@37signals/basecamp 0.2.0

package/dist/oauth/exchange.js

@@ -0,0 +1,324 @@
+/**
+ * OAuth 2.0 token exchange and refresh for Basecamp SDK.
+ *
+ * Handles authorization code exchange and token refresh operations.
+ * Supports both standard OAuth 2.0 and Basecamp's Launchpad legacy format.
+ */
+import { BasecampError } from "../errors.js";
+import { isLocalhost } from "../security.js";
+/**
+ * Exchanges an authorization code for access and refresh tokens.
+ *
+ * Supports both standard OAuth 2.0 and Basecamp's Launchpad legacy format.
+ * Use `useLegacyFormat: true` for Launchpad compatibility.
+ *
+ * @param request - Exchange request parameters
+ * @param options - Optional configuration
+ * @returns The token response
+ * @throws BasecampError on validation, network, or authentication errors
+ *
+ * @example
+ * ```ts
+ * // Standard OAuth 2.0
+ * const token = await exchangeCode({
+ *   tokenEndpoint: config.tokenEndpoint,
+ *   code: "auth_code_from_callback",
+ *   redirectUri: "https://myapp.com/callback",
+ *   clientId: "my_client_id",
+ *   clientSecret: "my_client_secret",
+ * });
+ *
+ * // Launchpad legacy format
+ * const token = await exchangeCode({
+ *   tokenEndpoint: "https://launchpad.37signals.com/authorization/token",
+ *   code: "auth_code",
+ *   redirectUri: "https://myapp.com/callback",
+ *   clientId: "my_client_id",
+ *   clientSecret: "my_client_secret",
+ *   useLegacyFormat: true,
+ * });
+ * ```
+ */
+export async function exchangeCode(request, options = {}) {
+    // Validate required fields
+    if (!request.tokenEndpoint) {
+        throw new BasecampError("validation", "Token endpoint is required");
+    }
+    if (!request.code) {
+        throw new BasecampError("validation", "Authorization code is required");
+    }
+    if (!request.redirectUri) {
+        throw new BasecampError("validation", "Redirect URI is required");
+    }
+    if (!request.clientId) {
+        throw new BasecampError("validation", "Client ID is required");
+    }
+    // Build request body
+    const body = new URLSearchParams();
+    if (request.useLegacyFormat) {
+        // Launchpad uses non-standard "type" parameter
+        body.set("type", "web_server");
+    }
+    else {
+        // Standard OAuth 2.0
+        body.set("grant_type", "authorization_code");
+    }
+    body.set("code", request.code);
+    body.set("redirect_uri", request.redirectUri);
+    body.set("client_id", request.clientId);
+    if (request.clientSecret) {
+        body.set("client_secret", request.clientSecret);
+    }
+    if (request.codeVerifier) {
+        body.set("code_verifier", request.codeVerifier);
+    }
+    return doTokenRequest(request.tokenEndpoint, body, options);
+}
+/**
+ * Refreshes an access token using a refresh token.
+ *
+ * Supports both standard OAuth 2.0 and Basecamp's Launchpad legacy format.
+ * Use `useLegacyFormat: true` for Launchpad compatibility.
+ *
+ * @param request - Refresh request parameters
+ * @param options - Optional configuration
+ * @returns The new token response
+ * @throws BasecampError on validation, network, or authentication errors
+ *
+ * @example
+ * ```ts
+ * // Standard OAuth 2.0
+ * const newToken = await refreshToken({
+ *   tokenEndpoint: config.tokenEndpoint,
+ *   refreshToken: oldToken.refreshToken,
+ *   clientId: "my_client_id",
+ *   clientSecret: "my_client_secret",
+ * });
+ *
+ * // Launchpad legacy format
+ * const newToken = await refreshToken({
+ *   tokenEndpoint: "https://launchpad.37signals.com/authorization/token",
+ *   refreshToken: oldToken.refreshToken,
+ *   useLegacyFormat: true,
+ * });
+ * ```
+ */
+export async function refreshToken(request, options = {}) {
+    // Validate required fields
+    if (!request.tokenEndpoint) {
+        throw new BasecampError("validation", "Token endpoint is required");
+    }
+    if (!request.refreshToken) {
+        throw new BasecampError("validation", "Refresh token is required");
+    }
+    // Build request body
+    const body = new URLSearchParams();
+    if (request.useLegacyFormat) {
+        // Launchpad uses non-standard "type" parameter
+        body.set("type", "refresh");
+    }
+    else {
+        // Standard OAuth 2.0
+        body.set("grant_type", "refresh_token");
+    }
+    body.set("refresh_token", request.refreshToken);
+    if (request.clientId) {
+        body.set("client_id", request.clientId);
+    }
+    if (request.clientSecret) {
+        body.set("client_secret", request.clientSecret);
+    }
+    return doTokenRequest(request.tokenEndpoint, body, options);
+}
+/**
+ * Validates that a URL uses the HTTPS scheme (allows localhost for testing).
+ */
+function requireHTTPS(url, label) {
+    try {
+        const parsed = new URL(url);
+        if (parsed.protocol !== "https:" && !isLocalhost(parsed.hostname)) {
+            throw new BasecampError("validation", `${label} must use HTTPS: ${url}`);
+        }
+    }
+    catch (err) {
+        if (err instanceof BasecampError)
+            throw err;
+        throw new BasecampError("validation", `Invalid ${label}: ${url}`);
+    }
+}
+/**
+ * Parses Content-Length header, returning null for missing/invalid values.
+ * Treats non-numeric or negative values as invalid (fail closed).
+ */
+function parseContentLength(header) {
+    if (!header)
+        return null;
+    const parsed = parseInt(header, 10);
+    // NaN, negative, or non-integer values are invalid
+    if (!Number.isInteger(parsed) || parsed < 0)
+        return null;
+    // Reject if the header contains non-digit characters (e.g., "123abc")
+    if (!/^\d+$/.test(header.trim()))
+        return null;
+    return parsed;
+}
+/**
+ * Reads a response body with streaming byte limit.
+ * Uses true byte counting even when Content-Length is absent or inaccurate.
+ */
+async function readResponseWithByteLimit(response, maxBytes, httpStatus) {
+    // Parse Content-Length, treating invalid values as missing (fail closed)
+    const contentLengthBytes = parseContentLength(response.headers.get("Content-Length"));
+    // Fast path: reject if Content-Length exceeds limit
+    if (contentLengthBytes !== null && contentLengthBytes > maxBytes) {
+        throw new BasecampError("api_error", `Token response too large (Content-Length: ${contentLengthBytes} bytes, max ${maxBytes})`, { httpStatus });
+    }
+    // If no body or body isn't streamable, require valid Content-Length
+    if (!response.body) {
+        // If Content-Length is missing or invalid, we cannot protect against DoS - fail closed.
+        // If it was valid and within limits, we can safely read.
+        if (contentLengthBytes === null) {
+            throw new BasecampError("api_error", "Cannot safely read token response: no valid Content-Length header and streaming unavailable", { httpStatus });
+        }
+        // Content-Length was valid and within limits, safe to read
+        return response.text();
+    }
+    // Stream with byte counting
+    const reader = response.body.getReader();
+    const chunks = [];
+    let totalBytes = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            totalBytes += value.length;
+            if (totalBytes > maxBytes) {
+                reader.cancel();
+                throw new BasecampError("api_error", `Token response too large (${totalBytes}+ bytes, max ${maxBytes})`, { httpStatus });
+            }
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    // Concatenate and decode
+    const combined = new Uint8Array(totalBytes);
+    let offset = 0;
+    for (const chunk of chunks) {
+        combined.set(chunk, offset);
+        offset += chunk.length;
+    }
+    return new TextDecoder().decode(combined);
+}
+/**
+ * Performs the actual HTTP token request.
+ */
+async function doTokenRequest(tokenEndpoint, body, options) {
+    requireHTTPS(tokenEndpoint, "token endpoint");
+    const { fetch: customFetch = globalThis.fetch, timeoutMs = 30000 } = options;
+    // Create abort controller for timeout
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const response = await customFetch(tokenEndpoint, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/x-www-form-urlencoded",
+                Accept: "application/json",
+            },
+            body: body.toString(),
+            signal: controller.signal,
+        });
+        const MAX_TOKEN_RESPONSE_BYTES = 1 * 1024 * 1024; // 1 MB
+        // Use streaming reader with true byte-level limit enforcement.
+        // This handles cases where Content-Length is absent or inaccurate.
+        const responseText = await readResponseWithByteLimit(response, MAX_TOKEN_RESPONSE_BYTES, response.status);
+        let data;
+        try {
+            data = JSON.parse(responseText);
+        }
+        catch {
+            // Truncate response text to avoid leaking sensitive data in error messages
+            const truncated = responseText.length > 500 ? responseText.slice(0, 497) + "..." : responseText;
+            throw new BasecampError("api_error", `Failed to parse token response: ${truncated}`, { httpStatus: response.status });
+        }
+        // Check for error response
+        if (!response.ok) {
+            const errorData = data;
+            const rawMessage = errorData.error_description || errorData.error || "Token request failed";
+            const message = rawMessage.length > 500 ? rawMessage.slice(0, 497) + "..." : rawMessage;
+            if (response.status === 401 || errorData.error === "invalid_grant") {
+                throw new BasecampError("auth", message, {
+                    httpStatus: response.status,
+                    hint: "The authorization code or refresh token may be invalid or expired",
+                });
+            }
+            throw new BasecampError("api_error", message, {
+                httpStatus: response.status,
+            });
+        }
+        // Parse successful response
+        const tokenData = data;
+        if (!tokenData.access_token) {
+            throw new BasecampError("api_error", "Token response missing access_token");
+        }
+        return {
+            accessToken: tokenData.access_token,
+            refreshToken: tokenData.refresh_token,
+            tokenType: tokenData.token_type || "Bearer",
+            expiresIn: tokenData.expires_in,
+            expiresAt: tokenData.expires_in
+                ? new Date(Date.now() + tokenData.expires_in * 1000)
+                : undefined,
+            scope: tokenData.scope,
+        };
+    }
+    catch (err) {
+        if (err instanceof BasecampError) {
+            throw err;
+        }
+        if (err instanceof Error) {
+            if (err.name === "AbortError") {
+                throw new BasecampError("network", "Token request timed out", {
+                    cause: err,
+                    retryable: true,
+                });
+            }
+            throw new BasecampError("network", `Token request failed: ${err.message}`, {
+                cause: err,
+                retryable: true,
+            });
+        }
+        throw new BasecampError("network", "Token request failed with unknown error", {
+            retryable: true,
+        });
+    }
+    finally {
+        clearTimeout(timeoutId);
+    }
+}
+/**
+ * Checks if a token is expired or about to expire.
+ *
+ * @param token - The token to check
+ * @param bufferSeconds - Buffer time before actual expiration (default: 60)
+ * @returns true if the token is expired or will expire within the buffer time
+ *
+ * @example
+ * ```ts
+ * if (isTokenExpired(token)) {
+ *   token = await refreshToken({ ... });
+ * }
+ * ```
+ */
+export function isTokenExpired(token, bufferSeconds = 60) {
+    if (!token.expiresAt) {
+        // No expiration info - assume not expired
+        return false;
+    }
+    const bufferMs = bufferSeconds * 1000;
+    return Date.now() + bufferMs >= token.expiresAt.getTime();
+}
+//# sourceMappingURL=exchange.js.map

package/dist/oauth/exchange.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exchange.js","sourceRoot":"","sources":["../../src/oauth/exchange.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAmB7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAwB,EACxB,UAAwB,EAAE;IAE1B,2BAA2B;IAC3B,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,4BAA4B,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,gCAAgC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,0BAA0B,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,uBAAuB,CAAC,CAAC;IACjE,CAAC;IAED,qBAAqB;IACrB,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IAEnC,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,+CAA+C;QAC/C,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,qBAAqB;QACrB,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAExC,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,cAAc,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAuB,EACvB,UAAwB,EAAE;IAE1B,2BAA2B;IAC3B,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,4BAA4B,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,2BAA2B,CAAC,CAAC;IACrE,CAAC;IAED,qBAAqB;IACrB,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IAEnC,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,+CAA+C;QAC/C,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC9B,CAAC;SAAM,CAAC;QACN,qBAAqB;QACrB,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAEhD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,cAAc,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,GAAW,EAAE,KAAa;IAC9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,GAAG,KAAK,oBAAoB,GAAG,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa;YAAE,MAAM,GAAG,CAAC;QAC5C,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,WAAW,KAAK,KAAK,GAAG,EAAE,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,MAAqB;IAC/C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpC,mDAAmD;IACnD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,sEAAsE;IACtE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,yBAAyB,CACtC,QAAkB,EAClB,QAAgB,EAChB,UAAkB;IAElB,yEAAyE;IACzE,MAAM,kBAAkB,GAAG,kBAAkB,CAC3C,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CACvC,CAAC;IAEF,oDAAoD;IACpD,IAAI,kBAAkB,KAAK,IAAI,IAAI,kBAAkB,GAAG,QAAQ,EAAE,CAAC;QACjE,MAAM,IAAI,aAAa,CACrB,WAAW,EACX,6CAA6C,kBAAkB,eAAe,QAAQ,GAAG,EACzF,EAAE,UAAU,EAAE,CACf,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,wFAAwF;QACxF,yDAAyD;QACzD,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;YAChC,MAAM,IAAI,aAAa,CACrB,WAAW,EACX,6FAA6F,EAC7F,EAAE,UAAU,EAAE,CACf,CAAC;QACJ,CAAC;QACD,2DAA2D;QAC3D,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,4BAA4B;IAC5B,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAEhB,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC;YAC3B,IAAI,UAAU,GAAG,QAAQ,EAAE,CAAC;gBAC1B,MAAM,CAAC,MAAM,EAAE,CAAC;gBAChB,MAAM,IAAI,aAAa,CACrB,WAAW,EACX,6BAA6B,UAAU,gBAAgB,QAAQ,GAAG,EAClE,EAAE,UAAU,EAAE,CACf,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAED,yBAAyB;IACzB,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;IACzB,CAAC;IAED,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,cAAc,CAC3B,aAAqB,EACrB,IAAqB,EACrB,OAAqB;IAErB,YAAY,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IAE9C,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IAE7E,sCAAsC;IACtC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAElE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,aAAa,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YACrB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QAEH,MAAM,wBAAwB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO;QAEzD,+DAA+D;QAC/D,mEAAmE;QACnE,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAClD,QAAQ,EACR,wBAAwB,EACxB,QAAQ,CAAC,MAAM,CAChB,CAAC;QAEF,IAAI,IAA2C,CAAC;QAEhD,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;YAC3E,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC;YAChG,MAAM,IAAI,aAAa,CACrB,WAAW,EACX,mCAAmC,SAAS,EAAE,EAC9C,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,CAChC,CAAC;QACJ,CAAC;QAED,2BAA2B;QAC3B,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,IAA0B,CAAC;YAC7C,MAAM,UAAU,GAAG,SAAS,CAAC,iBAAiB,IAAI,SAAS,CAAC,KAAK,IAAI,sBAAsB,CAAC;YAC5F,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;YAExF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;gBACnE,MAAM,IAAI,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE;oBACvC,UAAU,EAAE,QAAQ,CAAC,MAAM;oBAC3B,IAAI,EAAE,mEAAmE;iBAC1E,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,OAAO,EAAE;gBAC5C,UAAU,EAAE,QAAQ,CAAC,MAAM;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,4BAA4B;QAC5B,MAAM,SAAS,GAAG,IAAwB,CAAC;QAE3C,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;YAC5B,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,qCAAqC,CAAC,CAAC;QAC9E,CAAC;QAED,OAAO;YACL,WAAW,EAAE,SAAS,CAAC,YAAY;YACnC,YAAY,EAAE,SAAS,CAAC,aAAa;YACrC,SAAS,EAAE,SAAS,CAAC,UAAU,IAAI,QAAQ;YAC3C,SAAS,EAAE,SAAS,CAAC,UAAU;YAC/B,SAAS,EAAE,SAAS,CAAC,UAAU;gBAC7B,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,UAAU,GAAG,IAAI,CAAC;gBACpD,CAAC,CAAC,SAAS;YACb,KAAK,EAAE,SAAS,CAAC,KAAK;SACvB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;YACzB,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC9B,MAAM,IAAI,aAAa,CAAC,SAAS,EAAE,yBAAyB,EAAE;oBAC5D,KAAK,EAAE,GAAG;oBACV,SAAS,EAAE,IAAI;iBAChB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,aAAa,CAAC,SAAS,EAAE,yBAAyB,GAAG,CAAC,OAAO,EAAE,EAAE;gBACzE,KAAK,EAAE,GAAG;gBACV,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,aAAa,CAAC,SAAS,EAAE,yCAAyC,EAAE;YAC5E,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,KAAiB,EAAE,aAAa,GAAG,EAAE;IAClE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACrB,0CAA0C;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,GAAG,IAAI,CAAC;IACtC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;AAC5D,CAAC"}

package/dist/oauth/identity.d.ts

@@ -0,0 +1,30 @@
+/**
+ * OAuth identity discovery for Basecamp SDK.
+ *
+ * Fetches authorization information (identity and accounts) from
+ * the Launchpad endpoint without requiring a full client instance.
+ */
+import type { TokenProvider } from "../client.js";
+import type { AuthorizationInfo } from "../services/authorization.js";
+/**
+ * Fetches authorization information using an access token.
+ *
+ * Calls the Launchpad authorization endpoint to retrieve the
+ * authenticated user's identity and list of accessible accounts.
+ * Does not require a full Basecamp client instance.
+ *
+ * @param accessToken - A token string or async function returning one
+ * @returns Authorization information including identity and accounts
+ * @throws BasecampError on network or auth errors
+ *
+ * @example
+ * ```ts
+ * const info = await discoverIdentity("my_access_token");
+ * console.log(info.identity.firstName, info.identity.lastName);
+ * for (const account of info.accounts) {
+ *   console.log(`${account.name} (${account.product})`);
+ * }
+ * ```
+ */
+export declare function discoverIdentity(accessToken: TokenProvider): Promise<AuthorizationInfo>;
+//# sourceMappingURL=identity.d.ts.map

package/dist/oauth/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/oauth/identity.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AA2BtE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,gBAAgB,CAAC,WAAW,EAAE,aAAa,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAsD7F"}

package/dist/oauth/identity.js

@@ -0,0 +1,82 @@
+/**
+ * OAuth identity discovery for Basecamp SDK.
+ *
+ * Fetches authorization information (identity and accounts) from
+ * the Launchpad endpoint without requiring a full client instance.
+ */
+import { BasecampError } from "../errors.js";
+const AUTHORIZATION_ENDPOINT = "https://launchpad.37signals.com/authorization.json";
+/**
+ * Fetches authorization information using an access token.
+ *
+ * Calls the Launchpad authorization endpoint to retrieve the
+ * authenticated user's identity and list of accessible accounts.
+ * Does not require a full Basecamp client instance.
+ *
+ * @param accessToken - A token string or async function returning one
+ * @returns Authorization information including identity and accounts
+ * @throws BasecampError on network or auth errors
+ *
+ * @example
+ * ```ts
+ * const info = await discoverIdentity("my_access_token");
+ * console.log(info.identity.firstName, info.identity.lastName);
+ * for (const account of info.accounts) {
+ *   console.log(`${account.name} (${account.product})`);
+ * }
+ * ```
+ */
+export async function discoverIdentity(accessToken) {
+    const token = typeof accessToken === "function" ? await accessToken() : accessToken;
+    let response;
+    try {
+        response = await fetch(AUTHORIZATION_ENDPOINT, {
+            method: "GET",
+            headers: {
+                Authorization: `Bearer ${token}`,
+                Accept: "application/json",
+            },
+        });
+    }
+    catch (err) {
+        throw new BasecampError("network", `Identity discovery failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (!response.ok) {
+        if (response.status === 401) {
+            throw new BasecampError("auth", "Invalid or expired access token", {
+                httpStatus: 401,
+                hint: "The access token may need to be refreshed",
+            });
+        }
+        throw new BasecampError("api_error", `Authorization endpoint returned ${response.status}`, {
+            httpStatus: response.status,
+        });
+    }
+    let raw;
+    try {
+        raw = (await response.json());
+    }
+    catch {
+        throw new BasecampError("api_error", "Identity discovery returned invalid JSON");
+    }
+    return {
+        expiresAt: new Date(raw.expires_at),
+        identity: {
+            id: raw.identity.id,
+            firstName: raw.identity.first_name,
+            lastName: raw.identity.last_name,
+            emailAddress: raw.identity.email_address,
+        },
+        accounts: raw.accounts.map((a) => ({
+            id: a.id,
+            name: a.name,
+            product: a.product,
+            href: a.href,
+            appHref: a.app_href ?? "",
+            hidden: a.hidden,
+            expired: a.expired,
+            featured: a.featured,
+        })),
+    };
+}
+//# sourceMappingURL=identity.js.map

package/dist/oauth/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/oauth/identity.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AA2B7C,MAAM,sBAAsB,GAAG,oDAAoD,CAAC;AAEpF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,WAA0B;IAC/D,MAAM,KAAK,GAAG,OAAO,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,WAAW,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;IAEpF,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,sBAAsB,EAAE;YAC7C,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,MAAM,EAAE,kBAAkB;aAC3B;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,aAAa,CAAC,SAAS,EAAE,8BAA8B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvH,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,aAAa,CAAC,MAAM,EAAE,iCAAiC,EAAE;gBACjE,UAAU,EAAE,GAAG;gBACf,IAAI,EAAE,2CAA2C;aAClD,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,mCAAmC,QAAQ,CAAC,MAAM,EAAE,EAAE;YACzF,UAAU,EAAE,QAAQ,CAAC,MAAM;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,IAAI,GAA6B,CAAC;IAClC,IAAI,CAAC;QACH,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA6B,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,0CAA0C,CAAC,CAAC;IACnF,CAAC;IAED,OAAO;QACL,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;QACnC,QAAQ,EAAE;YACR,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE;YACnB,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,UAAU;YAClC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS;YAChC,YAAY,EAAE,GAAG,CAAC,QAAQ,CAAC,aAAa;SACzC;QACD,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjC,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE;YACzB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;SACrB,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC"}

package/dist/oauth/index.d.ts

@@ -0,0 +1,50 @@
+/**
+ * OAuth 2.0 module for Basecamp SDK.
+ *
+ * Provides OAuth discovery, token exchange, and token refresh functionality.
+ * Supports both standard OAuth 2.0 and Basecamp's Launchpad legacy format.
+ *
+ * @example
+ * ```ts
+ * import { discover, exchangeCode, refreshToken, isTokenExpired } from "@basecamp/sdk/oauth";
+ *
+ * // 1. Discover OAuth configuration
+ * const config = await discover("https://launchpad.37signals.com");
+ *
+ * // 2. Exchange authorization code for tokens
+ * const token = await exchangeCode({
+ *   tokenEndpoint: config.tokenEndpoint,
+ *   code: "auth_code_from_callback",
+ *   redirectUri: "https://myapp.com/callback",
+ *   clientId: process.env.BASECAMP_CLIENT_ID!,
+ *   clientSecret: process.env.BASECAMP_CLIENT_SECRET!,
+ *   useLegacyFormat: true, // Required for Launchpad
+ * });
+ *
+ * // 3. Use the token
+ * const client = createBasecampClient({
+ *   accountId: "12345",
+ *   accessToken: token.accessToken,
+ * });
+ *
+ * // 4. Refresh when needed
+ * if (isTokenExpired(token)) {
+ *   const newToken = await refreshToken({
+ *     tokenEndpoint: config.tokenEndpoint,
+ *     refreshToken: token.refreshToken!,
+ *     useLegacyFormat: true,
+ *   });
+ * }
+ * ```
+ */
+export type { OAuthConfig, OAuthToken, ExchangeRequest, RefreshRequest, RawTokenResponse, OAuthErrorResponse, } from "./types.js";
+export { discover, discoverLaunchpad, LAUNCHPAD_BASE_URL, type DiscoverOptions, } from "./discovery.js";
+export { exchangeCode, refreshToken, isTokenExpired, type TokenOptions, } from "./exchange.js";
+export { generatePKCE, generateState, type PKCE, } from "./pkce.js";
+export { buildAuthorizationUrl, type AuthorizeParams, } from "./authorize.js";
+export { FileTokenStore, type TokenStore, } from "./token-store.js";
+export { TokenManager, type TokenManagerOptions, } from "./token-manager.js";
+export { startCallbackServer, type CallbackResult, type CallbackServerOptions, } from "./callback-server.js";
+export { performInteractiveLogin, type InteractiveLoginOptions, } from "./interactive-login.js";
+export { discoverIdentity, } from "./identity.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/oauth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAGH,YAAY,EACV,WAAW,EACX,UAAU,EACV,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,QAAQ,EACR,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,KAAK,YAAY,GAClB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,KAAK,IAAI,GACV,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,qBAAqB,EACrB,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,cAAc,EACd,KAAK,UAAU,GAChB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,YAAY,EACZ,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,qBAAqB,GAC3B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,uBAAuB,EACvB,KAAK,uBAAuB,GAC7B,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,gBAAgB,GACjB,MAAM,eAAe,CAAC"}

package/dist/oauth/index.js

@@ -0,0 +1,58 @@
+/**
+ * OAuth 2.0 module for Basecamp SDK.
+ *
+ * Provides OAuth discovery, token exchange, and token refresh functionality.
+ * Supports both standard OAuth 2.0 and Basecamp's Launchpad legacy format.
+ *
+ * @example
+ * ```ts
+ * import { discover, exchangeCode, refreshToken, isTokenExpired } from "@basecamp/sdk/oauth";
+ *
+ * // 1. Discover OAuth configuration
+ * const config = await discover("https://launchpad.37signals.com");
+ *
+ * // 2. Exchange authorization code for tokens
+ * const token = await exchangeCode({
+ *   tokenEndpoint: config.tokenEndpoint,
+ *   code: "auth_code_from_callback",
+ *   redirectUri: "https://myapp.com/callback",
+ *   clientId: process.env.BASECAMP_CLIENT_ID!,
+ *   clientSecret: process.env.BASECAMP_CLIENT_SECRET!,
+ *   useLegacyFormat: true, // Required for Launchpad
+ * });
+ *
+ * // 3. Use the token
+ * const client = createBasecampClient({
+ *   accountId: "12345",
+ *   accessToken: token.accessToken,
+ * });
+ *
+ * // 4. Refresh when needed
+ * if (isTokenExpired(token)) {
+ *   const newToken = await refreshToken({
+ *     tokenEndpoint: config.tokenEndpoint,
+ *     refreshToken: token.refreshToken!,
+ *     useLegacyFormat: true,
+ *   });
+ * }
+ * ```
+ */
+// Discovery
+export { discover, discoverLaunchpad, LAUNCHPAD_BASE_URL, } from "./discovery.js";
+// Token exchange
+export { exchangeCode, refreshToken, isTokenExpired, } from "./exchange.js";
+// PKCE utilities
+export { generatePKCE, generateState, } from "./pkce.js";
+// Authorization URL
+export { buildAuthorizationUrl, } from "./authorize.js";
+// Token store
+export { FileTokenStore, } from "./token-store.js";
+// Token manager
+export { TokenManager, } from "./token-manager.js";
+// Callback server
+export { startCallbackServer, } from "./callback-server.js";
+// Interactive login
+export { performInteractiveLogin, } from "./interactive-login.js";
+// Identity
+export { discoverIdentity, } from "./identity.js";
+//# sourceMappingURL=index.js.map

package/dist/oauth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAYH,YAAY;AACZ,OAAO,EACL,QAAQ,EACR,iBAAiB,EACjB,kBAAkB,GAEnB,MAAM,gBAAgB,CAAC;AAExB,iBAAiB;AACjB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,cAAc,GAEf,MAAM,eAAe,CAAC;AAEvB,iBAAiB;AACjB,OAAO,EACL,YAAY,EACZ,aAAa,GAEd,MAAM,WAAW,CAAC;AAEnB,oBAAoB;AACpB,OAAO,EACL,qBAAqB,GAEtB,MAAM,gBAAgB,CAAC;AAExB,cAAc;AACd,OAAO,EACL,cAAc,GAEf,MAAM,kBAAkB,CAAC;AAE1B,gBAAgB;AAChB,OAAO,EACL,YAAY,GAEb,MAAM,oBAAoB,CAAC;AAE5B,kBAAkB;AAClB,OAAO,EACL,mBAAmB,GAGpB,MAAM,sBAAsB,CAAC;AAE9B,oBAAoB;AACpB,OAAO,EACL,uBAAuB,GAExB,MAAM,wBAAwB,CAAC;AAEhC,WAAW;AACX,OAAO,EACL,gBAAgB,GACjB,MAAM,eAAe,CAAC"}

package/dist/oauth/interactive-login.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Interactive OAuth login flow for CLI and desktop applications.
+ *
+ * Orchestrates the full OAuth 2.0 authorization code flow:
+ * discovery, PKCE, local callback server, browser launch, code exchange.
+ */
+import type { TokenStore } from "./token-store.js";
+import type { OAuthToken } from "./types.js";
+/**
+ * Options for the interactive login flow.
+ */
+export interface InteractiveLoginOptions {
+    /** The client identifier */
+    clientId: string;
+    /** The client secret (optional for public clients) */
+    clientSecret?: string;
+    /** Token store for persisting the resulting token */
+    store: TokenStore;
+    /** OAuth server base URL (defaults to Launchpad) */
+    baseUrl?: string;
+    /** Use Launchpad's non-standard token format (default: true) */
+    useLegacyFormat?: boolean;
+    /** Port for the local callback server (optional) */
+    callbackPort?: number;
+    /** Function to open the authorization URL in a browser */
+    openBrowser: (url: string) => Promise<void>;
+    /** Fallback for when browser launch fails — prompt user to visit URL manually */
+    promptForManualVisit?: (authUrl: string) => Promise<void>;
+    /** Status callback for progress messages */
+    onStatus?: (message: string) => void;
+}
+/**
+ * Performs the full interactive OAuth login flow.
+ *
+ * Steps:
+ * 1. Discover OAuth endpoints
+ * 2. Generate PKCE and state parameters
+ * 3. Start local callback server
+ * 4. Build authorization URL and open browser
+ * 5. Wait for callback with authorization code
+ * 6. Exchange code for tokens
+ * 7. Save token to store
+ *
+ * @param options - Login flow configuration
+ * @returns The resulting OAuth token
+ * @throws BasecampError on any flow failure
+ *
+ * @example
+ * ```ts
+ * import open from "open"; // or use child_process
+ *
+ * const token = await performInteractiveLogin({
+ *   clientId: process.env.BASECAMP_CLIENT_ID!,
+ *   clientSecret: process.env.BASECAMP_CLIENT_SECRET!,
+ *   store: new FileTokenStore("~/.config/basecamp/tokens.json"),
+ *   openBrowser: (url) => open(url),
+ *   onStatus: (msg) => console.log(msg),
+ * });
+ * ```
+ */
+export declare function performInteractiveLogin(options: InteractiveLoginOptions): Promise<OAuthToken>;
+//# sourceMappingURL=interactive-login.d.ts.map

package/dist/oauth/interactive-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interactive-login.d.ts","sourceRoot":"","sources":["../../src/oauth/interactive-login.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAG7C;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,4BAA4B;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,KAAK,EAAE,UAAU,CAAC;IAClB,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,oDAAoD;IACpD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0DAA0D;IAC1D,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,iFAAiF;IACjF,oBAAoB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,UAAU,CAAC,CAgFrB"}