@salesforce/b2c-tooling-sdk 1.24.2 → 2.0.0

package/dist/esm/auth/oauth.js

@@ -66,12 +66,53 @@ export function setCachedOAuthToken(cacheKey, tokenResponse) {
     ACCESS_TOKEN_CACHE.set(cacheKey, tokenResponse);
 }
 /**
- * Invalidates a cached OAuth token.
+ * Scans the cache for a non-expired token (matching the supplied identity
+ * prefix) whose scopes are a superset of `requiredScopes`.
  *
- * @param cacheKey - Cache key from getOAuthCacheKey()
+ * Used by cascade resolution: a cached token granted with broader scopes
+ * (e.g. `sfcc.jobs.rw`) automatically satisfies a later request that needs
+ * a narrower scope (e.g. `sfcc.jobs`), with no extra AM round trip.
+ *
+ * The identity prefix is `${accountManagerHost}:${clientId}:${method}:` —
+ * the same prefix `getOAuthCacheKey` produces. We iterate cache values that
+ * share this prefix; in practice 1-3 entries per identity.
+ *
+ * @returns The first satisfying token, or undefined if none.
+ */
+export function findCachedTokenSatisfying(identityPrefix, requiredScopes) {
+    const now = new Date();
+    for (const [key, entry] of ACCESS_TOKEN_CACHE) {
+        if (!key.startsWith(identityPrefix))
+            continue;
+        if (now.getTime() > entry.expires.getTime()) {
+            ACCESS_TOKEN_CACHE.delete(key);
+            continue;
+        }
+        if (requiredScopes.every((s) => entry.scopes.includes(s))) {
+            return entry;
+        }
+    }
+    return undefined;
+}
+/**
+ * Invalidates **every** cached token for an identity prefix
+ * (`${accountManagerHost}:${clientId}:${method}:`).
+ *
+ * A cascade-resolving strategy caches tokens under *merged-scope* keys (e.g.
+ * base ∪ `sfcc.jobs.rw`), which differ from the strategy's configured base-
+ * scope {@link getOAuthCacheKey}. Deleting only the base key on a 401 would
+ * leave the rejected merged token cached, so the retry's cascade cache-scan
+ * ({@link findCachedTokenSatisfying}) would re-hand out the same rejected
+ * token. Clearing by identity prefix evicts all of them so the retry re-
+ * requests from Account Manager. The prefix scopes deletion to this
+ * client/method/AM host, so unrelated identities are untouched.
  */
-export function invalidateCachedOAuthToken(cacheKey) {
-    ACCESS_TOKEN_CACHE.delete(cacheKey);
+export function invalidateCachedTokensForIdentity(identityPrefix) {
+    for (const key of ACCESS_TOKEN_CACHE.keys()) {
+        if (key.startsWith(identityPrefix)) {
+            ACCESS_TOKEN_CACHE.delete(key);
+        }
+    }
 }
 /**
  * OAuth 2.0 Client Credentials authentication strategy.
@@ -99,6 +140,7 @@ export class OAuthStrategy {
     accountManagerHost;
     _hasHadSuccess = false;
     cacheKey;
+    identityPrefix;
     /**
      * Creates a new OAuthStrategy instance with the provided OAuth configuration.
      *
@@ -108,6 +150,7 @@ export class OAuthStrategy {
         this.config = config;
         this.accountManagerHost = config.accountManagerHost || DEFAULT_ACCOUNT_MANAGER_HOST;
         this.cacheKey = getOAuthCacheKey(this.config.clientId, 'client-credentials', this.accountManagerHost, this.config.scopes);
+        this.identityPrefix = `${this.accountManagerHost}:${this.config.clientId}:client-credentials:`;
     }
     /**
      * Performs a fetch request with OAuth bearer token authentication.
@@ -122,7 +165,7 @@ export class OAuthStrategy {
      * @returns The fetch response
      */
     async fetch(url, init = {}) {
-        const token = await this.getAccessToken();
+        const token = init.signal ? (await this.getTokenResponse(init.signal)).accessToken : await this.getAccessToken();
         const headers = new Headers(init.headers);
         headers.set('Authorization', `Bearer ${token}`);
         headers.set('x-dw-client-id', this.config.clientId);
@@ -136,7 +179,9 @@ export class OAuthStrategy {
         // Skip retry on initial 401 to avoid retrying with bad credentials.
         if (res.status === 401 && this._hasHadSuccess) {
             this.invalidateToken();
-            const newToken = await this.getAccessToken();
+            const newToken = init.signal
+                ? (await this.getTokenResponse(init.signal)).accessToken
+                : await this.getAccessToken();
             headers.set('Authorization', `Bearer ${newToken}`);
             res = await dispatchFetch(url, { ...init, headers });
         }
@@ -157,20 +202,31 @@ export class OAuthStrategy {
      * Gets the full token response including expiration and scopes.
      * Useful for commands that need to display or return token metadata.
      */
-    async getTokenResponse() {
+    async getTokenResponse(signal) {
+        signal?.throwIfAborted();
         const logger = getLogger();
         const cached = getCachedOAuthToken(this.cacheKey, this.config.scopes || []);
         if (cached) {
             logger.debug('[OAuthStrategy] Reusing cached access token');
             return cached;
         }
+        if (signal) {
+            // A cancelled caller must not abort a shared token refresh for other consumers.
+            const token = await this.clientCredentialsGrant(this.config.scopes, signal);
+            setCachedOAuthToken(this.cacheKey, token);
+            return token;
+        }
         return this.refreshTokenSingleflight();
     }
     /**
-     * Invalidates the cached token, forcing re-authentication on next request
+     * Invalidates cached tokens, forcing re-authentication on next request.
+     *
+     * Clears every token for this client/method/AM-host identity — not just the
+     * base-scope key — so a 401 retry can't re-use a rejected token that was
+     * cached under a merged cascade-scope key.
      */
     invalidateToken() {
-        invalidateCachedOAuthToken(this.cacheKey);
+        invalidateCachedTokensForIdentity(this.identityPrefix);
     }
     /**
      * Creates a new OAuthStrategy with additional scopes merged in.
@@ -186,6 +242,54 @@ export class OAuthStrategy {
             scopes: mergedScopes,
         });
     }
+    /**
+     * Resolves a scope cascade. See {@link AuthStrategy.getAccessTokenForCascade}.
+     *
+     * Each candidate is merged with this strategy's base scopes (e.g. tenant
+     * scope baked in via {@link withAdditionalScopes}) before being sent to AM.
+     *
+     * Cache strategy:
+     *   1. For each candidate, scan the cache for any non-expired token whose
+     *      scopes ⊇ (base ∪ candidate). First hit wins, no AM call.
+     *   2. On miss, request each candidate from AM in order. Cache successes.
+     *   3. On `invalid_scope` for a candidate, continue to the next candidate.
+     *      On any other error, rethrow.
+     */
+    async getAccessTokenForCascade(candidates) {
+        const logger = getLogger();
+        const baseScopes = this.config.scopes ?? [];
+        const identityPrefix = this.identityPrefix;
+        // Pass 1: cache scan. Return the first cached token that satisfies any
+        // candidate.
+        for (const candidate of candidates) {
+            const required = [...new Set([...baseScopes, ...candidate])];
+            const cached = findCachedTokenSatisfying(identityPrefix, required);
+            if (cached) {
+                logger.debug({ required, cachedScopes: cached.scopes }, `[OAuthStrategy] Cache hit: cached token satisfies cascade candidate ${JSON.stringify(candidate)}`);
+                return cached.accessToken;
+            }
+        }
+        // Pass 2: try each candidate against AM in order.
+        let lastError;
+        for (const candidate of candidates) {
+            const merged = [...new Set([...baseScopes, ...candidate])];
+            try {
+                logger.debug({ scopes: merged }, `[OAuthStrategy] Cascade trying scopes ${JSON.stringify(candidate)}`);
+                const tokenResponse = await this.refreshTokenForScopes(merged);
+                return tokenResponse.accessToken;
+            }
+            catch (error) {
+                if (error instanceof Error && error.message.includes('invalid_scope')) {
+                    logger.debug({ scopes: merged }, `[OAuthStrategy] Cascade candidate ${JSON.stringify(candidate)} rejected (invalid_scope), trying next`);
+                    lastError = error;
+                    continue;
+                }
+                throw error;
+            }
+        }
+        // All candidates exhausted. Rethrow the last invalid_scope.
+        throw lastError ?? new Error('All scope cascade candidates failed');
+    }
     /**
      * Gets an access token, using cache if valid
      */
@@ -205,34 +309,45 @@ export class OAuthStrategy {
      * when many requests trigger refresh at once.
      */
     refreshTokenSingleflight() {
-        const existing = PENDING_TOKEN_REQUESTS.get(this.cacheKey);
+        return this.refreshTokenForScopes(this.config.scopes);
+    }
+    /**
+     * Variant of {@link refreshTokenSingleflight} that requests a specific scope
+     * set rather than the strategy's configured scopes. Used by cascade
+     * resolution. Caches under a key derived from the requested scopes.
+     */
+    refreshTokenForScopes(scopes) {
+        const cacheKey = getOAuthCacheKey(this.config.clientId, 'client-credentials', this.accountManagerHost, scopes);
+        const existing = PENDING_TOKEN_REQUESTS.get(cacheKey);
         if (existing) {
             getLogger().debug('[OAuthStrategy] Joining in-flight token request');
             return existing;
         }
         const pending = (async () => {
-            getLogger().debug('[OAuthStrategy] Requesting new access token');
-            const tokenResponse = await this.clientCredentialsGrant();
-            setCachedOAuthToken(this.cacheKey, tokenResponse);
+            getLogger().debug({ scopes }, '[OAuthStrategy] Requesting new access token');
+            const tokenResponse = await this.clientCredentialsGrant(scopes);
+            setCachedOAuthToken(cacheKey, tokenResponse);
             return tokenResponse;
         })().finally(() => {
-            PENDING_TOKEN_REQUESTS.delete(this.cacheKey);
+            PENDING_TOKEN_REQUESTS.delete(cacheKey);
         });
-        PENDING_TOKEN_REQUESTS.set(this.cacheKey, pending);
+        PENDING_TOKEN_REQUESTS.set(cacheKey, pending);
         return pending;
     }
     /**
-     * Performs client credentials grant flow
+     * Performs client credentials grant flow with the given scope set.
+     * Defaults to the strategy's configured scopes when `scopes` is omitted.
      */
-    async clientCredentialsGrant() {
+    async clientCredentialsGrant(scopeOverride, signal) {
         const logger = getLogger();
+        const requestedScopes = scopeOverride ?? this.config.scopes;
         const url = `https://${this.accountManagerHost}/dwsso/oauth2/access_token`;
         const method = 'POST';
         const params = new URLSearchParams({
             grant_type: 'client_credentials',
         });
-        if (this.config.scopes && this.config.scopes.length > 0) {
-            params.append('scope', this.config.scopes.join(' '));
+        if (requestedScopes && requestedScopes.length > 0) {
+            params.append('scope', requestedScopes.join(' '));
         }
         const credentials = encodeBasicClientCredentials(this.config.clientId, this.config.clientSecret);
         // Build request object for middleware
@@ -260,7 +375,7 @@ export class OAuthStrategy {
         const startTime = Date.now();
         let response;
         try {
-            response = await fetch(request);
+            response = await fetch(request, { signal, redirect: 'error' });
         }
         catch (err) {
             const host = new URL(url).host;
@@ -288,7 +403,10 @@ export class OAuthStrategy {
         logger.trace({ jwt: jwt.payload }, '[Auth] JWT payload');
         const now = new Date();
         const expiration = new Date(now.getTime() + data.expires_in * 1000);
-        const scopes = data.scope?.split(' ') ?? [];
+        // AM normally echoes back the granted scopes; some configurations omit
+        // the `scope` claim in the token response. Fall back to what we
+        // requested so cache satisfies-checks (cascade resolution) still work.
+        const scopes = data.scope?.split(' ') ?? requestedScopes ?? [];
         return {
             accessToken: data.access_token,
             expires: expiration,

package/dist/esm/auth/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/auth/oauth.ts"],"names":[],"mappings":"AAMA,OAAO,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAC,gBAAgB,EAAC,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAC,SAAS,EAAC,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAC,4BAA4B,EAAC,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAC,4BAA4B,EAAE,0BAA0B,EAAE,2BAA2B,EAAC,MAAM,iBAAiB,CAAC;AACtH,OAAO,EAAC,4BAA4B,EAAC,MAAM,yBAAyB,CAAC;AAErE,4EAA4E;AAC5E,MAAM,kBAAkB,GAAqC,IAAI,GAAG,EAAE,CAAC;AAEvE,8EAA8E;AAC9E,4EAA4E;AAC5E,MAAM,sBAAsB,GAA8C,IAAI,GAAG,EAAE,CAAC;AASpF;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvE,OAAO,EAAC,MAAM,EAAE,OAAO,EAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,MAAoC,EACpC,kBAA0B,EAC1B,MAAiB;IAEjB,MAAM,SAAS,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IACjD,OAAO,GAAG,kBAAkB,IAAI,QAAQ,IAAI,MAAM,IAAI,SAAS,EAAE,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,iBAA2B,EAAE;IACjF,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAEpF,uDAAuD;IACvD,IAAI,CAAC,YAAY,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9D,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,aAAkC;IACtF,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAgB;IACzD,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,aAAa;IAUJ;IATZ,kBAAkB,CAAS;IAC3B,cAAc,GAAG,KAAK,CAAC;IACvB,QAAQ,CAAS;IAEzB;;;;OAIG;IACH,YAAoB,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;QACrC,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,IAAI,4BAA4B,CAAC;QACpF,IAAI,CAAC,QAAQ,GAAG,gBAAgB,CAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,EACpB,oBAAoB,EACpB,IAAI,CAAC,kBAAkB,EACvB,IAAI,CAAC,MAAM,CAAC,MAAM,CACnB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,OAAkB,EAAE;QAC3C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAE1C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEpD,mEAAmE;QACnE,IAAI,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,EAAC,GAAG,IAAI,EAAE,OAAO,EAAC,CAAC,CAAC;QAEvD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC7B,CAAC;QAED,4EAA4E;QAC5E,4EAA4E;QAC5E,oEAAoE;QACpE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC9C,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,QAAQ,EAAE,CAAC,CAAC;YACnD,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,EAAC,GAAG,IAAI,EAAE,OAAO,EAAC,CAAC,CAAC;QACrD,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,sBAAsB;QAC1B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,OAAO,UAAU,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gBAAgB;QACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAE5E,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;YAC5D,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,OAAO,IAAI,CAAC,wBAAwB,EAAE,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,eAAe;QACb,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;OAMG;IACH,oBAAoB,CAAC,gBAA0B;QAC7C,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACxF,OAAO,IAAI,aAAa,CAAC;YACvB,GAAG,IAAI,CAAC,MAAM;YACd,MAAM,EAAE,YAAY;SACrB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,cAAc;QAC1B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAE5E,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;YAC5D,OAAO,MAAM,CAAC,WAAW,CAAC;QAC5B,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC5D,OAAO,aAAa,CAAC,WAAW,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACK,wBAAwB;QAC9B,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,QAAQ,EAAE,CAAC;YACb,SAAS,EAAE,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACrE,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YAC1B,SAAS,EAAE,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACjE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC1D,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YAClD,OAAO,aAAa,CAAC;QACvB,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAChB,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QACH,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,sBAAsB;QAClC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,WAAW,IAAI,CAAC,kBAAkB,4BAA4B,CAAC;QAC3E,MAAM,MAAM,GAAG,MAAM,CAAC;QAEtB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,oBAAoB;SACjC,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxD,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,WAAW,GAAG,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAEjG,sCAAsC;QACtC,IAAI,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;YAC7B,MAAM;YACN,OAAO,EAAE;gBACP,aAAa,EAAE,SAAS,WAAW,EAAE;gBACrC,cAAc,EAAE,mCAAmC;aACpD;YACD,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACxB,CAAC,CAAC;QAEH,2CAA2C;QAC3C,MAAM,UAAU,GAAG,4BAA4B,CAAC,aAAa,EAAE,CAAC;QAChE,OAAO,GAAG,MAAM,0BAA0B,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAEhE,wCAAwC;QACxC,MAAM,cAAc,GAA2B,EAAE,CAAC;QAClD,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACrC,cAAc,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CACV,EAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAC,EAChC,2DAA2D,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAClF,CAAC;QACF,2BAA2B;QAC3B,MAAM,CAAC,KAAK,CAAC,EAAC,MAAM,EAAE,GAAG,EAAC,EAAE,cAAc,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;QAE3D,6BAA6B;QAC7B,MAAM,CAAC,KAAK,CAAC,EAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAC,EAAE,mBAAmB,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;QAElH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC/B,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAC,SAAS,EAAE,qBAAqB,EAAE,IAAI,EAAC,CAAC,CAAC;QACxE,CAAC;QAED,4BAA4B;QAC5B,QAAQ,GAAG,MAAM,2BAA2B,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAE5E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAExC,8BAA8B;QAC9B,MAAM,CAAC,KAAK,CACV,EAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAC,EAChD,eAAe,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,QAAQ,IAAI,CAChE,CAAC;QAEF,uBAAuB;QACvB,MAAM,eAAe,GAA2B,EAAE,CAAC;QACnD,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACtC,eAAe,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,EAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAC,EAAE,oBAAoB,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;YAC5G,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,MAAM,SAAS,EAAE,CAAC,CAAC;QAC1G,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAIlC,CAAC;QAEF,8BAA8B;QAC9B,MAAM,CAAC,KAAK,CAAC,EAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,EAAC,EAAE,oBAAoB,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;QAEvG,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,EAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAC,EAAE,oBAAoB,CAAC,CAAC;QAEvD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAE5C,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,OAAO,EAAE,UAAU;YACnB,MAAM;SACP,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/auth/oauth.ts"],"names":[],"mappings":"AAMA,OAAO,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAC,gBAAgB,EAAC,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAC,SAAS,EAAC,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAC,4BAA4B,EAAC,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAC,4BAA4B,EAAE,0BAA0B,EAAE,2BAA2B,EAAC,MAAM,iBAAiB,CAAC;AACtH,OAAO,EAAC,4BAA4B,EAAC,MAAM,yBAAyB,CAAC;AAErE,4EAA4E;AAC5E,MAAM,kBAAkB,GAAqC,IAAI,GAAG,EAAE,CAAC;AAEvE,8EAA8E;AAC9E,4EAA4E;AAC5E,MAAM,sBAAsB,GAA8C,IAAI,GAAG,EAAE,CAAC;AASpF;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvE,OAAO,EAAC,MAAM,EAAE,OAAO,EAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,MAAoC,EACpC,kBAA0B,EAC1B,MAAiB;IAEjB,MAAM,SAAS,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IACjD,OAAO,GAAG,kBAAkB,IAAI,QAAQ,IAAI,MAAM,IAAI,SAAS,EAAE,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,iBAA2B,EAAE;IACjF,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAEpF,uDAAuD;IACvD,IAAI,CAAC,YAAY,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9D,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,aAAkC;IACtF,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CACvC,cAAsB,EACtB,cAAwB;IAExB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,kBAAkB,EAAE,CAAC;QAC9C,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC;YAAE,SAAS;QAC9C,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5C,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iCAAiC,CAAC,cAAsB;IACtE,KAAK,MAAM,GAAG,IAAI,kBAAkB,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5C,IAAI,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YACnC,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,aAAa;IAWJ;IAVZ,kBAAkB,CAAS;IAC3B,cAAc,GAAG,KAAK,CAAC;IACvB,QAAQ,CAAS;IACjB,cAAc,CAAS;IAE/B;;;;OAIG;IACH,YAAoB,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;QACrC,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,IAAI,4BAA4B,CAAC;QACpF,IAAI,CAAC,QAAQ,GAAG,gBAAgB,CAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,EACpB,oBAAoB,EACpB,IAAI,CAAC,kBAAkB,EACvB,IAAI,CAAC,MAAM,CAAC,MAAM,CACnB,CAAC;QACF,IAAI,CAAC,cAAc,GAAG,GAAG,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,sBAAsB,CAAC;IACjG,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,OAAkB,EAAE;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAEjH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEpD,mEAAmE;QACnE,IAAI,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,EAAC,GAAG,IAAI,EAAE,OAAO,EAAC,CAAC,CAAC;QAEvD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC7B,CAAC;QAED,4EAA4E;QAC5E,4EAA4E;QAC5E,oEAAoE;QACpE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC9C,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM;gBAC1B,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW;gBACxD,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,QAAQ,EAAE,CAAC,CAAC;YACnD,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,EAAC,GAAG,IAAI,EAAE,OAAO,EAAC,CAAC,CAAC;QACrD,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,sBAAsB;QAC1B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,OAAO,UAAU,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gBAAgB,CAAC,MAAoB;QACzC,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAE5E,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;YAC5D,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACX,gFAAgF;YAChF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC5E,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC1C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,wBAAwB,EAAE,CAAC;IACzC,CAAC;IAED;;;;;;OAMG;IACH,eAAe;QACb,iCAAiC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACzD,CAAC;IAED;;;;;;OAMG;IACH,oBAAoB,CAAC,gBAA0B;QAC7C,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACxF,OAAO,IAAI,aAAa,CAAC;YACvB,GAAG,IAAI,CAAC,MAAM;YACd,MAAM,EAAE,YAAY;SACrB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,wBAAwB,CAAC,UAAsB;QACnD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;QAC5C,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QAE3C,uEAAuE;QACvE,aAAa;QACb,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,yBAAyB,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;YACnE,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,CAAC,KAAK,CACV,EAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAC,EACvC,uEAAuE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CACnG,CAAC;gBACF,OAAO,MAAM,CAAC,WAAW,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,kDAAkD;QAClD,IAAI,SAAkB,CAAC;QACvB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAC3D,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,CAAC,EAAC,MAAM,EAAE,MAAM,EAAC,EAAE,yCAAyC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBACrG,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;gBAC/D,OAAO,aAAa,CAAC,WAAW,CAAC;YACnC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;oBACtE,MAAM,CAAC,KAAK,CACV,EAAC,MAAM,EAAE,MAAM,EAAC,EAChB,qCAAqC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,wCAAwC,CACvG,CAAC;oBACF,SAAS,GAAG,KAAK,CAAC;oBAClB,SAAS;gBACX,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,4DAA4D;QAC5D,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACtE,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,cAAc;QAC1B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAE5E,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;YAC5D,OAAO,MAAM,CAAC,WAAW,CAAC;QAC5B,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC5D,OAAO,aAAa,CAAC,WAAW,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACK,wBAAwB;QAC9B,OAAO,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxD,CAAC;IAED;;;;OAIG;IACK,qBAAqB,CAAC,MAA4B;QACxD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,oBAAoB,EAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;QAC/G,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtD,IAAI,QAAQ,EAAE,CAAC;YACb,SAAS,EAAE,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACrE,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YAC1B,SAAS,EAAE,CAAC,KAAK,CAAC,EAAC,MAAM,EAAC,EAAE,6CAA6C,CAAC,CAAC;YAC3E,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;YAChE,mBAAmB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YAC7C,OAAO,aAAa,CAAC;QACvB,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAChB,sBAAsB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;QACH,sBAAsB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,sBAAsB,CAAC,aAAwB,EAAE,MAAoB;QACjF,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,eAAe,GAAG,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAC5D,MAAM,GAAG,GAAG,WAAW,IAAI,CAAC,kBAAkB,4BAA4B,CAAC;QAC3E,MAAM,MAAM,GAAG,MAAM,CAAC;QAEtB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,oBAAoB;SACjC,CAAC,CAAC;QAEH,IAAI,eAAe,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,WAAW,GAAG,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAEjG,sCAAsC;QACtC,IAAI,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;YAC7B,MAAM;YACN,OAAO,EAAE;gBACP,aAAa,EAAE,SAAS,WAAW,EAAE;gBACrC,cAAc,EAAE,mCAAmC;aACpD;YACD,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACxB,CAAC,CAAC;QAEH,2CAA2C;QAC3C,MAAM,UAAU,GAAG,4BAA4B,CAAC,aAAa,EAAE,CAAC;QAChE,OAAO,GAAG,MAAM,0BAA0B,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAEhE,wCAAwC;QACxC,MAAM,cAAc,GAA2B,EAAE,CAAC;QAClD,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACrC,cAAc,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CACV,EAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAC,EAChC,2DAA2D,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAClF,CAAC;QACF,2BAA2B;QAC3B,MAAM,CAAC,KAAK,CAAC,EAAC,MAAM,EAAE,GAAG,EAAC,EAAE,cAAc,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;QAE3D,6BAA6B;QAC7B,MAAM,CAAC,KAAK,CAAC,EAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAC,EAAE,mBAAmB,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;QAElH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,EAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAC,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC/B,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAC,SAAS,EAAE,qBAAqB,EAAE,IAAI,EAAC,CAAC,CAAC;QACxE,CAAC;QAED,4BAA4B;QAC5B,QAAQ,GAAG,MAAM,2BAA2B,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAE5E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAExC,8BAA8B;QAC9B,MAAM,CAAC,KAAK,CACV,EAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAC,EAChD,eAAe,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,QAAQ,IAAI,CAChE,CAAC;QAEF,uBAAuB;QACvB,MAAM,eAAe,GAA2B,EAAE,CAAC;QACnD,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACtC,eAAe,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,EAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAC,EAAE,oBAAoB,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;YAC5G,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,MAAM,SAAS,EAAE,CAAC,CAAC;QAC1G,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAIlC,CAAC;QAEF,8BAA8B;QAC9B,MAAM,CAAC,KAAK,CAAC,EAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,EAAC,EAAE,oBAAoB,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;QAEvG,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,EAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAC,EAAE,oBAAoB,CAAC,CAAC;QAEvD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;QACpE,uEAAuE;QACvE,gEAAgE;QAChE,uEAAuE;QACvE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,eAAe,IAAI,EAAE,CAAC;QAE/D,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,OAAO,EAAE,UAAU;YACnB,MAAM;SACP,CAAC;IACJ,CAAC;CACF"}

package/dist/esm/auth/resolve.d.ts

@@ -105,3 +105,40 @@ export declare function checkAvailableAuthMethods(credentials: AuthCredentials,
  * ```
  */
 export declare function resolveAuthStrategy(credentials: AuthCredentials, options?: ResolveAuthStrategyOptions): AuthStrategy;
+/**
+ * Credentials for the non-interactive (system) OAuth flows — client-credentials
+ * and JWT Bearer. A superset of the OAuth fields shared by `NormalizedConfig`
+ * and `AuthConfig.oauth`, so either can be passed directly (extra fields are
+ * ignored by structural typing).
+ */
+export interface SystemOAuthCredentials {
+    clientId?: string;
+    clientSecret?: string;
+    scopes?: string[];
+    accountManagerHost?: string;
+    jwtCertPath?: string;
+    jwtKeyPath?: string;
+    jwtPassphrase?: string;
+}
+/**
+ * Builds a stateless, scope-flexible **system** OAuth strategy — client-credentials
+ * or JWT Bearer — or `undefined` when neither is fully configured.
+ *
+ * These are the only flows that can request arbitrary `sfcc.*` scopes from Account
+ * Manager per call (via the scope-cascade / additional-scopes hooks the SCAPI client
+ * factories rely on). Browser user-auth (PKCE/implicit) and fixed-token stored
+ * sessions are intentionally excluded, so this is the shared definition of
+ * "SCAPI-eligible auth" used by both {@link B2CInstance.scapiClientConfig} and
+ * `MrtCommand.getScapiMrtConfig`.
+ *
+ * Unlike {@link resolveAuthStrategy}, this handles JWT (which needs cert/key paths
+ * not present on {@link AuthCredentials}) and never throws — callers treat
+ * `undefined` as "not SCAPI-eligible". The Account Manager host default is applied by
+ * the strategy constructors, so `accountManagerHost` may be passed through as-is.
+ *
+ * @param credentials - The available system OAuth credentials.
+ * @param methods - Allowed methods in priority order. Defaults to
+ *   client-credentials before JWT, matching the CLI's auth priority.
+ * @returns The first eligible strategy, or `undefined` if none is configured.
+ */
+export declare function resolveSystemOAuthStrategy(credentials: SystemOAuthCredentials, methods?: AuthMethod[]): AuthStrategy | undefined;

package/dist/esm/auth/resolve.js

@@ -28,10 +28,12 @@
  */
 import { ALL_AUTH_METHODS } from './types.js';
 import { OAuthStrategy } from './oauth.js';
+import { JwtOAuthStrategy } from './oauth-jwt.js';
 import { ImplicitOAuthStrategy } from './oauth-implicit.js';
 import { createUserAuthStrategy } from './oauth-pkce-fallback.js';
 import { BasicAuthStrategy } from './basic.js';
 import { ApiKeyStrategy } from './api-key.js';
+import { DEFAULT_ACCOUNT_MANAGER_HOST } from '../defaults.js';
 /**
  * Checks which auth methods have the required credentials available.
  *
@@ -187,4 +189,50 @@ export function resolveAuthStrategy(credentials, options = {}) {
     throw new Error(`No valid auth method available. Allowed methods: [${allowedMethods.join(', ')}]. ` +
         `Missing credentials: ${details}`);
 }
+/**
+ * Builds a stateless, scope-flexible **system** OAuth strategy — client-credentials
+ * or JWT Bearer — or `undefined` when neither is fully configured.
+ *
+ * These are the only flows that can request arbitrary `sfcc.*` scopes from Account
+ * Manager per call (via the scope-cascade / additional-scopes hooks the SCAPI client
+ * factories rely on). Browser user-auth (PKCE/implicit) and fixed-token stored
+ * sessions are intentionally excluded, so this is the shared definition of
+ * "SCAPI-eligible auth" used by both {@link B2CInstance.scapiClientConfig} and
+ * `MrtCommand.getScapiMrtConfig`.
+ *
+ * Unlike {@link resolveAuthStrategy}, this handles JWT (which needs cert/key paths
+ * not present on {@link AuthCredentials}) and never throws — callers treat
+ * `undefined` as "not SCAPI-eligible". The Account Manager host default is applied by
+ * the strategy constructors, so `accountManagerHost` may be passed through as-is.
+ *
+ * @param credentials - The available system OAuth credentials.
+ * @param methods - Allowed methods in priority order. Defaults to
+ *   client-credentials before JWT, matching the CLI's auth priority.
+ * @returns The first eligible strategy, or `undefined` if none is configured.
+ */
+export function resolveSystemOAuthStrategy(credentials, methods = ['client-credentials', 'jwt']) {
+    const { clientId, clientSecret, scopes, jwtCertPath, jwtKeyPath, jwtPassphrase } = credentials;
+    if (!clientId) {
+        return undefined;
+    }
+    // JwtOAuthConfig requires a defined host; OAuthStrategy applies the same
+    // default internally, so this stays consistent across both flows.
+    const accountManagerHost = credentials.accountManagerHost ?? DEFAULT_ACCOUNT_MANAGER_HOST;
+    for (const method of methods) {
+        if (method === 'client-credentials' && clientSecret) {
+            return new OAuthStrategy({ clientId, clientSecret, scopes, accountManagerHost });
+        }
+        if (method === 'jwt' && jwtCertPath && jwtKeyPath) {
+            return new JwtOAuthStrategy({
+                clientId,
+                certPath: jwtCertPath,
+                keyPath: jwtKeyPath,
+                passphrase: jwtPassphrase,
+                accountManagerHost,
+                scopes,
+            });
+        }
+    }
+    return undefined;
+}
 //# sourceMappingURL=resolve.js.map

package/dist/esm/auth/resolve.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../../src/auth/resolve.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAC,gBAAgB,EAAC,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAC,aAAa,EAAC,MAAM,YAAY,CAAC;AACzC,OAAO,EAAC,qBAAqB,EAAC,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAC,sBAAsB,EAAC,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAC,iBAAiB,EAAC,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAC,cAAc,EAAC,MAAM,cAAc,CAAC;AA+B5C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,yBAAyB,CACvC,WAA4B,EAC5B,iBAA+B,gBAAgB;IAE/C,MAAM,SAAS,GAAiB,EAAE,CAAC;IACnC,MAAM,WAAW,GAA2C,EAAE,CAAC;IAE/D,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,oBAAoB;gBACvB,IAAI,WAAW,CAAC,QAAQ,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;oBACrD,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACzB,CAAC;qBAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;oBACjC,WAAW,CAAC,IAAI,CAAC,EAAC,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAC,CAAC,CAAC;gBAC7D,CAAC;qBAAM,CAAC;oBACN,WAAW,CAAC,IAAI,CAAC,EAAC,MAAM,EAAE,MAAM,EAAE,0BAA0B,EAAC,CAAC,CAAC;gBACjE,CAAC;gBACD,MAAM;YAER,KAAK,MAAM,CAAC;YACZ,KAAK,UAAU;gBACb,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;oBACzB,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACzB,CAAC;qBAAM,CAAC;oBACN,WAAW,CAAC,IAAI,CAAC,EAAC,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAC,CAAC,CAAC;gBAC7D,CAAC;gBACD,MAAM;YAER,KAAK,OAAO;gBACV,IAAI,WAAW,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;oBACjD,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACzB,CAAC;qBAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;oBACjC,WAAW,CAAC,IAAI,CAAC,EAAC,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAC,CAAC,CAAC;gBAC7D,CAAC;qBAAM,CAAC;oBACN,WAAW,CAAC,IAAI,CAAC,EAAC,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAC,CAAC,CAAC;gBAC7D,CAAC;gBACD,MAAM;YAER,KAAK,SAAS;gBACZ,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;oBACvB,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACzB,CAAC;qBAAM,CAAC;oBACN,WAAW,CAAC,IAAI,CAAC,EAAC,MAAM,EAAE,MAAM,EAAE,oBAAoB,EAAC,CAAC,CAAC;gBAC3D,CAAC;gBACD,MAAM;QACV,CAAC;IACH,CAAC;IAED,OAAO,EAAC,SAAS,EAAE,WAAW,EAAC,CAAC;AAClC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAA4B,EAC5B,UAAsC,EAAE;IAExC,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,gBAAgB,CAAC;IAElE,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,oBAAoB;gBACvB,IAAI,WAAW,CAAC,QAAQ,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;oBACrD,OAAO,IAAI,aAAa,CAAC;wBACvB,QAAQ,EAAE,WAAW,CAAC,QAAQ;wBAC9B,YAAY,EAAE,WAAW,CAAC,YAAY;wBACtC,MAAM,EAAE,WAAW,CAAC,MAAM;wBAC1B,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;qBACnD,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM;YAER,KAAK,MAAM;gBACT,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;oBACzB,oEAAoE;oBACpE,qEAAqE;oBACrE,OAAO,sBAAsB,CAAC;wBAC5B,QAAQ,EAAE,WAAW,CAAC,QAAQ;wBAC9B,MAAM,EAAE,WAAW,CAAC,MAAM;wBAC1B,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;wBAClD,WAAW,EAAE,WAAW,CAAC,WAAW;wBACpC,WAAW,EAAE,WAAW,CAAC,WAAW;qBACrC,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM;YAER,KAAK,UAAU;gBACb,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;oBACzB,OAAO,IAAI,qBAAqB,CAAC;wBAC/B,QAAQ,EAAE,WAAW,CAAC,QAAQ;wBAC9B,MAAM,EAAE,WAAW,CAAC,MAAM;wBAC1B,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;wBAClD,WAAW,EAAE,WAAW,CAAC,WAAW;wBACpC,WAAW,EAAE,WAAW,CAAC,WAAW;qBACrC,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM;YAER,KAAK,OAAO;gBACV,IAAI,WAAW,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;oBACjD,OAAO,IAAI,iBAAiB,CAAC,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;gBAC3E,CAAC;gBACD,MAAM;YAER,KAAK,SAAS;gBACZ,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;oBACvB,OAAO,IAAI,cAAc,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,gBAAgB,CAAC,CAAC;gBAC9E,CAAC;gBACD,MAAM;QACV,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,MAAM,EAAC,WAAW,EAAC,GAAG,yBAAyB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE9E,MAAM,IAAI,KAAK,CACb,qDAAqD,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;QACjF,wBAAwB,OAAO,EAAE,CACpC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../../src/auth/resolve.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAC,gBAAgB,EAAC,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAC,aAAa,EAAC,MAAM,YAAY,CAAC;AACzC,OAAO,EAAC,gBAAgB,EAAC,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAC,qBAAqB,EAAC,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAC,sBAAsB,EAAC,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAC,iBAAiB,EAAC,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAC,cAAc,EAAC,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAC,4BAA4B,EAAC,MAAM,gBAAgB,CAAC;AA+B5D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,yBAAyB,CACvC,WAA4B,EAC5B,iBAA+B,gBAAgB;IAE/C,MAAM,SAAS,GAAiB,EAAE,CAAC;IACnC,MAAM,WAAW,GAA2C,EAAE,CAAC;IAE/D,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,oBAAoB;gBACvB,IAAI,WAAW,CAAC,QAAQ,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;oBACrD,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACzB,CAAC;qBAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;oBACjC,WAAW,CAAC,IAAI,CAAC,EAAC,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAC,CAAC,CAAC;gBAC7D,CAAC;qBAAM,CAAC;oBACN,WAAW,CAAC,IAAI,CAAC,EAAC,MAAM,EAAE,MAAM,EAAE,0BAA0B,EAAC,CAAC,CAAC;gBACjE,CAAC;gBACD,MAAM;YAER,KAAK,MAAM,CAAC;YACZ,KAAK,UAAU;gBACb,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;oBACzB,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACzB,CAAC;qBAAM,CAAC;oBACN,WAAW,CAAC,IAAI,CAAC,EAAC,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAC,CAAC,CAAC;gBAC7D,CAAC;gBACD,MAAM;YAER,KAAK,OAAO;gBACV,IAAI,WAAW,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;oBACjD,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACzB,CAAC;qBAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;oBACjC,WAAW,CAAC,IAAI,CAAC,EAAC,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAC,CAAC,CAAC;gBAC7D,CAAC;qBAAM,CAAC;oBACN,WAAW,CAAC,IAAI,CAAC,EAAC,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAC,CAAC,CAAC;gBAC7D,CAAC;gBACD,MAAM;YAER,KAAK,SAAS;gBACZ,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;oBACvB,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACzB,CAAC;qBAAM,CAAC;oBACN,WAAW,CAAC,IAAI,CAAC,EAAC,MAAM,EAAE,MAAM,EAAE,oBAAoB,EAAC,CAAC,CAAC;gBAC3D,CAAC;gBACD,MAAM;QACV,CAAC;IACH,CAAC;IAED,OAAO,EAAC,SAAS,EAAE,WAAW,EAAC,CAAC;AAClC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAA4B,EAC5B,UAAsC,EAAE;IAExC,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,gBAAgB,CAAC;IAElE,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,oBAAoB;gBACvB,IAAI,WAAW,CAAC,QAAQ,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;oBACrD,OAAO,IAAI,aAAa,CAAC;wBACvB,QAAQ,EAAE,WAAW,CAAC,QAAQ;wBAC9B,YAAY,EAAE,WAAW,CAAC,YAAY;wBACtC,MAAM,EAAE,WAAW,CAAC,MAAM;wBAC1B,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;qBACnD,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM;YAER,KAAK,MAAM;gBACT,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;oBACzB,oEAAoE;oBACpE,qEAAqE;oBACrE,OAAO,sBAAsB,CAAC;wBAC5B,QAAQ,EAAE,WAAW,CAAC,QAAQ;wBAC9B,MAAM,EAAE,WAAW,CAAC,MAAM;wBAC1B,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;wBAClD,WAAW,EAAE,WAAW,CAAC,WAAW;wBACpC,WAAW,EAAE,WAAW,CAAC,WAAW;qBACrC,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM;YAER,KAAK,UAAU;gBACb,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;oBACzB,OAAO,IAAI,qBAAqB,CAAC;wBAC/B,QAAQ,EAAE,WAAW,CAAC,QAAQ;wBAC9B,MAAM,EAAE,WAAW,CAAC,MAAM;wBAC1B,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;wBAClD,WAAW,EAAE,WAAW,CAAC,WAAW;wBACpC,WAAW,EAAE,WAAW,CAAC,WAAW;qBACrC,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM;YAER,KAAK,OAAO;gBACV,IAAI,WAAW,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;oBACjD,OAAO,IAAI,iBAAiB,CAAC,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;gBAC3E,CAAC;gBACD,MAAM;YAER,KAAK,SAAS;gBACZ,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;oBACvB,OAAO,IAAI,cAAc,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,gBAAgB,CAAC,CAAC;gBAC9E,CAAC;gBACD,MAAM;QACV,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,MAAM,EAAC,WAAW,EAAC,GAAG,yBAAyB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE9E,MAAM,IAAI,KAAK,CACb,qDAAqD,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;QACjF,wBAAwB,OAAO,EAAE,CACpC,CAAC;AACJ,CAAC;AAkBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,0BAA0B,CACxC,WAAmC,EACnC,UAAwB,CAAC,oBAAoB,EAAE,KAAK,CAAC;IAErD,MAAM,EAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAC,GAAG,WAAW,CAAC;IAC7F,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,yEAAyE;IACzE,kEAAkE;IAClE,MAAM,kBAAkB,GAAG,WAAW,CAAC,kBAAkB,IAAI,4BAA4B,CAAC;IAE1F,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,KAAK,oBAAoB,IAAI,YAAY,EAAE,CAAC;YACpD,OAAO,IAAI,aAAa,CAAC,EAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,kBAAkB,EAAC,CAAC,CAAC;QACjF,CAAC;QAED,IAAI,MAAM,KAAK,KAAK,IAAI,WAAW,IAAI,UAAU,EAAE,CAAC;YAClD,OAAO,IAAI,gBAAgB,CAAC;gBAC1B,QAAQ;gBACR,QAAQ,EAAE,WAAW;gBACrB,OAAO,EAAE,UAAU;gBACnB,UAAU,EAAE,aAAa;gBACzB,kBAAkB;gBAClB,MAAM;aACP,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/esm/auth/types.d.ts

@@ -22,6 +22,42 @@ export interface AuthStrategy {
      * Used by middleware to retry requests after receiving a 401 response.
      */
     invalidateToken?(): void;
+    /**
+     * Optional: Returns a copy of this strategy with the given scopes merged into
+     * its requested scope set. SCAPI client factories use this to ensure the
+     * tenant scope is present on every token request.
+     *
+     * Implemented by `OAuthStrategy` and `JwtOAuthStrategy`. Strategies that
+     * obtain tokens by other means (basic, api-key, implicit-via-stored-session)
+     * may not implement this; callers should treat them as "scopes already
+     * established at construction time."
+     */
+    withAdditionalScopes?(additionalScopes: string[]): AuthStrategy;
+    /**
+     * Optional: Resolves a scope cascade by trying each candidate scope set
+     * in order and returning the first that AM accepts.
+     *
+     * Implementations should:
+     *   1. Return any cached token whose scopes ⊇ a candidate (no AM call).
+     *   2. Otherwise, call AM with each candidate in order until one survives;
+     *      cache the result keyed by what was requested.
+     *   3. Throw the last `invalid_scope` error if all candidates fail.
+     *
+     * Implementations MUST add any base scopes (e.g. tenant scope baked in
+     * via {@link withAdditionalScopes}) to each candidate before sending it
+     * to AM.
+     *
+     * Used by the SCAPI auth middleware to pick the right scope tier (rw vs
+     * ro) per operation. Strategies without OAuth-style scope grants (basic,
+     * api-key) should leave this unset; the middleware falls through to
+     * {@link getAuthorizationHeader} in that case.
+     *
+     * @param candidates - Outer array is cascade order; inner arrays are the
+     *   scopes for each token request attempt. e.g.
+     *   `[['sfcc.jobs.rw'], ['sfcc.jobs']]`.
+     * @returns The access token (Bearer value, no `Bearer ` prefix).
+     */
+    getAccessTokenForCascade?(candidates: string[][]): Promise<string>;
 }
 /**
  * An interactive, token-bearing OAuth strategy — the "user" auth flow
@@ -33,6 +69,8 @@ export interface AuthStrategy {
  * `PkceWithImplicitFallbackStrategy`.
  */
 export interface UserAuthStrategy extends AuthStrategy {
+    /** Browser auth method represented by this strategy. */
+    readonly authMethod: 'user' | 'implicit';
     getAuthorizationHeader(): Promise<string>;
     getJWT(): Promise<DecodedJWT>;
     getTokenResponse(): Promise<AccessTokenResponse>;
@@ -55,6 +93,12 @@ export interface OAuthAuthConfig {
     clientSecret?: string;
     scopes?: string[];
     accountManagerHost?: string;
+    /** Path to JWT certificate file (cert.pem) for the JWT Bearer flow */
+    jwtCertPath?: string;
+    /** Path to JWT private key file (key.pem) for the JWT Bearer flow */
+    jwtKeyPath?: string;
+    /** Optional passphrase for an encrypted JWT private key */
+    jwtPassphrase?: string;
     /** Override redirect URI for browser OAuth flows (e.g., for port forwarding in remote environments) */
     redirectUri?: string;
     /** Custom browser opener for browser OAuth flows. Receives the authorization URL. */

package/dist/esm/auth/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAiIH,2DAA2D;AAC3D,MAAM,CAAC,MAAM,gBAAgB,GAAiB,CAAC,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA+KH,2DAA2D;AAC3D,MAAM,CAAC,MAAM,gBAAgB,GAAiB,CAAC,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC"}

package/dist/esm/cli/base-command.d.ts

@@ -36,6 +36,15 @@ export type ErrorCategory = 'guardrail' | 'runtime' | 'validation';
  * 3. Everything else is a genuine `runtime` error (the reliability signal).
  */
 export declare function classifyError(err: unknown): ErrorCategory;
+/**
+ * oclif throws `Flag --<name> can only be specified once` when a non-multiple
+ * flag is passed more than once — including when the duplicate arrived through
+ * an alias (e.g. `-p my-store -s other`, where `-s` / `--storefront` are aliases
+ * of `--project`). The bare message names only the canonical flag, so a user who
+ * typed an alias can't tell what collided. When the offending flag has aliases,
+ * rewrite the message to list every long and short form it accepts.
+ */
+export declare function augmentDuplicateFlagError(message: string, flags: Record<string, unknown>): string;
 /**
  * Base command class for B2C CLI tools.
  *

package/dist/esm/cli/base-command.js

@@ -18,6 +18,7 @@ import { globalMiddlewareRegistry } from '../clients/middleware-registry.js';
 import { globalAuthMiddlewareRegistry } from '../auth/middleware.js';
 import { initializeFileAuthSessionStore } from '../auth/session-store.js';
 import { initializeContentCache } from '../docs/content-cache.js';
+import { initializeScapiSnippetStore } from '../scapi/snippets.js';
 import { setUserAgent } from '../clients/user-agent.js';
 import { createTelemetry, Telemetry } from '../telemetry/index.js';
 const LOG_LEVELS = ['trace', 'debug', 'info', 'warn', 'error', 'silent'];
@@ -61,6 +62,31 @@ export function classifyError(err) {
         return 'guardrail';
     return 'runtime';
 }
+/**
+ * oclif throws `Flag --<name> can only be specified once` when a non-multiple
+ * flag is passed more than once — including when the duplicate arrived through
+ * an alias (e.g. `-p my-store -s other`, where `-s` / `--storefront` are aliases
+ * of `--project`). The bare message names only the canonical flag, so a user who
+ * typed an alias can't tell what collided. When the offending flag has aliases,
+ * rewrite the message to list every long and short form it accepts.
+ */
+export function augmentDuplicateFlagError(message, flags) {
+    const match = /^Flag --(.+) can only be specified once$/.exec(message);
+    if (!match)
+        return message;
+    const flag = flags[match[1]];
+    if (!flag)
+        return message;
+    // Only clarify when the flag actually has aliases; a plain --name/-n pair
+    // needs no explanation.
+    if (!flag.aliases?.length && !flag.charAliases?.length)
+        return message;
+    const forms = [
+        ...[match[1], ...(flag.aliases ?? [])].map((name) => `--${name}`),
+        ...[flag.char, ...(flag.charAliases ?? [])].filter((c) => Boolean(c)).map((c) => `-${c}`),
+    ];
+    return `${message} (${forms.join(', ')} all refer to the same flag)`;
+}
 /**
  * Base command class for B2C CLI tools.
  *
@@ -174,6 +200,7 @@ export class BaseCommand extends Command {
         // Tests may override the path via B2C_TEST_DATA_DIR to isolate the auth-sessions.json
         // file (e.g. per mocha worker) so they don't race on the developer's real session file.
         initializeFileAuthSessionStore(process.env.B2C_TEST_DATA_DIR ?? this.config.dataDir);
+        initializeScapiSnippetStore(process.env.B2C_TEST_DATA_DIR ?? this.config.dataDir);
         // Point the docs online-content cache at oclif's cacheDir (e.g. ~/.cache/b2c)
         // so cached docs live alongside other CLI cache data and honor oclif dir
         // overrides. Standalone SDK use falls back to an OS-idiomatic path.
@@ -536,6 +563,10 @@ export class BaseCommand extends Command {
      * Sends exception to telemetry if initialized.
      */
     async catch(err) {
+        // Surface flag aliases in oclif's "can only be specified once" error so a
+        // user who passed, e.g., `-p x -s y` learns that `-s`/`--storefront` are the
+        // same flag as `-p`/`--project`.
+        err.message = augmentDuplicateFlagError(err.message, { ...this.ctor.baseFlags, ...this.ctor.flags });
         const exitCode = err.exitCode ?? 1;
         const duration = this.commandStartTime ? Date.now() - this.commandStartTime : undefined;
         const errorCategory = classifyError(err);