@mcp-z/client 1.0.0

package/dist/cjs/auth/interactive-oauth-flow.d.cts

@@ -0,0 +1,58 @@
+/**
+ * OAuth Authorization Flow Handler
+ * Manages browser-based OAuth flows and token exchange with PKCE support
+ */
+import type { OAuthFlowOptions, TokenSet } from './types.js';
+/**
+ * InteractiveOAuthFlow manages the complete OAuth authorization code flow
+ */
+export declare class InteractiveOAuthFlow {
+    /**
+     * Perform OAuth authorization code flow
+     *
+     * @param authorizationEndpoint - OAuth authorization endpoint URL
+     * @param tokenEndpoint - OAuth token endpoint URL
+     * @param clientId - OAuth client ID
+     * @param clientSecret - OAuth client secret
+     * @param options - Flow options (port is required - use get-port to find available port)
+     * @returns Token set with access and refresh tokens
+     *
+     * @throws Error if flow fails or times out
+     *
+     * @example
+     * import getPort from 'get-port';
+     *
+     * const flow = new InteractiveOAuthFlow();
+     * const port = await getPort();
+     * const tokens = await flow.performAuthFlow(
+     *   'https://example.com/oauth/authorize',
+     *   'https://example.com/oauth/token',
+     *   'client-id',
+     *   'client-secret',
+     *   { port, scopes: ['read', 'write'] }
+     * );
+     */
+    performAuthFlow(authorizationEndpoint: string, tokenEndpoint: string, clientId: string, clientSecret: string, options: OAuthFlowOptions): Promise<TokenSet>;
+    /**
+     * Exchange authorization code for access and refresh tokens
+     * @param codeVerifier - Optional PKCE code verifier (RFC 7636)
+     */
+    private exchangeCodeForTokens;
+    /**
+     * Refresh access token using refresh token
+     *
+     * @param tokenEndpoint - OAuth token endpoint URL
+     * @param refreshToken - Refresh token from previous token set
+     * @param clientId - OAuth client ID
+     * @param clientSecret - OAuth client secret
+     * @returns New token set with refreshed access token
+     *
+     * @throws Error if refresh fails
+     */
+    refreshTokens(tokenEndpoint: string, refreshToken: string, clientId: string, clientSecret: string): Promise<TokenSet>;
+    /**
+     * Open browser to authorization URL
+     * Uses platform-specific command to open default browser
+     */
+    private openBrowser;
+}

package/dist/cjs/auth/interactive-oauth-flow.d.ts

@@ -0,0 +1,58 @@
+/**
+ * OAuth Authorization Flow Handler
+ * Manages browser-based OAuth flows and token exchange with PKCE support
+ */
+import type { OAuthFlowOptions, TokenSet } from './types.js';
+/**
+ * InteractiveOAuthFlow manages the complete OAuth authorization code flow
+ */
+export declare class InteractiveOAuthFlow {
+    /**
+     * Perform OAuth authorization code flow
+     *
+     * @param authorizationEndpoint - OAuth authorization endpoint URL
+     * @param tokenEndpoint - OAuth token endpoint URL
+     * @param clientId - OAuth client ID
+     * @param clientSecret - OAuth client secret
+     * @param options - Flow options (port is required - use get-port to find available port)
+     * @returns Token set with access and refresh tokens
+     *
+     * @throws Error if flow fails or times out
+     *
+     * @example
+     * import getPort from 'get-port';
+     *
+     * const flow = new InteractiveOAuthFlow();
+     * const port = await getPort();
+     * const tokens = await flow.performAuthFlow(
+     *   'https://example.com/oauth/authorize',
+     *   'https://example.com/oauth/token',
+     *   'client-id',
+     *   'client-secret',
+     *   { port, scopes: ['read', 'write'] }
+     * );
+     */
+    performAuthFlow(authorizationEndpoint: string, tokenEndpoint: string, clientId: string, clientSecret: string, options: OAuthFlowOptions): Promise<TokenSet>;
+    /**
+     * Exchange authorization code for access and refresh tokens
+     * @param codeVerifier - Optional PKCE code verifier (RFC 7636)
+     */
+    private exchangeCodeForTokens;
+    /**
+     * Refresh access token using refresh token
+     *
+     * @param tokenEndpoint - OAuth token endpoint URL
+     * @param refreshToken - Refresh token from previous token set
+     * @param clientId - OAuth client ID
+     * @param clientSecret - OAuth client secret
+     * @returns New token set with refreshed access token
+     *
+     * @throws Error if refresh fails
+     */
+    refreshTokens(tokenEndpoint: string, refreshToken: string, clientId: string, clientSecret: string): Promise<TokenSet>;
+    /**
+     * Open browser to authorization URL
+     * Uses platform-specific command to open default browser
+     */
+    private openBrowser;
+}

package/dist/cjs/auth/interactive-oauth-flow.js

@@ -0,0 +1,537 @@
+/**
+ * OAuth Authorization Flow Handler
+ * Manages browser-based OAuth flows and token exchange with PKCE support
+ */ "use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "InteractiveOAuthFlow", {
+    enumerable: true,
+    get: function() {
+        return InteractiveOAuthFlow;
+    }
+});
+var _nodechild_process = /*#__PURE__*/ _interop_require_wildcard(require("node:child_process"));
+var _loggerts = require("../utils/logger.js");
+var _oauthcallbacklistenerts = require("./oauth-callback-listener.js");
+var _pkcets = require("./pkce.js");
+function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
+    }
+}
+function _async_to_generator(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _class_call_check(instance, Constructor) {
+    if (!(instance instanceof Constructor)) {
+        throw new TypeError("Cannot call a class as a function");
+    }
+}
+function _instanceof(left, right) {
+    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
+        return !!right[Symbol.hasInstance](left);
+    } else {
+        return left instanceof right;
+    }
+}
+function _getRequireWildcardCache(nodeInterop) {
+    if (typeof WeakMap !== "function") return null;
+    var cacheBabelInterop = new WeakMap();
+    var cacheNodeInterop = new WeakMap();
+    return (_getRequireWildcardCache = function(nodeInterop) {
+        return nodeInterop ? cacheNodeInterop : cacheBabelInterop;
+    })(nodeInterop);
+}
+function _interop_require_wildcard(obj, nodeInterop) {
+    if (!nodeInterop && obj && obj.__esModule) {
+        return obj;
+    }
+    if (obj === null || typeof obj !== "object" && typeof obj !== "function") {
+        return {
+            default: obj
+        };
+    }
+    var cache = _getRequireWildcardCache(nodeInterop);
+    if (cache && cache.has(obj)) {
+        return cache.get(obj);
+    }
+    var newObj = {
+        __proto__: null
+    };
+    var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor;
+    for(var key in obj){
+        if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) {
+            var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null;
+            if (desc && (desc.get || desc.set)) {
+                Object.defineProperty(newObj, key, desc);
+            } else {
+                newObj[key] = obj[key];
+            }
+        }
+    }
+    newObj.default = obj;
+    if (cache) {
+        cache.set(obj, newObj);
+    }
+    return newObj;
+}
+function _ts_generator(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
+        }
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+var InteractiveOAuthFlow = /*#__PURE__*/ function() {
+    "use strict";
+    function InteractiveOAuthFlow() {
+        _class_call_check(this, InteractiveOAuthFlow);
+    }
+    var _proto = InteractiveOAuthFlow.prototype;
+    /**
+   * Perform OAuth authorization code flow
+   *
+   * @param authorizationEndpoint - OAuth authorization endpoint URL
+   * @param tokenEndpoint - OAuth token endpoint URL
+   * @param clientId - OAuth client ID
+   * @param clientSecret - OAuth client secret
+   * @param options - Flow options (port is required - use get-port to find available port)
+   * @returns Token set with access and refresh tokens
+   *
+   * @throws Error if flow fails or times out
+   *
+   * @example
+   * import getPort from 'get-port';
+   *
+   * const flow = new InteractiveOAuthFlow();
+   * const port = await getPort();
+   * const tokens = await flow.performAuthFlow(
+   *   'https://example.com/oauth/authorize',
+   *   'https://example.com/oauth/token',
+   *   'client-id',
+   *   'client-secret',
+   *   { port, scopes: ['read', 'write'] }
+   * );
+   */ _proto.performAuthFlow = function performAuthFlow(authorizationEndpoint, tokenEndpoint, clientId, clientSecret, options) {
+        return _async_to_generator(function() {
+            var _options_logger, logger, callbackListener, pkce, redirectUri, authUrl, timeout, result, tokens, error;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        logger = (_options_logger = options.logger) !== null && _options_logger !== void 0 ? _options_logger : _loggerts.logger;
+                        callbackListener = new _oauthcallbacklistenerts.OAuthCallbackListener({
+                            port: options.port,
+                            logger: logger
+                        });
+                        if (!options.pkce) return [
+                            3,
+                            2
+                        ];
+                        logger.debug('🔐 Generating PKCE parameters...');
+                        return [
+                            4,
+                            (0, _pkcets.generatePkce)()
+                        ];
+                    case 1:
+                        pkce = _state.sent();
+                        _state.label = 2;
+                    case 2:
+                        _state.trys.push([
+                            2,
+                            9,
+                            10,
+                            12
+                        ]);
+                        // Start callback server
+                        return [
+                            4,
+                            callbackListener.start()
+                        ];
+                    case 3:
+                        _state.sent();
+                        // Build redirect URI
+                        redirectUri = options.redirectUri || "http://localhost:".concat(options.port, "/callback");
+                        // Build authorization URL
+                        authUrl = new URL(authorizationEndpoint);
+                        authUrl.searchParams.set('client_id', clientId);
+                        authUrl.searchParams.set('redirect_uri', redirectUri);
+                        authUrl.searchParams.set('response_type', 'code');
+                        if (options.scopes && options.scopes.length > 0) {
+                            authUrl.searchParams.set('scope', options.scopes.join(' '));
+                        }
+                        // Add resource parameter if specified (RFC 8707)
+                        if (options.resource) {
+                            authUrl.searchParams.set('resource', options.resource);
+                        }
+                        // Add PKCE parameters if generated (RFC 7636)
+                        if (pkce) {
+                            authUrl.searchParams.set('code_challenge', pkce.codeChallenge);
+                            authUrl.searchParams.set('code_challenge_method', pkce.codeChallengeMethod);
+                        }
+                        if (!options.headless) return [
+                            3,
+                            4
+                        ];
+                        logger.info('🔗 Please visit this URL to authorize:');
+                        logger.info(authUrl.toString());
+                        logger.info('Waiting for callback...');
+                        return [
+                            3,
+                            6
+                        ];
+                    case 4:
+                        logger.debug('🌐 Opening browser for OAuth authorization...');
+                        // Try to open browser (requires 'open' package or native command)
+                        return [
+                            4,
+                            this.openBrowser(authUrl.toString())
+                        ];
+                    case 5:
+                        _state.sent();
+                        _state.label = 6;
+                    case 6:
+                        // Wait for callback with timeout
+                        timeout = options.timeout || (options.headless ? 60000 : 300000);
+                        return [
+                            4,
+                            callbackListener.waitForCallback(timeout)
+                        ];
+                    case 7:
+                        result = _state.sent();
+                        return [
+                            4,
+                            this.exchangeCodeForTokens(tokenEndpoint, result.code, clientId, clientSecret, redirectUri, pkce === null || pkce === void 0 ? void 0 : pkce.codeVerifier)
+                        ];
+                    case 8:
+                        tokens = _state.sent();
+                        return [
+                            2,
+                            tokens
+                        ];
+                    case 9:
+                        error = _state.sent();
+                        logger.error('❌ OAuth flow failed:', _instanceof(error, Error) ? error.message : String(error));
+                        throw error;
+                    case 10:
+                        // Always close callback server
+                        return [
+                            4,
+                            callbackListener.stop()
+                        ];
+                    case 11:
+                        _state.sent();
+                        return [
+                            7
+                        ];
+                    case 12:
+                        return [
+                            2
+                        ];
+                }
+            });
+        }).call(this);
+    };
+    /**
+   * Exchange authorization code for access and refresh tokens
+   * @param codeVerifier - Optional PKCE code verifier (RFC 7636)
+   */ _proto.exchangeCodeForTokens = function exchangeCodeForTokens(tokenEndpoint, code, clientId, clientSecret, redirectUri, codeVerifier) {
+        return _async_to_generator(function() {
+            var params, response, errorText, data, tokenSet;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        params = new URLSearchParams({
+                            grant_type: 'authorization_code',
+                            code: code,
+                            redirect_uri: redirectUri,
+                            client_id: clientId,
+                            client_secret: clientSecret
+                        });
+                        // Add PKCE code verifier if provided (RFC 7636)
+                        if (codeVerifier) {
+                            params.set('code_verifier', codeVerifier);
+                        }
+                        return [
+                            4,
+                            fetch(tokenEndpoint, {
+                                method: 'POST',
+                                headers: {
+                                    'Content-Type': 'application/x-www-form-urlencoded',
+                                    Accept: 'application/json',
+                                    Connection: 'close'
+                                },
+                                body: params
+                            })
+                        ];
+                    case 1:
+                        response = _state.sent();
+                        if (!!response.ok) return [
+                            3,
+                            3
+                        ];
+                        return [
+                            4,
+                            response.text()
+                        ];
+                    case 2:
+                        errorText = _state.sent();
+                        throw new Error("Token exchange failed (".concat(response.status, "): ").concat(errorText));
+                    case 3:
+                        return [
+                            4,
+                            response.json()
+                        ];
+                    case 4:
+                        data = _state.sent();
+                        if (!data.access_token) {
+                            throw new Error('Token response missing access_token');
+                        }
+                        tokenSet = {
+                            accessToken: data.access_token,
+                            refreshToken: data.refresh_token || '',
+                            expiresAt: Date.now() + data.expires_in * 1000,
+                            clientId: clientId,
+                            clientSecret: clientSecret
+                        };
+                        if (data.scope) {
+                            tokenSet.scopes = data.scope.split(' ');
+                        }
+                        return [
+                            2,
+                            tokenSet
+                        ];
+                }
+            });
+        })();
+    };
+    /**
+   * Refresh access token using refresh token
+   *
+   * @param tokenEndpoint - OAuth token endpoint URL
+   * @param refreshToken - Refresh token from previous token set
+   * @param clientId - OAuth client ID
+   * @param clientSecret - OAuth client secret
+   * @returns New token set with refreshed access token
+   *
+   * @throws Error if refresh fails
+   */ _proto.refreshTokens = function refreshTokens(tokenEndpoint, refreshToken, clientId, clientSecret) {
+        return _async_to_generator(function() {
+            var response, errorText, data, tokenSet;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        return [
+                            4,
+                            fetch(tokenEndpoint, {
+                                method: 'POST',
+                                headers: {
+                                    'Content-Type': 'application/x-www-form-urlencoded',
+                                    Accept: 'application/json',
+                                    Connection: 'close'
+                                },
+                                body: new URLSearchParams({
+                                    grant_type: 'refresh_token',
+                                    refresh_token: refreshToken,
+                                    client_id: clientId,
+                                    client_secret: clientSecret
+                                })
+                            })
+                        ];
+                    case 1:
+                        response = _state.sent();
+                        if (!!response.ok) return [
+                            3,
+                            3
+                        ];
+                        return [
+                            4,
+                            response.text()
+                        ];
+                    case 2:
+                        errorText = _state.sent();
+                        throw new Error("Token refresh failed (".concat(response.status, "): ").concat(errorText));
+                    case 3:
+                        return [
+                            4,
+                            response.json()
+                        ];
+                    case 4:
+                        data = _state.sent();
+                        if (!data.access_token) {
+                            throw new Error('Token refresh response missing access_token');
+                        }
+                        tokenSet = {
+                            accessToken: data.access_token,
+                            refreshToken: data.refresh_token || refreshToken,
+                            expiresAt: Date.now() + data.expires_in * 1000,
+                            clientId: clientId,
+                            clientSecret: clientSecret
+                        };
+                        if (data.scope) {
+                            tokenSet.scopes = data.scope.split(' ');
+                        }
+                        return [
+                            2,
+                            tokenSet
+                        ];
+                }
+            });
+        })();
+    };
+    /**
+   * Open browser to authorization URL
+   * Uses platform-specific command to open default browser
+   */ _proto.openBrowser = function openBrowser(url) {
+        return _async_to_generator(function() {
+            var platform, command, args, child;
+            return _ts_generator(this, function(_state) {
+                // Determine platform-specific command
+                platform = process.platform;
+                if (platform === 'darwin') {
+                    command = 'open';
+                    args = [
+                        url
+                    ];
+                } else if (platform === 'win32') {
+                    command = 'cmd';
+                    args = [
+                        '/c',
+                        'start',
+                        url
+                    ];
+                } else {
+                    // Linux and others
+                    command = 'xdg-open';
+                    args = [
+                        url
+                    ];
+                }
+                // Spawn browser process
+                child = _nodechild_process.spawn(command, args, {
+                    detached: true,
+                    stdio: 'ignore'
+                });
+                child.unref();
+                return [
+                    2
+                ];
+            });
+        })();
+    };
+    return InteractiveOAuthFlow;
+}();
+/* CJS INTEROP */ if (exports.__esModule && exports.default) { try { Object.defineProperty(exports.default, '__esModule', { value: true }); for (var key in exports) { exports.default[key] = exports[key]; } } catch (_) {}; module.exports = exports.default; }

package/dist/cjs/auth/interactive-oauth-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/Users/kevin/Dev/Projects/ai/mcp-z/libs/client/src/auth/interactive-oauth-flow.ts"],"sourcesContent":["/**\n * OAuth Authorization Flow Handler\n * Manages browser-based OAuth flows and token exchange with PKCE support\n */\n\nimport * as child_process from 'node:child_process';\nimport { logger as defaultLogger } from '../utils/logger.ts';\nimport { OAuthCallbackListener } from './oauth-callback-listener.ts';\nimport { generatePkce } from './pkce.ts';\nimport type { OAuthFlowOptions, PkceParams, TokenSet } from './types.ts';\n\n/**\n * OAuth token response from token endpoint\n */\ninterface TokenResponse {\n  access_token: string;\n  refresh_token?: string;\n  expires_in: number;\n  scope?: string;\n  token_type?: string;\n}\n\n/**\n * InteractiveOAuthFlow manages the complete OAuth authorization code flow\n */\nexport class InteractiveOAuthFlow {\n  /**\n   * Perform OAuth authorization code flow\n   *\n   * @param authorizationEndpoint - OAuth authorization endpoint URL\n   * @param tokenEndpoint - OAuth token endpoint URL\n   * @param clientId - OAuth client ID\n   * @param clientSecret - OAuth client secret\n   * @param options - Flow options (port is required - use get-port to find available port)\n   * @returns Token set with access and refresh tokens\n   *\n   * @throws Error if flow fails or times out\n   *\n   * @example\n   * import getPort from 'get-port';\n   *\n   * const flow = new InteractiveOAuthFlow();\n   * const port = await getPort();\n   * const tokens = await flow.performAuthFlow(\n   *   'https://example.com/oauth/authorize',\n   *   'https://example.com/oauth/token',\n   *   'client-id',\n   *   'client-secret',\n   *   { port, scopes: ['read', 'write'] }\n   * );\n   */\n  async performAuthFlow(authorizationEndpoint: string, tokenEndpoint: string, clientId: string, clientSecret: string, options: OAuthFlowOptions): Promise<TokenSet> {\n    const logger = options.logger ?? defaultLogger;\n    const callbackListener = new OAuthCallbackListener({ port: options.port, logger });\n\n    // Generate PKCE parameters if requested (RFC 7636)\n    let pkce: PkceParams | undefined;\n    if (options.pkce) {\n      logger.debug('🔐 Generating PKCE parameters...');\n      pkce = await generatePkce();\n    }\n\n    try {\n      // Start callback server\n      await callbackListener.start();\n\n      // Build redirect URI\n      const redirectUri = options.redirectUri || `http://localhost:${options.port}/callback`;\n\n      // Build authorization URL\n      const authUrl = new URL(authorizationEndpoint);\n      authUrl.searchParams.set('client_id', clientId);\n      authUrl.searchParams.set('redirect_uri', redirectUri);\n      authUrl.searchParams.set('response_type', 'code');\n\n      if (options.scopes && options.scopes.length > 0) {\n        authUrl.searchParams.set('scope', options.scopes.join(' '));\n      }\n\n      // Add resource parameter if specified (RFC 8707)\n      if (options.resource) {\n        authUrl.searchParams.set('resource', options.resource);\n      }\n\n      // Add PKCE parameters if generated (RFC 7636)\n      if (pkce) {\n        authUrl.searchParams.set('code_challenge', pkce.codeChallenge);\n        authUrl.searchParams.set('code_challenge_method', pkce.codeChallengeMethod);\n      }\n\n      // Open browser or print URL for headless mode\n      if (options.headless) {\n        logger.info('🔗 Please visit this URL to authorize:');\n        logger.info(authUrl.toString());\n        logger.info('Waiting for callback...');\n      } else {\n        logger.debug('🌐 Opening browser for OAuth authorization...');\n        // Try to open browser (requires 'open' package or native command)\n        await this.openBrowser(authUrl.toString());\n      }\n\n      // Wait for callback with timeout\n      const timeout = options.timeout || (options.headless ? 60000 : 300000);\n      const result = await callbackListener.waitForCallback(timeout);\n\n      // Exchange authorization code for tokens (with PKCE verifier if used)\n      const tokens = await this.exchangeCodeForTokens(tokenEndpoint, result.code, clientId, clientSecret, redirectUri, pkce?.codeVerifier);\n\n      return tokens;\n    } catch (error) {\n      logger.error('❌ OAuth flow failed:', error instanceof Error ? error.message : String(error));\n      throw error;\n    } finally {\n      // Always close callback server\n      await callbackListener.stop();\n    }\n  }\n\n  /**\n   * Exchange authorization code for access and refresh tokens\n   * @param codeVerifier - Optional PKCE code verifier (RFC 7636)\n   */\n  private async exchangeCodeForTokens(tokenEndpoint: string, code: string, clientId: string, clientSecret: string, redirectUri: string, codeVerifier?: string): Promise<TokenSet> {\n    const params = new URLSearchParams({\n      grant_type: 'authorization_code',\n      code,\n      redirect_uri: redirectUri,\n      client_id: clientId,\n      client_secret: clientSecret,\n    });\n\n    // Add PKCE code verifier if provided (RFC 7636)\n    if (codeVerifier) {\n      params.set('code_verifier', codeVerifier);\n    }\n\n    const response = await fetch(tokenEndpoint, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n        Accept: 'application/json',\n        Connection: 'close',\n      },\n      body: params,\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      throw new Error(`Token exchange failed (${response.status}): ${errorText}`);\n    }\n\n    const data = (await response.json()) as TokenResponse;\n\n    if (!data.access_token) {\n      throw new Error('Token response missing access_token');\n    }\n\n    const tokenSet: TokenSet = {\n      accessToken: data.access_token,\n      refreshToken: data.refresh_token || '',\n      expiresAt: Date.now() + data.expires_in * 1000,\n      clientId,\n      clientSecret,\n    };\n\n    if (data.scope) {\n      tokenSet.scopes = data.scope.split(' ');\n    }\n\n    return tokenSet;\n  }\n\n  /**\n   * Refresh access token using refresh token\n   *\n   * @param tokenEndpoint - OAuth token endpoint URL\n   * @param refreshToken - Refresh token from previous token set\n   * @param clientId - OAuth client ID\n   * @param clientSecret - OAuth client secret\n   * @returns New token set with refreshed access token\n   *\n   * @throws Error if refresh fails\n   */\n  async refreshTokens(tokenEndpoint: string, refreshToken: string, clientId: string, clientSecret: string): Promise<TokenSet> {\n    const response = await fetch(tokenEndpoint, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n        Accept: 'application/json',\n        Connection: 'close',\n      },\n      body: new URLSearchParams({\n        grant_type: 'refresh_token',\n        refresh_token: refreshToken,\n        client_id: clientId,\n        client_secret: clientSecret,\n      }),\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      throw new Error(`Token refresh failed (${response.status}): ${errorText}`);\n    }\n\n    const data = (await response.json()) as TokenResponse;\n\n    if (!data.access_token) {\n      throw new Error('Token refresh response missing access_token');\n    }\n\n    const tokenSet: TokenSet = {\n      accessToken: data.access_token,\n      refreshToken: data.refresh_token || refreshToken, // Reuse old refresh token if not provided\n      expiresAt: Date.now() + data.expires_in * 1000,\n      clientId,\n      clientSecret,\n    };\n\n    if (data.scope) {\n      tokenSet.scopes = data.scope.split(' ');\n    }\n\n    return tokenSet;\n  }\n\n  /**\n   * Open browser to authorization URL\n   * Uses platform-specific command to open default browser\n   */\n  private async openBrowser(url: string): Promise<void> {\n    // Determine platform-specific command\n    const platform = process.platform;\n    let command: string;\n    let args: string[];\n\n    if (platform === 'darwin') {\n      command = 'open';\n      args = [url];\n    } else if (platform === 'win32') {\n      command = 'cmd';\n      args = ['/c', 'start', url];\n    } else {\n      // Linux and others\n      command = 'xdg-open';\n      args = [url];\n    }\n\n    // Spawn browser process\n    const child = child_process.spawn(command, args, {\n      detached: true,\n      stdio: 'ignore',\n    });\n\n    child.unref();\n  }\n}\n"],"names":["InteractiveOAuthFlow","performAuthFlow","authorizationEndpoint","tokenEndpoint","clientId","clientSecret","options","logger","callbackListener","pkce","redirectUri","authUrl","timeout","result","tokens","error","defaultLogger","OAuthCallbackListener","port","debug","generatePkce","start","URL","searchParams","set","scopes","length","join","resource","codeChallenge","codeChallengeMethod","headless","info","toString","openBrowser","waitForCallback","exchangeCodeForTokens","code","codeVerifier","Error","message","String","stop","params","response","errorText","data","tokenSet","URLSearchParams","grant_type","redirect_uri","client_id","client_secret","fetch","method","headers","Accept","Connection","body","ok","text","status","json","access_token","accessToken","refreshToken","refresh_token","expiresAt","Date","now","expires_in","scope","split","refreshTokens","url","platform","command","args","child","process","child_process","spawn","detached","stdio","unref"],"mappings":"AAAA;;;CAGC;;;;+BAsBYA;;;eAAAA;;;yEApBkB;wBACS;uCACF;sBACT;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBtB,IAAA,AAAMA,qCAAN;;aAAMA;gCAAAA;;iBAAAA;IACX;;;;;;;;;;;;;;;;;;;;;;;;GAwBC,GACD,OAAMC,eAiEL,GAjED,SAAMA,gBAAgBC,qBAA6B,EAAEC,aAAqB,EAAEC,QAAgB,EAAEC,YAAoB,EAAEC,OAAyB;;gBAC5HA,iBAATC,QACAC,kBAGFC,MAWIC,aAGAC,SAgCAC,SACAC,QAGAC,QAGCC;;;;wBAzDHR,UAASD,kBAAAA,QAAQC,MAAM,cAAdD,6BAAAA,kBAAkBU,gBAAa;wBACxCR,mBAAmB,IAAIS,8CAAqB,CAAC;4BAAEC,MAAMZ,QAAQY,IAAI;4BAAEX,QAAAA;wBAAO;6BAI5ED,QAAQG,IAAI,EAAZH;;;;wBACFC,OAAOY,KAAK,CAAC;wBACN;;4BAAMC,IAAAA,oBAAY;;;wBAAzBX,OAAO;;;;;;;;;wBAIP,wBAAwB;wBACxB;;4BAAMD,iBAAiBa,KAAK;;;wBAA5B;wBAEA,qBAAqB;wBACfX,cAAcJ,QAAQI,WAAW,IAAI,AAAC,oBAAgC,OAAbJ,QAAQY,IAAI,EAAC;wBAE5E,0BAA0B;wBACpBP,UAAU,IAAIW,IAAIpB;wBACxBS,QAAQY,YAAY,CAACC,GAAG,CAAC,aAAapB;wBACtCO,QAAQY,YAAY,CAACC,GAAG,CAAC,gBAAgBd;wBACzCC,QAAQY,YAAY,CAACC,GAAG,CAAC,iBAAiB;wBAE1C,IAAIlB,QAAQmB,MAAM,IAAInB,QAAQmB,MAAM,CAACC,MAAM,GAAG,GAAG;4BAC/Cf,QAAQY,YAAY,CAACC,GAAG,CAAC,SAASlB,QAAQmB,MAAM,CAACE,IAAI,CAAC;wBACxD;wBAEA,iDAAiD;wBACjD,IAAIrB,QAAQsB,QAAQ,EAAE;4BACpBjB,QAAQY,YAAY,CAACC,GAAG,CAAC,YAAYlB,QAAQsB,QAAQ;wBACvD;wBAEA,8CAA8C;wBAC9C,IAAInB,MAAM;4BACRE,QAAQY,YAAY,CAACC,GAAG,CAAC,kBAAkBf,KAAKoB,aAAa;4BAC7DlB,QAAQY,YAAY,CAACC,GAAG,CAAC,yBAAyBf,KAAKqB,mBAAmB;wBAC5E;6BAGIxB,QAAQyB,QAAQ,EAAhBzB;;;;wBACFC,OAAOyB,IAAI,CAAC;wBACZzB,OAAOyB,IAAI,CAACrB,QAAQsB,QAAQ;wBAC5B1B,OAAOyB,IAAI,CAAC;;;;;;wBAEZzB,OAAOY,KAAK,CAAC;wBACb,kEAAkE;wBAClE;;4BAAM,IAAI,CAACe,WAAW,CAACvB,QAAQsB,QAAQ;;;wBAAvC;;;wBAGF,iCAAiC;wBAC3BrB,UAAUN,QAAQM,OAAO,IAAKN,CAAAA,QAAQyB,QAAQ,GAAG,QAAQ,MAAK;wBACrD;;4BAAMvB,iBAAiB2B,eAAe,CAACvB;;;wBAAhDC,SAAS;wBAGA;;4BAAM,IAAI,CAACuB,qBAAqB,CAACjC,eAAeU,OAAOwB,IAAI,EAAEjC,UAAUC,cAAcK,aAAaD,iBAAAA,2BAAAA,KAAM6B,YAAY;;;wBAA7HxB,SAAS;wBAEf;;4BAAOA;;;wBACAC;wBACPR,OAAOQ,KAAK,CAAC,wBAAwBA,AAAK,YAALA,OAAiBwB,SAAQxB,MAAMyB,OAAO,GAAGC,OAAO1B;wBACrF,MAAMA;;wBAEN,+BAA+B;wBAC/B;;4BAAMP,iBAAiBkC,IAAI;;;wBAA3B;;;;;;;;;;QAEJ;;IAEA;;;GAGC,GACD,OAAcN,qBAgDb,GAhDD,SAAcA,sBAAsBjC,aAAqB,EAAEkC,IAAY,EAAEjC,QAAgB,EAAEC,YAAoB,EAAEK,WAAmB,EAAE4B,YAAqB;;gBACnJK,QAaAC,UAWEC,WAIFC,MAMAC;;;;wBAlCAJ,SAAS,IAAIK,gBAAgB;4BACjCC,YAAY;4BACZZ,MAAAA;4BACAa,cAAcxC;4BACdyC,WAAW/C;4BACXgD,eAAe/C;wBACjB;wBAEA,gDAAgD;wBAChD,IAAIiC,cAAc;4BAChBK,OAAOnB,GAAG,CAAC,iBAAiBc;wBAC9B;wBAEiB;;4BAAMe,MAAMlD,eAAe;gCAC1CmD,QAAQ;gCACRC,SAAS;oCACP,gBAAgB;oCAChBC,QAAQ;oCACRC,YAAY;gCACd;gCACAC,MAAMf;4BACR;;;wBARMC,WAAW;6BAUb,CAACA,SAASe,EAAE,EAAZ;;;;wBACgB;;4BAAMf,SAASgB,IAAI;;;wBAA/Bf,YAAY;wBAClB,MAAM,IAAIN,MAAM,AAAC,0BAA8CM,OAArBD,SAASiB,MAAM,EAAC,OAAe,OAAVhB;;wBAGnD;;4BAAMD,SAASkB,IAAI;;;wBAA3BhB,OAAQ;wBAEd,IAAI,CAACA,KAAKiB,YAAY,EAAE;4BACtB,MAAM,IAAIxB,MAAM;wBAClB;wBAEMQ,WAAqB;4BACzBiB,aAAalB,KAAKiB,YAAY;4BAC9BE,cAAcnB,KAAKoB,aAAa,IAAI;4BACpCC,WAAWC,KAAKC,GAAG,KAAKvB,KAAKwB,UAAU,GAAG;4BAC1ClE,UAAAA;4BACAC,cAAAA;wBACF;wBAEA,IAAIyC,KAAKyB,KAAK,EAAE;4BACdxB,SAAStB,MAAM,GAAGqB,KAAKyB,KAAK,CAACC,KAAK,CAAC;wBACrC;wBAEA;;4BAAOzB;;;;QACT;;IAEA;;;;;;;;;;GAUC,GACD,OAAM0B,aAwCL,GAxCD,SAAMA,cAActE,aAAqB,EAAE8D,YAAoB,EAAE7D,QAAgB,EAAEC,YAAoB;;gBAC/FuC,UAgBEC,WAIFC,MAMAC;;;;wBA1BW;;4BAAMM,MAAMlD,eAAe;gCAC1CmD,QAAQ;gCACRC,SAAS;oCACP,gBAAgB;oCAChBC,QAAQ;oCACRC,YAAY;gCACd;gCACAC,MAAM,IAAIV,gBAAgB;oCACxBC,YAAY;oCACZiB,eAAeD;oCACfd,WAAW/C;oCACXgD,eAAe/C;gCACjB;4BACF;;;wBAbMuC,WAAW;6BAeb,CAACA,SAASe,EAAE,EAAZ;;;;wBACgB;;4BAAMf,SAASgB,IAAI;;;wBAA/Bf,YAAY;wBAClB,MAAM,IAAIN,MAAM,AAAC,yBAA6CM,OAArBD,SAASiB,MAAM,EAAC,OAAe,OAAVhB;;wBAGlD;;4BAAMD,SAASkB,IAAI;;;wBAA3BhB,OAAQ;wBAEd,IAAI,CAACA,KAAKiB,YAAY,EAAE;4BACtB,MAAM,IAAIxB,MAAM;wBAClB;wBAEMQ,WAAqB;4BACzBiB,aAAalB,KAAKiB,YAAY;4BAC9BE,cAAcnB,KAAKoB,aAAa,IAAID;4BACpCE,WAAWC,KAAKC,GAAG,KAAKvB,KAAKwB,UAAU,GAAG;4BAC1ClE,UAAAA;4BACAC,cAAAA;wBACF;wBAEA,IAAIyC,KAAKyB,KAAK,EAAE;4BACdxB,SAAStB,MAAM,GAAGqB,KAAKyB,KAAK,CAACC,KAAK,CAAC;wBACrC;wBAEA;;4BAAOzB;;;;QACT;;IAEA;;;GAGC,GACD,OAAcb,WAyBb,GAzBD,SAAcA,YAAYwC,GAAW;;gBAE7BC,UACFC,SACAC,MAeEC;;gBAlBN,sCAAsC;gBAChCH,WAAWI,QAAQJ,QAAQ;gBAIjC,IAAIA,aAAa,UAAU;oBACzBC,UAAU;oBACVC;wBAAQH;;gBACV,OAAO,IAAIC,aAAa,SAAS;oBAC/BC,UAAU;oBACVC;wBAAQ;wBAAM;wBAASH;;gBACzB,OAAO;oBACL,mBAAmB;oBACnBE,UAAU;oBACVC;wBAAQH;;gBACV;gBAEA,wBAAwB;gBAClBI,QAAQE,mBAAcC,KAAK,CAACL,SAASC,MAAM;oBAC/CK,UAAU;oBACVC,OAAO;gBACT;gBAEAL,MAAMM,KAAK;;;;;QACb;;WArOWpF"}