@salesforce/b2c-tooling-sdk 0.0.1 → 0.0.3

package/dist/cjs/auth/api-key.d.ts

@@ -0,0 +1,28 @@
+import type { AuthStrategy } from './types.js';
+/**
+ * API Key authentication strategy.
+ *
+ * Supports two modes:
+ * - Bearer token: When headerName is 'Authorization', formats as 'Bearer {key}'
+ * - Direct key: For other headers (e.g., 'x-api-key'), sets the key directly
+ *
+ * @example
+ * // For MRT API (Bearer token)
+ * const auth = new ApiKeyStrategy(apiKey, 'Authorization');
+ * // Sets: Authorization: Bearer {apiKey}
+ *
+ * @example
+ * // For custom API key header
+ * const auth = new ApiKeyStrategy(apiKey, 'x-api-key');
+ * // Sets: x-api-key: {apiKey}
+ */
+export declare class ApiKeyStrategy implements AuthStrategy {
+    private readonly headerValue;
+    private readonly headerName;
+    constructor(key: string, headerName?: string);
+    fetch(url: string, init?: RequestInit): Promise<Response>;
+    /**
+     * Returns the authorization header value for use with openapi-fetch middleware.
+     */
+    getAuthorizationHeader(): Promise<string>;
+}

package/dist/cjs/auth/api-key.js

@@ -0,0 +1,44 @@
+import { getLogger } from '../logging/logger.js';
+/**
+ * API Key authentication strategy.
+ *
+ * Supports two modes:
+ * - Bearer token: When headerName is 'Authorization', formats as 'Bearer {key}'
+ * - Direct key: For other headers (e.g., 'x-api-key'), sets the key directly
+ *
+ * @example
+ * // For MRT API (Bearer token)
+ * const auth = new ApiKeyStrategy(apiKey, 'Authorization');
+ * // Sets: Authorization: Bearer {apiKey}
+ *
+ * @example
+ * // For custom API key header
+ * const auth = new ApiKeyStrategy(apiKey, 'x-api-key');
+ * // Sets: x-api-key: {apiKey}
+ */
+export class ApiKeyStrategy {
+    headerValue;
+    headerName;
+    constructor(key, headerName = 'x-api-key') {
+        const logger = getLogger();
+        this.headerName = headerName;
+        // For Authorization header, use Bearer prefix (standard for MRT API)
+        // For other headers (like x-api-key), use the key directly
+        this.headerValue = headerName === 'Authorization' ? `Bearer ${key}` : key;
+        // Show partial key for identification (first 8 chars)
+        const keyPreview = key.length > 8 ? `${key.slice(0, 8)}...` : key;
+        logger.debug({ headerName, keyPreview }, `[Auth] Using API Key authentication (${headerName}): ${keyPreview}`);
+    }
+    async fetch(url, init = {}) {
+        const headers = new Headers(init.headers);
+        headers.set(this.headerName, this.headerValue);
+        return fetch(url, { ...init, headers });
+    }
+    /**
+     * Returns the authorization header value for use with openapi-fetch middleware.
+     */
+    async getAuthorizationHeader() {
+        return this.headerValue;
+    }
+}
+//# sourceMappingURL=api-key.js.map

package/dist/cjs/auth/api-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.js","sourceRoot":"","sources":["../../../src/auth/api-key.ts"],"names":[],"mappings":"AAMA,OAAO,EAAC,SAAS,EAAC,MAAM,sBAAsB,CAAC;AAE/C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,cAAc;IACR,WAAW,CAAS;IACpB,UAAU,CAAS;IAEpC,YAAY,GAAW,EAAE,UAAU,GAAG,WAAW;QAC/C,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAE7B,qEAAqE;QACrE,2DAA2D;QAC3D,IAAI,CAAC,WAAW,GAAG,UAAU,KAAK,eAAe,CAAC,CAAC,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAE1E,sDAAsD;QACtD,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;QAClE,MAAM,CAAC,KAAK,CAAC,EAAC,UAAU,EAAE,UAAU,EAAC,EAAE,wCAAwC,UAAU,MAAM,UAAU,EAAE,CAAC,CAAC;IAC/G,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,OAAoB,EAAE;QAC7C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/C,OAAO,KAAK,CAAC,GAAG,EAAE,EAAC,GAAG,IAAI,EAAE,OAAO,EAAC,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB;QAC1B,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF"}

package/dist/cjs/auth/basic.d.ts

@@ -0,0 +1,7 @@
+import type { AuthStrategy } from './types.js';
+export declare class BasicAuthStrategy implements AuthStrategy {
+    private encoded;
+    constructor(user: string, pass: string);
+    fetch(url: string, init?: RequestInit): Promise<Response>;
+    getAuthorizationHeader(): Promise<string>;
+}

package/dist/cjs/auth/basic.js

@@ -0,0 +1,18 @@
+import { getLogger } from '../logging/logger.js';
+export class BasicAuthStrategy {
+    encoded;
+    constructor(user, pass) {
+        this.encoded = Buffer.from(`${user}:${pass}`).toString('base64');
+        const logger = getLogger();
+        logger.debug({ username: user }, `[Auth] Using Basic authentication for user: ${user}`);
+    }
+    async fetch(url, init = {}) {
+        const headers = new Headers(init.headers);
+        headers.set('Authorization', `Basic ${this.encoded}`);
+        return fetch(url, { ...init, headers });
+    }
+    async getAuthorizationHeader() {
+        return `Basic ${this.encoded}`;
+    }
+}
+//# sourceMappingURL=basic.js.map

package/dist/cjs/auth/basic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"basic.js","sourceRoot":"","sources":["../../../src/auth/basic.ts"],"names":[],"mappings":"AAMA,OAAO,EAAC,SAAS,EAAC,MAAM,sBAAsB,CAAC;AAE/C,MAAM,OAAO,iBAAiB;IACpB,OAAO,CAAS;IAExB,YAAY,IAAY,EAAE,IAAY;QACpC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEjE,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,CAAC,KAAK,CAAC,EAAC,QAAQ,EAAE,IAAI,EAAC,EAAE,+CAA+C,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,OAAoB,EAAE;QAC7C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACtD,OAAO,KAAK,CAAC,GAAG,EAAE,EAAC,GAAG,IAAI,EAAE,OAAO,EAAC,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,sBAAsB;QAC1B,OAAO,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;IACjC,CAAC;CACF"}

package/dist/cjs/auth/index.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Authentication strategies for B2C Commerce APIs.
+ *
+ * This module provides different authentication mechanisms for connecting to
+ * B2C Commerce instances and platform services.
+ *
+ * ## Available Strategies
+ *
+ * - {@link BasicAuthStrategy} - Username/password authentication for WebDAV operations
+ * - {@link OAuthStrategy} - OAuth 2.0 client credentials for OCAPI and platform APIs
+ * - {@link ImplicitOAuthStrategy} - Interactive browser-based OAuth for CLI/desktop apps
+ * - {@link ApiKeyStrategy} - API key authentication for MRT services
+ *
+ * ## Strategy Resolution
+ *
+ * Use {@link resolveAuthStrategy} to automatically select the best strategy based on
+ * available credentials and allowed methods:
+ *
+ * ```typescript
+ * import { resolveAuthStrategy } from '@salesforce/b2c-tooling-sdk';
+ *
+ * // Automatically picks client-credentials if secret available, otherwise implicit
+ * const strategy = resolveAuthStrategy({
+ *   clientId: 'your-client-id',
+ *   clientSecret: process.env.CLIENT_SECRET, // may be undefined
+ * });
+ *
+ * // Force a specific method
+ * const implicitOnly = resolveAuthStrategy(
+ *   { clientId: 'your-client-id' },
+ *   { allowedMethods: ['implicit'] }
+ * );
+ * ```
+ *
+ * ## Direct Usage
+ *
+ * All strategies implement the {@link AuthStrategy} interface:
+ *
+ * ```typescript
+ * import { OAuthStrategy, ImplicitOAuthStrategy } from '@salesforce/b2c-tooling-sdk';
+ *
+ * // For automated/server usage (client credentials)
+ * const oauthAuth = new OAuthStrategy({
+ *   clientId: 'your-client-id',
+ *   clientSecret: 'your-client-secret',
+ * });
+ *
+ * // For interactive/CLI usage (opens browser)
+ * const implicitAuth = new ImplicitOAuthStrategy({
+ *   clientId: 'your-client-id',
+ * });
+ * ```
+ *
+ * @module auth
+ */
+export type { AuthStrategy, AccessTokenResponse, DecodedJWT, AuthConfig, BasicAuthConfig, OAuthAuthConfig, ApiKeyAuthConfig, AuthMethod, AuthCredentials, } from './types.js';
+export { ALL_AUTH_METHODS } from './types.js';
+export { BasicAuthStrategy } from './basic.js';
+export { OAuthStrategy, decodeJWT } from './oauth.js';
+export type { OAuthConfig } from './oauth.js';
+export { ImplicitOAuthStrategy } from './oauth-implicit.js';
+export type { ImplicitOAuthConfig } from './oauth-implicit.js';
+export { ApiKeyStrategy } from './api-key.js';
+export { resolveAuthStrategy, checkAvailableAuthMethods } from './resolve.js';
+export type { ResolveAuthStrategyOptions, AvailableAuthMethods } from './resolve.js';

package/dist/cjs/auth/index.js

@@ -0,0 +1,69 @@
+/*
+ * Copyright (c) 2025, Salesforce, Inc.
+ * SPDX-License-Identifier: Apache-2
+ * For full license text, see the license.txt file in the repo root or http://www.apache.org/licenses/LICENSE-2.0
+ */
+/**
+ * Authentication strategies for B2C Commerce APIs.
+ *
+ * This module provides different authentication mechanisms for connecting to
+ * B2C Commerce instances and platform services.
+ *
+ * ## Available Strategies
+ *
+ * - {@link BasicAuthStrategy} - Username/password authentication for WebDAV operations
+ * - {@link OAuthStrategy} - OAuth 2.0 client credentials for OCAPI and platform APIs
+ * - {@link ImplicitOAuthStrategy} - Interactive browser-based OAuth for CLI/desktop apps
+ * - {@link ApiKeyStrategy} - API key authentication for MRT services
+ *
+ * ## Strategy Resolution
+ *
+ * Use {@link resolveAuthStrategy} to automatically select the best strategy based on
+ * available credentials and allowed methods:
+ *
+ * ```typescript
+ * import { resolveAuthStrategy } from '@salesforce/b2c-tooling-sdk';
+ *
+ * // Automatically picks client-credentials if secret available, otherwise implicit
+ * const strategy = resolveAuthStrategy({
+ *   clientId: 'your-client-id',
+ *   clientSecret: process.env.CLIENT_SECRET, // may be undefined
+ * });
+ *
+ * // Force a specific method
+ * const implicitOnly = resolveAuthStrategy(
+ *   { clientId: 'your-client-id' },
+ *   { allowedMethods: ['implicit'] }
+ * );
+ * ```
+ *
+ * ## Direct Usage
+ *
+ * All strategies implement the {@link AuthStrategy} interface:
+ *
+ * ```typescript
+ * import { OAuthStrategy, ImplicitOAuthStrategy } from '@salesforce/b2c-tooling-sdk';
+ *
+ * // For automated/server usage (client credentials)
+ * const oauthAuth = new OAuthStrategy({
+ *   clientId: 'your-client-id',
+ *   clientSecret: 'your-client-secret',
+ * });
+ *
+ * // For interactive/CLI usage (opens browser)
+ * const implicitAuth = new ImplicitOAuthStrategy({
+ *   clientId: 'your-client-id',
+ * });
+ * ```
+ *
+ * @module auth
+ */
+export { ALL_AUTH_METHODS } from './types.js';
+// Strategies
+export { BasicAuthStrategy } from './basic.js';
+export { OAuthStrategy, decodeJWT } from './oauth.js';
+export { ImplicitOAuthStrategy } from './oauth-implicit.js';
+export { ApiKeyStrategy } from './api-key.js';
+// Resolution helpers
+export { resolveAuthStrategy, checkAvailableAuthMethods } from './resolve.js';
+//# sourceMappingURL=index.js.map

package/dist/cjs/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAcH,OAAO,EAAC,gBAAgB,EAAC,MAAM,YAAY,CAAC;AAE5C,aAAa;AACb,OAAO,EAAC,iBAAiB,EAAC,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAC,aAAa,EAAE,SAAS,EAAC,MAAM,YAAY,CAAC;AAEpD,OAAO,EAAC,qBAAqB,EAAC,MAAM,qBAAqB,CAAC;AAE1D,OAAO,EAAC,cAAc,EAAC,MAAM,cAAc,CAAC;AAE5C,qBAAqB;AACrB,OAAO,EAAC,mBAAmB,EAAE,yBAAyB,EAAC,MAAM,cAAc,CAAC"}

package/dist/cjs/auth/oauth-implicit.d.ts

@@ -0,0 +1,74 @@
+import type { AuthStrategy, AccessTokenResponse, DecodedJWT } from './types.js';
+/**
+ * Configuration for the implicit OAuth flow.
+ */
+export interface ImplicitOAuthConfig {
+    /** OAuth client ID registered with Account Manager */
+    clientId: string;
+    /** OAuth scopes to request (e.g., 'sfcc.products', 'sfcc.orders') */
+    scopes?: string[];
+    /** Account Manager host (defaults to 'account.demandware.com') */
+    accountManagerHost?: string;
+    /**
+     * Local port for the OAuth redirect server.
+     * Defaults to 8080 or SFCC_OAUTH_LOCAL_PORT environment variable.
+     */
+    localPort?: number;
+}
+/**
+ * OAuth 2.0 Implicit Grant Flow authentication strategy.
+ *
+ * This strategy is used when only a client ID is available (no client secret).
+ * It opens a browser for the user to authenticate with Account Manager,
+ * then captures the access token from the OAuth redirect.
+ *
+ * Note: The access token from implicit flow is valid for 30 minutes and cannot be renewed.
+ * This flow requires user interaction and a TTY.
+ *
+ * @example
+ * ```typescript
+ * import { ImplicitOAuthStrategy } from '@salesforce/b2c-tooling-sdk';
+ *
+ * const auth = new ImplicitOAuthStrategy({
+ *   clientId: 'your-client-id',
+ *   scopes: ['sfcc.products', 'sfcc.orders'],
+ * });
+ *
+ * // Will open browser for authentication
+ * const response = await auth.fetch('https://example.com/api/resource');
+ * ```
+ */
+export declare class ImplicitOAuthStrategy implements AuthStrategy {
+    private config;
+    private accountManagerHost;
+    private localPort;
+    constructor(config: ImplicitOAuthConfig);
+    fetch(url: string, init?: RequestInit): Promise<Response>;
+    getAuthorizationHeader(): Promise<string>;
+    /**
+     * Gets the decoded JWT payload
+     */
+    getJWT(): Promise<DecodedJWT>;
+    /**
+     * Gets the full token response including expiration and scopes.
+     * Useful for commands that need to display or return token metadata.
+     */
+    getTokenResponse(): Promise<AccessTokenResponse>;
+    /**
+     * Invalidates the cached token, forcing re-authentication on next request
+     */
+    invalidateToken(): void;
+    /**
+     * Gets an access token, using cache if valid.
+     * Uses a mutex to prevent concurrent auth flows for the same clientId.
+     */
+    private getAccessToken;
+    /**
+     * Performs an implicit OAuth2 login flow.
+     * Opens the user's browser for authentication with Account Manager.
+     *
+     * NOTE: This method requires a TTY and user intervention; it is interactive.
+     * NOTE: Access token is valid for 30 minutes and cannot be renewed.
+     */
+    private implicitFlowLogin;
+}

package/dist/cjs/auth/oauth-implicit.js

@@ -0,0 +1,330 @@
+/*
+ * Copyright (c) 2025, Salesforce, Inc.
+ * SPDX-License-Identifier: Apache-2
+ * For full license text, see the license.txt file in the repo root or http://www.apache.org/licenses/LICENSE-2.0
+ */
+import { createServer } from 'node:http';
+import { URL } from 'node:url';
+import { getLogger } from '../logging/logger.js';
+import { decodeJWT } from './oauth.js';
+import { DEFAULT_ACCOUNT_MANAGER_HOST } from '../defaults.js';
+const DEFAULT_LOCAL_PORT = 8080;
+// Module-level token cache to support multiple instances with same clientId
+const ACCESS_TOKEN_CACHE = new Map();
+// Module-level pending auth promises to prevent concurrent auth flows for the same clientId
+const PENDING_AUTH = new Map();
+/**
+ * Returns the HTML page served to the browser to extract the access token
+ * from the URL fragment and redirect it as query parameters.
+ */
+function getOauth2RedirectHTML(port) {
+    return `
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <title>OAuth Return Flow</title>
+</head>
+<body onload="doReturnFlow()">
+<script>
+    function doReturnFlow() {
+        document.location = "http://localhost:${port}/?" + window.location.hash.substring(1);
+    }
+</script>
+</body>
+</html>
+`;
+}
+/**
+ * Opens the system default browser to the specified URL.
+ * Dynamically imports 'open' package to handle the browser opening.
+ */
+async function openBrowser(url) {
+    try {
+        // Dynamic import of 'open' package
+        const open = await import('open');
+        await open.default(url);
+    }
+    catch {
+        // If open fails, the URL will still be printed to console
+        getLogger().debug('Could not automatically open browser');
+    }
+}
+/**
+ * OAuth 2.0 Implicit Grant Flow authentication strategy.
+ *
+ * This strategy is used when only a client ID is available (no client secret).
+ * It opens a browser for the user to authenticate with Account Manager,
+ * then captures the access token from the OAuth redirect.
+ *
+ * Note: The access token from implicit flow is valid for 30 minutes and cannot be renewed.
+ * This flow requires user interaction and a TTY.
+ *
+ * @example
+ * ```typescript
+ * import { ImplicitOAuthStrategy } from '@salesforce/b2c-tooling-sdk';
+ *
+ * const auth = new ImplicitOAuthStrategy({
+ *   clientId: 'your-client-id',
+ *   scopes: ['sfcc.products', 'sfcc.orders'],
+ * });
+ *
+ * // Will open browser for authentication
+ * const response = await auth.fetch('https://example.com/api/resource');
+ * ```
+ */
+export class ImplicitOAuthStrategy {
+    config;
+    accountManagerHost;
+    localPort;
+    constructor(config) {
+        this.config = config;
+        this.accountManagerHost = config.accountManagerHost || DEFAULT_ACCOUNT_MANAGER_HOST;
+        this.localPort = config.localPort || parseInt(process.env.SFCC_OAUTH_LOCAL_PORT || '', 10) || DEFAULT_LOCAL_PORT;
+        const logger = getLogger();
+        logger.debug({ clientId: this.config.clientId, accountManagerHost: this.accountManagerHost, port: this.localPort }, '[Auth] ImplicitOAuthStrategy initialized');
+        logger.trace({ scopes: this.config.scopes }, '[Auth] Configured scopes');
+    }
+    async fetch(url, init = {}) {
+        const logger = getLogger();
+        const method = init.method || 'GET';
+        logger.trace({ method, url }, '[Auth] Fetching with implicit OAuth');
+        const token = await this.getAccessToken();
+        const headers = new Headers(init.headers);
+        headers.set('Authorization', `Bearer ${token}`);
+        headers.set('x-dw-client-id', this.config.clientId);
+        const startTime = Date.now();
+        let res = await fetch(url, { ...init, headers });
+        const duration = Date.now() - startTime;
+        logger.debug({ method, url, status: res.status, duration }, '[Auth] Response');
+        // RESILIENCE: If the server says 401, the token might have expired or been revoked.
+        // We retry exactly once after invalidating the cached token.
+        if (res.status === 401) {
+            logger.debug('[Auth] Received 401, invalidating token and retrying');
+            this.invalidateToken();
+            const newToken = await this.getAccessToken();
+            headers.set('Authorization', `Bearer ${newToken}`);
+            const retryStart = Date.now();
+            res = await fetch(url, { ...init, headers });
+            const retryDuration = Date.now() - retryStart;
+            logger.debug({ method, url, status: res.status, duration: retryDuration }, '[Auth] Retry response');
+        }
+        return res;
+    }
+    async getAuthorizationHeader() {
+        const token = await this.getAccessToken();
+        return `Bearer ${token}`;
+    }
+    /**
+     * Gets the decoded JWT payload
+     */
+    async getJWT() {
+        const token = await this.getAccessToken();
+        return decodeJWT(token);
+    }
+    /**
+     * Gets the full token response including expiration and scopes.
+     * Useful for commands that need to display or return token metadata.
+     */
+    async getTokenResponse() {
+        const logger = getLogger();
+        const cached = ACCESS_TOKEN_CACHE.get(this.config.clientId);
+        if (cached) {
+            const now = new Date();
+            const requiredScopes = this.config.scopes || [];
+            const hasAllScopes = requiredScopes.every((scope) => cached.scopes.includes(scope));
+            if (hasAllScopes && now.getTime() <= cached.expires.getTime()) {
+                logger.debug('Reusing cached access token');
+                return cached;
+            }
+        }
+        // Get new token via implicit flow
+        const tokenResponse = await this.implicitFlowLogin();
+        ACCESS_TOKEN_CACHE.set(this.config.clientId, tokenResponse);
+        return tokenResponse;
+    }
+    /**
+     * Invalidates the cached token, forcing re-authentication on next request
+     */
+    invalidateToken() {
+        ACCESS_TOKEN_CACHE.delete(this.config.clientId);
+    }
+    /**
+     * Gets an access token, using cache if valid.
+     * Uses a mutex to prevent concurrent auth flows for the same clientId.
+     */
+    async getAccessToken() {
+        const logger = getLogger();
+        const clientId = this.config.clientId;
+        const cached = ACCESS_TOKEN_CACHE.get(clientId);
+        logger.trace({ clientId, hasCached: !!cached }, '[Auth] Getting access token');
+        if (cached) {
+            const now = new Date();
+            const requiredScopes = this.config.scopes || [];
+            const hasAllScopes = requiredScopes.every((scope) => cached.scopes.includes(scope));
+            const timeUntilExpiry = cached.expires.getTime() - now.getTime();
+            logger.trace({
+                cachedScopes: cached.scopes,
+                requiredScopes,
+                hasAllScopes,
+                expiresAt: cached.expires.toISOString(),
+                timeUntilExpiryMs: timeUntilExpiry,
+            }, '[Auth] Checking cached token validity');
+            if (!hasAllScopes) {
+                logger.warn({ cachedScopes: cached.scopes, requiredScopes }, '[Auth] Access token missing scopes; invalidating and re-authenticating');
+                ACCESS_TOKEN_CACHE.delete(clientId);
+            }
+            else if (now.getTime() > cached.expires.getTime()) {
+                logger.warn({ expiresAt: cached.expires.toISOString() }, '[Auth] Access token expired; invalidating and re-authenticating');
+                ACCESS_TOKEN_CACHE.delete(clientId);
+            }
+            else {
+                logger.debug({ timeUntilExpiryMs: timeUntilExpiry }, '[Auth] Reusing cached access token');
+                return cached.accessToken;
+            }
+        }
+        // Check if there's already an auth flow in progress for this clientId
+        const pendingAuth = PENDING_AUTH.get(clientId);
+        if (pendingAuth) {
+            logger.debug('[Auth] Auth flow already in progress, waiting for it to complete');
+            const tokenResponse = await pendingAuth;
+            return tokenResponse.accessToken;
+        }
+        // Start new auth flow and store the promise so concurrent calls can wait
+        logger.debug('[Auth] No valid cached token, starting implicit flow login');
+        const authPromise = this.implicitFlowLogin();
+        PENDING_AUTH.set(clientId, authPromise);
+        try {
+            const tokenResponse = await authPromise;
+            ACCESS_TOKEN_CACHE.set(clientId, tokenResponse);
+            logger.debug({ expiresAt: tokenResponse.expires.toISOString(), scopes: tokenResponse.scopes }, '[Auth] New token cached');
+            return tokenResponse.accessToken;
+        }
+        finally {
+            // Clean up pending auth promise
+            PENDING_AUTH.delete(clientId);
+        }
+    }
+    /**
+     * Performs an implicit OAuth2 login flow.
+     * Opens the user's browser for authentication with Account Manager.
+     *
+     * NOTE: This method requires a TTY and user intervention; it is interactive.
+     * NOTE: Access token is valid for 30 minutes and cannot be renewed.
+     */
+    async implicitFlowLogin() {
+        const logger = getLogger();
+        const redirectUrl = `http://localhost:${this.localPort}`;
+        const params = new URLSearchParams({
+            client_id: this.config.clientId,
+            redirect_uri: redirectUrl,
+            response_type: 'token',
+        });
+        if (this.config.scopes && this.config.scopes.length > 0) {
+            params.append('scope', this.config.scopes.join(' '));
+        }
+        const authorizeUrl = `https://${this.accountManagerHost}/dwsso/oauth2/authorize?${params.toString()}`;
+        logger.debug({
+            clientId: this.config.clientId,
+            redirectUrl,
+            scopes: this.config.scopes,
+            accountManagerHost: this.accountManagerHost,
+        }, '[Auth] Starting implicit OAuth flow');
+        logger.trace({ authorizeUrl }, '[Auth] Authorization URL');
+        // Print URL to console (in case machine has no default browser)
+        logger.info({ url: authorizeUrl }, `Login URL: ${authorizeUrl}`);
+        logger.info('If the URL does not open automatically, copy/paste it into a browser on this machine.');
+        // Attempt to open the browser
+        logger.debug('[Auth] Attempting to open browser');
+        await openBrowser(authorizeUrl);
+        return new Promise((resolve, reject) => {
+            const sockets = new Set();
+            const startTime = Date.now();
+            const server = createServer((request, response) => {
+                const requestUrl = new URL(request.url || '/', `http://localhost:${this.localPort}`);
+                const accessToken = requestUrl.searchParams.get('access_token');
+                const error = requestUrl.searchParams.get('error');
+                const errorDescription = requestUrl.searchParams.get('error_description');
+                logger.trace({
+                    path: requestUrl.pathname,
+                    hasAccessToken: !!accessToken,
+                    hasError: !!error,
+                }, '[Auth] Received redirect request');
+                if (!accessToken && !error) {
+                    // Serve HTML page to extract token from URL fragment
+                    logger.debug('[Auth] Serving token extraction HTML page');
+                    response.writeHead(200, { 'Content-Type': 'text/html' });
+                    response.write(getOauth2RedirectHTML(this.localPort));
+                    response.end();
+                }
+                else if (accessToken) {
+                    const authDuration = Date.now() - startTime;
+                    // Successfully received access token
+                    logger.debug({ duration: authDuration }, `[Auth] Got access token response (${authDuration}ms)`);
+                    logger.info('Successfully authenticated');
+                    try {
+                        const jwt = decodeJWT(accessToken);
+                        logger.trace({ jwt: jwt.payload }, '[Auth] Decoded JWT payload');
+                    }
+                    catch {
+                        logger.debug('[Auth] Error decoding JWT (token may not be a JWT)');
+                    }
+                    const expiresIn = parseInt(requestUrl.searchParams.get('expires_in') || '0', 10);
+                    const now = new Date();
+                    const expiration = new Date(now.getTime() + expiresIn * 1000);
+                    const scopes = requestUrl.searchParams.get('scope')?.split(' ') ?? [];
+                    logger.debug({ expiresIn, expiresAt: expiration.toISOString(), scopes }, `[Auth] Token expires in ${expiresIn}s, scopes: ${scopes.join(' ')}`);
+                    resolve({
+                        accessToken,
+                        expires: expiration,
+                        scopes,
+                    });
+                    response.writeHead(200, { 'Content-Type': 'text/plain' });
+                    response.write('Authentication successful! You may close this browser window and return to your terminal.');
+                    response.end();
+                    // Shutdown server after a short delay
+                    setTimeout(() => {
+                        logger.debug('[Auth] Shutting down OAuth redirect server');
+                        server.close(() => logger.trace('[Auth] OAuth redirect server closed'));
+                        for (const socket of sockets) {
+                            socket.destroy();
+                        }
+                        logger.trace({ socketCount: sockets.size }, '[Auth] Cleaned up sockets');
+                    }, 100);
+                }
+                else if (error) {
+                    // OAuth error response
+                    const errorMessage = errorDescription || error;
+                    logger.error({ error, errorDescription }, `[Auth] OAuth error: ${error}`);
+                    response.writeHead(500, { 'Content-Type': 'text/plain' });
+                    response.write(`Authentication failed: ${errorMessage}`);
+                    response.end();
+                    reject(new Error(`OAuth error: ${errorMessage}`));
+                    setTimeout(() => {
+                        server.close();
+                        for (const socket of sockets) {
+                            socket.destroy();
+                        }
+                    }, 100);
+                }
+            });
+            server.on('connection', (socket) => {
+                sockets.add(socket);
+                logger.trace({ socketCount: sockets.size }, '[Auth] New socket connection');
+                socket.on('close', () => {
+                    sockets.delete(socket);
+                    logger.trace({ socketCount: sockets.size }, '[Auth] Socket closed');
+                });
+            });
+            server.listen(this.localPort, () => {
+                logger.debug({ port: this.localPort }, `[Auth] OAuth redirect server listening on port ${this.localPort}`);
+                logger.info('Waiting for user to authenticate...');
+            });
+            server.on('error', (err) => {
+                logger.error({ error: err.message, port: this.localPort }, '[Auth] Failed to start OAuth redirect server');
+                reject(new Error(`Failed to start OAuth redirect server: ${err.message}`));
+            });
+        });
+    }
+}
+//# sourceMappingURL=oauth-implicit.js.map