@xemahq/xema 0.14.0 → 0.15.0

package/dist/lib/control-plane.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.authHeaders = authHeaders;
 exports.resolveTarget = resolveTarget;
 exports.loadManifest = loadManifest;
 exports.writeManifest = writeManifest;
@@ -13,16 +14,65 @@ const resource_1 = require("@xemahq/kernel-contracts/resource");
 const yaml_1 = require("yaml");
 const exit_codes_1 = require("./exit-codes");
 const http_error_1 = require("./http-error");
-function resolveTarget(flags) {
-    const endpoint = flags.endpoint ?? process.env.XEMA_ENDPOINT;
-    const token = flags.token ?? process.env.XEMA_TOKEN;
+const session_auth_1 = require("../runtime/auth/session-auth");
+const credentials_1 = require("../runtime/sources/credentials");
+function authHeaders(target) {
+    return {
+        authorization: `Bearer ${target.token}`,
+        ...(target.orgId !== undefined && target.orgId.length > 0
+            ? { 'x-xema-org-id': target.orgId }
+            : {}),
+    };
+}
+function resolveExplicitToken(flags) {
+    if (flags.token !== undefined && flags.token.length > 0) {
+        return flags.token;
+    }
+    if (flags.tokenEnv !== undefined && flags.tokenEnv.length > 0) {
+        return new credentials_1.CredentialResolver().resolve(flags.tokenEnv, '--token-env');
+    }
+    const ambient = process.env.XEMA_TOKEN;
+    return ambient !== undefined && ambient.length > 0 ? ambient : undefined;
+}
+async function resolveTarget(flags) {
+    let token;
+    try {
+        token = resolveExplicitToken(flags);
+    }
+    catch (err) {
+        const detail = err instanceof Error ? err.message : String(err);
+        (0, exit_codes_1.exitWith)(exit_codes_1.XemaCliExitCode.ConfigurationError, detail);
+    }
+    let endpoint = flags.endpoint ?? process.env.XEMA_ENDPOINT;
+    if (token === undefined || endpoint === undefined || endpoint.length === 0) {
+        let session;
+        try {
+            session = await (0, session_auth_1.loadUsableSession)();
+        }
+        catch (err) {
+            const detail = err instanceof Error ? err.message : String(err);
+            (0, exit_codes_1.exitWith)(exit_codes_1.XemaCliExitCode.ConfigurationError, detail);
+        }
+        if (session !== undefined) {
+            token = token ?? session.accessToken;
+            endpoint =
+                endpoint !== undefined && endpoint.length > 0
+                    ? endpoint
+                    : session.endpoint;
+        }
+    }
     if (endpoint === undefined || endpoint.length === 0) {
-        (0, exit_codes_1.exitWith)(exit_codes_1.XemaCliExitCode.ConfigurationError, 'No control-plane endpoint. Pass --endpoint <url> or set XEMA_ENDPOINT.');
+        (0, exit_codes_1.exitWith)(exit_codes_1.XemaCliExitCode.ConfigurationError, 'No control-plane endpoint. Pass --endpoint <url>, set XEMA_ENDPOINT, or run `xema login`.');
     }
     if (token === undefined || token.length === 0) {
-        (0, exit_codes_1.exitWith)(exit_codes_1.XemaCliExitCode.ConfigurationError, 'No org-admin token. Pass --token <jwt> or set XEMA_TOKEN.');
+        (0, exit_codes_1.exitWith)(exit_codes_1.XemaCliExitCode.ConfigurationError, 'No token. Pass --token <jwt>, set XEMA_TOKEN, or run `xema login`.');
     }
-    return { baseUrl: endpoint.replace(/\/+$/, ''), token };
+    const orgId = flags.orgId ?? process.env.XEMA_ORG_ID;
+    return {
+        baseUrl: endpoint.replace(/\/+$/, ''),
+        token,
+        ...(orgId !== undefined && orgId.length > 0 ? { orgId } : {}),
+    };
 }
 async function loadManifest(path) {
     let raw;

package/dist/lib/control-plane.js.map

@@ -1 +1 @@
-{"version":3,"file":"control-plane.js","sourceRoot":"","sources":["../../src/lib/control-plane.ts"],"names":[],"mappings":";;AAmEA,sCAkBC;AAOD,oCAsBC;AAGD,sCAEC;AAGD,oCAEC;AAwDD,8BAQC;AAED,gCAWC;AAED,kCAUC;AAED,kCAWC;AA/MD,+CAAuD;AAEvD,gEAI2C;AAC3C,+BAAsE;AAEtE,6CAAyD;AACzD,6CAAkD;AAsClD,SAAgB,aAAa,CAAC,KAAwB;IACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IAEpD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,IAAA,qBAAQ,EACN,4BAAe,CAAC,kBAAkB,EAClC,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,IAAA,qBAAQ,EACN,4BAAe,CAAC,kBAAkB,EAClC,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;AAC1D,CAAC;AAOM,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,IAAA,mBAAQ,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,IAAA,qBAAQ,EAAC,4BAAe,CAAC,QAAQ,EAAE,uBAAuB,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAA,YAAS,EAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,IAAA,qBAAQ,EAAC,4BAAe,CAAC,kBAAkB,EAAE,mBAAmB,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAA,4BAAiB,EAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,IAAA,qBAAQ,EAAC,4BAAe,CAAC,kBAAkB,EAAE,oBAAoB,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;IACtF,CAAC;AACH,CAAC;AAGM,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,QAAsB;IACtE,MAAM,IAAA,oBAAS,EAAC,IAAI,EAAE,IAAA,gBAAa,EAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;AACzD,CAAC;AAGD,SAAgB,YAAY,CAAC,IAAwB,EAAE,QAAuB;IAC5E,OAAO,IAAI,IAAI,QAAQ,EAAE,KAAK,IAAI,SAAS,CAAC;AAC9C,CAAC;AAeD,KAAK,UAAU,IAAI,CACjB,MAA0B,EAC1B,MAAsB,EACtB,IAAY,EACZ,IAAc;IAEd,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;IACvC,MAAM,IAAI,GAAgB;QACxB,MAAM;QACN,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,KAAK,EAAE,EAAE;KACrD,CAAC;IACF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACtB,IAAI,CAAC,OAAkC,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QAC9E,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,OAAO,IAAA,qBAAQ,EACb,4BAAe,CAAC,YAAY,EAC5B,gCAAgC,GAAG,KAAK,MAAM,EAAE,CACjD,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO,IAAA,qBAAQ,EACb,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,4BAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,4BAAe,CAAC,YAAY,EAC5E,iBAAiB,MAAM,IAAI,IAAI,MAAM,GAAG,CAAC,MAAM,IAAI;YACjD,IAAA,+BAAkB,EAAC,GAAG,CAAC,MAAM,EAAE,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CACzD,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAoB,CAAC;IAC9E,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;AAElE,SAAgB,SAAS,CACvB,MAA0B,EAC1B,KAAa,EACb,QAAsB;IAEtB,OAAO,IAAI,CAAe,MAAM,EAAE,MAAM,EAAE,yBAAyB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;QACvF,QAAQ;KACT,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,UAAU,CACxB,MAA0B,EAC1B,KAAa,EACb,QAAsB;IAEtB,OAAO,IAAI,CACT,MAAM,EACN,MAAM,EACN,yBAAyB,MAAM,CAAC,KAAK,CAAC,QAAQ,EAC9C,EAAE,QAAQ,EAAE,CACb,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,WAAW,CAC/B,MAA0B,EAC1B,KAAa;IAEb,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAC7B,MAAM,EACN,KAAK,EACL,yBAAyB,MAAM,CAAC,KAAK,CAAC,SAAS,CAChD,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAgB,WAAW,CACzB,MAA0B,EAC1B,KAAa,EACb,QAAsB;IAEtB,OAAO,IAAI,CACT,MAAM,EACN,MAAM,EACN,yBAAyB,MAAM,CAAC,KAAK,CAAC,SAAS,EAC/C,EAAE,QAAQ,EAAE,CACb,CAAC;AACJ,CAAC"}
+{"version":3,"file":"control-plane.js","sourceRoot":"","sources":["../../src/lib/control-plane.ts"],"names":[],"mappings":";;AA2FA,kCASC;AAoCD,sCAmDC;AAOD,oCAsBC;AAGD,sCAEC;AAGD,oCAEC;AAwDD,8BAQC;AAED,gCAWC;AAED,kCAUC;AAED,kCAWC;AArTD,+CAAuD;AAEvD,gEAI2C;AAC3C,+BAAsE;AAEtE,6CAAyD;AACzD,6CAAkD;AAClD,+DAAiE;AACjE,gEAAoE;AA4DpE,SAAgB,WAAW,CACzB,MAA0B;IAE1B,OAAO;QACL,aAAa,EAAE,UAAU,MAAM,CAAC,KAAK,EAAE;QACvC,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YACvD,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,KAAK,EAAE;YACnC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAYD,SAAS,oBAAoB,CAAC,KAAwB;IACpD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAI9D,OAAO,IAAI,gCAAkB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACvC,OAAO,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAYM,KAAK,UAAU,aAAa,CACjC,KAAwB;IAExB,IAAI,KAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,KAAK,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,IAAA,qBAAQ,EAAC,4BAAe,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAK3D,IAAI,KAAK,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3E,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAA,gCAAiB,GAAE,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChE,IAAA,qBAAQ,EAAC,4BAAe,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,KAAK,GAAG,KAAK,IAAI,OAAO,CAAC,WAAW,CAAC;YACrC,QAAQ;gBACN,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;oBAC3C,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,IAAA,qBAAQ,EACN,4BAAe,CAAC,kBAAkB,EAClC,2FAA2F,CAC5F,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,IAAA,qBAAQ,EACN,4BAAe,CAAC,kBAAkB,EAClC,oEAAoE,CACrE,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACrD,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACrC,KAAK;QACL,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9D,CAAC;AACJ,CAAC;AAOM,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,IAAA,mBAAQ,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,IAAA,qBAAQ,EAAC,4BAAe,CAAC,QAAQ,EAAE,uBAAuB,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAA,YAAS,EAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,IAAA,qBAAQ,EAAC,4BAAe,CAAC,kBAAkB,EAAE,mBAAmB,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAA,4BAAiB,EAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,IAAA,qBAAQ,EAAC,4BAAe,CAAC,kBAAkB,EAAE,oBAAoB,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;IACtF,CAAC;AACH,CAAC;AAGM,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,QAAsB;IACtE,MAAM,IAAA,oBAAS,EAAC,IAAI,EAAE,IAAA,gBAAa,EAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;AACzD,CAAC;AAGD,SAAgB,YAAY,CAAC,IAAwB,EAAE,QAAuB;IAC5E,OAAO,IAAI,IAAI,QAAQ,EAAE,KAAK,IAAI,SAAS,CAAC;AAC9C,CAAC;AAeD,KAAK,UAAU,IAAI,CACjB,MAA0B,EAC1B,MAAsB,EACtB,IAAY,EACZ,IAAc;IAEd,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;IACvC,MAAM,IAAI,GAAgB;QACxB,MAAM;QACN,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,KAAK,EAAE,EAAE;KACrD,CAAC;IACF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACtB,IAAI,CAAC,OAAkC,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QAC9E,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,OAAO,IAAA,qBAAQ,EACb,4BAAe,CAAC,YAAY,EAC5B,gCAAgC,GAAG,KAAK,MAAM,EAAE,CACjD,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO,IAAA,qBAAQ,EACb,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,4BAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,4BAAe,CAAC,YAAY,EAC5E,iBAAiB,MAAM,IAAI,IAAI,MAAM,GAAG,CAAC,MAAM,IAAI;YACjD,IAAA,+BAAkB,EAAC,GAAG,CAAC,MAAM,EAAE,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CACzD,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAoB,CAAC;IAC9E,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;AAElE,SAAgB,SAAS,CACvB,MAA0B,EAC1B,KAAa,EACb,QAAsB;IAEtB,OAAO,IAAI,CAAe,MAAM,EAAE,MAAM,EAAE,yBAAyB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;QACvF,QAAQ;KACT,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,UAAU,CACxB,MAA0B,EAC1B,KAAa,EACb,QAAsB;IAEtB,OAAO,IAAI,CACT,MAAM,EACN,MAAM,EACN,yBAAyB,MAAM,CAAC,KAAK,CAAC,QAAQ,EAC9C,EAAE,QAAQ,EAAE,CACb,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,WAAW,CAC/B,MAA0B,EAC1B,KAAa;IAEb,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAC7B,MAAM,EACN,KAAK,EACL,yBAAyB,MAAM,CAAC,KAAK,CAAC,SAAS,CAChD,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAgB,WAAW,CACzB,MAA0B,EAC1B,KAAa,EACb,QAAsB;IAEtB,OAAO,IAAI,CACT,MAAM,EACN,MAAM,EACN,yBAAyB,MAAM,CAAC,KAAK,CAAC,SAAS,EAC/C,EAAE,QAAQ,EAAE,CACb,CAAC;AACJ,CAAC"}

package/dist/runtime/asset-provenance.d.ts

@@ -0,0 +1,17 @@
+export interface VendoredEditionProvenance {
+    readonly id: string;
+    readonly sourceCommit: string;
+    readonly inputHash: string | null;
+}
+export interface AssetProvenance {
+    readonly distributionsRepo: string;
+    readonly bootGraph: {
+        readonly repo: string;
+        readonly sourcePath: string;
+        readonly sourceCommit: string;
+    };
+    readonly editions: ReadonlyArray<VendoredEditionProvenance>;
+}
+export declare function readAssetProvenance(): AssetProvenance | null;
+export declare function describeAssetProvenance(provenance: AssetProvenance): string;
+//# sourceMappingURL=asset-provenance.d.ts.map

package/dist/runtime/asset-provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-provenance.d.ts","sourceRoot":"","sources":["../../src/runtime/asset-provenance.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;KAC/B,CAAC;IACF,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,yBAAyB,CAAC,CAAC;CAC7D;AAWD,wBAAgB,mBAAmB,IAAI,eAAe,GAAG,IAAI,CAiB5D;AAGD,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,eAAe,GAAG,MAAM,CAK3E"}

package/dist/runtime/asset-provenance.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readAssetProvenance = readAssetProvenance;
+exports.describeAssetProvenance = describeAssetProvenance;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const paths_1 = require("./paths");
+const MANIFEST_FILE = 'distribution-assets.manifest.json';
+function readAssetProvenance() {
+    const manifestPath = (0, node_path_1.join)((0, paths_1.vendoredAssetsDir)(), MANIFEST_FILE);
+    if (!(0, node_fs_1.existsSync)(manifestPath)) {
+        return null;
+    }
+    const parsed = JSON.parse((0, node_fs_1.readFileSync)(manifestPath, 'utf8'));
+    if (typeof parsed.distributionsRepo !== 'string' ||
+        parsed.bootGraph === undefined ||
+        !Array.isArray(parsed.editions)) {
+        throw new Error(`${manifestPath} is not a valid distribution-asset manifest — this install is corrupt; ` +
+            'reinstall @xemahq/xema.');
+    }
+    return parsed;
+}
+function describeAssetProvenance(provenance) {
+    const editions = provenance.editions
+        .map((e) => `${e.id}@${e.sourceCommit.slice(0, 8)}`)
+        .join(', ');
+    return `${provenance.distributionsRepo}: ${editions}`;
+}
+//# sourceMappingURL=asset-provenance.js.map

package/dist/runtime/asset-provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-provenance.js","sourceRoot":"","sources":["../../src/runtime/asset-provenance.ts"],"names":[],"mappings":";;AA6CA,kDAiBC;AAGD,0DAKC;AAtED,qCAAmD;AACnD,yCAAiC;AAEjC,mCAA4C;AAkC5C,MAAM,aAAa,GAAG,mCAAmC,CAAC;AAQ1D,SAAgB,mBAAmB;IACjC,MAAM,YAAY,GAAG,IAAA,gBAAI,EAAC,IAAA,yBAAiB,GAAE,EAAE,aAAa,CAAC,CAAC;IAC9D,IAAI,CAAC,IAAA,oBAAU,EAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,YAAY,EAAE,MAAM,CAAC,CAA6B,CAAC;IAC1F,IACE,OAAO,MAAM,CAAC,iBAAiB,KAAK,QAAQ;QAC5C,MAAM,CAAC,SAAS,KAAK,SAAS;QAC9B,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC/B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,GAAG,YAAY,yEAAyE;YACtF,yBAAyB,CAC5B,CAAC;IACJ,CAAC;IACD,OAAO,MAAyB,CAAC;AACnC,CAAC;AAGD,SAAgB,uBAAuB,CAAC,UAA2B;IACjE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ;SACjC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;SACnD,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,GAAG,UAAU,CAAC,iBAAiB,KAAK,QAAQ,EAAE,CAAC;AACxD,CAAC"}

package/dist/runtime/auth/client-bootstrap.d.ts

@@ -0,0 +1,11 @@
+import { IdentityApiClient } from '@xemahq/identity-client';
+export interface RegisterCliClientOptions {
+    readonly identityApiUrl: string;
+    readonly internalToken: string;
+    readonly realm: string;
+    readonly identityClient?: Pick<IdentityApiClient, 'registerServiceFull'>;
+}
+export declare const IDENTITY_API_INTERNAL_TOKEN = "IDENTITY_API_INTERNAL_TOKEN";
+export declare function resolveIdentityRegistrationToken(configuredToken: string | undefined, environmentToken: string | undefined): string;
+export declare function registerCliDeviceClient(options: RegisterCliClientOptions): Promise<void>;
+//# sourceMappingURL=client-bootstrap.d.ts.map

package/dist/runtime/auth/client-bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-bootstrap.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/client-bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EAIlB,MAAM,yBAAyB,CAAC;AAIjC,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;CAC1E;AAaD,eAAO,MAAM,2BAA2B,gCAAgC,CAAC;AAQzE,wBAAgB,gCAAgC,CAC9C,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,gBAAgB,EAAE,MAAM,GAAG,SAAS,GACnC,MAAM,CAmBR;AAOD,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,IAAI,CAAC,CAsBf"}

package/dist/runtime/auth/client-bootstrap.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDENTITY_API_INTERNAL_TOKEN = void 0;
+exports.resolveIdentityRegistrationToken = resolveIdentityRegistrationToken;
+exports.registerCliDeviceClient = registerCliDeviceClient;
+const identity_client_1 = require("@xemahq/identity-client");
+const device_flow_1 = require("./device-flow");
+const PUBLIC_DEVICE_SERVICE_TYPE = 'PUBLIC_DEVICE';
+const CLI_REGISTRATION = Object.freeze({
+    name: device_flow_1.DEFAULT_CLI_CLIENT_ID,
+    displayName: 'Xema CLI',
+    description: 'Public device-authorization client for the Xema command-line interface',
+    serviceType: PUBLIC_DEVICE_SERVICE_TYPE,
+    regenerateSecret: false,
+});
+exports.IDENTITY_API_INTERNAL_TOKEN = 'IDENTITY_API_INTERNAL_TOKEN';
+function resolveIdentityRegistrationToken(configuredToken, environmentToken) {
+    const configured = normalizeToken(configuredToken, 'configured secret');
+    const environment = normalizeToken(environmentToken, 'process environment');
+    if (configured !== undefined &&
+        environment !== undefined &&
+        configured !== environment) {
+        throw new Error(`${exports.IDENTITY_API_INTERNAL_TOKEN} differs between the configured secret and process environment. Refusing ambiguous identity authority.`);
+    }
+    const token = configured ?? environment;
+    if (token === undefined) {
+        throw new Error(`${exports.IDENTITY_API_INTERNAL_TOKEN} is required to reconcile the ${device_flow_1.DEFAULT_CLI_CLIENT_ID} public device client. Declare that exact secret or environment variable before launch.`);
+    }
+    return token;
+}
+async function registerCliDeviceClient(options) {
+    const client = options.identityClient ??
+        new identity_client_1.IdentityApiClient({
+            baseUrl: options.identityApiUrl,
+            internalToken: options.internalToken,
+        });
+    const registration = await client.registerServiceFull({
+        ...CLI_REGISTRATION,
+        realm: options.realm,
+    });
+    if (registration.id !== device_flow_1.DEFAULT_CLI_CLIENT_ID) {
+        throw new Error(`identity-api registration response did not identify ${device_flow_1.DEFAULT_CLI_CLIENT_ID}.`);
+    }
+    if (registration.clientSecret !== null) {
+        throw new Error(`identity-api returned a client secret for public client ${device_flow_1.DEFAULT_CLI_CLIENT_ID}.`);
+    }
+}
+function normalizeToken(token, source) {
+    if (token === undefined) {
+        return undefined;
+    }
+    if (token.length === 0 || token.trim().length === 0) {
+        throw new Error(`${exports.IDENTITY_API_INTERNAL_TOKEN} from ${source} is empty.`);
+    }
+    if (token !== token.trim()) {
+        throw new Error(`${exports.IDENTITY_API_INTERNAL_TOKEN} from ${source} has leading or trailing whitespace.`);
+    }
+    return token;
+}
+//# sourceMappingURL=client-bootstrap.js.map

package/dist/runtime/auth/client-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-bootstrap.js","sourceRoot":"","sources":["../../../src/runtime/auth/client-bootstrap.ts"],"names":[],"mappings":";;;AAmCA,4EAsBC;AAOD,0DAwBC;AAxFD,6DAKiC;AAEjC,+CAAsD;AAStD,MAAM,0BAA0B,GAAgB,eAAe,CAAC;AAEhE,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC;IACrC,IAAI,EAAE,mCAAqB;IAC3B,WAAW,EAAE,UAAU;IACvB,WAAW,EACT,wEAAwE;IAC1E,WAAW,EAAE,0BAA0B;IACvC,gBAAgB,EAAE,KAAK;CACwB,CAAC,CAAC;AAEtC,QAAA,2BAA2B,GAAG,6BAA6B,CAAC;AAQzE,SAAgB,gCAAgC,CAC9C,eAAmC,EACnC,gBAAoC;IAEpC,MAAM,UAAU,GAAG,cAAc,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;IACxE,MAAM,WAAW,GAAG,cAAc,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,CAAC;IAC5E,IACE,UAAU,KAAK,SAAS;QACxB,WAAW,KAAK,SAAS;QACzB,UAAU,KAAK,WAAW,EAC1B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,GAAG,mCAA2B,wGAAwG,CACvI,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,IAAI,WAAW,CAAC;IACxC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,GAAG,mCAA2B,iCAAiC,mCAAqB,yFAAyF,CAC9K,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAOM,KAAK,UAAU,uBAAuB,CAC3C,OAAiC;IAEjC,MAAM,MAAM,GACV,OAAO,CAAC,cAAc;QACtB,IAAI,mCAAiB,CAAC;YACpB,OAAO,EAAE,OAAO,CAAC,cAAc;YAC/B,aAAa,EAAE,OAAO,CAAC,aAAa;SACrC,CAAC,CAAC;IACL,MAAM,YAAY,GAChB,MAAM,MAAM,CAAC,mBAAmB,CAAC;QAC/B,GAAG,gBAAgB;QACnB,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC;IACL,IAAI,YAAY,CAAC,EAAE,KAAK,mCAAqB,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,uDAAuD,mCAAqB,GAAG,CAChF,CAAC;IACJ,CAAC;IACD,IAAI,YAAY,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,2DAA2D,mCAAqB,GAAG,CACpF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,KAAyB,EACzB,MAAc;IAEd,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,GAAG,mCAA2B,SAAS,MAAM,YAAY,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,GAAG,mCAA2B,SAAS,MAAM,sCAAsC,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/runtime/auth/device-flow.d.ts

@@ -0,0 +1,43 @@
+export declare enum DeviceFlowErrorCode {
+    AuthorizationPending = "authorization_pending",
+    SlowDown = "slow_down",
+    AccessDenied = "access_denied",
+    ExpiredToken = "expired_token"
+}
+export declare const DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+export declare const DEFAULT_POLL_INTERVAL_SECONDS = 5;
+export declare const SLOW_DOWN_INCREMENT_SECONDS = 5;
+export declare const DEVICE_FLOW_SCOPE = "openid profile email offline_access";
+export declare const DEFAULT_CLI_CLIENT_ID = "xema-cli";
+export declare class DeviceFlowError extends Error {
+    constructor(message: string);
+}
+export interface OidcEndpoints {
+    readonly issuer: string;
+    readonly deviceAuthorizationEndpoint: string;
+    readonly tokenEndpoint: string;
+}
+export interface DeviceAuthorization {
+    readonly deviceCode: string;
+    readonly userCode: string;
+    readonly verificationUri: string;
+    readonly verificationUriComplete?: string;
+    readonly expiresInSeconds: number;
+    readonly intervalSeconds: number;
+}
+export interface DeviceTokens {
+    readonly accessToken: string;
+    readonly refreshToken?: string;
+    readonly expiresAt: number;
+}
+export interface DeviceFlowDeps {
+    readonly fetch: typeof globalThis.fetch;
+    readonly sleep: (ms: number) => Promise<void>;
+    readonly now: () => number;
+}
+export declare function defaultDeviceFlowDeps(): DeviceFlowDeps;
+export declare function discoverOidcEndpoints(issuer: string, deps: DeviceFlowDeps): Promise<OidcEndpoints>;
+export declare function requestDeviceAuthorization(endpoints: OidcEndpoints, clientId: string, deps: DeviceFlowDeps): Promise<DeviceAuthorization>;
+export declare function pollForDeviceTokens(endpoints: OidcEndpoints, clientId: string, authorization: DeviceAuthorization, deps: DeviceFlowDeps): Promise<DeviceTokens>;
+export declare function refreshAccessToken(endpoints: OidcEndpoints, clientId: string, refreshToken: string, deps: DeviceFlowDeps): Promise<DeviceTokens>;
+//# sourceMappingURL=device-flow.d.ts.map

package/dist/runtime/auth/device-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/device-flow.ts"],"names":[],"mappings":"AAiCA,oBAAY,mBAAmB;IAE7B,oBAAoB,0BAA0B;IAE9C,QAAQ,cAAc;IAEtB,YAAY,kBAAkB;IAE9B,YAAY,kBAAkB;CAC/B;AAGD,eAAO,MAAM,sBAAsB,iDACa,CAAC;AAMjD,eAAO,MAAM,6BAA6B,IAAI,CAAC;AAG/C,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAG7C,eAAO,MAAM,iBAAiB,wCAAwC,CAAC;AAMvE,eAAO,MAAM,qBAAqB,aAAa,CAAC;AAGhD,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM;CAI5B;AAGD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,2BAA2B,EAAE,MAAM,CAAC;IAC7C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAGD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IAEjC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAGD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAMD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;CAC5B;AAGD,wBAAgB,qBAAqB,IAAI,cAAc,CAStD;AAkED,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,aAAa,CAAC,CAqCxB;AA4BD,wBAAsB,0BAA0B,CAC9C,SAAS,EAAE,aAAa,EACxB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,mBAAmB,CAAC,CA4C9B;AA4BD,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,aAAa,EACxB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,mBAAmB,EAClC,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,YAAY,CAAC,CAwDvB;AAUD,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,aAAa,EACxB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,YAAY,CAAC,CAoBvB"}

package/dist/runtime/auth/device-flow.js

@@ -0,0 +1,201 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeviceFlowError = exports.DEFAULT_CLI_CLIENT_ID = exports.DEVICE_FLOW_SCOPE = exports.SLOW_DOWN_INCREMENT_SECONDS = exports.DEFAULT_POLL_INTERVAL_SECONDS = exports.DEVICE_CODE_GRANT_TYPE = exports.DeviceFlowErrorCode = void 0;
+exports.defaultDeviceFlowDeps = defaultDeviceFlowDeps;
+exports.discoverOidcEndpoints = discoverOidcEndpoints;
+exports.requestDeviceAuthorization = requestDeviceAuthorization;
+exports.pollForDeviceTokens = pollForDeviceTokens;
+exports.refreshAccessToken = refreshAccessToken;
+var DeviceFlowErrorCode;
+(function (DeviceFlowErrorCode) {
+    DeviceFlowErrorCode["AuthorizationPending"] = "authorization_pending";
+    DeviceFlowErrorCode["SlowDown"] = "slow_down";
+    DeviceFlowErrorCode["AccessDenied"] = "access_denied";
+    DeviceFlowErrorCode["ExpiredToken"] = "expired_token";
+})(DeviceFlowErrorCode || (exports.DeviceFlowErrorCode = DeviceFlowErrorCode = {}));
+exports.DEVICE_CODE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code';
+exports.DEFAULT_POLL_INTERVAL_SECONDS = 5;
+exports.SLOW_DOWN_INCREMENT_SECONDS = 5;
+exports.DEVICE_FLOW_SCOPE = 'openid profile email offline_access';
+exports.DEFAULT_CLI_CLIENT_ID = 'xema-cli';
+class DeviceFlowError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'DeviceFlowError';
+    }
+}
+exports.DeviceFlowError = DeviceFlowError;
+function defaultDeviceFlowDeps() {
+    return {
+        fetch: globalThis.fetch.bind(globalThis),
+        sleep: (ms) => new Promise((resolve) => {
+            setTimeout(resolve, ms);
+        }),
+        now: () => Date.now(),
+    };
+}
+function requireString(body, field, context) {
+    const value = body[field];
+    if (typeof value !== 'string' || value.length === 0) {
+        throw new DeviceFlowError(`${context} response is missing the required "${field}" field.`);
+    }
+    return value;
+}
+function requirePositiveInt(body, field, context) {
+    const value = body[field];
+    if (typeof value !== 'number' || !Number.isFinite(value) || value <= 0) {
+        throw new DeviceFlowError(`${context} response field "${field}" must be a positive number.`);
+    }
+    return Math.floor(value);
+}
+async function readJson(response, context) {
+    const text = await response.text();
+    if (text.trim().length === 0) {
+        throw new DeviceFlowError(`${context} returned an empty body.`);
+    }
+    try {
+        const parsed = JSON.parse(text);
+        if (typeof parsed !== 'object' || parsed === null) {
+            throw new DeviceFlowError(`${context} returned a non-object body.`);
+        }
+        return parsed;
+    }
+    catch (err) {
+        if (err instanceof DeviceFlowError) {
+            throw err;
+        }
+        throw new DeviceFlowError(`${context} returned a body that is not JSON: ${text.slice(0, 200)}`);
+    }
+}
+async function discoverOidcEndpoints(issuer, deps) {
+    const base = issuer.replace(/\/+$/, '');
+    const url = `${base}/.well-known/openid-configuration`;
+    let response;
+    try {
+        response = await deps.fetch(url, {
+            headers: { accept: 'application/json' },
+        });
+    }
+    catch (err) {
+        const detail = err instanceof Error ? err.message : String(err);
+        throw new DeviceFlowError(`Identity provider unreachable at ${url}: ${detail}`);
+    }
+    if (!response.ok) {
+        throw new DeviceFlowError(`OIDC discovery failed: ${url} → HTTP ${String(response.status)}.`);
+    }
+    const body = await readJson(response, 'OIDC discovery');
+    const deviceEndpoint = body.device_authorization_endpoint;
+    if (typeof deviceEndpoint !== 'string' || deviceEndpoint.length === 0) {
+        throw new DeviceFlowError(`The identity provider at ${base} does not advertise a ` +
+            'device_authorization_endpoint, so `xema login` cannot run. Enable the ' +
+            'OAuth 2.0 Device Authorization Grant on the realm client, then retry.');
+    }
+    return {
+        issuer: requireString(body, 'issuer', 'OIDC discovery'),
+        deviceAuthorizationEndpoint: deviceEndpoint,
+        tokenEndpoint: requireString(body, 'token_endpoint', 'OIDC discovery'),
+    };
+}
+async function postForm(endpoint, form, deps, context) {
+    try {
+        return await deps.fetch(endpoint, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/x-www-form-urlencoded',
+                accept: 'application/json',
+            },
+            body: new URLSearchParams(form).toString(),
+        });
+    }
+    catch (err) {
+        const detail = err instanceof Error ? err.message : String(err);
+        throw new DeviceFlowError(`${context} unreachable at ${endpoint}: ${detail}`);
+    }
+}
+async function requestDeviceAuthorization(endpoints, clientId, deps) {
+    const response = await postForm(endpoints.deviceAuthorizationEndpoint, { client_id: clientId, scope: exports.DEVICE_FLOW_SCOPE }, deps, 'Device authorization');
+    const body = await readJson(response, 'Device authorization');
+    if (!response.ok) {
+        const code = typeof body.error === 'string' ? body.error : 'unknown_error';
+        const description = typeof body.error_description === 'string'
+            ? ` — ${body.error_description}`
+            : '';
+        throw new DeviceFlowError(`Device authorization refused by the identity provider (${code})${description}. ` +
+            `Check that the "${clientId}" client exists and has the device grant enabled.`);
+    }
+    const verificationUriComplete = body.verification_uri_complete;
+    return {
+        deviceCode: requireString(body, 'device_code', 'Device authorization'),
+        userCode: requireString(body, 'user_code', 'Device authorization'),
+        verificationUri: requireString(body, 'verification_uri', 'Device authorization'),
+        ...(typeof verificationUriComplete === 'string' &&
+            verificationUriComplete.length > 0
+            ? { verificationUriComplete }
+            : {}),
+        expiresInSeconds: requirePositiveInt(body, 'expires_in', 'Device authorization'),
+        intervalSeconds: typeof body.interval === 'number' && body.interval > 0
+            ? Math.floor(body.interval)
+            : exports.DEFAULT_POLL_INTERVAL_SECONDS,
+    };
+}
+function toTokens(body, context, now) {
+    const refreshToken = body.refresh_token;
+    return {
+        accessToken: requireString(body, 'access_token', context),
+        ...(typeof refreshToken === 'string' && refreshToken.length > 0
+            ? { refreshToken }
+            : {}),
+        expiresAt: now + requirePositiveInt(body, 'expires_in', context) * 1000,
+    };
+}
+async function pollForDeviceTokens(endpoints, clientId, authorization, deps) {
+    let intervalSeconds = authorization.intervalSeconds;
+    const deadline = deps.now() + authorization.expiresInSeconds * 1000;
+    for (;;) {
+        await deps.sleep(intervalSeconds * 1000);
+        if (deps.now() >= deadline) {
+            throw new DeviceFlowError('The login request expired before it was approved. Run `xema login` again.');
+        }
+        const response = await postForm(endpoints.tokenEndpoint, {
+            grant_type: exports.DEVICE_CODE_GRANT_TYPE,
+            device_code: authorization.deviceCode,
+            client_id: clientId,
+        }, deps, 'Token endpoint');
+        const body = await readJson(response, 'Token endpoint');
+        if (response.ok) {
+            return toTokens(body, 'Token endpoint', deps.now());
+        }
+        const error = typeof body.error === 'string' ? body.error : '';
+        switch (error) {
+            case DeviceFlowErrorCode.AuthorizationPending:
+                continue;
+            case DeviceFlowErrorCode.SlowDown:
+                intervalSeconds += exports.SLOW_DOWN_INCREMENT_SECONDS;
+                continue;
+            case DeviceFlowErrorCode.AccessDenied:
+                throw new DeviceFlowError('The login request was denied in the browser.');
+            case DeviceFlowErrorCode.ExpiredToken:
+                throw new DeviceFlowError('The login request expired before it was approved. Run `xema login` again.');
+            default: {
+                const description = typeof body.error_description === 'string'
+                    ? ` — ${body.error_description}`
+                    : '';
+                throw new DeviceFlowError(`Login failed (${error.length > 0 ? error : `HTTP ${String(response.status)}`})${description}.`);
+            }
+        }
+    }
+}
+async function refreshAccessToken(endpoints, clientId, refreshToken, deps) {
+    const response = await postForm(endpoints.tokenEndpoint, {
+        grant_type: 'refresh_token',
+        refresh_token: refreshToken,
+        client_id: clientId,
+    }, deps, 'Token endpoint');
+    const body = await readJson(response, 'Token endpoint');
+    if (!response.ok) {
+        const error = typeof body.error === 'string' ? body.error : 'unknown_error';
+        throw new DeviceFlowError(`Session refresh failed (${error}). Run \`xema login\` to sign in again.`);
+    }
+    return toTokens(body, 'Token endpoint', deps.now());
+}
+//# sourceMappingURL=device-flow.js.map

package/dist/runtime/auth/device-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow.js","sourceRoot":"","sources":["../../../src/runtime/auth/device-flow.ts"],"names":[],"mappings":";;;AA+GA,sDASC;AAkED,sDAwCC;AA4BD,gEAgDC;AA4BD,kDA6DC;AAUD,gDAyBC;AAzYD,IAAY,mBASX;AATD,WAAY,mBAAmB;IAE7B,qEAA8C,CAAA;IAE9C,6CAAsB,CAAA;IAEtB,qDAA8B,CAAA;IAE9B,qDAA8B,CAAA;AAChC,CAAC,EATW,mBAAmB,mCAAnB,mBAAmB,QAS9B;AAGY,QAAA,sBAAsB,GACjC,8CAA8C,CAAC;AAMpC,QAAA,6BAA6B,GAAG,CAAC,CAAC;AAGlC,QAAA,2BAA2B,GAAG,CAAC,CAAC;AAGhC,QAAA,iBAAiB,GAAG,qCAAqC,CAAC;AAM1D,QAAA,qBAAqB,GAAG,UAAU,CAAC;AAGhD,MAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AALD,0CAKC;AAuCD,SAAgB,qBAAqB;IACnC,OAAO;QACL,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;QACxC,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CACZ,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YACtB,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC1B,CAAC,CAAC;QACJ,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC;AACJ,CAAC;AAGD,SAAS,aAAa,CACpB,IAA6B,EAC7B,KAAa,EACb,OAAe;IAEf,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,eAAe,CACvB,GAAG,OAAO,sCAAsC,KAAK,UAAU,CAChE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAGD,SAAS,kBAAkB,CACzB,IAA6B,EAC7B,KAAa,EACb,OAAe;IAEf,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,eAAe,CACvB,GAAG,OAAO,oBAAoB,KAAK,8BAA8B,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAGD,KAAK,UAAU,QAAQ,CACrB,QAAkB,EAClB,OAAe;IAEf,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,eAAe,CAAC,GAAG,OAAO,0BAA0B,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClD,MAAM,IAAI,eAAe,CAAC,GAAG,OAAO,8BAA8B,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,MAAiC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,eAAe,EAAE,CAAC;YACnC,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,IAAI,eAAe,CACvB,GAAG,OAAO,sCAAsC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACrE,CAAC;IACJ,CAAC;AACH,CAAC;AAWM,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,IAAoB;IAEpB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,GAAG,IAAI,mCAAmC,CAAC;IAEvD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAC/B,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,eAAe,CACvB,oCAAoC,GAAG,KAAK,MAAM,EAAE,CACrD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,eAAe,CACvB,0BAA0B,GAAG,WAAW,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CACnE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,IAAI,CAAC,6BAA6B,CAAC;IAC1D,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,eAAe,CACvB,4BAA4B,IAAI,wBAAwB;YACtD,wEAAwE;YACxE,uEAAuE,CAC1E,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,gBAAgB,CAAC;QACvD,2BAA2B,EAAE,cAAc;QAC3C,aAAa,EAAE,aAAa,CAAC,IAAI,EAAE,gBAAgB,EAAE,gBAAgB,CAAC;KACvE,CAAC;AACJ,CAAC;AAGD,KAAK,UAAU,QAAQ,CACrB,QAAgB,EAChB,IAA4B,EAC5B,IAAoB,EACpB,OAAe;IAEf,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;SAC3C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,eAAe,CAAC,GAAG,OAAO,mBAAmB,QAAQ,KAAK,MAAM,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAMM,KAAK,UAAU,0BAA0B,CAC9C,SAAwB,EACxB,QAAgB,EAChB,IAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAC7B,SAAS,CAAC,2BAA2B,EACrC,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,yBAAiB,EAAE,EACjD,IAAI,EACJ,sBAAsB,CACvB,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IAC9D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC;QAC3E,MAAM,WAAW,GACf,OAAO,IAAI,CAAC,iBAAiB,KAAK,QAAQ;YACxC,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,EAAE;YAChC,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,IAAI,eAAe,CACvB,0DAA0D,IAAI,IAAI,WAAW,IAAI;YAC/E,mBAAmB,QAAQ,mDAAmD,CACjF,CAAC;IACJ,CAAC;IAED,MAAM,uBAAuB,GAAG,IAAI,CAAC,yBAAyB,CAAC;IAC/D,OAAO;QACL,UAAU,EAAE,aAAa,CAAC,IAAI,EAAE,aAAa,EAAE,sBAAsB,CAAC;QACtE,QAAQ,EAAE,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,sBAAsB,CAAC;QAClE,eAAe,EAAE,aAAa,CAC5B,IAAI,EACJ,kBAAkB,EAClB,sBAAsB,CACvB;QACD,GAAG,CAAC,OAAO,uBAAuB,KAAK,QAAQ;YAC/C,uBAAuB,CAAC,MAAM,GAAG,CAAC;YAChC,CAAC,CAAC,EAAE,uBAAuB,EAAE;YAC7B,CAAC,CAAC,EAAE,CAAC;QACP,gBAAgB,EAAE,kBAAkB,CAClC,IAAI,EACJ,YAAY,EACZ,sBAAsB,CACvB;QACD,eAAe,EACb,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC;YACpD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC3B,CAAC,CAAC,qCAA6B;KACpC,CAAC;AACJ,CAAC;AAGD,SAAS,QAAQ,CACf,IAA6B,EAC7B,OAAe,EACf,GAAW;IAEX,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC;IACxC,OAAO;QACL,WAAW,EAAE,aAAa,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,CAAC;QACzD,GAAG,CAAC,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;YAC7D,CAAC,CAAC,EAAE,YAAY,EAAE;YAClB,CAAC,CAAC,EAAE,CAAC;QACP,SAAS,EAAE,GAAG,GAAG,kBAAkB,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,CAAC,GAAG,IAAI;KACxE,CAAC;AACJ,CAAC;AAYM,KAAK,UAAU,mBAAmB,CACvC,SAAwB,EACxB,QAAgB,EAChB,aAAkC,EAClC,IAAoB;IAEpB,IAAI,eAAe,GAAG,aAAa,CAAC,eAAe,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAEpE,SAAS,CAAC;QAER,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;QAEzC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,eAAe,CACvB,2EAA2E,CAC5E,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAC7B,SAAS,CAAC,aAAa,EACvB;YACE,UAAU,EAAE,8BAAsB;YAClC,WAAW,EAAE,aAAa,CAAC,UAAU;YACrC,SAAS,EAAE,QAAQ;SACpB,EACD,IAAI,EACJ,gBAAgB,CACjB,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAExD,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,QAAQ,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,QAAQ,KAAK,EAAE,CAAC;YACd,KAAK,mBAAmB,CAAC,oBAAoB;gBAC3C,SAAS;YACX,KAAK,mBAAmB,CAAC,QAAQ;gBAC/B,eAAe,IAAI,mCAA2B,CAAC;gBAC/C,SAAS;YACX,KAAK,mBAAmB,CAAC,YAAY;gBACnC,MAAM,IAAI,eAAe,CACvB,8CAA8C,CAC/C,CAAC;YACJ,KAAK,mBAAmB,CAAC,YAAY;gBACnC,MAAM,IAAI,eAAe,CACvB,2EAA2E,CAC5E,CAAC;YACJ,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,WAAW,GACf,OAAO,IAAI,CAAC,iBAAiB,KAAK,QAAQ;oBACxC,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,EAAE;oBAChC,CAAC,CAAC,EAAE,CAAC;gBACT,MAAM,IAAI,eAAe,CACvB,iBAAiB,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,WAAW,GAAG,CAChG,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAUM,KAAK,UAAU,kBAAkB,CACtC,SAAwB,EACxB,QAAgB,EAChB,YAAoB,EACpB,IAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAC7B,SAAS,CAAC,aAAa,EACvB;QACE,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,YAAY;QAC3B,SAAS,EAAE,QAAQ;KACpB,EACD,IAAI,EACJ,gBAAgB,CACjB,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAExD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC;QAC5E,MAAM,IAAI,eAAe,CACvB,2BAA2B,KAAK,yCAAyC,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AACtD,CAAC"}

package/dist/runtime/auth/session-auth.d.ts

@@ -0,0 +1,8 @@
+import { type DeviceFlowDeps } from './device-flow';
+import { type XemaSession } from './session-store';
+export declare class SessionExpiredError extends Error {
+    constructor(message: string);
+}
+export declare function ensureUsableSession(session: XemaSession | undefined, deps?: DeviceFlowDeps, path?: string): Promise<XemaSession | undefined>;
+export declare function loadUsableSession(deps?: DeviceFlowDeps, path?: string): Promise<XemaSession | undefined>;
+//# sourceMappingURL=session-auth.d.ts.map

package/dist/runtime/auth/session-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-auth.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/session-auth.ts"],"names":[],"mappings":"AAYA,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,iBAAiB,CAAC;AAGzB,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AASD,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,WAAW,GAAG,SAAS,EAChC,IAAI,GAAE,cAAwC,EAC9C,IAAI,GAAE,MAAqB,GAC1B,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAqClC;AAMD,wBAAsB,iBAAiB,CACrC,IAAI,GAAE,cAAwC,EAC9C,IAAI,GAAE,MAAqB,GAC1B,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAElC"}

package/dist/runtime/auth/session-auth.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionExpiredError = void 0;
+exports.ensureUsableSession = ensureUsableSession;
+exports.loadUsableSession = loadUsableSession;
+const device_flow_1 = require("./device-flow");
+const session_store_1 = require("./session-store");
+class SessionExpiredError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'SessionExpiredError';
+    }
+}
+exports.SessionExpiredError = SessionExpiredError;
+async function ensureUsableSession(session, deps = (0, device_flow_1.defaultDeviceFlowDeps)(), path = session_store_1.SESSION_FILE) {
+    if (session === undefined) {
+        return undefined;
+    }
+    if ((0, session_store_1.isAccessTokenUsable)(session, deps.now())) {
+        return session;
+    }
+    if (session.refreshToken === undefined) {
+        throw new SessionExpiredError('Your Xema session has expired and carries no refresh token. ' +
+            'Run `xema login` to sign in again.');
+    }
+    const endpoints = await (0, device_flow_1.discoverOidcEndpoints)(session.issuer, deps);
+    const tokens = await (0, device_flow_1.refreshAccessToken)(endpoints, session.clientId, session.refreshToken, deps);
+    const refreshed = {
+        endpoint: session.endpoint,
+        issuer: session.issuer,
+        clientId: session.clientId,
+        accessToken: tokens.accessToken,
+        refreshToken: tokens.refreshToken ?? session.refreshToken,
+        expiresAt: tokens.expiresAt,
+        ...(session.subject !== undefined ? { subject: session.subject } : {}),
+    };
+    (0, session_store_1.writeSession)(refreshed, path);
+    return refreshed;
+}
+async function loadUsableSession(deps = (0, device_flow_1.defaultDeviceFlowDeps)(), path = session_store_1.SESSION_FILE) {
+    return ensureUsableSession((0, session_store_1.readSession)(path), deps, path);
+}
+//# sourceMappingURL=session-auth.js.map

package/dist/runtime/auth/session-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-auth.js","sourceRoot":"","sources":["../../../src/runtime/auth/session-auth.ts"],"names":[],"mappings":";;;AAyCA,kDAyCC;AAMD,8CAKC;AAjFD,+CAKuB;AACvB,mDAMyB;AAGzB,MAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AALD,kDAKC;AASM,KAAK,UAAU,mBAAmB,CACvC,OAAgC,EAChC,OAAuB,IAAA,mCAAqB,GAAE,EAC9C,OAAe,4BAAY;IAE3B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAA,mCAAmB,EAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QAC7C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,IAAI,mBAAmB,CAC3B,8DAA8D;YAC5D,oCAAoC,CACvC,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,IAAA,mCAAqB,EAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,MAAM,IAAA,gCAAkB,EACrC,SAAS,EACT,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,YAAY,EACpB,IAAI,CACL,CAAC;IAKF,MAAM,SAAS,GAAgB;QAC7B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY;QACzD,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvE,CAAC;IACF,IAAA,4BAAY,EAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9B,OAAO,SAAS,CAAC;AACnB,CAAC;AAMM,KAAK,UAAU,iBAAiB,CACrC,OAAuB,IAAA,mCAAqB,GAAE,EAC9C,OAAe,4BAAY;IAE3B,OAAO,mBAAmB,CAAC,IAAA,2BAAW,EAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAC5D,CAAC"}

package/dist/runtime/auth/session-store.d.ts

@@ -0,0 +1,19 @@
+export declare const SESSION_FILE: string;
+export interface XemaSession {
+    readonly endpoint: string;
+    readonly issuer: string;
+    readonly clientId: string;
+    readonly accessToken: string;
+    readonly refreshToken?: string;
+    readonly expiresAt: number;
+    readonly subject?: string;
+}
+export declare class SessionStoreError extends Error {
+    constructor(message: string);
+}
+export declare function readSession(path?: string): XemaSession | undefined;
+export declare function writeSession(session: XemaSession, path?: string): void;
+export declare function clearSession(path?: string): boolean;
+export declare const SESSION_EXPIRY_SKEW_MS = 60000;
+export declare function isAccessTokenUsable(session: XemaSession, now: number): boolean;
+//# sourceMappingURL=session-store.d.ts.map

package/dist/runtime/auth/session-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/session-store.ts"],"names":[],"mappings":"AA2BA,eAAO,MAAM,YAAY,QAA2C,CAAC;AAerE,MAAM,WAAW,WAAW;IAE1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAGD,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,OAAO,EAAE,MAAM;CAI5B;AA2BD,wBAAgB,WAAW,CAAC,IAAI,GAAE,MAAqB,GAAG,WAAW,GAAG,SAAS,CA0ChF;AAQD,wBAAgB,YAAY,CAC1B,OAAO,EAAE,WAAW,EACpB,IAAI,GAAE,MAAqB,GAC1B,IAAI,CAON;AAMD,wBAAgB,YAAY,CAAC,IAAI,GAAE,MAAqB,GAAG,OAAO,CAMjE;AASD,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAG7C,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAE9E"}