@provos/ironcurtain 0.8.0 → 0.9.0

package/dist/auth/auth-command.d.ts

@@ -0,0 +1,15 @@
+/**
+ * CLI entry point for `ironcurtain auth` subcommands.
+ *
+ * Manages third-party OAuth providers: credential import, authorization,
+ * status checking, and token revocation.
+ *
+ * Subcommands:
+ *   ironcurtain auth                           - show status of all providers
+ *   ironcurtain auth import <provider> <file>  - import OAuth client credentials
+ *   ironcurtain auth <provider>                - authorize a provider (opens browser)
+ *   ironcurtain auth <provider> --scopes x,y   - authorize with additional scopes
+ *   ironcurtain auth status                    - same as no args
+ *   ironcurtain auth revoke <provider>         - revoke and delete stored token
+ */
+export declare function runAuthCommand(args: string[]): Promise<void>;

package/dist/auth/auth-command.js

@@ -0,0 +1,424 @@
+/**
+ * CLI entry point for `ironcurtain auth` subcommands.
+ *
+ * Manages third-party OAuth providers: credential import, authorization,
+ * status checking, and token revocation.
+ *
+ * Subcommands:
+ *   ironcurtain auth                           - show status of all providers
+ *   ironcurtain auth import <provider> <file>  - import OAuth client credentials
+ *   ironcurtain auth <provider>                - authorize a provider (opens browser)
+ *   ironcurtain auth <provider> --scopes x,y   - authorize with additional scopes
+ *   ironcurtain auth status                    - same as no args
+ *   ironcurtain auth revoke <provider>         - revoke and delete stored token
+ */
+import { copyFileSync, existsSync, chmodSync, mkdirSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { parseArgs } from 'node:util';
+import * as p from '@clack/prompts';
+import { printHelp } from '../cli-help.js';
+import { getOAuthDir, getOAuthTokenPath } from '../config/paths.js';
+import { loadClientCredentials } from './oauth-provider.js';
+import { getAllOAuthProviders, printAvailableProviders, resolveProviderOrExit } from './oauth-registry.js';
+import { runOAuthFlow, fetchWithTimeout } from './oauth-flow.js';
+import { deleteOAuthToken, loadOAuthToken, saveOAuthToken } from './oauth-token-store.js';
+// ---------------------------------------------------------------------------
+// Help specs
+// ---------------------------------------------------------------------------
+const authSpec = {
+    name: 'ironcurtain auth',
+    description: 'Manage third-party OAuth providers for MCP servers',
+    usage: [
+        'ironcurtain auth                              # Show provider status',
+        'ironcurtain auth import <provider> <file>      # Import client credentials',
+        'ironcurtain auth <provider>                    # Authorize (opens browser)',
+        'ironcurtain auth <provider> --scopes <scopes>  # Authorize with extra scopes',
+        'ironcurtain auth revoke <provider>             # Revoke stored token',
+        'ironcurtain auth status                        # Show provider status',
+    ],
+    subcommands: [
+        { name: 'import <provider> <file>', description: 'Import OAuth client credentials from provider' },
+        { name: '<provider>', description: 'Authorize a provider (opens browser for OAuth flow)' },
+        { name: 'revoke <provider>', description: 'Revoke and delete stored OAuth token' },
+        { name: 'status', description: 'Show authorization status for all providers' },
+    ],
+    options: [
+        { flag: 'scopes', description: 'Comma-separated scopes for incremental consent', placeholder: '<scopes>' },
+        { flag: 'help', short: 'h', description: 'Show this help message' },
+    ],
+    examples: [
+        'ironcurtain auth import google ~/Downloads/credentials.json',
+        'ironcurtain auth google',
+        'ironcurtain auth google --scopes gmail.send,calendar.events',
+        'ironcurtain auth revoke google',
+        'ironcurtain auth status',
+    ],
+};
+// ---------------------------------------------------------------------------
+// Google Cloud setup guide (shown when credentials are missing)
+// ---------------------------------------------------------------------------
+const GOOGLE_SETUP_GUIDE = `
+  Google Cloud Project Setup
+  ==========================
+
+  IronCurtain requires you to create your own Google Cloud OAuth credentials.
+  This is a one-time setup.
+
+  Step 1: Create a Google Cloud Project
+    Go to https://console.cloud.google.com/projectcreate
+    Enter a project name (e.g., "IronCurtain") and click Create.
+
+  Step 2: Enable Google Workspace APIs
+    Navigate to APIs & Services > Library and enable:
+      - Gmail API
+      - Google Calendar API
+      - Google Drive API
+
+  Step 3: Configure the OAuth Consent Screen
+    Navigate to APIs & Services > OAuth consent screen
+    Set User type to "External" (or "Internal" for Google Workspace orgs)
+    Fill in App name, support email, and developer contact email.
+    Add scopes based on what you need:
+      Read-only (default):  gmail.readonly, calendar.readonly, drive.readonly
+      Write access:         gmail.send, calendar.events, drive.file
+    You choose which scopes to enable — write scopes are optional.
+    Under Test users, add your Google account email.
+
+    Note: In "Testing" mode, refresh tokens expire after 7 days.
+    You will need to re-authorize weekly.
+
+    To add write scopes after initial authorization:
+      ironcurtain auth google --scopes gmail.send,calendar.events
+
+  Step 4: Create OAuth Client Credentials
+    Navigate to APIs & Services > Credentials
+    Click "Create Credentials" > "OAuth client ID"
+    Select Application type: "Desktop app"
+    Enter a name (e.g., "IronCurtain CLI")
+    Click Create, then "Download JSON"
+
+  Step 5: Import into IronCurtain
+    ironcurtain auth import google /path/to/downloaded-credentials.json
+
+  For more details, see: docs/designs/third-party-oauth.md
+`;
+/** Provider-specific setup guides, keyed by provider ID. */
+const SETUP_GUIDES = {
+    google: GOOGLE_SETUP_GUIDE,
+};
+function showSetupGuide(providerId) {
+    const guide = SETUP_GUIDES[providerId];
+    if (guide) {
+        process.stdout.write(guide);
+    }
+}
+function truncate(value, maxLen) {
+    return value.length > maxLen ? value.slice(0, maxLen) + '...' : value;
+}
+// ---------------------------------------------------------------------------
+// Import credentials
+// ---------------------------------------------------------------------------
+/**
+ * Handles `ironcurtain auth import <provider> <credentials-file>`.
+ * Shows provider-specific setup guidance when credentials file is not provided.
+ */
+function importCredentials(args) {
+    const providerId = args[0];
+    const credentialsPath = args[1];
+    if (!providerId) {
+        process.stdout.write('Usage: ironcurtain auth import <provider> <credentials-file>\n\n');
+        printAvailableProviders();
+        process.exit(1);
+    }
+    const provider = resolveProviderOrExit(providerId);
+    if (!credentialsPath) {
+        process.stdout.write(`Usage: ironcurtain auth import ${providerId} <credentials-file>\n`);
+        process.stdout.write('\nProvide the path to the credentials JSON file downloaded from your provider.\n');
+        showSetupGuide(provider.id);
+        process.exit(1);
+        return;
+    }
+    const resolvedPath = resolve(credentialsPath);
+    // Ensure the oauth directory exists and copy the file
+    const oauthDir = getOAuthDir();
+    mkdirSync(oauthDir, { recursive: true });
+    const destPath = resolve(oauthDir, provider.credentialsFilename);
+    try {
+        copyFileSync(resolvedPath, destPath);
+        chmodSync(destPath, 0o600);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        process.stdout.write(`Failed to import credentials: ${message}\n`);
+        process.exit(1);
+    }
+    // Validate by loading the copied credentials
+    const credentials = loadClientCredentials(provider);
+    if (!credentials) {
+        process.stdout.write(`Invalid credentials file: could not extract client_id and client_secret.\n`);
+        process.exit(1);
+    }
+    process.stdout.write(`\n  ${provider.displayName} -- Import OAuth Credentials\n\n`);
+    process.stdout.write(`  Found client_id: ${truncate(credentials.clientId, 20)}\n`);
+    process.stdout.write(`  Credentials saved to ${destPath}\n\n`);
+    process.stdout.write(`  Next step: run 'ironcurtain auth ${provider.id}' to authorize.\n\n`);
+}
+// ---------------------------------------------------------------------------
+// Status display
+// ---------------------------------------------------------------------------
+function showStatus() {
+    const providers = getAllOAuthProviders();
+    if (providers.length === 0) {
+        process.stdout.write('No OAuth providers registered.\n');
+        return;
+    }
+    process.stdout.write('\nOAuth Provider Status:\n\n');
+    for (const provider of providers) {
+        let credStatus;
+        try {
+            credStatus = loadClientCredentials(provider) !== null ? 'configured' : 'not configured';
+        }
+        catch {
+            credStatus = 'invalid';
+        }
+        const tokenPath = getOAuthTokenPath(provider.id);
+        const hasToken = existsSync(tokenPath);
+        const tokenStatus = hasToken ? 'authorized' : 'not authorized';
+        process.stdout.write(`  ${provider.displayName} (${provider.id})\n`);
+        process.stdout.write(`    Credentials: ${credStatus}\n`);
+        process.stdout.write(`    Token:       ${tokenStatus}\n`);
+        process.stdout.write('\n');
+    }
+}
+// ---------------------------------------------------------------------------
+// Revoke
+// ---------------------------------------------------------------------------
+/**
+ * Attempts to revoke the token server-side via the provider's revocation
+ * endpoint (if configured), then deletes the local token file.
+ */
+async function revokeToken(providerId) {
+    const provider = resolveProviderOrExit(providerId);
+    const token = loadOAuthToken(provider.id);
+    if (!token) {
+        process.stdout.write(`No stored token found for ${provider.displayName}.\n`);
+        return;
+    }
+    // Attempt server-side revocation if the provider has a revocation endpoint
+    await revokeTokenRemotely(provider, token);
+    deleteOAuthToken(provider.id);
+    process.stdout.write(`Token revoked for ${provider.displayName}.\n`);
+    process.stdout.write(`Deleted: ${getOAuthTokenPath(provider.id)}\n`);
+}
+/**
+ * Calls the provider's token revocation endpoint to invalidate the token
+ * server-side. Best-effort: logs a warning on failure but does not throw.
+ */
+async function revokeTokenRemotely(provider, token) {
+    if (!provider.revocationUrl) {
+        return;
+    }
+    // Prefer revoking the refresh token (invalidates both access and refresh)
+    const tokenToRevoke = token.refreshToken || token.accessToken;
+    const REVOCATION_TIMEOUT_MS = 10_000;
+    try {
+        const response = await fetchWithTimeout(provider.revocationUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({ token: tokenToRevoke }).toString(),
+        }, REVOCATION_TIMEOUT_MS);
+        if (!response.ok) {
+            const text = await response.text();
+            process.stdout.write(`Warning: Server-side revocation returned ${response.status}: ${text}\n`);
+        }
+    }
+    catch (err) {
+        if (err instanceof Error && err.name === 'TimeoutError') {
+            process.stdout.write(`Warning: Revocation request timed out after ${REVOCATION_TIMEOUT_MS}ms\n`);
+        }
+        else {
+            const message = err instanceof Error ? err.message : String(err);
+            process.stdout.write(`Warning: Could not reach revocation endpoint: ${message}\n`);
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// Authorize
+// ---------------------------------------------------------------------------
+/**
+ * Parses optional --scopes flag from remaining args after the provider name.
+ * Returns the scopes array, or undefined if not specified.
+ */
+function parseScopesArg(args) {
+    // args is everything after the provider name
+    if (args.length === 0) {
+        return undefined;
+    }
+    const scopesFlagPresent = args.includes('--scopes');
+    try {
+        const { values } = parseArgs({
+            args,
+            options: {
+                scopes: { type: 'string' },
+            },
+            strict: false,
+        });
+        if (typeof values.scopes === 'string' && values.scopes.length > 0) {
+            return values.scopes
+                .split(',')
+                .map((s) => s.trim())
+                .filter((s) => s.length > 0);
+        }
+    }
+    catch (err) {
+        if (scopesFlagPresent) {
+            const message = err instanceof Error ? err.message : String(err);
+            throw new Error(`Failed to parse --scopes: ${message}`, { cause: err });
+        }
+        // --scopes not present: ignore unrelated parse errors
+    }
+    return undefined;
+}
+/**
+ * Checks whether any of the selected scopes are non-default for this provider.
+ * Used to decide whether to show a consent-screen warning.
+ */
+function hasNonDefaultScopes(provider, scopes) {
+    const defaults = new Set(provider.defaultScopes);
+    return scopes.some((s) => !defaults.has(s));
+}
+/**
+ * Shows a warning note about non-default scopes, with optional
+ * provider-specific guidance, then prompts for confirmation.
+ * Returns false if the user cancels.
+ */
+async function confirmNonDefaultScopes(provider, scopes) {
+    if (!hasNonDefaultScopes(provider, scopes)) {
+        return true;
+    }
+    const defaults = new Set(provider.defaultScopes);
+    const nonDefault = scopes.filter((s) => !defaults.has(s));
+    const scopeList = nonDefault.map((s) => `  ${s}`).join('\n');
+    const guidance = provider.nonDefaultScopeWarning ??
+        'Ensure these scopes are configured with your OAuth provider\nbefore proceeding.';
+    p.note(`The following non-default scopes were selected:\n\n${scopeList}\n\n${guidance}`, 'Non-default scopes selected');
+    const confirmed = await p.confirm({
+        message: 'Continue with authorization?',
+        initialValue: true,
+    });
+    if (p.isCancel(confirmed) || !confirmed) {
+        return false;
+    }
+    return true;
+}
+async function authorize(providerId, extraArgs) {
+    const provider = resolveProviderOrExit(providerId);
+    let credentials;
+    try {
+        credentials = loadClientCredentials(provider);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        process.stdout.write(`Invalid credentials for ${provider.displayName}: ${message}\n`);
+        process.stdout.write(`Re-import with: ironcurtain auth import ${provider.id} <credentials-file>\n`);
+        process.exit(1);
+    }
+    if (!credentials) {
+        process.stdout.write(`No credentials configured for ${provider.displayName}.\n` +
+            `Run 'ironcurtain auth import ${provider.id} <credentials-file>' first.\n`);
+        showSetupGuide(provider.id);
+        process.exit(1);
+    }
+    const requestedScopes = parseScopesArg(extraArgs);
+    // Determine effective scopes (merge default + existing + requested for incremental consent)
+    let effectiveScopes;
+    let needsConfirmation = false;
+    if (requestedScopes) {
+        // --scopes flag: resolve short names and merge with existing
+        const resolved = provider.resolveShortScopes ? provider.resolveShortScopes(requestedScopes) : requestedScopes;
+        const existingToken = loadOAuthToken(provider.id);
+        const existingScopes = existingToken?.scopes ?? [];
+        // Always include provider defaults as baseline so --scopes only adds, never drops
+        const merged = [...new Set([...provider.defaultScopes, ...existingScopes, ...resolved])];
+        effectiveScopes = merged;
+        process.stdout.write(`\n  ${provider.displayName} OAuth -- Incremental Consent\n\n`);
+        if (existingScopes.length > 0) {
+            process.stdout.write('  Existing scopes:\n');
+            for (const scope of existingScopes) {
+                process.stdout.write(`    - ${scope}\n`);
+            }
+            process.stdout.write('\n  Requesting additional scopes:\n');
+            for (const scope of resolved) {
+                if (!existingScopes.includes(scope)) {
+                    process.stdout.write(`    + ${scope}\n`);
+                }
+            }
+            process.stdout.write('\n');
+        }
+    }
+    else if (process.stdin.isTTY && provider.scopePicker) {
+        // Interactive TTY: show the scope picker
+        const existingToken = loadOAuthToken(provider.id);
+        const existingScopes = existingToken?.scopes ?? [];
+        const selected = await provider.scopePicker(existingScopes);
+        if (p.isCancel(selected)) {
+            p.cancel('Authorization cancelled.');
+            return;
+        }
+        effectiveScopes = selected;
+        needsConfirmation = true;
+    }
+    else {
+        // Non-interactive: use defaults
+        process.stdout.write(`\n  ${provider.displayName} OAuth\n\n`);
+        process.stdout.write(`  Using credentials: ${truncate(credentials.clientId, 30)}\n`);
+        process.stdout.write(`  Requesting scopes: ${provider.defaultScopes.join(', ')}\n\n`);
+    }
+    // Warn about non-default scopes and confirm (for interactive picker only)
+    if (effectiveScopes && needsConfirmation) {
+        const confirmed = await confirmNonDefaultScopes(provider, effectiveScopes);
+        if (!confirmed) {
+            p.cancel('Authorization cancelled.');
+            return;
+        }
+    }
+    process.stdout.write('  Opening browser for authorization...\n');
+    const result = await runOAuthFlow(provider, credentials, effectiveScopes);
+    saveOAuthToken(provider.id, result.token);
+    const tokenPath = getOAuthTokenPath(provider.id);
+    process.stdout.write(`\n  Authorization successful!\n`);
+    process.stdout.write(`  Token stored at ${tokenPath}\n`);
+    process.stdout.write(`  Granted scopes: ${result.grantedScopes.join(', ')}\n\n`);
+}
+// ---------------------------------------------------------------------------
+// Entry point
+// ---------------------------------------------------------------------------
+export async function runAuthCommand(args) {
+    const subcommand = args[0];
+    // Show help when --help/-h is the first arg or no subcommand is given.
+    // Don't intercept --help after a subcommand — let subcommands handle their own help.
+    if (subcommand === '--help' || subcommand === '-h') {
+        printHelp(authSpec);
+        return;
+    }
+    if (!subcommand || subcommand === 'status') {
+        showStatus();
+        return;
+    }
+    if (subcommand === 'import') {
+        importCredentials(args.slice(1));
+        return;
+    }
+    if (subcommand === 'revoke') {
+        const providerId = args[1];
+        if (!providerId) {
+            process.stdout.write('Usage: ironcurtain auth revoke <provider>\n');
+            process.exit(1);
+        }
+        await revokeToken(providerId);
+        return;
+    }
+    // Remaining args after the provider name go to authorize for --scopes parsing
+    await authorize(subcommand, args.slice(1));
+}
+//# sourceMappingURL=auth-command.js.map

package/dist/auth/auth-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-command.js","sourceRoot":"","sources":["../../src/auth/auth-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,SAAS,EAAoB,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC3G,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE1F,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,MAAM,QAAQ,GAAgB;IAC5B,IAAI,EAAE,kBAAkB;IACxB,WAAW,EAAE,oDAAoD;IACjE,KAAK,EAAE;QACL,sEAAsE;QACtE,4EAA4E;QAC5E,4EAA4E;QAC5E,8EAA8E;QAC9E,sEAAsE;QACtE,uEAAuE;KACxE;IACD,WAAW,EAAE;QACX,EAAE,IAAI,EAAE,0BAA0B,EAAE,WAAW,EAAE,+CAA+C,EAAE;QAClG,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,qDAAqD,EAAE;QAC1F,EAAE,IAAI,EAAE,mBAAmB,EAAE,WAAW,EAAE,sCAAsC,EAAE;QAClF,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6CAA6C,EAAE;KAC/E;IACD,OAAO,EAAE;QACP,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,gDAAgD,EAAE,WAAW,EAAE,UAAU,EAAE;QAC1G,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE;KACpE;IACD,QAAQ,EAAE;QACR,6DAA6D;QAC7D,yBAAyB;QACzB,6DAA6D;QAC7D,gCAAgC;QAChC,yBAAyB;KAC1B;CACF,CAAC;AAEF,8EAA8E;AAC9E,gEAAgE;AAChE,8EAA8E;AAE9E,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4C1B,CAAC;AAEF,4DAA4D;AAC5D,MAAM,YAAY,GAAqC;IACrD,MAAM,EAAE,kBAAkB;CAC3B,CAAC;AAEF,SAAS,cAAc,CAAC,UAAkB;IACxC,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACvC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,MAAc;IAC7C,OAAO,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;AACxE,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,iBAAiB,CAAC,IAAc;IACvC,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,eAAe,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAEhC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACzF,uBAAuB,EAAE,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAEnD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,UAAU,uBAAuB,CAAC,CAAC;QAC1F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kFAAkF,CAAC,CAAC;QACzG,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAE9C,sDAAsD;IACtD,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEzC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,YAAY,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACrC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,OAAO,IAAI,CAAC,CAAC;QACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,6CAA6C;IAC7C,MAAM,WAAW,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4EAA4E,CAAC,CAAC;QACnG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,WAAW,kCAAkC,CAAC,CAAC;IACpF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,QAAQ,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IACnF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,QAAQ,MAAM,CAAC,CAAC;IAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,QAAQ,CAAC,EAAE,qBAAqB,CAAC,CAAC;AAC/F,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,SAAS,UAAU;IACjB,MAAM,SAAS,GAAG,oBAAoB,EAAE,CAAC;IAEzC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACzD,OAAO;IACT,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAErD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,UAAkB,CAAC;QACvB,IAAI,CAAC;YACH,UAAU,GAAG,qBAAqB,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAC1F,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,SAAS,CAAC;QACzB,CAAC;QACD,MAAM,SAAS,GAAG,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QAEvC,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAE/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;QACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,UAAU,IAAI,CAAC,CAAC;QACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,WAAW,IAAI,CAAC,CAAC;QAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;GAGG;AACH,KAAK,UAAU,WAAW,CAAC,UAAkB;IAC3C,MAAM,QAAQ,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAEnD,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,QAAQ,CAAC,WAAW,KAAK,CAAC,CAAC;QAC7E,OAAO;IACT,CAAC;IAED,2EAA2E;IAC3E,MAAM,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAE3C,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,QAAQ,CAAC,WAAW,KAAK,CAAC,CAAC;IACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,mBAAmB,CAAC,QAA6B,EAAE,KAAuB;IACvF,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QAC5B,OAAO;IACT,CAAC;IAED,0EAA0E;IAC1E,MAAM,aAAa,GAAG,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,WAAW,CAAC;IAE9D,MAAM,qBAAqB,GAAG,MAAM,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,QAAQ,CAAC,aAAa,EACtB;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,QAAQ,EAAE;SAC/D,EACD,qBAAqB,CACtB,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,QAAQ,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACxD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,qBAAqB,MAAM,CAAC,CAAC;QACnG,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iDAAiD,OAAO,IAAI,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,cAAc,CAAC,IAAc;IACpC,6CAA6C;IAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,iBAAiB,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;YAC3B,IAAI;YACJ,OAAO,EAAE;gBACP,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aAC3B;YACD,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QAEH,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClE,OAAO,MAAM,CAAC,MAAM;iBACjB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,6BAA6B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,sDAAsD;IACxD,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,QAA6B,EAAE,MAAyB;IACnF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,uBAAuB,CAAC,QAA6B,EAAE,MAAyB;IAC7F,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1D,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7D,MAAM,QAAQ,GACZ,QAAQ,CAAC,sBAAsB;QAC/B,iFAAiF,CAAC;IAEpF,CAAC,CAAC,IAAI,CACJ,sDAAsD,SAAS,OAAO,QAAQ,EAAE,EAChF,6BAA6B,CAC9B,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC;QAChC,OAAO,EAAE,8BAA8B;QACvC,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;IAEH,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,UAAkB,EAAE,SAAmB;IAC9D,MAAM,QAAQ,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAEnD,IAAI,WAAW,CAAC;IAChB,IAAI,CAAC;QACH,WAAW,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,QAAQ,CAAC,WAAW,KAAK,OAAO,IAAI,CAAC,CAAC;QACtF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,QAAQ,CAAC,EAAE,uBAAuB,CAAC,CAAC;QACpG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iCAAiC,QAAQ,CAAC,WAAW,KAAK;YACxD,gCAAgC,QAAQ,CAAC,EAAE,+BAA+B,CAC7E,CAAC;QACF,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,eAAe,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAElD,4FAA4F;IAC5F,IAAI,eAA8C,CAAC;IACnD,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAE9B,IAAI,eAAe,EAAE,CAAC;QACpB,6DAA6D;QAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;QAE9G,MAAM,aAAa,GAAG,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAClD,MAAM,cAAc,GAAG,aAAa,EAAE,MAAM,IAAI,EAAE,CAAC;QACnD,kFAAkF;QAClF,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,aAAa,EAAE,GAAG,cAAc,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACzF,eAAe,GAAG,MAAM,CAAC;QAEzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,WAAW,mCAAmC,CAAC,CAAC;QACrF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC7C,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;gBACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;YAC5D,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;gBAC7B,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;oBACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;gBAC3C,CAAC;YACH,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QACvD,yCAAyC;QACzC,MAAM,aAAa,GAAG,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAClD,MAAM,cAAc,GAAG,aAAa,EAAE,MAAM,IAAI,EAAE,CAAC;QAEnD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;QAC5D,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,CAAC,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QAED,eAAe,GAAG,QAAQ,CAAC;QAC3B,iBAAiB,GAAG,IAAI,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,gCAAgC;QAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,WAAW,YAAY,CAAC,CAAC;QAC9D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,QAAQ,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QACrF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxF,CAAC;IAED,0EAA0E;IAC1E,IAAI,eAAe,IAAI,iBAAiB,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QAC3E,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,CAAC,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;IACH,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAEjE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;IAC1E,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAE1C,MAAM,SAAS,GAAG,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACxD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,SAAS,IAAI,CAAC,CAAC;IACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACnF,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAc;IACjD,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAE3B,uEAAuE;IACvE,qFAAqF;IACrF,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACnD,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpB,OAAO;IACT,CAAC;IAED,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC3C,UAAU,EAAE,CAAC;QACb,OAAO;IACT,CAAC;IAED,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,WAAW,CAAC,UAAU,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IAED,8EAA8E;IAC9E,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC"}

package/dist/auth/oauth-flow.d.ts

@@ -0,0 +1,46 @@
+/**
+ * OAuth 2.0 authorization code flow with PKCE.
+ *
+ * Runs the complete browser-based flow: generates PKCE challenge,
+ * starts an ephemeral callback server, opens the browser, waits for
+ * the authorization code, and exchanges it for tokens.
+ */
+import type { OAuthProviderConfig, OAuthClientCredentials, StoredOAuthToken } from './oauth-provider.js';
+export interface OAuthFlowResult {
+    readonly token: StoredOAuthToken;
+    /** The scopes actually granted by the provider (may differ from requested). */
+    readonly grantedScopes: readonly string[];
+}
+export declare class OAuthFlowError extends Error {
+    constructor(message: string, options?: ErrorOptions);
+}
+export interface OAuthFlowOptions {
+    /** Override how the authorization URL is opened (default: system browser). */
+    readonly openUrl?: (url: string) => void;
+}
+/** Generates a cryptographically random code verifier (43-128 chars, base64url). */
+export declare function generateCodeVerifier(): string;
+/** Computes the S256 code challenge from a code verifier. */
+export declare function computeCodeChallenge(verifier: string): string;
+/**
+ * Runs the OAuth 2.0 authorization code flow with PKCE.
+ *
+ * 1. Generates PKCE code verifier and challenge
+ * 2. Starts an ephemeral HTTP server on 127.0.0.1:0 (OS-assigned port)
+ * 3. Opens the authorization URL in the user's default browser
+ * 4. Waits for the callback with the authorization code
+ * 5. Exchanges the code for tokens using client_id + client_secret
+ * 6. Stops the callback server
+ */
+export declare function runOAuthFlow(provider: OAuthProviderConfig, clientCredentials: OAuthClientCredentials, scopes?: readonly string[], timeoutMs?: number, options?: OAuthFlowOptions): Promise<OAuthFlowResult>;
+/**
+ * Wraps fetch() with an AbortSignal-based timeout.
+ * Callers are responsible for catching the AbortError and rethrowing as
+ * the appropriate domain error (OAuthFlowError, OAuthTokenExpiredError, etc.).
+ */
+export declare function fetchWithTimeout(url: string, init: RequestInit, timeoutMs: number): Promise<Response>;
+/**
+ * Safely parses a Response body as JSON.
+ * Returns the parsed value, or throws with a descriptive message on failure.
+ */
+export declare function safeResponseJson(response: Response): Promise<unknown>;