@salesforce/b2c-cli 0.0.7 → 0.1.0

package/node_modules/@salesforce/b2c-tooling-sdk/dist/cjs/auth/api-key.d.ts

@@ -1,28 +0,0 @@
-import type { AuthStrategy } from './types.js';
-/**
- * API Key authentication strategy.
- *
- * Supports two modes:
- * - Bearer token: When headerName is 'Authorization', formats as 'Bearer {key}'
- * - Direct key: For other headers (e.g., 'x-api-key'), sets the key directly
- *
- * @example
- * // For MRT API (Bearer token)
- * const auth = new ApiKeyStrategy(apiKey, 'Authorization');
- * // Sets: Authorization: Bearer {apiKey}
- *
- * @example
- * // For custom API key header
- * const auth = new ApiKeyStrategy(apiKey, 'x-api-key');
- * // Sets: x-api-key: {apiKey}
- */
-export declare class ApiKeyStrategy implements AuthStrategy {
-    private readonly headerValue;
-    private readonly headerName;
-    constructor(key: string, headerName?: string);
-    fetch(url: string, init?: RequestInit): Promise<Response>;
-    /**
-     * Returns the authorization header value for use with openapi-fetch middleware.
-     */
-    getAuthorizationHeader(): Promise<string>;
-}

package/node_modules/@salesforce/b2c-tooling-sdk/dist/cjs/auth/api-key.js

@@ -1,44 +0,0 @@
-import { getLogger } from '../logging/logger.js';
-/**
- * API Key authentication strategy.
- *
- * Supports two modes:
- * - Bearer token: When headerName is 'Authorization', formats as 'Bearer {key}'
- * - Direct key: For other headers (e.g., 'x-api-key'), sets the key directly
- *
- * @example
- * // For MRT API (Bearer token)
- * const auth = new ApiKeyStrategy(apiKey, 'Authorization');
- * // Sets: Authorization: Bearer {apiKey}
- *
- * @example
- * // For custom API key header
- * const auth = new ApiKeyStrategy(apiKey, 'x-api-key');
- * // Sets: x-api-key: {apiKey}
- */
-export class ApiKeyStrategy {
-    headerValue;
-    headerName;
-    constructor(key, headerName = 'x-api-key') {
-        const logger = getLogger();
-        this.headerName = headerName;
-        // For Authorization header, use Bearer prefix (standard for MRT API)
-        // For other headers (like x-api-key), use the key directly
-        this.headerValue = headerName === 'Authorization' ? `Bearer ${key}` : key;
-        // Show partial key for identification (first 8 chars)
-        const keyPreview = key.length > 8 ? `${key.slice(0, 8)}...` : key;
-        logger.debug({ headerName, keyPreview }, `[Auth] Using API Key authentication (${headerName}): ${keyPreview}`);
-    }
-    async fetch(url, init = {}) {
-        const headers = new Headers(init.headers);
-        headers.set(this.headerName, this.headerValue);
-        return fetch(url, { ...init, headers });
-    }
-    /**
-     * Returns the authorization header value for use with openapi-fetch middleware.
-     */
-    async getAuthorizationHeader() {
-        return this.headerValue;
-    }
-}
-//# sourceMappingURL=api-key.js.map

package/node_modules/@salesforce/b2c-tooling-sdk/dist/cjs/auth/api-key.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"api-key.js","sourceRoot":"","sources":["../../../src/auth/api-key.ts"],"names":[],"mappings":"AAMA,OAAO,EAAC,SAAS,EAAC,MAAM,sBAAsB,CAAC;AAE/C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,cAAc;IACR,WAAW,CAAS;IACpB,UAAU,CAAS;IAEpC,YAAY,GAAW,EAAE,UAAU,GAAG,WAAW;QAC/C,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAE7B,qEAAqE;QACrE,2DAA2D;QAC3D,IAAI,CAAC,WAAW,GAAG,UAAU,KAAK,eAAe,CAAC,CAAC,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAE1E,sDAAsD;QACtD,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;QAClE,MAAM,CAAC,KAAK,CAAC,EAAC,UAAU,EAAE,UAAU,EAAC,EAAE,wCAAwC,UAAU,MAAM,UAAU,EAAE,CAAC,CAAC;IAC/G,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,OAAoB,EAAE;QAC7C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/C,OAAO,KAAK,CAAC,GAAG,EAAE,EAAC,GAAG,IAAI,EAAE,OAAO,EAAC,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB;QAC1B,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF"}

package/node_modules/@salesforce/b2c-tooling-sdk/dist/cjs/auth/basic.d.ts

@@ -1,7 +0,0 @@
-import type { AuthStrategy } from './types.js';
-export declare class BasicAuthStrategy implements AuthStrategy {
-    private encoded;
-    constructor(user: string, pass: string);
-    fetch(url: string, init?: RequestInit): Promise<Response>;
-    getAuthorizationHeader(): Promise<string>;
-}

package/node_modules/@salesforce/b2c-tooling-sdk/dist/cjs/auth/basic.js

@@ -1,18 +0,0 @@
-import { getLogger } from '../logging/logger.js';
-export class BasicAuthStrategy {
-    encoded;
-    constructor(user, pass) {
-        this.encoded = Buffer.from(`${user}:${pass}`).toString('base64');
-        const logger = getLogger();
-        logger.debug({ username: user }, `[Auth] Using Basic authentication for user: ${user}`);
-    }
-    async fetch(url, init = {}) {
-        const headers = new Headers(init.headers);
-        headers.set('Authorization', `Basic ${this.encoded}`);
-        return fetch(url, { ...init, headers });
-    }
-    async getAuthorizationHeader() {
-        return `Basic ${this.encoded}`;
-    }
-}
-//# sourceMappingURL=basic.js.map

package/node_modules/@salesforce/b2c-tooling-sdk/dist/cjs/auth/basic.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"basic.js","sourceRoot":"","sources":["../../../src/auth/basic.ts"],"names":[],"mappings":"AAMA,OAAO,EAAC,SAAS,EAAC,MAAM,sBAAsB,CAAC;AAE/C,MAAM,OAAO,iBAAiB;IACpB,OAAO,CAAS;IAExB,YAAY,IAAY,EAAE,IAAY;QACpC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEjE,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,CAAC,KAAK,CAAC,EAAC,QAAQ,EAAE,IAAI,EAAC,EAAE,+CAA+C,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,OAAoB,EAAE;QAC7C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACtD,OAAO,KAAK,CAAC,GAAG,EAAE,EAAC,GAAG,IAAI,EAAE,OAAO,EAAC,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,sBAAsB;QAC1B,OAAO,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;IACjC,CAAC;CACF"}

package/node_modules/@salesforce/b2c-tooling-sdk/dist/cjs/auth/index.d.ts

@@ -1,65 +0,0 @@
-/**
- * Authentication strategies for B2C Commerce APIs.
- *
- * This module provides different authentication mechanisms for connecting to
- * B2C Commerce instances and platform services.
- *
- * ## Available Strategies
- *
- * - {@link BasicAuthStrategy} - Username/password authentication for WebDAV operations
- * - {@link OAuthStrategy} - OAuth 2.0 client credentials for OCAPI and platform APIs
- * - {@link ImplicitOAuthStrategy} - Interactive browser-based OAuth for CLI/desktop apps
- * - {@link ApiKeyStrategy} - API key authentication for MRT services
- *
- * ## Strategy Resolution
- *
- * Use {@link resolveAuthStrategy} to automatically select the best strategy based on
- * available credentials and allowed methods:
- *
- * ```typescript
- * import { resolveAuthStrategy } from '@salesforce/b2c-tooling-sdk';
- *
- * // Automatically picks client-credentials if secret available, otherwise implicit
- * const strategy = resolveAuthStrategy({
- *   clientId: 'your-client-id',
- *   clientSecret: process.env.CLIENT_SECRET, // may be undefined
- * });
- *
- * // Force a specific method
- * const implicitOnly = resolveAuthStrategy(
- *   { clientId: 'your-client-id' },
- *   { allowedMethods: ['implicit'] }
- * );
- * ```
- *
- * ## Direct Usage
- *
- * All strategies implement the {@link AuthStrategy} interface:
- *
- * ```typescript
- * import { OAuthStrategy, ImplicitOAuthStrategy } from '@salesforce/b2c-tooling-sdk';
- *
- * // For automated/server usage (client credentials)
- * const oauthAuth = new OAuthStrategy({
- *   clientId: 'your-client-id',
- *   clientSecret: 'your-client-secret',
- * });
- *
- * // For interactive/CLI usage (opens browser)
- * const implicitAuth = new ImplicitOAuthStrategy({
- *   clientId: 'your-client-id',
- * });
- * ```
- *
- * @module auth
- */
-export type { AuthStrategy, AccessTokenResponse, DecodedJWT, AuthConfig, BasicAuthConfig, OAuthAuthConfig, ApiKeyAuthConfig, AuthMethod, AuthCredentials, } from './types.js';
-export { ALL_AUTH_METHODS } from './types.js';
-export { BasicAuthStrategy } from './basic.js';
-export { OAuthStrategy, decodeJWT } from './oauth.js';
-export type { OAuthConfig } from './oauth.js';
-export { ImplicitOAuthStrategy } from './oauth-implicit.js';
-export type { ImplicitOAuthConfig } from './oauth-implicit.js';
-export { ApiKeyStrategy } from './api-key.js';
-export { resolveAuthStrategy, checkAvailableAuthMethods } from './resolve.js';
-export type { ResolveAuthStrategyOptions, AvailableAuthMethods } from './resolve.js';

package/node_modules/@salesforce/b2c-tooling-sdk/dist/cjs/auth/index.js

@@ -1,69 +0,0 @@
-/*
- * Copyright (c) 2025, Salesforce, Inc.
- * SPDX-License-Identifier: Apache-2
- * For full license text, see the license.txt file in the repo root or http://www.apache.org/licenses/LICENSE-2.0
- */
-/**
- * Authentication strategies for B2C Commerce APIs.
- *
- * This module provides different authentication mechanisms for connecting to
- * B2C Commerce instances and platform services.
- *
- * ## Available Strategies
- *
- * - {@link BasicAuthStrategy} - Username/password authentication for WebDAV operations
- * - {@link OAuthStrategy} - OAuth 2.0 client credentials for OCAPI and platform APIs
- * - {@link ImplicitOAuthStrategy} - Interactive browser-based OAuth for CLI/desktop apps
- * - {@link ApiKeyStrategy} - API key authentication for MRT services
- *
- * ## Strategy Resolution
- *
- * Use {@link resolveAuthStrategy} to automatically select the best strategy based on
- * available credentials and allowed methods:
- *
- * ```typescript
- * import { resolveAuthStrategy } from '@salesforce/b2c-tooling-sdk';
- *
- * // Automatically picks client-credentials if secret available, otherwise implicit
- * const strategy = resolveAuthStrategy({
- *   clientId: 'your-client-id',
- *   clientSecret: process.env.CLIENT_SECRET, // may be undefined
- * });
- *
- * // Force a specific method
- * const implicitOnly = resolveAuthStrategy(
- *   { clientId: 'your-client-id' },
- *   { allowedMethods: ['implicit'] }
- * );
- * ```
- *
- * ## Direct Usage
- *
- * All strategies implement the {@link AuthStrategy} interface:
- *
- * ```typescript
- * import { OAuthStrategy, ImplicitOAuthStrategy } from '@salesforce/b2c-tooling-sdk';
- *
- * // For automated/server usage (client credentials)
- * const oauthAuth = new OAuthStrategy({
- *   clientId: 'your-client-id',
- *   clientSecret: 'your-client-secret',
- * });
- *
- * // For interactive/CLI usage (opens browser)
- * const implicitAuth = new ImplicitOAuthStrategy({
- *   clientId: 'your-client-id',
- * });
- * ```
- *
- * @module auth
- */
-export { ALL_AUTH_METHODS } from './types.js';
-// Strategies
-export { BasicAuthStrategy } from './basic.js';
-export { OAuthStrategy, decodeJWT } from './oauth.js';
-export { ImplicitOAuthStrategy } from './oauth-implicit.js';
-export { ApiKeyStrategy } from './api-key.js';
-// Resolution helpers
-export { resolveAuthStrategy, checkAvailableAuthMethods } from './resolve.js';
-//# sourceMappingURL=index.js.map

package/node_modules/@salesforce/b2c-tooling-sdk/dist/cjs/auth/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAcH,OAAO,EAAC,gBAAgB,EAAC,MAAM,YAAY,CAAC;AAE5C,aAAa;AACb,OAAO,EAAC,iBAAiB,EAAC,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAC,aAAa,EAAE,SAAS,EAAC,MAAM,YAAY,CAAC;AAEpD,OAAO,EAAC,qBAAqB,EAAC,MAAM,qBAAqB,CAAC;AAE1D,OAAO,EAAC,cAAc,EAAC,MAAM,cAAc,CAAC;AAE5C,qBAAqB;AACrB,OAAO,EAAC,mBAAmB,EAAE,yBAAyB,EAAC,MAAM,cAAc,CAAC"}

package/node_modules/@salesforce/b2c-tooling-sdk/dist/cjs/auth/oauth-implicit.d.ts

@@ -1,74 +0,0 @@
-import type { AuthStrategy, AccessTokenResponse, DecodedJWT } from './types.js';
-/**
- * Configuration for the implicit OAuth flow.
- */
-export interface ImplicitOAuthConfig {
-    /** OAuth client ID registered with Account Manager */
-    clientId: string;
-    /** OAuth scopes to request (e.g., 'sfcc.products', 'sfcc.orders') */
-    scopes?: string[];
-    /** Account Manager host (defaults to 'account.demandware.com') */
-    accountManagerHost?: string;
-    /**
-     * Local port for the OAuth redirect server.
-     * Defaults to 8080 or SFCC_OAUTH_LOCAL_PORT environment variable.
-     */
-    localPort?: number;
-}
-/**
- * OAuth 2.0 Implicit Grant Flow authentication strategy.
- *
- * This strategy is used when only a client ID is available (no client secret).
- * It opens a browser for the user to authenticate with Account Manager,
- * then captures the access token from the OAuth redirect.
- *
- * Note: The access token from implicit flow is valid for 30 minutes and cannot be renewed.
- * This flow requires user interaction and a TTY.
- *
- * @example
- * ```typescript
- * import { ImplicitOAuthStrategy } from '@salesforce/b2c-tooling-sdk';
- *
- * const auth = new ImplicitOAuthStrategy({
- *   clientId: 'your-client-id',
- *   scopes: ['sfcc.products', 'sfcc.orders'],
- * });
- *
- * // Will open browser for authentication
- * const response = await auth.fetch('https://example.com/api/resource');
- * ```
- */
-export declare class ImplicitOAuthStrategy implements AuthStrategy {
-    private config;
-    private accountManagerHost;
-    private localPort;
-    constructor(config: ImplicitOAuthConfig);
-    fetch(url: string, init?: RequestInit): Promise<Response>;
-    getAuthorizationHeader(): Promise<string>;
-    /**
-     * Gets the decoded JWT payload
-     */
-    getJWT(): Promise<DecodedJWT>;
-    /**
-     * Gets the full token response including expiration and scopes.
-     * Useful for commands that need to display or return token metadata.
-     */
-    getTokenResponse(): Promise<AccessTokenResponse>;
-    /**
-     * Invalidates the cached token, forcing re-authentication on next request
-     */
-    invalidateToken(): void;
-    /**
-     * Gets an access token, using cache if valid.
-     * Uses a mutex to prevent concurrent auth flows for the same clientId.
-     */
-    private getAccessToken;
-    /**
-     * Performs an implicit OAuth2 login flow.
-     * Opens the user's browser for authentication with Account Manager.
-     *
-     * NOTE: This method requires a TTY and user intervention; it is interactive.
-     * NOTE: Access token is valid for 30 minutes and cannot be renewed.
-     */
-    private implicitFlowLogin;
-}

package/node_modules/@salesforce/b2c-tooling-sdk/dist/cjs/auth/oauth-implicit.js

@@ -1,330 +0,0 @@
-/*
- * Copyright (c) 2025, Salesforce, Inc.
- * SPDX-License-Identifier: Apache-2
- * For full license text, see the license.txt file in the repo root or http://www.apache.org/licenses/LICENSE-2.0
- */
-import { createServer } from 'node:http';
-import { URL } from 'node:url';
-import { getLogger } from '../logging/logger.js';
-import { decodeJWT } from './oauth.js';
-import { DEFAULT_ACCOUNT_MANAGER_HOST } from '../defaults.js';
-const DEFAULT_LOCAL_PORT = 8080;
-// Module-level token cache to support multiple instances with same clientId
-const ACCESS_TOKEN_CACHE = new Map();
-// Module-level pending auth promises to prevent concurrent auth flows for the same clientId
-const PENDING_AUTH = new Map();
-/**
- * Returns the HTML page served to the browser to extract the access token
- * from the URL fragment and redirect it as query parameters.
- */
-function getOauth2RedirectHTML(port) {
-    return `
-<!DOCTYPE html>
-<html lang="en">
-<head>
-    <meta charset="UTF-8">
-    <title>OAuth Return Flow</title>
-</head>
-<body onload="doReturnFlow()">
-<script>
-    function doReturnFlow() {
-        document.location = "http://localhost:${port}/?" + window.location.hash.substring(1);
-    }
-</script>
-</body>
-</html>
-`;
-}
-/**
- * Opens the system default browser to the specified URL.
- * Dynamically imports 'open' package to handle the browser opening.
- */
-async function openBrowser(url) {
-    try {
-        // Dynamic import of 'open' package
-        const open = await import('open');
-        await open.default(url);
-    }
-    catch {
-        // If open fails, the URL will still be printed to console
-        getLogger().debug('Could not automatically open browser');
-    }
-}
-/**
- * OAuth 2.0 Implicit Grant Flow authentication strategy.
- *
- * This strategy is used when only a client ID is available (no client secret).
- * It opens a browser for the user to authenticate with Account Manager,
- * then captures the access token from the OAuth redirect.
- *
- * Note: The access token from implicit flow is valid for 30 minutes and cannot be renewed.
- * This flow requires user interaction and a TTY.
- *
- * @example
- * ```typescript
- * import { ImplicitOAuthStrategy } from '@salesforce/b2c-tooling-sdk';
- *
- * const auth = new ImplicitOAuthStrategy({
- *   clientId: 'your-client-id',
- *   scopes: ['sfcc.products', 'sfcc.orders'],
- * });
- *
- * // Will open browser for authentication
- * const response = await auth.fetch('https://example.com/api/resource');
- * ```
- */
-export class ImplicitOAuthStrategy {
-    config;
-    accountManagerHost;
-    localPort;
-    constructor(config) {
-        this.config = config;
-        this.accountManagerHost = config.accountManagerHost || DEFAULT_ACCOUNT_MANAGER_HOST;
-        this.localPort = config.localPort || parseInt(process.env.SFCC_OAUTH_LOCAL_PORT || '', 10) || DEFAULT_LOCAL_PORT;
-        const logger = getLogger();
-        logger.debug({ clientId: this.config.clientId, accountManagerHost: this.accountManagerHost, port: this.localPort }, '[Auth] ImplicitOAuthStrategy initialized');
-        logger.trace({ scopes: this.config.scopes }, '[Auth] Configured scopes');
-    }
-    async fetch(url, init = {}) {
-        const logger = getLogger();
-        const method = init.method || 'GET';
-        logger.trace({ method, url }, '[Auth] Fetching with implicit OAuth');
-        const token = await this.getAccessToken();
-        const headers = new Headers(init.headers);
-        headers.set('Authorization', `Bearer ${token}`);
-        headers.set('x-dw-client-id', this.config.clientId);
-        const startTime = Date.now();
-        let res = await fetch(url, { ...init, headers });
-        const duration = Date.now() - startTime;
-        logger.debug({ method, url, status: res.status, duration }, '[Auth] Response');
-        // RESILIENCE: If the server says 401, the token might have expired or been revoked.
-        // We retry exactly once after invalidating the cached token.
-        if (res.status === 401) {
-            logger.debug('[Auth] Received 401, invalidating token and retrying');
-            this.invalidateToken();
-            const newToken = await this.getAccessToken();
-            headers.set('Authorization', `Bearer ${newToken}`);
-            const retryStart = Date.now();
-            res = await fetch(url, { ...init, headers });
-            const retryDuration = Date.now() - retryStart;
-            logger.debug({ method, url, status: res.status, duration: retryDuration }, '[Auth] Retry response');
-        }
-        return res;
-    }
-    async getAuthorizationHeader() {
-        const token = await this.getAccessToken();
-        return `Bearer ${token}`;
-    }
-    /**
-     * Gets the decoded JWT payload
-     */
-    async getJWT() {
-        const token = await this.getAccessToken();
-        return decodeJWT(token);
-    }
-    /**
-     * Gets the full token response including expiration and scopes.
-     * Useful for commands that need to display or return token metadata.
-     */
-    async getTokenResponse() {
-        const logger = getLogger();
-        const cached = ACCESS_TOKEN_CACHE.get(this.config.clientId);
-        if (cached) {
-            const now = new Date();
-            const requiredScopes = this.config.scopes || [];
-            const hasAllScopes = requiredScopes.every((scope) => cached.scopes.includes(scope));
-            if (hasAllScopes && now.getTime() <= cached.expires.getTime()) {
-                logger.debug('Reusing cached access token');
-                return cached;
-            }
-        }
-        // Get new token via implicit flow
-        const tokenResponse = await this.implicitFlowLogin();
-        ACCESS_TOKEN_CACHE.set(this.config.clientId, tokenResponse);
-        return tokenResponse;
-    }
-    /**
-     * Invalidates the cached token, forcing re-authentication on next request
-     */
-    invalidateToken() {
-        ACCESS_TOKEN_CACHE.delete(this.config.clientId);
-    }
-    /**
-     * Gets an access token, using cache if valid.
-     * Uses a mutex to prevent concurrent auth flows for the same clientId.
-     */
-    async getAccessToken() {
-        const logger = getLogger();
-        const clientId = this.config.clientId;
-        const cached = ACCESS_TOKEN_CACHE.get(clientId);
-        logger.trace({ clientId, hasCached: !!cached }, '[Auth] Getting access token');
-        if (cached) {
-            const now = new Date();
-            const requiredScopes = this.config.scopes || [];
-            const hasAllScopes = requiredScopes.every((scope) => cached.scopes.includes(scope));
-            const timeUntilExpiry = cached.expires.getTime() - now.getTime();
-            logger.trace({
-                cachedScopes: cached.scopes,
-                requiredScopes,
-                hasAllScopes,
-                expiresAt: cached.expires.toISOString(),
-                timeUntilExpiryMs: timeUntilExpiry,
-            }, '[Auth] Checking cached token validity');
-            if (!hasAllScopes) {
-                logger.warn({ cachedScopes: cached.scopes, requiredScopes }, '[Auth] Access token missing scopes; invalidating and re-authenticating');
-                ACCESS_TOKEN_CACHE.delete(clientId);
-            }
-            else if (now.getTime() > cached.expires.getTime()) {
-                logger.warn({ expiresAt: cached.expires.toISOString() }, '[Auth] Access token expired; invalidating and re-authenticating');
-                ACCESS_TOKEN_CACHE.delete(clientId);
-            }
-            else {
-                logger.debug({ timeUntilExpiryMs: timeUntilExpiry }, '[Auth] Reusing cached access token');
-                return cached.accessToken;
-            }
-        }
-        // Check if there's already an auth flow in progress for this clientId
-        const pendingAuth = PENDING_AUTH.get(clientId);
-        if (pendingAuth) {
-            logger.debug('[Auth] Auth flow already in progress, waiting for it to complete');
-            const tokenResponse = await pendingAuth;
-            return tokenResponse.accessToken;
-        }
-        // Start new auth flow and store the promise so concurrent calls can wait
-        logger.debug('[Auth] No valid cached token, starting implicit flow login');
-        const authPromise = this.implicitFlowLogin();
-        PENDING_AUTH.set(clientId, authPromise);
-        try {
-            const tokenResponse = await authPromise;
-            ACCESS_TOKEN_CACHE.set(clientId, tokenResponse);
-            logger.debug({ expiresAt: tokenResponse.expires.toISOString(), scopes: tokenResponse.scopes }, '[Auth] New token cached');
-            return tokenResponse.accessToken;
-        }
-        finally {
-            // Clean up pending auth promise
-            PENDING_AUTH.delete(clientId);
-        }
-    }
-    /**
-     * Performs an implicit OAuth2 login flow.
-     * Opens the user's browser for authentication with Account Manager.
-     *
-     * NOTE: This method requires a TTY and user intervention; it is interactive.
-     * NOTE: Access token is valid for 30 minutes and cannot be renewed.
-     */
-    async implicitFlowLogin() {
-        const logger = getLogger();
-        const redirectUrl = `http://localhost:${this.localPort}`;
-        const params = new URLSearchParams({
-            client_id: this.config.clientId,
-            redirect_uri: redirectUrl,
-            response_type: 'token',
-        });
-        if (this.config.scopes && this.config.scopes.length > 0) {
-            params.append('scope', this.config.scopes.join(' '));
-        }
-        const authorizeUrl = `https://${this.accountManagerHost}/dwsso/oauth2/authorize?${params.toString()}`;
-        logger.debug({
-            clientId: this.config.clientId,
-            redirectUrl,
-            scopes: this.config.scopes,
-            accountManagerHost: this.accountManagerHost,
-        }, '[Auth] Starting implicit OAuth flow');
-        logger.trace({ authorizeUrl }, '[Auth] Authorization URL');
-        // Print URL to console (in case machine has no default browser)
-        logger.info({ url: authorizeUrl }, `Login URL: ${authorizeUrl}`);
-        logger.info('If the URL does not open automatically, copy/paste it into a browser on this machine.');
-        // Attempt to open the browser
-        logger.debug('[Auth] Attempting to open browser');
-        await openBrowser(authorizeUrl);
-        return new Promise((resolve, reject) => {
-            const sockets = new Set();
-            const startTime = Date.now();
-            const server = createServer((request, response) => {
-                const requestUrl = new URL(request.url || '/', `http://localhost:${this.localPort}`);
-                const accessToken = requestUrl.searchParams.get('access_token');
-                const error = requestUrl.searchParams.get('error');
-                const errorDescription = requestUrl.searchParams.get('error_description');
-                logger.trace({
-                    path: requestUrl.pathname,
-                    hasAccessToken: !!accessToken,
-                    hasError: !!error,
-                }, '[Auth] Received redirect request');
-                if (!accessToken && !error) {
-                    // Serve HTML page to extract token from URL fragment
-                    logger.debug('[Auth] Serving token extraction HTML page');
-                    response.writeHead(200, { 'Content-Type': 'text/html' });
-                    response.write(getOauth2RedirectHTML(this.localPort));
-                    response.end();
-                }
-                else if (accessToken) {
-                    const authDuration = Date.now() - startTime;
-                    // Successfully received access token
-                    logger.debug({ duration: authDuration }, `[Auth] Got access token response (${authDuration}ms)`);
-                    logger.info('Successfully authenticated');
-                    try {
-                        const jwt = decodeJWT(accessToken);
-                        logger.trace({ jwt: jwt.payload }, '[Auth] Decoded JWT payload');
-                    }
-                    catch {
-                        logger.debug('[Auth] Error decoding JWT (token may not be a JWT)');
-                    }
-                    const expiresIn = parseInt(requestUrl.searchParams.get('expires_in') || '0', 10);
-                    const now = new Date();
-                    const expiration = new Date(now.getTime() + expiresIn * 1000);
-                    const scopes = requestUrl.searchParams.get('scope')?.split(' ') ?? [];
-                    logger.debug({ expiresIn, expiresAt: expiration.toISOString(), scopes }, `[Auth] Token expires in ${expiresIn}s, scopes: ${scopes.join(' ')}`);
-                    resolve({
-                        accessToken,
-                        expires: expiration,
-                        scopes,
-                    });
-                    response.writeHead(200, { 'Content-Type': 'text/plain' });
-                    response.write('Authentication successful! You may close this browser window and return to your terminal.');
-                    response.end();
-                    // Shutdown server after a short delay
-                    setTimeout(() => {
-                        logger.debug('[Auth] Shutting down OAuth redirect server');
-                        server.close(() => logger.trace('[Auth] OAuth redirect server closed'));
-                        for (const socket of sockets) {
-                            socket.destroy();
-                        }
-                        logger.trace({ socketCount: sockets.size }, '[Auth] Cleaned up sockets');
-                    }, 100);
-                }
-                else if (error) {
-                    // OAuth error response
-                    const errorMessage = errorDescription || error;
-                    logger.error({ error, errorDescription }, `[Auth] OAuth error: ${error}`);
-                    response.writeHead(500, { 'Content-Type': 'text/plain' });
-                    response.write(`Authentication failed: ${errorMessage}`);
-                    response.end();
-                    reject(new Error(`OAuth error: ${errorMessage}`));
-                    setTimeout(() => {
-                        server.close();
-                        for (const socket of sockets) {
-                            socket.destroy();
-                        }
-                    }, 100);
-                }
-            });
-            server.on('connection', (socket) => {
-                sockets.add(socket);
-                logger.trace({ socketCount: sockets.size }, '[Auth] New socket connection');
-                socket.on('close', () => {
-                    sockets.delete(socket);
-                    logger.trace({ socketCount: sockets.size }, '[Auth] Socket closed');
-                });
-            });
-            server.listen(this.localPort, () => {
-                logger.debug({ port: this.localPort }, `[Auth] OAuth redirect server listening on port ${this.localPort}`);
-                logger.info('Waiting for user to authenticate...');
-            });
-            server.on('error', (err) => {
-                logger.error({ error: err.message, port: this.localPort }, '[Auth] Failed to start OAuth redirect server');
-                reject(new Error(`Failed to start OAuth redirect server: ${err.message}`));
-            });
-        });
-    }
-}
-//# sourceMappingURL=oauth-implicit.js.map