@desplega.ai/agent-swarm 1.113.0 → 1.115.0

package/dist/cli-bgef578c.js

@@ -1,771 +0,0 @@
-import {
-  getDb,
-  init_date_utils,
-  init_db,
-  normalizeDateRequired
-} from "./cli-ncfgsqbd.js";
-
-// src/be/db-queries/oauth.ts
-init_date_utils();
-init_db();
-function normalizeOAuthApp(row) {
-  return {
-    ...row,
-    createdAt: normalizeDateRequired(row.createdAt),
-    updatedAt: normalizeDateRequired(row.updatedAt)
-  };
-}
-function normalizeOAuthTokens(row) {
-  return {
-    ...row,
-    createdAt: normalizeDateRequired(row.createdAt),
-    updatedAt: normalizeDateRequired(row.updatedAt)
-  };
-}
-function getOAuthApp(provider) {
-  const row = getDb().query("SELECT * FROM oauth_apps WHERE provider = ?").get(provider);
-  return row ? normalizeOAuthApp(row) : null;
-}
-function upsertOAuthApp(provider, data) {
-  const metadataProvided = data.metadata !== undefined;
-  const sql = metadataProvided ? `INSERT INTO oauth_apps (provider, clientId, clientSecret, authorizeUrl, tokenUrl, redirectUri, scopes, metadata)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-       ON CONFLICT(provider) DO UPDATE SET
-         clientId = excluded.clientId,
-         clientSecret = excluded.clientSecret,
-         authorizeUrl = excluded.authorizeUrl,
-         tokenUrl = excluded.tokenUrl,
-         redirectUri = excluded.redirectUri,
-         scopes = excluded.scopes,
-         metadata = excluded.metadata,
-         updatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')` : `INSERT INTO oauth_apps (provider, clientId, clientSecret, authorizeUrl, tokenUrl, redirectUri, scopes, metadata)
-       VALUES (?, ?, ?, ?, ?, ?, ?, '{}')
-       ON CONFLICT(provider) DO UPDATE SET
-         clientId = excluded.clientId,
-         clientSecret = excluded.clientSecret,
-         authorizeUrl = excluded.authorizeUrl,
-         tokenUrl = excluded.tokenUrl,
-         redirectUri = excluded.redirectUri,
-         scopes = excluded.scopes,
-         updatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')`;
-  if (metadataProvided) {
-    getDb().query(sql).run(provider, data.clientId, data.clientSecret, data.authorizeUrl, data.tokenUrl, data.redirectUri, data.scopes, data.metadata);
-  } else {
-    getDb().query(sql).run(provider, data.clientId, data.clientSecret, data.authorizeUrl, data.tokenUrl, data.redirectUri, data.scopes);
-  }
-}
-function getOAuthTokens(provider) {
-  const row = getDb().query("SELECT * FROM oauth_tokens WHERE provider = ?").get(provider);
-  return row ? normalizeOAuthTokens(row) : null;
-}
-function storeOAuthTokens(provider, data) {
-  getDb().query(`INSERT INTO oauth_tokens (provider, accessToken, refreshToken, expiresAt, scope)
-       VALUES (?, ?, ?, ?, ?)
-       ON CONFLICT(provider) DO UPDATE SET
-         accessToken = excluded.accessToken,
-         refreshToken = COALESCE(excluded.refreshToken, oauth_tokens.refreshToken),
-         expiresAt = excluded.expiresAt,
-         scope = COALESCE(excluded.scope, oauth_tokens.scope),
-         updatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')`).run(provider, data.accessToken, data.refreshToken ?? null, data.expiresAt, data.scope ?? null);
-}
-function updateOAuthTokensAfterRefresh(provider, expectedRefreshToken, data) {
-  const result = getDb().query(`UPDATE oauth_tokens
-       SET accessToken = ?,
-           refreshToken = ?,
-           expiresAt = ?,
-           scope = COALESCE(?, scope),
-           updatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-       WHERE provider = ? AND refreshToken = ?`).run(data.accessToken, data.refreshToken, data.expiresAt, data.scope ?? null, provider, expectedRefreshToken);
-  if (result.changes === 1)
-    return;
-  const current = getOAuthTokens(provider);
-  if (!current) {
-    throw new Error(`OAuth token refresh persistence failed for ${provider}: token row missing`);
-  }
-  if (current.refreshToken !== expectedRefreshToken) {
-    throw new Error(`OAuth token refresh persistence failed for ${provider}: stored refresh token changed during refresh`);
-  }
-  throw new Error(`OAuth token refresh persistence failed for ${provider}: no rows updated`);
-}
-function deleteOAuthTokens(provider) {
-  getDb().query("DELETE FROM oauth_tokens WHERE provider = ?").run(provider);
-}
-function isTokenExpiringSoon(provider, bufferMs = 5 * 60 * 1000) {
-  const tokens = getOAuthTokens(provider);
-  if (!tokens)
-    return true;
-  const expiresAt = new Date(tokens.expiresAt).getTime();
-  return expiresAt - Date.now() < bufferMs;
-}
-function acquireOAuthRefreshLock(provider, ttlMs) {
-  const owner = crypto.randomUUID();
-  const now = Date.now();
-  const expiresAt = new Date(now + ttlMs).toISOString();
-  const nowIso = new Date(now).toISOString();
-  getDb().query(`INSERT INTO oauth_refresh_locks (provider, owner, expiresAt, createdAt, updatedAt)
-       VALUES (?, ?, ?, ?, ?)
-       ON CONFLICT(provider) DO UPDATE SET
-         owner = excluded.owner,
-         expiresAt = excluded.expiresAt,
-         updatedAt = excluded.updatedAt
-       WHERE oauth_refresh_locks.expiresAt <= ?`).run(provider, owner, expiresAt, nowIso, nowIso, nowIso);
-  const row = getDb().query("SELECT owner FROM oauth_refresh_locks WHERE provider = ?").get(provider);
-  return row?.owner === owner ? owner : null;
-}
-function releaseOAuthRefreshLock(provider, owner) {
-  getDb().query("DELETE FROM oauth_refresh_locks WHERE provider = ? AND owner = ?").run(provider, owner);
-}
-
-// node_modules/oauth4webapi/build/index.js
-var USER_AGENT;
-if (typeof navigator === "undefined" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) {
-  const NAME = "oauth4webapi";
-  const VERSION = "v3.8.5";
-  USER_AGENT = `${NAME}/${VERSION}`;
-}
-var ERR_INVALID_ARG_VALUE = "ERR_INVALID_ARG_VALUE";
-var ERR_INVALID_ARG_TYPE = "ERR_INVALID_ARG_TYPE";
-function CodedTypeError(message, code, cause) {
-  const err = new TypeError(message, { cause });
-  Object.assign(err, { code });
-  return err;
-}
-var allowInsecureRequests = Symbol();
-var clockSkew = Symbol();
-var clockTolerance = Symbol();
-var customFetch = Symbol();
-var modifyAssertion = Symbol();
-var jweDecrypt = Symbol();
-var jwksCache = Symbol();
-var encoder = new TextEncoder;
-var decoder = new TextDecoder;
-function buf(input) {
-  if (typeof input === "string") {
-    return encoder.encode(input);
-  }
-  return decoder.decode(input);
-}
-var encodeBase64Url;
-if (Uint8Array.prototype.toBase64) {
-  encodeBase64Url = (input) => {
-    if (input instanceof ArrayBuffer) {
-      input = new Uint8Array(input);
-    }
-    return input.toBase64({ alphabet: "base64url", omitPadding: true });
-  };
-} else {
-  const CHUNK_SIZE = 32768;
-  encodeBase64Url = (input) => {
-    if (input instanceof ArrayBuffer) {
-      input = new Uint8Array(input);
-    }
-    const arr = [];
-    for (let i = 0;i < input.byteLength; i += CHUNK_SIZE) {
-      arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
-    }
-    return btoa(arr.join("")).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
-  };
-}
-var decodeBase64Url;
-if (Uint8Array.fromBase64) {
-  decodeBase64Url = (input) => {
-    try {
-      return Uint8Array.fromBase64(input, { alphabet: "base64url" });
-    } catch (cause) {
-      throw CodedTypeError("The input to be decoded is not correctly encoded.", ERR_INVALID_ARG_VALUE, cause);
-    }
-  };
-} else {
-  decodeBase64Url = (input) => {
-    try {
-      const binary = atob(input.replace(/-/g, "+").replace(/_/g, "/").replace(/\s/g, ""));
-      const bytes = new Uint8Array(binary.length);
-      for (let i = 0;i < binary.length; i++) {
-        bytes[i] = binary.charCodeAt(i);
-      }
-      return bytes;
-    } catch (cause) {
-      throw CodedTypeError("The input to be decoded is not correctly encoded.", ERR_INVALID_ARG_VALUE, cause);
-    }
-  };
-}
-function b64u(input) {
-  if (typeof input === "string") {
-    return decodeBase64Url(input);
-  }
-  return encodeBase64Url(input);
-}
-
-class UnsupportedOperationError extends Error {
-  code;
-  constructor(message, options) {
-    super(message, options);
-    this.name = this.constructor.name;
-    this.code = UNSUPPORTED_OPERATION;
-    Error.captureStackTrace?.(this, this.constructor);
-  }
-}
-
-class OperationProcessingError extends Error {
-  code;
-  constructor(message, options) {
-    super(message, options);
-    this.name = this.constructor.name;
-    if (options?.code) {
-      this.code = options?.code;
-    }
-    Error.captureStackTrace?.(this, this.constructor);
-  }
-}
-function OPE(message, code, cause) {
-  return new OperationProcessingError(message, { code, cause });
-}
-async function calculateJwkThumbprint(jwk) {
-  let components;
-  switch (jwk.kty) {
-    case "EC":
-      components = {
-        crv: jwk.crv,
-        kty: jwk.kty,
-        x: jwk.x,
-        y: jwk.y
-      };
-      break;
-    case "OKP":
-      components = {
-        crv: jwk.crv,
-        kty: jwk.kty,
-        x: jwk.x
-      };
-      break;
-    case "AKP":
-      components = {
-        alg: jwk.alg,
-        kty: jwk.kty,
-        pub: jwk.pub
-      };
-      break;
-    case "RSA":
-      components = {
-        e: jwk.e,
-        kty: jwk.kty,
-        n: jwk.n
-      };
-      break;
-    default:
-      throw new UnsupportedOperationError("unsupported JWK key type", { cause: jwk });
-  }
-  return b64u(await crypto.subtle.digest("SHA-256", buf(JSON.stringify(components))));
-}
-function assertCryptoKey(key, it) {
-  if (!(key instanceof CryptoKey)) {
-    throw CodedTypeError(`${it} must be a CryptoKey`, ERR_INVALID_ARG_TYPE);
-  }
-}
-function assertPrivateKey(key, it) {
-  assertCryptoKey(key, it);
-  if (key.type !== "private") {
-    throw CodedTypeError(`${it} must be a private CryptoKey`, ERR_INVALID_ARG_VALUE);
-  }
-}
-function assertPublicKey(key, it) {
-  assertCryptoKey(key, it);
-  if (key.type !== "public") {
-    throw CodedTypeError(`${it} must be a public CryptoKey`, ERR_INVALID_ARG_VALUE);
-  }
-}
-function assertString(input, it, code, cause) {
-  try {
-    if (typeof input !== "string") {
-      throw CodedTypeError(`${it} must be a string`, ERR_INVALID_ARG_TYPE, cause);
-    }
-    if (input.length === 0) {
-      throw CodedTypeError(`${it} must not be empty`, ERR_INVALID_ARG_VALUE, cause);
-    }
-  } catch (err) {
-    if (code) {
-      throw OPE(err.message, code, cause);
-    }
-    throw err;
-  }
-}
-function randomBytes() {
-  return b64u(crypto.getRandomValues(new Uint8Array(32)));
-}
-function generateRandomCodeVerifier() {
-  return randomBytes();
-}
-function generateRandomState() {
-  return randomBytes();
-}
-async function calculatePKCECodeChallenge(codeVerifier) {
-  assertString(codeVerifier, "codeVerifier");
-  return b64u(await crypto.subtle.digest("SHA-256", buf(codeVerifier)));
-}
-function psAlg(key) {
-  switch (key.algorithm.hash.name) {
-    case "SHA-256":
-      return "PS256";
-    case "SHA-384":
-      return "PS384";
-    case "SHA-512":
-      return "PS512";
-    default:
-      throw new UnsupportedOperationError("unsupported RsaHashedKeyAlgorithm hash name", {
-        cause: key
-      });
-  }
-}
-function rsAlg(key) {
-  switch (key.algorithm.hash.name) {
-    case "SHA-256":
-      return "RS256";
-    case "SHA-384":
-      return "RS384";
-    case "SHA-512":
-      return "RS512";
-    default:
-      throw new UnsupportedOperationError("unsupported RsaHashedKeyAlgorithm hash name", {
-        cause: key
-      });
-  }
-}
-function esAlg(key) {
-  switch (key.algorithm.namedCurve) {
-    case "P-256":
-      return "ES256";
-    case "P-384":
-      return "ES384";
-    case "P-521":
-      return "ES512";
-    default:
-      throw new UnsupportedOperationError("unsupported EcKeyAlgorithm namedCurve", { cause: key });
-  }
-}
-function keyToJws(key) {
-  switch (key.algorithm.name) {
-    case "RSA-PSS":
-      return psAlg(key);
-    case "RSASSA-PKCS1-v1_5":
-      return rsAlg(key);
-    case "ECDSA":
-      return esAlg(key);
-    case "Ed25519":
-    case "ML-DSA-44":
-    case "ML-DSA-65":
-    case "ML-DSA-87":
-      return key.algorithm.name;
-    case "EdDSA":
-      return "Ed25519";
-    default:
-      throw new UnsupportedOperationError("unsupported CryptoKey algorithm name", { cause: key });
-  }
-}
-function getClockSkew(client) {
-  const skew = client?.[clockSkew];
-  return typeof skew === "number" && Number.isFinite(skew) ? skew : 0;
-}
-function epochTime() {
-  return Math.floor(Date.now() / 1000);
-}
-async function signJwt(header, payload, key) {
-  if (!key.usages.includes("sign")) {
-    throw CodedTypeError('CryptoKey instances used for signing assertions must include "sign" in their "usages"', ERR_INVALID_ARG_VALUE);
-  }
-  const input = `${b64u(buf(JSON.stringify(header)))}.${b64u(buf(JSON.stringify(payload)))}`;
-  const signature = b64u(await crypto.subtle.sign(keyToSubtle(key), key, buf(input)));
-  return `${input}.${signature}`;
-}
-var jwkCache;
-async function getSetPublicJwkCache(key, alg) {
-  const { kty, e, n, x, y, crv, pub } = await crypto.subtle.exportKey("jwk", key);
-  const jwk = { kty, e, n, x, y, crv, pub };
-  if (kty === "AKP")
-    jwk.alg = alg;
-  jwkCache.set(key, jwk);
-  return jwk;
-}
-async function publicJwk(key, alg) {
-  jwkCache ||= new WeakMap;
-  return jwkCache.get(key) || getSetPublicJwkCache(key, alg);
-}
-var URLParse = URL.parse ? (url, base) => URL.parse(url, base) : (url, base) => {
-  try {
-    return new URL(url, base);
-  } catch {
-    return null;
-  }
-};
-class DPoPHandler {
-  #header;
-  #privateKey;
-  #publicKey;
-  #clockSkew;
-  #modifyAssertion;
-  #map;
-  #jkt;
-  constructor(client, keyPair, options) {
-    assertPrivateKey(keyPair?.privateKey, '"DPoP.privateKey"');
-    assertPublicKey(keyPair?.publicKey, '"DPoP.publicKey"');
-    if (!keyPair.publicKey.extractable) {
-      throw CodedTypeError('"DPoP.publicKey.extractable" must be true', ERR_INVALID_ARG_VALUE);
-    }
-    this.#modifyAssertion = options?.[modifyAssertion];
-    this.#clockSkew = getClockSkew(client);
-    this.#privateKey = keyPair.privateKey;
-    this.#publicKey = keyPair.publicKey;
-    branded.add(this);
-  }
-  #get(key) {
-    this.#map ||= new Map;
-    let item = this.#map.get(key);
-    if (item) {
-      this.#map.delete(key);
-      this.#map.set(key, item);
-    }
-    return item;
-  }
-  #set(key, val) {
-    this.#map ||= new Map;
-    this.#map.delete(key);
-    if (this.#map.size === 100) {
-      this.#map.delete(this.#map.keys().next().value);
-    }
-    this.#map.set(key, val);
-  }
-  async calculateThumbprint() {
-    if (!this.#jkt) {
-      const jwk = await crypto.subtle.exportKey("jwk", this.#publicKey);
-      this.#jkt ||= await calculateJwkThumbprint(jwk);
-    }
-    return this.#jkt;
-  }
-  async addProof(url, headers, htm, accessToken) {
-    const alg = keyToJws(this.#privateKey);
-    this.#header ||= {
-      alg,
-      typ: "dpop+jwt",
-      jwk: await publicJwk(this.#publicKey, alg)
-    };
-    const nonce = this.#get(url.origin);
-    const now = epochTime() + this.#clockSkew;
-    const payload = {
-      iat: now,
-      jti: randomBytes(),
-      htm,
-      nonce,
-      htu: `${url.origin}${url.pathname}`,
-      ath: accessToken ? b64u(await crypto.subtle.digest("SHA-256", buf(accessToken))) : undefined
-    };
-    this.#modifyAssertion?.(this.#header, payload);
-    headers.set("dpop", await signJwt(this.#header, payload, this.#privateKey));
-  }
-  cacheNonce(response, url) {
-    try {
-      const nonce = response.headers.get("dpop-nonce");
-      if (nonce) {
-        this.#set(url.origin, nonce);
-      }
-    } catch {}
-  }
-}
-var tokenMatch = "[a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+";
-var token68Match = "[a-zA-Z0-9\\-\\._\\~\\+\\/]+={0,2}";
-var quotedMatch = '"((?:[^"\\\\]|\\\\[\\s\\S])*)"';
-var quotedParamMatcher = "(" + tokenMatch + ")\\s*=\\s*" + quotedMatch;
-var paramMatcher = "(" + tokenMatch + ")\\s*=\\s*(" + tokenMatch + ")";
-var schemeRE = new RegExp("^[,\\s]*(" + tokenMatch + ")");
-var quotedParamRE = new RegExp("^[,\\s]*" + quotedParamMatcher + "[,\\s]*(.*)");
-var unquotedParamRE = new RegExp("^[,\\s]*" + paramMatcher + "[,\\s]*(.*)");
-var token68ParamRE = new RegExp("^(" + token68Match + ")(?:$|[,\\s])(.*)");
-var skipSubjectCheck = Symbol();
-var idTokenClaims = new WeakMap;
-var jwtRefs = new WeakMap;
-var branded = new WeakSet;
-var nopkce = Symbol();
-var expectNoNonce = Symbol();
-var skipAuthTimeCheck = Symbol();
-var UNSUPPORTED_OPERATION = "OAUTH_UNSUPPORTED_OPERATION";
-function checkRsaKeyAlgorithm(key) {
-  const { algorithm } = key;
-  if (typeof algorithm.modulusLength !== "number" || algorithm.modulusLength < 2048) {
-    throw new UnsupportedOperationError(`unsupported ${algorithm.name} modulusLength`, {
-      cause: key
-    });
-  }
-}
-function ecdsaHashName(key) {
-  const { algorithm } = key;
-  switch (algorithm.namedCurve) {
-    case "P-256":
-      return "SHA-256";
-    case "P-384":
-      return "SHA-384";
-    case "P-521":
-      return "SHA-512";
-    default:
-      throw new UnsupportedOperationError("unsupported ECDSA namedCurve", { cause: key });
-  }
-}
-function keyToSubtle(key) {
-  switch (key.algorithm.name) {
-    case "ECDSA":
-      return {
-        name: key.algorithm.name,
-        hash: ecdsaHashName(key)
-      };
-    case "RSA-PSS": {
-      checkRsaKeyAlgorithm(key);
-      switch (key.algorithm.hash.name) {
-        case "SHA-256":
-        case "SHA-384":
-        case "SHA-512":
-          return {
-            name: key.algorithm.name,
-            saltLength: parseInt(key.algorithm.hash.name.slice(-3), 10) >> 3
-          };
-        default:
-          throw new UnsupportedOperationError("unsupported RSA-PSS hash name", { cause: key });
-      }
-    }
-    case "RSASSA-PKCS1-v1_5":
-      checkRsaKeyAlgorithm(key);
-      return key.algorithm.name;
-    case "ML-DSA-44":
-    case "ML-DSA-65":
-    case "ML-DSA-87":
-    case "Ed25519":
-      return key.algorithm.name;
-  }
-  throw new UnsupportedOperationError("unsupported CryptoKey algorithm name", { cause: key });
-}
-var skipStateCheck = Symbol();
-var expectNoState = Symbol();
-var _nodiscoverycheck = Symbol();
-var _expectedIssuer = Symbol();
-
-// src/oauth/wrapper.ts
-var STATE_TTL_MS = 10 * 60 * 1000;
-var pendingStates = new Map;
-function cleanupExpiredStates() {
-  const now = Date.now();
-  for (const [key, entry] of pendingStates) {
-    if (now - entry.createdAt > STATE_TTL_MS) {
-      pendingStates.delete(key);
-    }
-  }
-}
-async function buildAuthorizationUrl(config) {
-  cleanupExpiredStates();
-  const state = generateRandomState();
-  const codeVerifier = generateRandomCodeVerifier();
-  const codeChallenge = await calculatePKCECodeChallenge(codeVerifier);
-  pendingStates.set(state, {
-    codeVerifier,
-    config,
-    createdAt: Date.now()
-  });
-  const url = new URL(config.authorizeUrl);
-  url.searchParams.set("client_id", config.clientId);
-  url.searchParams.set("redirect_uri", config.redirectUri);
-  url.searchParams.set("response_type", "code");
-  url.searchParams.set("scope", config.scopes.join(config.scopeSeparator ?? ","));
-  url.searchParams.set("state", state);
-  url.searchParams.set("code_challenge", codeChallenge);
-  url.searchParams.set("code_challenge_method", "S256");
-  if (config.extraParams) {
-    for (const [key, value] of Object.entries(config.extraParams)) {
-      url.searchParams.set(key, value);
-    }
-  }
-  return { url: url.toString(), state, codeVerifier };
-}
-async function exchangeCode(config, code, state) {
-  const pending = pendingStates.get(state);
-  if (!pending) {
-    throw new Error("Invalid or expired OAuth state");
-  }
-  pendingStates.delete(state);
-  const { codeVerifier } = pending;
-  const body = new URLSearchParams({
-    grant_type: "authorization_code",
-    client_id: config.clientId,
-    client_secret: config.clientSecret,
-    redirect_uri: config.redirectUri,
-    code,
-    code_verifier: codeVerifier
-  });
-  const response = await fetch(config.tokenUrl, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: body.toString()
-  });
-  if (!response.ok) {
-    const errorText = await response.text();
-    throw new Error(`Token exchange failed (${response.status}): ${errorText}`);
-  }
-  const data = await response.json();
-  const expiresAt = data.expires_in ? new Date(Date.now() + data.expires_in * 1000).toISOString() : new Date(Date.now() + 24 * 60 * 60 * 1000).toISOString();
-  storeOAuthTokens(config.provider, {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token ?? null,
-    expiresAt,
-    scope: data.scope ?? null
-  });
-  return {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token,
-    expiresIn: data.expires_in,
-    scope: data.scope
-  };
-}
-async function refreshAccessToken(config, refreshToken) {
-  const body = new URLSearchParams({
-    grant_type: "refresh_token",
-    client_id: config.clientId,
-    client_secret: config.clientSecret,
-    refresh_token: refreshToken
-  });
-  const response = await fetch(config.tokenUrl, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: body.toString()
-  });
-  if (!response.ok) {
-    const errorText = await response.text();
-    throw new Error(`Token refresh failed (${response.status}): ${errorText}`);
-  }
-  const data = await response.json();
-  if (typeof data.access_token !== "string" || data.access_token.length === 0) {
-    throw new Error(`Token refresh failed: ${config.provider} response missing access_token`);
-  }
-  if (config.requiresRefreshTokenRotation && (typeof data.refresh_token !== "string" || data.refresh_token.length === 0)) {
-    throw new Error(`Token refresh failed: ${config.provider} response did not include a rotated refresh_token`);
-  }
-  const expiresAt = data.expires_in ? new Date(Date.now() + data.expires_in * 1000).toISOString() : new Date(Date.now() + 24 * 60 * 60 * 1000).toISOString();
-  const nextRefreshToken = data.refresh_token ?? refreshToken;
-  try {
-    updateOAuthTokensAfterRefresh(config.provider, refreshToken, {
-      accessToken: data.access_token,
-      refreshToken: nextRefreshToken,
-      expiresAt,
-      scope: data.scope ?? null
-    });
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    console.warn(`[OAuth] Refusing to use refreshed ${config.provider} access token because persistence failed: ${message}`);
-    throw err;
-  }
-  return {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token,
-    expiresIn: data.expires_in,
-    scope: data.scope
-  };
-}
-
-// src/oauth/ensure-token.ts
-var refreshLocks = new Map;
-var REFRESH_LOCK_TTL_MS = 2 * 60 * 1000;
-var REFRESH_LOCK_WAIT_MS = 30 * 1000;
-var REFRESH_LOCK_POLL_MS = 250;
-function getOAuthConfig(provider) {
-  const app = getOAuthApp(provider);
-  if (!app)
-    return null;
-  const metadata = JSON.parse(app.metadata || "{}");
-  return {
-    provider,
-    clientId: app.clientId,
-    clientSecret: app.clientSecret,
-    authorizeUrl: app.authorizeUrl,
-    tokenUrl: app.tokenUrl,
-    redirectUri: app.redirectUri,
-    scopes: app.scopes.split(","),
-    extraParams: metadata.extraParams ?? (metadata.actor ? { actor: metadata.actor } : undefined),
-    requiresRefreshTokenRotation: provider === "jira"
-  };
-}
-async function withProviderRefreshLock(provider, fn) {
-  const previous = refreshLocks.get(provider) ?? Promise.resolve();
-  let release;
-  const current = new Promise((resolve) => {
-    release = resolve;
-  });
-  const next = previous.catch(() => {
-    return;
-  }).then(() => current);
-  refreshLocks.set(provider, next);
-  await previous.catch(() => {
-    return;
-  });
-  try {
-    return await fn();
-  } finally {
-    release();
-    if (refreshLocks.get(provider) === next) {
-      refreshLocks.delete(provider);
-    }
-  }
-}
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-function tokenRowChanged(current, observed) {
-  if (!observed)
-    return current !== null;
-  if (!current)
-    return true;
-  return current.accessToken !== observed.accessToken || current.refreshToken !== observed.refreshToken || current.expiresAt !== observed.expiresAt;
-}
-async function ensureToken(provider, bufferMs) {
-  try {
-    await ensureTokenOrThrow(provider, bufferMs);
-  } catch (err) {
-    console.error(`[OAuth] Failed to refresh ${provider} token:`, err instanceof Error ? err.message : err);
-  }
-}
-async function ensureTokenOrThrow(provider, bufferMs) {
-  if (!isTokenExpiringSoon(provider, bufferMs))
-    return;
-  const observedTokens = getOAuthTokens(provider);
-  await withProviderRefreshLock(provider, async () => {
-    const waitStartedAt = Date.now();
-    while (isTokenExpiringSoon(provider, bufferMs)) {
-      const tokens = getOAuthTokens(provider);
-      if (tokenRowChanged(tokens, observedTokens))
-        return;
-      const config = getOAuthConfig(provider);
-      if (!config || !tokens?.refreshToken) {
-        console.warn(`[OAuth] ${provider} token expiring but cannot refresh (missing config or refresh token)`);
-        return;
-      }
-      const lockOwner = acquireOAuthRefreshLock(provider, REFRESH_LOCK_TTL_MS);
-      if (!lockOwner) {
-        if (Date.now() - waitStartedAt > REFRESH_LOCK_WAIT_MS) {
-          throw new Error(`Timed out waiting for ${provider} OAuth token refresh lock`);
-        }
-        await sleep(REFRESH_LOCK_POLL_MS);
-        continue;
-      }
-      try {
-        const lockedTokens = getOAuthTokens(provider);
-        if (!isTokenExpiringSoon(provider, bufferMs) || tokenRowChanged(lockedTokens, observedTokens)) {
-          return;
-        }
-        const lockedConfig = getOAuthConfig(provider);
-        if (!lockedConfig || !lockedTokens?.refreshToken) {
-          console.warn(`[OAuth] ${provider} token expiring but cannot refresh (missing config or refresh token)`);
-          return;
-        }
-        await refreshAccessToken(lockedConfig, lockedTokens.refreshToken);
-        console.log(`[OAuth] ${provider} token refreshed successfully`);
-        return;
-      } finally {
-        releaseOAuthRefreshLock(provider, lockOwner);
-      }
-    }
-  });
-}
-
-export { getOAuthApp, upsertOAuthApp, getOAuthTokens, deleteOAuthTokens, acquireOAuthRefreshLock, releaseOAuthRefreshLock, generateRandomCodeVerifier, generateRandomState, calculatePKCECodeChallenge, buildAuthorizationUrl, exchangeCode, ensureToken, ensureTokenOrThrow };