@qvac/core 0.0.0 → 0.1.1

package/dist-lib/lib/oauth/asana.d.ts

@@ -0,0 +1,35 @@
+import { type ConfigEngine, type Fetch, type OAuthTokens } from './common.ts';
+export declare const ASANA_MCP_CREDENTIAL_KEY = "asana_mcp_access_token";
+export declare const ASANA_OAUTH_STATE_KEY = "asana_oauth";
+export declare const ASANA_OAUTH_PORT = 18981;
+export type AsanaTokens = OAuthTokens;
+export declare function buildAsanaAuthUrl(opts: {
+    clientId: string;
+    state: string;
+    challenge: string;
+}): string;
+export declare function exchangeAsanaCode(opts: {
+    clientId: string;
+    clientSecret: string;
+    code: string;
+    verifier: string;
+    fetch?: Fetch;
+}): Promise<AsanaTokens>;
+export declare function refreshAsanaToken(opts: {
+    clientId: string;
+    clientSecret: string;
+    refreshToken: string;
+    fetch?: Fetch;
+}): Promise<AsanaTokens>;
+export declare function connectAsana(opts: {
+    clientId: string;
+    clientSecret: string;
+    openUrl: (url: string) => unknown;
+    fetch?: Fetch;
+    timeoutMs?: number;
+}): Promise<AsanaTokens>;
+export declare function resolveAsanaCredential(opts: {
+    engine: ConfigEngine;
+    agentId?: string;
+    fetch?: Fetch;
+}): Promise<string | null>;

package/dist-lib/lib/oauth/asana.js

@@ -0,0 +1,71 @@
+import { URLSearchParams } from 'url';
+import defaultFetch from '#fetch';
+import { runBrowserConnect } from "./browser-connect.js";
+import { oauthRedirectUri, tokenRequest } from "./common.js";
+import { resolveOAuthCredential } from "./resolve.js";
+export const ASANA_MCP_CREDENTIAL_KEY = 'asana_mcp_access_token';
+export const ASANA_OAUTH_STATE_KEY = 'asana_oauth';
+export const ASANA_OAUTH_PORT = 18981;
+const REDIRECT_URI = oauthRedirectUri(ASANA_OAUTH_PORT);
+const AUTH_URL = 'https://app.asana.com/-/oauth_authorize';
+const TOKEN_URL = 'https://app.asana.com/-/oauth_token';
+const MCP_RESOURCE = 'https://mcp.asana.com/v2';
+export function buildAsanaAuthUrl(opts) {
+    const params = new URLSearchParams({
+        response_type: 'code',
+        client_id: opts.clientId,
+        redirect_uri: REDIRECT_URI,
+        resource: MCP_RESOURCE,
+        state: opts.state,
+        code_challenge: opts.challenge,
+        code_challenge_method: 'S256'
+    });
+    return `${AUTH_URL}?${params.toString()}`;
+}
+export async function exchangeAsanaCode(opts) {
+    return tokenRequest(opts.fetch ?? defaultFetch, TOKEN_URL, new URLSearchParams({
+        grant_type: 'authorization_code',
+        code: opts.code,
+        redirect_uri: REDIRECT_URI,
+        client_id: opts.clientId,
+        client_secret: opts.clientSecret,
+        code_verifier: opts.verifier
+    }), 'Asana');
+}
+export async function refreshAsanaToken(opts) {
+    const tokens = await tokenRequest(opts.fetch ?? defaultFetch, TOKEN_URL, new URLSearchParams({
+        grant_type: 'refresh_token',
+        refresh_token: opts.refreshToken,
+        client_id: opts.clientId,
+        client_secret: opts.clientSecret
+    }), 'Asana');
+    return { ...tokens, refreshToken: tokens.refreshToken ?? opts.refreshToken };
+}
+export async function connectAsana(opts) {
+    return runBrowserConnect({
+        port: ASANA_OAUTH_PORT,
+        timeoutMs: opts.timeoutMs,
+        openUrl: opts.openUrl,
+        buildAuthUrl: ({ state, challenge }) => buildAsanaAuthUrl({ clientId: opts.clientId, state, challenge }),
+        exchange: ({ code, verifier }) => exchangeAsanaCode({
+            clientId: opts.clientId,
+            clientSecret: opts.clientSecret,
+            code,
+            verifier,
+            fetch: opts.fetch
+        })
+    });
+}
+export async function resolveAsanaCredential(opts) {
+    return resolveOAuthCredential({
+        ...opts,
+        credentialKey: ASANA_MCP_CREDENTIAL_KEY,
+        stateKey: ASANA_OAUTH_STATE_KEY,
+        requireClientSecret: true,
+        refresh: async ({ clientId, clientSecret, refreshToken, fetch }) => {
+            if (!clientSecret)
+                throw new Error('Asana refresh requires clientSecret');
+            return refreshAsanaToken({ clientId, clientSecret, refreshToken, fetch });
+        }
+    });
+}

package/dist-lib/lib/oauth/browser-connect.d.ts

@@ -0,0 +1,22 @@
+import { type OAuthTokens } from './common.ts';
+export declare function waitForOAuthCallback(opts: {
+    port: number;
+    state: string;
+    timeoutMs?: number;
+    onListening?: () => void;
+}): Promise<{
+    code: string;
+}>;
+export declare function runBrowserConnect(opts: {
+    port: number;
+    buildAuthUrl: (args: {
+        state: string;
+        challenge: string;
+    }) => string;
+    openUrl: (url: string) => unknown;
+    exchange: (args: {
+        code: string;
+        verifier: string;
+    }) => Promise<OAuthTokens>;
+    timeoutMs?: number;
+}): Promise<OAuthTokens>;

package/dist-lib/lib/oauth/browser-connect.js

@@ -0,0 +1,83 @@
+import { randomBytes as defaultRandomBytes } from 'crypto';
+import { createServer } from 'http';
+import { URL } from 'url';
+import { base64url, CALLBACK_PATH, createPkce, DEFAULT_TIMEOUT_MS } from "./common.js";
+export function waitForOAuthCallback(opts) {
+    const { port, state, timeoutMs = DEFAULT_TIMEOUT_MS, onListening } = opts;
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const respond = (res, status, body = '', close = false) => {
+            const headers = { 'Content-Type': 'text/html; charset=utf-8' };
+            if (close)
+                headers.Connection = 'close';
+            res.writeHead(status, headers);
+            res.end(body);
+        };
+        const settle = (err, result, res) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            const close = () => {
+                server.close();
+                server.closeAllConnections?.();
+            };
+            const socket = res?.socket;
+            if (socket)
+                socket.once('close', close);
+            else
+                close();
+            if (err)
+                reject(err);
+            else
+                resolve(result);
+        };
+        const server = createServer((req, res) => {
+            const url = new URL(req.url ?? '/', `http://127.0.0.1:${port}`);
+            if (url.pathname !== CALLBACK_PATH)
+                return respond(res, 404, 'Not found');
+            if (url.searchParams.get('state') !== state)
+                return respond(res, 204);
+            const error = url.searchParams.get('error');
+            const code = url.searchParams.get('code');
+            if (error) {
+                respond(res, 200, '<html><body><p>Authorization failed. You can close this tab.</p></body></html>', true);
+                settle(new Error(`OAuth error: ${error}`), undefined, res);
+            }
+            else if (code) {
+                respond(res, 200, '<html><body><p>You can close this tab.</p></body></html>', true);
+                settle(null, { code }, res);
+            }
+            else {
+                respond(res, 204);
+            }
+        });
+        const timer = setTimeout(() => settle(new Error('OAuth callback timed out')), timeoutMs);
+        server.once('error', (err) => settle(err));
+        server.listen(port, '127.0.0.1', () => onListening?.());
+    });
+}
+export async function runBrowserConnect(opts) {
+    const { verifier, challenge } = createPkce();
+    const state = base64url(defaultRandomBytes(16));
+    let onListening;
+    const listening = new Promise((resolve) => {
+        onListening = resolve;
+    });
+    const callback = waitForOAuthCallback({
+        port: opts.port,
+        state,
+        timeoutMs: opts.timeoutMs,
+        onListening: () => onListening()
+    });
+    try {
+        await Promise.race([listening, callback]);
+        await opts.openUrl(opts.buildAuthUrl({ state, challenge }));
+    }
+    catch (err) {
+        callback.catch(() => { });
+        throw err;
+    }
+    const { code } = await callback;
+    return opts.exchange({ code, verifier });
+}

package/dist-lib/lib/oauth/client.d.ts

@@ -0,0 +1,9 @@
+import { type OAuthRuntimeFlowDeps } from './flow-core.ts';
+import { isTokenExpired } from './token-exchange-core.ts';
+import type { OAuthProviderConfig, OAuthRuntime, OAuthTokens } from './types.ts';
+export type OAuthClient = {
+    readonly runOAuthFlow: (config: OAuthProviderConfig, deps: OAuthRuntimeFlowDeps) => Promise<OAuthTokens>;
+    readonly refreshOAuthTokens: (config: OAuthProviderConfig, refreshToken: string) => Promise<OAuthTokens>;
+};
+export declare function createOAuthClient(runtime: OAuthRuntime): OAuthClient;
+export { isTokenExpired };

package/dist-lib/lib/oauth/client.js

@@ -0,0 +1,9 @@
+import { runOAuthFlowWithRuntime } from "./flow-core.js";
+import { isTokenExpired, refreshOAuthTokensWithFetch } from "./token-exchange-core.js";
+export function createOAuthClient(runtime) {
+    return {
+        runOAuthFlow: (config, deps) => runOAuthFlowWithRuntime(config, deps, runtime),
+        refreshOAuthTokens: (config, refreshToken) => refreshOAuthTokensWithFetch(config, refreshToken, runtime.fetch)
+    };
+}
+export { isTokenExpired };

package/dist-lib/lib/oauth/common.d.ts

@@ -0,0 +1,38 @@
+import { Buffer } from 'buffer';
+export declare const CALLBACK_PATH = "/callback";
+export declare const DEFAULT_TIMEOUT_MS = 120000;
+export declare const REFRESH_SKEW_MS = 60000;
+export type FetchResponse = {
+    ok: boolean;
+    status: number;
+    text(): Promise<string>;
+    json(): Promise<unknown>;
+};
+export type Fetch = (url: string, init?: object) => Promise<FetchResponse>;
+export type RandomBytes = (size: number) => Buffer | Uint8Array;
+export type OAuthTokens = {
+    accessToken: string;
+    refreshToken?: string;
+    expiresAt?: number;
+    scope?: string;
+};
+export type ConfigEngine = {
+    configGet(req: {
+        key: string;
+    }): Promise<{
+        value?: unknown;
+    }>;
+    configSet(req: {
+        key: string;
+        value: string;
+    }): Promise<unknown>;
+};
+export declare function base64url(bytes: Buffer | Uint8Array): string;
+export declare function createPkce(randomBytes?: RandomBytes): {
+    verifier: string;
+    challenge: string;
+    method: "S256";
+};
+export declare function scopedKey(agentId: string | undefined, key: string): string;
+export declare function oauthRedirectUri(port: number): string;
+export declare function tokenRequest(fetchImpl: Fetch, tokenUrl: string, body: URLSearchParams, label: string): Promise<OAuthTokens>;

package/dist-lib/lib/oauth/common.js

@@ -0,0 +1,36 @@
+import { Buffer } from 'buffer';
+import { createHash, randomBytes as defaultRandomBytes } from 'crypto';
+export const CALLBACK_PATH = '/callback';
+export const DEFAULT_TIMEOUT_MS = 120_000;
+export const REFRESH_SKEW_MS = 60_000;
+export function base64url(bytes) {
+    return Buffer.from(bytes).toString('base64url');
+}
+export function createPkce(randomBytes = defaultRandomBytes) {
+    const verifier = base64url(randomBytes(32));
+    const challenge = base64url(createHash('sha256').update(verifier).digest());
+    return { verifier, challenge, method: 'S256' };
+}
+export function scopedKey(agentId, key) {
+    return agentId ? `skills.${agentId}.${key}` : `skills.${key}`;
+}
+export function oauthRedirectUri(port) {
+    return `http://127.0.0.1:${port}${CALLBACK_PATH}`;
+}
+export async function tokenRequest(fetchImpl, tokenUrl, body, label) {
+    const response = await fetchImpl(tokenUrl, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' },
+        body: body.toString()
+    });
+    if (!response.ok) {
+        const text = await response.text().catch(() => '');
+        throw new Error(`${label} token request failed (${response.status}): ${text.slice(0, 256)}`);
+    }
+    const raw = (await response.json());
+    return {
+        accessToken: raw.access_token,
+        refreshToken: raw.refresh_token,
+        expiresAt: raw.expires_in ? Date.now() + raw.expires_in * 1000 : undefined
+    };
+}

package/dist-lib/lib/oauth/crypto.d.ts

@@ -0,0 +1,3 @@
+export declare function bytesToBase64Url(bytes: Uint8Array): string;
+export declare function randomBase64Url(size: number): string;
+export declare function sha256Base64Url(value: string): string;

package/dist-lib/lib/oauth/crypto.js

@@ -0,0 +1,25 @@
+import { createHash, randomBytes } from 'crypto';
+const BASE64URL = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+export function bytesToBase64Url(bytes) {
+    let output = '';
+    for (let index = 0; index < bytes.length; index += 3) {
+        const first = bytes[index] ?? 0;
+        const second = bytes[index + 1] ?? 0;
+        const third = bytes[index + 2] ?? 0;
+        output += BASE64URL[first >> 2];
+        output += BASE64URL[((first & 0x03) << 4) | (second >> 4)];
+        if (index + 1 < bytes.length) {
+            output += BASE64URL[((second & 0x0f) << 2) | (third >> 6)];
+        }
+        if (index + 2 < bytes.length) {
+            output += BASE64URL[third & 0x3f];
+        }
+    }
+    return output;
+}
+export function randomBase64Url(size) {
+    return bytesToBase64Url(randomBytes(size));
+}
+export function sha256Base64Url(value) {
+    return createHash('sha256').update(value).digest('base64url');
+}

package/dist-lib/lib/oauth/fetch-platform.d.ts

@@ -0,0 +1 @@
+export { default } from '#fetch';

package/dist-lib/lib/oauth/fetch-platform.js

@@ -0,0 +1 @@
+export { default } from '#fetch';

package/dist-lib/lib/oauth/flow-core.d.ts

@@ -0,0 +1,6 @@
+import type { OAuthRedirectFactory } from './redirect-types.ts';
+import type { OAuthFlowDeps, OAuthProviderConfig, OAuthRuntime, OAuthTokens } from './types.ts';
+export type OAuthRuntimeFlowDeps = OAuthFlowDeps & {
+    readonly createRedirect: OAuthRedirectFactory;
+};
+export declare function runOAuthFlowWithRuntime(config: OAuthProviderConfig, deps: OAuthRuntimeFlowDeps, runtime: OAuthRuntime): Promise<OAuthTokens>;

package/dist-lib/lib/oauth/flow-core.js

@@ -0,0 +1,37 @@
+import { generateRuntimePkceChallenge } from "./pkce-runtime.js";
+import { resolveDynamicClientId } from "./register.js";
+import { exchangeCodeWithFetch } from "./token-exchange-core.js";
+function buildAuthParams(config, clientId, redirectUri, state, pkce) {
+    const params = new URLSearchParams({
+        ...(config.extraAuthParams ?? {}),
+        client_id: clientId,
+        redirect_uri: redirectUri,
+        response_type: 'code',
+        state,
+        code_challenge: pkce.challenge,
+        code_challenge_method: 'S256'
+    });
+    if (config.scopes.length > 0)
+        params.set('scope', config.scopes.join(' '));
+    return params;
+}
+export async function runOAuthFlowWithRuntime(config, deps, runtime) {
+    const openUrl = deps.openUrl ??
+        (() => Promise.reject(new Error('OAuth browser launcher is unavailable; inject openUrl or createRedirect')));
+    const redirect = await deps.createRedirect({ port: config.port }, { openUrl });
+    try {
+        const clientId = config.dynamicRegistration && !config.clientId
+            ? await resolveDynamicClientId(config, redirect.redirectUri, deps, runtime.fetch)
+            : config.clientId;
+        const pkce = await generateRuntimePkceChallenge(runtime);
+        const state = runtime.randomBase64Url(16);
+        const authParams = buildAuthParams(config, clientId, redirect.redirectUri, state, pkce);
+        const callback = await redirect.authorize(`${config.authUrl}?${authParams.toString()}`, deps.timeoutMs, state);
+        if (callback.state !== state)
+            throw new Error('OAuth state mismatch (possible CSRF)');
+        return exchangeCodeWithFetch(config, clientId, redirect.redirectUri, callback.code, pkce.verifier, deps, runtime.fetch);
+    }
+    finally {
+        redirect.close();
+    }
+}

package/dist-lib/lib/oauth/flow.d.ts

@@ -0,0 +1,3 @@
+import type { OAuthFlowDeps, OAuthProvider, OAuthProviderConfig, OAuthTokens } from './types.ts';
+export declare function cancelOAuthFlow(provider: OAuthProvider): Promise<boolean>;
+export declare function runOAuthFlow(config: OAuthProviderConfig, deps?: OAuthFlowDeps): Promise<OAuthTokens>;

package/dist-lib/lib/oauth/flow.js

@@ -0,0 +1,24 @@
+import { abortOAuthLoopback, startOAuthLoopback } from '#oauth-loopback';
+import { randomBase64Url, sha256Base64Url } from '@qvac/core/oauth/runtime/crypto';
+import defaultFetch from '@qvac/core/oauth/runtime/fetch';
+import { runOAuthFlowWithRuntime } from "./flow-core.js";
+import { OAUTH_PROVIDER_PORTS } from "./keys.js";
+export function cancelOAuthFlow(provider) {
+    return abortOAuthLoopback(OAUTH_PROVIDER_PORTS[provider]);
+}
+const loopbackRedirect = async (target, deps) => {
+    const loopback = await startOAuthLoopback(target.port);
+    return {
+        redirectUri: loopback.redirectUri,
+        async authorize(authUrl, timeoutMs, expectedState) {
+            const callback = loopback.waitForCode(timeoutMs, expectedState);
+            callback.catch(() => undefined);
+            await deps.openUrl(authUrl);
+            return callback;
+        },
+        close: () => loopback.close()
+    };
+};
+export function runOAuthFlow(config, deps = {}) {
+    return runOAuthFlowWithRuntime(config, { ...deps, createRedirect: deps.createRedirect ?? loopbackRedirect }, { fetch: defaultFetch, randomBase64Url, sha256Base64Url });
+}

package/dist-lib/lib/oauth/google.d.ts

@@ -0,0 +1,37 @@
+import { type ConfigEngine, type Fetch, type OAuthTokens } from './common.ts';
+export declare const GOOGLE_OAUTH_PORT: number;
+export type GoogleTokens = OAuthTokens;
+export declare function buildGoogleAuthUrl(opts: {
+    clientId: string;
+    state: string;
+    challenge: string;
+    credentialKey: string;
+}): string;
+export declare function exchangeGoogleCode(opts: {
+    clientId: string;
+    clientSecret: string;
+    code: string;
+    verifier: string;
+    fetch?: Fetch;
+}): Promise<GoogleTokens>;
+export declare function refreshGoogleToken(opts: {
+    clientId: string;
+    clientSecret: string;
+    refreshToken: string;
+    fetch?: Fetch;
+}): Promise<GoogleTokens>;
+export declare function connectGoogle(opts: {
+    clientId: string;
+    clientSecret: string;
+    credentialKey: string;
+    openUrl: (url: string) => unknown;
+    fetch?: Fetch;
+    timeoutMs?: number;
+}): Promise<GoogleTokens>;
+export declare function resolveGoogleCredential(opts: {
+    engine: ConfigEngine;
+    agentId?: string;
+    fetch?: Fetch;
+    credentialKey: string;
+    stateKey: string;
+}): Promise<string | null>;

package/dist-lib/lib/oauth/google.js

@@ -0,0 +1,77 @@
+import { URLSearchParams } from 'url';
+import defaultFetch from '#fetch';
+import { runBrowserConnect } from "./browser-connect.js";
+import { oauthRedirectUri, tokenRequest } from "./common.js";
+import { OAUTH_PROVIDER_PORTS, oauthKeySpec } from "./keys.js";
+import { resolveOAuthCredential } from "./resolve.js";
+export const GOOGLE_OAUTH_PORT = OAUTH_PROVIDER_PORTS.google;
+const REDIRECT_URI = oauthRedirectUri(GOOGLE_OAUTH_PORT);
+const AUTH_URL = 'https://accounts.google.com/o/oauth2/v2/auth';
+const TOKEN_URL = 'https://oauth2.googleapis.com/token';
+function scopesFor(credentialKey) {
+    return oauthKeySpec(credentialKey)?.scopes ?? [];
+}
+export function buildGoogleAuthUrl(opts) {
+    const params = new URLSearchParams({
+        response_type: 'code',
+        client_id: opts.clientId,
+        redirect_uri: REDIRECT_URI,
+        scope: scopesFor(opts.credentialKey).join(' '),
+        state: opts.state,
+        code_challenge: opts.challenge,
+        code_challenge_method: 'S256',
+        access_type: 'offline',
+        prompt: 'consent'
+    });
+    return `${AUTH_URL}?${params.toString()}`;
+}
+export async function exchangeGoogleCode(opts) {
+    return tokenRequest(opts.fetch ?? defaultFetch, TOKEN_URL, new URLSearchParams({
+        grant_type: 'authorization_code',
+        code: opts.code,
+        redirect_uri: REDIRECT_URI,
+        client_id: opts.clientId,
+        client_secret: opts.clientSecret,
+        code_verifier: opts.verifier
+    }), 'Google');
+}
+export async function refreshGoogleToken(opts) {
+    const tokens = await tokenRequest(opts.fetch ?? defaultFetch, TOKEN_URL, new URLSearchParams({
+        grant_type: 'refresh_token',
+        refresh_token: opts.refreshToken,
+        client_id: opts.clientId,
+        client_secret: opts.clientSecret
+    }), 'Google');
+    return { ...tokens, refreshToken: tokens.refreshToken ?? opts.refreshToken };
+}
+export async function connectGoogle(opts) {
+    return runBrowserConnect({
+        port: GOOGLE_OAUTH_PORT,
+        timeoutMs: opts.timeoutMs,
+        openUrl: opts.openUrl,
+        buildAuthUrl: ({ state, challenge }) => buildGoogleAuthUrl({
+            clientId: opts.clientId,
+            state,
+            challenge,
+            credentialKey: opts.credentialKey
+        }),
+        exchange: ({ code, verifier }) => exchangeGoogleCode({
+            clientId: opts.clientId,
+            clientSecret: opts.clientSecret,
+            code,
+            verifier,
+            fetch: opts.fetch
+        })
+    });
+}
+export async function resolveGoogleCredential(opts) {
+    return resolveOAuthCredential({
+        ...opts,
+        requireClientSecret: true,
+        refresh: async ({ clientId, clientSecret, refreshToken, fetch }) => {
+            if (!clientSecret)
+                throw new Error('Google refresh requires clientSecret');
+            return refreshGoogleToken({ clientId, clientSecret, refreshToken, fetch });
+        }
+    });
+}

package/dist-lib/lib/oauth/host.d.ts

@@ -0,0 +1,5 @@
+export { buildProviderConfig, providerRequiresSecret, providerSupportsDcr, providerSupportsSharedIosSession } from './providers.ts';
+export { isTokenExpired, refreshOAuthTokens } from './token-exchange.ts';
+export { cancelOAuthFlow, runOAuthFlow } from './flow.ts';
+export type { OAuthCredentials, OAuthFlowDeps, OAuthFlowResult, OAuthProvider, OAuthProviderConfig, OAuthTokens } from './types.ts';
+export type { OAuthCallbackResult, OAuthRedirect, OAuthRedirectFactory } from './redirect-types.ts';

package/dist-lib/lib/oauth/host.js

@@ -0,0 +1,3 @@
+export { buildProviderConfig, providerRequiresSecret, providerSupportsDcr, providerSupportsSharedIosSession } from "./providers.js";
+export { isTokenExpired, refreshOAuthTokens } from "./token-exchange.js";
+export { cancelOAuthFlow, runOAuthFlow } from "./flow.js";

package/dist-lib/lib/oauth/keys.d.ts

@@ -0,0 +1,25 @@
+import type { OAuthProvider } from './types.ts';
+export declare const GMAIL_CREDENTIAL_KEY = "gmail_access_token";
+export declare const GOOGLE_CALENDAR_CREDENTIAL_KEY = "google_calendar_access_token";
+export declare const GOOGLE_DOCS_CREDENTIAL_KEY = "google_docs_access_token";
+export declare const GOOGLE_DRIVE_CREDENTIAL_KEY = "google_drive_access_token";
+export declare const GOOGLE_SHEETS_CREDENTIAL_KEY = "google_sheets_access_token";
+export declare const SPOTIFY_CREDENTIAL_KEY = "spotify_access_token";
+export declare const ASANA_MCP_CREDENTIAL_KEY = "asana_mcp_access_token";
+export declare const NOTION_MCP_CREDENTIAL_KEY = "notion_mcp_access_token";
+export declare const LEGACY_GOOGLE_CREDENTIAL_KEY = "google_workspace_access_token";
+export type OAuthKeySpec = {
+    readonly credentialKey: string;
+    readonly stateKey: string;
+    readonly provider: OAuthProvider;
+    readonly scopes: ReadonlyArray<string>;
+};
+export declare const OAUTH_KEY_SPECS: ReadonlyArray<OAuthKeySpec>;
+export declare function oauthKeySpec(credentialKey: string): OAuthKeySpec | null;
+export declare function oauthStateKeyFor(credentialKey: string): string | null;
+export declare function defaultCredentialKeyFor(provider: OAuthProvider): string;
+export declare const GOOGLE_CREDENTIAL_KEYS: ReadonlyArray<string>;
+export declare const OAUTH_PROVIDER_PORTS: Readonly<Record<OAuthProvider, number>>;
+export declare const OAUTH_CALLBACK_PATH = "/callback";
+export declare const OAUTH_WAIT_FOR_CODE_TIMEOUT_MS = 120000;
+export declare function oauthRedirectUri(port: number): string;