@salesforce/b2c-tooling-sdk 1.9.0 → 1.11.0

package/dist/cjs/auth/stateful-oauth-strategy.js

@@ -1,130 +0,0 @@
-import { getLogger } from '../logging/logger.js';
-import { decodeJWT } from './oauth.js';
-import { decodeJwtTokenInfo } from './jwt-utils.js';
-import { DEFAULT_ACCOUNT_MANAGER_HOST } from '../defaults.js';
-import { getStoredSession, setStoredSession, clearStoredSession } from './stateful-store.js';
-import { globalAuthMiddlewareRegistry, applyAuthRequestMiddleware, applyAuthResponseMiddleware } from './middleware.js';
-/**
- * Auth strategy that uses the stateful store (sfcc-ci compatible).
- * On 401, attempts to refresh using stored refresh_token or client_credentials (renew base);
- * on refresh failure clears the stored session.
- */
-export class StatefulOAuthStrategy {
-    accountManagerHost;
-    scopes;
-    _session;
-    _hasHadSuccess = false;
-    constructor(session, options) {
-        this._session = session;
-        this.accountManagerHost = options.accountManagerHost || DEFAULT_ACCOUNT_MANAGER_HOST;
-        this.scopes = options.scopes ?? [];
-    }
-    async fetch(url, init = {}) {
-        const logger = getLogger();
-        const token = await this.getAccessToken();
-        const headers = new Headers(init.headers);
-        headers.set('Authorization', `Bearer ${token}`);
-        headers.set('x-dw-client-id', this._session.clientId);
-        let res = await fetch(url, { ...init, headers });
-        if (res.status !== 401) {
-            this._hasHadSuccess = true;
-        }
-        if (res.status === 401 && this._hasHadSuccess) {
-            logger.debug('[StatefulAuth] 401 received, attempting refresh');
-            const refreshed = await this.tryRefresh();
-            if (refreshed) {
-                const newToken = await this.getAccessToken();
-                headers.set('Authorization', `Bearer ${newToken}`);
-                res = await fetch(url, { ...init, headers });
-            }
-        }
-        return res;
-    }
-    async getAuthorizationHeader() {
-        const token = await this.getAccessToken();
-        return `Bearer ${token}`;
-    }
-    /**
-     * Returns the current token as AccessTokenResponse (expires/scopes from JWT).
-     */
-    async getTokenResponse() {
-        const token = await this.getAccessToken();
-        const { expires, scopes } = decodeJwtTokenInfo(token);
-        return { accessToken: token, expires, scopes };
-    }
-    async getJWT() {
-        const token = await this.getAccessToken();
-        return decodeJWT(token);
-    }
-    invalidateToken() {
-        clearStoredSession();
-        this._session = { ...this._session, accessToken: '' };
-    }
-    async getAccessToken() {
-        const session = getStoredSession();
-        if (session?.accessToken) {
-            this._session = session;
-            return session.accessToken;
-        }
-        throw new Error('Stateful session lost; please run auth:login or configure client credentials.');
-    }
-    /**
-     * Attempts to refresh the access token using stored refresh_token or client_credentials (renew base).
-     * Requires SFCC_CLIENT_RENEW_BASE (client:secret) for both flows; updates store on success.
-     */
-    async tryRefresh() {
-        const logger = getLogger();
-        const session = getStoredSession();
-        if (!session?.renewBase) {
-            logger.debug('[StatefulAuth] No renew credentials (SFCC_CLIENT_RENEW_BASE); cannot refresh');
-            clearStoredSession();
-            return false;
-        }
-        const url = `https://${this.accountManagerHost}/dwsso/oauth2/access_token`;
-        const grantPayload = session.refreshToken != null && session.refreshToken !== ''
-            ? { grant_type: 'refresh_token', refresh_token: session.refreshToken }
-            : { grant_type: 'client_credentials' };
-        if (this.scopes.length > 0) {
-            grantPayload.scope = this.scopes.join(' ');
-        }
-        const body = new URLSearchParams(grantPayload).toString();
-        let request = new Request(url, {
-            method: 'POST',
-            headers: {
-                Authorization: `Basic ${session.renewBase}`,
-                'Content-Type': 'application/x-www-form-urlencoded',
-            },
-            body,
-        });
-        const middleware = globalAuthMiddlewareRegistry.getMiddleware();
-        request = await applyAuthRequestMiddleware(request, middleware);
-        let response;
-        try {
-            response = await fetch(request);
-            response = await applyAuthResponseMiddleware(request, response, middleware);
-        }
-        catch (err) {
-            logger.debug({ err }, '[StatefulAuth] Refresh request failed');
-            clearStoredSession();
-            return false;
-        }
-        if (!response.ok) {
-            const text = await response.text();
-            logger.debug({ status: response.status, body: text }, '[StatefulAuth] Refresh failed');
-            clearStoredSession();
-            return false;
-        }
-        const data = (await response.json());
-        setStoredSession({
-            clientId: session.clientId,
-            accessToken: data.access_token,
-            refreshToken: data.refresh_token ?? session.refreshToken ?? null,
-            renewBase: session.renewBase ?? null,
-            user: session.user ?? null,
-        });
-        this._session = getStoredSession();
-        logger.debug('[StatefulAuth] Token refreshed successfully');
-        return true;
-    }
-}
-//# sourceMappingURL=stateful-oauth-strategy.js.map

package/dist/cjs/auth/stateful-oauth-strategy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"stateful-oauth-strategy.js","sourceRoot":"","sources":["../../../src/auth/stateful-oauth-strategy.ts"],"names":[],"mappings":"AAaA,OAAO,EAAC,SAAS,EAAC,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAC,SAAS,EAAC,MAAM,YAAY,CAAC;AACrC,OAAO,EAAC,kBAAkB,EAAC,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAC,4BAA4B,EAAC,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAC,gBAAgB,EAAE,gBAAgB,EAAE,kBAAkB,EAAuB,MAAM,qBAAqB,CAAC;AACjH,OAAO,EAAC,4BAA4B,EAAE,0BAA0B,EAAE,2BAA2B,EAAC,MAAM,iBAAiB,CAAC;AAOtH;;;;GAIG;AACH,MAAM,OAAO,qBAAqB;IACxB,kBAAkB,CAAS;IAC3B,MAAM,CAAW;IACjB,QAAQ,CAAkB;IAC1B,cAAc,GAAG,KAAK,CAAC;IAE/B,YAAY,OAAwB,EAAE,OAAqC;QACzE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,4BAA4B,CAAC;QACrF,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,OAAkB,EAAE;QAC3C,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAE1C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEtD,IAAI,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAC,GAAG,IAAI,EAAE,OAAO,EAAgB,CAAC,CAAC;QAE9D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC7B,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC9C,MAAM,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;YAChE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YAC1C,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;gBAC7C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,QAAQ,EAAE,CAAC,CAAC;gBACnD,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAC,GAAG,IAAI,EAAE,OAAO,EAAgB,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,sBAAsB;QAC1B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,OAAO,UAAU,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB;QACpB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,EAAC,OAAO,EAAE,MAAM,EAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACpD,OAAO,EAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,eAAe;QACb,kBAAkB,EAAE,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,EAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAC,CAAC;IACtD,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;QACnC,IAAI,OAAO,EAAE,WAAW,EAAE,CAAC;YACzB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;YACxB,OAAO,OAAO,CAAC,WAAW,CAAC;QAC7B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;IACnG,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,UAAU;QACtB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;QACnC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC;YACxB,MAAM,CAAC,KAAK,CAAC,8EAA8E,CAAC,CAAC;YAC7F,kBAAkB,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,GAAG,GAAG,WAAW,IAAI,CAAC,kBAAkB,4BAA4B,CAAC;QAC3E,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY,IAAI,IAAI,IAAI,OAAO,CAAC,YAAY,KAAK,EAAE;YACzD,CAAC,CAAC,EAAC,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,OAAO,CAAC,YAAY,EAAC;YACpE,CAAC,CAAC,EAAC,UAAU,EAAE,oBAAoB,EAAC,CAAC;QACzC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,YAAY,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC1D,IAAI,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;YAC7B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,SAAS,OAAO,CAAC,SAAS,EAAE;gBAC3C,cAAc,EAAE,mCAAmC;aACpD;YACD,IAAI;SACL,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,4BAA4B,CAAC,aAAa,EAAE,CAAC;QAChE,OAAO,GAAG,MAAM,0BAA0B,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAEhE,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;YAChC,QAAQ,GAAG,MAAM,2BAA2B,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,EAAC,GAAG,EAAC,EAAE,uCAAuC,CAAC,CAAC;YAC7D,kBAAkB,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,CAAC,KAAK,CAAC,EAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAC,EAAE,+BAA+B,CAAC,CAAC;YACrF,kBAAkB,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAKlC,CAAC;QAEF,gBAAgB,CAAC;YACf,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa,IAAI,OAAO,CAAC,YAAY,IAAI,IAAI;YAChE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;YACpC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,GAAG,gBAAgB,EAAG,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/cjs/auth/stateful-store.d.ts

@@ -1,49 +0,0 @@
-/**
- * Initialize the stateful store with the oclif data directory.
- * Call this from BaseCommand.init() with this.config.dataDir so the session
- * file is stored alongside other CLI data (e.g. ~/Library/Application Support/@salesforce/b2c-cli).
- */
-export declare function initializeStatefulStore(dataDir: string): void;
-/**
- * Stored session persisted by stateful auth commands.
- */
-export interface StatefulSession {
-    clientId: string;
-    accessToken: string;
-    refreshToken?: string | null;
-    /** Base64-encoded "clientId:clientSecret" for token renewal. */
-    renewBase?: string | null;
-    user?: string | null;
-}
-/**
- * Reads the current stateful session from the JSON file.
- * Returns null if no session file exists or the file is invalid.
- */
-export declare function getStoredSession(): StatefulSession | null;
-/**
- * Writes a session to the JSON file, creating the directory if needed.
- */
-export declare function setStoredSession(session: StatefulSession): void;
-/**
- * Clears the stored session by removing the session file.
- */
-export declare function clearStoredSession(): void;
-/**
- * Checks whether the stored access token is present and valid: not expired
- * (with a small buffer), optionally satisfies required scopes, and optionally
- * matches the expected client ID.
- * Does not perform network calls.
- *
- * @param session - Session from getStoredSession()
- * @param requiredScopes - If provided, token must include all of these scopes
- * @param expiryBufferSec - Seconds before exp to treat token as expired (default 60)
- * @param requiredClientId - If provided, session clientId must match
- * @returns true if token is present and valid for use
- */
-export declare function isStatefulTokenValid(session: StatefulSession, requiredScopes?: string[], expiryBufferSec?: number, requiredClientId?: string): boolean;
-/**
- * Resets the store path (for tests). After calling this, the next operation
- * will use the default data directory unless initializeStatefulStore() is called again.
- * @internal
- */
-export declare function resetStatefulStoreForTesting(): void;

package/dist/cjs/auth/stateful-store.js

@@ -1,166 +0,0 @@
-/*
- * Copyright (c) 2025, Salesforce, Inc.
- * SPDX-License-Identifier: Apache-2
- * For full license text, see the license.txt file in the repo root or http://www.apache.org/licenses/LICENSE-2.0
- */
-/**
- * Stateful auth store backed by a JSON file in the oclif data directory
- * (e.g. ~/Library/Application Support/@salesforce/b2c-cli/auth-session.json on macOS).
- *
- * Initialize via initializeStatefulStore(dataDir) from BaseCommand.init() so the
- * session file is co-located with other CLI data. Falls back to an OS-appropriate
- * default path when used standalone (outside a CLI command).
- *
- * The stateful auth workflow (b2c auth client / b2c auth login / b2c auth logout)
- * is compatible with sfcc-ci command patterns. Session data is stored internally
- * in the CLI data directory, not in the sfcc-ci config store.
- *
- * @module auth/stateful-store
- */
-import { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { homedir, platform } from 'node:os';
-import { DEFAULT_EXPIRY_BUFFER_SEC, decodeJwtTokenInfo } from './jwt-utils.js';
-import { getLogger } from '../logging/logger.js';
-const STATEFUL_AUTH_SESSION_STORE = 'auth-session.json';
-let storePath = null;
-/**
- * Computes the oclif-compatible data directory for @salesforce/b2c-cli.
- * Used as a fallback when initializeStatefulStore() has not been called.
- */
-function getDefaultDataDir() {
-    const home = homedir();
-    const name = '@salesforce/b2c-cli';
-    switch (platform()) {
-        case 'darwin':
-            return join(home, 'Library', 'Application Support', name);
-        case 'win32':
-            return join(process.env.LOCALAPPDATA ?? join(home, 'AppData', 'Local'), name);
-        default:
-            return join(process.env.XDG_DATA_HOME ?? join(home, '.local', 'share'), name);
-    }
-}
-function getSessionFilePath() {
-    return join(storePath ?? getDefaultDataDir(), STATEFUL_AUTH_SESSION_STORE);
-}
-/**
- * Initialize the stateful store with the oclif data directory.
- * Call this from BaseCommand.init() with this.config.dataDir so the session
- * file is stored alongside other CLI data (e.g. ~/Library/Application Support/@salesforce/b2c-cli).
- */
-export function initializeStatefulStore(dataDir) {
-    storePath = dataDir;
-}
-/**
- * Reads the current stateful session from the JSON file.
- * Returns null if no session file exists or the file is invalid.
- */
-export function getStoredSession() {
-    const filePath = getSessionFilePath();
-    if (!existsSync(filePath)) {
-        return null;
-    }
-    try {
-        const data = JSON.parse(readFileSync(filePath, 'utf8'));
-        if (!data.clientId || !data.accessToken) {
-            return null;
-        }
-        return {
-            clientId: data.clientId,
-            accessToken: data.accessToken,
-            refreshToken: data.refreshToken ?? null,
-            renewBase: data.renewBase ?? null,
-            user: data.user ?? null,
-        };
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Writes a session to the JSON file, creating the directory if needed.
- */
-export function setStoredSession(session) {
-    const filePath = getSessionFilePath();
-    const dir = join(filePath, '..');
-    if (!existsSync(dir)) {
-        mkdirSync(dir, { recursive: true });
-    }
-    const data = {
-        clientId: session.clientId,
-        accessToken: session.accessToken,
-        refreshToken: session.refreshToken ?? null,
-        renewBase: session.renewBase ?? null,
-        user: session.user ?? null,
-    };
-    // Atomic write: write to temp file then rename so a concurrent reader (or a
-    // crashed writer) never observes a partially written JSON document.
-    const tmpPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
-    writeFileSync(tmpPath, JSON.stringify(data, null, 2), 'utf8');
-    renameSync(tmpPath, filePath);
-}
-/**
- * Clears the stored session by removing the session file.
- */
-export function clearStoredSession() {
-    const filePath = getSessionFilePath();
-    if (existsSync(filePath)) {
-        try {
-            unlinkSync(filePath);
-        }
-        catch (err) {
-            getLogger().debug({ err, filePath }, '[StatefulAuth] Failed to remove session file');
-        }
-    }
-}
-/**
- * Checks whether the stored access token is present and valid: not expired
- * (with a small buffer), optionally satisfies required scopes, and optionally
- * matches the expected client ID.
- * Does not perform network calls.
- *
- * @param session - Session from getStoredSession()
- * @param requiredScopes - If provided, token must include all of these scopes
- * @param expiryBufferSec - Seconds before exp to treat token as expired (default 60)
- * @param requiredClientId - If provided, session clientId must match
- * @returns true if token is present and valid for use
- */
-export function isStatefulTokenValid(session, requiredScopes = [], expiryBufferSec = DEFAULT_EXPIRY_BUFFER_SEC, requiredClientId) {
-    const logger = getLogger();
-    if (requiredClientId && session.clientId !== requiredClientId) {
-        logger.debug({ storedClientId: session.clientId, requiredClientId }, '[StatefulAuth] Token client ID mismatch');
-        return false;
-    }
-    let info;
-    try {
-        info = decodeJwtTokenInfo(session.accessToken);
-    }
-    catch (error) {
-        logger.debug({ err: error }, '[StatefulAuth] Token invalid (e.g. not a JWT)');
-        return false;
-    }
-    if (info.expires.getTime() === 0) {
-        logger.debug('[StatefulAuth] Token has no exp claim; treating as invalid');
-        return false;
-    }
-    const nowSec = Math.floor(Date.now() / 1000);
-    const expSec = Math.floor(info.expires.getTime() / 1000);
-    if (nowSec >= expSec - expiryBufferSec) {
-        logger.debug('[StatefulAuth] Token missing or expired');
-        return false;
-    }
-    if (requiredScopes.length > 0 && !requiredScopes.every((s) => info.scopes.includes(s))) {
-        logger.debug({ requiredScopes, tokenScopes: info.scopes }, '[StatefulAuth] Token missing required scopes');
-        return false;
-    }
-    return true;
-}
-/**
- * Resets the store path (for tests). After calling this, the next operation
- * will use the default data directory unless initializeStatefulStore() is called again.
- * @internal
- */
-export function resetStatefulStoreForTesting() {
-    storePath = null;
-}
-//# sourceMappingURL=stateful-store.js.map

package/dist/cjs/auth/stateful-store.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"stateful-store.js","sourceRoot":"","sources":["../../../src/auth/stateful-store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAC,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAC,MAAM,SAAS,CAAC;AACnG,OAAO,EAAC,IAAI,EAAC,MAAM,WAAW,CAAC;AAC/B,OAAO,EAAC,OAAO,EAAE,QAAQ,EAAC,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAC,yBAAyB,EAAE,kBAAkB,EAAC,MAAM,gBAAgB,CAAC;AAC7E,OAAO,EAAC,SAAS,EAAC,MAAM,sBAAsB,CAAC;AAE/C,MAAM,2BAA2B,GAAG,mBAAmB,CAAC;AAExD,IAAI,SAAS,GAAkB,IAAI,CAAC;AAEpC;;;GAGG;AACH,SAAS,iBAAiB;IACxB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,qBAAqB,CAAC;IACnC,QAAQ,QAAQ,EAAE,EAAE,CAAC;QACnB,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,IAAI,CAAC,CAAC;QAC5D,KAAK,OAAO;YACV,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;QAChF;YACE,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,IAAI,CAAC,SAAS,IAAI,iBAAiB,EAAE,EAAE,2BAA2B,CAAC,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,SAAS,GAAG,OAAO,CAAC;AACtB,CAAC;AAcD;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IACtC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAA6B,CAAC;QACpF,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI;YACvC,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;YACjC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI;SACxB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAwB;IACvD,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,EAAC,SAAS,EAAE,IAAI,EAAC,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,IAAI,GAAoB;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;QAC1C,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;QACpC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;KAC3B,CAAC;IACF,4EAA4E;IAC5E,oEAAoE;IACpE,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;IAC/D,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9D,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IACtC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,EAAE,CAAC,KAAK,CAAC,EAAC,GAAG,EAAE,QAAQ,EAAC,EAAE,8CAA8C,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAwB,EACxB,iBAA2B,EAAE,EAC7B,kBAA0B,yBAAyB,EACnD,gBAAyB;IAEzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,gBAAgB,IAAI,OAAO,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QAC9D,MAAM,CAAC,KAAK,CAAC,EAAC,cAAc,EAAE,OAAO,CAAC,QAAQ,EAAE,gBAAgB,EAAC,EAAE,yCAAyC,CAAC,CAAC;QAC9G,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAuC,CAAC;IAC5C,IAAI,CAAC;QACH,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,EAAC,GAAG,EAAE,KAAK,EAAC,EAAE,+CAA+C,CAAC,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAC3E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACzD,IAAI,MAAM,IAAI,MAAM,GAAG,eAAe,EAAE,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACxD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,MAAM,CAAC,KAAK,CAAC,EAAC,cAAc,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,EAAC,EAAE,8CAA8C,CAAC,CAAC;QACzG,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B;IAC1C,SAAS,GAAG,IAAI,CAAC;AACnB,CAAC"}

package/dist/cjs/auth/types.d.ts

@@ -1,124 +0,0 @@
-/**
- * Extended RequestInit that supports undici dispatcher for TLS/mTLS.
- * Uses `unknown` for dispatcher to avoid type conflicts between undici package
- * and @types/node/undici-types.
- */
-export type FetchInit = Omit<RequestInit, 'dispatcher'> & {
-    /** undici dispatcher for custom TLS options (mTLS, self-signed certs) */
-    dispatcher?: unknown;
-};
-export interface AuthStrategy {
-    /**
-     * Performs a fetch request with authentication.
-     * Implementations MUST handle header injection and 401 retries (token refresh) internally.
-     */
-    fetch(url: string, init?: FetchInit): Promise<Response>;
-    /**
-     * Optional: Helper for legacy clients (like a strict WebDAV lib) that need the raw header.
-     */
-    getAuthorizationHeader?(): Promise<string>;
-    /**
-     * Optional: Invalidates the cached token, forcing re-authentication on next request.
-     * Used by middleware to retry requests after receiving a 401 response.
-     */
-    invalidateToken?(): void;
-}
-/**
- * Configuration for Basic authentication (username/access-key).
- * Used primarily for WebDAV operations.
- */
-export interface BasicAuthConfig {
-    username: string;
-    password: string;
-}
-/**
- * Configuration for OAuth authentication.
- * Used for OCAPI and platform API operations.
- */
-export interface OAuthAuthConfig {
-    clientId: string;
-    clientSecret?: string;
-    scopes?: string[];
-    accountManagerHost?: string;
-    /** Override redirect URI for implicit OAuth flow (e.g., for port forwarding in remote environments) */
-    redirectUri?: string;
-    /** Custom browser opener for implicit OAuth flow. Receives the authorization URL. */
-    openBrowser?: (url: string) => Promise<void>;
-}
-/**
- * Configuration for API key authentication.
- * Used for MRT and external services.
- */
-export interface ApiKeyAuthConfig {
-    key: string;
-    headerName?: string;
-}
-/**
- * Combined authentication configuration.
- * B2CInstance uses this to determine which auth strategy to use for each operation type.
- */
-export interface AuthConfig {
-    /** Basic auth for WebDAV (username/access-key) */
-    basic?: BasicAuthConfig;
-    /** OAuth credentials for OCAPI/platform APIs */
-    oauth?: OAuthAuthConfig;
-    /** API key for MRT/external services */
-    apiKey?: ApiKeyAuthConfig;
-    /**
-     * Allowed authentication methods in priority order.
-     * If not set, defaults to all methods: ['client-credentials', 'implicit', 'basic', 'api-key']
-     */
-    authMethods?: AuthMethod[];
-}
-/**
- * Access token response structure from Account Manager
- */
-export interface AccessTokenResponse {
-    accessToken: string;
-    expires: Date;
-    scopes: string[];
-}
-/**
- * Decoded JWT structure
- */
-export interface DecodedJWT {
-    header: Record<string, unknown>;
-    payload: Record<string, unknown>;
-}
-/**
- * Available authentication methods.
- * - 'client-credentials': OAuth client credentials flow (requires clientId + clientSecret)
- * - 'jwt': OAuth JWT Bearer flow (requires clientId + JWT certificate/key pair)
- * - 'implicit': Interactive browser-based OAuth (requires clientId only)
- * - 'basic': Username/password (access key) authentication
- * - 'api-key': API key authentication (for MRT, etc.)
- */
-export type AuthMethod = 'client-credentials' | 'jwt' | 'implicit' | 'basic' | 'api-key';
-/** All available auth methods in default priority order */
-export declare const ALL_AUTH_METHODS: AuthMethod[];
-/**
- * Configuration for resolving an auth strategy.
- * Combines all possible credential types.
- */
-export interface AuthCredentials {
-    /** OAuth client ID */
-    clientId?: string;
-    /** OAuth client secret (for client-credentials flow) */
-    clientSecret?: string;
-    /** OAuth scopes to request */
-    scopes?: string[];
-    /** Account Manager host (defaults to account.demandware.com) */
-    accountManagerHost?: string;
-    /** Username for basic auth */
-    username?: string;
-    /** Password/access key for basic auth */
-    password?: string;
-    /** API key for api-key auth */
-    apiKey?: string;
-    /** Header name for API key (defaults to Authorization with Bearer prefix) */
-    apiKeyHeaderName?: string;
-    /** Override redirect URI for implicit OAuth flow (e.g., for port forwarding in remote environments) */
-    redirectUri?: string;
-    /** Custom browser opener for implicit OAuth flow. Receives the authorization URL. */
-    openBrowser?: (url: string) => Promise<void>;
-}

package/dist/cjs/auth/types.js

@@ -1,8 +0,0 @@
-/*
- * Copyright (c) 2025, Salesforce, Inc.
- * SPDX-License-Identifier: Apache-2
- * For full license text, see the license.txt file in the repo root or http://www.apache.org/licenses/LICENSE-2.0
- */
-/** All available auth methods in default priority order */
-export const ALL_AUTH_METHODS = ['client-credentials', 'jwt', 'implicit', 'basic', 'api-key'];
-//# sourceMappingURL=types.js.map

package/dist/cjs/auth/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAgHH,2DAA2D;AAC3D,MAAM,CAAC,MAAM,gBAAgB,GAAiB,CAAC,oBAAoB,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC"}

package/dist/cjs/cli/am-command.d.ts

@@ -1,74 +0,0 @@
-import { Command } from '@oclif/core';
-import { OAuthCommand } from './oauth-command.js';
-import type { AccountManagerClient } from '../clients/am-api.js';
-/**
- * Base command for Account Manager operations.
- *
- * Extends OAuthCommand with Account Manager client setup for users, roles, and organizations.
- * Provides enhanced error messages with role-specific guidance when authentication fails.
- *
- * @example
- * export default class UserList extends AmCommand<typeof UserList> {
- *   async run(): Promise<void> {
- *     const users = await this.accountManagerClient.listUsers({});
- *     // ...
- *   }
- * }
- *
- * @example
- * export default class OrgList extends AmCommand<typeof OrgList> {
- *   async run(): Promise<void> {
- *     const orgs = await this.accountManagerClient.listOrgs();
- *     // ...
- *   }
- * }
- */
-export declare abstract class AmCommand<T extends typeof Command> extends OAuthCommand<T> {
-    protected getDefaultClientId(): string;
-    private _accountManagerClient?;
-    private _authStrategy?;
-    /**
-     * Gets the auth method type that was used, based on the stored strategy.
-     */
-    protected get authMethodUsed(): 'implicit' | 'client-credentials' | 'jwt' | 'stateful' | undefined;
-    /**
-     * Gets the unified Account Manager client, creating it if necessary.
-     * This provides direct access to all Account Manager API methods (users, roles, orgs).
-     *
-     * @example
-     * const client = this.accountManagerClient;
-     * const users = await client.listUsers({});
-     * const roles = await client.listRoles({});
-     * const orgs = await client.listOrgs();
-     * const user = await client.getUser('user-id');
-     * const role = await client.getRole('bm-admin');
-     * const org = await client.getOrg('org-id');
-     */
-    protected get accountManagerClient(): AccountManagerClient;
-    /**
-     * Override catch() to detect auth errors and append contextual AM role guidance.
-     */
-    protected catch(err: Error & {
-        exitCode?: number;
-    }): Promise<never>;
-    /**
-     * Builds a contextual suggestion message based on the auth method and AM subtopic.
-     */
-    private getAuthErrorSuggestion;
-    /**
-     * Gets the AM subtopic from the command ID (e.g., 'am:users:list' → 'users').
-     */
-    private getAmSubtopic;
-    /**
-     * Attempts to extract roles from the cached JWT token synchronously.
-     */
-    private getJwtRolesInfo;
-    /**
-     * Suggestion for client-credentials auth failures.
-     */
-    private getClientCredentialsSuggestion;
-    /**
-     * Suggestion for implicit auth failures.
-     */
-    private getImplicitSuggestion;
-}