@omnicross/subscriptions 0.1.0

package/dist/oauth.cjs

@@ -0,0 +1,396 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/oauth/index.ts
+var oauth_exports = {};
+__export(oauth_exports, {
+  claudeOAuth: () => claude_exports,
+  codexOAuth: () => codex_exports,
+  geminiOAuth: () => gemini_exports
+});
+module.exports = __toCommonJS(oauth_exports);
+
+// src/oauth/flows/claude.ts
+var claude_exports = {};
+__export(claude_exports, {
+  exchangeCodeForTokens: () => exchangeCodeForTokens,
+  exchangeSetupTokenCode: () => exchangeSetupTokenCode,
+  generateAuthParams: () => generateAuthParams,
+  generateSetupTokenParams: () => generateSetupTokenParams,
+  refreshAccessToken: () => refreshAccessToken
+});
+var import_node_crypto = __toESM(require("crypto"), 1);
+
+// src/oauth/fetchPort.ts
+function errorMessage(error, errorDescription) {
+  if (errorDescription) return errorDescription;
+  if (typeof error === "string") return error;
+  if (error && typeof error === "object") {
+    const e = error;
+    if (typeof e.message === "string" && e.message) return e.message;
+    if (typeof e.error_description === "string" && e.error_description) {
+      return e.error_description;
+    }
+    return JSON.stringify(error);
+  }
+  return String(error);
+}
+async function postForm(fetchImpl, url, params, parseErrorMessage) {
+  const response = await fetchImpl(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: params.toString()
+  });
+  const responseData = await response.text();
+  let data;
+  try {
+    data = JSON.parse(responseData);
+  } catch {
+    throw new Error(parseErrorMessage);
+  }
+  if (data.error) {
+    throw new Error(errorMessage(data.error, data.error_description));
+  }
+  return data;
+}
+async function postJson(fetchImpl, url, body, parseErrorMessage, extraHeaders = {}) {
+  const response = await fetchImpl(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...extraHeaders },
+    body: JSON.stringify(body)
+  });
+  const responseData = await response.text();
+  let data;
+  try {
+    data = JSON.parse(responseData);
+  } catch {
+    throw new Error(parseErrorMessage);
+  }
+  if (data.error) {
+    throw new Error(errorMessage(data.error, data.error_description));
+  }
+  return data;
+}
+
+// src/oauth/flows/claude.ts
+var CLAUDE_TOKEN_HEADERS = {
+  "User-Agent": "claude-cli/1.0.56 (external, cli)",
+  Accept: "application/json, text/plain, */*",
+  "Accept-Language": "en-US,en;q=0.9",
+  Referer: "https://claude.ai/",
+  Origin: "https://claude.ai"
+};
+var CLAUDE_OAUTH_CONFIG = {
+  clientId: "9d1c250a-e61b-44d9-88ed-5944d1962f5e",
+  authorizationEndpoint: "https://claude.ai/oauth/authorize",
+  // The token endpoint stays on console.anthropic.com (still the live value —
+  // matches the official Claude Code CLI / claude-relay-service reference); only
+  // the OAuth callback moved to platform.claude.com (2026). The redirect_uri MUST
+  // match what the client is registered for AND match between authorize + token
+  // exchange. Scopes mirror the live Claude Code authorize URL.
+  tokenEndpoint: "https://console.anthropic.com/v1/oauth/token",
+  redirectUri: "https://platform.claude.com/oauth/code/callback",
+  scopes: [
+    "org:create_api_key",
+    "user:profile",
+    "user:inference",
+    "user:sessions:claude_code",
+    "user:mcp_servers",
+    "user:file_upload"
+  ]
+};
+var SETUP_TOKEN_CONFIG = {
+  scopes: ["user:inference"]
+  // Only inference permission, no API key creation
+};
+function generatePkce() {
+  const codeVerifier = import_node_crypto.default.randomBytes(32).toString("base64url");
+  const codeChallenge = import_node_crypto.default.createHash("sha256").update(codeVerifier).digest("base64url");
+  const state = import_node_crypto.default.randomBytes(16).toString("hex");
+  return { codeVerifier, codeChallenge, state };
+}
+function generateAuthParams() {
+  const { codeVerifier, codeChallenge, state } = generatePkce();
+  const params = new URLSearchParams({
+    code: "true",
+    client_id: CLAUDE_OAUTH_CONFIG.clientId,
+    response_type: "code",
+    redirect_uri: CLAUDE_OAUTH_CONFIG.redirectUri,
+    scope: CLAUDE_OAUTH_CONFIG.scopes.join(" "),
+    code_challenge: codeChallenge,
+    code_challenge_method: "S256",
+    state
+  });
+  const authUrl = `${CLAUDE_OAUTH_CONFIG.authorizationEndpoint}?${params.toString()}`;
+  return { authUrl, codeVerifier, state };
+}
+function generateSetupTokenParams() {
+  const { codeVerifier, codeChallenge, state } = generatePkce();
+  const params = new URLSearchParams({
+    code: "true",
+    client_id: CLAUDE_OAUTH_CONFIG.clientId,
+    response_type: "code",
+    redirect_uri: CLAUDE_OAUTH_CONFIG.redirectUri,
+    scope: SETUP_TOKEN_CONFIG.scopes.join(" "),
+    code_challenge: codeChallenge,
+    code_challenge_method: "S256",
+    state
+  });
+  const authUrl = `${CLAUDE_OAUTH_CONFIG.authorizationEndpoint}?${params.toString()}`;
+  return { authUrl, codeVerifier, state };
+}
+async function exchangeCodeForTokens(request, fetchImpl) {
+  const { authorizationCode, codeVerifier, state } = request;
+  const code = authorizationCode.split("#")[0]?.split("&")[0] ?? authorizationCode;
+  const data = await postJson(
+    fetchImpl,
+    CLAUDE_OAUTH_CONFIG.tokenEndpoint,
+    {
+      grant_type: "authorization_code",
+      client_id: CLAUDE_OAUTH_CONFIG.clientId,
+      code,
+      code_verifier: codeVerifier,
+      redirect_uri: CLAUDE_OAUTH_CONFIG.redirectUri,
+      state
+    },
+    "Failed to parse token response",
+    CLAUDE_TOKEN_HEADERS
+  );
+  return {
+    accessToken: data.access_token,
+    // The authorization_code grant always returns a refresh_token; the original
+    // helper read it from an untyped `data` and declared the field `string`.
+    refreshToken: data.refresh_token,
+    expiresIn: data.expires_in,
+    scopes: data.scope?.split(" ") || CLAUDE_OAUTH_CONFIG.scopes
+  };
+}
+async function exchangeSetupTokenCode(request, fetchImpl) {
+  const { authorizationCode, codeVerifier, state } = request;
+  const code = authorizationCode.split("#")[0]?.split("&")[0] ?? authorizationCode;
+  const data = await postJson(
+    fetchImpl,
+    CLAUDE_OAUTH_CONFIG.tokenEndpoint,
+    {
+      grant_type: "authorization_code",
+      client_id: CLAUDE_OAUTH_CONFIG.clientId,
+      code,
+      code_verifier: codeVerifier,
+      redirect_uri: CLAUDE_OAUTH_CONFIG.redirectUri,
+      state
+    },
+    "Failed to parse setup token response",
+    CLAUDE_TOKEN_HEADERS
+  );
+  return {
+    accessToken: data.access_token,
+    expiresIn: data.expires_in,
+    scopes: data.scope?.split(" ") || SETUP_TOKEN_CONFIG.scopes
+  };
+}
+async function refreshAccessToken(refreshToken, fetchImpl) {
+  const data = await postJson(
+    fetchImpl,
+    CLAUDE_OAUTH_CONFIG.tokenEndpoint,
+    {
+      grant_type: "refresh_token",
+      client_id: CLAUDE_OAUTH_CONFIG.clientId,
+      refresh_token: refreshToken
+    },
+    "Failed to parse refresh response",
+    CLAUDE_TOKEN_HEADERS
+  );
+  return {
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token || refreshToken,
+    expiresIn: data.expires_in
+  };
+}
+
+// src/oauth/flows/codex.ts
+var codex_exports = {};
+__export(codex_exports, {
+  exchangeCodeForTokens: () => exchangeCodeForTokens2,
+  generateAuthParams: () => generateAuthParams2,
+  refreshAccessToken: () => refreshAccessToken2
+});
+var import_node_crypto2 = __toESM(require("crypto"), 1);
+var CODEX_OAUTH_CONFIG = {
+  clientId: "app_EMoamEEZ73f0CkXaXp7hrann",
+  authorizationEndpoint: "https://auth.openai.com/oauth/authorize",
+  tokenEndpoint: "https://auth.openai.com/oauth/token",
+  redirectUri: "http://localhost:1455/auth/callback",
+  scopes: ["openid", "profile", "email", "offline_access"]
+};
+function generateAuthParams2() {
+  const codeVerifier = import_node_crypto2.default.randomBytes(64).toString("hex");
+  const codeChallenge = import_node_crypto2.default.createHash("sha256").update(codeVerifier).digest("base64url");
+  const state = import_node_crypto2.default.randomBytes(16).toString("hex");
+  const params = new URLSearchParams({
+    response_type: "code",
+    client_id: CODEX_OAUTH_CONFIG.clientId,
+    redirect_uri: CODEX_OAUTH_CONFIG.redirectUri,
+    scope: CODEX_OAUTH_CONFIG.scopes.join(" "),
+    code_challenge: codeChallenge,
+    code_challenge_method: "S256",
+    state
+  });
+  const authUrl = `${CODEX_OAUTH_CONFIG.authorizationEndpoint}?${params.toString()}`;
+  return { authUrl, codeVerifier, state };
+}
+async function exchangeCodeForTokens2(request, fetchImpl) {
+  const { authorizationCode, codeVerifier } = request;
+  const params = new URLSearchParams({
+    grant_type: "authorization_code",
+    client_id: CODEX_OAUTH_CONFIG.clientId,
+    code: authorizationCode,
+    code_verifier: codeVerifier,
+    redirect_uri: CODEX_OAUTH_CONFIG.redirectUri
+  });
+  const data = await postForm(
+    fetchImpl,
+    CODEX_OAUTH_CONFIG.tokenEndpoint,
+    params,
+    "Failed to parse token response"
+  );
+  return {
+    accessToken: data.access_token,
+    // authorization_code grant returns both; the original helper read them from
+    // an untyped `data` and declared the fields `string`.
+    refreshToken: data.refresh_token,
+    idToken: data.id_token,
+    expiresIn: data.expires_in
+  };
+}
+async function refreshAccessToken2(refreshToken, fetchImpl) {
+  const params = new URLSearchParams({
+    grant_type: "refresh_token",
+    client_id: CODEX_OAUTH_CONFIG.clientId,
+    refresh_token: refreshToken,
+    scope: "openid profile email"
+  });
+  const data = await postForm(
+    fetchImpl,
+    CODEX_OAUTH_CONFIG.tokenEndpoint,
+    params,
+    "Failed to parse refresh response"
+  );
+  return {
+    accessToken: data.access_token,
+    idToken: data.id_token,
+    refreshToken: data.refresh_token || refreshToken,
+    expiresIn: data.expires_in || 3600
+  };
+}
+
+// src/oauth/flows/gemini.ts
+var gemini_exports = {};
+__export(gemini_exports, {
+  exchangeCodeForTokens: () => exchangeCodeForTokens3,
+  generateAuthParams: () => generateAuthParams3,
+  refreshAccessToken: () => refreshAccessToken3
+});
+var import_node_crypto3 = __toESM(require("crypto"), 1);
+var GEMINI_OAUTH_CONFIG = {
+  clientId: "681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com",
+  // The Gemini CLI's *public* installed-app OAuth client secret (mirrors the
+  // upstream CLI). Per Google's OAuth docs, native-app client secrets are not
+  // treated as confidential — not a leaked key.
+  clientSecret: "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",
+  // allowlist-secret
+  authorizationEndpoint: "https://accounts.google.com/o/oauth2/v2/auth",
+  tokenEndpoint: "https://oauth2.googleapis.com/token",
+  redirectUri: "urn:ietf:wg:oauth:2.0:oob",
+  scopes: ["https://www.googleapis.com/auth/cloud-platform"]
+};
+function generateAuthParams3() {
+  const codeVerifier = import_node_crypto3.default.randomBytes(32).toString("base64url");
+  const codeChallenge = import_node_crypto3.default.createHash("sha256").update(codeVerifier).digest("base64url");
+  const state = import_node_crypto3.default.randomBytes(16).toString("hex");
+  const params = new URLSearchParams({
+    client_id: GEMINI_OAUTH_CONFIG.clientId,
+    redirect_uri: GEMINI_OAUTH_CONFIG.redirectUri,
+    scope: GEMINI_OAUTH_CONFIG.scopes.join(" "),
+    response_type: "code",
+    code_challenge: codeChallenge,
+    code_challenge_method: "S256",
+    state,
+    access_type: "offline",
+    prompt: "consent"
+  });
+  const authUrl = `${GEMINI_OAUTH_CONFIG.authorizationEndpoint}?${params.toString()}`;
+  return { authUrl, codeVerifier, state };
+}
+async function exchangeCodeForTokens3(authorizationCode, codeVerifier, fetchImpl) {
+  const params = new URLSearchParams({
+    grant_type: "authorization_code",
+    client_id: GEMINI_OAUTH_CONFIG.clientId,
+    client_secret: GEMINI_OAUTH_CONFIG.clientSecret,
+    code: authorizationCode,
+    code_verifier: codeVerifier,
+    redirect_uri: GEMINI_OAUTH_CONFIG.redirectUri
+  });
+  const data = await postForm(
+    fetchImpl,
+    GEMINI_OAUTH_CONFIG.tokenEndpoint,
+    params,
+    "Failed to parse token response"
+  );
+  return {
+    accessToken: data.access_token,
+    // authorization_code grant returns a refresh_token; the original helper read
+    // it from an untyped `data` and declared the field `string`.
+    refreshToken: data.refresh_token,
+    expiresIn: data.expires_in
+  };
+}
+async function refreshAccessToken3(refreshToken, fetchImpl) {
+  const params = new URLSearchParams({
+    grant_type: "refresh_token",
+    client_id: GEMINI_OAUTH_CONFIG.clientId,
+    client_secret: GEMINI_OAUTH_CONFIG.clientSecret,
+    refresh_token: refreshToken
+  });
+  const data = await postForm(
+    fetchImpl,
+    GEMINI_OAUTH_CONFIG.tokenEndpoint,
+    params,
+    "Failed to parse refresh response"
+  );
+  return {
+    accessToken: data.access_token,
+    expiresIn: data.expires_in
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  claudeOAuth,
+  codexOAuth,
+  geminiOAuth
+});

package/dist/oauth.d.cts

@@ -0,0 +1,131 @@
+import { TokenExchangeRequest, OAuthParams } from '@omnicross/contracts/account-tokens-types';
+
+/** Injectable fetch so tests can mock the network without a live endpoint. */
+type FetchLike = (url: string, init: RequestInit) => Promise<Response>;
+
+/**
+ * Claude OAuth flow — host-clean PKCE logic.
+ *
+ * Pure logic only: authorize-URL construction, PKCE generation, authorization-
+ * code exchange, setup-token exchange, and refresh. Every network request goes
+ * through an INJECTED `FetchLike` port — NO `electron`, NO `net`, NO host path
+ * (a desktop host can inject an electron-net adapter; the daemon injects global
+ * `fetch`). Claude `code=true`, `state` carried in exchange, setup-token has no
+ * refresh_token. Reference: claude-relay-service `src/utils/oauthHelper.js`.
+ *
+ * @module @omnicross/subscriptions/oauth/flows/claude
+ */
+
+/** Generate OAuth authorization parameters (PKCE). */
+declare function generateAuthParams$2(): OAuthParams;
+/**
+ * Generate Setup Token authorization parameters (PKCE). Setup Token has minimal
+ * permissions (user:inference only) but longer expiry; no refresh token is
+ * returned — the user re-authorizes when it expires.
+ */
+declare function generateSetupTokenParams(): OAuthParams;
+/** Exchange authorization code for tokens. */
+declare function exchangeCodeForTokens$2(request: TokenExchangeRequest, fetchImpl: FetchLike): Promise<{
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+    scopes: string[];
+}>;
+/**
+ * Exchange Setup Token authorization code for access token.
+ * Note: Setup Token does NOT return refresh_token.
+ */
+declare function exchangeSetupTokenCode(request: TokenExchangeRequest, fetchImpl: FetchLike): Promise<{
+    accessToken: string;
+    expiresIn: number;
+    scopes: string[];
+}>;
+/** Refresh access token using refresh_token. */
+declare function refreshAccessToken$2(refreshToken: string, fetchImpl: FetchLike): Promise<{
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+}>;
+
+declare const claude_exchangeSetupTokenCode: typeof exchangeSetupTokenCode;
+declare const claude_generateSetupTokenParams: typeof generateSetupTokenParams;
+declare namespace claude {
+  export { exchangeCodeForTokens$2 as exchangeCodeForTokens, claude_exchangeSetupTokenCode as exchangeSetupTokenCode, generateAuthParams$2 as generateAuthParams, claude_generateSetupTokenParams as generateSetupTokenParams, refreshAccessToken$2 as refreshAccessToken };
+}
+
+/**
+ * Codex (ChatGPT) OAuth flow — host-clean PKCE logic.
+ *
+ * PKCE verifier = `randomBytes(64).hex` (NOT base64url like claude/gemini),
+ * loopback redirect_uri, scope `openid profile email offline_access`, NO state in
+ * the exchange body, refresh carries `scope=openid profile email`, and the refresh
+ * defaults `expiresIn` to 3600 + returns an `idToken`. Network goes through the
+ * injected `FetchLike`.
+ * Reference: claude-relay-service `src/services/openaiAccountService.js`.
+ *
+ * @module @omnicross/subscriptions/oauth/flows/codex
+ */
+
+/** Generate OAuth authorization parameters (PKCE). */
+declare function generateAuthParams$1(): OAuthParams;
+/** Exchange authorization code for tokens (codex carries NO state in the body). */
+declare function exchangeCodeForTokens$1(request: TokenExchangeRequest, fetchImpl: FetchLike): Promise<{
+    accessToken: string;
+    refreshToken: string;
+    idToken: string;
+    expiresIn: number;
+}>;
+/** Refresh access token using refresh_token. */
+declare function refreshAccessToken$1(refreshToken: string, fetchImpl: FetchLike): Promise<{
+    accessToken: string;
+    idToken: string;
+    refreshToken: string;
+    expiresIn: number;
+}>;
+
+declare namespace codex {
+  export { exchangeCodeForTokens$1 as exchangeCodeForTokens, generateAuthParams$1 as generateAuthParams, refreshAccessToken$1 as refreshAccessToken };
+}
+
+/**
+ * Gemini (Google) OAuth flow — host-clean logic.
+ *
+ * PKCE verifier = `randomBytes(32).base64url`, oob redirect_uri
+ * (`urn:ietf:wg:oauth:2.0:oob`), authorize carries `access_type=offline` +
+ * `prompt=consent`, the exchange + refresh bodies carry the public installed-app
+ * `client_secret`, and the refresh response is NOT expected to return a new
+ * refresh_token (the caller reuses the old one — see the store's
+ * `refreshGeminiToken`). Network goes through the injected `FetchLike`.
+ * NOTE: `exchangeCodeForTokens` keeps a POSITIONAL signature
+ * `(authorizationCode, codeVerifier)`.
+ * Reference: claude-relay-service `src/services/geminiAccountService.js`.
+ *
+ * @module @omnicross/subscriptions/oauth/flows/gemini
+ */
+
+/** Generate OAuth authorization parameters. */
+declare function generateAuthParams(): OAuthParams;
+/** Exchange authorization code for tokens (positional args, mirrors the helper). */
+declare function exchangeCodeForTokens(authorizationCode: string, codeVerifier: string, fetchImpl: FetchLike): Promise<{
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+}>;
+/**
+ * Refresh access token using refresh_token. The Google token endpoint does NOT
+ * return a refresh_token on refresh — the result intentionally omits it (the
+ * store reuses the old value).
+ */
+declare function refreshAccessToken(refreshToken: string, fetchImpl: FetchLike): Promise<{
+    accessToken: string;
+    expiresIn: number;
+}>;
+
+declare const gemini_exchangeCodeForTokens: typeof exchangeCodeForTokens;
+declare const gemini_generateAuthParams: typeof generateAuthParams;
+declare const gemini_refreshAccessToken: typeof refreshAccessToken;
+declare namespace gemini {
+  export { gemini_exchangeCodeForTokens as exchangeCodeForTokens, gemini_generateAuthParams as generateAuthParams, gemini_refreshAccessToken as refreshAccessToken };
+}
+
+export { type FetchLike, claude as claudeOAuth, codex as codexOAuth, gemini as geminiOAuth };

package/dist/oauth.d.ts

@@ -0,0 +1,131 @@
+import { TokenExchangeRequest, OAuthParams } from '@omnicross/contracts/account-tokens-types';
+
+/** Injectable fetch so tests can mock the network without a live endpoint. */
+type FetchLike = (url: string, init: RequestInit) => Promise<Response>;
+
+/**
+ * Claude OAuth flow — host-clean PKCE logic.
+ *
+ * Pure logic only: authorize-URL construction, PKCE generation, authorization-
+ * code exchange, setup-token exchange, and refresh. Every network request goes
+ * through an INJECTED `FetchLike` port — NO `electron`, NO `net`, NO host path
+ * (a desktop host can inject an electron-net adapter; the daemon injects global
+ * `fetch`). Claude `code=true`, `state` carried in exchange, setup-token has no
+ * refresh_token. Reference: claude-relay-service `src/utils/oauthHelper.js`.
+ *
+ * @module @omnicross/subscriptions/oauth/flows/claude
+ */
+
+/** Generate OAuth authorization parameters (PKCE). */
+declare function generateAuthParams$2(): OAuthParams;
+/**
+ * Generate Setup Token authorization parameters (PKCE). Setup Token has minimal
+ * permissions (user:inference only) but longer expiry; no refresh token is
+ * returned — the user re-authorizes when it expires.
+ */
+declare function generateSetupTokenParams(): OAuthParams;
+/** Exchange authorization code for tokens. */
+declare function exchangeCodeForTokens$2(request: TokenExchangeRequest, fetchImpl: FetchLike): Promise<{
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+    scopes: string[];
+}>;
+/**
+ * Exchange Setup Token authorization code for access token.
+ * Note: Setup Token does NOT return refresh_token.
+ */
+declare function exchangeSetupTokenCode(request: TokenExchangeRequest, fetchImpl: FetchLike): Promise<{
+    accessToken: string;
+    expiresIn: number;
+    scopes: string[];
+}>;
+/** Refresh access token using refresh_token. */
+declare function refreshAccessToken$2(refreshToken: string, fetchImpl: FetchLike): Promise<{
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+}>;
+
+declare const claude_exchangeSetupTokenCode: typeof exchangeSetupTokenCode;
+declare const claude_generateSetupTokenParams: typeof generateSetupTokenParams;
+declare namespace claude {
+  export { exchangeCodeForTokens$2 as exchangeCodeForTokens, claude_exchangeSetupTokenCode as exchangeSetupTokenCode, generateAuthParams$2 as generateAuthParams, claude_generateSetupTokenParams as generateSetupTokenParams, refreshAccessToken$2 as refreshAccessToken };
+}
+
+/**
+ * Codex (ChatGPT) OAuth flow — host-clean PKCE logic.
+ *
+ * PKCE verifier = `randomBytes(64).hex` (NOT base64url like claude/gemini),
+ * loopback redirect_uri, scope `openid profile email offline_access`, NO state in
+ * the exchange body, refresh carries `scope=openid profile email`, and the refresh
+ * defaults `expiresIn` to 3600 + returns an `idToken`. Network goes through the
+ * injected `FetchLike`.
+ * Reference: claude-relay-service `src/services/openaiAccountService.js`.
+ *
+ * @module @omnicross/subscriptions/oauth/flows/codex
+ */
+
+/** Generate OAuth authorization parameters (PKCE). */
+declare function generateAuthParams$1(): OAuthParams;
+/** Exchange authorization code for tokens (codex carries NO state in the body). */
+declare function exchangeCodeForTokens$1(request: TokenExchangeRequest, fetchImpl: FetchLike): Promise<{
+    accessToken: string;
+    refreshToken: string;
+    idToken: string;
+    expiresIn: number;
+}>;
+/** Refresh access token using refresh_token. */
+declare function refreshAccessToken$1(refreshToken: string, fetchImpl: FetchLike): Promise<{
+    accessToken: string;
+    idToken: string;
+    refreshToken: string;
+    expiresIn: number;
+}>;
+
+declare namespace codex {
+  export { exchangeCodeForTokens$1 as exchangeCodeForTokens, generateAuthParams$1 as generateAuthParams, refreshAccessToken$1 as refreshAccessToken };
+}
+
+/**
+ * Gemini (Google) OAuth flow — host-clean logic.
+ *
+ * PKCE verifier = `randomBytes(32).base64url`, oob redirect_uri
+ * (`urn:ietf:wg:oauth:2.0:oob`), authorize carries `access_type=offline` +
+ * `prompt=consent`, the exchange + refresh bodies carry the public installed-app
+ * `client_secret`, and the refresh response is NOT expected to return a new
+ * refresh_token (the caller reuses the old one — see the store's
+ * `refreshGeminiToken`). Network goes through the injected `FetchLike`.
+ * NOTE: `exchangeCodeForTokens` keeps a POSITIONAL signature
+ * `(authorizationCode, codeVerifier)`.
+ * Reference: claude-relay-service `src/services/geminiAccountService.js`.
+ *
+ * @module @omnicross/subscriptions/oauth/flows/gemini
+ */
+
+/** Generate OAuth authorization parameters. */
+declare function generateAuthParams(): OAuthParams;
+/** Exchange authorization code for tokens (positional args, mirrors the helper). */
+declare function exchangeCodeForTokens(authorizationCode: string, codeVerifier: string, fetchImpl: FetchLike): Promise<{
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+}>;
+/**
+ * Refresh access token using refresh_token. The Google token endpoint does NOT
+ * return a refresh_token on refresh — the result intentionally omits it (the
+ * store reuses the old value).
+ */
+declare function refreshAccessToken(refreshToken: string, fetchImpl: FetchLike): Promise<{
+    accessToken: string;
+    expiresIn: number;
+}>;
+
+declare const gemini_exchangeCodeForTokens: typeof exchangeCodeForTokens;
+declare const gemini_generateAuthParams: typeof generateAuthParams;
+declare const gemini_refreshAccessToken: typeof refreshAccessToken;
+declare namespace gemini {
+  export { gemini_exchangeCodeForTokens as exchangeCodeForTokens, gemini_generateAuthParams as generateAuthParams, gemini_refreshAccessToken as refreshAccessToken };
+}
+
+export { type FetchLike, claude as claudeOAuth, codex as codexOAuth, gemini as geminiOAuth };