@nodetool-ai/runtime 0.7.0-rc.23 → 0.8.2

package/dist/providers/oauth/errors.js

@@ -0,0 +1,79 @@
+/**
+ * Typed error hierarchy for the OAuth subsystem.
+ *
+ * Every failure mode in the spec maps to a concrete subclass so callers can
+ * branch on `instanceof` (or on the stable `code`) rather than string-matching
+ * messages. Error messages NEVER contain token material — see `redaction.ts`.
+ */
+/** Base class for everything thrown by the OAuth subsystem. */
+export class OAuthError extends Error {
+    code;
+    constructor(code, message, options) {
+        super(message, options);
+        this.name = new.target.name;
+        this.code = code;
+        // Restore prototype chain for transpiled `extends Error`.
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+/** The stored refresh token was rejected by the server (invalid_grant). */
+export class InvalidRefreshTokenError extends OAuthError {
+    constructor(message = "Refresh token is invalid or expired", options) {
+        super("invalid_refresh_token", message, options);
+    }
+}
+/** No usable credentials in the store / access token expired with no refresh. */
+export class SessionExpiredError extends OAuthError {
+    constructor(message = "Session expired; re-authentication required", options) {
+        super("session_expired", message, options);
+    }
+}
+/** The default browser could not be launched for the authorization request. */
+export class BrowserLaunchError extends OAuthError {
+    constructor(message = "Failed to open the browser for authentication", options) {
+        super("browser_launch_failed", message, options);
+    }
+}
+/** The user did not complete the browser flow within the allotted time. */
+export class CallbackTimeoutError extends OAuthError {
+    constructor(message = "Timed out waiting for the OAuth callback", options) {
+        super("callback_timeout", message, options);
+    }
+}
+/** A network-level failure (DNS, TLS, connection reset) talking to the server. */
+export class OAuthNetworkError extends OAuthError {
+    constructor(message = "Network error during OAuth request", options) {
+        super("network_error", message, options);
+    }
+}
+/** The credentials were revoked server-side (access_denied / revoked grant). */
+export class CredentialsRevokedError extends OAuthError {
+    constructor(message = "Credentials were revoked", options) {
+        super("credentials_revoked", message, options);
+    }
+}
+/** CSRF guard: the `state` returned to the callback did not match. */
+export class StateMismatchError extends OAuthError {
+    constructor(message = "OAuth state mismatch — possible CSRF", options) {
+        super("state_mismatch", message, options);
+    }
+}
+/** The user denied the authorization request in the browser. */
+export class AuthorizationDeniedError extends OAuthError {
+    constructor(message = "Authorization was denied", options) {
+        super("authorization_denied", message, options);
+    }
+}
+/** The authorization-code → token exchange failed for a non-network reason. */
+export class TokenExchangeError extends OAuthError {
+    constructor(message = "Failed to exchange authorization code for tokens", options) {
+        super("token_exchange_failed", message, options);
+    }
+}
+/** A request requiring authentication was made before login completed. */
+export class NotAuthenticatedError extends OAuthError {
+    constructor(message = "Not authenticated; call login() first", options) {
+        super("not_authenticated", message, options);
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/providers/oauth/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/providers/oauth/errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAcH,+DAA+D;AAC/D,MAAM,OAAO,UAAW,SAAQ,KAAK;IAC1B,IAAI,CAAiB;IAE9B,YAAY,IAAoB,EAAE,OAAe,EAAE,OAAsB;QACvE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,0DAA0D;QAC1D,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,2EAA2E;AAC3E,MAAM,OAAO,wBAAyB,SAAQ,UAAU;IACtD,YAAY,OAAO,GAAG,qCAAqC,EAAE,OAAsB;QACjF,KAAK,CAAC,uBAAuB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,OAAO,mBAAoB,SAAQ,UAAU;IACjD,YAAY,OAAO,GAAG,6CAA6C,EAAE,OAAsB;QACzF,KAAK,CAAC,iBAAiB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;CACF;AAED,+EAA+E;AAC/E,MAAM,OAAO,kBAAmB,SAAQ,UAAU;IAChD,YAAY,OAAO,GAAG,+CAA+C,EAAE,OAAsB;QAC3F,KAAK,CAAC,uBAAuB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;CACF;AAED,2EAA2E;AAC3E,MAAM,OAAO,oBAAqB,SAAQ,UAAU;IAClD,YAAY,OAAO,GAAG,0CAA0C,EAAE,OAAsB;QACtF,KAAK,CAAC,kBAAkB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;CACF;AAED,kFAAkF;AAClF,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC/C,YAAY,OAAO,GAAG,oCAAoC,EAAE,OAAsB;QAChF,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;CACF;AAED,gFAAgF;AAChF,MAAM,OAAO,uBAAwB,SAAQ,UAAU;IACrD,YAAY,OAAO,GAAG,0BAA0B,EAAE,OAAsB;QACtE,KAAK,CAAC,qBAAqB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;CACF;AAED,sEAAsE;AACtE,MAAM,OAAO,kBAAmB,SAAQ,UAAU;IAChD,YAAY,OAAO,GAAG,sCAAsC,EAAE,OAAsB;QAClF,KAAK,CAAC,gBAAgB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;CACF;AAED,gEAAgE;AAChE,MAAM,OAAO,wBAAyB,SAAQ,UAAU;IACtD,YAAY,OAAO,GAAG,0BAA0B,EAAE,OAAsB;QACtE,KAAK,CAAC,sBAAsB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;CACF;AAED,+EAA+E;AAC/E,MAAM,OAAO,kBAAmB,SAAQ,UAAU;IAChD,YAAY,OAAO,GAAG,kDAAkD,EAAE,OAAsB;QAC9F,KAAK,CAAC,uBAAuB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;CACF;AAED,0EAA0E;AAC1E,MAAM,OAAO,qBAAsB,SAAQ,UAAU;IACnD,YAAY,OAAO,GAAG,uCAAuC,EAAE,OAAsB;QACnF,KAAK,CAAC,mBAAmB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;CACF"}

package/dist/providers/oauth/index.d.ts

@@ -0,0 +1,105 @@
+/**
+ * OpenAI OAuth subsystem — public surface.
+ *
+ * Layers (each depends only on the one below, via interfaces):
+ *
+ *   OpenAIOAuthProvider          orchestration + OpenAI capability inheritance
+ *     ├─ OAuthClient             OAuth 2.0 protocol (PKCE code exchange/refresh)
+ *     ├─ PKCEHelper              PKCE + CSRF-state generation
+ *     ├─ LocalCallbackServer     localhost redirect receiver
+ *     ├─ BrowserLauncher         opens the system browser
+ *     └─ TokenStore              token persistence
+ *          └─ SecureCredentialStore   opaque secret persistence (OS keychain)
+ *
+ * `createOpenAIOAuthProvider` wires production defaults; every collaborator can
+ * be overridden for testing or alternate hosts.
+ */
+import { type Logger } from "@nodetool-ai/config";
+import { CODEX_OAUTH_CLIENT_ID, CODEX_BACKEND_BASE_URL, CODEX_CALLBACK_PORT, CODEX_CALLBACK_PATH } from "@nodetool-ai/protocol";
+import { type BrowserLauncher } from "./browser-launcher.js";
+import { type SecureCredentialStore } from "./secure-credential-store.js";
+import { type TokenStore } from "./token-store.js";
+import { OpenAIOAuthProvider } from "./openai-oauth-provider.js";
+import type { OAuthClientConfig } from "./types.js";
+export * from "./types.js";
+export * from "./errors.js";
+export { decodeJwtPayload, extractChatGptAccountId } from "./jwt-claims.js";
+export { redactToken, redactObject } from "./redaction.js";
+export { PKCEHelper, nodeRandomSource, type RandomSource } from "./pkce-helper.js";
+export { OAuthClient, type OAuthClientOptions, type FetchLike } from "./oauth-client.js";
+export { LocalCallbackServer, type LocalCallbackServerOptions, type WaitForCodeOptions } from "./local-callback-server.js";
+export { DefaultBrowserLauncher, type BrowserLauncher } from "./browser-launcher.js";
+export { KeychainSecureCredentialStore, InMemorySecureCredentialStore, type SecureCredentialStore, type KeyringBackend } from "./secure-credential-store.js";
+export { SecureTokenStore, InMemoryTokenStore, type TokenStore } from "./token-store.js";
+export { OpenAIOAuthProvider, type OpenAIOAuthProviderOptions, type LoginOptions } from "./openai-oauth-provider.js";
+export { ClaudeCodeOAuthClient, type AuthorizationUrlOptions, type ClaudeCodeLoginMethod, type ClaudeCodeProfile, type ClaudeCodeTokenAccount, type ClaudeCodeTokens, type JsonFetchLike } from "./claude-code-oauth-client.js";
+export { ClaudeCodeCredentialsStore, claudeConfigDir, isExpired as areClaudeCredentialsExpired, type ClaudeAiOAuthCredentials } from "./claude-code-credentials.js";
+export { ClaudeCodeLogin, parsePastedCode, CLAUDE_LOGIN_TIMEOUT_MS, type ClaudeCodeAuthStatus, type ClaudeCodeLoginDeps, type ClaudeCodeLoginOptions, type PendingClaudeCodeLogin } from "./claude-code-login.js";
+/**
+ * Default OAuth endpoints for OpenAI. These are configuration, not contracts —
+ * override them via `createOpenAIOAuthProvider({ oauthConfig })` if OpenAI's
+ * published endpoints differ for your tenant.
+ */
+export declare const DEFAULT_OPENAI_OAUTH_CONFIG: Omit<OAuthClientConfig, "clientId">;
+export interface CreateOpenAIOAuthProviderOptions {
+    /** OAuth client id registered with OpenAI. */
+    readonly clientId: string;
+    /** Account identifier used to namespace stored tokens (e.g. user id). */
+    readonly accountId?: string;
+    /** Override any part of the OAuth endpoint config. */
+    readonly oauthConfig?: Partial<OAuthClientConfig>;
+    /** Override token persistence (defaults to OS keychain). */
+    readonly tokenStore?: TokenStore;
+    /** Override the secret backend used by the default token store. */
+    readonly credentialStore?: SecureCredentialStore;
+    /** Override the browser launcher. */
+    readonly browserLauncher?: BrowserLauncher;
+    /** Fixed callback port/path, if OpenAI requires a pre-registered redirect. */
+    readonly callbackPort?: number;
+    readonly callbackPath?: string;
+    readonly logger?: Logger;
+}
+/** Wire an {@link OpenAIOAuthProvider} with production defaults. */
+export declare function createOpenAIOAuthProvider(options: CreateOpenAIOAuthProviderOptions): OpenAIOAuthProvider;
+export { CODEX_OAUTH_CLIENT_ID, CODEX_BACKEND_BASE_URL, CODEX_CALLBACK_PORT, CODEX_CALLBACK_PATH };
+/**
+ * `originator` the ChatGPT backend expects from a Codex client. A non-Codex
+ * value (e.g. `pi`) is rejected with 403, so we present as the Codex CLI.
+ * Override via `CODEX_ORIGINATOR` env for resilience if the backend tightens.
+ */
+export declare const CODEX_ORIGINATOR: string;
+/**
+ * OAuth endpoint configuration for the Codex CLI client. Scopes and the extra
+ * authorization params mirror what the Codex CLI sends; `clientId` is filled in
+ * by {@link createCodexOAuthProvider}.
+ */
+export declare const DEFAULT_CODEX_OAUTH_CONFIG: Omit<OAuthClientConfig, "clientId">;
+export interface CreateCodexOAuthProviderOptions {
+    /** Override the published Codex client id. */
+    readonly clientId?: string;
+    /** Account identifier used to namespace stored tokens. */
+    readonly accountId?: string;
+    /** Override any part of the OAuth endpoint config. */
+    readonly oauthConfig?: Partial<OAuthClientConfig>;
+    /** Override the ChatGPT Codex backend base URL. */
+    readonly backendBaseUrl?: string;
+    /** Override the `originator` header value. */
+    readonly originator?: string;
+    /** Override token persistence (defaults to OS keychain). */
+    readonly tokenStore?: TokenStore;
+    /** Override the secret backend used by the default token store. */
+    readonly credentialStore?: SecureCredentialStore;
+    /** Override the browser launcher. */
+    readonly browserLauncher?: BrowserLauncher;
+    readonly logger?: Logger;
+}
+/**
+ * Wire an {@link OpenAIOAuthProvider} that authenticates with the public Codex
+ * CLI client and routes requests to the ChatGPT Codex backend.
+ *
+ * The callback server is pinned to the Codex-registered loopback redirect
+ * (port 1455, `/auth/callback`); every request carries the Codex `originator`
+ * and the `chatgpt-account-id` decoded from the access-token JWT.
+ */
+export declare function createCodexOAuthProvider(options?: CreateCodexOAuthProviderOptions): OpenAIOAuthProvider;
+//# sourceMappingURL=index.d.ts.map

package/dist/providers/oauth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/providers/oauth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EAMpB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EAA0B,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACrF,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACzF,OAAO,EACL,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACxB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,sBAAsB,EACtB,KAAK,eAAe,EACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EACL,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,YAAY,EAClB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,qBAAqB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,EACrB,KAAK,aAAa,EACnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,0BAA0B,EAC1B,eAAe,EACf,SAAS,IAAI,2BAA2B,EACxC,KAAK,wBAAwB,EAC9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,eAAe,EACf,eAAe,EACf,uBAAuB,EACvB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC5B,MAAM,wBAAwB,CAAC;AAEhC;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,EAAE,IAAI,CAAC,iBAAiB,EAAE,UAAU,CAK3E,CAAC;AAEF,MAAM,WAAW,gCAAgC;IAC/C,8CAA8C;IAC9C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,sDAAsD;IACtD,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAClD,4DAA4D;IAC5D,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,mEAAmE;IACnE,QAAQ,CAAC,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACjD,qCAAqC;IACrC,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C,8EAA8E;IAC9E,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,oEAAoE;AACpE,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,gCAAgC,GACxC,mBAAmB,CAgCrB;AAqBD,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACpB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,QAEH,CAAC;AAE3B;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,EAAE,IAAI,CAAC,iBAAiB,EAAE,UAAU,CAS1E,CAAC;AAEF,MAAM,WAAW,+BAA+B;IAC9C,8CAA8C;IAC9C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,0DAA0D;IAC1D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,sDAAsD;IACtD,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAClD,mDAAmD;IACnD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,8CAA8C;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,4DAA4D;IAC5D,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,mEAAmE;IACnE,QAAQ,CAAC,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACjD,qCAAqC;IACrC,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,GAAE,+BAAoC,GAC5C,mBAAmB,CAwCrB"}

package/dist/providers/oauth/index.js

@@ -0,0 +1,167 @@
+/**
+ * OpenAI OAuth subsystem — public surface.
+ *
+ * Layers (each depends only on the one below, via interfaces):
+ *
+ *   OpenAIOAuthProvider          orchestration + OpenAI capability inheritance
+ *     ├─ OAuthClient             OAuth 2.0 protocol (PKCE code exchange/refresh)
+ *     ├─ PKCEHelper              PKCE + CSRF-state generation
+ *     ├─ LocalCallbackServer     localhost redirect receiver
+ *     ├─ BrowserLauncher         opens the system browser
+ *     └─ TokenStore              token persistence
+ *          └─ SecureCredentialStore   opaque secret persistence (OS keychain)
+ *
+ * `createOpenAIOAuthProvider` wires production defaults; every collaborator can
+ * be overridden for testing or alternate hosts.
+ */
+import { createLogger } from "@nodetool-ai/config";
+import { CODEX_OAUTH_CLIENT_ID, CODEX_BACKEND_BASE_URL, CODEX_CALLBACK_PORT, CODEX_CALLBACK_PATH, CODEX_OAUTH_AUTHORIZATION_URL, CODEX_OAUTH_TOKEN_URL, CODEX_OAUTH_REVOCATION_URL, CODEX_OAUTH_SCOPES, CODEX_DEFAULT_ORIGINATOR } from "@nodetool-ai/protocol";
+import { OAuthClient } from "./oauth-client.js";
+import { PKCEHelper } from "./pkce-helper.js";
+import { LocalCallbackServer } from "./local-callback-server.js";
+import { DefaultBrowserLauncher } from "./browser-launcher.js";
+import { KeychainSecureCredentialStore } from "./secure-credential-store.js";
+import { SecureTokenStore } from "./token-store.js";
+import { OpenAIOAuthProvider } from "./openai-oauth-provider.js";
+import { extractChatGptAccountId } from "./jwt-claims.js";
+export * from "./types.js";
+export * from "./errors.js";
+export { decodeJwtPayload, extractChatGptAccountId } from "./jwt-claims.js";
+export { redactToken, redactObject } from "./redaction.js";
+export { PKCEHelper, nodeRandomSource } from "./pkce-helper.js";
+export { OAuthClient } from "./oauth-client.js";
+export { LocalCallbackServer } from "./local-callback-server.js";
+export { DefaultBrowserLauncher } from "./browser-launcher.js";
+export { KeychainSecureCredentialStore, InMemorySecureCredentialStore } from "./secure-credential-store.js";
+export { SecureTokenStore, InMemoryTokenStore } from "./token-store.js";
+export { OpenAIOAuthProvider } from "./openai-oauth-provider.js";
+export { ClaudeCodeOAuthClient } from "./claude-code-oauth-client.js";
+export { ClaudeCodeCredentialsStore, claudeConfigDir, isExpired as areClaudeCredentialsExpired } from "./claude-code-credentials.js";
+export { ClaudeCodeLogin, parsePastedCode, CLAUDE_LOGIN_TIMEOUT_MS } from "./claude-code-login.js";
+/**
+ * Default OAuth endpoints for OpenAI. These are configuration, not contracts —
+ * override them via `createOpenAIOAuthProvider({ oauthConfig })` if OpenAI's
+ * published endpoints differ for your tenant.
+ */
+export const DEFAULT_OPENAI_OAUTH_CONFIG = {
+    authorizationEndpoint: "https://auth.openai.com/oauth/authorize",
+    tokenEndpoint: "https://auth.openai.com/oauth/token",
+    revocationEndpoint: "https://auth.openai.com/oauth/revoke",
+    scopes: ["openid", "profile", "email", "offline_access", "api.read", "api.write"]
+};
+/** Wire an {@link OpenAIOAuthProvider} with production defaults. */
+export function createOpenAIOAuthProvider(options) {
+    const logger = options.logger ?? createLogger("nodetool.runtime.oauth");
+    const config = {
+        ...DEFAULT_OPENAI_OAUTH_CONFIG,
+        clientId: options.clientId,
+        ...options.oauthConfig
+    };
+    const credentialStore = options.credentialStore ?? new KeychainSecureCredentialStore({ logger });
+    const tokenStore = options.tokenStore ??
+        new SecureTokenStore({
+            credentialStore,
+            provider: "openai",
+            accountId: options.accountId ?? "default",
+            logger
+        });
+    return new OpenAIOAuthProvider({
+        oauthClient: new OAuthClient({ config, logger }),
+        tokenStore,
+        browserLauncher: options.browserLauncher ?? new DefaultBrowserLauncher({ logger }),
+        callbackServerFactory: () => new LocalCallbackServer({
+            port: options.callbackPort,
+            path: options.callbackPath,
+            logger
+        }),
+        pkce: new PKCEHelper(),
+        logger
+    });
+}
+// ── Codex (ChatGPT-backed) OAuth ──────────────────────────────────────────
+//
+// Rather than a NodeTool-specific OpenAI app, this reuses the public Codex CLI
+// OAuth client and talks to the ChatGPT Codex backend the same way the Codex
+// CLI does. That means three fixed, non-obvious facts the authorization server
+// and backend enforce:
+//   1. The client id is the published Codex CLI client. There is no secret.
+//   2. The redirect URI is the Codex-registered loopback callback,
+//      http://localhost:1455/auth/callback, so the local callback server MUST
+//      bind port 1455 with that path — an ephemeral port will be rejected.
+//   3. Backend requests must look like Codex: the `originator` header and the
+//      `chatgpt-account-id` (decoded from the access-token JWT) are required;
+//      a foreign originator is answered with 403.
+// These are configuration, not contracts — every value is override-able.
+// The Codex client id, endpoints, scopes, backend URL and loopback redirect are
+// the canonical constants in `@nodetool-ai/protocol` (shared with the login
+// flow and the token resolver). Re-exported here for the OAuth subsystem's
+// existing public surface.
+export { CODEX_OAUTH_CLIENT_ID, CODEX_BACKEND_BASE_URL, CODEX_CALLBACK_PORT, CODEX_CALLBACK_PATH };
+/**
+ * `originator` the ChatGPT backend expects from a Codex client. A non-Codex
+ * value (e.g. `pi`) is rejected with 403, so we present as the Codex CLI.
+ * Override via `CODEX_ORIGINATOR` env for resilience if the backend tightens.
+ */
+export const CODEX_ORIGINATOR = (typeof process !== "undefined" && process.env?.CODEX_ORIGINATOR) ||
+    CODEX_DEFAULT_ORIGINATOR;
+/**
+ * OAuth endpoint configuration for the Codex CLI client. Scopes and the extra
+ * authorization params mirror what the Codex CLI sends; `clientId` is filled in
+ * by {@link createCodexOAuthProvider}.
+ */
+export const DEFAULT_CODEX_OAUTH_CONFIG = {
+    authorizationEndpoint: CODEX_OAUTH_AUTHORIZATION_URL,
+    tokenEndpoint: CODEX_OAUTH_TOKEN_URL,
+    revocationEndpoint: CODEX_OAUTH_REVOCATION_URL,
+    scopes: [...CODEX_OAUTH_SCOPES],
+    extraAuthParams: {
+        id_token_add_organizations: "true",
+        codex_cli_simplified_flow: "true"
+    }
+};
+/**
+ * Wire an {@link OpenAIOAuthProvider} that authenticates with the public Codex
+ * CLI client and routes requests to the ChatGPT Codex backend.
+ *
+ * The callback server is pinned to the Codex-registered loopback redirect
+ * (port 1455, `/auth/callback`); every request carries the Codex `originator`
+ * and the `chatgpt-account-id` decoded from the access-token JWT.
+ */
+export function createCodexOAuthProvider(options = {}) {
+    const logger = options.logger ?? createLogger("nodetool.runtime.oauth.codex");
+    const config = {
+        ...DEFAULT_CODEX_OAUTH_CONFIG,
+        clientId: options.clientId ?? CODEX_OAUTH_CLIENT_ID,
+        ...options.oauthConfig
+    };
+    const credentialStore = options.credentialStore ?? new KeychainSecureCredentialStore({ logger });
+    const tokenStore = options.tokenStore ??
+        new SecureTokenStore({
+            credentialStore,
+            provider: "openai",
+            accountId: options.accountId ?? "codex",
+            logger
+        });
+    return new OpenAIOAuthProvider({
+        oauthClient: new OAuthClient({ config, logger }),
+        tokenStore,
+        browserLauncher: options.browserLauncher ?? new DefaultBrowserLauncher({ logger }),
+        callbackServerFactory: () => new LocalCallbackServer({
+            port: CODEX_CALLBACK_PORT,
+            path: CODEX_CALLBACK_PATH,
+            logger
+        }),
+        pkce: new PKCEHelper(),
+        apiBaseUrl: options.backendBaseUrl ?? CODEX_BACKEND_BASE_URL,
+        apiHeaders: { originator: options.originator ?? CODEX_ORIGINATOR },
+        dynamicApiHeaders: (accessToken) => {
+            const accountId = extractChatGptAccountId(accessToken);
+            const headers = {};
+            if (accountId)
+                headers["chatgpt-account-id"] = accountId;
+            return headers;
+        },
+        logger
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/providers/oauth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/providers/oauth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,YAAY,EAAe,MAAM,qBAAqB,CAAC;AAChE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,6BAA6B,EAC7B,qBAAqB,EACrB,0BAA0B,EAC1B,kBAAkB,EAClB,wBAAwB,EACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAwB,MAAM,uBAAuB,CAAC;AACrF,OAAO,EACL,6BAA6B,EAE9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAmB,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAG1D,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAqB,MAAM,kBAAkB,CAAC;AACnF,OAAO,EAAE,WAAW,EAA2C,MAAM,mBAAmB,CAAC;AACzF,OAAO,EACL,mBAAmB,EAGpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,sBAAsB,EAEvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,EAG9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAmB,MAAM,kBAAkB,CAAC;AACzF,OAAO,EACL,mBAAmB,EAGpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,qBAAqB,EAOtB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,0BAA0B,EAC1B,eAAe,EACf,SAAS,IAAI,2BAA2B,EAEzC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,eAAe,EACf,eAAe,EACf,uBAAuB,EAKxB,MAAM,wBAAwB,CAAC;AAEhC;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAwC;IAC9E,qBAAqB,EAAE,yCAAyC;IAChE,aAAa,EAAE,qCAAqC;IACpD,kBAAkB,EAAE,sCAAsC;IAC1D,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,CAAC;CAClF,CAAC;AAqBF,oEAAoE;AACpE,MAAM,UAAU,yBAAyB,CACvC,OAAyC;IAEzC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC,wBAAwB,CAAC,CAAC;IACxE,MAAM,MAAM,GAAsB;QAChC,GAAG,2BAA2B;QAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,GAAG,OAAO,CAAC,WAAW;KACvB,CAAC;IAEF,MAAM,eAAe,GACnB,OAAO,CAAC,eAAe,IAAI,IAAI,6BAA6B,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3E,MAAM,UAAU,GACd,OAAO,CAAC,UAAU;QAClB,IAAI,gBAAgB,CAAC;YACnB,eAAe;YACf,QAAQ,EAAE,QAAQ;YAClB,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,SAAS;YACzC,MAAM;SACP,CAAC,CAAC;IAEL,OAAO,IAAI,mBAAmB,CAAC;QAC7B,WAAW,EAAE,IAAI,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAChD,UAAU;QACV,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,IAAI,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;QAClF,qBAAqB,EAAE,GAAG,EAAE,CAC1B,IAAI,mBAAmB,CAAC;YACtB,IAAI,EAAE,OAAO,CAAC,YAAY;YAC1B,IAAI,EAAE,OAAO,CAAC,YAAY;YAC1B,MAAM;SACP,CAAC;QACJ,IAAI,EAAE,IAAI,UAAU,EAAE;QACtB,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAC/E,uBAAuB;AACvB,4EAA4E;AAC5E,mEAAmE;AACnE,8EAA8E;AAC9E,2EAA2E;AAC3E,8EAA8E;AAC9E,8EAA8E;AAC9E,kDAAkD;AAClD,yEAAyE;AAEzE,gFAAgF;AAChF,4EAA4E;AAC5E,2EAA2E;AAC3E,2BAA2B;AAC3B,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACpB,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAC3B,CAAC,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,gBAAgB,CAAC;IACjE,wBAAwB,CAAC;AAE3B;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAwC;IAC7E,qBAAqB,EAAE,6BAA6B;IACpD,aAAa,EAAE,qBAAqB;IACpC,kBAAkB,EAAE,0BAA0B;IAC9C,MAAM,EAAE,CAAC,GAAG,kBAAkB,CAAC;IAC/B,eAAe,EAAE;QACf,0BAA0B,EAAE,MAAM;QAClC,yBAAyB,EAAE,MAAM;KAClC;CACF,CAAC;AAsBF;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAO,GAAoC,EAAE;IAE7C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC,8BAA8B,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAsB;QAChC,GAAG,0BAA0B;QAC7B,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,qBAAqB;QACnD,GAAG,OAAO,CAAC,WAAW;KACvB,CAAC;IAEF,MAAM,eAAe,GACnB,OAAO,CAAC,eAAe,IAAI,IAAI,6BAA6B,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3E,MAAM,UAAU,GACd,OAAO,CAAC,UAAU;QAClB,IAAI,gBAAgB,CAAC;YACnB,eAAe;YACf,QAAQ,EAAE,QAAQ;YAClB,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,OAAO;YACvC,MAAM;SACP,CAAC,CAAC;IAEL,OAAO,IAAI,mBAAmB,CAAC;QAC7B,WAAW,EAAE,IAAI,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAChD,UAAU;QACV,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,IAAI,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;QAClF,qBAAqB,EAAE,GAAG,EAAE,CAC1B,IAAI,mBAAmB,CAAC;YACtB,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,mBAAmB;YACzB,MAAM;SACP,CAAC;QACJ,IAAI,EAAE,IAAI,UAAU,EAAE;QACtB,UAAU,EAAE,OAAO,CAAC,cAAc,IAAI,sBAAsB;QAC5D,UAAU,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,gBAAgB,EAAE;QAClE,iBAAiB,EAAE,CAAC,WAAW,EAAE,EAAE;YACjC,MAAM,SAAS,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAC;YACvD,MAAM,OAAO,GAA2B,EAAE,CAAC;YAC3C,IAAI,SAAS;gBAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,SAAS,CAAC;YACzD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM;KACP,CAAC,CAAC;AACL,CAAC"}

package/dist/providers/oauth/jwt-claims.d.ts

@@ -0,0 +1,23 @@
+/**
+ * JWT claim extraction for the ChatGPT/Codex backend.
+ *
+ * The Codex OAuth access token is a JWT whose payload carries the ChatGPT
+ * account identity needed to address the `chatgpt.com/backend-api/codex`
+ * routes. This module decodes that payload (without verifying the signature —
+ * verification is the authorization server's job; we only read claims we were
+ * already issued) and pulls out the account id.
+ *
+ * No I/O, no dependencies — pure string/JSON work so it is trivially testable
+ * and safe to import from any layer.
+ */
+/** Decode the JSON payload (the middle segment) of a JWT. */
+export declare function decodeJwtPayload(token: string): Record<string, unknown> | null;
+/**
+ * Extract the ChatGPT account id from a Codex OAuth token.
+ *
+ * The claim lives under the `https://api.openai.com/auth` namespace as
+ * `chatgpt_account_id`; some token shapes also surface it at the top level, so
+ * both are checked. Returns `null` when absent or malformed.
+ */
+export declare function extractChatGptAccountId(token: string): string | null;
+//# sourceMappingURL=jwt-claims.d.ts.map

package/dist/providers/oauth/jwt-claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-claims.d.ts","sourceRoot":"","sources":["../../../src/providers/oauth/jwt-claims.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAWH,6DAA6D;AAC7D,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAwB9E;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAcpE"}

package/dist/providers/oauth/jwt-claims.js

@@ -0,0 +1,67 @@
+/**
+ * JWT claim extraction for the ChatGPT/Codex backend.
+ *
+ * The Codex OAuth access token is a JWT whose payload carries the ChatGPT
+ * account identity needed to address the `chatgpt.com/backend-api/codex`
+ * routes. This module decodes that payload (without verifying the signature —
+ * verification is the authorization server's job; we only read claims we were
+ * already issued) and pulls out the account id.
+ *
+ * No I/O, no dependencies — pure string/JSON work so it is trivially testable
+ * and safe to import from any layer.
+ */
+import { isNonEmptyString, isRecord, isString } from "@nodetool-ai/protocol";
+/** OIDC namespace under which OpenAI nests its custom auth claims. */
+const OPENAI_AUTH_CLAIM = "https://api.openai.com/auth";
+/** Decode the JSON payload (the middle segment) of a JWT. */
+export function decodeJwtPayload(token) {
+    if (!isString(token))
+        return null;
+    const segments = token.split(".");
+    // A well-formed JWS has three dot-separated segments: header.payload.signature.
+    if (segments.length !== 3)
+        return null;
+    const payloadSegment = segments[1];
+    if (!payloadSegment)
+        return null;
+    let json;
+    try {
+        json = Buffer.from(payloadSegment, "base64url").toString("utf8");
+    }
+    catch {
+        return null;
+    }
+    try {
+        const parsed = JSON.parse(json);
+        if (!isRecord(parsed)) {
+            return null;
+        }
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Extract the ChatGPT account id from a Codex OAuth token.
+ *
+ * The claim lives under the `https://api.openai.com/auth` namespace as
+ * `chatgpt_account_id`; some token shapes also surface it at the top level, so
+ * both are checked. Returns `null` when absent or malformed.
+ */
+export function extractChatGptAccountId(token) {
+    const payload = decodeJwtPayload(token);
+    if (!payload)
+        return null;
+    const namespaced = payload[OPENAI_AUTH_CLAIM];
+    if (isRecord(namespaced)) {
+        const id = namespaced.chatgpt_account_id;
+        if (isNonEmptyString(id))
+            return id;
+    }
+    const topLevel = payload.chatgpt_account_id;
+    if (isNonEmptyString(topLevel))
+        return topLevel;
+    return null;
+}
+//# sourceMappingURL=jwt-claims.js.map

package/dist/providers/oauth/jwt-claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-claims.js","sourceRoot":"","sources":["../../../src/providers/oauth/jwt-claims.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,gBAAgB,EAChB,QAAQ,EACR,QAAQ,EACT,MAAM,uBAAuB,CAAC;AAE/B,sEAAsE;AACtE,MAAM,iBAAiB,GAAG,6BAA6B,CAAC;AAExD,6DAA6D;AAC7D,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,gFAAgF;IAChF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,cAAc,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IAEjC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QAC3C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC9C,IAAI,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACzC,IAAI,gBAAgB,CAAC,EAAE,CAAC;YAAE,OAAO,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAC5C,IAAI,gBAAgB,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEhD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/providers/oauth/local-callback-server.d.ts

@@ -0,0 +1,60 @@
+/**
+ * LocalCallbackServer — a single-shot localhost HTTP listener that receives the
+ * OAuth redirect, validates the CSRF `state`, and resolves with the
+ * authorization code.
+ *
+ * Lifecycle is explicit: `listen()` → `waitForCode()` → `close()`. The server
+ * binds to loopback only, serves exactly one callback, and then becomes inert.
+ * No module-level state — each login owns its own instance.
+ */
+import type { Logger } from "@nodetool-ai/config";
+import type { AuthorizationResult } from "./types.js";
+export interface LocalCallbackServerOptions {
+    /** Loopback host to bind. Defaults to 127.0.0.1. */
+    readonly host?: string;
+    /** Port to bind. 0 (default) lets the OS pick an ephemeral port. */
+    readonly port?: number;
+    /** Callback path the authorization server will redirect to. */
+    readonly path?: string;
+    /** HTML shown in the browser after a successful callback. */
+    readonly successHtml?: string;
+    /** HTML shown in the browser after a failed callback. */
+    readonly failureHtml?: string;
+    readonly logger?: Logger;
+}
+export interface WaitForCodeOptions {
+    /** The exact `state` value sent in the authorization request (CSRF guard). */
+    readonly expectedState: string;
+    /** Abort if no callback arrives within this many milliseconds. */
+    readonly timeoutMs: number;
+    /** External cancellation (e.g. user cancels the flow). */
+    readonly signal?: AbortSignal;
+}
+export declare class LocalCallbackServer {
+    private readonly host;
+    private readonly requestedPort;
+    private readonly path;
+    private readonly successHtml;
+    private readonly failureHtml;
+    private readonly logger?;
+    private server;
+    private boundPort;
+    constructor(options?: LocalCallbackServerOptions);
+    /** Start listening. Resolves with the bound port and full redirect URI. */
+    listen(): Promise<{
+        port: number;
+        redirectUri: string;
+    }>;
+    /** The redirect URI to register with the authorization server. */
+    redirectUri(): string;
+    /**
+     * Resolve when the browser hits the callback path with a matching `state`
+     * and an authorization `code`. Rejects on timeout, CSRF mismatch, an
+     * `error` param from the server, or external abort.
+     */
+    waitForCode(options: WaitForCodeOptions): Promise<AuthorizationResult>;
+    /** Stop listening and release the port. Idempotent. */
+    close(): Promise<void>;
+    private respond;
+}
+//# sourceMappingURL=local-callback-server.d.ts.map

package/dist/providers/oauth/local-callback-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-callback-server.d.ts","sourceRoot":"","sources":["../../../src/providers/oauth/local-callback-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAOlD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,WAAW,0BAA0B;IACzC,oDAAoD;IACpD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,6DAA6D;IAC7D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,yDAAyD;IACzD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAYD,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,kEAAkE;IAClE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;IACjC,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,SAAS,CAAuB;IAExC,YAAY,OAAO,GAAE,0BAA+B,EAOnD;IAED,2EAA2E;IACrE,MAAM,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAyB7D;IAED,kEAAkE;IAClE,WAAW,IAAI,MAAM,CAKpB;IAED;;;;OAIG;IACG,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAyE3E;IAED,uDAAuD;IACjD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAM3B;IAED,OAAO,CAAC,OAAO;CAIhB"}