@vigilbase/cli 0.1.4 → 0.2.0

package/README.md

@@ -6,7 +6,8 @@ monitoring, organization, and support operations from the terminal.
 ## Install and sign in
 
 Node 20+ is required. Node 22.19+ or Node 24.5+ enables automatic system
-certificate trust.
+certificate trust. `cloudflare-checkup` needs Node 22.18+, because it runs
+Cloudflare's `cf` under the same Node.
 
 ```bash
 npm install -g @vigilbase/cli
@@ -32,6 +33,7 @@ preserved; resolve a conflicting installation yourself before linking.
 | [CLOUDFLARE.md](./CLOUDFLARE.md) | Accounts, zones, DNS, WAF, analytics, Zero Trust, Workers/Pages, audit, checkups |
 | [SECURITY.md](./SECURITY.md) | Incidents, logs, intelligence, analytics, assets, connections, policies, notifications, reports |
 | [ONE.md](./ONE.md) | Customer records/billing/reports/investigations, organizations, monitoring, support |
+| [LOCAL.md](./LOCAL.md) | `cloudflare-checkup`: one command that verifies your work email, collects Cloudflare config on your machine with Cloudflare's `cf` and uploads it after you confirm |
 
 These references ship with the npm package. Built-in help is available through
 `vigilbase <command> --help` or `vigilbase help <command>`.
@@ -113,7 +115,8 @@ billing portal sessions, scans, and checkup starts).
 Every command supports `-j` / `--json`. JSON goes to stdout; progress and browser
 instructions go to stderr. Progress animations are disabled for JSON, CI, and
 non-TTY output. Preserve JSON pagination fields when fetching subsequent pages;
-list commands do not silently fetch every page. New text views display complete
+list commands do not silently fetch every page (local collection pages through
+every list by design). New text views display complete
 identifiers. All human-readable output removes terminal control sequences and
 bidirectional overrides, including identities, tool results, skills, and errors.
 JSON preserves successful response data with control characters escaped. Default
@@ -130,6 +133,26 @@ Commands use named One APIs and existing server authorization. They do not accep
 Cloudflare/provider secrets, delegated identity claims, or an arbitrary upstream
 URL. Billing records are fetched on demand and not persisted by the CLI.
 
+Exception: `vigilbase cloudflare-checkup` (also `local cloudflare-checkup`) runs
+Cloudflare's own `cf` CLI on your machine with a fixed allowlist of read-only
+commands. cf owns your Cloudflare login; the Vigilbase CLI never reads, prints,
+stores or uploads it. Its only Vigilbase requests are the email verification
+and the explicit upload of a snapshot file you can inspect, after you confirm.
+The command asks for your work email, and vigilbase.com emails you a 6-digit
+code to enter; it then installs cf if needed (asks first), signs in read-only,
+lets you choose the account, collects, uploads and prints the results link
+(opening it in your browser on macOS and Linux).
+Results go to the verified address. Your email address goes to vigilbase.com
+only so it can send the code; the CLI never prints, logs or stores it (it shows
+the masked `j***@acme.com`). In a terminal the steps show as an interactive
+timeline with arrow-key questions; pipes, CI, `TERM=dumb` and `--json` get
+plain lines. See [LOCAL.md](./LOCAL.md).
+
+```bash
+npx @vigilbase/cli cloudflare-checkup          # also shown at https://vigilbase.com/tools/cloudflare-checkup?mode=local
+npx @vigilbase/cli cloudflare-checkup logout   # later: remove the read-only cf login and the cf it installed
+```
+
 ## Login and configuration
 
 `login` opens a browser and waits for device approval. On remote terminals, run
@@ -144,26 +167,45 @@ The credential directory must be an absolute path, owned by the current user,
 and mode `0700`; `credentials.json` must be an owned regular file with mode
 `0600`. Symlinks, hard links, and unsafe parent directories are rejected. Existing
 files with broader permissions require `chmod 700 <config-directory>` and
-`chmod 600 <config-directory>/credentials.json`. Only the access token and session
-metadata are saved; unused refresh tokens are never persisted.
+`chmod 600 <config-directory>/credentials.json`. Legacy manual/session credentials contain only access-token metadata. Identity
+credentials use version 2 and store the rotating refresh token with its issuer,
+client and One resource binding.
 
 Credentials are stored atomically in `~/.config/vigilbase/credentials.json` with
 owner-only file permissions. `XDG_CONFIG_HOME` or `VIGILBASE_CONFIG_DIR` can change
 the location. Tokens are restricted to their issuing One origin. Legacy credential
 files remain valid for production only; re-login for a custom One origin.
-`whoami` validates the live session. `logout` removes the local credential file.
+`login` reads One's protected-resource discovery at runtime. Until cutover, One
+advertises its legacy device flow (missing metadata also retains that flow).
+After cutover it advertises Identity, which grants a token for the organization
+you choose during device approval. `whoami` and `doctor` use Identity userinfo
+for these grants. `logout` revokes the Identity refresh token before removing the
+local file; legacy logout remains local. Network failures retain the file for retry.
+
+Identity access tokens last five minutes. Refresh starts within 60 seconds of
+expiry, or once after One returns 401. An exclusive credentials lock coordinates
+independent CLI processes; each holder rereads the file before rotating. A durable
+pending marker prevents retry after an uncertain token exchange. Run `login`
+again after an uncertain refresh. Fresh login/logout may retire a dead process's
+owned lock, but never steal a live process lock. If a damaged lock cannot be
+recovered, stop all CLI processes before removing `credentials.json.lock` and
+logging in again. Never reuse the refresh token manually.
 
 | Option | Environment variable | Default |
 | --- | --- | --- |
 | `--base-url <origin>` | `VIGILBASE_BASE_URL` | `https://vigilbase.com` |
 | `--one-url <origin>` | `VIGILBASE_ONE_URL` | `https://one.vigilbase.com` |
+| `--auth-url <origin>` | `VIGILBASE_AUTH_URL` | issuer selected by One discovery |
 | `--client-id <id>` | `VIGILBASE_CLIENT_ID` | `vigilbase-cli` |
 | `--timeout <ms>` | — | `60000` per request |
 
 Origins must be HTTP(S) URLs without paths, credentials, or queries. Authenticated
 One origins require HTTPS. HTTP is allowed only for loopback development
 (`localhost`, `127.0.0.0/8`, or `::1`). This applies to device authorization,
-explicit tokens, and saved sessions. API redirects are refused.
+explicit tokens, and saved sessions. Identity issuer and endpoint origins are
+restricted to `auth.vigilbase.com` and `identity-staging.vigilbase.com`; local
+Identity requires explicit `--auth-url` and a loopback One origin. Arbitrary
+issuers, endpoints, and API redirects are refused.
 `VIGILBASE_API_URL` and `VIGILBASE_PUBLIC_URL` are legacy public-origin aliases,
 used after `VIGILBASE_BASE_URL` when no explicit flag is supplied.
 `VIGILBASE_CLI_NO_OPEN=1` disables automatic browser opening.
@@ -216,6 +258,16 @@ operation in both JSON and text, with exact methods, paths, query filters, beare
 headers, bodies, error exits, and included documentation. Fixtures use temporary
 credentials and a loopback server; simulated mutations never touch production.
 
+The local Cloudflare Checkup has a cross-package end-to-end test in apps/com: the
+built CLI collects through the smoke's fake `cf` and uploads to the real
+vigilbase.com route handlers, with One's tool-runs API faked on loopback. Run it
+after a build:
+
+```bash
+pnpm --filter @vigilbase/cli build
+pnpm --filter com exec vitest run lib/cloudflare-checkup/local/__tests__/e2e-local-cli.test.ts
+```
+
 The separate `smoke:e2e` script runs real public scanners. Configure
 `VIGILBASE_BASE_URL` and `VIGILBASE_SMOKE_ARTIFACTS` as shown in COMMANDS.md.
 Authenticated production verification requires a valid One session and appropriate

package/dist/auth/device-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"device-auth.d.ts","sourceRoot":"","sources":["../../src/auth/device-auth.ts"],"names":[],"mappings":"AAGA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,EACnB,MAAM,YAAY,CAAA;AAOnB,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;gBAGpB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE;CAQ7D;AAkCD,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,SAAS,EACjB,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAgC7B;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,kBAAkB,CAAA;CAAE,GACnD;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,uBAAuB,CAAA;CAAE,GACrD;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,uBAAuB,CAAA;CAAE,GACpD;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,uBAAuB,CAAA;CAAE,GACrD;IACE,MAAM,EAAE,WAAW,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,uBAAuB,CAAA;CAC/B,CAAA;AAEL,wBAAsB,eAAe,CACnC,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,UAAU,CAAC,CA2ErB;AAED,wBAAsB,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAc3E;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,kBAAkB,EAC1B,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE;QACjB,OAAO,EAAE,MAAM,CAAA;QACf,WAAW,EAAE,MAAM,CAAA;QACnB,IAAI,EAAE,SAAS,GAAG,WAAW,CAAA;KAC9B,KAAK,IAAI,CAAA;IACV,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,uBAAuB,CAAC,EAAE,MAAM,CAAA;CACjC,GACA,OAAO,CAAC,kBAAkB,CAAC,CAkF7B"}
+{"version":3,"file":"device-auth.d.ts","sourceRoot":"","sources":["../../src/auth/device-auth.ts"],"names":[],"mappings":"AAGA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,EACnB,MAAM,YAAY,CAAA;AAOnB,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;gBAGpB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE;CAQ7D;AAoCD,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,SAAS,EACjB,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAiC7B;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,kBAAkB,CAAA;CAAE,GACnD;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,uBAAuB,CAAA;CAAE,GACrD;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,uBAAuB,CAAA;CAAE,GACpD;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,uBAAuB,CAAA;CAAE,GACrD;IACE,MAAM,EAAE,WAAW,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,uBAAuB,CAAA;CAC/B,CAAA;AAEL,wBAAsB,eAAe,CACnC,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,UAAU,CAAC,CA4ErB;AAED,wBAAsB,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAc3E;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,kBAAkB,EAC1B,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE;QACjB,OAAO,EAAE,MAAM,CAAA;QACf,WAAW,EAAE,MAAM,CAAA;QACnB,IAAI,EAAE,SAAS,GAAG,WAAW,CAAA;KAC9B,KAAK,IAAI,CAAA;IACV,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,uBAAuB,CAAC,EAAE,MAAM,CAAA;CACjC,GACA,OAAO,CAAC,kBAAkB,CAAC,CAkF7B"}

package/dist/auth/device-auth.js

@@ -27,21 +27,24 @@ function isRetryableTokenStatus(status) {
         status >= 500);
 }
 async function postJson(config, path, body) {
-    const url = `${authBase(config)}${path}`;
+    const provider = config.authProvider;
+    const url = provider ? (path === '/device/code' ? provider.deviceEndpoint : provider.tokenEndpoint) : `${authBase(config)}${path}`;
+    const form = provider && path === '/device/token';
     const { response, text } = await requestText(config, url, {
         method: 'POST',
         headers: {
             Accept: 'application/json',
-            'Content-Type': 'application/json',
+            'Content-Type': form ? 'application/x-www-form-urlencoded' : 'application/json',
             'User-Agent': config.userAgent,
         },
-        body: JSON.stringify(body),
+        body: form ? new URLSearchParams(Object.entries(body).map(([key, value]) => [key, String(value)])) : JSON.stringify(body),
     });
     return { status: response.status, json: parseJsonResponse(response, text) };
 }
 export async function requestDeviceCode(config, options) {
     const { status, json } = await postJson(config, '/device/code', {
         client_id: config.clientId,
+        ...(config.authProvider ? { resource: config.authProvider.resource, scope: 'openid profile email offline_access one:api' } : {}),
         ...(options?.scope ? { scope: options.scope } : {}),
     });
     if (status === 404) {
@@ -75,6 +78,7 @@ export async function pollDeviceToken(config, deviceCode) {
             grant_type: DEVICE_GRANT,
             device_code: deviceCode,
             client_id: config.clientId,
+            ...(config.authProvider ? { resource: config.authProvider.resource } : {}),
         }));
     }
     catch (error) {

package/dist/auth/device-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"device-auth.js","sourceRoot":"","sources":["../../src/auth/device-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAmBhF,MAAM,YAAY,GAAG,8CAA8C,CAAA;AAEnE,iFAAiF;AACjF,MAAM,yBAAyB,GAAG,CAAC,CAAA;AAEnC,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,IAAI,CAAS;IACb,MAAM,CAAQ;IACd,IAAI,CAAS;IAEtB,YACE,OAAe,EACf,OAA0D;QAE1D,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;QAC7B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC5B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;QACxB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;IAC1B,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,MAAiB;IACjC,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAA;AAC3D,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAc;IAC5C,OAAO,CACL,MAAM,KAAK,GAAG;QACd,MAAM,KAAK,GAAG;QACd,MAAM,KAAK,GAAG;QACd,MAAM,KAAK,GAAG;QACd,MAAM,IAAI,GAAG,CACd,CAAA;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,MAAiB,EACjB,IAAY,EACZ,IAA6B;IAE7B,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAA;IACxC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE;QACxD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,cAAc,EAAE,kBAAkB;YAClC,YAAY,EAAE,MAAM,CAAC,SAAS;SAC/B;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAA;IACF,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAA;AAC7E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAiB,EACjB,OAA4B;IAE5B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,cAAc,EAAE;QAC9D,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC,CAAA;IAEF,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,MAAM,IAAI,eAAe,CACvB,0CAA0C,MAAM,CAAC,UAAU,QAAQ;YACjE,kGAAkG,EACpG,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,CAChC,CAAA;IACH,CAAC;IAED,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAClC,MAAM,IAAI,eAAe,CAAC,oCAAoC,MAAM,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IACtF,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QACtB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACnC,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACvD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;QAChE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KAC7D,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAClB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,eAAe,CAAC,+EAA+E,EAAE;YACzG,MAAM,EAAE,IAAI,EAAE,kBAAkB;SACjC,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAA;AACpB,CAAC;AAaD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAiB,EACjB,UAAkB;IAElB,IAAI,MAAc,CAAA;IAClB,IAAI,IAAa,CAAA;IACjB,IAAI,CAAC;QACH,CAAC;QAAA,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,eAAe,EAAE;YAC3D,UAAU,EAAE,YAAY;YACxB,WAAW,EAAE,UAAU;YACvB,SAAS,EAAE,MAAM,CAAC,QAAQ;SAC3B,CAAC,CAAC,CAAA;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY,IAAI,yEAAyE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,MAAM,KAAK,CAAA;QAC5I,MAAM,WAAW,GACf,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B,CAAA;QACxE,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,UAAU,EAAE,CAAC;YACb,KAAK,EAAE;gBACL,KAAK,EAAE,uBAAuB;gBAC9B,iBAAiB,EAAE,WAAW;aAC/B;SACF,CAAA;IACH,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;QACrB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QAClD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC7B,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAClB,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnD,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAA;IACpD,CAAC;IACD,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;QAClC,MAAM,IAAI,eAAe,CAAC,gCAAgC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAA;IACnG,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;QAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC5D,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAClB,MAAM,SAAS,GAA4B,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,MAAM,EAAE,EAAE,CAAA;IAC/G,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAA;IAE5B,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,uBAAuB,CAAC;QAC7B,KAAK,WAAW;YACd,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;QAChD,KAAK,eAAe;YAClB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;QAC/C,KAAK,eAAe;YAClB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;QAChD;YACE,MAAK;IACT,CAAC;IAED,4EAA4E;IAC5E,yCAAyC;IACzC,IAAI,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,UAAU,EAAE,MAAM;YAClB,KAAK,EAAE;gBACL,KAAK,EAAE,uBAAuB;gBAC9B,iBAAiB,EACf,SAAS,CAAC,iBAAiB;oBAC3B,SAAS,CAAC,KAAK;oBACf,sCAAsC,MAAM,GAAG;aAClD;SACF,CAAA;IACH,CAAC;IAED,MAAM,IAAI,eAAe,CACvB,qCAAqC,MAAM,GAAG,EAC9C,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAClC,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,EAAU,EAAE,MAAoB;IAC1D,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YAC5C,MAAM,CAAC,IAAI,eAAe,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;QACnF,CAAC,CAAA;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YAC5C,OAAO,EAAE,CAAA;QACX,CAAC,EAAE,EAAE,CAAC,CAAA;QACN,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACzD,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,EAAE,CAAA;IAC/B,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAiB,EACjB,MAA0B,EAC1B,OAQC;IAED,IAAI,WAAW,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAA;IACtD,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,IAAI,oBAAoB,GAAG,CAAC,CAAA;IAC5B,MAAM,YAAY,GAChB,OAAO,EAAE,uBAAuB,IAAI,yBAAyB,CAAA;IAC/D,IAAI,mBAAmB,GAAG,CAAC,CAAA;IAE3B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE;gBAC5C,MAAM,EAAE,CAAC;gBACT,IAAI,EAAE,WAAW;aAClB,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,CAAA;QACZ,OAAO,EAAE,SAAS,EAAE,CAAC;YACnB,OAAO;YACP,WAAW;YACX,IAAI,EAAE,oBAAoB,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;SACzD,CAAC,CAAA;QACF,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;QAC9F,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;YAAE,MAAK;QAEjC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;QAChE,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,KAAK,YAAY;gBACf,OAAO,MAAM,CAAC,KAAK,CAAA;YACrB,KAAK,SAAS;gBACZ,oBAAoB,GAAG,CAAC,CAAA;gBACxB,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;oBACvC,WAAW,IAAI,CAAC,CAAA;gBAClB,CAAC;gBACD,MAAK;YACP,KAAK,WAAW;gBACd,oBAAoB,IAAI,CAAC,CAAA;gBACzB,mBAAmB,GAAG,MAAM,CAAC,UAAU,CAAA;gBACvC,IAAI,oBAAoB,IAAI,YAAY,EAAE,CAAC;oBACzC,MAAM,IAAI,eAAe,CACvB,6CAA6C,MAAM,CAAC,UAAU,6BAA6B;wBACzF,CAAC,mBAAmB;4BAClB,CAAC,CAAC,UAAU,mBAAmB,GAAG;4BAClC,CAAC,CAAC,EAAE,CAAC;wBACP,KAAK,MAAM,CAAC,KAAK,CAAC,iBAAiB,IAAI,8CAA8C,EAAE,EACzF;wBACE,MAAM,EAAE,mBAAmB;wBAC3B,IAAI,EAAE,aAAa;wBACnB,IAAI,EAAE,MAAM,CAAC,KAAK;qBACnB,CACF,CAAA;gBACH,CAAC;gBACD,MAAK;YACP,KAAK,QAAQ;gBACX,MAAM,IAAI,eAAe,CAAC,mCAAmC,EAAE;oBAC7D,MAAM,EAAE,GAAG;oBACX,IAAI,EAAE,eAAe;oBACrB,IAAI,EAAE,MAAM,CAAC,KAAK;iBACnB,CAAC,CAAA;YACJ,KAAK,SAAS;gBACZ,MAAM,IAAI,eAAe,CACvB,uDAAuD,EACvD,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,CAC3D,CAAA;YACH,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,WAAW,GAAU,MAAM,CAAA;gBACjC,MAAM,IAAI,eAAe,CACvB,2BAA2B,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,EACxD;oBACE,MAAM,EAAE,CAAC;oBACT,IAAI,EAAE,YAAY;iBACnB,CACF,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,IAAI,eAAe,CACvB,2EAA2E,EAC3E,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAC/B,CAAA;AACH,CAAC"}
+{"version":3,"file":"device-auth.js","sourceRoot":"","sources":["../../src/auth/device-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAmBhF,MAAM,YAAY,GAAG,8CAA8C,CAAA;AAEnE,iFAAiF;AACjF,MAAM,yBAAyB,GAAG,CAAC,CAAA;AAEnC,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,IAAI,CAAS;IACb,MAAM,CAAQ;IACd,IAAI,CAAS;IAEtB,YACE,OAAe,EACf,OAA0D;QAE1D,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;QAC7B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC5B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;QACxB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;IAC1B,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,MAAiB;IACjC,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAA;AAC3D,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAc;IAC5C,OAAO,CACL,MAAM,KAAK,GAAG;QACd,MAAM,KAAK,GAAG;QACd,MAAM,KAAK,GAAG;QACd,MAAM,KAAK,GAAG;QACd,MAAM,IAAI,GAAG,CACd,CAAA;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,MAAiB,EACjB,IAAY,EACZ,IAA6B;IAE7B,MAAM,QAAQ,GAAC,MAAM,CAAC,YAAY,CAAA;IAClC,MAAM,GAAG,GAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,KAAG,cAAc,CAAA,CAAC,CAAA,QAAQ,CAAC,cAAc,CAAA,CAAC,CAAA,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAA;IAC1H,MAAM,IAAI,GAAC,QAAQ,IAAI,IAAI,KAAG,eAAe,CAAA;IAC7C,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE;QACxD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,cAAc,EAAE,IAAI,CAAA,CAAC,CAAA,mCAAmC,CAAA,CAAC,CAAA,kBAAkB;YAC3E,YAAY,EAAE,MAAM,CAAC,SAAS;SAC/B;QACD,IAAI,EAAE,IAAI,CAAA,CAAC,CAAA,IAAI,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAC,KAAK,CAAC,EAAC,EAAE,CAAA,CAAC,GAAG,EAAC,MAAM,CAAC,KAAK,CAAC,CAAoB,CAAC,CAAC,CAAA,CAAC,CAAA,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KACrI,CAAC,CAAA;IACF,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAA;AAC7E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAiB,EACjB,OAA4B;IAE5B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,cAAc,EAAE;QAC9D,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,GAAG,CAAC,MAAM,CAAC,YAAY,CAAA,CAAC,CAAA,EAAC,QAAQ,EAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAC,KAAK,EAAC,6CAA6C,EAAC,CAAA,CAAC,CAAA,EAAE,CAAC;QACvH,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC,CAAA;IAEF,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,MAAM,IAAI,eAAe,CACvB,0CAA0C,MAAM,CAAC,UAAU,QAAQ;YACjE,kGAAkG,EACpG,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,CAChC,CAAA;IACH,CAAC;IAED,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAClC,MAAM,IAAI,eAAe,CAAC,oCAAoC,MAAM,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IACtF,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QACtB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACnC,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACvD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;QAChE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KAC7D,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAClB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,eAAe,CAAC,+EAA+E,EAAE;YACzG,MAAM,EAAE,IAAI,EAAE,kBAAkB;SACjC,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAA;AACpB,CAAC;AAaD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAiB,EACjB,UAAkB;IAElB,IAAI,MAAc,CAAA;IAClB,IAAI,IAAa,CAAA;IACjB,IAAI,CAAC;QACH,CAAC;QAAA,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,eAAe,EAAE;YAC3D,UAAU,EAAE,YAAY;YACxB,WAAW,EAAE,UAAU;YACvB,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,GAAG,CAAC,MAAM,CAAC,YAAY,CAAA,CAAC,CAAA,EAAC,QAAQ,EAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAC,CAAA,CAAC,CAAA,EAAE,CAAC;SACpE,CAAC,CAAC,CAAA;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY,IAAI,yEAAyE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,MAAM,KAAK,CAAA;QAC5I,MAAM,WAAW,GACf,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B,CAAA;QACxE,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,UAAU,EAAE,CAAC;YACb,KAAK,EAAE;gBACL,KAAK,EAAE,uBAAuB;gBAC9B,iBAAiB,EAAE,WAAW;aAC/B;SACF,CAAA;IACH,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;QACrB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QAClD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC7B,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAClB,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnD,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAA;IACpD,CAAC;IACD,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;QAClC,MAAM,IAAI,eAAe,CAAC,gCAAgC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAA;IACnG,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;QAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC5D,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAClB,MAAM,SAAS,GAA4B,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,MAAM,EAAE,EAAE,CAAA;IAC/G,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAA;IAE5B,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,uBAAuB,CAAC;QAC7B,KAAK,WAAW;YACd,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;QAChD,KAAK,eAAe;YAClB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;QAC/C,KAAK,eAAe;YAClB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;QAChD;YACE,MAAK;IACT,CAAC;IAED,4EAA4E;IAC5E,yCAAyC;IACzC,IAAI,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,UAAU,EAAE,MAAM;YAClB,KAAK,EAAE;gBACL,KAAK,EAAE,uBAAuB;gBAC9B,iBAAiB,EACf,SAAS,CAAC,iBAAiB;oBAC3B,SAAS,CAAC,KAAK;oBACf,sCAAsC,MAAM,GAAG;aAClD;SACF,CAAA;IACH,CAAC;IAED,MAAM,IAAI,eAAe,CACvB,qCAAqC,MAAM,GAAG,EAC9C,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAClC,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,EAAU,EAAE,MAAoB;IAC1D,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YAC5C,MAAM,CAAC,IAAI,eAAe,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;QACnF,CAAC,CAAA;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YAC5C,OAAO,EAAE,CAAA;QACX,CAAC,EAAE,EAAE,CAAC,CAAA;QACN,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACzD,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,EAAE,CAAA;IAC/B,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAiB,EACjB,MAA0B,EAC1B,OAQC;IAED,IAAI,WAAW,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAA;IACtD,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,IAAI,oBAAoB,GAAG,CAAC,CAAA;IAC5B,MAAM,YAAY,GAChB,OAAO,EAAE,uBAAuB,IAAI,yBAAyB,CAAA;IAC/D,IAAI,mBAAmB,GAAG,CAAC,CAAA;IAE3B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE;gBAC5C,MAAM,EAAE,CAAC;gBACT,IAAI,EAAE,WAAW;aAClB,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,CAAA;QACZ,OAAO,EAAE,SAAS,EAAE,CAAC;YACnB,OAAO;YACP,WAAW;YACX,IAAI,EAAE,oBAAoB,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;SACzD,CAAC,CAAA;QACF,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;QAC9F,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;YAAE,MAAK;QAEjC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;QAChE,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,KAAK,YAAY;gBACf,OAAO,MAAM,CAAC,KAAK,CAAA;YACrB,KAAK,SAAS;gBACZ,oBAAoB,GAAG,CAAC,CAAA;gBACxB,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;oBACvC,WAAW,IAAI,CAAC,CAAA;gBAClB,CAAC;gBACD,MAAK;YACP,KAAK,WAAW;gBACd,oBAAoB,IAAI,CAAC,CAAA;gBACzB,mBAAmB,GAAG,MAAM,CAAC,UAAU,CAAA;gBACvC,IAAI,oBAAoB,IAAI,YAAY,EAAE,CAAC;oBACzC,MAAM,IAAI,eAAe,CACvB,6CAA6C,MAAM,CAAC,UAAU,6BAA6B;wBACzF,CAAC,mBAAmB;4BAClB,CAAC,CAAC,UAAU,mBAAmB,GAAG;4BAClC,CAAC,CAAC,EAAE,CAAC;wBACP,KAAK,MAAM,CAAC,KAAK,CAAC,iBAAiB,IAAI,8CAA8C,EAAE,EACzF;wBACE,MAAM,EAAE,mBAAmB;wBAC3B,IAAI,EAAE,aAAa;wBACnB,IAAI,EAAE,MAAM,CAAC,KAAK;qBACnB,CACF,CAAA;gBACH,CAAC;gBACD,MAAK;YACP,KAAK,QAAQ;gBACX,MAAM,IAAI,eAAe,CAAC,mCAAmC,EAAE;oBAC7D,MAAM,EAAE,GAAG;oBACX,IAAI,EAAE,eAAe;oBACrB,IAAI,EAAE,MAAM,CAAC,KAAK;iBACnB,CAAC,CAAA;YACJ,KAAK,SAAS;gBACZ,MAAM,IAAI,eAAe,CACvB,uDAAuD,EACvD,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,CAC3D,CAAA;YACH,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,WAAW,GAAU,MAAM,CAAA;gBACjC,MAAM,IAAI,eAAe,CACvB,2BAA2B,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,EACxD;oBACE,MAAM,EAAE,CAAC;oBACT,IAAI,EAAE,YAAY;iBACnB,CACF,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,IAAI,eAAe,CACvB,2EAA2E,EAC3E,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAC/B,CAAA;AACH,CAAC"}

package/dist/auth/index.d.ts

@@ -1,4 +1,7 @@
 export { clearOneCredentials, credentialsPath, getOneAccessToken, readCredentials, writeOneCredentials, } from './store.js';
 export { DeviceAuthError, pollDeviceToken, requestDeviceCode, waitForDeviceAuthorization, } from './device-auth.js';
 export type { CredentialsFile, DeviceCodeResponse, DeviceTokenSuccess, OneCredentials, StoredUser, } from './types.js';
+export { discoverAuthProvider, identityProvider } from './provider.js';
+export { managedAccessToken, revokeSavedCredentials } from './refresh.js';
+export type { AuthProvider } from './provider.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,mBAAmB,GACpB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,UAAU,GACX,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,mBAAmB,GACpB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,UAAU,GACX,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAC,oBAAoB,EAAC,gBAAgB,EAAC,MAAM,eAAe,CAAA;AACnE,OAAO,EAAC,kBAAkB,EAAC,sBAAsB,EAAC,MAAM,cAAc,CAAA;AACtE,YAAY,EAAC,YAAY,EAAC,MAAM,eAAe,CAAA"}

package/dist/auth/index.js

@@ -1,3 +1,5 @@
 export { clearOneCredentials, credentialsPath, getOneAccessToken, readCredentials, writeOneCredentials, } from './store.js';
 export { DeviceAuthError, pollDeviceToken, requestDeviceCode, waitForDeviceAuthorization, } from './device-auth.js';
+export { discoverAuthProvider, identityProvider } from './provider.js';
+export { managedAccessToken, revokeSavedCredentials } from './refresh.js';
 //# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,mBAAmB,GACpB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,mBAAmB,GACpB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAA;AASzB,OAAO,EAAC,oBAAoB,EAAC,gBAAgB,EAAC,MAAM,eAAe,CAAA;AACnE,OAAO,EAAC,kBAAkB,EAAC,sBAAsB,EAAC,MAAM,cAAc,CAAA"}

package/dist/auth/provider.d.ts

@@ -0,0 +1,18 @@
+import { type CliConfig } from '../lib/config.js';
+export interface AuthProvider {
+    issuer: string;
+    tokenEndpoint: string;
+    deviceEndpoint: string;
+    userinfoEndpoint: string;
+    revocationEndpoint: string;
+    resource: string;
+}
+export declare function validateIdentityIssuer(raw: string, config: Pick<CliConfig, 'oneBaseUrl' | 'identityBaseUrl'>): string;
+export declare function identityProvider(config: CliConfig, issuer: string): Promise<AuthProvider>;
+/**
+ * Older One deployments answer the protected-resource path with a sign-in
+ * redirect or an HTML page; those mean "no Identity metadata" (legacy login).
+ * JSON that is present but malformed or names another resource still aborts.
+ */
+export declare function discoverAuthProvider(config: CliConfig): Promise<AuthProvider | undefined>;
+//# sourceMappingURL=provider.d.ts.map

package/dist/auth/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/auth/provider.ts"],"names":[],"mappings":"AAEA,OAAO,EAAoB,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAEnE,MAAM,WAAW,YAAY;IAAE,MAAM,EAAC,MAAM,CAAC;IAAA,aAAa,EAAC,MAAM,CAAC;IAAA,cAAc,EAAC,MAAM,CAAC;IAAA,gBAAgB,EAAC,MAAM,CAAC;IAAA,kBAAkB,EAAC,MAAM,CAAC;IAAA,QAAQ,EAAC,MAAM,CAAA;CAAC;AAC1J,wBAAgB,sBAAsB,CAAC,GAAG,EAAC,MAAM,EAAC,MAAM,EAAC,IAAI,CAAC,SAAS,EAAC,YAAY,GAAC,iBAAiB,CAAC,GAAE,MAAM,CAK9G;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAC,SAAS,EAAC,MAAM,EAAC,MAAM,GAAE,OAAO,CAAC,YAAY,CAAC,CAO3F;AACD;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAC,SAAS,GAAE,OAAO,CAAC,YAAY,GAAC,SAAS,CAAC,CAiB3F"}

package/dist/auth/provider.js

@@ -0,0 +1,62 @@
+import { DeviceAuthError } from './device-auth.js';
+import { z } from 'zod';
+import { validateOneOrigin } from '../lib/config.js';
+import { requestText, parseJsonResponse } from '../lib/network.js';
+export function validateIdentityIssuer(raw, config) {
+    const origin = validateOneOrigin(raw);
+    const loopback = ['localhost', '127.0.0.1', '[::1]'].includes(new URL(origin).hostname);
+    if (!['https://auth.vigilbase.com', 'https://identity-staging.vigilbase.com'].includes(origin) && !(loopback && config.identityBaseUrl === origin && ['localhost', '127.0.0.1', '[::1]'].includes(new URL(config.oneBaseUrl).hostname)))
+        throw new Error('Untrusted Identity issuer. Configure --auth-url explicitly for loopback development.');
+    return origin;
+}
+async function json(config, url) { const { response, text } = await requestText(config, url, { headers: { Accept: 'application/json', 'User-Agent': config.userAgent } }); return { response, body: parseJsonResponse(response, text) }; }
+export async function identityProvider(config, issuer) {
+    issuer = validateIdentityIssuer(issuer, config);
+    const { response, body } = await json(config, `${issuer}/.well-known/openid-configuration`);
+    const data = z.object({ issuer: z.literal(issuer), token_endpoint: z.string(), device_authorization_endpoint: z.string(), userinfo_endpoint: z.string(), revocation_endpoint: z.string() }).safeParse(body);
+    if (!response.ok || !data.success)
+        throw new Error('Invalid Identity discovery response.');
+    const endpoint = (raw, paths) => { let url; try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new Error('Invalid Identity endpoint.');
+    } ; if (url.origin !== issuer || url.username || url.password || url.search || url.hash || !paths.includes(url.pathname))
+        throw new Error('Untrusted Identity endpoint.'); return url.href; };
+    return { issuer, resource: validateOneOrigin(config.oneBaseUrl), tokenEndpoint: endpoint(data.data.token_endpoint, ['/api/auth/oauth2/token', '/token']), deviceEndpoint: endpoint(data.data.device_authorization_endpoint, ['/api/auth/device/code']), userinfoEndpoint: endpoint(data.data.userinfo_endpoint, ['/api/auth/oauth2/userinfo', '/userinfo']), revocationEndpoint: endpoint(data.data.revocation_endpoint, ['/api/auth/oauth2/revoke', '/revoke']) };
+}
+/**
+ * Older One deployments answer the protected-resource path with a sign-in
+ * redirect or an HTML page; those mean "no Identity metadata" (legacy login).
+ * JSON that is present but malformed or names another resource still aborts.
+ */
+export async function discoverAuthProvider(config) {
+    const one = validateOneOrigin(config.oneBaseUrl);
+    const { response, text } = await requestText(config, `${one}/.well-known/oauth-protected-resource`, { headers: { Accept: 'application/json', 'User-Agent': config.userAgent }, redirect: 'manual' });
+    if (response.type === 'opaqueredirect' || response.status === 0 || (response.status >= 300 && response.status < 400))
+        return undefined;
+    if (response.status === 404)
+        return undefined;
+    if (response.status === 429)
+        throw new DeviceAuthError('Discovery rate limit exceeded.', { status: 429, code: 'rate_limited' });
+    let body;
+    if (response.ok) {
+        const contentType = (response.headers.get('content-type') ?? '').split(';')[0].trim().toLowerCase();
+        if (contentType && contentType !== 'application/json' && !contentType.endsWith('+json'))
+            return undefined;
+        try {
+            body = JSON.parse(text);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    const metadata = z.object({ resource: z.literal(one), authorization_servers: z.array(z.string()).length(1) }).safeParse(body);
+    if (!response.ok || !metadata.success)
+        throw new Error('Invalid One protected-resource discovery response.');
+    const issuer = metadata.data.authorization_servers[0];
+    if (issuer === `${one}/api/auth`)
+        return undefined;
+    return identityProvider(config, issuer);
+}
+//# sourceMappingURL=provider.js.map

package/dist/auth/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../src/auth/provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,iBAAiB,EAAiB,MAAM,kBAAkB,CAAA;AACnE,OAAO,EAAE,WAAW,EAAC,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAEjE,MAAM,UAAU,sBAAsB,CAAC,GAAU,EAAC,MAAqD;IACtG,MAAM,MAAM,GAAC,iBAAiB,CAAC,GAAG,CAAC,CAAA;IACnC,MAAM,QAAQ,GAAC,CAAC,WAAW,EAAC,WAAW,EAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAA;IACnF,IAAG,CAAC,CAAC,4BAA4B,EAAC,wCAAwC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,MAAM,CAAC,eAAe,KAAG,MAAM,IAAI,CAAC,WAAW,EAAC,WAAW,EAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAA;IACzU,OAAO,MAAM,CAAA;AACd,CAAC;AACD,KAAK,UAAU,IAAI,CAAC,MAAgB,EAAC,GAAU,IAAE,MAAM,EAAC,QAAQ,EAAC,IAAI,EAAC,GAAC,MAAM,WAAW,CAAC,MAAM,EAAC,GAAG,EAAC,EAAC,OAAO,EAAC,EAAC,MAAM,EAAC,kBAAkB,EAAC,YAAY,EAAC,MAAM,CAAC,SAAS,EAAC,EAAC,CAAC,CAAC,CAAA,OAAO,EAAC,QAAQ,EAAC,IAAI,EAAC,iBAAiB,CAAC,QAAQ,EAAC,IAAI,CAAC,EAAC,CAAA,CAAA,CAAC;AACjO,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAgB,EAAC,MAAa;IACpE,MAAM,GAAC,sBAAsB,CAAC,MAAM,EAAC,MAAM,CAAC,CAAA;IAC5C,MAAM,EAAC,QAAQ,EAAC,IAAI,EAAC,GAAC,MAAM,IAAI,CAAC,MAAM,EAAC,GAAG,MAAM,mCAAmC,CAAC,CAAA;IACrF,MAAM,IAAI,GAAC,CAAC,CAAC,MAAM,CAAC,EAAC,MAAM,EAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAC,cAAc,EAAC,CAAC,CAAC,MAAM,EAAE,EAAC,6BAA6B,EAAC,CAAC,CAAC,MAAM,EAAE,EAAC,iBAAiB,EAAC,CAAC,CAAC,MAAM,EAAE,EAAC,mBAAmB,EAAC,CAAC,CAAC,MAAM,EAAE,EAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAC9L,IAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;QAAC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;IACxF,MAAM,QAAQ,GAAC,CAAC,GAAU,EAAC,KAAc,EAAC,EAAE,GAAC,IAAI,GAAO,CAAC,CAAA,IAAG,CAAC;QAAA,GAAG,GAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IAAA,CAAC;IAAA,MAAK,CAAC;QAAA,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IAAA,CAAC,CAAA,CAAC,CAAA,IAAG,GAAG,CAAC,MAAM,KAAG,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAA,OAAO,GAAG,CAAC,IAAI,CAAA,CAAA,CAAC,CAAA;IACrT,OAAO,EAAC,MAAM,EAAC,QAAQ,EAAC,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAC,aAAa,EAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAC,CAAC,wBAAwB,EAAC,QAAQ,CAAC,CAAC,EAAC,cAAc,EAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,EAAC,CAAC,uBAAuB,CAAC,CAAC,EAAC,gBAAgB,EAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAC,CAAC,2BAA2B,EAAC,WAAW,CAAC,CAAC,EAAC,kBAAkB,EAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAC,CAAC,yBAAyB,EAAC,SAAS,CAAC,CAAC,EAAC,CAAA;AAChb,CAAC;AACD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAgB;IAC1D,MAAM,GAAG,GAAC,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IAC9C,MAAM,EAAC,QAAQ,EAAC,IAAI,EAAC,GAAC,MAAM,WAAW,CAAC,MAAM,EAAC,GAAG,GAAG,uCAAuC,EAAC,EAAC,OAAO,EAAC,EAAC,MAAM,EAAC,kBAAkB,EAAC,YAAY,EAAC,MAAM,CAAC,SAAS,EAAC,EAAC,QAAQ,EAAC,QAAQ,EAAC,CAAC,CAAA;IACnL,IAAG,QAAQ,CAAC,IAAI,KAAG,gBAAgB,IAAI,QAAQ,CAAC,MAAM,KAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAC,GAAG,CAAC;QAAC,OAAO,SAAS,CAAA;IAC5H,IAAG,QAAQ,CAAC,MAAM,KAAG,GAAG;QAAC,OAAO,SAAS,CAAA;IACzC,IAAG,QAAQ,CAAC,MAAM,KAAG,GAAG;QAAC,MAAM,IAAI,eAAe,CAAC,gCAAgC,EAAC,EAAC,MAAM,EAAC,GAAG,EAAC,IAAI,EAAC,cAAc,EAAC,CAAC,CAAA;IACrH,IAAI,IAAY,CAAA;IAChB,IAAG,QAAQ,CAAC,EAAE,EAAC,CAAC;QACf,MAAM,WAAW,GAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAClG,IAAG,WAAW,IAAI,WAAW,KAAG,kBAAkB,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAC,OAAO,SAAS,CAAA;QACrG,IAAG,CAAC;YAAA,IAAI,GAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAAA,CAAC;QAAA,MAAK,CAAC;YAAA,OAAO,SAAS,CAAA;QAAA,CAAC;IAClD,CAAC;IACD,MAAM,QAAQ,GAAC,CAAC,CAAC,MAAM,CAAC,EAAC,QAAQ,EAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAC,qBAAqB,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IACtH,IAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;IAC1G,MAAM,MAAM,GAAC,QAAQ,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAE,CAAA;IACpD,IAAG,MAAM,KAAG,GAAG,GAAG,WAAW;QAAC,OAAO,SAAS,CAAA;IAC9C,OAAO,gBAAgB,CAAC,MAAM,EAAC,MAAM,CAAC,CAAA;AACvC,CAAC"}

package/dist/auth/refresh.d.ts

@@ -0,0 +1,10 @@
+import type { CliConfig } from '../lib/config.js';
+import type { OneCredentials } from './types.js';
+export declare function boundIdentityCredentials(config: CliConfig, one: OneCredentials): boolean;
+/** Library callers may omit or mistype timeoutMs; NaN would make the wait unbounded. */
+export declare function credentialsLockWaitMs(timeoutMs: unknown): number;
+/** Never steal a stale lock: a crashed refresh may have consumed the rotating token. */
+export declare function withCredentialsLock<T>(config: CliConfig, callback: () => Promise<T>, replaceDeadLock?: boolean): Promise<T>;
+export declare function managedAccessToken(config: CliConfig, failedToken?: string): Promise<string | null>;
+export declare function revokeSavedCredentials(config: CliConfig): Promise<boolean>;
+//# sourceMappingURL=refresh.d.ts.map

package/dist/auth/refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../src/auth/refresh.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAKjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAChD,wBAAgB,wBAAwB,CAAC,MAAM,EAAC,SAAS,EAAC,GAAG,EAAC,cAAc,GAAE,OAAO,CAEpF;AAED,wFAAwF;AACxF,wBAAgB,qBAAqB,CAAC,SAAS,EAAC,OAAO,GAAE,MAAM,CAG9D;AACD,wFAAwF;AACxF,wBAAsB,mBAAmB,CAAC,CAAC,EAAE,MAAM,EAAC,SAAS,EAAC,QAAQ,EAAC,MAAI,OAAO,CAAC,CAAC,CAAC,EAAC,eAAe,UAAM,GAAE,OAAO,CAAC,CAAC,CAAC,CA2BtH;AACD,wBAAsB,kBAAkB,CAAC,MAAM,EAAC,SAAS,EAAC,WAAW,CAAC,EAAC,MAAM,GAAE,OAAO,CAAC,MAAM,GAAC,IAAI,CAAC,CAsBlG;AACD,wBAAsB,sBAAsB,CAAC,MAAM,EAAC,SAAS,GAAE,OAAO,CAAC,OAAO,CAAC,CAW9E"}

package/dist/auth/refresh.js

@@ -0,0 +1,143 @@
+import { readIdentityTokenMetadata } from './token-metadata.js';
+import { constants } from 'node:fs';
+import { open, rm, lstat } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { z } from 'zod';
+import { DEFAULT_TIMEOUT_MS, validateOneOrigin } from '../lib/config.js';
+import { requestText, parseJsonResponse } from '../lib/network.js';
+import { assertFile, checkDirectory, credentialsPath, readCredentials, writeOneCredentials, clearOneCredentials } from './store.js';
+import { identityProvider, validateIdentityIssuer } from './provider.js';
+export function boundIdentityCredentials(config, one) {
+    try {
+        return one.clientId === config.clientId && one.resource === validateOneOrigin(config.oneBaseUrl) && one.oneBaseUrl === one.resource && validateIdentityIssuer(one.issuer, config) === one.issuer;
+    }
+    catch {
+        return false;
+    }
+}
+const MAX_LOCK_WAIT_MS = 15_000;
+/** Library callers may omit or mistype timeoutMs; NaN would make the wait unbounded. */
+export function credentialsLockWaitMs(timeoutMs) {
+    const requested = typeof timeoutMs === 'number' && Number.isFinite(timeoutMs) && timeoutMs > 0 ? timeoutMs : DEFAULT_TIMEOUT_MS;
+    return Math.min(requested, MAX_LOCK_WAIT_MS);
+}
+/** Never steal a stale lock: a crashed refresh may have consumed the rotating token. */
+export async function withCredentialsLock(config, callback, replaceDeadLock = false) {
+    const path = `${credentialsPath(config)}.lock`;
+    await checkDirectory(dirname(path), true);
+    const deadline = Date.now() + credentialsLockWaitMs(config.timeoutMs);
+    let handle;
+    for (;;) {
+        try {
+            handle = await open(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+            break;
+        }
+        catch (error) {
+            if (!(error instanceof Error && 'code' in error && error.code === 'EEXIST'))
+                throw error;
+            const existing = await lstat(path);
+            assertFile(existing);
+            if (replaceDeadLock) {
+                const existingHandle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+                let owner = '';
+                try {
+                    assertFile(await existingHandle.stat());
+                    owner = await existingHandle.readFile('utf8');
+                }
+                finally {
+                    await existingHandle.close();
+                }
+                const pid = Number(owner);
+                let dead = false;
+                if (Number.isSafeInteger(pid) && pid > 0) {
+                    try {
+                        process.kill(pid, 0);
+                    }
+                    catch (error) {
+                        dead = error instanceof Error && 'code' in error && error.code === 'ESRCH';
+                    }
+                }
+                if (dead) {
+                    const current = await lstat(path);
+                    if (current.ino === existing.ino && current.dev === existing.dev) {
+                        await rm(path);
+                        continue;
+                    }
+                }
+            }
+            if (Date.now() >= deadline)
+                throw new Error('Credentials are locked by another command. A crashed refresh requires a new login; do not reuse its refresh token.');
+            await new Promise(resolve => setTimeout(resolve, 100));
+        }
+    }
+    await handle.chmod(0o600);
+    const info = await handle.stat();
+    assertFile(info);
+    try {
+        await handle.writeFile(String(process.pid));
+        await handle.sync();
+        return await callback();
+    }
+    finally {
+        await handle.close();
+        const current = await lstat(path).catch(() => null);
+        if (current?.ino === info.ino && current.dev === info.dev)
+            await rm(path);
+    }
+}
+export async function managedAccessToken(config, failedToken) {
+    const initial = await readCredentials(config);
+    if (initial.version !== 2 || !initial.one || !boundIdentityCredentials(config, initial.one))
+        return null;
+    if (!failedToken && Date.parse(initial.one.expiresAt ?? '') - Date.now() > 60_000) {
+        readIdentityTokenMetadata(initial.one.accessToken, { issuer: initial.one.issuer, clientId: initial.one.clientId, resource: initial.one.resource });
+        return initial.one.accessToken;
+    }
+    return withCredentialsLock(config, async () => {
+        const current = await readCredentials(config), one = current.one;
+        if (current.version !== 2 || !one || !boundIdentityCredentials(config, one))
+            return null;
+        if (failedToken && one.accessToken !== failedToken) {
+            readIdentityTokenMetadata(one.accessToken, { issuer: one.issuer, clientId: one.clientId, resource: one.resource });
+            return one.accessToken;
+        }
+        if (!failedToken && Date.parse(one.expiresAt ?? '') - Date.now() > 60_000) {
+            readIdentityTokenMetadata(one.accessToken, { issuer: one.issuer, clientId: one.clientId, resource: one.resource });
+            return one.accessToken;
+        }
+        if (one.refreshPending)
+            throw new Error('A previous refresh has an uncertain result. Run `vigilbase login` again; its token cannot be retried safely.');
+        const provider = await identityProvider(config, one.issuer);
+        await writeOneCredentials(config, { ...one, refreshPending: true });
+        const { response, text } = await requestText(config, provider.tokenEndpoint, { method: 'POST', headers: { Accept: 'application/json', 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': config.userAgent }, body: new URLSearchParams({ grant_type: 'refresh_token', refresh_token: one.refreshToken, client_id: one.clientId, resource: one.resource }) });
+        const body = parseJsonResponse(response, text);
+        if (!response.ok) {
+            if (z.object({ error: z.literal('invalid_grant') }).safeParse(body).success)
+                await clearOneCredentials(config);
+            throw new Error('Identity refresh failed. Run `vigilbase login` again.');
+        }
+        const token = z.object({ access_token: z.string().min(1), refresh_token: z.string().min(1), expires_in: z.number().int().positive().max(300), scope: z.string().optional() }).safeParse(body);
+        if (!token.success)
+            throw new Error('Invalid Identity refresh response.');
+        const metadata = readIdentityTokenMetadata(token.data.access_token, { issuer: one.issuer, clientId: one.clientId, resource: one.resource });
+        if (one.orgId && metadata.organizationId !== one.orgId)
+            throw new Error('Identity refresh changed its bound organization. Run `vigilbase login` again.');
+        await writeOneCredentials(config, { ...one, orgId: metadata.organizationId, refreshPending: false, accessToken: token.data.access_token, refreshToken: token.data.refresh_token, expiresAt: new Date(Date.now() + token.data.expires_in * 1000).toISOString(), scope: token.data.scope ?? one.scope });
+        return token.data.access_token;
+    });
+}
+export async function revokeSavedCredentials(config) {
+    return withCredentialsLock(config, async () => {
+        const saved = await readCredentials(config);
+        if (saved.version === 2 && saved.one) {
+            if (!boundIdentityCredentials(config, saved.one))
+                throw new Error('Saved credentials belong to a different issuer, resource, or client. Use the matching configuration to log out.');
+            const provider = await identityProvider(config, saved.one.issuer);
+            const { response } = await requestText(config, provider.revocationEndpoint, { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': config.userAgent }, body: new URLSearchParams({ token: saved.one.refreshToken, token_type_hint: 'refresh_token', client_id: saved.one.clientId }) });
+            if (!response.ok)
+                throw new Error('Identity revocation failed. Credentials retained so logout can be retried.');
+        }
+        return clearOneCredentials(config);
+    }, true);
+}
+//# sourceMappingURL=refresh.js.map

package/dist/auth/refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.js","sourceRoot":"","sources":["../../src/auth/refresh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnC,OAAO,EAAE,IAAI,EAAC,EAAE,EAAC,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,kBAAkB,EAAC,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACvE,OAAO,EAAE,WAAW,EAAC,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACjE,OAAO,EAAE,UAAU,EAAC,cAAc,EAAC,eAAe,EAAC,eAAe,EAAC,mBAAmB,EAAC,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAC9H,OAAO,EAAE,gBAAgB,EAAC,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAEvE,MAAM,UAAU,wBAAwB,CAAC,MAAgB,EAAC,GAAkB;IAC3E,IAAG,CAAC;QAAA,OAAO,GAAG,CAAC,QAAQ,KAAG,MAAM,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAG,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,UAAU,KAAG,GAAG,CAAC,QAAQ,IAAI,sBAAsB,CAAC,GAAG,CAAC,MAAO,EAAC,MAAM,CAAC,KAAG,GAAG,CAAC,MAAM,CAAA;IAAA,CAAC;IAAA,MAAK,CAAC;QAAA,OAAO,KAAK,CAAA;IAAA,CAAC;AACjN,CAAC;AACD,MAAM,gBAAgB,GAAC,MAAM,CAAA;AAC7B,wFAAwF;AACxF,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACtD,MAAM,SAAS,GAAC,OAAO,SAAS,KAAG,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAA;IACzH,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,EAAC,gBAAgB,CAAC,CAAA;AAC5C,CAAC;AACD,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAI,MAAgB,EAAC,QAAuB,EAAC,eAAe,GAAC,KAAK;IAC1G,MAAM,IAAI,GAAC,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,CAAA;IAC5C,MAAM,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,EAAC,IAAI,CAAC,CAAA;IACxC,MAAM,QAAQ,GAAC,IAAI,CAAC,GAAG,EAAE,GAAC,qBAAqB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACjE,IAAI,MAAuC,CAAA;IAC3C,SAAO,CAAC;QACP,IAAG,CAAC;YAAA,MAAM,GAAC,MAAM,IAAI,CAAC,IAAI,EAAC,SAAS,CAAC,QAAQ,GAAC,SAAS,CAAC,OAAO,GAAC,SAAS,CAAC,MAAM,GAAC,SAAS,CAAC,UAAU,EAAC,KAAK,CAAC,CAAC;YAAA,MAAK;QAAA,CAAC;QAAA,OAAM,KAAK,EAAC,CAAC;YAC/H,IAAG,CAAC,CAAC,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAG,QAAQ,CAAC;gBAAC,MAAM,KAAK,CAAA;YACpF,MAAM,QAAQ,GAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YAAA,UAAU,CAAC,QAAQ,CAAC,CAAA;YACrD,IAAG,eAAe,EAAC,CAAC;gBACnB,MAAM,cAAc,GAAC,MAAM,IAAI,CAAC,IAAI,EAAC,SAAS,CAAC,QAAQ,GAAC,SAAS,CAAC,UAAU,GAAC,SAAS,CAAC,UAAU,CAAC,CAAA;gBAClG,IAAI,KAAK,GAAC,EAAE,CAAC;gBAAA,IAAG,CAAC;oBAAA,UAAU,CAAC,MAAM,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;oBAAA,KAAK,GAAC,MAAM,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;gBAAA,CAAC;wBAAO,CAAC;oBAAA,MAAM,cAAc,CAAC,KAAK,EAAE,CAAA;gBAAA,CAAC;gBAC1I,MAAM,GAAG,GAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAAA,IAAI,IAAI,GAAC,KAAK,CAAA;gBACtC,IAAG,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAC,CAAC,EAAC,CAAC;oBAAA,IAAG,CAAC;wBAAA,OAAO,CAAC,IAAI,CAAC,GAAG,EAAC,CAAC,CAAC,CAAA;oBAAA,CAAC;oBAAA,OAAM,KAAK,EAAC,CAAC;wBAAA,IAAI,GAAC,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAG,OAAO,CAAA;oBAAA,CAAC;gBAAA,CAAC;gBACpJ,IAAG,IAAI,EAAC,CAAC;oBAAA,MAAM,OAAO,GAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;oBAAA,IAAG,OAAO,CAAC,GAAG,KAAG,QAAQ,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAG,QAAQ,CAAC,GAAG,EAAC,CAAC;wBAAA,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;wBAAA,SAAQ;oBAAA,CAAC;gBAAA,CAAC;YAChI,CAAC;YACD,IAAG,IAAI,CAAC,GAAG,EAAE,IAAE,QAAQ;gBAAC,MAAM,IAAI,KAAK,CAAC,oHAAoH,CAAC,CAAA;YAC7J,MAAM,IAAI,OAAO,CAAC,OAAO,CAAA,EAAE,CAAA,UAAU,CAAC,OAAO,EAAC,GAAG,CAAC,CAAC,CAAA;QACpD,CAAC;IACF,CAAC;IACD,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IACzB,MAAM,IAAI,GAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IAAA,UAAU,CAAC,IAAI,CAAC,CAAA;IAC/C,IAAG,CAAC;QAAA,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAAA,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAAA,OAAO,MAAM,QAAQ,EAAE,CAAA;IAAA,CAAC;YAAO,CAAC;QACnG,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;QACpB,MAAM,OAAO,GAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAE,EAAE,CAAA,IAAI,CAAC,CAAA;QAC/C,IAAG,OAAO,EAAE,GAAG,KAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAG,IAAI,CAAC,GAAG;YAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAA;IACpE,CAAC;AACF,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAgB,EAAC,WAAmB;IAC5E,MAAM,OAAO,GAAC,MAAM,eAAe,CAAC,MAAM,CAAC,CAAA;IAC3C,IAAG,OAAO,CAAC,OAAO,KAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,wBAAwB,CAAC,MAAM,EAAC,OAAO,CAAC,GAAG,CAAC;QAAC,OAAO,IAAI,CAAA;IACnG,IAAG,CAAC,WAAW,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,GAAC,IAAI,CAAC,GAAG,EAAE,GAAC,MAAM,EAAC,CAAC;QAAA,yBAAyB,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAC,EAAC,MAAM,EAAC,OAAO,CAAC,GAAG,CAAC,MAAO,EAAC,QAAQ,EAAC,OAAO,CAAC,GAAG,CAAC,QAAS,EAAC,QAAQ,EAAC,OAAO,CAAC,GAAG,CAAC,QAAS,EAAC,CAAC,CAAC;QAAA,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAA;IAAA,CAAC;IAC3P,OAAO,mBAAmB,CAAC,MAAM,EAAC,KAAK,IAAE,EAAE;QAC1C,MAAM,OAAO,GAAC,MAAM,eAAe,CAAC,MAAM,CAAC,EAAC,GAAG,GAAC,OAAO,CAAC,GAAG,CAAA;QAC3D,IAAG,OAAO,CAAC,OAAO,KAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,wBAAwB,CAAC,MAAM,EAAC,GAAG,CAAC;YAAC,OAAO,IAAI,CAAA;QACnF,IAAG,WAAW,IAAI,GAAG,CAAC,WAAW,KAAG,WAAW,EAAC,CAAC;YAAA,yBAAyB,CAAC,GAAG,CAAC,WAAW,EAAC,EAAC,MAAM,EAAC,GAAG,CAAC,MAAO,EAAC,QAAQ,EAAC,GAAG,CAAC,QAAS,EAAC,QAAQ,EAAC,GAAG,CAAC,QAAS,EAAC,CAAC,CAAC;YAAA,OAAO,GAAG,CAAC,WAAW,CAAA;QAAA,CAAC;QACtL,IAAG,CAAC,WAAW,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,GAAC,IAAI,CAAC,GAAG,EAAE,GAAC,MAAM,EAAC,CAAC;YAAA,yBAAyB,CAAC,GAAG,CAAC,WAAW,EAAC,EAAC,MAAM,EAAC,GAAG,CAAC,MAAO,EAAC,QAAQ,EAAC,GAAG,CAAC,QAAS,EAAC,QAAQ,EAAC,GAAG,CAAC,QAAS,EAAC,CAAC,CAAC;YAAA,OAAO,GAAG,CAAC,WAAW,CAAA;QAAA,CAAC;QAC3M,IAAG,GAAG,CAAC,cAAc;YAAC,MAAM,IAAI,KAAK,CAAC,8GAA8G,CAAC,CAAA;QACrJ,MAAM,QAAQ,GAAC,MAAM,gBAAgB,CAAC,MAAM,EAAC,GAAG,CAAC,MAAO,CAAC,CAAA;QACzD,MAAM,mBAAmB,CAAC,MAAM,EAAC,EAAC,GAAG,GAAG,EAAC,cAAc,EAAC,IAAI,EAAC,CAAC,CAAA;QAC9D,MAAM,EAAC,QAAQ,EAAC,IAAI,EAAC,GAAC,MAAM,WAAW,CAAC,MAAM,EAAC,QAAQ,CAAC,aAAa,EAAC,EAAC,MAAM,EAAC,MAAM,EAAC,OAAO,EAAC,EAAC,MAAM,EAAC,kBAAkB,EAAC,cAAc,EAAC,mCAAmC,EAAC,YAAY,EAAC,MAAM,CAAC,SAAS,EAAC,EAAC,IAAI,EAAC,IAAI,eAAe,CAAC,EAAC,UAAU,EAAC,eAAe,EAAC,aAAa,EAAC,GAAG,CAAC,YAAa,EAAC,SAAS,EAAC,GAAG,CAAC,QAAS,EAAC,QAAQ,EAAC,GAAG,CAAC,QAAS,EAAC,CAAC,EAAC,CAAC,CAAA;QACjV,MAAM,IAAI,GAAC,iBAAiB,CAAC,QAAQ,EAAC,IAAI,CAAC,CAAA;QAC3C,IAAG,CAAC,QAAQ,CAAC,EAAE,EAAC,CAAC;YAAA,IAAG,CAAC,CAAC,MAAM,CAAC,EAAC,KAAK,EAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO;gBAAC,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAAA,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;QAAA,CAAC;QACpM,MAAM,KAAK,GAAC,CAAC,CAAC,MAAM,CAAC,EAAC,YAAY,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAC,aAAa,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAC,UAAU,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAC,KAAK,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAClL,IAAG,CAAC,KAAK,CAAC,OAAO;YAAC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QACvE,MAAM,QAAQ,GAAC,yBAAyB,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,EAAC,EAAC,MAAM,EAAC,GAAG,CAAC,MAAO,EAAC,QAAQ,EAAC,GAAG,CAAC,QAAS,EAAC,QAAQ,EAAC,GAAG,CAAC,QAAS,EAAC,CAAC,CAAA;QACpI,IAAG,GAAG,CAAC,KAAK,IAAI,QAAQ,CAAC,cAAc,KAAG,GAAG,CAAC,KAAK;YAAC,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAA;QACpJ,MAAM,mBAAmB,CAAC,MAAM,EAAC,EAAC,GAAG,GAAG,EAAC,KAAK,EAAC,QAAQ,CAAC,cAAc,EAAC,cAAc,EAAC,KAAK,EAAC,WAAW,EAAC,KAAK,CAAC,IAAI,CAAC,YAAY,EAAC,YAAY,EAAC,KAAK,CAAC,IAAI,CAAC,aAAa,EAAC,SAAS,EAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAC,KAAK,CAAC,IAAI,CAAC,UAAU,GAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAC,KAAK,EAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,EAAC,CAAC,CAAA;QACnR,OAAO,KAAK,CAAC,IAAI,CAAC,YAAY,CAAA;IAC/B,CAAC,CAAC,CAAA;AACH,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,MAAgB;IAC5D,OAAO,mBAAmB,CAAC,MAAM,EAAC,KAAK,IAAE,EAAE;QAC1C,MAAM,KAAK,GAAC,MAAM,eAAe,CAAC,MAAM,CAAC,CAAA;QACzC,IAAG,KAAK,CAAC,OAAO,KAAG,CAAC,IAAI,KAAK,CAAC,GAAG,EAAC,CAAC;YAClC,IAAG,CAAC,wBAAwB,CAAC,MAAM,EAAC,KAAK,CAAC,GAAG,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,iHAAiH,CAAC,CAAA;YACjL,MAAM,QAAQ,GAAC,MAAM,gBAAgB,CAAC,MAAM,EAAC,KAAK,CAAC,GAAG,CAAC,MAAO,CAAC,CAAA;YAC/D,MAAM,EAAC,QAAQ,EAAC,GAAC,MAAM,WAAW,CAAC,MAAM,EAAC,QAAQ,CAAC,kBAAkB,EAAC,EAAC,MAAM,EAAC,MAAM,EAAC,OAAO,EAAC,EAAC,cAAc,EAAC,mCAAmC,EAAC,YAAY,EAAC,MAAM,CAAC,SAAS,EAAC,EAAC,IAAI,EAAC,IAAI,eAAe,CAAC,EAAC,KAAK,EAAC,KAAK,CAAC,GAAG,CAAC,YAAa,EAAC,eAAe,EAAC,eAAe,EAAC,SAAS,EAAC,KAAK,CAAC,GAAG,CAAC,QAAS,EAAC,CAAC,EAAC,CAAC,CAAA;YACzS,IAAG,CAAC,QAAQ,CAAC,EAAE;gBAAC,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAA;QAC9G,CAAC;QACD,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAA;IACnC,CAAC,EAAC,IAAI,CAAC,CAAA;AACR,CAAC"}

package/dist/auth/store.d.ts

@@ -1,7 +1,32 @@
-import type { CliConfig } from '../lib/config.js';
+import { type Stats } from 'node:fs';
+import { z } from 'zod';
+import { type CliConfig } from '../lib/config.js';
 import type { CredentialsFile, OneCredentials } from './types.js';
-type CredentialsConfig = Pick<CliConfig, 'configDir'> & Partial<Pick<CliConfig, 'oneBaseUrl'>>;
+type CredentialsConfig = Pick<CliConfig, 'configDir'> & Partial<Pick<CliConfig, 'oneBaseUrl' | 'clientId' | 'identityBaseUrl' | 'timeoutMs' | 'userAgent'>>;
+export declare const OneCredentialsSchema: z.ZodObject<{
+    issuer: z.ZodOptional<z.ZodString>;
+    clientId: z.ZodOptional<z.ZodString>;
+    resource: z.ZodOptional<z.ZodString>;
+    refreshToken: z.ZodOptional<z.ZodString>;
+    refreshTokenExpiresAt: z.ZodOptional<z.ZodString>;
+    refreshPending: z.ZodOptional<z.ZodBoolean>;
+    orgId: z.ZodOptional<z.ZodString>;
+    oneBaseUrl: z.ZodOptional<z.ZodString>;
+    accessToken: z.ZodString;
+    tokenType: z.ZodOptional<z.ZodString>;
+    scope: z.ZodOptional<z.ZodString>;
+    expiresAt: z.ZodOptional<z.ZodString>;
+    obtainedAt: z.ZodString;
+    user: z.ZodOptional<z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
+        email: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
 export declare function credentialsPath(config: Pick<CliConfig, 'configDir'>): string;
+export declare function assertFile(info: Stats): void;
+/** Check every ancestor before traversing it; a writable non-sticky parent permits replacement. */
+export declare function checkDirectory(configDir: string, isCreate?: boolean): Promise<boolean>;
 export declare function readCredentials(config: Pick<CliConfig, 'configDir'>): Promise<CredentialsFile>;
 export declare function writeOneCredentials(config: CredentialsConfig, one: OneCredentials): Promise<void>;
 export declare function clearOneCredentials(config: Pick<CliConfig, 'configDir'>): Promise<boolean>;

package/dist/auth/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/auth/store.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAMjE,KAAK,iBAAiB,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAA;AAQ9F,wBAAgB,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,GAAG,MAAM,CAG5E;AA4DD,wBAAsB,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC,CAepG;AAED,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBvG;AAED,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAKhG;AAED,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAczF"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/auth/store.ts"],"names":[],"mappings":"AACA,OAAO,EAAa,KAAK,KAAK,EAAE,MAAM,SAAS,CAAA;AAG/C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAMjE,KAAK,iBAAiB,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,GAAC,UAAU,GAAC,iBAAiB,GAAC,WAAW,GAAC,WAAW,CAAC,CAAC,CAAA;AACnJ,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;iBAK/B,CAAA;AAGF,wBAAgB,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,GAAG,MAAM,CAG5E;AASD,wBAAgB,UAAU,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,CAQ5C;AAED,mGAAmG;AACnG,wBAAsB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,UAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CA+B1F;AASD,wBAAsB,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC,CAiBpG;AAED,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBvG;AAED,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAKhG;AAED,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoBzF"}