@capybara-hq/testing 0.0.0-stage → 0.1.0-rc.0

package/fixtures/extensions/fake-dep-requirer/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "@capybara-hq/test-plugin-fake-dep-requirer",
+  "version": "0.1.0",
+  "private": true,
+  "description": "Test fake: requires counter@1 and depends on the plugin fake-dep-provider",
+  "license": "Apache-2.0",
+  "type": "module",
+  "dependencies": {
+    "@capybara-hq/plugin-sdk": "^0.1.0-rc.0",
+    "zod": "^4.6.7"
+  }
+}

package/fixtures/extensions/fake-dep-requirer/src/index.ts

@@ -0,0 +1,21 @@
+import { defineExtension } from "@capybara-hq/plugin-sdk";
+
+/**
+ * Test fake: the requirer side of a dependency pair. Requires `counter@1` (provided by
+ * `fake-dep-provider`, which its plugin.json also lists as a plugin dependency); the route
+ * `GET /ping` answers with what the provider's `ping()` returns.
+ */
+export default defineExtension({
+  name: "fake-dep-requirer",
+  version: "0.1.0",
+  sdk: "^0.1.0-rc.0",
+  provides: [],
+  requires: ["counter@1"],
+  permissions: { http: [{ method: "GET", path: "/ping" }] },
+  setup(ctx) {
+    ctx.http.route("GET", "/ping", async () => {
+      const impl = ctx.extensionPoints.list<{ ping(): string }>("counter@1")[0]?.impl;
+      return new Response(impl ? impl.ping() : "no provider", { status: impl ? 200 : 503 });
+    });
+  },
+});

package/fixtures/extensions/fake-embed/.capybara-plugin/plugin.json

@@ -0,0 +1,7 @@
+{
+  "schemaVersion": 1,
+  "name": "fake-embed",
+  "version": "0.1.0",
+  "publisher": "Capybara",
+  "description": "Test fake: two embed contributions (org page and conversation tab) with token-checked routes and SSE over ctx.bus"
+}

package/fixtures/extensions/fake-embed/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "@capybara-hq/test-plugin-fake-embed",
+  "version": "0.1.0",
+  "private": true,
+  "description": "Test fake: two embed contributions (org page and conversation tab) with token-checked routes and SSE over ctx.bus",
+  "license": "Apache-2.0",
+  "type": "module",
+  "dependencies": {
+    "@capybara-hq/plugin-sdk": "^0.1.0-rc.0",
+    "zod": "^4.6.7"
+  }
+}

package/fixtures/extensions/fake-embed/src/index.ts

@@ -0,0 +1,207 @@
+import { defineExtension, EMBED_PROTOCOL, type EmbedClaims } from "@capybara-hq/plugin-sdk";
+import { z } from "zod";
+
+/**
+ * Test fake of an embed extension (`ui.embeds`): the kernel side of embedded apps (token issue and
+ * verification, the `/plugin-ui` proxy, `ctx.bus` across replicas) without the official board.
+ * - embeds `panel` (org page, `/ui/panel`) and `panel-conv` (conversation tab, `/ui/panel-conv`);
+ *   both pages are static HTML loading the static script `/ui/panel.js`; none of them needs a
+ *   token. The script speaks the host's message bridge (`capybara-embed/1`): on `init` it fetches
+ *   `claims` with the token it was given, shows `<contribution> <orgId>` in `#status` and posts a
+ *   `toast` "fake-embed ready" to the host (a failed fetch shows `error <status>`), then reads the
+ *   `/ui/events` stream with the token: `ready` sets `data-live="1"` on the body, each `event`
+ *   shows its text in `#event`;
+ * - every data route checks `Authorization: Bearer <embed token>` with `ctx.ui.verifyEmbedToken`
+ *   (401 otherwise); identity comes only from the claims;
+ * - `GET /ui/claims` returns the verified claims;
+ * - `POST /ui/events` `{ text }` publishes `{ conversationId, text }` on the bus topic
+ *   `events.<orgId>` (202);
+ * - `GET /ui/events` is an SSE stream: `ready` first, then an `event` for each message in the
+ *   token's scope (its conversation, or org-wide messages for a page token); it ends when the
+ *   client disconnects or the token expires.
+ */
+
+const BEARER_RE = /^Bearer ([A-Za-z0-9._-]{1,4096})$/;
+const EventBody = z.object({ text: z.string().min(1).max(200) });
+
+const PAGE = `<!doctype html><html><head><meta charset="utf-8"><title>Fake embed</title><script src="./panel.js"></script></head><body><p>fake-embed</p><p id="status">waiting</p><p id="event"></p></body></html>`;
+
+const SCRIPT = `(function () {
+  var PROTOCOL = "${EMBED_PROTOCOL}";
+  var started = false;
+  document.addEventListener("DOMContentLoaded", function () { document.body.dataset.ready = "1"; });
+  function show(text) { document.getElementById("status").textContent = text; }
+  window.addEventListener("message", function (e) {
+    if (e.source !== window.parent) return;
+    var m = e.data;
+    if (!m || typeof m !== "object" || m.protocol !== PROTOCOL || m.type !== "init") return;
+    if (started || typeof m.token !== "string") return;
+    started = true;
+    fetch("claims", { headers: { authorization: "Bearer " + m.token }, credentials: "omit" })
+      .then(function (res) {
+        if (!res.ok) throw new Error("error " + res.status);
+        return res.json();
+      })
+      .then(function (c) {
+        show(c.contribution + " " + c.orgId);
+        window.parent.postMessage({ protocol: PROTOCOL, type: "toast", text: "fake-embed ready" }, "*");
+        listen(m.token);
+      })
+      .catch(function (err) { show(String(err.message)); });
+  });
+  // The SSE stream of /ui/events, read with fetch (EventSource cannot send the token): "ready"
+  // marks the body data-live="1", each "event" shows its text in #event.
+  function listen(token) {
+    fetch("events", { headers: { authorization: "Bearer " + token }, credentials: "omit" })
+      .then(function (res) {
+        if (!res.ok || !res.body) throw new Error("events " + res.status);
+        var reader = res.body.getReader();
+        var decoder = new TextDecoder();
+        var buf = "";
+        function pump() {
+          return reader.read().then(function (r) {
+            if (r.done) return;
+            buf += decoder.decode(r.value, { stream: true });
+            var at;
+            while ((at = buf.indexOf("\\n\\n")) >= 0) {
+              var block = buf.slice(0, at);
+              buf = buf.slice(at + 2);
+              var type = (/^event: (.*)$/m.exec(block) || [])[1];
+              var data = (/^data: (.*)$/m.exec(block) || [])[1];
+              if (type === "ready") document.body.dataset.live = "1";
+              if (type === "event") document.getElementById("event").textContent = JSON.parse(data).text;
+            }
+            return pump();
+          });
+        }
+        return pump();
+      })
+      .catch(function (err) { document.getElementById("event").textContent = String(err.message); });
+  }
+})();
+`;
+
+const topic = (orgId: string) => `events.${orgId}`;
+
+const json = (status: number, body: unknown) => Response.json(body, { status });
+const unauthorized = () =>
+  json(401, { error: { code: "unauthorized", message: "A valid embed token is required" } });
+
+export default defineExtension({
+  name: "fake-embed",
+  version: "0.1.0",
+  sdk: "^0.1.0-rc.0",
+  provides: [],
+  ui: [
+    {
+      id: "panel",
+      title: { zh: "面板", en: "Panel" },
+      place: "page",
+      kind: "embed",
+      path: "/ui/panel",
+    },
+    {
+      id: "panel-conv",
+      title: { zh: "面板", en: "Panel" },
+      place: "conversation",
+      kind: "embed",
+      path: "/ui/panel-conv",
+    },
+  ],
+  permissions: {
+    http: [
+      { method: "GET", path: "/ui/panel" },
+      { method: "GET", path: "/ui/panel-conv" },
+      { method: "GET", path: "/ui/panel.js" },
+      { method: "GET", path: "/ui/claims" },
+      { method: "POST", path: "/ui/events" },
+      { method: "GET", path: "/ui/events" },
+    ],
+    ui: { embeds: ["panel", "panel-conv"] },
+  },
+  setup(ctx) {
+    const auth = async (req: Request): Promise<EmbedClaims | null> => {
+      const m = BEARER_RE.exec(req.headers.get("authorization") ?? "");
+      return m?.[1] === undefined ? null : ctx.ui.verifyEmbedToken(m[1]);
+    };
+    const page = async () =>
+      new Response(PAGE, { headers: { "content-type": "text/html; charset=utf-8" } });
+    ctx.http.route("GET", "/ui/panel", page);
+    ctx.http.route("GET", "/ui/panel-conv", page);
+    ctx.http.route(
+      "GET",
+      "/ui/panel.js",
+      async () =>
+        new Response(SCRIPT, { headers: { "content-type": "text/javascript; charset=utf-8" } }),
+    );
+
+    ctx.http.route("GET", "/ui/claims", async (req) => {
+      const claims = await auth(req);
+      return claims ? json(200, claims) : unauthorized();
+    });
+
+    ctx.http.route("POST", "/ui/events", async (req) => {
+      const claims = await auth(req);
+      if (!claims) return unauthorized();
+      const body = EventBody.safeParse(await req.json().catch(() => undefined));
+      if (!body.success) {
+        return json(400, { error: { code: "validation_failed", message: "text is required" } });
+      }
+      await ctx.bus.publish(topic(claims.orgId), {
+        conversationId: claims.conversationId ?? null,
+        text: body.data.text,
+      });
+      return json(202, { published: true });
+    });
+
+    ctx.http.route("GET", "/ui/events", async (req) => {
+      const claims = await auth(req);
+      if (!claims) return unauthorized();
+      const done = AbortSignal.any([
+        req.signal,
+        AbortSignal.timeout(Math.max(1, claims.exp * 1000 - Date.now())),
+      ]);
+      const enc = new TextEncoder();
+      let closed = false;
+      let unsubscribe: (() => Promise<void>) | undefined;
+      const stream = new ReadableStream<Uint8Array>({
+        async start(controller) {
+          const send = (s: string) => {
+            if (!closed) controller.enqueue(enc.encode(s));
+          };
+          const finish = () => {
+            if (closed) return;
+            closed = true;
+            void unsubscribe?.().catch(() => {});
+            try {
+              controller.close();
+            } catch {
+              // already cancelled
+            }
+          };
+          unsubscribe = await ctx.bus.subscribe(topic(claims.orgId), (m) => {
+            const msg = m as { conversationId?: unknown; text?: unknown } | null;
+            if ((msg?.conversationId ?? null) !== (claims.conversationId ?? null)) return;
+            send(`event: event\ndata: ${JSON.stringify({ text: String(msg?.text ?? "") })}\n\n`);
+          });
+          if (done.aborted) {
+            finish();
+            return;
+          }
+          done.addEventListener("abort", finish, { once: true });
+          send("event: ready\ndata: {}\n\n");
+        },
+        cancel() {
+          closed = true;
+          void unsubscribe?.().catch(() => {});
+        },
+      });
+      return new Response(stream, {
+        headers: {
+          "content-type": "text/event-stream; charset=utf-8",
+          "cache-control": "no-cache",
+        },
+      });
+    });
+  },
+});

package/fixtures/extensions/fake-im/.capybara-plugin/plugin.json

@@ -0,0 +1,7 @@
+{
+  "schemaVersion": 1,
+  "name": "fake-im",
+  "version": "0.1.0",
+  "publisher": "Capybara",
+  "description": "Test fake: a whole IM platform for startFakeChannelServer (channel@1, identity-source@1, directory@1) and a write tool that asks"
+}

package/fixtures/extensions/fake-im/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "@capybara-hq/test-plugin-fake-im",
+  "version": "0.1.0",
+  "private": true,
+  "description": "Test fake: a whole IM platform for startFakeChannelServer (channel@1, identity-source@1, directory@1) and a write tool that asks",
+  "license": "Apache-2.0",
+  "type": "module",
+  "dependencies": {
+    "@capybara-hq/plugin-sdk": "^0.1.0-rc.0",
+    "zod": "^4.6.7"
+  }
+}

package/fixtures/extensions/fake-im/src/channel.ts

@@ -0,0 +1,224 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+import {
+  type Channel,
+  ChannelSendError,
+  type ChannelSendFailure,
+  type ChannelWebhook,
+  type InboundEvent,
+  secret,
+} from "@capybara-hq/plugin-sdk";
+import { z } from "zod";
+
+/**
+ * 假 IM 平台的 `channel@1`（连 `@capybara-hq/testing` 的 startFakeChannelServer）。真实渠道插件（Slack / 飞书）照这个形状写：
+ * - verify：`POST <platformUrl>/bot/verify` 校验应用凭据，拿到机器人 id 与租户；
+ * - connect：`GET <platformUrl>/connect` 拿一条 NDJSON 长连接，逐行交给 `onEvent`；平台关闭连接后自行重连，
+ *   连接请求失败（非 200）时抛错（内核据此记录 last_error 并退避重试）；signal 中止时返回；
+ * - send / update：POST 给平台并透传 `idempotencyKey`（平台据此去重）与 `locale`；429 / 5xx 抛可重试的
+ *   `ChannelSendError`（带平台给的等待时长），其他失败抛不可重试的（带平台给的失败原因 `reason`）。
+ * 所有请求带 `x-pid`，让平台知道是哪个进程（副本）发起的。
+ */
+export const FakeImConnection = z.object({
+  platformUrl: z.string().url(),
+  appId: z.string().min(1),
+  tenant: z.string().min(1).default("t1"),
+  appSecret: secret(z.string().min(1)),
+  /**
+   * Optional secret (also tests PATCH secret semantics); the webhook signing secret: webhook
+   * requests are signed `x-fake-signature: sha256=<hex HMAC-SHA256(webhookToken, raw body)>`.
+   */
+  webhookToken: secret(z.string().min(1).optional()),
+  /** 被中止后拖这么久才返回（模拟不及时退出的插件）。 */
+  lingerMs: z.number().int().nonnegative().default(0),
+});
+type ConnConfig = z.infer<typeof FakeImConnection>;
+
+const headers = (extra: Record<string, string> = {}) => ({
+  "content-type": "application/json",
+  "x-pid": String(process.pid),
+  ...extra,
+});
+
+// capybara:allow-module-state a read-only constant set
+const REASONS = new Set<ChannelSendFailure>(["auth", "target_gone", "rejected", "too_large"]);
+
+/**
+ * Waits `ms` or until `signal` aborts. Extensions may not use timers (plugin-timer rule), so
+ * `AbortSignal.timeout` does the timing, as in the real channel extensions.
+ */
+const pause = (ms: number, signal?: AbortSignal) =>
+  new Promise<void>((resolve) => {
+    if (signal?.aborted) return resolve();
+    const timer = AbortSignal.timeout(ms);
+    const done = () => {
+      signal?.removeEventListener("abort", done);
+      timer.removeEventListener("abort", done);
+      resolve();
+    };
+    signal?.addEventListener("abort", done, { once: true });
+    timer.addEventListener("abort", done, { once: true });
+  });
+
+/**
+ * POST 给平台：429 / 5xx → 可重试的 ChannelSendError（带平台给的等待时长），其他非 200 → 不可重试
+ * （带平台给的失败原因）。
+ */
+async function post(c: ConnConfig, path: string, body: unknown, signal: AbortSignal) {
+  const res = await fetch(`${c.platformUrl}${path}`, {
+    method: "POST",
+    headers: headers(),
+    body: JSON.stringify(body),
+    signal,
+  });
+  if (res.status === 200) return res;
+  const b = (await res.json().catch(() => ({}))) as {
+    retryAfterMs?: number | null;
+    reason?: string | null;
+  };
+  const retryable = res.status === 429 || res.status >= 500;
+  const reason = REASONS.has(b.reason as ChannelSendFailure)
+    ? (b.reason as ChannelSendFailure)
+    : undefined;
+  throw new ChannelSendError(`platform returned ${res.status}`, {
+    retryable,
+    ...(typeof b.retryAfterMs === "number" && { retryAfterMs: b.retryAfterMs }),
+    ...(!retryable && reason !== undefined && { reason }),
+  });
+}
+
+/** 读一条 NDJSON 长连接直到平台关闭；每行一个入站事件。 */
+async function pump(body: ReadableStream<Uint8Array>, onEvent: (e: InboundEvent) => Promise<void>) {
+  const reader = body.getReader();
+  const dec = new TextDecoder();
+  let buf = "";
+  for (;;) {
+    const { value, done } = await reader.read();
+    if (done) return;
+    buf += dec.decode(value, { stream: true });
+    let nl = buf.indexOf("\n");
+    while (nl >= 0) {
+      const line = buf.slice(0, nl).trim();
+      buf = buf.slice(nl + 1);
+      if (line !== "") {
+        try {
+          await onEvent(JSON.parse(line) as InboundEvent);
+        } catch {
+          // 处理失败：真实平台会因未确认而重投；测试里由平台手动重推
+        }
+      }
+      nl = buf.indexOf("\n");
+    }
+  }
+}
+
+/** Constant-time check of `x-fake-signature` against HMAC-SHA256(secret, body). */
+function signatureOk(header: string | undefined, secret: string, body: Uint8Array): boolean {
+  if (header === undefined) return false;
+  const want = Buffer.from(`sha256=${createHmac("sha256", secret).update(body).digest("hex")}`);
+  const got = Buffer.from(header);
+  return got.length === want.length && timingSafeEqual(got, want);
+}
+
+/**
+ * Webhook inbound of the fake platform (see `signFakeWebhook` in `@capybara-hq/testing`): every
+ * request must be signed with `webhookToken` (missing secret or bad signature → reject 401);
+ * `{ type: "challenge", challenge }` echoes `{ challenge }`; `{ type: "events", events }` hands the
+ * events to the kernel with the ack body `ok`; anything else → reject 400.
+ */
+export const fakeImWebhook: ChannelWebhook = {
+  async handle({ config, request }) {
+    const c = config as ConnConfig;
+    if (c.webhookToken === undefined) return { kind: "reject", status: 401 };
+    if (!signatureOk(request.headers["x-fake-signature"], c.webhookToken, request.body)) {
+      return { kind: "reject", status: 401 };
+    }
+    let msg: { type?: unknown; challenge?: unknown; events?: unknown };
+    try {
+      msg = JSON.parse(new TextDecoder().decode(request.body)) as typeof msg;
+    } catch {
+      return { kind: "reject", status: 400 };
+    }
+    if (msg.type === "challenge" && typeof msg.challenge === "string") {
+      return {
+        kind: "respond",
+        response: {
+          status: 200,
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ challenge: msg.challenge }),
+        },
+      };
+    }
+    if (msg.type === "events" && Array.isArray(msg.events)) {
+      return {
+        kind: "events",
+        events: msg.events as InboundEvent[],
+        ack: { status: 200, headers: { "content-type": "text/plain" }, body: "ok" },
+      };
+    }
+    return { kind: "reject", status: 400 };
+  },
+};
+
+/**
+ * 按能力开关造一个假渠道（chan-mini / chan-noedit 复用，只是插件名与 features 不同）。
+ * `opts.webhook` adds {@link fakeImWebhook} (only `fake-im` has it; the others test "unsupported").
+ */
+export const makeFakeImChannel = (
+  features: Channel["features"],
+  opts: { webhook?: boolean } = {},
+): Channel => ({
+  ...(opts.webhook === true && { webhook: fakeImWebhook }),
+  connectionSchema: FakeImConnection,
+  features,
+  async verify({ config, signal }) {
+    const c = config as ConnConfig;
+    const res = await fetch(`${c.platformUrl}/bot/verify`, {
+      method: "POST",
+      headers: headers(),
+      body: JSON.stringify({ appId: c.appId, appSecret: c.appSecret, tenant: c.tenant }),
+      signal,
+    });
+    if (res.status !== 200) {
+      await res.body?.cancel();
+      throw new Error(`invalid app credentials (platform returned ${res.status})`);
+    }
+    return (await res.json()) as { botUserId: string; botName: string; tenantId: string };
+  },
+  async connect({ connectionId, config, onEvent, signal }) {
+    const c = config as ConnConfig;
+    while (!signal.aborted) {
+      try {
+        const res = await fetch(
+          `${c.platformUrl}/connect?connection=${encodeURIComponent(connectionId)}`,
+          { signal, headers: headers({ "x-app-id": c.appId }) },
+        );
+        if (res.status !== 200 || !res.body) {
+          await res.body?.cancel();
+          throw new Error(`connect failed with status ${res.status}`);
+        }
+        await pump(res.body, onEvent);
+      } catch (e) {
+        if (signal.aborted) {
+          // the signal is already aborted: linger without it
+          if (c.lingerMs > 0) await pause(c.lingerMs);
+          return;
+        }
+        throw e;
+      }
+      // The platform closed the connection: reconnect shortly
+      await pause(50, signal);
+    }
+  },
+  async send({ config, target, message, signal, idempotencyKey, locale }) {
+    const c = config as ConnConfig;
+    const body = { appId: c.appId, target, message, idempotencyKey, locale };
+    const res = await post(c, "/send", body, signal);
+    return (await res.json()) as { messageId: string };
+  },
+  async update({ config, target, message, messageId, signal, idempotencyKey, locale }) {
+    const c = config as ConnConfig;
+    const body = { appId: c.appId, target, message, messageId, idempotencyKey, locale };
+    const res = await post(c, "/update", body, signal);
+    await res.body?.cancel();
+  },
+});

package/fixtures/extensions/fake-im/src/directory.ts

@@ -0,0 +1,25 @@
+import type { Directory, DirectoryMember } from "@capybara-hq/plugin-sdk";
+import { z } from "zod";
+
+/** 组织级配置：假平台上一份通讯录的地址（startFakeChannelServer().book(key).url）。 */
+export const FakeImOrgConfig = z.object({ url: z.string().url() });
+
+/**
+ * 假 IM 平台的 `directory@1`：`listMembers` 按游标 GET `<url>/members?cursor=<c>`（请求头 `x-pid`），
+ * 非 200 抛错（内核把整轮当作不完整，不移除任何人）。dir-mini 复用它。
+ */
+export const fakeImDirectory: Directory = {
+  async listMembers({ orgConfig, cursor, signal }) {
+    const c = FakeImOrgConfig.parse(orgConfig);
+    const q = cursor === undefined ? "" : `?cursor=${encodeURIComponent(cursor)}`;
+    const res = await fetch(`${c.url}/members${q}`, {
+      signal,
+      headers: { "x-pid": String(process.pid) },
+    });
+    if (res.status !== 200) {
+      await res.body?.cancel();
+      throw new Error(`directory returned ${res.status}`);
+    }
+    return (await res.json()) as { members: DirectoryMember[]; next?: string };
+  },
+};

package/fixtures/extensions/fake-im/src/identity.ts

@@ -0,0 +1,66 @@
+import type { ExternalIdentity, IdentitySource } from "@capybara-hq/plugin-sdk";
+import type { FakeImDeployment } from "./index.js";
+
+interface TokenResponse {
+  user: {
+    externalId: string;
+    tenantId: string;
+    email?: string;
+    emailVerified?: boolean;
+    displayName: string;
+  };
+  nonce: string;
+}
+
+/**
+ * 假 IM 平台的 `identity-source@1`（登录）：授权地址指向平台的 `/oauth/authorize`；回调用授权码在
+ * `/oauth/token` 换用户资料，核对 nonce 与租户。身份源键 `fake-im:<租户>` 与渠道入站、通讯录相同，
+ * 同一个人只对应一行身份。授权地址带内核给的 PKCE challenge，换 token 时带 codeVerifier（平台核对）。
+ */
+export const fakeImIdentitySource: IdentitySource = {
+  label: { zh: "假 IM", en: "Fake IM" },
+  authorizeUrl({ config, redirectUri, state, nonce, codeChallenge, codeChallengeMethod }) {
+    const c = config as FakeImDeployment;
+    const u = new URL(`${c.platformUrl}/oauth/authorize`);
+    u.searchParams.set("client_id", c.clientId);
+    u.searchParams.set("redirect_uri", redirectUri);
+    u.searchParams.set("state", state);
+    u.searchParams.set("nonce", nonce);
+    if (codeChallenge !== undefined) {
+      u.searchParams.set("code_challenge", codeChallenge);
+      u.searchParams.set("code_challenge_method", codeChallengeMethod ?? "S256");
+    }
+    return u.toString();
+  },
+  async callback({ config, query, nonce, signal, codeVerifier }): Promise<ExternalIdentity> {
+    const c = config as FakeImDeployment;
+    if (query.error !== undefined) throw new Error(`authorization failed: ${query.error}`);
+    if (query.code === undefined) throw new Error("authorization code missing");
+    const res = await fetch(`${c.platformUrl}/oauth/token`, {
+      method: "POST",
+      headers: { "content-type": "application/json", "x-pid": String(process.pid) },
+      body: JSON.stringify({
+        code: query.code,
+        clientId: c.clientId,
+        clientSecret: c.clientSecret,
+        ...(codeVerifier !== undefined && { codeVerifier }),
+      }),
+      signal,
+    });
+    if (res.status !== 200) {
+      await res.body?.cancel();
+      throw new Error(`token exchange failed with status ${res.status}`);
+    }
+    const t = (await res.json()) as TokenResponse;
+    if (t.nonce !== nonce) throw new Error("nonce mismatch");
+    if (t.user.tenantId !== c.tenant) throw new Error("user belongs to another tenant");
+    return {
+      source: `fake-im:${t.user.tenantId}`,
+      externalId: t.user.externalId,
+      tenantId: t.user.tenantId,
+      ...(t.user.email !== undefined && { email: t.user.email }),
+      emailVerified: t.user.emailVerified ?? false,
+      displayName: t.user.displayName,
+    };
+  },
+};