@sunshinelife83/hearth 1.0.0

package/dist/local-agent-targets.js

@@ -0,0 +1,97 @@
+import { isLocalAgentProvider, } from "./local-agent-profiles.js";
+export function parseLocalAgentRunArgs(args) {
+    const parsed = parseAgentPromptArgs(args, 'Usage: hearth agents run <profile-or-provider> [--model <model>] [--effort <level>] "<prompt>"');
+    return parsed;
+}
+export function parseLocalAgentContinueArgs(args) {
+    const parsed = parseAgentPromptArgs(args, 'Usage: hearth agents continue <id> [--model <model>] [--effort <level>] "<prompt>"');
+    return { agentId: parsed.target, prompt: parsed.prompt, model: parsed.model, effort: parsed.effort };
+}
+function parseAgentPromptArgs(args, usage) {
+    const [target, ...rest] = args;
+    if (!target) {
+        throw new Error(usage);
+    }
+    let model;
+    let effort;
+    const promptParts = [];
+    let optionsEnded = false;
+    for (let index = 0; index < rest.length; index += 1) {
+        const part = rest[index];
+        if (!optionsEnded && part === "--") {
+            optionsEnded = true;
+            continue;
+        }
+        if (optionsEnded) {
+            promptParts.push(part ?? "");
+            continue;
+        }
+        if (part === "--model") {
+            const value = parseOptionValue(rest[index + 1], "--model");
+            model = value;
+            index += 1;
+            continue;
+        }
+        if (part?.startsWith("--model=")) {
+            const value = parseOptionValue(part.slice("--model=".length), "--model");
+            model = value;
+            continue;
+        }
+        if (part === "--effort") {
+            const value = parseOptionValue(rest[index + 1], "--effort");
+            effort = value;
+            index += 1;
+            continue;
+        }
+        if (part?.startsWith("--effort=")) {
+            const value = parseOptionValue(part.slice("--effort=".length), "--effort");
+            effort = value;
+            continue;
+        }
+        if (part?.startsWith("-")) {
+            throw unknownOptionError(part);
+        }
+        promptParts.push(part ?? "");
+    }
+    const prompt = promptParts.join(" ").trim();
+    if (!prompt) {
+        throw new Error(usage);
+    }
+    return { target, prompt, model, effort };
+}
+function parseOptionValue(value, option) {
+    const trimmed = value?.trim();
+    if (!trimmed)
+        throw new Error(`Missing value for ${option}.`);
+    if (trimmed.startsWith("-"))
+        throw unknownOptionError(trimmed);
+    return trimmed;
+}
+function unknownOptionError(option) {
+    return new Error(`Unknown option: ${option}. Use -- before prompt text that starts with a dash.`);
+}
+export function resolveLocalAgentTarget(target, profiles, modelOverride, effortOverride, providerConfigs = []) {
+    const profile = profiles.find((candidate) => candidate.name === target);
+    if (profile) {
+        const providerConfig = providerConfigs.find((entry) => entry.id === profile.provider);
+        return {
+            kind: "profile",
+            name: profile.name,
+            provider: profile.provider,
+            model: modelOverride ?? profile.model ?? providerConfig?.model,
+            effort: effortOverride ?? profile.effort ?? providerConfig?.effort,
+            profile,
+        };
+    }
+    if (isLocalAgentProvider(target)) {
+        const providerConfig = providerConfigs.find((entry) => entry.id === target);
+        return {
+            kind: "provider",
+            name: target,
+            provider: target,
+            model: modelOverride ?? providerConfig?.model,
+            effort: effortOverride ?? providerConfig?.effort,
+        };
+    }
+    return undefined;
+}

package/dist/logger.js

@@ -0,0 +1,97 @@
+const RECENT_LOG_CAP = 200;
+const recentLog = [];
+const RECENT_SCALAR_KEYS = new Set(["tool", "workspaceId", "status", "method", "path"]);
+const SENSITIVE_KEY_RE = /token|secret|password|credential|apikey|api_key|auth|cookie|session/i;
+function toRecentEntry(entry) {
+    if (typeof entry.event !== "string")
+        return undefined;
+    const out = { ts: entry.ts, level: entry.level, event: entry.event };
+    for (const key of RECENT_SCALAR_KEYS) {
+        if (SENSITIVE_KEY_RE.test(key))
+            continue;
+        const value = entry[key];
+        if (typeof value === "string" && !SENSITIVE_KEY_RE.test(value)) {
+            out[key] = value.slice(0, 200);
+        }
+    }
+    if (typeof entry.durationMs === "number" && Number.isFinite(entry.durationMs)) {
+        out.durationMs = Math.round(entry.durationMs);
+    }
+    return out;
+}
+export function recentLogEntries(limit = 100) {
+    const capped = Math.min(Math.max(1, Math.floor(limit)), RECENT_LOG_CAP);
+    return recentLog.slice(-capped);
+}
+const LEVEL_WEIGHT = {
+    silent: 0,
+    error: 1,
+    warn: 2,
+    info: 3,
+    debug: 4,
+};
+export function shouldLog(config, level) {
+    return LEVEL_WEIGHT[config.level] >= LEVEL_WEIGHT[level];
+}
+export function logEvent(config, level, event, fields = {}) {
+    if (!shouldLog(config, level))
+        return;
+    const entry = {
+        ts: new Date().toISOString(),
+        level,
+        event,
+        ...fields,
+    };
+    const recent = toRecentEntry(entry);
+    if (recent) {
+        recentLog.push(recent);
+        if (recentLog.length > RECENT_LOG_CAP)
+            recentLog.splice(0, recentLog.length - RECENT_LOG_CAP);
+    }
+    const line = config.format === "pretty" ? formatPretty(entry) : JSON.stringify(entry);
+    if (level === "error") {
+        console.error(line);
+    }
+    else if (level === "warn") {
+        console.warn(line);
+    }
+    else {
+        console.log(line);
+    }
+}
+export function requestIp(req, trustProxy) {
+    if (trustProxy) {
+        const cfConnectingIp = firstHeaderValue(req.header("cf-connecting-ip"));
+        if (cfConnectingIp)
+            return cfConnectingIp;
+        const forwardedFor = firstHeaderValue(req.header("x-forwarded-for"));
+        if (forwardedFor)
+            return forwardedFor;
+    }
+    return req.ip ?? req.socket.remoteAddress;
+}
+export function requestPath(req) {
+    return req.path || req.url.split("?")[0] || req.url;
+}
+export function commandPreview(command) {
+    const normalized = command.replace(/\s+/g, " ").trim();
+    return normalized.length > 120 ? `${normalized.slice(0, 117)}...` : normalized;
+}
+function firstHeaderValue(value) {
+    return value?.split(",")[0]?.trim() || undefined;
+}
+function formatPretty(entry) {
+    const ts = String(entry.ts);
+    const level = String(entry.level).toUpperCase();
+    const event = String(entry.event);
+    const rest = Object.entries(entry)
+        .filter(([key, value]) => !["ts", "level", "event"].includes(key) && value !== undefined)
+        .map(([key, value]) => `${key}=${formatPrettyValue(value)}`)
+        .join(" ");
+    return rest ? `${ts} ${level} ${event} ${rest}` : `${ts} ${level} ${event}`;
+}
+function formatPrettyValue(value) {
+    if (typeof value === "string")
+        return JSON.stringify(value);
+    return JSON.stringify(value);
+}

package/dist/machine-id.js

@@ -0,0 +1,35 @@
+import { randomBytes } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { hostname, platform, arch } from "node:os";
+import { join } from "node:path";
+export function loadMachineIdentity(stateDir) {
+    const path = join(stateDir, "machine.json");
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        if (typeof parsed.id === "string" && /^hearth-[0-9a-f]{12}$/.test(parsed.id)) {
+            return {
+                id: parsed.id,
+                hostname: hostname(),
+                platform: platform(),
+                arch: arch(),
+                createdAt: typeof parsed.createdAt === "string" ? parsed.createdAt : new Date(0).toISOString(),
+            };
+        }
+    }
+    catch {
+        // Missing or corrupt: mint a fresh identity below.
+    }
+    const identity = {
+        id: `hearth-${randomBytes(6).toString("hex")}`,
+        hostname: hostname(),
+        platform: platform(),
+        arch: arch(),
+        createdAt: new Date().toISOString(),
+    };
+    mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+    writeFileSync(path, JSON.stringify(identity, null, 2), { mode: 0o600 });
+    return identity;
+}
+export function machineFileExists(stateDir) {
+    return existsSync(join(stateDir, "machine.json"));
+}

package/dist/mcp-modern-server.js

@@ -0,0 +1,65 @@
+import { McpServer, } from "@modelcontextprotocol/server";
+export function createModernMcpServerAdapter(serverInfo, options) {
+    const server = new McpServer(serverInfo, options);
+    const registerModernTool = server.registerTool.bind(server);
+    const registerModernResource = server.registerResource.bind(server);
+    const registrationTarget = {
+        registerTool: ((name, definition, handler) => registerModernTool(name, definition, async (input, context) => handler(input, legacyToolHandlerExtra(context)))),
+        registerResource: ((...args) => {
+            const callback = args.at(-1);
+            return registerModernResource(...args.slice(0, -1), (...callbackArgs) => {
+                const context = callbackArgs.at(-1);
+                return callback(...callbackArgs.slice(0, -1), legacyToolHandlerExtra(context));
+            });
+        }),
+    };
+    return {
+        server,
+        registrationTarget,
+    };
+}
+export function compileMcpRegistrationSurface(registerSurface) {
+    const registrations = [];
+    const recordingTarget = {
+        registerTool: ((...args) => {
+            registrations.push((target) => {
+                target.registerTool(...args);
+            });
+        }),
+        registerResource: ((...args) => {
+            registrations.push((target) => {
+                target.registerResource(...args);
+            });
+        }),
+    };
+    registerSurface(recordingTarget);
+    const compiled = Object.freeze(registrations.slice());
+    return (target) => {
+        for (const replay of compiled)
+            replay(target);
+    };
+}
+export function modernMcpAdapterErrorLogFields(error) {
+    const cause = error.cause;
+    return {
+        error: error.message,
+        errorName: error.name,
+        ...(cause === undefined ? {} : {
+            cause: cause instanceof Error
+                ? { name: cause.name, message: cause.message }
+                : { name: typeof cause, message: String(cause) },
+        }),
+    };
+}
+function legacyToolHandlerExtra(context) {
+    return {
+        signal: context.mcpReq.signal,
+        authInfo: context.http?.authInfo,
+        sessionId: context.sessionId,
+        _meta: context.mcpReq._meta,
+        requestId: context.mcpReq.id,
+        requestInfo: context.http?.req,
+        sendNotification: context.mcpReq.notify,
+        sendRequest: context.mcpReq.send,
+    };
+}

package/dist/oauth-provider.js

@@ -0,0 +1,331 @@
+import { timingSafeEqual, randomBytes, randomUUID, createHash, createHmac } from "node:crypto";
+import { AccessDeniedError, InvalidGrantError, InvalidRequestError, InvalidTokenError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
+import { checkResourceAllowed, resourceUrlFromServerUrl } from "@modelcontextprotocol/sdk/shared/auth-utils.js";
+import { requestIp } from "./logger.js";
+import { DeviceTokenStore } from "./device-tokens.js";
+import { SqliteOAuthClientsStore, SqliteOAuthStore } from "./oauth-store.js";
+const CODE_TTL_MS = 5 * 60 * 1000;
+function randomToken() {
+    return randomBytes(32).toString("base64url");
+}
+function safeEquals(a, b) {
+    const left = Buffer.from(a);
+    const right = Buffer.from(b);
+    if (left.byteLength !== right.byteLength)
+        return false;
+    return timingSafeEqual(left, right);
+}
+function htmlEscape(value) {
+    return value
+        .replaceAll("&", "&")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;")
+        .replaceAll("'", "&#39;");
+}
+function formHtml(params) {
+    const scopeText = params.scopes.length > 0 ? params.scopes.join(" ") : "hearth";
+    const resourceText = params.resource?.href ?? "Hearth MCP endpoint";
+    const error = params.error
+        ? `<p class="error">${htmlEscape(params.error)}</p>`
+        : "";
+    const hiddenFields = Object.entries({ ...params.fields, csrf_token: params.csrfToken })
+        .filter((entry) => entry[1] !== undefined)
+        .map(([name, value]) => `        <input type="hidden" name="${htmlEscape(name)}" value="${htmlEscape(value)}" />`)
+        .join("\n");
+    return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Connect Hearth</title>
+    <style>
+      body { font-family: system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; margin: 0; background: #0f172a; color: #e2e8f0; }
+      main { max-width: 440px; margin: 12vh auto; padding: 32px; background: #111827; border: 1px solid #334155; border-radius: 18px; box-shadow: 0 24px 80px rgba(0,0,0,.35); }
+      h1 { margin: 0 0 12px; font-size: 28px; }
+      p { line-height: 1.5; color: #cbd5e1; }
+      dl { padding: 16px; background: #020617; border-radius: 12px; }
+      dt { color: #94a3b8; font-size: 12px; text-transform: uppercase; letter-spacing: .06em; }
+      dd { margin: 4px 0 12px; word-break: break-word; }
+      label { display: block; margin: 18px 0 8px; font-weight: 600; }
+      input { box-sizing: border-box; width: 100%; padding: 12px 14px; border-radius: 10px; border: 1px solid #475569; background: #020617; color: #e2e8f0; font-size: 16px; }
+      button { margin-top: 18px; width: 100%; border: 0; border-radius: 10px; padding: 12px 14px; font-weight: 700; color: #020617; background: #38bdf8; cursor: pointer; }
+      .error { color: #fecaca; background: #7f1d1d; border-radius: 10px; padding: 10px 12px; }
+      .warning { color: #fde68a; }
+    </style>
+  </head>
+  <body>
+    <main>
+      <h1>Connect Hearth</h1>
+      <p class="warning">Only approve this if you are intentionally connecting your own ChatGPT or MCP client to this local machine.</p>
+      ${error}
+      <dl>
+        <dt>Client</dt><dd>${htmlEscape(params.clientName)}</dd>
+        <dt>Scope</dt><dd>${htmlEscape(scopeText)}</dd>
+        <dt>Resource</dt><dd>${htmlEscape(resourceText)}</dd>
+      </dl>
+      <form method="post">
+${hiddenFields}
+        <label for="owner_token">Owner password</label>
+        <input id="owner_token" name="owner_token" type="password" autocomplete="current-password" autofocus required />
+        <button type="submit">Authorize Hearth</button>
+      </form>
+    </main>
+  </body>
+</html>`;
+}
+function requestedScopesAllowed(requested, supported) {
+    return requested.every((scope) => supported.includes(scope));
+}
+const CONSENT_FRAME_HEADERS = {
+    "X-Frame-Options": "DENY",
+    "Content-Security-Policy": "frame-ancestors 'none'",
+};
+function setConsentHeaders(res) {
+    for (const [name, value] of Object.entries(CONSENT_FRAME_HEADERS)) {
+        res.setHeader(name, value);
+    }
+}
+function consentCsrfToken(config, fields) {
+    const key = createHash("sha256").update(`hearth-consent:${config.ownerToken}`).digest();
+    const canonical = JSON.stringify([
+        "hearth-consent-v1",
+        fields.client_id ?? "",
+        fields.redirect_uri ?? "",
+        fields.code_challenge ?? "",
+        fields.scope ?? "",
+        fields.state ?? "",
+        fields.resource ?? "",
+    ]);
+    return createHmac("sha256", key).update(canonical).digest("base64url");
+}
+function consentCsrfValid(config, body) {
+    const provided = typeof body.csrf_token === "string" ? body.csrf_token : "";
+    if (!provided)
+        return false;
+    const expected = consentCsrfToken(config, {
+        client_id: asString(body.client_id),
+        redirect_uri: asString(body.redirect_uri),
+        code_challenge: asString(body.code_challenge),
+        scope: asString(body.scope),
+        state: asString(body.state),
+        resource: asString(body.resource),
+    });
+    return safeEquals(provided, expected);
+}
+function asString(value) {
+    return typeof value === "string" ? value : undefined;
+}
+export class SingleUserOAuthProvider {
+    config;
+    ownerTokenFailureLimiter;
+    clientsStore;
+    codes = new Map();
+    oauthStore;
+    resourceServerUrl;
+    deviceTokens;
+    constructor(config, resourceServerUrl, stateDir, ownerTokenFailureLimiter) {
+        this.config = config;
+        this.ownerTokenFailureLimiter = ownerTokenFailureLimiter;
+        this.resourceServerUrl = resourceUrlFromServerUrl(resourceServerUrl);
+        this.oauthStore = new SqliteOAuthStore(stateDir);
+        this.deviceTokens = new DeviceTokenStore(stateDir);
+        this.clientsStore = new SqliteOAuthClientsStore(this.oauthStore, config.allowedRedirectHosts);
+    }
+    async authorize(client, params, res) {
+        if (!params.resource || !checkResourceAllowed({ requestedResource: params.resource, configuredResource: this.resourceServerUrl })) {
+            throw new InvalidRequestError("Invalid or missing OAuth resource");
+        }
+        if (!requestedScopesAllowed(params.scopes ?? [], this.config.scopes)) {
+            throw new InvalidRequestError("Requested scope is not supported");
+        }
+        if (res.req.method !== "POST") {
+            const fields = authorizationFormFields(client, params);
+            setConsentHeaders(res);
+            res.status(200).setHeader("Content-Type", "text/html; charset=utf-8");
+            res.send(formHtml({
+                clientName: client.client_name ?? client.client_id,
+                scopes: params.scopes ?? this.config.scopes,
+                resource: params.resource,
+                fields,
+                csrfToken: consentCsrfToken(this.config, fields),
+            }));
+            return;
+        }
+        if (!consentCsrfValid(this.config, res.req.body)) {
+            setConsentHeaders(res);
+            res.status(400).setHeader("Content-Type", "text/html; charset=utf-8");
+            res.send(formHtml({
+                error: "This approval request is invalid or stale. Restart the connection from your MCP client.",
+                clientName: client.client_name ?? client.client_id,
+                scopes: params.scopes ?? this.config.scopes,
+                resource: params.resource,
+                fields: authorizationFormFields(client, params),
+                csrfToken: consentCsrfToken(this.config, authorizationFormFields(client, params)),
+            }));
+            return;
+        }
+        const providedToken = String(res.req.body?.owner_token ?? "");
+        const failureKey = requestIp(res.req, this.config.trustProxy) ?? "unknown";
+        if (!safeEquals(providedToken, this.config.ownerToken)) {
+            if (this.ownerTokenFailureLimiter) {
+                const verdict = this.ownerTokenFailureLimiter.take(failureKey);
+                if (!verdict.allowed) {
+                    setConsentHeaders(res);
+                    res.setHeader("Retry-After", String(verdict.retryAfterSeconds));
+                    res.status(429).setHeader("Content-Type", "text/html; charset=utf-8");
+                    res.send(formHtml({
+                        error: `Too many failed approval attempts. Try again in ${verdict.retryAfterSeconds} seconds.`,
+                        clientName: client.client_name ?? client.client_id,
+                        scopes: params.scopes ?? this.config.scopes,
+                        resource: params.resource,
+                        fields: authorizationFormFields(client, params),
+                        csrfToken: consentCsrfToken(this.config, authorizationFormFields(client, params)),
+                    }));
+                    return;
+                }
+            }
+            setConsentHeaders(res);
+            res.status(401).setHeader("Content-Type", "text/html; charset=utf-8");
+            res.send(formHtml({
+                error: "The Owner password was not accepted.",
+                clientName: client.client_name ?? client.client_id,
+                scopes: params.scopes ?? this.config.scopes,
+                resource: params.resource,
+                fields: authorizationFormFields(client, params),
+            }));
+            return;
+        }
+        this.ownerTokenFailureLimiter?.reset(failureKey);
+        const code = `code-${randomUUID()}`;
+        this.codes.set(code, {
+            clientId: client.client_id,
+            params,
+            expiresAtMs: Date.now() + CODE_TTL_MS,
+        });
+        const redirectUrl = new URL(params.redirectUri);
+        redirectUrl.searchParams.set("code", code);
+        if (params.state !== undefined)
+            redirectUrl.searchParams.set("state", params.state);
+        res.redirect(302, redirectUrl.href);
+    }
+    async challengeForAuthorizationCode(client, authorizationCode) {
+        const record = this.validCodeRecord(client, authorizationCode);
+        return record.params.codeChallenge;
+    }
+    async exchangeAuthorizationCode(client, authorizationCode, _codeVerifier, redirectUri, resource) {
+        const record = this.validCodeRecord(client, authorizationCode);
+        if (redirectUri && redirectUri !== record.params.redirectUri) {
+            throw new InvalidGrantError("redirect_uri does not match the authorization request");
+        }
+        if (resource && !checkResourceAllowed({ requestedResource: resource, configuredResource: this.resourceServerUrl })) {
+            throw new InvalidGrantError("Invalid resource");
+        }
+        this.codes.delete(authorizationCode);
+        return this.issueTokens(client.client_id, record.params.scopes ?? this.config.scopes, record.params.resource);
+    }
+    async exchangeRefreshToken(client, refreshToken, scopes, resource) {
+        const refreshTokenHash = hashToken(refreshToken);
+        const record = this.oauthStore.getRefreshToken(refreshTokenHash);
+        if (!record || record.clientId !== client.client_id || record.expiresAt < Math.floor(Date.now() / 1000)) {
+            throw new InvalidGrantError("Invalid refresh token");
+        }
+        if (resource && !checkResourceAllowed({ requestedResource: resource, configuredResource: this.resourceServerUrl })) {
+            throw new InvalidGrantError("Invalid resource");
+        }
+        const requestedScopes = scopes ?? record.scopes;
+        if (!requestedScopes.every((scope) => record.scopes.includes(scope))) {
+            throw new AccessDeniedError("Refresh token cannot grant requested scopes");
+        }
+        return this.issueTokens(client.client_id, requestedScopes, resource ?? (record.resource ? new URL(record.resource) : undefined), refreshTokenHash);
+    }
+    async verifyAccessToken(token) {
+        const record = this.oauthStore.getAccessToken(hashToken(token));
+        if (!record || record.expiresAt < Math.floor(Date.now() / 1000)) {
+            // Local device tokens (created via `hearth token create`) carry the
+            // same authority; they bind to this server's protected resource.
+            const device = this.deviceTokens.verify(token);
+            if (device) {
+                return {
+                    token,
+                    clientId: `device:${device.name}`,
+                    scopes: this.config.scopes,
+                    expiresAt: Math.floor(Date.now() / 1000) + 3600,
+                    resource: this.resourceServerUrl,
+                };
+            }
+            throw new InvalidTokenError("Invalid or expired access token");
+        }
+        return {
+            token,
+            clientId: record.clientId,
+            scopes: record.scopes,
+            expiresAt: record.expiresAt,
+            resource: record.resource ? new URL(record.resource) : undefined,
+        };
+    }
+    async revokeToken(_client, request) {
+        const hashed = hashToken(request.token);
+        this.oauthStore.deleteAccessToken(hashed);
+        this.oauthStore.deleteRefreshToken(hashed);
+    }
+    close() {
+        this.oauthStore.close();
+        this.deviceTokens.close();
+    }
+    validCodeRecord(client, authorizationCode) {
+        const record = this.codes.get(authorizationCode);
+        if (!record || record.clientId !== client.client_id || record.expiresAtMs < Date.now()) {
+            throw new InvalidGrantError("Invalid authorization code");
+        }
+        return record;
+    }
+    issueTokens(clientId, scopes, resource, consumedRefreshTokenHash) {
+        const now = Math.floor(Date.now() / 1000);
+        const accessToken = randomToken();
+        const refreshToken = randomToken();
+        const accessExpiresAt = now + this.config.accessTokenTtlSeconds;
+        const refreshExpiresAt = now + this.config.refreshTokenTtlSeconds;
+        const saved = this.oauthStore.saveTokenPair({
+            accessTokenHash: hashToken(accessToken),
+            accessToken: {
+                clientId,
+                scopes,
+                expiresAt: accessExpiresAt,
+                resource: resource?.href,
+            },
+            refreshTokenHash: hashToken(refreshToken),
+            refreshToken: {
+                clientId,
+                scopes,
+                expiresAt: refreshExpiresAt,
+                resource: resource?.href,
+            },
+        }, consumedRefreshTokenHash);
+        if (!saved) {
+            throw new InvalidGrantError("Invalid refresh token");
+        }
+        return {
+            access_token: accessToken,
+            token_type: "bearer",
+            expires_in: this.config.accessTokenTtlSeconds,
+            refresh_token: refreshToken,
+            scope: scopes.join(" "),
+        };
+    }
+}
+function authorizationFormFields(client, params) {
+    return {
+        response_type: "code",
+        client_id: client.client_id,
+        redirect_uri: params.redirectUri,
+        code_challenge: params.codeChallenge,
+        code_challenge_method: "S256",
+        scope: params.scopes?.join(" "),
+        state: params.state,
+        resource: params.resource?.href,
+    };
+}
+function hashToken(token) {
+    return createHash("sha256").update(token).digest("base64url");
+}