@salesforce/b2c-cli 0.0.1 → 0.0.7

package/node_modules/@salesforce/b2c-tooling-sdk/dist/esm/auth/oauth.js

@@ -0,0 +1,178 @@
+import { getLogger } from '../logging/logger.js';
+import { DEFAULT_ACCOUNT_MANAGER_HOST } from '../defaults.js';
+// Module-level token cache to support multiple instances with same clientId
+const ACCESS_TOKEN_CACHE = new Map();
+/**
+ * Decodes a JWT token without verification
+ */
+function decodeJWT(jwt) {
+    const parts = jwt.split('.');
+    if (parts.length !== 3) {
+        throw new Error('Invalid JWT format');
+    }
+    const header = JSON.parse(Buffer.from(parts[0], 'base64').toString());
+    const payload = JSON.parse(Buffer.from(parts[1], 'base64').toString());
+    return { header, payload };
+}
+export class OAuthStrategy {
+    config;
+    accountManagerHost;
+    constructor(config) {
+        this.config = config;
+        this.accountManagerHost = config.accountManagerHost || DEFAULT_ACCOUNT_MANAGER_HOST;
+    }
+    async fetch(url, init = {}) {
+        const token = await this.getAccessToken();
+        const headers = new Headers(init.headers);
+        headers.set('Authorization', `Bearer ${token}`);
+        headers.set('x-dw-client-id', this.config.clientId);
+        let res = await fetch(url, { ...init, headers });
+        // RESILIENCE: If the server says 401, the token might have expired or been revoked.
+        // We retry exactly once after invalidating the cached token.
+        if (res.status === 401) {
+            this.invalidateToken();
+            const newToken = await this.getAccessToken();
+            headers.set('Authorization', `Bearer ${newToken}`);
+            res = await fetch(url, { ...init, headers });
+        }
+        return res;
+    }
+    async getAuthorizationHeader() {
+        const token = await this.getAccessToken();
+        return `Bearer ${token}`;
+    }
+    /**
+     * Gets the decoded JWT payload
+     */
+    async getJWT() {
+        const token = await this.getAccessToken();
+        return decodeJWT(token);
+    }
+    /**
+     * Gets the full token response including expiration and scopes.
+     * Useful for commands that need to display or return token metadata.
+     */
+    async getTokenResponse() {
+        const logger = getLogger();
+        const cached = ACCESS_TOKEN_CACHE.get(this.config.clientId);
+        if (cached) {
+            const now = new Date();
+            const requiredScopes = this.config.scopes || [];
+            const hasAllScopes = requiredScopes.every((scope) => cached.scopes.includes(scope));
+            if (hasAllScopes && now.getTime() <= cached.expires.getTime()) {
+                logger.debug('Reusing cached access token');
+                return cached;
+            }
+        }
+        // Get new token via client credentials
+        const tokenResponse = await this.clientCredentialsGrant();
+        ACCESS_TOKEN_CACHE.set(this.config.clientId, tokenResponse);
+        return tokenResponse;
+    }
+    /**
+     * Invalidates the cached token, forcing re-authentication on next request
+     */
+    invalidateToken() {
+        ACCESS_TOKEN_CACHE.delete(this.config.clientId);
+    }
+    /**
+     * Creates a new OAuthStrategy with additional scopes merged in.
+     * Used by clients that have specific scope requirements.
+     *
+     * @param additionalScopes - Scopes to add to this strategy's existing scopes
+     * @returns A new OAuthStrategy instance with merged scopes
+     */
+    withAdditionalScopes(additionalScopes) {
+        const mergedScopes = [...new Set([...(this.config.scopes || []), ...additionalScopes])];
+        return new OAuthStrategy({
+            ...this.config,
+            scopes: mergedScopes,
+        });
+    }
+    /**
+     * Gets an access token, using cache if valid
+     */
+    async getAccessToken() {
+        const logger = getLogger();
+        const cached = ACCESS_TOKEN_CACHE.get(this.config.clientId);
+        if (cached) {
+            const now = new Date();
+            const requiredScopes = this.config.scopes || [];
+            const hasAllScopes = requiredScopes.every((scope) => cached.scopes.includes(scope));
+            if (!hasAllScopes) {
+                logger.warn('Access token missing scopes; invalidating and re-authenticating');
+                ACCESS_TOKEN_CACHE.delete(this.config.clientId);
+            }
+            else if (now.getTime() > cached.expires.getTime()) {
+                logger.warn('Access token expired; invalidating and re-authenticating');
+                ACCESS_TOKEN_CACHE.delete(this.config.clientId);
+            }
+            else {
+                logger.debug('Reusing cached access token');
+                return cached.accessToken;
+            }
+        }
+        // Get new token via client credentials
+        const tokenResponse = await this.clientCredentialsGrant();
+        ACCESS_TOKEN_CACHE.set(this.config.clientId, tokenResponse);
+        return tokenResponse.accessToken;
+    }
+    /**
+     * Performs client credentials grant flow
+     */
+    async clientCredentialsGrant() {
+        const logger = getLogger();
+        const url = `https://${this.accountManagerHost}/dwsso/oauth2/access_token`;
+        const method = 'POST';
+        const params = new URLSearchParams({
+            grant_type: 'client_credentials',
+        });
+        if (this.config.scopes && this.config.scopes.length > 0) {
+            params.append('scope', this.config.scopes.join(' '));
+        }
+        const credentials = Buffer.from(`${this.config.clientId}:${this.config.clientSecret}`).toString('base64');
+        const requestHeaders = {
+            Authorization: `Basic ${credentials}`,
+            'Content-Type': 'application/x-www-form-urlencoded',
+        };
+        logger.debug({ clientId: this.config.clientId }, `[Auth] Using OAuth client_credentials grant for client: ${this.config.clientId}`);
+        // Debug: Log request start
+        logger.debug({ method, url }, `[Auth REQ] ${method} ${url}`);
+        // Trace: Log request details
+        logger.trace({ method, url, headers: requestHeaders, body: params.toString() }, `[Auth REQ BODY] ${method} ${url}`);
+        const startTime = Date.now();
+        const response = await fetch(url, {
+            method,
+            headers: requestHeaders,
+            body: params.toString(),
+        });
+        const duration = Date.now() - startTime;
+        // Debug: Log response summary
+        logger.debug({ method, url, status: response.status, duration }, `[Auth RESP] ${method} ${url} ${response.status} ${duration}ms`);
+        // Get response headers
+        const responseHeaders = {};
+        response.headers.forEach((value, key) => {
+            responseHeaders[key] = value;
+        });
+        if (!response.ok) {
+            const errorText = await response.text();
+            logger.trace({ method, url, headers: responseHeaders, body: errorText }, `[Auth RESP BODY] ${method} ${url}`);
+            throw new Error(`Failed to get access token: ${response.status} ${response.statusText} - ${errorText}`);
+        }
+        const data = (await response.json());
+        // Trace: Log response details
+        logger.trace({ method, url, headers: responseHeaders, body: data }, `[Auth RESP BODY] ${method} ${url}`);
+        const jwt = decodeJWT(data.access_token);
+        logger.trace({ jwt: jwt.payload }, '[Auth] JWT payload');
+        const now = new Date();
+        const expiration = new Date(now.getTime() + data.expires_in * 1000);
+        const scopes = data.scope?.split(' ') ?? [];
+        return {
+            accessToken: data.access_token,
+            expires: expiration,
+            scopes,
+        };
+    }
+}
+export { decodeJWT };
+//# sourceMappingURL=oauth.js.map

package/node_modules/@salesforce/b2c-tooling-sdk/dist/esm/auth/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/auth/oauth.ts"],"names":[],"mappings":"AAMA,OAAO,EAAC,SAAS,EAAC,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAC,4BAA4B,EAAC,MAAM,gBAAgB,CAAC;AAE5D,4EAA4E;AAC5E,MAAM,kBAAkB,GAAqC,IAAI,GAAG,EAAE,CAAC;AASvE;;GAEG;AACH,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvE,OAAO,EAAC,MAAM,EAAE,OAAO,EAAC,CAAC;AAC3B,CAAC;AAED,MAAM,OAAO,aAAa;IAGJ;IAFZ,kBAAkB,CAAS;IAEnC,YAAoB,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;QACrC,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,IAAI,4BAA4B,CAAC;IACtF,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,OAAoB,EAAE;QAC7C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAE1C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEpD,IAAI,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAC,GAAG,IAAI,EAAE,OAAO,EAAC,CAAC,CAAC;QAE/C,oFAAoF;QACpF,6DAA6D;QAC7D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,QAAQ,EAAE,CAAC,CAAC;YACnD,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAC,GAAG,IAAI,EAAE,OAAO,EAAC,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,sBAAsB;QAC1B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,OAAO,UAAU,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gBAAgB;QACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAE5D,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;YAChD,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YAEpF,IAAI,YAAY,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC9D,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;gBAC5C,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAED,uCAAuC;QACvC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC1D,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QAC5D,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,eAAe;QACb,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;OAMG;IACH,oBAAoB,CAAC,gBAA0B;QAC7C,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACxF,OAAO,IAAI,aAAa,CAAC;YACvB,GAAG,IAAI,CAAC,MAAM;YACd,MAAM,EAAE,YAAY;SACrB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,cAAc;QAC1B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAE5D,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;YAChD,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YAEpF,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;gBAC/E,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAClD,CAAC;iBAAM,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;gBACpD,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;gBACxE,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAClD,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;gBAC5C,OAAO,MAAM,CAAC,WAAW,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,uCAAuC;QACvC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC1D,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QAC5D,OAAO,aAAa,CAAC,WAAW,CAAC;IACnC,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,sBAAsB;QAClC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,WAAW,IAAI,CAAC,kBAAkB,4BAA4B,CAAC;QAC3E,MAAM,MAAM,GAAG,MAAM,CAAC;QAEtB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,oBAAoB;SACjC,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxD,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1G,MAAM,cAAc,GAAG;YACrB,aAAa,EAAE,SAAS,WAAW,EAAE;YACrC,cAAc,EAAE,mCAAmC;SACpD,CAAC;QAEF,MAAM,CAAC,KAAK,CACV,EAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAC,EAChC,2DAA2D,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAClF,CAAC;QACF,2BAA2B;QAC3B,MAAM,CAAC,KAAK,CAAC,EAAC,MAAM,EAAE,GAAG,EAAC,EAAE,cAAc,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;QAE3D,6BAA6B;QAC7B,MAAM,CAAC,KAAK,CAAC,EAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAC,EAAE,mBAAmB,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;QAElH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM;YACN,OAAO,EAAE,cAAc;YACvB,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACxB,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAExC,8BAA8B;QAC9B,MAAM,CAAC,KAAK,CACV,EAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAC,EAChD,eAAe,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,QAAQ,IAAI,CAChE,CAAC;QAEF,uBAAuB;QACvB,MAAM,eAAe,GAA2B,EAAE,CAAC;QACnD,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACtC,eAAe,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,EAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAC,EAAE,oBAAoB,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;YAC5G,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,MAAM,SAAS,EAAE,CAAC,CAAC;QAC1G,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAIlC,CAAC;QAEF,8BAA8B;QAC9B,MAAM,CAAC,KAAK,CAAC,EAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,EAAC,EAAE,oBAAoB,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;QAEvG,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,EAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAC,EAAE,oBAAoB,CAAC,CAAC;QAEvD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAE5C,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,OAAO,EAAE,UAAU;YACnB,MAAM;SACP,CAAC;IACJ,CAAC;CACF;AAED,OAAO,EAAC,SAAS,EAAC,CAAC"}

package/node_modules/@salesforce/b2c-tooling-sdk/dist/esm/auth/resolve.d.ts

@@ -0,0 +1,100 @@
+/**
+ * Auth strategy resolution utilities.
+ *
+ * This module provides functions to automatically select and create the appropriate
+ * authentication strategy based on available credentials and allowed methods.
+ *
+ * ## Usage
+ *
+ * ```typescript
+ * import { resolveAuthStrategy, checkAvailableAuthMethods } from '@salesforce/b2c-tooling-sdk';
+ *
+ * // Auto-select best strategy based on credentials
+ * const strategy = resolveAuthStrategy({
+ *   clientId: 'my-client-id',
+ *   clientSecret: process.env.CLIENT_SECRET,
+ * });
+ *
+ * // Check which methods are available
+ * const { available, unavailable } = checkAvailableAuthMethods(credentials);
+ * ```
+ *
+ * @module auth/resolve
+ */
+import type { AuthStrategy, AuthMethod, AuthCredentials } from './types.js';
+/**
+ * Options for resolving an auth strategy.
+ */
+export interface ResolveAuthStrategyOptions {
+    /**
+     * Allowed authentication methods in priority order.
+     * The first method with available credentials will be used.
+     * Defaults to all methods: ['client-credentials', 'implicit', 'basic', 'api-key']
+     */
+    allowedMethods?: AuthMethod[];
+}
+/**
+ * Result of checking which auth methods are available.
+ */
+export interface AvailableAuthMethods {
+    /** Methods that have all required credentials configured */
+    available: AuthMethod[];
+    /** Methods that are missing required credentials */
+    unavailable: {
+        method: AuthMethod;
+        reason: string;
+    }[];
+}
+/**
+ * Checks which auth methods have the required credentials available.
+ *
+ * @param credentials - The available credentials
+ * @param allowedMethods - Methods to check (defaults to all)
+ * @returns Object with available and unavailable methods
+ *
+ * @example
+ * ```typescript
+ * import { checkAvailableAuthMethods } from '@salesforce/b2c-tooling-sdk';
+ *
+ * const result = checkAvailableAuthMethods({
+ *   clientId: 'my-client',
+ *   clientSecret: 'my-secret',
+ * });
+ *
+ * console.log(result.available); // ['client-credentials', 'implicit']
+ * ```
+ */
+export declare function checkAvailableAuthMethods(credentials: AuthCredentials, allowedMethods?: AuthMethod[]): AvailableAuthMethods;
+/**
+ * Resolves and creates the appropriate auth strategy based on credentials and allowed methods.
+ *
+ * Iterates through allowed methods in priority order and returns the first strategy
+ * for which the required credentials are available.
+ *
+ * @param credentials - The available credentials
+ * @param options - Resolution options (allowed methods, etc.)
+ * @returns The resolved auth strategy
+ * @throws Error if no allowed method has the required credentials
+ *
+ * @example
+ * ```typescript
+ * import { resolveAuthStrategy } from '@salesforce/b2c-tooling-sdk';
+ *
+ * // Will use client-credentials if secret is available, otherwise implicit
+ * const strategy = resolveAuthStrategy({
+ *   clientId: 'my-client-id',
+ *   clientSecret: process.env.CLIENT_SECRET, // may be undefined
+ *   scopes: ['sfcc.products'],
+ * });
+ *
+ * // Force implicit auth only
+ * const implicitStrategy = resolveAuthStrategy(
+ *   { clientId: 'my-client-id' },
+ *   { allowedMethods: ['implicit'] }
+ * );
+ *
+ * // Use the strategy
+ * const response = await strategy.fetch('https://example.com/api');
+ * ```
+ */
+export declare function resolveAuthStrategy(credentials: AuthCredentials, options?: ResolveAuthStrategyOptions): AuthStrategy;

package/node_modules/@salesforce/b2c-tooling-sdk/dist/esm/auth/resolve.js

@@ -0,0 +1,173 @@
+/*
+ * Copyright (c) 2025, Salesforce, Inc.
+ * SPDX-License-Identifier: Apache-2
+ * For full license text, see the license.txt file in the repo root or http://www.apache.org/licenses/LICENSE-2.0
+ */
+/**
+ * Auth strategy resolution utilities.
+ *
+ * This module provides functions to automatically select and create the appropriate
+ * authentication strategy based on available credentials and allowed methods.
+ *
+ * ## Usage
+ *
+ * ```typescript
+ * import { resolveAuthStrategy, checkAvailableAuthMethods } from '@salesforce/b2c-tooling-sdk';
+ *
+ * // Auto-select best strategy based on credentials
+ * const strategy = resolveAuthStrategy({
+ *   clientId: 'my-client-id',
+ *   clientSecret: process.env.CLIENT_SECRET,
+ * });
+ *
+ * // Check which methods are available
+ * const { available, unavailable } = checkAvailableAuthMethods(credentials);
+ * ```
+ *
+ * @module auth/resolve
+ */
+import { ALL_AUTH_METHODS } from './types.js';
+import { OAuthStrategy } from './oauth.js';
+import { ImplicitOAuthStrategy } from './oauth-implicit.js';
+import { BasicAuthStrategy } from './basic.js';
+import { ApiKeyStrategy } from './api-key.js';
+/**
+ * Checks which auth methods have the required credentials available.
+ *
+ * @param credentials - The available credentials
+ * @param allowedMethods - Methods to check (defaults to all)
+ * @returns Object with available and unavailable methods
+ *
+ * @example
+ * ```typescript
+ * import { checkAvailableAuthMethods } from '@salesforce/b2c-tooling-sdk';
+ *
+ * const result = checkAvailableAuthMethods({
+ *   clientId: 'my-client',
+ *   clientSecret: 'my-secret',
+ * });
+ *
+ * console.log(result.available); // ['client-credentials', 'implicit']
+ * ```
+ */
+export function checkAvailableAuthMethods(credentials, allowedMethods = ALL_AUTH_METHODS) {
+    const available = [];
+    const unavailable = [];
+    for (const method of allowedMethods) {
+        switch (method) {
+            case 'client-credentials':
+                if (credentials.clientId && credentials.clientSecret) {
+                    available.push(method);
+                }
+                else if (!credentials.clientId) {
+                    unavailable.push({ method, reason: 'clientId is required' });
+                }
+                else {
+                    unavailable.push({ method, reason: 'clientSecret is required' });
+                }
+                break;
+            case 'implicit':
+                if (credentials.clientId) {
+                    available.push(method);
+                }
+                else {
+                    unavailable.push({ method, reason: 'clientId is required' });
+                }
+                break;
+            case 'basic':
+                if (credentials.username && credentials.password) {
+                    available.push(method);
+                }
+                else if (!credentials.username) {
+                    unavailable.push({ method, reason: 'username is required' });
+                }
+                else {
+                    unavailable.push({ method, reason: 'password is required' });
+                }
+                break;
+            case 'api-key':
+                if (credentials.apiKey) {
+                    available.push(method);
+                }
+                else {
+                    unavailable.push({ method, reason: 'apiKey is required' });
+                }
+                break;
+        }
+    }
+    return { available, unavailable };
+}
+/**
+ * Resolves and creates the appropriate auth strategy based on credentials and allowed methods.
+ *
+ * Iterates through allowed methods in priority order and returns the first strategy
+ * for which the required credentials are available.
+ *
+ * @param credentials - The available credentials
+ * @param options - Resolution options (allowed methods, etc.)
+ * @returns The resolved auth strategy
+ * @throws Error if no allowed method has the required credentials
+ *
+ * @example
+ * ```typescript
+ * import { resolveAuthStrategy } from '@salesforce/b2c-tooling-sdk';
+ *
+ * // Will use client-credentials if secret is available, otherwise implicit
+ * const strategy = resolveAuthStrategy({
+ *   clientId: 'my-client-id',
+ *   clientSecret: process.env.CLIENT_SECRET, // may be undefined
+ *   scopes: ['sfcc.products'],
+ * });
+ *
+ * // Force implicit auth only
+ * const implicitStrategy = resolveAuthStrategy(
+ *   { clientId: 'my-client-id' },
+ *   { allowedMethods: ['implicit'] }
+ * );
+ *
+ * // Use the strategy
+ * const response = await strategy.fetch('https://example.com/api');
+ * ```
+ */
+export function resolveAuthStrategy(credentials, options = {}) {
+    const allowedMethods = options.allowedMethods || ALL_AUTH_METHODS;
+    for (const method of allowedMethods) {
+        switch (method) {
+            case 'client-credentials':
+                if (credentials.clientId && credentials.clientSecret) {
+                    return new OAuthStrategy({
+                        clientId: credentials.clientId,
+                        clientSecret: credentials.clientSecret,
+                        scopes: credentials.scopes,
+                        accountManagerHost: credentials.accountManagerHost,
+                    });
+                }
+                break;
+            case 'implicit':
+                if (credentials.clientId) {
+                    return new ImplicitOAuthStrategy({
+                        clientId: credentials.clientId,
+                        scopes: credentials.scopes,
+                        accountManagerHost: credentials.accountManagerHost,
+                    });
+                }
+                break;
+            case 'basic':
+                if (credentials.username && credentials.password) {
+                    return new BasicAuthStrategy(credentials.username, credentials.password);
+                }
+                break;
+            case 'api-key':
+                if (credentials.apiKey) {
+                    return new ApiKeyStrategy(credentials.apiKey, credentials.apiKeyHeaderName);
+                }
+                break;
+        }
+    }
+    // Build helpful error message
+    const { unavailable } = checkAvailableAuthMethods(credentials, allowedMethods);
+    const details = unavailable.map((u) => `${u.method}: ${u.reason}`).join('; ');
+    throw new Error(`No valid auth method available. Allowed methods: [${allowedMethods.join(', ')}]. ` +
+        `Missing credentials: ${details}`);
+}
+//# sourceMappingURL=resolve.js.map

package/node_modules/@salesforce/b2c-tooling-sdk/dist/esm/auth/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../../src/auth/resolve.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAC,gBAAgB,EAAC,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAC,aAAa,EAAC,MAAM,YAAY,CAAC;AACzC,OAAO,EAAC,qBAAqB,EAAC,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAC,iBAAiB,EAAC,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAC,cAAc,EAAC,MAAM,cAAc,CAAC;AAwB5C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,yBAAyB,CACvC,WAA4B,EAC5B,iBAA+B,gBAAgB;IAE/C,MAAM,SAAS,GAAiB,EAAE,CAAC;IACnC,MAAM,WAAW,GAA2C,EAAE,CAAC;IAE/D,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,oBAAoB;gBACvB,IAAI,WAAW,CAAC,QAAQ,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;oBACrD,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACzB,CAAC;qBAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;oBACjC,WAAW,CAAC,IAAI,CAAC,EAAC,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAC,CAAC,CAAC;gBAC7D,CAAC;qBAAM,CAAC;oBACN,WAAW,CAAC,IAAI,CAAC,EAAC,MAAM,EAAE,MAAM,EAAE,0BAA0B,EAAC,CAAC,CAAC;gBACjE,CAAC;gBACD,MAAM;YAER,KAAK,UAAU;gBACb,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;oBACzB,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACzB,CAAC;qBAAM,CAAC;oBACN,WAAW,CAAC,IAAI,CAAC,EAAC,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAC,CAAC,CAAC;gBAC7D,CAAC;gBACD,MAAM;YAER,KAAK,OAAO;gBACV,IAAI,WAAW,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;oBACjD,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACzB,CAAC;qBAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;oBACjC,WAAW,CAAC,IAAI,CAAC,EAAC,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAC,CAAC,CAAC;gBAC7D,CAAC;qBAAM,CAAC;oBACN,WAAW,CAAC,IAAI,CAAC,EAAC,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAC,CAAC,CAAC;gBAC7D,CAAC;gBACD,MAAM;YAER,KAAK,SAAS;gBACZ,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;oBACvB,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACzB,CAAC;qBAAM,CAAC;oBACN,WAAW,CAAC,IAAI,CAAC,EAAC,MAAM,EAAE,MAAM,EAAE,oBAAoB,EAAC,CAAC,CAAC;gBAC3D,CAAC;gBACD,MAAM;QACV,CAAC;IACH,CAAC;IAED,OAAO,EAAC,SAAS,EAAE,WAAW,EAAC,CAAC;AAClC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAA4B,EAC5B,UAAsC,EAAE;IAExC,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,gBAAgB,CAAC;IAElE,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,oBAAoB;gBACvB,IAAI,WAAW,CAAC,QAAQ,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;oBACrD,OAAO,IAAI,aAAa,CAAC;wBACvB,QAAQ,EAAE,WAAW,CAAC,QAAQ;wBAC9B,YAAY,EAAE,WAAW,CAAC,YAAY;wBACtC,MAAM,EAAE,WAAW,CAAC,MAAM;wBAC1B,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;qBACnD,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM;YAER,KAAK,UAAU;gBACb,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;oBACzB,OAAO,IAAI,qBAAqB,CAAC;wBAC/B,QAAQ,EAAE,WAAW,CAAC,QAAQ;wBAC9B,MAAM,EAAE,WAAW,CAAC,MAAM;wBAC1B,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;qBACnD,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM;YAER,KAAK,OAAO;gBACV,IAAI,WAAW,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;oBACjD,OAAO,IAAI,iBAAiB,CAAC,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;gBAC3E,CAAC;gBACD,MAAM;YAER,KAAK,SAAS;gBACZ,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;oBACvB,OAAO,IAAI,cAAc,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,gBAAgB,CAAC,CAAC;gBAC9E,CAAC;gBACD,MAAM;QACV,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,MAAM,EAAC,WAAW,EAAC,GAAG,yBAAyB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE9E,MAAM,IAAI,KAAK,CACb,qDAAqD,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;QACjF,wBAAwB,OAAO,EAAE,CACpC,CAAC;AACJ,CAAC"}

package/node_modules/@salesforce/b2c-tooling-sdk/dist/esm/auth/types.d.ts

@@ -0,0 +1,101 @@
+export interface AuthStrategy {
+    /**
+     * Performs a fetch request with authentication.
+     * Implementations MUST handle header injection and 401 retries (token refresh) internally.
+     */
+    fetch(url: string, init?: RequestInit): Promise<Response>;
+    /**
+     * Optional: Helper for legacy clients (like a strict WebDAV lib) that need the raw header.
+     */
+    getAuthorizationHeader?(): Promise<string>;
+}
+/**
+ * Configuration for Basic authentication (username/access-key).
+ * Used primarily for WebDAV operations.
+ */
+export interface BasicAuthConfig {
+    username: string;
+    password: string;
+}
+/**
+ * Configuration for OAuth authentication.
+ * Used for OCAPI and platform API operations.
+ */
+export interface OAuthAuthConfig {
+    clientId: string;
+    clientSecret?: string;
+    scopes?: string[];
+    accountManagerHost?: string;
+}
+/**
+ * Configuration for API key authentication.
+ * Used for MRT and external services.
+ */
+export interface ApiKeyAuthConfig {
+    key: string;
+    headerName?: string;
+}
+/**
+ * Combined authentication configuration.
+ * B2CInstance uses this to determine which auth strategy to use for each operation type.
+ */
+export interface AuthConfig {
+    /** Basic auth for WebDAV (username/access-key) */
+    basic?: BasicAuthConfig;
+    /** OAuth credentials for OCAPI/platform APIs */
+    oauth?: OAuthAuthConfig;
+    /** API key for MRT/external services */
+    apiKey?: ApiKeyAuthConfig;
+    /**
+     * Allowed authentication methods in priority order.
+     * If not set, defaults to all methods: ['client-credentials', 'implicit', 'basic', 'api-key']
+     */
+    authMethods?: AuthMethod[];
+}
+/**
+ * Access token response structure from Account Manager
+ */
+export interface AccessTokenResponse {
+    accessToken: string;
+    expires: Date;
+    scopes: string[];
+}
+/**
+ * Decoded JWT structure
+ */
+export interface DecodedJWT {
+    header: Record<string, unknown>;
+    payload: Record<string, unknown>;
+}
+/**
+ * Available authentication methods.
+ * - 'client-credentials': OAuth client credentials flow (requires clientId + clientSecret)
+ * - 'implicit': Interactive browser-based OAuth (requires clientId only)
+ * - 'basic': Username/password (access key) authentication
+ * - 'api-key': API key authentication (for MRT, etc.)
+ */
+export type AuthMethod = 'client-credentials' | 'implicit' | 'basic' | 'api-key';
+/** All available auth methods in default priority order */
+export declare const ALL_AUTH_METHODS: AuthMethod[];
+/**
+ * Configuration for resolving an auth strategy.
+ * Combines all possible credential types.
+ */
+export interface AuthCredentials {
+    /** OAuth client ID */
+    clientId?: string;
+    /** OAuth client secret (for client-credentials flow) */
+    clientSecret?: string;
+    /** OAuth scopes to request */
+    scopes?: string[];
+    /** Account Manager host (defaults to account.demandware.com) */
+    accountManagerHost?: string;
+    /** Username for basic auth */
+    username?: string;
+    /** Password/access key for basic auth */
+    password?: string;
+    /** API key for api-key auth */
+    apiKey?: string;
+    /** Header name for API key (defaults to Authorization with Bearer prefix) */
+    apiKeyHeaderName?: string;
+}

package/node_modules/@salesforce/b2c-tooling-sdk/dist/esm/auth/types.js

@@ -0,0 +1,3 @@
+/** All available auth methods in default priority order */
+export const ALL_AUTH_METHODS = ['client-credentials', 'implicit', 'basic', 'api-key'];
+//# sourceMappingURL=types.js.map

package/node_modules/@salesforce/b2c-tooling-sdk/dist/esm/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/auth/types.ts"],"names":[],"mappings":"AA8FA,2DAA2D;AAC3D,MAAM,CAAC,MAAM,gBAAgB,GAAiB,CAAC,oBAAoB,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC"}