@stage-labs/metro 0.1.0-beta.7 → 0.1.0-beta.71

package/runtime/node_modules/@metro-labs/mcp/src/daemon/local-mode.ts

@@ -0,0 +1,187 @@
+import { ApiError } from './api-error.js';
+import { errMsg, log } from './log.js';
+import { AttachSessions } from './attach-session.js';
+import type { AgentApiDeps } from './agent-api.js';
+import { ATTACHABLE, type AccountApiDeps } from './account-api.js';
+import type { SessionApis } from './session-apis.js';
+import type { ModeInfo } from './mode-api.js';
+import { loadedAgentOf, type AgentBundle, type BundleApiDeps } from './bundle-api.js';
+import { METRO_VERSION } from './version.js';
+import type { ConnectorApiDeps } from './connector-api.js';
+import { allowLocalConnectors } from './connector-url.js';
+import { keyIdentity, type LocalCliDeps } from './local-cli-api.js';
+import type { RelayApiDeps } from './relay.js';
+import {
+  readLocalConnectors,
+  localImportConnectors,
+  localConnectorNamesByIds,
+  localCreateConnector,
+  localCreatePendingConnector,
+  localDeleteConnector,
+  localDisconnectConnector,
+  localGetConnector,
+  localListConnectors,
+  localReconnectConnector,
+  localRelayTarget,
+  localRenameConnector,
+  localVerifyConnector,
+} from '../db/local-connectors.js';
+import {
+  assertLocalOwner,
+  LOCAL_PROJECT_ID,
+  localAttachAccount,
+  localCreateAgent,
+  localDeleteAgent,
+  localDetachAccount,
+  localImportAgent,
+  localListAgents,
+  localOwnedAgentOrThrow,
+  localOwner,
+  localResetAgentKey,
+  readLocalAgentFile,
+} from '../db/file-admin.js';
+import { listAgentFiles, readAgentFile } from '../db/file-source.js';
+import { readModelConfig } from '../gateway/model-config.js';
+import type { StationName } from '../db/stations.js';
+
+export interface LocalModeDeps {
+  syncStations: (station: StationName) => Promise<void>;
+  restart: () => void;
+  stop: () => void;
+  closeAgentSession: (id: string) => Promise<boolean>;
+  gatherAccounts: AgentApiDeps['gatherAccounts'];
+  capabilities: AgentApiDeps['capabilities'];
+  liveness: AgentApiDeps['liveness'];
+  prepareAccount: AccountApiDeps['prepareAccount'];
+}
+
+function attachSessions(deps: LocalModeDeps): AttachSessions {
+  return new AttachSessions({
+    authorize: async (owner) => {
+      await localOwnedAgentOrThrow(owner.subject, owner.agentId);
+    },
+    complete: async (owner, station, config) => {
+      const ref = await localAttachAccount(owner.subject, owner.agentId, station, config);
+      const activated = await deps.syncStations(station).then(
+        () => true,
+        (err: unknown) => {
+          log.warn(
+            { station, err: errMsg(err) },
+            'attach-session: station reload failed, the change lands at the next boot',
+          );
+          return false;
+        },
+      );
+      return { accountId: ref.accountId, activated };
+    },
+  });
+}
+
+function agentApi(deps: LocalModeDeps): AgentApiDeps {
+  return {
+    attachSessions: attachSessions(deps),
+    listAgents: localListAgents,
+    createAgent: localCreateAgent,
+    deleteAgent: localDeleteAgent,
+    resetKey: async (subject, id) => {
+      const reset = await localResetAgentKey(subject, id);
+      const closed = await deps.closeAgentSession(id);
+      log.info({ agent: reset.name, id, sessionClosed: closed }, 'local: key rotated');
+      return reset;
+    },
+    gatherAccounts: deps.gatherAccounts,
+    capabilities: deps.capabilities,
+    attachable: ATTACHABLE.filter((s) => s !== 'webhook'),
+    liveness: deps.liveness,
+    connectorIds: connectorIdsOfLocalAgents,
+    prepareAccount: deps.prepareAccount,
+    attachAccount: localAttachAccount,
+    detachAccount: localDetachAccount,
+    syncStations: deps.syncStations,
+  };
+}
+
+const allConnectorIds = (): string[] => readLocalConnectors().map((c) => c.id);
+
+function connectorIdsOfLocalAgents(ids: string[]): Promise<Map<string, string[]>> {
+  const all = allConnectorIds();
+  return Promise.resolve(new Map(ids.map((id) => [id, all] as const)));
+}
+
+const connectorApi: ConnectorApiDeps = {
+  listConnectors: localListConnectors,
+  createConnector: localCreateConnector,
+  verifyConnector: localVerifyConnector,
+  disconnectConnector: localDisconnectConnector,
+  renameConnector: localRenameConnector,
+  deleteConnector: localDeleteConnector,
+  createPendingConnector: localCreatePendingConnector,
+  reconnectConnector: localReconnectConnector,
+  getConnector: localGetConnector,
+};
+
+const relayApi: RelayApiDeps = {
+  target: (connectorId, force) => localRelayTarget(connectorId, force),
+  identify: keyIdentity,
+};
+
+function agentNameOf(agentId: string): string | null {
+  return listAgentFiles()
+    .map((path) => readAgentFile(path))
+    .find((file) => file.id === agentId)?.name ?? null;
+}
+
+const localCli: LocalCliDeps = {
+  agentName: agentNameOf,
+  connectorEntries: () => localConnectorNamesByIds(allConnectorIds()),
+};
+
+function bundleApi(deps: LocalModeDeps): BundleApiDeps {
+  return {
+    bundle: async (subject, agentId) => {
+      const { agent } = await localOwnedAgentOrThrow(subject, agentId);
+      const file = readLocalAgentFile(agentId);
+      const bundle: AgentBundle = {
+        version: 1,
+        agent: { id: file.id, name: file.name, key: file.key ?? '', stations: file.stations },
+        connectors: readLocalConnectors().map((c) => ({ id: c.id, name: c.name, url: c.url, transport: c.transport, config: { ...c.config } })),
+      };
+      if (bundle.agent.key === '') throw new ApiError(`agent '${agent.name}' has no key to bundle`, 400);
+      return bundle;
+    },
+    restore: async (subject, bundle) => {
+      assertLocalOwner(subject);
+      const made = await localImportAgent(subject, loadedAgentOf(bundle));
+      const connectors = localImportConnectors(bundle.connectors);
+      for (const station of new Set(bundle.agent.stations.map((a) => a.station)))
+        await deps.syncStations(station).catch((err: unknown) => {
+          log.warn({ station, err: errMsg(err) }, 'restore: station reload failed, the change lands at the next boot');
+        });
+      return { id: made.id, name: made.name, stations: made.stations, connectors };
+    },
+  };
+}
+
+function localModeInfo(): ModeInfo {
+  return { mode: 'local', owner: localOwner(), project: LOCAL_PROJECT_ID, version: METRO_VERSION };
+}
+
+export function localSessionApis(deps: LocalModeDeps): SessionApis {
+  allowLocalConnectors(true);
+  return {
+    agentApi: agentApi(deps),
+    bundleApi: bundleApi(deps),
+    connectorApi,
+    relayApi,
+    localCli,
+    claudeApi: { authorize: (subject) => { assertLocalOwner(subject); } },
+    updateApi: { authorize: (subject) => { assertLocalOwner(subject); }, restart: deps.restart },
+    controlApi: { authorize: (subject) => { assertLocalOwner(subject); }, restart: deps.restart, stop: deps.stop },
+    machineApi: { authorize: (subject) => { assertLocalOwner(subject); } },
+    modelApi: { authorize: (subject) => { assertLocalOwner(subject); } },
+    gateway: { config: readModelConfig },
+    terminalApi: { authorize: (subject) => { assertLocalOwner(subject); } },
+    identity: { owner: localOwner },
+    mode: localModeInfo,
+  };
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/local-owner.ts

@@ -0,0 +1,14 @@
+import { localOwner, setLocalOwner } from '../db/file-admin.js';
+import { log } from './log.js';
+
+export function applyLocalOwner(): string | null {
+  const wanted = process.env.METRO_OWNER?.trim() ?? '';
+  if (wanted !== '') {
+    const address = setLocalOwner(wanted);
+    log.info({ owner: address }, 'local daemon: owner set from METRO_OWNER');
+    return address;
+  }
+  const stored = localOwner();
+  if (stored === null) log.warn('local daemon: no owner set, so no wallet can sign in; restart with metro serve --owner <address>');
+  return stored;
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/log.ts

@@ -0,0 +1,42 @@
+import { writeSync } from 'node:fs';
+import pino from 'pino';
+import pinoPretty from 'pino-pretty';
+
+const stream = process.stderr.isTTY
+  ? pinoPretty({
+      colorize: true,
+      translateTime: 'HH:MM:ss',
+      ignore: 'pid,hostname,name',
+      destination: 2,
+    })
+  : pino.destination(2);
+
+export const log = pino(
+  { base: { name: 'metro' }, level: process.env.METRO_LOG_LEVEL ?? 'info' },
+  stream,
+);
+
+export const logFatalSync = (
+  fields: Record<string, unknown>,
+  msg: string,
+): void => {
+  const line = JSON.stringify({
+    level: 60,
+    time: Date.now(),
+    name: 'metro',
+    ...fields,
+    msg,
+  });
+  try {
+    writeSync(2, `${line}\n`);
+  } catch {
+    return;
+  }
+};
+
+export const errMsg = (err: unknown): string => {
+  if (err instanceof Error) return err.message;
+  if (err && typeof err === 'object' && 'message' in err)
+    return String(err.message);
+  return String(err);
+};

package/runtime/node_modules/@metro-labs/mcp/src/daemon/machine-api.ts

@@ -0,0 +1,61 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { hostname } from 'node:os';
+import { ApiError } from './api-error.js';
+import { apiFailure, apiSession, cors, sendJson } from './api-http.js';
+import { publicBaseUrl } from './attach-serve.js';
+import { claudeDir } from './claude-files.js';
+import { webhookPort } from './tunnel.js';
+import { METRO_VERSION } from './version.js';
+import { agentsDir } from '../db/file-source.js';
+import { localOwner } from '../db/file-admin.js';
+
+const PATH = '/api/server';
+
+export interface MachineApiDeps {
+  authorize: (subject: string) => void;
+  startedAt?: string;
+}
+
+const bootedAt = new Date(Date.now() - process.uptime() * 1000).toISOString();
+
+export function machineInfo(startedAt = bootedAt): Record<string, unknown> {
+  const store = process.env.METRO_RUNTIME_STORE?.trim() ?? '';
+  return {
+    version: METRO_VERSION,
+    owner: localOwner(),
+    hostname: hostname(),
+    platform: process.platform,
+    arch: process.arch,
+    port: webhookPort(),
+    publicUrl: publicBaseUrl(),
+    uptimeSeconds: Math.round(process.uptime()),
+    startedAt,
+    bun: process.versions.bun ?? null,
+    agentsDir: agentsDir(),
+    claudeDir: claudeDir(),
+    runtimeStore: store === '' ? null : store,
+  };
+}
+
+export function handleMachineRequest(req: IncomingMessage, res: ServerResponse, deps: MachineApiDeps): boolean {
+  const path = (req.url ?? '').split('?')[0] ?? '';
+  if (path !== PATH) return false;
+  if (req.method === 'OPTIONS') {
+    res.writeHead(204, cors(req)).end();
+    return true;
+  }
+  if (req.method !== 'GET') {
+    sendJson(req, res, 405, { error: 'method not allowed' });
+    return true;
+  }
+  apiSession(req)
+    .then((session) => {
+      if (!session) throw new ApiError('unauthorized', 401);
+      deps.authorize(session.subject);
+      sendJson(req, res, 200, machineInfo(deps.startedAt));
+    })
+    .catch((err: unknown) => {
+      apiFailure(req, res, err, 'machine-api');
+    });
+  return true;
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/mode-api.ts

@@ -0,0 +1,32 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { cors, sendJson } from './api-http.js';
+
+const PATH = '/api/mode';
+
+export type DaemonMode = 'hosted' | 'linked' | 'local';
+
+export interface ModeInfo {
+  mode: DaemonMode;
+  owner: string | null;
+  project: string | null;
+  version: string;
+}
+
+export function handleModeRequest(
+  req: IncomingMessage,
+  res: ServerResponse,
+  info: () => ModeInfo,
+): boolean {
+  const path = (req.url ?? '').split('?')[0] ?? '';
+  if (path !== PATH) return false;
+  if (req.method === 'OPTIONS') {
+    res.writeHead(204, cors(req)).end();
+    return true;
+  }
+  if (req.method !== 'GET') {
+    sendJson(req, res, 405, { error: 'method not allowed' });
+    return true;
+  }
+  sendJson(req, res, 200, info());
+  return true;
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/model-api.ts

@@ -0,0 +1,169 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { ApiError } from './api-error.js';
+import { apiFailure, apiSession, cors, readJsonBody, sendJson } from './api-http.js';
+import { isRecord } from './is-record.js';
+import { log } from './log.js';
+import { beginLogin, CodexAuthError, finishLogin, readCodexCliAuth } from '../gateway/codex-auth.js';
+import { beginDeviceLogin, pollDeviceLogin } from '../gateway/codex-device.js';
+import { codexModels, currentTokens, freshCodexState } from '../gateway/codex.js';
+import type { CodexTokens } from '../gateway/codex-auth.js';
+import { GatewayError } from '../gateway/forward.js';
+import {
+  applyModelUpdate,
+  ModelConfigError,
+  publicModelConfig,
+  readModelConfig,
+  setCodexAuth,
+  writeModelConfig,
+  type ModelConfig,
+} from '../gateway/model-config.js';
+
+const PATH = '/api/model';
+const CODEX = '/api/model/codex/';
+const BODY_MAX = 16 * 1024;
+const DEVICE_PREFIX = 'device/';
+const DEVICE_ID_RE = /^[A-Za-z0-9_-]{16,64}$/;
+
+export interface ModelApiDeps {
+  authorize: (subject: string) => void;
+  read?: () => ModelConfig;
+  write?: (cfg: ModelConfig) => void;
+  issuer?: string;
+  fetchImpl?: typeof fetch;
+  codexHome?: string;
+  codexBase?: string;
+}
+
+interface Store {
+  read: () => ModelConfig;
+  write: (cfg: ModelConfig) => void;
+}
+
+type Handler = (req: IncomingMessage, deps: ModelApiDeps, store: Store) => Promise<unknown>;
+
+interface Route {
+  method: 'GET' | 'POST';
+  run: Handler;
+}
+
+function asApiError(err: unknown): never {
+  if (err instanceof ModelConfigError || err instanceof CodexAuthError) throw new ApiError(err.message, 400);
+  if (err instanceof GatewayError) throw new ApiError(err.message, 502);
+  throw err;
+}
+
+async function update(req: IncomingMessage, store: Store): Promise<unknown> {
+  const patch = await readJsonBody(req, BODY_MAX);
+  let next: ModelConfig;
+  try {
+    next = applyModelUpdate(store.read(), patch);
+  } catch (err) {
+    asApiError(err);
+  }
+  store.write(next);
+  log.info({ provider: next.provider }, 'model-api: route updated');
+  return publicModelConfig(next);
+}
+
+function saveCodex(store: Store, cfg: ModelConfig, note: string): unknown {
+  store.write(cfg);
+  log.info({ signedIn: cfg.codex.auth !== null, plan: cfg.codex.auth?.plan ?? null }, note);
+  return publicModelConfig(cfg);
+}
+
+const modelApiState = freshCodexState();
+
+async function pollDevice(id: string, deps: ModelApiDeps, store: Store): Promise<unknown> {
+  const result = await pollDeviceLogin(id, deps.fetchImpl).catch(asApiError);
+  if (result.status !== 'done') return result;
+  return { status: 'done', settings: saveCodex(store, setCodexAuth(store.read(), result.tokens), 'model-api: Codex connected by device code') };
+}
+
+const CODEX_ROUTES: Record<string, Route> = {
+  device: {
+    method: 'POST',
+    run: async (_req, deps) => {
+      const login = await beginDeviceLogin(deps.issuer, deps.fetchImpl).catch(asApiError);
+      return { id: login.id, user_code: login.userCode, verify_url: login.verifyUrl, interval: login.interval };
+    },
+  },
+  login: {
+    method: 'POST',
+    run: (_req, deps) => Promise.resolve({ url: beginLogin(deps.issuer).url }),
+  },
+  callback: {
+    method: 'POST',
+    run: async (req, deps, store) => {
+      const body = await readJsonBody(req, BODY_MAX);
+      const raw = isRecord(body) && typeof body.url === 'string' ? body.url : '';
+      const tokens = await finishLogin(raw, deps.issuer, deps.fetchImpl).catch(asApiError);
+      return saveCodex(store, setCodexAuth(store.read(), tokens), 'model-api: Codex connected');
+    },
+  },
+  logout: {
+    method: 'POST',
+    run: (_req, _deps, store) => Promise.resolve(saveCodex(store, setCodexAuth(store.read(), null), 'model-api: Codex disconnected')),
+  },
+  import: {
+    method: 'POST',
+    run: (_req, deps, store) => {
+      let tokens;
+      try {
+        tokens = readCodexCliAuth(deps.codexHome);
+      } catch (err) {
+        asApiError(err);
+      }
+      return Promise.resolve(saveCodex(store, setCodexAuth(store.read(), tokens), 'model-api: Codex CLI login imported'));
+    },
+  },
+  models: {
+    method: 'GET',
+    run: async (_req, deps, store) => {
+      const cfg = store.read();
+      if (cfg.codex.auth === null) throw new ApiError('Codex is not connected: sign in with ChatGPT first', 400);
+      const codexDeps = { issuer: deps.issuer, fetchImpl: deps.fetchImpl, base: deps.codexBase, save: (t: CodexTokens) => { store.write(setCodexAuth(store.read(), t)); } };
+      const auth = await currentTokens(cfg, codexDeps, modelApiState).catch(asApiError);
+      const models = await codexModels(auth, codexDeps).catch(asApiError);
+      return { models };
+    },
+  },
+};
+
+function routeFor(path: string, method: string | undefined): Route | number {
+  if (path === PATH) {
+    if (method === 'GET') return { method: 'GET', run: (_req, _deps, store) => Promise.resolve(publicModelConfig(store.read())) };
+    if (method === 'PUT') return { method: 'POST', run: (req, _deps, store) => update(req, store) };
+    return 405;
+  }
+  const rest = path.slice(CODEX.length);
+  const route = CODEX_ROUTES[rest];
+  if (route !== undefined) return route.method === method ? route : 405;
+  const id = rest.startsWith(DEVICE_PREFIX) ? rest.slice(DEVICE_PREFIX.length) : '';
+  if (!DEVICE_ID_RE.test(id)) return 404;
+  return method === 'GET' ? { method: 'GET', run: (_req, deps, store) => pollDevice(id, deps, store) } : 405;
+}
+
+export function handleModelRequest(req: IncomingMessage, res: ServerResponse, deps: ModelApiDeps): boolean {
+  const path = (req.url ?? '').split('?')[0] ?? '';
+  if (path !== PATH && !path.startsWith(CODEX)) return false;
+  if (req.method === 'OPTIONS') {
+    res.writeHead(204, cors(req)).end();
+    return true;
+  }
+  const route = routeFor(path, req.method);
+  if (typeof route === 'number') {
+    sendJson(req, res, route, { error: route === 404 ? 'not found' : 'method not allowed' });
+    return true;
+  }
+  const store: Store = { read: deps.read ?? readModelConfig, write: deps.write ?? writeModelConfig };
+  apiSession(req)
+    .then(async (session) => {
+      if (!session) throw new ApiError('unauthorized', 401);
+      deps.authorize(session.subject);
+      sendJson(req, res, 200, await route.run(req, deps, store));
+    })
+    .catch((err: unknown) => {
+      apiFailure(req, res, err, 'model-api');
+    });
+  return true;
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/oauth-client.ts

@@ -0,0 +1,159 @@
+import { createHash, randomBytes } from 'node:crypto';
+import {
+  ConnectorVerifyError,
+  type OAuthTokens,
+} from './connector-verify.js';
+import type { OAuthServer } from './oauth-discovery.js';
+import { isRecord } from './is-record.js';
+
+const TOKEN_TIMEOUT_MS = 15_000;
+const CLIENT_NAME = 'Metro';
+
+export interface OAuthClient {
+  clientId: string;
+  clientSecret?: string;
+}
+
+function refused(message: string): ConnectorVerifyError {
+  return new ConnectorVerifyError(message, 400);
+}
+
+export function newVerifier(): string {
+  return randomBytes(32).toString('base64url');
+}
+
+export function challengeOf(verifier: string): string {
+  return createHash('sha256').update(verifier).digest('base64url');
+}
+
+export async function registerClient(
+  server: OAuthServer,
+  redirectUri: string,
+): Promise<OAuthClient> {
+  if (server.registrationEndpoint === null)
+    throw refused(
+      'That server requires OAuth but does not accept client registration, so Metro cannot sign in to it.',
+    );
+  let res: Response;
+  try {
+    res = await fetch(server.registrationEndpoint, {
+      method: 'POST',
+      redirect: 'manual',
+      signal: AbortSignal.timeout(TOKEN_TIMEOUT_MS),
+      headers: { 'content-type': 'application/json', accept: 'application/json' },
+      body: JSON.stringify({
+        client_name: CLIENT_NAME,
+        redirect_uris: [redirectUri],
+        grant_types: ['authorization_code', 'refresh_token'],
+        response_types: ['code'],
+        token_endpoint_auth_method: 'none',
+      }),
+    });
+  } catch {
+    throw refused('Metro could not reach that server to register.');
+  }
+  const body: unknown = await res.json().catch(() => null);
+  if (!res.ok || !isRecord(body) || typeof body.client_id !== 'string')
+    throw refused('That server refused to register Metro as a client.');
+  const secret = body.client_secret;
+  return {
+    clientId: body.client_id,
+    ...(typeof secret === 'string' ? { clientSecret: secret } : {}),
+  };
+}
+
+export interface AuthorizeInput {
+  server: OAuthServer;
+  client: OAuthClient;
+  redirectUri: string;
+  state: string;
+  verifier: string;
+  resource: string;
+}
+
+export function authorizeUrl(input: AuthorizeInput): string {
+  const url = new URL(input.server.authorizationEndpoint);
+  url.searchParams.set('response_type', 'code');
+  url.searchParams.set('client_id', input.client.clientId);
+  url.searchParams.set('redirect_uri', input.redirectUri);
+  url.searchParams.set('state', input.state);
+  url.searchParams.set('code_challenge', challengeOf(input.verifier));
+  url.searchParams.set('code_challenge_method', 'S256');
+  url.searchParams.set('resource', input.resource);
+  return url.toString();
+}
+
+function tokensFrom(body: Record<string, unknown>): OAuthTokens {
+  const access = body.access_token;
+  if (typeof access !== 'string' || access === '')
+    throw refused('That server did not return an access token.');
+  const refresh = body.refresh_token;
+  const expires = body.expires_in;
+  return {
+    accessToken: access,
+    ...(typeof refresh === 'string' ? { refreshToken: refresh } : {}),
+    ...(typeof expires === 'number'
+      ? { expiresAt: Date.now() + expires * 1000 }
+      : {}),
+  };
+}
+
+async function postToken(
+  server: OAuthServer,
+  client: OAuthClient,
+  form: Record<string, string>,
+): Promise<OAuthTokens> {
+  const params = new URLSearchParams({
+    ...form,
+    client_id: client.clientId,
+    ...(client.clientSecret === undefined
+      ? {}
+      : { client_secret: client.clientSecret }),
+  });
+  let res: Response;
+  try {
+    res = await fetch(server.tokenEndpoint, {
+      method: 'POST',
+      redirect: 'manual',
+      signal: AbortSignal.timeout(TOKEN_TIMEOUT_MS),
+      headers: {
+        'content-type': 'application/x-www-form-urlencoded',
+        accept: 'application/json',
+      },
+      body: params.toString(),
+    });
+  } catch {
+    throw refused('Metro could not reach that server to finish signing in.');
+  }
+  const body: unknown = await res.json().catch(() => null);
+  if (!res.ok || !isRecord(body))
+    throw refused('That server refused to complete the sign-in.');
+  return tokensFrom(body);
+}
+
+export function exchangeCode(
+  server: OAuthServer,
+  client: OAuthClient,
+  input: { code: string; redirectUri: string; verifier: string; resource: string },
+): Promise<OAuthTokens> {
+  return postToken(server, client, {
+    grant_type: 'authorization_code',
+    code: input.code,
+    redirect_uri: input.redirectUri,
+    code_verifier: input.verifier,
+    resource: input.resource,
+  });
+}
+
+export function refreshTokens(
+  server: OAuthServer,
+  client: OAuthClient,
+  refreshToken: string,
+  resource: string,
+): Promise<OAuthTokens> {
+  return postToken(server, client, {
+    grant_type: 'refresh_token',
+    refresh_token: refreshToken,
+    resource,
+  });
+}