brightspace-mcp-server 1.6.3 → 2.0.0

package/build/auth/encrypted-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted-store.js","sourceRoot":"","sources":["../../src/auth/encrypted-store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAA0B,MAAM,uBAAuB,CAAC;AAexF,MAAM,UAAU,OAAO,CAAC,SAAiB,EAAE,GAAW,EAAE,GAAY;IAClE,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7D,IAAI,GAAG;QAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC/E,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAC9G,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,SAAwB,EAAE,GAAW,EAAE,GAAY;IACzE,IAAI,CAAC,SAAS,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACrJ,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/F,IAAI,GAAG;QAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACjH,CAAC;AAED,SAAS,cAAc,CAAC,IAA6B;IACnD,OAAO,4BAA4B,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAI,UAAkB,EAAE,MAAuB,EAAE,IAA6B,EAAE,OAA2B;IAClJ,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxH,MAAM,GAAG,GAAG,MAAM,uBAAuB,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAM,CAAC;AAC/E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,UAAkB,EAAE,IAAY,EAAE,IAA6B,EAAE,KAAc,EAAE,OAA2B;IACpJ,MAAM,GAAG,GAAG,MAAM,uBAAuB,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,MAAM,GAAoB,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;IAC/G,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAChI,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,eAAe,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;QACrE,IAAI,EAAE,KAAK;QACX,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;YAC7B,MAAM,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YAClG,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5B,CAAC;KACF,CAAC,CAAC;IACH,2EAA2E;IAC3E,MAAM,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AACpG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,OAA2B;IACvE,IAAI,OAAO,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;AACpB,CAAC"}

package/build/auth/legacy-profile.d.ts

@@ -0,0 +1,3 @@
+/** Retire only the known v1 profile after both encrypted state and token persistence succeed. */
+export declare function retireLegacyProfile(sessionDir: string): Promise<void>;
+//# sourceMappingURL=legacy-profile.d.ts.map

package/build/auth/legacy-profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-profile.d.ts","sourceRoot":"","sources":["../../src/auth/legacy-profile.ts"],"names":[],"mappings":"AAMA,iGAAiG;AACjG,wBAAsB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA0B3E"}

package/build/auth/legacy-profile.js

@@ -0,0 +1,41 @@
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import * as os from "node:os";
+import trash from "trash";
+import { log } from "../utils/logger.js";
+/** Retire only the known v1 profile after both encrypted state and token persistence succeed. */
+export async function retireLegacyProfile(sessionDir) {
+    const profile = path.join(sessionDir, "browser-data");
+    try {
+        const stat = await fs.lstat(profile);
+        if (!stat.isDirectory() || stat.isSymbolicLink())
+            return;
+        await fs.access(path.join(sessionDir, "storage-state.encrypted.json"));
+        try {
+            const owner = await fs.readlink(path.join(profile, "SingletonLock"));
+            const match = /^(.*)-(\d+)$/.exec(owner);
+            if (!match || match[1] !== os.hostname())
+                return;
+            try {
+                process.kill(Number(match[2]), 0);
+                return;
+            }
+            catch (error) {
+                if (error.code !== "ESRCH")
+                    return;
+            }
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                return;
+        }
+        await trash([profile]);
+        log("INFO", "Moved the retired v1 browser-data profile to Trash. It can be restored there.");
+    }
+    catch (error) {
+        if (error.code !== "ENOENT") {
+            log("WARN", "Could not retire the inactive v1 browser profile. It was preserved.");
+        }
+    }
+}
+//# sourceMappingURL=legacy-profile.js.map

package/build/auth/legacy-profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-profile.js","sourceRoot":"","sources":["../../src/auth/legacy-profile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAEzC,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,UAAkB;IAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,OAAO;QACzD,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,8BAA8B,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC;YACrE,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACzC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;gBAAE,OAAO;YACjD,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAClC,OAAO;YACT,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAK,KAA+B,CAAC,IAAI,KAAK,OAAO;oBAAE,OAAO;YAChE,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO;QACjE,CAAC;QACD,MAAM,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACvB,GAAG,CAAC,MAAM,EAAE,+EAA+E,CAAC,CAAC;IAC/F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,GAAG,CAAC,MAAM,EAAE,qEAAqE,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;AACH,CAAC"}

package/build/auth/legacy-state.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Brightspace MCP Server
+ * Copyright (c) 2026 Rohan Muppa. All rights reserved.
+ * Licensed under MIT. See LICENSE file for details.
+ */
+type StateDisposition = "absent" | "encrypted" | "preserved";
+export interface LegacyMigrationResult {
+    tokenState: StateDisposition;
+    browserState: StateDisposition;
+}
+/** Secure v1 state in its original directory without assigning it to a new identity. */
+export declare function migrateLegacyState(sessionRoot: string): Promise<LegacyMigrationResult>;
+export {};
+//# sourceMappingURL=legacy-state.d.ts.map

package/build/auth/legacy-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-state.d.ts","sourceRoot":"","sources":["../../src/auth/legacy-state.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH,KAAK,gBAAgB,GAAG,QAAQ,GAAG,WAAW,GAAG,WAAW,CAAC;AAC7D,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,gBAAgB,CAAC;IAC7B,YAAY,EAAE,gBAAgB,CAAC;CAChC;AAmCD,wFAAwF;AACxF,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAwD5F"}

package/build/auth/legacy-state.js

@@ -0,0 +1,107 @@
+/**
+ * Brightspace MCP Server
+ * Copyright (c) 2026 Rohan Muppa. All rights reserved.
+ * Licensed under MIT. See LICENSE file for details.
+ */
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import { acquireProcessLock, AuthenticationInProgressError } from "./auth-lock.js";
+import { BrowserStateStore } from "./browser-state-store.js";
+import { NativeCredentialStoreError } from "./credential-store.js";
+import { SessionStore } from "./session-store.js";
+import { log } from "../utils/logger.js";
+async function fileKind(root, name) {
+    try {
+        const stat = await fs.lstat(path.join(root, name));
+        return stat.isFile() && !stat.isSymbolicLink() ? "regular" : "unsafe";
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return "absent";
+        throw error;
+    }
+}
+function reportPreserved(label) {
+    log("WARN", `Legacy ${label} could not be migrated safely and was preserved in the original session directory. The new account will use a separate session.`);
+}
+async function migrate(label, operation) {
+    try {
+        await operation();
+        return "encrypted";
+    }
+    catch (error) {
+        if (error instanceof NativeCredentialStoreError || error instanceof AuthenticationInProgressError)
+            throw error;
+        reportPreserved(label);
+        return "preserved";
+    }
+}
+async function isV2Session(root) {
+    try {
+        return JSON.parse(await fs.readFile(path.join(root, "session.json"), "utf8")).version === 2;
+    }
+    catch {
+        return false;
+    }
+}
+/** Secure v1 state in its original directory without assigning it to a new identity. */
+export async function migrateLegacyState(sessionRoot) {
+    const names = ["session.json", "storage-state.json", "storage-state.encrypted.json"];
+    const kinds = await Promise.all(names.map((name) => fileKind(sessionRoot, name)));
+    if (kinds.every((kind) => kind === "absent"))
+        return { tokenState: "absent", browserState: "absent" };
+    const [token, plainBrowser, encryptedBrowser] = kinds;
+    const tokenAlreadyV2 = token === "regular" && await isV2Session(sessionRoot);
+    // Once migration is complete, validation is read-only and must not make
+    // concurrent MCP startups contend on the authentication lock.
+    if ((token === "absent" || token === "unsafe" || tokenAlreadyV2) && plainBrowser === "absent") {
+        let tokenState = "absent";
+        if (token === "unsafe") {
+            reportPreserved("token state");
+            tokenState = "preserved";
+        }
+        else if (tokenAlreadyV2) {
+            tokenState = await migrate("token state", () => new SessionStore(sessionRoot).load());
+        }
+        let browserState = "absent";
+        if (encryptedBrowser === "unsafe") {
+            reportPreserved("browser state");
+            browserState = "preserved";
+        }
+        else if (encryptedBrowser === "regular") {
+            browserState = await migrate("browser state", () => new BrowserStateStore(sessionRoot).load());
+        }
+        return { tokenState, browserState };
+    }
+    const release = await acquireProcessLock(path.join(sessionRoot, ".auth.lock"));
+    try {
+        const result = { tokenState: "absent", browserState: "absent" };
+        // Recheck under the process lock; never follow links into another directory.
+        const token = await fileKind(sessionRoot, "session.json");
+        if (token !== "absent") {
+            const salt = await fileKind(sessionRoot, "salt");
+            if (token === "unsafe" || salt === "unsafe") {
+                reportPreserved("token state");
+                result.tokenState = "preserved";
+            }
+            else {
+                result.tokenState = await migrate("token state", () => new SessionStore(sessionRoot).load());
+            }
+        }
+        const [plain, encrypted] = await Promise.all([
+            fileKind(sessionRoot, "storage-state.json"), fileKind(sessionRoot, "storage-state.encrypted.json"),
+        ]);
+        if (plain === "unsafe" || encrypted === "unsafe") {
+            reportPreserved("browser state");
+            result.browserState = "preserved";
+        }
+        else if (plain !== "absent" || encrypted !== "absent") {
+            result.browserState = await migrate("browser state", () => new BrowserStateStore(sessionRoot).load());
+        }
+        return result;
+    }
+    finally {
+        await release();
+    }
+}
+//# sourceMappingURL=legacy-state.js.map

package/build/auth/legacy-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-state.js","sourceRoot":"","sources":["../../src/auth/legacy-state.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAQzC,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,IAAY;IAChD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IACxE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAC;QACxE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,GAAG,CAAC,MAAM,EAAE,UAAU,KAAK,iIAAiI,CAAC,CAAC;AAChK,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,KAAa,EAAE,SAAiC;IACrE,IAAI,CAAC;QACH,MAAM,SAAS,EAAE,CAAC;QAClB,OAAO,WAAW,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,0BAA0B,IAAI,KAAK,YAAY,6BAA6B;YAAE,MAAM,KAAK,CAAC;QAC/G,eAAe,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY;IACrC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC;IAC9F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,WAAmB;IAC1D,MAAM,KAAK,GAAG,CAAC,cAAc,EAAE,oBAAoB,EAAE,8BAA8B,CAAC,CAAC;IACrF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAClF,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;IAEtG,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,gBAAgB,CAAC,GAAG,KAAK,CAAC;IACtD,MAAM,cAAc,GAAG,KAAK,KAAK,SAAS,IAAI,MAAM,WAAW,CAAC,WAAW,CAAC,CAAC;IAC7E,wEAAwE;IACxE,8DAA8D;IAC9D,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,QAAQ,IAAI,cAAc,CAAC,IAAI,YAAY,KAAK,QAAQ,EAAE,CAAC;QAC9F,IAAI,UAAU,GAAqB,QAAQ,CAAC;QAC5C,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvB,eAAe,CAAC,aAAa,CAAC,CAAC;YAC/B,UAAU,GAAG,WAAW,CAAC;QAC3B,CAAC;aAAM,IAAI,cAAc,EAAE,CAAC;YAC1B,UAAU,GAAG,MAAM,OAAO,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI,YAAY,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;QAED,IAAI,YAAY,GAAqB,QAAQ,CAAC;QAC9C,IAAI,gBAAgB,KAAK,QAAQ,EAAE,CAAC;YAClC,eAAe,CAAC,eAAe,CAAC,CAAC;YACjC,YAAY,GAAG,WAAW,CAAC;QAC7B,CAAC;aAAM,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YAC1C,YAAY,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,IAAI,iBAAiB,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;IAC/E,IAAI,CAAC;QACH,MAAM,MAAM,GAA0B,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;QACvF,6EAA6E;QAC7E,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QAC1D,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YACjD,IAAI,KAAK,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC5C,eAAe,CAAC,aAAa,CAAC,CAAC;gBAC/B,MAAM,CAAC,UAAU,GAAG,WAAW,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,UAAU,GAAG,MAAM,OAAO,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI,YAAY,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/F,CAAC;QACH,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC3C,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC,EAAE,QAAQ,CAAC,WAAW,EAAE,8BAA8B,CAAC;SACnG,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YACjD,eAAe,CAAC,eAAe,CAAC,CAAC;YACjC,MAAM,CAAC,YAAY,GAAG,WAAW,CAAC;QACpC,CAAC;aAAM,IAAI,KAAK,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YACxD,MAAM,CAAC,YAAY,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,IAAI,iBAAiB,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACxG,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC;AACH,CAAC"}

package/build/auth/purdue-sso.d.ts

@@ -1,66 +1,48 @@
 /**
  * Purdue Brightspace MCP Server
  * Copyright (c) 2026 Rohan Muppa. All rights reserved.
- * Licensed under MIT — see LICENSE file for details.
+ * Licensed under MIT : see LICENSE file for details.
  */
 import type { Page } from "playwright";
 interface PurdueSSOConfig {
     username?: string;
     password?: string;
+    baseUrl?: string;
 }
 export declare class PurdueSSOFlow {
     private config;
+    private accountHintSubmitted;
     constructor(config: PurdueSSOConfig);
     /**
      * Returns true if credentials are available for automated SSO login.
      */
     hasCredentials(): boolean;
+    prepareLogin(page: Page): Promise<void>;
+    /** First half of Brightspace Bar's choreography, with no password access. */
+    identifyAccount(page: Page): Promise<boolean>;
     /**
      * Execute the complete Microsoft Entra ID SSO login flow for Purdue.
-     * Handles institution selector, email/password entry, MFA (TOTP or manual), and "stay signed in" prompt.
+     * Handles the school selector, saved credentials, device MFA approval, and stay-signed-in.
      *
      * @param page - Playwright page instance (already navigated to Brightspace or redirected to login)
-     * @returns true on successful login (URL contains /d2l/home), false on timeout/failure
+     * @returns true after reaching Brightspace home; failures are typed errors
      */
     login(page: Page): Promise<boolean>;
-    /**
-     * Manual login fallback: let the user type credentials and complete MFA themselves.
-     * The browser stays open in headed mode while we wait for /d2l/home.
-     */
-    manualLogin(page: Page): Promise<boolean>;
     private handleCampusSelector;
     private enterCredentials;
-    /**
-     * Resolve a control only when it is actually on screen.
-     *
-     * Entra is a single-page app: the account-name view stays in the DOM once
-     * the password view replaces it, so a plain page.$() returns the hidden
-     * first-page input or button that precedes the live one in document order.
-     * Filling or clicking those stalls on Playwright's actionability wait.
-     */
-    private findVisible;
-    /**
-     * Advance Microsoft Entra's account-name page.
-     *
-     * That page carries a password box of its own, and Playwright reports it as
-     * visible, so presence cannot tell it apart from a single-page form. The
-     * button label can: it reads "Next" there and "Sign in" on the view that
-     * follows. Filling the password against the account-name page leaves the
-     * browser parked with both fields populated and nothing submitted.
-     */
-    private submitAccountName;
+    /** Ported from Brightspace Bar's proven four-step Entra choreography. */
+    private actWhenReady;
+    private fillWhenReady;
+    private clickWhenReady;
+    /** Match Brightspace Bar's selector loop instead of trusting the first DOM match. */
+    private anyVisible;
+    /** Brightspace Bar's bounded number/auth/KMSI polling loop. */
     private handleMFA;
-    /**
-     * Log Entra's number-match digits until the MFA wait is over.
-     *
-     * Only a CHANGED value is logged: Entra re-mints the number whenever the
-     * user asks for a new request, and repeating the same digits every two
-     * seconds would bury everything else in the log.
-     */
-    private watchNumberMatch;
+    /** The login shell also exposes D2L.LP, so verify origin and home as well. */
+    private isAuthenticated;
+    private clickProvenKmsi;
     /** The digits on screen, or null when Entra is not showing any. */
     private readNumberMatch;
-    private handleStaySignedIn;
 }
 export {};
 //# sourceMappingURL=purdue-sso.d.ts.map

package/build/auth/purdue-sso.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"purdue-sso.d.ts","sourceRoot":"","sources":["../../src/auth/purdue-sso.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAiB,IAAI,EAAE,MAAM,YAAY,CAAC;AAyCtD,UAAU,eAAe;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAkB;gBAEpB,MAAM,EAAE,eAAe;IAInC;;OAEG;IACH,cAAc,IAAI,OAAO;IAIzB;;;;;;OAMG;IACG,KAAK,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IA2BzC;;;OAGG;IACG,WAAW,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;YAoBjC,oBAAoB;YAepB,gBAAgB;IAuD9B;;;;;;;OAOG;YACW,WAAW;IAUzB;;;;;;;;OAQG;YACW,iBAAiB;YAiBjB,SAAS;IA2CvB;;;;;;OAMG;YACW,gBAAgB;IAoB9B,mEAAmE;YACrD,eAAe;YASf,kBAAkB;CAiBjC"}
+{"version":3,"file":"purdue-sso.d.ts","sourceRoot":"","sources":["../../src/auth/purdue-sso.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAW,IAAI,EAAE,MAAM,YAAY,CAAC;AAyBhD,UAAU,eAAe;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAQD,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,oBAAoB,CAAS;gBAEzB,MAAM,EAAE,eAAe;IAInC;;OAEG;IACH,cAAc,IAAI,OAAO;IAInB,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7C,6EAA6E;IACvE,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IASnD;;;;;;OAMG;IACG,KAAK,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;YA2B3B,oBAAoB;YAuBpB,gBAAgB;IAuB9B,yEAAyE;YAC3D,YAAY;YAeZ,aAAa;YAIb,cAAc;IAK5B,qFAAqF;YACvE,UAAU;IAOxB,+DAA+D;YACjD,SAAS;IAoCvB,8EAA8E;YAChE,eAAe;YAkBf,eAAe;IAa7B,mEAAmE;YACrD,eAAe;CAU9B"}