D,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,SAAS,EAAE,MAAM,CAAC,QAAQ;iBAC3B,CAAC;aACH,CAAC,CAAC;YAEH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAEtC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;gBAC3B,WAAW,EAAE,CAAC;gBACd,SAAS,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;gBACjE,MAAM;YACR,CAAC;iBAAM,IAAI,CAAC,uBAAuB,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1E,gDAAgD;gBAChD,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;oBAClC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;gBACzC,CAAC;YACH,CAAC;iBAAM,IAAI,OAAO,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;gBAC7C,WAAW,EAAE,CAAC;gBACd,QAAQ,CACN,gBAAgB,EAChB,OAAO,CAAC,iBAAiB,IAAI,sDAAsD,CACpF,CAAC;gBACF,MAAM;YACR,CAAC;iBAAM,IAAI,OAAO,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;gBAC7C,WAAW,EAAE,CAAC;gBACd,QAAQ,CAAC,sBAAsB,EAAE,kBAAkB,CAAC,CAAC;gBACrD,MAAM;YACR,CAAC;iBAAM,CAAC;gBACN,WAAW,EAAE,CAAC;gBACd,QAAQ,CAAC,mBAAmB,EAAE,GAAG,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC,CAAC;gBACtF,MAAM;YACR,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,EAAE,CAAC;YACd,QAAQ,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;YAC1C,MAAM;QACR,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,QAI1B;IACC,MAAM,UAAU,GAAG,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAE7D,MAAM,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAErC,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;QAC3B,MAAM,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QACvD,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC;QAC1D,MAAM,QAAQ,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC5C,GAAG,CAAC,qBAAqB,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAkB,EAClB,WAAoB;IAEpB,IAAI,CAAC;QACH,GAAG,CAAC,oCAAoC,CAAC,CAAC;QAE1C,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,eAAe,EAAE,CAAC;QACtD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,GAAG,CAAC,oCAAoC,CAAC,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,+CAA+C;QAC/C,MAAM,MAAM,GAAG,SAAS,IAAI,CAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,2CAA2C,CAAC,CAAC;YACjD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,GAAG,CAAC,yCAAyC,CAAC,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAErD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,eAAe;gBAC3B,SAAS,EAAE,WAAW;gBACtB,aAAa,EAAE,YAAY;aAC5B,CAAC;YACF,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;aACpD;SACF,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEvC,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,GAAG,CAAC,2BAA2B,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;YACjD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC5B,GAAG,CAAC,qCAAqC,CAAC,CAAC;QAC3C,OAAO,QAAQ,CAAC,YAAY,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAkB,EAClB,WAAoB;IAEpB,IAAI,CAAC;QACH,GAAG,CAAC,oCAAoC,CAAC,CAAC;QAE1C,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,eAAe,EAAE,CAAC;QACtD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,GAAG,CAAC,oCAAoC,CAAC,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,SAAS,IAAI,CAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,8CAA8C,CAAC,CAAC;YACpD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,GAAG,CAAC,4CAA4C,CAAC,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,kBAAkB,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,GAAG,CAAC,OAAO,MAAM,oCAAoC,CAAC,CAAC;YACvD,uDAAuD;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,kBAAkB,EAAE;YAC/C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,SAAS,EAAE,WAAW;gBACtB,KAAK,EAAE,YAAY;aACpB,CAAC;YACF,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;aACpD;SACF,CAAC,CAAC;QAEH,wEAAwE;QACxE,wEAAwE;QACxE,oBAAoB;QACpB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,GAAG,CAAC,oCAAoC,CAAC,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,2BAA2B,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;YACtD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,aAAa,GAAG,GAAG;IACtD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QACrD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,GAAG,CAAC,gCAAgC,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,GAAG,GAAG,aAAa,GAAG,IAAI,IAAI,SAAS,CAAC;QAE1D,IAAI,SAAS,EAAE,CAAC;YACd,GAAG,CAAC,qDAAqD,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAChG,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,cAAc,EAAE,CAAC;QAEvC,IAAI,OAAO,EAAE,CAAC;YACZ,GAAG,CAAC,wFAAwF,CAAC,CAAC;YAC9F,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,MAAM,QAAQ,CAAC,QAAQ,EAAE,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,OAAO,EAAE,oBAAoB,EAAE,CAAC"}

package/dist/auth/oidc-discovery.d.ts

@@ -0,0 +1,51 @@
+/**
+ * OIDC Discovery document structure
+ * Based on OpenID Connect Discovery 1.0 specification
+ */
+export interface OIDCDiscoveryDocument {
+    issuer: string;
+    authorization_endpoint?: string;
+    token_endpoint: string;
+    userinfo_endpoint?: string;
+    jwks_uri?: string;
+    registration_endpoint?: string;
+    scopes_supported?: string[];
+    response_types_supported?: string[];
+    grant_types_supported?: string[];
+    subject_types_supported?: string[];
+    id_token_signing_alg_values_supported?: string[];
+    token_endpoint_auth_methods_supported?: string[];
+    revocation_endpoint?: string;
+    introspection_endpoint?: string;
+    device_authorization_endpoint?: string;
+}
+/**
+ * Fetches the OIDC discovery document from an IdP
+ *
+ * @param idpDomain - The IdP domain (e.g., 'your-tenant.auth0.com' or 'accounts.google.com')
+ * @returns The OIDC discovery document
+ * @throws Error if the discovery document cannot be fetched
+ */
+export declare function fetchOIDCDiscoveryDocument(idpDomain: string): Promise<OIDCDiscoveryDocument>;
+/**
+ * Gets the token endpoint from the IdP's discovery document
+ */
+export declare function getTokenEndpoint(idpDomain: string): Promise<string>;
+/**
+ * Gets the device authorization endpoint from the IdP's discovery document
+ * @throws Error if the IdP doesn't support device authorization
+ */
+export declare function getDeviceAuthorizationEndpoint(idpDomain: string): Promise<string>;
+/**
+ * Gets the revocation endpoint from the IdP's discovery document
+ * @returns The revocation endpoint, or null if not supported
+ */
+export declare function getRevocationEndpoint(idpDomain: string): Promise<string | null>;
+/**
+ * Checks if the IdP supports a specific grant type
+ */
+export declare function supportsGrantType(idpDomain: string, grantType: string): Promise<boolean>;
+/**
+ * Clears the discovery cache (useful for testing or when IdP config changes)
+ */
+export declare function clearDiscoveryCache(): void;

package/dist/auth/oidc-discovery.js

@@ -0,0 +1,100 @@
+import { log, logError } from '../utils/logger.js';
+/**
+ * Cache for OIDC discovery documents to avoid repeated fetches
+ */
+const discoveryCache = new Map();
+const CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes
+/**
+ * Fetches the OIDC discovery document from an IdP
+ *
+ * @param idpDomain - The IdP domain (e.g., 'your-tenant.auth0.com' or 'accounts.google.com')
+ * @returns The OIDC discovery document
+ * @throws Error if the discovery document cannot be fetched
+ */
+export async function fetchOIDCDiscoveryDocument(idpDomain) {
+    // Check cache first
+    const cached = discoveryCache.get(idpDomain);
+    if (cached && cached.expiresAt > Date.now()) {
+        log(`Using cached OIDC discovery document for ${idpDomain}`);
+        return cached.document;
+    }
+    // Normalize domain - remove protocol if present
+    const normalizedDomain = idpDomain.replace(/^https?:\/\//, '');
+    const discoveryUrl = `https://${normalizedDomain}/.well-known/openid-configuration`;
+    log(`Fetching OIDC discovery document from ${discoveryUrl}`);
+    try {
+        const response = await fetch(discoveryUrl, {
+            method: 'GET',
+            headers: {
+                Accept: 'application/json',
+            },
+        });
+        if (!response.ok) {
+            throw new Error(`Failed to fetch OIDC discovery document: ${response.status} ${response.statusText}`);
+        }
+        const document = (await response.json());
+        // Validate required fields
+        if (!document.issuer) {
+            throw new Error('OIDC discovery document missing required field: issuer');
+        }
+        if (!document.token_endpoint) {
+            throw new Error('OIDC discovery document missing required field: token_endpoint');
+        }
+        // Cache the document
+        discoveryCache.set(idpDomain, {
+            document,
+            expiresAt: Date.now() + CACHE_TTL_MS,
+        });
+        log(`Successfully fetched OIDC discovery document for ${idpDomain}`);
+        return document;
+    }
+    catch (error) {
+        logError(`Error fetching OIDC discovery document from ${discoveryUrl}:`, error);
+        throw error;
+    }
+}
+/**
+ * Gets the token endpoint from the IdP's discovery document
+ */
+export async function getTokenEndpoint(idpDomain) {
+    const document = await fetchOIDCDiscoveryDocument(idpDomain);
+    return document.token_endpoint;
+}
+/**
+ * Gets the device authorization endpoint from the IdP's discovery document
+ * @throws Error if the IdP doesn't support device authorization
+ */
+export async function getDeviceAuthorizationEndpoint(idpDomain) {
+    const document = await fetchOIDCDiscoveryDocument(idpDomain);
+    if (!document.device_authorization_endpoint) {
+        throw new Error(`IdP ${idpDomain} does not support device authorization flow. ` +
+            'The device_authorization_endpoint is not present in the discovery document.');
+    }
+    return document.device_authorization_endpoint;
+}
+/**
+ * Gets the revocation endpoint from the IdP's discovery document
+ * @returns The revocation endpoint, or null if not supported
+ */
+export async function getRevocationEndpoint(idpDomain) {
+    const document = await fetchOIDCDiscoveryDocument(idpDomain);
+    return document.revocation_endpoint || null;
+}
+/**
+ * Checks if the IdP supports a specific grant type
+ */
+export async function supportsGrantType(idpDomain, grantType) {
+    const document = await fetchOIDCDiscoveryDocument(idpDomain);
+    if (!document.grant_types_supported) {
+        // If not specified, assume common grant types are supported per OIDC spec
+        return true;
+    }
+    return document.grant_types_supported.includes(grantType);
+}
+/**
+ * Clears the discovery cache (useful for testing or when IdP config changes)
+ */
+export function clearDiscoveryCache() {
+    discoveryCache.clear();
+}
+//# sourceMappingURL=oidc-discovery.js.map

package/dist/auth/oidc-discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-discovery.js","sourceRoot":"","sources":["../../src/auth/oidc-discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAwBnD;;GAEG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkE,CAAC;AAEjG,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAEhD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,SAAiB;IAEjB,oBAAoB;IACpB,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC5C,GAAG,CAAC,4CAA4C,SAAS,EAAE,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC;IAED,gDAAgD;IAChD,MAAM,gBAAgB,GAAG,SAAS,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,WAAW,gBAAgB,mCAAmC,CAAC;IAEpF,GAAG,CAAC,yCAAyC,YAAY,EAAE,CAAC,CAAC;IAE7D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE;YACzC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;aAC3B;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,4CAA4C,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CACrF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA0B,CAAC;QAElE,2BAA2B;QAC3B,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACpF,CAAC;QAED,qBAAqB;QACrB,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE;YAC5B,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY;SACrC,CAAC,CAAC;QAEH,GAAG,CAAC,oDAAoD,SAAS,EAAE,CAAC,CAAC;QACrE,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,+CAA+C,YAAY,GAAG,EAAE,KAAK,CAAC,CAAC;QAChF,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,SAAiB;IACtD,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,SAAS,CAAC,CAAC;IAC7D,OAAO,QAAQ,CAAC,cAAc,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,SAAiB;IACpE,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,SAAS,CAAC,CAAC;IAC7D,IAAI,CAAC,QAAQ,CAAC,6BAA6B,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,OAAO,SAAS,+CAA+C;YAC7D,6EAA6E,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,6BAA6B,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,SAAiB;IAC3D,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,SAAS,CAAC,CAAC;IAC7D,OAAO,QAAQ,CAAC,mBAAmB,IAAI,IAAI,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAiB,EAAE,SAAiB;IAC1E,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,SAAS,CAAC,CAAC;IAC7D,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,CAAC;QACpC,0EAA0E;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,QAAQ,CAAC,qBAAqB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC5D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB;IACjC,cAAc,CAAC,KAAK,EAAE,CAAC;AACzB,CAAC"}

package/dist/clients/base.js

@@ -60,15 +60,28 @@ export class BaseClientManager {
      * @protected
      */
     createServerConfig(options) {
-        const args = [entryPoint, 'run', '--tools', options.tools.join(',')];
-        if (options.readOnly) {
-            args.push('--read-only');
+        let command;
+        let args;
+        if (options.wsl) {
+            const runCmd = [
+                'source ~/.nvm/nvm.sh',
+                `${entryPoint} run --tools '${options.tools.join(',')}'${options.readOnly ? ' --read-only' : ''}`,
+            ].join(' && ');
+            command = 'wsl.exe';
+            args = ['bash', '-c', runCmd];
+        }
+        else {
+            args = [entryPoint, 'run', '--tools', options.tools.join(',')];
+            if (options.readOnly) {
+                args.push('--read-only');
+            }
+            command = process.execPath;
         }
         const config = {
-            command: process.execPath,
+            command,
             args,
             env: {
-                DEBUG: 'ziti-mcp',
+                DEBUG: 'ziti-mcp-server',
             },
         };
         if (this.capabilities?.length) {

package/dist/clients/base.js.map

@@ -1 +1 @@
-{"version":3,"file":"base.js","sourceRoot":"","sources":["../../src/clients/base.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGjD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,2DAA2D;AAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAClD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;AAEtD;;;;GAIG;AACH,MAAM,OAAgB,iBAAiB;IAClB,UAAU,CAAa;IAC1B,WAAW,CAAS;IACjB,YAAY,CAAY;IAE3C;;;;OAIG;IACH,YAAY,OAAiF;QAC3F,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IAC3C,CAAC;IAYD;;;;;;;OAOG;IACH,KAAK,CAAC,SAAS,CAAC,OAAsB;QACpC,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;QAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAEtD,UAAU,CAAC,eAAe,CAAC,GAAG,YAAY,CAAC;QAC3C,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC;QAE/B,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACrC,GAAG,CAAC,WAAW,IAAI,CAAC,WAAW,oBAAoB,UAAU,EAAE,CAAC,CAAC;QAEjE,SAAS,CACP,KAAK,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,oCAAoC,KAAK,CAAC,MAAM,CACnE,WAAW,IAAI,CAAC,WAAW,EAAE,CAC9B,sBAAsB,CACxB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACO,kBAAkB,CAAC,OAAsB;QACjD,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAErE,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3B,CAAC;QAED,MAAM,MAAM,GAAiB;YAC3B,OAAO,EAAE,OAAO,CAAC,QAAQ;YACzB,IAAI;YACJ,GAAG,EAAE;gBACH,KAAK,EAAE,UAAU;aAClB;SACF,CAAC;QAEF,IAAI,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;YAC9B,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QAC1C,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;OASG;IACO,UAAU,CAAC,UAAkB;QACrC,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;gBAClD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,qCAAqC,UAAU,KAAK,GAAG,EAAE,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC5B,CAAC;IAED;;;;;;;;OAQG;IACO,WAAW,CAAC,UAAkB,EAAE,MAAoB;QAC5D,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;CACF"}
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../src/clients/base.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGjD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,2DAA2D;AAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAClD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;AAEtD;;;;GAIG;AACH,MAAM,OAAgB,iBAAiB;IAClB,UAAU,CAAa;IAC1B,WAAW,CAAS;IACjB,YAAY,CAAY;IAE3C;;;;OAIG;IACH,YAAY,OAAiF;QAC3F,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IAC3C,CAAC;IAYD;;;;;;;OAOG;IACH,KAAK,CAAC,SAAS,CAAC,OAAsB;QACpC,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;QAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAEtD,UAAU,CAAC,eAAe,CAAC,GAAG,YAAY,CAAC;QAC3C,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC;QAE/B,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACrC,GAAG,CAAC,WAAW,IAAI,CAAC,WAAW,oBAAoB,UAAU,EAAE,CAAC,CAAC;QAEjE,SAAS,CACP,KAAK,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,oCAAoC,KAAK,CAAC,MAAM,CACnE,WAAW,IAAI,CAAC,WAAW,EAAE,CAC9B,sBAAsB,CACxB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACO,kBAAkB,CAAC,OAAsB;QACjD,IAAI,OAAe,CAAC;QACpB,IAAI,IAAc,CAAC;QAEnB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG;gBACb,sBAAsB;gBACtB,GAAG,UAAU,iBAAiB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE;aAClG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACf,OAAO,GAAG,SAAS,CAAC;YACpB,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/D,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC3B,CAAC;YACD,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC7B,CAAC;QAED,MAAM,MAAM,GAAiB;YAC3B,OAAO;YACP,IAAI;YACJ,GAAG,EAAE;gBACH,KAAK,EAAE,iBAAiB;aACzB;SACF,CAAC;QAEF,IAAI,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;YAC9B,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QAC1C,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;OASG;IACO,UAAU,CAAC,UAAkB;QACrC,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;gBAClD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,qCAAqC,UAAU,KAAK,GAAG,EAAE,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC5B,CAAC;IAED;;;;;;;;OAQG;IACO,WAAW,CAAC,UAAkB,EAAE,MAAoB;QAC5D,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;CACF"}

package/dist/clients/claude.d.ts

@@ -1,4 +1,5 @@
 import { BaseClientManager } from './base.js';
+import type { ClientOptions } from '../utils/types.js';
 /**
  * Client manager implementation for Claude Desktop.
  *
@@ -8,13 +9,15 @@ import { BaseClientManager } from './base.js';
  * @see {@link https://claude.ai/download | Claude Desktop Download}
  */
 export declare class ClaudeClientManager extends BaseClientManager {
+    private wsl;
     constructor();
+    configure(options: ClientOptions): Promise<void>;
     /**
      * Returns the path to the Claude Desktop configuration file.
      *
-     * Resolves the platform-specific configuration directory,
-     * ensures the directory exists on disk, and constructs the full path
-     * to the Claude Desktop configuration file.
+     * When running under WSL, resolves the Windows APPDATA path via cmd.exe and
+     * constructs the path under the WSL mount point so the config is placed where
+     * Claude Desktop (running on Windows) expects it.
      *
      * @returns The absolute path to the configuration file.
      */