@nodetool-ai/runtime 0.7.0-rc.23 → 0.8.1

package/dist/providers/oauth/local-callback-server.js

@@ -0,0 +1,148 @@
+/**
+ * LocalCallbackServer — a single-shot localhost HTTP listener that receives the
+ * OAuth redirect, validates the CSRF `state`, and resolves with the
+ * authorization code.
+ *
+ * Lifecycle is explicit: `listen()` → `waitForCode()` → `close()`. The server
+ * binds to loopback only, serves exactly one callback, and then becomes inert.
+ * No module-level state — each login owns its own instance.
+ */
+import { createServer } from "node:http";
+import { AuthorizationDeniedError, CallbackTimeoutError, OAuthError, StateMismatchError } from "./errors.js";
+const DEFAULT_SUCCESS_HTML = "<!doctype html><meta charset=utf-8><title>NodeTool</title>" +
+    "<body style=\"font-family:system-ui;text-align:center;padding-top:3rem\">" +
+    "<h2>Authentication complete</h2><p>You can close this tab and return to NodeTool.</p></body>";
+const DEFAULT_FAILURE_HTML = "<!doctype html><meta charset=utf-8><title>NodeTool</title>" +
+    "<body style=\"font-family:system-ui;text-align:center;padding-top:3rem\">" +
+    "<h2>Authentication failed</h2><p>You can close this tab and return to NodeTool.</p></body>";
+export class LocalCallbackServer {
+    host;
+    requestedPort;
+    path;
+    successHtml;
+    failureHtml;
+    logger;
+    server = null;
+    boundPort = null;
+    constructor(options = {}) {
+        this.host = options.host ?? "127.0.0.1";
+        this.requestedPort = options.port ?? 0;
+        this.path = options.path ?? "/callback";
+        this.successHtml = options.successHtml ?? DEFAULT_SUCCESS_HTML;
+        this.failureHtml = options.failureHtml ?? DEFAULT_FAILURE_HTML;
+        this.logger = options.logger;
+    }
+    /** Start listening. Resolves with the bound port and full redirect URI. */
+    async listen() {
+        if (this.server) {
+            throw new OAuthError("token_exchange_failed", "Callback server already listening");
+        }
+        const server = createServer();
+        this.server = server;
+        await new Promise((resolve, reject) => {
+            const onError = (err) => {
+                server.removeListener("listening", onListening);
+                reject(err);
+            };
+            const onListening = () => {
+                server.removeListener("error", onError);
+                resolve();
+            };
+            server.once("error", onError);
+            server.once("listening", onListening);
+            server.listen(this.requestedPort, this.host);
+        });
+        const address = server.address();
+        this.boundPort = address.port;
+        this.logger?.debug("Callback server listening", { host: this.host, port: address.port });
+        return { port: address.port, redirectUri: this.redirectUri() };
+    }
+    /** The redirect URI to register with the authorization server. */
+    redirectUri() {
+        if (this.boundPort == null) {
+            throw new OAuthError("token_exchange_failed", "Callback server is not listening yet");
+        }
+        return `http://${this.host}:${this.boundPort}${this.path}`;
+    }
+    /**
+     * Resolve when the browser hits the callback path with a matching `state`
+     * and an authorization `code`. Rejects on timeout, CSRF mismatch, an
+     * `error` param from the server, or external abort.
+     */
+    async waitForCode(options) {
+        const server = this.server;
+        if (!server) {
+            throw new OAuthError("token_exchange_failed", "Callback server is not listening");
+        }
+        return new Promise((resolve, reject) => {
+            let settled = false;
+            const onAbort = () => finish(() => reject(new OAuthError("callback_timeout", "Login aborted")));
+            const finish = (action) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                options.signal?.removeEventListener("abort", onAbort);
+                server.removeListener("request", onRequest);
+                action();
+            };
+            const timer = setTimeout(() => {
+                finish(() => reject(new CallbackTimeoutError()));
+            }, options.timeoutMs);
+            const onRequest = (req, res) => {
+                // Reconstruct the URL; host header is irrelevant for loopback parsing.
+                const url = new URL(req.url ?? "/", `http://${this.host}`);
+                if (url.pathname !== this.path) {
+                    res.writeHead(404).end();
+                    return;
+                }
+                const error = url.searchParams.get("error");
+                const code = url.searchParams.get("code");
+                const state = url.searchParams.get("state");
+                if (error) {
+                    this.respond(res, false);
+                    const denied = error === "access_denied"
+                        ? new AuthorizationDeniedError()
+                        : new OAuthError("authorization_denied", `Authorization server returned error: ${error}`);
+                    finish(() => reject(denied));
+                    return;
+                }
+                // CSRF: validate state BEFORE trusting the code.
+                if (!state || state !== options.expectedState) {
+                    this.respond(res, false);
+                    finish(() => reject(new StateMismatchError()));
+                    return;
+                }
+                if (!code) {
+                    this.respond(res, false);
+                    finish(() => reject(new OAuthError("authorization_denied", "Callback missing authorization code")));
+                    return;
+                }
+                this.respond(res, true);
+                finish(() => resolve({ code, state }));
+            };
+            server.on("request", onRequest);
+            if (options.signal) {
+                if (options.signal.aborted) {
+                    onAbort();
+                    return;
+                }
+                options.signal.addEventListener("abort", onAbort, { once: true });
+            }
+        });
+    }
+    /** Stop listening and release the port. Idempotent. */
+    async close() {
+        const server = this.server;
+        if (!server)
+            return;
+        this.server = null;
+        this.boundPort = null;
+        await new Promise((resolve) => server.close(() => resolve()));
+    }
+    respond(res, ok) {
+        res.writeHead(ok ? 200 : 400, { "content-type": "text/html; charset=utf-8" });
+        res.end(ok ? this.successHtml : this.failureHtml);
+    }
+}
+//# sourceMappingURL=local-callback-server.js.map

package/dist/providers/oauth/local-callback-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-callback-server.js","sourceRoot":"","sources":["../../../src/providers/oauth/local-callback-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AAGjG,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,UAAU,EACV,kBAAkB,EACnB,MAAM,aAAa,CAAC;AAiBrB,MAAM,oBAAoB,GACxB,4DAA4D;IAC5D,2EAA2E;IAC3E,8FAA8F,CAAC;AAEjG,MAAM,oBAAoB,GACxB,4DAA4D;IAC5D,2EAA2E;IAC3E,4FAA4F,CAAC;AAW/F,MAAM,OAAO,mBAAmB;IACb,IAAI,CAAS;IACb,aAAa,CAAS;IACtB,IAAI,CAAS;IACb,WAAW,CAAS;IACpB,WAAW,CAAS;IACpB,MAAM,CAAU;IACzB,MAAM,GAAkB,IAAI,CAAC;IAC7B,SAAS,GAAkB,IAAI,CAAC;IAExC,YAAY,OAAO,GAA+B,EAAE;QAClD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;QACxC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC/D,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC/D,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,MAAM;QACV,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,UAAU,CAAC,uBAAuB,EAAE,mCAAmC,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAErB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,OAAO,GAAG,CAAC,GAAU,EAAE,EAAE;gBAC7B,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;gBAChD,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,CAAC;YACF,MAAM,WAAW,GAAG,GAAG,EAAE;gBACvB,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACxC,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;QAChD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;QAC9B,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,2BAA2B,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACzF,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;IACjE,CAAC;IAED,kEAAkE;IAClE,WAAW;QACT,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,UAAU,CAAC,uBAAuB,EAAE,sCAAsC,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,UAAU,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7D,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,OAA2B;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,UAAU,CAAC,uBAAuB,EAAE,kCAAkC,CAAC,CAAC;QACpF,CAAC;QAED,OAAO,IAAI,OAAO,CAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1D,IAAI,OAAO,GAAG,KAAK,CAAC;YAEpB,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;YAEhG,MAAM,MAAM,GAAG,CAAC,MAAkB,EAAE,EAAE;gBACpC,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACtD,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;gBAC5C,MAAM,EAAE,CAAC;YACX,CAAC,CAAC;YAEF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC,CAAC;YACnD,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;YAEtB,MAAM,SAAS,GAAG,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;gBAC9D,uEAAuE;gBACvE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC3D,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;oBAC/B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;oBACzB,OAAO;gBACT,CAAC;gBAED,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAE5C,IAAI,KAAK,EAAE,CAAC;oBACV,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;oBACzB,MAAM,MAAM,GACV,KAAK,KAAK,eAAe;wBACvB,CAAC,CAAC,IAAI,wBAAwB,EAAE;wBAChC,CAAC,CAAC,IAAI,UAAU,CAAC,sBAAsB,EAAE,wCAAwC,KAAK,EAAE,CAAC,CAAC;oBAC9F,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;oBAC7B,OAAO;gBACT,CAAC;gBAED,iDAAiD;gBACjD,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC;oBAC9C,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;oBACzB,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,kBAAkB,EAAE,CAAC,CAAC,CAAC;oBAC/C,OAAO;gBACT,CAAC;gBAED,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;oBACzB,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,sBAAsB,EAAE,qCAAqC,CAAC,CAAC,CAAC,CAAC;oBACpG,OAAO;gBACT,CAAC;gBAED,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACxB,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YACzC,CAAC,CAAC;YAEF,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAEhC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC3B,OAAO,EAAE,CAAC;oBACV,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,uDAAuD;IACvD,KAAK,CAAC,KAAK;QACT,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC;IAEO,OAAO,CAAC,GAAmB,EAAE,EAAW;QAC9C,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC9E,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACpD,CAAC;CACF"}

package/dist/providers/oauth/oauth-client.d.ts

@@ -0,0 +1,55 @@
+/**
+ * OAuthClient — the protocol layer. Builds authorization URLs and performs the
+ * token-endpoint round-trips (code exchange, refresh, revoke).
+ *
+ * It is pure protocol: no browser, no storage, no provider awareness. `fetch`
+ * and the clock are injected so the whole thing is deterministically testable,
+ * and every failure is mapped to a typed error. Tokens are never logged.
+ */
+import { type Logger } from "@nodetool-ai/config";
+import { type AuthorizationUrlParams, type Clock, type OAuthClientConfig, type OAuthTokens } from "./types.js";
+/** Minimal `fetch` surface this client needs — satisfied by global `fetch`. */
+export type FetchLike = (input: string, init: {
+    method: string;
+    headers: Record<string, string>;
+    body: string;
+    signal?: AbortSignal;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+    /** Decode the body as the caller's named response type. */
+    json<TBody>(): Promise<TBody>;
+    text(): Promise<string>;
+}>;
+export interface OAuthClientOptions {
+    readonly config: OAuthClientConfig;
+    /** Injected fetch. Defaults to the global. */
+    readonly fetchFn?: FetchLike;
+    readonly clock?: Clock;
+    readonly logger?: Logger;
+}
+export declare class OAuthClient {
+    private readonly config;
+    private readonly fetchFn;
+    private readonly clock;
+    private readonly logger;
+    constructor(options: OAuthClientOptions);
+    /** Build the authorization-endpoint URL the browser should open. */
+    buildAuthorizationUrl(params: AuthorizationUrlParams): string;
+    /** Exchange an authorization code for an initial token set. */
+    exchangeAuthorizationCode(params: {
+        code: string;
+        codeVerifier: string;
+        redirectUri: string;
+        signal?: AbortSignal;
+    }): Promise<OAuthTokens>;
+    /** Exchange a refresh token for a fresh access token. */
+    refreshAccessToken(refreshToken: string, signal?: AbortSignal): Promise<OAuthTokens>;
+    /** Best-effort RFC 7009 token revocation. No-op if no endpoint configured. */
+    revokeToken(token: string, tokenTypeHint?: "access_token" | "refresh_token", signal?: AbortSignal): Promise<void>;
+    private tokenRequest;
+    private readJson;
+    private mapErrorResponse;
+    private normalizeTokens;
+}
+//# sourceMappingURL=oauth-client.d.ts.map

package/dist/providers/oauth/oauth-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-client.d.ts","sourceRoot":"","sources":["../../../src/providers/oauth/oauth-client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAUhE,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,KAAK,EACV,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAEjB,MAAM,YAAY,CAAC;AAEpB,+EAA+E;AAC/E,MAAM,MAAM,SAAS,GAAG,CACtB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACJ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,KACE,OAAO,CAAC;IACX,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,IAAI,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACzB,CAAC,CAAC;AAEH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,8CAA8C;IAC9C,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAaD,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoB;IAC3C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAY;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC,YAAY,OAAO,EAAE,kBAAkB,EAKtC;IAED,oEAAoE;IACpE,qBAAqB,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,CAe5D;IAED,+DAA+D;IACzD,yBAAyB,CAAC,MAAM,EAAE;QACtC,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,EAAE,MAAM,CAAC;QACrB,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,WAAW,CAAC;KACtB,GAAG,OAAO,CAAC,WAAW,CAAC,CASvB;IAED,yDAAyD;IACnD,kBAAkB,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAUzF;IAED,8EAA8E;IACxE,WAAW,CACf,KAAK,EAAE,MAAM,EACb,aAAa,GAAE,cAAc,GAAG,eAAiC,EACjE,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,IAAI,CAAC,CAsBf;YAEa,YAAY;YA0BZ,QAAQ;IAStB,OAAO,CAAC,gBAAgB;IA4BxB,OAAO,CAAC,eAAe;CAgBxB"}

package/dist/providers/oauth/oauth-client.js

@@ -0,0 +1,161 @@
+/**
+ * OAuthClient — the protocol layer. Builds authorization URLs and performs the
+ * token-endpoint round-trips (code exchange, refresh, revoke).
+ *
+ * It is pure protocol: no browser, no storage, no provider awareness. `fetch`
+ * and the clock are injected so the whole thing is deterministically testable,
+ * and every failure is mapped to a typed error. Tokens are never logged.
+ */
+import { createLogger } from "@nodetool-ai/config";
+import { isNonEmptyString, isNumber, isString } from "@nodetool-ai/protocol";
+import { CredentialsRevokedError, InvalidRefreshTokenError, OAuthNetworkError, TokenExchangeError } from "./errors.js";
+import { redactObject } from "./redaction.js";
+import { systemClock } from "./types.js";
+export class OAuthClient {
+    config;
+    fetchFn;
+    clock;
+    logger;
+    constructor(options) {
+        this.config = options.config;
+        this.fetchFn = options.fetchFn ?? globalThis.fetch;
+        this.clock = options.clock ?? systemClock;
+        this.logger = options.logger ?? createLogger("nodetool.runtime.oauth.client");
+    }
+    /** Build the authorization-endpoint URL the browser should open. */
+    buildAuthorizationUrl(params) {
+        const url = new URL(this.config.authorizationEndpoint);
+        const q = url.searchParams;
+        q.set("response_type", "code");
+        q.set("client_id", this.config.clientId);
+        q.set("redirect_uri", params.redirectUri);
+        q.set("scope", this.config.scopes.join(" "));
+        q.set("state", params.state);
+        q.set("code_challenge", params.codeChallenge);
+        q.set("code_challenge_method", params.codeChallengeMethod);
+        if (this.config.audience)
+            q.set("audience", this.config.audience);
+        for (const [k, v] of Object.entries(this.config.extraAuthParams ?? {})) {
+            q.set(k, v);
+        }
+        return url.toString();
+    }
+    /** Exchange an authorization code for an initial token set. */
+    async exchangeAuthorizationCode(params) {
+        const body = new URLSearchParams({
+            grant_type: "authorization_code",
+            code: params.code,
+            redirect_uri: params.redirectUri,
+            client_id: this.config.clientId,
+            code_verifier: params.codeVerifier
+        });
+        return this.tokenRequest(body, params.signal, "exchange");
+    }
+    /** Exchange a refresh token for a fresh access token. */
+    async refreshAccessToken(refreshToken, signal) {
+        const body = new URLSearchParams({
+            grant_type: "refresh_token",
+            refresh_token: refreshToken,
+            client_id: this.config.clientId
+        });
+        if (this.config.scopes.length > 0) {
+            body.set("scope", this.config.scopes.join(" "));
+        }
+        return this.tokenRequest(body, signal, "refresh");
+    }
+    /** Best-effort RFC 7009 token revocation. No-op if no endpoint configured. */
+    async revokeToken(token, tokenTypeHint = "refresh_token", signal) {
+        if (!this.config.revocationEndpoint)
+            return;
+        const body = new URLSearchParams({
+            token,
+            token_type_hint: tokenTypeHint,
+            client_id: this.config.clientId
+        });
+        let res;
+        try {
+            res = await this.fetchFn(this.config.revocationEndpoint, {
+                method: "POST",
+                headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+                body: body.toString(),
+                signal
+            });
+        }
+        catch (err) {
+            throw new OAuthNetworkError("Network error during token revocation", { cause: err });
+        }
+        // RFC 7009: the server returns 200 even for an already-invalid token.
+        if (!res.ok) {
+            this.logger.warn("Token revocation returned a non-OK status", { status: res.status });
+        }
+    }
+    async tokenRequest(body, signal, kind) {
+        let res;
+        try {
+            res = await this.fetchFn(this.config.tokenEndpoint, {
+                method: "POST",
+                headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+                body: body.toString(),
+                signal
+            });
+        }
+        catch (err) {
+            throw new OAuthNetworkError(`Network error during token ${kind}`, { cause: err });
+        }
+        const payload = await this.readJson(res);
+        if (!res.ok) {
+            throw this.mapErrorResponse(res.status, payload, kind);
+        }
+        return this.normalizeTokens(payload, kind);
+    }
+    async readJson(res) {
+        try {
+            return await res.json();
+        }
+        catch {
+            // Some servers send an empty / non-JSON error body.
+            return {};
+        }
+    }
+    mapErrorResponse(status, payload, kind) {
+        const code = isString(payload.error) ? payload.error : undefined;
+        const description = isString(payload.error_description) ? payload.error_description : undefined;
+        // Never include the raw body in the message; log a redacted copy instead.
+        this.logger.warn("Token endpoint returned an error", {
+            status,
+            kind,
+            error: code,
+            body: redactObject(payload)
+        });
+        const message = description ? `Token ${kind} failed: ${code ?? status}` : `Token ${kind} failed (${status})`;
+        if (code === "invalid_grant") {
+            return kind === "refresh"
+                ? new InvalidRefreshTokenError(message)
+                : new TokenExchangeError(message);
+        }
+        if (code === "access_denied" || code === "revoked_token" || code === "invalid_client") {
+            return new CredentialsRevokedError(message);
+        }
+        if (status >= 500) {
+            return new OAuthNetworkError(`Token ${kind} failed: server error ${status}`);
+        }
+        return new TokenExchangeError(message);
+    }
+    normalizeTokens(payload, kind) {
+        const accessToken = payload.access_token;
+        if (!isNonEmptyString(accessToken)) {
+            throw new TokenExchangeError(`Token ${kind} response missing access_token`);
+        }
+        const receivedAt = this.clock.now();
+        const expiresIn = isNumber(payload.expires_in) ? payload.expires_in : null;
+        return {
+            accessToken,
+            refreshToken: isString(payload.refresh_token) ? payload.refresh_token : null,
+            tokenType: isString(payload.token_type) ? payload.token_type : "Bearer",
+            scope: isString(payload.scope) ? payload.scope : null,
+            expiresAt: expiresIn != null ? receivedAt + expiresIn * 1000 : null,
+            receivedAt
+        };
+    }
+}
+//# sourceMappingURL=oauth-client.js.map

package/dist/providers/oauth/oauth-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-client.js","sourceRoot":"","sources":["../../../src/providers/oauth/oauth-client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAe,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EAExB,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAKL,WAAW,EACZ,MAAM,YAAY,CAAC;AAsCpB,MAAM,OAAO,WAAW;IACL,MAAM,CAAoB;IAC1B,OAAO,CAAY;IACnB,KAAK,CAAQ;IACb,MAAM,CAAS;IAEhC,YAAY,OAA2B;QACrC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC;QACnD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,WAAW,CAAC;QAC1C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC,+BAA+B,CAAC,CAAC;IAChF,CAAC;IAED,oEAAoE;IACpE,qBAAqB,CAAC,MAA8B;QAClD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC;QAC3B,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC/B,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QAC1C,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7C,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9C,CAAC,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC3D,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;YACvE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACd,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,yBAAyB,CAAC,MAK/B;QACC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,oBAAoB;YAChC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,MAAM,CAAC,YAAY;SACnC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC5D,CAAC;IAED,yDAAyD;IACzD,KAAK,CAAC,kBAAkB,CAAC,YAAoB,EAAE,MAAoB;QACjE,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;YAC3B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;SAChC,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IACpD,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,WAAW,CACf,KAAa,EACb,aAAa,GAAqC,eAAe,EACjE,MAAoB;QAEpB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB;YAAE,OAAO;QAC5C,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,KAAK;YACL,eAAe,EAAE,aAAa;YAC9B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;SAChC,CAAC,CAAC;QACH,IAAI,GAAmC,CAAC;QACxC,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE;gBACvD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBAC5F,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;gBACrB,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,iBAAiB,CAAC,uCAAuC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,sEAAsE;QACtE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,IAAqB,EACrB,MAA+B,EAC/B,IAA4B;QAE5B,IAAI,GAAmC,CAAC;QACxC,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE;gBAClD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBAC5F,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;gBACrB,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAEzC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACzD,CAAC;QAED,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,GAAmC;QACxD,IAAI,CAAC;YACH,OAAO,MAAM,GAAG,CAAC,IAAI,EAAqB,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;YACpD,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,gBAAgB,CAAC,MAAc,EAAE,OAA0B,EAAE,IAAY;QAC/E,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACjE,MAAM,WAAW,GACf,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9E,0EAA0E;QAC1E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;YACnD,MAAM;YACN,IAAI;YACJ,KAAK,EAAE,IAAI;YACX,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC;SAC5B,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,SAAS,IAAI,YAAY,IAAI,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,YAAY,MAAM,GAAG,CAAC;QAE7G,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;YAC7B,OAAO,IAAI,KAAK,SAAS;gBACvB,CAAC,CAAC,IAAI,wBAAwB,CAAC,OAAO,CAAC;gBACvC,CAAC,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACtF,OAAO,IAAI,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YAClB,OAAO,IAAI,iBAAiB,CAAC,SAAS,IAAI,yBAAyB,MAAM,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IAEO,eAAe,CAAC,OAA0B,EAAE,IAAY;QAC9D,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,kBAAkB,CAAC,SAAS,IAAI,gCAAgC,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3E,OAAO;YACL,WAAW;YACX,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;YAC5E,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;YACvE,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;YACrD,SAAS,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI;YACnE,UAAU;SACX,CAAC;IACJ,CAAC;CACF"}

package/dist/providers/oauth/openai-oauth-provider.d.ts

@@ -0,0 +1,129 @@
+/**
+ * OpenAIOAuthProvider — an OpenAI provider authenticated by browser-based
+ * OAuth 2.0 (Authorization Code + PKCE) instead of a pasted API key.
+ *
+ * It extends `OpenAIProvider` so every model capability (chat, streaming,
+ * images, audio, embeddings) is inherited unchanged. The only thing it
+ * replaces is *where the bearer token comes from*: instead of a static API
+ * key, every request is served by a short-lived OAuth access token that is
+ * transparently refreshed when it expires.
+ *
+ * All collaborators are injected (OAuth client, token store, callback server,
+ * PKCE helper, browser launcher), so there is no module-level state and the
+ * whole thing is unit-testable without a network or a browser.
+ */
+import OpenAI from "openai";
+import { type Logger } from "@nodetool-ai/config";
+import { OpenAIProvider } from "../openai-provider.js";
+import type { LanguageModel, Message, ProviderId, ProviderStreamItem } from "../types.js";
+import { OAuthClient } from "./oauth-client.js";
+import { LocalCallbackServer } from "./local-callback-server.js";
+import { PKCEHelper } from "./pkce-helper.js";
+import type { TokenStore } from "./token-store.js";
+import type { BrowserLauncher } from "./browser-launcher.js";
+import { type Clock, type OAuthTokens } from "./types.js";
+export interface OpenAIOAuthProviderOptions {
+    /** Performs the OAuth protocol round-trips. */
+    readonly oauthClient: OAuthClient;
+    /** Persists / loads the token set (e.g. OS keychain-backed). */
+    readonly tokenStore: TokenStore;
+    /** Opens the authorization URL in the user's browser. */
+    readonly browserLauncher: BrowserLauncher;
+    /** Factory for a fresh single-shot callback server per login attempt. */
+    readonly callbackServerFactory: () => LocalCallbackServer;
+    /** PKCE + CSRF-state generator. */
+    readonly pkce?: PKCEHelper;
+    /** Builds an OpenAI SDK client from a bearer token. Injectable for tests. */
+    readonly openAIClientFactory?: (accessToken: string) => OpenAI;
+    /**
+     * Override the OpenAI SDK `baseURL`. Used to point the inherited OpenAI
+     * capabilities at an alternate backend (e.g. the ChatGPT Codex routes).
+     * Ignored when a custom `openAIClientFactory` is supplied.
+     */
+    readonly apiBaseUrl?: string;
+    /**
+     * Static headers sent on every request (e.g. a Codex `originator`). Ignored
+     * when a custom `openAIClientFactory` is supplied.
+     */
+    readonly apiHeaders?: Readonly<Record<string, string>>;
+    /**
+     * Per-token headers derived from the current access token (e.g. the ChatGPT
+     * `chatgpt-account-id` decoded from the JWT). Recomputed whenever the bearer
+     * changes. Ignored when a custom `openAIClientFactory` is supplied.
+     */
+    readonly dynamicApiHeaders?: (accessToken: string) => Record<string, string>;
+    readonly clock?: Clock;
+    readonly logger?: Logger;
+    /** Provider id reported to the rest of the system. Defaults to "openai". */
+    readonly providerId?: ProviderId;
+    /** Seconds of clock skew treated as "already expired". Defaults to 60. */
+    readonly expirySkewSeconds?: number;
+    /** Default browser timeout for `login()` in ms. Defaults to 300_000. */
+    readonly loginTimeoutMs?: number;
+}
+export interface LoginOptions {
+    readonly timeoutMs?: number;
+    readonly signal?: AbortSignal;
+}
+export declare class OpenAIOAuthProvider extends OpenAIProvider {
+    private readonly oauthClient;
+    private readonly tokenStore;
+    private readonly browserLauncher;
+    private readonly callbackServerFactory;
+    private readonly pkce;
+    private readonly openAIClientFactory;
+    private readonly clock;
+    private readonly oauthLogger;
+    private readonly expirySkewMs;
+    private readonly loginTimeoutMs;
+    /** In-memory session mirror of the persisted token set. */
+    private session;
+    /** Cached OpenAI client, keyed by the token it was built for. */
+    private oauthOpenAIClient;
+    private cachedForToken;
+    /** Single-flight guard so concurrent calls share one refresh round-trip. */
+    private refreshInFlight;
+    constructor(options: OpenAIOAuthProviderOptions);
+    /**
+     * Run the full browser OAuth flow: spin up a localhost callback server, open
+     * the browser, wait for the redirect, exchange the code, and persist tokens.
+     * Resolves with the (non-secret) token metadata on success.
+     */
+    login(options?: LoginOptions): Promise<{
+        scope: string | null;
+        expiresAt: number | null;
+    }>;
+    /** Whether a non-expired session is available without hitting the network. */
+    isAuthenticated(): Promise<boolean>;
+    /**
+     * Forget the session locally and, if the server exposes a revocation
+     * endpoint, revoke the refresh token. Always clears local storage even if
+     * remote revocation fails.
+     */
+    logout(): Promise<void>;
+    /**
+     * Return a valid access token, refreshing if expired. Throws
+     * `SessionExpiredError`/`NotAuthenticatedError` when re-login is required.
+     */
+    getAccessToken(): Promise<string>;
+    private currentTokens;
+    private isExpired;
+    private ensureValidSession;
+    /** Refresh the access token (single-flight). */
+    refresh(): Promise<OAuthTokens>;
+    private doRefresh;
+    private applyTokens;
+    private invalidate;
+    /** Build (and cache) an OpenAI SDK client bound to the current access token. */
+    getClient(): OpenAI;
+    /**
+     * The OAuth bearer is short-lived and must never be baked into a container's
+     * environment as if it were a durable API key. Code runners that need OpenAI
+     * access should refresh through the provider instead.
+     */
+    getContainerEnv(): {};
+    getAvailableLanguageModels(): Promise<LanguageModel[]>;
+    generateMessage(args: Parameters<OpenAIProvider["generateMessage"]>[0]): Promise<Message>;
+    generateMessages(args: Parameters<OpenAIProvider["generateMessages"]>[0]): AsyncGenerator<ProviderStreamItem>;
+}
+//# sourceMappingURL=openai-oauth-provider.d.ts.map

package/dist/providers/oauth/openai-oauth-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openai-oauth-provider.d.ts","sourceRoot":"","sources":["../../../src/providers/oauth/openai-oauth-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EACV,aAAa,EACb,OAAO,EACP,UAAU,EACV,kBAAkB,EACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAO7D,OAAO,EAAE,KAAK,KAAK,EAAE,KAAK,WAAW,EAAe,MAAM,YAAY,CAAC;AAKvE,MAAM,WAAW,0BAA0B;IACzC,+CAA+C;IAC/C,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,gEAAgE;IAChE,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,yDAAyD;IACzD,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,yEAAyE;IACzE,QAAQ,CAAC,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;IAC1D,mCAAmC;IACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC;IAC3B,6EAA6E;IAC7E,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACvD;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7E,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,0EAA0E;IAC1E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,wEAAwE;IACxE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED,qBAAa,mBAAoB,SAAQ,cAAc;IACrD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAC1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAa;IACxC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA4B;IAClE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAkC;IACtE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IAExC,2DAA2D;IAC3D,OAAO,CAAC,OAAO,CAA4B;IAC3C,iEAAiE;IACjE,OAAO,CAAC,iBAAiB,CAAuB;IAChD,OAAO,CAAC,cAAc,CAAuB;IAC7C,4EAA4E;IAC5E,OAAO,CAAC,eAAe,CAAqC;IAE5D,YAAY,OAAO,EAAE,0BAA0B,EAoC9C;IAID;;;;OAIG;IACG,KAAK,CACT,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAwC7D;IAED,8EAA8E;IACxE,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,CAGxC;IAED;;;;OAIG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAe5B;IAED;;;OAGG;IACG,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAGtC;YAIa,aAAa;IAO3B,OAAO,CAAC,SAAS;YAKH,kBAAkB;IAWhC,gDAAgD;IAC1C,OAAO,IAAI,OAAO,CAAC,WAAW,CAAC,CAMpC;YAEa,SAAS;YAiCT,WAAW;YAUX,UAAU;IASxB,gFAAgF;IACvE,SAAS,IAAI,MAAM,CAY3B;IAED;;;;OAIG;IACM,eAAe,OAEvB;IAEc,0BAA0B,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAepE;IAEc,eAAe,CAC5B,IAAI,EAAE,UAAU,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,GACrD,OAAO,CAAC,OAAO,CAAC,CAGlB;IAEe,gBAAgB,CAC9B,IAAI,EAAE,UAAU,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,GACtD,cAAc,CAAC,kBAAkB,CAAC,CAGpC;CACF"}