@serviceme/devtools-core 2.0.0 → 2.0.2

package/dist/auth.js

@@ -1,1029 +1,14 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/auth/index.ts
-var auth_exports = {};
-__export(auth_exports, {
-  AccessControl: () => AccessControl,
-  AuthCore: () => AuthCore,
-  AuthStateManager: () => AuthStateManager,
-  GitHubAuthProvider: () => GitHubAuthProvider,
-  InMemoryKeychainAuthTokenStore: () => InMemoryKeychainAuthTokenStore,
-  KeychainUnavailableError: () => KeychainUnavailableError,
-  MicrosoftAuthProvider: () => MicrosoftAuthProvider,
-  MicrosoftProviderNotHostedError: () => MicrosoftProviderNotHostedError,
-  ProviderRegistry: () => ProviderRegistry,
-  buildGitHubLocalEmail: () => buildGitHubLocalEmail,
-  isGitHubLocalEmail: () => isGitHubLocalEmail,
-  resolvePrimaryEmail: () => resolvePrimaryEmail
-});
-module.exports = __toCommonJS(auth_exports);
-
-// src/auth/AccessControl.ts
-var DEFAULT_CACHE_TTL_MS = 10 * 60 * 1e3;
-var DEFAULT_PERSISTENT_CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
-var KEY_GRANTED_USERS = "msDevTools.accessControl.grantedUsers";
-var KEY_MEMBERSHIP_CACHE = "msDevTools.accessControl.membershipCache";
-var KEY_SERVER_IN_ORG = "msDevTools.accessControl.serverInOrg";
-var AccessControl = class {
-  constructor(kv, options) {
-    this.kv = kv;
-    this.memCache = /* @__PURE__ */ new Map();
-    this.serverInOrgMem = /* @__PURE__ */ new Map();
-    this.listeners = /* @__PURE__ */ new Set();
-    this.opts = {
-      org: options.org,
-      tokenFetcher: options.tokenFetcher,
-      orgFetcher: options.orgFetcher,
-      microsoftEmailDomains: options.microsoftEmailDomains ?? [],
-      cacheTtlMs: options.cacheTtlMs ?? DEFAULT_CACHE_TTL_MS,
-      persistentCacheTtlMs: options.persistentCacheTtlMs ?? DEFAULT_PERSISTENT_CACHE_TTL_MS,
-      now: options.now ?? (() => Date.now())
-    };
-    const persistedServerInOrg = this.kv.get(KEY_SERVER_IN_ORG);
-    if (persistedServerInOrg) {
-      for (const [key, value] of Object.entries(persistedServerInOrg)) {
-        this.serverInOrgMem.set(key, value);
-      }
-    }
-  }
-  /** Subscribe to inOrg changes (used by extension to refresh access-gated UI). */
-  onDidChange(listener) {
-    this.listeners.add(listener);
-    return () => this.listeners.delete(listener);
-  }
-  /** Full check: requires authentication + org membership / admin grant. */
-  async checkAccess(user) {
-    if (!user) {
-      return { allowed: false, reason: "not_authenticated" };
-    }
-    if (user.provider === "microsoft" && user.login) {
-      const inOrg = this.serverInOrgMem.get(user.login.toLowerCase());
-      if (inOrg === true) return { allowed: true };
-      if (inOrg === false) {
-        return { allowed: false, reason: "not_member", username: user.login };
-      }
-    }
-    const githubAccount = user.provider === "github" ? user : null;
-    if (!githubAccount && user.provider === "microsoft" && user.login) {
-      const [, domain = ""] = user.login.split("@");
-      const isDomainMember = domain.length > 0 && this.opts.microsoftEmailDomains.includes(domain.toLowerCase());
-      if (isDomainMember) return { allowed: true };
-      return { allowed: false, reason: "not_member", username: user.login };
-    }
-    if (!githubAccount) {
-      return { allowed: true };
-    }
-    const accessUsername = githubAccount.login ?? user.login ?? "";
-    if (accessUsername.length === 0) {
-      return { allowed: false, reason: "not_member", username: "" };
-    }
-    const granted = this.getGrantedUsers();
-    if (granted.includes(accessUsername.toLowerCase())) {
-      return { allowed: true };
-    }
-    const isMember = await this.checkOrgMembership(accessUsername);
-    return isMember ? { allowed: true } : { allowed: false, reason: "not_member", username: accessUsername };
-  }
-  /** Admin: grant access to a GitHub username (bypasses org check). */
-  async grantAccess(username) {
-    const list = this.getGrantedUsers();
-    const key = username.toLowerCase();
-    if (!list.includes(key)) {
-      list.push(key);
-      await this.kv.update(KEY_GRANTED_USERS, list);
-    }
-  }
-  /** Admin: revoke a previously granted access. */
-  async revokeAccess(username) {
-    const updated = this.getGrantedUsers().filter((u) => u !== username.toLowerCase());
-    await this.kv.update(KEY_GRANTED_USERS, updated);
-  }
-  /** Snapshot of all admin-granted usernames (lowercased). */
-  getGrantedUsers() {
-    return this.kv.get(KEY_GRANTED_USERS) ?? [];
-  }
-  /** Cached membership lookup with both in-memory + persistent layers. */
-  async checkOrgMembership(username) {
-    const now = this.opts.now();
-    const inMem = this.memCache.get(username);
-    if (inMem && now - inMem.at < this.opts.cacheTtlMs) {
-      return inMem.isMember;
-    }
-    const persistent = this.kv.get(KEY_MEMBERSHIP_CACHE) ?? {};
-    const persistentEntry = persistent[username];
-    if (persistentEntry && now - persistentEntry.at < this.opts.persistentCacheTtlMs) {
-      this.memCache.set(username, persistentEntry);
-      return persistentEntry.isMember;
-    }
-    const token = await this.opts.tokenFetcher("github");
-    if (!token) return false;
-    try {
-      const result = await this.opts.orgFetcher(token, this.opts.org);
-      const decision = this.resolveDecision(username, result);
-      if (typeof decision === "boolean") {
-        this.updateCache(username, decision);
-        return decision;
-      }
-      return true;
-    } catch {
-      return true;
-    }
-  }
-  /** Server-confirmed inOrg status (set by device claim flow). */
-  setServerInOrg(username, inOrg) {
-    const key = username.toLowerCase();
-    this.serverInOrgMem.set(key, inOrg);
-    const persisted = this.kv.get(KEY_SERVER_IN_ORG) ?? {};
-    persisted[key] = inOrg;
-    void this.kv.update(KEY_SERVER_IN_ORG, persisted);
-    this.notifyListeners();
-  }
-  /** Inspect server-confirmed inOrg for a username; returns undefined when unknown. */
-  getServerInOrg(username) {
-    return this.serverInOrgMem.get(username.toLowerCase());
-  }
-  resolveDecision(_username, membership) {
-    if (membership.status === "active" || membership.status === "pending") return true;
-    if (membership.status === "not_member") return false;
-    return void 0;
-  }
-  updateCache(username, isMember) {
-    const at = this.opts.now();
-    this.memCache.set(username, { isMember, at });
-    const persistent = this.kv.get(KEY_MEMBERSHIP_CACHE) ?? {};
-    persistent[username] = { isMember, at };
-    void this.kv.update(KEY_MEMBERSHIP_CACHE, persistent);
-  }
-  notifyListeners() {
-    for (const listener of this.listeners) {
-      try {
-        listener();
-      } catch {
-      }
-    }
-  }
-};
-
-// src/logger.ts
-var noopLogger = {
-  debug() {
-  },
-  info() {
-  },
-  warn() {
-  },
-  error() {
-  }
-};
-
-// src/auth/AuthStateManager.ts
-var import_node_events = require("events");
-var AuthStateManager = class {
-  constructor(opts = {}) {
-    this.emitter = new import_node_events.EventEmitter();
-    this.accounts = [];
-    this.activeProvider = null;
-    this.activeAccountId = null;
-    this.lastError = null;
-    if (opts.maxListeners !== void 0) {
-      this.emitter.setMaxListeners(opts.maxListeners);
-    }
-  }
-  /** Subscribe to state-change events. Returns a disposer. */
-  onDidChange(listener) {
-    this.emitter.on("change", listener);
-    return () => this.emitter.off("change", listener);
-  }
-  /** Snapshot of all known accounts (immutable copy). */
-  listAccounts() {
-    return [...this.accounts];
-  }
-  /** Find an account by `(provider, accountId)` tuple; returns `null` when absent. */
-  findAccount(provider, accountId) {
-    return this.accounts.find((a) => a.provider === provider && a.id === accountId) ?? null;
-  }
-  /** First account for the requested provider — used for "switch to GitHub" UX. */
-  findFirstForProvider(provider) {
-    return this.accounts.find((a) => a.provider === provider) ?? null;
-  }
-  /** Insert or update an account entry. New accounts land at the head of the list. */
-  upsertAccount(meta) {
-    const idx = this.accounts.findIndex((a) => a.provider === meta.provider && a.id === meta.id);
-    if (idx >= 0) {
-      this.accounts[idx] = meta;
-    } else {
-      this.accounts.unshift(meta);
-    }
-    this.fire();
-  }
-  /** Remove an account entry. Returns `true` when an entry was removed. */
-  removeAccount(provider, accountId) {
-    const before = this.accounts.length;
-    this.accounts = this.accounts.filter((a) => !(a.provider === provider && a.id === accountId));
-    const removed = this.accounts.length !== before;
-    if (removed && this.activeProvider === provider && this.activeAccountId === accountId) {
-      const stillHasSameProvider = this.accounts.some((a) => a.provider === provider);
-      if (!stillHasSameProvider) {
-        this.activeProvider = null;
-        this.activeAccountId = null;
-      } else {
-        const next = this.accounts.find((a) => a.provider === provider);
-        if (next) {
-          this.activeAccountId = next.id;
-        }
-      }
-    }
-    if (removed) this.fire();
-    return removed;
-  }
-  /** Set the active provider. When `accountId` is omitted, picks the first account for that provider. */
-  setActive(provider, accountId) {
-    const match = accountId !== void 0 ? this.accounts.find((a) => a.provider === provider && a.id === accountId) : this.accounts.find((a) => a.provider === provider);
-    if (!match) return false;
-    this.activeProvider = provider;
-    this.activeAccountId = match.id;
-    this.fire();
-    return true;
-  }
-  /** Currently active provider — `null` when no session is active. */
-  getActiveProvider() {
-    return this.activeProvider;
-  }
-  /** Currently active account metadata — `null` when none. */
-  getActiveAccount() {
-    if (!this.activeProvider || !this.activeAccountId) return null;
-    return this.accounts.find(
-      (a) => a.provider === this.activeProvider && a.id === this.activeAccountId
-    ) ?? null;
-  }
-  /** True when at least one provider has an account entry. */
-  hasAnySession() {
-    return this.accounts.length > 0 && this.activeProvider !== null;
-  }
-  /** Snapshot of the state for `auth.status` and bridge serialization. */
-  getStatus() {
-    const grouped = {};
-    for (const account of this.accounts) {
-      grouped[account.provider] = account;
-    }
-    return {
-      activeProvider: this.activeProvider,
-      accounts: grouped,
-      hasAnySession: this.hasAnySession(),
-      lastError: this.lastError ?? void 0
-    };
-  }
-  /** Record a non-fatal error from the last login/refresh attempt. */
-  recordError(message) {
-    this.lastError = message;
-    this.fire();
-  }
-  /** Clear the recorded error (e.g. after a successful login). */
-  clearError() {
-    if (this.lastError === null) return;
-    this.lastError = null;
-    this.fire();
-  }
-  /** Drop every account — used by `auth.logout` with no provider. */
-  clearAll() {
-    this.accounts = [];
-    this.activeProvider = null;
-    this.activeAccountId = null;
-    this.lastError = null;
-    this.fire();
-  }
-  fire() {
-    this.emitter.emit("change");
-  }
-};
-
-// src/auth/ProviderRegistry.ts
-var ProviderRegistry = class {
-  constructor() {
-    this.providers = /* @__PURE__ */ new Map();
-  }
-  /** Register or replace a provider implementation. */
-  register(provider) {
-    this.providers.set(provider.providerId, provider);
-  }
-  /** Look up a registered provider by id; throws when missing. */
-  get(providerId) {
-    const p = this.providers.get(providerId);
-    if (!p) {
-      throw new Error(`Auth provider not registered: ${providerId}`);
-    }
-    return p;
-  }
-  /** Non-throwing lookup; returns `undefined` when the provider is unknown. */
-  tryGet(providerId) {
-    return this.providers.get(providerId);
-  }
-  /** Return all registered provider ids — used by `auth.status` and bridge capability hints. */
-  list() {
-    return [...this.providers.keys()];
-  }
-  /** True when a provider has been registered for this id. */
-  has(providerId) {
-    return this.providers.has(providerId);
-  }
-};
-
-// src/auth/AuthCore.ts
-var AuthCore = class {
-  constructor(opts) {
-    this.registry = new ProviderRegistry();
-    for (const provider of opts.providers) {
-      this.registry.register(provider);
-    }
-    this.state = opts.stateManager ?? new AuthStateManager();
-    this.tokenStore = opts.tokenStore;
-    this.accessControl = opts.accessControl;
-    this.logger = opts.logger ?? noopLogger;
-  }
-  /** Snapshot of every account, the active provider, and the last error. */
-  status() {
-    return this.state.getStatus();
-  }
-  /** List accounts (immutable copy). */
-  listAccounts() {
-    return this.state.listAccounts();
-  }
-  /**
-   * Drive the device-flow login for `provider`.
-   *
-   * Sequence:
-   *   1. Ask the provider for the user code + verification URL.
-   *   2. Surface the code to the user (via `ui`).
-   *   3. Poll until the user authorizes (or `shouldContinue` aborts).
-   *   4. Persist the token via `KeychainAuthTokenStore.set()`.
-   *   5. Insert the resulting `AuthAccountMeta` into state and mark active.
-   */
-  async login(provider, ui, shouldContinue) {
-    const providerImpl = this.registry.get(provider);
-    this.logger.info("[AuthCore] Starting device-flow login", { provider });
-    try {
-      const initial = await providerImpl.requestDeviceFlow();
-      await ui(initial);
-      if (!initial.deviceCode) {
-        this.logger.error("[AuthCore] Provider did not return deviceCode", provider);
-        throw new Error("Auth provider did not return deviceCode for device flow completion");
-      }
-      const session = await providerImpl.completeDeviceFlow(
-        initial.deviceCode,
-        shouldContinue,
-        initial.pollIntervalMs
-      );
-      const result = await this.persistSession(providerImpl, session);
-      this.logger.info("[AuthCore] Device-flow login completed", { provider });
-      return result;
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      this.logger.error("[AuthCore] Device-flow login failed", message, {
-        provider
-      });
-      this.state.recordError(message);
-      throw err;
-    }
-  }
-  /**
-   * Complete the device-flow handshake given a pre-fetched user code.
-   * Useful when the caller (Phase 5.3 CLI) wants to fetch the code,
-   * print the URL, and then poll on a subsequent invocation.
-   */
-  async completeLogin(provider, deviceCode, shouldContinue) {
-    const providerImpl = this.registry.get(provider);
-    try {
-      const session = await providerImpl.completeDeviceFlow(deviceCode, shouldContinue);
-      return await this.persistSession(providerImpl, session);
-    } catch (err) {
-      this.state.recordError(err instanceof Error ? err.message : String(err));
-      throw err;
-    }
-  }
-  /** Resolve the provider + token for the active session; returns null when no session is active. */
-  async resolveActiveToken() {
-    const provider = this.state.getActiveProvider();
-    if (!provider) return null;
-    const account = this.state.getActiveAccount();
-    if (!account) return null;
-    const envelope = await this.tokenStore.get({
-      provider,
-      accountId: account.id
-    });
-    if (!envelope) return null;
-    return { provider, account, token: envelope.token };
-  }
-  /**
-   * Logout: removes the token bytes from the keychain + drops the
-   * account entry from state. When `provider` is omitted, clears
-   * every account.
-   */
-  async logout(provider) {
-    this.logger.info("[AuthCore] Logout requested", {
-      provider: provider ?? "all"
-    });
-    if (!provider) {
-      for (const account of this.state.listAccounts()) {
-        await this.tokenStore.delete({
-          provider: account.provider,
-          accountId: account.id
-        });
-        this.state.removeAccount(account.provider, account.id);
-      }
-      this.state.clearAll();
-      return { provider: null, success: true };
-    }
-    const accountsForProvider = this.state.listAccounts().filter((a) => a.provider === provider);
-    let removed = false;
-    for (const account of accountsForProvider) {
-      await this.tokenStore.delete({ provider, accountId: account.id });
-      const didRemove = this.state.removeAccount(provider, account.id);
-      removed = removed || didRemove;
-    }
-    if (this.state.getActiveProvider() === provider) {
-      const firstRemaining = this.state.listAccounts()[0];
-      if (firstRemaining) {
-        this.state.setActive(firstRemaining.provider);
-      }
-    }
-    return { provider, success: removed };
-  }
-  /** Minimal identity for `auth.whoami`. */
-  async whoami() {
-    const provider = this.state.getActiveProvider();
-    const account = this.state.getActiveAccount();
-    if (!provider || !account) {
-      return { provider: null };
-    }
-    return {
-      provider,
-      login: account.login,
-      name: account.displayName,
-      avatarUrl: account.avatarUrl,
-      email: account.email
-    };
-  }
-  /** Switch the active provider. Returns the resulting active account. */
-  switchProvider(provider, accountId) {
-    const ok = this.state.setActive(provider, accountId);
-    const account = this.state.getActiveAccount();
-    return {
-      activeProvider: ok ? provider : this.state.getActiveProvider(),
-      account
-    };
-  }
-  /** Run the access-control check against the active account (optional, requires AccessControl). */
-  async checkAccess() {
-    if (!this.accessControl) return null;
-    const account = this.state.getActiveAccount();
-    return this.accessControl.checkAccess(account);
-  }
-  /** Expose the state manager for test inspection (not for mutation). */
-  getStateManager() {
-    return this.state;
-  }
-  /** Expose the provider registry for test inspection. */
-  getProviderRegistry() {
-    return this.registry;
-  }
-  /** Expose the access control (or undefined when not configured). */
-  getAccessControl() {
-    return this.accessControl;
-  }
-  async persistSession(providerImpl, session) {
-    const expiresAt = session.expiresIn ? Date.now() + session.expiresIn * 1e3 : null;
-    const meta = await providerImpl.fetchAccountMeta(session.token);
-    const accountMeta = {
-      id: meta.id,
-      provider: meta.provider,
-      displayName: meta.displayName,
-      login: meta.login,
-      email: meta.email,
-      avatarUrl: meta.avatarUrl,
-      expiresAt: meta.expiresAt ?? expiresAt
-    };
-    this.logger.debug("[AuthCore] Persisting session", {
-      provider: meta.provider,
-      accountId: meta.id
-    });
-    await this.tokenStore.set({ provider: meta.provider, accountId: meta.id }, session.token, {
-      expiresAt
-    });
-    this.state.upsertAccount(accountMeta);
-    this.state.setActive(meta.provider, meta.id);
-    this.state.clearError();
-    return {
-      provider: meta.provider,
-      message: `Logged in as ${meta.login ?? meta.id}`
-    };
-  }
-};
-
-// src/auth/KeychainAuthTokenStore.ts
-var KeychainUnavailableError = class extends Error {
-  constructor(message, cause) {
-    super(message, cause !== void 0 ? { cause } : void 0);
-    this.name = "KeychainUnavailableError";
-  }
-};
-var InMemoryKeychainAuthTokenStore = class {
-  constructor() {
-    this.entries = /* @__PURE__ */ new Map();
-  }
-  compositeKey(key) {
-    return `${key.provider}:${key.accountId}`;
-  }
-  async set(key, token, opts) {
-    this.entries.set(this.compositeKey(key), {
-      token,
-      expiresAt: opts?.expiresAt ?? null,
-      storedAt: Date.now()
-    });
-  }
-  async get(key) {
-    const entry = this.entries.get(this.compositeKey(key));
-    if (!entry) return null;
-    return {
-      token: entry.token,
-      metadata: {
-        provider: key.provider,
-        accountId: key.accountId,
-        expiresAt: entry.expiresAt,
-        storedAt: entry.storedAt
-      }
-    };
-  }
-  async delete(key) {
-    this.entries.delete(this.compositeKey(key));
-  }
-  async list() {
-    const out = [];
-    for (const composite of this.entries.keys()) {
-      const sepIdx = composite.indexOf(":");
-      if (sepIdx <= 0) continue;
-      out.push({
-        provider: composite.slice(0, sepIdx),
-        accountId: composite.slice(sepIdx + 1)
-      });
-    }
-    return out;
-  }
-  async isAvailable() {
-    return true;
-  }
-};
-
-// src/auth/utils/githubUserEmail.ts
-function isGitHubLocalEmail(email) {
-  return typeof email === "string" && email.trim().toLowerCase().endsWith("@github.local");
-}
-function buildGitHubLocalEmail(login) {
-  return `${login}@github.local`;
-}
-function resolvePrimaryEmail(login, email) {
-  const normalizedEmail = email?.trim();
-  return normalizedEmail || buildGitHubLocalEmail(login);
-}
-
-// src/auth/providers/GitHubAuthProvider.ts
-var DEFAULT_DEVICE_CODE_URL = "https://github.com/login/device/code";
-var DEFAULT_TOKEN_URL = "https://github.com/login/oauth/access_token";
-var DEFAULT_USER_URL = "https://api.github.com/user";
-var DEFAULT_SCOPE = "read:user user:email";
-var DEVICE_CODE_MAX_ATTEMPTS = 3;
-var DEFAULT_DEVICE_CODE_RETRY_BASE_DELAY_MS = 500;
-function isTransientNetworkError(error) {
-  return error instanceof TypeError;
-}
-var GitHubAuthProvider = class {
-  constructor(config) {
-    this.providerId = "github";
-    if (!config.clientId || config.clientId.length === 0) {
-      throw new Error("GitHubAuthProvider requires a non-empty `clientId`");
-    }
-    this.cfg = {
-      clientId: config.clientId,
-      deviceCodeUrl: config.deviceCodeUrl ?? DEFAULT_DEVICE_CODE_URL,
-      tokenUrl: config.tokenUrl ?? DEFAULT_TOKEN_URL,
-      userUrl: config.userUrl ?? DEFAULT_USER_URL,
-      scope: config.scope ?? DEFAULT_SCOPE,
-      minPollIntervalMs: config.minPollIntervalMs ?? 1e3,
-      maxPollIntervalMs: config.maxPollIntervalMs ?? 6e4,
-      maxWaitMs: config.maxWaitMs,
-      fetchImpl: config.fetchImpl ?? fetch,
-      deviceCodeRetryBaseDelayMs: config.deviceCodeRetryBaseDelayMs ?? DEFAULT_DEVICE_CODE_RETRY_BASE_DELAY_MS
-    };
-    this.logger = config.logger ?? noopLogger;
-    this.sleepImpl = config.sleepImpl ?? sleep;
-  }
-  async requestDeviceFlow(opts) {
-    const body = JSON.stringify({
-      client_id: this.cfg.clientId,
-      scope: opts?.scope ?? this.cfg.scope
-    });
-    let lastNetworkError;
-    for (let attempt = 1; attempt <= DEVICE_CODE_MAX_ATTEMPTS; attempt++) {
-      this.logger.debug("[GitHubAuthProvider] Requesting device code", {
-        attempt,
-        maxAttempts: DEVICE_CODE_MAX_ATTEMPTS
-      });
-      let resp;
-      try {
-        resp = await this.cfg.fetchImpl(this.cfg.deviceCodeUrl, {
-          method: "POST",
-          headers: {
-            Accept: "application/json",
-            "Content-Type": "application/json",
-            "User-Agent": "serviceme-core"
-          },
-          body
-        });
-      } catch (error) {
-        if (!isTransientNetworkError(error) || attempt === DEVICE_CODE_MAX_ATTEMPTS) {
-          this.logger.error(
-            "[GitHubAuthProvider] Device-code request failed (non-retryable)",
-            error instanceof Error ? error.message : String(error),
-            { attempt }
-          );
-          throw error;
-        }
-        const delayMs = this.cfg.deviceCodeRetryBaseDelayMs * 2 ** (attempt - 1);
-        this.logger.warn(
-          "[GitHubAuthProvider] Transient network error requesting device code, retrying",
-          {
-            attempt,
-            delayMs,
-            error: error instanceof Error ? error.message : String(error)
-          }
-        );
-        lastNetworkError = error;
-        await this.sleepImpl(delayMs);
-        continue;
-      }
-      if (!resp.ok) {
-        this.logger.error(
-          "[GitHubAuthProvider] Device-code request rejected by GitHub",
-          `HTTP ${resp.status}`
-        );
-        throw new Error(`GitHub device-code request failed: HTTP ${resp.status}`);
-      }
-      const data = await resp.json();
-      if (!data.device_code || !data.user_code || !data.verification_uri) {
-        this.logger.error(
-          "[GitHubAuthProvider] Device-code response missing required fields",
-          JSON.stringify(Object.keys(data))
-        );
-        throw new Error("GitHub device-code response missing required fields");
-      }
-      this.logger.info("[GitHubAuthProvider] Device code obtained", {
-        userCode: data.user_code,
-        verificationUri: data.verification_uri,
-        expiresInSec: data.expires_in,
-        pollIntervalSec: data.interval
-      });
-      return {
-        provider: this.providerId,
-        deviceCode: data.device_code,
-        userCode: data.user_code,
-        verificationUrl: data.verification_uri,
-        expiresAt: Date.now() + data.expires_in * 1e3,
-        pollIntervalMs: data.interval * 1e3,
-        message: `Open ${data.verification_uri} and enter ${data.user_code}`
-      };
-    }
-    throw lastNetworkError ?? new Error("GitHub device-code request failed");
-  }
-  async completeDeviceFlow(deviceCode, shouldContinue, initialPollIntervalMs) {
-    const start = Date.now();
-    let pollIntervalMs = Math.max(this.cfg.minPollIntervalMs, initialPollIntervalMs ?? 0);
-    let consecutiveSlowDown = 0;
-    let pollCount = 0;
-    this.logger.info("[GitHubAuthProvider] Starting device-flow polling", {
-      initialPollIntervalMs: pollIntervalMs,
-      maxWaitMs: this.cfg.maxWaitMs
-    });
-    while (true) {
-      if (shouldContinue && !shouldContinue()) {
-        this.logger.info("[GitHubAuthProvider] Device flow cancelled by caller", {
-          elapsedMs: Date.now() - start,
-          pollCount
-        });
-        throw new Error("GitHub device flow cancelled by caller");
-      }
-      const elapsed = Date.now() - start;
-      if (this.cfg.maxWaitMs !== void 0 && elapsed > this.cfg.maxWaitMs) {
-        this.logger.warn("[GitHubAuthProvider] Device flow exceeded max wait time", {
-          elapsedMs: elapsed,
-          maxWaitMs: this.cfg.maxWaitMs,
-          pollCount
-        });
-        throw new Error("GitHub device flow exceeded max wait time");
-      }
-      await this.sleepImpl(pollIntervalMs);
-      if (shouldContinue && !shouldContinue()) {
-        this.logger.info("[GitHubAuthProvider] Device flow cancelled by caller", {
-          elapsedMs: Date.now() - start,
-          pollCount
-        });
-        throw new Error("GitHub device flow cancelled by caller");
-      }
-      pollCount++;
-      this.logger.debug("[GitHubAuthProvider] Polling for authorization", {
-        pollCount,
-        elapsedMs: Date.now() - start,
-        pollIntervalMs
-      });
-      let resp;
-      try {
-        resp = await this.cfg.fetchImpl(this.cfg.tokenUrl, {
-          method: "POST",
-          headers: {
-            Accept: "application/json",
-            "Content-Type": "application/json",
-            "User-Agent": "serviceme-core"
-          },
-          body: JSON.stringify({
-            client_id: this.cfg.clientId,
-            device_code: deviceCode,
-            grant_type: "urn:ietf:params:oauth:grant-type:device_code"
-          })
-        });
-      } catch (error) {
-        if (!isTransientNetworkError(error)) {
-          this.logger.error(
-            "[GitHubAuthProvider] Non-retryable error while polling token endpoint",
-            error instanceof Error ? error.message : String(error),
-            { pollCount }
-          );
-          throw error;
-        }
-        const nextPollIntervalMs = Math.min(
-          Math.round(pollIntervalMs * 1.5),
-          this.cfg.maxPollIntervalMs
-        );
-        this.logger.warn(
-          "[GitHubAuthProvider] Transient network error while polling, backing off",
-          {
-            pollCount,
-            error: error instanceof Error ? error.message : String(error),
-            previousPollIntervalMs: pollIntervalMs,
-            nextPollIntervalMs
-          }
-        );
-        pollIntervalMs = nextPollIntervalMs;
-        continue;
-      }
-      if (!resp.ok) {
-        const nextPollIntervalMs = Math.min(
-          Math.round(pollIntervalMs * 1.5),
-          this.cfg.maxPollIntervalMs
-        );
-        this.logger.warn(
-          "[GitHubAuthProvider] Token endpoint returned non-OK status, backing off",
-          {
-            pollCount,
-            status: resp.status,
-            previousPollIntervalMs: pollIntervalMs,
-            nextPollIntervalMs
-          }
-        );
-        pollIntervalMs = nextPollIntervalMs;
-        continue;
-      }
-      const data = await resp.json();
-      if (data.access_token) {
-        this.logger.info("[GitHubAuthProvider] Authorization granted, fetching user profile", {
-          pollCount,
-          elapsedMs: Date.now() - start
-        });
-        const rawUser = await this.fetchGitHubUser(data.access_token);
-        const email = await this.resolveEmail(data.access_token, rawUser);
-        this.logger.info("[GitHubAuthProvider] Device-flow login completed", {
-          pollCount,
-          elapsedMs: Date.now() - start,
-          login: rawUser.login
-        });
-        return {
-          token: data.access_token,
-          refreshToken: data.refresh_token,
-          expiresIn: data.expires_in,
-          user: {
-            id: String(rawUser.id),
-            login: rawUser.login,
-            name: rawUser.name ?? void 0,
-            email: email ?? null,
-            avatarUrl: rawUser.avatar_url ?? void 0
-          }
-        };
-      }
-      if (data.error === "authorization_pending") {
-        this.logger.debug("[GitHubAuthProvider] Authorization still pending", {
-          pollCount,
-          elapsedMs: Date.now() - start
-        });
-        continue;
-      }
-      if (data.error === "slow_down") {
-        consecutiveSlowDown++;
-        const nextPollIntervalMs = Math.min(pollIntervalMs + 5e3, this.cfg.maxPollIntervalMs);
-        this.logger.warn("[GitHubAuthProvider] GitHub requested slower polling (slow_down)", {
-          pollCount,
-          consecutiveSlowDown,
-          previousPollIntervalMs: pollIntervalMs,
-          nextPollIntervalMs
-        });
-        pollIntervalMs = nextPollIntervalMs;
-        continue;
-      }
-      if (data.error === "access_denied") {
-        this.logger.warn("[GitHubAuthProvider] User denied authorization", {
-          pollCount
-        });
-        throw new Error("User denied authorization");
-      }
-      if (data.error === "expired_token") {
-        this.logger.warn(
-          "[GitHubAuthProvider] Device code expired before authorization completed",
-          { pollCount, elapsedMs: Date.now() - start }
-        );
-        throw new Error("GitHub device code expired \u2014 restart the flow");
-      }
-      this.logger.error(
-        "[GitHubAuthProvider] Unexpected device-flow error from token endpoint",
-        data.error ?? "unknown",
-        { pollCount }
-      );
-      throw new Error(`GitHub device flow error: ${data.error ?? "unknown"}`);
-    }
-  }
-  async refreshAccessToken(refreshToken) {
-    if (!refreshToken) {
-      throw new Error("refreshAccessToken requires a non-empty refresh token");
-    }
-    const resp = await this.cfg.fetchImpl(this.cfg.tokenUrl, {
-      method: "POST",
-      headers: {
-        Accept: "application/json",
-        "Content-Type": "application/json",
-        "User-Agent": "serviceme-core"
-      },
-      body: JSON.stringify({
-        client_id: this.cfg.clientId,
-        grant_type: "refresh_token",
-        refresh_token: refreshToken
-      })
-    });
-    if (!resp.ok) {
-      throw new Error(`GitHub refresh failed: HTTP ${resp.status}`);
-    }
-    const data = await resp.json();
-    if (!data.access_token) {
-      throw new Error(`GitHub refresh failed: ${data.error ?? "no_access_token"}`);
-    }
-    const rawUser = await this.fetchGitHubUser(data.access_token);
-    const email = await this.resolveEmail(data.access_token, rawUser);
-    return {
-      token: data.access_token,
-      refreshToken: data.refresh_token ?? refreshToken,
-      expiresIn: data.expires_in,
-      user: {
-        id: String(rawUser.id),
-        login: rawUser.login,
-        name: rawUser.name ?? void 0,
-        email: email ?? null,
-        avatarUrl: rawUser.avatar_url ?? void 0
-      }
-    };
-  }
-  async validateToken(token) {
-    try {
-      const resp = await this.cfg.fetchImpl(this.cfg.userUrl, {
-        headers: {
-          Accept: "application/vnd.github+json",
-          Authorization: `Bearer ${token}`,
-          "User-Agent": "serviceme-core"
-        }
-      });
-      if (resp.status === 401) return false;
-      if (!resp.ok) {
-        throw new Error(`GitHub /user returned HTTP ${resp.status}`);
-      }
-      return true;
-    } catch (err) {
-      if (err instanceof Error && err.message.includes("401")) return false;
-      throw err;
-    }
-  }
-  async fetchAccountMeta(token) {
-    const user = await this.fetchGitHubUser(token);
-    const email = await this.resolveEmail(token, user);
-    return {
-      id: String(user.id),
-      provider: this.providerId,
-      displayName: user.name ?? user.login,
-      login: user.login,
-      email: email ?? buildGitHubLocalEmail(user.login),
-      avatarUrl: user.avatar_url ?? void 0,
-      expiresAt: null
-    };
-  }
-  async fetchGitHubUser(token) {
-    const resp = await this.cfg.fetchImpl(this.cfg.userUrl, {
-      headers: {
-        Accept: "application/vnd.github+json",
-        Authorization: `Bearer ${token}`,
-        "User-Agent": "serviceme-core"
-      }
-    });
-    if (!resp.ok) {
-      throw new Error(`GitHub /user failed: HTTP ${resp.status}`);
-    }
-    return await resp.json();
-  }
-  /**
-   * GitHub's `/user` endpoint returns `null` when the user kept their
-   * email private. The `/user/emails` endpoint reveals verified emails;
-   * we pick the primary one, falling back to the synthetic
-   * `<login>@github.local` form so the account is never email-less.
-   */
-  async resolveEmail(token, user) {
-    if (user.email) return user.email;
-    const emailsResp = await this.cfg.fetchImpl("https://api.github.com/user/emails", {
-      headers: {
-        Accept: "application/vnd.github+json",
-        Authorization: `Bearer ${token}`,
-        "User-Agent": "serviceme-core"
-      }
-    });
-    if (!emailsResp.ok) {
-      return null;
-    }
-    const emails = await emailsResp.json();
-    const primary = emails.find((e) => e.primary && e.verified);
-    return primary?.email ?? null;
-  }
-};
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
-// src/auth/providers/MicrosoftAuthProvider.ts
-var MicrosoftProviderNotHostedError = class extends Error {
-  constructor(message = "Microsoft auth requires the VSCode host; CLI does not yet implement MSA device flow") {
-    super(message);
-    this.name = "MicrosoftProviderNotHostedError";
-  }
-};
-var MicrosoftAuthProvider = class {
-  constructor() {
-    this.providerId = "microsoft";
-  }
-  async requestDeviceFlow() {
-    throw new MicrosoftProviderNotHostedError();
-  }
-  async completeDeviceFlow(_deviceCode, _shouldContinue) {
-    throw new MicrosoftProviderNotHostedError();
-  }
-  async refreshAccessToken(_refreshToken) {
-    throw new MicrosoftProviderNotHostedError();
-  }
-  async validateToken(_token) {
-    throw new MicrosoftProviderNotHostedError();
-  }
-  async fetchAccountMeta(_token) {
-    throw new MicrosoftProviderNotHostedError();
-  }
-};
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  AccessControl,
-  AuthCore,
-  AuthStateManager,
-  GitHubAuthProvider,
-  InMemoryKeychainAuthTokenStore,
-  KeychainUnavailableError,
-  MicrosoftAuthProvider,
-  MicrosoftProviderNotHostedError,
-  ProviderRegistry,
-  buildGitHubLocalEmail,
-  isGitHubLocalEmail,
-  resolvePrimaryEmail
-});
-//# sourceMappingURL=auth.js.map
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_auth = require("./auth-DXam3c4S.js");
+exports.AccessControl = require_auth.AccessControl;
+exports.AuthCore = require_auth.AuthCore;
+exports.AuthStateManager = require_auth.AuthStateManager;
+exports.GitHubAuthProvider = require_auth.GitHubAuthProvider;
+exports.InMemoryKeychainAuthTokenStore = require_auth.InMemoryKeychainAuthTokenStore;
+exports.KeychainUnavailableError = require_auth.KeychainUnavailableError;
+exports.MicrosoftAuthProvider = require_auth.MicrosoftAuthProvider;
+exports.MicrosoftProviderNotHostedError = require_auth.MicrosoftProviderNotHostedError;
+exports.ProviderRegistry = require_auth.ProviderRegistry;
+exports.buildGitHubLocalEmail = require_auth.buildGitHubLocalEmail;
+exports.isGitHubLocalEmail = require_auth.isGitHubLocalEmail;
+exports.resolvePrimaryEmail = require_auth.resolvePrimaryEmail;