@agent-native/core 0.105.0 → 0.106.0

package/dist/provider-api/index.js

@@ -320,8 +320,10 @@ const PROVIDER_CONFIGS = {
         label: "GitHub REST API",
         defaultBaseUrl: "https://api.github.com",
         auth: {
-            type: "bearer",
-            keys: ["GITHUB_TOKEN"],
+            type: "oauth-bearer-or-bearer-key",
+            oauthProvider: "github",
+            tokenLabel: "GitHub OAuth token",
+            key: "GITHUB_TOKEN",
             workspaceProvider: "github",
         },
         credentialKeys: ["GITHUB_TOKEN"],
@@ -632,8 +634,11 @@ const PROVIDER_CONFIGS = {
         label: "HubSpot",
         defaultBaseUrl: "https://api.hubapi.com",
         auth: {
-            type: "bearer",
-            keys: ["HUBSPOT_PRIVATE_APP_TOKEN", "HUBSPOT_ACCESS_TOKEN"],
+            type: "oauth-bearer-or-bearer-key",
+            oauthProvider: "hubspot",
+            tokenLabel: "HubSpot OAuth token",
+            key: "HUBSPOT_PRIVATE_APP_TOKEN",
+            fallbackKeys: ["HUBSPOT_PRIVATE_APP_TOKEN", "HUBSPOT_ACCESS_TOKEN"],
             workspaceProvider: "hubspot",
         },
         credentialKeys: ["HUBSPOT_PRIVATE_APP_TOKEN", "HUBSPOT_ACCESS_TOKEN"],
@@ -673,9 +678,12 @@ const PROVIDER_CONFIGS = {
         defaultBaseUrl: "https://example.atlassian.net",
         baseUrlCredentialKey: "JIRA_BASE_URL",
         auth: {
-            type: "basic",
+            type: "oauth-bearer-or-basic",
+            oauthProvider: "jira",
+            tokenLabel: "Jira",
             usernameKey: "JIRA_USER_EMAIL",
             passwordKey: "JIRA_API_TOKEN",
+            workspaceProvider: "jira",
         },
         credentialKeys: ["JIRA_BASE_URL", "JIRA_USER_EMAIL", "JIRA_API_TOKEN"],
         docsUrls: [
@@ -807,8 +815,12 @@ const PROVIDER_CONFIGS = {
         label: "Sentry",
         defaultBaseUrl: "https://sentry.io/api/0",
         auth: {
-            type: "bearer",
-            keys: ["SENTRY_AUTH_TOKEN", "SENTRY_SERVER_TOKEN"],
+            type: "oauth-bearer-or-bearer-key",
+            oauthProvider: "sentry",
+            tokenLabel: "Sentry OAuth token",
+            key: "SENTRY_AUTH_TOKEN",
+            fallbackKeys: ["SENTRY_AUTH_TOKEN", "SENTRY_SERVER_TOKEN"],
+            workspaceProvider: "sentry",
         },
         credentialKeys: [
             "SENTRY_AUTH_TOKEN",
@@ -939,6 +951,7 @@ export function createProviderApiRuntime(options) {
         listCatalog: (provider) => listProviderApiCatalogWithCustom(provider, { providerIds }, runtimeOptions),
         fetchDocs: (docsOptions) => fetchProviderApiDocs(docsOptions, runtimeOptions),
         executeRequest: (args) => executeProviderApiRequest(args, runtimeOptions),
+        resolveOAuthAccessToken: (args) => resolveProviderApiOAuthAccessToken(args, runtimeOptions),
         listGitHubRepositoryFiles: (args) => listGitHubRepositoryFiles(args, runtimeOptions),
         searchGitHubRepositoryFiles: (args) => searchGitHubRepositoryFiles(args, runtimeOptions),
         readGitHubRepositoryFile: (args) => readGitHubRepositoryFile(args, runtimeOptions),
@@ -1201,24 +1214,45 @@ export async function resolveProviderApiOAuthAccessToken(args, runtime) {
     await assertProviderAllowedAsync(args.provider, runtime);
     const config = getProviderApiConfig(args.provider);
     const auth = config.auth;
-    if (auth.type !== "oauth-bearer") {
+    const oauthAuth = auth.type === "oauth-bearer"
+        ? auth
+        : auth.type === "oauth-bearer-or-api-key-header" ||
+            auth.type === "oauth-bearer-or-bearer-key"
+            ? {
+                type: "oauth-bearer",
+                oauthProvider: auth.oauthProvider,
+                tokenLabel: auth.tokenLabel,
+                workspaceProvider: auth.workspaceProvider,
+            }
+            : auth.type === "oauth-bearer-or-basic"
+                ? {
+                    type: "oauth-bearer",
+                    oauthProvider: auth.oauthProvider,
+                    tokenLabel: auth.tokenLabel,
+                    workspaceProvider: auth.workspaceProvider,
+                }
+                : null;
+    if (!oauthAuth) {
         throw new Error(`Provider API ${args.provider} does not use a direct OAuth bearer token.`);
     }
     const ctx = requireRuntimeCredentialContext(runtime, config.credentialKeys[0] ?? config.id);
-    const credential = auth.workspaceProvider && args.connectionId
-        ? await resolveConnectionBoundOAuthBearerToken({
-            auth,
+    const credential = oauthAuth.workspaceProvider
+        ? await resolveOptionalConnectionBoundOAuthBearerToken({
+            auth: oauthAuth,
             runtime,
             ctx,
-            workspaceProvider: auth.workspaceProvider,
+            workspaceProvider: oauthAuth.workspaceProvider,
             connectionId: args.connectionId,
             accountId: args.accountId,
         })
         : await resolveOAuthBearerToken({
-            auth,
+            auth: oauthAuth,
             ctx,
             accountId: args.accountId,
         });
+    if (!credential) {
+        throw new Error(`${oauthAuth.tokenLabel} workspace connection is not available to ${runtime.appId}.`);
+    }
     return {
         accessToken: credential.value,
         accountId: credential.accountId ?? null,
@@ -2184,10 +2218,13 @@ function describeAuth(auth) {
     if (auth.type === "oauth-bearer")
         return `oauth-bearer:${auth.oauthProvider}`;
     if (auth.type === "oauth-bearer-or-api-key-header") {
-        return `oauth-bearer:${auth.oauthProvider}-or-api-key-header:${auth.header}`;
+        return `oauth-bearer:${auth.oauthProvider}-or-api-key-header:${auth.header}:${(auth.fallbackKeys ?? [auth.key]).join(",")}`;
     }
     if (auth.type === "oauth-bearer-or-bearer-key") {
-        return `oauth-bearer:${auth.oauthProvider}-or-bearer-key:${auth.key}`;
+        return `oauth-bearer:${auth.oauthProvider}-or-bearer-key:${(auth.fallbackKeys ?? [auth.key]).join(",")}`;
+    }
+    if (auth.type === "oauth-bearer-or-basic") {
+        return `oauth-bearer:${auth.oauthProvider}-or-basic:${auth.usernameKey}:${auth.passwordKey}`;
     }
     return "prometheus-basic-or-bearer";
 }
@@ -2199,17 +2236,64 @@ function requireRuntimeCredentialContext(runtime, credentialKey) {
     return ctx;
 }
 async function resolveBaseUrl(config, runtime, ctx, args) {
+    const oauthBaseUrl = await resolveWorkspaceOAuthBaseUrl(config, runtime, args);
+    if (oauthBaseUrl)
+        return oauthBaseUrl;
     if (!config.baseUrlCredentialKey)
         return config.defaultBaseUrl;
+    const auth = config.auth;
+    const workspaceProvider = auth.type === "oauth-bearer" ||
+        auth.type === "oauth-bearer-or-api-key-header" ||
+        auth.type === "oauth-bearer-or-bearer-key" ||
+        auth.type === "oauth-bearer-or-basic"
+        ? auth.workspaceProvider
+        : undefined;
     const configured = await resolveCredentialValue({
         config,
         runtime,
         ctx,
         key: config.baseUrlCredentialKey,
         args,
+        workspaceProvider,
     });
     return (configured || config.defaultBaseUrl).replace(/\/+$/, "");
 }
+async function resolveWorkspaceOAuthBaseUrl(config, runtime, args) {
+    const auth = config.auth;
+    const workspaceProvider = auth.type === "oauth-bearer" ||
+        auth.type === "oauth-bearer-or-api-key-header" ||
+        auth.type === "oauth-bearer-or-bearer-key" ||
+        auth.type === "oauth-bearer-or-basic"
+        ? auth.workspaceProvider
+        : undefined;
+    if (workspaceProvider !== "jira")
+        return null;
+    let resolved;
+    try {
+        resolved = await resolveWorkspaceConnectionForApp({
+            appId: runtime.appId,
+            provider: workspaceProvider,
+            connectionId: args.connectionId ?? undefined,
+            requireConnected: true,
+        });
+    }
+    catch (error) {
+        if (error instanceof Error &&
+            error.message === "Workspace connections require an authenticated user.") {
+            return null;
+        }
+        throw error;
+    }
+    if (!resolved.available || !resolved.connection)
+        return null;
+    const connectionConfig = resolved.connection.config;
+    if (connectionConfig.credentialMode !== "oauth")
+        return null;
+    const baseUrl = connectionConfig.atlassianApiBaseUrl;
+    if (typeof baseUrl !== "string" || !baseUrl.trim())
+        return null;
+    return baseUrl.replace(/\/+$/, "");
+}
 async function resolvePlaceholders(config, runtime, ctx, args) {
     const placeholders = {};
     for (const placeholder of config.placeholders ?? []) {
@@ -2440,29 +2524,63 @@ async function resolveAuth(config, runtime, ctx, args) {
         };
     }
     if (auth.type === "oauth-bearer-or-api-key-header") {
-        if (args.connectionId) {
-            const credential = await resolveConnectionBoundOAuthBearerToken({
-                auth: {
-                    type: "oauth-bearer",
-                    oauthProvider: auth.oauthProvider,
-                    tokenLabel: auth.tokenLabel,
-                },
+        const explicitConnectionFallback = Boolean(args.connectionId?.trim()) && Boolean(runtime.resolveCredential);
+        const resolvedFallback = explicitConnectionFallback
+            ? await resolveHybridFallbackCredential({
+                auth,
+                config,
                 runtime,
                 ctx,
-                connectionId: args.connectionId,
-                accountId: args.accountId,
-                workspaceProvider: auth.workspaceProvider,
-            });
+                args,
+            })
+            : null;
+        if (resolvedFallback) {
             return {
-                headers: { Authorization: `Bearer ${credential.value}` },
-                credentialSources: [omitCredentialValue(credential)],
-                secretValues: [credential.value],
+                headers: { [auth.header]: resolvedFallback.value },
+                credentialSources: [omitCredentialValue(resolvedFallback)],
+                secretValues: [resolvedFallback.value],
             };
         }
-        const credential = await resolveRequiredCredential({
+        const workspaceCredential = await resolveOptionalConnectionBoundOAuthBearerToken({
+            auth: {
+                type: "oauth-bearer",
+                oauthProvider: auth.oauthProvider,
+                tokenLabel: auth.tokenLabel,
+            },
+            runtime,
+            ctx,
+            connectionId: args.connectionId,
+            accountId: args.accountId,
+            workspaceProvider: auth.workspaceProvider,
+            allowUnbound: true,
+        });
+        if (workspaceCredential) {
+            return {
+                headers: { Authorization: `Bearer ${workspaceCredential.value}` },
+                credentialSources: [omitCredentialValue(workspaceCredential)],
+                secretValues: [workspaceCredential.value],
+            };
+        }
+        if (!explicitConnectionFallback) {
+            const resolvedFallback = await resolveHybridFallbackCredential({
+                auth,
+                config,
+                runtime,
+                ctx,
+                args,
+            });
+            if (resolvedFallback) {
+                return {
+                    headers: { [auth.header]: resolvedFallback.value },
+                    credentialSources: [omitCredentialValue(resolvedFallback)],
+                    secretValues: [resolvedFallback.value],
+                };
+            }
+        }
+        const credential = await resolveAnyCredential({
             provider: config.id,
             workspaceProvider: auth.workspaceProvider,
-            key: auth.key,
+            keys: auth.fallbackKeys ?? [auth.key],
             ctx,
             runtime,
         });
@@ -2473,29 +2591,63 @@ async function resolveAuth(config, runtime, ctx, args) {
         };
     }
     if (auth.type === "oauth-bearer-or-bearer-key") {
-        if (args.connectionId) {
-            const credential = await resolveConnectionBoundOAuthBearerToken({
-                auth: {
-                    type: "oauth-bearer",
-                    oauthProvider: auth.oauthProvider,
-                    tokenLabel: auth.tokenLabel,
-                },
+        const explicitConnectionFallback = Boolean(args.connectionId?.trim()) && Boolean(runtime.resolveCredential);
+        const resolvedFallback = explicitConnectionFallback
+            ? await resolveHybridFallbackCredential({
+                auth,
+                config,
                 runtime,
                 ctx,
-                connectionId: args.connectionId,
-                accountId: args.accountId,
-                workspaceProvider: auth.workspaceProvider,
-            });
+                args,
+            })
+            : null;
+        if (resolvedFallback) {
             return {
-                headers: { Authorization: `Bearer ${credential.value}` },
-                credentialSources: [omitCredentialValue(credential)],
-                secretValues: [credential.value],
+                headers: { Authorization: `Bearer ${resolvedFallback.value}` },
+                credentialSources: [omitCredentialValue(resolvedFallback)],
+                secretValues: [resolvedFallback.value],
             };
         }
-        const credential = await resolveRequiredCredential({
+        const workspaceCredential = await resolveOptionalConnectionBoundOAuthBearerToken({
+            auth: {
+                type: "oauth-bearer",
+                oauthProvider: auth.oauthProvider,
+                tokenLabel: auth.tokenLabel,
+            },
+            runtime,
+            ctx,
+            connectionId: args.connectionId,
+            accountId: args.accountId,
+            workspaceProvider: auth.workspaceProvider,
+            allowUnbound: true,
+        });
+        if (workspaceCredential) {
+            return {
+                headers: { Authorization: `Bearer ${workspaceCredential.value}` },
+                credentialSources: [omitCredentialValue(workspaceCredential)],
+                secretValues: [workspaceCredential.value],
+            };
+        }
+        if (!explicitConnectionFallback) {
+            const resolvedFallback = await resolveHybridFallbackCredential({
+                auth,
+                config,
+                runtime,
+                ctx,
+                args,
+            });
+            if (resolvedFallback) {
+                return {
+                    headers: { Authorization: `Bearer ${resolvedFallback.value}` },
+                    credentialSources: [omitCredentialValue(resolvedFallback)],
+                    secretValues: [resolvedFallback.value],
+                };
+            }
+        }
+        const credential = await resolveAnyCredential({
             provider: config.id,
             workspaceProvider: auth.workspaceProvider,
-            key: auth.key,
+            keys: auth.fallbackKeys ?? [auth.key],
             ctx,
             runtime,
         });
@@ -2505,6 +2657,53 @@ async function resolveAuth(config, runtime, ctx, args) {
             secretValues: [credential.value],
         };
     }
+    if (auth.type === "oauth-bearer-or-basic") {
+        const workspaceCredential = await resolveOptionalConnectionBoundOAuthBearerToken({
+            auth: {
+                type: "oauth-bearer",
+                oauthProvider: auth.oauthProvider,
+                tokenLabel: auth.tokenLabel,
+            },
+            runtime,
+            ctx,
+            connectionId: args.connectionId,
+            accountId: args.accountId,
+            workspaceProvider: auth.workspaceProvider,
+            allowUnbound: true,
+        });
+        if (workspaceCredential) {
+            return {
+                headers: { Authorization: `Bearer ${workspaceCredential.value}` },
+                credentialSources: [omitCredentialValue(workspaceCredential)],
+                secretValues: [workspaceCredential.value],
+            };
+        }
+        const username = await resolveRequiredCredential({
+            provider: config.id,
+            workspaceProvider: auth.workspaceProvider,
+            key: auth.usernameKey,
+            ctx,
+            runtime,
+            connectionId: args.connectionId,
+        });
+        const password = await resolveRequiredCredential({
+            provider: config.id,
+            workspaceProvider: auth.workspaceProvider,
+            key: auth.passwordKey,
+            ctx,
+            runtime,
+            connectionId: args.connectionId,
+        });
+        const encoded = Buffer.from(`${username.value}:${password.value}`).toString("base64");
+        return {
+            headers: { Authorization: `Basic ${encoded}` },
+            credentialSources: [
+                omitCredentialValue(username),
+                omitCredentialValue(password),
+            ],
+            secretValues: [username.value, password.value, encoded],
+        };
+    }
     const bearer = await resolveCredentialValue({
         config,
         runtime,
@@ -2563,6 +2762,20 @@ async function resolveAuth(config, runtime, ctx, args) {
 function emptyAuth() {
     return { headers: {}, credentialSources: [], secretValues: [] };
 }
+async function resolveHybridFallbackCredential(options) {
+    // App-specific resolvers keep existing provider credentials working when a
+    // caller explicitly selects a connection or account.
+    if (!options.runtime.resolveCredential)
+        return null;
+    return resolveOptionalCredential({
+        provider: options.config.id,
+        workspaceProvider: options.auth.workspaceProvider,
+        key: options.auth.key,
+        ctx: options.ctx,
+        runtime: options.runtime,
+        connectionId: options.args.connectionId,
+    });
+}
 async function resolveAnyCredential(options) {
     for (const key of options.keys) {
         const credential = await resolveOptionalCredential({ ...options, key });
@@ -2653,22 +2866,23 @@ async function getGoogleServiceAccountToken(scopes, runtime, ctx) {
     return data.access_token;
 }
 async function resolveOAuthBearerToken(options) {
-    const accounts = await listOAuthAccountsByOwner(options.auth.oauthProvider, options.ctx.userEmail);
+    const ownerEmail = options.ownerEmail?.trim() || options.ctx.userEmail;
+    const accounts = await listOAuthAccountsByOwner(options.auth.oauthProvider, ownerEmail);
     if (accounts.length === 0) {
-        throw new Error(`${options.auth.tokenLabel} is not connected for ${options.ctx.userEmail}.`);
+        throw new Error(`${options.auth.tokenLabel} is not connected for ${ownerEmail}.`);
     }
     const accountId = options.accountId?.trim();
     const account = accountId
         ? accounts.find((entry) => entry.accountId === accountId)
         : accounts[0];
     if (!account) {
-        throw new Error(`${options.auth.tokenLabel} account ${accountId} is not available to ${options.ctx.userEmail}.`);
+        throw new Error(`${options.auth.tokenLabel} account ${accountId} is not available to ${ownerEmail}.`);
     }
     const tokens = account.tokens;
     const token = await getValidOAuthAccessToken({
         oauthProvider: options.auth.oauthProvider,
         accountId: account.accountId,
-        ownerEmail: options.ctx.userEmail,
+        ownerEmail,
         tokens,
     });
     return {
@@ -2681,22 +2895,39 @@ async function resolveOAuthBearerToken(options) {
     };
 }
 async function resolveConnectionBoundOAuthBearerToken(options) {
+    const credential = await resolveOptionalConnectionBoundOAuthBearerToken(options);
+    if (credential)
+        return credential;
+    throw new Error(`${options.auth.tokenLabel} requires an available workspace connection.`);
+}
+async function resolveOptionalConnectionBoundOAuthBearerToken(options) {
     const requestedConnectionId = options.connectionId?.trim();
-    if (!requestedConnectionId) {
-        throw new Error(`${options.auth.tokenLabel} requires an explicit workspace connection selection.`);
+    let resolved;
+    try {
+        resolved = await resolveWorkspaceConnectionForApp({
+            appId: options.runtime.appId,
+            provider: options.workspaceProvider,
+            connectionId: requestedConnectionId,
+            requireConnected: true,
+        });
+    }
+    catch (error) {
+        if (error instanceof Error &&
+            error.message === "Workspace connections require an authenticated user.") {
+            return null;
+        }
+        throw error;
     }
-    const resolved = await resolveWorkspaceConnectionForApp({
-        appId: options.runtime.appId,
-        provider: options.workspaceProvider,
-        connectionId: requestedConnectionId,
-        requireConnected: true,
-    });
     if (!resolved.available || !resolved.connection) {
-        throw new Error(resolved.reason);
+        if (requestedConnectionId)
+            throw new Error(resolved.reason);
+        return null;
     }
     const connectionAccountId = resolved.connection.accountId?.trim();
     if (!connectionAccountId) {
-        throw new Error(`${options.auth.tokenLabel} workspace connection ${requestedConnectionId} is missing its OAuth account binding.`);
+        if (options.allowUnbound)
+            return null;
+        throw new Error(`${options.auth.tokenLabel} workspace connection ${resolved.connection.id} is missing its OAuth account binding.`);
     }
     const requestedAccountId = options.accountId?.trim();
     if (requestedAccountId && requestedAccountId !== connectionAccountId) {
@@ -2706,6 +2937,7 @@ async function resolveConnectionBoundOAuthBearerToken(options) {
         auth: options.auth,
         ctx: options.ctx,
         accountId: connectionAccountId,
+        ownerEmail: resolved.connection.ownerEmail,
     });
     return {
         ...credential,
@@ -2737,6 +2969,18 @@ async function getValidOAuthAccessToken(options) {
     if (options.oauthProvider === "notion") {
         return refreshNotionOAuthToken(options, refreshToken);
     }
+    if (options.oauthProvider === "github") {
+        return refreshGitHubOAuthToken(options, refreshToken);
+    }
+    if (options.oauthProvider === "hubspot") {
+        return refreshHubSpotOAuthToken(options, refreshToken);
+    }
+    if (options.oauthProvider === "jira") {
+        return refreshJiraOAuthToken(options, refreshToken);
+    }
+    if (options.oauthProvider === "sentry") {
+        return refreshSentryOAuthToken(options, refreshToken);
+    }
     throw new Error(`${options.oauthProvider} OAuth token is expired and automatic refresh is not configured for provider-api.`);
 }
 async function refreshFigmaOAuthToken(options, refreshToken) {
@@ -2804,6 +3048,179 @@ async function refreshNotionOAuthToken(options, refreshToken) {
     await saveOAuthTokens(options.oauthProvider, options.accountId, updated, options.ownerEmail);
     return data.access_token;
 }
+async function refreshGitHubOAuthToken(options, refreshToken) {
+    const credentials = await resolveOAuthClientCredentialCandidates("GITHUB");
+    if (!credentials.length) {
+        throw new Error("GITHUB_CLIENT_ID/SECRET not set for GitHub OAuth refresh.");
+    }
+    let response = null;
+    let data = {};
+    for (const credential of credentials) {
+        const result = await fetchBoundedOAuthRefreshJson("https://github.com/login/oauth/access_token", {
+            method: "POST",
+            headers: {
+                Accept: "application/json",
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+                client_id: credential.clientId,
+                client_secret: credential.clientSecret,
+                grant_type: "refresh_token",
+                refresh_token: refreshToken,
+            }),
+        }, "GitHub");
+        response = result.response;
+        data = result.data;
+        if (response.ok && data.access_token)
+            break;
+    }
+    if (!response?.ok || !data.access_token) {
+        throw new Error(`GitHub OAuth refresh failed (${response?.status ?? 0}).`);
+    }
+    const updated = {
+        ...options.tokens,
+        access_token: data.access_token,
+        refresh_token: data.refresh_token ?? refreshToken,
+        token_type: data.token_type ?? options.tokens.token_type,
+        ...(Number.isFinite(data.expires_in) && (data.expires_in ?? 0) > 0
+            ? { expiry_date: Date.now() + data.expires_in * 1_000 }
+            : {}),
+    };
+    await saveOAuthTokens(options.oauthProvider, options.accountId, updated, options.ownerEmail);
+    return data.access_token;
+}
+async function saveOAuthTokensAndLinkedJiraAccounts(options) {
+    const serializedTokens = options.updated;
+    await saveOAuthTokens(options.options.oauthProvider, options.options.accountId, serializedTokens, options.options.ownerEmail);
+    const accounts = await listOAuthAccountsByOwner(options.options.oauthProvider, options.options.ownerEmail);
+    for (const account of accounts) {
+        if (account.accountId === options.options.accountId)
+            continue;
+        const accountRefreshToken = account.tokens.refresh_token ??
+            account.tokens.refreshToken;
+        if (accountRefreshToken !== options.previousRefreshToken)
+            continue;
+        await saveOAuthTokens(options.options.oauthProvider, account.accountId, serializedTokens, options.options.ownerEmail);
+    }
+}
+async function refreshHubSpotOAuthToken(options, refreshToken) {
+    const credentials = await resolveOAuthClientCredentialCandidates("HUBSPOT");
+    if (!credentials.length) {
+        throw new Error("HUBSPOT_CLIENT_ID/SECRET not set for HubSpot OAuth refresh.");
+    }
+    let response = null;
+    let data = {};
+    for (const credential of credentials) {
+        const result = await fetchBoundedOAuthRefreshJson("https://api.hubapi.com/oauth/v3/token", {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                grant_type: "refresh_token",
+                client_id: credential.clientId,
+                client_secret: credential.clientSecret,
+                refresh_token: refreshToken,
+            }),
+        }, "HubSpot");
+        response = result.response;
+        data = result.data;
+        if (response.ok && data.access_token)
+            break;
+    }
+    if (!response?.ok || !data.access_token) {
+        throw new Error(`HubSpot OAuth refresh failed (${response?.status ?? 0}).`);
+    }
+    const updated = {
+        ...options.tokens,
+        access_token: data.access_token,
+        refresh_token: data.refresh_token ?? refreshToken,
+        token_type: data.token_type ?? options.tokens.token_type,
+        ...(Number.isFinite(data.expires_in) && (data.expires_in ?? 0) > 0
+            ? { expiry_date: Date.now() + data.expires_in * 1_000 }
+            : {}),
+    };
+    await saveOAuthTokens(options.oauthProvider, options.accountId, updated, options.ownerEmail);
+    return data.access_token;
+}
+async function refreshJiraOAuthToken(options, refreshToken) {
+    const credentials = await resolveOAuthClientCredentialCandidates("JIRA");
+    if (!credentials.length) {
+        throw new Error("JIRA_CLIENT_ID/SECRET not set for Jira OAuth refresh.");
+    }
+    let response = null;
+    let data = {};
+    for (const credential of credentials) {
+        const result = await fetchBoundedOAuthRefreshJson("https://auth.atlassian.com/oauth/token", {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                grant_type: "refresh_token",
+                client_id: credential.clientId,
+                client_secret: credential.clientSecret,
+                refresh_token: refreshToken,
+            }),
+        }, "Jira");
+        response = result.response;
+        data = result.data;
+        if (response.ok && data.access_token)
+            break;
+    }
+    if (!response?.ok || !data.access_token) {
+        throw new Error(`Jira OAuth refresh failed (${response?.status ?? 0}).`);
+    }
+    const updated = {
+        ...options.tokens,
+        access_token: data.access_token,
+        refresh_token: data.refresh_token ?? refreshToken,
+        token_type: data.token_type ?? options.tokens.token_type,
+        ...(Number.isFinite(data.expires_in) && (data.expires_in ?? 0) > 0
+            ? { expiry_date: Date.now() + data.expires_in * 1_000 }
+            : {}),
+    };
+    await saveOAuthTokensAndLinkedJiraAccounts({
+        options,
+        previousRefreshToken: refreshToken,
+        updated,
+    });
+    return data.access_token;
+}
+async function refreshSentryOAuthToken(options, refreshToken) {
+    const credentials = await resolveOAuthClientCredentialCandidates("SENTRY");
+    if (!credentials.length) {
+        throw new Error("SENTRY_CLIENT_ID/SECRET not set for Sentry OAuth refresh.");
+    }
+    let response = null;
+    let data = {};
+    for (const credential of credentials) {
+        const result = await fetchBoundedOAuthRefreshJson("https://sentry.io/oauth/token/", {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                grant_type: "refresh_token",
+                client_id: credential.clientId,
+                client_secret: credential.clientSecret,
+                refresh_token: refreshToken,
+            }),
+        }, "Sentry");
+        response = result.response;
+        data = result.data;
+        if (response.ok && data.access_token)
+            break;
+    }
+    if (!response?.ok || !data.access_token) {
+        throw new Error(`Sentry OAuth refresh failed (${response?.status ?? 0}).`);
+    }
+    const updated = {
+        ...options.tokens,
+        access_token: data.access_token,
+        refresh_token: data.refresh_token ?? refreshToken,
+        token_type: data.token_type ?? options.tokens.token_type,
+        ...(Number.isFinite(data.expires_in) && (data.expires_in ?? 0) > 0
+            ? { expiry_date: Date.now() + data.expires_in * 1_000 }
+            : {}),
+    };
+    await saveOAuthTokens(options.oauthProvider, options.accountId, updated, options.ownerEmail);
+    return data.access_token;
+}
 const OAUTH_REFRESH_TIMEOUT_MS = 10_000;
 const OAUTH_REFRESH_MAX_BYTES = 256 * 1024;
 async function fetchBoundedOAuthRefreshJson(url, init, providerLabel) {
@@ -2922,6 +3339,27 @@ function dedupeGoogleOAuthCredentials(candidates) {
         return true;
     });
 }
+async function resolveOAuthClientCredentialCandidates(provider) {
+    const [clientId, clientSecret, integrationClientId, integrationClientSecret] = await Promise.all([
+        resolveSecret(`${provider}_CLIENT_ID`),
+        resolveSecret(`${provider}_CLIENT_SECRET`),
+        resolveSecret(`${provider}_INTEGRATION_CLIENT_ID`),
+        resolveSecret(`${provider}_INTEGRATION_CLIENT_SECRET`),
+    ]);
+    const candidates = [
+        integrationClientId && integrationClientSecret
+            ? { clientId: integrationClientId, clientSecret: integrationClientSecret }
+            : null,
+        clientId && clientSecret ? { clientId, clientSecret } : null,
+    ].filter((value) => Boolean(value));
+    const seen = new Set();
+    return candidates.filter((candidate) => {
+        if (seen.has(candidate.clientId))
+            return false;
+        seen.add(candidate.clientId);
+        return true;
+    });
+}
 function normalizeMethod(method) {
     const normalized = String(method || "GET").toUpperCase();
     if (normalized === "GET" ||