npm - @pencil-agent/nano-pencil - Versions diffs - 2.0.0-beta.2 → 2.0.0-beta.3 - Mend

@pencil-agent/nano-pencil 2.0.0-beta.2 → 2.0.0-beta.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (179) hide show

package/dist/node_modules/@pencil-agent/ai/dist/utils/oauth/google-gemini-cli.js ADDED Viewed

@@ -0,0 +1,483 @@
+/**
+ * Gemini CLI OAuth flow (Google Cloud Code Assist)
+ * Standard Gemini models only (gemini-2.0-flash, gemini-2.5-*)
+ *
+ * NOTE: This module uses Node.js http.createServer for the OAuth callback.
+ * It is only intended for CLI use, not browser environments.
+ */
+/**
+ * [WHO]: geminiCliOAuthProvider
+ * [FROM]: Depends on ./pkce.js
+ * [TO]: Consumed by core/lib/ai/src/index.ts
+ * [HERE]: core/lib/ai/src/utils/oauth/google-gemini-cli.ts -
+ */
+import { decodeOAuthCredentialSegment } from "./decode-credential.js";
+import { generatePKCE } from "./pkce.js";
+let _createServer = null;
+let _httpImportPromise = null;
+if (typeof process !== "undefined" && (process.versions?.node || process.versions?.bun)) {
+    _httpImportPromise = import("node:http").then((m) => {
+        _createServer = m.createServer;
+    });
+}
+const CLIENT_ID = decodeOAuthCredentialSegment("YOUR_CLIENT_ID_HERE");
+const CLIENT_SECRET = decodeOAuthCredentialSegment("YOUR_CLIENT_SECRET_HERE");
+const REDIRECT_URI = "http://localhost:8085/oauth2callback";
+const SCOPES = [
+    "https://www.googleapis.com/auth/cloud-platform",
+    "https://www.googleapis.com/auth/userinfo.email",
+    "https://www.googleapis.com/auth/userinfo.profile",
+];
+const AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
+const TOKEN_URL = "https://oauth2.googleapis.com/token";
+const CODE_ASSIST_ENDPOINT = "https://cloudcode-pa.googleapis.com";
+/**
+ * Start a local HTTP server to receive the OAuth callback
+ */
+async function getNodeCreateServer() {
+    if (_createServer)
+        return _createServer;
+    if (_httpImportPromise) {
+        await _httpImportPromise;
+    }
+    if (_createServer)
+        return _createServer;
+    throw new Error("Gemini CLI OAuth is only available in Node.js environments");
+}
+async function startCallbackServer() {
+    const createServer = await getNodeCreateServer();
+    return new Promise((resolve, reject) => {
+        let result = null;
+        let cancelled = false;
+        const server = createServer((req, res) => {
+            const url = new URL(req.url || "", `http://localhost:8085`);
+            if (url.pathname === "/oauth2callback") {
+                const code = url.searchParams.get("code");
+                const state = url.searchParams.get("state");
+                const error = url.searchParams.get("error");
+                if (error) {
+                    res.writeHead(400, { "Content-Type": "text/html" });
+                    res.end(`<html><body><h1>Authentication Failed</h1><p>Error: ${error}</p><p>You can close this window.</p></body></html>`);
+                    return;
+                }
+                if (code && state) {
+                    res.writeHead(200, { "Content-Type": "text/html" });
+                    res.end(`<html><body><h1>Authentication Successful</h1><p>You can close this window and return to the terminal.</p></body></html>`);
+                    result = { code, state };
+                }
+                else {
+                    res.writeHead(400, { "Content-Type": "text/html" });
+                    res.end(`<html><body><h1>Authentication Failed</h1><p>Missing code or state parameter.</p></body></html>`);
+                }
+            }
+            else {
+                res.writeHead(404);
+                res.end();
+            }
+        });
+        server.on("error", (err) => {
+            reject(err);
+        });
+        server.listen(8085, "127.0.0.1", () => {
+            resolve({
+                server,
+                cancelWait: () => {
+                    cancelled = true;
+                },
+                waitForCode: async () => {
+                    const sleep = () => new Promise((r) => setTimeout(r, 100));
+                    while (!result && !cancelled) {
+                        await sleep();
+                    }
+                    return result;
+                },
+            });
+        });
+    });
+}
+/**
+ * Parse redirect URL to extract code and state
+ */
+function parseRedirectUrl(input) {
+    const value = input.trim();
+    if (!value)
+        return {};
+    try {
+        const url = new URL(value);
+        return {
+            code: url.searchParams.get("code") ?? undefined,
+            state: url.searchParams.get("state") ?? undefined,
+        };
+    }
+    catch {
+        // Not a URL, return empty
+        return {};
+    }
+}
+// Tier IDs as used by the Cloud Code API
+const TIER_FREE = "free-tier";
+const TIER_LEGACY = "legacy-tier";
+const TIER_STANDARD = "standard-tier";
+/**
+ * Wait helper for onboarding retries
+ */
+function wait(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/**
+ * Get default tier from allowed tiers
+ */
+function getDefaultTier(allowedTiers) {
+    if (!allowedTiers || allowedTiers.length === 0)
+        return { id: TIER_LEGACY };
+    const defaultTier = allowedTiers.find((t) => t.isDefault);
+    return defaultTier ?? { id: TIER_LEGACY };
+}
+function isVpcScAffectedUser(payload) {
+    if (!payload || typeof payload !== "object")
+        return false;
+    if (!("error" in payload))
+        return false;
+    const error = payload.error;
+    if (!error?.details || !Array.isArray(error.details))
+        return false;
+    return error.details.some((detail) => detail.reason === "SECURITY_POLICY_VIOLATED");
+}
+/**
+ * Poll a long-running operation until completion
+ */
+async function pollOperation(operationName, headers, onProgress) {
+    let attempt = 0;
+    while (true) {
+        if (attempt > 0) {
+            onProgress?.(`Waiting for project provisioning (attempt ${attempt + 1})...`);
+            await wait(5000);
+        }
+        const response = await fetch(`${CODE_ASSIST_ENDPOINT}/v1internal/${operationName}`, {
+            method: "GET",
+            headers,
+        });
+        if (!response.ok) {
+            throw new Error(`Failed to poll operation: ${response.status} ${response.statusText}`);
+        }
+        const data = (await response.json());
+        if (data.done) {
+            return data;
+        }
+        attempt += 1;
+    }
+}
+/**
+ * Discover or provision a Google Cloud project for the user
+ */
+async function discoverProject(accessToken, onProgress) {
+    // Check for user-provided project ID via environment variable
+    const envProjectId = process.env.GOOGLE_CLOUD_PROJECT || process.env.GOOGLE_CLOUD_PROJECT_ID;
+    const headers = {
+        Authorization: `Bearer ${accessToken}`,
+        "Content-Type": "application/json",
+        "User-Agent": "google-api-nodejs-client/9.15.1",
+        "X-Goog-Api-Client": "gl-node/22.17.0",
+    };
+    // Try to load existing project via loadCodeAssist
+    onProgress?.("Checking for existing Cloud Code Assist project...");
+    const loadResponse = await fetch(`${CODE_ASSIST_ENDPOINT}/v1internal:loadCodeAssist`, {
+        method: "POST",
+        headers,
+        body: JSON.stringify({
+            cloudaicompanionProject: envProjectId,
+            metadata: {
+                ideType: "IDE_UNSPECIFIED",
+                platform: "PLATFORM_UNSPECIFIED",
+                pluginType: "GEMINI",
+                duetProject: envProjectId,
+            },
+        }),
+    });
+    let data;
+    if (!loadResponse.ok) {
+        let errorPayload;
+        try {
+            errorPayload = await loadResponse.clone().json();
+        }
+        catch {
+            errorPayload = undefined;
+        }
+        if (isVpcScAffectedUser(errorPayload)) {
+            data = { currentTier: { id: TIER_STANDARD } };
+        }
+        else {
+            const errorText = await loadResponse.text();
+            throw new Error(`loadCodeAssist failed: ${loadResponse.status} ${loadResponse.statusText}: ${errorText}`);
+        }
+    }
+    else {
+        data = (await loadResponse.json());
+    }
+    // If user already has a current tier and project, use it
+    if (data.currentTier) {
+        if (data.cloudaicompanionProject) {
+            return data.cloudaicompanionProject;
+        }
+        // User has a tier but no managed project - they need to provide one via env var
+        if (envProjectId) {
+            return envProjectId;
+        }
+        throw new Error("This account requires setting the GOOGLE_CLOUD_PROJECT or GOOGLE_CLOUD_PROJECT_ID environment variable. " +
+            "See https://goo.gle/gemini-cli-auth-docs#workspace-gca");
+    }
+    // User needs to be onboarded - get the default tier
+    const tier = getDefaultTier(data.allowedTiers);
+    const tierId = tier?.id ?? TIER_FREE;
+    if (tierId !== TIER_FREE && !envProjectId) {
+        throw new Error("This account requires setting the GOOGLE_CLOUD_PROJECT or GOOGLE_CLOUD_PROJECT_ID environment variable. " +
+            "See https://goo.gle/gemini-cli-auth-docs#workspace-gca");
+    }
+    onProgress?.("Provisioning Cloud Code Assist project (this may take a moment)...");
+    // Build onboard request - for free tier, don't include project ID (Google provisions one)
+    // For other tiers, include the user's project ID if available
+    const onboardBody = {
+        tierId,
+        metadata: {
+            ideType: "IDE_UNSPECIFIED",
+            platform: "PLATFORM_UNSPECIFIED",
+            pluginType: "GEMINI",
+        },
+    };
+    if (tierId !== TIER_FREE && envProjectId) {
+        onboardBody.cloudaicompanionProject = envProjectId;
+        onboardBody.metadata.duetProject = envProjectId;
+    }
+    // Start onboarding - this returns a long-running operation
+    const onboardResponse = await fetch(`${CODE_ASSIST_ENDPOINT}/v1internal:onboardUser`, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(onboardBody),
+    });
+    if (!onboardResponse.ok) {
+        const errorText = await onboardResponse.text();
+        throw new Error(`onboardUser failed: ${onboardResponse.status} ${onboardResponse.statusText}: ${errorText}`);
+    }
+    let lroData = (await onboardResponse.json());
+    // If the operation isn't done yet, poll until completion
+    if (!lroData.done && lroData.name) {
+        lroData = await pollOperation(lroData.name, headers, onProgress);
+    }
+    // Try to get project ID from the response
+    const projectId = lroData.response?.cloudaicompanionProject?.id;
+    if (projectId) {
+        return projectId;
+    }
+    // If no project ID from onboarding, fall back to env var
+    if (envProjectId) {
+        return envProjectId;
+    }
+    throw new Error("Could not discover or provision a Google Cloud project. " +
+        "Try setting the GOOGLE_CLOUD_PROJECT or GOOGLE_CLOUD_PROJECT_ID environment variable. " +
+        "See https://goo.gle/gemini-cli-auth-docs#workspace-gca");
+}
+/**
+ * Get user email from the access token
+ */
+async function getUserEmail(accessToken) {
+    try {
+        const response = await fetch("https://www.googleapis.com/oauth2/v1/userinfo?alt=json", {
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+            },
+        });
+        if (response.ok) {
+            const data = (await response.json());
+            return data.email;
+        }
+    }
+    catch {
+        // Ignore errors, email is optional
+    }
+    return undefined;
+}
+/**
+ * Refresh Google Cloud Code Assist token
+ */
+export async function refreshGoogleCloudToken(refreshToken, projectId) {
+    const response = await fetch(TOKEN_URL, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+            client_id: CLIENT_ID,
+            client_secret: CLIENT_SECRET,
+            refresh_token: refreshToken,
+            grant_type: "refresh_token",
+        }),
+    });
+    if (!response.ok) {
+        const error = await response.text();
+        throw new Error(`Google Cloud token refresh failed: ${error}`);
+    }
+    const data = (await response.json());
+    return {
+        refresh: data.refresh_token || refreshToken,
+        access: data.access_token,
+        expires: Date.now() + data.expires_in * 1000 - 5 * 60 * 1000,
+        projectId,
+    };
+}
+/**
+ * Login with Gemini CLI (Google Cloud Code Assist) OAuth
+ *
+ * @param onAuth - Callback with URL and optional instructions
+ * @param onProgress - Optional progress callback
+ * @param onManualCodeInput - Optional promise that resolves with user-pasted redirect URL.
+ *                            Races with browser callback - whichever completes first wins.
+ */
+export async function loginGeminiCli(onAuth, onProgress, onManualCodeInput) {
+    const { verifier, challenge } = await generatePKCE();
+    // Start local server for callback
+    onProgress?.("Starting local server for OAuth callback...");
+    const server = await startCallbackServer();
+    let code;
+    try {
+        // Build authorization URL
+        const authParams = new URLSearchParams({
+            client_id: CLIENT_ID,
+            response_type: "code",
+            redirect_uri: REDIRECT_URI,
+            scope: SCOPES.join(" "),
+            code_challenge: challenge,
+            code_challenge_method: "S256",
+            state: verifier,
+            access_type: "offline",
+            prompt: "consent",
+        });
+        const authUrl = `${AUTH_URL}?${authParams.toString()}`;
+        // Notify caller with URL to open
+        onAuth({
+            url: authUrl,
+            instructions: "Complete the sign-in in your browser.",
+        });
+        // Wait for the callback, racing with manual input if provided
+        onProgress?.("Waiting for OAuth callback...");
+        if (onManualCodeInput) {
+            // Race between browser callback and manual input
+            let manualInput;
+            let manualError;
+            const manualPromise = onManualCodeInput()
+                .then((input) => {
+                manualInput = input;
+                server.cancelWait();
+            })
+                .catch((err) => {
+                manualError = err instanceof Error ? err : new Error(String(err));
+                server.cancelWait();
+            });
+            const result = await server.waitForCode();
+            // If manual input was cancelled, throw that error
+            if (manualError) {
+                throw manualError;
+            }
+            if (result?.code) {
+                // Browser callback won - verify state
+                if (result.state !== verifier) {
+                    throw new Error("OAuth state mismatch - possible CSRF attack");
+                }
+                code = result.code;
+            }
+            else if (manualInput) {
+                // Manual input won
+                const parsed = parseRedirectUrl(manualInput);
+                if (parsed.state && parsed.state !== verifier) {
+                    throw new Error("OAuth state mismatch - possible CSRF attack");
+                }
+                code = parsed.code;
+            }
+            // If still no code, wait for manual promise and try that
+            if (!code) {
+                await manualPromise;
+                if (manualError) {
+                    throw manualError;
+                }
+                if (manualInput) {
+                    const parsed = parseRedirectUrl(manualInput);
+                    if (parsed.state && parsed.state !== verifier) {
+                        throw new Error("OAuth state mismatch - possible CSRF attack");
+                    }
+                    code = parsed.code;
+                }
+            }
+        }
+        else {
+            // Original flow: just wait for callback
+            const result = await server.waitForCode();
+            if (result?.code) {
+                if (result.state !== verifier) {
+                    throw new Error("OAuth state mismatch - possible CSRF attack");
+                }
+                code = result.code;
+            }
+        }
+        if (!code) {
+            throw new Error("No authorization code received");
+        }
+        // Exchange code for tokens
+        onProgress?.("Exchanging authorization code for tokens...");
+        const tokenResponse = await fetch(TOKEN_URL, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/x-www-form-urlencoded",
+            },
+            body: new URLSearchParams({
+                client_id: CLIENT_ID,
+                client_secret: CLIENT_SECRET,
+                code,
+                grant_type: "authorization_code",
+                redirect_uri: REDIRECT_URI,
+                code_verifier: verifier,
+            }),
+        });
+        if (!tokenResponse.ok) {
+            const error = await tokenResponse.text();
+            throw new Error(`Token exchange failed: ${error}`);
+        }
+        const tokenData = (await tokenResponse.json());
+        if (!tokenData.refresh_token) {
+            throw new Error("No refresh token received. Please try again.");
+        }
+        // Get user email
+        onProgress?.("Getting user info...");
+        const email = await getUserEmail(tokenData.access_token);
+        // Discover project
+        const projectId = await discoverProject(tokenData.access_token, onProgress);
+        // Calculate expiry time (current time + expires_in seconds - 5 min buffer)
+        const expiresAt = Date.now() + tokenData.expires_in * 1000 - 5 * 60 * 1000;
+        const credentials = {
+            refresh: tokenData.refresh_token,
+            access: tokenData.access_token,
+            expires: expiresAt,
+            projectId,
+            email,
+        };
+        return credentials;
+    }
+    finally {
+        server.server.close();
+    }
+}
+export const geminiCliOAuthProvider = {
+    id: "google-gemini-cli",
+    name: "Google Cloud Code Assist (Gemini CLI)",
+    usesCallbackServer: true,
+    async login(callbacks) {
+        return loginGeminiCli(callbacks.onAuth, callbacks.onProgress, callbacks.onManualCodeInput);
+    },
+    async refreshToken(credentials) {
+        const creds = credentials;
+        if (!creds.projectId) {
+            throw new Error("Google Cloud credentials missing projectId");
+        }
+        return refreshGoogleCloudToken(creds.refresh, creds.projectId);
+    },
+    getApiKey(credentials) {
+        const creds = credentials;
+        return JSON.stringify({ token: creds.access, projectId: creds.projectId });
+    },
+};

package/dist/node_modules/@pencil-agent/ai/dist/utils/oauth/index.d.ts ADDED Viewed

@@ -0,0 +1,60 @@
+/**
+ * [WHO]: OAuth credential management - loginAnthropic, refreshAnthropicToken, loginGitHubCopilot, loginGoogleGeminiCli, loginOpenAICodex
+ * [FROM]: Depends on ./anthropic, ./github-copilot, ./google-antigravity, ./google-gemini-cli, ./openai-codex, ../http-proxy
+ * [TO]: Consumed by core/lib/ai/src/index.ts, AI providers
+ * [HERE]: core/lib/ai/src/utils/oauth/index.ts - OAuth credential management for AI providers
+ *
+ * Handles login, token refresh, and credential storage for:
+ * Anthropic, GitHub Copilot, Google Cloud Code Assist, Antigravity
+ */
+import "../http-proxy.js";
+export { anthropicOAuthProvider, loginAnthropic, refreshAnthropicToken } from "./anthropic.js";
+export { getGitHubCopilotBaseUrl, githubCopilotOAuthProvider, loginGitHubCopilot, normalizeDomain, refreshGitHubCopilotToken, } from "./github-copilot.js";
+export { antigravityOAuthProvider, loginAntigravity, refreshAntigravityToken } from "./google-antigravity.js";
+export { geminiCliOAuthProvider, loginGeminiCli, refreshGoogleCloudToken } from "./google-gemini-cli.js";
+export { loginOpenAICodex, openaiCodexOAuthProvider, refreshOpenAICodexToken } from "./openai-codex.js";
+export * from "./types.js";
+import type { OAuthCredentials, OAuthProviderId, OAuthProviderInfo, OAuthProviderInterface } from "./types.js";
+/**
+ * Get an OAuth provider by ID
+ */
+export declare function getOAuthProvider(id: OAuthProviderId): OAuthProviderInterface | undefined;
+/**
+ * Register a custom OAuth provider
+ */
+export declare function registerOAuthProvider(provider: OAuthProviderInterface): void;
+/**
+ * Unregister an OAuth provider.
+ *
+ * If the provider is built-in, restores the built-in implementation.
+ * Custom providers are removed completely.
+ */
+export declare function unregisterOAuthProvider(id: string): void;
+/**
+ * Reset OAuth providers to built-ins.
+ */
+export declare function resetOAuthProviders(): void;
+/**
+ * Get all registered OAuth providers
+ */
+export declare function getOAuthProviders(): OAuthProviderInterface[];
+/**
+ * @deprecated Use getOAuthProviders() which returns OAuthProviderInterface[]
+ */
+export declare function getOAuthProviderInfoList(): OAuthProviderInfo[];
+/**
+ * Refresh token for any OAuth provider.
+ * @deprecated Use getOAuthProvider(id).refreshToken() instead
+ */
+export declare function refreshOAuthToken(providerId: OAuthProviderId, credentials: OAuthCredentials): Promise<OAuthCredentials>;
+/**
+ * Get API key for a provider from OAuth credentials.
+ * Automatically refreshes expired tokens.
+ *
+ * @returns API key string and updated credentials, or null if no credentials
+ * @throws Error if refresh fails
+ */
+export declare function getOAuthApiKey(providerId: OAuthProviderId, credentials: Record<string, OAuthCredentials>): Promise<{
+    newCredentials: OAuthCredentials;
+    apiKey: string;
+} | null>;

package/dist/node_modules/@pencil-agent/ai/dist/utils/oauth/index.js ADDED Viewed

@@ -0,0 +1,131 @@
+/**
+ * [WHO]: OAuth credential management - loginAnthropic, refreshAnthropicToken, loginGitHubCopilot, loginGoogleGeminiCli, loginOpenAICodex
+ * [FROM]: Depends on ./anthropic, ./github-copilot, ./google-antigravity, ./google-gemini-cli, ./openai-codex, ../http-proxy
+ * [TO]: Consumed by core/lib/ai/src/index.ts, AI providers
+ * [HERE]: core/lib/ai/src/utils/oauth/index.ts - OAuth credential management for AI providers
+ *
+ * Handles login, token refresh, and credential storage for:
+ * Anthropic, GitHub Copilot, Google Cloud Code Assist, Antigravity
+ */
+// Set up HTTP proxy for fetch() calls (respects HTTP_PROXY, HTTPS_PROXY env vars)
+import "../http-proxy.js";
+// Anthropic
+export { anthropicOAuthProvider, loginAnthropic, refreshAnthropicToken } from "./anthropic.js";
+// GitHub Copilot
+export { getGitHubCopilotBaseUrl, githubCopilotOAuthProvider, loginGitHubCopilot, normalizeDomain, refreshGitHubCopilotToken, } from "./github-copilot.js";
+// Google Antigravity
+export { antigravityOAuthProvider, loginAntigravity, refreshAntigravityToken } from "./google-antigravity.js";
+// Google Gemini CLI
+export { geminiCliOAuthProvider, loginGeminiCli, refreshGoogleCloudToken } from "./google-gemini-cli.js";
+// OpenAI Codex (ChatGPT OAuth)
+export { loginOpenAICodex, openaiCodexOAuthProvider, refreshOpenAICodexToken } from "./openai-codex.js";
+export * from "./types.js";
+// ============================================================================
+// Provider Registry
+// ============================================================================
+import { anthropicOAuthProvider } from "./anthropic.js";
+import { githubCopilotOAuthProvider } from "./github-copilot.js";
+import { antigravityOAuthProvider } from "./google-antigravity.js";
+import { geminiCliOAuthProvider } from "./google-gemini-cli.js";
+import { openaiCodexOAuthProvider } from "./openai-codex.js";
+const BUILT_IN_OAUTH_PROVIDERS = [
+    anthropicOAuthProvider,
+    githubCopilotOAuthProvider,
+    geminiCliOAuthProvider,
+    antigravityOAuthProvider,
+    openaiCodexOAuthProvider,
+];
+const oauthProviderRegistry = new Map(BUILT_IN_OAUTH_PROVIDERS.map((provider) => [provider.id, provider]));
+/**
+ * Get an OAuth provider by ID
+ */
+export function getOAuthProvider(id) {
+    return oauthProviderRegistry.get(id);
+}
+/**
+ * Register a custom OAuth provider
+ */
+export function registerOAuthProvider(provider) {
+    oauthProviderRegistry.set(provider.id, provider);
+}
+/**
+ * Unregister an OAuth provider.
+ *
+ * If the provider is built-in, restores the built-in implementation.
+ * Custom providers are removed completely.
+ */
+export function unregisterOAuthProvider(id) {
+    const builtInProvider = BUILT_IN_OAUTH_PROVIDERS.find((provider) => provider.id === id);
+    if (builtInProvider) {
+        oauthProviderRegistry.set(id, builtInProvider);
+        return;
+    }
+    oauthProviderRegistry.delete(id);
+}
+/**
+ * Reset OAuth providers to built-ins.
+ */
+export function resetOAuthProviders() {
+    oauthProviderRegistry.clear();
+    for (const provider of BUILT_IN_OAUTH_PROVIDERS) {
+        oauthProviderRegistry.set(provider.id, provider);
+    }
+}
+/**
+ * Get all registered OAuth providers
+ */
+export function getOAuthProviders() {
+    return Array.from(oauthProviderRegistry.values());
+}
+/**
+ * @deprecated Use getOAuthProviders() which returns OAuthProviderInterface[]
+ */
+export function getOAuthProviderInfoList() {
+    return getOAuthProviders().map((p) => ({
+        id: p.id,
+        name: p.name,
+        available: true,
+    }));
+}
+// ============================================================================
+// High-level API (uses provider registry)
+// ============================================================================
+/**
+ * Refresh token for any OAuth provider.
+ * @deprecated Use getOAuthProvider(id).refreshToken() instead
+ */
+export async function refreshOAuthToken(providerId, credentials) {
+    const provider = getOAuthProvider(providerId);
+    if (!provider) {
+        throw new Error(`Unknown OAuth provider: ${providerId}`);
+    }
+    return provider.refreshToken(credentials);
+}
+/**
+ * Get API key for a provider from OAuth credentials.
+ * Automatically refreshes expired tokens.
+ *
+ * @returns API key string and updated credentials, or null if no credentials
+ * @throws Error if refresh fails
+ */
+export async function getOAuthApiKey(providerId, credentials) {
+    const provider = getOAuthProvider(providerId);
+    if (!provider) {
+        throw new Error(`Unknown OAuth provider: ${providerId}`);
+    }
+    let creds = credentials[providerId];
+    if (!creds) {
+        return null;
+    }
+    // Refresh if expired
+    if (Date.now() >= creds.expires) {
+        try {
+            creds = await provider.refreshToken(creds);
+        }
+        catch (_error) {
+            throw new Error(`Failed to refresh OAuth token for ${providerId}`);
+        }
+    }
+    const apiKey = provider.getApiKey(creds);
+    return { newCredentials: creds, apiKey };
+}