@payloadcms/figma 0.0.1-alpha.64 → 0.0.1-alpha.66

package/dist/db-content-api/generated/content-api-types.d.ts

@@ -3483,6 +3483,8 @@ export type components = {
         CreateDocumentRequest: {
             /** @example cms-xxxxx-xxxxx */
             contentSystemId: string;
+            /** User-defined Payload environment name (e.g. "production"). */
+            environmentName?: string;
             /** @example posts */
             collection: string;
             doc: components['schemas']['DocumentData'];
@@ -3594,6 +3596,8 @@ export type components = {
         UpdateDocumentRequest: {
             /** @example cms-xxxxx-xxxxx */
             contentSystemId: string;
+            /** User-defined Payload environment name (e.g. "production"). */
+            environmentName?: string;
             /** @example posts */
             collection: string;
             /** @example false */
@@ -3627,6 +3631,8 @@ export type components = {
         DeleteDocumentRequest: {
             /** @example cms-xxxxx-xxxxx */
             contentSystemId: string;
+            /** User-defined Payload environment name (e.g. "production"). */
+            environmentName?: string;
             /** @example posts */
             collection: string;
             locale?: components['schemas']['LocaleClause'];

package/dist/db-content-api/index.d.ts

@@ -6,6 +6,7 @@ type ContentAPIOptions = {
     allowIDOnCreate?: boolean;
     auth: AuthMode;
     contentSystemId: string;
+    environmentName?: string;
     url: string;
 };
 export type ContentAPIAdapter = {
@@ -13,6 +14,7 @@ export type ContentAPIAdapter = {
     clearDatabase: () => Promise<void>;
     client: ReturnType<typeof createClient<paths>>;
     contentSystemId: string;
+    environmentName?: string;
     idType: 'uuid';
     url: string;
 } & BaseDatabaseAdapter;

package/dist/db-content-api/index.js

@@ -213,7 +213,7 @@ async function createVersion(args) {
             contentSystemId: this.contentSystemId,
             versionDoc: {
                 createdAt: args.createdAt,
-                latest: !args.autosave,
+                latest: true,
                 parent: String(args.parent),
                 updatedAt: args.updatedAt,
                 version: dataToContentAPI(this.payload, args.collectionSlug, args.versionData, {
@@ -365,6 +365,7 @@ async function updateMany(args) {
             contentSystemId: this.contentSystemId,
             createOnMissing: false,
             doc: dataToContentAPI(this.payload, args.collection, args.data),
+            environmentName: this.environmentName,
             limit: args.limit,
             locale,
             returning: {},
@@ -411,6 +412,7 @@ async function updateOne(args) {
             contentSystemId: this.contentSystemId,
             createOnMissing: false,
             doc: dataToContentAPI(this.payload, args.collection, args.data),
+            environmentName: this.environmentName,
             locale,
             returning: {},
             where: convertPayloadWhereToContentAPI(where),
@@ -447,6 +449,7 @@ async function deleteMany(args) {
         body: {
             collection: args.collection,
             contentSystemId: this.contentSystemId,
+            environmentName: this.environmentName,
             locale,
             where: convertPayloadWhereToContentAPI(args.where),
             ...buildMeta(this.payload, {
@@ -466,6 +469,7 @@ async function deleteOne(args) {
         body: {
             collection: args.collection,
             contentSystemId: this.contentSystemId,
+            environmentName: this.environmentName,
             locale,
             returning: {},
             where: convertPayloadWhereToContentAPI(args.where),
@@ -525,6 +529,7 @@ async function create(args) {
                 }),
                 id
             },
+            environmentName: this.environmentName,
             locale,
             ...buildMeta(this.payload, {
                 collection: args.collection,
@@ -643,6 +648,7 @@ async function upsert(args) {
                 applyDefaults: true,
                 createdAt: true
             }),
+            environmentName: this.environmentName,
             locale,
             where: convertPayloadWhereToContentAPI(args.where),
             ...buildMeta(this.payload, {
@@ -708,6 +714,7 @@ async function updateJobs(args) {
             contentSystemId: this.contentSystemId,
             createOnMissing: false,
             doc: docData,
+            environmentName: this.environmentName,
             ...limit != null && {
                 limit
             },
@@ -862,6 +869,7 @@ export const contentAPIAdapter = (opts)=>({
                 deleteMany: deleteMany,
                 deleteOne: deleteOne,
                 deleteVersions: deleteVersions,
+                environmentName: opts.environmentName,
                 find: find,
                 findDistinct: findDistinct,
                 findGlobal: findGlobal,

package/dist/lib/download-skill.d.ts

@@ -0,0 +1,13 @@
+export type DownloadSkillResult = {
+    detail?: string;
+    ok: false;
+    reason: 'already-installed' | 'empty-extract' | 'error' | 'fetch-failed';
+} | {
+    ok: true;
+};
+export declare function downloadSkill(args: {
+    branch?: string;
+    debug?: boolean;
+    projectDir: string;
+}): Promise<DownloadSkillResult>;
+//# sourceMappingURL=download-skill.d.ts.map

package/dist/lib/download-skill.js

@@ -0,0 +1,79 @@
+import fs from 'fs/promises';
+import { Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+import path from 'path';
+import { x } from 'tar';
+export async function downloadSkill(args) {
+    const { branch = 'main', debug, projectDir } = args;
+    const destDir = path.join(projectDir, '.claude', 'skills', 'payload');
+    if (await pathExists(path.join(destDir, 'SKILL.md'))) {
+        return {
+            ok: false,
+            reason: 'already-installed'
+        };
+    }
+    const url = `https://codeload.github.com/payloadcms/payload/tar.gz/${branch}`;
+    const filter = `payload-${branch.replace(/^v/, '').replaceAll('/', '-')}/tools/claude-plugin/skills/payload/`;
+    if (debug) {
+        // eslint-disable-next-line no-console
+        console.log(`[download-skill] url=${url} dest=${destDir}`);
+    }
+    try {
+        const res = await fetch(url);
+        if (!res.ok) {
+            return {
+                detail: `${res.status} ${res.statusText}`,
+                ok: false,
+                reason: 'fetch-failed'
+            };
+        }
+        if (!res.body) {
+            return {
+                detail: 'empty response body',
+                ok: false,
+                reason: 'fetch-failed'
+            };
+        }
+        await fs.mkdir(destDir, {
+            recursive: true
+        });
+        await pipeline(Readable.from(res.body), x({
+            cwd: destDir,
+            filter: (p)=>p.includes(filter),
+            strip: filter.split('/').length - 1
+        }));
+        if (!await pathExists(path.join(destDir, 'SKILL.md'))) {
+            await fs.rm(destDir, {
+                force: true,
+                recursive: true
+            });
+            return {
+                ok: false,
+                reason: 'empty-extract'
+            };
+        }
+        return {
+            ok: true
+        };
+    } catch (err) {
+        await fs.rm(destDir, {
+            force: true,
+            recursive: true
+        }).catch(()=>{});
+        return {
+            detail: err instanceof Error ? err.message : String(err),
+            ok: false,
+            reason: 'error'
+        };
+    }
+}
+async function pathExists(p) {
+    try {
+        await fs.access(p);
+        return true;
+    } catch  {
+        return false;
+    }
+}
+
+//# sourceMappingURL=download-skill.js.map

package/dist/oauth/endpoints/getLoginEndpoint.js

@@ -1,11 +1,10 @@
-import { APIError, generateCookie, parseCookies } from 'payload';
+import { APIError, parseCookies } from 'payload';
 import { formatAdminURL, getSafeRedirect } from 'payload/shared';
-import { getProjectToken, getUserInfo } from '../../api/figma-api.js';
-import { createCookieOptions } from '../utilities/createCookieOptions.js';
 import { createDebugLogger } from '../utilities/createDebugLogger.js';
+import { establishSession } from '../utilities/establishSession.js';
+import { exchangeCodeForAccessToken } from '../utilities/exchangeCodeForAccessToken.js';
 import { extractOrigin } from '../utilities/extractOrigin.js';
-import { getCookieExpiration } from '../utilities/getCookieExpiration.js';
-const isAbsoluteURL = (url)=>/^[a-z][a-z\d+.-]*:/.test(url);
+import { isAbsoluteURL } from '../utilities/isAbsoluteURL.js';
 export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug, pluginOptions, strategy })=>({
         handler: async (req)=>{
             const { config } = req.payload;
@@ -127,32 +126,21 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
                     });
                     return Response.redirect(failedRedirect);
                 }
-                const body = {
-                    client_id: strategy.clientID,
-                    code,
-                    code_verifier: req.payload.decrypt(state.verifier),
-                    grant_type: 'authorization_code',
-                    redirect_uri: formatAdminURL({
-                        apiRoute: config.routes?.api || '/api',
-                        path: `/${collection.slug}/${endpointSlug}/login`,
-                        serverURL: redirectServerURL
-                    })
-                };
-                if (strategy.collectionOptions.clientSecret) {
-                    body.client_secret = strategy.collectionOptions.clientSecret;
-                }
+                const redirectUri = formatAdminURL({
+                    apiRoute: config.routes?.api || '/api',
+                    path: `/${collection.slug}/${endpointSlug}/login`,
+                    serverURL: redirectServerURL
+                });
                 debugLogger.info({
                     msg: 'Exchanging code for access token',
-                    path,
-                    requestBody: body
+                    path
+                });
+                const tokenRes = await exchangeCodeForAccessToken({
+                    code,
+                    codeVerifier: req.payload.decrypt(state.verifier),
+                    redirectUri,
+                    strategy
                 });
-                const tokenRes = await fetch(strategy.meta?.token_endpoint, {
-                    body: new URLSearchParams(body),
-                    headers: {
-                        'Content-Type': 'application/x-www-form-urlencoded'
-                    },
-                    method: 'POST'
-                }).then((r)=>r.json());
                 debugLogger.info({
                     msg: 'Token Response',
                     path,
@@ -167,25 +155,6 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
                     });
                     return Response.redirect(failedRedirect);
                 }
-                // Fetch Figma user info for handle and profile image
-                let figmaUserInfo = null;
-                try {
-                    const oauthCredential = {
-                        type: 'oauth',
-                        token: access_token
-                    };
-                    figmaUserInfo = await getUserInfo(oauthCredential);
-                    debugLogger.info({
-                        figmaUserInfo,
-                        msg: 'Fetched Figma user info'
-                    });
-                } catch (err) {
-                    // Non-fatal: user will just not have handle/image
-                    debugLogger.error({
-                        err,
-                        msg: 'Failed to fetch Figma user info'
-                    });
-                }
                 if (!access_token) {
                     const errMsg = 'No access_token was returned from the identity provider.';
                     req.payload.logger.error({
@@ -195,30 +164,6 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
                     });
                     throw new APIError(errMsg);
                 }
-                // Swap for project token
-                const oauthCredential = {
-                    type: 'oauth',
-                    token: access_token
-                };
-                const project_token = await getProjectToken(oauthCredential, config.custom.figma.contentSystemId);
-                const refresh_token = access_token;
-                // Store project token as access_token
-                const token = project_token.token;
-                const expiresIn = project_token.expiresAt;
-                if (!token) {
-                    const errMsg = `No ${collectionOptions.token || 'access_token'} was returned from the identity provider.`;
-                    req.payload.logger.error({
-                        msg: errMsg,
-                        path
-                    });
-                    throw new APIError(errMsg);
-                }
-                const cookieOptions = createCookieOptions({
-                    collection,
-                    headers: req.headers,
-                    pluginOptions
-                });
-                // get the payloadRedirect cookie value
                 const cookies = parseCookies(req.headers);
                 const payloadRedirect = 'payloadRedirect' in cookies ? cookies.payloadRedirect : '';
                 if (!req.responseHeaders) {
@@ -232,43 +177,17 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
                     }
                     req.responseHeaders.append('Set-Cookie', `payloadRedirect=${redirectToUse}; Max-Age=0; Path=/;`);
                 }
-                if (refresh_token && !collectionOptions.usePayloadJWT) {
-                    debugLogger.info('Setting refresh token cookie');
-                    const refreshCookie = generateCookie({
-                        returnCookieAsObject: false,
-                        ...cookieOptions,
-                        name: `${strategy.cookieName}-refresh`,
-                        value: refresh_token,
-                        // Default to 1 year if no expiration
-                        expires: getCookieExpiration(cookieOptions?.expires ?? refreshTokenExpires ?? 31_556_952)
-                    });
-                    req.responseHeaders.append('Set-Cookie', refreshCookie);
-                }
-                const tokenExpires = cookieOptions?.expires ? getCookieExpiration(cookieOptions.expires) : new Date(expiresIn) // Project token uses epoch time
-                ;
-                const tokenCookie = generateCookie({
-                    ...cookieOptions,
-                    name: strategy.cookieName,
-                    expires: tokenExpires,
-                    returnCookieAsObject: false,
-                    value: token
+                await establishSession({
+                    accessToken: access_token,
+                    collection,
+                    collectionOptions,
+                    contentSystemId: config.custom.figma.contentSystemId,
+                    debugLogger,
+                    pluginOptions,
+                    refreshTokenExpiresIn: refreshTokenExpires,
+                    req,
+                    strategy
                 });
-                req.responseHeaders.append('Set-Cookie', tokenCookie);
-                // Store user info in short-lived cookie for defaultVerify to consume
-                if (figmaUserInfo) {
-                    const userInfoValue = Buffer.from(JSON.stringify({
-                        handle: figmaUserInfo.handle,
-                        img_url: figmaUserInfo.img_url
-                    })).toString('base64');
-                    const userInfoCookie = generateCookie({
-                        ...cookieOptions,
-                        name: pluginOptions?.userInfoCookieName ?? 'figma-user-info',
-                        expires: new Date(Date.now() + 60_000),
-                        returnCookieAsObject: false,
-                        value: userInfoValue
-                    });
-                    req.responseHeaders.append('Set-Cookie', userInfoCookie);
-                }
                 return Response.redirect(redirectToUse);
             } catch (err) {
                 req.payload.logger.error({

package/dist/oauth/endpoints/getTokenLoginEndpoint.d.ts

@@ -0,0 +1,17 @@
+import type { CollectionConfig, Endpoint } from 'payload';
+import type { Strategy } from '../strategy/index.js';
+import type { CollectionOptions, PluginOptions } from '../types.js';
+interface Args {
+    collection: CollectionConfig;
+    collectionOptions: CollectionOptions;
+    endpointSlug: string;
+    pluginOptions: PluginOptions;
+    strategy: Strategy;
+}
+/**
+ * Auto-login endpoint for embedded contexts where the interactive OAuth flow
+ * cannot run.
+ */
+export declare const getTokenLoginEndpoint: ({ collection, collectionOptions, endpointSlug, pluginOptions, strategy, }: Args) => Endpoint;
+export {};
+//# sourceMappingURL=getTokenLoginEndpoint.d.ts.map

package/dist/oauth/endpoints/getTokenLoginEndpoint.js

@@ -0,0 +1,105 @@
+import { formatAdminURL, getSafeRedirect } from 'payload/shared';
+import { createDebugLogger } from '../utilities/createDebugLogger.js';
+import { establishSession } from '../utilities/establishSession.js';
+import { exchangeCodeForAccessToken } from '../utilities/exchangeCodeForAccessToken.js';
+import { isAbsoluteURL } from '../utilities/isAbsoluteURL.js';
+/**
+ * Auto-login endpoint for embedded contexts where the interactive OAuth flow
+ * cannot run.
+ */ export const getTokenLoginEndpoint = ({ collection, collectionOptions, endpointSlug, pluginOptions, strategy })=>({
+        handler: async (req)=>{
+            const { config } = req.payload;
+            const adminRoute = config.routes?.admin || '/admin';
+            const debugLogger = createDebugLogger(req.payload, pluginOptions.debug);
+            const adminURL = formatAdminURL({
+                adminRoute,
+                serverURL: config.serverURL
+            });
+            const failedRedirect = formatAdminURL({
+                adminRoute,
+                path: '/login',
+                serverURL: config.serverURL
+            });
+            try {
+                await strategy.ensureMeta();
+                const code = req.query.code;
+                const redirectQuery = req.query.redirect;
+                let redirectToUse = adminURL;
+                if (typeof redirectQuery === 'string' && redirectQuery.length > 0) {
+                    const safeRedirect = getSafeRedirect({
+                        allowAbsoluteUrls: false,
+                        redirectTo: redirectQuery
+                    });
+                    if (safeRedirect && !isAbsoluteURL(safeRedirect)) {
+                        redirectToUse = `${config.serverURL ?? ''}${safeRedirect}`;
+                    }
+                }
+                if (typeof code !== 'string' || code.length === 0) {
+                    debugLogger.error({
+                        msg: 'token_login: missing code'
+                    });
+                    return Response.redirect(failedRedirect);
+                }
+                if (!strategy.meta?.token_endpoint) {
+                    debugLogger.error({
+                        msg: 'token_login: no token_endpoint discovered from identity provider'
+                    });
+                    return Response.redirect(failedRedirect);
+                }
+                debugLogger.info({
+                    msg: 'token_login: exchanging code for access token'
+                });
+                const tokenRes = await exchangeCodeForAccessToken({
+                    code,
+                    redirectUri: formatAdminURL({
+                        apiRoute: config.routes?.api || '/api',
+                        path: `/${collection.slug}/${endpointSlug}/token_login`,
+                        serverURL: config.serverURL
+                    }),
+                    strategy
+                });
+                const { access_token, error, error_description, expires_in } = tokenRes;
+                if (error) {
+                    req.payload.logger.error({
+                        err: error,
+                        error_description,
+                        msg: 'token_login: error exchanging code for access token'
+                    });
+                    return Response.redirect(failedRedirect);
+                }
+                if (typeof access_token !== 'string' || access_token.length === 0) {
+                    req.payload.logger.error({
+                        msg: 'token_login: no access_token returned from identity provider'
+                    });
+                    return Response.redirect(failedRedirect);
+                }
+                await establishSession({
+                    accessToken: access_token,
+                    collection,
+                    collectionOptions,
+                    contentSystemId: config.custom.figma.contentSystemId,
+                    debugLogger,
+                    pluginOptions,
+                    refreshTokenExpiresIn: expires_in,
+                    req,
+                    strategy
+                });
+                return Response.redirect(redirectToUse);
+            } catch (err) {
+                req.payload.logger.error({
+                    err,
+                    msg: 'Error during token_login',
+                    path: req.pathname
+                });
+                return Response.json({
+                    error: 'Error during token_login'
+                }, {
+                    status: 500
+                });
+            }
+        },
+        method: 'get',
+        path: `/${endpointSlug}/token_login`
+    });
+
+//# sourceMappingURL=getTokenLoginEndpoint.js.map

package/dist/oauth/index.js

@@ -4,6 +4,7 @@ import { getLoginEndpoint } from './endpoints/getLoginEndpoint.js';
 import { getLogoutEndpoint } from './endpoints/getLogoutEndpoint.js';
 import { getMetaEndpoint } from './endpoints/getMetaEndpoint.js';
 import { getRedirectToLoginEndpoint } from './endpoints/getRedirectToLoginEndpoint.js';
+import { getTokenLoginEndpoint } from './endpoints/getTokenLoginEndpoint.js';
 import { getAfterLogout } from './hooks/afterLogout.js';
 import { getMeHook } from './hooks/me.js';
 import { getRefreshHook } from './hooks/refresh.js';
@@ -206,6 +207,13 @@ export const oAuth2Plugin = (pluginOptions)=>(config)=>{
                             endpointSlug,
                             pluginOptions,
                             strategy
+                        }),
+                        getTokenLoginEndpoint({
+                            collection: existingCollection,
+                            collectionOptions,
+                            endpointSlug,
+                            pluginOptions,
+                            strategy
                         })
                     ],
                     fields,

package/dist/oauth/utilities/establishSession.d.ts

@@ -0,0 +1,23 @@
+import type { CollectionConfig, PayloadRequest } from 'payload';
+import type { Strategy } from '../strategy/index.js';
+import type { CollectionOptions, DebugLogger, PluginOptions } from '../types.js';
+interface Args {
+    accessToken: string;
+    collection: CollectionConfig;
+    collectionOptions: CollectionOptions;
+    contentSystemId: string;
+    debugLogger: DebugLogger;
+    pluginOptions: PluginOptions;
+    /** From the IdP token response (`expires_in`); used as a refresh-cookie expiry fallback. */
+    refreshTokenExpiresIn?: number;
+    req: PayloadRequest;
+    strategy: Strategy;
+}
+/**
+ * Given a valid OAuth access_token: fetch user info (non-fatal), mint a
+ * project token, and write the main + refresh + user-info cookies to
+ * `req.responseHeaders`. Throws `APIError` if the project token mint fails.
+ */
+export declare const establishSession: ({ accessToken, collection, collectionOptions, contentSystemId, debugLogger, pluginOptions, refreshTokenExpiresIn, req, strategy, }: Args) => Promise<void>;
+export {};
+//# sourceMappingURL=establishSession.d.ts.map

package/dist/oauth/utilities/establishSession.js

@@ -0,0 +1,82 @@
+import { APIError, generateCookie } from 'payload';
+import { getProjectToken, getUserInfo } from '../../api/figma-api.js';
+import { createCookieOptions } from './createCookieOptions.js';
+import { getCookieExpiration } from './getCookieExpiration.js';
+/**
+ * Given a valid OAuth access_token: fetch user info (non-fatal), mint a
+ * project token, and write the main + refresh + user-info cookies to
+ * `req.responseHeaders`. Throws `APIError` if the project token mint fails.
+ */ export const establishSession = async ({ accessToken, collection, collectionOptions, contentSystemId, debugLogger, pluginOptions, refreshTokenExpiresIn, req, strategy })=>{
+    const oauthCredential = {
+        type: 'oauth',
+        token: accessToken
+    };
+    // Non-fatal: user just won't have handle/image on first request.
+    let figmaUserInfo = null;
+    try {
+        figmaUserInfo = await getUserInfo(oauthCredential);
+        debugLogger.info({
+            figmaUserInfo,
+            msg: 'Fetched Figma user info'
+        });
+    } catch (err) {
+        debugLogger.error({
+            err,
+            msg: 'Failed to fetch Figma user info'
+        });
+    }
+    const projectToken = await getProjectToken(oauthCredential, contentSystemId);
+    if (!projectToken.token) {
+        const errMsg = 'No project token returned from Figma API';
+        req.payload.logger.error({
+            msg: errMsg
+        });
+        throw new APIError(errMsg);
+    }
+    const cookieOptions = createCookieOptions({
+        collection,
+        headers: req.headers,
+        pluginOptions
+    });
+    if (!req.responseHeaders) {
+        req.responseHeaders = new Headers();
+    }
+    // The -refresh cookie holds the OAuth access_token so refreshTokens can
+    // re-mint project_tokens from it on JWT expiry.
+    if (!collectionOptions.usePayloadJWT) {
+        const refreshCookie = generateCookie({
+            ...cookieOptions,
+            name: `${strategy.cookieName}-refresh`,
+            expires: getCookieExpiration(cookieOptions?.expires ?? refreshTokenExpiresIn ?? 31_556_952),
+            returnCookieAsObject: false,
+            value: accessToken
+        });
+        req.responseHeaders.append('Set-Cookie', refreshCookie);
+    }
+    const tokenExpires = cookieOptions?.expires ? getCookieExpiration(cookieOptions.expires) : new Date(projectToken.expiresAt);
+    const tokenCookie = generateCookie({
+        ...cookieOptions,
+        name: strategy.cookieName,
+        expires: tokenExpires,
+        returnCookieAsObject: false,
+        value: projectToken.token
+    });
+    req.responseHeaders.append('Set-Cookie', tokenCookie);
+    // Short-lived handoff cookie consumed by defaultVerify on the next request.
+    if (figmaUserInfo) {
+        const userInfoValue = Buffer.from(JSON.stringify({
+            handle: figmaUserInfo.handle,
+            img_url: figmaUserInfo.img_url
+        })).toString('base64');
+        const userInfoCookie = generateCookie({
+            ...cookieOptions,
+            name: pluginOptions?.userInfoCookieName ?? 'figma-user-info',
+            expires: new Date(Date.now() + 60_000),
+            returnCookieAsObject: false,
+            value: userInfoValue
+        });
+        req.responseHeaders.append('Set-Cookie', userInfoCookie);
+    }
+};
+
+//# sourceMappingURL=establishSession.js.map

package/dist/oauth/utilities/exchangeCodeForAccessToken.d.ts

@@ -0,0 +1,24 @@
+import type { Strategy } from '../strategy/index.js';
+interface Args {
+    /** Authorization code received from the IdP redirect. */
+    code: string;
+    /** PKCE verifier; omit for non-PKCE flows. */
+    codeVerifier?: string;
+    /** Must match the redirect_uri the authorization request used. */
+    redirectUri: string;
+    strategy: Strategy;
+}
+export interface TokenEndpointResponse {
+    access_token?: null | string;
+    error?: string;
+    error_description?: string;
+    expires_in?: number;
+}
+/**
+ * POSTs an authorization code to the IdP's `token_endpoint` and returns the
+ * raw response body. Callers handle error/missing-token logging in their own
+ * style — this helper only owns the request shape.
+ */
+export declare const exchangeCodeForAccessToken: ({ code, codeVerifier, redirectUri, strategy, }: Args) => Promise<TokenEndpointResponse>;
+export {};
+//# sourceMappingURL=exchangeCodeForAccessToken.d.ts.map