@portaidentity/cli 1.7.3 → 1.8.0

package/dist/auth/browser-flow.d.ts

@@ -17,7 +17,7 @@
  *
  * @module auth/browser-flow
  */
-import type { AuthFlowResult } from './types.js';
+import type { AuthFlowResult, CliAuthOperationOptions, TokenResponse } from './types.js';
 /** Options for the browser flow */
 export interface BrowserFlowOptions {
     /** Porta server URL */
@@ -26,7 +26,33 @@ export interface BrowserFlowOptions {
     clientId?: string;
     /** Force manual mode (print URL instead of opening browser) */
     noBrowser?: boolean;
+    /** Optional cancellation signal owned by the calling UI. */
+    signal?: AbortSignal;
 }
+/**
+ * Exchange an authorization code for tokens at the OIDC token endpoint.
+ *
+ * Sends a POST request with the authorization code, PKCE code_verifier,
+ * and redirect URI to complete the Authorization Code flow.
+ *
+ * @param params - Token exchange parameters
+ * @returns Token response with access, refresh, and ID tokens
+ * @throws Error if the token exchange fails
+ */
+export interface AuthorizationCodeExchange {
+    /** Exact discovered token endpoint. */
+    readonly tokenEndpoint: string;
+    /** Public client identifier. */
+    readonly clientId: string;
+    /** Single-use authorization code. */
+    readonly code: string;
+    /** PKCE verifier bound to the authorization request. */
+    readonly codeVerifier: string;
+    /** Exact redirect URI used in the authorization request. */
+    readonly redirectUri: string;
+}
+/** Exchanges a code once while propagating caller-owned cancellation. */
+export declare function exchangeAuthorizationCode(params: AuthorizationCodeExchange, options: CliAuthOperationOptions): Promise<TokenResponse>;
 /**
  * Execute the OIDC Authorization Code + PKCE login flow.
  *

package/dist/auth/browser-flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser-flow.d.ts","sourceRoot":"","sources":["../../src/auth/browser-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAaH,OAAO,KAAK,EAAE,cAAc,EAAiB,MAAM,YAAY,CAAC;AAahE,mCAAmC;AACnC,MAAM,WAAW,kBAAkB;IACjC,uBAAuB;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAsDD;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,kBAAkB,EAC3B,GAAG,GAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAkB,GAC3C,OAAO,CAAC,cAAc,CAAC,CAsJzB"}
+{"version":3,"file":"browser-flow.d.ts","sourceRoot":"","sources":["../../src/auth/browser-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAaH,OAAO,KAAK,EAAE,cAAc,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAazF,mCAAmC;AACnC,MAAM,WAAW,kBAAkB;IACjC,uBAAuB;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAMD;;;;;;;;;GASG;AACH,MAAM,WAAW,yBAAyB;IACxC,uCAAuC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,gCAAgC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,4DAA4D;IAC5D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,yEAAyE;AACzE,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,yBAAyB,EACjC,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,aAAa,CAAC,CA6CxB;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,kBAAkB,EAC3B,GAAG,GAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAkB,GAC3C,OAAO,CAAC,cAAc,CAAC,CAoKzB"}

package/dist/auth/browser-flow.js

@@ -17,33 +17,20 @@
  *
  * @module auth/browser-flow
  */
-import { decodeJwt } from 'jose';
 import { URL } from 'node:url';
 import { question } from '../prompt.js';
 import { MANUAL_REDIRECT_URI, isContainerized, parseCallbackUrl, startCallbackServer, } from './callback-server.js';
 import { fetchAdminMetadata } from './metadata.js';
+import { fetchIssuerJwks, verifyCliIdToken } from './id-token-verifier.js';
 import { generateCodeChallenge, generateCodeVerifier, generateState } from './pkce.js';
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
 /** OIDC scopes requested during the login flow */
 const SCOPES = 'openid profile email offline_access';
-// ---------------------------------------------------------------------------
-// Token Exchange
-// ---------------------------------------------------------------------------
-/**
- * Exchange an authorization code for tokens at the OIDC token endpoint.
- *
- * Sends a POST request with the authorization code, PKCE code_verifier,
- * and redirect URI to complete the Authorization Code flow.
- *
- * @param params - Token exchange parameters
- * @returns Token response with access, refresh, and ID tokens
- * @throws Error if the token exchange fails
- */
-async function exchangeCode(params) {
-    const tokenUrl = `${params.server}/${params.orgSlug}/token`;
-    const response = await fetch(tokenUrl, {
+/** Exchanges a code once while propagating caller-owned cancellation. */
+export async function exchangeAuthorizationCode(params, options) {
+    const response = await fetch(params.tokenEndpoint, {
         method: 'POST',
         headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
         body: new URLSearchParams({
@@ -53,15 +40,38 @@ async function exchangeCode(params) {
             client_id: params.clientId,
             code_verifier: params.codeVerifier,
         }),
+        signal: options.signal,
     });
     if (!response.ok) {
-        const errorData = await response.json().catch(() => ({}));
-        const desc = errorData.error_description ||
-            errorData.error ||
-            `HTTP ${response.status}`;
-        throw new Error(`Token exchange failed: ${desc}`);
+        throw new Error(`Authentication failed (HTTP ${response.status})`);
+    }
+    let value;
+    try {
+        value = await response.json();
+    }
+    catch {
+        throw new Error('Authentication failed');
     }
-    return response.json();
+    if (!value || typeof value !== 'object')
+        throw new Error('Authentication failed');
+    const token = value;
+    if (typeof token.access_token !== 'string' ||
+        token.access_token.length === 0 ||
+        typeof token.id_token !== 'string' ||
+        token.id_token.length === 0 ||
+        typeof token.expires_in !== 'number' ||
+        !Number.isFinite(token.expires_in) ||
+        token.expires_in <= 0 ||
+        (token.refresh_token !== undefined &&
+            (typeof token.refresh_token !== 'string' || token.refresh_token.length === 0))) {
+        throw new Error('Authentication failed');
+    }
+    return {
+        access_token: token.access_token,
+        refresh_token: token.refresh_token,
+        id_token: token.id_token,
+        expires_in: token.expires_in,
+    };
 }
 // ---------------------------------------------------------------------------
 // Flow Orchestration
@@ -79,6 +89,7 @@ async function exchangeCode(params) {
  */
 export async function executeBrowserFlow(options, log = console.log) {
     const { server, noBrowser } = options;
+    const signal = options.signal ?? new AbortController().signal;
     // ---------------------------------------------------------------
     // Step 1: Determine login mode (browser vs. manual)
     // ---------------------------------------------------------------
@@ -91,14 +102,17 @@ export async function executeBrowserFlow(options, log = console.log) {
     // ---------------------------------------------------------------
     let clientId;
     let orgSlug;
+    let issuer;
     if (options.clientId) {
         clientId = options.clientId;
         orgSlug = 'porta-admin';
+        issuer = `${server}/porta-admin`;
     }
     else {
-        const metadata = await fetchAdminMetadata(server);
+        const metadata = await fetchAdminMetadata(server, { signal });
         clientId = metadata.clientId;
         orgSlug = metadata.orgSlug;
+        issuer = metadata.issuer;
     }
     // ---------------------------------------------------------------
     // Step 3: Generate PKCE parameters
@@ -106,6 +120,7 @@ export async function executeBrowserFlow(options, log = console.log) {
     const codeVerifier = generateCodeVerifier();
     const codeChallenge = generateCodeChallenge(codeVerifier);
     const state = generateState();
+    const nonce = generateState();
     // ---------------------------------------------------------------
     // Step 4: Set up redirect URI — mode-dependent
     // ---------------------------------------------------------------
@@ -131,6 +146,7 @@ export async function executeBrowserFlow(options, log = console.log) {
     authUrl.searchParams.set('code_challenge', codeChallenge);
     authUrl.searchParams.set('code_challenge_method', 'S256');
     authUrl.searchParams.set('state', state);
+    authUrl.searchParams.set('nonce', nonce);
     // prompt MUST include `consent` for `offline_access` to survive.
     //
     // Per OIDC Core §3.1.2.1 and node-oidc-provider's check_scope, the provider
@@ -169,14 +185,13 @@ export async function executeBrowserFlow(options, log = console.log) {
     // ---------------------------------------------------------------
     // Step 7: Exchange the authorization code for tokens
     // ---------------------------------------------------------------
-    const tokens = await exchangeCode({
-        server,
-        orgSlug,
+    const tokens = await exchangeAuthorizationCode({
+        tokenEndpoint: `${server}/${orgSlug}/token`,
         code,
         redirectUri,
         clientId,
         codeVerifier,
-    });
+    }, { signal });
     // ---------------------------------------------------------------
     // Step 7.5: Warn if the server did not issue a refresh token.
     //
@@ -192,9 +207,16 @@ export async function executeBrowserFlow(options, log = console.log) {
             "'refresh_token' grant and the 'offline_access' scope.");
     }
     // ---------------------------------------------------------------
-    // Step 8: Decode the ID token to extract user identity
+    // Step 8: Authenticate the ID token before accepting identity
     // ---------------------------------------------------------------
-    const claims = decodeJwt(tokens.id_token);
+    const jwks = await fetchIssuerJwks(`${issuer}/jwks`, { signal });
+    const identity = await verifyCliIdToken({
+        token: tokens.id_token,
+        issuer,
+        clientId,
+        nonce,
+        jwks,
+    });
     // ---------------------------------------------------------------
     // Step 9: Build and return the auth flow result
     // ---------------------------------------------------------------
@@ -207,9 +229,9 @@ export async function executeBrowserFlow(options, log = console.log) {
         idToken: tokens.id_token,
         expiresAt: new Date(Date.now() + tokens.expires_in * 1000).toISOString(),
         userInfo: {
-            sub: claims.sub ?? '',
-            email: claims.email ?? '',
-            name: claims.name ?? undefined,
+            sub: identity.sub,
+            email: identity.email ?? '',
+            name: identity.name,
         },
     };
 }

package/dist/auth/browser-flow.js.map

@@ -1 +1 @@
-{"version":3,"file":"browser-flow.js","sourceRoot":"","sources":["../../src/auth/browser-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAGvF,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,kDAAkD;AAClD,MAAM,MAAM,GAAG,qCAAqC,CAAC;AAgBrD,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,KAAK,UAAU,YAAY,CAAC,MAO3B;IACC,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,QAAQ,CAAC;IAE5D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;QACrC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,oBAAoB;YAChC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;SACnC,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1D,MAAM,IAAI,GACP,SAAoC,CAAC,iBAAiB;YACtD,SAAoC,CAAC,KAAK;YAC3C,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,EAA4B,CAAC;AACnD,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAA2B,EAC3B,GAAG,GAA8B,OAAO,CAAC,GAAG;IAE5C,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAEtC,kEAAkE;IAClE,oDAAoD;IACpD,kEAAkE;IAClE,MAAM,UAAU,GAAG,SAAS,IAAI,eAAe,EAAE,CAAC;IAElD,IAAI,UAAU,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7B,GAAG,CAAC,6DAA6D,CAAC,CAAC;IACrE,CAAC;IAED,kEAAkE;IAClE,yDAAyD;IACzD,kEAAkE;IAClE,IAAI,QAAgB,CAAC;IACrB,IAAI,OAAe,CAAC;IAEpB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC5B,OAAO,GAAG,aAAa,CAAC;IAC1B,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAClD,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAC7B,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IAC7B,CAAC;IAED,kEAAkE;IAClE,mCAAmC;IACnC,kEAAkE;IAClE,MAAM,YAAY,GAAG,oBAAoB,EAAE,CAAC;IAC5C,MAAM,aAAa,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAE9B,kEAAkE;IAClE,+CAA+C;IAC/C,kEAAkE;IAClE,IAAI,WAAmB,CAAC;IACxB,IAAI,QAAyB,CAAC;IAE9B,IAAI,UAAU,EAAE,CAAC;QACf,WAAW,GAAG,mBAAmB,CAAC;QAClC,QAAQ,GAAG,SAAuC,CAAC;IACrD,CAAC;SAAM,CAAC;QACN,MAAM,cAAc,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACxD,WAAW,GAAG,oBAAoB,cAAc,CAAC,IAAI,WAAW,CAAC;QACjE,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC;IACrC,CAAC;IAED,kEAAkE;IAClE,sCAAsC;IACtC,kEAAkE;IAClE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,IAAI,OAAO,OAAO,CAAC,CAAC;IACrD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAClD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAChD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACtD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;IAC1D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IAC1D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzC,iEAAiE;IACjE,EAAE;IACF,4EAA4E;IAC5E,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,0EAA0E;IAC1E,4CAA4C;IAC5C,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAGpD,kEAAkE;IAClE,wDAAwD;IACxD,kEAAkE;IAClE,IAAI,IAAY,CAAC;IAEjB,IAAI,UAAU,EAAE,CAAC;QACf,GAAG,CAAC,4CAA4C,CAAC,CAAC;QAClD,GAAG,CAAC,KAAK,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACjC,GAAG,CAAC,yEAAyE,CAAC,CAAC;QAC/E,GAAG,CAAC,yEAAyE,CAAC,CAAC;QAE/E,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,0BAA0B,CAAC,CAAC;QAC7D,IAAI,GAAG,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,uCAAuC,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,iDAAiD;YACjD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;YAClD,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,qDAAqD,CAAC,CAAC;YAC3D,GAAG,CAAC,KAAK,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;QAED,GAAG,CAAC,+BAA+B,CAAC,CAAC;QACrC,IAAI,GAAG,MAAM,QAAQ,CAAC;IACxB,CAAC;IAED,kEAAkE;IAClE,qDAAqD;IACrD,kEAAkE;IAClE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;QAChC,MAAM;QACN,OAAO;QACP,IAAI;QACJ,WAAW;QACX,QAAQ;QACR,YAAY;KACb,CAAC,CAAC;IAEH,kEAAkE;IAClE,8DAA8D;IAC9D,EAAE;IACF,oEAAoE;IACpE,oEAAoE;IACpE,uEAAuE;IACvE,wEAAwE;IACxE,6EAA6E;IAC7E,kEAAkE;IAClE,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1B,GAAG,CACD,sFAAsF;YACpF,0EAA0E;YAC1E,uDAAuD,CAC1D,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,uDAAuD;IACvD,kEAAkE;IAClE,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE1C,kEAAkE;IAClE,gDAAgD;IAChD,kEAAkE;IAClE,OAAO;QACL,MAAM;QACN,OAAO;QACP,QAAQ;QACR,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,YAAY,EAAE,MAAM,CAAC,aAAa;QAClC,OAAO,EAAE,MAAM,CAAC,QAAQ;QACxB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QACxE,QAAQ,EAAE;YACR,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,EAAE;YACrB,KAAK,EAAG,MAAM,CAAC,KAAgB,IAAI,EAAE;YACrC,IAAI,EAAG,MAAM,CAAC,IAAe,IAAI,SAAS;SAC3C;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"browser-flow.js","sourceRoot":"","sources":["../../src/auth/browser-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAGvF,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,kDAAkD;AAClD,MAAM,MAAM,GAAG,qCAAqC,CAAC;AA6CrD,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAiC,EACjC,OAAgC;IAEhC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE;QACjD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,oBAAoB;YAChC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;SACnC,CAAC;QACF,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAClF,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,IACE,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;QACtC,KAAK,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QAC/B,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC3B,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QACpC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;QAClC,KAAK,CAAC,UAAU,IAAI,CAAC;QACrB,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS;YAChC,CAAC,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,EAChF,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAA2B,EAC3B,GAAG,GAA8B,OAAO,CAAC,GAAG;IAE5C,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IACtC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC;IAE9D,kEAAkE;IAClE,oDAAoD;IACpD,kEAAkE;IAClE,MAAM,UAAU,GAAG,SAAS,IAAI,eAAe,EAAE,CAAC;IAElD,IAAI,UAAU,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7B,GAAG,CAAC,6DAA6D,CAAC,CAAC;IACrE,CAAC;IAED,kEAAkE;IAClE,yDAAyD;IACzD,kEAAkE;IAClE,IAAI,QAAgB,CAAC;IACrB,IAAI,OAAe,CAAC;IACpB,IAAI,MAAc,CAAC;IAEnB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC5B,OAAO,GAAG,aAAa,CAAC;QACxB,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC;IACnC,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9D,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAC7B,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;QAC3B,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC3B,CAAC;IAED,kEAAkE;IAClE,mCAAmC;IACnC,kEAAkE;IAClE,MAAM,YAAY,GAAG,oBAAoB,EAAE,CAAC;IAC5C,MAAM,aAAa,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAE9B,kEAAkE;IAClE,+CAA+C;IAC/C,kEAAkE;IAClE,IAAI,WAAmB,CAAC;IACxB,IAAI,QAAyB,CAAC;IAE9B,IAAI,UAAU,EAAE,CAAC;QACf,WAAW,GAAG,mBAAmB,CAAC;QAClC,QAAQ,GAAG,SAAuC,CAAC;IACrD,CAAC;SAAM,CAAC;QACN,MAAM,cAAc,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACxD,WAAW,GAAG,oBAAoB,cAAc,CAAC,IAAI,WAAW,CAAC;QACjE,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC;IACrC,CAAC;IAED,kEAAkE;IAClE,sCAAsC;IACtC,kEAAkE;IAClE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,IAAI,OAAO,OAAO,CAAC,CAAC;IACrD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAClD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAChD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACtD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;IAC1D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IAC1D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzC,iEAAiE;IACjE,EAAE;IACF,4EAA4E;IAC5E,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,0EAA0E;IAC1E,4CAA4C;IAC5C,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAEpD,kEAAkE;IAClE,wDAAwD;IACxD,kEAAkE;IAClE,IAAI,IAAY,CAAC;IAEjB,IAAI,UAAU,EAAE,CAAC;QACf,GAAG,CAAC,4CAA4C,CAAC,CAAC;QAClD,GAAG,CAAC,KAAK,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACjC,GAAG,CAAC,yEAAyE,CAAC,CAAC;QAC/E,GAAG,CAAC,yEAAyE,CAAC,CAAC;QAE/E,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,0BAA0B,CAAC,CAAC;QAC7D,IAAI,GAAG,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,uCAAuC,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,iDAAiD;YACjD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;YAClD,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,qDAAqD,CAAC,CAAC;YAC3D,GAAG,CAAC,KAAK,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;QAED,GAAG,CAAC,+BAA+B,CAAC,CAAC;QACrC,IAAI,GAAG,MAAM,QAAQ,CAAC;IACxB,CAAC;IAED,kEAAkE;IAClE,qDAAqD;IACrD,kEAAkE;IAClE,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAC5C;QACE,aAAa,EAAE,GAAG,MAAM,IAAI,OAAO,QAAQ;QAC3C,IAAI;QACJ,WAAW;QACX,QAAQ;QACR,YAAY;KACb,EACD,EAAE,MAAM,EAAE,CACX,CAAC;IAEF,kEAAkE;IAClE,8DAA8D;IAC9D,EAAE;IACF,oEAAoE;IACpE,oEAAoE;IACpE,uEAAuE;IACvE,wEAAwE;IACxE,6EAA6E;IAC7E,kEAAkE;IAClE,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1B,GAAG,CACD,sFAAsF;YACpF,0EAA0E;YAC1E,uDAAuD,CAC1D,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,8DAA8D;IAC9D,kEAAkE;IAClE,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,MAAM,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC;QACtC,KAAK,EAAE,MAAM,CAAC,QAAQ;QACtB,MAAM;QACN,QAAQ;QACR,KAAK;QACL,IAAI;KACL,CAAC,CAAC;IAEH,kEAAkE;IAClE,gDAAgD;IAChD,kEAAkE;IAClE,OAAO;QACL,MAAM;QACN,OAAO;QACP,QAAQ;QACR,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,YAAY,EAAE,MAAM,CAAC,aAAa;QAClC,OAAO,EAAE,MAAM,CAAC,QAAQ;QACxB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QACxE,QAAQ,EAAE;YACR,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,EAAE;YAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI;SACpB;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/callback-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"callback-server.d.ts","sourceRoot":"","sources":["../../src/auth/callback-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAaH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,oCAAoC,CAAC;AAMrE;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1B,8CAA8C;IAC9C,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CACjC,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,oBAAoB,CAAC,CA+F/B;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,GACpB,MAAM,CA8BR;AAMD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAUzC"}
+{"version":3,"file":"callback-server.d.ts","sourceRoot":"","sources":["../../src/auth/callback-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAaH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,oCAAoC,CAAC;AAMrE;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1B,8CAA8C;IAC9C,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAyFxF;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CA2BjF;AAMD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAUzC"}

package/dist/auth/callback-server.js

@@ -72,12 +72,10 @@ export function startCallbackServer(expectedState) {
             const errorParam = url.searchParams.get('error');
             // Case 1: OIDC provider returned an error (user cancelled, etc.)
             if (errorParam) {
-                const desc = url.searchParams.get('error_description') || errorParam;
                 res.writeHead(200, { 'Content-Type': 'text/html' });
-                res.end('<html><body><h1>Login Failed</h1>' +
-                    '<p>You can close this tab.</p></body></html>');
+                res.end('<html><body><h1>Login Failed</h1>' + '<p>You can close this tab.</p></body></html>');
                 server.close();
-                rejectCode(new Error(`Authentication failed: ${desc}`));
+                rejectCode(new Error('Authentication failed'));
                 return;
             }
             // Case 2: State mismatch — possible CSRF attack
@@ -92,8 +90,7 @@ export function startCallbackServer(expectedState) {
             // Case 3: No authorization code in the callback
             if (!code) {
                 res.writeHead(200, { 'Content-Type': 'text/html' });
-                res.end('<html><body><h1>Error</h1>' +
-                    '<p>No authorization code received.</p></body></html>');
+                res.end('<html><body><h1>Error</h1>' + '<p>No authorization code received.</p></body></html>');
                 server.close();
                 rejectCode(new Error('No authorization code received'));
                 return;
@@ -145,13 +142,12 @@ export function parseCallbackUrl(pastedUrl, expectedState) {
         url = new URL(pastedUrl.trim());
     }
     catch {
-        throw new Error('Invalid URL. Please copy the full URL from your browser\'s address bar.');
+        throw new Error("Invalid URL. Please copy the full URL from your browser's address bar.");
     }
     // Check for OIDC error response in the callback URL
     const errorParam = url.searchParams.get('error');
     if (errorParam) {
-        const desc = url.searchParams.get('error_description') || errorParam;
-        throw new Error(`Authentication failed: ${desc}`);
+        throw new Error('Authentication failed');
     }
     // Validate state parameter (CSRF protection)
     const returnedState = url.searchParams.get('state');

package/dist/auth/callback-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"callback-server.js","sourceRoot":"","sources":["../../src/auth/callback-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,wEAAwE;AACxE,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,iCAAiC,CAAC;AAkBrE;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CACjC,aAAqB;IAErB,OAAO,IAAI,OAAO,CAAC,CAAC,YAAY,EAAE,EAAE;QAClC,IAAI,WAAmC,CAAC;QACxC,IAAI,UAAgC,CAAC;QAErC,wEAAwE;QACxE,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACvD,WAAW,GAAG,OAAO,CAAC;YACtB,UAAU,GAAG,MAAM,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAW,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAExD,wDAAwD;YACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACjC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACpD,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAEjD,iEAAiE;YACjE,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,IAAI,GACR,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,UAAU,CAAC;gBAC1D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACL,mCAAmC;oBACjC,8CAA8C,CACjD,CAAC;gBACF,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,UAAU,CAAC,IAAI,KAAK,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YAED,gDAAgD;YAChD,IAAI,aAAa,KAAK,aAAa,EAAE,CAAC;gBACpC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACL,qCAAqC;oBACnC,wDAAwD,CAC3D,CAAC;gBACF,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,UAAU,CACR,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAC5D,CAAC;gBACF,OAAO;YACT,CAAC;YAED,gDAAgD;YAChD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACL,4BAA4B;oBAC1B,sDAAsD,CACzD,CAAC;gBACF,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,UAAU,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YAED,kDAAkD;YAClD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;YACpD,GAAG,CAAC,GAAG,CACL,uCAAuC;gBACrC,yEAAyE,CAC5E,CAAC;YACF,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;QAEH,yDAAyD;QACzD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,UAAU,CAAC,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC,CAAC;QAC3D,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAErB,iEAAiE;QACjE,OAAO,CAAC,KAAK,EAAE,CAAC;QAEhB,2DAA2D;QAC3D,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,YAAY,CAAC;gBACX,IAAI;gBACJ,QAAQ;gBACR,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE;aAC5B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,8CAA8C;AAC9C,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAAiB,EACjB,aAAqB;IAErB,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IAED,oDAAoD;IACpD,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,UAAU,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,6CAA6C;IAC7C,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,aAAa,KAAK,aAAa,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,iCAAiC;IACjC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe;IAC7B,6CAA6C;IAC7C,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAErD,2DAA2D;IAC3D,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,aAAa,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"callback-server.js","sourceRoot":"","sources":["../../src/auth/callback-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,wEAAwE;AACxE,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,iCAAiC,CAAC;AAkBrE;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,aAAqB;IACvD,OAAO,IAAI,OAAO,CAAC,CAAC,YAAY,EAAE,EAAE;QAClC,IAAI,WAAmC,CAAC;QACxC,IAAI,UAAgC,CAAC;QAErC,wEAAwE;QACxE,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACvD,WAAW,GAAG,OAAO,CAAC;YACtB,UAAU,GAAG,MAAM,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAW,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAExD,wDAAwD;YACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACjC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACpD,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAEjD,iEAAiE;YACjE,IAAI,UAAU,EAAE,CAAC;gBACf,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACL,mCAAmC,GAAG,8CAA8C,CACrF,CAAC;gBACF,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,UAAU,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;gBAC/C,OAAO;YACT,CAAC;YAED,gDAAgD;YAChD,IAAI,aAAa,KAAK,aAAa,EAAE,CAAC;gBACpC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACL,qCAAqC;oBACnC,wDAAwD,CAC3D,CAAC;gBACF,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,UAAU,CAAC,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC,CAAC;gBACxE,OAAO;YACT,CAAC;YAED,gDAAgD;YAChD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACL,4BAA4B,GAAG,sDAAsD,CACtF,CAAC;gBACF,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,UAAU,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YAED,kDAAkD;YAClD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;YACpD,GAAG,CAAC,GAAG,CACL,uCAAuC;gBACrC,yEAAyE,CAC5E,CAAC;YACF,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;QAEH,yDAAyD;QACzD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,UAAU,CAAC,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC,CAAC;QAC3D,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAErB,iEAAiE;QACjE,OAAO,CAAC,KAAK,EAAE,CAAC;QAEhB,2DAA2D;QAC3D,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,YAAY,CAAC;gBACX,IAAI;gBACJ,QAAQ;gBACR,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE;aAC5B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,8CAA8C;AAC9C,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,aAAqB;IACvE,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;IAED,oDAAoD;IACpD,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,6CAA6C;IAC7C,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,aAAa,KAAK,aAAa,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,iCAAiC;IACjC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe;IAC7B,6CAA6C;IAC7C,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAErD,2DAA2D;IAC3D,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,aAAa,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/auth/id-token-verifier.d.ts

@@ -0,0 +1,39 @@
+/** Secure OIDC ID-token verification for interactive CLI authentication. */
+import { type JSONWebKeySet } from 'jose';
+import type { CliAuthOperationOptions, VerifiedIdentity } from './types.js';
+/** Inputs that bind an ID token to one authorization request. */
+export interface VerifyCliIdTokenRequest {
+    /** Compact ID token returned by the issuer. */
+    readonly token: string;
+    /** Exact discovered issuer URL. */
+    readonly issuer: string;
+    /** Public CLI client identifier. */
+    readonly clientId: string;
+    /** Unpredictable nonce sent in the matching authorization request. */
+    readonly nonce: string;
+    /** Issuer key set obtained from trusted discovery metadata. */
+    readonly jwks: JSONWebKeySet;
+}
+/** Optional context required to authenticate a refreshed ID token. */
+export type IdTokenValidationContext = Omit<VerifyCliIdTokenRequest, 'token'>;
+/** Inputs for retaining or safely updating display identity after refresh. */
+export interface RefreshIdentityRequest {
+    /** Previously authenticated identity. */
+    readonly original: VerifiedIdentity;
+    /** Immutable subject established by the original login. */
+    readonly originalSubject: string;
+    /** Optional ID token returned by refresh. */
+    readonly token?: string;
+    /** Original validation context, when still available. */
+    readonly validationContext?: IdTokenValidationContext;
+}
+/** Verifies signature, issuer, audience, time, nonce, and subject. */
+export declare function verifyCliIdToken(request: VerifyCliIdTokenRequest): Promise<VerifiedIdentity>;
+/** Fetches and minimally validates an issuer JWKS with caller-owned cancellation. */
+export declare function fetchIssuerJwks(endpoint: string, options: CliAuthOperationOptions): Promise<JSONWebKeySet>;
+/**
+ * Accepts refreshed display claims only when the original verification context
+ * is available and the immutable subject remains unchanged.
+ */
+export declare function updateDisplayIdentityFromRefresh(request: RefreshIdentityRequest): Promise<VerifiedIdentity>;
+//# sourceMappingURL=id-token-verifier.d.ts.map

package/dist/auth/id-token-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"id-token-verifier.d.ts","sourceRoot":"","sources":["../../src/auth/id-token-verifier.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAE5E,OAAO,EAIL,KAAK,aAAa,EAEnB,MAAM,MAAM,CAAC;AACd,OAAO,KAAK,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAW5E,iEAAiE;AACjE,MAAM,WAAW,uBAAuB;IACtC,+CAA+C;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mCAAmC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oCAAoC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;CAC9B;AAED,sEAAsE;AACtE,MAAM,MAAM,wBAAwB,GAAG,IAAI,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;AAE9E,8EAA8E;AAC9E,MAAM,WAAW,sBAAsB;IACrC,yCAAyC;IACzC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,2DAA2D;IAC3D,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,yDAAyD;IACzD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;CACvD;AAaD,sEAAsE;AACtE,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,gBAAgB,CAAC,CAwC3B;AAED,qFAAqF;AACrF,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,aAAa,CAAC,CAmBxB;AAED;;;GAGG;AACH,wBAAsB,gCAAgC,CACpD,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CAW3B"}

package/dist/auth/id-token-verifier.js

@@ -0,0 +1,104 @@
+/** Secure OIDC ID-token verification for interactive CLI authentication. */
+import { createLocalJWKSet, decodeProtectedHeader, jwtVerify, } from 'jose';
+/** Detects ASCII and C1 controls that can alter terminal presentation. */
+function containsTerminalControl(value) {
+    for (const character of value) {
+        const codePoint = character.codePointAt(0) ?? 0;
+        if (codePoint <= 0x1f || (codePoint >= 0x7f && codePoint <= 0x9f))
+            return true;
+    }
+    return false;
+}
+/** Returns an allowlisted optional string claim. */
+function optionalString(payload, claim) {
+    const value = payload[claim];
+    return typeof value === 'string' &&
+        value.length > 0 &&
+        value.length <= 256 &&
+        !containsTerminalControl(value)
+        ? value
+        : undefined;
+}
+/** Verifies signature, issuer, audience, time, nonce, and subject. */
+export async function verifyCliIdToken(request) {
+    try {
+        const verificationTime = Math.floor(Date.now() / 1000);
+        const protectedHeader = decodeProtectedHeader(request.token);
+        if (protectedHeader.alg !== 'ES256')
+            throw new Error('Unexpected signing algorithm');
+        const { payload } = await jwtVerify(request.token, createLocalJWKSet(request.jwks), {
+            algorithms: ['ES256'],
+            audience: request.clientId,
+            issuer: request.issuer,
+        });
+        if (typeof payload.iat !== 'number' ||
+            payload.iat > verificationTime + 60 ||
+            typeof payload.exp !== 'number' ||
+            payload.exp <= verificationTime ||
+            payload.nonce !== request.nonce ||
+            typeof payload.sub !== 'string' ||
+            payload.sub.length === 0 ||
+            payload.sub.length > 255 ||
+            containsTerminalControl(payload.sub)) {
+            throw new Error('Invalid required claims');
+        }
+        const audiences = Array.isArray(payload.aud) ? payload.aud : [payload.aud];
+        if (!audiences.includes(request.clientId) ||
+            (audiences.length > 1 && payload.azp !== request.clientId) ||
+            (payload.azp !== undefined && payload.azp !== request.clientId)) {
+            throw new Error('Invalid audience binding');
+        }
+        return {
+            sub: payload.sub,
+            email: optionalString(payload, 'email'),
+            name: optionalString(payload, 'name'),
+        };
+    }
+    catch {
+        throw new Error('Authentication failed');
+    }
+}
+/** Fetches and minimally validates an issuer JWKS with caller-owned cancellation. */
+export async function fetchIssuerJwks(endpoint, options) {
+    let response;
+    try {
+        response = await fetch(endpoint, { signal: options.signal });
+    }
+    catch (error) {
+        if (error instanceof DOMException && error.name === 'AbortError')
+            throw error;
+        throw new Error('Authentication failed', { cause: error });
+    }
+    if (!response.ok)
+        throw new Error('Authentication failed');
+    let value;
+    try {
+        value = await response.json();
+    }
+    catch {
+        throw new Error('Authentication failed');
+    }
+    if (!value || typeof value !== 'object' || !('keys' in value) || !Array.isArray(value.keys)) {
+        throw new Error('Authentication failed');
+    }
+    return { keys: value.keys };
+}
+/**
+ * Accepts refreshed display claims only when the original verification context
+ * is available and the immutable subject remains unchanged.
+ */
+export async function updateDisplayIdentityFromRefresh(request) {
+    if (!request.token || !request.validationContext)
+        return request.original;
+    try {
+        const refreshed = await verifyCliIdToken({
+            ...request.validationContext,
+            token: request.token,
+        });
+        return refreshed.sub === request.originalSubject ? refreshed : request.original;
+    }
+    catch {
+        return request.original;
+    }
+}
+//# sourceMappingURL=id-token-verifier.js.map

package/dist/auth/id-token-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"id-token-verifier.js","sourceRoot":"","sources":["../../src/auth/id-token-verifier.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAE5E,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,SAAS,GAGV,MAAM,MAAM,CAAC;AAGd,0EAA0E;AAC1E,SAAS,uBAAuB,CAAC,KAAa;IAC5C,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,SAAS,IAAI,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AA+BD,oDAAoD;AACpD,SAAS,cAAc,CAAC,OAAmB,EAAE,KAAuB;IAClE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ;QAC9B,KAAK,CAAC,MAAM,GAAG,CAAC;QAChB,KAAK,CAAC,MAAM,IAAI,GAAG;QACnB,CAAC,uBAAuB,CAAC,KAAK,CAAC;QAC/B,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAgC;IAEhC,IAAI,CAAC;QACH,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACvD,MAAM,eAAe,GAAG,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7D,IAAI,eAAe,CAAC,GAAG,KAAK,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAErF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;YAClF,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QACH,IACE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAC/B,OAAO,CAAC,GAAG,GAAG,gBAAgB,GAAG,EAAE;YACnC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAC/B,OAAO,CAAC,GAAG,IAAI,gBAAgB;YAC/B,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK;YAC/B,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAC/B,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG;YACxB,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,EACpC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3E,IACE,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;YACrC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,QAAQ,CAAC;YAC1D,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,QAAQ,CAAC,EAC/D,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO;YACL,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC;YACvC,IAAI,EAAE,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC;SACtC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAgB,EAChB,OAAgC;IAEhC,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;YAAE,MAAM,KAAK,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3D,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,OAA+B;IAE/B,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,iBAAiB;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC;IAC1E,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC;YACvC,GAAG,OAAO,CAAC,iBAAiB;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,GAAG,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,QAAQ,CAAC;IAC1B,CAAC;AACH,CAAC"}

package/dist/auth/login-coordinator.d.ts

@@ -0,0 +1,72 @@
+/** UI-neutral coordination for the CLI Authorization Code + PKCE flow. */
+import type { AdminCapabilities } from '../admin/state.js';
+import type { AuthFlowResult, CliAuthOperationOptions, VerifiedIdentity } from './types.js';
+/** Parameters used to create one authorization request. */
+export interface AuthorizationRequestOptions {
+    /** Exact organization issuer. */
+    readonly issuer: string;
+    /** Public CLI client identifier. */
+    readonly clientId: string;
+    /** Redirect URI registered for the native CLI. */
+    readonly redirectUri?: string;
+}
+/** Security values bound to one authorization request and callback. */
+export interface AuthorizationRequest {
+    /** Complete browser authorization URL. */
+    readonly url: URL;
+    /** CSRF state value. */
+    readonly state: string;
+    /** OIDC nonce value. */
+    readonly nonce: string;
+    /** PKCE verifier retained for the token exchange. */
+    readonly codeVerifier: string;
+    /** Exact redirect URI included in the request. */
+    readonly redirectUri: string;
+}
+/** UI interactions needed by the authentication coordinator. */
+export interface LoginInteraction {
+    /** Shows a browser URL when automatic opening is unavailable. */
+    readonly presentAuthorizationUrl: (url: URL, signal: AbortSignal) => Promise<void>;
+    /** Reads one complete callback URL from the owning UI. */
+    readonly requestManualCallback: (signal: AbortSignal) => Promise<string>;
+    /** Confirms replacement of credentials belonging to another origin. */
+    readonly confirmCredentialReplacement: (currentServer: URL, nextServer: URL, signal: AbortSignal) => Promise<boolean>;
+}
+/** Injectable boundaries used by a CLI authentication attempt. */
+export interface LoginRequest {
+    /** Selected Porta server origin. */
+    readonly server: URL;
+    /** Optional public client override retained for existing CLI usage. */
+    readonly clientId?: string;
+    /** Uses pasted callback completion instead of a local listener. */
+    readonly noBrowser?: boolean;
+    /** Browser opener, injectable for tests and alternate UIs. */
+    readonly openBrowser?: (url: URL) => Promise<unknown>;
+    /** Existing profile origin, used to prevent silent cross-server replacement. */
+    readonly currentServer?: URL;
+    /** Persists only a fully authenticated credential result. */
+    readonly persistCredentials?: (credentials: AuthFlowResult) => Promise<void> | void;
+}
+/** Result returned after a successful authenticated login. */
+export interface VerifiedSession {
+    /** Successful login discriminator. */
+    readonly status: 'authenticated';
+    /** Fully verified identity accepted from the ID token. */
+    readonly identity: VerifiedIdentity;
+    /** Organization actions from live UserInfo, retained only in memory. */
+    readonly capabilities: AdminCapabilities;
+    /** Credentials committed by the coordinator. */
+    readonly credentials: AuthFlowResult;
+}
+/** Typed cancellation returned without persisting partial authentication state. */
+export interface CancelledLogin {
+    /** Cancellation discriminator. */
+    readonly status: 'cancelled';
+}
+/** Creates fresh state, PKCE, and nonce values for one browser request. */
+export declare function createAuthorizationRequest(options: AuthorizationRequestOptions): Promise<AuthorizationRequest>;
+/** Validates one callback URL against its exact request state. */
+export declare function validateAuthorizationCallback(callbackUrl: string, request: AuthorizationRequest): string;
+/** Completes one authentication attempt and persists only verified credentials. */
+export declare function authenticateCliSession(request: LoginRequest, interaction: LoginInteraction, options: CliAuthOperationOptions): Promise<VerifiedSession | CancelledLogin>;
+//# sourceMappingURL=login-coordinator.d.ts.map

package/dist/auth/login-coordinator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-coordinator.d.ts","sourceRoot":"","sources":["../../src/auth/login-coordinator.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAS1E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAa5F,2DAA2D;AAC3D,MAAM,WAAW,2BAA2B;IAC1C,iCAAiC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oCAAoC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,uEAAuE;AACvE,MAAM,WAAW,oBAAoB;IACnC,0CAA0C;IAC1C,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,wBAAwB;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,wBAAwB;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,kDAAkD;IAClD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,gEAAgE;AAChE,MAAM,WAAW,gBAAgB;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,uBAAuB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnF,0DAA0D;IAC1D,QAAQ,CAAC,qBAAqB,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACzE,uEAAuE;IACvE,QAAQ,CAAC,4BAA4B,EAAE,CACrC,aAAa,EAAE,GAAG,EAClB,UAAU,EAAE,GAAG,EACf,MAAM,EAAE,WAAW,KAChB,OAAO,CAAC,OAAO,CAAC,CAAC;CACvB;AAED,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,oCAAoC;IACpC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC;IACrB,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,mEAAmE;IACnE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,8DAA8D;IAC9D,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD,gFAAgF;IAChF,QAAQ,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC,WAAW,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACrF;AAED,8DAA8D;AAC9D,MAAM,WAAW,eAAe;IAC9B,sCAAsC;IACtC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,wEAAwE;IACxE,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC;IACzC,gDAAgD;IAChD,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;CACtC;AAED,mFAAmF;AACnF,MAAM,WAAW,cAAc;IAC7B,kCAAkC;IAClC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED,2EAA2E;AAC3E,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,oBAAoB,CAAC,CAgB/B;AAED,kEAAkE;AAClE,wBAAgB,6BAA6B,CAC3C,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,oBAAoB,GAC5B,MAAM,CAqBR;AA0CD,mFAAmF;AACnF,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,YAAY,EACrB,WAAW,EAAE,gBAAgB,EAC7B,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,eAAe,GAAG,cAAc,CAAC,CAuE3C"}