@cleocode/contracts 2026.6.13 → 2026.6.15

package/dist/vault/service-provider.js

@@ -0,0 +1,857 @@
+/**
+ * Universal service-vault — declarative service-provider registry (types + DATA).
+ *
+ * EP-UNIVERSAL-SERVICE-VAULT (epic T11765 · saga SG-VAULT-CORE T10409 · M2 W1a ·
+ * task T11937). The **service** half of the universal vault: machine-wide OAuth /
+ * API credentials for third-party SERVICES (github, google, notion, figma, …) —
+ * distinct from the LLM-provider credential pool (`accounts`, T11709) which holds
+ * model-API keys. A {@link ServiceProviderDef} is a purely declarative description
+ * of one connectable service: its stable key, display label, auth shape, and the
+ * default OAuth endpoints/scopes the (later) OAuth dance (T11939) will drive.
+ *
+ * ## Why this lives in `@cleocode/contracts` (Gate 10 purity)
+ *
+ * This module is **types + frozen DATA only**. {@link SERVICE_PROVIDERS} is a
+ * `const` record literal (no bodied function, no zod schema, no type guard) — it
+ * is configuration data, exactly like a routing table, so it satisfies the
+ * contracts-purity gate (`lint-no-runtime-in-contracts`). The runtime that
+ * CONSUMES the registry (the store, the trust gate, the OAuth flow) lives in
+ * `@cleocode/core`; this file never imports from core and carries no side effects.
+ *
+ * ## Pattern, not census (T11937 vs T11938)
+ *
+ * Only **github** and **google** are seeded here, deliberately — they prove the
+ * declarative pattern (one PKCE provider with a fixed loopback, one classic
+ * web-OAuth provider) before the fan-out to ~40 services in the follow-up
+ * (T11938). Adding a service is a single DATA entry; no code change.
+ *
+ * @module contracts/vault/service-provider
+ * @task T11937
+ * @epic T11765
+ * @saga T10409
+ * @see ../llm/oauth.js — `ProviderOAuthConfig` / `OAuthMode` (reused here)
+ * @see ../llm/sealed-credential.js — `SealedCredential` (the egress handle a resolved service credential is wrapped in)
+ */
+/**
+ * Auth shape a service uses to obtain credentials.
+ *
+ * - `oauth2` — classic OAuth 2.0 Authorization Code grant (e.g. github web flow).
+ * - `oauth2-pkce` — OAuth 2.0 Authorization Code + PKCE (RFC 7636), for CLI /
+ *   headless flows (e.g. google installed-app flow).
+ * - `api-key` — a long-lived API token pasted/imported directly (no OAuth dance).
+ *
+ * The value drives which fields of {@link ServiceProviderDef.oauth} are required
+ * and which OAuth code path (T11939) runs for the service.
+ *
+ * @task T11937
+ */
+export const SERVICE_AUTH_KINDS = ['oauth2', 'oauth2-pkce', 'api-key'];
+// ---------------------------------------------------------------------------
+// Refresh configuration (T11938 BREADTH · T11939 W2 — driven by this DATA)
+// ---------------------------------------------------------------------------
+/**
+ * Discriminant naming the refresh GRANT a provider uses (T11938 AC3).
+ *
+ * The OAuth flow (T11939) branches on this value to pick the refresh code path:
+ *
+ *  - `refresh-token` — the standard OAuth 2.0 `grant_type=refresh_token` exchange
+ *    (RFC 6749 §6), shaped by {@link RefreshConfig.bodyFormat} /
+ *    {@link RefreshConfig.clientAuth}. The common case (google, atlassian, …).
+ *  - `github-app` — a GitHub App installation token: sign an RS256 JWT with the
+ *    app private key, then POST `/app/installations/{id}/access_tokens`.
+ *  - `service-account-jwt` — a Google service-account: sign an RS256 JWT and
+ *    exchange it via `grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer`.
+ *  - `client-credentials` — the OAuth 2.0 `grant_type=client_credentials` grant
+ *    (RFC 6749 §4.4), Basic-auth client id/secret (e.g. MongoDB Atlas SAs).
+ *
+ * @task T11938
+ */
+export const REFRESH_KINDS = [
+    'refresh-token',
+    'github-app',
+    'service-account-jwt',
+    'client-credentials',
+];
+// ---------------------------------------------------------------------------
+// Shared refresh configs (T11938) — frozen DATA reused across provider families.
+// Mirror onecli `apps.rs` statics (GOOGLE_REFRESH, ATLASSIAN_REFRESH, …). These
+// are `const` object literals (no runtime helper) so contracts-purity (Gate 10)
+// stays green.
+// ---------------------------------------------------------------------------
+/** Shared refresh config for every Google OAuth API (form body, client-id/secret in body). */
+const GOOGLE_REFRESH = {
+    kind: 'refresh-token',
+    tokenUrl: 'https://oauth2.googleapis.com/token',
+    bodyFormat: 'form',
+    clientAuth: 'body',
+};
+/** Shared refresh config for the Atlassian OAuth APIs (Jira, Confluence) — JSON body. */
+const ATLASSIAN_REFRESH = {
+    kind: 'refresh-token',
+    tokenUrl: 'https://auth.atlassian.com/oauth/token',
+    bodyFormat: 'json',
+    clientAuth: 'body',
+};
+/**
+ * The full service-provider census — **~40 declarative entries** (T11938 BREADTH).
+ *
+ * Spread into {@link SERVICE_PROVIDERS} after the github/google seeds. Each entry
+ * is PURE DATA cannibalized from onecli `apps.rs::APP_PROVIDERS` (host rules,
+ * refresh shape, display name) — no code, no runtime helper. Three special-case
+ * refresh GRANTS are declared as {@link RefreshKind} discriminants (T11938 AC3):
+ * `github-app` (GitHub App), `client-credentials` (MongoDB Atlas SAs). The OAuth
+ * flow (T11939) branches on `refresh.kind` to drive the right grant.
+ *
+ * Default OAuth `clientId`s are PLACEHOLDER public client ids (BYOC-overridden at
+ * flow time from `service_configs`); they are not secrets.
+ *
+ * @task T11938
+ */
+const SERVICE_PROVIDERS_BREADTH = {
+    // ── GitHub App (installation token via signed RS256 JWT — special refresh) ──
+    'github-app': {
+        provider: 'github-app',
+        displayName: 'GitHub App',
+        authKind: 'oauth2',
+        description: 'GitHub App installation access — short-lived installation tokens.',
+        defaultScopes: '',
+        refresh: {
+            kind: 'github-app',
+            tokenUrl: 'https://api.github.com/app/installations',
+        },
+        hostRules: [
+            { host: 'api.github.com', strategy: 'bearer' },
+            { host: 'github.com', strategy: 'basic-x-access-token' },
+            { host: 'raw.githubusercontent.com', strategy: 'bearer' },
+        ],
+    },
+    // ── Google API family (all share GOOGLE_REFRESH + the google PKCE oauth) ──
+    gmail: {
+        provider: 'gmail',
+        displayName: 'Gmail',
+        authKind: 'oauth2-pkce',
+        description: 'Read, search, and send mail via the Gmail API.',
+        defaultScopes: 'https://www.googleapis.com/auth/gmail.modify',
+        oauth: {
+            mode: 'pkce',
+            clientId: 'cleo-google-client-id.apps.googleusercontent.com',
+            authorizationEndpoint: 'https://accounts.google.com/o/oauth2/v2/auth',
+            tokenEndpoint: 'https://oauth2.googleapis.com/token',
+            scope: 'https://www.googleapis.com/auth/gmail.modify',
+            redirectUri: 'http://127.0.0.1:7878/service/gmail/callback',
+            extraAuthParams: { access_type: 'offline', prompt: 'consent' },
+        },
+        refresh: GOOGLE_REFRESH,
+        hostRules: [
+            { host: 'gmail.googleapis.com', strategy: 'bearer' },
+            { host: 'www.googleapis.com', pathPrefix: '/gmail/', strategy: 'bearer' },
+        ],
+    },
+    'google-calendar': {
+        provider: 'google-calendar',
+        displayName: 'Google Calendar',
+        authKind: 'oauth2-pkce',
+        description: 'Manage calendars and events via the Google Calendar API.',
+        defaultScopes: 'https://www.googleapis.com/auth/calendar',
+        oauth: {
+            mode: 'pkce',
+            clientId: 'cleo-google-client-id.apps.googleusercontent.com',
+            authorizationEndpoint: 'https://accounts.google.com/o/oauth2/v2/auth',
+            tokenEndpoint: 'https://oauth2.googleapis.com/token',
+            scope: 'https://www.googleapis.com/auth/calendar',
+            redirectUri: 'http://127.0.0.1:7878/service/google-calendar/callback',
+            extraAuthParams: { access_type: 'offline', prompt: 'consent' },
+        },
+        refresh: GOOGLE_REFRESH,
+        hostRules: [{ host: 'www.googleapis.com', pathPrefix: '/calendar/', strategy: 'bearer' }],
+    },
+    'google-drive': {
+        provider: 'google-drive',
+        displayName: 'Google Drive',
+        authKind: 'oauth2-pkce',
+        description: 'List, read, and write files via the Google Drive API.',
+        defaultScopes: 'https://www.googleapis.com/auth/drive',
+        oauth: {
+            mode: 'pkce',
+            clientId: 'cleo-google-client-id.apps.googleusercontent.com',
+            authorizationEndpoint: 'https://accounts.google.com/o/oauth2/v2/auth',
+            tokenEndpoint: 'https://oauth2.googleapis.com/token',
+            scope: 'https://www.googleapis.com/auth/drive',
+            redirectUri: 'http://127.0.0.1:7878/service/google-drive/callback',
+            extraAuthParams: { access_type: 'offline', prompt: 'consent' },
+        },
+        refresh: GOOGLE_REFRESH,
+        hostRules: [
+            { host: 'www.googleapis.com', pathPrefix: '/drive/', strategy: 'bearer' },
+            { host: 'www.googleapis.com', pathPrefix: '/upload/drive/', strategy: 'bearer' },
+        ],
+    },
+    'google-docs': {
+        provider: 'google-docs',
+        displayName: 'Google Docs',
+        authKind: 'oauth2-pkce',
+        description: 'Read and edit documents via the Google Docs API.',
+        defaultScopes: 'https://www.googleapis.com/auth/documents',
+        oauth: {
+            mode: 'pkce',
+            clientId: 'cleo-google-client-id.apps.googleusercontent.com',
+            authorizationEndpoint: 'https://accounts.google.com/o/oauth2/v2/auth',
+            tokenEndpoint: 'https://oauth2.googleapis.com/token',
+            scope: 'https://www.googleapis.com/auth/documents',
+            redirectUri: 'http://127.0.0.1:7878/service/google-docs/callback',
+            extraAuthParams: { access_type: 'offline', prompt: 'consent' },
+        },
+        refresh: GOOGLE_REFRESH,
+        hostRules: [{ host: 'docs.googleapis.com', strategy: 'bearer' }],
+    },
+    'google-sheets': {
+        provider: 'google-sheets',
+        displayName: 'Google Sheets',
+        authKind: 'oauth2-pkce',
+        description: 'Read and write spreadsheets via the Google Sheets API.',
+        defaultScopes: 'https://www.googleapis.com/auth/spreadsheets',
+        oauth: {
+            mode: 'pkce',
+            clientId: 'cleo-google-client-id.apps.googleusercontent.com',
+            authorizationEndpoint: 'https://accounts.google.com/o/oauth2/v2/auth',
+            tokenEndpoint: 'https://oauth2.googleapis.com/token',
+            scope: 'https://www.googleapis.com/auth/spreadsheets',
+            redirectUri: 'http://127.0.0.1:7878/service/google-sheets/callback',
+            extraAuthParams: { access_type: 'offline', prompt: 'consent' },
+        },
+        refresh: GOOGLE_REFRESH,
+        hostRules: [{ host: 'sheets.googleapis.com', strategy: 'bearer' }],
+    },
+    'google-slides': {
+        provider: 'google-slides',
+        displayName: 'Google Slides',
+        authKind: 'oauth2-pkce',
+        description: 'Read and edit presentations via the Google Slides API.',
+        defaultScopes: 'https://www.googleapis.com/auth/presentations',
+        oauth: {
+            mode: 'pkce',
+            clientId: 'cleo-google-client-id.apps.googleusercontent.com',
+            authorizationEndpoint: 'https://accounts.google.com/o/oauth2/v2/auth',
+            tokenEndpoint: 'https://oauth2.googleapis.com/token',
+            scope: 'https://www.googleapis.com/auth/presentations',
+            redirectUri: 'http://127.0.0.1:7878/service/google-slides/callback',
+            extraAuthParams: { access_type: 'offline', prompt: 'consent' },
+        },
+        refresh: GOOGLE_REFRESH,
+        hostRules: [{ host: 'slides.googleapis.com', strategy: 'bearer' }],
+    },
+    'google-tasks': {
+        provider: 'google-tasks',
+        displayName: 'Google Tasks',
+        authKind: 'oauth2-pkce',
+        description: 'Manage task lists via the Google Tasks API.',
+        defaultScopes: 'https://www.googleapis.com/auth/tasks',
+        oauth: {
+            mode: 'pkce',
+            clientId: 'cleo-google-client-id.apps.googleusercontent.com',
+            authorizationEndpoint: 'https://accounts.google.com/o/oauth2/v2/auth',
+            tokenEndpoint: 'https://oauth2.googleapis.com/token',
+            scope: 'https://www.googleapis.com/auth/tasks',
+            redirectUri: 'http://127.0.0.1:7878/service/google-tasks/callback',
+            extraAuthParams: { access_type: 'offline', prompt: 'consent' },
+        },
+        refresh: GOOGLE_REFRESH,
+        hostRules: [{ host: 'tasks.googleapis.com', strategy: 'bearer' }],
+    },
+    'google-forms': {
+        provider: 'google-forms',
+        displayName: 'Google Forms',
+        authKind: 'oauth2-pkce',
+        description: 'Read forms and responses via the Google Forms API.',
+        defaultScopes: 'https://www.googleapis.com/auth/forms.body',
+        oauth: {
+            mode: 'pkce',
+            clientId: 'cleo-google-client-id.apps.googleusercontent.com',
+            authorizationEndpoint: 'https://accounts.google.com/o/oauth2/v2/auth',
+            tokenEndpoint: 'https://oauth2.googleapis.com/token',
+            scope: 'https://www.googleapis.com/auth/forms.body',
+            redirectUri: 'http://127.0.0.1:7878/service/google-forms/callback',
+            extraAuthParams: { access_type: 'offline', prompt: 'consent' },
+        },
+        refresh: GOOGLE_REFRESH,
+        hostRules: [{ host: 'forms.googleapis.com', strategy: 'bearer' }],
+    },
+    'google-classroom': {
+        provider: 'google-classroom',
+        displayName: 'Google Classroom',
+        authKind: 'oauth2-pkce',
+        description: 'Manage courses and coursework via the Google Classroom API.',
+        defaultScopes: 'https://www.googleapis.com/auth/classroom.courses',
+        oauth: {
+            mode: 'pkce',
+            clientId: 'cleo-google-client-id.apps.googleusercontent.com',
+            authorizationEndpoint: 'https://accounts.google.com/o/oauth2/v2/auth',
+            tokenEndpoint: 'https://oauth2.googleapis.com/token',
+            scope: 'https://www.googleapis.com/auth/classroom.courses',
+            redirectUri: 'http://127.0.0.1:7878/service/google-classroom/callback',
+            extraAuthParams: { access_type: 'offline', prompt: 'consent' },
+        },
+        refresh: GOOGLE_REFRESH,
+        hostRules: [{ host: 'classroom.googleapis.com', strategy: 'bearer' }],
+    },
+    'google-admin': {
+        provider: 'google-admin',
+        displayName: 'Google Admin',
+        authKind: 'oauth2-pkce',
+        description: 'Directory and admin operations via the Google Admin SDK.',
+        defaultScopes: 'https://www.googleapis.com/auth/admin.directory.user',
+        oauth: {
+            mode: 'pkce',
+            clientId: 'cleo-google-client-id.apps.googleusercontent.com',
+            authorizationEndpoint: 'https://accounts.google.com/o/oauth2/v2/auth',
+            tokenEndpoint: 'https://oauth2.googleapis.com/token',
+            scope: 'https://www.googleapis.com/auth/admin.directory.user',
+            redirectUri: 'http://127.0.0.1:7878/service/google-admin/callback',
+            extraAuthParams: { access_type: 'offline', prompt: 'consent' },
+        },
+        refresh: GOOGLE_REFRESH,
+        hostRules: [{ host: 'admin.googleapis.com', strategy: 'bearer' }],
+    },
+    'google-analytics': {
+        provider: 'google-analytics',
+        displayName: 'Google Analytics',
+        authKind: 'oauth2-pkce',
+        description: 'Query reports via the Google Analytics Data API.',
+        defaultScopes: 'https://www.googleapis.com/auth/analytics.readonly',
+        oauth: {
+            mode: 'pkce',
+            clientId: 'cleo-google-client-id.apps.googleusercontent.com',
+            authorizationEndpoint: 'https://accounts.google.com/o/oauth2/v2/auth',
+            tokenEndpoint: 'https://oauth2.googleapis.com/token',
+            scope: 'https://www.googleapis.com/auth/analytics.readonly',
+            redirectUri: 'http://127.0.0.1:7878/service/google-analytics/callback',
+            extraAuthParams: { access_type: 'offline', prompt: 'consent' },
+        },
+        refresh: GOOGLE_REFRESH,
+        hostRules: [{ host: 'analyticsdata.googleapis.com', strategy: 'bearer' }],
+    },
+    'google-search-console': {
+        provider: 'google-search-console',
+        displayName: 'Google Search Console',
+        authKind: 'oauth2-pkce',
+        description: 'Query search analytics via the Google Search Console API.',
+        defaultScopes: 'https://www.googleapis.com/auth/webmasters.readonly',
+        oauth: {
+            mode: 'pkce',
+            clientId: 'cleo-google-client-id.apps.googleusercontent.com',
+            authorizationEndpoint: 'https://accounts.google.com/o/oauth2/v2/auth',
+            tokenEndpoint: 'https://oauth2.googleapis.com/token',
+            scope: 'https://www.googleapis.com/auth/webmasters.readonly',
+            redirectUri: 'http://127.0.0.1:7878/service/google-search-console/callback',
+            extraAuthParams: { access_type: 'offline', prompt: 'consent' },
+        },
+        refresh: GOOGLE_REFRESH,
+        hostRules: [
+            { host: 'searchconsole.googleapis.com', strategy: 'bearer' },
+            { host: 'www.googleapis.com', pathPrefix: '/webmasters/', strategy: 'bearer' },
+        ],
+    },
+    'google-meet': {
+        provider: 'google-meet',
+        displayName: 'Google Meet',
+        authKind: 'oauth2-pkce',
+        description: 'Manage meeting spaces and conference records via the Google Meet API.',
+        defaultScopes: 'https://www.googleapis.com/auth/meetings.space.created',
+        oauth: {
+            mode: 'pkce',
+            clientId: 'cleo-google-client-id.apps.googleusercontent.com',
+            authorizationEndpoint: 'https://accounts.google.com/o/oauth2/v2/auth',
+            tokenEndpoint: 'https://oauth2.googleapis.com/token',
+            scope: 'https://www.googleapis.com/auth/meetings.space.created',
+            redirectUri: 'http://127.0.0.1:7878/service/google-meet/callback',
+            extraAuthParams: { access_type: 'offline', prompt: 'consent' },
+        },
+        refresh: GOOGLE_REFRESH,
+        hostRules: [{ host: 'meet.googleapis.com', strategy: 'bearer' }],
+    },
+    'google-photos': {
+        provider: 'google-photos',
+        displayName: 'Google Photos',
+        authKind: 'oauth2-pkce',
+        description: 'Read media items and albums via the Google Photos Library API.',
+        defaultScopes: 'https://www.googleapis.com/auth/photoslibrary.readonly',
+        oauth: {
+            mode: 'pkce',
+            clientId: 'cleo-google-client-id.apps.googleusercontent.com',
+            authorizationEndpoint: 'https://accounts.google.com/o/oauth2/v2/auth',
+            tokenEndpoint: 'https://oauth2.googleapis.com/token',
+            scope: 'https://www.googleapis.com/auth/photoslibrary.readonly',
+            redirectUri: 'http://127.0.0.1:7878/service/google-photos/callback',
+            extraAuthParams: { access_type: 'offline', prompt: 'consent' },
+        },
+        refresh: GOOGLE_REFRESH,
+        hostRules: [{ host: 'photoslibrary.googleapis.com', strategy: 'bearer' }],
+    },
+    youtube: {
+        provider: 'youtube',
+        displayName: 'YouTube',
+        authKind: 'oauth2-pkce',
+        description: 'Manage channels, videos, and playlists via the YouTube Data API.',
+        defaultScopes: 'https://www.googleapis.com/auth/youtube',
+        oauth: {
+            mode: 'pkce',
+            clientId: 'cleo-google-client-id.apps.googleusercontent.com',
+            authorizationEndpoint: 'https://accounts.google.com/o/oauth2/v2/auth',
+            tokenEndpoint: 'https://oauth2.googleapis.com/token',
+            scope: 'https://www.googleapis.com/auth/youtube',
+            redirectUri: 'http://127.0.0.1:7878/service/youtube/callback',
+            extraAuthParams: { access_type: 'offline', prompt: 'consent' },
+        },
+        refresh: GOOGLE_REFRESH,
+        hostRules: [{ host: 'www.googleapis.com', pathPrefix: '/youtube/', strategy: 'bearer' }],
+    },
+    'vertex-ai': {
+        provider: 'vertex-ai',
+        displayName: 'Vertex AI',
+        authKind: 'oauth2-pkce',
+        description: 'Call Google Cloud Vertex AI model endpoints.',
+        defaultScopes: 'https://www.googleapis.com/auth/cloud-platform',
+        oauth: {
+            mode: 'pkce',
+            clientId: 'cleo-google-client-id.apps.googleusercontent.com',
+            authorizationEndpoint: 'https://accounts.google.com/o/oauth2/v2/auth',
+            tokenEndpoint: 'https://oauth2.googleapis.com/token',
+            scope: 'https://www.googleapis.com/auth/cloud-platform',
+            redirectUri: 'http://127.0.0.1:7878/service/vertex-ai/callback',
+            extraAuthParams: { access_type: 'offline', prompt: 'consent' },
+        },
+        refresh: GOOGLE_REFRESH,
+        hostRules: [
+            { host: 'aiplatform.googleapis.com', strategy: 'bearer' },
+            { host: 'oauth2.googleapis.com', strategy: 'bearer' },
+        ],
+        metadataHeaders: [{ metadataKey: 'projectId', headerName: 'x-goog-user-project' }],
+    },
+    // ── Atlassian family (JSON refresh body) ──
+    jira: {
+        provider: 'jira',
+        displayName: 'Jira',
+        authKind: 'oauth2',
+        description: 'Issues, projects, and workflows via the Jira Cloud REST API.',
+        defaultScopes: 'read:jira-work write:jira-work offline_access',
+        oauth: {
+            mode: 'pkce',
+            clientId: 'cleo-atlassian-client-id',
+            authorizationEndpoint: 'https://auth.atlassian.com/authorize',
+            tokenEndpoint: 'https://auth.atlassian.com/oauth/token',
+            scope: 'read:jira-work write:jira-work offline_access',
+            redirectUri: 'http://127.0.0.1:7878/service/jira/callback',
+            extraAuthParams: { audience: 'api.atlassian.com', prompt: 'consent' },
+        },
+        refresh: ATLASSIAN_REFRESH,
+        hostRules: [{ host: 'api.atlassian.com', strategy: 'bearer' }],
+    },
+    confluence: {
+        provider: 'confluence',
+        displayName: 'Confluence',
+        authKind: 'oauth2',
+        description: 'Spaces, pages, and content via the Confluence Cloud REST API.',
+        defaultScopes: 'read:confluence-content.all write:confluence-content offline_access',
+        oauth: {
+            mode: 'pkce',
+            clientId: 'cleo-atlassian-client-id',
+            authorizationEndpoint: 'https://auth.atlassian.com/authorize',
+            tokenEndpoint: 'https://auth.atlassian.com/oauth/token',
+            scope: 'read:confluence-content.all write:confluence-content offline_access',
+            redirectUri: 'http://127.0.0.1:7878/service/confluence/callback',
+            extraAuthParams: { audience: 'api.atlassian.com', prompt: 'consent' },
+        },
+        refresh: ATLASSIAN_REFRESH,
+        hostRules: [{ host: 'api.atlassian.com', strategy: 'bearer' }],
+    },
+    // ── Notion (JSON body + Basic-auth client credentials) ──
+    notion: {
+        provider: 'notion',
+        displayName: 'Notion',
+        authKind: 'oauth2',
+        description: 'Databases, pages, and blocks via the Notion API.',
+        defaultScopes: '',
+        oauth: {
+            mode: 'pkce',
+            clientId: 'cleo-notion-client-id',
+            authorizationEndpoint: 'https://api.notion.com/v1/oauth/authorize',
+            tokenEndpoint: 'https://api.notion.com/v1/oauth/token',
+            scope: '',
+            redirectUri: 'http://127.0.0.1:7878/service/notion/callback',
+            extraAuthParams: { owner: 'user' },
+        },
+        refresh: {
+            kind: 'refresh-token',
+            tokenUrl: 'https://api.notion.com/v1/oauth/token',
+            bodyFormat: 'json',
+            clientAuth: 'basic-auth',
+        },
+        hostRules: [{ host: 'api.notion.com', strategy: 'bearer' }],
+    },
+    // ── Dropbox (form body) ──
+    dropbox: {
+        provider: 'dropbox',
+        displayName: 'Dropbox',
+        authKind: 'oauth2',
+        description: 'Files, folders, and sharing via the Dropbox API.',
+        defaultScopes: 'files.content.read files.content.write account_info.read',
+        oauth: {
+            mode: 'pkce',
+            clientId: 'cleo-dropbox-client-id',
+            authorizationEndpoint: 'https://www.dropbox.com/oauth2/authorize',
+            tokenEndpoint: 'https://api.dropboxapi.com/oauth2/token',
+            scope: 'files.content.read files.content.write account_info.read',
+            redirectUri: 'http://127.0.0.1:7878/service/dropbox/callback',
+            extraAuthParams: { token_access_type: 'offline' },
+        },
+        refresh: {
+            kind: 'refresh-token',
+            tokenUrl: 'https://api.dropboxapi.com/oauth2/token',
+            bodyFormat: 'form',
+            clientAuth: 'body',
+        },
+        hostRules: [
+            { host: 'api.dropboxapi.com', strategy: 'bearer' },
+            { host: 'content.dropboxapi.com', strategy: 'bearer' },
+        ],
+    },
+    // ── LinkedIn (form body) ──
+    linkedin: {
+        provider: 'linkedin',
+        displayName: 'LinkedIn',
+        authKind: 'oauth2',
+        description: 'Profile, posts, and shares via the LinkedIn API.',
+        defaultScopes: 'r_liteprofile r_emailaddress w_member_social',
+        oauth: {
+            mode: 'pkce',
+            clientId: 'cleo-linkedin-client-id',
+            authorizationEndpoint: 'https://www.linkedin.com/oauth/v2/authorization',
+            tokenEndpoint: 'https://www.linkedin.com/oauth/v2/accessToken',
+            scope: 'r_liteprofile r_emailaddress w_member_social',
+            redirectUri: 'http://127.0.0.1:7878/service/linkedin/callback',
+        },
+        refresh: {
+            kind: 'refresh-token',
+            tokenUrl: 'https://www.linkedin.com/oauth/v2/accessToken',
+            bodyFormat: 'form',
+            clientAuth: 'body',
+        },
+        hostRules: [{ host: 'api.linkedin.com', strategy: 'bearer' }],
+    },
+    // ── Todoist (form body) ──
+    todoist: {
+        provider: 'todoist',
+        displayName: 'Todoist',
+        authKind: 'oauth2',
+        description: 'Tasks, projects, and labels via the Todoist REST API.',
+        defaultScopes: 'data:read_write',
+        oauth: {
+            mode: 'pkce',
+            clientId: 'cleo-todoist-client-id',
+            authorizationEndpoint: 'https://todoist.com/oauth/authorize',
+            tokenEndpoint: 'https://api.todoist.com/oauth/access_token',
+            scope: 'data:read_write',
+            redirectUri: 'http://127.0.0.1:7878/service/todoist/callback',
+        },
+        refresh: {
+            kind: 'refresh-token',
+            tokenUrl: 'https://api.todoist.com/oauth/access_token',
+            bodyFormat: 'form',
+            clientAuth: 'body',
+        },
+        hostRules: [{ host: 'api.todoist.com', strategy: 'bearer' }],
+    },
+    // ── Supabase Management API (form body + Basic-auth client credentials) ──
+    supabase: {
+        provider: 'supabase',
+        displayName: 'Supabase',
+        authKind: 'oauth2',
+        description: 'Projects and configuration via the Supabase Management API.',
+        defaultScopes: 'all',
+        oauth: {
+            mode: 'pkce',
+            clientId: 'cleo-supabase-client-id',
+            authorizationEndpoint: 'https://api.supabase.com/v1/oauth/authorize',
+            tokenEndpoint: 'https://api.supabase.com/v1/oauth/token',
+            scope: 'all',
+            redirectUri: 'http://127.0.0.1:7878/service/supabase/callback',
+        },
+        refresh: {
+            kind: 'refresh-token',
+            tokenUrl: 'https://api.supabase.com/v1/oauth/token',
+            bodyFormat: 'form',
+            clientAuth: 'basic-auth',
+        },
+        hostRules: [{ host: 'api.supabase.com', strategy: 'bearer' }],
+    },
+    // ── MongoDB Atlas (client_credentials grant — special refresh) ──
+    'mongodb-atlas': {
+        provider: 'mongodb-atlas',
+        displayName: 'MongoDB Atlas',
+        authKind: 'oauth2',
+        description: 'Clusters and projects via the MongoDB Atlas Administration API.',
+        defaultScopes: '',
+        refresh: {
+            kind: 'client-credentials',
+            tokenUrl: 'https://cloud.mongodb.com/api/oauth/token',
+        },
+        hostRules: [{ host: 'cloud.mongodb.com', strategy: 'bearer' }],
+    },
+    // ── monday.com (api-key — no OAuth refresh) ──
+    monday: {
+        provider: 'monday',
+        displayName: 'monday.com',
+        authKind: 'oauth2',
+        description: 'Boards, items, and updates via the monday.com GraphQL API.',
+        defaultScopes: 'me:read boards:read boards:write',
+        oauth: {
+            mode: 'pkce',
+            clientId: 'cleo-monday-client-id',
+            authorizationEndpoint: 'https://auth.monday.com/oauth2/authorize',
+            tokenEndpoint: 'https://auth.monday.com/oauth2/token',
+            scope: 'me:read boards:read boards:write',
+            redirectUri: 'http://127.0.0.1:7878/service/monday/callback',
+        },
+        hostRules: [{ host: 'api.monday.com', strategy: 'bearer' }],
+    },
+    // ── Resend (api-key) ──
+    resend: {
+        provider: 'resend',
+        displayName: 'Resend',
+        authKind: 'api-key',
+        description: 'Send transactional email via the Resend API (API-key auth).',
+        defaultScopes: 'full_access',
+        hostRules: [{ host: 'api.resend.com', strategy: 'bearer' }],
+    },
+    // ── Cloudflare (api-key) ──
+    cloudflare: {
+        provider: 'cloudflare',
+        displayName: 'Cloudflare',
+        authKind: 'api-key',
+        description: 'Zones, DNS, and Workers via the Cloudflare API (API-token auth).',
+        defaultScopes: '',
+        hostRules: [{ host: 'api.cloudflare.com', strategy: 'bearer' }],
+    },
+    // ── Fly.io (api-key) ──
+    flyio: {
+        provider: 'flyio',
+        displayName: 'Fly.io',
+        authKind: 'api-key',
+        description: 'Machines and apps via the Fly.io Machines API (API-token auth).',
+        defaultScopes: '',
+        hostRules: [
+            { host: 'api.machines.dev', strategy: 'bearer' },
+            { host: 'api.fly.io', strategy: 'bearer' },
+        ],
+    },
+    // ── AWS (api-key/SigV4 — credential headers; no token refresh) ──
+    aws: {
+        provider: 'aws',
+        displayName: 'AWS',
+        authKind: 'api-key',
+        description: 'AWS service APIs signed with SigV4 (access-key credentials).',
+        defaultScopes: '',
+        hostRules: [{ host: 'amazonaws.com', strategy: 'header' }],
+        credentialHeaders: [{ credentialField: 'accessKeyId', headerName: 'x-amz-access-key-id' }],
+    },
+    // ── Figma (form body refresh) ──
+    figma: {
+        provider: 'figma',
+        displayName: 'Figma',
+        authKind: 'oauth2',
+        description: 'Files, projects, and comments via the Figma REST API.',
+        defaultScopes: 'file_read',
+        oauth: {
+            mode: 'pkce',
+            clientId: 'cleo-figma-client-id',
+            authorizationEndpoint: 'https://www.figma.com/oauth',
+            tokenEndpoint: 'https://api.figma.com/v1/oauth/token',
+            scope: 'file_read',
+            redirectUri: 'http://127.0.0.1:7878/service/figma/callback',
+        },
+        refresh: {
+            kind: 'refresh-token',
+            tokenUrl: 'https://api.figma.com/v1/oauth/refresh',
+            bodyFormat: 'form',
+            clientAuth: 'body',
+        },
+        hostRules: [{ host: 'api.figma.com', strategy: 'bearer' }],
+    },
+    // ── Linear (form body refresh) ──
+    linear: {
+        provider: 'linear',
+        displayName: 'Linear',
+        authKind: 'oauth2',
+        description: 'Issues, projects, and cycles via the Linear GraphQL API.',
+        defaultScopes: 'read write',
+        oauth: {
+            mode: 'pkce',
+            clientId: 'cleo-linear-client-id',
+            authorizationEndpoint: 'https://linear.app/oauth/authorize',
+            tokenEndpoint: 'https://api.linear.app/oauth/token',
+            scope: 'read write',
+            redirectUri: 'http://127.0.0.1:7878/service/linear/callback',
+        },
+        refresh: {
+            kind: 'refresh-token',
+            tokenUrl: 'https://api.linear.app/oauth/token',
+            bodyFormat: 'form',
+            clientAuth: 'body',
+        },
+        hostRules: [{ host: 'api.linear.app', strategy: 'bearer' }],
+    },
+    // ── Slack (form body refresh; token rotation) ──
+    slack: {
+        provider: 'slack',
+        displayName: 'Slack',
+        authKind: 'oauth2',
+        description: 'Channels, messages, and users via the Slack Web API.',
+        defaultScopes: 'channels:read chat:write users:read',
+        oauth: {
+            mode: 'pkce',
+            clientId: 'cleo-slack-client-id',
+            authorizationEndpoint: 'https://slack.com/oauth/v2/authorize',
+            tokenEndpoint: 'https://slack.com/api/oauth.v2.access',
+            scope: 'channels:read chat:write users:read',
+            redirectUri: 'http://127.0.0.1:7878/service/slack/callback',
+        },
+        refresh: {
+            kind: 'refresh-token',
+            tokenUrl: 'https://slack.com/api/oauth.v2.access',
+            bodyFormat: 'form',
+            clientAuth: 'body',
+        },
+        hostRules: [{ host: 'slack.com', strategy: 'bearer' }],
+    },
+    // ── Discord (form body refresh) ──
+    discord: {
+        provider: 'discord',
+        displayName: 'Discord',
+        authKind: 'oauth2',
+        description: 'Guilds, channels, and messages via the Discord API.',
+        defaultScopes: 'identify guilds',
+        oauth: {
+            mode: 'pkce',
+            clientId: 'cleo-discord-client-id',
+            authorizationEndpoint: 'https://discord.com/oauth2/authorize',
+            tokenEndpoint: 'https://discord.com/api/oauth2/token',
+            scope: 'identify guilds',
+            redirectUri: 'http://127.0.0.1:7878/service/discord/callback',
+        },
+        refresh: {
+            kind: 'refresh-token',
+            tokenUrl: 'https://discord.com/api/oauth2/token',
+            bodyFormat: 'form',
+            clientAuth: 'body',
+        },
+        hostRules: [{ host: 'discord.com', strategy: 'bearer' }],
+    },
+    // ── Sentry (form body refresh) ──
+    sentry: {
+        provider: 'sentry',
+        displayName: 'Sentry',
+        authKind: 'oauth2',
+        description: 'Issues, events, and releases via the Sentry API.',
+        defaultScopes: 'org:read project:read event:read',
+        oauth: {
+            mode: 'pkce',
+            clientId: 'cleo-sentry-client-id',
+            authorizationEndpoint: 'https://sentry.io/oauth/authorize/',
+            tokenEndpoint: 'https://sentry.io/oauth/token/',
+            scope: 'org:read project:read event:read',
+            redirectUri: 'http://127.0.0.1:7878/service/sentry/callback',
+        },
+        refresh: {
+            kind: 'refresh-token',
+            tokenUrl: 'https://sentry.io/oauth/token/',
+            bodyFormat: 'form',
+            clientAuth: 'body',
+        },
+        hostRules: [{ host: 'sentry.io', strategy: 'bearer' }],
+    },
+    // ── Vercel (api-key — no OAuth refresh) ──
+    vercel: {
+        provider: 'vercel',
+        displayName: 'Vercel',
+        authKind: 'api-key',
+        description: 'Deployments, projects, and domains via the Vercel REST API.',
+        defaultScopes: '',
+        hostRules: [{ host: 'api.vercel.com', strategy: 'bearer' }],
+    },
+};
+/**
+ * The seeded service-provider registry — **github + google + the ~40-service
+ * census** (T11937 seeds + T11938 breadth).
+ *
+ * Keyed by {@link ServiceProviderDef.provider}. This is the SSoT the store reads
+ * when validating a `connect` and the OAuth flow (T11939) reads for default
+ * endpoints/scopes. The two seeds prove the two OAuth shapes:
+ *
+ *  - **github** — classic OAuth 2.0 web flow (`authKind: 'oauth2'`), fixed
+ *    loopback redirect; user grants `repo`/`read:user` scopes.
+ *  - **google** — installed-app OAuth 2.0 + PKCE (`authKind: 'oauth2-pkce'`),
+ *    loopback redirect; user grants offline-access + the requested API scopes.
+ *
+ * The `clientId` values are PLACEHOLDER public client ids for CLEO's first-party
+ * OAuth apps — the real ids are wired (or BYOC-overridden) when the OAuth dance
+ * lands in T11939. They are NOT secrets (a public OAuth client id is, by design,
+ * embeddable in a distributed CLI).
+ *
+ * Fan-out to the full ~40-service census is the follow-up (T11938): add a DATA
+ * entry here, nothing else.
+ *
+ * @task T11937
+ */
+export const SERVICE_PROVIDERS = {
+    github: {
+        provider: 'github',
+        displayName: 'GitHub',
+        authKind: 'oauth2',
+        description: 'Repositories, issues, pull requests, and Actions on GitHub.',
+        defaultScopes: 'repo read:user read:org',
+        oauth: {
+            mode: 'pkce',
+            // PLACEHOLDER public client id for CLEO's first-party GitHub OAuth app —
+            // real id (or a BYOC override from service_configs) wired in T11939.
+            clientId: 'cleo-github-client-id',
+            authorizationEndpoint: 'https://github.com/login/oauth/authorize',
+            tokenEndpoint: 'https://github.com/login/oauth/access_token',
+            scope: 'repo read:user read:org',
+            redirectUri: 'http://127.0.0.1:7878/service/github/callback',
+        },
+        hostRules: [
+            { host: 'api.github.com', strategy: 'bearer' },
+            { host: 'github.com', strategy: 'basic-x-access-token' },
+            { host: 'raw.githubusercontent.com', strategy: 'bearer' },
+        ],
+    },
+    google: {
+        provider: 'google',
+        displayName: 'Google',
+        authKind: 'oauth2-pkce',
+        description: 'Gmail, Drive, Calendar, and other Google APIs.',
+        defaultScopes: 'openid email profile https://www.googleapis.com/auth/drive.readonly',
+        oauth: {
+            mode: 'pkce',
+            // PLACEHOLDER public client id for CLEO's first-party Google installed-app
+            // OAuth client — real id (or a BYOC override) wired in T11939.
+            clientId: 'cleo-google-client-id.apps.googleusercontent.com',
+            authorizationEndpoint: 'https://accounts.google.com/o/oauth2/v2/auth',
+            tokenEndpoint: 'https://oauth2.googleapis.com/token',
+            scope: 'openid email profile https://www.googleapis.com/auth/drive.readonly',
+            redirectUri: 'http://127.0.0.1:7878/service/google/callback',
+            extraAuthParams: {
+                // Google requires these to return a refresh token on the first consent.
+                access_type: 'offline',
+                prompt: 'consent',
+            },
+        },
+        refresh: GOOGLE_REFRESH,
+        hostRules: [
+            { host: 'www.googleapis.com', strategy: 'bearer' },
+            { host: 'accounts.google.com', strategy: 'bearer' },
+        ],
+    },
+    ...SERVICE_PROVIDERS_BREADTH,
+};
+//# sourceMappingURL=service-provider.js.map