@serviceme/devtools-core 2.0.1 → 2.0.3

package/dist/auth-Bzss8zOv.mjs

@@ -0,0 +1,995 @@
+import { EventEmitter } from "node:events";
+//#region src/auth/AccessControl.ts
+const DEFAULT_CACHE_TTL_MS = 6e5;
+const DEFAULT_PERSISTENT_CACHE_TTL_MS = 864e5;
+const KEY_GRANTED_USERS = "msDevTools.accessControl.grantedUsers";
+const KEY_MEMBERSHIP_CACHE = "msDevTools.accessControl.membershipCache";
+const KEY_SERVER_IN_ORG = "msDevTools.accessControl.serverInOrg";
+var AccessControl = class {
+	constructor(kv, options) {
+		this.kv = kv;
+		this.memCache = /* @__PURE__ */ new Map();
+		this.serverInOrgMem = /* @__PURE__ */ new Map();
+		this.listeners = /* @__PURE__ */ new Set();
+		this.opts = {
+			org: options.org,
+			tokenFetcher: options.tokenFetcher,
+			orgFetcher: options.orgFetcher,
+			microsoftEmailDomains: options.microsoftEmailDomains ?? [],
+			cacheTtlMs: options.cacheTtlMs ?? DEFAULT_CACHE_TTL_MS,
+			persistentCacheTtlMs: options.persistentCacheTtlMs ?? DEFAULT_PERSISTENT_CACHE_TTL_MS,
+			now: options.now ?? (() => Date.now())
+		};
+		const persistedServerInOrg = this.kv.get(KEY_SERVER_IN_ORG);
+		if (persistedServerInOrg) for (const [key, value] of Object.entries(persistedServerInOrg)) this.serverInOrgMem.set(key, value);
+	}
+	/** Subscribe to inOrg changes (used by extension to refresh access-gated UI). */
+	onDidChange(listener) {
+		this.listeners.add(listener);
+		return () => this.listeners.delete(listener);
+	}
+	/** Full check: requires authentication + org membership / admin grant. */
+	async checkAccess(user) {
+		if (!user) return {
+			allowed: false,
+			reason: "not_authenticated"
+		};
+		if (user.provider === "microsoft" && user.login) {
+			const inOrg = this.serverInOrgMem.get(user.login.toLowerCase());
+			if (inOrg === true) return { allowed: true };
+			if (inOrg === false) return {
+				allowed: false,
+				reason: "not_member",
+				username: user.login
+			};
+		}
+		const githubAccount = user.provider === "github" ? user : null;
+		if (!githubAccount && user.provider === "microsoft" && user.login) {
+			const [, domain = ""] = user.login.split("@");
+			if (domain.length > 0 && this.opts.microsoftEmailDomains.includes(domain.toLowerCase())) return { allowed: true };
+			return {
+				allowed: false,
+				reason: "not_member",
+				username: user.login
+			};
+		}
+		if (!githubAccount) return { allowed: true };
+		const accessUsername = githubAccount.login ?? user.login ?? "";
+		if (accessUsername.length === 0) return {
+			allowed: false,
+			reason: "not_member",
+			username: ""
+		};
+		if (this.getGrantedUsers().includes(accessUsername.toLowerCase())) return { allowed: true };
+		return await this.checkOrgMembership(accessUsername) ? { allowed: true } : {
+			allowed: false,
+			reason: "not_member",
+			username: accessUsername
+		};
+	}
+	/** Admin: grant access to a GitHub username (bypasses org check). */
+	async grantAccess(username) {
+		const list = this.getGrantedUsers();
+		const key = username.toLowerCase();
+		if (!list.includes(key)) {
+			list.push(key);
+			await this.kv.update(KEY_GRANTED_USERS, list);
+		}
+	}
+	/** Admin: revoke a previously granted access. */
+	async revokeAccess(username) {
+		const updated = this.getGrantedUsers().filter((u) => u !== username.toLowerCase());
+		await this.kv.update(KEY_GRANTED_USERS, updated);
+	}
+	/** Snapshot of all admin-granted usernames (lowercased). */
+	getGrantedUsers() {
+		return this.kv.get(KEY_GRANTED_USERS) ?? [];
+	}
+	/** Cached membership lookup with both in-memory + persistent layers. */
+	async checkOrgMembership(username) {
+		const now = this.opts.now();
+		const inMem = this.memCache.get(username);
+		if (inMem && now - inMem.at < this.opts.cacheTtlMs) return inMem.isMember;
+		const persistentEntry = (this.kv.get(KEY_MEMBERSHIP_CACHE) ?? {})[username];
+		if (persistentEntry && now - persistentEntry.at < this.opts.persistentCacheTtlMs) {
+			this.memCache.set(username, persistentEntry);
+			return persistentEntry.isMember;
+		}
+		const token = await this.opts.tokenFetcher("github");
+		if (!token) return false;
+		try {
+			const result = await this.opts.orgFetcher(token, this.opts.org);
+			const decision = this.resolveDecision(username, result);
+			if (typeof decision === "boolean") {
+				this.updateCache(username, decision);
+				return decision;
+			}
+			return true;
+		} catch {
+			return true;
+		}
+	}
+	/** Server-confirmed inOrg status (set by device claim flow). */
+	setServerInOrg(username, inOrg) {
+		const key = username.toLowerCase();
+		this.serverInOrgMem.set(key, inOrg);
+		const persisted = this.kv.get(KEY_SERVER_IN_ORG) ?? {};
+		persisted[key] = inOrg;
+		this.kv.update(KEY_SERVER_IN_ORG, persisted);
+		this.notifyListeners();
+	}
+	/** Inspect server-confirmed inOrg for a username; returns undefined when unknown. */
+	getServerInOrg(username) {
+		return this.serverInOrgMem.get(username.toLowerCase());
+	}
+	resolveDecision(_username, membership) {
+		if (membership.status === "active" || membership.status === "pending") return true;
+		if (membership.status === "not_member") return false;
+	}
+	updateCache(username, isMember) {
+		const at = this.opts.now();
+		this.memCache.set(username, {
+			isMember,
+			at
+		});
+		const persistent = this.kv.get(KEY_MEMBERSHIP_CACHE) ?? {};
+		persistent[username] = {
+			isMember,
+			at
+		};
+		this.kv.update(KEY_MEMBERSHIP_CACHE, persistent);
+	}
+	notifyListeners() {
+		for (const listener of this.listeners) try {
+			listener();
+		} catch {}
+	}
+};
+//#endregion
+//#region src/logger.ts
+const noopLogger = {
+	debug() {},
+	info() {},
+	warn() {},
+	error() {}
+};
+function formatArgs(args) {
+	return args.map((arg) => {
+		if (typeof arg === "string") return arg;
+		try {
+			return JSON.stringify(arg);
+		} catch {
+			return String(arg);
+		}
+	}).join(" ");
+}
+function createConsoleLogger(prefix = "serviceme") {
+	return {
+		debug(message, ...args) {
+			process.stderr.write(`[${prefix}] DEBUG ${message} ${formatArgs(args)}\n`);
+		},
+		info(message, ...args) {
+			process.stderr.write(`[${prefix}] INFO ${message} ${formatArgs(args)}\n`);
+		},
+		warn(message, ...args) {
+			process.stderr.write(`[${prefix}] WARN ${message} ${formatArgs(args)}\n`);
+		},
+		error(message, ...args) {
+			process.stderr.write(`[${prefix}] ERROR ${message} ${formatArgs(args)}\n`);
+		}
+	};
+}
+//#endregion
+//#region src/auth/AuthStateManager.ts
+/**
+* AuthStateManager — In-memory mirror of the persisted auth state.
+*
+* Holds the multi-account map (provider + accountId keyed) plus the
+* "active" provider/account pair. Emits change events via Node's
+* built-in `events.EventEmitter` so listeners stay decoupled.
+*
+* Important: this class does NOT touch `vscode.SecretStorage` or any
+* file — it only keeps the metadata (`AuthAccountMeta`) and the
+* `activeProvider` selection. Token bytes are looked up via the
+* `KeychainAuthTokenStore` on demand. This separation is what lets
+* `AuthCore` run identically in CLI + Extension.
+*
+* Refs:
+* - 4.功能规划.md §2.1 — `AuthStateManager.ts events.EventEmitter, NO VSCode dep`
+* - ADL-004 — token bytes never enter Core state
+*/
+var AuthStateManager = class {
+	constructor(opts = {}) {
+		this.emitter = new EventEmitter();
+		this.accounts = [];
+		this.activeProvider = null;
+		this.activeAccountId = null;
+		this.lastError = null;
+		if (opts.maxListeners !== void 0) this.emitter.setMaxListeners(opts.maxListeners);
+	}
+	/** Subscribe to state-change events. Returns a disposer. */
+	onDidChange(listener) {
+		this.emitter.on("change", listener);
+		return () => this.emitter.off("change", listener);
+	}
+	/** Snapshot of all known accounts (immutable copy). */
+	listAccounts() {
+		return [...this.accounts];
+	}
+	/** Find an account by `(provider, accountId)` tuple; returns `null` when absent. */
+	findAccount(provider, accountId) {
+		return this.accounts.find((a) => a.provider === provider && a.id === accountId) ?? null;
+	}
+	/** First account for the requested provider — used for "switch to GitHub" UX. */
+	findFirstForProvider(provider) {
+		return this.accounts.find((a) => a.provider === provider) ?? null;
+	}
+	/** Insert or update an account entry. New accounts land at the head of the list. */
+	upsertAccount(meta) {
+		const idx = this.accounts.findIndex((a) => a.provider === meta.provider && a.id === meta.id);
+		if (idx >= 0) this.accounts[idx] = meta;
+		else this.accounts.unshift(meta);
+		this.fire();
+	}
+	/** Remove an account entry. Returns `true` when an entry was removed. */
+	removeAccount(provider, accountId) {
+		const before = this.accounts.length;
+		this.accounts = this.accounts.filter((a) => !(a.provider === provider && a.id === accountId));
+		const removed = this.accounts.length !== before;
+		if (removed && this.activeProvider === provider && this.activeAccountId === accountId) {
+			if (!this.accounts.some((a) => a.provider === provider)) {
+				this.activeProvider = null;
+				this.activeAccountId = null;
+			} else {
+				const next = this.accounts.find((a) => a.provider === provider);
+				if (next) this.activeAccountId = next.id;
+			}
+		}
+		if (removed) this.fire();
+		return removed;
+	}
+	/** Set the active provider. When `accountId` is omitted, picks the first account for that provider. */
+	setActive(provider, accountId) {
+		const match = accountId !== void 0 ? this.accounts.find((a) => a.provider === provider && a.id === accountId) : this.accounts.find((a) => a.provider === provider);
+		if (!match) return false;
+		this.activeProvider = provider;
+		this.activeAccountId = match.id;
+		this.fire();
+		return true;
+	}
+	/** Currently active provider — `null` when no session is active. */
+	getActiveProvider() {
+		return this.activeProvider;
+	}
+	/** Currently active account metadata — `null` when none. */
+	getActiveAccount() {
+		if (!this.activeProvider || !this.activeAccountId) return null;
+		return this.accounts.find((a) => a.provider === this.activeProvider && a.id === this.activeAccountId) ?? null;
+	}
+	/** True when at least one provider has an account entry. */
+	hasAnySession() {
+		return this.accounts.length > 0 && this.activeProvider !== null;
+	}
+	/** Snapshot of the state for `auth.status` and bridge serialization. */
+	getStatus() {
+		const grouped = {};
+		for (const account of this.accounts) grouped[account.provider] = account;
+		return {
+			activeProvider: this.activeProvider,
+			accounts: grouped,
+			hasAnySession: this.hasAnySession(),
+			lastError: this.lastError ?? void 0
+		};
+	}
+	/** Record a non-fatal error from the last login/refresh attempt. */
+	recordError(message) {
+		this.lastError = message;
+		this.fire();
+	}
+	/** Clear the recorded error (e.g. after a successful login). */
+	clearError() {
+		if (this.lastError === null) return;
+		this.lastError = null;
+		this.fire();
+	}
+	/** Drop every account — used by `auth.logout` with no provider. */
+	clearAll() {
+		this.accounts = [];
+		this.activeProvider = null;
+		this.activeAccountId = null;
+		this.lastError = null;
+		this.fire();
+	}
+	fire() {
+		this.emitter.emit("change");
+	}
+};
+//#endregion
+//#region src/auth/ProviderRegistry.ts
+var ProviderRegistry = class {
+	constructor() {
+		this.providers = /* @__PURE__ */ new Map();
+	}
+	/** Register or replace a provider implementation. */
+	register(provider) {
+		this.providers.set(provider.providerId, provider);
+	}
+	/** Look up a registered provider by id; throws when missing. */
+	get(providerId) {
+		const p = this.providers.get(providerId);
+		if (!p) throw new Error(`Auth provider not registered: ${providerId}`);
+		return p;
+	}
+	/** Non-throwing lookup; returns `undefined` when the provider is unknown. */
+	tryGet(providerId) {
+		return this.providers.get(providerId);
+	}
+	/** Return all registered provider ids — used by `auth.status` and bridge capability hints. */
+	list() {
+		return [...this.providers.keys()];
+	}
+	/** True when a provider has been registered for this id. */
+	has(providerId) {
+		return this.providers.has(providerId);
+	}
+};
+//#endregion
+//#region src/auth/AuthCore.ts
+var AuthCore = class {
+	constructor(opts) {
+		this.registry = new ProviderRegistry();
+		for (const provider of opts.providers) this.registry.register(provider);
+		this.state = opts.stateManager ?? new AuthStateManager();
+		this.tokenStore = opts.tokenStore;
+		this.accessControl = opts.accessControl;
+		this.logger = opts.logger ?? noopLogger;
+	}
+	/** Snapshot of every account, the active provider, and the last error. */
+	status() {
+		return this.state.getStatus();
+	}
+	/** List accounts (immutable copy). */
+	listAccounts() {
+		return this.state.listAccounts();
+	}
+	/**
+	* Drive the device-flow login for `provider`.
+	*
+	* Sequence:
+	*   1. Ask the provider for the user code + verification URL.
+	*   2. Surface the code to the user (via `ui`).
+	*   3. Poll until the user authorizes (or `shouldContinue` aborts).
+	*   4. Persist the token via `KeychainAuthTokenStore.set()`.
+	*   5. Insert the resulting `AuthAccountMeta` into state and mark active.
+	*/
+	async login(provider, ui, shouldContinue) {
+		const providerImpl = this.registry.get(provider);
+		this.logger.info("[AuthCore] Starting device-flow login", { provider });
+		try {
+			const initial = await providerImpl.requestDeviceFlow();
+			await ui(initial);
+			if (!initial.deviceCode) {
+				this.logger.error("[AuthCore] Provider did not return deviceCode", provider);
+				throw new Error("Auth provider did not return deviceCode for device flow completion");
+			}
+			const session = await providerImpl.completeDeviceFlow(initial.deviceCode, shouldContinue, initial.pollIntervalMs);
+			const result = await this.persistSession(providerImpl, session);
+			this.logger.info("[AuthCore] Device-flow login completed", { provider });
+			return result;
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			this.logger.error("[AuthCore] Device-flow login failed", message, { provider });
+			this.state.recordError(message);
+			throw err;
+		}
+	}
+	/**
+	* Complete the device-flow handshake given a pre-fetched user code.
+	* Useful when the caller (Phase 5.3 CLI) wants to fetch the code,
+	* print the URL, and then poll on a subsequent invocation.
+	*/
+	async completeLogin(provider, deviceCode, shouldContinue) {
+		const providerImpl = this.registry.get(provider);
+		try {
+			const session = await providerImpl.completeDeviceFlow(deviceCode, shouldContinue);
+			return await this.persistSession(providerImpl, session);
+		} catch (err) {
+			this.state.recordError(err instanceof Error ? err.message : String(err));
+			throw err;
+		}
+	}
+	/** Resolve the provider + token for the active session; returns null when no session is active. */
+	async resolveActiveToken() {
+		const provider = this.state.getActiveProvider();
+		if (!provider) return null;
+		const account = this.state.getActiveAccount();
+		if (!account) return null;
+		const envelope = await this.tokenStore.get({
+			provider,
+			accountId: account.id
+		});
+		if (!envelope) return null;
+		return {
+			provider,
+			account,
+			token: envelope.token
+		};
+	}
+	/**
+	* Logout: removes the token bytes from the keychain + drops the
+	* account entry from state. When `provider` is omitted, clears
+	* every account.
+	*/
+	async logout(provider) {
+		this.logger.info("[AuthCore] Logout requested", { provider: provider ?? "all" });
+		if (!provider) {
+			for (const account of this.state.listAccounts()) {
+				await this.tokenStore.delete({
+					provider: account.provider,
+					accountId: account.id
+				});
+				this.state.removeAccount(account.provider, account.id);
+			}
+			this.state.clearAll();
+			return {
+				provider: null,
+				success: true
+			};
+		}
+		const accountsForProvider = this.state.listAccounts().filter((a) => a.provider === provider);
+		let removed = false;
+		for (const account of accountsForProvider) {
+			await this.tokenStore.delete({
+				provider,
+				accountId: account.id
+			});
+			const didRemove = this.state.removeAccount(provider, account.id);
+			removed = removed || didRemove;
+		}
+		if (this.state.getActiveProvider() === provider) {
+			const firstRemaining = this.state.listAccounts()[0];
+			if (firstRemaining) this.state.setActive(firstRemaining.provider);
+		}
+		return {
+			provider,
+			success: removed
+		};
+	}
+	/** Minimal identity for `auth.whoami`. */
+	async whoami() {
+		const provider = this.state.getActiveProvider();
+		const account = this.state.getActiveAccount();
+		if (!provider || !account) return { provider: null };
+		return {
+			provider,
+			login: account.login,
+			name: account.displayName,
+			avatarUrl: account.avatarUrl,
+			email: account.email
+		};
+	}
+	/** Switch the active provider. Returns the resulting active account. */
+	switchProvider(provider, accountId) {
+		const ok = this.state.setActive(provider, accountId);
+		const account = this.state.getActiveAccount();
+		return {
+			activeProvider: ok ? provider : this.state.getActiveProvider(),
+			account
+		};
+	}
+	/** Run the access-control check against the active account (optional, requires AccessControl). */
+	async checkAccess() {
+		if (!this.accessControl) return null;
+		const account = this.state.getActiveAccount();
+		return this.accessControl.checkAccess(account);
+	}
+	/** Expose the state manager for test inspection (not for mutation). */
+	getStateManager() {
+		return this.state;
+	}
+	/** Expose the provider registry for test inspection. */
+	getProviderRegistry() {
+		return this.registry;
+	}
+	/** Expose the access control (or undefined when not configured). */
+	getAccessControl() {
+		return this.accessControl;
+	}
+	async persistSession(providerImpl, session) {
+		const expiresAt = session.expiresIn ? Date.now() + session.expiresIn * 1e3 : null;
+		const meta = await providerImpl.fetchAccountMeta(session.token);
+		const accountMeta = {
+			id: meta.id,
+			provider: meta.provider,
+			displayName: meta.displayName,
+			login: meta.login,
+			email: meta.email,
+			avatarUrl: meta.avatarUrl,
+			expiresAt: meta.expiresAt ?? expiresAt
+		};
+		this.logger.debug("[AuthCore] Persisting session", {
+			provider: meta.provider,
+			accountId: meta.id
+		});
+		await this.tokenStore.set({
+			provider: meta.provider,
+			accountId: meta.id
+		}, session.token, { expiresAt });
+		this.state.upsertAccount(accountMeta);
+		this.state.setActive(meta.provider, meta.id);
+		this.state.clearError();
+		return {
+			provider: meta.provider,
+			message: `Logged in as ${meta.login ?? meta.id}`
+		};
+	}
+};
+//#endregion
+//#region src/auth/KeychainAuthTokenStore.ts
+/**
+* Sentinel error thrown by `KeychainAuthTokenStore.get()` / `.set()`
+* when the underlying keychain is unavailable. Callers map this to
+* `AUTH_KEYRING_UNAVAILABLE` (Phase 5.3 error code).
+*/
+var KeychainUnavailableError = class extends Error {
+	constructor(message, cause) {
+		super(message, cause !== void 0 ? { cause } : void 0);
+		this.name = "KeychainUnavailableError";
+	}
+};
+/**
+* In-memory `KeychainAuthTokenStore` — test/dev fallback. NEVER use
+* in production: tokens live in process memory and disappear on exit.
+* Production wiring is `KeyringTokenStore` (CLI) / `SecretStorageTokenStore`
+* (Extension).
+*/
+var InMemoryKeychainAuthTokenStore = class {
+	constructor() {
+		this.entries = /* @__PURE__ */ new Map();
+	}
+	compositeKey(key) {
+		return `${key.provider}:${key.accountId}`;
+	}
+	async set(key, token, opts) {
+		this.entries.set(this.compositeKey(key), {
+			token,
+			expiresAt: opts?.expiresAt ?? null,
+			storedAt: Date.now()
+		});
+	}
+	async get(key) {
+		const entry = this.entries.get(this.compositeKey(key));
+		if (!entry) return null;
+		return {
+			token: entry.token,
+			metadata: {
+				provider: key.provider,
+				accountId: key.accountId,
+				expiresAt: entry.expiresAt,
+				storedAt: entry.storedAt
+			}
+		};
+	}
+	async delete(key) {
+		this.entries.delete(this.compositeKey(key));
+	}
+	async list() {
+		const out = [];
+		for (const composite of this.entries.keys()) {
+			const sepIdx = composite.indexOf(":");
+			if (sepIdx <= 0) continue;
+			out.push({
+				provider: composite.slice(0, sepIdx),
+				accountId: composite.slice(sepIdx + 1)
+			});
+		}
+		return out;
+	}
+	async isAvailable() {
+		return true;
+	}
+};
+//#endregion
+//#region src/auth/utils/githubUserEmail.ts
+/**
+* AuthCore — Pure local utilities for GitHub local email handling.
+*
+* Copied verbatim from `@serviceme/devtools-shared/src/github-user-email.ts` (15 LOC)
+* because ADL-003 forbids Core from depending on `@serviceme/devtools-shared`. These
+* helpers are pure functions with zero side effects, so the duplication is
+* trivial to keep in sync.
+*
+* Refs:
+* - 4.功能规划.md §2.1 — "utils/githubUserEmail.ts 纯函数,直接搬"
+* - ADL-003 — `@serviceme/devtools-shared` boundary decision
+*/
+/**
+* Returns true when the supplied address is a synthetic GitHub "local" email
+* (suffixed with `@github.local`). Real GitHub OAuth clients often return
+* `null` for `email` (user kept it private) and the application substitutes
+* `<login>@github.local` to keep the field non-null.
+*/
+function isGitHubLocalEmail(email) {
+	return typeof email === "string" && email.trim().toLowerCase().endsWith("@github.local");
+}
+/** Build a synthetic `<login>@github.local` address. */
+function buildGitHubLocalEmail(login) {
+	return `${login}@github.local`;
+}
+/**
+* Resolve the user's primary email address — falling back to the synthetic
+* `<login>@github.local` form when the upstream email is missing or blank.
+*/
+function resolvePrimaryEmail(login, email) {
+	return email?.trim() || buildGitHubLocalEmail(login);
+}
+//#endregion
+//#region src/auth/providers/GitHubAuthProvider.ts
+const DEFAULT_DEVICE_CODE_URL = "https://github.com/login/device/code";
+const DEFAULT_TOKEN_URL = "https://github.com/login/oauth/access_token";
+const DEFAULT_USER_URL = "https://api.github.com/user";
+const DEFAULT_SCOPE = "read:user user:email";
+/** Attempts for the one-shot device-code request before surfacing a network error. */
+const DEVICE_CODE_MAX_ATTEMPTS = 3;
+const DEFAULT_DEVICE_CODE_RETRY_BASE_DELAY_MS = 500;
+/**
+* `fetch` (both browser and Node's undici) rejects with a `TypeError`
+* (e.g. "fetch failed") when the underlying connection never completes —
+* DNS failure, TLS handshake reset, ECONNRESET, etc. These are transient
+* network hiccups, distinct from a well-formed non-2xx HTTP response, and
+* should be retried rather than immediately failing the whole login.
+*/
+function isTransientNetworkError(error) {
+	return error instanceof TypeError;
+}
+var GitHubAuthProvider = class {
+	constructor(config) {
+		this.providerId = "github";
+		if (!config.clientId || config.clientId.length === 0) throw new Error("GitHubAuthProvider requires a non-empty `clientId`");
+		this.cfg = {
+			clientId: config.clientId,
+			deviceCodeUrl: config.deviceCodeUrl ?? DEFAULT_DEVICE_CODE_URL,
+			tokenUrl: config.tokenUrl ?? DEFAULT_TOKEN_URL,
+			userUrl: config.userUrl ?? DEFAULT_USER_URL,
+			scope: config.scope ?? DEFAULT_SCOPE,
+			minPollIntervalMs: config.minPollIntervalMs ?? 1e3,
+			maxPollIntervalMs: config.maxPollIntervalMs ?? 6e4,
+			maxWaitMs: config.maxWaitMs,
+			fetchImpl: config.fetchImpl ?? fetch,
+			deviceCodeRetryBaseDelayMs: config.deviceCodeRetryBaseDelayMs ?? DEFAULT_DEVICE_CODE_RETRY_BASE_DELAY_MS
+		};
+		this.logger = config.logger ?? noopLogger;
+		this.sleepImpl = config.sleepImpl ?? sleep;
+	}
+	async requestDeviceFlow(opts) {
+		const body = JSON.stringify({
+			client_id: this.cfg.clientId,
+			scope: opts?.scope ?? this.cfg.scope
+		});
+		let lastNetworkError;
+		for (let attempt = 1; attempt <= DEVICE_CODE_MAX_ATTEMPTS; attempt++) {
+			this.logger.debug("[GitHubAuthProvider] Requesting device code", {
+				attempt,
+				maxAttempts: DEVICE_CODE_MAX_ATTEMPTS
+			});
+			let resp;
+			try {
+				resp = await this.cfg.fetchImpl(this.cfg.deviceCodeUrl, {
+					method: "POST",
+					headers: {
+						Accept: "application/json",
+						"Content-Type": "application/json",
+						"User-Agent": "serviceme-core"
+					},
+					body
+				});
+			} catch (error) {
+				if (!isTransientNetworkError(error) || attempt === DEVICE_CODE_MAX_ATTEMPTS) {
+					this.logger.error("[GitHubAuthProvider] Device-code request failed (non-retryable)", error instanceof Error ? error.message : String(error), { attempt });
+					throw error;
+				}
+				const delayMs = this.cfg.deviceCodeRetryBaseDelayMs * 2 ** (attempt - 1);
+				this.logger.warn("[GitHubAuthProvider] Transient network error requesting device code, retrying", {
+					attempt,
+					delayMs,
+					error: error instanceof Error ? error.message : String(error)
+				});
+				lastNetworkError = error;
+				await this.sleepImpl(delayMs);
+				continue;
+			}
+			if (!resp.ok) {
+				this.logger.error("[GitHubAuthProvider] Device-code request rejected by GitHub", `HTTP ${resp.status}`);
+				throw new Error(`GitHub device-code request failed: HTTP ${resp.status}`);
+			}
+			const data = await resp.json();
+			if (!data.device_code || !data.user_code || !data.verification_uri) {
+				this.logger.error("[GitHubAuthProvider] Device-code response missing required fields", JSON.stringify(Object.keys(data)));
+				throw new Error("GitHub device-code response missing required fields");
+			}
+			this.logger.info("[GitHubAuthProvider] Device code obtained", {
+				userCode: data.user_code,
+				verificationUri: data.verification_uri,
+				expiresInSec: data.expires_in,
+				pollIntervalSec: data.interval
+			});
+			return {
+				provider: this.providerId,
+				deviceCode: data.device_code,
+				userCode: data.user_code,
+				verificationUrl: data.verification_uri,
+				expiresAt: Date.now() + data.expires_in * 1e3,
+				pollIntervalMs: data.interval * 1e3,
+				message: `Open ${data.verification_uri} and enter ${data.user_code}`
+			};
+		}
+		throw lastNetworkError ?? /* @__PURE__ */ new Error("GitHub device-code request failed");
+	}
+	async completeDeviceFlow(deviceCode, shouldContinue, initialPollIntervalMs) {
+		const start = Date.now();
+		let pollIntervalMs = Math.max(this.cfg.minPollIntervalMs, initialPollIntervalMs ?? 0);
+		let consecutiveSlowDown = 0;
+		let pollCount = 0;
+		this.logger.info("[GitHubAuthProvider] Starting device-flow polling", {
+			initialPollIntervalMs: pollIntervalMs,
+			maxWaitMs: this.cfg.maxWaitMs
+		});
+		while (true) {
+			if (shouldContinue && !shouldContinue()) {
+				this.logger.info("[GitHubAuthProvider] Device flow cancelled by caller", {
+					elapsedMs: Date.now() - start,
+					pollCount
+				});
+				throw new Error("GitHub device flow cancelled by caller");
+			}
+			const elapsed = Date.now() - start;
+			if (this.cfg.maxWaitMs !== void 0 && elapsed > this.cfg.maxWaitMs) {
+				this.logger.warn("[GitHubAuthProvider] Device flow exceeded max wait time", {
+					elapsedMs: elapsed,
+					maxWaitMs: this.cfg.maxWaitMs,
+					pollCount
+				});
+				throw new Error("GitHub device flow exceeded max wait time");
+			}
+			await this.sleepImpl(pollIntervalMs);
+			if (shouldContinue && !shouldContinue()) {
+				this.logger.info("[GitHubAuthProvider] Device flow cancelled by caller", {
+					elapsedMs: Date.now() - start,
+					pollCount
+				});
+				throw new Error("GitHub device flow cancelled by caller");
+			}
+			pollCount++;
+			this.logger.debug("[GitHubAuthProvider] Polling for authorization", {
+				pollCount,
+				elapsedMs: Date.now() - start,
+				pollIntervalMs
+			});
+			let resp;
+			try {
+				resp = await this.cfg.fetchImpl(this.cfg.tokenUrl, {
+					method: "POST",
+					headers: {
+						Accept: "application/json",
+						"Content-Type": "application/json",
+						"User-Agent": "serviceme-core"
+					},
+					body: JSON.stringify({
+						client_id: this.cfg.clientId,
+						device_code: deviceCode,
+						grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+					})
+				});
+			} catch (error) {
+				if (!isTransientNetworkError(error)) {
+					this.logger.error("[GitHubAuthProvider] Non-retryable error while polling token endpoint", error instanceof Error ? error.message : String(error), { pollCount });
+					throw error;
+				}
+				const nextPollIntervalMs = Math.min(Math.round(pollIntervalMs * 1.5), this.cfg.maxPollIntervalMs);
+				this.logger.warn("[GitHubAuthProvider] Transient network error while polling, backing off", {
+					pollCount,
+					error: error instanceof Error ? error.message : String(error),
+					previousPollIntervalMs: pollIntervalMs,
+					nextPollIntervalMs
+				});
+				pollIntervalMs = nextPollIntervalMs;
+				continue;
+			}
+			if (!resp.ok) {
+				const nextPollIntervalMs = Math.min(Math.round(pollIntervalMs * 1.5), this.cfg.maxPollIntervalMs);
+				this.logger.warn("[GitHubAuthProvider] Token endpoint returned non-OK status, backing off", {
+					pollCount,
+					status: resp.status,
+					previousPollIntervalMs: pollIntervalMs,
+					nextPollIntervalMs
+				});
+				pollIntervalMs = nextPollIntervalMs;
+				continue;
+			}
+			const data = await resp.json();
+			if (data.access_token) {
+				this.logger.info("[GitHubAuthProvider] Authorization granted, fetching user profile", {
+					pollCount,
+					elapsedMs: Date.now() - start
+				});
+				const rawUser = await this.fetchGitHubUser(data.access_token);
+				const email = await this.resolveEmail(data.access_token, rawUser);
+				this.logger.info("[GitHubAuthProvider] Device-flow login completed", {
+					pollCount,
+					elapsedMs: Date.now() - start,
+					login: rawUser.login
+				});
+				return {
+					token: data.access_token,
+					refreshToken: data.refresh_token,
+					expiresIn: data.expires_in,
+					user: {
+						id: String(rawUser.id),
+						login: rawUser.login,
+						name: rawUser.name ?? void 0,
+						email: email ?? null,
+						avatarUrl: rawUser.avatar_url ?? void 0
+					}
+				};
+			}
+			if (data.error === "authorization_pending") {
+				this.logger.debug("[GitHubAuthProvider] Authorization still pending", {
+					pollCount,
+					elapsedMs: Date.now() - start
+				});
+				continue;
+			}
+			if (data.error === "slow_down") {
+				consecutiveSlowDown++;
+				const nextPollIntervalMs = Math.min(pollIntervalMs + 5e3, this.cfg.maxPollIntervalMs);
+				this.logger.warn("[GitHubAuthProvider] GitHub requested slower polling (slow_down)", {
+					pollCount,
+					consecutiveSlowDown,
+					previousPollIntervalMs: pollIntervalMs,
+					nextPollIntervalMs
+				});
+				pollIntervalMs = nextPollIntervalMs;
+				continue;
+			}
+			if (data.error === "access_denied") {
+				this.logger.warn("[GitHubAuthProvider] User denied authorization", { pollCount });
+				throw new Error("User denied authorization");
+			}
+			if (data.error === "expired_token") {
+				this.logger.warn("[GitHubAuthProvider] Device code expired before authorization completed", {
+					pollCount,
+					elapsedMs: Date.now() - start
+				});
+				throw new Error("GitHub device code expired — restart the flow");
+			}
+			this.logger.error("[GitHubAuthProvider] Unexpected device-flow error from token endpoint", data.error ?? "unknown", { pollCount });
+			throw new Error(`GitHub device flow error: ${data.error ?? "unknown"}`);
+		}
+	}
+	async refreshAccessToken(refreshToken) {
+		if (!refreshToken) throw new Error("refreshAccessToken requires a non-empty refresh token");
+		const resp = await this.cfg.fetchImpl(this.cfg.tokenUrl, {
+			method: "POST",
+			headers: {
+				Accept: "application/json",
+				"Content-Type": "application/json",
+				"User-Agent": "serviceme-core"
+			},
+			body: JSON.stringify({
+				client_id: this.cfg.clientId,
+				grant_type: "refresh_token",
+				refresh_token: refreshToken
+			})
+		});
+		if (!resp.ok) throw new Error(`GitHub refresh failed: HTTP ${resp.status}`);
+		const data = await resp.json();
+		if (!data.access_token) throw new Error(`GitHub refresh failed: ${data.error ?? "no_access_token"}`);
+		const rawUser = await this.fetchGitHubUser(data.access_token);
+		const email = await this.resolveEmail(data.access_token, rawUser);
+		return {
+			token: data.access_token,
+			refreshToken: data.refresh_token ?? refreshToken,
+			expiresIn: data.expires_in,
+			user: {
+				id: String(rawUser.id),
+				login: rawUser.login,
+				name: rawUser.name ?? void 0,
+				email: email ?? null,
+				avatarUrl: rawUser.avatar_url ?? void 0
+			}
+		};
+	}
+	async validateToken(token) {
+		try {
+			const resp = await this.cfg.fetchImpl(this.cfg.userUrl, { headers: {
+				Accept: "application/vnd.github+json",
+				Authorization: `Bearer ${token}`,
+				"User-Agent": "serviceme-core"
+			} });
+			if (resp.status === 401) return false;
+			if (!resp.ok) throw new Error(`GitHub /user returned HTTP ${resp.status}`);
+			return true;
+		} catch (err) {
+			if (err instanceof Error && err.message.includes("401")) return false;
+			throw err;
+		}
+	}
+	async fetchAccountMeta(token) {
+		const user = await this.fetchGitHubUser(token);
+		const email = await this.resolveEmail(token, user);
+		return {
+			id: String(user.id),
+			provider: this.providerId,
+			displayName: user.name ?? user.login,
+			login: user.login,
+			email: email ?? buildGitHubLocalEmail(user.login),
+			avatarUrl: user.avatar_url ?? void 0,
+			expiresAt: null
+		};
+	}
+	async fetchGitHubUser(token) {
+		const resp = await this.cfg.fetchImpl(this.cfg.userUrl, { headers: {
+			Accept: "application/vnd.github+json",
+			Authorization: `Bearer ${token}`,
+			"User-Agent": "serviceme-core"
+		} });
+		if (!resp.ok) throw new Error(`GitHub /user failed: HTTP ${resp.status}`);
+		return await resp.json();
+	}
+	/**
+	* GitHub's `/user` endpoint returns `null` when the user kept their
+	* email private. The `/user/emails` endpoint reveals verified emails;
+	* we pick the primary one, falling back to the synthetic
+	* `<login>@github.local` form so the account is never email-less.
+	*/
+	async resolveEmail(token, user) {
+		if (user.email) return user.email;
+		const emailsResp = await this.cfg.fetchImpl("https://api.github.com/user/emails", { headers: {
+			Accept: "application/vnd.github+json",
+			Authorization: `Bearer ${token}`,
+			"User-Agent": "serviceme-core"
+		} });
+		if (!emailsResp.ok) return null;
+		return (await emailsResp.json()).find((e) => e.primary && e.verified)?.email ?? null;
+	}
+};
+function sleep(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//#endregion
+//#region src/auth/providers/MicrosoftAuthProvider.ts
+/**
+* Error thrown when callers invoke Microsoft auth from a non-Extension
+* runtime (CLI / Bridge). The CLI maps this to `AUTH_PROVIDER_REQUIRES_HOST`
+* so the user is prompted to retry inside VSCode.
+*/
+var MicrosoftProviderNotHostedError = class extends Error {
+	constructor(message = "Microsoft auth requires the VSCode host; CLI does not yet implement MSA device flow") {
+		super(message);
+		this.name = "MicrosoftProviderNotHostedError";
+	}
+};
+var MicrosoftAuthProvider = class {
+	constructor() {
+		this.providerId = "microsoft";
+	}
+	async requestDeviceFlow() {
+		throw new MicrosoftProviderNotHostedError();
+	}
+	async completeDeviceFlow(_deviceCode, _shouldContinue) {
+		throw new MicrosoftProviderNotHostedError();
+	}
+	async refreshAccessToken(_refreshToken) {
+		throw new MicrosoftProviderNotHostedError();
+	}
+	async validateToken(_token) {
+		throw new MicrosoftProviderNotHostedError();
+	}
+	async fetchAccountMeta(_token) {
+		throw new MicrosoftProviderNotHostedError();
+	}
+};
+//#endregion
+export { isGitHubLocalEmail as a, KeychainUnavailableError as c, AuthStateManager as d, createConsoleLogger as f, buildGitHubLocalEmail as i, AuthCore as l, AccessControl as m, MicrosoftProviderNotHostedError as n, resolvePrimaryEmail as o, noopLogger as p, GitHubAuthProvider as r, InMemoryKeychainAuthTokenStore as s, MicrosoftAuthProvider as t, ProviderRegistry as u };
+
+//# sourceMappingURL=auth-Bzss8zOv.mjs.map