brightspace-mcp-server 1.6.2 → 2.0.0

package/build/auth/token-manager.d.ts

@@ -4,6 +4,7 @@
  * Licensed under MIT — see LICENSE file for details.
  */
 import type { TokenData } from "../types/index.js";
+import { SessionStore } from "./session-store.js";
 import { mintAccessToken } from "./token-mint.js";
 export interface TokenManagerOptions {
     sessionDir?: string;
@@ -13,6 +14,8 @@ export interface TokenManagerOptions {
     tokenTtl?: number;
     /** Injection seam for tests. */
     mint?: typeof mintAccessToken;
+    /** Persistence injection keeps unit tests independent of native credentials. */
+    sessionStore?: Pick<SessionStore, "load" | "save" | "clear" | "saveIfCurrent" | "clearIfCurrent">;
 }
 /**
  * TokenManager manages token lifecycle with in-memory caching and disk persistence.
@@ -26,6 +29,7 @@ export declare class TokenManager {
     private readonly mint;
     /** Single in-flight mint, so concurrent callers share one request. */
     private mintInFlight;
+    private rejectedAccessToken;
     constructor(sessionDir?: string);
     constructor(options: TokenManagerOptions);
     /**
@@ -33,10 +37,9 @@ export declare class TokenManager {
      * Checks memory cache first, then loads from disk if needed.
      * Returns null if token is expired or within refresh buffer.
      */
-    getToken(): Promise<TokenData | null>;
+    getToken(rejectedAccessToken?: string): Promise<TokenData | null>;
     /**
-     * First candidate that carries both the cookie header and the XSRF token,
-     * or null when neither can be used to mint.
+     * Only use persisted session material, including updates from other processes.
      */
     private pickMintable;
     /**
@@ -53,6 +56,10 @@ export declare class TokenManager {
      * Clear the token from memory and disk.
      */
     clearToken(): Promise<void>;
+    private isUsable;
+    private matchesTenant;
+    private sameToken;
+    private afterConcurrentChange;
     /**
      * Check if a token is valid (not expired and outside refresh buffer).
      * A token is valid if it expires more than REFRESH_BUFFER_MS from now.

package/build/auth/token-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-manager.d.ts","sourceRoot":"","sources":["../../src/auth/token-manager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAYlD,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gCAAgC;IAChC,IAAI,CAAC,EAAE,OAAO,eAAe,CAAC;CAC/B;AAED;;;GAGG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,WAAW,CAA0B;IAC7C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyB;IAC9C,sEAAsE;IACtE,OAAO,CAAC,YAAY,CAA0C;gBAElD,UAAU,CAAC,EAAE,MAAM;gBACnB,OAAO,EAAE,mBAAmB;IAaxC;;;;OAIG;IACG,QAAQ,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IA2B3C;;;OAGG;IACH,OAAO,CAAC,YAAY;IAUpB;;;OAGG;YACW,eAAe;YAaf,OAAO;IAkCrB;;OAEG;IACG,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAM/C;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAMjC;;;OAGG;IACH,OAAO,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO;IAiBlC;;;OAGG;IACG,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC;CAIvC"}
+{"version":3,"file":"token-manager.d.ts","sourceRoot":"","sources":["../../src/auth/token-manager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAalD,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gCAAgC;IAChC,IAAI,CAAC,EAAE,OAAO,eAAe,CAAC;IAC9B,gFAAgF;IAChF,YAAY,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,eAAe,GAAG,gBAAgB,CAAC,CAAC;CACnG;AAED;;;GAGG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,WAAW,CAA0B;IAC7C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmD;IAChF,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyB;IAC9C,sEAAsE;IACtE,OAAO,CAAC,YAAY,CAA0C;IAC9D,OAAO,CAAC,mBAAmB,CAAuB;gBAEtC,UAAU,CAAC,EAAE,MAAM;gBACnB,OAAO,EAAE,mBAAmB;IAaxC;;;;OAIG;IACG,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IA8BvE;;OAEG;IACH,OAAO,CAAC,YAAY;IAIpB;;;OAGG;YACW,eAAe;YAaf,OAAO;IAmDrB;;OAEG;IACG,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/C;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAMjC,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,SAAS;YAKH,qBAAqB;IAMnC;;;OAGG;IACH,OAAO,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO;IAiBlC;;;OAGG;IACG,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC;CAIvC"}

package/build/auth/token-manager.js

@@ -6,6 +6,7 @@
 import { SessionStore } from "./session-store.js";
 import { mintAccessToken } from "./token-mint.js";
 import { log } from "../utils/logger.js";
+import { TokenRefreshError } from "../api/errors.js";
 /**
  * Token refresh buffer - tokens within this time of expiry are considered invalid.
  * This prevents using tokens that might expire during a request.
@@ -25,12 +26,13 @@ export class TokenManager {
     mint;
     /** Single in-flight mint, so concurrent callers share one request. */
     mintInFlight = null;
+    rejectedAccessToken = null;
     constructor(sessionDirOrOptions) {
         const options = typeof sessionDirOrOptions === "string" || sessionDirOrOptions === undefined
             ? { sessionDir: sessionDirOrOptions }
             : sessionDirOrOptions;
-        this.sessionStore = new SessionStore(options.sessionDir);
-        this.baseUrl = options.baseUrl;
+        this.sessionStore = options.sessionStore ?? new SessionStore(options.sessionDir);
+        this.baseUrl = options.baseUrl ? new URL(options.baseUrl).origin : undefined;
         this.tokenTtl = options.tokenTtl ?? DEFAULT_TOKEN_TTL_SECONDS;
         this.mint = options.mint ?? mintAccessToken;
     }
@@ -39,22 +41,26 @@ export class TokenManager {
      * Checks memory cache first, then loads from disk if needed.
      * Returns null if token is expired or within refresh buffer.
      */
-    async getToken() {
+    async getToken(rejectedAccessToken) {
+        if (rejectedAccessToken)
+            this.rejectedAccessToken = rejectedAccessToken;
         // Check memory cache first
-        if (this.cachedToken && this.isValid(this.cachedToken)) {
+        if (this.cachedToken && this.isUsable(this.cachedToken)) {
             log("DEBUG", "Returning cached token");
             return this.cachedToken;
         }
         // Try loading from disk
         const storedToken = await this.sessionStore.load();
-        if (storedToken && this.isValid(storedToken)) {
+        if (storedToken && this.isUsable(storedToken)) {
             log("DEBUG", "Loaded valid token from session store");
             this.cachedToken = storedToken;
             return storedToken;
         }
         // The token is stale, but if it carried the session material we can trade
         // that for a fresh JWT over plain HTTP instead of relaunching the browser.
-        const mintable = this.pickMintable(this.cachedToken, storedToken);
+        // Disk may have been refreshed by another MCP process. Never prefer stale
+        // cached cookies over the current persisted session.
+        const mintable = this.pickMintable(storedToken);
         if (mintable) {
             const minted = await this.mintFromSession(mintable);
             if (minted)
@@ -64,17 +70,10 @@ export class TokenManager {
         return null;
     }
     /**
-     * First candidate that carries both the cookie header and the XSRF token,
-     * or null when neither can be used to mint.
+     * Only use persisted session material, including updates from other processes.
      */
-    pickMintable(...candidates) {
-        if (!this.baseUrl)
-            return null;
-        for (const candidate of candidates) {
-            if (candidate?.cookieHeader && candidate.csrfToken)
-                return candidate;
-        }
-        return null;
+    pickMintable(candidate) {
+        return this.baseUrl && candidate && this.matchesTenant(candidate) && candidate.cookieHeader && candidate.csrfToken ? candidate : null;
     }
     /**
      * Mint a fresh token from the stale one's session material, collapsing
@@ -93,39 +92,60 @@ export class TokenManager {
     }
     async runMint(stale) {
         log("DEBUG", "Trying to mint an access token from the session cookie");
-        const result = await this.mint({
-            baseUrl: this.baseUrl,
-            cookieHeader: stale.cookieHeader,
-            csrfToken: stale.csrfToken,
-        });
+        let result;
+        try {
+            result = await this.mint({
+                baseUrl: this.baseUrl,
+                cookieHeader: stale.cookieHeader,
+                csrfToken: stale.csrfToken,
+            });
+        }
+        catch (error) {
+            throw new TokenRefreshError("token service request failed", error instanceof Error ? error : undefined);
+        }
+        // The auth CLI or another MCP process can finish a login while HTTP minting
+        // is in flight. Its newer session wins over either result of this request.
+        const current = await this.sessionStore.load();
+        if (current && !this.sameToken(current, stale)) {
+            this.cachedToken = current;
+            if (this.isUsable(current))
+                return current;
+            throw new TokenRefreshError("saved authentication changed during refresh");
+        }
         if (result.ok) {
             const now = Date.now();
             const token = {
                 accessToken: result.accessToken,
+                tenantOrigin: this.baseUrl,
                 capturedAt: now,
                 expiresAt: now + this.tokenTtl * 1000,
                 source: "browser",
                 cookieHeader: stale.cookieHeader,
                 csrfToken: stale.csrfToken,
             };
-            await this.setToken(token);
+            if (!await this.sessionStore.saveIfCurrent(token, stale))
+                return this.afterConcurrentChange();
+            this.cachedToken = token;
+            this.rejectedAccessToken = null;
             log("INFO", "Minted a fresh access token from the session cookie");
             return token;
         }
         if (result.reason === "sessionExpired") {
             log("INFO", "The session cookie has expired, a browser login is needed");
-            await this.clearToken();
+            if (!await this.sessionStore.clearIfCurrent(stale))
+                return this.afterConcurrentChange();
+            this.cachedToken = null;
             return null;
         }
-        log("WARN", `Could not mint an access token: ${result.detail ?? "transport failure"}`);
-        return null;
+        throw new TokenRefreshError(result.detail ?? "unexpected token service response");
     }
     /**
      * Set a new token, caching in memory and persisting to disk.
      */
     async setToken(token) {
-        this.cachedToken = token;
         await this.sessionStore.save(token);
+        this.cachedToken = token;
+        this.rejectedAccessToken = null;
         log("DEBUG", "Token cached and persisted");
     }
     /**
@@ -136,6 +156,22 @@ export class TokenManager {
         await this.sessionStore.clear();
         log("DEBUG", "Token cleared from memory and disk");
     }
+    isUsable(token) {
+        return this.matchesTenant(token) && token.accessToken !== this.rejectedAccessToken && this.isValid(token);
+    }
+    matchesTenant(token) {
+        return this.baseUrl === undefined || token.tenantOrigin === this.baseUrl;
+    }
+    sameToken(a, b) {
+        return a.accessToken === b.accessToken && a.capturedAt === b.capturedAt &&
+            a.cookieHeader === b.cookieHeader && a.csrfToken === b.csrfToken && a.tenantOrigin === b.tenantOrigin;
+    }
+    async afterConcurrentChange() {
+        this.cachedToken = await this.sessionStore.load();
+        if (this.cachedToken && this.isUsable(this.cachedToken))
+            return this.cachedToken;
+        throw new TokenRefreshError("saved authentication changed during refresh");
+    }
     /**
      * Check if a token is valid (not expired and outside refresh buffer).
      * A token is valid if it expires more than REFRESH_BUFFER_MS from now.

package/build/auth/token-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-manager.js","sourceRoot":"","sources":["../../src/auth/token-manager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAEzC;;;GAGG;AACH,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAErD,sDAAsD;AACtD,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAYvC;;;GAGG;AACH,MAAM,OAAO,YAAY;IACf,WAAW,GAAqB,IAAI,CAAC;IAC5B,YAAY,CAAe;IAC3B,OAAO,CAAU;IACjB,QAAQ,CAAS;IACjB,IAAI,CAAyB;IAC9C,sEAAsE;IAC9D,YAAY,GAAqC,IAAI,CAAC;IAI9D,YAAY,mBAAkD;QAC5D,MAAM,OAAO,GACX,OAAO,mBAAmB,KAAK,QAAQ,IAAI,mBAAmB,KAAK,SAAS;YAC1E,CAAC,CAAC,EAAE,UAAU,EAAE,mBAAmB,EAAE;YACrC,CAAC,CAAC,mBAAmB,CAAC;QAE1B,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,yBAAyB,CAAC;QAC9D,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,eAAe,CAAC;IAC9C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ;QACZ,2BAA2B;QAC3B,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;YACvC,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,CAAC;QAED,wBAAwB;QACxB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACnD,IAAI,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,OAAO,EAAE,uCAAuC,CAAC,CAAC;YACtD,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;YAC/B,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,0EAA0E;QAC1E,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAClE,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;YACpD,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QAED,GAAG,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACK,YAAY,CAClB,GAAG,UAAmC;QAEtC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC/B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,SAAS,EAAE,YAAY,IAAI,SAAS,CAAC,SAAS;gBAAE,OAAO,SAAS,CAAC;QACvE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe,CAAC,KAAgB;QAC5C,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,GAAG,CAAC,OAAO,EAAE,kCAAkC,CAAC,CAAC;YACjD,OAAO,IAAI,CAAC,YAAY,CAAC;QAC3B,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YAChD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC;QAC7B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,KAAgB;QACpC,GAAG,CAAC,OAAO,EAAE,wDAAwD,CAAC,CAAC;QAEvE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC;YAC7B,OAAO,EAAE,IAAI,CAAC,OAAiB;YAC/B,YAAY,EAAE,KAAK,CAAC,YAAsB;YAC1C,SAAS,EAAE,KAAK,CAAC,SAAmB;SACrC,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,KAAK,GAAc;gBACvB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,UAAU,EAAE,GAAG;gBACf,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI;gBACrC,MAAM,EAAE,SAAS;gBACjB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC;YACF,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC3B,GAAG,CAAC,MAAM,EAAE,qDAAqD,CAAC,CAAC;YACnE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;YACvC,GAAG,CAAC,MAAM,EAAE,2DAA2D,CAAC,CAAC;YACzE,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,GAAG,CAAC,MAAM,EAAE,mCAAmC,MAAM,CAAC,MAAM,IAAI,mBAAmB,EAAE,CAAC,CAAC;QACvF,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CAAC,KAAgB;QAC7B,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QACzB,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpC,GAAG,CAAC,OAAO,EAAE,4BAA4B,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAChC,GAAG,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;IACrD,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,KAAgB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,eAAe,GAAG,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC;QAE9C,8DAA8D;QAC9D,MAAM,KAAK,GAAG,eAAe,GAAG,iBAAiB,CAAC;QAElD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CACD,OAAO,EACP,6BAA6B,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,cAAc,iBAAiB,GAAG,IAAI,IAAI,CAC1G,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY;QAChB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,OAAO,KAAK,KAAK,IAAI,CAAC;IACxB,CAAC;CACF"}
+{"version":3,"file":"token-manager.js","sourceRoot":"","sources":["../../src/auth/token-manager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD;;;GAGG;AACH,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAErD,sDAAsD;AACtD,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAcvC;;;GAGG;AACH,MAAM,OAAO,YAAY;IACf,WAAW,GAAqB,IAAI,CAAC;IAC5B,YAAY,CAAmD;IAC/D,OAAO,CAAU;IACjB,QAAQ,CAAS;IACjB,IAAI,CAAyB;IAC9C,sEAAsE;IAC9D,YAAY,GAAqC,IAAI,CAAC;IACtD,mBAAmB,GAAkB,IAAI,CAAC;IAIlD,YAAY,mBAAkD;QAC5D,MAAM,OAAO,GACX,OAAO,mBAAmB,KAAK,QAAQ,IAAI,mBAAmB,KAAK,SAAS;YAC1E,CAAC,CAAC,EAAE,UAAU,EAAE,mBAAmB,EAAE;YACrC,CAAC,CAAC,mBAAmB,CAAC;QAE1B,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACjF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,yBAAyB,CAAC;QAC9D,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,eAAe,CAAC;IAC9C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CAAC,mBAA4B;QACzC,IAAI,mBAAmB;YAAE,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;QACxE,2BAA2B;QAC3B,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;YACvC,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,CAAC;QAED,wBAAwB;QACxB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACnD,IAAI,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9C,GAAG,CAAC,OAAO,EAAE,uCAAuC,CAAC,CAAC;YACtD,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;YAC/B,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,0EAA0E;QAC1E,2EAA2E;QAC3E,0EAA0E;QAC1E,qDAAqD;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;YACpD,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QAED,GAAG,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,SAA2B;QAC9C,OAAO,IAAI,CAAC,OAAO,IAAI,SAAS,IAAI,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,YAAY,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IACxI,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe,CAAC,KAAgB;QAC5C,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,GAAG,CAAC,OAAO,EAAE,kCAAkC,CAAC,CAAC;YACjD,OAAO,IAAI,CAAC,YAAY,CAAC;QAC3B,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YAChD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC;QAC7B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,KAAgB;QACpC,GAAG,CAAC,OAAO,EAAE,wDAAwD,CAAC,CAAC;QAEvE,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC;gBACvB,OAAO,EAAE,IAAI,CAAC,OAAiB;gBAC/B,YAAY,EAAE,KAAK,CAAC,YAAsB;gBAC1C,SAAS,EAAE,KAAK,CAAC,SAAmB;aACrC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1G,CAAC;QAED,4EAA4E;QAC5E,2EAA2E;QAC3E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC;YAC3B,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,OAAO,CAAC;YAC3C,MAAM,IAAI,iBAAiB,CAAC,6CAA6C,CAAC,CAAC;QAC7E,CAAC;QAED,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,KAAK,GAAc;gBACvB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,YAAY,EAAE,IAAI,CAAC,OAAO;gBAC1B,UAAU,EAAE,GAAG;gBACf,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI;gBACrC,MAAM,EAAE,SAAS;gBACjB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC;YACF,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC9F,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;YACzB,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;YAChC,GAAG,CAAC,MAAM,EAAE,qDAAqD,CAAC,CAAC;YACnE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;YACvC,GAAG,CAAC,MAAM,EAAE,2DAA2D,CAAC,CAAC;YACzE,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACxF,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,iBAAiB,CAAC,MAAM,CAAC,MAAM,IAAI,mCAAmC,CAAC,CAAC;IACpF,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CAAC,KAAgB;QAC7B,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;QAChC,GAAG,CAAC,OAAO,EAAE,4BAA4B,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAChC,GAAG,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;IACrD,CAAC;IAEO,QAAQ,CAAC,KAAgB;QAC/B,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5G,CAAC;IAEO,aAAa,CAAC,KAAgB;QACpC,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,OAAO,CAAC;IAC3E,CAAC;IAEO,SAAS,CAAC,CAAY,EAAE,CAAY;QAC1C,OAAO,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;YACrE,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,YAAY,CAAC;IAC1G,CAAC;IAEO,KAAK,CAAC,qBAAqB;QACjC,IAAI,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC;QACjF,MAAM,IAAI,iBAAiB,CAAC,6CAA6C,CAAC,CAAC;IAC7E,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,KAAgB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,eAAe,GAAG,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC;QAE9C,8DAA8D;QAC9D,MAAM,KAAK,GAAG,eAAe,GAAG,iBAAiB,CAAC;QAElD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CACD,OAAO,EACP,6BAA6B,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,cAAc,iBAAiB,GAAG,IAAI,IAAI,CAC1G,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY;QAChB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,OAAO,KAAK,KAAK,IAAI,CAAC;IACxB,CAAC;CACF"}

package/build/auth/token-mint.d.ts

@@ -25,8 +25,8 @@ export type MintResult = {
  * Exchange the D2L session cookies for a fresh Bearer token in one request.
  * This is the cheap alternative to relaunching Chromium when the JWT expires.
  *
- * Classification order matters: a network throw is transport, the expiry marker
- * wins over the status code, then a non-2xx status, then a missing access_token.
+ * Only a 401 or the known login redirect proves session expiry. Server errors,
+ * permission failures and unknown response formats remain temporary failures.
  */
 export declare function mintAccessToken({ baseUrl, cookieHeader, csrfToken, fetchImpl, timeoutMs, }: MintOptions): Promise<MintResult>;
 //# sourceMappingURL=token-mint.d.ts.map

package/build/auth/token-mint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-mint.d.ts","sourceRoot":"","sources":["../../src/auth/token-mint.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAkBH,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,YAAY,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gBAAgB,GAAG,WAAW,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAQ3E;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,EACpC,OAAO,EACP,YAAY,EACZ,SAAS,EACT,SAAiB,EACjB,SAA8B,GAC/B,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CA6CnC"}
+{"version":3,"file":"token-mint.d.ts","sourceRoot":"","sources":["../../src/auth/token-mint.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAkBH,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,YAAY,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gBAAgB,GAAG,WAAW,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAmB3E;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,EACpC,OAAO,EACP,YAAY,EACZ,SAAS,EACT,SAAiB,EACjB,SAA8B,GAC/B,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAyDnC"}

package/build/auth/token-mint.js

@@ -10,7 +10,7 @@ import { log } from "../utils/logger.js";
  * carrying a script that redirects to /d2l/login?sessionExpired=1. There is no
  * 401 on this path, so the marker, not the status, is the only honest signal.
  */
-const EXPIRED_MARKER = "sessionExpired=1";
+const EXPIRED_MARKER = "/d2l/login?sessionExpired=1";
 /** Same identity the API client sends, see buildAuthHeaders in api/client.ts. */
 const USER_AGENT = "BrightspaceMCP/1.0 (Rohan Muppa; github.com/rohanmuppa/brightspace-mcp-server)";
 const DEFAULT_TIMEOUT_MS = 15000;
@@ -19,17 +19,30 @@ const transport = (detail) => ({
     reason: "transport",
     detail,
 });
+function expiredRedirect(location, tokenUrl) {
+    if (!location)
+        return false;
+    try {
+        const target = new URL(location, tokenUrl);
+        return target.origin === new URL(tokenUrl).origin &&
+            target.pathname === "/d2l/login" && target.searchParams.get("sessionExpired") === "1";
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Exchange the D2L session cookies for a fresh Bearer token in one request.
  * This is the cheap alternative to relaunching Chromium when the JWT expires.
  *
- * Classification order matters: a network throw is transport, the expiry marker
- * wins over the status code, then a non-2xx status, then a missing access_token.
+ * Only a 401 or the known login redirect proves session expiry. Server errors,
+ * permission failures and unknown response formats remain temporary failures.
  */
 export async function mintAccessToken({ baseUrl, cookieHeader, csrfToken, fetchImpl = fetch, timeoutMs = DEFAULT_TIMEOUT_MS, }) {
     const url = `${baseUrl.replace(/\/+$/, "")}/d2l/lp/auth/oauth2/token`;
     let status;
     let body;
+    let location;
     try {
         const response = await fetchImpl(url, {
             method: "POST",
@@ -41,28 +54,37 @@ export async function mintAccessToken({ baseUrl, cookieHeader, csrfToken, fetchI
             },
             body: "scope=*:*:*",
             signal: AbortSignal.timeout(timeoutMs),
+            redirect: "manual",
         });
         status = response.status;
         body = await response.text();
+        location = response.headers?.get("location") ?? null;
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
         return transport(message);
     }
-    if (body.includes(EXPIRED_MARKER)) {
+    if (status >= 500 || status === 429)
+        return transport(`HTTP ${status}`);
+    let payload = null;
+    try {
+        payload = JSON.parse(body);
+    }
+    catch {
+        // The known expired-session response is an HTML login redirect.
+    }
+    if (status === 401 || (!payload && body.includes(EXPIRED_MARKER)) ||
+        expiredRedirect(location, url)) {
         log("DEBUG", "The token mint answered with the session-expired stub");
         return { ok: false, reason: "sessionExpired" };
     }
     if (status < 200 || status >= 300) {
         return transport(`HTTP ${status}`);
     }
-    let accessToken;
-    try {
-        accessToken = JSON.parse(body).access_token;
-    }
-    catch {
+    if (!payload) {
         return transport("the token mint returned an unparseable body");
     }
+    const accessToken = payload.access_token;
     if (typeof accessToken !== "string" || accessToken.length === 0) {
         return transport("the token mint returned no access_token");
     }

package/build/auth/token-mint.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-mint.js","sourceRoot":"","sources":["../../src/auth/token-mint.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAE1C,iFAAiF;AACjF,MAAM,UAAU,GACd,gFAAgF,CAAC;AAEnF,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAiBjC,MAAM,SAAS,GAAG,CAAC,MAAc,EAAc,EAAE,CAAC,CAAC;IACjD,EAAE,EAAE,KAAK;IACT,MAAM,EAAE,WAAW;IACnB,MAAM;CACP,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,OAAO,EACP,YAAY,EACZ,SAAS,EACT,SAAS,GAAG,KAAK,EACjB,SAAS,GAAG,kBAAkB,GAClB;IACZ,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,2BAA2B,CAAC;IAEtE,IAAI,MAAc,CAAC;IACnB,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,YAAY;gBACpB,cAAc,EAAE,SAAS;gBACzB,YAAY,EAAE,UAAU;aACzB;YACD,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACvC,CAAC,CAAC;QACH,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QACzB,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,OAAO,EAAE,uDAAuD,CAAC,CAAC;QACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjD,CAAC;IAED,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAClC,OAAO,SAAS,CAAC,QAAQ,MAAM,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,WAAoB,CAAC;IACzB,IAAI,CAAC;QACH,WAAW,GAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgC,CAAC,YAAY,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,6CAA6C,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,SAAS,CAAC,yCAAyC,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AACnC,CAAC"}
+{"version":3,"file":"token-mint.js","sourceRoot":"","sources":["../../src/auth/token-mint.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,cAAc,GAAG,6BAA6B,CAAC;AAErD,iFAAiF;AACjF,MAAM,UAAU,GACd,gFAAgF,CAAC;AAEnF,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAiBjC,MAAM,SAAS,GAAG,CAAC,MAAc,EAAc,EAAE,CAAC,CAAC;IACjD,EAAE,EAAE,KAAK;IACT,MAAM,EAAE,WAAW;IACnB,MAAM;CACP,CAAC,CAAC;AAEH,SAAS,eAAe,CAAC,QAAuB,EAAE,QAAgB;IAChE,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM;YAC/C,MAAM,CAAC,QAAQ,KAAK,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,GAAG,CAAC;IAC1F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,OAAO,EACP,YAAY,EACZ,SAAS,EACT,SAAS,GAAG,KAAK,EACjB,SAAS,GAAG,kBAAkB,GAClB;IACZ,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,2BAA2B,CAAC;IAEtE,IAAI,MAAc,CAAC;IACnB,IAAI,IAAY,CAAC;IACjB,IAAI,QAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,YAAY;gBACpB,cAAc,EAAE,SAAS;gBACzB,YAAY,EAAE,UAAU;aACzB;YACD,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;YACtC,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QACH,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QACzB,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC7B,QAAQ,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAED,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,SAAS,CAAC,QAAQ,MAAM,EAAE,CAAC,CAAC;IAExE,IAAI,OAAO,GAAsC,IAAI,CAAC;IACtD,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAsC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;IAClE,CAAC;IAED,IAAI,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC7D,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,OAAO,EAAE,uDAAuD,CAAC,CAAC;QACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjD,CAAC;IAED,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAClC,OAAO,SAAS,CAAC,QAAQ,MAAM,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAC,6CAA6C,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;IAEzC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,SAAS,CAAC,yCAAyC,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AACnC,CAAC"}

package/build/auth-cli.d.ts

@@ -1,10 +1,4 @@
 #!/usr/bin/env node
-/**
- * Brightspace MCP Server
- * Copyright (c) 2026 Rohan Muppa. All rights reserved.
- * Licensed under MIT — see LICENSE file for details.
- *
- * https://github.com/rohanmuppa/brightspace-mcp-server
- */
+/** Brightspace MCP Server. Copyright (c) 2026 Rohan Muppa. MIT licensed. */
 export {};
 //# sourceMappingURL=auth-cli.d.ts.map

package/build/auth-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-cli.d.ts","sourceRoot":"","sources":["../src/auth-cli.ts"],"names":[],"mappings":";AACA;;;;;;GAMG"}
+{"version":3,"file":"auth-cli.d.ts","sourceRoot":"","sources":["../src/auth-cli.ts"],"names":[],"mappings":";AACA,4EAA4E"}

package/build/auth-cli.js

@@ -1,93 +1,49 @@
 #!/usr/bin/env node
-/**
- * Brightspace MCP Server
- * Copyright (c) 2026 Rohan Muppa. All rights reserved.
- * Licensed under MIT — see LICENSE file for details.
- *
- * https://github.com/rohanmuppa/brightspace-mcp-server
- */
-import * as fs from "node:fs/promises";
+/** Brightspace MCP Server. Copyright (c) 2026 Rohan Muppa. MIT licensed. */
 import { readFileSync } from "node:fs";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import dotenv from "dotenv";
 import { loadConfig } from "./utils/config.js";
 import { BrowserAuth, TokenManager } from "./auth/index.js";
-// Load .env file so credentials are available via process.env
+import { NativeCredentialStoreError } from "./auth/credential-store.js";
+import { retireLegacyProfile } from "./auth/legacy-profile.js";
 dotenv.config({ quiet: true });
-const pkgVersion = (() => {
-    try {
-        const pkg = JSON.parse(readFileSync(path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "package.json"), "utf-8"));
-        return pkg.version ?? "unknown";
-    }
-    catch {
-        return "unknown";
-    }
-})();
+const pkg = JSON.parse(readFileSync(path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "package.json"), "utf8"));
 async function main() {
+    const automatic = process.argv.includes("--automatic");
     try {
-        // Load configuration from environment
-        const config = loadConfig();
-        // Print header
-        console.log(`\n=== Brightspace Authentication v${pkgVersion} - by Rohan Muppa ===\n`);
-        // Check for credentials and provide status
-        if (config.username && config.password) {
-            console.log(`Authenticating as: ${config.username}`);
-            console.log("Approve the sign-in request in Microsoft Authenticator when prompted.");
-            console.log("If it shows a number, it is printed below: enter that number in the app.");
-        }
-        else {
-            console.log("No credentials. Opening browser for manual login.");
-        }
-        console.log("\nStarting authentication...\n");
-        // Create BrowserAuth with config
-        const browserAuth = new BrowserAuth(config);
-        // Authenticate and get token
-        const token = await browserAuth.authenticate();
-        // Create TokenManager and persist token
+        const config = await loadConfig();
+        console.error(`\n=== Brightspace Authentication v${pkg.version} ===\n`);
+        console.error("Authentication runs headlessly. If Microsoft requests MFA, the number appears here.");
         const tokenManager = new TokenManager({
             sessionDir: config.sessionDir,
             baseUrl: config.baseUrl,
             tokenTtl: config.tokenTtl,
         });
-        await tokenManager.setToken(token);
-        // Verify session.json was actually written to disk
-        const sessionFile = path.join(config.sessionDir, "session.json");
-        try {
-            await fs.access(sessionFile);
-        }
-        catch {
-            console.error(`\nWARNING: session.json was not found at ${sessionFile} after save.`);
-            console.error("Token was captured but failed to persist. Retrying save...");
-            // Retry once — the directory should already exist from the first attempt
-            await tokenManager.setToken(token);
-            try {
-                await fs.access(sessionFile);
-                console.log("Retry succeeded — session.json saved.");
-            }
-            catch {
-                console.error("Retry failed. Check directory permissions on", config.sessionDir);
-                process.exit(1);
-            }
-        }
-        // Print success
-        console.log("\n=== Authentication successful! ===");
-        console.log(`Session saved to ${sessionFile}`);
-        console.log("\nThe MCP server will use this token automatically.");
-        console.log("You can now add the server to your Claude Desktop configuration.\n");
-        process.exit(0);
+        await new BrowserAuth(config).authenticate({
+            automatic,
+            onAuthenticated: async (token) => {
+                await tokenManager.setToken(token);
+                await retireLegacyProfile(config.sessionDir);
+                if (config.legacyBrowserStateMigrated && config.sessionRoot && config.sessionRoot !== config.sessionDir) {
+                    await retireLegacyProfile(config.sessionRoot);
+                }
+            },
+        });
+        console.error("\nAuthentication successful. Your encrypted session is ready for the MCP server.");
     }
     catch (error) {
-        console.error("\n=== Authentication failed ===");
-        console.error("\nError:", error instanceof Error ? error.message : String(error));
-        console.error("\nTroubleshooting tips:");
-        console.error("1. Ensure D2L_USERNAME and D2L_PASSWORD are set correctly in .env");
-        console.error("2. If MFA approval failed, approve the sign-in request in Microsoft Authenticator, entering the number shown above if there was one");
-        console.error("3. Check that you have a stable internet connection");
-        console.error("4. Try running with D2L_HEADLESS=false to see the browser");
-        console.error("\nFor more details, check the error message above.\n");
-        process.exit(1);
+        const code = error?.code;
+        process.exitCode = error instanceof NativeCredentialStoreError ? 5
+            : code === "AUTH_IN_PROGRESS" ? 2
+                : code === "AUTH_COOLDOWN" ? 3
+                    : code === "AUTH_UNSUPPORTED" ? 4
+                        : code === "AUTH_TRANSPORT" ? 6 : 1;
+        console.error("\nAuthentication failed:", error instanceof Error ? error.message : "Unknown authentication error");
+        console.error("Run `npx brightspace-mcp-server setup` to update saved credentials.");
+        console.error("Run `npx brightspace-mcp-server auth` to retry explicitly. This bypasses the automatic MFA cooldown.");
     }
 }
-main();
+await main();
 //# sourceMappingURL=auth-cli.js.map

package/build/auth-cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-cli.js","sourceRoot":"","sources":["../src/auth-cli.ts"],"names":[],"mappings":";AACA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE5D,8DAA8D;AAC9D,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAE/B,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CACpB,YAAY,CACV,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,EAChF,OAAO,CACR,CACF,CAAC;QACF,OAAO,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AAEL,KAAK,UAAU,IAAI;IACjB,IAAI,CAAC;QACH,sCAAsC;QACtC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAE5B,eAAe;QACf,OAAO,CAAC,GAAG,CAAC,qCAAqC,UAAU,yBAAyB,CAAC,CAAC;QAEtF,2CAA2C;QAC3C,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,sBAAsB,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrD,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;YACrF,OAAO,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC;QAC1F,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;QAE9C,iCAAiC;QACjC,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;QAE5C,6BAA6B;QAC7B,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,YAAY,EAAE,CAAC;QAE/C,wCAAwC;QACxC,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC;YACpC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC;QACH,MAAM,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAEnC,mDAAmD;QACnD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QACjE,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,KAAK,CACX,4CAA4C,WAAW,cAAc,CACtE,CAAC;YACF,OAAO,CAAC,KAAK,CACX,4DAA4D,CAC7D,CAAC;YACF,yEAAyE;YACzE,MAAM,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBAC7B,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;YACvD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;gBACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,gBAAgB;QAChB,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,oBAAoB,WAAW,EAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;QACnE,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;QAElF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACjD,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAClF,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACzC,OAAO,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACnF,OAAO,CAAC,KAAK,CAAC,qIAAqI,CAAC,CAAC;QACrJ,OAAO,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACrE,OAAO,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC3E,OAAO,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC"}
+{"version":3,"file":"auth-cli.js","sourceRoot":"","sources":["../src/auth-cli.ts"],"names":[],"mappings":";AACA,4EAA4E;AAE5E,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAE/H,KAAK,UAAU,IAAI;IACjB,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,qCAAqC,GAAG,CAAC,OAAO,QAAQ,CAAC,CAAC;QACxE,OAAO,CAAC,KAAK,CAAC,qFAAqF,CAAC,CAAC;QAErG,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC;YACpC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC;QACH,MAAM,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC;YACzC,SAAS;YACT,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBAC/B,MAAM,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBACnC,MAAM,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBAC7C,IAAI,MAAM,CAAC,0BAA0B,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;oBACxG,MAAM,mBAAmB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBAChD,CAAC;YACH,CAAC;SACF,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,CAAC,kFAAkF,CAAC,CAAC;IACpG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA2B,EAAE,IAAI,CAAC;QAChD,OAAO,CAAC,QAAQ,GAAG,KAAK,YAAY,0BAA0B,CAAC,CAAC,CAAC,CAAC;YAChE,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC,CAAC;gBACjC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC;oBAC9B,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC,CAAC;wBACjC,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC;QACnH,OAAO,CAAC,KAAK,CAAC,qEAAqE,CAAC,CAAC;QACrF,OAAO,CAAC,KAAK,CAAC,sGAAsG,CAAC,CAAC;IACxH,CAAC;AACH,CAAC;AAED,MAAM,IAAI,EAAE,CAAC"}

package/build/index.js

@@ -47,14 +47,14 @@ else {
     async function main() {
         try {
             // Load configuration
-            const config = loadConfig();
+            const config = await loadConfig();
             log("DEBUG", "Configuration loaded", { sessionDir: config.sessionDir });
             // Create MCP server instance
             const server = new McpServer({
                 name: "brightspace",
                 version: PKG_VERSION,
                 description: "Brightspace MCP Server — by Rohan Muppa (github.com/rohanmuppa/brightspace-mcp-server)",
-            });
+            }, { capabilities: { logging: {} } });
             log("INFO", "");
             log("INFO", "========================================");
             log("INFO", `  Brightspace MCP Server v${PKG_VERSION}`);
@@ -69,7 +69,11 @@ else {
                 tokenTtl: config.tokenTtl,
             });
             // Create AuthRunner for auto-reauthentication
-            const authRunner = new AuthRunner();
+            const authRunner = new AuthRunner({
+                onProgress: (message) => {
+                    void server.sendLoggingMessage({ level: "info", logger: "brightspace-auth", data: message }).catch(() => { });
+                },
+            });
             // Create D2L API Client with auto-reauth support
             const apiClient = new D2LApiClient({
                 baseUrl: config.baseUrl,
@@ -111,7 +115,7 @@ else {
                                 type: "text",
                                 text: "Not authenticated. Auto-reauthentication was attempted but failed. " +
                                     "Please run `brightspace-auth` manually in your terminal to log in. " +
-                                    "Make sure your credentials in .env are correct and your internet connection is stable.",
+                                    "Run setup to update your saved credentials, and check your internet connection.",
                             },
                         ];
                         const notice = getUpdateNotice();

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,oBAAoB,EACpB,0BAA0B,EAC1B,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AACtC,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACxF,OAAO,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AAEL,uEAAuE;AACvE,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAEnC,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;IAC3B,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;AAC7B,CAAC;KAAM,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;IACjC,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;AAChC,CAAC;KAAM,CAAC;IACN,uEAAuE;IAEvE,qFAAqF;IACrF,iBAAiB,EAAE,CAAC;IAEpB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,EAAE;QAC1C,GAAG,CAAC,OAAO,EAAE,6BAA6B,EAAE,MAAM,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,IAAI;QACjB,IAAI,CAAC;YACH,qBAAqB;YACrB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,GAAG,CAAC,OAAO,EAAE,sBAAsB,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;YAExE,6BAA6B;YAC7B,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;gBAC3B,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,WAAW;gBACpB,WAAW,EAAE,wFAAwF;aACtG,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAChB,GAAG,CAAC,MAAM,EAAE,0CAA0C,CAAC,CAAC;YACxD,GAAG,CAAC,MAAM,EAAE,6BAA6B,WAAW,EAAE,CAAC,CAAC;YACxD,GAAG,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAC;YAC/C,GAAG,CAAC,MAAM,EAAE,gDAAgD,CAAC,CAAC;YAC9D,GAAG,CAAC,MAAM,EAAE,0CAA0C,CAAC,CAAC;YACxD,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAEhB,gDAAgD;YAChD,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC;gBACpC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAC;YAEH,8CAA8C;YAC9C,MAAM,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC;YAEpC,iDAAiD;YACjD,MAAM,SAAS,GAAG,IAAI,YAAY,CAAC;gBACjC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,YAAY;gBACZ,aAAa,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE;aACtC,CAAC,CAAC;YAEH,gDAAgD;YAChD,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,UAAU,EAAE,CAAC;gBAC7B,GAAG,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;YAC5C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,GAAG,CAAC,OAAO,EAAE,qCAAqC,EAAE,KAAK,CAAC,CAAC;gBAC3D,GAAG,CAAC,OAAO,EAAE,8DAA8D,CAAC,CAAC;gBAC7E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,kDAAkD;YAClD,iBAAiB,EAAE,CAAC;YAEpB,2EAA2E;YAC3E,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;gBACE,KAAK,EAAE,6BAA6B;gBACpC,WAAW,EACT,mDAAmD;oBACnD,sDAAsD;oBACtD,kFAAkF;oBAClF,yCAAyC;aAC5C,EACD,KAAK,IAAI,EAAE;gBACT,GAAG,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;gBAEvC,IAAI,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,CAAC;gBAE1C,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,GAAG,CAAC,MAAM,EAAE,iEAAiE,CAAC,CAAC;oBAE/E,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,CAAC;oBACvC,IAAI,OAAO,EAAE,CAAC;wBACZ,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,CAAC;oBACxC,CAAC;oBAED,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,GAAG,CAAC,MAAM,EAAE,qEAAqE,CAAC,CAAC;wBAEnF,MAAM,OAAO,GAA0C;4BACrD;gCACE,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,qEAAqE;oCACzE,qEAAqE;oCACrE,wFAAwF;6BAC3F;yBACF,CAAC;wBACF,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;wBACjC,IAAI,MAAM;4BAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;wBACzD,OAAO,EAAE,OAAO,EAAE,CAAC;oBACrB,CAAC;oBAED,GAAG,CAAC,MAAM,EAAE,6CAA6C,CAAC,CAAC;gBAC7D,CAAC;gBAED,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC;gBACzE,GAAG,CAAC,MAAM,EAAE,wCAAwC,SAAS,UAAU,CAAC,CAAC;gBAEzE,MAAM,OAAO,GAA0C;oBACrD;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,qDAAqD,SAAS,qBAAqB,KAAK,CAAC,MAAM,GAAG;qBACzG;iBACF,CAAC;gBACF,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;gBACjC,IAAI,MAAM;oBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;gBACzD,OAAO,EAAE,OAAO,EAAE,CAAC;YACrB,CAAC,CACF,CAAC;YAEF,GAAG,CAAC,OAAO,EAAE,4BAA4B,CAAC,CAAC;YAE3C,uDAAuD;YACvD,IAAI,MAAM,CAAC,YAAY,CAAC,gBAAgB,IAAI,MAAM,CAAC,YAAY,CAAC,gBAAgB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC;gBACpH,GAAG,CAAC,OAAO,EAAE,sBAAsB,EAAE;oBACnC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,gBAAgB;oBAC7C,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,gBAAgB;oBAC7C,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,UAAU;iBAC3C,CAAC,CAAC;YACL,CAAC;YAED,qBAAqB;YACrB,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YAChD,2BAA2B,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YACvD,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YAC/C,wBAAwB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YACpD,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YAClD,0BAA0B,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAC9D,wBAAwB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC5C,oBAAoB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACxC,0BAA0B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC9C,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACrC,mBAAmB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACvC,sBAAsB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC1C,GAAG,CAAC,OAAO,EAAE,gEAAgE,CAAC,CAAC;YAE/E,0BAA0B;YAC1B,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;YAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAEhC,GAAG,CAAC,MAAM,EAAE,gFAAgF,CAAC,CAAC;YAC9F,GAAG,CAAC,MAAM,EAAE,mGAAmG,CAAC,CAAC;QACnH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,OAAO,EAAE,4BAA4B,EAAE,KAAK,CAAC,CAAC;YAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,oBAAoB;IACpB,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACxB,GAAG,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;QACzB,GAAG,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,IAAI,EAAE,CAAC;AACT,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,oBAAoB,EACpB,0BAA0B,EAC1B,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AACtC,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACxF,OAAO,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AAEL,uEAAuE;AACvE,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAEnC,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;IAC3B,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;AAC7B,CAAC;KAAM,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;IACjC,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;AAChC,CAAC;KAAM,CAAC;IACN,uEAAuE;IAEvE,qFAAqF;IACrF,iBAAiB,EAAE,CAAC;IAEpB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,EAAE;QAC1C,GAAG,CAAC,OAAO,EAAE,6BAA6B,EAAE,MAAM,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,IAAI;QACjB,IAAI,CAAC;YACH,qBAAqB;YACrB,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;YAClC,GAAG,CAAC,OAAO,EAAE,sBAAsB,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;YAExE,6BAA6B;YAC7B,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;gBAC3B,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,WAAW;gBACpB,WAAW,EAAE,wFAAwF;aACtG,EAAE,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YACtC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAChB,GAAG,CAAC,MAAM,EAAE,0CAA0C,CAAC,CAAC;YACxD,GAAG,CAAC,MAAM,EAAE,6BAA6B,WAAW,EAAE,CAAC,CAAC;YACxD,GAAG,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAC;YAC/C,GAAG,CAAC,MAAM,EAAE,gDAAgD,CAAC,CAAC;YAC9D,GAAG,CAAC,MAAM,EAAE,0CAA0C,CAAC,CAAC;YACxD,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAEhB,gDAAgD;YAChD,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC;gBACpC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAC;YAEH,8CAA8C;YAC9C,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC;gBAChC,UAAU,EAAE,CAAC,OAAO,EAAE,EAAE;oBACtB,KAAK,MAAM,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAC/G,CAAC;aACF,CAAC,CAAC;YAEH,iDAAiD;YACjD,MAAM,SAAS,GAAG,IAAI,YAAY,CAAC;gBACjC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,YAAY;gBACZ,aAAa,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE;aACtC,CAAC,CAAC;YAEH,gDAAgD;YAChD,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,UAAU,EAAE,CAAC;gBAC7B,GAAG,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;YAC5C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,GAAG,CAAC,OAAO,EAAE,qCAAqC,EAAE,KAAK,CAAC,CAAC;gBAC3D,GAAG,CAAC,OAAO,EAAE,8DAA8D,CAAC,CAAC;gBAC7E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,kDAAkD;YAClD,iBAAiB,EAAE,CAAC;YAEpB,2EAA2E;YAC3E,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;gBACE,KAAK,EAAE,6BAA6B;gBACpC,WAAW,EACT,mDAAmD;oBACnD,sDAAsD;oBACtD,kFAAkF;oBAClF,yCAAyC;aAC5C,EACD,KAAK,IAAI,EAAE;gBACT,GAAG,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;gBAEvC,IAAI,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,CAAC;gBAE1C,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,GAAG,CAAC,MAAM,EAAE,iEAAiE,CAAC,CAAC;oBAE/E,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,CAAC;oBACvC,IAAI,OAAO,EAAE,CAAC;wBACZ,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,CAAC;oBACxC,CAAC;oBAED,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,GAAG,CAAC,MAAM,EAAE,qEAAqE,CAAC,CAAC;wBAEnF,MAAM,OAAO,GAA0C;4BACrD;gCACE,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,qEAAqE;oCACzE,qEAAqE;oCACrE,iFAAiF;6BACpF;yBACF,CAAC;wBACF,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;wBACjC,IAAI,MAAM;4BAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;wBACzD,OAAO,EAAE,OAAO,EAAE,CAAC;oBACrB,CAAC;oBAED,GAAG,CAAC,MAAM,EAAE,6CAA6C,CAAC,CAAC;gBAC7D,CAAC;gBAED,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC;gBACzE,GAAG,CAAC,MAAM,EAAE,wCAAwC,SAAS,UAAU,CAAC,CAAC;gBAEzE,MAAM,OAAO,GAA0C;oBACrD;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,qDAAqD,SAAS,qBAAqB,KAAK,CAAC,MAAM,GAAG;qBACzG;iBACF,CAAC;gBACF,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;gBACjC,IAAI,MAAM;oBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;gBACzD,OAAO,EAAE,OAAO,EAAE,CAAC;YACrB,CAAC,CACF,CAAC;YAEF,GAAG,CAAC,OAAO,EAAE,4BAA4B,CAAC,CAAC;YAE3C,uDAAuD;YACvD,IAAI,MAAM,CAAC,YAAY,CAAC,gBAAgB,IAAI,MAAM,CAAC,YAAY,CAAC,gBAAgB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC;gBACpH,GAAG,CAAC,OAAO,EAAE,sBAAsB,EAAE;oBACnC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,gBAAgB;oBAC7C,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,gBAAgB;oBAC7C,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,UAAU;iBAC3C,CAAC,CAAC;YACL,CAAC;YAED,qBAAqB;YACrB,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YAChD,2BAA2B,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YACvD,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YAC/C,wBAAwB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YACpD,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YAClD,0BAA0B,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAC9D,wBAAwB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC5C,oBAAoB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACxC,0BAA0B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC9C,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACrC,mBAAmB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACvC,sBAAsB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC1C,GAAG,CAAC,OAAO,EAAE,gEAAgE,CAAC,CAAC;YAE/E,0BAA0B;YAC1B,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;YAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAEhC,GAAG,CAAC,MAAM,EAAE,gFAAgF,CAAC,CAAC;YAC9F,GAAG,CAAC,MAAM,EAAE,mGAAmG,CAAC,CAAC;QACnH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,OAAO,EAAE,4BAA4B,EAAE,KAAK,CAAC,CAAC;YAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,oBAAoB;IACpB,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACxB,GAAG,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;QACzB,GAAG,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,IAAI,EAAE,CAAC;AACT,CAAC"}