@irogane/kaji 0.2.0-beta.11

package/dist/auth.cjs

@@ -0,0 +1,1507 @@
+'use strict';
+
+var crypto = require('crypto');
+var http = require('http');
+var https = require('https');
+var child_process = require('child_process');
+var fs = require('fs');
+var os = require('os');
+
+// src/auth/oauth.ts
+
+// src/contracts/integration-recovery.ts
+var DOCS = "https://kaji.dev/docs/integrations/recovery-v1";
+function recovery(errorCode, recoveryCode, anchor, problem, cause, fix) {
+  return Object.freeze({
+    errorCode,
+    recoveryCode,
+    docUrl: `${DOCS}#${anchor}`,
+    problem,
+    cause,
+    fix
+  });
+}
+var INTEGRATION_RECOVERY = Object.freeze({
+  github_token_missing: recovery(
+    "INTEGRATION_AUTH_REQUIRED",
+    "CONFIGURE_GITHUB_TOKEN",
+    "github-token",
+    "GitHub authentication is required.",
+    "The configured GitHub token is unavailable.",
+    "Set the manifest-declared GitHub token environment variable and retry."
+  ),
+  gmail_grant_missing: recovery(
+    "INTEGRATION_AUTH_REQUIRED",
+    "CONNECT_GMAIL",
+    "gmail-grant",
+    "Gmail authorization is required.",
+    "No Gmail grant exists for this principal.",
+    "Use the package-qualified connect command for this runtime and principal, then retry."
+  ),
+  keychain_missing: recovery(
+    "INTEGRATION_AUTH_ERROR",
+    "RESTORE_KEYCHAIN",
+    "keychain-missing",
+    "The macOS Keychain is unavailable.",
+    "The Keychain command could not be found.",
+    "Restore `/usr/bin/security` on a supported macOS host and retry."
+  ),
+  keychain_locked: recovery(
+    "INTEGRATION_AUTH_ERROR",
+    "UNLOCK_KEYCHAIN",
+    "keychain-locked",
+    "The macOS Keychain is locked.",
+    "The stored integration grant cannot be read while Keychain is locked.",
+    "Unlock the login Keychain and retry."
+  ),
+  keychain_corrupt: recovery(
+    "INTEGRATION_AUTH_ERROR",
+    "RESET_GMAIL_GRANT",
+    "keychain-corrupt",
+    "The stored Gmail grant is invalid.",
+    "The Keychain entry is corrupt or incomplete.",
+    "Disconnect Gmail locally, then reconnect with the same principal."
+  ),
+  keychain_unsupported: recovery(
+    "INTEGRATION_AUTH_ERROR",
+    "USE_SUPPORTED_KEYCHAIN",
+    "keychain-unsupported",
+    "Secure Gmail grant storage is unsupported.",
+    "This host cannot provide the required macOS Keychain boundary.",
+    "Use a supported macOS host; do not fall back to plaintext storage."
+  ),
+  gmail_scope_drift: recovery(
+    "INTEGRATION_AUTH_REQUIRED",
+    "RECONNECT_GMAIL",
+    "gmail-scope-drift",
+    "The Gmail grant no longer has the required scopes.",
+    "Stored and required OAuth scopes differ.",
+    "Use the package-qualified connect command for this runtime and principal, then consent again."
+  ),
+  policy_rejected: recovery(
+    "INTEGRATION_POLICY_REJECTED",
+    "REVIEW_INTEGRATION_POLICY",
+    "policy-rejected",
+    "The integration request was rejected before dispatch.",
+    "A fixed-origin, repository, recipient, or schema policy did not match.",
+    "Review the integration allowlist and request shape before retrying."
+  ),
+  api_rejected: recovery(
+    "INTEGRATION_API_ERROR",
+    "REVIEW_PROVIDER_REJECTION",
+    "api-rejected",
+    "The provider rejected the integration request.",
+    "The provider returned a confirmed non-retryable API rejection.",
+    "Review the request against the provider response guidance before retrying manually."
+  ),
+  transient_read_failed: recovery(
+    "INTEGRATION_API_ERROR",
+    "RETRY_INTEGRATION_READ",
+    "transient-read",
+    "The integration read did not complete.",
+    "The provider returned a transient failure before any external effect.",
+    "Retry the idempotent read with bounded backoff."
+  ),
+  rate_limited: recovery(
+    "INTEGRATION_RATE_LIMITED",
+    "RETRY_AFTER_RATE_LIMIT",
+    "rate-limited",
+    "The provider rate limit was reached.",
+    "The provider confirmed that this request was rate limited.",
+    "Reduce parallelism and retry only after the bounded provider delay."
+  ),
+  redirect_rejected: recovery(
+    "INTEGRATION_REDIRECT_REJECTED",
+    "REJECT_PROVIDER_REDIRECT",
+    "redirect-rejected",
+    "The provider returned a redirect that Kaji will not follow.",
+    "Fixed-origin integration requests reject every redirect.",
+    "Verify the provider endpoint; do not retry an ambiguous mutation blindly."
+  ),
+  response_limit_exceeded: recovery(
+    "INTEGRATION_RESPONSE_LIMIT",
+    "REDUCE_INTEGRATION_RESPONSE",
+    "response-limit",
+    "The integration response exceeded a safety bound.",
+    "Provider headers or body were malformed or too large.",
+    "Narrow the read request; reconcile a mutation before any retry."
+  ),
+  github_mutation_unknown: recovery(
+    "TOOL_EXECUTION_FAILED",
+    "RECONCILE_GITHUB_MUTATION",
+    "github-mutation-unknown",
+    "The GitHub mutation outcome is unknown.",
+    "The connection failed after dispatch without a confirmed provider result.",
+    "Reconcile the GitHub issue or comment marker before any manual retry."
+  ),
+  gmail_mutation_unknown: recovery(
+    "TOOL_EXECUTION_FAILED",
+    "RECONCILE_GMAIL_MUTATION",
+    "gmail-mutation-unknown",
+    "The Gmail mutation outcome is unknown.",
+    "The connection failed after dispatch without a confirmed provider result.",
+    "Reconcile the Gmail draft key or sent message before any manual retry."
+  )
+});
+function recoveryForReason(reasonCode) {
+  const value = INTEGRATION_RECOVERY[reasonCode];
+  if (value === void 0) throw new TypeError("unknown integration recovery reason");
+  return value;
+}
+
+// src/tools/execution-errors.ts
+var TOOL_EXECUTION_ERROR_BRAND = /* @__PURE__ */ Symbol.for("@kaji/sdk.ToolExecutionError.v1");
+function nativeInstanceOf(constructor, value) {
+  return Function.prototype[Symbol.hasInstance].call(constructor, value);
+}
+var ToolExecutionError = class _ToolExecutionError extends Error {
+  constructor(message, error_code, retryable, outcome, recovery2) {
+    super(message);
+    this.error_code = error_code;
+    this.retryable = retryable;
+    this.outcome = outcome;
+    this.name = "ToolExecutionError";
+    Object.defineProperty(this, TOOL_EXECUTION_ERROR_BRAND, { value: true });
+    if (recovery2 !== void 0) {
+      this.reason_code = recovery2.reason_code;
+      this.recovery_code = recovery2.recovery_code;
+      this.doc_url = recovery2.doc_url;
+    }
+  }
+  error_code;
+  retryable;
+  outcome;
+  static [Symbol.hasInstance](value) {
+    if (this !== _ToolExecutionError) return nativeInstanceOf(this, value);
+    return nativeInstanceOf(this, value) || value instanceof Error && Reflect.get(value, TOOL_EXECUTION_ERROR_BRAND) === true;
+  }
+  reason_code;
+  recovery_code;
+  doc_url;
+};
+
+// src/integrations/errors.ts
+function certified(kind, reasonCode, retryable) {
+  return Object.freeze({ kind, recovery: recoveryForReason(reasonCode), retryable });
+}
+var CERTIFIED_FAILURES = Object.freeze({
+  api_rejected: certified("api", "api_rejected", false),
+  github_token_missing: certified("auth_required", "github_token_missing", false),
+  gmail_grant_missing: certified("auth_required", "gmail_grant_missing", false),
+  gmail_scope_drift: certified("auth_required", "gmail_scope_drift", false),
+  keychain_missing: certified("auth", "keychain_missing", false),
+  keychain_locked: certified("auth", "keychain_locked", false),
+  keychain_corrupt: certified("auth", "keychain_corrupt", false),
+  keychain_unsupported: certified("auth", "keychain_unsupported", false),
+  rate_limited: certified("rate_limited", "rate_limited", true),
+  transient_read_failed: certified("transient_read", "transient_read_failed", true),
+  policy_rejected: certified("policy", "policy_rejected", false)
+});
+function certifiedFailure(reasonCode) {
+  const failure = CERTIFIED_FAILURES[reasonCode];
+  if (failure === void 0) throw new TypeError("uncertified integration failure reason");
+  return failure;
+}
+function constructorKind(constructor) {
+  if (constructor === IntegrationExecutionError) return "api";
+  if (constructor === IntegrationAuthRequiredError) return "auth_required";
+  if (constructor === IntegrationAuthError) return "auth";
+  if (constructor === IntegrationRateLimitedError) return "rate_limited";
+  if (constructor === IntegrationTransientReadError) return "transient_read";
+  if (constructor === IntegrationPolicyError) return "policy";
+  return void 0;
+}
+var IntegrationExecutionError = class extends ToolExecutionError {
+  constructor(reasonCode) {
+    const failure = certifiedFailure(reasonCode);
+    if (failure.kind !== constructorKind(new.target)) {
+      throw new TypeError("integration failure reason is not certified for this error class");
+    }
+    const { recovery: recovery2 } = failure;
+    super("Tool execution failed", recovery2.errorCode, failure.retryable, "failed", {
+      reason_code: reasonCode,
+      recovery_code: recovery2.recoveryCode,
+      doc_url: recovery2.docUrl
+    });
+    this.name = "IntegrationExecutionError";
+  }
+};
+var IntegrationAuthRequiredError = class extends IntegrationExecutionError {
+  constructor(reasonCode) {
+    super(reasonCode);
+    this.name = "IntegrationAuthRequiredError";
+  }
+};
+var IntegrationAuthError = class extends IntegrationExecutionError {
+  constructor(reasonCode) {
+    super(reasonCode);
+    this.name = "IntegrationAuthError";
+  }
+};
+var IntegrationRateLimitedError = class extends IntegrationExecutionError {
+  constructor() {
+    super("rate_limited");
+    this.name = "IntegrationRateLimitedError";
+  }
+};
+var IntegrationTransientReadError = class extends IntegrationExecutionError {
+  constructor() {
+    super("transient_read_failed");
+    this.name = "IntegrationTransientReadError";
+  }
+};
+var IntegrationPolicyError = class extends IntegrationExecutionError {
+  constructor() {
+    super("policy_rejected");
+    this.name = "IntegrationPolicyError";
+  }
+};
+var systemClock = Object.freeze({
+  nowWallSeconds: () => Date.now() / 1e3,
+  nowMonotonic: () => globalThis.performance.now()
+});
+
+// src/observability.ts
+var SPAN_NAMES = /* @__PURE__ */ new Set([
+  "kaji.turn",
+  "kaji.provider",
+  "kaji.tool",
+  "kaji.integration.auth",
+  "kaji.integration.request"
+]);
+var TRACE_ATTRIBUTES = /* @__PURE__ */ new Set([
+  "session.id",
+  "turn.id",
+  "request.id",
+  "trace.id",
+  "tool.call_id",
+  "provider.family",
+  "integration.name",
+  "integration.operation",
+  "http.status_family"
+]);
+var METRIC_UNITS = Object.freeze({
+  "kaji.turn.queue_wait_ms": "ms",
+  "kaji.turn.duration_ms": "ms",
+  "kaji.turn.iterations": "count",
+  "kaji.provider.duration_ms": "ms",
+  "kaji.provider.retries": "count",
+  "kaji.replay.input_events": "count",
+  "kaji.context.messages": "count",
+  "kaji.context.characters": "count",
+  "kaji.tool.queue_wait_ms": "ms",
+  "kaji.tool.active": "gauge",
+  "kaji.tool.duration_ms": "ms",
+  "kaji.journal.failures": "count",
+  "kaji.subscriber.lag_events": "count",
+  "kaji.subscriber.overflow": "count",
+  "kaji.integration.auth_ms": "ms",
+  "kaji.integration.request_ms": "ms"
+});
+Object.freeze(
+  Object.keys(METRIC_UNITS)
+);
+var ALLOWED_LABELS = Object.freeze({
+  "kaji.turn.queue_wait_ms": [],
+  "kaji.turn.duration_ms": ["outcome"],
+  "kaji.turn.iterations": ["outcome"],
+  "kaji.provider.duration_ms": ["provider_family", "status"],
+  "kaji.provider.retries": ["provider_family"],
+  "kaji.replay.input_events": [],
+  "kaji.context.messages": [],
+  "kaji.context.characters": [],
+  "kaji.tool.queue_wait_ms": ["outcome"],
+  "kaji.tool.active": [],
+  "kaji.tool.duration_ms": ["outcome", "error_code"],
+  "kaji.journal.failures": ["stage"],
+  "kaji.subscriber.lag_events": [],
+  "kaji.subscriber.overflow": ["stage"],
+  "kaji.integration.auth_ms": ["integration", "operation", "outcome"],
+  "kaji.integration.request_ms": ["integration", "operation", "outcome"]
+});
+var STABLE_ERROR_CODES = /* @__PURE__ */ new Set([
+  "NONE",
+  "OTHER",
+  "INVALID_TOOL_SCHEMA",
+  "INVALID_TOOL_ARGUMENTS",
+  "UNCLASSIFIED_TOOL_RISK",
+  "MISSING_TOOL_IDENTITY",
+  "TOOL_NOT_ALLOWED",
+  "APPROVAL_UNAVAILABLE",
+  "APPROVAL_REJECTED",
+  "APPROVAL_TIMEOUT",
+  "TOOL_CANCELLED",
+  "TOOL_TIMEOUT",
+  "TURN_TIMEOUT",
+  "TOOL_EXECUTION_FAILED",
+  "TOOL_START_RECORD_FAILED",
+  "IDEMPOTENCY_CAPACITY_EXCEEDED",
+  "IDEMPOTENCY_CONFLICT",
+  "INTEGRATION_AUTH_ERROR",
+  "INTEGRATION_AUTH_REQUIRED",
+  "INTEGRATION_API_ERROR",
+  "INTEGRATION_POLICY_REJECTED",
+  "INTEGRATION_RATE_LIMITED",
+  "INTEGRATION_REDIRECT_REJECTED",
+  "INTEGRATION_RESPONSE_LIMIT"
+]);
+function validLabel(key, value) {
+  if (typeof value !== "string") return false;
+  const text = value;
+  if (key === "provider_family") {
+    return text === "openai" || text === "anthropic" || text === "custom";
+  }
+  if (key === "status") {
+    return text === "success" || text === "cancelled" || text === "error";
+  }
+  if (key === "stage") {
+    return ["append", "publish", "lag", "overflow"].includes(text);
+  }
+  if (key === "error_code") return STABLE_ERROR_CODES.has(text);
+  if (key === "outcome") {
+    return [
+      "acquired",
+      "completed",
+      "failed",
+      "cancelled",
+      "timeout",
+      "not_started",
+      "unknown",
+      "success",
+      "error"
+    ].includes(text);
+  }
+  if (key === "integration") return text === "github" || text === "gmail";
+  if (key === "operation") return ["read", "mutation", "token"].includes(text);
+  return false;
+}
+function recordMetric(sink, name, value, labels) {
+  if (!Number.isFinite(value)) return;
+  if (sink === NOOP_METRICS) return;
+  if (!Object.hasOwn(METRIC_UNITS, name)) return;
+  const sanitized = {};
+  const allowed = ALLOWED_LABELS[name];
+  const supplied = Object.keys(labels);
+  if (supplied.length !== allowed.length || supplied.some((key) => !allowed.includes(key))) return;
+  for (const key of allowed) {
+    const raw = labels[key];
+    if (!validLabel(key, raw)) return;
+    sanitized[key] = raw;
+  }
+  const measurement = Object.freeze({
+    name,
+    value,
+    unit: METRIC_UNITS[name],
+    labels: Object.freeze(sanitized)
+  });
+  try {
+    const pending = sink.record(measurement);
+    if (pending !== void 0) void Promise.resolve(pending).catch(() => void 0);
+  } catch {
+  }
+}
+var NOOP_SPAN = Object.freeze({
+  setAttribute: () => {
+  },
+  recordError: () => {
+  },
+  end: () => {
+  }
+});
+var NOOP_METRICS = Object.freeze({ record: () => {
+} });
+var NOOP_TRACE = Object.freeze({ startSpan: () => NOOP_SPAN });
+function validTraceAttribute(name, value) {
+  if (typeof value !== "string") return false;
+  if (name === "integration.name") return value === "github" || value === "gmail";
+  if (name === "integration.operation") {
+    return value === "read" || value === "mutation" || value === "token";
+  }
+  if (name === "http.status_family") return /^(?:[1-5]xx|none)$/.test(value);
+  return true;
+}
+function startSpan(sink, name, attributes = {}) {
+  if (sink === NOOP_TRACE) return NOOP_SPAN;
+  if (!SPAN_NAMES.has(name)) return NOOP_SPAN;
+  let safeAttributes;
+  try {
+    const entries = Object.entries(attributes);
+    if (entries.some(
+      ([key, value]) => !TRACE_ATTRIBUTES.has(key) || !validTraceAttribute(key, value)
+    )) {
+      return NOOP_SPAN;
+    }
+    safeAttributes = Object.freeze(Object.fromEntries(entries));
+  } catch {
+    return NOOP_SPAN;
+  }
+  let inner;
+  try {
+    inner = sink.startSpan(name, safeAttributes);
+  } catch {
+    return NOOP_SPAN;
+  }
+  let ended = false;
+  return {
+    setAttribute(attributeName, value) {
+      if (ended) return;
+      if (!TRACE_ATTRIBUTES.has(attributeName) || !validTraceAttribute(attributeName, value))
+        return;
+      try {
+        inner.setAttribute(attributeName, value);
+      } catch {
+      }
+    },
+    recordError(error) {
+      if (ended) return;
+      try {
+        const kind = error instanceof Error ? error.name : typeof error;
+        inner.recordError(new Error(`${kind}: details redacted`));
+      } catch {
+      }
+    },
+    end() {
+      if (ended) return;
+      ended = true;
+      try {
+        inner.end();
+      } catch {
+      }
+    }
+  };
+}
+
+// src/auth/oauth.ts
+var GOOGLE_AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
+var GOOGLE_TOKEN_URL = "https://oauth2.googleapis.com/token";
+var GOOGLE_REVOKE_URL = "https://oauth2.googleapis.com/revoke";
+var PRINCIPAL = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+var MAX_CREDENTIAL_BYTES = 16 * 1024;
+var MAX_PROVIDER_BYTES = 64 * 1024;
+var MAX_TOKEN_CHARACTERS = 8192;
+var REFRESH_BUFFER_MS = 6e4;
+var OPERATION_MS = 3e4;
+var CALLBACK_MS = 5 * 6e4;
+var OAuthOperationError = class extends Error {
+  constructor() {
+    super("OAuth operation failed");
+  }
+};
+var OAuthScopeDriftError = class extends OAuthOperationError {
+};
+var Mutex = class {
+  tail = Promise.resolve();
+  async run(operation) {
+    const previous = this.tail;
+    const next = Promise.withResolvers();
+    this.tail = next.promise;
+    await previous;
+    try {
+      return await operation();
+    } finally {
+      next.resolve();
+    }
+  }
+};
+function policyError() {
+  return new IntegrationPolicyError();
+}
+function authRequired(reason) {
+  return new IntegrationAuthRequiredError(reason);
+}
+function validateOAuthPrincipal(value) {
+  if (typeof value !== "string" || !PRINCIPAL.test(value)) throw policyError();
+  return value;
+}
+function scalarLength(value) {
+  for (let index = 0; index < value.length; index += 1) {
+    const unit = value.charCodeAt(index);
+    if (unit >= 55296 && unit <= 56319) {
+      const next = value.charCodeAt(index + 1);
+      if (next < 56320 || next > 57343) throw new OAuthOperationError();
+      index += 1;
+    } else if (unit >= 56320 && unit <= 57343) {
+      throw new OAuthOperationError();
+    }
+  }
+  return Array.from(value).length;
+}
+function boundedString(value, maximum = MAX_TOKEN_CHARACTERS) {
+  if (typeof value !== "string" || scalarLength(value) < 1 || scalarLength(value) > maximum) {
+    throw new OAuthOperationError();
+  }
+  return value;
+}
+function normalizedScopes(value, provider = false) {
+  if (!Array.isArray(value)) throw provider ? new OAuthOperationError() : policyError();
+  const scopes = [...new Set(value)].sort();
+  if (scopes.length === 0 || scopes.length > 64 || scopes.some(
+    (scope) => typeof scope !== "string" || scope.length === 0 || scalarLength(scope) > 2048 || /\s/.test(scope)
+  )) {
+    throw provider ? new OAuthOperationError() : policyError();
+  }
+  return Object.freeze(scopes);
+}
+function snapshotOAuthCredentialRecord(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new OAuthOperationError();
+  }
+  const root = value;
+  if (Object.keys(root).sort().join(",") !== "schemaVersion,state,tokens") {
+    throw new OAuthOperationError();
+  }
+  if (root.schemaVersion !== 1 || root.state !== "active" && root.state !== "revocation_pending") {
+    throw new OAuthOperationError();
+  }
+  if (root.tokens === null || typeof root.tokens !== "object" || Array.isArray(root.tokens)) {
+    throw new OAuthOperationError();
+  }
+  const tokens = root.tokens;
+  if (Object.keys(tokens).sort().join(",") !== "accessToken,expiresAtEpochMs,grantedScopes,refreshToken,tokenType") {
+    throw new OAuthOperationError();
+  }
+  if (tokens.tokenType !== "Bearer" || !Number.isSafeInteger(tokens.expiresAtEpochMs) || tokens.expiresAtEpochMs < 1 || !Array.isArray(tokens.grantedScopes)) {
+    throw new OAuthOperationError();
+  }
+  const grantedScopes = normalizedScopes(tokens.grantedScopes, true);
+  if (grantedScopes.length !== tokens.grantedScopes.length) throw new OAuthOperationError();
+  const record = {
+    schemaVersion: 1,
+    state: root.state,
+    tokens: {
+      accessToken: boundedString(tokens.accessToken),
+      refreshToken: boundedString(tokens.refreshToken),
+      expiresAtEpochMs: tokens.expiresAtEpochMs,
+      grantedScopes,
+      tokenType: "Bearer"
+    }
+  };
+  return Object.freeze({ ...record, tokens: Object.freeze(record.tokens) });
+}
+function canonicalOAuthCredentialJson(value) {
+  const record = snapshotOAuthCredentialRecord(value);
+  const encoded = JSON.stringify({
+    schemaVersion: 1,
+    state: record.state,
+    tokens: {
+      accessToken: record.tokens.accessToken,
+      expiresAtEpochMs: record.tokens.expiresAtEpochMs,
+      grantedScopes: record.tokens.grantedScopes,
+      refreshToken: record.tokens.refreshToken,
+      tokenType: "Bearer"
+    }
+  });
+  if (new TextEncoder().encode(encoded).byteLength > MAX_CREDENTIAL_BYTES) {
+    throw new OAuthOperationError();
+  }
+  return encoded;
+}
+function parseProviderJson(bytes) {
+  if (bytes.byteLength > MAX_PROVIDER_BYTES) throw new OAuthOperationError();
+  try {
+    const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+      throw new OAuthOperationError();
+    }
+    return value;
+  } catch {
+    throw new OAuthOperationError();
+  }
+}
+function providerErrorCode(bytes) {
+  try {
+    const error = parseProviderJson(bytes).error;
+    return error === "invalid_grant" ? error : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function abortError() {
+  return new DOMException("OAuth operation cancelled", "AbortError");
+}
+function timeoutError() {
+  return new DOMException("OAuth operation timed out", "TimeoutError");
+}
+function throwIfAborted(signal) {
+  if (signal.aborted) throw abortError();
+}
+var NodeOAuthTransport = class {
+  postForm(endpoint, form, signal, deadlineMonotonicMs) {
+    if (endpoint !== GOOGLE_TOKEN_URL && endpoint !== GOOGLE_REVOKE_URL) throw policyError();
+    throwIfAborted(signal);
+    const remaining = Math.min(OPERATION_MS, deadlineMonotonicMs - performance.now());
+    if (remaining <= 0) return Promise.reject(timeoutError());
+    return new Promise((resolve, reject) => {
+      const body = new URLSearchParams(form).toString();
+      const request = https.request(
+        endpoint,
+        {
+          method: "POST",
+          headers: {
+            "content-type": "application/x-www-form-urlencoded",
+            "content-length": Buffer.byteLength(body)
+          },
+          timeout: remaining
+        },
+        (response) => {
+          const chunks = [];
+          let size = 0;
+          response.on("data", (chunk) => {
+            size += chunk.byteLength;
+            if (size > MAX_PROVIDER_BYTES) request.destroy(new OAuthOperationError());
+            else chunks.push(chunk);
+          });
+          response.once(
+            "end",
+            () => resolve({ status: response.statusCode ?? 0, bytes: Buffer.concat(chunks) })
+          );
+        }
+      );
+      const onAbort = () => request.destroy(abortError());
+      signal.addEventListener("abort", onAbort, { once: true });
+      const absoluteTimeout = setTimeout(() => request.destroy(timeoutError()), remaining);
+      request.once("timeout", () => request.destroy(timeoutError()));
+      request.once(
+        "error",
+        (error) => reject(error instanceof DOMException ? error : new OAuthOperationError())
+      );
+      request.once("close", () => {
+        clearTimeout(absoluteTimeout);
+        signal.removeEventListener("abort", onAbort);
+      });
+      request.end(body);
+    });
+  }
+};
+var LoopbackCallback = class {
+  constructor(server, port, sockets) {
+    this.server = server;
+    this.sockets = sockets;
+    this.redirectUri = `http://127.0.0.1:${port}/oauth/callback`;
+  }
+  server;
+  sockets;
+  redirectUri;
+  result = Promise.withResolvers();
+  accept(target) {
+    try {
+      const url = new URL(target, this.redirectUri);
+      const code = url.searchParams.has("error") ? "" : url.searchParams.get("code") ?? "";
+      this.result.resolve([
+        (url.searchParams.get("state") ?? "").slice(0, 256),
+        code.slice(0, 8192)
+      ]);
+      return code.length > 0;
+    } catch {
+      this.result.resolve(["", ""]);
+      return false;
+    }
+  }
+  async waitForCode(expectedState, signal, deadlineMonotonicMs) {
+    const [state, code] = await raceSignal(this.result.promise, signal, deadlineMonotonicMs);
+    const left = Buffer.from(state);
+    const right = Buffer.from(expectedState);
+    const leftHash = crypto.createHash("sha256").update(left).digest();
+    const rightHash = crypto.createHash("sha256").update(right).digest();
+    if (left.byteLength !== right.byteLength || !crypto.timingSafeEqual(leftHash, rightHash)) {
+      throw new OAuthOperationError();
+    }
+    return boundedString(code);
+  }
+  async close() {
+    for (const socket of this.sockets) socket.destroy();
+    if (!this.server.listening) return;
+    await new Promise((resolve) => this.server.close(() => resolve()));
+  }
+};
+var LoopbackCallbackFactory = class {
+  open(signal, deadlineMonotonicMs) {
+    throwIfAborted(signal);
+    const remaining = deadlineMonotonicMs - performance.now();
+    if (remaining <= 0) return Promise.reject(timeoutError());
+    return new Promise((resolve, reject) => {
+      let callback;
+      const sockets = /* @__PURE__ */ new Set();
+      const server = http.createServer((request, response) => {
+        if (request.method !== "GET" || request.url === void 0 || request.url.length > 8192) {
+          response.writeHead(400).end();
+          callback?.accept("");
+          return;
+        }
+        let validPath = false;
+        try {
+          validPath = new URL(request.url, "http://127.0.0.1").pathname === "/oauth/callback";
+        } catch {
+        }
+        const accepted = validPath && callback !== void 0 && callback.accept(request.url);
+        response.writeHead(accepted ? 200 : 400, { "content-length": "0", connection: "close" }).end();
+      });
+      server.on("connection", (socket) => {
+        sockets.add(socket);
+        socket.once("close", () => sockets.delete(socket));
+      });
+      let settled = false;
+      const cleanup = () => {
+        clearTimeout(timeout);
+        signal.removeEventListener("abort", onAbort);
+      };
+      const fail = (error) => {
+        if (settled) return;
+        settled = true;
+        cleanup();
+        try {
+          server.close();
+        } catch {
+        }
+        reject(error);
+      };
+      const onAbort = () => fail(abortError());
+      const timeout = setTimeout(() => fail(timeoutError()), remaining);
+      signal.addEventListener("abort", onAbort, { once: true });
+      server.once("error", () => fail(new OAuthOperationError()));
+      server.listen(0, "127.0.0.1", () => {
+        if (settled) {
+          for (const socket of sockets) socket.destroy();
+          server.close();
+          return;
+        }
+        const address = server.address();
+        if (address === null || typeof address === "string") {
+          fail(new OAuthOperationError());
+          return;
+        }
+        settled = true;
+        cleanup();
+        callback = new LoopbackCallback(server, address.port, sockets);
+        resolve(callback);
+      });
+    });
+  }
+};
+var SystemBrowser = class {
+  async open(url, signal, deadlineMonotonicMs) {
+    throwIfAborted(signal);
+    const remaining = deadlineMonotonicMs - performance.now();
+    if (remaining <= 0) throw timeoutError();
+    await new Promise((resolve, reject) => {
+      const child = child_process.spawn("/usr/bin/open", [url], { stdio: "ignore", shell: false });
+      let failure;
+      let grace;
+      const terminate = (error) => {
+        failure ??= error;
+        if (child.exitCode !== null || child.signalCode !== null) return;
+        child.kill("SIGTERM");
+        grace ??= setTimeout(() => {
+          if (child.exitCode === null && child.signalCode === null) child.kill("SIGKILL");
+        }, 250);
+      };
+      const onAbort = () => terminate(abortError());
+      signal.addEventListener("abort", onAbort, { once: true });
+      const timeout = setTimeout(() => terminate(timeoutError()), remaining);
+      child.once("error", () => terminate(new OAuthOperationError()));
+      child.once("close", (code) => {
+        clearTimeout(timeout);
+        if (grace !== void 0) clearTimeout(grace);
+        signal.removeEventListener("abort", onAbort);
+        if (failure !== void 0) reject(failure);
+        else if (code === 0) resolve();
+        else reject(new OAuthOperationError());
+      });
+    });
+  }
+};
+async function raceSignal(operation, signal, deadlineMonotonicMs, nowMonotonic = () => performance.now()) {
+  throwIfAborted(signal);
+  let remaining;
+  if (deadlineMonotonicMs !== void 0) {
+    remaining = deadlineMonotonicMs - nowMonotonic();
+    if (remaining <= 0) throw timeoutError();
+  }
+  const cancellation = Promise.withResolvers();
+  const onAbort = () => cancellation.reject(abortError());
+  signal.addEventListener("abort", onAbort, { once: true });
+  let timer;
+  const candidates = [operation, cancellation.promise];
+  if (remaining !== void 0) {
+    const timeout = new Promise((_, reject) => {
+      timer = setTimeout(() => reject(timeoutError()), remaining);
+    });
+    candidates.push(timeout);
+  }
+  try {
+    return await Promise.race(candidates);
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+    signal.removeEventListener("abort", onAbort);
+  }
+}
+function base64Url(value) {
+  return Buffer.from(value).toString("base64url");
+}
+var GoogleOAuthClient = class _GoogleOAuthClient {
+  options;
+  dependencies;
+  metrics;
+  trace;
+  slots = /* @__PURE__ */ new Map();
+  slotsGate = new Mutex();
+  constructor(options) {
+    this.options = validatedOptions(options);
+    this.metrics = options.metricsSink ?? NOOP_METRICS;
+    this.trace = options.traceSink ?? NOOP_TRACE;
+    this.dependencies = {
+      http: new NodeOAuthTransport(),
+      callbackFactory: new LoopbackCallbackFactory(),
+      browser: new SystemBrowser(),
+      clock: systemClock,
+      randomBytes: (count) => crypto.randomBytes(count)
+    };
+  }
+  /** @internal Source-relative tests only. */
+  static _create(options, dependencies) {
+    const client = Object.create(_GoogleOAuthClient.prototype);
+    Object.defineProperty(client, "options", { value: validatedOptions(options) });
+    Object.defineProperty(client, "dependencies", { value: dependencies });
+    Object.defineProperty(client, "metrics", { value: options.metricsSink ?? NOOP_METRICS });
+    Object.defineProperty(client, "trace", { value: options.traceSink ?? NOOP_TRACE });
+    Object.defineProperty(client, "slots", { value: /* @__PURE__ */ new Map() });
+    Object.defineProperty(client, "slotsGate", { value: new Mutex() });
+    return client;
+  }
+  async connect(principalId, signal) {
+    principalId = validateOAuthPrincipal(principalId);
+    throwIfAborted(signal);
+    const clientId = this.requiredClientId();
+    const slot = await this.acquireSlot(principalId);
+    try {
+      let operation;
+      while (operation === void 0) {
+        let pendingDisconnect;
+        await slot.gate.run(() => {
+          if (slot.disconnect !== void 0) {
+            pendingDisconnect = slot.disconnect;
+            return;
+          }
+          slot.generation += 1;
+          slot.blocked = true;
+          const previous = [];
+          if (slot.connect !== void 0) {
+            slot.connect.controller.abort(abortError());
+            previous.push(slot.connect.promise);
+          }
+          if (slot.refresh !== void 0) {
+            slot.refresh.controller.abort(abortError());
+            previous.push(slot.refresh.promise);
+          }
+          const controller = new AbortController();
+          const generation = slot.generation;
+          const promise = (async () => {
+            await Promise.allSettled(previous);
+            throwIfAborted(controller.signal);
+            await slot.gate.run(() => {
+              if (slot.generation !== generation || slot.connect?.generation !== generation || slot.connect.controller !== controller) {
+                throw authRequired("gmail_grant_missing");
+              }
+            });
+            await this.runConnect(principalId, slot, generation, clientId, controller.signal);
+            await slot.gate.run(() => {
+              if (slot.generation !== generation || slot.connect?.generation !== generation || slot.connect.controller !== controller) {
+                throw authRequired("gmail_grant_missing");
+              }
+              slot.blocked = false;
+            });
+          })();
+          operation = { generation, controller, promise };
+          slot.connect = operation;
+        });
+        if (pendingDisconnect !== void 0) await raceSignal(pendingDisconnect, signal);
+      }
+      try {
+        await raceSignal(operation.promise, signal);
+      } catch (error) {
+        operation.controller.abort(abortError());
+        await Promise.allSettled([operation.promise]);
+        throw error;
+      } finally {
+        await slot.gate.run(() => {
+          if (slot.connect === operation) delete slot.connect;
+        });
+      }
+    } finally {
+      await this.releaseSlot(principalId, slot);
+    }
+  }
+  async accessToken(context) {
+    const started = this.dependencies.clock.nowMonotonic();
+    const span = startSpan(this.trace, "kaji.integration.auth", {
+      "integration.name": "gmail",
+      "integration.operation": "token",
+      "http.status_family": "none"
+    });
+    let outcome = "error";
+    try {
+      const token = await this.accessTokenInternal(context);
+      outcome = "success";
+      return token;
+    } catch (error) {
+      if (error instanceof DOMException && error.name === "AbortError") outcome = "cancelled";
+      span.recordError(error);
+      throw error;
+    } finally {
+      recordMetric(
+        this.metrics,
+        "kaji.integration.auth_ms",
+        Math.max(0, this.dependencies.clock.nowMonotonic() - started),
+        { integration: "gmail", operation: "token", outcome }
+      );
+      span.end();
+    }
+  }
+  async accessTokenInternal(context) {
+    const principalId = validateOAuthPrincipal(context.principalId);
+    throwIfAborted(context.signal);
+    this.checkDeadline(context.deadlineMonotonicMs);
+    const slot = await this.acquireSlot(principalId);
+    try {
+      if (slot.blocked) throw authRequired("gmail_grant_missing");
+      const generation = await slot.gate.run(() => {
+        if (slot.blocked) throw authRequired("gmail_grant_missing");
+        return slot.generation;
+      });
+      const loaded = await raceSignal(
+        this.options.storage.load(principalId, context.signal),
+        context.signal,
+        context.deadlineMonotonicMs,
+        () => this.dependencies.clock.nowMonotonic()
+      );
+      if (loaded === void 0) throw authRequired("gmail_grant_missing");
+      const record = snapshotOAuthCredentialRecord(loaded);
+      if (record.state === "revocation_pending") throw authRequired("gmail_grant_missing");
+      if (!isSuperset(record.tokens.grantedScopes, this.options.scopes)) {
+        this.checkDeadline(context.deadlineMonotonicMs);
+        await this.deleteIfCurrent(principalId, slot, generation, context.signal);
+        throw authRequired("gmail_scope_drift");
+      }
+      if (record.tokens.expiresAtEpochMs > this.dependencies.clock.nowWallSeconds() * 1e3 + REFRESH_BUFFER_MS) {
+        return slot.gate.run(() => {
+          this.checkDeadline(context.deadlineMonotonicMs);
+          if (slot.blocked || slot.generation !== generation) {
+            throw authRequired("gmail_grant_missing");
+          }
+          return record.tokens.accessToken;
+        });
+      }
+      return await this.joinRefresh(principalId, slot, generation, record, context);
+    } finally {
+      await this.releaseSlot(principalId, slot);
+    }
+  }
+  async disconnect(principalId, signal, options = {}) {
+    principalId = validateOAuthPrincipal(principalId);
+    throwIfAborted(signal);
+    const slot = await this.acquireSlot(principalId);
+    const completion = Promise.withResolvers();
+    let previousDisconnect;
+    await slot.gate.run(() => {
+      previousDisconnect = slot.disconnect;
+      slot.disconnect = completion.promise;
+    });
+    try {
+      if (previousDisconnect !== void 0) await raceSignal(previousDisconnect, signal);
+      let generation = 0;
+      let operations = [];
+      await slot.gate.run(() => {
+        slot.generation += 1;
+        generation = slot.generation;
+        slot.blocked = true;
+        if (slot.connect !== void 0) {
+          slot.connect.controller.abort(abortError());
+          operations.push(slot.connect.promise);
+        }
+        if (slot.refresh !== void 0) {
+          slot.refresh.controller.abort(abortError());
+          operations.push(slot.refresh.promise);
+        }
+      });
+      await Promise.allSettled(operations);
+      const loaded = await this.options.storage.load(principalId, signal);
+      if (loaded === void 0)
+        return Object.freeze({ localState: "missing", remoteRevoked: false });
+      const record = snapshotOAuthCredentialRecord(loaded);
+      if (options.forceLocal === true) {
+        await this.deleteBlockedIfCurrent(principalId, slot, generation, signal);
+        return Object.freeze({ localState: "deleted", remoteRevoked: false });
+      }
+      const pending = snapshotOAuthCredentialRecord({ ...record, state: "revocation_pending" });
+      const cleanup = new AbortController();
+      let response;
+      try {
+        response = await this.dependencies.http.postForm(
+          GOOGLE_REVOKE_URL,
+          { token: record.tokens.refreshToken },
+          signal,
+          this.dependencies.clock.nowMonotonic() + OPERATION_MS
+        );
+      } catch {
+        await this.saveIfCurrent(principalId, slot, generation, pending, cleanup.signal);
+        if (signal.aborted) throw abortError();
+        return Object.freeze({ localState: "revocation_pending", remoteRevoked: false });
+      }
+      if (response.status === 200) {
+        try {
+          await this.deleteBlockedIfCurrent(principalId, slot, generation, cleanup.signal);
+        } catch {
+          await this.saveIfCurrent(principalId, slot, generation, pending, cleanup.signal);
+          return Object.freeze({ localState: "revocation_pending", remoteRevoked: true });
+        }
+        return Object.freeze({ localState: "deleted", remoteRevoked: true });
+      }
+      await this.saveIfCurrent(principalId, slot, generation, pending, cleanup.signal);
+      return Object.freeze({ localState: "revocation_pending", remoteRevoked: false });
+    } finally {
+      completion.resolve();
+      await slot.gate.run(() => {
+        if (slot.disconnect === completion.promise) delete slot.disconnect;
+      });
+      await this.releaseSlot(principalId, slot);
+    }
+  }
+  requiredClientId() {
+    if (this.options.clientId === void 0 || this.options.clientId.length === 0) {
+      throw authRequired("gmail_grant_missing");
+    }
+    return this.options.clientId;
+  }
+  checkDeadline(deadline) {
+    if (deadline !== void 0 && deadline <= this.dependencies.clock.nowMonotonic()) {
+      throw timeoutError();
+    }
+  }
+  async runConnect(principalId, slot, generation, clientId, signal) {
+    const callbackDeadline = this.dependencies.clock.nowMonotonic() + CALLBACK_MS;
+    const callback = await this.dependencies.callbackFactory.open(signal, callbackDeadline);
+    try {
+      const state = base64Url(this.dependencies.randomBytes(32));
+      const verifier = base64Url(this.dependencies.randomBytes(64));
+      if (verifier.length < 43 || verifier.length > 128) throw new OAuthOperationError();
+      const challenge = crypto.createHash("sha256").update(verifier, "ascii").digest("base64url");
+      const authorization = new URL(GOOGLE_AUTH_URL);
+      authorization.search = new URLSearchParams({
+        client_id: clientId,
+        redirect_uri: callback.redirectUri,
+        response_type: "code",
+        scope: this.options.scopes.join(" "),
+        state,
+        access_type: "offline",
+        prompt: "consent",
+        code_challenge: challenge,
+        code_challenge_method: "S256"
+      }).toString();
+      await this.dependencies.browser.open(authorization.href, signal, callbackDeadline);
+      const code = boundedString(await callback.waitForCode(state, signal, callbackDeadline));
+      const form = {
+        code,
+        code_verifier: verifier,
+        client_id: clientId,
+        redirect_uri: callback.redirectUri,
+        grant_type: "authorization_code"
+      };
+      if (this.options.clientSecret !== void 0) form.client_secret = this.options.clientSecret;
+      const response = await this.dependencies.http.postForm(
+        GOOGLE_TOKEN_URL,
+        form,
+        signal,
+        this.dependencies.clock.nowMonotonic() + OPERATION_MS
+      );
+      if (response.status !== 200) throw new OAuthOperationError();
+      const tokens = this.tokensFromResponse(response.bytes, void 0, true);
+      await this.saveIfCurrent(
+        principalId,
+        slot,
+        generation,
+        snapshotOAuthCredentialRecord({ schemaVersion: 1, state: "active", tokens }),
+        signal,
+        true
+      );
+    } catch (error) {
+      if (error instanceof DOMException || error instanceof IntegrationExecutionError) throw error;
+      throw new OAuthOperationError();
+    } finally {
+      await callback.close();
+    }
+  }
+  async joinRefresh(principalId, slot, generation, record, context) {
+    let flight;
+    await slot.gate.run(() => {
+      if (slot.blocked || slot.generation !== generation) throw authRequired("gmail_grant_missing");
+      if (slot.refresh === void 0 || slot.refresh.generation !== generation) {
+        const controller = new AbortController();
+        const identity = {};
+        const deadline = this.dependencies.clock.nowMonotonic() + OPERATION_MS;
+        const promise = this.runRefreshWithDeadline(
+          () => this.runRefresh(principalId, slot, generation, record, controller.signal, deadline),
+          controller
+        ).finally(async () => {
+          await slot.gate.run(() => {
+            if (slot.refresh?.identity === identity) delete slot.refresh;
+          });
+        });
+        slot.refresh = { identity, generation, controller, promise, waiters: 0 };
+      }
+      flight = slot.refresh;
+      flight.waiters += 1;
+    });
+    try {
+      return await raceSignal(
+        flight.promise,
+        context.signal,
+        context.deadlineMonotonicMs,
+        () => this.dependencies.clock.nowMonotonic()
+      );
+    } finally {
+      let abort = false;
+      await slot.gate.run(() => {
+        flight.waiters -= 1;
+        abort = flight.waiters === 0 && slot.refresh?.identity === flight.identity;
+      });
+      if (abort) {
+        flight.controller.abort(abortError());
+        await Promise.allSettled([flight.promise]);
+      }
+    }
+  }
+  async runRefresh(principalId, slot, generation, record, signal, deadlineMonotonicMs) {
+    const form = {
+      refresh_token: record.tokens.refreshToken,
+      client_id: this.requiredClientId(),
+      grant_type: "refresh_token"
+    };
+    if (this.options.clientSecret !== void 0) form.client_secret = this.options.clientSecret;
+    const response = await this.dependencies.http.postForm(
+      GOOGLE_TOKEN_URL,
+      form,
+      signal,
+      deadlineMonotonicMs
+    );
+    if (response.status !== 200) {
+      if (providerErrorCode(response.bytes) === "invalid_grant") {
+        await this.deleteIfCurrent(principalId, slot, generation, signal);
+        throw authRequired("gmail_grant_missing");
+      }
+      throw new IntegrationExecutionError("api_rejected");
+    }
+    let tokens;
+    try {
+      tokens = this.tokensFromResponse(response.bytes, record.tokens, false);
+    } catch (error) {
+      if (!(error instanceof OAuthScopeDriftError)) throw error;
+      await this.deleteIfCurrent(principalId, slot, generation, signal);
+      throw authRequired("gmail_scope_drift");
+    }
+    await this.saveIfCurrent(
+      principalId,
+      slot,
+      generation,
+      snapshotOAuthCredentialRecord({ schemaVersion: 1, state: "active", tokens }),
+      signal
+    );
+    return tokens.accessToken;
+  }
+  async runRefreshWithDeadline(start, controller) {
+    const operation = start();
+    let timedOut = false;
+    let timer;
+    const timeout = new Promise((_, reject) => {
+      timer = setTimeout(() => {
+        timedOut = true;
+        controller.abort(abortError());
+        reject(timeoutError());
+      }, OPERATION_MS);
+    });
+    try {
+      return await Promise.race([operation, timeout]);
+    } catch (error) {
+      if (!timedOut) throw error;
+      await Promise.allSettled([operation]);
+      throw timeoutError();
+    } finally {
+      if (timer !== void 0) clearTimeout(timer);
+    }
+  }
+  tokensFromResponse(bytes, fallback, requireScope) {
+    const value = parseProviderJson(bytes);
+    if (value.token_type !== "Bearer") throw new OAuthOperationError();
+    const expires = value.expires_in;
+    if (typeof expires !== "number" || !Number.isFinite(expires) || expires <= 0 || expires > 604800) {
+      throw new OAuthOperationError();
+    }
+    const refreshToken = value.refresh_token === void 0 && fallback !== void 0 ? fallback.refreshToken : boundedString(value.refresh_token);
+    let grantedScopes;
+    if (value.scope === void 0) {
+      if (requireScope || fallback === void 0) throw new OAuthOperationError();
+      grantedScopes = fallback.grantedScopes;
+    } else {
+      if (typeof value.scope !== "string") throw new OAuthOperationError();
+      grantedScopes = normalizedScopes(value.scope.split(/\s+/).filter(Boolean), true);
+      if (!isSuperset(grantedScopes, this.options.scopes)) {
+        if (fallback !== void 0) throw new OAuthScopeDriftError();
+        throw new OAuthOperationError();
+      }
+    }
+    return Object.freeze({
+      accessToken: boundedString(value.access_token),
+      refreshToken,
+      expiresAtEpochMs: Math.floor(
+        this.dependencies.clock.nowWallSeconds() * 1e3 + expires * 1e3
+      ),
+      grantedScopes,
+      tokenType: "Bearer"
+    });
+  }
+  async saveIfCurrent(principalId, slot, generation, record, signal, allowBlockedActive = false) {
+    await slot.gate.run(() => {
+      if (slot.generation !== generation || slot.blocked && record.state === "active" && !allowBlockedActive) {
+        throw authRequired("gmail_grant_missing");
+      }
+      return this.options.storage.save(principalId, record, signal);
+    });
+  }
+  async deleteIfCurrent(principalId, slot, generation, signal) {
+    await slot.gate.run(() => {
+      if (slot.generation !== generation || slot.blocked) throw authRequired("gmail_grant_missing");
+      return this.options.storage.delete(principalId, signal);
+    });
+  }
+  async deleteBlockedIfCurrent(principalId, slot, generation, signal) {
+    await slot.gate.run(() => {
+      if (slot.generation !== generation || !slot.blocked) {
+        throw authRequired("gmail_grant_missing");
+      }
+      return this.options.storage.delete(principalId, signal);
+    });
+  }
+  async acquireSlot(principalId) {
+    return this.slotsGate.run(() => {
+      let slot = this.slots.get(principalId);
+      if (slot === void 0) {
+        slot = { gate: new Mutex(), generation: 0, blocked: false, references: 0 };
+        this.slots.set(principalId, slot);
+      }
+      slot.references += 1;
+      return slot;
+    });
+  }
+  async releaseSlot(principalId, slot) {
+    await this.slotsGate.run(() => {
+      slot.references -= 1;
+      if (slot.references === 0 && slot.connect === void 0 && slot.refresh === void 0 && slot.disconnect === void 0 && this.slots.get(principalId) === slot) {
+        this.slots.delete(principalId);
+      }
+    });
+  }
+};
+function isSuperset(candidate, required) {
+  const values = new Set(candidate);
+  return required.every((scope) => values.has(scope));
+}
+function validatedOptions(options) {
+  if (options === null || typeof options !== "object" || typeof options.storage !== "object") {
+    throw policyError();
+  }
+  const scopes = normalizedScopes(options.scopes);
+  const clientId = options.clientId === void 0 || options.clientId === "" ? void 0 : boundedString(options.clientId, 4096);
+  const clientSecret = options.clientSecret === void 0 ? void 0 : boundedString(options.clientSecret);
+  return Object.freeze({
+    ...clientId === void 0 ? {} : { clientId },
+    ...clientSecret === void 0 ? {} : { clientSecret },
+    scopes,
+    storage: options.storage
+  });
+}
+var SECURITY = "/usr/bin/security";
+var INTEGRATION_NAME = /^[a-z][a-z0-9_-]*$/;
+var MAX_INTEGRATION_NAME_LENGTH = 128;
+var TIMEOUT_MS = 1e4;
+var MAX_STDOUT_BYTES = 16 * 1024 + 1;
+var MAX_STDERR_BYTES = 8 * 1024;
+var TERM_GRACE_MS = 250;
+var ProcessFailure = class extends Error {
+  constructor(kind) {
+    super("Keychain process failed");
+    this.kind = kind;
+  }
+  kind;
+};
+var SpawnKeychainProcess = class {
+  constructor(spawnChild = child_process.spawn) {
+    this.spawnChild = spawnChild;
+  }
+  spawnChild;
+  run(args, options) {
+    if (options.signal.aborted) return Promise.reject(new ProcessFailure("cancelled"));
+    return new Promise((resolve, reject) => {
+      let child;
+      try {
+        child = this.spawnChild(SECURITY, args, {
+          shell: false,
+          stdio: ["pipe", "pipe", "pipe"]
+        });
+      } catch {
+        reject(new ProcessFailure("failed"));
+        return;
+      }
+      const stdout = [];
+      let stdoutBytes = 0;
+      let stderrBytes = 0;
+      let failure;
+      let grace;
+      const terminate = (next) => {
+        if (failure === void 0) failure = next;
+        if (child.exitCode !== null || child.signalCode !== null) return;
+        child.kill("SIGTERM");
+        grace ??= setTimeout(() => {
+          if (child.exitCode === null && child.signalCode === null) child.kill("SIGKILL");
+        }, TERM_GRACE_MS);
+      };
+      child.stdout.on("data", (chunk) => {
+        stdoutBytes += chunk.byteLength;
+        if (stdoutBytes > options.maxStdoutBytes) terminate(new ProcessFailure("overflow"));
+        else stdout.push(chunk);
+      });
+      child.stderr.on("data", (chunk) => {
+        stderrBytes += chunk.byteLength;
+        if (stderrBytes > MAX_STDERR_BYTES) terminate(new ProcessFailure("overflow"));
+      });
+      const onAbort = () => terminate(new ProcessFailure("cancelled"));
+      options.signal.addEventListener("abort", onAbort, { once: true });
+      const timeout = setTimeout(() => terminate(new ProcessFailure("timeout")), options.timeoutMs);
+      child.once("error", () => terminate(new ProcessFailure("failed")));
+      child.once("close", (code) => {
+        clearTimeout(timeout);
+        if (grace !== void 0) clearTimeout(grace);
+        options.signal.removeEventListener("abort", onAbort);
+        if (failure !== void 0) {
+          reject(failure);
+          return;
+        }
+        try {
+          resolve({
+            code: code ?? 1,
+            stdout: new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(stdout))
+          });
+        } catch {
+          reject(new ProcessFailure("overflow"));
+        }
+      });
+      child.stdin.once("error", () => terminate(new ProcessFailure("failed")));
+      child.stdin.end(options.stdin);
+    });
+  }
+};
+function executable() {
+  try {
+    fs.accessSync(SECURITY, fs.constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function serviceFor(integrationName) {
+  if (typeof integrationName !== "string" || integrationName.length > MAX_INTEGRATION_NAME_LENGTH || !INTEGRATION_NAME.test(integrationName)) {
+    throw new IntegrationPolicyError();
+  }
+  return `dev.kaji.oauth.${integrationName}`;
+}
+function accountFor(service, principalId) {
+  principalId = validateOAuthPrincipal(principalId);
+  return crypto.createHash("sha256").update(`${service}\0${principalId}`, "utf8").digest("hex");
+}
+var MacOSKeychainTokenStorage = class _MacOSKeychainTokenStorage {
+  process;
+  platform;
+  executable;
+  service;
+  constructor(integrationName = "gmail") {
+    this.service = serviceFor(integrationName);
+    this.process = new SpawnKeychainProcess();
+    this.platform = os.platform();
+    this.executable = executable();
+  }
+  /** @internal Source-relative tests only. */
+  static _create(options) {
+    const service = serviceFor(options.integrationName ?? "gmail");
+    const storage = Object.create(_MacOSKeychainTokenStorage.prototype);
+    Object.defineProperties(storage, {
+      process: { value: options.process },
+      platform: { value: options.platform },
+      executable: { value: options.executable },
+      service: { value: service }
+    });
+    return storage;
+  }
+  async load(principalId, signal) {
+    const account = this.preflight(principalId);
+    const result = await this.run(
+      ["find-generic-password", "-a", account, "-s", this.service, "-w"],
+      { signal }
+    );
+    if (result.code === 44) return void 0;
+    if (result.code !== 0) throw new IntegrationAuthError("keychain_locked");
+    const output = result.stdout.endsWith("\n") ? result.stdout.slice(0, -1) : result.stdout;
+    try {
+      if (new TextEncoder().encode(output).byteLength > 16 * 1024) throw new Error();
+      return snapshotOAuthCredentialRecord(JSON.parse(output));
+    } catch {
+      throw new IntegrationAuthError("keychain_corrupt");
+    }
+  }
+  async save(principalId, record, signal) {
+    const account = this.preflight(principalId);
+    const stdin = canonicalOAuthCredentialJson(record);
+    const result = await this.run(
+      ["add-generic-password", "-a", account, "-s", this.service, "-U", "-w"],
+      { signal, stdin }
+    );
+    if (result.code !== 0) throw new IntegrationAuthError("keychain_locked");
+  }
+  async delete(principalId, signal) {
+    const account = this.preflight(principalId);
+    const result = await this.run(["delete-generic-password", "-a", account, "-s", this.service], {
+      signal
+    });
+    if (result.code !== 0 && result.code !== 44) {
+      throw new IntegrationAuthError("keychain_locked");
+    }
+  }
+  preflight(principalId) {
+    const account = accountFor(this.service, principalId);
+    if (this.platform !== "darwin" || !this.executable) {
+      throw new IntegrationAuthError("keychain_unsupported");
+    }
+    return account;
+  }
+  async run(args, options) {
+    try {
+      return await this.process.run(args, {
+        ...options,
+        timeoutMs: TIMEOUT_MS,
+        maxStdoutBytes: MAX_STDOUT_BYTES
+      });
+    } catch (error) {
+      if (error instanceof ProcessFailure && error.kind === "cancelled") {
+        throw new DOMException("Keychain operation cancelled", "AbortError");
+      }
+      if (error instanceof ProcessFailure && error.kind === "overflow") {
+        throw new IntegrationAuthError("keychain_corrupt");
+      }
+      throw new IntegrationAuthError("keychain_locked");
+    }
+  }
+};
+
+exports.GoogleOAuthClient = GoogleOAuthClient;
+exports.MacOSKeychainTokenStorage = MacOSKeychainTokenStorage;
+exports.canonicalOAuthCredentialJson = canonicalOAuthCredentialJson;
+exports.snapshotOAuthCredentialRecord = snapshotOAuthCredentialRecord;
+//# sourceMappingURL=auth.cjs.map
+//# sourceMappingURL=auth.cjs.map