@moxxy/plugin-oauth 0.0.33

package/dist/storage.js

@@ -0,0 +1,167 @@
+/**
+ * Vault key convention:
+ *   oauth/<provider>/access_token
+ *   oauth/<provider>/refresh_token
+ *   oauth/<provider>/expires_at      (epoch ms, string)
+ *   oauth/<provider>/scope
+ *   oauth/<provider>/token_type
+ *   oauth/<provider>/id_token        (OIDC providers only)
+ *   oauth/<provider>/client_id       (so refresh doesn't need the model to re-pass it)
+ *   oauth/<provider>/client_secret   (confidential clients only)
+ *   oauth/<provider>/token_url       (so refresh works without re-supplying)
+ *   oauth/<provider>/extras          (JSON map of provider-specific fields, e.g. account_id)
+ *
+ * Provider names are namespaced with a `/` so the vault's `list-by-tag`
+ * UI groups them. Provider names MUST be `[a-z0-9._-]+`; the schema in
+ * the tool layer enforces this.
+ */
+const PROVIDER_RE = /^[a-z0-9._-]+$/;
+export function validateProvider(name) {
+    if (!PROVIDER_RE.test(name)) {
+        throw new Error(`oauth provider name "${name}" must match ${PROVIDER_RE.source} (lowercase, digits, ._-)`);
+    }
+}
+export async function storeTokenSet(vault, provider, tokens, meta) {
+    validateProvider(provider);
+    const tag = `oauth:${provider}`;
+    const base = `oauth/${provider}`;
+    // Write each optional field when present, but DELETE the stored key when the
+    // new TokenSet omits it, so the persisted bundle exactly mirrors the live
+    // TokenSet. A refresh response that omits expires_in/scope/id_token (RFC 6749
+    // §5.1 permits this) must not leave a stale expires_at (which would make
+    // isExpired() loop forever or trust a token off dead data) or a stale OIDC
+    // id_token (which extractAccountId/extractExtras might re-derive identity
+    // from). Callers preserve a rotated-or-prior refresh_token BEFORE calling us
+    // (RFC 6749 §6: a refresh MAY omit refresh_token), so an undefined
+    // refreshToken here genuinely means "no refresh token" — mirror that too.
+    const upsert = async (key, value) => {
+        if (value !== undefined) {
+            await vault.set(`${base}/${key}`, value, [tag]);
+        }
+        else {
+            await vault.delete?.(`${base}/${key}`);
+        }
+    };
+    await vault.set(`${base}/access_token`, tokens.accessToken, [tag]);
+    await upsert('refresh_token', tokens.refreshToken);
+    await upsert('expires_at', tokens.expiresAt !== undefined ? String(tokens.expiresAt) : undefined);
+    await upsert('scope', tokens.scope);
+    await vault.set(`${base}/token_type`, tokens.tokenType, [tag]);
+    await upsert('id_token', tokens.idToken);
+    await vault.set(`${base}/client_id`, meta.clientId, [tag]);
+    if (meta.clientSecret) {
+        await vault.set(`${base}/client_secret`, meta.clientSecret, [tag]);
+    }
+    await vault.set(`${base}/token_url`, meta.tokenUrl, [tag]);
+    if (meta.extras && Object.keys(meta.extras).length > 0) {
+        await vault.set(`${base}/extras`, JSON.stringify(meta.extras), [tag]);
+    }
+}
+export async function readStoredCreds(vault, provider) {
+    validateProvider(provider);
+    const base = `oauth/${provider}`;
+    const access = await vault.get(`${base}/access_token`);
+    if (!access)
+        return null;
+    // The remaining nine keys are independent reads with no ordering dependency;
+    // ensureFreshTokens runs this before every upstream LLM call, so fetch them
+    // concurrently instead of serializing ~9 vault round-trips on the hot path.
+    const [refresh, expiresStr, scope, tokenTypeRaw, idToken, clientId, clientSecret, tokenUrl, extrasRaw] = await Promise.all([
+        vault.get(`${base}/refresh_token`),
+        vault.get(`${base}/expires_at`),
+        vault.get(`${base}/scope`),
+        vault.get(`${base}/token_type`),
+        vault.get(`${base}/id_token`),
+        vault.get(`${base}/client_id`),
+        vault.get(`${base}/client_secret`),
+        vault.get(`${base}/token_url`),
+        vault.get(`${base}/extras`),
+    ]);
+    const tokenType = tokenTypeRaw ?? 'Bearer';
+    if (!clientId || !tokenUrl) {
+        // Missing setup-meta means a partial store — refresh impossible. Treat as absent.
+        return null;
+    }
+    // A stored `expires_at` that doesn't parse to a finite number (corrupt vault
+    // write, a hand-edited value, a partial flush) is poison: carried through as
+    // NaN it makes `isExpired` return false (NaN comparisons are always false),
+    // so the token would read as ETERNALLY fresh and never refresh — the user
+    // silently keeps presenting a possibly-dead token. Drop the unparseable value
+    // and let `expiresAt` go undefined; `isExpired` then defends the
+    // no-known-expiry case explicitly (see below).
+    const expiresAtParsed = expiresStr !== null ? Number.parseInt(expiresStr, 10) : null;
+    const expiresAt = expiresAtParsed !== null && Number.isFinite(expiresAtParsed) ? expiresAtParsed : undefined;
+    return {
+        tokenSet: {
+            accessToken: access,
+            ...(refresh !== null ? { refreshToken: refresh } : {}),
+            ...(expiresAt !== undefined ? { expiresAt } : {}),
+            ...(scope !== null ? { scope } : {}),
+            tokenType,
+            ...(idToken !== null ? { idToken } : {}),
+        },
+        clientId,
+        clientSecret,
+        tokenUrl,
+        extras: parseExtras(extrasRaw),
+    };
+}
+export async function clearStoredCreds(vault, provider) {
+    validateProvider(provider);
+    const base = `oauth/${provider}`;
+    const keys = [
+        `${base}/access_token`,
+        `${base}/refresh_token`,
+        `${base}/expires_at`,
+        `${base}/scope`,
+        `${base}/token_type`,
+        `${base}/id_token`,
+        `${base}/client_id`,
+        `${base}/client_secret`,
+        `${base}/token_url`,
+        `${base}/extras`,
+    ];
+    let removed = 0;
+    for (const k of keys) {
+        if (await vault.delete?.(k))
+            removed += 1;
+    }
+    return removed;
+}
+/**
+ * True when the access token has expired (or is within `skewMs` of doing so).
+ *
+ * A token with no `expiresAt` is treated as non-expiring (some providers issue
+ * tokens without `expires_in`). A non-FINITE `expiresAt` (NaN/Infinity — corrupt
+ * data, an out-of-range parse) is treated as EXPIRED, never as fresh: a bare
+ * `>=` against NaN is always false, which would otherwise mark a token eternally
+ * valid and suppress every refresh. Forcing the expired branch degrades to a
+ * refresh (or a clear AUTH_EXPIRED if no refresh_token) instead of silently
+ * serving a token whose real expiry is unknown.
+ */
+export function isExpired(tokens, skewMs = 60_000) {
+    if (tokens.expiresAt === undefined)
+        return false;
+    if (!Number.isFinite(tokens.expiresAt))
+        return true;
+    return Date.now() + skewMs >= tokens.expiresAt;
+}
+function parseExtras(raw) {
+    if (!raw)
+        return {};
+    try {
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+            return {};
+        const out = {};
+        for (const [k, v] of Object.entries(parsed)) {
+            if (typeof v === 'string')
+                out[k] = v;
+        }
+        return out;
+    }
+    catch {
+        return {};
+    }
+}
+//# sourceMappingURL=storage.js.map

package/dist/storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAarC,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,wBAAwB,IAAI,gBAAgB,WAAW,CAAC,MAAM,2BAA2B,CAC1F,CAAC;IACJ,CAAC;AACH,CAAC;AAsBD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAiB,EACjB,QAAgB,EAChB,MAAgB,EAChB,IAAuB;IAEvB,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC3B,MAAM,GAAG,GAAG,SAAS,QAAQ,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,SAAS,QAAQ,EAAE,CAAC;IACjC,6EAA6E;IAC7E,0EAA0E;IAC1E,8EAA8E;IAC9E,yEAAyE;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,6EAA6E;IAC7E,mEAAmE;IACnE,0EAA0E;IAC1E,MAAM,MAAM,GAAG,KAAK,EAAE,GAAW,EAAE,KAAyB,EAAiB,EAAE;QAC7E,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC;IACF,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,eAAe,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,MAAM,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IACnD,MAAM,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAClG,MAAM,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,aAAa,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/D,MAAM,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,gBAAgB,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,IAAI,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvD,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAiB,EACjB,QAAgB;IAEhB,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,SAAS,QAAQ,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,eAAe,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,CAAC,GACpG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,gBAAgB,CAAC;QAClC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,aAAa,CAAC;QAC/B,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,QAAQ,CAAC;QAC1B,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,aAAa,CAAC;QAC/B,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,WAAW,CAAC;QAC7B,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,YAAY,CAAC;QAC9B,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,gBAAgB,CAAC;QAClC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,YAAY,CAAC;QAC9B,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,SAAS,CAAC;KAC5B,CAAC,CAAC;IACL,MAAM,SAAS,GAAG,YAAY,IAAI,QAAQ,CAAC;IAC3C,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC3B,kFAAkF;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,0EAA0E;IAC1E,8EAA8E;IAC9E,iEAAiE;IACjE,+CAA+C;IAC/C,MAAM,eAAe,GAAG,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrF,MAAM,SAAS,GACb,eAAe,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,OAAO;QACL,QAAQ,EAAE;YACR,WAAW,EAAE,MAAM;YACnB,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,SAAS;YACT,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzC;QACD,QAAQ;QACR,YAAY;QACZ,QAAQ;QACR,MAAM,EAAE,WAAW,CAAC,SAAS,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAiB,EAAE,QAAgB;IACxE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,SAAS,QAAQ,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG;QACX,GAAG,IAAI,eAAe;QACtB,GAAG,IAAI,gBAAgB;QACvB,GAAG,IAAI,aAAa;QACpB,GAAG,IAAI,QAAQ;QACf,GAAG,IAAI,aAAa;QACpB,GAAG,IAAI,WAAW;QAClB,GAAG,IAAI,YAAY;QACnB,GAAG,IAAI,gBAAgB;QACvB,GAAG,IAAI,YAAY;QACnB,GAAG,IAAI,SAAS;KACjB,CAAC;IACF,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,SAAS,CAAC,MAAgB,EAAE,MAAM,GAAG,MAAM;IACzD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC;AACjD,CAAC;AAED,SAAS,WAAW,CAAC,GAAkB;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QAC9E,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/tools.d.ts

@@ -0,0 +1,8 @@
+import type { VaultStore } from '@moxxy/plugin-vault';
+export interface OAuthToolDeps {
+    readonly vault: VaultStore;
+}
+export declare function buildOauthAuthorizeTool(deps: OAuthToolDeps): import("@moxxy/sdk").ToolDef;
+export declare function buildOauthGetTokenTool(deps: OAuthToolDeps): import("@moxxy/sdk").ToolDef;
+export declare function buildOauthClearTool(deps: OAuthToolDeps): import("@moxxy/sdk").ToolDef;
+//# sourceMappingURL=tools.d.ts.map

package/dist/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAmBtD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAWD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,aAAa,gCAuK1D;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,aAAa,gCAkEzD;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,aAAa,gCActD"}

package/dist/tools.js

@@ -0,0 +1,283 @@
+import { defineTool, MoxxyError, z } from '@moxxy/sdk';
+import { buildAuthUrl, runAuthorizationCodeFlow, runDeviceCodeFlow, } from './flow.js';
+import { generateCodeVerifier, generateState } from './pkce.js';
+import { clearStoredCreds, isExpired, readStoredCreds, storeTokenSet, validateProvider, } from './storage.js';
+import { withCredentialLock } from './credential-lock.js';
+import { refreshAndStore } from './ensure-fresh.js';
+const providerNameField = z
+    .string()
+    .min(1)
+    .max(60)
+    .describe('Stable provider key used as the vault namespace (e.g. "google", "github", ' +
+    '"notion"). Lowercase letters, digits, dot/dash/underscore only.');
+export function buildOauthAuthorizeTool(deps) {
+    return defineTool({
+        name: 'oauth_authorize',
+        description: 'Run an OAuth 2.0 authorization-code flow (PKCE) against any provider, ' +
+            'or RFC 8628 device-code flow for headless hosts. Opens the user\'s ' +
+            'browser (loopback mode), or prints a code to type on another device ' +
+            '(device mode). Stores the resulting tokens in the vault under ' +
+            '`oauth/<provider>/*`. Subsequent `oauth_get_token` calls auto-refresh ' +
+            'when the access token expires. Returns when the user finishes the dance.',
+        inputSchema: z.object({
+            provider: providerNameField,
+            authUrl: z
+                .string()
+                .url()
+                .optional()
+                .describe('Provider authorization endpoint. Required for `mode: "loopback"`. ' +
+                'E.g. https://accounts.google.com/o/oauth2/v2/auth'),
+            tokenUrl: z
+                .string()
+                .url()
+                .describe('Provider token endpoint. E.g. https://oauth2.googleapis.com/token'),
+            deviceUrl: z
+                .string()
+                .url()
+                .optional()
+                .describe('Provider device-authorization endpoint. Required for `mode: "device"`. ' +
+                'E.g. https://oauth2.googleapis.com/device/code'),
+            clientId: z.string().min(1),
+            clientSecret: z
+                .string()
+                .optional()
+                .describe('Required for confidential clients (most server-side apps). Omit for native/installed apps using PKCE alone.'),
+            scopes: z.array(z.string().min(1)).min(1),
+            mode: z
+                .enum(['loopback', 'device'])
+                .optional()
+                .describe('Flow mode. "loopback" (default) opens a browser + local callback ' +
+                'server. "device" prints a code for the user to type into another ' +
+                'device — use when running headless (SSH session, CI, no display).'),
+            redirectPort: z
+                .number()
+                .int()
+                .positive()
+                .max(65535)
+                .optional()
+                .describe('Loopback-mode redirect port. Default 8765. MUST match what you registered with the provider.'),
+            redirectPath: z
+                .string()
+                .optional()
+                .describe('Loopback-mode redirect path. Default "/callback".'),
+            extraAuthParams: z
+                .record(z.string(), z.string())
+                .optional()
+                .describe('Provider-specific auth-URL params. Google wants `access_type=offline` + `prompt=consent` ' +
+                'to issue a refresh_token; Auth0 may want `audience=...`.'),
+            noOpen: z
+                .boolean()
+                .optional()
+                .describe('Loopback-mode only: skip auto-opening the browser. The auth URL is ' +
+                'logged via the tool logger so the user can open it manually on the ' +
+                'host where the loopback server is reachable.'),
+        }),
+        permission: { action: 'prompt' },
+        async handler(input, ctx) {
+            validateProvider(input.provider);
+            const mode = input.mode ?? 'loopback';
+            let tokens;
+            if (mode === 'device') {
+                if (!input.deviceUrl) {
+                    throw new MoxxyError({
+                        code: 'TOOL_ERROR',
+                        message: 'mode="device" requires `deviceUrl` (the provider\'s device-authorization endpoint)',
+                    });
+                }
+                tokens = await runDeviceCodeFlow({
+                    deviceUrl: input.deviceUrl,
+                    tokenUrl: input.tokenUrl,
+                    clientId: input.clientId,
+                    ...(input.clientSecret ? { clientSecret: input.clientSecret } : {}),
+                    scopes: input.scopes,
+                    ...(ctx.signal ? { signal: ctx.signal } : {}),
+                    onPrompt: (info) => {
+                        // Surface the prompt prominently via the tool logger so the
+                        // channel renders it as a system notice. The model can also
+                        // see this in the event log and echo it to the user.
+                        ctx.logger.info('oauth_authorize: device flow — visit URL', {
+                            verificationUri: info.verificationUri,
+                            ...(info.verificationUriComplete ? { verificationUriComplete: info.verificationUriComplete } : {}),
+                            userCode: info.userCode,
+                            expiresInSec: info.expiresIn,
+                        });
+                        // Belt-and-suspenders: stderr in case the logger isn't
+                        // wired to a visible surface in the current channel.
+                        process.stderr.write(`\n  Open ${info.verificationUri} and enter code: ${info.userCode}\n` +
+                            (info.verificationUriComplete
+                                ? `  (or visit directly: ${info.verificationUriComplete})\n`
+                                : '') +
+                            `  Code expires in ${Math.floor(info.expiresIn / 60)}m.\n\n`);
+                    },
+                });
+            }
+            else {
+                if (!input.authUrl) {
+                    throw new MoxxyError({
+                        code: 'TOOL_ERROR',
+                        message: 'mode="loopback" requires `authUrl` (the provider\'s authorization endpoint)',
+                    });
+                }
+                if (input.noOpen) {
+                    // Compute + log the URL without spawning a browser.
+                    const verifier = generateCodeVerifier();
+                    const state = generateState();
+                    const { computeCodeChallenge } = await import('./pkce.js');
+                    const challenge = computeCodeChallenge(verifier);
+                    const port = input.redirectPort ?? 8765;
+                    const path = input.redirectPath ?? '/callback';
+                    const url = buildAuthUrl({
+                        authUrl: input.authUrl,
+                        clientId: input.clientId,
+                        redirectUri: `http://localhost:${port}${path}`,
+                        scopes: input.scopes,
+                        codeChallenge: challenge,
+                        state,
+                        ...(input.extraAuthParams ? { extraAuthParams: input.extraAuthParams } : {}),
+                    });
+                    ctx.logger.info('oauth_authorize: open this URL manually', { url });
+                    process.stderr.write(`\n  Open this URL in a browser on this host:\n  ${url}\n\n`);
+                }
+                tokens = await runAuthorizationCodeFlow({
+                    authUrl: input.authUrl,
+                    tokenUrl: input.tokenUrl,
+                    clientId: input.clientId,
+                    ...(input.clientSecret ? { clientSecret: input.clientSecret } : {}),
+                    scopes: input.scopes,
+                    ...(input.redirectPort !== undefined ? { redirectPort: input.redirectPort } : {}),
+                    ...(input.redirectPath !== undefined ? { redirectPath: input.redirectPath } : {}),
+                    ...(input.extraAuthParams ? { extraAuthParams: input.extraAuthParams } : {}),
+                    ...(input.noOpen ? { noOpen: true } : {}),
+                    ...(ctx.signal ? { signal: ctx.signal } : {}),
+                    onAuthUrl: (url) => {
+                        ctx.logger.info('oauth_authorize: opening browser', { url });
+                    },
+                });
+            }
+            await storeTokenSet(deps.vault, input.provider, tokens, {
+                clientId: input.clientId,
+                ...(input.clientSecret ? { clientSecret: input.clientSecret } : {}),
+                tokenUrl: input.tokenUrl,
+            });
+            return summarizeTokens(input.provider, tokens);
+        },
+    });
+}
+export function buildOauthGetTokenTool(deps) {
+    return defineTool({
+        name: 'oauth_get_token',
+        description: 'Read the stored access token for an OAuth provider, transparently ' +
+            'refreshing it via refresh_token if it has expired. Returns the bearer ' +
+            'token ready to drop into an Authorization header. Throws if no token ' +
+            'has been stored — call `oauth_authorize` first.',
+        inputSchema: z.object({
+            provider: providerNameField,
+            forceRefresh: z
+                .boolean()
+                .optional()
+                .describe('Refresh even if the cached token has not expired yet.'),
+            includeRefresh: z
+                .boolean()
+                .optional()
+                .describe('Also return the refresh_token. Default false — the refresh_token ' +
+                'is more sensitive than the access_token and most callers never ' +
+                'need it. Set true when wiring an MCP server (or other long-lived ' +
+                'subprocess) that needs to mint its own access tokens.'),
+        }),
+        permission: { action: 'prompt' },
+        async handler({ provider, forceRefresh, includeRefresh }, _ctx) {
+            const stored = await readStoredCreds(deps.vault, provider);
+            if (!stored) {
+                throw new MoxxyError({
+                    code: 'AUTH_NO_CREDENTIALS',
+                    message: `no stored OAuth credentials for "${provider}". Run oauth_authorize first.`,
+                    context: { provider },
+                });
+            }
+            // Fast path: a still-fresh token needs no lock and no network. Refreshing
+            // a rotating single-use refresh_token, on the other hand, MUST serialize
+            // per credential (a second concurrent refresher — another oauth_get_token
+            // call OR a provider's ensureFreshTokens sharing this vault credential —
+            // would otherwise burn the now-rotated token and log the user out). Route
+            // the refresh+persist critical section through the same per-credential
+            // lock ensure-fresh.ts uses, re-reading inside the lock so a queued
+            // waiter reuses the winner's rotated token instead of re-racing.
+            if (!forceRefresh && !isExpired(stored.tokenSet)) {
+                return summarizeTokens(provider, stored.tokenSet, {
+                    includeAccess: true,
+                    ...(includeRefresh ? { includeRefresh: true } : {}),
+                });
+            }
+            const tokens = await withCredentialLock(`oauth-${provider}`, async () => {
+                // Re-read under the lock: another consumer/process may have refreshed
+                // while we queued. Reuse a now-fresh token even under forceRefresh,
+                // which exists for 401 recovery and is satisfied by ANY rotation.
+                const current = (await readStoredCreds(deps.vault, provider)) ?? stored;
+                const rotatedMeanwhile = current.tokenSet.accessToken !== stored.tokenSet.accessToken;
+                if (!isExpired(current.tokenSet) && (!forceRefresh || rotatedMeanwhile)) {
+                    return current.tokenSet;
+                }
+                const { tokens } = await refreshAndStore(deps.vault, toolRefreshSpec(provider), current);
+                return tokens;
+            });
+            return summarizeTokens(provider, tokens, {
+                includeAccess: true,
+                ...(includeRefresh ? { includeRefresh: true } : {}),
+            });
+        },
+    });
+}
+export function buildOauthClearTool(deps) {
+    return defineTool({
+        name: 'oauth_clear_token',
+        description: 'Delete every stored credential for an OAuth provider — access token, ' +
+            'refresh token, client config, etc. Use when the user wants to revoke ' +
+            'the grant or re-do the flow with different scopes.',
+        inputSchema: z.object({ provider: providerNameField }),
+        permission: { action: 'prompt' },
+        async handler({ provider }) {
+            const removed = await clearStoredCreds(deps.vault, provider);
+            return { ok: true, provider, removedKeys: removed };
+        },
+    });
+}
+/**
+ * RefreshSpec for `oauth_get_token`, which has no provider profile — it works
+ * off raw StoredCreds. Mirrors the shared `refreshAndStore` critical section in
+ * ensure-fresh.ts (lock-guarded; preserves a rotated-or-prior refresh_token per
+ * RFC 6749 §6; recovers once from an invalid_grant when another process rotated
+ * our refresh_token away). Re-persists the stored extras so a store-layer change
+ * can't silently wipe account_id on a tool-driven refresh, and re-throws a
+ * non-network refresh failure verbatim (the tool has no friendlier wording).
+ */
+function toolRefreshSpec(provider) {
+    return {
+        provider,
+        noRefreshTokenError: () => new MoxxyError({
+            code: 'AUTH_EXPIRED',
+            message: `OAuth token for "${provider}" expired and no refresh_token is stored. Re-run oauth_authorize.`,
+            context: { provider },
+        }),
+        wrapRefreshFailure: (err) => err,
+        resolveExtras: (_merged, storedExtras) => Object.keys(storedExtras).length > 0 ? { ...storedExtras } : undefined,
+    };
+}
+function summarizeTokens(provider, tokens, opts = {}) {
+    return {
+        provider,
+        tokenType: tokens.tokenType,
+        expiresAt: tokens.expiresAt ?? null,
+        scope: tokens.scope ?? null,
+        hasRefreshToken: tokens.refreshToken !== undefined,
+        // The actual access_token only flows through `oauth_get_token`
+        // (the model needs it to make API calls). For `oauth_authorize`
+        // the response is a confirmation; the token stays in the vault.
+        ...(opts.includeAccess
+            ? { accessToken: tokens.accessToken, ...(tokens.idToken ? { idToken: tokens.idToken } : {}) }
+            : {}),
+        ...(opts.includeRefresh && tokens.refreshToken !== undefined
+            ? { refreshToken: tokens.refreshToken }
+            : {}),
+    };
+}
+//# sourceMappingURL=tools.js.map

package/dist/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,YAAY,CAAC;AAEvD,OAAO,EACL,YAAY,EACZ,wBAAwB,EACxB,iBAAiB,GAGlB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EACL,gBAAgB,EAChB,SAAS,EACT,eAAe,EACf,aAAa,EACb,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAoB,MAAM,mBAAmB,CAAC;AAMtE,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,QAAQ,CACP,4EAA4E;IAC1E,iEAAiE,CACpE,CAAC;AAEJ,MAAM,UAAU,uBAAuB,CAAC,IAAmB;IACzD,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,wEAAwE;YACxE,qEAAqE;YACrE,sEAAsE;YACtE,gEAAgE;YAChE,wEAAwE;YACxE,0EAA0E;QAC5E,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,QAAQ,EAAE,iBAAiB;YAC3B,OAAO,EAAE,CAAC;iBACP,MAAM,EAAE;iBACR,GAAG,EAAE;iBACL,QAAQ,EAAE;iBACV,QAAQ,CACP,oEAAoE;gBAClE,mDAAmD,CACtD;YACH,QAAQ,EAAE,CAAC;iBACR,MAAM,EAAE;iBACR,GAAG,EAAE;iBACL,QAAQ,CAAC,mEAAmE,CAAC;YAChF,SAAS,EAAE,CAAC;iBACT,MAAM,EAAE;iBACR,GAAG,EAAE;iBACL,QAAQ,EAAE;iBACV,QAAQ,CACP,yEAAyE;gBACvE,gDAAgD,CACnD;YACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3B,YAAY,EAAE,CAAC;iBACZ,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,6GAA6G,CAAC;YAC1H,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzC,IAAI,EAAE,CAAC;iBACJ,IAAI,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;iBAC5B,QAAQ,EAAE;iBACV,QAAQ,CACP,mEAAmE;gBACjE,mEAAmE;gBACnE,mEAAmE,CACtE;YACH,YAAY,EAAE,CAAC;iBACZ,MAAM,EAAE;iBACR,GAAG,EAAE;iBACL,QAAQ,EAAE;iBACV,GAAG,CAAC,KAAK,CAAC;iBACV,QAAQ,EAAE;iBACV,QAAQ,CAAC,8FAA8F,CAAC;YAC3G,YAAY,EAAE,CAAC;iBACZ,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,mDAAmD,CAAC;YAChE,eAAe,EAAE,CAAC;iBACf,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;iBAC9B,QAAQ,EAAE;iBACV,QAAQ,CACP,2FAA2F;gBACzF,0DAA0D,CAC7D;YACH,MAAM,EAAE,CAAC;iBACN,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,QAAQ,CACP,qEAAqE;gBACnE,qEAAqE;gBACrE,8CAA8C,CACjD;SACJ,CAAC;QACF,UAAU,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;QAChC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG;YACtB,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,UAAU,CAAC;YAEtC,IAAI,MAAgB,CAAC;YACrB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;oBACrB,MAAM,IAAI,UAAU,CAAC;wBACnB,IAAI,EAAE,YAAY;wBAClB,OAAO,EAAE,oFAAoF;qBAC9F,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,GAAG,MAAM,iBAAiB,CAAC;oBAC/B,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnE,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7C,QAAQ,EAAE,CAAC,IAAkB,EAAE,EAAE;wBAC/B,4DAA4D;wBAC5D,4DAA4D;wBAC5D,qDAAqD;wBACrD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE;4BAC1D,eAAe,EAAE,IAAI,CAAC,eAAe;4BACrC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,IAAI,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BAClG,QAAQ,EAAE,IAAI,CAAC,QAAQ;4BACvB,YAAY,EAAE,IAAI,CAAC,SAAS;yBAC7B,CAAC,CAAC;wBACH,uDAAuD;wBACvD,qDAAqD;wBACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,YAAY,IAAI,CAAC,eAAe,oBAAoB,IAAI,CAAC,QAAQ,IAAI;4BACnE,CAAC,IAAI,CAAC,uBAAuB;gCAC3B,CAAC,CAAC,yBAAyB,IAAI,CAAC,uBAAuB,KAAK;gCAC5D,CAAC,CAAC,EAAE,CAAC;4BACP,qBAAqB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC,QAAQ,CAC/D,CAAC;oBACJ,CAAC;iBACF,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;oBACnB,MAAM,IAAI,UAAU,CAAC;wBACnB,IAAI,EAAE,YAAY;wBAClB,OAAO,EAAE,6EAA6E;qBACvF,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;oBACjB,oDAAoD;oBACpD,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;oBACxC,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;oBAC9B,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;oBAC3D,MAAM,SAAS,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;oBACjD,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC;oBACxC,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,IAAI,WAAW,CAAC;oBAC/C,MAAM,GAAG,GAAG,YAAY,CAAC;wBACvB,OAAO,EAAE,KAAK,CAAC,OAAO;wBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;wBACxB,WAAW,EAAE,oBAAoB,IAAI,GAAG,IAAI,EAAE;wBAC9C,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,aAAa,EAAE,SAAS;wBACxB,KAAK;wBACL,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC7E,CAAC,CAAC;oBACH,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;oBACpE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mDAAmD,GAAG,MAAM,CAAC,CAAC;gBACrF,CAAC;gBACD,MAAM,GAAG,MAAM,wBAAwB,CAAC;oBACtC,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnE,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjF,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjF,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5E,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7C,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;wBACjB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;oBAC/D,CAAC;iBACF,CAAC,CAAC;YACL,CAAC;YAED,MAAM,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE;gBACtD,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CAAC;YAEH,OAAO,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjD,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAmB;IACxD,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,oEAAoE;YACpE,wEAAwE;YACxE,uEAAuE;YACvE,iDAAiD;QACnD,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,QAAQ,EAAE,iBAAiB;YAC3B,YAAY,EAAE,CAAC;iBACZ,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,QAAQ,CAAC,uDAAuD,CAAC;YACpE,cAAc,EAAE,CAAC;iBACd,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,QAAQ,CACP,mEAAmE;gBACjE,iEAAiE;gBACjE,mEAAmE;gBACnE,uDAAuD,CAC1D;SACJ,CAAC;QACF,UAAU,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;QAChC,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,cAAc,EAAE,EAAE,IAAI;YAC5D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,UAAU,CAAC;oBACnB,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,oCAAoC,QAAQ,+BAA+B;oBACpF,OAAO,EAAE,EAAE,QAAQ,EAAE;iBACtB,CAAC,CAAC;YACL,CAAC;YACD,0EAA0E;YAC1E,yEAAyE;YACzE,0EAA0E;YAC1E,yEAAyE;YACzE,0EAA0E;YAC1E,uEAAuE;YACvE,oEAAoE;YACpE,iEAAiE;YACjE,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjD,OAAO,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;oBAChD,aAAa,EAAE,IAAI;oBACnB,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpD,CAAC,CAAC;YACL,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,SAAS,QAAQ,EAAE,EAAE,KAAK,IAAI,EAAE;gBACtE,sEAAsE;gBACtE,oEAAoE;gBACpE,kEAAkE;gBAClE,MAAM,OAAO,GAAG,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,IAAI,MAAM,CAAC;gBACxE,MAAM,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,KAAK,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;gBACtF,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,YAAY,IAAI,gBAAgB,CAAC,EAAE,CAAC;oBACxE,OAAO,OAAO,CAAC,QAAQ,CAAC;gBAC1B,CAAC;gBACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;gBACzF,OAAO,MAAM,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,OAAO,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE;gBACvC,aAAa,EAAE,IAAI;gBACnB,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpD,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAmB;IACrD,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,uEAAuE;YACvE,uEAAuE;YACvE,oDAAoD;QACtD,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC;QACtD,UAAU,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;QAChC,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE;YACxB,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC7D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;QACtD,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,QAAgB;IACvC,OAAO;QACL,QAAQ;QACR,mBAAmB,EAAE,GAAG,EAAE,CACxB,IAAI,UAAU,CAAC;YACb,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,oBAAoB,QAAQ,mEAAmE;YACxG,OAAO,EAAE,EAAE,QAAQ,EAAE;SACtB,CAAC;QACJ,kBAAkB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG;QAChC,aAAa,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,CACvC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS;KACzE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,QAAgB,EAChB,MAAgB,EAChB,OAA8D,EAAE;IAEhE,OAAO;QACL,QAAQ;QACR,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;QACnC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;QAC3B,eAAe,EAAE,MAAM,CAAC,YAAY,KAAK,SAAS;QAClD,+DAA+D;QAC/D,gEAAgE;QAChE,gEAAgE;QAChE,GAAG,CAAC,IAAI,CAAC,aAAa;YACpB,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YAC7F,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS;YAC1D,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;YACvC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,73 @@
+{
+  "name": "@moxxy/plugin-oauth",
+  "version": "0.0.33",
+  "description": "Generic OAuth 2.0 + PKCE client. Loopback callback server, vault-backed token storage, refresh helpers. Bundled skills for Google Workspace + arbitrary providers.",
+  "keywords": [
+    "moxxy",
+    "oauth",
+    "pkce",
+    "auth",
+    "plugin"
+  ],
+  "homepage": "https://moxxy.ai",
+  "bugs": {
+    "url": "https://github.com/moxxy-ai/moxxy/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/moxxy-ai/moxxy.git",
+    "directory": "packages/plugin-oauth"
+  },
+  "author": "Michal Makowski <michal.makowski97@gmail.com>",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./skills/*": "./skills/*"
+  },
+  "files": [
+    "dist",
+    "src",
+    "skills"
+  ],
+  "moxxy": {
+    "plugin": {
+      "entry": "./dist/index.js",
+      "kind": "tools",
+      "skills": "./skills"
+    },
+    "requirements": [
+      {
+        "kind": "plugin",
+        "name": "@moxxy/plugin-vault",
+        "hint": "oauth resolves the vault from the service registry to store tokens; @moxxy/plugin-vault must load first"
+      }
+    ]
+  },
+  "dependencies": {
+    "zod": "^3.24.0",
+    "@moxxy/sdk": "0.21.1",
+    "@moxxy/plugin-vault": "0.0.33"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "typescript": "^5.7.3",
+    "vitest": "^2.1.8",
+    "@moxxy/tsconfig": "0.0.0",
+    "@moxxy/vitest-preset": "0.0.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "clean": "rm -rf dist .turbo"
+  }
+}