@pikku/core 0.12.80 → 0.12.83

package/dist/services/scenario-actors-service.d.ts

@@ -1,127 +0,0 @@
-import type { ConverseOptions, ActorFlowVerdict } from '../wirings/actor-flow/actor-flow.types.js';
-/**
- * What the transport answered, for a step that treats the status as data.
- *
- * An HTTP response with its body already drained: the stream can only be read
- * once, and a step's return value crosses into the run record, so the response
- * object itself cannot travel. This is the shape every caller ends up with.
- */
-export interface ScenarioHttpResponse<T = unknown> {
-    status: number;
-    ok: boolean;
-    /**
-     * The parsed JSON body — or, when the body was not JSON, the raw text it was
-     * parsed from, so an HTML error page is still readable rather than lost.
-     * `undefined` for an empty response.
-     *
-     * `T` is a claim the caller makes, not one the transport checked: a step that
-     * knows the route's payload names it here instead of casting at every use.
-     */
-    body: T;
-    /**
-     * The whole body as text, so an assertion can search it without knowing the
-     * payload's shape — and so an error body that is HTML rather than JSON still
-     * says what went wrong.
-     */
-    serialized: string;
-}
-/**
- * Drain a response into the shape a step can carry: the parsed body (an empty
- * one counting as no body at all) alongside the text it was parsed from.
- *
- * `invokeRaw` returns this, and a step that has to reach past an actor — a
- * route with no RPC, an identity no actor can hold — reaches for this rather
- * than writing the same record by hand.
- */
-export declare const readScenarioHttpResponse: <T = unknown>(res: Response) => Promise<ScenarioHttpResponse<T>>;
-/** How to send one JSON request, for `postScenarioJson`. */
-export interface ScenarioJsonRequest {
-    /** Serialised as the JSON body. Omit for a request that carries none. */
-    body?: unknown;
-    /** Sent alongside `content-type: application/json`, and may override it. */
-    headers?: Record<string, string>;
-    /** Defaults to `POST` — the method every scenario route here answers. */
-    method?: string;
-    /**
-     * The `fetch` to send it with. Pass a `ScenarioCookieJar`'s to keep the
-     * session; the global `fetch` otherwise, which is what a step asserting on a
-     * sessionless call wants.
-     */
-    fetch?: typeof fetch;
-}
-/**
- * POST JSON somewhere and report what came back, without throwing on a 4xx/5xx.
- *
- * Every scenario that reaches past an actor was writing this by hand — the same
- * `content-type`, the same `JSON.stringify`, the same drain — and the copies had
- * drifted: some returned `res.json()`, which loses the status and throws
- * outright when the target answers an empty body or an HTML error page. A
- * refusal is the expected outcome of a permissions scenario, so it has to
- * survive as data.
- */
-export declare const postScenarioJson: <T = unknown>(url: string, { body, headers, method, fetch: send, }?: ScenarioJsonRequest) => Promise<ScenarioHttpResponse<T>>;
-/** Per-call transport options. */
-export interface ScenarioInvokeOptions {
-    /**
-     * Headers to send alongside the actor's own session. This is how a step
-     * expresses an identity the actor registry cannot — an impersonation header,
-     * or one of the header-shim principals a credential scenario invents.
-     */
-    headers?: Record<string, string>;
-}
-/**
- * The RPC surface an actor can reach, as name → input/output. A project binds
- * its generated exposed RPC map here; the default leaves every name open, which
- * is what an actor built by hand (or by a third-party driver) gets.
- */
-export type ScenarioRpcMap = Record<string, {
-    input: any;
-    output: any;
-}>;
-/**
- * The actor a step wire carries, for a project whose actor registry is known.
- * An empty registry keeps the open actor type rather than collapsing to
- * `never` — a project may still build actors itself.
- */
-export type ScenarioActorOf<TActors> = [keyof TActors] extends [never] ? ScenarioActor : TActors[keyof TActors];
-/** A synthetic user (a user row flagged `actor`) that workflow steps run as over the real transport */
-export interface ScenarioActor<TAgentName extends string = string, TRpcMap extends ScenarioRpcMap = ScenarioRpcMap> {
-    /** Stable actor name (the key in pikku.config.json's actor registry). */
-    readonly name: string;
-    /** The actor's user email — flows use it for invites/lookups. */
-    readonly email: string;
-    /** Invoke an exposed RPC as this actor over the real transport. */
-    invoke<TName extends keyof TRpcMap & string>(rpcName: TName, data: TRpcMap[TName]['input']): Promise<TRpcMap[TName]['output']>;
-    /**
-     * The same call, reporting what the transport answered rather than throwing.
-     * A refusal is the expected outcome of a permissions or scopes scenario, and
-     * `invoke`'s error truncates the body that names which scope was missing.
-     */
-    invokeRaw<TName extends keyof TRpcMap & string>(rpcName: TName, data: TRpcMap[TName]['input'], options?: ScenarioInvokeOptions): Promise<ScenarioHttpResponse>;
-    /** Converse with a Pikku AI agent in this actor's persona and return its verdict */
-    converse(options: ConverseOptions<TAgentName>): Promise<ActorFlowVerdict>;
-}
-/** Display/config metadata for an actor (from pikku.config.json) */
-export interface ScenarioActorConfig {
-    email: string;
-    name?: string;
-    jobTitle?: string;
-    personality?: string;
-    /**
-     * The persona this body is one of — the KIND of person, declared in
-     * `scenarios.personas`. Most personas have exactly one actor and it is
-     * materialised for them; a second body of the same persona is what tenant
-     * isolation and peer-sharing scenarios are made of.
-     */
-    persona?: string;
-    /**
-     * Scopes this actor holds, granted directly rather than through a role, and
-     * the roles it belongs to. Pikku carries them; it never applies them — which
-     * scope store exists and which roles have been created is the app's own, so
-     * the app's seed reads these back off `scenarioActorConfigs` and grants them.
-     */
-    scopes?: readonly string[];
-    roles?: readonly string[];
-}
-/** The injected `actors` service: actor name → actor. */
-export type ScenarioActors = Record<string, ScenarioActor>;

package/dist/services/scenario-actors-service.js

@@ -1,40 +0,0 @@
-/**
- * Drain a response into the shape a step can carry: the parsed body (an empty
- * one counting as no body at all) alongside the text it was parsed from.
- *
- * `invokeRaw` returns this, and a step that has to reach past an actor — a
- * route with no RPC, an identity no actor can hold — reaches for this rather
- * than writing the same record by hand.
- */
-export const readScenarioHttpResponse = async (res) => {
-    const text = res.status === 204 ? '' : await res.text().catch(() => '');
-    return {
-        status: res.status,
-        ok: res.ok,
-        body: (text ? parseJsonBody(text) : undefined),
-        serialized: text,
-    };
-};
-const parseJsonBody = (text) => {
-    try {
-        return JSON.parse(text);
-    }
-    catch {
-        return text;
-    }
-};
-/**
- * POST JSON somewhere and report what came back, without throwing on a 4xx/5xx.
- *
- * Every scenario that reaches past an actor was writing this by hand — the same
- * `content-type`, the same `JSON.stringify`, the same drain — and the copies had
- * drifted: some returned `res.json()`, which loses the status and throws
- * outright when the target answers an empty body or an HTML error page. A
- * refusal is the expected outcome of a permissions scenario, so it has to
- * survive as data.
- */
-export const postScenarioJson = async (url, { body, headers, method = 'POST', fetch: send = fetch, } = {}) => readScenarioHttpResponse(await send(url, {
-    method,
-    headers: { 'content-type': 'application/json', ...headers },
-    ...(body === undefined ? {} : { body: JSON.stringify(body) }),
-}));

package/dist/services/user-flow-actors-service.d.ts

@@ -1,39 +0,0 @@
-import type { ConverseOptions, ActorFlowVerdict } from '../wirings/actor-flow/actor-flow.types.js';
-/**
- * A user-flow actor: a synthetic user (a normal user row flagged `actor`) that
- * workflow steps can run as. Passed to `workflow.do(step, rpc, data, { actor })`
- * — the step then goes through the actor's authenticated client over the REAL
- * transport (auth middleware, permissions, serialization all exercised),
- * never through internal dispatch. Login is lazy: the first `invoke` signs the
- * actor in and the session is cached for the actor's lifetime.
- */
-export interface UserFlowActor<TAgentName extends string = string> {
-    /** Stable actor name (the key in pikku.config.json's actor registry). */
-    readonly name: string;
-    /** The actor's user email — flows use it for invites/lookups. */
-    readonly email: string;
-    /** Invoke an exposed RPC as this actor over the real transport. */
-    invoke(rpcName: string, data: unknown): Promise<unknown>;
-    /**
-     * Hold a dynamic conversation with a target Pikku AI agent, in THIS actor's
-     * persona (personality/jobTitle). Drives the target over the real transport
-     * as the signed-in actor, answers its tool-approval requests in-persona, and
-     * returns the actor's verdict on whether the task was met. Deterministic
-     * checks are the caller's job — use `invoke` afterwards. In a typed project
-     * `agent` is constrained to the generated union of agent names.
-     */
-    converse(options: ConverseOptions<TAgentName>): Promise<ActorFlowVerdict>;
-}
-/**
- * Display/config metadata for an actor (from pikku.config.json). The email
- * identifies the actor's user row; personality/jobTitle exist for the console
- * screen and for agent-driven flows (the agent plays the persona).
- */
-export interface UserFlowActorConfig {
-    email: string;
-    name?: string;
-    jobTitle?: string;
-    personality?: string;
-}
-/** The injected `actors` service: actor name → actor. */
-export type UserFlowActors = Record<string, UserFlowActor>;

package/dist/wirings/credential/wire-credential.d.ts

@@ -1,48 +0,0 @@
-import type { CoreCredential } from './credential.types.js';
-/**
- * No-op function for declaring credentials.
- * This exists purely for TypeScript type checking and will be tree-shaken.
- * The CLI extracts metadata via AST parsing.
- *
- * @example
- * ```typescript
- * // Per-user API key
- * wireCredential({
- *   name: 'stripe',
- *   displayName: 'Stripe API Key',
- *   type: 'wire',
- *   schema: z.object({ apiKey: z.string() }),
- * })
- *
- * // Per-user OAuth
- * wireCredential({
- *   name: 'google-sheets',
- *   displayName: 'Google Sheets',
- *   type: 'wire',
- *   schema: z.object({ accessToken: z.string(), refreshToken: z.string() }),
- *   oauth2: {
- *     appCredentialSecretId: 'GOOGLE_OAUTH_APP',
- *     authorizationUrl: 'https://accounts.google.com/o/oauth2/v2/auth',
- *     tokenUrl: 'https://oauth2.googleapis.com/token',
- *     scopes: ['https://www.googleapis.com/auth/spreadsheets'],
- *     tokenSecretId: 'GOOGLE_OAUTH_TOKENS',
- *   }
- * })
- *
- * // Platform-level OAuth (singleton)
- * wireCredential({
- *   name: 'slack',
- *   displayName: 'Slack',
- *   type: 'singleton',
- *   schema: z.object({ accessToken: z.string(), refreshToken: z.string() }),
- *   oauth2: {
- *     appCredentialSecretId: 'SLACK_OAUTH_APP',
- *     authorizationUrl: 'https://slack.com/oauth/v2/authorize',
- *     tokenUrl: 'https://slack.com/api/oauth.v2.access',
- *     scopes: ['chat:write', 'channels:read'],
- *     tokenSecretId: 'SLACK_OAUTH_TOKENS',
- *   }
- * })
- * ```
- */
-export declare const wireCredential: <T>(_config: CoreCredential<T>) => void;

package/dist/wirings/credential/wire-credential.js

@@ -1,47 +0,0 @@
-/**
- * No-op function for declaring credentials.
- * This exists purely for TypeScript type checking and will be tree-shaken.
- * The CLI extracts metadata via AST parsing.
- *
- * @example
- * ```typescript
- * // Per-user API key
- * wireCredential({
- *   name: 'stripe',
- *   displayName: 'Stripe API Key',
- *   type: 'wire',
- *   schema: z.object({ apiKey: z.string() }),
- * })
- *
- * // Per-user OAuth
- * wireCredential({
- *   name: 'google-sheets',
- *   displayName: 'Google Sheets',
- *   type: 'wire',
- *   schema: z.object({ accessToken: z.string(), refreshToken: z.string() }),
- *   oauth2: {
- *     appCredentialSecretId: 'GOOGLE_OAUTH_APP',
- *     authorizationUrl: 'https://accounts.google.com/o/oauth2/v2/auth',
- *     tokenUrl: 'https://oauth2.googleapis.com/token',
- *     scopes: ['https://www.googleapis.com/auth/spreadsheets'],
- *     tokenSecretId: 'GOOGLE_OAUTH_TOKENS',
- *   }
- * })
- *
- * // Platform-level OAuth (singleton)
- * wireCredential({
- *   name: 'slack',
- *   displayName: 'Slack',
- *   type: 'singleton',
- *   schema: z.object({ accessToken: z.string(), refreshToken: z.string() }),
- *   oauth2: {
- *     appCredentialSecretId: 'SLACK_OAUTH_APP',
- *     authorizationUrl: 'https://slack.com/oauth/v2/authorize',
- *     tokenUrl: 'https://slack.com/api/oauth.v2.access',
- *     scopes: ['chat:write', 'channels:read'],
- *     tokenSecretId: 'SLACK_OAUTH_TOKENS',
- *   }
- * })
- * ```
- */
-export const wireCredential = (_config) => { };

package/dist/wirings/oauth2/oauth2-client.d.ts

@@ -1,47 +0,0 @@
-import type { OAuth2Token } from './oauth2.types.js';
-import type { OAuth2CredentialConfig } from '../secret/secret.types.js';
-import type { SecretService } from '../../services/secret-service.js';
-export declare class OAuth2Client {
-    private oauth2Config;
-    private appCredentialSecretId;
-    private secrets;
-    private cachedToken;
-    private cachedAppCredential;
-    private refreshPromise;
-    constructor(oauth2Config: OAuth2CredentialConfig, appCredentialSecretId: string, secrets: SecretService);
-    /**
-     * Make an authenticated request. Handles token caching and 401 refresh.
-     */
-    request(url: string, options?: RequestInit, timeoutMs?: number): Promise<Response>;
-    /**
-     * Get cached token or load from secrets.
-     */
-    getAccessToken(): Promise<string>;
-    /**
-     * Refresh token and update cache.
-     * Uses a promise lock to prevent concurrent refresh attempts.
-     */
-    private refreshAndGetToken;
-    /**
-     * Perform the actual token refresh.
-     */
-    private doRefreshToken;
-    /**
-     * Check if token is valid (not expired).
-     */
-    private isTokenValid;
-    /**
-     * Get app credentials (cached).
-     */
-    private getAppCredential;
-    /**
-     * Generate OAuth2 authorization URL.
-     * Used by CLI during `pikku oauth connect`.
-     */
-    getAuthorizationUrl(state: string, redirectUri: string): Promise<string>;
-    /**
-     * Exchange authorization code for tokens.
-     * Used by CLI during `pikku oauth connect`.
-     */
-    exchangeCode(code: string, redirectUri: string): Promise<OAuth2Token>;
-}

package/dist/wirings/oauth2/oauth2-client.js

@@ -1,263 +0,0 @@
-/**
- * OAuth2 client that acts as a service.
- * Created once in createSingletonServices, handles token caching and refresh internally.
- * Functions use it directly via oauth.request().
- *
- * @example
- * ```typescript
- * // In services.ts
- * export const createSingletonServices = async (config, { secrets }) => {
- *   return {
- *     slackOAuth: new OAuth2Client(
- *       { tokenSecretId: 'SLACK_TOKENS', authorizationUrl: '...', tokenUrl: '...', scopes: [] },
- *       'SLACK_APP_CREDS',
- *       secrets
- *     ),
- *   }
- * }
- *
- * // In function
- * export const postMessage = pikkuFunc(async ({ slackOAuth }, { channel, text }) => {
- *   const response = await slackOAuth.request('https://slack.com/api/chat.postMessage', {
- *     method: 'POST',
- *     body: JSON.stringify({ channel, text }),
- *   })
- *   return response.json()
- * })
- * ```
- */
-const DEFAULT_TIMEOUT_MS = 30_000;
-const TOKEN_EXPIRY_BUFFER_MS = 60_000;
-/**
- * Helper to fetch with a timeout using AbortController.
- */
-async function fetchWithTimeout(url, options, timeoutMs = DEFAULT_TIMEOUT_MS) {
-    const controller = new AbortController();
-    const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
-    try {
-        return await fetch(url, {
-            ...options,
-            signal: controller.signal,
-        });
-    }
-    finally {
-        clearTimeout(timeoutId);
-    }
-}
-export class OAuth2Client {
-    oauth2Config;
-    appCredentialSecretId;
-    secrets;
-    cachedToken = null;
-    cachedAppCredential = null;
-    refreshPromise = null;
-    constructor(oauth2Config, appCredentialSecretId, secrets) {
-        this.oauth2Config = oauth2Config;
-        this.appCredentialSecretId = appCredentialSecretId;
-        this.secrets = secrets;
-    }
-    /**
-     * Make an authenticated request. Handles token caching and 401 refresh.
-     */
-    async request(url, options, timeoutMs = DEFAULT_TIMEOUT_MS) {
-        const token = await this.getAccessToken();
-        const response = await fetchWithTimeout(url, {
-            ...options,
-            headers: {
-                ...options?.headers,
-                Authorization: `Bearer ${token}`,
-            },
-        }, timeoutMs);
-        // Auto-retry on 401 after refresh
-        if (response.status === 401) {
-            const newToken = await this.refreshAndGetToken();
-            return fetchWithTimeout(url, {
-                ...options,
-                headers: {
-                    ...options?.headers,
-                    Authorization: `Bearer ${newToken}`,
-                },
-            }, timeoutMs);
-        }
-        return response;
-    }
-    /**
-     * Get cached token or load from secrets.
-     */
-    async getAccessToken() {
-        // Return cached token if valid
-        if (this.cachedToken) {
-            if (this.isTokenValid(this.cachedToken)) {
-                return this.cachedToken.accessToken;
-            }
-            // Token expired, try to refresh
-            if (this.cachedToken.refreshToken) {
-                return this.refreshAndGetToken();
-            }
-            // Token expired and no refresh token available
-            throw new Error('OAuth2 token expired and no refresh token available');
-        }
-        // Load from secrets
-        const token = await this.secrets.getSecret(this.oauth2Config.tokenSecretId);
-        this.cachedToken = token;
-        // Check if loaded token is expired and needs refresh
-        if (!this.isTokenValid(token)) {
-            if (token.refreshToken) {
-                return this.refreshAndGetToken();
-            }
-            // Token expired and no refresh token available
-            throw new Error('OAuth2 token expired and no refresh token available');
-        }
-        return token.accessToken;
-    }
-    /**
-     * Refresh token and update cache.
-     * Uses a promise lock to prevent concurrent refresh attempts.
-     */
-    async refreshAndGetToken() {
-        if (this.refreshPromise) {
-            const token = await this.refreshPromise;
-            return token.accessToken;
-        }
-        this.refreshPromise = this.doRefreshToken();
-        try {
-            const token = await this.refreshPromise;
-            return token.accessToken;
-        }
-        finally {
-            this.refreshPromise = null;
-        }
-    }
-    /**
-     * Perform the actual token refresh.
-     */
-    async doRefreshToken() {
-        if (!this.cachedToken?.refreshToken) {
-            throw new Error('No refresh token available');
-        }
-        const appCredential = await this.getAppCredential();
-        const params = new URLSearchParams({
-            grant_type: 'refresh_token',
-            refresh_token: this.cachedToken.refreshToken,
-            client_id: appCredential.clientId,
-        });
-        if (appCredential.clientSecret) {
-            params.set('client_secret', appCredential.clientSecret);
-        }
-        const response = await fetchWithTimeout(this.oauth2Config.tokenUrl, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/x-www-form-urlencoded',
-            },
-            body: params.toString(),
-        });
-        if (!response.ok) {
-            throw new Error(`Token refresh failed: ${response.status}`);
-        }
-        const data = await response.json();
-        if (!data.access_token || typeof data.access_token !== 'string') {
-            throw new Error('Invalid token response: missing access_token');
-        }
-        const token = {
-            accessToken: data.access_token,
-            refreshToken: data.refresh_token || this.cachedToken.refreshToken,
-            expiresAt: data.expires_in
-                ? Date.now() + data.expires_in * 1000
-                : undefined,
-            tokenType: data.token_type || 'Bearer',
-            scope: data.scope,
-        };
-        await this.secrets.setSecret(this.oauth2Config.tokenSecretId, token);
-        this.cachedToken = token;
-        return token;
-    }
-    /**
-     * Check if token is valid (not expired).
-     */
-    isTokenValid(token) {
-        if (!token.expiresAt) {
-            return true; // No expiry info, assume valid
-        }
-        return token.expiresAt > Date.now() + TOKEN_EXPIRY_BUFFER_MS;
-    }
-    /**
-     * Get app credentials (cached).
-     */
-    async getAppCredential() {
-        if (this.cachedAppCredential) {
-            return this.cachedAppCredential;
-        }
-        this.cachedAppCredential =
-            await this.secrets.getSecret(this.appCredentialSecretId);
-        return this.cachedAppCredential;
-    }
-    // ========================================
-    // CLI-only methods (for pikku oauth connect)
-    // ========================================
-    /**
-     * Generate OAuth2 authorization URL.
-     * Used by CLI during `pikku oauth connect`.
-     */
-    async getAuthorizationUrl(state, redirectUri) {
-        const appCredential = await this.getAppCredential();
-        const params = new URLSearchParams({
-            response_type: 'code',
-            client_id: appCredential.clientId,
-            redirect_uri: redirectUri,
-            scope: this.oauth2Config.scopes.join(' '),
-            state,
-        });
-        // Add PKCE if enabled
-        // Note: code_verifier should be stored and passed to exchangeCode
-        // For now, PKCE implementation is simplified
-        // Add any additional params
-        if (this.oauth2Config.additionalParams) {
-            for (const [key, value] of Object.entries(this.oauth2Config.additionalParams)) {
-                params.set(key, value);
-            }
-        }
-        return `${this.oauth2Config.authorizationUrl}?${params.toString()}`;
-    }
-    /**
-     * Exchange authorization code for tokens.
-     * Used by CLI during `pikku oauth connect`.
-     */
-    async exchangeCode(code, redirectUri) {
-        const appCredential = await this.getAppCredential();
-        const params = new URLSearchParams({
-            grant_type: 'authorization_code',
-            code,
-            redirect_uri: redirectUri,
-            client_id: appCredential.clientId,
-        });
-        if (appCredential.clientSecret) {
-            params.set('client_secret', appCredential.clientSecret);
-        }
-        const response = await fetchWithTimeout(this.oauth2Config.tokenUrl, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/x-www-form-urlencoded',
-            },
-            body: params.toString(),
-        });
-        if (!response.ok) {
-            throw new Error(`Token exchange failed: ${response.status}`);
-        }
-        const data = await response.json();
-        if (!data.access_token || typeof data.access_token !== 'string') {
-            throw new Error('Invalid token response: missing access_token');
-        }
-        const token = {
-            accessToken: data.access_token,
-            refreshToken: data.refresh_token,
-            expiresAt: data.expires_in
-                ? Date.now() + data.expires_in * 1000
-                : undefined,
-            tokenType: data.token_type || 'Bearer',
-            scope: data.scope,
-        };
-        // Cache the token
-        this.cachedToken = token;
-        return token;
-    }
-}

package/dist/wirings/oauth2/oauth2-routes.d.ts

@@ -1,35 +0,0 @@
-import type { CredentialDefinitionsMeta } from '../credential/credential.types.js';
-export type CreateOAuth2HandlerOptions = {
-    credentialsMeta: CredentialDefinitionsMeta;
-    basePath?: string;
-};
-/**
- * Creates OAuth2 route handlers for user credential management.
- *
- * Returns individual handler functions for connect/callback/disconnect/status
- * that handle the OAuth2 authorization code flow and store tokens in CredentialService.
- *
- * @example
- * ```typescript
- * const oauth2 = createOAuth2Handler({ credentialsMeta })
- *
- * const oauth2Routes = defineHTTPRoutes({
- *   auth: true,
- *   basePath: '/credentials',
- *   routes: {
- *     connect: { method: 'get', route: '/:name/connect', func: oauth2.connect },
- *     callback: { method: 'get', route: '/:name/callback', func: oauth2.callback, auth: false },
- *     disconnect: { method: 'delete', route: '/:name', func: oauth2.disconnect },
- *     status: { method: 'get', route: '/:name/status', func: oauth2.status },
- *   },
- * })
- *
- * wireHTTPRoutes({ routes: { credentials: oauth2Routes } })
- * ```
- */
-export declare const createOAuth2Handler: (options: CreateOAuth2HandlerOptions) => {
-    connect: any;
-    callback: any;
-    disconnect: any;
-    status: any;
-};