@moxxy/plugin-oauth 0.0.33

package/dist/oauth/device-flow-shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow-shared.d.ts","sourceRoot":"","sources":["../../src/oauth/device-flow-shared.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;GAIG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAAE;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAyD/B;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,GAAG,EAAE;IAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EACtD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,KAAK,EAAE;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAC5B,WAAW,CAAC,QAAQ,CAAC,CA8BvB"}

package/dist/oauth/device-flow-shared.js

@@ -0,0 +1,101 @@
+import { classifyHttpStatus, MoxxyError } from '@moxxy/sdk';
+import { parseTokenResponse } from './token-exchange.js';
+/**
+ * POST the RFC 8628 device-authorization request and parse the response. The
+ * single home for the request + field parsing + error handling shared by the
+ * legacy `runDeviceCodeFlow` and the `rfc8628DeviceFlow` adapter.
+ */
+export async function requestDeviceAuthorization(args) {
+    const body = new URLSearchParams();
+    body.set('client_id', args.clientId);
+    body.set('scope', args.scopes.join(' '));
+    const res = await fetch(args.deviceUrl, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' },
+        body: body.toString(),
+        ...(args.signal ? { signal: args.signal } : {}),
+    });
+    if (!res.ok) {
+        const text = await res.text().catch(() => '');
+        throw (classifyHttpStatus(res.status, { url: args.deviceUrl, body: text }) ??
+            new MoxxyError({
+                code: 'AUTH_INVALID',
+                message: `device-code request failed (HTTP ${res.status}): ${text.slice(0, 300)}`,
+                context: { status: res.status, url: args.deviceUrl },
+            }));
+    }
+    // A 200 with a non-JSON/truncated body (proxy/captive-portal error page)
+    // would make res.json() reject with a raw SyntaxError that escapes the
+    // MoxxyError boundary; convert it to a typed PROVIDER_UNKNOWN_RESPONSE.
+    const json = (await res.json().catch(() => {
+        throw new MoxxyError({
+            code: 'PROVIDER_UNKNOWN_RESPONSE',
+            message: 'device-authorization endpoint returned a non-JSON success body',
+            context: { url: args.deviceUrl },
+        });
+    }));
+    const deviceCode = typeof json.device_code === 'string' ? json.device_code : null;
+    const userCode = typeof json.user_code === 'string' ? json.user_code : null;
+    const verificationUri = typeof json.verification_uri === 'string'
+        ? json.verification_uri
+        : typeof json.verification_url === 'string'
+            ? json.verification_url
+            : null;
+    const verificationUriComplete = typeof json.verification_uri_complete === 'string' ? json.verification_uri_complete : undefined;
+    const expiresInSec = typeof json.expires_in === 'number' ? json.expires_in : 600;
+    const intervalSec = typeof json.interval === 'number' ? json.interval : 5;
+    if (!deviceCode || !userCode || !verificationUri) {
+        throw new MoxxyError({
+            code: 'PROVIDER_UNKNOWN_RESPONSE',
+            message: `device-code response missing required fields: ${JSON.stringify(json).slice(0, 200)}`,
+        });
+    }
+    return {
+        deviceCode,
+        userCode,
+        verificationUri,
+        ...(verificationUriComplete ? { verificationUriComplete } : {}),
+        expiresInSec,
+        intervalSec,
+    };
+}
+/**
+ * Classify a device-flow token-poll response per RFC 8628 §3.5: success →
+ * `done`; `authorization_pending` → keep waiting; `slow_down` → +5s and wait;
+ * `access_denied` / `expired_token` / other → throw a MoxxyError. Shared by both
+ * poll loops; each caller builds its own request body (the legacy flow appends
+ * client_id/client_secret) and hands the response + parsed JSON here.
+ */
+export function classifyDeviceTokenResponse(res, json, state) {
+    if (res.ok && typeof json.access_token === 'string') {
+        return { done: parseTokenResponse(json) };
+    }
+    const err = typeof json.error === 'string' ? json.error : `HTTP ${res.status}`;
+    if (err === 'authorization_pending')
+        return { pending: true };
+    if (err === 'slow_down') {
+        state.intervalMs += 5000;
+        return { pending: true };
+    }
+    if (err === 'access_denied') {
+        throw new MoxxyError({
+            code: 'OAUTH_FLOW_DENIED',
+            message: 'You declined the device authorization.',
+            hint: 'Re-run the login command and approve the consent screen on your browser device.',
+        });
+    }
+    if (err === 'expired_token') {
+        throw new MoxxyError({
+            code: 'OAUTH_FLOW_TIMEOUT',
+            message: 'The device code expired before you finished signing in.',
+            hint: 'Re-run the login command — a new code will be generated.',
+        });
+    }
+    const desc = typeof json.error_description === 'string' ? json.error_description : '';
+    throw new MoxxyError({
+        code: 'AUTH_INVALID',
+        message: `OAuth device flow failed: ${err}${desc ? ` — ${desc}` : ''}.`,
+        context: { provider_error: String(err), ...(desc ? { description: desc } : {}) },
+    });
+}
+//# sourceMappingURL=device-flow-shared.js.map

package/dist/oauth/device-flow-shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow-shared.js","sourceRoot":"","sources":["../../src/oauth/device-flow-shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAiBzD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,IAKhD;IACC,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE;QACtC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC5F,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;QACrB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,CACJ,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACnE,IAAI,UAAU,CAAC;gBACb,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,oCAAoC,GAAG,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;gBACjF,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE;aACrD,CAAC,CACH,CAAC;IACJ,CAAC;IACD,yEAAyE;IACzE,uEAAuE;IACvE,wEAAwE;IACxE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;QACxC,MAAM,IAAI,UAAU,CAAC;YACnB,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,gEAAgE;YACzE,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE;SACjC,CAAC,CAAC;IACL,CAAC,CAAC,CAA4B,CAAC;IAC/B,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IAClF,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,MAAM,eAAe,GACnB,OAAO,IAAI,CAAC,gBAAgB,KAAK,QAAQ;QACvC,CAAC,CAAC,IAAI,CAAC,gBAAgB;QACvB,CAAC,CAAC,OAAO,IAAI,CAAC,gBAAgB,KAAK,QAAQ;YACzC,CAAC,CAAC,IAAI,CAAC,gBAAgB;YACvB,CAAC,CAAC,IAAI,CAAC;IACb,MAAM,uBAAuB,GAC3B,OAAO,IAAI,CAAC,yBAAyB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC,SAAS,CAAC;IAClG,MAAM,YAAY,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC;IACjF,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,EAAE,CAAC;QACjD,MAAM,IAAI,UAAU,CAAC;YACnB,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,iDAAiD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SAC/F,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,UAAU;QACV,QAAQ;QACR,eAAe;QACf,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,YAAY;QACZ,WAAW;KACZ,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,GAAsD,EACtD,IAA6B,EAC7B,KAA6B;IAE7B,IAAI,GAAG,CAAC,EAAE,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;QACpD,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;IAC/E,IAAI,GAAG,KAAK,uBAAuB;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC9D,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;QACxB,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IACD,IAAI,GAAG,KAAK,eAAe,EAAE,CAAC;QAC5B,MAAM,IAAI,UAAU,CAAC;YACnB,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,wCAAwC;YACjD,IAAI,EAAE,iFAAiF;SACxF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,GAAG,KAAK,eAAe,EAAE,CAAC;QAC5B,MAAM,IAAI,UAAU,CAAC;YACnB,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,yDAAyD;YAClE,IAAI,EAAE,0DAA0D;SACjE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,MAAM,IAAI,UAAU,CAAC;QACnB,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,6BAA6B,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG;QACvE,OAAO,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;KACjF,CAAC,CAAC;AACL,CAAC"}

package/dist/oauth/device-flow.d.ts

@@ -0,0 +1,29 @@
+import type { DeviceFlowOptions, TokenSet } from './types.js';
+/**
+ * Run the RFC 8628 device-authorization flow. Suitable for headless
+ * environments (SSH session, CI, kiosk, no display): the user opens
+ * the verification URL on any device, types the short user_code,
+ * approves the scopes, and the local process discovers the grant by
+ * polling the token endpoint.
+ *
+ * Phases:
+ *   1. POST `client_id` + `scope` to deviceUrl → returns user_code,
+ *      verification_uri, device_code, expires_in, interval.
+ *   2. `onPrompt` fires once with the user-facing pieces — the caller
+ *      surfaces them in whatever UI it has.
+ *   3. Poll tokenUrl every `interval` seconds with
+ *      grant_type=urn:ietf:params:oauth:grant-type:device_code +
+ *      device_code. The provider replies:
+ *        - authorization_pending → keep polling.
+ *        - slow_down            → bump interval by 5s and keep polling.
+ *        - access_denied        → user clicked deny; throw.
+ *        - expired_token        → device_code expired; throw.
+ *        - access_token, ...    → success; return TokenSet.
+ *
+ * The device-authorization request + the poll-response classification are
+ * shared with the {@link rfc8628DeviceFlow} adapter via `device-flow-shared`.
+ * This flow additionally sends `client_id` (+ optional `client_secret`) on the
+ * poll, which is why it builds its own poll body.
+ */
+export declare function runDeviceCodeFlow(opts: DeviceFlowOptions): Promise<TokenSet>;
+//# sourceMappingURL=device-flow.d.ts.map

package/dist/oauth/device-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow.d.ts","sourceRoot":"","sources":["../../src/oauth/device-flow.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAU9D;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAuBlF"}

package/dist/oauth/device-flow.js

@@ -0,0 +1,74 @@
+import { pollUntil } from './poll-until.js';
+import { classifyDeviceTokenResponse, requestDeviceAuthorization } from './device-flow-shared.js';
+/**
+ * Small margin added to the provider's interval before the first/each poll, so
+ * a server that enforces the interval strictly doesn't answer edge polls with
+ * `slow_down`. Mirrors `run-login.ts`'s margin so both device-flow drivers
+ * behave identically.
+ */
+const DEVICE_POLL_SAFETY_MARGIN_MS = 3000;
+/**
+ * Run the RFC 8628 device-authorization flow. Suitable for headless
+ * environments (SSH session, CI, kiosk, no display): the user opens
+ * the verification URL on any device, types the short user_code,
+ * approves the scopes, and the local process discovers the grant by
+ * polling the token endpoint.
+ *
+ * Phases:
+ *   1. POST `client_id` + `scope` to deviceUrl → returns user_code,
+ *      verification_uri, device_code, expires_in, interval.
+ *   2. `onPrompt` fires once with the user-facing pieces — the caller
+ *      surfaces them in whatever UI it has.
+ *   3. Poll tokenUrl every `interval` seconds with
+ *      grant_type=urn:ietf:params:oauth:grant-type:device_code +
+ *      device_code. The provider replies:
+ *        - authorization_pending → keep polling.
+ *        - slow_down            → bump interval by 5s and keep polling.
+ *        - access_denied        → user clicked deny; throw.
+ *        - expired_token        → device_code expired; throw.
+ *        - access_token, ...    → success; return TokenSet.
+ *
+ * The device-authorization request + the poll-response classification are
+ * shared with the {@link rfc8628DeviceFlow} adapter via `device-flow-shared`.
+ * This flow additionally sends `client_id` (+ optional `client_secret`) on the
+ * poll, which is why it builds its own poll body.
+ */
+export async function runDeviceCodeFlow(opts) {
+    const auth = await requestDeviceAuthorization({
+        deviceUrl: opts.deviceUrl,
+        clientId: opts.clientId,
+        scopes: opts.scopes,
+        ...(opts.signal ? { signal: opts.signal } : {}),
+    });
+    opts.onPrompt({
+        userCode: auth.userCode,
+        verificationUri: auth.verificationUri,
+        ...(auth.verificationUriComplete ? { verificationUriComplete: auth.verificationUriComplete } : {}),
+        expiresIn: auth.expiresInSec,
+        interval: auth.intervalSec,
+    });
+    return pollUntil((state) => pollOnce(opts, auth.deviceCode, state), {
+        intervalMs: auth.intervalSec * 1000 + DEVICE_POLL_SAFETY_MARGIN_MS,
+        timeoutMs: Math.min(opts.timeoutMs ?? auth.expiresInSec * 1000, auth.expiresInSec * 1000),
+        label: 'OAuth device flow',
+        leadingWait: true,
+        ...(opts.signal ? { signal: opts.signal } : {}),
+    });
+}
+async function pollOnce(opts, deviceCode, state) {
+    const body = new URLSearchParams();
+    body.set('grant_type', 'urn:ietf:params:oauth:grant-type:device_code');
+    body.set('device_code', deviceCode);
+    body.set('client_id', opts.clientId);
+    if (opts.clientSecret)
+        body.set('client_secret', opts.clientSecret);
+    const pollRes = await fetch(opts.tokenUrl, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' },
+        body: body.toString(),
+        ...(state.signal ? { signal: state.signal } : {}),
+    });
+    const pollJson = (await pollRes.json().catch(() => ({})));
+    return classifyDeviceTokenResponse(pollRes, pollJson, state);
+}
+//# sourceMappingURL=device-flow.js.map

package/dist/oauth/device-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow.js","sourceRoot":"","sources":["../../src/oauth/device-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAoC,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAGlG;;;;;GAKG;AACH,MAAM,4BAA4B,GAAG,IAAI,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAuB;IAC7D,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC;QAC5C,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC;QACZ,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,IAAI,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClG,SAAS,EAAE,IAAI,CAAC,YAAY;QAC5B,QAAQ,EAAE,IAAI,CAAC,WAAW;KAC3B,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE;QAClE,UAAU,EAAE,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,4BAA4B;QAClE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,GAAG,IAAI,EAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzF,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,IAAI;QACjB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,IAAuB,EACvB,UAAkB,EAClB,KAAgB;IAEhB,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,8CAA8C,CAAC,CAAC;IACvE,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,IAAI,CAAC,YAAY;QAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;QACzC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC5F,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;QACrB,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;IACrF,OAAO,2BAA2B,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC/D,CAAC"}

package/dist/oauth/poll-until.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Shared polling primitive for OAuth-style "ask again later" modes. Handles
+ * the gnarly bits — deadline math, abort-responsive sleep, interval bumps
+ * for `slow_down`-style backpressure — so each device-flow dialect only has
+ * to encode its HTTP shape, not the timing harness.
+ *
+ * Consumed by both `runDeviceCodeFlow` (RFC 8628) and the Codex device flow
+ * (non-standard OpenAI endpoints). The polling fn returns `{done}` to finish
+ * or `{pending}` to keep going, and may mutate `state.intervalMs` mid-flight
+ * to apply a `slow_down` bump.
+ */
+export interface PollState {
+    /** Mutable so the polling fn can bump on `slow_down`. */
+    intervalMs: number;
+    /**
+     * The flow's abort signal, threaded through so a polling fn can pass it
+     * into its in-flight fetch and cancel a hung request — not just the
+     * inter-poll sleep. Undefined when the caller supplied no signal.
+     */
+    readonly signal?: AbortSignal;
+}
+export type PollOutcome<T> = {
+    done: T;
+} | {
+    pending: true;
+};
+export interface PollUntilOpts {
+    readonly intervalMs: number;
+    readonly timeoutMs: number;
+    readonly signal?: AbortSignal;
+    /**
+     * Wait BEFORE the first call. RFC 8628 says clients SHOULD wait `interval`
+     * before the first poll; some flows (e.g. Codex) poll immediately. Default
+     * true to match the more conservative RFC behavior.
+     */
+    readonly leadingWait?: boolean;
+    /** Used in timeout / abort error messages. */
+    readonly label?: string;
+}
+export declare function pollUntil<T>(fn: (state: PollState) => Promise<PollOutcome<T>>, opts: PollUntilOpts): Promise<T>;
+//# sourceMappingURL=poll-until.d.ts.map

package/dist/oauth/poll-until.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"poll-until.d.ts","sourceRoot":"","sources":["../../src/oauth/poll-until.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,MAAM,WAAW,SAAS;IACxB,yDAAyD;IACzD,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED,MAAM,MAAM,WAAW,CAAC,CAAC,IAAI;IAAE,IAAI,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,CAAC;AAE7D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,wBAAsB,SAAS,CAAC,CAAC,EAC/B,EAAE,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EACjD,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,CAAC,CAAC,CA0BZ"}

package/dist/oauth/poll-until.js

@@ -0,0 +1,70 @@
+/**
+ * Shared polling primitive for OAuth-style "ask again later" modes. Handles
+ * the gnarly bits — deadline math, abort-responsive sleep, interval bumps
+ * for `slow_down`-style backpressure — so each device-flow dialect only has
+ * to encode its HTTP shape, not the timing harness.
+ *
+ * Consumed by both `runDeviceCodeFlow` (RFC 8628) and the Codex device flow
+ * (non-standard OpenAI endpoints). The polling fn returns `{done}` to finish
+ * or `{pending}` to keep going, and may mutate `state.intervalMs` mid-flight
+ * to apply a `slow_down` bump.
+ */
+import { MoxxyError } from '@moxxy/sdk';
+export async function pollUntil(fn, opts) {
+    const state = {
+        intervalMs: opts.intervalMs,
+        ...(opts.signal ? { signal: opts.signal } : {}),
+    };
+    const leadingWait = opts.leadingWait ?? true;
+    const deadline = Date.now() + opts.timeoutMs;
+    const label = opts.label ?? 'poll';
+    let first = true;
+    while (Date.now() < deadline) {
+        if (opts.signal?.aborted)
+            throw abortedError(label);
+        if (!first || leadingWait) {
+            const remaining = deadline - Date.now();
+            if (remaining <= 0)
+                break;
+            await sleep(Math.min(state.intervalMs, remaining), opts.signal, label);
+        }
+        first = false;
+        const result = await fn(state);
+        if ('done' in result)
+            return result.done;
+    }
+    throw new MoxxyError({
+        code: 'OAUTH_FLOW_TIMEOUT',
+        message: `${label} timed out waiting for completion`,
+        context: { label, timeout_ms: opts.timeoutMs },
+    });
+}
+function abortedError(label) {
+    return new MoxxyError({
+        code: 'NETWORK_ABORTED',
+        message: `${label} aborted`,
+        context: { label },
+    });
+}
+function sleep(ms, signal, label) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted)
+            return reject(abortedError(label));
+        // `{ once: true }` only auto-removes a listener that actually FIRES; on the
+        // timer-resolved path it would linger. pollUntil calls sleep() once per
+        // poll cycle against the SAME long-lived signal, so an unremoved listener
+        // accumulates one-per-iteration (~120 over a 10-min device flow), tripping
+        // MaxListenersExceededWarning and retaining each closure. Remove on BOTH
+        // exits so it's exactly one add / one remove per sleep.
+        const onAbort = () => {
+            clearTimeout(t);
+            reject(abortedError(label));
+        };
+        const t = setTimeout(() => {
+            signal?.removeEventListener('abort', onAbort);
+            resolve();
+        }, ms);
+        signal?.addEventListener('abort', onAbort, { once: true });
+    });
+}
+//# sourceMappingURL=poll-until.js.map

package/dist/oauth/poll-until.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"poll-until.js","sourceRoot":"","sources":["../../src/oauth/poll-until.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AA6BxC,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,EAAiD,EACjD,IAAmB;IAEnB,MAAM,KAAK,GAAc;QACvB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC;IAEnC,IAAI,KAAK,GAAG,IAAI,CAAC;IACjB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;YAAE,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,IAAI,WAAW,EAAE,CAAC;YAC1B,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACxC,IAAI,SAAS,IAAI,CAAC;gBAAE,MAAM;YAC1B,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACzE,CAAC;QACD,KAAK,GAAG,KAAK,CAAC;QACd,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,MAAM,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IAC3C,CAAC;IACD,MAAM,IAAI,UAAU,CAAC;QACnB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,GAAG,KAAK,mCAAmC;QACpD,OAAO,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE;KAC/C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,IAAI,UAAU,CAAC;QACpB,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,GAAG,KAAK,UAAU;QAC3B,OAAO,EAAE,EAAE,KAAK,EAAE;KACnB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,KAAK,CAAC,EAAU,EAAE,MAA+B,EAAE,KAAa;IACvE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,MAAM,EAAE,OAAO;YAAE,OAAO,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QACxD,4EAA4E;QAC5E,wEAAwE;QACxE,0EAA0E;QAC1E,2EAA2E;QAC3E,yEAAyE;QACzE,wDAAwD;QACxD,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,YAAY,CAAC,CAAC,CAAC,CAAC;YAChB,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9B,CAAC,CAAC;QACF,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE;YACxB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/oauth/token-exchange.d.ts

@@ -0,0 +1,28 @@
+import type { TokenSet } from './types.js';
+interface ExchangeCodeInput {
+    readonly tokenUrl: string;
+    readonly code: string;
+    readonly redirectUri: string;
+    readonly clientId: string;
+    readonly clientSecret?: string;
+    readonly codeVerifier: string;
+    /** Abort the exchange fetch when the caller's flow is cancelled. */
+    readonly signal?: AbortSignal;
+}
+export declare function exchangeCodeForToken(input: ExchangeCodeInput, fetchImpl?: typeof fetch): Promise<TokenSet>;
+/**
+ * Refresh an access token using a stored refresh_token. Same token
+ * endpoint, different grant_type. Returns a new TokenSet — note that
+ * providers MAY or MAY NOT rotate the refresh_token (Google does
+ * not; Auth0 with rotation does). Caller should preserve the prior
+ * refresh_token if the response omits one.
+ */
+export declare function refreshAccessToken(input: {
+    readonly tokenUrl: string;
+    readonly clientId: string;
+    readonly clientSecret?: string;
+    readonly refreshToken: string;
+}, fetchImpl?: typeof fetch): Promise<TokenSet>;
+export declare function parseTokenResponse(json: Record<string, unknown>): TokenSet;
+export {};
+//# sourceMappingURL=token-exchange.d.ts.map

package/dist/oauth/token-exchange.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-exchange.d.ts","sourceRoot":"","sources":["../../src/oauth/token-exchange.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,UAAU,iBAAiB;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,oEAAoE;IACpE,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,iBAAiB,EACxB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,QAAQ,CAAC,CA2BnB;AA2DD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE;IACL,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B,EACD,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,QAAQ,CAAC,CA2BnB;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,QAAQ,CAqB1E"}

package/dist/oauth/token-exchange.js

@@ -0,0 +1,142 @@
+import { classifyHttpStatus, MoxxyError } from '@moxxy/sdk';
+export async function exchangeCodeForToken(input, fetchImpl = fetch) {
+    const body = new URLSearchParams();
+    body.set('grant_type', 'authorization_code');
+    body.set('code', input.code);
+    body.set('redirect_uri', input.redirectUri);
+    body.set('client_id', input.clientId);
+    body.set('code_verifier', input.codeVerifier);
+    if (input.clientSecret)
+        body.set('client_secret', input.clientSecret);
+    const res = await fetchImpl(input.tokenUrl, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' },
+        body: body.toString(),
+        ...(input.signal ? { signal: input.signal } : {}),
+    });
+    if (!res.ok) {
+        const text = await res.text().catch(() => '');
+        throw (classifyHttpStatus(res.status, { url: input.tokenUrl, body: text }) ??
+            new MoxxyError({
+                code: 'AUTH_INVALID',
+                message: `Token exchange failed (HTTP ${res.status})${errorSummary(text)}`,
+                context: { status: res.status, url: input.tokenUrl, ...bodyContext(text) },
+            }));
+    }
+    const json = await parseJsonBody(res, input.tokenUrl);
+    return parseTokenResponse(json);
+}
+/**
+ * Build a human-message suffix from a token-endpoint error body. Token
+ * endpoints return `{error, error_description}` (RFC 6749 §5.2); prefer those
+ * structured fields verbatim. For an opaque/HTML body (proxy/captive-portal
+ * error page) — provider/attacker-influenced text that flows to logs and can
+ * reach the model — emit nothing in the human message; the bounded raw body
+ * still lands in `context` via {@link bodyContext}.
+ */
+function errorSummary(body) {
+    const fields = parseOauthError(body);
+    if (!fields)
+        return '';
+    const { error, error_description } = fields;
+    const detail = error_description ?? error;
+    return detail ? `: ${detail.slice(0, 300)}` : '';
+}
+/** Truncated raw body for the error context only (never the human message). */
+function bodyContext(body) {
+    return body ? { body: body.slice(0, 200) } : {};
+}
+function parseOauthError(body) {
+    if (!body)
+        return null;
+    try {
+        const parsed = JSON.parse(body);
+        if (!parsed || typeof parsed !== 'object')
+            return null;
+        const obj = parsed;
+        const error = typeof obj.error === 'string' ? obj.error : undefined;
+        const error_description = typeof obj.error_description === 'string' ? obj.error_description : undefined;
+        if (!error && !error_description)
+            return null;
+        return {
+            ...(error !== undefined ? { error } : {}),
+            ...(error_description !== undefined ? { error_description } : {}),
+        };
+    }
+    catch {
+        return null; // opaque / HTML body — don't reflect it into the message
+    }
+}
+/**
+ * Parse a 2xx token-endpoint body as JSON. A provider (or an intercepting
+ * proxy / captive portal / load-balancer error page) can return HTTP 200 with
+ * a non-JSON or truncated body; an unguarded `res.json()` would reject with a
+ * native SyntaxError that escapes the MoxxyError boundary (no code/hint, and
+ * `isAuthRejection` can't classify it). Convert it to a typed error instead.
+ */
+async function parseJsonBody(res, url) {
+    return (await res.json().catch(() => {
+        throw new MoxxyError({
+            code: 'PROVIDER_UNKNOWN_RESPONSE',
+            message: 'token endpoint returned a non-JSON success body',
+            context: { url },
+        });
+    }));
+}
+/**
+ * Refresh an access token using a stored refresh_token. Same token
+ * endpoint, different grant_type. Returns a new TokenSet — note that
+ * providers MAY or MAY NOT rotate the refresh_token (Google does
+ * not; Auth0 with rotation does). Caller should preserve the prior
+ * refresh_token if the response omits one.
+ */
+export async function refreshAccessToken(input, fetchImpl = fetch) {
+    const body = new URLSearchParams();
+    body.set('grant_type', 'refresh_token');
+    body.set('refresh_token', input.refreshToken);
+    body.set('client_id', input.clientId);
+    if (input.clientSecret)
+        body.set('client_secret', input.clientSecret);
+    const res = await fetchImpl(input.tokenUrl, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' },
+        body: body.toString(),
+    });
+    if (!res.ok) {
+        const text = await res.text().catch(() => '');
+        // 401/403 here typically means the refresh_token was revoked/expired —
+        // classifyHttpStatus maps those to AUTH_INVALID/AUTH_DENIED. Surface a
+        // refresh-specific fallback for the unmapped statuses.
+        throw (classifyHttpStatus(res.status, { url: input.tokenUrl, body: text }) ??
+            new MoxxyError({
+                code: 'AUTH_EXPIRED',
+                message: `Token refresh failed (HTTP ${res.status})${errorSummary(text)}`,
+                context: { status: res.status, url: input.tokenUrl, ...bodyContext(text) },
+            }));
+    }
+    const json = await parseJsonBody(res, input.tokenUrl);
+    return parseTokenResponse(json);
+}
+export function parseTokenResponse(json) {
+    const access = typeof json.access_token === 'string' ? json.access_token : null;
+    if (!access) {
+        throw new MoxxyError({
+            code: 'PROVIDER_UNKNOWN_RESPONSE',
+            message: `token response missing access_token: ${JSON.stringify(json).slice(0, 200)}`,
+        });
+    }
+    const refresh = typeof json.refresh_token === 'string' ? json.refresh_token : undefined;
+    const expiresIn = typeof json.expires_in === 'number' ? json.expires_in : null;
+    const scope = typeof json.scope === 'string' ? json.scope : undefined;
+    const tokenType = typeof json.token_type === 'string' ? json.token_type : 'Bearer';
+    const idToken = typeof json.id_token === 'string' ? json.id_token : undefined;
+    return {
+        accessToken: access,
+        ...(refresh !== undefined ? { refreshToken: refresh } : {}),
+        ...(expiresIn != null ? { expiresAt: Date.now() + expiresIn * 1000 } : {}),
+        ...(scope !== undefined ? { scope } : {}),
+        tokenType,
+        ...(idToken !== undefined ? { idToken } : {}),
+    };
+}
+//# sourceMappingURL=token-exchange.js.map

package/dist/oauth/token-exchange.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-exchange.js","sourceRoot":"","sources":["../../src/oauth/token-exchange.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAc5D,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAwB,EACxB,YAA0B,KAAK;IAE/B,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,YAAY;QAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE;QAC1C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC5F,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;QACrB,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,CACJ,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACnE,IAAI,UAAU,CAAC;gBACb,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,+BAA+B,GAAG,CAAC,MAAM,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE;gBAC1E,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE;aAC3E,CAAC,CACH,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC;IAC5C,MAAM,MAAM,GAAG,iBAAiB,IAAI,KAAK,CAAC;IAC1C,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,+EAA+E;AAC/E,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACvD,MAAM,GAAG,GAAG,MAAiC,CAAC;QAC9C,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACpE,MAAM,iBAAiB,GACrB,OAAO,GAAG,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,IAAI,CAAC,KAAK,IAAI,CAAC,iBAAiB;YAAE,OAAO,IAAI,CAAC;QAC9C,OAAO;YACL,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,yDAAyD;IACxE,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,aAAa,CAAC,GAAiC,EAAE,GAAW;IACzE,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;QAClC,MAAM,IAAI,UAAU,CAAC;YACnB,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,iDAAiD;YAC1D,OAAO,EAAE,EAAE,GAAG,EAAE;SACjB,CAAC,CAAC;IACL,CAAC,CAAC,CAA4B,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAKC,EACD,YAA0B,KAAK;IAE/B,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACxC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,YAAY;QAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE;QAC1C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC5F,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;KACtB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,uEAAuE;QACvE,uEAAuE;QACvE,uDAAuD;QACvD,MAAM,CACJ,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACnE,IAAI,UAAU,CAAC;gBACb,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,8BAA8B,GAAG,CAAC,MAAM,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE;gBACzE,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE;aAC3E,CAAC,CACH,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAA6B;IAC9D,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAChF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,UAAU,CAAC;YACnB,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,wCAAwC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SACtF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/E,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;IACnF,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,OAAO;QACL,WAAW,EAAE,MAAM;QACnB,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,SAAS;QACT,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC"}

package/dist/oauth/types.d.ts

@@ -0,0 +1,90 @@
+export interface OAuthFlowOptions {
+    /** Provider's authorization endpoint, e.g. https://accounts.google.com/o/oauth2/v2/auth */
+    readonly authUrl: string;
+    /** Provider's token endpoint, e.g. https://oauth2.googleapis.com/token */
+    readonly tokenUrl: string;
+    readonly clientId: string;
+    /** Confidential clients only; loopback flows usually omit. */
+    readonly clientSecret?: string;
+    readonly scopes: ReadonlyArray<string>;
+    /**
+     * Loopback redirect port. The redirect URI MUST be registered with
+     * the provider exactly (most providers require an exact match) — pick
+     * a value and tell the user to register it. Default 8765 to keep the
+     * Google Cloud Console setup deterministic across sessions.
+     */
+    readonly redirectPort?: number;
+    /**
+     * Loopback redirect path. Default `/callback`. Some providers reject
+     * paths other than `/`; tweak per provider. The full registered
+     * redirect URI must be `http://localhost:<port><path>` exactly.
+     */
+    readonly redirectPath?: string;
+    /**
+     * Provider-specific extra query parameters on the auth URL. Common
+     * cases: `access_type=offline` + `prompt=consent` for Google (forces
+     * the issuance of a refresh_token); `audience=...` for Auth0.
+     */
+    readonly extraAuthParams?: Readonly<Record<string, string>>;
+    /** How long to wait for the callback before giving up. Default 5min. */
+    readonly timeoutMs?: number;
+    /**
+     * Abort signal — when fired, shuts the local server and rejects the
+     * flow. Wire from `ctx.signal` so a turn cancel kills a pending auth.
+     */
+    readonly signal?: AbortSignal;
+    /**
+     * When true, do NOT auto-open the browser. The auth URL still
+     * gets handed to `onAuthUrl`; the caller is expected to print it
+     * for the user to visit on a host where the loopback callback is
+     * reachable (same machine, SSH tunnel, port-forward).
+     */
+    readonly noOpen?: boolean;
+    /**
+     * Fires with the built auth URL just before the browser-open step.
+     * Use to log / display the URL so the user sees it even when
+     * auto-open fails or `noOpen` is set.
+     */
+    readonly onAuthUrl?: (url: string) => void;
+}
+export interface DeviceFlowOptions {
+    /** Provider's device-authorization endpoint (RFC 8628 §3.1). */
+    readonly deviceUrl: string;
+    readonly tokenUrl: string;
+    readonly clientId: string;
+    readonly clientSecret?: string;
+    readonly scopes: ReadonlyArray<string>;
+    /** Hard cap; the device-code's own expires_in usually drives the timer. */
+    readonly timeoutMs?: number;
+    readonly signal?: AbortSignal;
+    /**
+     * Fired ONCE with the user-facing prompt info as soon as the
+     * device endpoint returns. Channels should surface this prominently
+     * — the whole flow stalls until the user finishes on the URL.
+     */
+    readonly onPrompt: (info: DevicePrompt) => void;
+}
+export interface DevicePrompt {
+    /** Short code the user types into the verification page. */
+    readonly userCode: string;
+    /** URL the user opens on any device. */
+    readonly verificationUri: string;
+    /** Some providers return a URL that already includes the user_code. */
+    readonly verificationUriComplete?: string;
+    /** Seconds until the device_code expires (from the provider). */
+    readonly expiresIn: number;
+    /** Poll interval the provider wants us to use, in seconds. */
+    readonly interval: number;
+}
+export interface TokenSet {
+    readonly accessToken: string;
+    readonly refreshToken?: string;
+    /** Epoch ms when the access_token expires. */
+    readonly expiresAt?: number;
+    /** Granted scopes — provider may grant less than requested. */
+    readonly scope?: string;
+    readonly tokenType: string;
+    /** OIDC id_token if the provider returned one (Google does for `openid` scope). */
+    readonly idToken?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/oauth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/oauth/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,gBAAgB;IAC/B,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D,wEAAwE;IACxE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC5C;AAED,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;CACjD;AAED,MAAM,WAAW,YAAY;IAC3B,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,wCAAwC;IACxC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,uEAAuE;IACvE,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAC1C,iEAAiE;IACjE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,8CAA8C;IAC9C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,mFAAmF;IACnF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B"}

package/dist/oauth/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/oauth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/oauth/types.ts"],"names":[],"mappings":""}