@jini-ai/agent-runtime 0.1.0

package/dist/providers/model-catalog.js

@@ -0,0 +1,394 @@
+/**
+ * @module providers/model-catalog
+ *
+ * Live model-catalog discovery for BYOK providers (OpenAI-compatible,
+ * Anthropic, Google, AIHubMix, SenseAudio, plus static seeds for Bedrock and
+ * an explicit "unsupported" response for Azure). Ported from OD's
+ * `integrations/provider-models.ts` (`listProviderModels`) with its
+ * upstream contracts-package type imports repointed at this package's own
+ * vendored `types.ts`, and its `../connectionTest.js` SSRF-guard /
+ * secret-redaction imports repointed at this package's own vendored
+ * `connection-guard.ts` (see that module's doc comment for what was and
+ * wasn't pulled from the 2,600-line origin file). Logic is otherwise
+ * unchanged — product-neutral as found (a bare BYOK-protocol model lister,
+ * no OD-branded strings).
+ */
+import { defaultDnsLookup, redactSecrets, validateBaseUrlResolved } from './connection-guard.js';
+import { aihubmixCatalogUrl, aihubmixHeaders, parseAIHubMixCatalog } from './aihubmix.js';
+import { googleProviderModelsUrl, normalizeGoogleModelId } from './google.js';
+const PROVIDER_MODELS_TIMEOUT_MS = 12_000;
+const BEDROCK_MODEL_OPTIONS = [
+    { id: 'anthropic.claude-3-5-sonnet-20241022-v2:0', label: 'Claude 3.5 Sonnet v2' },
+    { id: 'anthropic.claude-3-5-haiku-20241022-v1:0', label: 'Claude 3.5 Haiku' },
+    { id: 'anthropic.claude-3-haiku-20240307-v1:0', label: 'Claude 3 Haiku' },
+    { id: 'amazon.nova-pro-v1:0', label: 'Amazon Nova Pro' },
+    { id: 'amazon.nova-lite-v1:0', label: 'Amazon Nova Lite' },
+    { id: 'amazon.nova-micro-v1:0', label: 'Amazon Nova Micro' },
+];
+function appendVersionedApiPath(baseUrl, suffix) {
+    const url = new URL(baseUrl);
+    const pathname = url.pathname.replace(/\/+$/, '');
+    url.pathname = /\/v\d+(\/|$)/.test(pathname)
+        ? `${pathname}${suffix}`
+        : `${pathname}/v1${suffix}`;
+    return url.toString();
+}
+function statusToKind(status) {
+    if (status === 401)
+        return 'auth_failed';
+    if (status === 403)
+        return 'forbidden';
+    if (status === 404)
+        return 'invalid_base_url';
+    if (status === 429)
+        return 'rate_limited';
+    if (status >= 500)
+        return 'upstream_unavailable';
+    return 'unknown';
+}
+function extractProviderErrorDetail(data, rawText) {
+    const obj = data && typeof data === 'object' ? data : null;
+    const error = obj ? obj.error : null;
+    if (typeof error === 'string')
+        return error;
+    if (error && typeof error === 'object') {
+        const message = error.message;
+        if (typeof message === 'string' && message.trim())
+            return message;
+    }
+    const message = obj ? obj.message : null;
+    if (typeof message === 'string' && message.trim())
+        return message;
+    return rawText.trim().slice(0, 240);
+}
+function networkErrorToKind(err) {
+    if (err instanceof Error) {
+        if (err.name === 'AbortError')
+            return 'timeout';
+        const cause = err.cause;
+        const code = cause?.code;
+        if (code === 'ENOTFOUND' ||
+            code === 'EAI_AGAIN' ||
+            code === 'ECONNREFUSED' ||
+            code === 'ECONNRESET' ||
+            code === 'ETIMEDOUT' ||
+            code === 'EHOSTUNREACH' ||
+            code === 'ENETUNREACH' ||
+            code === 'CERT_HAS_EXPIRED' ||
+            code === 'UNABLE_TO_VERIFY_LEAF_SIGNATURE') {
+            return 'invalid_base_url';
+        }
+    }
+    return 'unknown';
+}
+function uniqueModels(models) {
+    const seen = new Set();
+    const out = [];
+    for (const model of models) {
+        const id = model.id.trim();
+        if (!id || seen.has(id))
+            continue;
+        seen.add(id);
+        out.push({ id, label: model.label.trim() || id });
+    }
+    return out.sort((a, b) => a.id.localeCompare(b.id));
+}
+function isOpenAiChatModelId(id) {
+    const normalized = id.trim().toLowerCase();
+    if (!normalized)
+        return false;
+    if (normalized.includes('embedding') ||
+        normalized.includes('moderation') ||
+        normalized.includes('rerank') ||
+        normalized.includes('whisper') ||
+        normalized.includes('tts') ||
+        normalized.includes('transcribe') ||
+        normalized.includes('speech') ||
+        normalized.includes('image') ||
+        normalized.includes('video') ||
+        normalized.includes('dall-e') ||
+        normalized.includes('stable-diffusion') ||
+        normalized.includes('flux') ||
+        (normalized.includes('wan') &&
+            /(?:^|[-_.:])(?:t2v|i2v|v2v)(?:[-_.:]|$)/u.test(normalized))) {
+        return false;
+    }
+    return !/(?:^|[-_.:])(?:t2i|i2i|t2v|i2v|v2v|tts|asr|ocr)(?:[-_.:]|$)/u.test(normalized);
+}
+function extractOpenAiModels(data) {
+    const items = data.data;
+    if (!Array.isArray(items))
+        return [];
+    return uniqueModels(items
+        .map((item) => item?.id)
+        .filter((id) => typeof id === 'string' && id.length > 0)
+        .filter(isOpenAiChatModelId)
+        .map((id) => ({ id, label: id })));
+}
+function extractAnthropicModels(data) {
+    const items = data.data;
+    if (!Array.isArray(items))
+        return [];
+    return uniqueModels(items
+        .map((item) => {
+        const obj = item && typeof item === 'object'
+            ? item
+            : null;
+        const id = typeof obj?.id === 'string' ? obj.id : '';
+        const label = typeof obj?.display_name === 'string'
+            ? obj.display_name
+            : typeof obj?.displayName === 'string'
+                ? obj.displayName
+                : id;
+        return id ? { id, label } : null;
+    })
+        .filter((item) => item != null));
+}
+function googleModelId(rawName, rawBaseModelId) {
+    if (typeof rawBaseModelId === 'string' && rawBaseModelId.trim()) {
+        return normalizeGoogleModelId(rawBaseModelId);
+    }
+    if (typeof rawName !== 'string')
+        return '';
+    return normalizeGoogleModelId(rawName);
+}
+function supportsGoogleGenerateContent(item) {
+    const methods = item
+        ?.supportedGenerationMethods
+        ?? item?.supported_actions;
+    return Array.isArray(methods) && methods.includes('generateContent');
+}
+function extractGoogleModels(data) {
+    const items = data.models;
+    if (!Array.isArray(items))
+        return [];
+    return uniqueModels(items
+        // supportsGoogleGenerateContent only returns true for an item whose
+        // (optionally-chained) supportedGenerationMethods/supported_actions
+        // resolves to an array — a non-object item can never satisfy that, so
+        // every item reaching .map() below is already known to be an object.
+        // No redundant `typeof item === 'object'` re-check here.
+        .filter(supportsGoogleGenerateContent)
+        .map((item) => {
+        const obj = item;
+        const id = googleModelId(obj.name, obj.baseModelId);
+        const label = typeof obj.displayName === 'string' && obj.displayName.trim()
+            ? obj.displayName
+            : id;
+        return id ? { id, label } : null;
+    })
+        .filter((item) => item != null));
+}
+function providerModelsUrl(protocol, baseUrl, apiKey) {
+    if (protocol === 'aihubmix') {
+        // AIHubMix exposes its chat catalogue on a dedicated endpoint
+        // (GET /api/v1/models?type=llm), not the OpenAI /v1/models route.
+        return aihubmixCatalogUrl(baseUrl, 'llm');
+    }
+    if (protocol === 'openai' || protocol === 'senseaudio') {
+        return appendVersionedApiPath(baseUrl, '/models');
+    }
+    if (protocol === 'anthropic') {
+        const url = new URL(appendVersionedApiPath(baseUrl, '/models'));
+        url.searchParams.set('limit', '1000');
+        return url.toString();
+    }
+    if (protocol === 'google') {
+        return googleProviderModelsUrl(baseUrl, apiKey);
+    }
+    throw new Error(`Unsupported protocol: ${protocol}`);
+}
+function providerModelsHeaders(protocol, apiKey) {
+    if (protocol === 'openai' || protocol === 'senseaudio') {
+        return { authorization: `Bearer ${apiKey}` };
+    }
+    if (protocol === 'aihubmix') {
+        // The catalogue is public — only attach Bearer auth (+ APP-Code) when the
+        // caller actually supplied a key. An empty `Bearer ` would be rejected by
+        // some gateways, so send no headers when the key is blank.
+        return apiKey.trim() ? aihubmixHeaders(apiKey) : {};
+    }
+    if (protocol === 'anthropic') {
+        return {
+            'x-api-key': apiKey,
+            'anthropic-version': '2023-06-01',
+        };
+    }
+    return {};
+}
+function extractModels(protocol, data) {
+    // SenseAudio's /v1/models response follows the OpenAI envelope
+    // (`{ data: [{ id, ... }] }`), so the same extractor handles both.
+    // Chat picker: drop media-generation rows. AIHubMix's `?type=llm` matches any
+    // model whose `types` merely contains `llm`, so dual-tagged image models
+    // (e.g. gpt-image-2 -> "image_generation,llm") would otherwise leak in. Those
+    // belong to the dedicated image/video/audio pickers.
+    if (protocol === 'aihubmix')
+        return parseAIHubMixCatalog(data, { chatOnly: true });
+    if (protocol === 'openai' || protocol === 'senseaudio')
+        return extractOpenAiModels(data);
+    if (protocol === 'anthropic')
+        return extractAnthropicModels(data);
+    return extractGoogleModels(data);
+}
+/**
+ * Fetches the live model catalog for a BYOK provider connection. Validates
+ * the base URL (sync + DNS-resolved SSRF guard) before issuing any request,
+ * dispatches per-protocol (a static seed for Bedrock, an explicit
+ * "unsupported" response for Azure), and normalizes every provider's
+ * response envelope into a de-duplicated, alphabetized `{ id, label }[]`.
+ */
+export async function listProviderModels(input) {
+    const start = Date.now();
+    if (input.protocol === 'azure') {
+        return {
+            ok: false,
+            kind: 'unsupported_protocol',
+            latencyMs: Date.now() - start,
+            detail: 'Azure OpenAI deployment discovery is not supported from the inference endpoint.',
+        };
+    }
+    const validated = await validateBaseUrlResolved(input.baseUrl, input.dnsLookup ?? defaultDnsLookup);
+    if (validated.error || !validated.parsed) {
+        return {
+            ok: false,
+            kind: validated.forbidden ? 'forbidden' : 'invalid_base_url',
+            latencyMs: Date.now() - start,
+            // Non-null assertion, not a runtime guard: every BaseUrlValidationResult
+            // this branch's guard condition can produce sets `error` alongside a
+            // missing `parsed` (connection-guard.ts never returns neither/both) —
+            // `?? ''` would satisfy the `detail: string` type too, but per this
+            // package's coverage-loop policy an assertion is more honest about
+            // "TS requires an `undefined` guard here that can't actually occur".
+            detail: validated.error,
+        };
+    }
+    if (input.protocol === 'bedrock') {
+        return {
+            ok: true,
+            kind: 'success',
+            latencyMs: Date.now() - start,
+            models: BEDROCK_MODEL_OPTIONS,
+            detail: 'AWS Bedrock uses a static seed until AWS credential-backed discovery is available.',
+        };
+    }
+    let url;
+    try {
+        url = providerModelsUrl(input.protocol, input.baseUrl, input.apiKey);
+    }
+    catch (err) {
+        return {
+            ok: false,
+            kind: 'unsupported_protocol',
+            latencyMs: Date.now() - start,
+            // `providerModelsUrl`'s only throw site is `throw new Error(...)`; the
+            // cast (rather than an `instanceof` guard) documents that the
+            // non-Error case can't occur here without adding an untestable branch.
+            detail: err.message,
+        };
+    }
+    const controller = new AbortController();
+    const abortFromParent = () => controller.abort();
+    if (input.signal?.aborted) {
+        controller.abort();
+    }
+    else {
+        input.signal?.addEventListener('abort', abortFromParent, { once: true });
+    }
+    const timer = setTimeout(() => controller.abort(), PROVIDER_MODELS_TIMEOUT_MS);
+    // `result` + a trailing `return result;` after the try/catch/finally,
+    // rather than returning directly from inside `catch` (every return inside
+    // `try` stays a direct early return): a v8/istanbul coverage-instrumentation
+    // artifact, re-derived empirically for this exact shape (a minimal
+    // `try { return A } catch { return B } finally {}` repro reproduces an
+    // uncoverable phantom branch at the `finally` clause's own opening brace,
+    // regardless of which/how many try/catch paths a test exercises — verified
+    // with `success`, `try-throws-then-caught`, and `throw-from-inside-catch`
+    // scenarios, all leaving the same phantom branch at 0). Only `catch`
+    // needed to change: with `try`'s own returns direct and only `catch`
+    // falling through, the phantom branch doesn't appear (also re-derived).
+    // TypeScript accepts `result` as definitely assigned at the trailing
+    // `return` because every real path through `try` above already returns or
+    // throws — the only way to fall through to it is via `catch`, which
+    // assigns unconditionally.
+    let result;
+    try {
+        const response = await fetch(url, {
+            method: 'GET',
+            headers: providerModelsHeaders(input.protocol, input.apiKey),
+            ...input.requestInit,
+            signal: controller.signal,
+            redirect: 'error',
+        });
+        const latencyMs = Date.now() - start;
+        const rawText = await response.text();
+        let data = {};
+        let parseError;
+        try {
+            data = rawText ? JSON.parse(rawText) : {};
+        }
+        catch (err) {
+            // JSON.parse only ever throws a SyntaxError (an Error); the cast
+            // documents that rather than adding an untestable non-Error branch.
+            parseError = err.message;
+        }
+        if (!response.ok) {
+            const detail = parseError
+                ? rawText.trim().slice(0, 240) || parseError
+                : extractProviderErrorDetail(data, rawText);
+            return {
+                ok: false,
+                kind: statusToKind(response.status),
+                latencyMs,
+                status: response.status,
+                detail: redactSecrets(detail, [input.apiKey]),
+            };
+        }
+        if (parseError) {
+            return {
+                ok: false,
+                kind: 'unknown',
+                latencyMs,
+                status: response.status,
+                detail: redactSecrets(parseError, [input.apiKey]),
+            };
+        }
+        // Safe: `url` above only resolves for the five protocols
+        // `ModelListProtocol` covers (providerModelsUrl throws for every other
+        // ConnectionTestProtocol, and azure/bedrock already returned above).
+        const models = extractModels(input.protocol, data);
+        if (models.length === 0) {
+            return {
+                ok: false,
+                kind: 'no_models',
+                latencyMs,
+                status: response.status,
+                detail: 'Provider returned no usable text-generation models.',
+            };
+        }
+        return {
+            ok: true,
+            kind: 'success',
+            latencyMs,
+            status: response.status,
+            models,
+        };
+    }
+    catch (err) {
+        const latencyMs = Date.now() - start;
+        const kind = networkErrorToKind(err);
+        const message = err instanceof Error ? err.message : String(err);
+        result = {
+            ok: false,
+            kind,
+            latencyMs,
+            detail: redactSecrets(message, [input.apiKey]),
+        };
+    }
+    finally {
+        clearTimeout(timer);
+        input.signal?.removeEventListener('abort', abortFromParent);
+    }
+    return result;
+}
+//# sourceMappingURL=model-catalog.js.map

package/dist/providers/model-catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-catalog.js","sourceRoot":"","sources":["../../src/providers/model-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AACjG,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAgB9E,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAC1C,MAAM,qBAAqB,GAA0B;IACnD,EAAE,EAAE,EAAE,2CAA2C,EAAE,KAAK,EAAE,sBAAsB,EAAE;IAClF,EAAE,EAAE,EAAE,0CAA0C,EAAE,KAAK,EAAE,kBAAkB,EAAE;IAC7E,EAAE,EAAE,EAAE,wCAAwC,EAAE,KAAK,EAAE,gBAAgB,EAAE;IACzE,EAAE,EAAE,EAAE,sBAAsB,EAAE,KAAK,EAAE,iBAAiB,EAAE;IACxD,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,kBAAkB,EAAE;IAC1D,EAAE,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,mBAAmB,EAAE;CAC7D,CAAC;AAEF,SAAS,sBAAsB,CAAC,OAAe,EAAE,MAAc;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClD,GAAG,CAAC,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC1C,CAAC,CAAC,GAAG,QAAQ,GAAG,MAAM,EAAE;QACxB,CAAC,CAAC,GAAG,QAAQ,MAAM,MAAM,EAAE,CAAC;IAC9B,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,aAAa,CAAC;IACzC,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,WAAW,CAAC;IACvC,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,kBAAkB,CAAC;IAC9C,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,cAAc,CAAC;IAC1C,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,sBAAsB,CAAC;IACjD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,0BAA0B,CAAC,IAAa,EAAE,OAAe;IAChE,MAAM,GAAG,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAE,GAA2B,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,OAAO,GAAI,KAA+B,CAAC,OAAO,CAAC;QACzD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE;YAAE,OAAO,OAAO,CAAC;IACpE,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAE,GAA6B,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,OAAO,CAAC;IAClE,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAY;IACtC,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;QACzB,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO,SAAS,CAAC;QAChD,MAAM,KAAK,GAAI,GAAqC,CAAC,KAAK,CAAC;QAC3D,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC;QACzB,IACE,IAAI,KAAK,WAAW;YACpB,IAAI,KAAK,WAAW;YACpB,IAAI,KAAK,cAAc;YACvB,IAAI,KAAK,YAAY;YACrB,IAAI,KAAK,WAAW;YACpB,IAAI,KAAK,cAAc;YACvB,IAAI,KAAK,aAAa;YACtB,IAAI,KAAK,kBAAkB;YAC3B,IAAI,KAAK,iCAAiC,EAC1C,CAAC;YACD,OAAO,kBAAkB,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,MAA6B;IACjD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAA0B,EAAE,CAAC;IACtC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAClC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,mBAAmB,CAAC,EAAU;IACrC,MAAM,UAAU,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,IACE,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;QAChC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC;QACjC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7B,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC9B,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC1B,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC;QACjC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7B,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC5B,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC5B,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7B,UAAU,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QACvC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC3B,CACE,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC1B,0CAA0C,CAAC,IAAI,CAAC,UAAU,CAAC,CAC5D,EACD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CAAC,8DAA8D,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAa;IACxC,MAAM,KAAK,GAAI,IAA2B,CAAC,IAAI,CAAC;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,YAAY,CACjB,KAAK;SACF,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAE,IAAyB,EAAE,EAAE,CAAC;SAC7C,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;SACrE,MAAM,CAAC,mBAAmB,CAAC;SAC3B,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CACpC,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAa;IAC3C,MAAM,KAAK,GAAI,IAA2B,CAAC,IAAI,CAAC;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,YAAY,CACjB,KAAK;SACF,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,GAAG,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAC1C,CAAC,CAAC,IAAuE;YACzE,CAAC,CAAC,IAAI,CAAC;QACT,MAAM,EAAE,GAAG,OAAO,GAAG,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,MAAM,KAAK,GACT,OAAO,GAAG,EAAE,YAAY,KAAK,QAAQ;YACnC,CAAC,CAAC,GAAG,CAAC,YAAY;YAClB,CAAC,CAAC,OAAO,GAAG,EAAE,WAAW,KAAK,QAAQ;gBACpC,CAAC,CAAC,GAAG,CAAC,WAAW;gBACjB,CAAC,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,IAAI,EAA+B,EAAE,CAAC,IAAI,IAAI,IAAI,CAAC,CAC/D,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,OAAgB,EAAE,cAAuB;IAC9D,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC;QAChE,OAAO,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC3C,OAAO,sBAAsB,CAAC,OAAO,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,6BAA6B,CAAC,IAAa;IAClD,MAAM,OAAO,GAAI,IAA8E;QAC7F,EAAE,0BAA0B;WACxB,IAAwC,EAAE,iBAAiB,CAAC;IAClE,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAa;IACxC,MAAM,KAAK,GAAI,IAA6B,CAAC,MAAM,CAAC;IACpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,YAAY,CACjB,KAAK;QACH,oEAAoE;QACpE,oEAAoE;QACpE,sEAAsE;QACtE,qEAAqE;QACrE,yDAAyD;SACxD,MAAM,CAAC,6BAA6B,CAAC;SACrC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,GAAG,GAAG,IAAwE,CAAC;QACrF,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE;YACzE,CAAC,CAAC,GAAG,CAAC,WAAW;YACjB,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,IAAI,EAA+B,EAAE,CAAC,IAAI,IAAI,IAAI,CAAC,CAC/D,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgC,EAAE,OAAe,EAAE,MAAc;IAC1F,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5B,8DAA8D;QAC9D,kEAAkE;QAClE,OAAO,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QACvD,OAAO,sBAAsB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QAChE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACtC,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,qBAAqB,CAC5B,QAAgC,EAChC,MAAc;IAEd,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QACvD,OAAO,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,CAAC;IAC/C,CAAC;IACD,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5B,0EAA0E;QAC1E,0EAA0E;QAC1E,2DAA2D;QAC3D,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC7B,OAAO;YACL,WAAW,EAAE,MAAM;YACnB,mBAAmB,EAAE,YAAY;SAClC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAWD,SAAS,aAAa,CAAC,QAA2B,EAAE,IAAa;IAC/D,+DAA+D;IAC/D,mEAAmE;IACnE,8EAA8E;IAC9E,yEAAyE;IACzE,8EAA8E;IAC9E,qDAAqD;IACrD,IAAI,QAAQ,KAAK,UAAU;QAAE,OAAO,oBAAoB,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACnF,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,YAAY;QAAE,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACzF,IAAI,QAAQ,KAAK,WAAW;QAAE,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAClE,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAA0B;IAE1B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,sBAAsB;YAC5B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC7B,MAAM,EAAE,iFAAiF;SAC1F,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,IAAI,gBAAgB,CAAC,CAAC;IACpG,IAAI,SAAS,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QACzC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,kBAAkB;YAC5D,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC7B,yEAAyE;YACzE,qEAAqE;YACrE,sEAAsE;YACtE,oEAAoE;YACpE,mEAAmE;YACnE,qEAAqE;YACrE,MAAM,EAAE,SAAS,CAAC,KAAM;SACzB,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,SAAS;YACf,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC7B,MAAM,EAAE,qBAAqB;YAC7B,MAAM,EAAE,oFAAoF;SAC7F,CAAC;IACJ,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,sBAAsB;YAC5B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC7B,uEAAuE;YACvE,8DAA8D;YAC9D,uEAAuE;YACvE,MAAM,EAAG,GAAa,CAAC,OAAO;SAC/B,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,eAAe,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IACjD,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QAC1B,UAAU,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,0BAA0B,CAAC,CAAC;IAE/E,sEAAsE;IACtE,0EAA0E;IAC1E,6EAA6E;IAC7E,mEAAmE;IACnE,uEAAuE;IACvE,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,qEAAqE;IACrE,qEAAqE;IACrE,wEAAwE;IACxE,qEAAqE;IACrE,0EAA0E;IAC1E,oEAAoE;IACpE,2BAA2B;IAC3B,IAAI,MAA8B,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,qBAAqB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;YAC5D,GAAG,KAAK,CAAC,WAAW;YACpB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,IAAI,GAAY,EAAE,CAAC;QACvB,IAAI,UAA8B,CAAC;QACnC,IAAI,CAAC;YACH,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,iEAAiE;YACjE,oEAAoE;YACpE,UAAU,GAAI,GAAa,CAAC,OAAO,CAAC;QACtC,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,UAAU;gBACvB,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,UAAU;gBAC5C,CAAC,CAAC,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACnC,SAAS;gBACT,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;aAC9C,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,SAAS;gBACf,SAAS;gBACT,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,MAAM,EAAE,aAAa,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;aAClD,CAAC;QACJ,CAAC;QAED,yDAAyD;QACzD,uEAAuE;QACvE,qEAAqE;QACrE,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,QAA6B,EAAE,IAAI,CAAC,CAAC;QACxE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,WAAW;gBACjB,SAAS;gBACT,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,MAAM,EAAE,qDAAqD;aAC9D,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,SAAS;YACf,SAAS;YACT,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,MAAM;SACP,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACrC,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,GAAG;YACP,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,SAAS;YACT,MAAM,EAAE,aAAa,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;SAC/C,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/providers/oauth-callback-server.d.ts

@@ -0,0 +1,35 @@
+export type OAuthCallbackOutcome = {
+    kind: 'ok';
+    code: string;
+    state: string;
+} | {
+    kind: 'error';
+    error: string;
+    state?: string;
+};
+export interface StartOAuthCallbackListenerInput {
+    host: string;
+    port: number;
+    path: string;
+    expectedState: string;
+    onCallback: (outcome: OAuthCallbackOutcome) => Promise<void> | void;
+    timeoutMs?: number;
+}
+export interface OAuthCallbackListener {
+    /** Where the listener is actually bound (informational, esp. for tests). */
+    readonly address: {
+        host: string;
+        port: number;
+    };
+    /** Stops the listener early (e.g. the user cancelled OAuth in the UI). */
+    stop(): Promise<void>;
+}
+/**
+ * Opens a one-shot HTTP listener for an OAuth redirect callback.
+ *
+ * Resolves once the listener is bound; callback handling is asynchronous
+ * via `onCallback`. The listener self-closes after the first matching
+ * callback OR after `timeoutMs` (default 30 min), whichever comes first.
+ */
+export declare function startOAuthCallbackListener(input: StartOAuthCallbackListenerInput): Promise<OAuthCallbackListener>;
+//# sourceMappingURL=oauth-callback-server.d.ts.map

package/dist/providers/oauth-callback-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-callback-server.d.ts","sourceRoot":"","sources":["../../src/providers/oauth-callback-server.ts"],"names":[],"mappings":"AAyBA,MAAM,MAAM,oBAAoB,GAC5B;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAErD,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,4EAA4E;IAC5E,QAAQ,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACjD,0EAA0E;IAC1E,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,+BAA+B,GACrC,OAAO,CAAC,qBAAqB,CAAC,CAyKhC"}

package/dist/providers/oauth-callback-server.js

@@ -0,0 +1,217 @@
+/**
+ * @module providers/oauth-callback-server
+ *
+ * One-shot HTTP listener for an OAuth PKCE redirect callback — opens a
+ * loopback listener, accepts a single `GET <path>?code=...&state=...`,
+ * validates `state` against the in-flight dance, invokes `onCallback`, then
+ * closes itself (or times out after a configurable window).
+ *
+ * Ported from OD's `integrations/xai-oauth-server.ts`, de-branded: the
+ * origin hardcoded xAI's fixed callback port/host/path as module constants
+ * and had the origin product's own name baked into the result-page HTML
+ * (see `source-map.md` for the exact original strings). Both are now
+ * caller-supplied — `host`/`port`/
+ * `path` are required input fields instead of defaulted constants (a
+ * provider whose OAuth client_id is locked to a specific redirect URI, like
+ * xAI's, supplies that provider's fixed port via
+ * `oauth-provider.ts`'s preset), and the result page uses generic "the host
+ * application" copy with no product name. Listener mechanics are otherwise
+ * unchanged.
+ */
+import http from 'node:http';
+const DEFAULT_TIMEOUT_MS = 30 * 60 * 1000; // 30 min
+/**
+ * Opens a one-shot HTTP listener for an OAuth redirect callback.
+ *
+ * Resolves once the listener is bound; callback handling is asynchronous
+ * via `onCallback`. The listener self-closes after the first matching
+ * callback OR after `timeoutMs` (default 30 min), whichever comes first.
+ */
+export async function startOAuthCallbackListener(input) {
+    const { host, port, path: callbackPath } = input;
+    const timeoutMs = input.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    let consumed = false;
+    let stopped = false;
+    let serverRef = null;
+    let timer = null;
+    const closeServer = () => new Promise((resolve) => {
+        // Non-null: `stop()` (this function's only caller) guards on `stopped`
+        // before ever reaching here, so this runs at most once — after
+        // `serverRef` was unconditionally set at listener-startup, before this
+        // closure's `stop`/`address` are ever handed to a caller.
+        const s = serverRef;
+        serverRef = null;
+        if (timer) {
+            clearTimeout(timer);
+            timer = null;
+        }
+        s.close(() => resolve());
+        // Force close after a short grace period so lingering keep-alive
+        // sockets don't keep the event loop alive in tests.
+        const reaper = setTimeout(() => {
+            try {
+                s.closeAllConnections?.();
+            }
+            catch {
+                // Best-effort cleanup only: node:http's closeAllConnections()
+                // doesn't document a throwing case in the supported Node range
+                // this package targets — this guard exists for a future/older
+                // runtime where it might, not a reachable path today.
+            }
+        }, 100);
+        reaper.unref?.();
+    });
+    const stop = async () => {
+        if (stopped)
+            return;
+        stopped = true;
+        await closeServer();
+    };
+    const handle = async (req, res) => {
+        if (consumed || !req.url) {
+            res.statusCode = 410;
+            res.setHeader('content-type', 'text/plain; charset=utf-8');
+            res.end('Listener already consumed.');
+            return;
+        }
+        let parsed;
+        try {
+            parsed = new URL(req.url, `http://${host}:${port}`);
+        }
+        catch {
+            res.statusCode = 400;
+            res.setHeader('content-type', 'text/plain; charset=utf-8');
+            res.end('Bad request.');
+            return;
+        }
+        // Ignore favicon.ico and any other path so the browser's incidental
+        // requests don't consume the slot meant for the callback path.
+        if (parsed.pathname !== callbackPath) {
+            res.statusCode = 404;
+            res.setHeader('content-type', 'text/plain; charset=utf-8');
+            res.end('Not found.');
+            return;
+        }
+        const code = parsed.searchParams.get('code') ?? '';
+        const state = parsed.searchParams.get('state') ?? '';
+        const errorParam = parsed.searchParams.get('error') ?? '';
+        let outcome;
+        if (errorParam) {
+            outcome = state
+                ? { kind: 'error', error: errorParam, state }
+                : { kind: 'error', error: errorParam };
+        }
+        else if (!code || !state) {
+            outcome = { kind: 'error', error: 'missing code or state' };
+        }
+        else if (state !== input.expectedState) {
+            outcome = { kind: 'error', error: 'state mismatch', state };
+        }
+        else {
+            outcome = { kind: 'ok', code, state };
+        }
+        // Decide whether this hit *consumes* the listener. A stray browser tab
+        // replaying an old `?state=...` (or `?error=...&state=...`) would
+        // otherwise close a shared fixed-port listener before the real redirect
+        // can arrive. Keep the listener open on stale/malformed requests; the
+        // real callback will still find it. Consume on:
+        //   - ok callback (matched state, code present)
+        //   - explicit ?error= without a state (the server rejected before
+        //     issuing state, so there's nothing to match against — safe to
+        //     consume)
+        //   - explicit ?error= with state matching expectedState (the server
+        //     told the user the dance failed; propagate now instead of waiting
+        //     for the timeout)
+        // An ?error= with a *mismatched* state is treated like the stale
+        // success replay above: 400 the browser, leave the listener live.
+        const errorConsumes = Boolean(errorParam) && (!state || state === input.expectedState);
+        const consumesListener = outcome.kind === 'ok' || errorConsumes;
+        if (consumesListener) {
+            consumed = true;
+        }
+        res.statusCode = outcome.kind === 'ok' ? 200 : 400;
+        res.setHeader('content-type', 'text/html; charset=utf-8');
+        res.end(renderResultPage(outcome));
+        if (!consumesListener) {
+            // Stale-tab replay or malformed request — don't surface to the
+            // caller and don't tear down the listener. The browser sees the
+            // 400 page; the real flow can still complete on a later hit.
+            return;
+        }
+        try {
+            await input.onCallback(outcome);
+        }
+        catch (err) {
+            console.error('[oauth-callback-server] onCallback failed:', err);
+        }
+        finally {
+            void stop();
+        }
+    };
+    const server = http.createServer((req, res) => {
+        void handle(req, res);
+    });
+    await new Promise((resolve, reject) => {
+        const onError = (err) => {
+            if (err.code === 'EADDRINUSE') {
+                reject(new Error(`Port ${port} is already in use — close any other process listening on ${host}:${port} (e.g. an in-flight OAuth flow) and try again`));
+            }
+            else {
+                reject(err);
+            }
+        };
+        server.once('error', onError);
+        server.listen(port, host, () => {
+            server.removeListener('error', onError);
+            resolve();
+        });
+    });
+    serverRef = server;
+    timer = setTimeout(() => {
+        Promise.resolve(input.onCallback({
+            kind: 'error',
+            error: 'OAuth timed out — sign in again',
+        })).catch(() => {
+            // already logging in handle(); this branch is best-effort cleanup.
+        });
+        void stop();
+    }, timeoutMs);
+    // unref so the timer doesn't keep the event loop alive in tests.
+    timer.unref?.();
+    const addr = server.address();
+    return {
+        address: { host: addr.address, port: addr.port },
+        stop,
+    };
+}
+function renderResultPage(outcome) {
+    if (outcome.kind === 'ok') {
+        return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><title>Authorized</title></head>
+<body style="font:14px system-ui;padding:40px;max-width:480px;margin:auto;text-align:center;color:#222;">
+  <h1 style="font-size:18px;margin:0 0 12px;">Authorized!</h1>
+  <p style="color:#666;">The host application now has access. You can close this tab and return to it.</p>
+</body></html>`;
+    }
+    // No `|| 'unknown error'` fallback: every 'error'-kind outcome this file
+    // constructs (state/code validation, state mismatch, timeout) always sets
+    // a non-empty `error` string, so the field is never falsy in practice —
+    // this documents that instead of adding an unreachable fallback branch.
+    const reason = escapeHtml(outcome.error);
+    return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><title>Sign-in failed</title></head>
+<body style="font:14px system-ui;padding:40px;max-width:480px;margin:auto;text-align:center;color:#222;">
+  <h1 style="font-size:18px;margin:0 0 12px;">Sign-in failed</h1>
+  <p style="color:#c00;">${reason}</p>
+  <p style="color:#666;">Close this tab and retry sign-in from the host application.</p>
+</body></html>`;
+}
+function escapeHtml(s) {
+    return s
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+//# sourceMappingURL=oauth-callback-server.js.map