@irogane/kaji 0.2.0-beta.11

package/dist/auth.js

@@ -0,0 +1,1039 @@
+import { systemClock, IntegrationExecutionError, IntegrationAuthError, IntegrationAuthRequiredError, IntegrationPolicyError } from './chunk-KCAXIOZS.js';
+import { NOOP_METRICS, NOOP_TRACE, startSpan, recordMetric } from './chunk-LSJ4AVO2.js';
+import { randomBytes, createHash, timingSafeEqual } from 'crypto';
+import { createServer } from 'http';
+import { request } from 'https';
+import { spawn } from 'child_process';
+import { accessSync, constants } from 'fs';
+import { platform } from 'os';
+
+var GOOGLE_AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
+var GOOGLE_TOKEN_URL = "https://oauth2.googleapis.com/token";
+var GOOGLE_REVOKE_URL = "https://oauth2.googleapis.com/revoke";
+var PRINCIPAL = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+var MAX_CREDENTIAL_BYTES = 16 * 1024;
+var MAX_PROVIDER_BYTES = 64 * 1024;
+var MAX_TOKEN_CHARACTERS = 8192;
+var REFRESH_BUFFER_MS = 6e4;
+var OPERATION_MS = 3e4;
+var CALLBACK_MS = 5 * 6e4;
+var OAuthOperationError = class extends Error {
+  constructor() {
+    super("OAuth operation failed");
+  }
+};
+var OAuthScopeDriftError = class extends OAuthOperationError {
+};
+var Mutex = class {
+  tail = Promise.resolve();
+  async run(operation) {
+    const previous = this.tail;
+    const next = Promise.withResolvers();
+    this.tail = next.promise;
+    await previous;
+    try {
+      return await operation();
+    } finally {
+      next.resolve();
+    }
+  }
+};
+function policyError() {
+  return new IntegrationPolicyError();
+}
+function authRequired(reason) {
+  return new IntegrationAuthRequiredError(reason);
+}
+function validateOAuthPrincipal(value) {
+  if (typeof value !== "string" || !PRINCIPAL.test(value)) throw policyError();
+  return value;
+}
+function scalarLength(value) {
+  for (let index = 0; index < value.length; index += 1) {
+    const unit = value.charCodeAt(index);
+    if (unit >= 55296 && unit <= 56319) {
+      const next = value.charCodeAt(index + 1);
+      if (next < 56320 || next > 57343) throw new OAuthOperationError();
+      index += 1;
+    } else if (unit >= 56320 && unit <= 57343) {
+      throw new OAuthOperationError();
+    }
+  }
+  return Array.from(value).length;
+}
+function boundedString(value, maximum = MAX_TOKEN_CHARACTERS) {
+  if (typeof value !== "string" || scalarLength(value) < 1 || scalarLength(value) > maximum) {
+    throw new OAuthOperationError();
+  }
+  return value;
+}
+function normalizedScopes(value, provider = false) {
+  if (!Array.isArray(value)) throw provider ? new OAuthOperationError() : policyError();
+  const scopes = [...new Set(value)].sort();
+  if (scopes.length === 0 || scopes.length > 64 || scopes.some(
+    (scope) => typeof scope !== "string" || scope.length === 0 || scalarLength(scope) > 2048 || /\s/.test(scope)
+  )) {
+    throw provider ? new OAuthOperationError() : policyError();
+  }
+  return Object.freeze(scopes);
+}
+function snapshotOAuthCredentialRecord(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new OAuthOperationError();
+  }
+  const root = value;
+  if (Object.keys(root).sort().join(",") !== "schemaVersion,state,tokens") {
+    throw new OAuthOperationError();
+  }
+  if (root.schemaVersion !== 1 || root.state !== "active" && root.state !== "revocation_pending") {
+    throw new OAuthOperationError();
+  }
+  if (root.tokens === null || typeof root.tokens !== "object" || Array.isArray(root.tokens)) {
+    throw new OAuthOperationError();
+  }
+  const tokens = root.tokens;
+  if (Object.keys(tokens).sort().join(",") !== "accessToken,expiresAtEpochMs,grantedScopes,refreshToken,tokenType") {
+    throw new OAuthOperationError();
+  }
+  if (tokens.tokenType !== "Bearer" || !Number.isSafeInteger(tokens.expiresAtEpochMs) || tokens.expiresAtEpochMs < 1 || !Array.isArray(tokens.grantedScopes)) {
+    throw new OAuthOperationError();
+  }
+  const grantedScopes = normalizedScopes(tokens.grantedScopes, true);
+  if (grantedScopes.length !== tokens.grantedScopes.length) throw new OAuthOperationError();
+  const record = {
+    schemaVersion: 1,
+    state: root.state,
+    tokens: {
+      accessToken: boundedString(tokens.accessToken),
+      refreshToken: boundedString(tokens.refreshToken),
+      expiresAtEpochMs: tokens.expiresAtEpochMs,
+      grantedScopes,
+      tokenType: "Bearer"
+    }
+  };
+  return Object.freeze({ ...record, tokens: Object.freeze(record.tokens) });
+}
+function canonicalOAuthCredentialJson(value) {
+  const record = snapshotOAuthCredentialRecord(value);
+  const encoded = JSON.stringify({
+    schemaVersion: 1,
+    state: record.state,
+    tokens: {
+      accessToken: record.tokens.accessToken,
+      expiresAtEpochMs: record.tokens.expiresAtEpochMs,
+      grantedScopes: record.tokens.grantedScopes,
+      refreshToken: record.tokens.refreshToken,
+      tokenType: "Bearer"
+    }
+  });
+  if (new TextEncoder().encode(encoded).byteLength > MAX_CREDENTIAL_BYTES) {
+    throw new OAuthOperationError();
+  }
+  return encoded;
+}
+function parseProviderJson(bytes) {
+  if (bytes.byteLength > MAX_PROVIDER_BYTES) throw new OAuthOperationError();
+  try {
+    const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+      throw new OAuthOperationError();
+    }
+    return value;
+  } catch {
+    throw new OAuthOperationError();
+  }
+}
+function providerErrorCode(bytes) {
+  try {
+    const error = parseProviderJson(bytes).error;
+    return error === "invalid_grant" ? error : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function abortError() {
+  return new DOMException("OAuth operation cancelled", "AbortError");
+}
+function timeoutError() {
+  return new DOMException("OAuth operation timed out", "TimeoutError");
+}
+function throwIfAborted(signal) {
+  if (signal.aborted) throw abortError();
+}
+var NodeOAuthTransport = class {
+  postForm(endpoint, form, signal, deadlineMonotonicMs) {
+    if (endpoint !== GOOGLE_TOKEN_URL && endpoint !== GOOGLE_REVOKE_URL) throw policyError();
+    throwIfAborted(signal);
+    const remaining = Math.min(OPERATION_MS, deadlineMonotonicMs - performance.now());
+    if (remaining <= 0) return Promise.reject(timeoutError());
+    return new Promise((resolve, reject) => {
+      const body = new URLSearchParams(form).toString();
+      const request$1 = request(
+        endpoint,
+        {
+          method: "POST",
+          headers: {
+            "content-type": "application/x-www-form-urlencoded",
+            "content-length": Buffer.byteLength(body)
+          },
+          timeout: remaining
+        },
+        (response) => {
+          const chunks = [];
+          let size = 0;
+          response.on("data", (chunk) => {
+            size += chunk.byteLength;
+            if (size > MAX_PROVIDER_BYTES) request$1.destroy(new OAuthOperationError());
+            else chunks.push(chunk);
+          });
+          response.once(
+            "end",
+            () => resolve({ status: response.statusCode ?? 0, bytes: Buffer.concat(chunks) })
+          );
+        }
+      );
+      const onAbort = () => request$1.destroy(abortError());
+      signal.addEventListener("abort", onAbort, { once: true });
+      const absoluteTimeout = setTimeout(() => request$1.destroy(timeoutError()), remaining);
+      request$1.once("timeout", () => request$1.destroy(timeoutError()));
+      request$1.once(
+        "error",
+        (error) => reject(error instanceof DOMException ? error : new OAuthOperationError())
+      );
+      request$1.once("close", () => {
+        clearTimeout(absoluteTimeout);
+        signal.removeEventListener("abort", onAbort);
+      });
+      request$1.end(body);
+    });
+  }
+};
+var LoopbackCallback = class {
+  constructor(server, port, sockets) {
+    this.server = server;
+    this.sockets = sockets;
+    this.redirectUri = `http://127.0.0.1:${port}/oauth/callback`;
+  }
+  server;
+  sockets;
+  redirectUri;
+  result = Promise.withResolvers();
+  accept(target) {
+    try {
+      const url = new URL(target, this.redirectUri);
+      const code = url.searchParams.has("error") ? "" : url.searchParams.get("code") ?? "";
+      this.result.resolve([
+        (url.searchParams.get("state") ?? "").slice(0, 256),
+        code.slice(0, 8192)
+      ]);
+      return code.length > 0;
+    } catch {
+      this.result.resolve(["", ""]);
+      return false;
+    }
+  }
+  async waitForCode(expectedState, signal, deadlineMonotonicMs) {
+    const [state, code] = await raceSignal(this.result.promise, signal, deadlineMonotonicMs);
+    const left = Buffer.from(state);
+    const right = Buffer.from(expectedState);
+    const leftHash = createHash("sha256").update(left).digest();
+    const rightHash = createHash("sha256").update(right).digest();
+    if (left.byteLength !== right.byteLength || !timingSafeEqual(leftHash, rightHash)) {
+      throw new OAuthOperationError();
+    }
+    return boundedString(code);
+  }
+  async close() {
+    for (const socket of this.sockets) socket.destroy();
+    if (!this.server.listening) return;
+    await new Promise((resolve) => this.server.close(() => resolve()));
+  }
+};
+var LoopbackCallbackFactory = class {
+  open(signal, deadlineMonotonicMs) {
+    throwIfAborted(signal);
+    const remaining = deadlineMonotonicMs - performance.now();
+    if (remaining <= 0) return Promise.reject(timeoutError());
+    return new Promise((resolve, reject) => {
+      let callback;
+      const sockets = /* @__PURE__ */ new Set();
+      const server = createServer((request, response) => {
+        if (request.method !== "GET" || request.url === void 0 || request.url.length > 8192) {
+          response.writeHead(400).end();
+          callback?.accept("");
+          return;
+        }
+        let validPath = false;
+        try {
+          validPath = new URL(request.url, "http://127.0.0.1").pathname === "/oauth/callback";
+        } catch {
+        }
+        const accepted = validPath && callback !== void 0 && callback.accept(request.url);
+        response.writeHead(accepted ? 200 : 400, { "content-length": "0", connection: "close" }).end();
+      });
+      server.on("connection", (socket) => {
+        sockets.add(socket);
+        socket.once("close", () => sockets.delete(socket));
+      });
+      let settled = false;
+      const cleanup = () => {
+        clearTimeout(timeout);
+        signal.removeEventListener("abort", onAbort);
+      };
+      const fail = (error) => {
+        if (settled) return;
+        settled = true;
+        cleanup();
+        try {
+          server.close();
+        } catch {
+        }
+        reject(error);
+      };
+      const onAbort = () => fail(abortError());
+      const timeout = setTimeout(() => fail(timeoutError()), remaining);
+      signal.addEventListener("abort", onAbort, { once: true });
+      server.once("error", () => fail(new OAuthOperationError()));
+      server.listen(0, "127.0.0.1", () => {
+        if (settled) {
+          for (const socket of sockets) socket.destroy();
+          server.close();
+          return;
+        }
+        const address = server.address();
+        if (address === null || typeof address === "string") {
+          fail(new OAuthOperationError());
+          return;
+        }
+        settled = true;
+        cleanup();
+        callback = new LoopbackCallback(server, address.port, sockets);
+        resolve(callback);
+      });
+    });
+  }
+};
+var SystemBrowser = class {
+  async open(url, signal, deadlineMonotonicMs) {
+    throwIfAborted(signal);
+    const remaining = deadlineMonotonicMs - performance.now();
+    if (remaining <= 0) throw timeoutError();
+    await new Promise((resolve, reject) => {
+      const child = spawn("/usr/bin/open", [url], { stdio: "ignore", shell: false });
+      let failure;
+      let grace;
+      const terminate = (error) => {
+        failure ??= error;
+        if (child.exitCode !== null || child.signalCode !== null) return;
+        child.kill("SIGTERM");
+        grace ??= setTimeout(() => {
+          if (child.exitCode === null && child.signalCode === null) child.kill("SIGKILL");
+        }, 250);
+      };
+      const onAbort = () => terminate(abortError());
+      signal.addEventListener("abort", onAbort, { once: true });
+      const timeout = setTimeout(() => terminate(timeoutError()), remaining);
+      child.once("error", () => terminate(new OAuthOperationError()));
+      child.once("close", (code) => {
+        clearTimeout(timeout);
+        if (grace !== void 0) clearTimeout(grace);
+        signal.removeEventListener("abort", onAbort);
+        if (failure !== void 0) reject(failure);
+        else if (code === 0) resolve();
+        else reject(new OAuthOperationError());
+      });
+    });
+  }
+};
+async function raceSignal(operation, signal, deadlineMonotonicMs, nowMonotonic = () => performance.now()) {
+  throwIfAborted(signal);
+  let remaining;
+  if (deadlineMonotonicMs !== void 0) {
+    remaining = deadlineMonotonicMs - nowMonotonic();
+    if (remaining <= 0) throw timeoutError();
+  }
+  const cancellation = Promise.withResolvers();
+  const onAbort = () => cancellation.reject(abortError());
+  signal.addEventListener("abort", onAbort, { once: true });
+  let timer;
+  const candidates = [operation, cancellation.promise];
+  if (remaining !== void 0) {
+    const timeout = new Promise((_, reject) => {
+      timer = setTimeout(() => reject(timeoutError()), remaining);
+    });
+    candidates.push(timeout);
+  }
+  try {
+    return await Promise.race(candidates);
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+    signal.removeEventListener("abort", onAbort);
+  }
+}
+function base64Url(value) {
+  return Buffer.from(value).toString("base64url");
+}
+var GoogleOAuthClient = class _GoogleOAuthClient {
+  options;
+  dependencies;
+  metrics;
+  trace;
+  slots = /* @__PURE__ */ new Map();
+  slotsGate = new Mutex();
+  constructor(options) {
+    this.options = validatedOptions(options);
+    this.metrics = options.metricsSink ?? NOOP_METRICS;
+    this.trace = options.traceSink ?? NOOP_TRACE;
+    this.dependencies = {
+      http: new NodeOAuthTransport(),
+      callbackFactory: new LoopbackCallbackFactory(),
+      browser: new SystemBrowser(),
+      clock: systemClock,
+      randomBytes: (count) => randomBytes(count)
+    };
+  }
+  /** @internal Source-relative tests only. */
+  static _create(options, dependencies) {
+    const client = Object.create(_GoogleOAuthClient.prototype);
+    Object.defineProperty(client, "options", { value: validatedOptions(options) });
+    Object.defineProperty(client, "dependencies", { value: dependencies });
+    Object.defineProperty(client, "metrics", { value: options.metricsSink ?? NOOP_METRICS });
+    Object.defineProperty(client, "trace", { value: options.traceSink ?? NOOP_TRACE });
+    Object.defineProperty(client, "slots", { value: /* @__PURE__ */ new Map() });
+    Object.defineProperty(client, "slotsGate", { value: new Mutex() });
+    return client;
+  }
+  async connect(principalId, signal) {
+    principalId = validateOAuthPrincipal(principalId);
+    throwIfAborted(signal);
+    const clientId = this.requiredClientId();
+    const slot = await this.acquireSlot(principalId);
+    try {
+      let operation;
+      while (operation === void 0) {
+        let pendingDisconnect;
+        await slot.gate.run(() => {
+          if (slot.disconnect !== void 0) {
+            pendingDisconnect = slot.disconnect;
+            return;
+          }
+          slot.generation += 1;
+          slot.blocked = true;
+          const previous = [];
+          if (slot.connect !== void 0) {
+            slot.connect.controller.abort(abortError());
+            previous.push(slot.connect.promise);
+          }
+          if (slot.refresh !== void 0) {
+            slot.refresh.controller.abort(abortError());
+            previous.push(slot.refresh.promise);
+          }
+          const controller = new AbortController();
+          const generation = slot.generation;
+          const promise = (async () => {
+            await Promise.allSettled(previous);
+            throwIfAborted(controller.signal);
+            await slot.gate.run(() => {
+              if (slot.generation !== generation || slot.connect?.generation !== generation || slot.connect.controller !== controller) {
+                throw authRequired("gmail_grant_missing");
+              }
+            });
+            await this.runConnect(principalId, slot, generation, clientId, controller.signal);
+            await slot.gate.run(() => {
+              if (slot.generation !== generation || slot.connect?.generation !== generation || slot.connect.controller !== controller) {
+                throw authRequired("gmail_grant_missing");
+              }
+              slot.blocked = false;
+            });
+          })();
+          operation = { generation, controller, promise };
+          slot.connect = operation;
+        });
+        if (pendingDisconnect !== void 0) await raceSignal(pendingDisconnect, signal);
+      }
+      try {
+        await raceSignal(operation.promise, signal);
+      } catch (error) {
+        operation.controller.abort(abortError());
+        await Promise.allSettled([operation.promise]);
+        throw error;
+      } finally {
+        await slot.gate.run(() => {
+          if (slot.connect === operation) delete slot.connect;
+        });
+      }
+    } finally {
+      await this.releaseSlot(principalId, slot);
+    }
+  }
+  async accessToken(context) {
+    const started = this.dependencies.clock.nowMonotonic();
+    const span = startSpan(this.trace, "kaji.integration.auth", {
+      "integration.name": "gmail",
+      "integration.operation": "token",
+      "http.status_family": "none"
+    });
+    let outcome = "error";
+    try {
+      const token = await this.accessTokenInternal(context);
+      outcome = "success";
+      return token;
+    } catch (error) {
+      if (error instanceof DOMException && error.name === "AbortError") outcome = "cancelled";
+      span.recordError(error);
+      throw error;
+    } finally {
+      recordMetric(
+        this.metrics,
+        "kaji.integration.auth_ms",
+        Math.max(0, this.dependencies.clock.nowMonotonic() - started),
+        { integration: "gmail", operation: "token", outcome }
+      );
+      span.end();
+    }
+  }
+  async accessTokenInternal(context) {
+    const principalId = validateOAuthPrincipal(context.principalId);
+    throwIfAborted(context.signal);
+    this.checkDeadline(context.deadlineMonotonicMs);
+    const slot = await this.acquireSlot(principalId);
+    try {
+      if (slot.blocked) throw authRequired("gmail_grant_missing");
+      const generation = await slot.gate.run(() => {
+        if (slot.blocked) throw authRequired("gmail_grant_missing");
+        return slot.generation;
+      });
+      const loaded = await raceSignal(
+        this.options.storage.load(principalId, context.signal),
+        context.signal,
+        context.deadlineMonotonicMs,
+        () => this.dependencies.clock.nowMonotonic()
+      );
+      if (loaded === void 0) throw authRequired("gmail_grant_missing");
+      const record = snapshotOAuthCredentialRecord(loaded);
+      if (record.state === "revocation_pending") throw authRequired("gmail_grant_missing");
+      if (!isSuperset(record.tokens.grantedScopes, this.options.scopes)) {
+        this.checkDeadline(context.deadlineMonotonicMs);
+        await this.deleteIfCurrent(principalId, slot, generation, context.signal);
+        throw authRequired("gmail_scope_drift");
+      }
+      if (record.tokens.expiresAtEpochMs > this.dependencies.clock.nowWallSeconds() * 1e3 + REFRESH_BUFFER_MS) {
+        return slot.gate.run(() => {
+          this.checkDeadline(context.deadlineMonotonicMs);
+          if (slot.blocked || slot.generation !== generation) {
+            throw authRequired("gmail_grant_missing");
+          }
+          return record.tokens.accessToken;
+        });
+      }
+      return await this.joinRefresh(principalId, slot, generation, record, context);
+    } finally {
+      await this.releaseSlot(principalId, slot);
+    }
+  }
+  async disconnect(principalId, signal, options = {}) {
+    principalId = validateOAuthPrincipal(principalId);
+    throwIfAborted(signal);
+    const slot = await this.acquireSlot(principalId);
+    const completion = Promise.withResolvers();
+    let previousDisconnect;
+    await slot.gate.run(() => {
+      previousDisconnect = slot.disconnect;
+      slot.disconnect = completion.promise;
+    });
+    try {
+      if (previousDisconnect !== void 0) await raceSignal(previousDisconnect, signal);
+      let generation = 0;
+      let operations = [];
+      await slot.gate.run(() => {
+        slot.generation += 1;
+        generation = slot.generation;
+        slot.blocked = true;
+        if (slot.connect !== void 0) {
+          slot.connect.controller.abort(abortError());
+          operations.push(slot.connect.promise);
+        }
+        if (slot.refresh !== void 0) {
+          slot.refresh.controller.abort(abortError());
+          operations.push(slot.refresh.promise);
+        }
+      });
+      await Promise.allSettled(operations);
+      const loaded = await this.options.storage.load(principalId, signal);
+      if (loaded === void 0)
+        return Object.freeze({ localState: "missing", remoteRevoked: false });
+      const record = snapshotOAuthCredentialRecord(loaded);
+      if (options.forceLocal === true) {
+        await this.deleteBlockedIfCurrent(principalId, slot, generation, signal);
+        return Object.freeze({ localState: "deleted", remoteRevoked: false });
+      }
+      const pending = snapshotOAuthCredentialRecord({ ...record, state: "revocation_pending" });
+      const cleanup = new AbortController();
+      let response;
+      try {
+        response = await this.dependencies.http.postForm(
+          GOOGLE_REVOKE_URL,
+          { token: record.tokens.refreshToken },
+          signal,
+          this.dependencies.clock.nowMonotonic() + OPERATION_MS
+        );
+      } catch {
+        await this.saveIfCurrent(principalId, slot, generation, pending, cleanup.signal);
+        if (signal.aborted) throw abortError();
+        return Object.freeze({ localState: "revocation_pending", remoteRevoked: false });
+      }
+      if (response.status === 200) {
+        try {
+          await this.deleteBlockedIfCurrent(principalId, slot, generation, cleanup.signal);
+        } catch {
+          await this.saveIfCurrent(principalId, slot, generation, pending, cleanup.signal);
+          return Object.freeze({ localState: "revocation_pending", remoteRevoked: true });
+        }
+        return Object.freeze({ localState: "deleted", remoteRevoked: true });
+      }
+      await this.saveIfCurrent(principalId, slot, generation, pending, cleanup.signal);
+      return Object.freeze({ localState: "revocation_pending", remoteRevoked: false });
+    } finally {
+      completion.resolve();
+      await slot.gate.run(() => {
+        if (slot.disconnect === completion.promise) delete slot.disconnect;
+      });
+      await this.releaseSlot(principalId, slot);
+    }
+  }
+  requiredClientId() {
+    if (this.options.clientId === void 0 || this.options.clientId.length === 0) {
+      throw authRequired("gmail_grant_missing");
+    }
+    return this.options.clientId;
+  }
+  checkDeadline(deadline) {
+    if (deadline !== void 0 && deadline <= this.dependencies.clock.nowMonotonic()) {
+      throw timeoutError();
+    }
+  }
+  async runConnect(principalId, slot, generation, clientId, signal) {
+    const callbackDeadline = this.dependencies.clock.nowMonotonic() + CALLBACK_MS;
+    const callback = await this.dependencies.callbackFactory.open(signal, callbackDeadline);
+    try {
+      const state = base64Url(this.dependencies.randomBytes(32));
+      const verifier = base64Url(this.dependencies.randomBytes(64));
+      if (verifier.length < 43 || verifier.length > 128) throw new OAuthOperationError();
+      const challenge = createHash("sha256").update(verifier, "ascii").digest("base64url");
+      const authorization = new URL(GOOGLE_AUTH_URL);
+      authorization.search = new URLSearchParams({
+        client_id: clientId,
+        redirect_uri: callback.redirectUri,
+        response_type: "code",
+        scope: this.options.scopes.join(" "),
+        state,
+        access_type: "offline",
+        prompt: "consent",
+        code_challenge: challenge,
+        code_challenge_method: "S256"
+      }).toString();
+      await this.dependencies.browser.open(authorization.href, signal, callbackDeadline);
+      const code = boundedString(await callback.waitForCode(state, signal, callbackDeadline));
+      const form = {
+        code,
+        code_verifier: verifier,
+        client_id: clientId,
+        redirect_uri: callback.redirectUri,
+        grant_type: "authorization_code"
+      };
+      if (this.options.clientSecret !== void 0) form.client_secret = this.options.clientSecret;
+      const response = await this.dependencies.http.postForm(
+        GOOGLE_TOKEN_URL,
+        form,
+        signal,
+        this.dependencies.clock.nowMonotonic() + OPERATION_MS
+      );
+      if (response.status !== 200) throw new OAuthOperationError();
+      const tokens = this.tokensFromResponse(response.bytes, void 0, true);
+      await this.saveIfCurrent(
+        principalId,
+        slot,
+        generation,
+        snapshotOAuthCredentialRecord({ schemaVersion: 1, state: "active", tokens }),
+        signal,
+        true
+      );
+    } catch (error) {
+      if (error instanceof DOMException || error instanceof IntegrationExecutionError) throw error;
+      throw new OAuthOperationError();
+    } finally {
+      await callback.close();
+    }
+  }
+  async joinRefresh(principalId, slot, generation, record, context) {
+    let flight;
+    await slot.gate.run(() => {
+      if (slot.blocked || slot.generation !== generation) throw authRequired("gmail_grant_missing");
+      if (slot.refresh === void 0 || slot.refresh.generation !== generation) {
+        const controller = new AbortController();
+        const identity = {};
+        const deadline = this.dependencies.clock.nowMonotonic() + OPERATION_MS;
+        const promise = this.runRefreshWithDeadline(
+          () => this.runRefresh(principalId, slot, generation, record, controller.signal, deadline),
+          controller
+        ).finally(async () => {
+          await slot.gate.run(() => {
+            if (slot.refresh?.identity === identity) delete slot.refresh;
+          });
+        });
+        slot.refresh = { identity, generation, controller, promise, waiters: 0 };
+      }
+      flight = slot.refresh;
+      flight.waiters += 1;
+    });
+    try {
+      return await raceSignal(
+        flight.promise,
+        context.signal,
+        context.deadlineMonotonicMs,
+        () => this.dependencies.clock.nowMonotonic()
+      );
+    } finally {
+      let abort = false;
+      await slot.gate.run(() => {
+        flight.waiters -= 1;
+        abort = flight.waiters === 0 && slot.refresh?.identity === flight.identity;
+      });
+      if (abort) {
+        flight.controller.abort(abortError());
+        await Promise.allSettled([flight.promise]);
+      }
+    }
+  }
+  async runRefresh(principalId, slot, generation, record, signal, deadlineMonotonicMs) {
+    const form = {
+      refresh_token: record.tokens.refreshToken,
+      client_id: this.requiredClientId(),
+      grant_type: "refresh_token"
+    };
+    if (this.options.clientSecret !== void 0) form.client_secret = this.options.clientSecret;
+    const response = await this.dependencies.http.postForm(
+      GOOGLE_TOKEN_URL,
+      form,
+      signal,
+      deadlineMonotonicMs
+    );
+    if (response.status !== 200) {
+      if (providerErrorCode(response.bytes) === "invalid_grant") {
+        await this.deleteIfCurrent(principalId, slot, generation, signal);
+        throw authRequired("gmail_grant_missing");
+      }
+      throw new IntegrationExecutionError("api_rejected");
+    }
+    let tokens;
+    try {
+      tokens = this.tokensFromResponse(response.bytes, record.tokens, false);
+    } catch (error) {
+      if (!(error instanceof OAuthScopeDriftError)) throw error;
+      await this.deleteIfCurrent(principalId, slot, generation, signal);
+      throw authRequired("gmail_scope_drift");
+    }
+    await this.saveIfCurrent(
+      principalId,
+      slot,
+      generation,
+      snapshotOAuthCredentialRecord({ schemaVersion: 1, state: "active", tokens }),
+      signal
+    );
+    return tokens.accessToken;
+  }
+  async runRefreshWithDeadline(start, controller) {
+    const operation = start();
+    let timedOut = false;
+    let timer;
+    const timeout = new Promise((_, reject) => {
+      timer = setTimeout(() => {
+        timedOut = true;
+        controller.abort(abortError());
+        reject(timeoutError());
+      }, OPERATION_MS);
+    });
+    try {
+      return await Promise.race([operation, timeout]);
+    } catch (error) {
+      if (!timedOut) throw error;
+      await Promise.allSettled([operation]);
+      throw timeoutError();
+    } finally {
+      if (timer !== void 0) clearTimeout(timer);
+    }
+  }
+  tokensFromResponse(bytes, fallback, requireScope) {
+    const value = parseProviderJson(bytes);
+    if (value.token_type !== "Bearer") throw new OAuthOperationError();
+    const expires = value.expires_in;
+    if (typeof expires !== "number" || !Number.isFinite(expires) || expires <= 0 || expires > 604800) {
+      throw new OAuthOperationError();
+    }
+    const refreshToken = value.refresh_token === void 0 && fallback !== void 0 ? fallback.refreshToken : boundedString(value.refresh_token);
+    let grantedScopes;
+    if (value.scope === void 0) {
+      if (requireScope || fallback === void 0) throw new OAuthOperationError();
+      grantedScopes = fallback.grantedScopes;
+    } else {
+      if (typeof value.scope !== "string") throw new OAuthOperationError();
+      grantedScopes = normalizedScopes(value.scope.split(/\s+/).filter(Boolean), true);
+      if (!isSuperset(grantedScopes, this.options.scopes)) {
+        if (fallback !== void 0) throw new OAuthScopeDriftError();
+        throw new OAuthOperationError();
+      }
+    }
+    return Object.freeze({
+      accessToken: boundedString(value.access_token),
+      refreshToken,
+      expiresAtEpochMs: Math.floor(
+        this.dependencies.clock.nowWallSeconds() * 1e3 + expires * 1e3
+      ),
+      grantedScopes,
+      tokenType: "Bearer"
+    });
+  }
+  async saveIfCurrent(principalId, slot, generation, record, signal, allowBlockedActive = false) {
+    await slot.gate.run(() => {
+      if (slot.generation !== generation || slot.blocked && record.state === "active" && !allowBlockedActive) {
+        throw authRequired("gmail_grant_missing");
+      }
+      return this.options.storage.save(principalId, record, signal);
+    });
+  }
+  async deleteIfCurrent(principalId, slot, generation, signal) {
+    await slot.gate.run(() => {
+      if (slot.generation !== generation || slot.blocked) throw authRequired("gmail_grant_missing");
+      return this.options.storage.delete(principalId, signal);
+    });
+  }
+  async deleteBlockedIfCurrent(principalId, slot, generation, signal) {
+    await slot.gate.run(() => {
+      if (slot.generation !== generation || !slot.blocked) {
+        throw authRequired("gmail_grant_missing");
+      }
+      return this.options.storage.delete(principalId, signal);
+    });
+  }
+  async acquireSlot(principalId) {
+    return this.slotsGate.run(() => {
+      let slot = this.slots.get(principalId);
+      if (slot === void 0) {
+        slot = { gate: new Mutex(), generation: 0, blocked: false, references: 0 };
+        this.slots.set(principalId, slot);
+      }
+      slot.references += 1;
+      return slot;
+    });
+  }
+  async releaseSlot(principalId, slot) {
+    await this.slotsGate.run(() => {
+      slot.references -= 1;
+      if (slot.references === 0 && slot.connect === void 0 && slot.refresh === void 0 && slot.disconnect === void 0 && this.slots.get(principalId) === slot) {
+        this.slots.delete(principalId);
+      }
+    });
+  }
+};
+function isSuperset(candidate, required) {
+  const values = new Set(candidate);
+  return required.every((scope) => values.has(scope));
+}
+function validatedOptions(options) {
+  if (options === null || typeof options !== "object" || typeof options.storage !== "object") {
+    throw policyError();
+  }
+  const scopes = normalizedScopes(options.scopes);
+  const clientId = options.clientId === void 0 || options.clientId === "" ? void 0 : boundedString(options.clientId, 4096);
+  const clientSecret = options.clientSecret === void 0 ? void 0 : boundedString(options.clientSecret);
+  return Object.freeze({
+    ...clientId === void 0 ? {} : { clientId },
+    ...clientSecret === void 0 ? {} : { clientSecret },
+    scopes,
+    storage: options.storage
+  });
+}
+var SECURITY = "/usr/bin/security";
+var INTEGRATION_NAME = /^[a-z][a-z0-9_-]*$/;
+var MAX_INTEGRATION_NAME_LENGTH = 128;
+var TIMEOUT_MS = 1e4;
+var MAX_STDOUT_BYTES = 16 * 1024 + 1;
+var MAX_STDERR_BYTES = 8 * 1024;
+var TERM_GRACE_MS = 250;
+var ProcessFailure = class extends Error {
+  constructor(kind) {
+    super("Keychain process failed");
+    this.kind = kind;
+  }
+  kind;
+};
+var SpawnKeychainProcess = class {
+  constructor(spawnChild = spawn) {
+    this.spawnChild = spawnChild;
+  }
+  spawnChild;
+  run(args, options) {
+    if (options.signal.aborted) return Promise.reject(new ProcessFailure("cancelled"));
+    return new Promise((resolve, reject) => {
+      let child;
+      try {
+        child = this.spawnChild(SECURITY, args, {
+          shell: false,
+          stdio: ["pipe", "pipe", "pipe"]
+        });
+      } catch {
+        reject(new ProcessFailure("failed"));
+        return;
+      }
+      const stdout = [];
+      let stdoutBytes = 0;
+      let stderrBytes = 0;
+      let failure;
+      let grace;
+      const terminate = (next) => {
+        if (failure === void 0) failure = next;
+        if (child.exitCode !== null || child.signalCode !== null) return;
+        child.kill("SIGTERM");
+        grace ??= setTimeout(() => {
+          if (child.exitCode === null && child.signalCode === null) child.kill("SIGKILL");
+        }, TERM_GRACE_MS);
+      };
+      child.stdout.on("data", (chunk) => {
+        stdoutBytes += chunk.byteLength;
+        if (stdoutBytes > options.maxStdoutBytes) terminate(new ProcessFailure("overflow"));
+        else stdout.push(chunk);
+      });
+      child.stderr.on("data", (chunk) => {
+        stderrBytes += chunk.byteLength;
+        if (stderrBytes > MAX_STDERR_BYTES) terminate(new ProcessFailure("overflow"));
+      });
+      const onAbort = () => terminate(new ProcessFailure("cancelled"));
+      options.signal.addEventListener("abort", onAbort, { once: true });
+      const timeout = setTimeout(() => terminate(new ProcessFailure("timeout")), options.timeoutMs);
+      child.once("error", () => terminate(new ProcessFailure("failed")));
+      child.once("close", (code) => {
+        clearTimeout(timeout);
+        if (grace !== void 0) clearTimeout(grace);
+        options.signal.removeEventListener("abort", onAbort);
+        if (failure !== void 0) {
+          reject(failure);
+          return;
+        }
+        try {
+          resolve({
+            code: code ?? 1,
+            stdout: new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(stdout))
+          });
+        } catch {
+          reject(new ProcessFailure("overflow"));
+        }
+      });
+      child.stdin.once("error", () => terminate(new ProcessFailure("failed")));
+      child.stdin.end(options.stdin);
+    });
+  }
+};
+function executable() {
+  try {
+    accessSync(SECURITY, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function serviceFor(integrationName) {
+  if (typeof integrationName !== "string" || integrationName.length > MAX_INTEGRATION_NAME_LENGTH || !INTEGRATION_NAME.test(integrationName)) {
+    throw new IntegrationPolicyError();
+  }
+  return `dev.kaji.oauth.${integrationName}`;
+}
+function accountFor(service, principalId) {
+  principalId = validateOAuthPrincipal(principalId);
+  return createHash("sha256").update(`${service}\0${principalId}`, "utf8").digest("hex");
+}
+var MacOSKeychainTokenStorage = class _MacOSKeychainTokenStorage {
+  process;
+  platform;
+  executable;
+  service;
+  constructor(integrationName = "gmail") {
+    this.service = serviceFor(integrationName);
+    this.process = new SpawnKeychainProcess();
+    this.platform = platform();
+    this.executable = executable();
+  }
+  /** @internal Source-relative tests only. */
+  static _create(options) {
+    const service = serviceFor(options.integrationName ?? "gmail");
+    const storage = Object.create(_MacOSKeychainTokenStorage.prototype);
+    Object.defineProperties(storage, {
+      process: { value: options.process },
+      platform: { value: options.platform },
+      executable: { value: options.executable },
+      service: { value: service }
+    });
+    return storage;
+  }
+  async load(principalId, signal) {
+    const account = this.preflight(principalId);
+    const result = await this.run(
+      ["find-generic-password", "-a", account, "-s", this.service, "-w"],
+      { signal }
+    );
+    if (result.code === 44) return void 0;
+    if (result.code !== 0) throw new IntegrationAuthError("keychain_locked");
+    const output = result.stdout.endsWith("\n") ? result.stdout.slice(0, -1) : result.stdout;
+    try {
+      if (new TextEncoder().encode(output).byteLength > 16 * 1024) throw new Error();
+      return snapshotOAuthCredentialRecord(JSON.parse(output));
+    } catch {
+      throw new IntegrationAuthError("keychain_corrupt");
+    }
+  }
+  async save(principalId, record, signal) {
+    const account = this.preflight(principalId);
+    const stdin = canonicalOAuthCredentialJson(record);
+    const result = await this.run(
+      ["add-generic-password", "-a", account, "-s", this.service, "-U", "-w"],
+      { signal, stdin }
+    );
+    if (result.code !== 0) throw new IntegrationAuthError("keychain_locked");
+  }
+  async delete(principalId, signal) {
+    const account = this.preflight(principalId);
+    const result = await this.run(["delete-generic-password", "-a", account, "-s", this.service], {
+      signal
+    });
+    if (result.code !== 0 && result.code !== 44) {
+      throw new IntegrationAuthError("keychain_locked");
+    }
+  }
+  preflight(principalId) {
+    const account = accountFor(this.service, principalId);
+    if (this.platform !== "darwin" || !this.executable) {
+      throw new IntegrationAuthError("keychain_unsupported");
+    }
+    return account;
+  }
+  async run(args, options) {
+    try {
+      return await this.process.run(args, {
+        ...options,
+        timeoutMs: TIMEOUT_MS,
+        maxStdoutBytes: MAX_STDOUT_BYTES
+      });
+    } catch (error) {
+      if (error instanceof ProcessFailure && error.kind === "cancelled") {
+        throw new DOMException("Keychain operation cancelled", "AbortError");
+      }
+      if (error instanceof ProcessFailure && error.kind === "overflow") {
+        throw new IntegrationAuthError("keychain_corrupt");
+      }
+      throw new IntegrationAuthError("keychain_locked");
+    }
+  }
+};
+
+export { GoogleOAuthClient, MacOSKeychainTokenStorage, canonicalOAuthCredentialJson, snapshotOAuthCredentialRecord };
+//# sourceMappingURL=auth.js.map
+//# sourceMappingURL=auth.js.map