rush-ai 0.18.0 → 0.19.0

package/dist/chunk-OIKYNVKO.js

@@ -0,0 +1,291 @@
+#!/usr/bin/env node
+
+// src/util/config.ts
+import { homedir } from "os";
+import { resolve } from "path";
+import Conf from "conf";
+var AUTH_CONFIG_DIR = resolve(homedir(), ".rush");
+var DEFAULT_API = "https://rush.zhenguanyu.com";
+var AUTH_DEFAULTS = {
+  token: null,
+  expiresAt: null,
+  refreshToken: null,
+  method: null,
+  tokenId: null,
+  sourceUrl: null
+};
+var GLOBAL_DEFAULTS = {
+  currentTeam: null,
+  api: DEFAULT_API,
+  collectMetrics: true
+};
+function isEmptyAuthEntry(entry) {
+  if (!entry || typeof entry !== "object") return false;
+  const auth = entry;
+  return !auth.token && auth.expiresAt == null && !auth.refreshToken && auth.method == null && !auth.tokenId && !auth.sourceUrl;
+}
+var globalStore = new Conf({
+  projectName: "rush-ai",
+  cwd: AUTH_CONFIG_DIR,
+  configName: "config",
+  defaults: {}
+});
+var authStore = new Conf({
+  projectName: "rush-ai",
+  cwd: AUTH_CONFIG_DIR,
+  configName: "auth",
+  defaults: {}
+});
+function migrateGlobalStoreIfNeeded() {
+  const version = globalStore.get("_version");
+  if (version === 2) return;
+  const hasOldFormat = globalStore.has("api") && !globalStore.has("profiles");
+  const isEmpty = globalStore.size === 0;
+  if (hasOldFormat) {
+    const oldConfig = {
+      currentTeam: globalStore.get("currentTeam") ?? null,
+      api: globalStore.get("api") ?? DEFAULT_API,
+      collectMetrics: globalStore.get("collectMetrics") ?? true
+    };
+    globalStore.clear();
+    globalStore.set("_version", 2);
+    globalStore.set("activeProfile", "default");
+    globalStore.set("profiles", { default: oldConfig });
+  } else if (isEmpty || !globalStore.has("profiles")) {
+    globalStore.set("_version", 2);
+    if (!globalStore.has("activeProfile")) {
+      globalStore.set("activeProfile", "default");
+    }
+    if (!globalStore.has("profiles")) {
+      globalStore.set("profiles", { default: { ...GLOBAL_DEFAULTS } });
+    }
+  }
+}
+function migrateAuthStoreIfNeeded() {
+  const version = authStore.get("_version");
+  if (version === 3) {
+    pruneEmptyAuthEntries();
+    return;
+  }
+  const hasOldFormat = authStore.has("token") || authStore.has("method");
+  const isEmpty = authStore.size === 0;
+  if (hasOldFormat) {
+    const oldAuth = {
+      token: authStore.get("token") ?? null,
+      expiresAt: authStore.get("expiresAt") ?? null,
+      refreshToken: authStore.get("refreshToken") ?? null,
+      method: authStore.get("method") ?? null,
+      tokenId: authStore.get("tokenId") ?? null,
+      sourceUrl: null
+    };
+    authStore.clear();
+    authStore.set("_version", 3);
+    if (!isEmptyAuthEntry(oldAuth)) {
+      authStore.set("default", oldAuth);
+    }
+    return;
+  }
+  if (isEmpty) {
+    authStore.set("_version", 3);
+    return;
+  }
+  if (version === 2) {
+    for (const key of Object.keys(authStore.store)) {
+      if (key === "_version") continue;
+      const entry = authStore.get(key);
+      if (!entry || typeof entry !== "object") continue;
+      const asAuth = entry;
+      if (!("sourceUrl" in asAuth)) {
+        authStore.set(key, { ...asAuth, sourceUrl: null });
+      }
+    }
+    authStore.set("_version", 3);
+    pruneEmptyAuthEntries();
+  }
+}
+function pruneEmptyAuthEntries() {
+  for (const key of Object.keys(authStore.store)) {
+    if (key === "_version") continue;
+    if (isEmptyAuthEntry(authStore.get(key))) {
+      authStore.delete(key);
+    }
+  }
+}
+migrateGlobalStoreIfNeeded();
+migrateAuthStoreIfNeeded();
+function getActiveProfile() {
+  return process.env.RUSH_PROFILE ?? globalStore.get("activeProfile") ?? "default";
+}
+function setActiveProfile(name) {
+  const profiles = globalStore.get("profiles") ?? {};
+  if (!profiles[name]) {
+    throw new Error(
+      `Profile '${name}' does not exist. Available: ${Object.keys(profiles).join(", ")}`
+    );
+  }
+  globalStore.set("activeProfile", name);
+}
+function listProfiles() {
+  const profiles = globalStore.get("profiles") ?? {};
+  return Object.keys(profiles);
+}
+function createProfile(name, config) {
+  const profiles = globalStore.get("profiles") ?? {};
+  if (profiles[name]) {
+    throw new Error(`Profile '${name}' already exists.`);
+  }
+  const defaultConfig = profiles.default ?? GLOBAL_DEFAULTS;
+  profiles[name] = { ...defaultConfig, ...config };
+  globalStore.set("profiles", profiles);
+}
+function deleteProfile(name) {
+  if (name === "default") {
+    throw new Error("Cannot delete the 'default' profile.");
+  }
+  const active = getActiveProfile();
+  if (name === active) {
+    throw new Error(
+      `Cannot delete the active profile '${name}'. Switch to another profile first.`
+    );
+  }
+  const profiles = globalStore.get("profiles") ?? {};
+  if (!profiles[name]) {
+    throw new Error(`Profile '${name}' does not exist.`);
+  }
+  delete profiles[name];
+  globalStore.set("profiles", profiles);
+  authStore.delete(name);
+}
+function getAuthConfig() {
+  const profile = getActiveProfile();
+  const profileAuth = authStore.get(profile);
+  return {
+    token: profileAuth?.token ?? null,
+    expiresAt: profileAuth?.expiresAt ?? null,
+    refreshToken: profileAuth?.refreshToken ?? null,
+    method: profileAuth?.method ?? null,
+    tokenId: profileAuth?.tokenId ?? null,
+    sourceUrl: profileAuth?.sourceUrl ?? null
+  };
+}
+function setAuthConfig(config) {
+  const profile = getActiveProfile();
+  const current = authStore.get(profile) ?? {
+    ...AUTH_DEFAULTS
+  };
+  authStore.set(profile, { ...current, ...config });
+}
+function clearAuthConfig() {
+  const profile = getActiveProfile();
+  authStore.delete(profile);
+}
+function getGlobalConfig() {
+  const profile = getActiveProfile();
+  const profiles = globalStore.get("profiles") ?? {};
+  const profileConfig = profiles[profile] ?? GLOBAL_DEFAULTS;
+  return {
+    currentTeam: profileConfig.currentTeam ?? null,
+    api: profileConfig.api ?? DEFAULT_API,
+    collectMetrics: profileConfig.collectMetrics ?? true
+  };
+}
+function setGlobalConfig(config) {
+  const profile = getActiveProfile();
+  const profiles = globalStore.get("profiles") ?? {};
+  const current = profiles[profile] ?? { ...GLOBAL_DEFAULTS };
+  profiles[profile] = { ...current, ...config };
+  globalStore.set("profiles", profiles);
+}
+function getConfigDir() {
+  return AUTH_CONFIG_DIR;
+}
+function isLoggedIn() {
+  const auth = getAuthConfig();
+  if (!auth.token) return false;
+  if (auth.expiresAt && Date.now() > auth.expiresAt) {
+    return auth.method === "cas" && Boolean(auth.refreshToken);
+  }
+  return true;
+}
+function normalizeApiUrl(url) {
+  return url.replace(/\/+$/, "").toLowerCase();
+}
+function checkAuthSourceMismatch(overrideCurrentUrl) {
+  const auth = getAuthConfig();
+  if (!auth.token || !auth.sourceUrl) return null;
+  const current = overrideCurrentUrl ?? getGlobalConfig().api;
+  if (normalizeApiUrl(auth.sourceUrl) === normalizeApiUrl(current)) return null;
+  return { stored: auth.sourceUrl, current };
+}
+function getProfileConfig(name) {
+  const profiles = globalStore.get("profiles") ?? {};
+  return profiles[name] ?? null;
+}
+function getProfileAuth(name) {
+  const profileAuth = authStore.get(name);
+  return {
+    token: profileAuth?.token ?? null,
+    expiresAt: profileAuth?.expiresAt ?? null,
+    refreshToken: profileAuth?.refreshToken ?? null,
+    method: profileAuth?.method ?? null,
+    tokenId: profileAuth?.tokenId ?? null,
+    sourceUrl: profileAuth?.sourceUrl ?? null
+  };
+}
+
+// src/util/auth.ts
+function getAuthMethod() {
+  if (process.env.RUSH_API_KEY) {
+    return "api_key";
+  }
+  const auth = getAuthConfig();
+  if (auth.token) {
+    if (auth.method === "api_key" || auth.token.startsWith("rush_sk_")) {
+      return "api_key";
+    }
+    if (auth.method === "platform_token") {
+      return "platform_token";
+    }
+    return auth.method ?? "cas";
+  }
+  return null;
+}
+function getAuthToken() {
+  if (process.env.RUSH_API_KEY) {
+    return process.env.RUSH_API_KEY;
+  }
+  const auth = getAuthConfig();
+  return auth.token;
+}
+function getCasConfig() {
+  const config = getGlobalConfig();
+  const baseUrl = process.env.RUSH_API_URL ?? config.api;
+  return {
+    authorizeEndpoint: process.env.RUSH_CAS_AUTHORIZE_ENDPOINT ?? `${baseUrl}/cas/oauth2/authorize`,
+    tokenEndpoint: process.env.RUSH_CAS_TOKEN_ENDPOINT ?? `${baseUrl}/cas/oauth2/token`,
+    revokeEndpoint: process.env.RUSH_CAS_REVOKE_ENDPOINT ?? `${baseUrl}/cas/oauth2/revoke`,
+    clientId: process.env.RUSH_CAS_CLIENT_ID ?? "rush-ai"
+  };
+}
+
+export {
+  getActiveProfile,
+  setActiveProfile,
+  listProfiles,
+  createProfile,
+  deleteProfile,
+  getAuthConfig,
+  setAuthConfig,
+  clearAuthConfig,
+  getGlobalConfig,
+  setGlobalConfig,
+  getConfigDir,
+  isLoggedIn,
+  checkAuthSourceMismatch,
+  getProfileConfig,
+  getProfileAuth,
+  getAuthMethod,
+  getAuthToken,
+  getCasConfig
+};
+//# sourceMappingURL=chunk-OIKYNVKO.js.map

package/dist/chunk-OIKYNVKO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/util/config.ts","../src/util/auth.ts"],"sourcesContent":["import { homedir } from 'node:os';\nimport { resolve } from 'node:path';\nimport Conf from 'conf';\n\nexport interface AuthConfig {\n  token: string | null;\n  expiresAt: number | null;\n  refreshToken: string | null;\n  /** How the token was obtained */\n  method: 'cas' | 'api_key' | 'platform_token' | null;\n  /** Platform Token jti (for remote revocation via DELETE /api/platform-tokens?id={tokenId}) */\n  tokenId: string | null;\n  /**\n   * API base URL the token was issued against. Stored at login so we can\n   * detect when the current profile's API URL drifts from where the token\n   * came from (e.g. `config set api` pointed at a different environment).\n   * `null` for tokens migrated from the v2 schema — treated as \"unknown\n   * origin\", so we don't flag false positives on upgrade.\n   */\n  sourceUrl: string | null;\n}\n\nexport interface GlobalConfig {\n  currentTeam: string | null;\n  api: string;\n  collectMetrics: boolean;\n}\n\nexport interface ProjectConfig {\n  projectId: string | null;\n  orgId: string | null;\n}\n\n// --- Profile store types ---\n\ninterface ProfiledGlobalStore {\n  _version: number;\n  activeProfile: string;\n  profiles: Record<string, GlobalConfig>;\n}\n\ninterface ProfiledAuthStore {\n  _version: number;\n  [profileName: string]: AuthConfig | number; // profile entries + _version\n}\n\nconst AUTH_CONFIG_DIR = resolve(homedir(), '.rush');\nconst DEFAULT_API = 'https://rush.zhenguanyu.com';\n\nconst AUTH_DEFAULTS: AuthConfig = {\n  token: null,\n  expiresAt: null,\n  refreshToken: null,\n  method: null,\n  tokenId: null,\n  sourceUrl: null,\n};\n\nconst GLOBAL_DEFAULTS: GlobalConfig = {\n  currentTeam: null,\n  api: DEFAULT_API,\n  collectMetrics: true,\n};\n\nfunction isEmptyAuthEntry(entry: unknown): boolean {\n  if (!entry || typeof entry !== 'object') return false;\n  const auth = entry as Partial<AuthConfig>;\n  return (\n    !auth.token &&\n    auth.expiresAt == null &&\n    !auth.refreshToken &&\n    auth.method == null &&\n    !auth.tokenId &&\n    !auth.sourceUrl\n  );\n}\n\n// --- Raw stores (untyped to support migration) ---\n\nconst globalStore = new Conf<Record<string, unknown>>({\n  projectName: 'rush-ai',\n  cwd: AUTH_CONFIG_DIR,\n  configName: 'config',\n  defaults: {},\n});\n\nconst authStore = new Conf<Record<string, unknown>>({\n  projectName: 'rush-ai',\n  cwd: AUTH_CONFIG_DIR,\n  configName: 'auth',\n  defaults: {},\n});\n\n// --- Migration ---\n\nfunction migrateGlobalStoreIfNeeded(): void {\n  const version = globalStore.get('_version');\n  if (version === 2) return; // Already migrated\n\n  // Check if this is old format (has 'api' at top level but no 'profiles')\n  const hasOldFormat = globalStore.has('api') && !globalStore.has('profiles');\n  const isEmpty = globalStore.size === 0;\n\n  if (hasOldFormat) {\n    // Migrate old flat format → profile format\n    const oldConfig: GlobalConfig = {\n      currentTeam: (globalStore.get('currentTeam') as string | null) ?? null,\n      api: (globalStore.get('api') as string) ?? DEFAULT_API,\n      collectMetrics: (globalStore.get('collectMetrics') as boolean) ?? true,\n    };\n\n    globalStore.clear();\n    globalStore.set('_version', 2);\n    globalStore.set('activeProfile', 'default');\n    globalStore.set('profiles', { default: oldConfig });\n  } else if (isEmpty || !globalStore.has('profiles')) {\n    // Fresh install or incomplete state — initialize\n    globalStore.set('_version', 2);\n    if (!globalStore.has('activeProfile')) {\n      globalStore.set('activeProfile', 'default');\n    }\n    if (!globalStore.has('profiles')) {\n      globalStore.set('profiles', { default: { ...GLOBAL_DEFAULTS } });\n    }\n  }\n}\n\nfunction migrateAuthStoreIfNeeded(): void {\n  const version = authStore.get('_version');\n  if (version === 3) {\n    pruneEmptyAuthEntries();\n    return;\n  }\n\n  // v1 → v3: legacy flat format (`token` at top level).\n  const hasOldFormat = authStore.has('token') || authStore.has('method');\n  const isEmpty = authStore.size === 0;\n\n  if (hasOldFormat) {\n    const oldAuth: AuthConfig = {\n      token: (authStore.get('token') as string | null) ?? null,\n      expiresAt: (authStore.get('expiresAt') as number | null) ?? null,\n      refreshToken: (authStore.get('refreshToken') as string | null) ?? null,\n      method: (authStore.get('method') as AuthConfig['method']) ?? null,\n      tokenId: (authStore.get('tokenId') as string | null) ?? null,\n      sourceUrl: null,\n    };\n\n    authStore.clear();\n    authStore.set('_version', 3);\n    if (!isEmptyAuthEntry(oldAuth)) {\n      authStore.set('default', oldAuth);\n    }\n    return;\n  }\n\n  if (isEmpty) {\n    authStore.set('_version', 3);\n    return;\n  }\n\n  // v2 → v3: profile-shaped but missing `sourceUrl`. Backfill null.\n  if (version === 2) {\n    for (const key of Object.keys(authStore.store)) {\n      if (key === '_version') continue;\n      const entry = authStore.get(key);\n      if (!entry || typeof entry !== 'object') continue;\n      const asAuth = entry as Record<string, unknown>;\n      if (!('sourceUrl' in asAuth)) {\n        authStore.set(key, { ...asAuth, sourceUrl: null });\n      }\n    }\n    authStore.set('_version', 3);\n    pruneEmptyAuthEntries();\n  }\n}\n\nfunction pruneEmptyAuthEntries(): void {\n  for (const key of Object.keys(authStore.store)) {\n    if (key === '_version') continue;\n    if (isEmptyAuthEntry(authStore.get(key))) {\n      authStore.delete(key);\n    }\n  }\n}\n\n// Run migrations on module load\nmigrateGlobalStoreIfNeeded();\nmigrateAuthStoreIfNeeded();\n\n// --- Profile helpers ---\n\n/**\n * Get the active profile name.\n * RUSH_PROFILE env var takes precedence over stored activeProfile.\n */\nexport function getActiveProfile(): string {\n  return (\n    process.env.RUSH_PROFILE ??\n    (globalStore.get('activeProfile') as string) ??\n    'default'\n  );\n}\n\nexport function setActiveProfile(name: string): void {\n  const profiles =\n    (globalStore.get('profiles') as Record<string, GlobalConfig>) ?? {};\n  if (!profiles[name]) {\n    throw new Error(\n      `Profile '${name}' does not exist. Available: ${Object.keys(profiles).join(', ')}`\n    );\n  }\n  globalStore.set('activeProfile', name);\n}\n\nexport function listProfiles(): string[] {\n  const profiles =\n    (globalStore.get('profiles') as Record<string, GlobalConfig>) ?? {};\n  return Object.keys(profiles);\n}\n\nexport function createProfile(\n  name: string,\n  config?: Partial<GlobalConfig>\n): void {\n  const profiles =\n    (globalStore.get('profiles') as Record<string, GlobalConfig>) ?? {};\n  if (profiles[name]) {\n    throw new Error(`Profile '${name}' already exists.`);\n  }\n  // Inherit from default profile\n  const defaultConfig = profiles.default ?? GLOBAL_DEFAULTS;\n  profiles[name] = { ...defaultConfig, ...config };\n  globalStore.set('profiles', profiles);\n}\n\nexport function deleteProfile(name: string): void {\n  if (name === 'default') {\n    throw new Error(\"Cannot delete the 'default' profile.\");\n  }\n  const active = getActiveProfile();\n  if (name === active) {\n    throw new Error(\n      `Cannot delete the active profile '${name}'. Switch to another profile first.`\n    );\n  }\n  const profiles =\n    (globalStore.get('profiles') as Record<string, GlobalConfig>) ?? {};\n  if (!profiles[name]) {\n    throw new Error(`Profile '${name}' does not exist.`);\n  }\n  delete profiles[name];\n  globalStore.set('profiles', profiles);\n\n  // Also clear auth for this profile\n  authStore.delete(name);\n}\n\n// --- Auth config (profile-aware) ---\n\nexport function getAuthConfig(): AuthConfig {\n  const profile = getActiveProfile();\n  const profileAuth = authStore.get(profile) as AuthConfig | undefined;\n  return {\n    token: profileAuth?.token ?? null,\n    expiresAt: profileAuth?.expiresAt ?? null,\n    refreshToken: profileAuth?.refreshToken ?? null,\n    method: profileAuth?.method ?? null,\n    tokenId: profileAuth?.tokenId ?? null,\n    sourceUrl: profileAuth?.sourceUrl ?? null,\n  };\n}\n\nexport function setAuthConfig(config: Partial<AuthConfig>): void {\n  const profile = getActiveProfile();\n  const current = (authStore.get(profile) as AuthConfig) ?? {\n    ...AUTH_DEFAULTS,\n  };\n  authStore.set(profile, { ...current, ...config });\n}\n\n/** Clear auth for the current profile only */\nexport function clearAuthConfig(): void {\n  const profile = getActiveProfile();\n  authStore.delete(profile);\n}\n\n/** Clear auth for ALL profiles */\nexport function clearAllAuthConfig(): void {\n  for (const key of Object.keys(authStore.store)) {\n    if (key !== '_version') {\n      authStore.delete(key);\n    }\n  }\n}\n\n// --- Global config (profile-aware) ---\n\nexport function getGlobalConfig(): GlobalConfig {\n  const profile = getActiveProfile();\n  const profiles =\n    (globalStore.get('profiles') as Record<string, GlobalConfig>) ?? {};\n  const profileConfig = profiles[profile] ?? GLOBAL_DEFAULTS;\n  return {\n    currentTeam: profileConfig.currentTeam ?? null,\n    api: profileConfig.api ?? DEFAULT_API,\n    collectMetrics: profileConfig.collectMetrics ?? true,\n  };\n}\n\nexport function setGlobalConfig(config: Partial<GlobalConfig>): void {\n  const profile = getActiveProfile();\n  const profiles =\n    (globalStore.get('profiles') as Record<string, GlobalConfig>) ?? {};\n  const current = profiles[profile] ?? { ...GLOBAL_DEFAULTS };\n  profiles[profile] = { ...current, ...config };\n  globalStore.set('profiles', profiles);\n}\n\nexport function getConfigDir(): string {\n  return AUTH_CONFIG_DIR;\n}\n\nexport function isLoggedIn(): boolean {\n  const auth = getAuthConfig();\n  if (!auth.token) return false;\n  if (auth.expiresAt && Date.now() > auth.expiresAt) {\n    // CAS tokens with refresh_token can still be renewed lazily by the client.\n    return auth.method === 'cas' && Boolean(auth.refreshToken);\n  }\n  return true;\n}\n\n/** Normalize an API URL for comparison — strips trailing slashes + lowercases. */\nexport function normalizeApiUrl(url: string): string {\n  return url.replace(/\\/+$/, '').toLowerCase();\n}\n\n/**\n * If the current profile's token was issued against a different API URL than\n * the profile currently points to, return both sides so the caller can prompt\n * the user to re-authenticate. Returns null when no mismatch (or when the\n * stored `sourceUrl` is null — migrated tokens with unknown origin). The\n * caller decides what to do; this function does NOT mutate or clear anything.\n *\n * @param overrideCurrentUrl use this URL instead of reading the current\n *   global config. Useful when evaluating mismatch BEFORE writing a new API\n *   URL in `config set`.\n */\nexport function checkAuthSourceMismatch(\n  overrideCurrentUrl?: string\n): { stored: string; current: string } | null {\n  const auth = getAuthConfig();\n  if (!auth.token || !auth.sourceUrl) return null;\n  const current = overrideCurrentUrl ?? getGlobalConfig().api;\n  if (normalizeApiUrl(auth.sourceUrl) === normalizeApiUrl(current)) return null;\n  return { stored: auth.sourceUrl, current };\n}\n\n/**\n * Get the config for a specific profile (for display purposes).\n */\nexport function getProfileConfig(name: string): GlobalConfig | null {\n  const profiles =\n    (globalStore.get('profiles') as Record<string, GlobalConfig>) ?? {};\n  return profiles[name] ?? null;\n}\n\n/**\n * Get auth config for a specific profile (for display purposes).\n */\nexport function getProfileAuth(name: string): AuthConfig {\n  const profileAuth = authStore.get(name) as AuthConfig | undefined;\n  return {\n    token: profileAuth?.token ?? null,\n    expiresAt: profileAuth?.expiresAt ?? null,\n    refreshToken: profileAuth?.refreshToken ?? null,\n    method: profileAuth?.method ?? null,\n    tokenId: profileAuth?.tokenId ?? null,\n    sourceUrl: profileAuth?.sourceUrl ?? null,\n  };\n}\n","import { getAuthConfig, getGlobalConfig } from './config.js';\n\nexport type AuthMethod = 'api_key' | 'cas' | 'platform_token' | null;\n\n/**\n * Determine the current authentication method.\n * Priority: RUSH_API_KEY env > stored CAS token > null\n */\nexport function getAuthMethod(): AuthMethod {\n  if (process.env.RUSH_API_KEY) {\n    return 'api_key';\n  }\n  const auth = getAuthConfig();\n  if (auth.token) {\n    // Use stored method if available; detect rush_sk_ prefix as fallback\n    if (auth.method === 'api_key' || auth.token.startsWith('rush_sk_')) {\n      return 'api_key';\n    }\n    if (auth.method === 'platform_token') {\n      return 'platform_token';\n    }\n    return auth.method ?? 'cas';\n  }\n  return null;\n}\n\n/**\n * Get the active auth token.\n * Priority: RUSH_API_KEY env > stored token\n */\nexport function getAuthToken(): string | null {\n  if (process.env.RUSH_API_KEY) {\n    return process.env.RUSH_API_KEY;\n  }\n  const auth = getAuthConfig();\n  return auth.token;\n}\n\nexport interface CasConfig {\n  authorizeEndpoint: string;\n  tokenEndpoint: string;\n  revokeEndpoint: string;\n  clientId: string;\n}\n\n/**\n * Get CAS PKCE configuration.\n * Supports env overrides for private deployments.\n */\nexport function getCasConfig(): CasConfig {\n  const config = getGlobalConfig();\n  const baseUrl = process.env.RUSH_API_URL ?? config.api;\n\n  return {\n    authorizeEndpoint:\n      process.env.RUSH_CAS_AUTHORIZE_ENDPOINT ??\n      `${baseUrl}/cas/oauth2/authorize`,\n    tokenEndpoint:\n      process.env.RUSH_CAS_TOKEN_ENDPOINT ?? `${baseUrl}/cas/oauth2/token`,\n    revokeEndpoint:\n      process.env.RUSH_CAS_REVOKE_ENDPOINT ?? `${baseUrl}/cas/oauth2/revoke`,\n    clientId: process.env.RUSH_CAS_CLIENT_ID ?? 'rush-ai',\n  };\n}\n\nexport interface Principal {\n  provider: 'ldap' | 'service';\n  subject: string;\n}\n\n/**\n * Build a Principal object from the current auth context.\n * M1: only ldap is supported.\n */\nexport function getPrincipal(subject: string): Principal {\n  const method = getAuthMethod();\n  return {\n    provider: method === 'api_key' ? 'service' : 'ldap',\n    subject,\n  };\n}\n"],"mappings":";;;AAAA,SAAS,eAAe;AACxB,SAAS,eAAe;AACxB,OAAO,UAAU;AA4CjB,IAAM,kBAAkB,QAAQ,QAAQ,GAAG,OAAO;AAClD,IAAM,cAAc;AAEpB,IAAM,gBAA4B;AAAA,EAChC,OAAO;AAAA,EACP,WAAW;AAAA,EACX,cAAc;AAAA,EACd,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,WAAW;AACb;AAEA,IAAM,kBAAgC;AAAA,EACpC,aAAa;AAAA,EACb,KAAK;AAAA,EACL,gBAAgB;AAClB;AAEA,SAAS,iBAAiB,OAAyB;AACjD,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,OAAO;AACb,SACE,CAAC,KAAK,SACN,KAAK,aAAa,QAClB,CAAC,KAAK,gBACN,KAAK,UAAU,QACf,CAAC,KAAK,WACN,CAAC,KAAK;AAEV;AAIA,IAAM,cAAc,IAAI,KAA8B;AAAA,EACpD,aAAa;AAAA,EACb,KAAK;AAAA,EACL,YAAY;AAAA,EACZ,UAAU,CAAC;AACb,CAAC;AAED,IAAM,YAAY,IAAI,KAA8B;AAAA,EAClD,aAAa;AAAA,EACb,KAAK;AAAA,EACL,YAAY;AAAA,EACZ,UAAU,CAAC;AACb,CAAC;AAID,SAAS,6BAAmC;AAC1C,QAAM,UAAU,YAAY,IAAI,UAAU;AAC1C,MAAI,YAAY,EAAG;AAGnB,QAAM,eAAe,YAAY,IAAI,KAAK,KAAK,CAAC,YAAY,IAAI,UAAU;AAC1E,QAAM,UAAU,YAAY,SAAS;AAErC,MAAI,cAAc;AAEhB,UAAM,YAA0B;AAAA,MAC9B,aAAc,YAAY,IAAI,aAAa,KAAuB;AAAA,MAClE,KAAM,YAAY,IAAI,KAAK,KAAgB;AAAA,MAC3C,gBAAiB,YAAY,IAAI,gBAAgB,KAAiB;AAAA,IACpE;AAEA,gBAAY,MAAM;AAClB,gBAAY,IAAI,YAAY,CAAC;AAC7B,gBAAY,IAAI,iBAAiB,SAAS;AAC1C,gBAAY,IAAI,YAAY,EAAE,SAAS,UAAU,CAAC;AAAA,EACpD,WAAW,WAAW,CAAC,YAAY,IAAI,UAAU,GAAG;AAElD,gBAAY,IAAI,YAAY,CAAC;AAC7B,QAAI,CAAC,YAAY,IAAI,eAAe,GAAG;AACrC,kBAAY,IAAI,iBAAiB,SAAS;AAAA,IAC5C;AACA,QAAI,CAAC,YAAY,IAAI,UAAU,GAAG;AAChC,kBAAY,IAAI,YAAY,EAAE,SAAS,EAAE,GAAG,gBAAgB,EAAE,CAAC;AAAA,IACjE;AAAA,EACF;AACF;AAEA,SAAS,2BAAiC;AACxC,QAAM,UAAU,UAAU,IAAI,UAAU;AACxC,MAAI,YAAY,GAAG;AACjB,0BAAsB;AACtB;AAAA,EACF;AAGA,QAAM,eAAe,UAAU,IAAI,OAAO,KAAK,UAAU,IAAI,QAAQ;AACrE,QAAM,UAAU,UAAU,SAAS;AAEnC,MAAI,cAAc;AAChB,UAAM,UAAsB;AAAA,MAC1B,OAAQ,UAAU,IAAI,OAAO,KAAuB;AAAA,MACpD,WAAY,UAAU,IAAI,WAAW,KAAuB;AAAA,MAC5D,cAAe,UAAU,IAAI,cAAc,KAAuB;AAAA,MAClE,QAAS,UAAU,IAAI,QAAQ,KAA8B;AAAA,MAC7D,SAAU,UAAU,IAAI,SAAS,KAAuB;AAAA,MACxD,WAAW;AAAA,IACb;AAEA,cAAU,MAAM;AAChB,cAAU,IAAI,YAAY,CAAC;AAC3B,QAAI,CAAC,iBAAiB,OAAO,GAAG;AAC9B,gBAAU,IAAI,WAAW,OAAO;AAAA,IAClC;AACA;AAAA,EACF;AAEA,MAAI,SAAS;AACX,cAAU,IAAI,YAAY,CAAC;AAC3B;AAAA,EACF;AAGA,MAAI,YAAY,GAAG;AACjB,eAAW,OAAO,OAAO,KAAK,UAAU,KAAK,GAAG;AAC9C,UAAI,QAAQ,WAAY;AACxB,YAAM,QAAQ,UAAU,IAAI,GAAG;AAC/B,UAAI,CAAC,SAAS,OAAO,UAAU,SAAU;AACzC,YAAM,SAAS;AACf,UAAI,EAAE,eAAe,SAAS;AAC5B,kBAAU,IAAI,KAAK,EAAE,GAAG,QAAQ,WAAW,KAAK,CAAC;AAAA,MACnD;AAAA,IACF;AACA,cAAU,IAAI,YAAY,CAAC;AAC3B,0BAAsB;AAAA,EACxB;AACF;AAEA,SAAS,wBAA8B;AACrC,aAAW,OAAO,OAAO,KAAK,UAAU,KAAK,GAAG;AAC9C,QAAI,QAAQ,WAAY;AACxB,QAAI,iBAAiB,UAAU,IAAI,GAAG,CAAC,GAAG;AACxC,gBAAU,OAAO,GAAG;AAAA,IACtB;AAAA,EACF;AACF;AAGA,2BAA2B;AAC3B,yBAAyB;AAQlB,SAAS,mBAA2B;AACzC,SACE,QAAQ,IAAI,gBACX,YAAY,IAAI,eAAe,KAChC;AAEJ;AAEO,SAAS,iBAAiB,MAAoB;AACnD,QAAM,WACH,YAAY,IAAI,UAAU,KAAsC,CAAC;AACpE,MAAI,CAAC,SAAS,IAAI,GAAG;AACnB,UAAM,IAAI;AAAA,MACR,YAAY,IAAI,gCAAgC,OAAO,KAAK,QAAQ,EAAE,KAAK,IAAI,CAAC;AAAA,IAClF;AAAA,EACF;AACA,cAAY,IAAI,iBAAiB,IAAI;AACvC;AAEO,SAAS,eAAyB;AACvC,QAAM,WACH,YAAY,IAAI,UAAU,KAAsC,CAAC;AACpE,SAAO,OAAO,KAAK,QAAQ;AAC7B;AAEO,SAAS,cACd,MACA,QACM;AACN,QAAM,WACH,YAAY,IAAI,UAAU,KAAsC,CAAC;AACpE,MAAI,SAAS,IAAI,GAAG;AAClB,UAAM,IAAI,MAAM,YAAY,IAAI,mBAAmB;AAAA,EACrD;AAEA,QAAM,gBAAgB,SAAS,WAAW;AAC1C,WAAS,IAAI,IAAI,EAAE,GAAG,eAAe,GAAG,OAAO;AAC/C,cAAY,IAAI,YAAY,QAAQ;AACtC;AAEO,SAAS,cAAc,MAAoB;AAChD,MAAI,SAAS,WAAW;AACtB,UAAM,IAAI,MAAM,sCAAsC;AAAA,EACxD;AACA,QAAM,SAAS,iBAAiB;AAChC,MAAI,SAAS,QAAQ;AACnB,UAAM,IAAI;AAAA,MACR,qCAAqC,IAAI;AAAA,IAC3C;AAAA,EACF;AACA,QAAM,WACH,YAAY,IAAI,UAAU,KAAsC,CAAC;AACpE,MAAI,CAAC,SAAS,IAAI,GAAG;AACnB,UAAM,IAAI,MAAM,YAAY,IAAI,mBAAmB;AAAA,EACrD;AACA,SAAO,SAAS,IAAI;AACpB,cAAY,IAAI,YAAY,QAAQ;AAGpC,YAAU,OAAO,IAAI;AACvB;AAIO,SAAS,gBAA4B;AAC1C,QAAM,UAAU,iBAAiB;AACjC,QAAM,cAAc,UAAU,IAAI,OAAO;AACzC,SAAO;AAAA,IACL,OAAO,aAAa,SAAS;AAAA,IAC7B,WAAW,aAAa,aAAa;AAAA,IACrC,cAAc,aAAa,gBAAgB;AAAA,IAC3C,QAAQ,aAAa,UAAU;AAAA,IAC/B,SAAS,aAAa,WAAW;AAAA,IACjC,WAAW,aAAa,aAAa;AAAA,EACvC;AACF;AAEO,SAAS,cAAc,QAAmC;AAC/D,QAAM,UAAU,iBAAiB;AACjC,QAAM,UAAW,UAAU,IAAI,OAAO,KAAoB;AAAA,IACxD,GAAG;AAAA,EACL;AACA,YAAU,IAAI,SAAS,EAAE,GAAG,SAAS,GAAG,OAAO,CAAC;AAClD;AAGO,SAAS,kBAAwB;AACtC,QAAM,UAAU,iBAAiB;AACjC,YAAU,OAAO,OAAO;AAC1B;AAaO,SAAS,kBAAgC;AAC9C,QAAM,UAAU,iBAAiB;AACjC,QAAM,WACH,YAAY,IAAI,UAAU,KAAsC,CAAC;AACpE,QAAM,gBAAgB,SAAS,OAAO,KAAK;AAC3C,SAAO;AAAA,IACL,aAAa,cAAc,eAAe;AAAA,IAC1C,KAAK,cAAc,OAAO;AAAA,IAC1B,gBAAgB,cAAc,kBAAkB;AAAA,EAClD;AACF;AAEO,SAAS,gBAAgB,QAAqC;AACnE,QAAM,UAAU,iBAAiB;AACjC,QAAM,WACH,YAAY,IAAI,UAAU,KAAsC,CAAC;AACpE,QAAM,UAAU,SAAS,OAAO,KAAK,EAAE,GAAG,gBAAgB;AAC1D,WAAS,OAAO,IAAI,EAAE,GAAG,SAAS,GAAG,OAAO;AAC5C,cAAY,IAAI,YAAY,QAAQ;AACtC;AAEO,SAAS,eAAuB;AACrC,SAAO;AACT;AAEO,SAAS,aAAsB;AACpC,QAAM,OAAO,cAAc;AAC3B,MAAI,CAAC,KAAK,MAAO,QAAO;AACxB,MAAI,KAAK,aAAa,KAAK,IAAI,IAAI,KAAK,WAAW;AAEjD,WAAO,KAAK,WAAW,SAAS,QAAQ,KAAK,YAAY;AAAA,EAC3D;AACA,SAAO;AACT;AAGO,SAAS,gBAAgB,KAAqB;AACnD,SAAO,IAAI,QAAQ,QAAQ,EAAE,EAAE,YAAY;AAC7C;AAaO,SAAS,wBACd,oBAC4C;AAC5C,QAAM,OAAO,cAAc;AAC3B,MAAI,CAAC,KAAK,SAAS,CAAC,KAAK,UAAW,QAAO;AAC3C,QAAM,UAAU,sBAAsB,gBAAgB,EAAE;AACxD,MAAI,gBAAgB,KAAK,SAAS,MAAM,gBAAgB,OAAO,EAAG,QAAO;AACzE,SAAO,EAAE,QAAQ,KAAK,WAAW,QAAQ;AAC3C;AAKO,SAAS,iBAAiB,MAAmC;AAClE,QAAM,WACH,YAAY,IAAI,UAAU,KAAsC,CAAC;AACpE,SAAO,SAAS,IAAI,KAAK;AAC3B;AAKO,SAAS,eAAe,MAA0B;AACvD,QAAM,cAAc,UAAU,IAAI,IAAI;AACtC,SAAO;AAAA,IACL,OAAO,aAAa,SAAS;AAAA,IAC7B,WAAW,aAAa,aAAa;AAAA,IACrC,cAAc,aAAa,gBAAgB;AAAA,IAC3C,QAAQ,aAAa,UAAU;AAAA,IAC/B,SAAS,aAAa,WAAW;AAAA,IACjC,WAAW,aAAa,aAAa;AAAA,EACvC;AACF;;;ACrXO,SAAS,gBAA4B;AAC1C,MAAI,QAAQ,IAAI,cAAc;AAC5B,WAAO;AAAA,EACT;AACA,QAAM,OAAO,cAAc;AAC3B,MAAI,KAAK,OAAO;AAEd,QAAI,KAAK,WAAW,aAAa,KAAK,MAAM,WAAW,UAAU,GAAG;AAClE,aAAO;AAAA,IACT;AACA,QAAI,KAAK,WAAW,kBAAkB;AACpC,aAAO;AAAA,IACT;AACA,WAAO,KAAK,UAAU;AAAA,EACxB;AACA,SAAO;AACT;AAMO,SAAS,eAA8B;AAC5C,MAAI,QAAQ,IAAI,cAAc;AAC5B,WAAO,QAAQ,IAAI;AAAA,EACrB;AACA,QAAM,OAAO,cAAc;AAC3B,SAAO,KAAK;AACd;AAaO,SAAS,eAA0B;AACxC,QAAM,SAAS,gBAAgB;AAC/B,QAAM,UAAU,QAAQ,IAAI,gBAAgB,OAAO;AAEnD,SAAO;AAAA,IACL,mBACE,QAAQ,IAAI,+BACZ,GAAG,OAAO;AAAA,IACZ,eACE,QAAQ,IAAI,2BAA2B,GAAG,OAAO;AAAA,IACnD,gBACE,QAAQ,IAAI,4BAA4B,GAAG,OAAO;AAAA,IACpD,UAAU,QAAQ,IAAI,sBAAsB;AAAA,EAC9C;AACF;","names":[]}