@agentuity/core 1.0.54 → 1.0.56

package/dist/services/oauth/flow.d.ts

@@ -34,6 +34,37 @@ export declare function buildAuthorizeUrl(redirectUri: string, config?: OAuthFlo
  * ```
  */
 export declare function exchangeToken(code: string, redirectUri: string, config?: OAuthFlowConfig): Promise<OAuthTokenResponse>;
+/**
+ * Refresh an access token using a refresh token.
+ *
+ * @param refreshTokenValue - The refresh token obtained from a previous token exchange
+ * @param config - Optional OAuth configuration. Falls back to environment variables.
+ * @returns The token response including a new access_token, and optionally a new refresh_token
+ *
+ * @example
+ * ```typescript
+ * const newToken = await refreshToken(previousToken.refresh_token!);
+ * console.log(newToken.access_token);
+ * ```
+ */
+export declare function refreshToken(refreshTokenValue: string, config?: OAuthFlowConfig): Promise<OAuthTokenResponse>;
+/**
+ * Revoke an OAuth token (access token or refresh token) to log the user out.
+ *
+ * Calls the token revocation endpoint (RFC 7009). The server will invalidate
+ * the token so it can no longer be used. Per the spec, the endpoint returns
+ * a success response even if the token was already invalid.
+ *
+ * @param token - The access token or refresh token to revoke
+ * @param config - Optional OAuth configuration. Falls back to environment variables.
+ *
+ * @example
+ * ```typescript
+ * // Revoke the refresh token to fully log out
+ * await logout(token.refresh_token!);
+ * ```
+ */
+export declare function logout(token: string, config?: OAuthFlowConfig): Promise<void>;
 /**
  * Fetch user information from the OIDC userinfo endpoint using an access token.
  *

package/dist/services/oauth/flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flow.d.ts","sourceRoot":"","sources":["../../../src/services/oauth/flow.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AA+BrF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,eAAe,GAAG,MAAM,CA2BvF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,aAAa,CAClC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC,kBAAkB,CAAC,CAyD7B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CAClC,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC,aAAa,CAAC,CAuCxB"}
+{"version":3,"file":"flow.d.ts","sourceRoot":"","sources":["../../../src/services/oauth/flow.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAgDrF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,eAAe,GAAG,MAAM,CA2BvF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,aAAa,CAClC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC,kBAAkB,CAAC,CAoD7B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CACjC,iBAAiB,EAAE,MAAM,EACzB,MAAM,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC,kBAAkB,CAAC,CAmD7B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CA+CnF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CAClC,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC,aAAa,CAAC,CAkCxB"}

package/dist/services/oauth/flow.js

@@ -19,9 +19,24 @@ function resolveConfig(config) {
     const userinfoUrl = config?.userinfoUrl ??
         getEnv('OAUTH_USERINFO_URL') ??
         (issuer ? `${issuer}/userinfo` : undefined);
+    const revokeUrl = config?.revokeUrl ?? getEnv('OAUTH_REVOKE_URL') ?? (issuer ? `${issuer}/revoke` : undefined);
+    const endSessionUrl = config?.endSessionUrl ??
+        getEnv('OAUTH_END_SESSION_URL') ??
+        (issuer ? `${issuer}/end_session` : undefined);
     const scopes = config?.scopes ?? getEnv('OAUTH_SCOPES') ?? 'openid profile email';
     const prompt = config?.prompt;
-    return { clientId, clientSecret, issuer, authorizeUrl, tokenUrl, userinfoUrl, scopes, prompt };
+    return {
+        clientId,
+        clientSecret,
+        issuer,
+        authorizeUrl,
+        tokenUrl,
+        userinfoUrl,
+        revokeUrl,
+        endSessionUrl,
+        scopes,
+        prompt,
+    };
 }
 /**
  * Build an OAuth 2.0 authorization URL for redirecting the user to the OIDC provider.
@@ -96,8 +111,6 @@ export async function exchangeToken(code, redirectUri, config) {
             message: 'No client secret configured. Set OAUTH_CLIENT_SECRET environment variable.',
         });
     }
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), DEFAULT_TIMEOUT_MS);
     let response;
     try {
         response = await fetch(resolved.tokenUrl, {
@@ -110,19 +123,17 @@ export async function exchangeToken(code, redirectUri, config) {
                 client_id: resolved.clientId,
                 client_secret: resolved.clientSecret,
             }),
-            signal: controller.signal,
+            signal: AbortSignal.timeout(DEFAULT_TIMEOUT_MS),
         });
     }
     catch (err) {
-        clearTimeout(timer);
-        if (err instanceof DOMException && err.name === 'AbortError') {
+        if (err instanceof DOMException && err.name === 'TimeoutError') {
             throw new OAuthResponseError({
                 message: `Token exchange timed out after ${DEFAULT_TIMEOUT_MS}ms`,
             });
         }
         throw err;
     }
-    clearTimeout(timer);
     if (!response.ok) {
         const error = await response.text();
         throw new OAuthResponseError({
@@ -132,6 +143,124 @@ export async function exchangeToken(code, redirectUri, config) {
     const data = await response.json();
     return OAuthTokenResponseSchema.parse(data);
 }
+/**
+ * Refresh an access token using a refresh token.
+ *
+ * @param refreshTokenValue - The refresh token obtained from a previous token exchange
+ * @param config - Optional OAuth configuration. Falls back to environment variables.
+ * @returns The token response including a new access_token, and optionally a new refresh_token
+ *
+ * @example
+ * ```typescript
+ * const newToken = await refreshToken(previousToken.refresh_token!);
+ * console.log(newToken.access_token);
+ * ```
+ */
+export async function refreshToken(refreshTokenValue, config) {
+    const resolved = resolveConfig(config);
+    if (!resolved.tokenUrl) {
+        throw new OAuthResponseError({
+            message: 'No token URL configured. Set OAUTH_TOKEN_URL or OAUTH_ISSUER environment variable.',
+        });
+    }
+    if (!resolved.clientId) {
+        throw new OAuthResponseError({
+            message: 'No client ID configured. Set OAUTH_CLIENT_ID environment variable.',
+        });
+    }
+    const params = new URLSearchParams({
+        grant_type: 'refresh_token',
+        refresh_token: refreshTokenValue,
+        client_id: resolved.clientId,
+    });
+    if (resolved.clientSecret) {
+        params.set('client_secret', resolved.clientSecret);
+    }
+    let response;
+    try {
+        response = await fetch(resolved.tokenUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: params,
+            signal: AbortSignal.timeout(DEFAULT_TIMEOUT_MS),
+        });
+    }
+    catch (err) {
+        if (err instanceof DOMException && err.name === 'TimeoutError') {
+            throw new OAuthResponseError({
+                message: `Token refresh timed out after ${DEFAULT_TIMEOUT_MS}ms`,
+            });
+        }
+        throw err;
+    }
+    if (!response.ok) {
+        const error = await response.text();
+        throw new OAuthResponseError({
+            message: `Token refresh failed (${response.status}): ${error}`,
+        });
+    }
+    const data = await response.json();
+    return OAuthTokenResponseSchema.parse(data);
+}
+/**
+ * Revoke an OAuth token (access token or refresh token) to log the user out.
+ *
+ * Calls the token revocation endpoint (RFC 7009). The server will invalidate
+ * the token so it can no longer be used. Per the spec, the endpoint returns
+ * a success response even if the token was already invalid.
+ *
+ * @param token - The access token or refresh token to revoke
+ * @param config - Optional OAuth configuration. Falls back to environment variables.
+ *
+ * @example
+ * ```typescript
+ * // Revoke the refresh token to fully log out
+ * await logout(token.refresh_token!);
+ * ```
+ */
+export async function logout(token, config) {
+    const resolved = resolveConfig(config);
+    if (!resolved.revokeUrl) {
+        throw new OAuthResponseError({
+            message: 'No revoke URL configured. Set OAUTH_REVOKE_URL or OAUTH_ISSUER environment variable.',
+        });
+    }
+    if (!resolved.clientId) {
+        throw new OAuthResponseError({
+            message: 'No client ID configured. Set OAUTH_CLIENT_ID environment variable.',
+        });
+    }
+    const params = new URLSearchParams({
+        token,
+        client_id: resolved.clientId,
+    });
+    if (resolved.clientSecret) {
+        params.set('client_secret', resolved.clientSecret);
+    }
+    let response;
+    try {
+        response = await fetch(resolved.revokeUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: params,
+            signal: AbortSignal.timeout(DEFAULT_TIMEOUT_MS),
+        });
+    }
+    catch (err) {
+        if (err instanceof DOMException && err.name === 'TimeoutError') {
+            throw new OAuthResponseError({
+                message: `Token revocation timed out after ${DEFAULT_TIMEOUT_MS}ms`,
+            });
+        }
+        throw err;
+    }
+    if (!response.ok) {
+        const error = await response.text();
+        throw new OAuthResponseError({
+            message: `Token revocation failed (${response.status}): ${error}`,
+        });
+    }
+}
 /**
  * Fetch user information from the OIDC userinfo endpoint using an access token.
  *
@@ -152,25 +281,21 @@ export async function fetchUserInfo(accessToken, config) {
             message: 'No userinfo URL configured. Set OAUTH_USERINFO_URL or OAUTH_ISSUER environment variable.',
         });
     }
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), DEFAULT_TIMEOUT_MS);
     let response;
     try {
         response = await fetch(resolved.userinfoUrl, {
             headers: { Authorization: `Bearer ${accessToken}` },
-            signal: controller.signal,
+            signal: AbortSignal.timeout(DEFAULT_TIMEOUT_MS),
         });
     }
     catch (err) {
-        clearTimeout(timer);
-        if (err instanceof DOMException && err.name === 'AbortError') {
+        if (err instanceof DOMException && err.name === 'TimeoutError') {
             throw new OAuthResponseError({
                 message: `Userinfo request timed out after ${DEFAULT_TIMEOUT_MS}ms`,
             });
         }
         throw err;
     }
-    clearTimeout(timer);
     if (!response.ok) {
         const error = await response.text();
         throw new OAuthResponseError({

package/dist/services/oauth/flow.js.map

@@ -1 +1 @@
-{"version":3,"file":"flow.js","sourceRoot":"","sources":["../../../src/services/oauth/flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAG3E,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC;;;GAGG;AACH,SAAS,aAAa,CAAC,MAAwB;IAC9C,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,MAAM,EAAE,YAAY,IAAI,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,MAAM,CAAC,cAAc,CAAC,CAAC;IACxD,MAAM,YAAY,GACjB,MAAM,EAAE,YAAY;QACpB,MAAM,CAAC,qBAAqB,CAAC;QAC7B,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,QAAQ,GACb,MAAM,EAAE,QAAQ;QAChB,MAAM,CAAC,iBAAiB,CAAC;QACzB,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,WAAW,GAChB,MAAM,EAAE,WAAW;QACnB,MAAM,CAAC,oBAAoB,CAAC;QAC5B,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,MAAM,CAAC,cAAc,CAAC,IAAI,sBAAsB,CAAC;IAElF,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC;IAE9B,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAChG,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB,EAAE,MAAwB;IAC9E,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAEvC,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC5B,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EACN,4FAA4F;SAC7F,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EAAE,oEAAoE;SAC7E,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QAClC,SAAS,EAAE,QAAQ,CAAC,QAAQ;QAC5B,YAAY,EAAE,WAAW;QACzB,aAAa,EAAE,MAAM;QACrB,KAAK,EAAE,QAAQ,CAAC,MAAM;KACtB,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,GAAG,QAAQ,CAAC,YAAY,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,IAAY,EACZ,WAAmB,EACnB,MAAwB;IAExB,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAEvC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EACN,oFAAoF;SACrF,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EAAE,oEAAoE;SAC7E,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC5B,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EAAE,4EAA4E;SACrF,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,kBAAkB,CAAC,CAAC;IAEvE,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE;YACzC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACzB,UAAU,EAAE,oBAAoB;gBAChC,IAAI;gBACJ,YAAY,EAAE,WAAW;gBACzB,SAAS,EAAE,QAAQ,CAAC,QAAQ;gBAC5B,aAAa,EAAE,QAAQ,CAAC,YAAY;aACpC,CAAC;YACF,MAAM,EAAE,UAAU,CAAC,MAAM;SACzB,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,IAAI,GAAG,YAAY,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC9D,MAAM,IAAI,kBAAkB,CAAC;gBAC5B,OAAO,EAAE,kCAAkC,kBAAkB,IAAI;aACjE,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACX,CAAC;IACD,YAAY,CAAC,KAAK,CAAC,CAAC;IAEpB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EAAE,0BAA0B,QAAQ,CAAC,MAAM,MAAM,KAAK,EAAE;SAC/D,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,WAAmB,EACnB,MAAwB;IAExB,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAEvC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC3B,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EACN,0FAA0F;SAC3F,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,kBAAkB,CAAC,CAAC;IAEvE,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE;YAC5C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;YACnD,MAAM,EAAE,UAAU,CAAC,MAAM;SACzB,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,IAAI,GAAG,YAAY,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC9D,MAAM,IAAI,kBAAkB,CAAC;gBAC5B,OAAO,EAAE,oCAAoC,kBAAkB,IAAI;aACnE,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACX,CAAC;IACD,YAAY,CAAC,KAAK,CAAC,CAAC;IAEpB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EAAE,8BAA8B,QAAQ,CAAC,MAAM,MAAM,KAAK,EAAE;SACnE,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC"}
+{"version":3,"file":"flow.js","sourceRoot":"","sources":["../../../src/services/oauth/flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAG3E,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC;;;GAGG;AACH,SAAS,aAAa,CAAC,MAAwB;IAC9C,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,MAAM,EAAE,YAAY,IAAI,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,MAAM,CAAC,cAAc,CAAC,CAAC;IACxD,MAAM,YAAY,GACjB,MAAM,EAAE,YAAY;QACpB,MAAM,CAAC,qBAAqB,CAAC;QAC7B,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,QAAQ,GACb,MAAM,EAAE,QAAQ;QAChB,MAAM,CAAC,iBAAiB,CAAC;QACzB,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,WAAW,GAChB,MAAM,EAAE,WAAW;QACnB,MAAM,CAAC,oBAAoB,CAAC;QAC5B,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,SAAS,GACd,MAAM,EAAE,SAAS,IAAI,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC9F,MAAM,aAAa,GAClB,MAAM,EAAE,aAAa;QACrB,MAAM,CAAC,uBAAuB,CAAC;QAC/B,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,MAAM,CAAC,cAAc,CAAC,IAAI,sBAAsB,CAAC;IAElF,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC;IAE9B,OAAO;QACN,QAAQ;QACR,YAAY;QACZ,MAAM;QACN,YAAY;QACZ,QAAQ;QACR,WAAW;QACX,SAAS;QACT,aAAa;QACb,MAAM;QACN,MAAM;KACN,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB,EAAE,MAAwB;IAC9E,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAEvC,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC5B,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EACN,4FAA4F;SAC7F,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EAAE,oEAAoE;SAC7E,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QAClC,SAAS,EAAE,QAAQ,CAAC,QAAQ;QAC5B,YAAY,EAAE,WAAW;QACzB,aAAa,EAAE,MAAM;QACrB,KAAK,EAAE,QAAQ,CAAC,MAAM;KACtB,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,GAAG,QAAQ,CAAC,YAAY,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,IAAY,EACZ,WAAmB,EACnB,MAAwB;IAExB,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAEvC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EACN,oFAAoF;SACrF,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EAAE,oEAAoE;SAC7E,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC5B,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EAAE,4EAA4E;SACrF,CAAC,CAAC;IACJ,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE;YACzC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACzB,UAAU,EAAE,oBAAoB;gBAChC,IAAI;gBACJ,YAAY,EAAE,WAAW;gBACzB,SAAS,EAAE,QAAQ,CAAC,QAAQ;gBAC5B,aAAa,EAAE,QAAQ,CAAC,YAAY;aACpC,CAAC;YACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;SAC/C,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAChE,MAAM,IAAI,kBAAkB,CAAC;gBAC5B,OAAO,EAAE,kCAAkC,kBAAkB,IAAI;aACjE,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACX,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EAAE,0BAA0B,QAAQ,CAAC,MAAM,MAAM,KAAK,EAAE;SAC/D,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,iBAAyB,EACzB,MAAwB;IAExB,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAEvC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EACN,oFAAoF;SACrF,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EAAE,oEAAoE;SAC7E,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QAClC,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,iBAAiB;QAChC,SAAS,EAAE,QAAQ,CAAC,QAAQ;KAC5B,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE;YACzC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;SAC/C,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAChE,MAAM,IAAI,kBAAkB,CAAC;gBAC5B,OAAO,EAAE,iCAAiC,kBAAkB,IAAI;aAChE,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACX,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EAAE,yBAAyB,QAAQ,CAAC,MAAM,MAAM,KAAK,EAAE;SAC9D,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,KAAa,EAAE,MAAwB;IACnE,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAEvC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EACN,sFAAsF;SACvF,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EAAE,oEAAoE;SAC7E,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QAClC,KAAK;QACL,SAAS,EAAE,QAAQ,CAAC,QAAQ;KAC5B,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;SAC/C,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAChE,MAAM,IAAI,kBAAkB,CAAC;gBAC5B,OAAO,EAAE,oCAAoC,kBAAkB,IAAI;aACnE,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACX,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EAAE,4BAA4B,QAAQ,CAAC,MAAM,MAAM,KAAK,EAAE;SACjE,CAAC,CAAC;IACJ,CAAC;AACF,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,WAAmB,EACnB,MAAwB;IAExB,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAEvC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC3B,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EACN,0FAA0F;SAC3F,CAAC,CAAC;IACJ,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE;YAC5C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;YACnD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;SAC/C,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAChE,MAAM,IAAI,kBAAkB,CAAC;gBAC5B,OAAO,EAAE,oCAAoC,kBAAkB,IAAI;aACnE,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACX,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EAAE,8BAA8B,QAAQ,CAAC,MAAM,MAAM,KAAK,EAAE;SACnE,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC"}

package/dist/services/oauth/index.d.ts

@@ -7,4 +7,5 @@ export * from './members.ts';
 export * from './keys.ts';
 export * from './util.ts';
 export * from './flow.ts';
+export * from './token-storage.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/services/oauth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/oauth/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/oauth/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,oBAAoB,CAAC"}

package/dist/services/oauth/index.js

@@ -7,4 +7,5 @@ export * from "./members.js";
 export * from "./keys.js";
 export * from "./util.js";
 export * from "./flow.js";
+export * from "./token-storage.js";
 //# sourceMappingURL=index.js.map

package/dist/services/oauth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/services/oauth/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/services/oauth/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,oBAAoB,CAAC"}

package/dist/services/oauth/token-storage.d.ts

@@ -0,0 +1,109 @@
+import type { KeyValueStorage } from '../keyvalue/service.ts';
+import type { OAuthFlowConfig, OAuthTokenResponse, StoredToken } from './types.ts';
+/**
+ * Check whether a stored token's access token has expired.
+ *
+ * @param token - The stored token to check
+ * @returns true if the token has an expires_at timestamp that is in the past
+ *
+ * @example
+ * ```typescript
+ * const token = await storage.get('user:123');
+ * if (token && isTokenExpired(token)) {
+ *   // Token is expired and auto-refresh wasn't available
+ * }
+ * ```
+ */
+export declare function isTokenExpired(token: StoredToken): boolean;
+/**
+ * Options for configuring a TokenStorage instance.
+ */
+export interface TokenStorageOptions {
+    /**
+     * OAuth configuration for auto-refresh and token revocation.
+     * If not provided, auto-refresh on get() and server-side revocation on invalidate() are disabled.
+     */
+    config?: OAuthFlowConfig;
+    /**
+     * KV namespace for storing tokens. Defaults to 'oauth-tokens'.
+     */
+    namespace?: string;
+    /**
+     * Key prefix prepended to all storage keys.
+     * Useful for scoping tokens by application or tenant.
+     */
+    prefix?: string;
+}
+/**
+ * Interface for storing, retrieving, and invalidating OAuth tokens.
+ *
+ * Implementations handle persistence and may support automatic token refresh
+ * on retrieval and server-side revocation on invalidation.
+ */
+export interface TokenStorage {
+    /**
+     * Retrieve a stored token by key.
+     *
+     * If the token is expired and a refresh_token is available (and config is provided),
+     * the token is automatically refreshed, stored, and the new token is returned.
+     * If auto-refresh fails, the expired token is returned so the caller can decide
+     * how to handle it (check with {@link isTokenExpired}).
+     *
+     * @param key - The storage key (e.g. a user ID or session ID)
+     * @returns The stored token, or null if no token exists for the key
+     */
+    get(key: string): Promise<StoredToken | null>;
+    /**
+     * Store a token response from a token exchange or refresh.
+     *
+     * Automatically computes `expires_at` from `expires_in` if present.
+     *
+     * @param key - The storage key (e.g. a user ID or session ID)
+     * @param token - The OAuth token response to store
+     */
+    set(key: string, token: OAuthTokenResponse): Promise<void>;
+    /**
+     * Invalidate a stored token: revoke it server-side and remove from storage.
+     *
+     * If config is provided, the refresh token (or access token as fallback)
+     * is revoked via the token revocation endpoint. Revocation is best-effort —
+     * the token is removed from storage regardless of whether revocation succeeds.
+     *
+     * @param key - The storage key to invalidate
+     * @returns The token that was removed, or null if no token existed
+     */
+    invalidate(key: string): Promise<StoredToken | null>;
+}
+/**
+ * Token storage backed by Agentuity's Key-Value storage service.
+ *
+ * Stores tokens as JSON in a KV namespace. Supports automatic token refresh
+ * on retrieval when tokens expire (if OAuth config is provided).
+ *
+ * @example
+ * ```typescript
+ * import { KeyValueTokenStorage } from '@agentuity/core/oauth';
+ *
+ * // Create storage with auto-refresh enabled
+ * const storage = new KeyValueTokenStorage(ctx.kv, {
+ *   config: { issuer: 'https://auth.example.com' },
+ * });
+ *
+ * // Store a token after initial exchange
+ * await storage.set('user:123', tokenResponse);
+ *
+ * // Retrieve — auto-refreshes if expired
+ * const token = await storage.get('user:123');
+ *
+ * // Logout — revokes server-side and removes from storage
+ * await storage.invalidate('user:123');
+ * ```
+ */
+export declare class KeyValueTokenStorage implements TokenStorage {
+    #private;
+    constructor(kv: KeyValueStorage, options?: TokenStorageOptions);
+    get(key: string): Promise<StoredToken | null>;
+    set(key: string, token: OAuthTokenResponse): Promise<void>;
+    invalidate(key: string): Promise<StoredToken | null>;
+}
+//# sourceMappingURL=token-storage.d.ts.map

package/dist/services/oauth/token-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-storage.d.ts","sourceRoot":"","sources":["../../../src/services/oauth/token-storage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAMnF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAG1D;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;OAGG;IACH,MAAM,CAAC,EAAE,eAAe,CAAC;IAEzB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC5B;;;;;;;;;;OAUG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAE9C;;;;;;;OAOG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3D;;;;;;;;;OASG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACrD;AAgBD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBAAa,oBAAqB,YAAW,YAAY;;gBAM5C,EAAE,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,mBAAmB;IAOxD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAyB7C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAK1D,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;CA8C1D"}

package/dist/services/oauth/token-storage.js

@@ -0,0 +1,140 @@
+import { StoredTokenSchema } from "./types.js";
+import { refreshToken, logout } from "./flow.js";
+const DEFAULT_NAMESPACE = 'oauth-tokens';
+/**
+ * Check whether a stored token's access token has expired.
+ *
+ * @param token - The stored token to check
+ * @returns true if the token has an expires_at timestamp that is in the past
+ *
+ * @example
+ * ```typescript
+ * const token = await storage.get('user:123');
+ * if (token && isTokenExpired(token)) {
+ *   // Token is expired and auto-refresh wasn't available
+ * }
+ * ```
+ */
+export function isTokenExpired(token) {
+    if (!token.expires_at)
+        return false;
+    return Math.floor(Date.now() / 1000) >= token.expires_at;
+}
+/**
+ * Convert an OAuth token response to a StoredToken with computed expires_at.
+ */
+function toStoredToken(token) {
+    return {
+        access_token: token.access_token,
+        token_type: token.token_type,
+        refresh_token: token.refresh_token,
+        scope: token.scope,
+        id_token: token.id_token,
+        expires_at: token.expires_in ? Math.floor(Date.now() / 1000) + token.expires_in : undefined,
+    };
+}
+/**
+ * Token storage backed by Agentuity's Key-Value storage service.
+ *
+ * Stores tokens as JSON in a KV namespace. Supports automatic token refresh
+ * on retrieval when tokens expire (if OAuth config is provided).
+ *
+ * @example
+ * ```typescript
+ * import { KeyValueTokenStorage } from '@agentuity/core/oauth';
+ *
+ * // Create storage with auto-refresh enabled
+ * const storage = new KeyValueTokenStorage(ctx.kv, {
+ *   config: { issuer: 'https://auth.example.com' },
+ * });
+ *
+ * // Store a token after initial exchange
+ * await storage.set('user:123', tokenResponse);
+ *
+ * // Retrieve — auto-refreshes if expired
+ * const token = await storage.get('user:123');
+ *
+ * // Logout — revokes server-side and removes from storage
+ * await storage.invalidate('user:123');
+ * ```
+ */
+export class KeyValueTokenStorage {
+    #kv;
+    #namespace;
+    #prefix;
+    #config;
+    constructor(kv, options) {
+        this.#kv = kv;
+        this.#namespace = options?.namespace ?? DEFAULT_NAMESPACE;
+        this.#prefix = options?.prefix ?? '';
+        this.#config = options?.config;
+    }
+    async get(key) {
+        const result = await this.#kv.get(this.#namespace, this.#resolveKey(key));
+        if (!result.exists)
+            return null;
+        const parsed = StoredTokenSchema.safeParse(result.data);
+        if (!parsed.success)
+            return null;
+        const token = parsed.data;
+        // Auto-refresh if expired and refresh_token + config are available
+        if (isTokenExpired(token) && token.refresh_token && this.#config) {
+            try {
+                const newTokenResponse = await refreshToken(token.refresh_token, this.#config);
+                const newStored = toStoredToken(newTokenResponse);
+                await this.#store(key, newStored);
+                return newStored;
+            }
+            catch {
+                // Refresh failed — return the expired token, caller can check isTokenExpired()
+                return token;
+            }
+        }
+        return token;
+    }
+    async set(key, token) {
+        const stored = toStoredToken(token);
+        await this.#store(key, stored);
+    }
+    async invalidate(key) {
+        const resolvedKey = this.#resolveKey(key);
+        const result = await this.#kv.get(this.#namespace, resolvedKey);
+        if (!result.exists)
+            return null;
+        const parsed = StoredTokenSchema.safeParse(result.data);
+        const token = parsed.success ? parsed.data : null;
+        // Revoke server-side (best effort)
+        if (token && this.#config) {
+            const tokenToRevoke = token.refresh_token ?? token.access_token;
+            try {
+                await logout(tokenToRevoke, this.#config);
+            }
+            catch {
+                // Best effort — continue with storage cleanup
+            }
+        }
+        // Remove from storage regardless of revocation result
+        await this.#kv.delete(this.#namespace, resolvedKey);
+        return token;
+    }
+    async #store(key, token) {
+        // Only set explicit TTL for tokens without a refresh_token.
+        // Tokens with refresh capability persist until explicitly invalidated
+        // (auto-refresh on get() will keep them fresh).
+        let ttl;
+        if (!token.refresh_token && token.expires_at) {
+            const remaining = token.expires_at - Math.floor(Date.now() / 1000);
+            if (remaining > 0) {
+                ttl = Math.max(remaining, 60); // KV minimum is 60 seconds
+            }
+        }
+        await this.#kv.set(this.#namespace, this.#resolveKey(key), token, {
+            ttl,
+            contentType: 'application/json',
+        });
+    }
+    #resolveKey(key) {
+        return this.#prefix ? `${this.#prefix}${key}` : key;
+    }
+}
+//# sourceMappingURL=token-storage.js.map

package/dist/services/oauth/token-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-storage.js","sourceRoot":"","sources":["../../../src/services/oauth/token-storage.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAEjD,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEzC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,KAAkB;IAChD,IAAI,CAAC,KAAK,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC;AAC1D,CAAC;AAmED;;GAEG;AACH,SAAS,aAAa,CAAC,KAAyB;IAC/C,OAAO;QACN,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;KAC3F,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,OAAO,oBAAoB;IAChC,GAAG,CAAkB;IACrB,UAAU,CAAS;IACnB,OAAO,CAAS;IAChB,OAAO,CAAmB;IAE1B,YAAY,EAAmB,EAAE,OAA6B;QAC7D,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;QACd,IAAI,CAAC,UAAU,GAAG,OAAO,EAAE,SAAS,IAAI,iBAAiB,CAAC;QAC1D,IAAI,CAAC,OAAO,GAAG,OAAO,EAAE,MAAM,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,OAAO,GAAG,OAAO,EAAE,MAAM,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAc,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEhC,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAEjC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;QAE1B,mEAAmE;QACnE,IAAI,cAAc,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClE,IAAI,CAAC;gBACJ,MAAM,gBAAgB,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC/E,MAAM,SAAS,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAC;gBAClD,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBAClC,OAAO,SAAS,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACR,+EAA+E;gBAC/E,OAAO,KAAK,CAAC;YACd,CAAC;QACF,CAAC;QAED,OAAO,KAAK,CAAC;IACd,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAyB;QAC/C,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,GAAW;QAC3B,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAc,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAE7E,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEhC,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAElD,mCAAmC;QACnC,IAAI,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC3B,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,YAAY,CAAC;YAChE,IAAI,CAAC;gBACJ,MAAM,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACR,8CAA8C;YAC/C,CAAC;QACF,CAAC;QAED,sDAAsD;QACtD,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAEpD,OAAO,KAAK,CAAC;IACd,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,KAAkB;QAC3C,4DAA4D;QAC5D,sEAAsE;QACtE,gDAAgD;QAChD,IAAI,GAAuB,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YACnE,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;gBACnB,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,2BAA2B;YAC3D,CAAC;QACF,CAAC;QAED,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE;YACjE,GAAG;YACH,WAAW,EAAE,kBAAkB;SAC/B,CAAC,CAAC;IACJ,CAAC;IAED,WAAW,CAAC,GAAW;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IACrD,CAAC;CACD"}

package/dist/services/oauth/types.d.ts

@@ -599,6 +599,8 @@ export declare const OAuthFlowConfigSchema: z.ZodObject<{
     authorizeUrl: z.ZodOptional<z.ZodString>;
     tokenUrl: z.ZodOptional<z.ZodString>;
     userinfoUrl: z.ZodOptional<z.ZodString>;
+    revokeUrl: z.ZodOptional<z.ZodString>;
+    endSessionUrl: z.ZodOptional<z.ZodString>;
     scopes: z.ZodOptional<z.ZodString>;
     prompt: z.ZodOptional<z.ZodEnum<{
         none: "none";
@@ -626,4 +628,13 @@ export declare const OAuthUserInfoSchema: z.ZodObject<{
     email_verified: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$catchall<z.ZodUnknown>>;
 export type OAuthUserInfo = z.infer<typeof OAuthUserInfoSchema>;
+export declare const StoredTokenSchema: z.ZodObject<{
+    access_token: z.ZodString;
+    token_type: z.ZodOptional<z.ZodString>;
+    refresh_token: z.ZodOptional<z.ZodString>;
+    scope: z.ZodOptional<z.ZodString>;
+    id_token: z.ZodOptional<z.ZodString>;
+    expires_at: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type StoredToken = z.infer<typeof StoredTokenSchema>;
 //# sourceMappingURL=types.d.ts.map

package/dist/services/oauth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/services/oauth/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;iBAqB5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAIpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;iBAgBzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;iBAgBzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,2BAA2B;;;iBAGtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,sBAAsB;;iBAEjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,6BAA6B;;;;iBAIxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,2BAA2B;;;;iBAItC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,uBAAuB;;;;;iBAKlC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,sBAAsB;;;;;;;;;iBASjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,gBAAgB;;;;;;;;iBAQ3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,0BAA0B;;;;iBAIrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,0BAA0B;;;;;;;;;iBAKrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;iBAIxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;iBAGhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,oBAAoB;;;;;;;iBAO/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,yBAAyB;;iBAEpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAAwD,CAAC;AACnG,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAA+C,CAAC;AACzF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAAiD,CAAC;AAC9F,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAAiD,CAAC;AAC9F,eAAO,MAAM,+BAA+B;;;;;;;;;8BAA4C,CAAC;AACzF,eAAO,MAAM,qCAAqC;;;;;;;;;;8BAAiD,CAAC;AACpG,eAAO,MAAM,8BAA8B;;;;;;;;;;;;8BAAsD,CAAC;AAClG,eAAO,MAAM,uCAAuC;;;;;;;;;8BAA4C,CAAC;AACjG,eAAO,MAAM,mCAAmC;;;;;;;;;8BAA4C,CAAC;AAC7F,eAAO,MAAM,iCAAiC;;;;;;;;;;;8BAE7C,CAAC;AACF,eAAO,MAAM,+BAA+B;;;;;;;;;;;8BAE3C,CAAC;AACF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;8BAAqD,CAAC;AACjG,eAAO,MAAM,oCAAoC;;;;;;;;;8BAA4C,CAAC;AAC9F,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAA2C,CAAC;AAClF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;8BAAmD,CAAC;AAC9F,eAAO,MAAM,6BAA6B;;;;;;;;;8BAA+C,CAAC;AAE1F,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AACpG,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACtD,OAAO,uCAAuC,CAC9C,CAAC;AACF,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAChG,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC5F,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAClG,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAMpF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;iBAkChC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,wBAAwB;;;;;;;iBAOnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,mBAAmB;;;;;;;kCAST,CAAC;AAExB,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/services/oauth/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;iBAqB5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAIpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;iBAgBzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;iBAgBzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,2BAA2B;;;iBAGtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,sBAAsB;;iBAEjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,6BAA6B;;;;iBAIxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,2BAA2B;;;;iBAItC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,uBAAuB;;;;;iBAKlC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,sBAAsB;;;;;;;;;iBASjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,gBAAgB;;;;;;;;iBAQ3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,0BAA0B;;;;iBAIrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,0BAA0B;;;;;;;;;iBAKrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;iBAIxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;iBAGhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,oBAAoB;;;;;;;iBAO/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,yBAAyB;;iBAEpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAAwD,CAAC;AACnG,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAA+C,CAAC;AACzF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAAiD,CAAC;AAC9F,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAAiD,CAAC;AAC9F,eAAO,MAAM,+BAA+B;;;;;;;;;8BAA4C,CAAC;AACzF,eAAO,MAAM,qCAAqC;;;;;;;;;;8BAAiD,CAAC;AACpG,eAAO,MAAM,8BAA8B;;;;;;;;;;;;8BAAsD,CAAC;AAClG,eAAO,MAAM,uCAAuC;;;;;;;;;8BAA4C,CAAC;AACjG,eAAO,MAAM,mCAAmC;;;;;;;;;8BAA4C,CAAC;AAC7F,eAAO,MAAM,iCAAiC;;;;;;;;;;;8BAE7C,CAAC;AACF,eAAO,MAAM,+BAA+B;;;;;;;;;;;8BAE3C,CAAC;AACF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;8BAAqD,CAAC;AACjG,eAAO,MAAM,oCAAoC;;;;;;;;;8BAA4C,CAAC;AAC9F,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAA2C,CAAC;AAClF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;8BAAmD,CAAC;AAC9F,eAAO,MAAM,6BAA6B;;;;;;;;;8BAA+C,CAAC;AAE1F,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AACpG,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACtD,OAAO,uCAAuC,CAC9C,CAAC;AACF,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAChG,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC5F,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAClG,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAMpF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;iBA8ChC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,wBAAwB;;;;;;;iBAOnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,mBAAmB;;;;;;;kCAST,CAAC;AAExB,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,iBAAiB;;;;;;;iBAU5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/services/oauth/types.js

@@ -183,6 +183,14 @@ export const OAuthFlowConfigSchema = z.object({
         .string()
         .optional()
         .describe('UserInfo endpoint. Defaults to OAUTH_USERINFO_URL or {issuer}/userinfo'),
+    revokeUrl: z
+        .string()
+        .optional()
+        .describe('Token revocation endpoint (RFC 7009). Defaults to OAUTH_REVOKE_URL or {issuer}/revoke'),
+    endSessionUrl: z
+        .string()
+        .optional()
+        .describe('OIDC end session endpoint. Defaults to OAUTH_END_SESSION_URL or {issuer}/end_session'),
     scopes: z
         .string()
         .optional()
@@ -210,4 +218,15 @@ export const OAuthUserInfoSchema = z
     email_verified: z.boolean().optional(),
 })
     .catchall(z.unknown());
+export const StoredTokenSchema = z.object({
+    access_token: z.string(),
+    token_type: z.string().optional(),
+    refresh_token: z.string().optional(),
+    scope: z.string().optional(),
+    id_token: z.string().optional(),
+    expires_at: z
+        .number()
+        .optional()
+        .describe('Unix timestamp (seconds) when the access token expires'),
+});
 //# sourceMappingURL=types.js.map