@nodetool-ai/runtime 0.7.0-rc.23 → 0.8.2

package/dist/providers/oauth/openai-oauth-provider.js

@@ -0,0 +1,265 @@
+/**
+ * OpenAIOAuthProvider — an OpenAI provider authenticated by browser-based
+ * OAuth 2.0 (Authorization Code + PKCE) instead of a pasted API key.
+ *
+ * It extends `OpenAIProvider` so every model capability (chat, streaming,
+ * images, audio, embeddings) is inherited unchanged. The only thing it
+ * replaces is *where the bearer token comes from*: instead of a static API
+ * key, every request is served by a short-lived OAuth access token that is
+ * transparently refreshed when it expires.
+ *
+ * All collaborators are injected (OAuth client, token store, callback server,
+ * PKCE helper, browser launcher), so there is no module-level state and the
+ * whole thing is unit-testable without a network or a browser.
+ */
+import OpenAI from "openai";
+import { createLogger } from "@nodetool-ai/config";
+import { OpenAIProvider } from "../openai-provider.js";
+import { PKCEHelper } from "./pkce-helper.js";
+import { CredentialsRevokedError, InvalidRefreshTokenError, NotAuthenticatedError, SessionExpiredError } from "./errors.js";
+import { systemClock } from "./types.js";
+/** Sentinel passed to the parent constructor; the real bearer is OAuth-sourced. */
+const OAUTH_API_KEY_SENTINEL = "__nodetool_oauth__";
+export class OpenAIOAuthProvider extends OpenAIProvider {
+    oauthClient;
+    tokenStore;
+    browserLauncher;
+    callbackServerFactory;
+    pkce;
+    openAIClientFactory;
+    clock;
+    oauthLogger;
+    expirySkewMs;
+    loginTimeoutMs;
+    /** In-memory session mirror of the persisted token set. */
+    session = null;
+    /** Cached OpenAI client, keyed by the token it was built for. */
+    oauthOpenAIClient = null;
+    cachedForToken = null;
+    /** Single-flight guard so concurrent calls share one refresh round-trip. */
+    refreshInFlight = null;
+    constructor(options) {
+        super({ OPENAI_API_KEY: OAUTH_API_KEY_SENTINEL }, { providerId: options.providerId ?? "openai" });
+        this.oauthClient = options.oauthClient;
+        this.tokenStore = options.tokenStore;
+        this.browserLauncher = options.browserLauncher;
+        this.callbackServerFactory = options.callbackServerFactory;
+        this.pkce = options.pkce ?? new PKCEHelper();
+        const apiBaseUrl = options.apiBaseUrl;
+        const apiHeaders = options.apiHeaders;
+        const dynamicApiHeaders = options.dynamicApiHeaders;
+        this.openAIClientFactory =
+            options.openAIClientFactory ??
+                ((accessToken) => {
+                    const headers = {
+                        ...(apiHeaders ?? {}),
+                        ...(dynamicApiHeaders?.(accessToken) ?? {})
+                    };
+                    const clientOptions = {
+                        apiKey: accessToken
+                    };
+                    if (apiBaseUrl) {
+                        clientOptions.baseURL = apiBaseUrl;
+                    }
+                    if (Object.keys(headers).length > 0) {
+                        clientOptions.defaultHeaders = headers;
+                    }
+                    return new OpenAI(clientOptions);
+                });
+        this.clock = options.clock ?? systemClock;
+        this.oauthLogger =
+            options.logger ?? createLogger("nodetool.runtime.oauth.provider");
+        this.expirySkewMs = (options.expirySkewSeconds ?? 60) * 1000;
+        this.loginTimeoutMs = options.loginTimeoutMs ?? 300_000;
+    }
+    // --- Authentication lifecycle ------------------------------------------
+    /**
+     * Run the full browser OAuth flow: spin up a localhost callback server, open
+     * the browser, wait for the redirect, exchange the code, and persist tokens.
+     * Resolves with the (non-secret) token metadata on success.
+     */
+    async login(options = {}) {
+        const server = this.callbackServerFactory();
+        try {
+            const { redirectUri } = await server.listen();
+            const pkcePair = await this.pkce.createPkcePair();
+            const state = await this.pkce.createState();
+            const authUrl = this.oauthClient.buildAuthorizationUrl({
+                redirectUri,
+                state,
+                codeChallenge: pkcePair.challenge,
+                codeChallengeMethod: pkcePair.method
+            });
+            // BrowserLaunchError propagates as a distinct failure mode.
+            await this.browserLauncher.open(authUrl);
+            this.oauthLogger.info("Waiting for OAuth callback");
+            const { code } = await server.waitForCode({
+                expectedState: state,
+                timeoutMs: options.timeoutMs ?? this.loginTimeoutMs,
+                signal: options.signal
+            });
+            const tokens = await this.oauthClient.exchangeAuthorizationCode({
+                code,
+                codeVerifier: pkcePair.verifier,
+                redirectUri,
+                signal: options.signal
+            });
+            await this.applyTokens(tokens);
+            this.oauthLogger.info("OAuth login succeeded", {
+                scope: tokens.scope,
+                expiresAt: tokens.expiresAt
+            });
+            return { scope: tokens.scope, expiresAt: tokens.expiresAt };
+        }
+        finally {
+            await server.close();
+        }
+    }
+    /** Whether a non-expired session is available without hitting the network. */
+    async isAuthenticated() {
+        const tokens = await this.currentTokens();
+        return tokens != null && !this.isExpired(tokens);
+    }
+    /**
+     * Forget the session locally and, if the server exposes a revocation
+     * endpoint, revoke the refresh token. Always clears local storage even if
+     * remote revocation fails.
+     */
+    async logout() {
+        const tokens = await this.currentTokens();
+        try {
+            if (tokens?.refreshToken) {
+                await this.oauthClient.revokeToken(tokens.refreshToken, "refresh_token");
+            }
+        }
+        finally {
+            await this.tokenStore.clear();
+            this.session = null;
+            this.oauthOpenAIClient = null;
+            this.cachedForToken = null;
+        }
+    }
+    /**
+     * Return a valid access token, refreshing if expired. Throws
+     * `SessionExpiredError`/`NotAuthenticatedError` when re-login is required.
+     */
+    async getAccessToken() {
+        const tokens = await this.ensureValidSession();
+        return tokens.accessToken;
+    }
+    // --- Token plumbing -----------------------------------------------------
+    async currentTokens() {
+        if (!this.session) {
+            this.session = await this.tokenStore.load();
+        }
+        return this.session;
+    }
+    isExpired(tokens) {
+        if (tokens.expiresAt == null)
+            return false;
+        return this.clock.now() >= tokens.expiresAt - this.expirySkewMs;
+    }
+    async ensureValidSession() {
+        const tokens = await this.currentTokens();
+        if (!tokens) {
+            throw new NotAuthenticatedError();
+        }
+        if (!this.isExpired(tokens)) {
+            return tokens;
+        }
+        return this.refresh();
+    }
+    /** Refresh the access token (single-flight). */
+    async refresh() {
+        if (this.refreshInFlight)
+            return this.refreshInFlight;
+        this.refreshInFlight = this.doRefresh().finally(() => {
+            this.refreshInFlight = null;
+        });
+        return this.refreshInFlight;
+    }
+    async doRefresh() {
+        const current = await this.currentTokens();
+        const refreshToken = current?.refreshToken;
+        if (!refreshToken) {
+            // Nothing to refresh with — the session is effectively over.
+            await this.invalidate();
+            throw new SessionExpiredError("No refresh token available; re-authentication required");
+        }
+        let next;
+        try {
+            next = await this.oauthClient.refreshAccessToken(refreshToken);
+        }
+        catch (err) {
+            // A rejected or revoked refresh token means the local session is dead.
+            if (err instanceof InvalidRefreshTokenError ||
+                err instanceof CredentialsRevokedError) {
+                await this.invalidate();
+            }
+            throw err;
+        }
+        // Providers may omit a rotated refresh token; keep the previous one.
+        const merged = next.refreshToken
+            ? next
+            : { ...next, refreshToken };
+        await this.applyTokens(merged);
+        return merged;
+    }
+    async applyTokens(tokens) {
+        await this.tokenStore.save(tokens);
+        this.session = tokens;
+        // Invalidate the cached SDK client so the next call rebinds the new bearer.
+        if (this.cachedForToken !== tokens.accessToken) {
+            this.oauthOpenAIClient = null;
+            this.cachedForToken = null;
+        }
+    }
+    async invalidate() {
+        await this.tokenStore.clear();
+        this.session = null;
+        this.oauthOpenAIClient = null;
+        this.cachedForToken = null;
+    }
+    // --- OpenAIProvider overrides ------------------------------------------
+    /** Build (and cache) an OpenAI SDK client bound to the current access token. */
+    getClient() {
+        const token = this.session?.accessToken;
+        if (!token) {
+            throw new NotAuthenticatedError("No active OAuth session; call login() first");
+        }
+        if (!this.oauthOpenAIClient || this.cachedForToken !== token) {
+            this.oauthOpenAIClient = this.openAIClientFactory(token);
+            this.cachedForToken = token;
+        }
+        return this.oauthOpenAIClient;
+    }
+    /**
+     * The OAuth bearer is short-lived and must never be baked into a container's
+     * environment as if it were a durable API key. Code runners that need OpenAI
+     * access should refresh through the provider instead.
+     */
+    getContainerEnv() {
+        return {};
+    }
+    async getAvailableLanguageModels() {
+        const token = await this.getAccessToken();
+        const response = await fetch("https://api.openai.com/v1/models", {
+            headers: { Authorization: `Bearer ${token}` }
+        });
+        if (!response.ok)
+            return [];
+        const payload = (await response.json());
+        return (payload.data ?? [])
+            .filter((row) => typeof row.id === "string" && row.id.length > 0)
+            .map((row) => ({ id: row.id, name: row.id, provider: "openai" }));
+    }
+    async generateMessage(args) {
+        await this.ensureValidSession();
+        return super.generateMessage(args);
+    }
+    async *generateMessages(args) {
+        await this.ensureValidSession();
+        yield* super.generateMessages(args);
+    }
+}
+//# sourceMappingURL=openai-oauth-provider.js.map

package/dist/providers/oauth/openai-oauth-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openai-oauth-provider.js","sourceRoot":"","sources":["../../../src/providers/oauth/openai-oauth-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAe,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AASvD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG9C,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,EACrB,mBAAmB,EACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAgC,WAAW,EAAE,MAAM,YAAY,CAAC;AAEvE,mFAAmF;AACnF,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AA+CpD,MAAM,OAAO,mBAAoB,SAAQ,cAAc;IACpC,WAAW,CAAc;IACzB,UAAU,CAAa;IACvB,eAAe,CAAkB;IACjC,qBAAqB,CAA4B;IACjD,IAAI,CAAa;IACjB,mBAAmB,CAAkC;IACrD,KAAK,CAAQ;IACb,WAAW,CAAS;IACpB,YAAY,CAAS;IACrB,cAAc,CAAS;IAExC,2DAA2D;IACnD,OAAO,GAAuB,IAAI,CAAC;IAC3C,iEAAiE;IACzD,iBAAiB,GAAkB,IAAI,CAAC;IACxC,cAAc,GAAkB,IAAI,CAAC;IAC7C,4EAA4E;IACpE,eAAe,GAAgC,IAAI,CAAC;IAE5D,YAAY,OAAmC;QAC7C,KAAK,CACH,EAAE,cAAc,EAAE,sBAAsB,EAAE,EAC1C,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,QAAQ,EAAE,CAC/C,CAAC;QACF,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;QAC/C,IAAI,CAAC,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;QAC3D,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,UAAU,EAAE,CAAC;QAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;QACpD,IAAI,CAAC,mBAAmB;YACtB,OAAO,CAAC,mBAAmB;gBAC3B,CAAC,CAAC,WAAW,EAAE,EAAE;oBACf,MAAM,OAAO,GAAG;wBACd,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;wBACrB,GAAG,CAAC,iBAAiB,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;qBAC5C,CAAC;oBACF,MAAM,aAAa,GAA4C;wBAC7D,MAAM,EAAE,WAAW;qBACpB,CAAC;oBACF,IAAI,UAAU,EAAE,CAAC;wBACf,aAAa,CAAC,OAAO,GAAG,UAAU,CAAC;oBACrC,CAAC;oBACD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACpC,aAAa,CAAC,cAAc,GAAG,OAAO,CAAC;oBACzC,CAAC;oBACD,OAAO,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC;gBACnC,CAAC,CAAC,CAAC;QACL,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,WAAW,CAAC;QAC1C,IAAI,CAAC,WAAW;YACd,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC,iCAAiC,CAAC,CAAC;QACpE,IAAI,CAAC,YAAY,GAAG,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QAC7D,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC;IAC1D,CAAC;IAED,0EAA0E;IAE1E;;;;OAIG;IACH,KAAK,CAAC,KAAK,CACT,OAAO,GAAiB,EAAE;QAE1B,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YAC9C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAE5C,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC;gBACrD,WAAW;gBACX,KAAK;gBACL,aAAa,EAAE,QAAQ,CAAC,SAAS;gBACjC,mBAAmB,EAAE,QAAQ,CAAC,MAAM;aACrC,CAAC,CAAC;YAEH,4DAA4D;YAC5D,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YAEpD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC;gBACxC,aAAa,EAAE,KAAK;gBACpB,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,cAAc;gBACnD,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,yBAAyB,CAAC;gBAC9D,IAAI;gBACJ,YAAY,EAAE,QAAQ,CAAC,QAAQ;gBAC/B,WAAW;gBACX,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;YAEH,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,uBAAuB,EAAE;gBAC7C,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;QAC9D,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,eAAe;QACnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1C,OAAO,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACnD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,IAAI,MAAM,EAAE,YAAY,EAAE,CAAC;gBACzB,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAChC,MAAM,CAAC,YAAY,EACnB,eAAe,CAChB,CAAC;YACJ,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACpB,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc;QAClB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC/C,OAAO,MAAM,CAAC,WAAW,CAAC;IAC5B,CAAC;IAED,2EAA2E;IAEnE,KAAK,CAAC,aAAa;QACzB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAC9C,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAEO,SAAS,CAAC,MAAmB;QACnC,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI;YAAE,OAAO,KAAK,CAAC;QAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC;IAClE,CAAC;IAEO,KAAK,CAAC,kBAAkB;QAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,qBAAqB,EAAE,CAAC;QACpC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,gDAAgD;IAChD,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC;QACtD,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACnD,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3C,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,CAAC;QAC3C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,6DAA6D;YAC7D,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACxB,MAAM,IAAI,mBAAmB,CAC3B,wDAAwD,CACzD,CAAC;QACJ,CAAC;QAED,IAAI,IAAiB,CAAC;QACtB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,uEAAuE;YACvE,IACE,GAAG,YAAY,wBAAwB;gBACvC,GAAG,YAAY,uBAAuB,EACtC,CAAC;gBACD,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YAC1B,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,qEAAqE;QACrE,MAAM,MAAM,GAAgB,IAAI,CAAC,YAAY;YAC3C,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,MAAmB;QAC3C,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,4EAA4E;QAC5E,IAAI,IAAI,CAAC,cAAc,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;YAC/C,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC7B,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QAC9B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAC9B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,CAAC;IAED,0EAA0E;IAE1E,gFAAgF;IACvE,SAAS;QAChB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC;QACxC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,qBAAqB,CAC7B,6CAA6C,CAC9C,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;YAC7D,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;YACzD,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC;QAC9B,CAAC;QACD,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED;;;;OAIG;IACM,eAAe;QACtB,OAAO,EAAE,CAAC;IACZ,CAAC;IAEQ,KAAK,CAAC,0BAA0B;QACvC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,kCAAkC,EAAE;YAC/D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAErC,CAAC;QACF,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;aACxB,MAAM,CACL,CAAC,GAAG,EAAyB,EAAE,CAC7B,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAClD;aACA,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC;IAEQ,KAAK,CAAC,eAAe,CAC5B,IAAsD;QAEtD,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAEQ,KAAK,CAAC,CAAC,gBAAgB,CAC9B,IAAuD;QAEvD,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAChC,KAAK,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;CACF"}

package/dist/providers/oauth/pkce-helper.d.ts

@@ -0,0 +1,43 @@
+/**
+ * PKCE (RFC 7636) and CSRF-state generation.
+ *
+ * Pure crypto with no I/O and no shared state. The randomness source is
+ * injectable so tests can assert exact verifier/challenge derivations, but the
+ * default uses the platform CSPRNG (`node:crypto`).
+ */
+import type { PkcePair } from "./types.js";
+/** Abstraction over a cryptographically-secure byte source. */
+export interface RandomSource {
+    /** Resolve to `size` random bytes. */
+    randomBytes(size: number): Promise<Uint8Array>;
+}
+/** Default CSPRNG backed by `node:crypto.randomBytes`. */
+export declare const nodeRandomSource: RandomSource;
+interface PKCEHelperOptions {
+    /** Injected randomness; defaults to the platform CSPRNG. */
+    readonly random?: RandomSource;
+    /** Verifier entropy in bytes. RFC 7636 allows 43–128 chars; 32 bytes → 43. */
+    readonly verifierBytes?: number;
+    /** CSRF state entropy in bytes. */
+    readonly stateBytes?: number;
+}
+/**
+ * Generates PKCE verifiers/challenges and CSRF state values. All methods are
+ * async to keep a uniform, non-blocking API even though hashing is synchronous.
+ */
+export declare class PKCEHelper {
+    private readonly random;
+    private readonly verifierBytes;
+    private readonly stateBytes;
+    constructor(options?: PKCEHelperOptions);
+    /** Generate a high-entropy `code_verifier`. */
+    createCodeVerifier(): Promise<string>;
+    /** Derive `code_challenge = BASE64URL(SHA-256(verifier))`. */
+    createCodeChallenge(verifier: string): Promise<string>;
+    /** Generate an opaque CSRF `state` token. */
+    createState(): Promise<string>;
+    /** Convenience: produce a full verifier + challenge pair in one call. */
+    createPkcePair(): Promise<PkcePair>;
+}
+export {};
+//# sourceMappingURL=pkce-helper.d.ts.map

package/dist/providers/oauth/pkce-helper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce-helper.d.ts","sourceRoot":"","sources":["../../../src/providers/oauth/pkce-helper.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAuB,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEhE,+DAA+D;AAC/D,MAAM,WAAW,YAAY;IAC3B,sCAAsC;IACtC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAChD;AAED,0DAA0D;AAC1D,eAAO,MAAM,gBAAgB,EAAE,YAK9B,CAAC;AAWF,UAAU,iBAAiB;IACzB,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;IAC/B,8EAA8E;IAC9E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,mCAAmC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;GAGG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IAEpC,YAAY,OAAO,GAAE,iBAAsB,EAI1C;IAED,+CAA+C;IACzC,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC,CAE1C;IAED,8DAA8D;IACxD,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG3D;IAED,6CAA6C;IACvC,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,CAEnC;IAED,yEAAyE;IACnE,cAAc,IAAI,OAAO,CAAC,QAAQ,CAAC,CAKxC;CACF"}

package/dist/providers/oauth/pkce-helper.js

@@ -0,0 +1,57 @@
+/**
+ * PKCE (RFC 7636) and CSRF-state generation.
+ *
+ * Pure crypto with no I/O and no shared state. The randomness source is
+ * injectable so tests can assert exact verifier/challenge derivations, but the
+ * default uses the platform CSPRNG (`node:crypto`).
+ */
+import { createHash, randomBytes } from "node:crypto";
+/** Default CSPRNG backed by `node:crypto.randomBytes`. */
+export const nodeRandomSource = {
+    randomBytes: (size) => new Promise((resolve, reject) => {
+        randomBytes(size, (err, buf) => (err ? reject(err) : resolve(new Uint8Array(buf))));
+    })
+};
+/** RFC 4648 §5 base64url, no padding. */
+function base64UrlEncode(bytes) {
+    return Buffer.from(bytes)
+        .toString("base64")
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+}
+/**
+ * Generates PKCE verifiers/challenges and CSRF state values. All methods are
+ * async to keep a uniform, non-blocking API even though hashing is synchronous.
+ */
+export class PKCEHelper {
+    random;
+    verifierBytes;
+    stateBytes;
+    constructor(options = {}) {
+        this.random = options.random ?? nodeRandomSource;
+        this.verifierBytes = options.verifierBytes ?? 32;
+        this.stateBytes = options.stateBytes ?? 32;
+    }
+    /** Generate a high-entropy `code_verifier`. */
+    async createCodeVerifier() {
+        return base64UrlEncode(await this.random.randomBytes(this.verifierBytes));
+    }
+    /** Derive `code_challenge = BASE64URL(SHA-256(verifier))`. */
+    async createCodeChallenge(verifier) {
+        const digest = createHash("sha256").update(verifier, "ascii").digest();
+        return base64UrlEncode(new Uint8Array(digest));
+    }
+    /** Generate an opaque CSRF `state` token. */
+    async createState() {
+        return base64UrlEncode(await this.random.randomBytes(this.stateBytes));
+    }
+    /** Convenience: produce a full verifier + challenge pair in one call. */
+    async createPkcePair() {
+        const verifier = await this.createCodeVerifier();
+        const challenge = await this.createCodeChallenge(verifier);
+        const method = "S256";
+        return { verifier, challenge, method };
+    }
+}
+//# sourceMappingURL=pkce-helper.js.map

package/dist/providers/oauth/pkce-helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce-helper.js","sourceRoot":"","sources":["../../../src/providers/oauth/pkce-helper.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAStD,0DAA0D;AAC1D,MAAM,CAAC,MAAM,gBAAgB,GAAiB;IAC5C,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CACpB,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,WAAW,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtF,CAAC,CAAC;CACL,CAAC;AAEF,yCAAyC;AACzC,SAAS,eAAe,CAAC,KAAiB;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACtB,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC;AAWD;;;GAGG;AACH,MAAM,OAAO,UAAU;IACJ,MAAM,CAAe;IACrB,aAAa,CAAS;IACtB,UAAU,CAAS;IAEpC,YAAY,OAAO,GAAsB,EAAE;QACzC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,gBAAgB,CAAC;QACjD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;IAC7C,CAAC;IAED,+CAA+C;IAC/C,KAAK,CAAC,kBAAkB;QACtB,OAAO,eAAe,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,8DAA8D;IAC9D,KAAK,CAAC,mBAAmB,CAAC,QAAgB;QACxC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;QACvE,OAAO,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,6CAA6C;IAC7C,KAAK,CAAC,WAAW;QACf,OAAO,eAAe,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,cAAc;QAClB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACjD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAwB,MAAM,CAAC;QAC3C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IACzC,CAAC;CACF"}

package/dist/providers/oauth/redaction.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Redaction helpers. The single rule of this subsystem: secrets never reach a
+ * log sink, an error message, or a thrown payload in cleartext. Anything that
+ * might carry token material is funnelled through here first.
+ */
+/**
+ * Redact a single secret string for diagnostics: keep a short, non-reversible
+ * prefix so two different tokens are distinguishable in logs, hide the rest.
+ * An empty/short value collapses entirely to `<redacted>`.
+ */
+export declare function redactToken(value: string | null | undefined): string;
+/**
+ * Deep-clone an arbitrary value with all sensitive fields replaced by
+ * `<redacted>`. Safe to pass straight into a logger. Cycles are broken with a
+ * `[Circular]` marker so logging can never throw.
+ */
+/** A value with every sensitive field replaced — safe to hand to a logger. */
+export type RedactedValue = string | number | boolean | null | undefined | RedactedValue[] | {
+    [key: string]: RedactedValue;
+};
+export declare function redactObject(input: unknown, seen?: WeakSet<object>): RedactedValue;
+//# sourceMappingURL=redaction.d.ts.map

package/dist/providers/oauth/redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../../../src/providers/oauth/redaction.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAsBH;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAIpE;AAED;;;;GAIG;AACH,8EAA8E;AAC9E,MAAM,MAAM,aAAa,GACrB,MAAM,GACN,MAAM,GACN,OAAO,GACP,IAAI,GACJ,SAAS,GACT,aAAa,EAAE,GACf;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,CAAA;CAAE,CAAC;AAErC,wBAAgB,YAAY,CAC1B,KAAK,EAAE,OAAO,EACd,IAAI,kBAAwB,GAC3B,aAAa,CAwBf"}

package/dist/providers/oauth/redaction.js

@@ -0,0 +1,59 @@
+/**
+ * Redaction helpers. The single rule of this subsystem: secrets never reach a
+ * log sink, an error message, or a thrown payload in cleartext. Anything that
+ * might carry token material is funnelled through here first.
+ */
+import { isObjectLike } from "@nodetool-ai/protocol";
+const REDACTED = "<redacted>";
+/** Keys whose values are always scrubbed, regardless of nesting depth. */
+const SENSITIVE_KEYS = new Set([
+    "access_token",
+    "accesstoken",
+    "refresh_token",
+    "refreshtoken",
+    "code",
+    "code_verifier",
+    "codeverifier",
+    "client_secret",
+    "clientsecret",
+    "authorization",
+    "id_token",
+    "idtoken"
+]);
+/**
+ * Redact a single secret string for diagnostics: keep a short, non-reversible
+ * prefix so two different tokens are distinguishable in logs, hide the rest.
+ * An empty/short value collapses entirely to `<redacted>`.
+ */
+export function redactToken(value) {
+    if (!value)
+        return REDACTED;
+    if (value.length <= 8)
+        return REDACTED;
+    return `${value.slice(0, 4)}…${REDACTED}`;
+}
+export function redactObject(input, seen = new WeakSet()) {
+    if (!isObjectLike(input)) {
+        // SAFETY: a non-object carries no fields to redact and goes to the logger
+        // as it stands.
+        return input;
+    }
+    if (seen.has(input)) {
+        return "[Circular]";
+    }
+    seen.add(input);
+    if (Array.isArray(input)) {
+        return input.map((item) => redactObject(item, seen));
+    }
+    const out = {};
+    for (const [key, val] of Object.entries(input)) {
+        if (SENSITIVE_KEYS.has(key.toLowerCase())) {
+            out[key] = REDACTED;
+        }
+        else {
+            out[key] = redactObject(val, seen);
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=redaction.js.map

package/dist/providers/oauth/redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../../../src/providers/oauth/redaction.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B,0EAA0E;AAC1E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,cAAc;IACd,aAAa;IACb,eAAe;IACf,cAAc;IACd,MAAM;IACN,eAAe;IACf,cAAc;IACd,eAAe;IACf,cAAc;IACd,eAAe;IACf,UAAU;IACV,SAAS;CACV,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAAgC;IAC1D,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IACvC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC;AAC5C,CAAC;AAiBD,MAAM,UAAU,YAAY,CAC1B,KAAc,EACd,IAAI,GAAG,IAAI,OAAO,EAAU;IAE5B,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,0EAA0E;QAC1E,gBAAgB;QAChB,OAAO,KAAsB,CAAC;IAChC,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAEhB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,GAAG,GAAqC,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC1E,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC1C,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/providers/oauth/secure-credential-store.d.ts

@@ -0,0 +1,67 @@
+/**
+ * SecureCredentialStore — the lowest storage layer.
+ *
+ * A minimal named-secret key/value abstraction. It knows nothing about OAuth,
+ * tokens, or providers; it only persists opaque strings under string keys.
+ * Higher layers (`TokenStore`) compose it. This separation is what lets the
+ * token logic be unit-tested against an in-memory backend while production
+ * persists into the OS credential store.
+ */
+import type { Logger } from "@nodetool-ai/config";
+/** Persist opaque secret strings. All operations are async. */
+export interface SecureCredentialStore {
+    /** Return the stored value for `key`, or null if absent. */
+    get(key: string): Promise<string | null>;
+    /** Create or overwrite the value for `key`. */
+    set(key: string, value: string): Promise<void>;
+    /** Remove `key`. Resolves whether or not it existed. */
+    delete(key: string): Promise<void>;
+}
+/**
+ * The subset of the `keytar` native module we depend on. Declared locally so we
+ * neither hard-depend on the package at build time nor pull its prebuilt binary
+ * into bundles that never authenticate.
+ */
+export interface KeyringBackend {
+    getPassword(service: string, account: string): Promise<string | null>;
+    setPassword(service: string, account: string, password: string): Promise<void>;
+    deletePassword(service: string, account: string): Promise<boolean>;
+}
+interface KeychainCredentialStoreOptions {
+    /** Keychain service namespace. */
+    readonly service?: string;
+    /** Inject a backend (tests / custom keyrings). Defaults to lazy `keytar`. */
+    readonly backend?: KeyringBackend;
+    readonly logger?: Logger;
+}
+/**
+ * SecureCredentialStore backed by the operating-system credential store
+ * (macOS Keychain, Windows Credential Manager, Linux Secret Service) via
+ * `keytar`. The OS layer provides at-rest encryption, satisfying the
+ * "refresh tokens encrypted by the OS credential store" requirement. The
+ * native module is loaded lazily so importing this file never forces the
+ * binary to resolve.
+ */
+export declare class KeychainSecureCredentialStore implements SecureCredentialStore {
+    private readonly service;
+    private readonly injectedBackend?;
+    private readonly logger?;
+    private backendPromise?;
+    constructor(options?: KeychainCredentialStoreOptions);
+    private backend;
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<void>;
+}
+/**
+ * In-memory SecureCredentialStore for tests and ephemeral sessions. Holds
+ * secrets only for the lifetime of the instance — never touches disk.
+ */
+export declare class InMemorySecureCredentialStore implements SecureCredentialStore {
+    private readonly map;
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<void>;
+}
+export {};
+//# sourceMappingURL=secure-credential-store.d.ts.map

package/dist/providers/oauth/secure-credential-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-credential-store.d.ts","sourceRoot":"","sources":["../../../src/providers/oauth/secure-credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,+DAA+D;AAC/D,MAAM,WAAW,qBAAqB;IACpC,4DAA4D;IAC5D,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACzC,+CAA+C;IAC/C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,wDAAwD;IACxD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtE,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACpE;AAED,UAAU,8BAA8B;IACtC,kCAAkC;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,qBAAa,6BAA8B,YAAW,qBAAqB;IACzE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAiB;IAClD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;IACjC,OAAO,CAAC,cAAc,CAAC,CAA0B;IAEjD,YAAY,OAAO,GAAE,8BAAmC,EAIvD;YAEa,OAAO;IAcf,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAG7C;IAEK,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKnD;IAEK,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIvC;CACF;AAED;;;GAGG;AACH,qBAAa,6BAA8B,YAAW,qBAAqB;IACzE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA6B;IAE3C,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE7C;IAEK,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnD;IAEK,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvC;CACF"}

package/dist/providers/oauth/secure-credential-store.js

@@ -0,0 +1,73 @@
+/**
+ * SecureCredentialStore — the lowest storage layer.
+ *
+ * A minimal named-secret key/value abstraction. It knows nothing about OAuth,
+ * tokens, or providers; it only persists opaque strings under string keys.
+ * Higher layers (`TokenStore`) compose it. This separation is what lets the
+ * token logic be unit-tested against an in-memory backend while production
+ * persists into the OS credential store.
+ */
+import { importHidden } from "@nodetool-ai/config";
+/**
+ * SecureCredentialStore backed by the operating-system credential store
+ * (macOS Keychain, Windows Credential Manager, Linux Secret Service) via
+ * `keytar`. The OS layer provides at-rest encryption, satisfying the
+ * "refresh tokens encrypted by the OS credential store" requirement. The
+ * native module is loaded lazily so importing this file never forces the
+ * binary to resolve.
+ */
+export class KeychainSecureCredentialStore {
+    service;
+    injectedBackend;
+    logger;
+    backendPromise;
+    constructor(options = {}) {
+        this.service = options.service ?? "nodetool-oauth";
+        this.injectedBackend = options.backend;
+        this.logger = options.logger;
+    }
+    async backend() {
+        if (this.injectedBackend)
+            return this.injectedBackend;
+        this.backendPromise ??= (async () => {
+            const mod = await importHidden("keytar");
+            if (!mod) {
+                throw new Error("Secure credential storage requires the 'keytar' native module, which is unavailable in this runtime");
+            }
+            return mod.default ?? mod;
+        })();
+        return this.backendPromise;
+    }
+    async get(key) {
+        const backend = await this.backend();
+        return backend.getPassword(this.service, key);
+    }
+    async set(key, value) {
+        const backend = await this.backend();
+        await backend.setPassword(this.service, key, value);
+        // Note: `key` is an account label, never a secret; `value` is never logged.
+        this.logger?.debug("Stored credential in OS keychain", { service: this.service, key });
+    }
+    async delete(key) {
+        const backend = await this.backend();
+        await backend.deletePassword(this.service, key);
+        this.logger?.debug("Deleted credential from OS keychain", { service: this.service, key });
+    }
+}
+/**
+ * In-memory SecureCredentialStore for tests and ephemeral sessions. Holds
+ * secrets only for the lifetime of the instance — never touches disk.
+ */
+export class InMemorySecureCredentialStore {
+    map = new Map();
+    async get(key) {
+        return this.map.has(key) ? this.map.get(key) : null;
+    }
+    async set(key, value) {
+        this.map.set(key, value);
+    }
+    async delete(key) {
+        this.map.delete(key);
+    }
+}
+//# sourceMappingURL=secure-credential-store.js.map

package/dist/providers/oauth/secure-credential-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-credential-store.js","sourceRoot":"","sources":["../../../src/providers/oauth/secure-credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAgCnD;;;;;;;GAOG;AACH,MAAM,OAAO,6BAA6B;IACvB,OAAO,CAAS;IAChB,eAAe,CAAkB;IACjC,MAAM,CAAU;IACzB,cAAc,CAA2B;IAEjD,YAAY,OAAO,GAAmC,EAAE;QACtD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;QACnD,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,IAAI,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC;QACtD,IAAI,CAAC,cAAc,KAAK,CAAC,KAAK,IAAI,EAAE;YAClC,MAAM,GAAG,GAAG,MAAM,YAAY,CAA+C,QAAQ,CAAC,CAAC;YACvF,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,KAAK,CACb,qGAAqG,CACtG,CAAC;YACJ,CAAC;YACD,OAAQ,GAAoC,CAAC,OAAO,IAAK,GAAsB,CAAC;QAClF,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrC,OAAO,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa;QAClC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACpD,4EAA4E;QAC5E,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,kCAAkC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,qCAAqC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5F,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,6BAA6B;IACvB,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEjD,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa;QAClC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;CACF"}