eve-online-mcp 0.3.2 → 0.5.0

package/README.md

@@ -6,14 +6,21 @@ The server is generated at runtime from a pinned copy of CCP's OpenAPI 3.1 docum
 
 ## What the MCP server exposes
 
+- `list_eve_characters` lists saved character IDs, names, and granted scopes without exposing credentials.
+- `authorize_eve_character` opens browser consent for a specific character, verifies the selected identity, and stores that character's refresh credential. `select_eve_character` chooses a saved character for protected operations that do not name one. These tools manage local authentication only; they never change game state.
 - `search_esi_operations` ranks endpoints using deterministic lexical and curated intent matching, supports hard tag/authentication filters and offsets, and explains every match.
 - `get_esi_operation` returns exact parameters, request-body schema, required caller inputs, defaults, pagination guidance, OAuth scopes, cache hints, safe examples where available, and rate-limit metadata.
 - `call_esi` invokes one page of one catalogued read operation. It rejects undeclared parameters, validates values, fixes the origin to ESI, supplies compatibility headers, and never accepts an Authorization header from a tool call.
 - `resolve_eve_entities` performs one exact-only public batch lookup from names to every matching ID/category, or from IDs to names/categories. Ambiguous and unresolved values remain explicit.
 - `get_character_context` retrieves only the requested `profile`, `location`, `ship`, `skills`, `skillQueue`, and/or `wallet` sections for an explicit character ID, with per-section data, freshness, and errors.
 - `get_market_snapshot` collects bounded pages of public regional orders for one type, optionally filters one exact location, and returns observed aggregates with honest completeness warnings.
+- `initialize_static_data` downloads and validates CCP's official static data into a local cache, reports its build/freshness, and checks for updates on request. Startup also initializes in the background.
+- `resolve_skill_plan_targets` resolves exact skill/ship names or type IDs against the cache, including explicit skill levels and unique singular skill names. Ambiguous or unresolved inputs return candidates.
+- `get_skill_dependencies` returns a public prerequisite graph with skill-level nodes and prerequisite-to-dependent edges, without login.
+- `generate_skill_plan` computes a personalized, dependency-checked plan from cached requirements and scoped character skills/queue, removes completed levels, and returns training text and estimated remaining SP.
 - `eve-esi://catalog` describes pinned API coverage, excluded operation count, and guidance for the generic and focused workflows.
 - `plan_eve_adventure` is a prompt for evidence-based recommendations with costs, preparation, risk, travel, and a concrete first action. Its optional activity playbooks cover exploration, factional warfare, mining, industry, trading, hauling, agent missions, PvE, and PvP.
+- `plan_eve_skills` interprets activity/class goals, resolves material choices, and calls the deterministic planning tools. It explains practical support, optional upgrades and eligibility limits.
 
 ESI cache headers are respected in memory, protected cache entries are isolated by credential context, and every response reports fetch/serve/expiry timestamps plus defensive page metadata. Errors include stable codes, retryability, Retry-After guidance, and a suggested action. Individual responses and bounded composite workflows use 5 MB safety ceilings. A descriptive User-Agent is sent as [recommended by ESI](https://developers.eveonline.com/docs/services/esi/best-practices/); it is derived from the installed package version and has the form `eve-online-mcp/<version> (adam@hammo.dev; +https://github.com/HammoTime/eve-online-mcp)`.
 
@@ -54,16 +61,41 @@ Once published, configure your MCP host to run the npm package directly:
 
 For a local checkout, build in the devcontainer and use `node /absolute/path/to/eve-online-mcp/dist/index.js` instead.
 
+During MCP initialization, the server reports the version from its installed `package.json`, so MCP host diagnostics identify the running package release.
+
+### Discovery in Codex and other MCP hosts
+
+Installing the npm package makes the executable available; the MCP host must also be configured to launch it. For [Codex](https://learn.chatgpt.com/docs/extend/mcp?surface=cli), register the stdio server with:
+
+```sh
+codex mcp add eve-online -- npx -y eve-online-mcp
+codex mcp list
+```
+
+The server advertises EVE Online use cases in every tool's title and description, and returns workflow guidance in the MCP initialization `instructions` field. This lets hosts recognize character sheets, skills, skill queues, markets and other ESI data requests before a prompt or catalog resource is opened. Codex reads these instructions; other hosts may handle them differently. Tool selection remains the host's decision.
+
+For a named character's training plan, use `resolve_eve_entities` to select the character-category ID, `resolve_skill_plan_targets` to verify goals, then `generate_skill_plan` with that explicit character ID. The planner retrieves skills and queue itself. `get_character_context` remains available for character inspection, and other ESI questions use `search_esi_operations`, `get_esi_operation`, then `call_esi`. Public discovery needs no login; protected data uses EVE SSO. ESI does not expose Omega subscription status or saved in-game skill plans, and skill injector recommendations require current game rules and explicit assumptions in addition to character data.
+
+To check discovery after updating the configured server, reconnect it or start a fresh host session and confirm that its tool list contains EVE Online tool titles. Try a request such as: "Use EVE Online data to review the character sheet, skills and skill queue for <exact character name>, and suggest a hauling training plan." The host should discover the EVE tools and resolve the name before retrieving the needed sections. Inspect the tool-call trace to verify that it uses MCP for ESI-covered data before inspecting the game client. This is a manual host check; the automated tests verify initialization metadata and tool listings, not model selection behavior.
+
+If the host still overlooks the server, capture the exact prompt, host/model version, configured server command and arguments, initialization instructions, tool listing and relevant tool-call sequence. Exclude credentials, tokens and private character responses from a shared report. This distinguishes a connection or stale-metadata problem from a host tool-selection problem.
+
 ### EVE SSO
 
-Public ESI routes need no credentials and never trigger login. On the first operation that needs character or corporation data, the server automatically opens EVE SSO in the browser. After consent it stores only the refresh credential in the user's OS configuration directory, rotates it when EVE returns a replacement, and manages short-lived access tokens in memory. No client secret or manual token handling is required.
+Public ESI routes need no credentials and never trigger login. Ask Codex for a character's protected data: when that character has no saved authorization, the server automatically opens EVE SSO in the browser. Select the requested character and approve access; the server verifies the identity, saves its separate refresh credential, and continues the request. Repeat for another character on the same or a different EVE account. Previously authorized characters remain available. No commands, client secret, or manual token handling are required.
+
+Credentials are stored per character, not per EVE account. Both `call_esi` and `get_character_context` select the credential matching the requested `character_id`/`characterId`. A wrong-character browser selection saves nothing and reports the requested and selected IDs. Tokens with a different or unreadable character subject are rejected before making a protected character request. A remaining upstream 403 identifies the character and required scopes; ownership or corporation roles can still deny access even with the correct character.
+
+Codex can inspect saved authorizations using `list_eve_characters` and renew consent using `authorize_eve_character` when scopes are missing or a grant has expired or been revoked. For corporation, fleet, or structure operations without a character path parameter, a sole saved character is used automatically. With multiple saved characters and no default, the server asks Codex to use `select_eve_character` for the intended character. This default never overrides a character-specific request. Login dialogs are serialized, and simultaneous requests for the same missing character share a successful login.
+
+The versioned credential file lives in the user's OS configuration directory. Each entry stores a character ID/name, client ID, granted scopes, creation time, and refresh token. Access tokens stay in memory. Login and refresh validate EVE's signature, issuer, audiences, expiration, and character claims. Refresh-token rotation updates only the matching character; writes use a restricted-permission temporary file, atomic replacement, and locks to coordinate concurrent processes. Running servers reread the store to notice new consent or removal. Old single-credential files migrate on their next protected use after the character identity is verified; adding a new character before migration preserves the legacy credential.
 
 The package ships with this public PKCE client configuration:
 
 - Client ID: `6a65f1e650d240659dafbad29fb55e05`
 - Callback URL: `http://localhost:52765/callback`
 
-The callback must match the EVE application registration exactly. PKCE is intended for local applications that cannot keep a client secret, so never distribute or commit the client secret. The login can also be started or managed explicitly:
+The callback must match the EVE application registration exactly. PKCE is intended for local applications that cannot keep a client secret, so never distribute or commit the client secret. Optional maintenance commands are available, but are not needed for the Codex workflow. `auth logout` removes all local character credentials:
 
 ```sh
 npx eve-online-mcp auth login
@@ -136,7 +168,7 @@ esi-wallet.read_corporation_wallets.v1
 
 </details>
 
-`EVE_ACCESS_TOKEN`, `EVE_REFRESH_TOKEN`, `EVE_CLIENT_ID`, and `EVE_CLIENT_SECRET` remain supported as non-default overrides for automation or existing credentials. The server reports missing JWT scopes before spending an ESI request.
+`EVE_ACCESS_TOKEN`, `EVE_REFRESH_TOKEN`, `EVE_CLIENT_ID`, and `EVE_CLIENT_SECRET` remain supported as non-default overrides for automation or existing credentials. An environment token override represents one character and takes precedence over the local store; browser authorization tools are unavailable in that mode. Character requests still check the token subject and required scopes before spending an ESI request. Remove the token override to use automatic multi-character login.
 
 Optional settings:
 
@@ -148,11 +180,60 @@ Optional settings:
 | `EVE_CREDENTIALS_PATH`   | Overrides the OS credential file location                 |
 | `EVE_DISABLE_AUTO_SSO`   | Set to `1` to prevent browser login on protected calls    |
 | `EVE_SSO_REDIRECT_URI`   | Overrides the localhost callback for a custom application |
+| `EVE_SDE_CACHE_DIR`      | Overrides the local CCP static-data cache directory       |
 
 Do not commit tokens or client secrets. Tool responses never include the token, and callers cannot override the ESI origin or inject arbitrary headers.
 
 ## Suggested usage
 
+### Character skill training plans
+
+The executable planner supports published skills and ship hulls from CCP's [official JSONL SDE](https://developers.eveonline.com/docs/services/static-data/). On first startup it downloads the archive in the background; planning waits for initialization. The archive is roughly 95 MB at the verified build and can change in size. The cache retains the ZIP and a compact, validated skill/ship index. No character snapshots or credentials are written to this cache.
+
+Defaults are `%LOCALAPPDATA%\eve-online-mcp\sde` on Windows, `~/Library/Caches/eve-online-mcp/sde` on macOS, and `$XDG_CACHE_HOME/eve-online-mcp/sde` or `~/.cache/eve-online-mcp/sde` on Linux. Set `EVE_SDE_CACHE_DIR` in the MCP server environment for a different location. In a container this is a container path: mount a persistent volume there to retain data between runs.
+
+Each initialization checks CCP's latest-build manifest when the last successful check is at least five minutes old; `initialize_static_data` with `{"refresh":true}` checks immediately. Conditional ETag requests avoid unchanged downloads. Cache publication is atomic and the index has a SHA-256 integrity check. A failed refresh returns the last validated build with a stale warning. A missing/corrupt cache plus download failure prevents planning rather than supplying empty requirements. Downloads use fixed CCP URLs, bounded streaming and selected ZIP entries, without extracting archive paths.
+
+Example MCP tool arguments (replace `42` with the intended, verified character ID):
+
+```text
+initialize_static_data {}
+resolve_skill_plan_targets {"target":"exhumer"}
+get_skill_dependencies {"target":"Hulk"}
+generate_skill_plan {"characterId":42,"target":"Mining II"}
+generate_skill_plan {"characterId":42,"target":"exhumer"}
+generate_skill_plan {"characterId":42,"targets":[{"typeId":3386,"level":2},"Hulk"],"queuePolicy":"reorder"}
+```
+
+`target` and `targets` are mutually exclusive; at most 50 targets are accepted. Names match case-insensitively, with surrounding whitespace removed. Skills accept Roman or numeric levels I–V / 1–5. A bare skill defaults to I, so `exhumer` resolves to **Exhumers I**, not a guessed Hulk fit. Exact ship names produce minimum hull requirements; training the class skill alone does not establish that every hull can be flown. Partial names return suggestions without selecting one. Modules, rigs and complete fitting plans are outside the engine's scope.
+
+The graph uses `(skillId, level)` nodes, all six dogma prerequisite slots, and preceding-level edges. An iterative dependency traversal deduplicates shared nodes, then Kahn's topological sort orders them in **O(V + E)** time and memory for the expanded graph. A separate replay checks every step against the source requirements. Cycles and missing prerequisite metadata fail closed. Already satisfied permanent levels prune completed branches; requesting another level checks current requirements.
+
+`generate_skill_plan` requires both `esi-skills.read_skills.v1` and `esi-skills.read_skillqueue.v1` for the chosen character, checked together before either ESI request. It validates complete skills and queue snapshots, credits partial SP once, and distinguishes trained levels from active restrictions. `queuePolicy=preserve` (default) keeps the observed queue and returns **additions after that queue**, using a conditional projected baseline. `reorder` returns a proposed replacement that includes unrelated queued commitments. Future queue rows never become observed completion; contradictory past completion requires refreshed evidence. Neither policy edits the live queue.
+
+Results contain resolved targets, SDE build/freshness, character source timestamps, retained queue, ordered `plan`, graph edges, estimated missing SP, acquisition checks, and copyable `trainingText`. An empty plan means no additional levels under its declared baseline. Estimates do not establish Alpha/Omega eligibility, fit validity, budget, training duration, or optimal milestone timing. Formula rounding may differ by one SP; source caveats are returned with the result. Review the in-game import preview and available queue slots before applying text.
+
+#### Natural-language goals
+
+Select the `plan_eve_skills` MCP prompt in your host. It requires `character` (an exact character name or ID, as a string) and `goal` (a role, hull/fit, doctrine, or target skill list). Optional `constraints` captures the time horizon, Alpha/Omega state, budget, and preferences. Optional `queuePolicy` is `preserve` by default, or `reorder` to request a proposed new order while retaining unrelated commitments.
+
+Example prompt arguments:
+
+```json
+{
+  "character": "Exact Character Name",
+  "goal": "Build a practical hauling training plan with an early usable milestone",
+  "constraints": "Omega; prioritize the first two weeks; no remap or paid skill points",
+  "queuePolicy": "preserve"
+}
+```
+
+The prompt handles requests such as "I want to fly Jump Freighters" by distinguishing the class skill from a specific racial hull and asking for a material choice when needed. It verifies selected targets and calls `generate_skill_plan` for dependencies, progress subtraction, ordering and SP estimates. It separates mandatory hull unlocks, practical support and discretionary upgrades, labels eligibility and timing gaps, and preserves the tool's training text unchanged. The model does not reconstruct the dependency graph or perform a second calculation.
+
+Fetching the prompt does not fetch private data or trigger SSO. The host model subsequently uses the read-only tools. The prompt cannot change a queue, save an in-game plan, purchase/inject skills, or allocate SP. Goal interpretation and discretionary recommendations still depend on the host model; dependency expansion and personalized plan computation execute in tested code. See the [research, algorithm rationale and review scenarios](docs/skill-plan-research.md) for provenance and limits.
+
+### Adventure planning
+
 Select the `plan_eve_adventure` prompt in your MCP host, or ask something like:
 
 > Using my current location, skills, wallet, assets, and the nearby market, give me three two-hour exploration plans. Explain risk and startup cost, then recommend the best first step.

package/dist/auth.d.ts

@@ -1,8 +1,22 @@
 import { CredentialStore } from "./credential-store.js";
 import { type SsoLoginOptions } from "./sso.js";
+import { type TokenVerifier } from "./token-identity.js";
 export declare const DEFAULT_EVE_CLIENT_ID = "6a65f1e650d240659dafbad29fb55e05";
 export interface TokenProvider {
-    getAccessToken(requiredScopes?: string[]): Promise<string | undefined>;
+    getAccessToken(requiredScopes?: string[], characterId?: number): Promise<string | undefined>;
+}
+export declare class AuthenticationError extends Error {
+    readonly code: "CHARACTER_MISMATCH" | "CHARACTER_SELECTION_REQUIRED" | "MISSING_SCOPES";
+    readonly details: {
+        characterId?: number;
+        authenticatedCharacterId?: number;
+        missingScopes?: string[];
+    };
+    constructor(message: string, code: "CHARACTER_MISMATCH" | "CHARACTER_SELECTION_REQUIRED" | "MISSING_SCOPES", details?: {
+        characterId?: number;
+        authenticatedCharacterId?: number;
+        missingScopes?: string[];
+    });
 }
 export declare class StaticTokenProvider implements TokenProvider {
     private readonly token;
@@ -14,27 +28,35 @@ export declare class RefreshTokenProvider implements TokenProvider {
     private readonly clientSecret;
     private readonly fetchImplementation;
     private readonly onRefreshToken?;
+    private readonly verifyAccessToken?;
     private cached?;
     private currentRefreshToken;
-    constructor(clientId: string, refreshToken: string, clientSecret: string | undefined, fetchImplementation?: typeof fetch, onRefreshToken?: ((refreshToken: string) => Promise<void>) | undefined);
+    private pending;
+    constructor(clientId: string, refreshToken: string, clientSecret: string | undefined, fetchImplementation?: typeof fetch, onRefreshToken?: ((refreshToken: string) => Promise<void> | void) | undefined, verifyAccessToken?: ((token: string) => Promise<void>) | undefined);
     getAccessToken(): Promise<string>;
+    private refresh;
 }
 export declare class StoredCredentialTokenProvider implements TokenProvider {
     private readonly store;
     private readonly fetchImplementation;
-    private provider?;
-    constructor(store: CredentialStore, fetchImplementation?: typeof fetch);
-    getAccessToken(): Promise<string | undefined>;
+    private readonly verify;
+    private readonly providers;
+    constructor(store: CredentialStore, fetchImplementation?: typeof fetch, verify?: TokenVerifier);
+    getAccessToken(requiredScopes?: string[], characterId?: number): Promise<string | undefined>;
 }
 export declare class InteractiveSsoTokenProvider implements TokenProvider {
-    private readonly store;
+    readonly store: CredentialStore;
     private readonly clientId;
     private readonly scopes;
     private readonly loginImplementation;
+    private readonly redirectUri?;
     private readonly storedProvider;
-    private loginPromise?;
-    constructor(store: CredentialStore, clientId: string, scopes: string[], fetchImplementation?: typeof fetch, loginImplementation?: (options: SsoLoginOptions) => Promise<unknown>);
-    getAccessToken(): Promise<string>;
+    private loginTail;
+    constructor(store: CredentialStore, clientId: string, scopes: string[], fetchImplementation?: typeof fetch, loginImplementation?: (options: SsoLoginOptions) => Promise<unknown>, verify?: TokenVerifier, redirectUri?: string | undefined);
+    getAccessToken(requiredScopes?: string[], characterId?: number): Promise<string>;
+    authorizeCharacter(characterId: number): Promise<void>;
+    private login;
+    private enqueueLogin;
 }
 export declare function tokenProviderFromEnvironment(environment?: NodeJS.ProcessEnv, fetchImplementation?: typeof fetch, options?: {
     clientId?: string;

package/dist/auth.js

@@ -1,6 +1,16 @@
 import { CredentialStore, defaultCredentialPath, } from "./credential-store.js";
 import { loginWithEveSso } from "./sso.js";
+import { createTokenVerifier, } from "./token-identity.js";
 export const DEFAULT_EVE_CLIENT_ID = "6a65f1e650d240659dafbad29fb55e05";
+export class AuthenticationError extends Error {
+    code;
+    details;
+    constructor(message, code, details = {}) {
+        super(message);
+        this.code = code;
+        this.details = details;
+    }
+}
 export class StaticTokenProvider {
     token;
     constructor(token) {
@@ -15,18 +25,27 @@ export class RefreshTokenProvider {
     clientSecret;
     fetchImplementation;
     onRefreshToken;
+    verifyAccessToken;
     cached;
     currentRefreshToken;
-    constructor(clientId, refreshToken, clientSecret, fetchImplementation = fetch, onRefreshToken) {
+    pending;
+    constructor(clientId, refreshToken, clientSecret, fetchImplementation = fetch, onRefreshToken, verifyAccessToken) {
         this.clientId = clientId;
         this.clientSecret = clientSecret;
         this.fetchImplementation = fetchImplementation;
         this.onRefreshToken = onRefreshToken;
+        this.verifyAccessToken = verifyAccessToken;
         this.currentRefreshToken = refreshToken;
     }
     async getAccessToken() {
         if (this.cached && this.cached.expiresAt > Date.now() + 60_000)
             return this.cached.token;
+        this.pending ??= this.refresh().finally(() => {
+            this.pending = undefined;
+        });
+        return this.pending;
+    }
+    async refresh() {
         const body = new URLSearchParams({
             grant_type: "refresh_token",
             refresh_token: this.currentRefreshToken,
@@ -48,12 +67,18 @@ export class RefreshTokenProvider {
         if (!response.ok)
             throw new Error(`EVE SSO token refresh failed with HTTP ${response.status}`);
         const value = (await response.json());
-        if (!value.access_token || !Number.isFinite(value.expires_in))
+        if (typeof value.access_token !== "string" ||
+            !value.access_token ||
+            !Number.isFinite(value.expires_in) ||
+            value.expires_in <= 0 ||
+            (value.refresh_token !== undefined &&
+                (typeof value.refresh_token !== "string" || !value.refresh_token)))
             throw new Error("EVE SSO returned an invalid token response");
+        await this.verifyAccessToken?.(value.access_token);
         if (value.refresh_token &&
             value.refresh_token !== this.currentRefreshToken) {
-            this.currentRefreshToken = value.refresh_token;
             await this.onRefreshToken?.(value.refresh_token);
+            this.currentRefreshToken = value.refresh_token;
         }
         this.cached = {
             token: value.access_token,
@@ -65,22 +90,83 @@ export class RefreshTokenProvider {
 export class StoredCredentialTokenProvider {
     store;
     fetchImplementation;
-    provider;
-    constructor(store, fetchImplementation = fetch) {
+    verify;
+    providers = new Map();
+    constructor(store, fetchImplementation = fetch, verify = createTokenVerifier(fetchImplementation)) {
         this.store = store;
         this.fetchImplementation = fetchImplementation;
+        this.verify = verify;
     }
-    async getAccessToken() {
-        if (!this.provider) {
-            const credential = await this.store.read();
-            if (!credential)
-                return undefined;
-            this.provider = new RefreshTokenProvider(credential.clientId, credential.refreshToken, undefined, this.fetchImplementation, async (refreshToken) => {
-                const updated = { ...credential, refreshToken };
-                await this.store.write(updated);
+    async getAccessToken(requiredScopes = [], characterId) {
+        let file = await this.store.read();
+        if (file.legacyCredential &&
+            (characterId === undefined ||
+                !file.characters.some((entry) => entry.characterId === characterId))) {
+            await this.store.withRefreshLock("legacy", async () => {
+                const legacy = (await this.store.read()).legacyCredential;
+                if (!legacy)
+                    return;
+                let identity;
+                let refreshToken = legacy.refreshToken;
+                const provider = new RefreshTokenProvider(legacy.clientId, refreshToken, undefined, this.fetchImplementation, (replacement) => {
+                    refreshToken = replacement;
+                }, async (token) => {
+                    identity = await this.verify(token, legacy.clientId);
+                });
+                await provider.getAccessToken();
+                if (!identity)
+                    throw new Error("EVE SSO did not return a verified character identity.");
+                await this.store.migrateLegacy(legacy, {
+                    ...legacy,
+                    ...identity,
+                    refreshToken,
+                });
             });
+            file = await this.store.read();
+        }
+        const characters = file.characters;
+        const selected = characterId ??
+            file.defaultCharacterId ??
+            (characters.length === 1 ? characters[0]?.characterId : undefined);
+        if (selected === undefined) {
+            if (characters.length > 1)
+                throw new AuthenticationError("Choose an authorized character for this protected operation using select_eve_character.", "CHARACTER_SELECTION_REQUIRED");
+            return undefined;
         }
-        return this.provider.getAccessToken();
+        return this.store.withRefreshLock(selected, async () => {
+            const credential = (await this.store.read()).characters.find((entry) => entry.characterId === selected);
+            if (!credential) {
+                this.providers.delete(selected);
+                return undefined;
+            }
+            const missingScopes = requiredScopes.filter((scope) => !credential.scopes.includes(scope));
+            if (missingScopes.length)
+                throw new AuthenticationError(`Character ${selected} lacks required scopes; use authorize_eve_character to grant access.`, "MISSING_SCOPES", { characterId: selected, missingScopes });
+            let cached = this.providers.get(selected);
+            if (cached?.credential.refreshToken !== credential.refreshToken ||
+                cached.credential.clientId !== credential.clientId ||
+                cached.credential.createdAt !== credential.createdAt ||
+                JSON.stringify(cached.credential.scopes) !==
+                    JSON.stringify(credential.scopes)) {
+                const entry = {
+                    credential,
+                    provider: new RefreshTokenProvider(credential.clientId, credential.refreshToken, undefined, this.fetchImplementation, async (refreshToken) => {
+                        await this.store.rotate(entry.credential, refreshToken);
+                        entry.credential = { ...entry.credential, refreshToken };
+                    }, async (token) => {
+                        const identity = await this.verify(token, credential.clientId);
+                        if (identity.characterId !== selected)
+                            throw new AuthenticationError(`The saved credential for character ${selected} authenticated character ${identity.characterId}; authorize the requested character again.`, "CHARACTER_MISMATCH", {
+                                characterId: selected,
+                                authenticatedCharacterId: identity.characterId,
+                            });
+                    }),
+                };
+                cached = entry;
+                this.providers.set(selected, cached);
+            }
+            return cached.provider.getAccessToken();
+        });
     }
 }
 export class InteractiveSsoTokenProvider {
@@ -88,40 +174,68 @@ export class InteractiveSsoTokenProvider {
     clientId;
     scopes;
     loginImplementation;
+    redirectUri;
     storedProvider;
-    loginPromise;
-    constructor(store, clientId, scopes, fetchImplementation = fetch, loginImplementation = loginWithEveSso) {
+    loginTail = Promise.resolve();
+    constructor(store, clientId, scopes, fetchImplementation = fetch, loginImplementation = loginWithEveSso, verify = createTokenVerifier(fetchImplementation), redirectUri) {
         this.store = store;
         this.clientId = clientId;
         this.scopes = scopes;
         this.loginImplementation = loginImplementation;
-        this.storedProvider = new StoredCredentialTokenProvider(store, fetchImplementation);
+        this.redirectUri = redirectUri;
+        this.storedProvider = new StoredCredentialTokenProvider(store, fetchImplementation, verify);
     }
-    async getAccessToken() {
-        const existing = await this.storedProvider.getAccessToken();
+    async getAccessToken(requiredScopes = [], characterId) {
+        const existing = await this.storedProvider.getAccessToken(requiredScopes, characterId);
         if (existing)
             return existing;
-        this.loginPromise ??= this.loginImplementation({
-            clientId: this.clientId,
-            scopes: this.scopes,
-            store: this.store,
-        }).then(() => undefined);
-        await this.loginPromise;
-        const token = await this.storedProvider.getAccessToken();
+        await this.enqueueLogin(async () => {
+            if (await this.storedProvider.getAccessToken(requiredScopes, characterId))
+                return;
+            await this.login(characterId);
+        });
+        const token = await this.storedProvider.getAccessToken(requiredScopes, characterId);
         if (!token)
             throw new Error("EVE SSO completed without storing a credential");
         return token;
     }
+    async authorizeCharacter(characterId) {
+        await this.enqueueLogin(async () => {
+            await this.login(characterId);
+        });
+    }
+    async login(characterId) {
+        await this.loginImplementation({
+            clientId: this.clientId,
+            scopes: this.scopes,
+            store: this.store,
+            ...(characterId === undefined
+                ? {}
+                : { expectedCharacterId: characterId }),
+            ...(this.redirectUri === undefined
+                ? {}
+                : { redirectUri: this.redirectUri }),
+        });
+    }
+    async enqueueLogin(action) {
+        const pending = this.loginTail.then(action);
+        this.loginTail = pending.catch(() => undefined);
+        await pending;
+    }
 }
 export function tokenProviderFromEnvironment(environment = process.env, fetchImplementation = fetch, options = {}) {
     if (environment.EVE_ACCESS_TOKEN)
         return new StaticTokenProvider(environment.EVE_ACCESS_TOKEN);
     if (environment.EVE_CLIENT_ID && environment.EVE_REFRESH_TOKEN) {
-        return new RefreshTokenProvider(environment.EVE_CLIENT_ID, environment.EVE_REFRESH_TOKEN, environment.EVE_CLIENT_SECRET, fetchImplementation);
+        const clientId = environment.EVE_CLIENT_ID;
+        const verify = createTokenVerifier(fetchImplementation);
+        return new RefreshTokenProvider(environment.EVE_CLIENT_ID, environment.EVE_REFRESH_TOKEN, environment.EVE_CLIENT_SECRET, fetchImplementation, undefined, async (token) => {
+            await verify(token, clientId);
+        });
     }
     const store = new CredentialStore(defaultCredentialPath(environment));
     if (options.interactive !== false && options.scopes?.length) {
-        return new InteractiveSsoTokenProvider(store, environment.EVE_CLIENT_ID ?? options.clientId ?? DEFAULT_EVE_CLIENT_ID, options.scopes, fetchImplementation);
+        return new InteractiveSsoTokenProvider(store, environment.EVE_CLIENT_ID ?? options.clientId ?? DEFAULT_EVE_CLIENT_ID, options.scopes, fetchImplementation, loginWithEveSso, createTokenVerifier(fetchImplementation), environment.EVE_SSO_REDIRECT_URI);
     }
     return new StoredCredentialTokenProvider(store, fetchImplementation);
 }

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,qBAAqB,GAEtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAwB,MAAM,UAAU,CAAC;AAEjE,MAAM,CAAC,MAAM,qBAAqB,GAAG,kCAAkC,CAAC;AAMxE,MAAM,OAAO,mBAAmB;IACD;IAA7B,YAA6B,KAAyB;QAAzB,UAAK,GAAL,KAAK,CAAoB;IAAG,CAAC;IAE1D,cAAc;QACZ,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;CACF;AAQD,MAAM,OAAO,oBAAoB;IAKZ;IAEA;IACA;IACA;IARX,MAAM,CAAwC;IAC9C,mBAAmB,CAAS;IAEpC,YACmB,QAAgB,EACjC,YAAoB,EACH,YAAgC,EAChC,sBAAoC,KAAK,EACzC,cAAwD;QAJxD,aAAQ,GAAR,QAAQ,CAAQ;QAEhB,iBAAY,GAAZ,YAAY,CAAoB;QAChC,wBAAmB,GAAnB,mBAAmB,CAAsB;QACzC,mBAAc,GAAd,cAAc,CAA0C;QAEzE,IAAI,CAAC,mBAAmB,GAAG,YAAY,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM;YAC5D,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAE3B,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,IAAI,CAAC,mBAAmB;SACxC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;YAC1B,cAAc,EAAE,mCAAmC;SACpD,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CACT,eAAe,EACf,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CACnF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAC7C,4CAA4C,EAC5C;YACE,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI;SACL,CACF,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE;YACd,MAAM,IAAI,KAAK,CACb,0CAA0C,QAAQ,CAAC,MAAM,EAAE,CAC5D,CAAC;QACJ,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAoB,CAAC;QACzD,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,IACE,KAAK,CAAC,aAAa;YACnB,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,mBAAmB,EAChD,CAAC;YACD,IAAI,CAAC,mBAAmB,GAAG,KAAK,CAAC,aAAa,CAAC;YAC/C,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,MAAM,GAAG;YACZ,KAAK,EAAE,KAAK,CAAC,YAAY;YACzB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI;SAChD,CAAC;QACF,OAAO,KAAK,CAAC,YAAY,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,OAAO,6BAA6B;IAIrB;IACA;IAJX,QAAQ,CAAwB;IAExC,YACmB,KAAsB,EACtB,sBAAoC,KAAK;QADzC,UAAK,GAAL,KAAK,CAAiB;QACtB,wBAAmB,GAAnB,mBAAmB,CAAsB;IACzD,CAAC;IAEJ,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAC3C,IAAI,CAAC,UAAU;gBAAE,OAAO,SAAS,CAAC;YAClC,IAAI,CAAC,QAAQ,GAAG,IAAI,oBAAoB,CACtC,UAAU,CAAC,QAAQ,EACnB,UAAU,CAAC,YAAY,EACvB,SAAS,EACT,IAAI,CAAC,mBAAmB,EACxB,KAAK,EAAE,YAAY,EAAE,EAAE;gBACrB,MAAM,OAAO,GAAqB,EAAE,GAAG,UAAU,EAAE,YAAY,EAAE,CAAC;gBAClE,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAClC,CAAC,CACF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,2BAA2B;IAKnB;IACA;IACA;IAEA;IARF,cAAc,CAAgC;IACvD,YAAY,CAAiB;IAErC,YACmB,KAAsB,EACtB,QAAgB,EAChB,MAAgB,EACjC,sBAAoC,KAAK,EACxB,sBAEO,eAAe;QANtB,UAAK,GAAL,KAAK,CAAiB;QACtB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAU;QAEhB,wBAAmB,GAAnB,mBAAmB,CAEG;QAEvC,IAAI,CAAC,cAAc,GAAG,IAAI,6BAA6B,CACrD,KAAK,EACL,mBAAmB,CACpB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,EAAE,CAAC;QAC5D,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,mBAAmB,CAAC;YAC7C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzB,MAAM,IAAI,CAAC,YAAY,CAAC;QACxB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,EAAE,CAAC;QACzD,IAAI,CAAC,KAAK;YACR,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,MAAM,UAAU,4BAA4B,CAC1C,cAAiC,OAAO,CAAC,GAAG,EAC5C,sBAAoC,KAAK,EACzC,UAA2E,EAAE;IAE7E,IAAI,WAAW,CAAC,gBAAgB;QAC9B,OAAO,IAAI,mBAAmB,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;IAC/D,IAAI,WAAW,CAAC,aAAa,IAAI,WAAW,CAAC,iBAAiB,EAAE,CAAC;QAC/D,OAAO,IAAI,oBAAoB,CAC7B,WAAW,CAAC,aAAa,EACzB,WAAW,CAAC,iBAAiB,EAC7B,WAAW,CAAC,iBAAiB,EAC7B,mBAAmB,CACpB,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAC5D,OAAO,IAAI,2BAA2B,CACpC,KAAK,EACL,WAAW,CAAC,aAAa,IAAI,OAAO,CAAC,QAAQ,IAAI,qBAAqB,EACtE,OAAO,CAAC,MAAM,EACd,mBAAmB,CACpB,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,6BAA6B,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,cAAwB;IAExB,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACpB,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAClE,CAAC;QACF,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,qBAAqB,GAEtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAwB,MAAM,UAAU,CAAC;AACjE,OAAO,EACL,mBAAmB,GAGpB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,CAAC,MAAM,qBAAqB,GAAG,kCAAkC,CAAC;AASxE,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAGjC;IAEA;IAJX,YACE,OAAe,EACN,IACiE,EACjE,UAIL,EAAE;QAEN,KAAK,CAAC,OAAO,CAAC,CAAC;QARN,SAAI,GAAJ,IAAI,CAC6D;QACjE,YAAO,GAAP,OAAO,CAIV;IAGR,CAAC;CACF;AAED,MAAM,OAAO,mBAAmB;IACD;IAA7B,YAA6B,KAAyB;QAAzB,UAAK,GAAL,KAAK,CAAoB;IAAG,CAAC;IAE1D,cAAc;QACZ,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;CACF;AAQD,MAAM,OAAO,oBAAoB;IAMZ;IAEA;IACA;IACA;IAGA;IAZX,MAAM,CAAwC;IAC9C,mBAAmB,CAAS;IAC5B,OAAO,CAA8B;IAE7C,YACmB,QAAgB,EACjC,YAAoB,EACH,YAAgC,EAChC,sBAAoC,KAAK,EACzC,cAEQ,EACR,iBAAoD;QAPpD,aAAQ,GAAR,QAAQ,CAAQ;QAEhB,iBAAY,GAAZ,YAAY,CAAoB;QAChC,wBAAmB,GAAnB,mBAAmB,CAAsB;QACzC,mBAAc,GAAd,cAAc,CAEN;QACR,sBAAiB,GAAjB,iBAAiB,CAAmC;QAErE,IAAI,CAAC,mBAAmB,GAAG,YAAY,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM;YAC5D,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAE3B,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAC3C,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,IAAI,CAAC,mBAAmB;SACxC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;YAC1B,cAAc,EAAE,mCAAmC;SACpD,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CACT,eAAe,EACf,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CACnF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAC7C,4CAA4C,EAC5C;YACE,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI;SACL,CACF,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE;YACd,MAAM,IAAI,KAAK,CACb,0CAA0C,QAAQ,CAAC,MAAM,EAAE,CAC5D,CAAC;QACJ,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAoB,CAAC;QACzD,IACE,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;YACtC,CAAC,KAAK,CAAC,YAAY;YACnB,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;YAClC,KAAK,CAAC,UAAU,IAAI,CAAC;YACrB,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS;gBAChC,CAAC,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YAEpE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACnD,IACE,KAAK,CAAC,aAAa;YACnB,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,mBAAmB,EAChD,CAAC;YACD,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YACjD,IAAI,CAAC,mBAAmB,GAAG,KAAK,CAAC,aAAa,CAAC;QACjD,CAAC;QACD,IAAI,CAAC,MAAM,GAAG;YACZ,KAAK,EAAE,KAAK,CAAC,YAAY;YACzB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI;SAChD,CAAC;QACF,OAAO,KAAK,CAAC,YAAY,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,OAAO,6BAA6B;IAOrB;IACA;IACA;IARF,SAAS,GAAG,IAAI,GAAG,EAGjC,CAAC;IAEJ,YACmB,KAAsB,EACtB,sBAAoC,KAAK,EACzC,SAAwB,mBAAmB,CAC1D,mBAAmB,CACpB;QAJgB,UAAK,GAAL,KAAK,CAAiB;QACtB,wBAAmB,GAAnB,mBAAmB,CAAsB;QACzC,WAAM,GAAN,MAAM,CAEtB;IACA,CAAC;IAEJ,KAAK,CAAC,cAAc,CAClB,iBAA2B,EAAE,EAC7B,WAAoB;QAEpB,IAAI,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACnC,IACE,IAAI,CAAC,gBAAgB;YACrB,CAAC,WAAW,KAAK,SAAS;gBACxB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC,EACtE,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;gBACpD,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,gBAAgB,CAAC;gBAC1D,IAAI,CAAC,MAAM;oBAAE,OAAO;gBACpB,IAAI,QAAmC,CAAC;gBACxC,IAAI,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;gBACvC,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CACvC,MAAM,CAAC,QAAQ,EACf,YAAY,EACZ,SAAS,EACT,IAAI,CAAC,mBAAmB,EACxB,CAAC,WAAW,EAAE,EAAE;oBACd,YAAY,GAAG,WAAW,CAAC;gBAC7B,CAAC,EACD,KAAK,EAAE,KAAK,EAAE,EAAE;oBACd,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACvD,CAAC,CACF,CAAC;gBACF,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAC;gBAChC,IAAI,CAAC,QAAQ;oBACX,MAAM,IAAI,KAAK,CACb,uDAAuD,CACxD,CAAC;gBACJ,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE;oBACrC,GAAG,MAAM;oBACT,GAAG,QAAQ;oBACX,YAAY;iBACb,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACnC,MAAM,QAAQ,GACZ,WAAW;YACX,IAAI,CAAC,kBAAkB;YACvB,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;gBACvB,MAAM,IAAI,mBAAmB,CAC3B,yFAAyF,EACzF,8BAA8B,CAC/B,CAAC;YACJ,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YACrD,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAC1D,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,QAAQ,CAC1C,CAAC;YACF,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAChC,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,CACzC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC9C,CAAC;YACF,IAAI,aAAa,CAAC,MAAM;gBACtB,MAAM,IAAI,mBAAmB,CAC3B,aAAa,QAAQ,sEAAsE,EAC3F,gBAAgB,EAChB,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,CACzC,CAAC;YACJ,IAAI,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC1C,IACE,MAAM,EAAE,UAAU,CAAC,YAAY,KAAK,UAAU,CAAC,YAAY;gBAC3D,MAAM,CAAC,UAAU,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ;gBAClD,MAAM,CAAC,UAAU,CAAC,SAAS,KAAK,UAAU,CAAC,SAAS;gBACpD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;oBACtC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,EACnC,CAAC;gBACD,MAAM,KAAK,GAAG;oBACZ,UAAU;oBACV,QAAQ,EAAE,IAAI,oBAAoB,CAChC,UAAU,CAAC,QAAQ,EACnB,UAAU,CAAC,YAAY,EACvB,SAAS,EACT,IAAI,CAAC,mBAAmB,EACxB,KAAK,EAAE,YAAY,EAAE,EAAE;wBACrB,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;wBACxD,KAAK,CAAC,UAAU,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,EAAE,YAAY,EAAE,CAAC;oBAC3D,CAAC,EACD,KAAK,EAAE,KAAK,EAAE,EAAE;wBACd,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;wBAC/D,IAAI,QAAQ,CAAC,WAAW,KAAK,QAAQ;4BACnC,MAAM,IAAI,mBAAmB,CAC3B,sCAAsC,QAAQ,4BAA4B,QAAQ,CAAC,WAAW,4CAA4C,EAC1I,oBAAoB,EACpB;gCACE,WAAW,EAAE,QAAQ;gCACrB,wBAAwB,EAAE,QAAQ,CAAC,WAAW;6BAC/C,CACF,CAAC;oBACN,CAAC,CACF;iBACF,CAAC;gBACF,MAAM,GAAG,KAAK,CAAC;gBACf,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACvC,CAAC;YACD,OAAO,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,OAAO,2BAA2B;IAK3B;IACQ;IACA;IAEA;IAIA;IAZF,cAAc,CAAgC;IACvD,SAAS,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAExD,YACW,KAAsB,EACd,QAAgB,EAChB,MAAgB,EACjC,sBAAoC,KAAK,EACxB,sBAEO,eAAe,EACvC,SAAwB,mBAAmB,CAAC,mBAAmB,CAAC,EAC/C,WAAoB;QAR5B,UAAK,GAAL,KAAK,CAAiB;QACd,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAU;QAEhB,wBAAmB,GAAnB,mBAAmB,CAEG;QAEtB,gBAAW,GAAX,WAAW,CAAS;QAErC,IAAI,CAAC,cAAc,GAAG,IAAI,6BAA6B,CACrD,KAAK,EACL,mBAAmB,EACnB,MAAM,CACP,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,iBAA2B,EAAE,EAC7B,WAAoB;QAEpB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,CACvD,cAAc,EACd,WAAW,CACZ,CAAC;QACF,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,EAAE;YACjC,IAAI,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,cAAc,EAAE,WAAW,CAAC;gBACvE,OAAO;YACT,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,CACpD,cAAc,EACd,WAAW,CACZ,CAAC;QACF,IAAI,CAAC,KAAK;YACR,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,WAAmB;QAC1C,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,EAAE;YACjC,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,WAAoB;QACtC,MAAM,IAAI,CAAC,mBAAmB,CAAC;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,GAAG,CAAC,WAAW,KAAK,SAAS;gBAC3B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,mBAAmB,EAAE,WAAW,EAAE,CAAC;YACzC,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS;gBAChC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,MAA2B;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAChD,MAAM,OAAO,CAAC;IAChB,CAAC;CACF;AAED,MAAM,UAAU,4BAA4B,CAC1C,cAAiC,OAAO,CAAC,GAAG,EAC5C,sBAAoC,KAAK,EACzC,UAA2E,EAAE;IAE7E,IAAI,WAAW,CAAC,gBAAgB;QAC9B,OAAO,IAAI,mBAAmB,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;IAC/D,IAAI,WAAW,CAAC,aAAa,IAAI,WAAW,CAAC,iBAAiB,EAAE,CAAC;QAC/D,MAAM,QAAQ,GAAG,WAAW,CAAC,aAAa,CAAC;QAC3C,MAAM,MAAM,GAAG,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QACxD,OAAO,IAAI,oBAAoB,CAC7B,WAAW,CAAC,aAAa,EACzB,WAAW,CAAC,iBAAiB,EAC7B,WAAW,CAAC,iBAAiB,EAC7B,mBAAmB,EACnB,SAAS,EACT,KAAK,EAAE,KAAK,EAAE,EAAE;YACd,MAAM,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAChC,CAAC,CACF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAC5D,OAAO,IAAI,2BAA2B,CACpC,KAAK,EACL,WAAW,CAAC,aAAa,IAAI,OAAO,CAAC,QAAQ,IAAI,qBAAqB,EACtE,OAAO,CAAC,MAAM,EACd,mBAAmB,EACnB,eAAe,EACf,mBAAmB,CAAC,mBAAmB,CAAC,EACxC,WAAW,CAAC,oBAAoB,CACjC,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,6BAA6B,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,cAAwB;IAExB,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACpB,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAClE,CAAC;QACF,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/character-authentication.d.ts

@@ -0,0 +1,38 @@
+import type { InteractiveSsoTokenProvider } from "./auth.js";
+import type { CredentialStore } from "./credential-store.js";
+/** Only non-secret character metadata crosses the MCP boundary. */
+export declare class CharacterAuthentication {
+    private readonly store;
+    private readonly interactive?;
+    constructor(store: CredentialStore, interactive?: InteractiveSsoTokenProvider | undefined);
+    list(): Promise<{
+        characters: {
+            characterId: number;
+            characterName: string;
+            scopes: string[];
+        }[];
+        defaultCharacterId: number | null;
+        legacyCredentialPendingMigration: boolean;
+        browserAuthorizationAvailable: boolean;
+    }>;
+    authorize(characterId: number): Promise<{
+        characters: {
+            characterId: number;
+            characterName: string;
+            scopes: string[];
+        }[];
+        defaultCharacterId: number | null;
+        legacyCredentialPendingMigration: boolean;
+        browserAuthorizationAvailable: boolean;
+    }>;
+    select(characterId: number): Promise<{
+        characters: {
+            characterId: number;
+            characterName: string;
+            scopes: string[];
+        }[];
+        defaultCharacterId: number | null;
+        legacyCredentialPendingMigration: boolean;
+        browserAuthorizationAvailable: boolean;
+    }>;
+}

package/dist/character-authentication.js

@@ -0,0 +1,35 @@
+/** Only non-secret character metadata crosses the MCP boundary. */
+export class CharacterAuthentication {
+    store;
+    interactive;
+    constructor(store, interactive) {
+        this.store = store;
+        this.interactive = interactive;
+    }
+    async list() {
+        const file = await this.store.read();
+        return {
+            characters: file.characters.map(({ characterId, characterName, scopes }) => ({
+                characterId,
+                characterName,
+                scopes,
+            })),
+            defaultCharacterId: file.defaultCharacterId ?? null,
+            legacyCredentialPendingMigration: !!file.legacyCredential,
+            browserAuthorizationAvailable: !!this.interactive,
+        };
+    }
+    async authorize(characterId) {
+        if (!this.interactive)
+            throw new Error("Browser authorization is unavailable while environment token overrides are configured.");
+        await this.interactive.authorizeCharacter(characterId);
+        return this.list();
+    }
+    async select(characterId) {
+        if (!this.interactive)
+            throw new Error("Character selection is unavailable while environment token overrides are configured.");
+        await this.store.select(characterId);
+        return this.list();
+    }
+}
+//# sourceMappingURL=character-authentication.js.map

package/dist/character-authentication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"character-authentication.js","sourceRoot":"","sources":["../src/character-authentication.ts"],"names":[],"mappings":"AAGA,mEAAmE;AACnE,MAAM,OAAO,uBAAuB;IAEf;IACA;IAFnB,YACmB,KAAsB,EACtB,WAAyC;QADzC,UAAK,GAAL,KAAK,CAAiB;QACtB,gBAAW,GAAX,WAAW,CAA8B;IACzD,CAAC;IAEJ,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACrC,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAC7B,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC3C,WAAW;gBACX,aAAa;gBACb,MAAM;aACP,CAAC,CACH;YACD,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,IAAI,IAAI;YACnD,gCAAgC,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB;YACzD,6BAA6B,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW;SAClD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,WAAmB;QACjC,IAAI,CAAC,IAAI,CAAC,WAAW;YACnB,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAC;QACJ,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB;QAC9B,IAAI,CAAC,IAAI,CAAC,WAAW;YACnB,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;QACJ,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;CACF"}

package/dist/character-context.js

@@ -36,7 +36,7 @@ export async function getCharacterContext(client, catalog, input, options = {})
     let authorizationError;
     if (requiredScopes.length > 0) {
         try {
-            authorization = await client.authorize(requiredScopes);
+            authorization = await client.authorize(requiredScopes, input.characterId);
         }
         catch (error) {
             authorizationError = error;

package/dist/character-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"character-context.js","sourceRoot":"","sources":["../src/character-context.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,cAAc,GAGf,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,OAAO,EAAE,0BAA0B;IACnC,QAAQ,EAAE,kCAAkC;IAC5C,IAAI,EAAE,8BAA8B;IACpC,MAAM,EAAE,gCAAgC;IACxC,UAAU,EAAE,oCAAoC;IAChD,MAAM,EAAE,gCAAgC;CAChC,CAAC;AAIX,MAAM,aAAa,GACjB,4JAA4J,CAAC;AAE/J,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,IAAI,eAAe,CACxB,yCAAyC,KAAK,8BAA8B,EAC5E,SAAS,EACT,SAAS,EACT,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,KAAK,EAAE,CAC7C,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAiB,EACjB,OAAyB,EACzB,KAA4D,EAC5D,UAAuC,EAAE;IAEzC,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,SAAS,CAAC;IAC3D,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CACjC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,YAAY,CAC9D;QACC,CAAC,CAAC;YACE,aAAa;YACb,sHAAsH;SACvH;QACH,CAAC,CAAC;YACE,sHAAsH;SACvH,CAAC;IACN,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAChD,OAAO;QACP,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;KACpD,CAAC,CAAC,CAAC;IACJ,MAAM,cAAc,GAAG;QACrB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;KAC1E,CAAC,IAAI,EAAE,CAAC;IACT,IAAI,aAA2C,CAAC;IAChD,IAAI,kBAA2B,CAAC;IAChC,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kBAAkB,GAAG,KAAK,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC9C,IAAI,SAAS,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,kBAAkB,EAAE,CAAC;YAC9D,QAAQ,CAAC,OAAO,CAAC,GAAG;gBAClB,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,cAAc,CAAC,kBAAkB,CAAC;aAC1C,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC;gBACE,WAAW,EAAE,SAAS,CAAC,WAAW;gBAClC,IAAI,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE;aAC1C,EACD,SAAS,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAChE,CAAC;YACF,MAAM,aAAa,GAAG;gBACpB,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC;aACjC,CAAC;YACF,MAAM,SAAS,GAAG;gBAChB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,iBAAiB,EAAE,KAAK,CAAC,QAAQ;gBACjC,MAAM,EAAE,UAAU;gBAClB,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE;gBACnD,MAAM,EAAE,KAAK;gBACb,OAAO;aACR,CAAC;YACF,IAAI,eAAe,CAAC,SAAS,CAAC,GAAG,cAAc,EAAE,CAAC;gBAChD,QAAQ,CAAC,OAAO,CAAC,GAAG;oBAClB,MAAM,EAAE,OAAO;oBACf,KAAK,EAAE,cAAc,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;iBAC1D,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC;gBAClC,SAAS,IAAI,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,CAAC;QACzB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,KAAK,CAAC,QAAQ;QACjC,MAAM,EACJ,SAAS,KAAK,QAAQ,CAAC,MAAM;YAC3B,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,SAAS,KAAK,CAAC;gBACf,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,SAAS;QACjB,QAAQ;QACR,MAAM,EAAE,KAAK;QACb,OAAO;KACR,CAAC,CAAC;IACH,IAAI,MAAM,GAAG,WAAW,EAAE,CAAC;IAC3B,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACpD,IAAI,eAAe,CAAC,MAAM,CAAC,IAAI,cAAc;YAAE,MAAM;QACrD,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxC,IACE,OAAO,aAAa,KAAK,QAAQ;YACjC,aAAa,KAAK,IAAI;YACtB,QAAQ,IAAI,aAAa;YACzB,aAAa,CAAC,MAAM,KAAK,IAAI,EAC7B,CAAC;YACD,QAAQ,CAAC,OAAO,CAAC,GAAG;gBAClB,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,cAAc,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;aAC1D,CAAC;YACF,SAAS,IAAI,CAAC,CAAC;YACf,MAAM,GAAG,WAAW,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"character-context.js","sourceRoot":"","sources":["../src/character-context.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,cAAc,GAGf,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,OAAO,EAAE,0BAA0B;IACnC,QAAQ,EAAE,kCAAkC;IAC5C,IAAI,EAAE,8BAA8B;IACpC,MAAM,EAAE,gCAAgC;IACxC,UAAU,EAAE,oCAAoC;IAChD,MAAM,EAAE,gCAAgC;CAChC,CAAC;AAIX,MAAM,aAAa,GACjB,4JAA4J,CAAC;AAE/J,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,IAAI,eAAe,CACxB,yCAAyC,KAAK,8BAA8B,EAC5E,SAAS,EACT,SAAS,EACT,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,KAAK,EAAE,CAC7C,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAiB,EACjB,OAAyB,EACzB,KAA4D,EAC5D,UAAuC,EAAE;IAEzC,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,SAAS,CAAC;IAC3D,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CACjC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,YAAY,CAC9D;QACC,CAAC,CAAC;YACE,aAAa;YACb,sHAAsH;SACvH;QACH,CAAC,CAAC;YACE,sHAAsH;SACvH,CAAC;IACN,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAChD,OAAO;QACP,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;KACpD,CAAC,CAAC,CAAC;IACJ,MAAM,cAAc,GAAG;QACrB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;KAC1E,CAAC,IAAI,EAAE,CAAC;IACT,IAAI,aAA2C,CAAC;IAChD,IAAI,kBAA2B,CAAC;IAChC,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kBAAkB,GAAG,KAAK,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC9C,IAAI,SAAS,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,kBAAkB,EAAE,CAAC;YAC9D,QAAQ,CAAC,OAAO,CAAC,GAAG;gBAClB,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,cAAc,CAAC,kBAAkB,CAAC;aAC1C,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC;gBACE,WAAW,EAAE,SAAS,CAAC,WAAW;gBAClC,IAAI,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE;aAC1C,EACD,SAAS,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAChE,CAAC;YACF,MAAM,aAAa,GAAG;gBACpB,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC;aACjC,CAAC;YACF,MAAM,SAAS,GAAG;gBAChB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,iBAAiB,EAAE,KAAK,CAAC,QAAQ;gBACjC,MAAM,EAAE,UAAU;gBAClB,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE;gBACnD,MAAM,EAAE,KAAK;gBACb,OAAO;aACR,CAAC;YACF,IAAI,eAAe,CAAC,SAAS,CAAC,GAAG,cAAc,EAAE,CAAC;gBAChD,QAAQ,CAAC,OAAO,CAAC,GAAG;oBAClB,MAAM,EAAE,OAAO;oBACf,KAAK,EAAE,cAAc,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;iBAC1D,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC;gBAClC,SAAS,IAAI,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,CAAC;QACzB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,KAAK,CAAC,QAAQ;QACjC,MAAM,EACJ,SAAS,KAAK,QAAQ,CAAC,MAAM;YAC3B,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,SAAS,KAAK,CAAC;gBACf,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,SAAS;QACjB,QAAQ;QACR,MAAM,EAAE,KAAK;QACb,OAAO;KACR,CAAC,CAAC;IACH,IAAI,MAAM,GAAG,WAAW,EAAE,CAAC;IAC3B,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACpD,IAAI,eAAe,CAAC,MAAM,CAAC,IAAI,cAAc;YAAE,MAAM;QACrD,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxC,IACE,OAAO,aAAa,KAAK,QAAQ;YACjC,aAAa,KAAK,IAAI;YACtB,QAAQ,IAAI,aAAa;YACzB,aAAa,CAAC,MAAM,KAAK,IAAI,EAC7B,CAAC;YACD,QAAQ,CAAC,OAAO,CAAC,GAAG;gBAClB,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,cAAc,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;aAC1D,CAAC;YACF,SAAS,IAAI,CAAC,CAAC;YACf,MAAM,GAAG,WAAW,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}