@pwfabric/runtime 0.0.0-stage → 1.0.0-rc.1

package/dist/auth/provider.d.ts

@@ -0,0 +1,132 @@
+/**
+ * Authentication Provider
+ *
+ * Authentication provider interface and implementations
+ *
+ * @module @pwfabric/runtime/auth/provider
+ */
+import type { AuthProviderType, AuthProviderConfig, MsalConfig, OAuth2Config, ApiKeyConfig, AuthSession, AuthResult, TokenResult, UserIdentity } from './types.js';
+/**
+ * Authentication provider interface
+ */
+export interface AuthProvider {
+    readonly type: AuthProviderType;
+    readonly config: AuthProviderConfig;
+    /**
+     * Initialize the provider
+     */
+    initialize(): Promise<void>;
+    /**
+     * Start authentication flow
+     */
+    login(options?: LoginOptions): Promise<AuthResult>;
+    /**
+     * End authentication session
+     */
+    logout(): Promise<void>;
+    /**
+     * Get current session
+     */
+    getSession(): AuthSession | undefined;
+    /**
+     * Acquire token silently
+     */
+    acquireTokenSilent(scopes?: readonly string[]): Promise<TokenResult>;
+    /**
+     * Check if authenticated
+     */
+    isAuthenticated(): boolean;
+    /**
+     * Get current user
+     */
+    getUser(): UserIdentity | undefined;
+}
+/**
+ * Login options
+ */
+export interface LoginOptions {
+    readonly scopes?: readonly string[];
+    readonly prompt?: 'login' | 'consent' | 'select_account' | 'none';
+    readonly loginHint?: string;
+}
+/**
+ * MSAL authentication provider
+ *
+ * Note: This is a stub implementation. In production, this would
+ * integrate with @azure/msal-browser or @azure/msal-node.
+ */
+export declare class MsalAuthProvider implements AuthProvider {
+    readonly type: AuthProviderType;
+    readonly config: MsalConfig;
+    private session;
+    private initialized;
+    constructor(config: MsalConfig);
+    initialize(): Promise<void>;
+    login(options?: LoginOptions): Promise<AuthResult>;
+    logout(): Promise<void>;
+    getSession(): AuthSession | undefined;
+    acquireTokenSilent(_scopes?: readonly string[]): Promise<TokenResult>;
+    isAuthenticated(): boolean;
+    getUser(): UserIdentity | undefined;
+}
+/**
+ * OAuth2 PKCE authentication provider
+ *
+ * Implements the Authorization Code flow with PKCE (RFC 7636)
+ * for secure authentication without client secrets.
+ */
+export declare class OAuth2PkceAuthProvider implements AuthProvider {
+    readonly type: AuthProviderType;
+    readonly config: OAuth2Config;
+    private session;
+    private codeVerifier;
+    private initialized;
+    constructor(config: OAuth2Config);
+    initialize(): Promise<void>;
+    login(options?: LoginOptions): Promise<AuthResult>;
+    /**
+     * Exchange authorization code for tokens (PKCE Step 2)
+     *
+     * Called after the user completes the OAuth flow and the authorization
+     * code is received via the redirect URI.
+     */
+    exchangeCode(code: string): Promise<AuthResult>;
+    logout(): Promise<void>;
+    getSession(): AuthSession | undefined;
+    acquireTokenSilent(_scopes?: readonly string[]): Promise<TokenResult>;
+    isAuthenticated(): boolean;
+    getUser(): UserIdentity | undefined;
+    /**
+     * Refresh the access token using a refresh token
+     */
+    private refreshToken;
+    /**
+     * Decode user identity from JWT token claims
+     */
+    private decodeUserFromToken;
+}
+/**
+ * API Key authentication provider
+ */
+export declare class ApiKeyAuthProvider implements AuthProvider {
+    readonly type: AuthProviderType;
+    readonly config: ApiKeyConfig;
+    private session;
+    private apiKey;
+    constructor(config: ApiKeyConfig);
+    initialize(): Promise<void>;
+    login(_options?: LoginOptions): Promise<AuthResult>;
+    logout(): Promise<void>;
+    getSession(): AuthSession | undefined;
+    acquireTokenSilent(): Promise<TokenResult>;
+    isAuthenticated(): boolean;
+    getUser(): UserIdentity | undefined;
+    /**
+     * Set the API key
+     */
+    setApiKey(key: string): void;
+}
+/**
+ * Create an authentication provider
+ */
+export declare function createAuthProvider(config: AuthProviderConfig): AuthProvider;

package/dist/auth/provider.js

@@ -0,0 +1,473 @@
+/**
+ * Authentication Provider
+ *
+ * Authentication provider interface and implementations
+ *
+ * @module @pwfabric/runtime/auth/provider
+ */
+// ============================================================
+// MSAL AUTH PROVIDER (Stub)
+// ============================================================
+/**
+ * MSAL authentication provider
+ *
+ * Note: This is a stub implementation. In production, this would
+ * integrate with @azure/msal-browser or @azure/msal-node.
+ */
+export class MsalAuthProvider {
+    type = 'msal';
+    config;
+    session;
+    initialized = false;
+    constructor(config) {
+        this.config = config;
+    }
+    async initialize() {
+        // In production: Initialize MSAL instance
+        this.initialized = true;
+    }
+    async login(options) {
+        if (!this.initialized) {
+            return {
+                success: false,
+                error: {
+                    type: 'invalid_config',
+                    message: 'Provider not initialized',
+                },
+            };
+        }
+        // Stub: Create mock session
+        const scopes = options?.scopes ?? this.config.scopes;
+        const token = {
+            accessToken: 'mock_access_token',
+            idToken: 'mock_id_token',
+            expiresAt: Date.now() + 3600000, // 1 hour
+            scopes,
+        };
+        const user = {
+            id: 'mock_user_id',
+            name: 'Mock User',
+            email: 'mock@example.com',
+            ...(this.config.worldId !== undefined ? { worldId: this.config.worldId } : {}),
+        };
+        this.session = {
+            id: `session_${Date.now()}`,
+            state: 'authenticated',
+            user,
+            token,
+            provider: 'msal',
+            createdAt: Date.now(),
+            expiresAt: token.expiresAt,
+        };
+        return { success: true, session: this.session };
+    }
+    async logout() {
+        this.session = undefined;
+    }
+    getSession() {
+        return this.session;
+    }
+    async acquireTokenSilent(_scopes) {
+        if (!this.session?.token) {
+            return {
+                success: false,
+                error: {
+                    type: 'token_expired',
+                    message: 'No active session',
+                },
+            };
+        }
+        // Check if token is expired
+        if (this.session.token.expiresAt < Date.now()) {
+            return {
+                success: false,
+                error: {
+                    type: 'token_expired',
+                    message: 'Token has expired',
+                },
+            };
+        }
+        return { success: true, token: this.session.token };
+    }
+    isAuthenticated() {
+        return this.session?.state === 'authenticated';
+    }
+    getUser() {
+        return this.session?.user;
+    }
+}
+// ============================================================
+// OAUTH2 PKCE AUTH PROVIDER
+// ============================================================
+/**
+ * Generate a cryptographically random code verifier for PKCE
+ */
+function generateCodeVerifier() {
+    const buffer = new Uint8Array(32);
+    crypto.getRandomValues(buffer);
+    return Array.from(buffer, (b) => b.toString(16).padStart(2, '0')).join('');
+}
+/**
+ * Generate a code challenge from a code verifier (S256 method)
+ */
+async function generateCodeChallenge(verifier) {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(verifier);
+    const digest = await crypto.subtle.digest('SHA-256', data);
+    return btoa(String.fromCharCode(...new Uint8Array(digest)))
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=+$/, '');
+}
+/**
+ * OAuth2 PKCE authentication provider
+ *
+ * Implements the Authorization Code flow with PKCE (RFC 7636)
+ * for secure authentication without client secrets.
+ */
+export class OAuth2PkceAuthProvider {
+    type = 'oauth2';
+    config;
+    session;
+    codeVerifier;
+    initialized = false;
+    constructor(config) {
+        this.config = config;
+    }
+    async initialize() {
+        this.initialized = true;
+    }
+    async login(options) {
+        if (!this.initialized) {
+            return {
+                success: false,
+                error: { type: 'invalid_config', message: 'Provider not initialized' },
+            };
+        }
+        try {
+            // Step 1: Generate PKCE code verifier and challenge
+            this.codeVerifier = generateCodeVerifier();
+            const codeChallenge = await generateCodeChallenge(this.codeVerifier);
+            const state = generateCodeVerifier().slice(0, 32);
+            const scopes = options?.scopes ?? this.config.scopes;
+            // Step 2: Build authorization URL
+            const authUrl = new URL(this.config.authorizationEndpoint);
+            authUrl.searchParams.set('response_type', 'code');
+            authUrl.searchParams.set('client_id', this.config.clientId);
+            authUrl.searchParams.set('redirect_uri', this.config.redirectUri);
+            authUrl.searchParams.set('scope', scopes.join(' '));
+            authUrl.searchParams.set('state', state);
+            authUrl.searchParams.set('code_challenge', codeChallenge);
+            authUrl.searchParams.set('code_challenge_method', 'S256');
+            if (options?.prompt) {
+                authUrl.searchParams.set('prompt', options.prompt);
+            }
+            if (options?.loginHint) {
+                authUrl.searchParams.set('login_hint', options.loginHint);
+            }
+            // Step 3: Return the authorization URL for the caller to open
+            // In browser context, this would redirect. In CLI, the caller
+            // starts a local server to capture the callback.
+            return {
+                success: false,
+                error: {
+                    type: 'provider_error',
+                    message: 'PKCE_REDIRECT_REQUIRED',
+                    code: authUrl.toString(),
+                },
+            };
+        }
+        catch (error) {
+            return {
+                success: false,
+                error: {
+                    type: 'provider_error',
+                    message: error instanceof Error ? error.message : 'OAuth2 login failed',
+                    cause: error,
+                },
+            };
+        }
+    }
+    /**
+     * Exchange authorization code for tokens (PKCE Step 2)
+     *
+     * Called after the user completes the OAuth flow and the authorization
+     * code is received via the redirect URI.
+     */
+    async exchangeCode(code) {
+        if (!this.codeVerifier) {
+            return {
+                success: false,
+                error: { type: 'invalid_config', message: 'No PKCE flow in progress. Call login() first.' },
+            };
+        }
+        try {
+            const response = await fetch(this.config.tokenEndpoint, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                body: new URLSearchParams({
+                    grant_type: 'authorization_code',
+                    code,
+                    redirect_uri: this.config.redirectUri,
+                    client_id: this.config.clientId,
+                    code_verifier: this.codeVerifier,
+                }),
+            });
+            if (!response.ok) {
+                const errorBody = await response.text();
+                return {
+                    success: false,
+                    error: {
+                        type: 'provider_error',
+                        message: `Token exchange failed: ${response.status}`,
+                        code: errorBody,
+                    },
+                };
+            }
+            const tokenData = (await response.json());
+            const token = {
+                accessToken: tokenData.access_token,
+                ...(tokenData.refresh_token !== undefined ? { refreshToken: tokenData.refresh_token } : {}),
+                ...(tokenData.id_token !== undefined ? { idToken: tokenData.id_token } : {}),
+                expiresAt: Date.now() + tokenData.expires_in * 1000,
+                scopes: tokenData.scope?.split(' ') ?? this.config.scopes,
+            };
+            // Decode user info from ID token or access token claims
+            const user = this.decodeUserFromToken(token);
+            this.session = {
+                id: `session_${Date.now()}`,
+                state: 'authenticated',
+                ...(user !== undefined ? { user } : {}),
+                token,
+                provider: 'oauth2',
+                createdAt: Date.now(),
+                expiresAt: token.expiresAt,
+            };
+            // Clear the code verifier after successful exchange
+            this.codeVerifier = undefined;
+            return { success: true, session: this.session };
+        }
+        catch (error) {
+            return {
+                success: false,
+                error: {
+                    type: 'network_error',
+                    message: error instanceof Error ? error.message : 'Token exchange failed',
+                    cause: error,
+                },
+            };
+        }
+    }
+    async logout() {
+        this.session = undefined;
+        this.codeVerifier = undefined;
+    }
+    getSession() {
+        return this.session;
+    }
+    async acquireTokenSilent(_scopes) {
+        if (!this.session?.token) {
+            return {
+                success: false,
+                error: { type: 'token_expired', message: 'No active session' },
+            };
+        }
+        // Check if token is expired
+        if (this.session.token.expiresAt < Date.now()) {
+            // Try refresh if refresh token available
+            if (this.session.token.refreshToken) {
+                return this.refreshToken(this.session.token.refreshToken);
+            }
+            return {
+                success: false,
+                error: {
+                    type: 'token_expired',
+                    message: 'Token has expired and no refresh token available',
+                },
+            };
+        }
+        return { success: true, token: this.session.token };
+    }
+    isAuthenticated() {
+        if (this.session?.state !== 'authenticated')
+            return false;
+        if (this.session.token && this.session.token.expiresAt < Date.now())
+            return false;
+        return true;
+    }
+    getUser() {
+        return this.session?.user;
+    }
+    /**
+     * Refresh the access token using a refresh token
+     */
+    async refreshToken(refreshToken) {
+        try {
+            const response = await fetch(this.config.tokenEndpoint, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                body: new URLSearchParams({
+                    grant_type: 'refresh_token',
+                    refresh_token: refreshToken,
+                    client_id: this.config.clientId,
+                }),
+            });
+            if (!response.ok) {
+                return {
+                    success: false,
+                    error: { type: 'token_expired', message: `Refresh failed: ${response.status}` },
+                };
+            }
+            const tokenData = (await response.json());
+            const newRefreshToken = tokenData.refresh_token ?? refreshToken;
+            const token = {
+                accessToken: tokenData.access_token,
+                refreshToken: newRefreshToken,
+                ...(tokenData.id_token !== undefined ? { idToken: tokenData.id_token } : {}),
+                expiresAt: Date.now() + tokenData.expires_in * 1000,
+                scopes: tokenData.scope?.split(' ') ?? this.config.scopes,
+            };
+            // Update session with new token
+            const user = this.decodeUserFromToken(token) ?? this.session?.user;
+            this.session = {
+                id: this.session?.id ?? `session_${Date.now()}`,
+                state: 'authenticated',
+                ...(user !== undefined ? { user } : {}),
+                token,
+                provider: 'oauth2',
+                createdAt: this.session?.createdAt ?? Date.now(),
+                expiresAt: token.expiresAt,
+            };
+            return { success: true, token };
+        }
+        catch (error) {
+            return {
+                success: false,
+                error: {
+                    type: 'network_error',
+                    message: error instanceof Error ? error.message : 'Token refresh failed',
+                    cause: error,
+                },
+            };
+        }
+    }
+    /**
+     * Decode user identity from JWT token claims
+     */
+    decodeUserFromToken(token) {
+        const jwtToDecode = token.idToken ?? token.accessToken;
+        try {
+            const parts = jwtToDecode.split('.');
+            if (parts.length !== 3)
+                return undefined;
+            const encodedPayload = parts[1];
+            if (!encodedPayload)
+                return undefined;
+            const payload = JSON.parse(atob(encodedPayload.replace(/-/g, '+').replace(/_/g, '/')));
+            return {
+                id: payload.sub ?? 'unknown',
+                ...(payload.name !== undefined ? { name: payload.name } : {}),
+                ...(payload.email !== undefined ? { email: payload.email } : {}),
+                ...(payload.wid !== undefined ? { worldId: payload.wid } : {}),
+                ...(payload.roles !== undefined ? { roles: payload.roles } : {}),
+            };
+        }
+        catch {
+            return undefined;
+        }
+    }
+}
+// ============================================================
+// API KEY AUTH PROVIDER
+// ============================================================
+/**
+ * API Key authentication provider
+ */
+export class ApiKeyAuthProvider {
+    type = 'api-key';
+    config;
+    session;
+    apiKey;
+    constructor(config) {
+        this.config = config;
+    }
+    async initialize() {
+        // No initialization needed
+    }
+    async login(_options) {
+        // API key auth doesn't have a login flow
+        // The key is typically set via setApiKey()
+        if (!this.apiKey) {
+            return {
+                success: false,
+                error: {
+                    type: 'invalid_credentials',
+                    message: 'API key not set',
+                },
+            };
+        }
+        const token = {
+            accessToken: this.apiKey,
+            expiresAt: Date.now() + 86400000, // 24 hours
+            scopes: [],
+        };
+        this.session = {
+            id: `session_${Date.now()}`,
+            state: 'authenticated',
+            token,
+            provider: 'api-key',
+            createdAt: Date.now(),
+        };
+        return { success: true, session: this.session };
+    }
+    async logout() {
+        this.session = undefined;
+        this.apiKey = undefined;
+    }
+    getSession() {
+        return this.session;
+    }
+    async acquireTokenSilent() {
+        if (!this.session?.token) {
+            return {
+                success: false,
+                error: {
+                    type: 'token_expired',
+                    message: 'No active session',
+                },
+            };
+        }
+        return { success: true, token: this.session.token };
+    }
+    isAuthenticated() {
+        return this.session?.state === 'authenticated';
+    }
+    getUser() {
+        return undefined; // API key auth typically doesn't have user identity
+    }
+    /**
+     * Set the API key
+     */
+    setApiKey(key) {
+        this.apiKey = key;
+    }
+}
+// ============================================================
+// AUTH PROVIDER FACTORY
+// ============================================================
+/**
+ * Create an authentication provider
+ */
+export function createAuthProvider(config) {
+    switch (config.type) {
+        case 'msal':
+            return new MsalAuthProvider(config);
+        case 'oauth2':
+            return new OAuth2PkceAuthProvider(config);
+        case 'api-key':
+            return new ApiKeyAuthProvider(config);
+        default:
+            throw new Error(`Unknown auth provider type: ${config.type}`);
+    }
+}
+//# sourceMappingURL=provider.js.map

package/dist/auth/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../src/auth/provider.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAuEH,+DAA+D;AAC/D,4BAA4B;AAC5B,+DAA+D;AAE/D;;;;;GAKG;AACH,MAAM,OAAO,gBAAgB;IAClB,IAAI,GAAqB,MAAM,CAAA;IAC/B,MAAM,CAAY;IAEnB,OAAO,CAAyB;IAChC,WAAW,GAAG,KAAK,CAAA;IAE3B,YAAY,MAAkB;QAC5B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAED,KAAK,CAAC,UAAU;QACd,0CAA0C;QAC1C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAA;IACzB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAsB;QAChC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EAAE,0BAA0B;iBACpC;aACF,CAAA;QACH,CAAC;QAED,4BAA4B;QAC5B,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAA;QACpD,MAAM,KAAK,GAAc;YACvB,WAAW,EAAE,mBAAmB;YAChC,OAAO,EAAE,eAAe;YACxB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS;YAC1C,MAAM;SACP,CAAA;QAED,MAAM,IAAI,GAAiB;YACzB,EAAE,EAAE,cAAc;YAClB,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,kBAAkB;YACzB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/E,CAAA;QAED,IAAI,CAAC,OAAO,GAAG;YACb,EAAE,EAAE,WAAW,IAAI,CAAC,GAAG,EAAE,EAAE;YAC3B,KAAK,EAAE,eAAe;YACtB,IAAI;YACJ,KAAK;YACL,QAAQ,EAAE,MAAM;YAChB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAA;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;IACjD,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,CAAC,OAAO,GAAG,SAAS,CAAA;IAC1B,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,OAAO,CAAA;IACrB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,OAA2B;QAClD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;YACzB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,mBAAmB;iBAC7B;aACF,CAAA;QACH,CAAC;QAED,4BAA4B;QAC5B,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC9C,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,mBAAmB;iBAC7B;aACF,CAAA;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAA;IACrD,CAAC;IAED,eAAe;QACb,OAAO,IAAI,CAAC,OAAO,EAAE,KAAK,KAAK,eAAe,CAAA;IAChD,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,OAAO,EAAE,IAAI,CAAA;IAC3B,CAAC;CACF;AAED,+DAA+D;AAC/D,4BAA4B;AAC5B,+DAA+D;AAE/D;;GAEG;AACH,SAAS,oBAAoB;IAC3B,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;IACjC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAC5E,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,qBAAqB,CAAC,QAAgB;IACnD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;IACjC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IACrC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IAC1D,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;SACxD,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACvB,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,sBAAsB;IACxB,IAAI,GAAqB,QAAQ,CAAA;IACjC,MAAM,CAAc;IAErB,OAAO,CAAyB;IAChC,YAAY,CAAoB;IAChC,WAAW,GAAG,KAAK,CAAA;IAE3B,YAAY,MAAoB;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,WAAW,GAAG,IAAI,CAAA;IACzB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAsB;QAChC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,0BAA0B,EAAE;aACvE,CAAA;QACH,CAAC;QAED,IAAI,CAAC;YACH,oDAAoD;YACpD,IAAI,CAAC,YAAY,GAAG,oBAAoB,EAAE,CAAA;YAC1C,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;YACpE,MAAM,KAAK,GAAG,oBAAoB,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YAEjD,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAA;YAEpD,kCAAkC;YAClC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAA;YAC1D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAA;YACjD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YAC3D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;YACjE,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;YACnD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YACxC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAA;YACzD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAA;YAEzD,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;gBACpB,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;YACpD,CAAC;YACD,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;gBACvB,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;YAC3D,CAAC;YAED,8DAA8D;YAC9D,8DAA8D;YAC9D,iDAAiD;YACjD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EAAE,wBAAwB;oBACjC,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE;iBACzB;aACF,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB;oBACvE,KAAK,EAAE,KAAK;iBACb;aACF,CAAA;QACH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAAC,IAAY;QAC7B,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,+CAA+C,EAAE;aAC5F,CAAA;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,UAAU,EAAE,oBAAoB;oBAChC,IAAI;oBACJ,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;oBACrC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;oBAC/B,aAAa,EAAE,IAAI,CAAC,YAAY;iBACjC,CAAC;aACH,CAAC,CAAA;YAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;gBACvC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,gBAAgB;wBACtB,OAAO,EAAE,0BAA0B,QAAQ,CAAC,MAAM,EAAE;wBACpD,IAAI,EAAE,SAAS;qBAChB;iBACF,CAAA;YACH,CAAC;YAED,MAAM,SAAS,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAMvC,CAAA;YAED,MAAM,KAAK,GAAc;gBACvB,WAAW,EAAE,SAAS,CAAC,YAAY;gBACnC,GAAG,CAAC,SAAS,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3F,GAAG,CAAC,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5E,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,UAAU,GAAG,IAAI;gBACnD,MAAM,EAAE,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM;aAC1D,CAAA;YAED,wDAAwD;YACxD,MAAM,IAAI,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAA;YAE5C,IAAI,CAAC,OAAO,GAAG;gBACb,EAAE,EAAE,WAAW,IAAI,CAAC,GAAG,EAAE,EAAE;gBAC3B,KAAK,EAAE,eAAe;gBACtB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvC,KAAK;gBACL,QAAQ,EAAE,QAAQ;gBAClB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAA;YAED,oDAAoD;YACpD,IAAI,CAAC,YAAY,GAAG,SAAS,CAAA;YAE7B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB;oBACzE,KAAK,EAAE,KAAK;iBACb;aACF,CAAA;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,CAAC,OAAO,GAAG,SAAS,CAAA;QACxB,IAAI,CAAC,YAAY,GAAG,SAAS,CAAA;IAC/B,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,OAAO,CAAA;IACrB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,OAA2B;QAClD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;YACzB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,mBAAmB,EAAE;aAC/D,CAAA;QACH,CAAC;QAED,4BAA4B;QAC5B,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC9C,yCAAyC;YACzC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;gBACpC,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;YAC3D,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,kDAAkD;iBAC5D;aACF,CAAA;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAA;IACrD,CAAC;IAED,eAAe;QACb,IAAI,IAAI,CAAC,OAAO,EAAE,KAAK,KAAK,eAAe;YAAE,OAAO,KAAK,CAAA;QACzD,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,KAAK,CAAA;QACjF,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,OAAO,EAAE,IAAI,CAAA;IAC3B,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,YAAY,CAAC,YAAoB;QAC7C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,UAAU,EAAE,eAAe;oBAC3B,aAAa,EAAE,YAAY;oBAC3B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;iBAChC,CAAC;aACH,CAAC,CAAA;YAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,mBAAmB,QAAQ,CAAC,MAAM,EAAE,EAAE;iBAChF,CAAA;YACH,CAAC;YAED,MAAM,SAAS,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAMvC,CAAA;YAED,MAAM,eAAe,GAAG,SAAS,CAAC,aAAa,IAAI,YAAY,CAAA;YAC/D,MAAM,KAAK,GAAc;gBACvB,WAAW,EAAE,SAAS,CAAC,YAAY;gBACnC,YAAY,EAAE,eAAe;gBAC7B,GAAG,CAAC,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5E,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,UAAU,GAAG,IAAI;gBACnD,MAAM,EAAE,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM;aAC1D,CAAA;YAED,gCAAgC;YAChC,MAAM,IAAI,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,IAAI,CAAA;YAClE,IAAI,CAAC,OAAO,GAAG;gBACb,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,WAAW,IAAI,CAAC,GAAG,EAAE,EAAE;gBAC/C,KAAK,EAAE,eAAe;gBACtB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvC,KAAK;gBACL,QAAQ,EAAE,QAAQ;gBAClB,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;gBAChD,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAA;YAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB;oBACxE,KAAK,EAAE,KAAK;iBACb;aACF,CAAA;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,KAAgB;QAC1C,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,WAAW,CAAA;QACtD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAA;YAExC,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;YAC/B,IAAI,CAAC,cAAc;gBAAE,OAAO,SAAS,CAAA;YACrC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAMpF,CAAA;YAED,OAAO;gBACL,EAAE,EAAE,OAAO,CAAC,GAAG,IAAI,SAAS;gBAC5B,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjE,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC;CACF;AAED,+DAA+D;AAC/D,wBAAwB;AACxB,+DAA+D;AAE/D;;GAEG;AACH,MAAM,OAAO,kBAAkB;IACpB,IAAI,GAAqB,SAAS,CAAA;IAClC,MAAM,CAAc;IAErB,OAAO,CAAyB;IAChC,MAAM,CAAoB;IAElC,YAAY,MAAoB;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAED,KAAK,CAAC,UAAU;QACd,2BAA2B;IAC7B,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAuB;QACjC,yCAAyC;QACzC,2CAA2C;QAC3C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,iBAAiB;iBAC3B;aACF,CAAA;QACH,CAAC;QAED,MAAM,KAAK,GAAc;YACvB,WAAW,EAAE,IAAI,CAAC,MAAM;YACxB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,WAAW;YAC7C,MAAM,EAAE,EAAE;SACX,CAAA;QAED,IAAI,CAAC,OAAO,GAAG;YACb,EAAE,EAAE,WAAW,IAAI,CAAC,GAAG,EAAE,EAAE;YAC3B,KAAK,EAAE,eAAe;YACtB,KAAK;YACL,QAAQ,EAAE,SAAS;YACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAA;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;IACjD,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,CAAC,OAAO,GAAG,SAAS,CAAA;QACxB,IAAI,CAAC,MAAM,GAAG,SAAS,CAAA;IACzB,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,OAAO,CAAA;IACrB,CAAC;IAED,KAAK,CAAC,kBAAkB;QACtB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;YACzB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,mBAAmB;iBAC7B;aACF,CAAA;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAA;IACrD,CAAC;IAED,eAAe;QACb,OAAO,IAAI,CAAC,OAAO,EAAE,KAAK,KAAK,eAAe,CAAA;IAChD,CAAC;IAED,OAAO;QACL,OAAO,SAAS,CAAA,CAAC,oDAAoD;IACvE,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,GAAW;QACnB,IAAI,CAAC,MAAM,GAAG,GAAG,CAAA;IACnB,CAAC;CACF;AAED,+DAA+D;AAC/D,wBAAwB;AACxB,+DAA+D;AAE/D;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAA0B;IAC3D,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,MAAM;YACT,OAAO,IAAI,gBAAgB,CAAC,MAAoB,CAAC,CAAA;QACnD,KAAK,QAAQ;YACX,OAAO,IAAI,sBAAsB,CAAC,MAAsB,CAAC,CAAA;QAC3D,KAAK,SAAS;YACZ,OAAO,IAAI,kBAAkB,CAAC,MAAsB,CAAC,CAAA;QACvD;YACE,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;IACjE,CAAC;AACH,CAAC","sourcesContent":["/**\n * Authentication Provider\n *\n * Authentication provider interface and implementations\n *\n * @module @pwfabric/runtime/auth/provider\n */\n\nimport type {\n  AuthProviderType,\n  AuthProviderConfig,\n  MsalConfig,\n  OAuth2Config,\n  ApiKeyConfig,\n  AuthSession,\n  AuthResult,\n  TokenResult,\n  AuthToken,\n  UserIdentity,\n} from './types.js'\n\n// ============================================================\n// AUTH PROVIDER INTERFACE\n// ============================================================\n\n/**\n * Authentication provider interface\n */\nexport interface AuthProvider {\n  readonly type: AuthProviderType\n  readonly config: AuthProviderConfig\n\n  /**\n   * Initialize the provider\n   */\n  initialize(): Promise<void>\n\n  /**\n   * Start authentication flow\n   */\n  login(options?: LoginOptions): Promise<AuthResult>\n\n  /**\n   * End authentication session\n   */\n  logout(): Promise<void>\n\n  /**\n   * Get current session\n   */\n  getSession(): AuthSession | undefined\n\n  /**\n   * Acquire token silently\n   */\n  acquireTokenSilent(scopes?: readonly string[]): Promise<TokenResult>\n\n  /**\n   * Check if authenticated\n   */\n  isAuthenticated(): boolean\n\n  /**\n   * Get current user\n   */\n  getUser(): UserIdentity | undefined\n}\n\n/**\n * Login options\n */\nexport interface LoginOptions {\n  readonly scopes?: readonly string[]\n  readonly prompt?: 'login' | 'consent' | 'select_account' | 'none'\n  readonly loginHint?: string\n}\n\n// ============================================================\n// MSAL AUTH PROVIDER (Stub)\n// ============================================================\n\n/**\n * MSAL authentication provider\n *\n * Note: This is a stub implementation. In production, this would\n * integrate with @azure/msal-browser or @azure/msal-node.\n */\nexport class MsalAuthProvider implements AuthProvider {\n  readonly type: AuthProviderType = 'msal'\n  readonly config: MsalConfig\n\n  private session: AuthSession | undefined\n  private initialized = false\n\n  constructor(config: MsalConfig) {\n    this.config = config\n  }\n\n  async initialize(): Promise<void> {\n    // In production: Initialize MSAL instance\n    this.initialized = true\n  }\n\n  async login(options?: LoginOptions): Promise<AuthResult> {\n    if (!this.initialized) {\n      return {\n        success: false,\n        error: {\n          type: 'invalid_config',\n          message: 'Provider not initialized',\n        },\n      }\n    }\n\n    // Stub: Create mock session\n    const scopes = options?.scopes ?? this.config.scopes\n    const token: AuthToken = {\n      accessToken: 'mock_access_token',\n      idToken: 'mock_id_token',\n      expiresAt: Date.now() + 3600000, // 1 hour\n      scopes,\n    }\n\n    const user: UserIdentity = {\n      id: 'mock_user_id',\n      name: 'Mock User',\n      email: 'mock@example.com',\n      ...(this.config.worldId !== undefined ? { worldId: this.config.worldId } : {}),\n    }\n\n    this.session = {\n      id: `session_${Date.now()}`,\n      state: 'authenticated',\n      user,\n      token,\n      provider: 'msal',\n      createdAt: Date.now(),\n      expiresAt: token.expiresAt,\n    }\n\n    return { success: true, session: this.session }\n  }\n\n  async logout(): Promise<void> {\n    this.session = undefined\n  }\n\n  getSession(): AuthSession | undefined {\n    return this.session\n  }\n\n  async acquireTokenSilent(_scopes?: readonly string[]): Promise<TokenResult> {\n    if (!this.session?.token) {\n      return {\n        success: false,\n        error: {\n          type: 'token_expired',\n          message: 'No active session',\n        },\n      }\n    }\n\n    // Check if token is expired\n    if (this.session.token.expiresAt < Date.now()) {\n      return {\n        success: false,\n        error: {\n          type: 'token_expired',\n          message: 'Token has expired',\n        },\n      }\n    }\n\n    return { success: true, token: this.session.token }\n  }\n\n  isAuthenticated(): boolean {\n    return this.session?.state === 'authenticated'\n  }\n\n  getUser(): UserIdentity | undefined {\n    return this.session?.user\n  }\n}\n\n// ============================================================\n// OAUTH2 PKCE AUTH PROVIDER\n// ============================================================\n\n/**\n * Generate a cryptographically random code verifier for PKCE\n */\nfunction generateCodeVerifier(): string {\n  const buffer = new Uint8Array(32)\n  crypto.getRandomValues(buffer)\n  return Array.from(buffer, (b) => b.toString(16).padStart(2, '0')).join('')\n}\n\n/**\n * Generate a code challenge from a code verifier (S256 method)\n */\nasync function generateCodeChallenge(verifier: string): Promise<string> {\n  const encoder = new TextEncoder()\n  const data = encoder.encode(verifier)\n  const digest = await crypto.subtle.digest('SHA-256', data)\n  return btoa(String.fromCharCode(...new Uint8Array(digest)))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=+$/, '')\n}\n\n/**\n * OAuth2 PKCE authentication provider\n *\n * Implements the Authorization Code flow with PKCE (RFC 7636)\n * for secure authentication without client secrets.\n */\nexport class OAuth2PkceAuthProvider implements AuthProvider {\n  readonly type: AuthProviderType = 'oauth2'\n  readonly config: OAuth2Config\n\n  private session: AuthSession | undefined\n  private codeVerifier: string | undefined\n  private initialized = false\n\n  constructor(config: OAuth2Config) {\n    this.config = config\n  }\n\n  async initialize(): Promise<void> {\n    this.initialized = true\n  }\n\n  async login(options?: LoginOptions): Promise<AuthResult> {\n    if (!this.initialized) {\n      return {\n        success: false,\n        error: { type: 'invalid_config', message: 'Provider not initialized' },\n      }\n    }\n\n    try {\n      // Step 1: Generate PKCE code verifier and challenge\n      this.codeVerifier = generateCodeVerifier()\n      const codeChallenge = await generateCodeChallenge(this.codeVerifier)\n      const state = generateCodeVerifier().slice(0, 32)\n\n      const scopes = options?.scopes ?? this.config.scopes\n\n      // Step 2: Build authorization URL\n      const authUrl = new URL(this.config.authorizationEndpoint)\n      authUrl.searchParams.set('response_type', 'code')\n      authUrl.searchParams.set('client_id', this.config.clientId)\n      authUrl.searchParams.set('redirect_uri', this.config.redirectUri)\n      authUrl.searchParams.set('scope', scopes.join(' '))\n      authUrl.searchParams.set('state', state)\n      authUrl.searchParams.set('code_challenge', codeChallenge)\n      authUrl.searchParams.set('code_challenge_method', 'S256')\n\n      if (options?.prompt) {\n        authUrl.searchParams.set('prompt', options.prompt)\n      }\n      if (options?.loginHint) {\n        authUrl.searchParams.set('login_hint', options.loginHint)\n      }\n\n      // Step 3: Return the authorization URL for the caller to open\n      // In browser context, this would redirect. In CLI, the caller\n      // starts a local server to capture the callback.\n      return {\n        success: false,\n        error: {\n          type: 'provider_error',\n          message: 'PKCE_REDIRECT_REQUIRED',\n          code: authUrl.toString(),\n        },\n      }\n    } catch (error) {\n      return {\n        success: false,\n        error: {\n          type: 'provider_error',\n          message: error instanceof Error ? error.message : 'OAuth2 login failed',\n          cause: error,\n        },\n      }\n    }\n  }\n\n  /**\n   * Exchange authorization code for tokens (PKCE Step 2)\n   *\n   * Called after the user completes the OAuth flow and the authorization\n   * code is received via the redirect URI.\n   */\n  async exchangeCode(code: string): Promise<AuthResult> {\n    if (!this.codeVerifier) {\n      return {\n        success: false,\n        error: { type: 'invalid_config', message: 'No PKCE flow in progress. Call login() first.' },\n      }\n    }\n\n    try {\n      const response = await fetch(this.config.tokenEndpoint, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n        body: new URLSearchParams({\n          grant_type: 'authorization_code',\n          code,\n          redirect_uri: this.config.redirectUri,\n          client_id: this.config.clientId,\n          code_verifier: this.codeVerifier,\n        }),\n      })\n\n      if (!response.ok) {\n        const errorBody = await response.text()\n        return {\n          success: false,\n          error: {\n            type: 'provider_error',\n            message: `Token exchange failed: ${response.status}`,\n            code: errorBody,\n          },\n        }\n      }\n\n      const tokenData = (await response.json()) as {\n        access_token: string\n        refresh_token?: string\n        id_token?: string\n        expires_in: number\n        scope?: string\n      }\n\n      const token: AuthToken = {\n        accessToken: tokenData.access_token,\n        ...(tokenData.refresh_token !== undefined ? { refreshToken: tokenData.refresh_token } : {}),\n        ...(tokenData.id_token !== undefined ? { idToken: tokenData.id_token } : {}),\n        expiresAt: Date.now() + tokenData.expires_in * 1000,\n        scopes: tokenData.scope?.split(' ') ?? this.config.scopes,\n      }\n\n      // Decode user info from ID token or access token claims\n      const user = this.decodeUserFromToken(token)\n\n      this.session = {\n        id: `session_${Date.now()}`,\n        state: 'authenticated',\n        ...(user !== undefined ? { user } : {}),\n        token,\n        provider: 'oauth2',\n        createdAt: Date.now(),\n        expiresAt: token.expiresAt,\n      }\n\n      // Clear the code verifier after successful exchange\n      this.codeVerifier = undefined\n\n      return { success: true, session: this.session }\n    } catch (error) {\n      return {\n        success: false,\n        error: {\n          type: 'network_error',\n          message: error instanceof Error ? error.message : 'Token exchange failed',\n          cause: error,\n        },\n      }\n    }\n  }\n\n  async logout(): Promise<void> {\n    this.session = undefined\n    this.codeVerifier = undefined\n  }\n\n  getSession(): AuthSession | undefined {\n    return this.session\n  }\n\n  async acquireTokenSilent(_scopes?: readonly string[]): Promise<TokenResult> {\n    if (!this.session?.token) {\n      return {\n        success: false,\n        error: { type: 'token_expired', message: 'No active session' },\n      }\n    }\n\n    // Check if token is expired\n    if (this.session.token.expiresAt < Date.now()) {\n      // Try refresh if refresh token available\n      if (this.session.token.refreshToken) {\n        return this.refreshToken(this.session.token.refreshToken)\n      }\n      return {\n        success: false,\n        error: {\n          type: 'token_expired',\n          message: 'Token has expired and no refresh token available',\n        },\n      }\n    }\n\n    return { success: true, token: this.session.token }\n  }\n\n  isAuthenticated(): boolean {\n    if (this.session?.state !== 'authenticated') return false\n    if (this.session.token && this.session.token.expiresAt < Date.now()) return false\n    return true\n  }\n\n  getUser(): UserIdentity | undefined {\n    return this.session?.user\n  }\n\n  /**\n   * Refresh the access token using a refresh token\n   */\n  private async refreshToken(refreshToken: string): Promise<TokenResult> {\n    try {\n      const response = await fetch(this.config.tokenEndpoint, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n        body: new URLSearchParams({\n          grant_type: 'refresh_token',\n          refresh_token: refreshToken,\n          client_id: this.config.clientId,\n        }),\n      })\n\n      if (!response.ok) {\n        return {\n          success: false,\n          error: { type: 'token_expired', message: `Refresh failed: ${response.status}` },\n        }\n      }\n\n      const tokenData = (await response.json()) as {\n        access_token: string\n        refresh_token?: string\n        id_token?: string\n        expires_in: number\n        scope?: string\n      }\n\n      const newRefreshToken = tokenData.refresh_token ?? refreshToken\n      const token: AuthToken = {\n        accessToken: tokenData.access_token,\n        refreshToken: newRefreshToken,\n        ...(tokenData.id_token !== undefined ? { idToken: tokenData.id_token } : {}),\n        expiresAt: Date.now() + tokenData.expires_in * 1000,\n        scopes: tokenData.scope?.split(' ') ?? this.config.scopes,\n      }\n\n      // Update session with new token\n      const user = this.decodeUserFromToken(token) ?? this.session?.user\n      this.session = {\n        id: this.session?.id ?? `session_${Date.now()}`,\n        state: 'authenticated',\n        ...(user !== undefined ? { user } : {}),\n        token,\n        provider: 'oauth2',\n        createdAt: this.session?.createdAt ?? Date.now(),\n        expiresAt: token.expiresAt,\n      }\n\n      return { success: true, token }\n    } catch (error) {\n      return {\n        success: false,\n        error: {\n          type: 'network_error',\n          message: error instanceof Error ? error.message : 'Token refresh failed',\n          cause: error,\n        },\n      }\n    }\n  }\n\n  /**\n   * Decode user identity from JWT token claims\n   */\n  private decodeUserFromToken(token: AuthToken): UserIdentity | undefined {\n    const jwtToDecode = token.idToken ?? token.accessToken\n    try {\n      const parts = jwtToDecode.split('.')\n      if (parts.length !== 3) return undefined\n\n      const encodedPayload = parts[1]\n      if (!encodedPayload) return undefined\n      const payload = JSON.parse(atob(encodedPayload.replace(/-/g, '+').replace(/_/g, '/'))) as {\n        sub?: string\n        name?: string\n        email?: string\n        wid?: string\n        roles?: string[]\n      }\n\n      return {\n        id: payload.sub ?? 'unknown',\n        ...(payload.name !== undefined ? { name: payload.name } : {}),\n        ...(payload.email !== undefined ? { email: payload.email } : {}),\n        ...(payload.wid !== undefined ? { worldId: payload.wid } : {}),\n        ...(payload.roles !== undefined ? { roles: payload.roles } : {}),\n      }\n    } catch {\n      return undefined\n    }\n  }\n}\n\n// ============================================================\n// API KEY AUTH PROVIDER\n// ============================================================\n\n/**\n * API Key authentication provider\n */\nexport class ApiKeyAuthProvider implements AuthProvider {\n  readonly type: AuthProviderType = 'api-key'\n  readonly config: ApiKeyConfig\n\n  private session: AuthSession | undefined\n  private apiKey: string | undefined\n\n  constructor(config: ApiKeyConfig) {\n    this.config = config\n  }\n\n  async initialize(): Promise<void> {\n    // No initialization needed\n  }\n\n  async login(_options?: LoginOptions): Promise<AuthResult> {\n    // API key auth doesn't have a login flow\n    // The key is typically set via setApiKey()\n    if (!this.apiKey) {\n      return {\n        success: false,\n        error: {\n          type: 'invalid_credentials',\n          message: 'API key not set',\n        },\n      }\n    }\n\n    const token: AuthToken = {\n      accessToken: this.apiKey,\n      expiresAt: Date.now() + 86400000, // 24 hours\n      scopes: [],\n    }\n\n    this.session = {\n      id: `session_${Date.now()}`,\n      state: 'authenticated',\n      token,\n      provider: 'api-key',\n      createdAt: Date.now(),\n    }\n\n    return { success: true, session: this.session }\n  }\n\n  async logout(): Promise<void> {\n    this.session = undefined\n    this.apiKey = undefined\n  }\n\n  getSession(): AuthSession | undefined {\n    return this.session\n  }\n\n  async acquireTokenSilent(): Promise<TokenResult> {\n    if (!this.session?.token) {\n      return {\n        success: false,\n        error: {\n          type: 'token_expired',\n          message: 'No active session',\n        },\n      }\n    }\n\n    return { success: true, token: this.session.token }\n  }\n\n  isAuthenticated(): boolean {\n    return this.session?.state === 'authenticated'\n  }\n\n  getUser(): UserIdentity | undefined {\n    return undefined // API key auth typically doesn't have user identity\n  }\n\n  /**\n   * Set the API key\n   */\n  setApiKey(key: string): void {\n    this.apiKey = key\n  }\n}\n\n// ============================================================\n// AUTH PROVIDER FACTORY\n// ============================================================\n\n/**\n * Create an authentication provider\n */\nexport function createAuthProvider(config: AuthProviderConfig): AuthProvider {\n  switch (config.type) {\n    case 'msal':\n      return new MsalAuthProvider(config as MsalConfig)\n    case 'oauth2':\n      return new OAuth2PkceAuthProvider(config as OAuth2Config)\n    case 'api-key':\n      return new ApiKeyAuthProvider(config as ApiKeyConfig)\n    default:\n      throw new Error(`Unknown auth provider type: ${config.type}`)\n  }\n}\n"]}