@softeria/ms-365-mcp-server 0.11.4 → 0.12.0

package/dist/auth.js

@@ -1,450 +1,437 @@
-import { PublicClientApplication } from '@azure/msal-node';
-import keytar from 'keytar';
-import { fileURLToPath } from 'url';
-import path from 'path';
-import fs from 'fs';
-import logger from './logger.js';
+import { PublicClientApplication } from "@azure/msal-node";
+import keytar from "keytar";
+import logger from "./logger.js";
+import { existsSync, readFileSync } from "fs";
+import { fileURLToPath } from "url";
+import path from "path";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
-const endpointsPath = path.join(__dirname, 'endpoints.json');
+const endpointsData = JSON.parse(
+  readFileSync(path.join(__dirname, "endpoints.json"), "utf8")
+);
 const endpoints = {
-    default: JSON.parse(fs.readFileSync(endpointsPath, 'utf8')),
+  default: endpointsData
 };
-const SERVICE_NAME = 'ms-365-mcp-server';
-const TOKEN_CACHE_ACCOUNT = 'msal-token-cache';
-const SELECTED_ACCOUNT_KEY = 'selected-account';
+const SERVICE_NAME = "ms-365-mcp-server";
+const TOKEN_CACHE_ACCOUNT = "msal-token-cache";
+const SELECTED_ACCOUNT_KEY = "selected-account";
 const FALLBACK_DIR = path.dirname(fileURLToPath(import.meta.url));
-const FALLBACK_PATH = path.join(FALLBACK_DIR, '..', '.token-cache.json');
-const SELECTED_ACCOUNT_PATH = path.join(FALLBACK_DIR, '..', '.selected-account.json');
+const FALLBACK_PATH = path.join(FALLBACK_DIR, "..", ".token-cache.json");
+const SELECTED_ACCOUNT_PATH = path.join(FALLBACK_DIR, "..", ".selected-account.json");
 const DEFAULT_CONFIG = {
-    auth: {
-        clientId: process.env.MS365_MCP_CLIENT_ID || '084a3e9f-a9f4-43f7-89f9-d229cf97853e',
-        authority: `https://login.microsoftonline.com/${process.env.MS365_MCP_TENANT_ID || 'common'}`,
-    },
+  auth: {
+    clientId: process.env.MS365_MCP_CLIENT_ID || "084a3e9f-a9f4-43f7-89f9-d229cf97853e",
+    authority: `https://login.microsoftonline.com/${process.env.MS365_MCP_TENANT_ID || "common"}`
+  }
 };
 const SCOPE_HIERARCHY = {
-    'Mail.ReadWrite': ['Mail.Read'],
-    'Calendars.ReadWrite': ['Calendars.Read'],
-    'Files.ReadWrite': ['Files.Read'],
-    'Tasks.ReadWrite': ['Tasks.Read'],
-    'Contacts.ReadWrite': ['Contacts.Read'],
+  "Mail.ReadWrite": ["Mail.Read"],
+  "Calendars.ReadWrite": ["Calendars.Read"],
+  "Files.ReadWrite": ["Files.Read"],
+  "Tasks.ReadWrite": ["Tasks.Read"],
+  "Contacts.ReadWrite": ["Contacts.Read"]
 };
 function buildScopesFromEndpoints(includeWorkAccountScopes = false) {
-    const scopesSet = new Set();
-    endpoints.default.forEach((endpoint) => {
-        if (endpoint.requiresWorkAccount && !includeWorkAccountScopes) {
-            return;
-        }
-        if (endpoint.scopes && Array.isArray(endpoint.scopes)) {
-            endpoint.scopes.forEach((scope) => scopesSet.add(scope));
-        }
-    });
-    Object.entries(SCOPE_HIERARCHY).forEach(([higherScope, lowerScopes]) => {
-        if (lowerScopes.every((scope) => scopesSet.has(scope))) {
-            lowerScopes.forEach((scope) => scopesSet.delete(scope));
-            scopesSet.add(higherScope);
-        }
-    });
-    return Array.from(scopesSet);
+  const scopesSet = /* @__PURE__ */ new Set();
+  endpoints.default.forEach((endpoint) => {
+    if (endpoint.requiresWorkAccount && !includeWorkAccountScopes) {
+      return;
+    }
+    if (endpoint.scopes && Array.isArray(endpoint.scopes)) {
+      endpoint.scopes.forEach((scope) => scopesSet.add(scope));
+    }
+  });
+  Object.entries(SCOPE_HIERARCHY).forEach(([higherScope, lowerScopes]) => {
+    if (lowerScopes.every((scope) => scopesSet.has(scope))) {
+      lowerScopes.forEach((scope) => scopesSet.delete(scope));
+      scopesSet.add(higherScope);
+    }
+  });
+  return Array.from(scopesSet);
 }
 function buildAllScopes() {
-    return buildScopesFromEndpoints(true);
+  return buildScopesFromEndpoints(true);
 }
 class AuthManager {
-    constructor(config = DEFAULT_CONFIG, scopes = buildScopesFromEndpoints()) {
-        logger.info(`And scopes are ${scopes.join(', ')}`, scopes);
-        this.config = config;
-        this.scopes = scopes;
-        this.msalApp = new PublicClientApplication(this.config);
-        this.accessToken = null;
-        this.tokenExpiry = null;
-        this.selectedAccountId = null;
-        const oauthTokenFromEnv = process.env.MS365_MCP_OAUTH_TOKEN;
-        this.oauthToken = oauthTokenFromEnv ?? null;
-        this.isOAuthMode = oauthTokenFromEnv != null;
+  constructor(config = DEFAULT_CONFIG, scopes = buildScopesFromEndpoints()) {
+    logger.info(`And scopes are ${scopes.join(", ")}`, scopes);
+    this.config = config;
+    this.scopes = scopes;
+    this.msalApp = new PublicClientApplication(this.config);
+    this.accessToken = null;
+    this.tokenExpiry = null;
+    this.selectedAccountId = null;
+    const oauthTokenFromEnv = process.env.MS365_MCP_OAUTH_TOKEN;
+    this.oauthToken = oauthTokenFromEnv ?? null;
+    this.isOAuthMode = oauthTokenFromEnv != null;
+  }
+  async loadTokenCache() {
+    try {
+      let cacheData;
+      try {
+        const cachedData = await keytar.getPassword(SERVICE_NAME, TOKEN_CACHE_ACCOUNT);
+        if (cachedData) {
+          cacheData = cachedData;
+        }
+      } catch (keytarError) {
+        logger.warn(
+          `Keychain access failed, falling back to file storage: ${keytarError.message}`
+        );
+      }
+      if (!cacheData && existsSync(FALLBACK_PATH)) {
+        cacheData = readFileSync(FALLBACK_PATH, "utf8");
+      }
+      if (cacheData) {
+        this.msalApp.getTokenCache().deserialize(cacheData);
+      }
+      await this.loadSelectedAccount();
+    } catch (error) {
+      logger.error(`Error loading token cache: ${error.message}`);
     }
-    async loadTokenCache() {
-        try {
-            let cacheData;
-            try {
-                const cachedData = await keytar.getPassword(SERVICE_NAME, TOKEN_CACHE_ACCOUNT);
-                if (cachedData) {
-                    cacheData = cachedData;
-                }
-            }
-            catch (keytarError) {
-                logger.warn(`Keychain access failed, falling back to file storage: ${keytarError.message}`);
-            }
-            if (!cacheData && fs.existsSync(FALLBACK_PATH)) {
-                cacheData = fs.readFileSync(FALLBACK_PATH, 'utf8');
-            }
-            if (cacheData) {
-                this.msalApp.getTokenCache().deserialize(cacheData);
-            }
-            // Load selected account
-            await this.loadSelectedAccount();
-        }
-        catch (error) {
-            logger.error(`Error loading token cache: ${error.message}`);
-        }
+  }
+  async loadSelectedAccount() {
+    try {
+      let selectedAccountData;
+      try {
+        const cachedData = await keytar.getPassword(SERVICE_NAME, SELECTED_ACCOUNT_KEY);
+        if (cachedData) {
+          selectedAccountData = cachedData;
+        }
+      } catch (keytarError) {
+        logger.warn(
+          `Keychain access failed for selected account, falling back to file storage: ${keytarError.message}`
+        );
+      }
+      if (!selectedAccountData && existsSync(SELECTED_ACCOUNT_PATH)) {
+        selectedAccountData = readFileSync(SELECTED_ACCOUNT_PATH, "utf8");
+      }
+      if (selectedAccountData) {
+        const parsed = JSON.parse(selectedAccountData);
+        this.selectedAccountId = parsed.accountId;
+        logger.info(`Loaded selected account: ${this.selectedAccountId}`);
+      }
+    } catch (error) {
+      logger.error(`Error loading selected account: ${error.message}`);
     }
-    async loadSelectedAccount() {
-        try {
-            let selectedAccountData;
-            try {
-                const cachedData = await keytar.getPassword(SERVICE_NAME, SELECTED_ACCOUNT_KEY);
-                if (cachedData) {
-                    selectedAccountData = cachedData;
-                }
-            }
-            catch (keytarError) {
-                logger.warn(`Keychain access failed for selected account, falling back to file storage: ${keytarError.message}`);
-            }
-            if (!selectedAccountData && fs.existsSync(SELECTED_ACCOUNT_PATH)) {
-                selectedAccountData = fs.readFileSync(SELECTED_ACCOUNT_PATH, 'utf8');
-            }
-            if (selectedAccountData) {
-                const parsed = JSON.parse(selectedAccountData);
-                this.selectedAccountId = parsed.accountId;
-                logger.info(`Loaded selected account: ${this.selectedAccountId}`);
-            }
-        }
-        catch (error) {
-            logger.error(`Error loading selected account: ${error.message}`);
-        }
+  }
+  async saveTokenCache() {
+    try {
+      const cacheData = this.msalApp.getTokenCache().serialize();
+      try {
+        await keytar.setPassword(SERVICE_NAME, TOKEN_CACHE_ACCOUNT, cacheData);
+      } catch (keytarError) {
+        logger.warn(
+          `Keychain save failed, falling back to file storage: ${keytarError.message}`
+        );
+        fs.writeFileSync(FALLBACK_PATH, cacheData);
+      }
+    } catch (error) {
+      logger.error(`Error saving token cache: ${error.message}`);
     }
-    async saveTokenCache() {
-        try {
-            const cacheData = this.msalApp.getTokenCache().serialize();
-            try {
-                await keytar.setPassword(SERVICE_NAME, TOKEN_CACHE_ACCOUNT, cacheData);
-            }
-            catch (keytarError) {
-                logger.warn(`Keychain save failed, falling back to file storage: ${keytarError.message}`);
-                fs.writeFileSync(FALLBACK_PATH, cacheData);
-            }
-        }
-        catch (error) {
-            logger.error(`Error saving token cache: ${error.message}`);
-        }
+  }
+  async saveSelectedAccount() {
+    try {
+      const selectedAccountData = JSON.stringify({ accountId: this.selectedAccountId });
+      try {
+        await keytar.setPassword(SERVICE_NAME, SELECTED_ACCOUNT_KEY, selectedAccountData);
+      } catch (keytarError) {
+        logger.warn(
+          `Keychain save failed for selected account, falling back to file storage: ${keytarError.message}`
+        );
+        fs.writeFileSync(SELECTED_ACCOUNT_PATH, selectedAccountData);
+      }
+    } catch (error) {
+      logger.error(`Error saving selected account: ${error.message}`);
     }
-    async saveSelectedAccount() {
-        try {
-            const selectedAccountData = JSON.stringify({ accountId: this.selectedAccountId });
-            try {
-                await keytar.setPassword(SERVICE_NAME, SELECTED_ACCOUNT_KEY, selectedAccountData);
-            }
-            catch (keytarError) {
-                logger.warn(`Keychain save failed for selected account, falling back to file storage: ${keytarError.message}`);
-                fs.writeFileSync(SELECTED_ACCOUNT_PATH, selectedAccountData);
-            }
-        }
-        catch (error) {
-            logger.error(`Error saving selected account: ${error.message}`);
-        }
+  }
+  async setOAuthToken(token) {
+    this.oauthToken = token;
+    this.isOAuthMode = true;
+  }
+  async getToken(forceRefresh = false) {
+    if (this.isOAuthMode && this.oauthToken) {
+      return this.oauthToken;
     }
-    async setOAuthToken(token) {
-        this.oauthToken = token;
-        this.isOAuthMode = true;
+    if (this.accessToken && this.tokenExpiry && this.tokenExpiry > Date.now() && !forceRefresh) {
+      return this.accessToken;
     }
-    async getToken(forceRefresh = false) {
-        if (this.isOAuthMode && this.oauthToken) {
-            return this.oauthToken;
-        }
-        if (this.accessToken && this.tokenExpiry && this.tokenExpiry > Date.now() && !forceRefresh) {
-            return this.accessToken;
-        }
-        const currentAccount = await this.getCurrentAccount();
-        if (currentAccount) {
-            const silentRequest = {
-                account: currentAccount,
-                scopes: this.scopes,
-            };
-            try {
-                const response = await this.msalApp.acquireTokenSilent(silentRequest);
-                this.accessToken = response.accessToken;
-                this.tokenExpiry = response.expiresOn ? new Date(response.expiresOn).getTime() : null;
-                return this.accessToken;
-            }
-            catch (error) {
-                logger.error('Silent token acquisition failed');
-                throw new Error('Silent token acquisition failed');
-            }
-        }
-        throw new Error('No valid token found');
+    const currentAccount = await this.getCurrentAccount();
+    if (currentAccount) {
+      const silentRequest = {
+        account: currentAccount,
+        scopes: this.scopes
+      };
+      try {
+        const response = await this.msalApp.acquireTokenSilent(silentRequest);
+        this.accessToken = response.accessToken;
+        this.tokenExpiry = response.expiresOn ? new Date(response.expiresOn).getTime() : null;
+        return this.accessToken;
+      } catch (error) {
+        logger.error("Silent token acquisition failed");
+        throw new Error("Silent token acquisition failed");
+      }
     }
-    async getCurrentAccount() {
-        const accounts = await this.msalApp.getTokenCache().getAllAccounts();
-        if (accounts.length === 0) {
-            return null;
-        }
-        // If a specific account is selected, find it
-        if (this.selectedAccountId) {
-            const selectedAccount = accounts.find((account) => account.homeAccountId === this.selectedAccountId);
-            if (selectedAccount) {
-                return selectedAccount;
-            }
-            logger.warn(`Selected account ${this.selectedAccountId} not found, falling back to first account`);
-        }
-        // Fall back to first account (backward compatibility)
-        return accounts[0];
+    throw new Error("No valid token found");
+  }
+  async getCurrentAccount() {
+    const accounts = await this.msalApp.getTokenCache().getAllAccounts();
+    if (accounts.length === 0) {
+      return null;
     }
-    async acquireTokenByDeviceCode(hack) {
-        const deviceCodeRequest = {
-            scopes: this.scopes,
-            deviceCodeCallback: (response) => {
-                const text = ['\n', response.message, '\n'].join('');
-                if (hack) {
-                    hack(text + 'After login run the "verify login" command');
-                }
-                else {
-                    console.log(text);
-                }
-                logger.info('Device code login initiated');
-            },
-        };
-        try {
-            logger.info('Requesting device code...');
-            logger.info(`Requesting scopes: ${this.scopes.join(', ')}`);
-            const response = await this.msalApp.acquireTokenByDeviceCode(deviceCodeRequest);
-            logger.info(`Granted scopes: ${response?.scopes?.join(', ') || 'none'}`);
-            logger.info('Device code login successful');
-            this.accessToken = response?.accessToken || null;
-            this.tokenExpiry = response?.expiresOn ? new Date(response.expiresOn).getTime() : null;
-            // Set the newly authenticated account as selected if no account is currently selected
-            if (!this.selectedAccountId && response?.account) {
-                this.selectedAccountId = response.account.homeAccountId;
-                await this.saveSelectedAccount();
-                logger.info(`Auto-selected new account: ${response.account.username}`);
-            }
-            await this.saveTokenCache();
-            return this.accessToken;
-        }
-        catch (error) {
-            logger.error(`Error in device code flow: ${error.message}`);
-            throw error;
-        }
+    if (this.selectedAccountId) {
+      const selectedAccount = accounts.find(
+        (account) => account.homeAccountId === this.selectedAccountId
+      );
+      if (selectedAccount) {
+        return selectedAccount;
+      }
+      logger.warn(
+        `Selected account ${this.selectedAccountId} not found, falling back to first account`
+      );
     }
-    async testLogin() {
-        try {
-            logger.info('Testing login...');
-            const token = await this.getToken();
-            if (!token) {
-                logger.error('Login test failed - no token received');
-                return {
-                    success: false,
-                    message: 'Login failed - no token received',
-                };
-            }
-            logger.info('Token retrieved successfully, testing Graph API access...');
-            try {
-                const response = await fetch('https://graph.microsoft.com/v1.0/me', {
-                    headers: {
-                        Authorization: `Bearer ${token}`,
-                    },
-                });
-                if (response.ok) {
-                    const userData = await response.json();
-                    logger.info('Graph API user data fetch successful');
-                    return {
-                        success: true,
-                        message: 'Login successful',
-                        userData: {
-                            displayName: userData.displayName,
-                            userPrincipalName: userData.userPrincipalName,
-                        },
-                    };
-                }
-                else {
-                    const errorText = await response.text();
-                    logger.error(`Graph API user data fetch failed: ${response.status} - ${errorText}`);
-                    return {
-                        success: false,
-                        message: `Login successful but Graph API access failed: ${response.status}`,
-                    };
-                }
-            }
-            catch (graphError) {
-                logger.error(`Error fetching user data: ${graphError.message}`);
-                return {
-                    success: false,
-                    message: `Login successful but Graph API access failed: ${graphError.message}`,
-                };
-            }
-        }
-        catch (error) {
-            logger.error(`Login test failed: ${error.message}`);
-            return {
-                success: false,
-                message: `Login failed: ${error.message}`,
-            };
-        }
+    return accounts[0];
+  }
+  async acquireTokenByDeviceCode(hack) {
+    const deviceCodeRequest = {
+      scopes: this.scopes,
+      deviceCodeCallback: (response) => {
+        const text = ["\n", response.message, "\n"].join("");
+        if (hack) {
+          hack(text + 'After login run the "verify login" command');
+        } else {
+          console.log(text);
+        }
+        logger.info("Device code login initiated");
+      }
+    };
+    try {
+      logger.info("Requesting device code...");
+      logger.info(`Requesting scopes: ${this.scopes.join(", ")}`);
+      const response = await this.msalApp.acquireTokenByDeviceCode(deviceCodeRequest);
+      logger.info(`Granted scopes: ${response?.scopes?.join(", ") || "none"}`);
+      logger.info("Device code login successful");
+      this.accessToken = response?.accessToken || null;
+      this.tokenExpiry = response?.expiresOn ? new Date(response.expiresOn).getTime() : null;
+      if (!this.selectedAccountId && response?.account) {
+        this.selectedAccountId = response.account.homeAccountId;
+        await this.saveSelectedAccount();
+        logger.info(`Auto-selected new account: ${response.account.username}`);
+      }
+      await this.saveTokenCache();
+      return this.accessToken;
+    } catch (error) {
+      logger.error(`Error in device code flow: ${error.message}`);
+      throw error;
     }
-    async logout() {
-        try {
-            const accounts = await this.msalApp.getTokenCache().getAllAccounts();
-            for (const account of accounts) {
-                await this.msalApp.getTokenCache().removeAccount(account);
-            }
-            this.accessToken = null;
-            this.tokenExpiry = null;
-            this.selectedAccountId = null;
-            try {
-                await keytar.deletePassword(SERVICE_NAME, TOKEN_CACHE_ACCOUNT);
-                await keytar.deletePassword(SERVICE_NAME, SELECTED_ACCOUNT_KEY);
-            }
-            catch (keytarError) {
-                logger.warn(`Keychain deletion failed: ${keytarError.message}`);
-            }
-            if (fs.existsSync(FALLBACK_PATH)) {
-                fs.unlinkSync(FALLBACK_PATH);
-            }
-            if (fs.existsSync(SELECTED_ACCOUNT_PATH)) {
-                fs.unlinkSync(SELECTED_ACCOUNT_PATH);
+  }
+  async testLogin() {
+    try {
+      logger.info("Testing login...");
+      const token = await this.getToken();
+      if (!token) {
+        logger.error("Login test failed - no token received");
+        return {
+          success: false,
+          message: "Login failed - no token received"
+        };
+      }
+      logger.info("Token retrieved successfully, testing Graph API access...");
+      try {
+        const response = await fetch("https://graph.microsoft.com/v1.0/me", {
+          headers: {
+            Authorization: `Bearer ${token}`
+          }
+        });
+        if (response.ok) {
+          const userData = await response.json();
+          logger.info("Graph API user data fetch successful");
+          return {
+            success: true,
+            message: "Login successful",
+            userData: {
+              displayName: userData.displayName,
+              userPrincipalName: userData.userPrincipalName
             }
-            return true;
-        }
-        catch (error) {
-            logger.error(`Error during logout: ${error.message}`);
-            throw error;
-        }
+          };
+        } else {
+          const errorText = await response.text();
+          logger.error(`Graph API user data fetch failed: ${response.status} - ${errorText}`);
+          return {
+            success: false,
+            message: `Login successful but Graph API access failed: ${response.status}`
+          };
+        }
+      } catch (graphError) {
+        logger.error(`Error fetching user data: ${graphError.message}`);
+        return {
+          success: false,
+          message: `Login successful but Graph API access failed: ${graphError.message}`
+        };
+      }
+    } catch (error) {
+      logger.error(`Login test failed: ${error.message}`);
+      return {
+        success: false,
+        message: `Login failed: ${error.message}`
+      };
     }
-    async hasWorkAccountPermissions() {
-        try {
-            const currentAccount = await this.getCurrentAccount();
-            if (!currentAccount) {
-                return false;
-            }
-            const workScopes = endpoints.default
-                .filter((e) => e.requiresWorkAccount)
-                .flatMap((e) => e.scopes || []);
-            try {
-                await this.msalApp.acquireTokenSilent({
-                    scopes: workScopes.slice(0, 1),
-                    account: currentAccount,
-                });
-                return true;
-            }
-            catch {
-                return false;
-            }
-        }
-        catch (error) {
-            logger.error(`Error checking work account permissions: ${error.message}`);
-            return false;
-        }
+  }
+  async logout() {
+    try {
+      const accounts = await this.msalApp.getTokenCache().getAllAccounts();
+      for (const account of accounts) {
+        await this.msalApp.getTokenCache().removeAccount(account);
+      }
+      this.accessToken = null;
+      this.tokenExpiry = null;
+      this.selectedAccountId = null;
+      try {
+        await keytar.deletePassword(SERVICE_NAME, TOKEN_CACHE_ACCOUNT);
+        await keytar.deletePassword(SERVICE_NAME, SELECTED_ACCOUNT_KEY);
+      } catch (keytarError) {
+        logger.warn(`Keychain deletion failed: ${keytarError.message}`);
+      }
+      if (fs.existsSync(FALLBACK_PATH)) {
+        fs.unlinkSync(FALLBACK_PATH);
+      }
+      if (fs.existsSync(SELECTED_ACCOUNT_PATH)) {
+        fs.unlinkSync(SELECTED_ACCOUNT_PATH);
+      }
+      return true;
+    } catch (error) {
+      logger.error(`Error during logout: ${error.message}`);
+      throw error;
     }
-    async expandToWorkAccountScopes(hack) {
-        try {
-            logger.info('Expanding to work account scopes...');
-            const allScopes = buildAllScopes();
-            const deviceCodeRequest = {
-                scopes: allScopes,
-                deviceCodeCallback: (response) => {
-                    const text = [
-                        '\n',
-                        '🔄 This feature requires additional permissions (work account scopes)',
-                        '\n',
-                        response.message,
-                        '\n',
-                    ].join('');
-                    if (hack) {
-                        hack(text + 'After login run the "verify login" command');
-                    }
-                    else {
-                        console.log(text);
-                    }
-                    logger.info('Work account scope expansion initiated');
-                },
-            };
-            const response = await this.msalApp.acquireTokenByDeviceCode(deviceCodeRequest);
-            logger.info('Work account scope expansion successful');
-            this.accessToken = response?.accessToken || null;
-            this.tokenExpiry = response?.expiresOn ? new Date(response.expiresOn).getTime() : null;
-            this.scopes = allScopes;
-            // Update selected account if this is a new account
-            if (response?.account) {
-                this.selectedAccountId = response.account.homeAccountId;
-                await this.saveSelectedAccount();
-                logger.info(`Updated selected account after scope expansion: ${response.account.username}`);
-            }
-            await this.saveTokenCache();
-            return true;
-        }
-        catch (error) {
-            logger.error(`Error expanding to work account scopes: ${error.message}`);
-            return false;
-        }
-    }
-    // Multi-account support methods
-    async listAccounts() {
-        return await this.msalApp.getTokenCache().getAllAccounts();
+  }
+  async hasWorkAccountPermissions() {
+    try {
+      const currentAccount = await this.getCurrentAccount();
+      if (!currentAccount) {
+        return false;
+      }
+      const workScopes = endpoints.default.filter((e) => e.requiresWorkAccount).flatMap((e) => e.scopes || []);
+      try {
+        await this.msalApp.acquireTokenSilent({
+          scopes: workScopes.slice(0, 1),
+          account: currentAccount
+        });
+        return true;
+      } catch {
+        return false;
+      }
+    } catch (error) {
+      logger.error(`Error checking work account permissions: ${error.message}`);
+      return false;
     }
-    async selectAccount(accountId) {
-        const accounts = await this.listAccounts();
-        const account = accounts.find((acc) => acc.homeAccountId === accountId);
-        if (!account) {
-            logger.error(`Account with ID ${accountId} not found`);
-            return false;
-        }
-        this.selectedAccountId = accountId;
+  }
+  async expandToWorkAccountScopes(hack) {
+    try {
+      logger.info("Expanding to work account scopes...");
+      const allScopes = buildAllScopes();
+      const deviceCodeRequest = {
+        scopes: allScopes,
+        deviceCodeCallback: (response2) => {
+          const text = [
+            "\n",
+            "\u{1F504} This feature requires additional permissions (work account scopes)",
+            "\n",
+            response2.message,
+            "\n"
+          ].join("");
+          if (hack) {
+            hack(text + 'After login run the "verify login" command');
+          } else {
+            console.log(text);
+          }
+          logger.info("Work account scope expansion initiated");
+        }
+      };
+      const response = await this.msalApp.acquireTokenByDeviceCode(deviceCodeRequest);
+      logger.info("Work account scope expansion successful");
+      this.accessToken = response?.accessToken || null;
+      this.tokenExpiry = response?.expiresOn ? new Date(response.expiresOn).getTime() : null;
+      this.scopes = allScopes;
+      if (response?.account) {
+        this.selectedAccountId = response.account.homeAccountId;
         await this.saveSelectedAccount();
-        // Clear cached tokens to force refresh with new account
-        this.accessToken = null;
-        this.tokenExpiry = null;
-        logger.info(`Selected account: ${account.username} (${accountId})`);
-        return true;
+        logger.info(`Updated selected account after scope expansion: ${response.account.username}`);
+      }
+      await this.saveTokenCache();
+      return true;
+    } catch (error) {
+      logger.error(`Error expanding to work account scopes: ${error.message}`);
+      return false;
     }
-    async getTokenForAccount(accountId) {
-        const accounts = await this.listAccounts();
-        const account = accounts.find((acc) => acc.homeAccountId === accountId);
-        if (!account) {
-            throw new Error(`Account with ID ${accountId} not found`);
-        }
-        const silentRequest = {
-            account: account,
-            scopes: this.scopes,
-        };
-        try {
-            const response = await this.msalApp.acquireTokenSilent(silentRequest);
-            return response.accessToken;
-        }
-        catch (error) {
-            logger.error(`Failed to get token for account ${accountId}: ${error.message}`);
-            throw error;
-        }
+  }
+  // Multi-account support methods
+  async listAccounts() {
+    return await this.msalApp.getTokenCache().getAllAccounts();
+  }
+  async selectAccount(accountId) {
+    const accounts = await this.listAccounts();
+    const account = accounts.find((acc) => acc.homeAccountId === accountId);
+    if (!account) {
+      logger.error(`Account with ID ${accountId} not found`);
+      return false;
     }
-    async removeAccount(accountId) {
-        const accounts = await this.listAccounts();
-        const account = accounts.find((acc) => acc.homeAccountId === accountId);
-        if (!account) {
-            logger.error(`Account with ID ${accountId} not found`);
-            return false;
-        }
-        try {
-            await this.msalApp.getTokenCache().removeAccount(account);
-            // If this was the selected account, clear the selection
-            if (this.selectedAccountId === accountId) {
-                this.selectedAccountId = null;
-                await this.saveSelectedAccount();
-                this.accessToken = null;
-                this.tokenExpiry = null;
-            }
-            logger.info(`Removed account: ${account.username} (${accountId})`);
-            return true;
-        }
-        catch (error) {
-            logger.error(`Failed to remove account ${accountId}: ${error.message}`);
-            return false;
-        }
+    this.selectedAccountId = accountId;
+    await this.saveSelectedAccount();
+    this.accessToken = null;
+    this.tokenExpiry = null;
+    logger.info(`Selected account: ${account.username} (${accountId})`);
+    return true;
+  }
+  async getTokenForAccount(accountId) {
+    const accounts = await this.listAccounts();
+    const account = accounts.find((acc) => acc.homeAccountId === accountId);
+    if (!account) {
+      throw new Error(`Account with ID ${accountId} not found`);
+    }
+    const silentRequest = {
+      account,
+      scopes: this.scopes
+    };
+    try {
+      const response = await this.msalApp.acquireTokenSilent(silentRequest);
+      return response.accessToken;
+    } catch (error) {
+      logger.error(`Failed to get token for account ${accountId}: ${error.message}`);
+      throw error;
     }
-    getSelectedAccountId() {
-        return this.selectedAccountId;
+  }
+  async removeAccount(accountId) {
+    const accounts = await this.listAccounts();
+    const account = accounts.find((acc) => acc.homeAccountId === accountId);
+    if (!account) {
+      logger.error(`Account with ID ${accountId} not found`);
+      return false;
     }
-    requiresWorkAccountScope(toolName) {
-        const endpoint = endpoints.default.find((e) => e.toolName === toolName);
-        return endpoint?.requiresWorkAccount === true;
+    try {
+      await this.msalApp.getTokenCache().removeAccount(account);
+      if (this.selectedAccountId === accountId) {
+        this.selectedAccountId = null;
+        await this.saveSelectedAccount();
+        this.accessToken = null;
+        this.tokenExpiry = null;
+      }
+      logger.info(`Removed account: ${account.username} (${accountId})`);
+      return true;
+    } catch (error) {
+      logger.error(`Failed to remove account ${accountId}: ${error.message}`);
+      return false;
     }
+  }
+  getSelectedAccountId() {
+    return this.selectedAccountId;
+  }
+  requiresWorkAccountScope(toolName) {
+    const endpoint = endpoints.default.find((e) => e.toolName === toolName);
+    return endpoint?.requiresWorkAccount === true;
+  }
 }
-export default AuthManager;
-export { buildScopesFromEndpoints, buildAllScopes };
+var auth_default = AuthManager;
+export {
+  buildAllScopes,
+  buildScopesFromEndpoints,
+  auth_default as default
+};