@serviceme/devtools-core 0.1.8 → 0.2.0

package/dist/auth.js

@@ -0,0 +1,842 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/auth/index.ts
+var auth_exports = {};
+__export(auth_exports, {
+  AccessControl: () => AccessControl,
+  AuthCore: () => AuthCore,
+  AuthStateManager: () => AuthStateManager,
+  GitHubAuthProvider: () => GitHubAuthProvider,
+  InMemoryKeychainAuthTokenStore: () => InMemoryKeychainAuthTokenStore,
+  KeychainUnavailableError: () => KeychainUnavailableError,
+  MicrosoftAuthProvider: () => MicrosoftAuthProvider,
+  MicrosoftProviderNotHostedError: () => MicrosoftProviderNotHostedError,
+  ProviderRegistry: () => ProviderRegistry,
+  buildGitHubLocalEmail: () => buildGitHubLocalEmail,
+  isGitHubLocalEmail: () => isGitHubLocalEmail,
+  resolvePrimaryEmail: () => resolvePrimaryEmail
+});
+module.exports = __toCommonJS(auth_exports);
+
+// src/auth/AccessControl.ts
+var DEFAULT_CACHE_TTL_MS = 10 * 60 * 1e3;
+var DEFAULT_PERSISTENT_CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
+var KEY_GRANTED_USERS = "msDevTools.accessControl.grantedUsers";
+var KEY_MEMBERSHIP_CACHE = "msDevTools.accessControl.membershipCache";
+var KEY_SERVER_IN_ORG = "msDevTools.accessControl.serverInOrg";
+var AccessControl = class {
+  constructor(kv, options) {
+    this.kv = kv;
+    this.memCache = /* @__PURE__ */ new Map();
+    this.serverInOrgMem = /* @__PURE__ */ new Map();
+    this.listeners = /* @__PURE__ */ new Set();
+    this.opts = {
+      org: options.org,
+      tokenFetcher: options.tokenFetcher,
+      orgFetcher: options.orgFetcher,
+      microsoftEmailDomains: options.microsoftEmailDomains ?? [],
+      cacheTtlMs: options.cacheTtlMs ?? DEFAULT_CACHE_TTL_MS,
+      persistentCacheTtlMs: options.persistentCacheTtlMs ?? DEFAULT_PERSISTENT_CACHE_TTL_MS,
+      now: options.now ?? (() => Date.now())
+    };
+    const persistedServerInOrg = this.kv.get(KEY_SERVER_IN_ORG);
+    if (persistedServerInOrg) {
+      for (const [key, value] of Object.entries(persistedServerInOrg)) {
+        this.serverInOrgMem.set(key, value);
+      }
+    }
+  }
+  /** Subscribe to inOrg changes (used by extension to refresh access-gated UI). */
+  onDidChange(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  /** Full check: requires authentication + org membership / admin grant. */
+  async checkAccess(user) {
+    if (!user) {
+      return { allowed: false, reason: "not_authenticated" };
+    }
+    if (user.provider === "microsoft" && user.login) {
+      const inOrg = this.serverInOrgMem.get(user.login.toLowerCase());
+      if (inOrg === true) return { allowed: true };
+      if (inOrg === false) {
+        return { allowed: false, reason: "not_member", username: user.login };
+      }
+    }
+    const githubAccount = user.provider === "github" ? user : null;
+    if (!githubAccount && user.provider === "microsoft" && user.login) {
+      const [, domain = ""] = user.login.split("@");
+      const isDomainMember = domain.length > 0 && this.opts.microsoftEmailDomains.includes(domain.toLowerCase());
+      if (isDomainMember) return { allowed: true };
+      return { allowed: false, reason: "not_member", username: user.login };
+    }
+    if (!githubAccount) {
+      return { allowed: true };
+    }
+    const accessUsername = githubAccount.login ?? user.login ?? "";
+    if (accessUsername.length === 0) {
+      return { allowed: false, reason: "not_member", username: "" };
+    }
+    const granted = this.getGrantedUsers();
+    if (granted.includes(accessUsername.toLowerCase())) {
+      return { allowed: true };
+    }
+    const isMember = await this.checkOrgMembership(accessUsername);
+    return isMember ? { allowed: true } : { allowed: false, reason: "not_member", username: accessUsername };
+  }
+  /** Admin: grant access to a GitHub username (bypasses org check). */
+  async grantAccess(username) {
+    const list = this.getGrantedUsers();
+    const key = username.toLowerCase();
+    if (!list.includes(key)) {
+      list.push(key);
+      await this.kv.update(KEY_GRANTED_USERS, list);
+    }
+  }
+  /** Admin: revoke a previously granted access. */
+  async revokeAccess(username) {
+    const updated = this.getGrantedUsers().filter((u) => u !== username.toLowerCase());
+    await this.kv.update(KEY_GRANTED_USERS, updated);
+  }
+  /** Snapshot of all admin-granted usernames (lowercased). */
+  getGrantedUsers() {
+    return this.kv.get(KEY_GRANTED_USERS) ?? [];
+  }
+  /** Cached membership lookup with both in-memory + persistent layers. */
+  async checkOrgMembership(username) {
+    const now = this.opts.now();
+    const inMem = this.memCache.get(username);
+    if (inMem && now - inMem.at < this.opts.cacheTtlMs) {
+      return inMem.isMember;
+    }
+    const persistent = this.kv.get(KEY_MEMBERSHIP_CACHE) ?? {};
+    const persistentEntry = persistent[username];
+    if (persistentEntry && now - persistentEntry.at < this.opts.persistentCacheTtlMs) {
+      this.memCache.set(username, persistentEntry);
+      return persistentEntry.isMember;
+    }
+    const token = await this.opts.tokenFetcher("github");
+    if (!token) return false;
+    try {
+      const result = await this.opts.orgFetcher(token, this.opts.org);
+      const decision = this.resolveDecision(username, result);
+      if (typeof decision === "boolean") {
+        this.updateCache(username, decision);
+        return decision;
+      }
+      return true;
+    } catch {
+      return true;
+    }
+  }
+  /** Server-confirmed inOrg status (set by device claim flow). */
+  setServerInOrg(username, inOrg) {
+    const key = username.toLowerCase();
+    this.serverInOrgMem.set(key, inOrg);
+    const persisted = this.kv.get(KEY_SERVER_IN_ORG) ?? {};
+    persisted[key] = inOrg;
+    void this.kv.update(KEY_SERVER_IN_ORG, persisted);
+    this.notifyListeners();
+  }
+  /** Inspect server-confirmed inOrg for a username; returns undefined when unknown. */
+  getServerInOrg(username) {
+    return this.serverInOrgMem.get(username.toLowerCase());
+  }
+  resolveDecision(_username, membership) {
+    if (membership.status === "active" || membership.status === "pending") return true;
+    if (membership.status === "not_member") return false;
+    return void 0;
+  }
+  updateCache(username, isMember) {
+    const at = this.opts.now();
+    this.memCache.set(username, { isMember, at });
+    const persistent = this.kv.get(KEY_MEMBERSHIP_CACHE) ?? {};
+    persistent[username] = { isMember, at };
+    void this.kv.update(KEY_MEMBERSHIP_CACHE, persistent);
+  }
+  notifyListeners() {
+    for (const listener of this.listeners) {
+      try {
+        listener();
+      } catch {
+      }
+    }
+  }
+};
+
+// src/auth/AuthStateManager.ts
+var import_node_events = require("events");
+var AuthStateManager = class {
+  constructor(opts = {}) {
+    this.emitter = new import_node_events.EventEmitter();
+    this.accounts = [];
+    this.activeProvider = null;
+    this.activeAccountId = null;
+    this.lastError = null;
+    if (opts.maxListeners !== void 0) {
+      this.emitter.setMaxListeners(opts.maxListeners);
+    }
+  }
+  /** Subscribe to state-change events. Returns a disposer. */
+  onDidChange(listener) {
+    this.emitter.on("change", listener);
+    return () => this.emitter.off("change", listener);
+  }
+  /** Snapshot of all known accounts (immutable copy). */
+  listAccounts() {
+    return [...this.accounts];
+  }
+  /** Find an account by `(provider, accountId)` tuple; returns `null` when absent. */
+  findAccount(provider, accountId) {
+    return this.accounts.find((a) => a.provider === provider && a.id === accountId) ?? null;
+  }
+  /** First account for the requested provider — used for "switch to GitHub" UX. */
+  findFirstForProvider(provider) {
+    return this.accounts.find((a) => a.provider === provider) ?? null;
+  }
+  /** Insert or update an account entry. New accounts land at the head of the list. */
+  upsertAccount(meta) {
+    const idx = this.accounts.findIndex((a) => a.provider === meta.provider && a.id === meta.id);
+    if (idx >= 0) {
+      this.accounts[idx] = meta;
+    } else {
+      this.accounts.unshift(meta);
+    }
+    this.fire();
+  }
+  /** Remove an account entry. Returns `true` when an entry was removed. */
+  removeAccount(provider, accountId) {
+    const before = this.accounts.length;
+    this.accounts = this.accounts.filter((a) => !(a.provider === provider && a.id === accountId));
+    const removed = this.accounts.length !== before;
+    if (removed && this.activeProvider === provider && this.activeAccountId === accountId) {
+      const stillHasSameProvider = this.accounts.some((a) => a.provider === provider);
+      if (!stillHasSameProvider) {
+        this.activeProvider = null;
+        this.activeAccountId = null;
+      } else {
+        const next = this.accounts.find((a) => a.provider === provider);
+        if (next) {
+          this.activeAccountId = next.id;
+        }
+      }
+    }
+    if (removed) this.fire();
+    return removed;
+  }
+  /** Set the active provider. When `accountId` is omitted, picks the first account for that provider. */
+  setActive(provider, accountId) {
+    const match = accountId !== void 0 ? this.accounts.find((a) => a.provider === provider && a.id === accountId) : this.accounts.find((a) => a.provider === provider);
+    if (!match) return false;
+    this.activeProvider = provider;
+    this.activeAccountId = match.id;
+    this.fire();
+    return true;
+  }
+  /** Currently active provider — `null` when no session is active. */
+  getActiveProvider() {
+    return this.activeProvider;
+  }
+  /** Currently active account metadata — `null` when none. */
+  getActiveAccount() {
+    if (!this.activeProvider || !this.activeAccountId) return null;
+    return this.accounts.find(
+      (a) => a.provider === this.activeProvider && a.id === this.activeAccountId
+    ) ?? null;
+  }
+  /** True when at least one provider has an account entry. */
+  hasAnySession() {
+    return this.accounts.length > 0 && this.activeProvider !== null;
+  }
+  /** Snapshot of the state for `auth.status` and bridge serialization. */
+  getStatus() {
+    const grouped = {};
+    for (const account of this.accounts) {
+      grouped[account.provider] = account;
+    }
+    return {
+      activeProvider: this.activeProvider,
+      accounts: grouped,
+      hasAnySession: this.hasAnySession(),
+      lastError: this.lastError ?? void 0
+    };
+  }
+  /** Record a non-fatal error from the last login/refresh attempt. */
+  recordError(message) {
+    this.lastError = message;
+    this.fire();
+  }
+  /** Clear the recorded error (e.g. after a successful login). */
+  clearError() {
+    if (this.lastError === null) return;
+    this.lastError = null;
+    this.fire();
+  }
+  /** Drop every account — used by `auth.logout` with no provider. */
+  clearAll() {
+    this.accounts = [];
+    this.activeProvider = null;
+    this.activeAccountId = null;
+    this.lastError = null;
+    this.fire();
+  }
+  fire() {
+    this.emitter.emit("change");
+  }
+};
+
+// src/auth/ProviderRegistry.ts
+var ProviderRegistry = class {
+  constructor() {
+    this.providers = /* @__PURE__ */ new Map();
+  }
+  /** Register or replace a provider implementation. */
+  register(provider) {
+    this.providers.set(provider.providerId, provider);
+  }
+  /** Look up a registered provider by id; throws when missing. */
+  get(providerId) {
+    const p = this.providers.get(providerId);
+    if (!p) {
+      throw new Error(`Auth provider not registered: ${providerId}`);
+    }
+    return p;
+  }
+  /** Non-throwing lookup; returns `undefined` when the provider is unknown. */
+  tryGet(providerId) {
+    return this.providers.get(providerId);
+  }
+  /** Return all registered provider ids — used by `auth.status` and bridge capability hints. */
+  list() {
+    return [...this.providers.keys()];
+  }
+  /** True when a provider has been registered for this id. */
+  has(providerId) {
+    return this.providers.has(providerId);
+  }
+};
+
+// src/auth/AuthCore.ts
+var AuthCore = class {
+  constructor(opts) {
+    this.registry = new ProviderRegistry();
+    for (const provider of opts.providers) {
+      this.registry.register(provider);
+    }
+    this.state = opts.stateManager ?? new AuthStateManager();
+    this.tokenStore = opts.tokenStore;
+    this.accessControl = opts.accessControl;
+  }
+  /** Snapshot of every account, the active provider, and the last error. */
+  status() {
+    return this.state.getStatus();
+  }
+  /** List accounts (immutable copy). */
+  listAccounts() {
+    return this.state.listAccounts();
+  }
+  /**
+   * Drive the device-flow login for `provider`.
+   *
+   * Sequence:
+   *   1. Ask the provider for the user code + verification URL.
+   *   2. Surface the code to the user (via `ui`).
+   *   3. Poll until the user authorizes (or `shouldContinue` aborts).
+   *   4. Persist the token via `KeychainAuthTokenStore.set()`.
+   *   5. Insert the resulting `AuthAccountMeta` into state and mark active.
+   */
+  async login(provider, ui, shouldContinue) {
+    const providerImpl = this.registry.get(provider);
+    try {
+      const initial = await providerImpl.requestDeviceFlow();
+      await ui(initial);
+      const session = await providerImpl.completeDeviceFlow(
+        initial.userCode ? initial.deviceCode ?? "" : "",
+        shouldContinue
+      );
+      return await this.persistSession(providerImpl, session);
+    } catch (err) {
+      this.state.recordError(err instanceof Error ? err.message : String(err));
+      throw err;
+    }
+  }
+  /**
+   * Complete the device-flow handshake given a pre-fetched user code.
+   * Useful when the caller (Phase 5.3 CLI) wants to fetch the code,
+   * print the URL, and then poll on a subsequent invocation.
+   */
+  async completeLogin(provider, deviceCode, shouldContinue) {
+    const providerImpl = this.registry.get(provider);
+    try {
+      const session = await providerImpl.completeDeviceFlow(deviceCode, shouldContinue);
+      return await this.persistSession(providerImpl, session);
+    } catch (err) {
+      this.state.recordError(err instanceof Error ? err.message : String(err));
+      throw err;
+    }
+  }
+  /** Resolve the provider + token for the active session; returns null when no session is active. */
+  async resolveActiveToken() {
+    const provider = this.state.getActiveProvider();
+    if (!provider) return null;
+    const account = this.state.getActiveAccount();
+    if (!account) return null;
+    const envelope = await this.tokenStore.get({ provider, accountId: account.id });
+    if (!envelope) return null;
+    return { provider, account, token: envelope.token };
+  }
+  /**
+   * Logout: removes the token bytes from the keychain + drops the
+   * account entry from state. When `provider` is omitted, clears
+   * every account.
+   */
+  async logout(provider) {
+    if (!provider) {
+      for (const account of this.state.listAccounts()) {
+        await this.tokenStore.delete({ provider: account.provider, accountId: account.id });
+        this.state.removeAccount(account.provider, account.id);
+      }
+      this.state.clearAll();
+      return { provider: null, success: true };
+    }
+    const accountsForProvider = this.state.listAccounts().filter((a) => a.provider === provider);
+    let removed = false;
+    for (const account of accountsForProvider) {
+      await this.tokenStore.delete({ provider, accountId: account.id });
+      const didRemove = this.state.removeAccount(provider, account.id);
+      removed = removed || didRemove;
+    }
+    if (this.state.getActiveProvider() === provider) {
+      const firstRemaining = this.state.listAccounts()[0];
+      if (firstRemaining) {
+        this.state.setActive(firstRemaining.provider);
+      }
+    }
+    return { provider, success: removed };
+  }
+  /** Minimal identity for `auth.whoami`. */
+  async whoami() {
+    const provider = this.state.getActiveProvider();
+    const account = this.state.getActiveAccount();
+    if (!provider || !account) {
+      return { provider: null };
+    }
+    return {
+      provider,
+      login: account.login,
+      name: account.displayName,
+      avatarUrl: account.avatarUrl,
+      email: account.email
+    };
+  }
+  /** Switch the active provider. Returns the resulting active account. */
+  switchProvider(provider, accountId) {
+    const ok = this.state.setActive(provider, accountId);
+    const account = this.state.getActiveAccount();
+    return {
+      activeProvider: ok ? provider : this.state.getActiveProvider(),
+      account
+    };
+  }
+  /** Run the access-control check against the active account (optional, requires AccessControl). */
+  async checkAccess() {
+    if (!this.accessControl) return null;
+    const account = this.state.getActiveAccount();
+    return this.accessControl.checkAccess(account);
+  }
+  /** Expose the state manager for test inspection (not for mutation). */
+  getStateManager() {
+    return this.state;
+  }
+  /** Expose the provider registry for test inspection. */
+  getProviderRegistry() {
+    return this.registry;
+  }
+  /** Expose the access control (or undefined when not configured). */
+  getAccessControl() {
+    return this.accessControl;
+  }
+  async persistSession(providerImpl, session) {
+    const expiresAt = session.expiresIn ? Date.now() + session.expiresIn * 1e3 : null;
+    const meta = await providerImpl.fetchAccountMeta(session.token);
+    const accountMeta = {
+      id: meta.id,
+      provider: meta.provider,
+      displayName: meta.displayName,
+      login: meta.login,
+      email: meta.email,
+      avatarUrl: meta.avatarUrl,
+      expiresAt: meta.expiresAt ?? expiresAt
+    };
+    await this.tokenStore.set({ provider: meta.provider, accountId: meta.id }, session.token, {
+      expiresAt
+    });
+    this.state.upsertAccount(accountMeta);
+    this.state.setActive(meta.provider, meta.id);
+    this.state.clearError();
+    return {
+      provider: meta.provider,
+      message: `Logged in as ${meta.login ?? meta.id}`
+    };
+  }
+};
+
+// src/auth/KeychainAuthTokenStore.ts
+var KeychainUnavailableError = class extends Error {
+  constructor(message, cause) {
+    super(message, cause !== void 0 ? { cause } : void 0);
+    this.name = "KeychainUnavailableError";
+  }
+};
+var InMemoryKeychainAuthTokenStore = class {
+  constructor() {
+    this.entries = /* @__PURE__ */ new Map();
+  }
+  compositeKey(key) {
+    return `${key.provider}:${key.accountId}`;
+  }
+  async set(key, token, opts) {
+    this.entries.set(this.compositeKey(key), {
+      token,
+      expiresAt: opts?.expiresAt ?? null,
+      storedAt: Date.now()
+    });
+  }
+  async get(key) {
+    const entry = this.entries.get(this.compositeKey(key));
+    if (!entry) return null;
+    return {
+      token: entry.token,
+      metadata: {
+        provider: key.provider,
+        accountId: key.accountId,
+        expiresAt: entry.expiresAt,
+        storedAt: entry.storedAt
+      }
+    };
+  }
+  async delete(key) {
+    this.entries.delete(this.compositeKey(key));
+  }
+  async list() {
+    const out = [];
+    for (const composite of this.entries.keys()) {
+      const sepIdx = composite.indexOf(":");
+      if (sepIdx <= 0) continue;
+      out.push({
+        provider: composite.slice(0, sepIdx),
+        accountId: composite.slice(sepIdx + 1)
+      });
+    }
+    return out;
+  }
+  async isAvailable() {
+    return true;
+  }
+};
+
+// src/auth/utils/githubUserEmail.ts
+function isGitHubLocalEmail(email) {
+  return typeof email === "string" && email.trim().toLowerCase().endsWith("@github.local");
+}
+function buildGitHubLocalEmail(login) {
+  return `${login}@github.local`;
+}
+function resolvePrimaryEmail(login, email) {
+  const normalizedEmail = email?.trim();
+  return normalizedEmail || buildGitHubLocalEmail(login);
+}
+
+// src/auth/providers/GitHubAuthProvider.ts
+var DEFAULT_DEVICE_CODE_URL = "https://github.com/login/device/code";
+var DEFAULT_TOKEN_URL = "https://github.com/login/oauth/access_token";
+var DEFAULT_USER_URL = "https://api.github.com/user";
+var DEFAULT_SCOPE = "read:user user:email";
+var GitHubAuthProvider = class {
+  constructor(config) {
+    this.providerId = "github";
+    if (!config.clientId || config.clientId.length === 0) {
+      throw new Error("GitHubAuthProvider requires a non-empty `clientId`");
+    }
+    this.cfg = {
+      clientId: config.clientId,
+      deviceCodeUrl: config.deviceCodeUrl ?? DEFAULT_DEVICE_CODE_URL,
+      tokenUrl: config.tokenUrl ?? DEFAULT_TOKEN_URL,
+      userUrl: config.userUrl ?? DEFAULT_USER_URL,
+      scope: config.scope ?? DEFAULT_SCOPE,
+      minPollIntervalMs: config.minPollIntervalMs ?? 1e3,
+      maxPollIntervalMs: config.maxPollIntervalMs ?? 15e3,
+      maxWaitMs: config.maxWaitMs,
+      fetchImpl: config.fetchImpl ?? fetch
+    };
+  }
+  async requestDeviceFlow(opts) {
+    const body = JSON.stringify({
+      client_id: this.cfg.clientId,
+      scope: opts?.scope ?? this.cfg.scope
+    });
+    const resp = await this.cfg.fetchImpl(this.cfg.deviceCodeUrl, {
+      method: "POST",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/json",
+        "User-Agent": "serviceme-core"
+      },
+      body
+    });
+    if (!resp.ok) {
+      throw new Error(`GitHub device-code request failed: HTTP ${resp.status}`);
+    }
+    const data = await resp.json();
+    if (!data.device_code || !data.user_code || !data.verification_uri) {
+      throw new Error("GitHub device-code response missing required fields");
+    }
+    return {
+      provider: this.providerId,
+      userCode: data.user_code,
+      verificationUrl: data.verification_uri,
+      expiresAt: Date.now() + data.expires_in * 1e3,
+      message: `Open ${data.verification_uri} and enter ${data.user_code}`
+    };
+  }
+  async completeDeviceFlow(deviceCode, shouldContinue) {
+    const start = Date.now();
+    let pollIntervalMs = this.cfg.minPollIntervalMs;
+    let consecutiveSlowDown = 0;
+    while (true) {
+      if (shouldContinue && !shouldContinue()) {
+        throw new Error("GitHub device flow cancelled by caller");
+      }
+      const elapsed = Date.now() - start;
+      if (this.cfg.maxWaitMs !== void 0 && elapsed > this.cfg.maxWaitMs) {
+        throw new Error("GitHub device flow exceeded max wait time");
+      }
+      await sleep(pollIntervalMs);
+      if (shouldContinue && !shouldContinue()) {
+        throw new Error("GitHub device flow cancelled by caller");
+      }
+      const resp = await this.cfg.fetchImpl(this.cfg.tokenUrl, {
+        method: "POST",
+        headers: {
+          Accept: "application/json",
+          "Content-Type": "application/json",
+          "User-Agent": "serviceme-core"
+        },
+        body: JSON.stringify({
+          client_id: this.cfg.clientId,
+          device_code: deviceCode,
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+        })
+      });
+      if (!resp.ok) {
+        pollIntervalMs = Math.min(Math.round(pollIntervalMs * 1.5), this.cfg.maxPollIntervalMs);
+        continue;
+      }
+      const data = await resp.json();
+      if (data.access_token) {
+        const rawUser = await this.fetchGitHubUser(data.access_token);
+        const email = await this.resolveEmail(data.access_token, rawUser);
+        return {
+          token: data.access_token,
+          refreshToken: data.refresh_token,
+          expiresIn: data.expires_in,
+          user: {
+            id: String(rawUser.id),
+            login: rawUser.login,
+            name: rawUser.name ?? void 0,
+            email: email ?? null,
+            avatarUrl: rawUser.avatar_url ?? void 0
+          }
+        };
+      }
+      if (data.error === "authorization_pending") {
+        continue;
+      }
+      if (data.error === "slow_down") {
+        consecutiveSlowDown++;
+        pollIntervalMs = Math.min(
+          Math.round(pollIntervalMs * 1.5 + Math.min(consecutiveSlowDown * 500, 2e3)),
+          this.cfg.maxPollIntervalMs
+        );
+        continue;
+      }
+      if (data.error === "access_denied") {
+        throw new Error("User denied authorization");
+      }
+      if (data.error === "expired_token") {
+        throw new Error("GitHub device code expired \u2014 restart the flow");
+      }
+      throw new Error(`GitHub device flow error: ${data.error ?? "unknown"}`);
+    }
+  }
+  async refreshAccessToken(refreshToken) {
+    if (!refreshToken) {
+      throw new Error("refreshAccessToken requires a non-empty refresh token");
+    }
+    const resp = await this.cfg.fetchImpl(this.cfg.tokenUrl, {
+      method: "POST",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/json",
+        "User-Agent": "serviceme-core"
+      },
+      body: JSON.stringify({
+        client_id: this.cfg.clientId,
+        grant_type: "refresh_token",
+        refresh_token: refreshToken
+      })
+    });
+    if (!resp.ok) {
+      throw new Error(`GitHub refresh failed: HTTP ${resp.status}`);
+    }
+    const data = await resp.json();
+    if (!data.access_token) {
+      throw new Error(`GitHub refresh failed: ${data.error ?? "no_access_token"}`);
+    }
+    const rawUser = await this.fetchGitHubUser(data.access_token);
+    const email = await this.resolveEmail(data.access_token, rawUser);
+    return {
+      token: data.access_token,
+      refreshToken: data.refresh_token ?? refreshToken,
+      expiresIn: data.expires_in,
+      user: {
+        id: String(rawUser.id),
+        login: rawUser.login,
+        name: rawUser.name ?? void 0,
+        email: email ?? null,
+        avatarUrl: rawUser.avatar_url ?? void 0
+      }
+    };
+  }
+  async validateToken(token) {
+    try {
+      const resp = await this.cfg.fetchImpl(this.cfg.userUrl, {
+        headers: {
+          Accept: "application/vnd.github+json",
+          Authorization: `Bearer ${token}`,
+          "User-Agent": "serviceme-core"
+        }
+      });
+      if (resp.status === 401) return false;
+      if (!resp.ok) {
+        throw new Error(`GitHub /user returned HTTP ${resp.status}`);
+      }
+      return true;
+    } catch (err) {
+      if (err instanceof Error && err.message.includes("401")) return false;
+      throw err;
+    }
+  }
+  async fetchAccountMeta(token) {
+    const user = await this.fetchGitHubUser(token);
+    const email = await this.resolveEmail(token, user);
+    return {
+      id: String(user.id),
+      provider: this.providerId,
+      displayName: user.name ?? user.login,
+      login: user.login,
+      email: email ?? buildGitHubLocalEmail(user.login),
+      avatarUrl: user.avatar_url ?? void 0,
+      expiresAt: null
+    };
+  }
+  async fetchGitHubUser(token) {
+    const resp = await this.cfg.fetchImpl(this.cfg.userUrl, {
+      headers: {
+        Accept: "application/vnd.github+json",
+        Authorization: `Bearer ${token}`,
+        "User-Agent": "serviceme-core"
+      }
+    });
+    if (!resp.ok) {
+      throw new Error(`GitHub /user failed: HTTP ${resp.status}`);
+    }
+    return await resp.json();
+  }
+  /**
+   * GitHub's `/user` endpoint returns `null` when the user kept their
+   * email private. The `/user/emails` endpoint reveals verified emails;
+   * we pick the primary one, falling back to the synthetic
+   * `<login>@github.local` form so the account is never email-less.
+   */
+  async resolveEmail(token, user) {
+    if (user.email) return user.email;
+    const emailsResp = await this.cfg.fetchImpl("https://api.github.com/user/emails", {
+      headers: {
+        Accept: "application/vnd.github+json",
+        Authorization: `Bearer ${token}`,
+        "User-Agent": "serviceme-core"
+      }
+    });
+    if (!emailsResp.ok) {
+      return null;
+    }
+    const emails = await emailsResp.json();
+    const primary = emails.find((e) => e.primary && e.verified);
+    return primary?.email ?? null;
+  }
+};
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// src/auth/providers/MicrosoftAuthProvider.ts
+var MicrosoftProviderNotHostedError = class extends Error {
+  constructor(message = "Microsoft auth requires the VSCode host; CLI does not yet implement MSA device flow") {
+    super(message);
+    this.name = "MicrosoftProviderNotHostedError";
+  }
+};
+var MicrosoftAuthProvider = class {
+  constructor() {
+    this.providerId = "microsoft";
+  }
+  async requestDeviceFlow() {
+    throw new MicrosoftProviderNotHostedError();
+  }
+  async completeDeviceFlow(_deviceCode, _shouldContinue) {
+    throw new MicrosoftProviderNotHostedError();
+  }
+  async refreshAccessToken(_refreshToken) {
+    throw new MicrosoftProviderNotHostedError();
+  }
+  async validateToken(_token) {
+    throw new MicrosoftProviderNotHostedError();
+  }
+  async fetchAccountMeta(_token) {
+    throw new MicrosoftProviderNotHostedError();
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AccessControl,
+  AuthCore,
+  AuthStateManager,
+  GitHubAuthProvider,
+  InMemoryKeychainAuthTokenStore,
+  KeychainUnavailableError,
+  MicrosoftAuthProvider,
+  MicrosoftProviderNotHostedError,
+  ProviderRegistry,
+  buildGitHubLocalEmail,
+  isGitHubLocalEmail,
+  resolvePrimaryEmail
+});
+//# sourceMappingURL=auth.js.map