@provos/ironcurtain 0.8.0 → 0.9.1

package/dist/auth/oauth-flow.js

@@ -0,0 +1,279 @@
+/**
+ * OAuth 2.0 authorization code flow with PKCE.
+ *
+ * Runs the complete browser-based flow: generates PKCE challenge,
+ * starts an ephemeral callback server, opens the browser, waits for
+ * the authorization code, and exchanges it for tokens.
+ */
+import { createHash, randomBytes } from 'node:crypto';
+import { createServer } from 'node:http';
+import { execFile } from 'node:child_process';
+import { URL } from 'node:url';
+export class OAuthFlowError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = 'OAuthFlowError';
+    }
+}
+// ---------------------------------------------------------------------------
+// PKCE
+// ---------------------------------------------------------------------------
+const CODE_VERIFIER_LENGTH = 64;
+/** Generates a cryptographically random code verifier (43-128 chars, base64url). */
+export function generateCodeVerifier() {
+    return randomBytes(CODE_VERIFIER_LENGTH).toString('base64url');
+}
+/** Computes the S256 code challenge from a code verifier. */
+export function computeCodeChallenge(verifier) {
+    const hash = createHash('sha256').update(verifier).digest();
+    return hash.toString('base64url');
+}
+// ---------------------------------------------------------------------------
+// State parameter (CSRF nonce)
+// ---------------------------------------------------------------------------
+function generateState() {
+    return randomBytes(32).toString('base64url');
+}
+// ---------------------------------------------------------------------------
+// Browser open
+// ---------------------------------------------------------------------------
+function openBrowser(url) {
+    const cmd = process.platform === 'darwin' ? 'open' : 'xdg-open';
+    execFile(cmd, [url], (err) => {
+        // Best-effort: if browser fails to open, user can copy the URL from terminal
+        if (err) {
+            console.error(`Could not open browser automatically. Please visit:\n${url}`);
+        }
+    });
+}
+function startCallbackServer(callbackPath, expectedState) {
+    let resolveResult;
+    const result = new Promise((resolve) => {
+        resolveResult = resolve;
+    });
+    const server = createServer((req, res) => {
+        const requestUrl = new URL(req.url ?? '/', `http://127.0.0.1`);
+        if (requestUrl.pathname !== callbackPath) {
+            res.writeHead(404, { 'Content-Type': 'text/plain' });
+            res.end('Not found');
+            return;
+        }
+        const error = requestUrl.searchParams.get('error');
+        if (error) {
+            const description = requestUrl.searchParams.get('error_description') ?? error;
+            respondWithHtml(res, 'Authorization Failed', `Authorization failed: ${description}`);
+            resolveResult({ ok: false, error: `Authorization failed: ${description}` });
+            return;
+        }
+        const state = requestUrl.searchParams.get('state');
+        if (state !== expectedState) {
+            respondWithHtml(res, 'Invalid State', 'State parameter mismatch. Possible CSRF attack.');
+            resolveResult({ ok: false, error: 'State parameter mismatch' });
+            return;
+        }
+        const code = requestUrl.searchParams.get('code');
+        if (!code) {
+            respondWithHtml(res, 'Missing Code', 'No authorization code received.');
+            resolveResult({ ok: false, error: 'No authorization code in callback' });
+            return;
+        }
+        respondWithHtml(res, 'Authorization Successful', 'Authorization successful! You can close this tab.');
+        resolveResult({ ok: true, code });
+    });
+    server.listen(0, '127.0.0.1');
+    const getPort = () => {
+        const address = server.address();
+        if (typeof address === 'object' && address !== null) {
+            return address.port;
+        }
+        throw new OAuthFlowError('Failed to get callback server port');
+    };
+    return { server, result, getPort };
+}
+function escapeHtml(text) {
+    return text.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+}
+function respondWithHtml(res, title, message) {
+    const safeTitle = escapeHtml(title);
+    const safeMessage = escapeHtml(message);
+    const html = `<!DOCTYPE html>
+<html><head><title>${safeTitle}</title></head>
+<body><h1>${safeTitle}</h1><p>${safeMessage}</p></body></html>`;
+    res.writeHead(200, { 'Content-Type': 'text/html', Connection: 'close' });
+    res.end(html);
+}
+async function exchangeCodeForTokens(provider, clientCredentials, code, redirectUri, codeVerifier) {
+    const body = new URLSearchParams({
+        grant_type: 'authorization_code',
+        code,
+        redirect_uri: redirectUri,
+        client_id: clientCredentials.clientId,
+        client_secret: clientCredentials.clientSecret,
+        code_verifier: codeVerifier,
+    });
+    const EXCHANGE_TIMEOUT_MS = 30_000;
+    let response;
+    try {
+        response = await fetchWithTimeout(provider.tokenUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: body.toString(),
+        }, EXCHANGE_TIMEOUT_MS);
+    }
+    catch (err) {
+        if (err instanceof Error && err.name === 'TimeoutError') {
+            throw new OAuthFlowError('Token exchange timed out', { cause: err });
+        }
+        throw err;
+    }
+    if (!response.ok) {
+        const text = await response.text();
+        throw new OAuthFlowError(`Token exchange failed (${response.status}): ${text}`);
+    }
+    let data;
+    try {
+        data = (await safeResponseJson(response));
+    }
+    catch (err) {
+        throw new OAuthFlowError('Token exchange returned non-JSON response', { cause: err });
+    }
+    if (!data.access_token) {
+        throw new OAuthFlowError('Token response missing access_token');
+    }
+    if (!data.refresh_token) {
+        throw new OAuthFlowError('Token response missing refresh_token. ' +
+            'This usually means the provider did not issue a refresh token. ' +
+            'For Google, ensure prompt=consent and access_type=offline are set.');
+    }
+    if (!data.expires_in || data.expires_in <= 0) {
+        throw new OAuthFlowError('Token response missing or invalid expires_in');
+    }
+    const expiresAt = Date.now() + data.expires_in * 1000;
+    const grantedScopes = data.scope ? data.scope.split(' ') : [];
+    const token = {
+        accessToken: data.access_token,
+        refreshToken: data.refresh_token,
+        expiresAt,
+        scopes: grantedScopes,
+    };
+    return { token, grantedScopes };
+}
+// ---------------------------------------------------------------------------
+// Authorization URL
+// ---------------------------------------------------------------------------
+function buildAuthorizationUrl(provider, clientId, redirectUri, state, codeChallenge, scopes) {
+    const url = new URL(provider.authorizationUrl);
+    url.searchParams.set('response_type', 'code');
+    url.searchParams.set('client_id', clientId);
+    url.searchParams.set('redirect_uri', redirectUri);
+    url.searchParams.set('state', state);
+    url.searchParams.set('scope', scopes.join(' '));
+    if (provider.usePkce) {
+        url.searchParams.set('code_challenge', codeChallenge);
+        url.searchParams.set('code_challenge_method', 'S256');
+    }
+    // Apply provider-specific extra params (e.g. access_type=offline for Google)
+    if (provider.extraAuthParams) {
+        for (const [key, value] of Object.entries(provider.extraAuthParams)) {
+            url.searchParams.set(key, value);
+        }
+    }
+    return url.toString();
+}
+// ---------------------------------------------------------------------------
+// Main flow
+// ---------------------------------------------------------------------------
+const DEFAULT_TIMEOUT_MS = 120_000;
+/**
+ * Runs the OAuth 2.0 authorization code flow with PKCE.
+ *
+ * 1. Generates PKCE code verifier and challenge
+ * 2. Starts an ephemeral HTTP server on 127.0.0.1:0 (OS-assigned port)
+ * 3. Opens the authorization URL in the user's default browser
+ * 4. Waits for the callback with the authorization code
+ * 5. Exchanges the code for tokens using client_id + client_secret
+ * 6. Stops the callback server
+ */
+export async function runOAuthFlow(provider, clientCredentials, scopes, timeoutMs, options) {
+    const effectiveScopes = scopes ?? provider.defaultScopes;
+    const timeout = timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    // Step 1: PKCE
+    const codeVerifier = generateCodeVerifier();
+    const codeChallenge = computeCodeChallenge(codeVerifier);
+    // Step 2: State nonce
+    const state = generateState();
+    // Step 3: Start callback server
+    const { server, result, getPort } = startCallbackServer(provider.callbackPath, state);
+    try {
+        // Wait for the server to be listening before reading the port
+        await new Promise((resolve) => {
+            if (server.listening) {
+                resolve();
+            }
+            else {
+                server.once('listening', resolve);
+            }
+        });
+        const port = getPort();
+        const redirectUri = `http://127.0.0.1:${port}${provider.callbackPath}`;
+        // Step 4: Build authorization URL and open browser
+        const authUrl = buildAuthorizationUrl(provider, clientCredentials.clientId, redirectUri, state, codeChallenge, effectiveScopes);
+        const opener = options?.openUrl ?? openBrowser;
+        opener(authUrl);
+        // Step 5: Wait for callback (with timeout)
+        const outcome = await withTimeout(result, timeout);
+        if (!outcome.ok) {
+            throw new OAuthFlowError(outcome.error);
+        }
+        // Step 6: Exchange code for tokens
+        return await exchangeCodeForTokens(provider, clientCredentials, outcome.code, redirectUri, codeVerifier);
+    }
+    finally {
+        // Step 7: Stop server and force-close any lingering connections
+        server.close();
+        server.closeAllConnections();
+    }
+}
+// ---------------------------------------------------------------------------
+// Timeout helpers
+// ---------------------------------------------------------------------------
+function withTimeout(promise, ms) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            reject(new OAuthFlowError(`OAuth flow timed out after ${ms}ms`));
+        }, ms);
+        promise.then((value) => {
+            clearTimeout(timer);
+            resolve(value);
+        }, (err) => {
+            clearTimeout(timer);
+            reject(err instanceof Error ? err : new Error(String(err)));
+        });
+    });
+}
+/**
+ * Wraps fetch() with an AbortSignal-based timeout.
+ * Callers are responsible for catching the AbortError and rethrowing as
+ * the appropriate domain error (OAuthFlowError, OAuthTokenExpiredError, etc.).
+ */
+export async function fetchWithTimeout(url, init, timeoutMs) {
+    const response = await fetch(url, {
+        ...init,
+        signal: AbortSignal.timeout(timeoutMs),
+    });
+    return response;
+}
+/**
+ * Safely parses a Response body as JSON.
+ * Returns the parsed value, or throws with a descriptive message on failure.
+ */
+export async function safeResponseJson(response) {
+    const text = await response.text();
+    try {
+        return JSON.parse(text);
+    }
+    catch (err) {
+        throw new SyntaxError(`Expected JSON response but got: ${text.slice(0, 200)}`, { cause: err });
+    }
+}
+//# sourceMappingURL=oauth-flow.js.map

package/dist/auth/oauth-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-flow.js","sourceRoot":"","sources":["../../src/auth/oauth-flow.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAa/B,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAe,EAAE,OAAsB;QACjD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAOD,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC,oFAAoF;AACpF,MAAM,UAAU,oBAAoB;IAClC,OAAO,WAAW,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACjE,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;IAC5D,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACpC,CAAC;AAED,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E,SAAS,aAAa;IACpB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;IAChE,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE;QAC3B,6EAA6E;QAC7E,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,CAAC,KAAK,CAAC,wDAAwD,GAAG,EAAE,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAQD,SAAS,mBAAmB,CAC1B,YAAoB,EACpB,aAAqB;IAErB,IAAI,aAAgD,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,OAAO,CAAkB,CAAC,OAAO,EAAE,EAAE;QACtD,aAAa,GAAG,OAAO,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;QACxE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAE/D,IAAI,UAAU,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YACzC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,WAAW,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,KAAK,CAAC;YAC9E,eAAe,CAAC,GAAG,EAAE,sBAAsB,EAAE,yBAAyB,WAAW,EAAE,CAAC,CAAC;YACrF,aAAa,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,WAAW,EAAE,EAAE,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;YAC5B,eAAe,CAAC,GAAG,EAAE,eAAe,EAAE,iDAAiD,CAAC,CAAC;YACzF,aAAa,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,eAAe,CAAC,GAAG,EAAE,cAAc,EAAE,iCAAiC,CAAC,CAAC;YACxE,aAAa,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QAED,eAAe,CAAC,GAAG,EAAE,0BAA0B,EAAE,mDAAmD,CAAC,CAAC;QACtG,aAAa,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IAE9B,MAAM,OAAO,GAAG,GAAW,EAAE;QAC3B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACjC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACpD,OAAO,OAAO,CAAC,IAAI,CAAC;QACtB,CAAC;QACD,MAAM,IAAI,cAAc,CAAC,oCAAoC,CAAC,CAAC;IACjE,CAAC,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACzG,CAAC;AAED,SAAS,eAAe,CAAC,GAAmB,EAAE,KAAa,EAAE,OAAe;IAC1E,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG;qBACM,SAAS;YAClB,SAAS,WAAW,WAAW,oBAAoB,CAAC;IAC9D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IACzE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAcD,KAAK,UAAU,qBAAqB,CAClC,QAA6B,EAC7B,iBAAyC,EACzC,IAAY,EACZ,WAAmB,EACnB,YAAoB;IAEpB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,IAAI;QACJ,YAAY,EAAE,WAAW;QACzB,SAAS,EAAE,iBAAiB,CAAC,QAAQ;QACrC,aAAa,EAAE,iBAAiB,CAAC,YAAY;QAC7C,aAAa,EAAE,YAAY;KAC5B,CAAC,CAAC;IAEH,MAAM,mBAAmB,GAAG,MAAM,CAAC;IACnC,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,gBAAgB,CAC/B,QAAQ,CAAC,QAAQ,EACjB;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,EACD,mBAAmB,CACpB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACxD,MAAM,IAAI,cAAc,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,cAAc,CAAC,0BAA0B,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,IAAI,IAAmB,CAAC;IACxB,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAkB,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,cAAc,CAAC,2CAA2C,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACxF,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,IAAI,cAAc,CAAC,qCAAqC,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACxB,MAAM,IAAI,cAAc,CACtB,wCAAwC;YACtC,iEAAiE;YACjE,oEAAoE,CACvE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,cAAc,CAAC,8CAA8C,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IACtD,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE9D,MAAM,KAAK,GAAqB;QAC9B,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;QAChC,SAAS;QACT,MAAM,EAAE,aAAa;KACtB,CAAC;IAEF,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;AAClC,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,SAAS,qBAAqB,CAC5B,QAA6B,EAC7B,QAAgB,EAChB,WAAmB,EACnB,KAAa,EACb,aAAqB,EACrB,MAAyB;IAEzB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC5C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAEhD,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;QACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;IAED,6EAA6E;IAC7E,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAEnC;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAA6B,EAC7B,iBAAyC,EACzC,MAA0B,EAC1B,SAAkB,EAClB,OAA0B;IAE1B,MAAM,eAAe,GAAG,MAAM,IAAI,QAAQ,CAAC,aAAa,CAAC;IACzD,MAAM,OAAO,GAAG,SAAS,IAAI,kBAAkB,CAAC;IAEhD,eAAe;IACf,MAAM,YAAY,GAAG,oBAAoB,EAAE,CAAC;IAC5C,MAAM,aAAa,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAEzD,sBAAsB;IACtB,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAE9B,gCAAgC;IAChC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,mBAAmB,CAAC,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAEtF,IAAI,CAAC;QACH,8DAA8D;QAC9D,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACrB,OAAO,EAAE,CAAC;YACZ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACpC,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,oBAAoB,IAAI,GAAG,QAAQ,CAAC,YAAY,EAAE,CAAC;QAEvE,mDAAmD;QACnD,MAAM,OAAO,GAAG,qBAAqB,CACnC,QAAQ,EACR,iBAAiB,CAAC,QAAQ,EAC1B,WAAW,EACX,KAAK,EACL,aAAa,EACb,eAAe,CAChB,CAAC;QACF,MAAM,MAAM,GAAG,OAAO,EAAE,OAAO,IAAI,WAAW,CAAC;QAC/C,MAAM,CAAC,OAAO,CAAC,CAAC;QAEhB,2CAA2C;QAC3C,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAEnD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,mCAAmC;QACnC,OAAO,MAAM,qBAAqB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;IAC3G,CAAC;YAAS,CAAC;QACT,gEAAgE;QAChE,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,mBAAmB,EAAE,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,SAAS,WAAW,CAAI,OAAmB,EAAE,EAAU;IACrD,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,IAAI,cAAc,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC,CAAC;QACnE,CAAC,EAAE,EAAE,CAAC,CAAC;QAEP,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE;YACR,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,EACD,CAAC,GAAY,EAAE,EAAE;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9D,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,IAAiB,EAAE,SAAiB;IACtF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,GAAG,IAAI;QACP,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;KACvC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAkB;IACvD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,WAAW,CAAC,mCAAmC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACjG,CAAC;AACH,CAAC"}

package/dist/auth/oauth-provider.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Core OAuth provider types and credential loading.
+ *
+ * Defines the shape of an OAuth provider configuration and provides
+ * utilities for loading client credentials from disk.
+ */
+/** Expand this union as new providers are registered in oauth-registry.ts. */
+export type OAuthProviderId = 'google';
+export interface OAuthProviderConfig {
+    readonly id: OAuthProviderId;
+    readonly displayName: string;
+    readonly authorizationUrl: string;
+    readonly tokenUrl: string;
+    readonly defaultScopes: readonly string[];
+    readonly callbackPath: string;
+    readonly usePkce: boolean;
+    readonly serverNames: readonly string[];
+    readonly tokenEnvVar: string;
+    readonly refreshTokenEnvVar: string;
+    readonly clientIdEnvVar: string;
+    readonly clientSecretEnvVar: string;
+    readonly credentialsFilename: string;
+    readonly additionalEnvVars?: Readonly<Record<string, (token: StoredOAuthToken) => string>>;
+    readonly postAuthUrl?: string;
+    readonly revocationUrl?: string;
+    /** Extra query parameters for the authorization URL (e.g. access_type, prompt). */
+    readonly extraAuthParams?: Readonly<Record<string, string>>;
+    /** Interactive scope picker shown when no --scopes flag and stdin is a TTY. */
+    readonly scopePicker?: (existingScopes: readonly string[]) => Promise<readonly string[] | symbol>;
+    /** Resolves short scope names (e.g. "gmail.send") to full scope URLs for --scopes flag. */
+    readonly resolveShortScopes?: (shortNames: readonly string[]) => readonly string[];
+    /** Provider-specific guidance shown when non-default scopes are requested. */
+    readonly nonDefaultScopeWarning?: string;
+}
+export interface OAuthClientCredentials {
+    readonly clientId: string;
+    readonly clientSecret: string;
+}
+export interface StoredOAuthToken {
+    readonly accessToken: string;
+    readonly refreshToken: string;
+    readonly expiresAt: number;
+    readonly scopes: readonly string[];
+}
+/**
+ * Loads OAuth client credentials from the provider's credentials file.
+ *
+ * Reads from ~/.ironcurtain/oauth/{provider.credentialsFilename}.
+ * Supports the Google "installed" Desktop app JSON format:
+ *   { "installed": { "client_id": "...", "client_secret": "..." } }
+ *
+ * Returns null if the file does not exist.
+ * Throws if the file exists but contains invalid or incomplete data.
+ */
+export declare function loadClientCredentials(provider: OAuthProviderConfig): OAuthClientCredentials | null;

package/dist/auth/oauth-provider.js

@@ -0,0 +1,73 @@
+/**
+ * Core OAuth provider types and credential loading.
+ *
+ * Defines the shape of an OAuth provider configuration and provides
+ * utilities for loading client credentials from disk.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { getOAuthDir } from '../config/paths.js';
+// ---------------------------------------------------------------------------
+// Credential loading
+// ---------------------------------------------------------------------------
+/**
+ * Loads OAuth client credentials from the provider's credentials file.
+ *
+ * Reads from ~/.ironcurtain/oauth/{provider.credentialsFilename}.
+ * Supports the Google "installed" Desktop app JSON format:
+ *   { "installed": { "client_id": "...", "client_secret": "..." } }
+ *
+ * Returns null if the file does not exist.
+ * Throws if the file exists but contains invalid or incomplete data.
+ */
+export function loadClientCredentials(provider) {
+    const credentialsPath = resolve(getOAuthDir(), provider.credentialsFilename);
+    if (!existsSync(credentialsPath)) {
+        return null;
+    }
+    const raw = readFileSync(credentialsPath, 'utf-8');
+    const parsed = parseCredentialsJson(raw, credentialsPath);
+    return extractClientCredentials(parsed, credentialsPath);
+}
+/**
+ * Parses the raw JSON string from a credentials file.
+ * Throws a descriptive error on invalid JSON.
+ */
+function parseCredentialsJson(raw, filePath) {
+    try {
+        return JSON.parse(raw);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`Invalid JSON in ${filePath}: ${message}`, { cause: err });
+    }
+}
+/**
+ * Extracts client_id and client_secret from the parsed credentials object.
+ *
+ * Supports two formats:
+ * 1. Desktop app (Google "installed"): { "installed": { "client_id": "...", "client_secret": "..." } }
+ * 2. Flat format: { "client_id": "...", "client_secret": "..." }
+ */
+function extractClientCredentials(parsed, filePath) {
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        throw new Error(`Invalid credentials format in ${filePath}: expected a JSON object`);
+    }
+    const obj = parsed;
+    // Check for "installed" wrapper (Google Desktop app format)
+    const source = isPlainObject(obj['installed']) ? obj['installed'] : obj;
+    const clientId = source['client_id'];
+    const clientSecret = source['client_secret'];
+    if (typeof clientId !== 'string' || clientId.length === 0) {
+        throw new Error(`Missing or empty client_id in ${filePath}`);
+    }
+    if (typeof clientSecret !== 'string' || clientSecret.length === 0) {
+        throw new Error(`Missing or empty client_secret in ${filePath}`);
+    }
+    return { clientId, clientSecret };
+}
+/** Type guard for non-null, non-array objects. */
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=oauth-provider.js.map

package/dist/auth/oauth-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-provider.js","sourceRoot":"","sources":["../../src/auth/oauth-provider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAgDjD,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAA6B;IACjE,MAAM,eAAe,GAAG,OAAO,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAE7E,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAC1D,OAAO,wBAAwB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAAC,GAAW,EAAE,QAAgB;IACzD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,KAAK,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,wBAAwB,CAAC,MAAe,EAAE,QAAgB;IACjE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,0BAA0B,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,GAAG,GAAG,MAAiC,CAAC;IAE9C,4DAA4D;IAC5D,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAExE,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACrC,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;IAE7C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACpC,CAAC;AAED,kDAAkD;AAClD,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/auth/oauth-registry.d.ts

@@ -0,0 +1,34 @@
+/**
+ * OAuth provider registry.
+ *
+ * Central lookup for all registered OAuth providers. Provides access
+ * by provider ID or by MCP server name.
+ */
+import type { OAuthProviderConfig, OAuthProviderId } from './oauth-provider.js';
+/**
+ * Returns the provider config for a given provider ID.
+ * Throws if the provider ID is not registered.
+ */
+export declare function getOAuthProvider(id: OAuthProviderId): OAuthProviderConfig;
+/**
+ * Returns all registered OAuth providers.
+ */
+export declare function getAllOAuthProviders(): readonly OAuthProviderConfig[];
+/**
+ * Returns the provider config associated with a given MCP server name,
+ * or undefined if no provider is registered for that server.
+ */
+export declare function getProviderForServer(serverName: string): OAuthProviderConfig | undefined;
+/**
+ * Returns true if the given string is a registered provider ID.
+ */
+export declare function isValidProviderId(id: string): id is OAuthProviderId;
+/**
+ * Resolves a provider ID string to its config, or writes an error and exits
+ * if the ID is not registered. Shared by setup-command and auth-command.
+ */
+export declare function resolveProviderOrExit(id: string): OAuthProviderConfig;
+/**
+ * Prints registered provider IDs and display names to stdout.
+ */
+export declare function printAvailableProviders(): void;

package/dist/auth/oauth-registry.js

@@ -0,0 +1,69 @@
+/**
+ * OAuth provider registry.
+ *
+ * Central lookup for all registered OAuth providers. Provides access
+ * by provider ID or by MCP server name.
+ */
+import { googleOAuthProvider } from './providers/google.js';
+// ---------------------------------------------------------------------------
+// Registry
+// ---------------------------------------------------------------------------
+const providers = [googleOAuthProvider];
+const providerById = new Map(providers.map((p) => [p.id, p]));
+const providerByServerName = new Map(providers.flatMap((p) => p.serverNames.map((name) => [name, p])));
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Returns the provider config for a given provider ID.
+ * Throws if the provider ID is not registered.
+ */
+export function getOAuthProvider(id) {
+    const provider = providerById.get(id);
+    if (!provider) {
+        throw new Error(`Unknown OAuth provider: ${id}`);
+    }
+    return provider;
+}
+/**
+ * Returns all registered OAuth providers.
+ */
+export function getAllOAuthProviders() {
+    return providers;
+}
+/**
+ * Returns the provider config associated with a given MCP server name,
+ * or undefined if no provider is registered for that server.
+ */
+export function getProviderForServer(serverName) {
+    return providerByServerName.get(serverName);
+}
+/**
+ * Returns true if the given string is a registered provider ID.
+ */
+export function isValidProviderId(id) {
+    return providerById.has(id);
+}
+/**
+ * Resolves a provider ID string to its config, or writes an error and exits
+ * if the ID is not registered. Shared by setup-command and auth-command.
+ */
+export function resolveProviderOrExit(id) {
+    if (!isValidProviderId(id)) {
+        process.stdout.write(`Unknown provider: ${id}\n\n`);
+        printAvailableProviders();
+        process.exit(1);
+    }
+    return getOAuthProvider(id);
+}
+/**
+ * Prints registered provider IDs and display names to stdout.
+ */
+export function printAvailableProviders() {
+    process.stdout.write('Available providers:\n');
+    for (const p of providers) {
+        process.stdout.write(`  ${p.id}  ${p.displayName}\n`);
+    }
+    process.stdout.write('\n');
+}
+//# sourceMappingURL=oauth-registry.js.map

package/dist/auth/oauth-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-registry.js","sourceRoot":"","sources":["../../src/auth/oauth-registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,MAAM,SAAS,GAAmC,CAAC,mBAAmB,CAAC,CAAC;AAExE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAuC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpG,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAClC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAU,CAAC,CAAC,CAC1E,CAAC;AAEF,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAmB;IAClD,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACrD,OAAO,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAU;IAC1C,OAAO,YAAY,CAAC,GAAG,CAAC,EAAqB,CAAC,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,EAAU;IAC9C,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QACpD,uBAAuB,EAAE,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,gBAAgB,CAAC,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC"}

package/dist/auth/oauth-token-provider.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Runtime OAuth token provider with transparent refresh.
+ *
+ * Provides valid access tokens for a specific OAuth provider, handling
+ * token expiry detection and refresh with deduplication. Follows the
+ * re-read-before-refresh pattern from OAuthTokenManager to coordinate
+ * with other processes that may refresh concurrently.
+ */
+import type { OAuthProviderConfig, OAuthClientCredentials } from './oauth-provider.js';
+export declare class OAuthTokenExpiredError extends Error {
+    readonly providerId: string;
+    constructor(providerId: string, message?: string, options?: ErrorOptions);
+}
+/**
+ * Provides valid access tokens for a specific OAuth provider at runtime.
+ * Handles transparent refresh with deduplication (single in-flight refresh).
+ */
+export declare class OAuthTokenProvider {
+    private readonly provider;
+    private readonly clientCredentials;
+    private inflightRefresh;
+    constructor(provider: OAuthProviderConfig, clientCredentials: OAuthClientCredentials);
+    /**
+     * Returns a valid access token, refreshing if near expiry.
+     * Uses the re-read-before-refresh pattern: checks if another process
+     * already refreshed the token before attempting our own refresh.
+     */
+    getValidAccessToken(): Promise<string>;
+    /**
+     * Forces a token refresh regardless of current expiry.
+     * Used by the TokenFileRefresher which has a more aggressive threshold
+     * (10 min) than the normal getValidAccessToken (5 min).
+     */
+    forceRefresh(): Promise<string>;
+    /** Returns true if a token file exists for this provider. */
+    isAuthorized(): boolean;
+    /** Returns the scopes granted during the last authorization flow. */
+    getGrantedScopes(): readonly string[];
+    /**
+     * Core refresh with deduplication. Concurrent callers share a single
+     * in-flight refresh promise.
+     */
+    private doRefresh;
+    /**
+     * Re-read-before-refresh pattern: another process may have already
+     * refreshed the token since our initial check.
+     *
+     * When force=true, skips the early return so the token is always
+     * refreshed via the provider's token endpoint.
+     */
+    private executeRefresh;
+}