daemora 1.0.0-alpha.0

package/dist/integrations/keys.js

@@ -0,0 +1,174 @@
+/**
+ * Integration OAuth app credentials.
+ *
+ * Daemora ships with pre-registered OAuth apps for Twitter, Google
+ * (YouTube), and Meta (Facebook + Instagram) so non-technical users can
+ * click "Connect" without registering their own developer accounts. For
+ * PKCE providers (Twitter, Google) the "secret" isn't really a secret —
+ * the client_id is inherently public. For Meta we bundle a client
+ * secret that's XOR-obfuscated in source to resist casual grep'ing.
+ *
+ * Power users can override per-provider via vault keys:
+ *   TWITTER_CLIENT_ID
+ *   GOOGLE_CLIENT_ID   / GOOGLE_CLIENT_SECRET
+ *   META_APP_ID        / META_APP_SECRET
+ *
+ * When a vault key is set, it takes precedence over the bundled value.
+ * When the bundled value is empty AND the vault key is unset, the
+ * integration is disabled with a clear UI message.
+ */
+/**
+ * Vault key that stores a JSON array of additional OAuth scopes the user
+ * wants to request on top of the built-in default set for a given
+ * integration. Managed by the Integrations UI credentials modal.
+ */
+export function extraScopesVaultKey(integration) {
+    return `${integration.toUpperCase()}_EXTRA_SCOPES`;
+}
+/** Read (and JSON-parse) the user's extra scopes for an integration. Empty on any failure. */
+export function readExtraScopes(cfg, integration) {
+    if (!cfg.vault.isUnlocked())
+        return [];
+    const raw = cfg.vault.get(extraScopesVaultKey(integration))?.reveal();
+    if (!raw)
+        return [];
+    try {
+        const parsed = JSON.parse(raw);
+        if (!Array.isArray(parsed))
+            return [];
+        return parsed.filter((s) => typeof s === "string" && s.length > 0);
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Per-integration redirect-URI override. Stored verbatim (no JSON wrap)
+ * so a user can pin "https://my-tunnel.example.com/oauth/callback" and
+ * daemora will use that exact string regardless of where the UI is
+ * loaded — bypasses the `uiOrigin` derivation entirely. Useful for:
+ *
+ *   - TikTok / providers that reject http://localhost in non-sandbox
+ *   - Tunnel setups where the browser's URL bar disagrees with the
+ *     URL registered in the developer portal
+ *   - Self-hosted users running behind a reverse proxy
+ */
+export function redirectUriOverrideVaultKey(integration) {
+    return `${integration.toUpperCase()}_REDIRECT_URI`;
+}
+export function readRedirectUriOverride(cfg, integration) {
+    if (!cfg.vault.isUnlocked())
+        return null;
+    const raw = cfg.vault.get(redirectUriOverrideVaultKey(integration))?.reveal();
+    return raw && raw.length > 0 ? raw : null;
+}
+/**
+ * Bundled Daemora app credentials. Fill these in after registering the
+ * apps on each platform. Empty strings mean "not bundled" — users will
+ * then need to supply their own via vault keys before the integration
+ * works.
+ *
+ * XOR-obfuscation is applied at rest to the two values that are
+ * secret-adjacent (Google secret, Meta app secret) so grep/copy-paste
+ * doesn't leak them. The XOR key `XOR_KEY` is not meaningful security
+ * — it's purely to keep tokens from showing up in plain-text searches.
+ */
+// All bundled slots intentionally empty. Users supply their own OAuth
+// app credentials through the Integrations UI → credentials are persisted
+// in the vault under the keys listed in `resolveIntegrationKeys` below.
+// Shipping real client secrets in source would leak them to anyone
+// running Daemora, and (for confidential providers) would let any
+// Daemora install impersonate our OAuth app.
+const BUNDLED = {
+    twitter_client_id: "",
+    google_client_id: "",
+    google_client_secret: "",
+    meta_app_id: "",
+    meta_app_secret: "",
+    github_client_id: "",
+    github_client_secret: "",
+    notion_client_id: "",
+    notion_client_secret: "",
+    reddit_client_id: "",
+    reddit_client_secret: "",
+    linkedin_client_id: "",
+    linkedin_client_secret: "",
+    tiktok_client_key: "",
+    tiktok_client_secret: "",
+};
+/** Not security — just keeps cleartext secrets out of casual greps. */
+const XOR_KEY = "daemora-v1-obf";
+/**
+ * Encode a plaintext secret. No longer used at runtime — we bundle
+ * plain secrets directly now — but exported in case anyone wants to
+ * ship an obfuscated build artefact.
+ */
+export function obfuscate(plain) {
+    if (!plain)
+        return "";
+    const bytes = Buffer.from(plain, "utf-8");
+    const out = Buffer.alloc(bytes.length);
+    for (let i = 0; i < bytes.length; i++) {
+        out[i] = bytes[i] ^ XOR_KEY.charCodeAt(i % XOR_KEY.length);
+    }
+    return out.toString("base64");
+}
+/**
+ * Resolve the OAuth app creds Daemora should use for each provider,
+ * preferring user-supplied vault overrides. Called at startup AND
+ * again whenever a vault change fires — don't cache the result across
+ * calls for longer than the current request.
+ */
+export function resolveIntegrationKeys(cfg) {
+    const vault = cfg.vault;
+    const readVault = (k) => vault.isUnlocked() ? vault.get(k)?.reveal() : undefined;
+    const twitterClientId = readVault("TWITTER_CLIENT_ID") ?? BUNDLED.twitter_client_id;
+    const twitterClientSecret = readVault("TWITTER_CLIENT_SECRET");
+    const googleClientId = readVault("GOOGLE_CLIENT_ID") ?? BUNDLED.google_client_id;
+    const googleSecret = readVault("GOOGLE_CLIENT_SECRET") ?? BUNDLED.google_client_secret;
+    const metaAppId = readVault("META_APP_ID") ?? BUNDLED.meta_app_id;
+    const metaSecret = readVault("META_APP_SECRET") ?? BUNDLED.meta_app_secret;
+    const githubClientId = readVault("GITHUB_CLIENT_ID") ?? BUNDLED.github_client_id;
+    const githubSecret = readVault("GITHUB_CLIENT_SECRET") ?? BUNDLED.github_client_secret;
+    const notionClientId = readVault("NOTION_CLIENT_ID") ?? BUNDLED.notion_client_id;
+    const notionSecret = readVault("NOTION_CLIENT_SECRET") ?? BUNDLED.notion_client_secret;
+    const redditClientId = readVault("REDDIT_CLIENT_ID") ?? BUNDLED.reddit_client_id;
+    const redditSecret = readVault("REDDIT_CLIENT_SECRET") ?? BUNDLED.reddit_client_secret;
+    const linkedinClientId = readVault("LINKEDIN_CLIENT_ID") ?? BUNDLED.linkedin_client_id;
+    const linkedinSecret = readVault("LINKEDIN_CLIENT_SECRET") ?? BUNDLED.linkedin_client_secret;
+    const tiktokClientKey = readVault("TIKTOK_CLIENT_KEY") ?? BUNDLED.tiktok_client_key;
+    const tiktokSecret = readVault("TIKTOK_CLIENT_SECRET") ?? BUNDLED.tiktok_client_secret;
+    return {
+        twitter: twitterClientId
+            ? {
+                clientId: twitterClientId,
+                // Confidential client mode — only supplied when the X app type
+                // is "Confidential" in the developer portal. Public clients
+                // leave this undefined and skip Basic auth on token exchange.
+                ...(twitterClientSecret ? { clientSecret: twitterClientSecret } : {}),
+            }
+            : null,
+        google: googleClientId && googleSecret
+            ? { clientId: googleClientId, clientSecret: googleSecret }
+            : null,
+        meta: metaAppId && metaSecret
+            ? { appId: metaAppId, appSecret: metaSecret }
+            : null,
+        github: githubClientId && githubSecret
+            ? { clientId: githubClientId, clientSecret: githubSecret }
+            : null,
+        notion: notionClientId && notionSecret
+            ? { clientId: notionClientId, clientSecret: notionSecret }
+            : null,
+        reddit: redditClientId && redditSecret
+            ? { clientId: redditClientId, clientSecret: redditSecret }
+            : null,
+        linkedin: linkedinClientId && linkedinSecret
+            ? { clientId: linkedinClientId, clientSecret: linkedinSecret }
+            : null,
+        tiktok: tiktokClientKey && tiktokSecret
+            ? { clientKey: tiktokClientKey, clientSecret: tiktokSecret }
+            : null,
+    };
+}
+//# sourceMappingURL=keys.js.map

package/dist/integrations/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/integrations/keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAA0B;IAC5D,OAAO,GAAG,WAAW,CAAC,WAAW,EAAE,eAAe,CAAC;AACrD,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,eAAe,CAAC,GAAkB,EAAE,WAA0B;IAC5E,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;IACtE,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B,CAAC,WAA0B;IACpE,OAAO,GAAG,WAAW,CAAC,WAAW,EAAE,eAAe,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,GAAkB,EAAE,WAA0B;IACpF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,2BAA2B,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9E,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;GAUG;AACH,sEAAsE;AACtE,0EAA0E;AAC1E,wEAAwE;AACxE,mEAAmE;AACnE,kEAAkE;AAClE,6CAA6C;AAC7C,MAAM,OAAO,GAAG;IACd,iBAAiB,EAAE,EAAE;IACrB,gBAAgB,EAAE,EAAE;IACpB,oBAAoB,EAAE,EAAE;IACxB,WAAW,EAAE,EAAE;IACf,eAAe,EAAE,EAAE;IACnB,gBAAgB,EAAE,EAAE;IACpB,oBAAoB,EAAE,EAAE;IACxB,gBAAgB,EAAE,EAAE;IACpB,oBAAoB,EAAE,EAAE;IACxB,gBAAgB,EAAE,EAAE;IACpB,oBAAoB,EAAE,EAAE;IACxB,kBAAkB,EAAE,EAAE;IACtB,sBAAsB,EAAE,EAAE;IAC1B,iBAAiB,EAAE,EAAE;IACrB,oBAAoB,EAAE,EAAE;CAChB,CAAC;AAEX,uEAAuE;AACvE,MAAM,OAAO,GAAG,gBAAgB,CAAC;AAEjC;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAkB;IACvD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACxB,MAAM,SAAS,GAAG,CAAC,CAAS,EAAsB,EAAE,CAClD,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAE1D,MAAM,eAAe,GAAG,SAAS,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAC,iBAAiB,CAAC;IACpF,MAAM,mBAAmB,GAAG,SAAS,CAAC,uBAAuB,CAAC,CAAC;IAC/D,MAAM,cAAc,GAAG,SAAS,CAAC,kBAAkB,CAAC,IAAI,OAAO,CAAC,gBAAgB,CAAC;IACjF,MAAM,YAAY,GAAG,SAAS,CAAC,sBAAsB,CAAC,IAAI,OAAO,CAAC,oBAAoB,CAAC;IACvF,MAAM,SAAS,GAAG,SAAS,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,WAAW,CAAC;IAClE,MAAM,UAAU,GAAG,SAAS,CAAC,iBAAiB,CAAC,IAAI,OAAO,CAAC,eAAe,CAAC;IAC3E,MAAM,cAAc,GAAG,SAAS,CAAC,kBAAkB,CAAC,IAAI,OAAO,CAAC,gBAAgB,CAAC;IACjF,MAAM,YAAY,GAAG,SAAS,CAAC,sBAAsB,CAAC,IAAI,OAAO,CAAC,oBAAoB,CAAC;IACvF,MAAM,cAAc,GAAG,SAAS,CAAC,kBAAkB,CAAC,IAAI,OAAO,CAAC,gBAAgB,CAAC;IACjF,MAAM,YAAY,GAAG,SAAS,CAAC,sBAAsB,CAAC,IAAI,OAAO,CAAC,oBAAoB,CAAC;IACvF,MAAM,cAAc,GAAG,SAAS,CAAC,kBAAkB,CAAC,IAAI,OAAO,CAAC,gBAAgB,CAAC;IACjF,MAAM,YAAY,GAAG,SAAS,CAAC,sBAAsB,CAAC,IAAI,OAAO,CAAC,oBAAoB,CAAC;IACvF,MAAM,gBAAgB,GAAG,SAAS,CAAC,oBAAoB,CAAC,IAAI,OAAO,CAAC,kBAAkB,CAAC;IACvF,MAAM,cAAc,GAAG,SAAS,CAAC,wBAAwB,CAAC,IAAI,OAAO,CAAC,sBAAsB,CAAC;IAC7F,MAAM,eAAe,GAAG,SAAS,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAC,iBAAiB,CAAC;IACpF,MAAM,YAAY,GAAG,SAAS,CAAC,sBAAsB,CAAC,IAAI,OAAO,CAAC,oBAAoB,CAAC;IAEvF,OAAO;QACL,OAAO,EAAE,eAAe;YACtB,CAAC,CAAC;gBACE,QAAQ,EAAE,eAAe;gBACzB,+DAA+D;gBAC/D,4DAA4D;gBAC5D,8DAA8D;gBAC9D,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtE;YACH,CAAC,CAAC,IAAI;QACR,MAAM,EAAE,cAAc,IAAI,YAAY;YACpC,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE;YAC1D,CAAC,CAAC,IAAI;QACR,IAAI,EAAE,SAAS,IAAI,UAAU;YAC3B,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE;YAC7C,CAAC,CAAC,IAAI;QACR,MAAM,EAAE,cAAc,IAAI,YAAY;YACpC,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE;YAC1D,CAAC,CAAC,IAAI;QACR,MAAM,EAAE,cAAc,IAAI,YAAY;YACpC,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE;YAC1D,CAAC,CAAC,IAAI;QACR,MAAM,EAAE,cAAc,IAAI,YAAY;YACpC,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE;YAC1D,CAAC,CAAC,IAAI;QACR,QAAQ,EAAE,gBAAgB,IAAI,cAAc;YAC1C,CAAC,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,EAAE,cAAc,EAAE;YAC9D,CAAC,CAAC,IAAI;QACR,MAAM,EAAE,eAAe,IAAI,YAAY;YACrC,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,EAAE;YAC5D,CAAC,CAAC,IAAI;KACT,CAAC;AACJ,CAAC"}

package/dist/integrations/linkedin/LinkedInClient.d.ts

@@ -0,0 +1,24 @@
+/**
+ * LinkedInClient — thin wrapper over LinkedIn's REST API v2.
+ *
+ * Scopes we request by default only unlock member-level endpoints:
+ *   /v2/userinfo            identity
+ *   /v2/ugcPosts            post to own feed (w_member_social)
+ *   /v2/socialActions/...   comment & like on your own posts
+ *
+ * Org / company-page endpoints need Marketing Developer Platform
+ * partnership — we don't expose those tools here.
+ *
+ * LinkedIn requires `X-Restli-Protocol-Version: 2.0.0` on most write
+ * endpoints; we send it on every request to keep the surface uniform.
+ */
+import type { IntegrationManager } from "../IntegrationManager.js";
+export declare class LinkedInClient {
+    private readonly integrations;
+    constructor(integrations: IntegrationManager);
+    request<T>(path: string, init?: RequestInit): Promise<T>;
+    /** Resolve the authenticated user's `urn:li:person:<sub>` URN. Cached per process. */
+    personUrn(): Promise<string>;
+    private urnCache?;
+}
+//# sourceMappingURL=LinkedInClient.d.ts.map

package/dist/integrations/linkedin/LinkedInClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LinkedInClient.d.ts","sourceRoot":"","sources":["../../../src/integrations/linkedin/LinkedInClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAInE,qBAAa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,YAAY;gBAAZ,YAAY,EAAE,kBAAkB;IAEvD,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,CAAC,CAAC;IA0BlE,sFAAsF;IAChF,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC;IAOlC,OAAO,CAAC,QAAQ,CAAC,CAAS;CAC3B"}

package/dist/integrations/linkedin/LinkedInClient.js

@@ -0,0 +1,56 @@
+/**
+ * LinkedInClient — thin wrapper over LinkedIn's REST API v2.
+ *
+ * Scopes we request by default only unlock member-level endpoints:
+ *   /v2/userinfo            identity
+ *   /v2/ugcPosts            post to own feed (w_member_social)
+ *   /v2/socialActions/...   comment & like on your own posts
+ *
+ * Org / company-page endpoints need Marketing Developer Platform
+ * partnership — we don't expose those tools here.
+ *
+ * LinkedIn requires `X-Restli-Protocol-Version: 2.0.0` on most write
+ * endpoints; we send it on every request to keep the surface uniform.
+ */
+import { ProviderError } from "../../util/errors.js";
+import { authFetch } from "../authFetch.js";
+const API = "https://api.linkedin.com";
+export class LinkedInClient {
+    integrations;
+    constructor(integrations) {
+        this.integrations = integrations;
+    }
+    async request(path, init = {}) {
+        const resp = await authFetch(this.integrations, "linkedin", (token) => fetch(`${API}${path}`, {
+            ...init,
+            headers: {
+                Authorization: `Bearer ${token}`,
+                "X-Restli-Protocol-Version": "2.0.0",
+                ...(init.body && !init.headers ? { "Content-Type": "application/json" } : {}),
+                ...(init.headers ?? {}),
+            },
+        }));
+        if (!resp.ok) {
+            const body = await resp.text().catch(() => "");
+            if (resp.status === 401) {
+                throw new ProviderError(`LinkedIn auth failed after refresh (${resp.status}). Reconnect in Settings → Integrations. ${body.slice(0, 200)}`, "linkedin");
+            }
+            throw new ProviderError(`LinkedIn ${resp.status} ${path}: ${body.slice(0, 300)}`, "linkedin");
+        }
+        if (resp.status === 204)
+            return {};
+        return (await resp.json());
+    }
+    /** Resolve the authenticated user's `urn:li:person:<sub>` URN. Cached per process. */
+    async personUrn() {
+        if (this.urnCache)
+            return this.urnCache;
+        const info = await this.request("/v2/userinfo");
+        if (!info.sub)
+            throw new ProviderError("Could not resolve LinkedIn person URN", "linkedin");
+        this.urnCache = `urn:li:person:${info.sub}`;
+        return this.urnCache;
+    }
+    urnCache;
+}
+//# sourceMappingURL=LinkedInClient.js.map

package/dist/integrations/linkedin/LinkedInClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LinkedInClient.js","sourceRoot":"","sources":["../../../src/integrations/linkedin/LinkedInClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAG5C,MAAM,GAAG,GAAG,0BAA0B,CAAC;AAEvC,MAAM,OAAO,cAAc;IACI;IAA7B,YAA6B,YAAgC;QAAhC,iBAAY,GAAZ,YAAY,CAAoB;IAAG,CAAC;IAEjE,KAAK,CAAC,OAAO,CAAI,IAAY,EAAE,OAAoB,EAAE;QACnD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CACpE,KAAK,CAAC,GAAG,GAAG,GAAG,IAAI,EAAE,EAAE;YACrB,GAAG,IAAI;YACP,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,2BAA2B,EAAE,OAAO;gBACpC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7E,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;aACxB;SACF,CAAC,CACH,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxB,MAAM,IAAI,aAAa,CACrB,uCAAuC,IAAI,CAAC,MAAM,4CAA4C,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAClH,UAAU,CACX,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,aAAa,CAAC,YAAY,IAAI,CAAC,MAAM,IAAI,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAO,CAAC;QACxC,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAM,CAAC;IAClC,CAAC;IAED,sFAAsF;IACtF,KAAK,CAAC,SAAS;QACb,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAmB,cAAc,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,aAAa,CAAC,uCAAuC,EAAE,UAAU,CAAC,CAAC;QAC5F,IAAI,CAAC,QAAQ,GAAG,iBAAiB,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IACO,QAAQ,CAAU;CAC3B"}

package/dist/integrations/linkedin/tools.d.ts

@@ -0,0 +1,14 @@
+/**
+ * LinkedIn tools exposed to the `linkedin-crew`.
+ *
+ * Scope: personal-feed write + read. Company-page / Marketing-Platform
+ * endpoints are not included because they require Partner status.
+ *
+ * Coverage:
+ *   userinfo, text share, article share, delete share, read share,
+ *   like, unlike, comment on share.
+ */
+import type { ToolDef } from "../../tools/types.js";
+import type { IntegrationManager } from "../IntegrationManager.js";
+export declare function makeLinkedInTools(integrations: IntegrationManager): readonly ToolDef[];
+//# sourceMappingURL=tools.d.ts.map

package/dist/integrations/linkedin/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../../src/integrations/linkedin/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAGnE,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,kBAAkB,GAAG,SAAS,OAAO,EAAE,CAgKtF"}

package/dist/integrations/linkedin/tools.js

@@ -0,0 +1,154 @@
+/**
+ * LinkedIn tools exposed to the `linkedin-crew`.
+ *
+ * Scope: personal-feed write + read. Company-page / Marketing-Platform
+ * endpoints are not included because they require Partner status.
+ *
+ * Coverage:
+ *   userinfo, text share, article share, delete share, read share,
+ *   like, unlike, comment on share.
+ */
+import { z } from "zod";
+import { LinkedInClient } from "./LinkedInClient.js";
+export function makeLinkedInTools(integrations) {
+    const client = new LinkedInClient(integrations);
+    const me = {
+        name: "linkedin_me",
+        description: "Return the authenticated user's profile (name, email, sub/urn).",
+        category: "channel",
+        source: { kind: "core" },
+        tags: ["linkedin", "user"],
+        inputSchema: z.object({}),
+        async execute() {
+            return client.request("/v2/userinfo");
+        },
+    };
+    const shareText = {
+        name: "linkedin_share_text",
+        description: "Publish a text-only post to the authenticated user's feed.",
+        category: "channel",
+        source: { kind: "core" },
+        tags: ["linkedin", "post"],
+        inputSchema: z.object({
+            text: z.string().min(1).max(3000),
+            visibility: z.enum(["PUBLIC", "CONNECTIONS"]).optional(),
+        }),
+        async execute({ text, visibility }) {
+            const author = await client.personUrn();
+            return client.request("/v2/ugcPosts", {
+                method: "POST",
+                body: JSON.stringify({
+                    author,
+                    lifecycleState: "PUBLISHED",
+                    specificContent: {
+                        "com.linkedin.ugc.ShareContent": {
+                            shareCommentary: { text },
+                            shareMediaCategory: "NONE",
+                        },
+                    },
+                    visibility: {
+                        "com.linkedin.ugc.MemberNetworkVisibility": visibility ?? "PUBLIC",
+                    },
+                }),
+            });
+        },
+    };
+    const shareArticle = {
+        name: "linkedin_share_article",
+        description: "Publish a post that links to an article / external URL with optional title & description.",
+        category: "channel",
+        source: { kind: "core" },
+        tags: ["linkedin", "post", "article"],
+        inputSchema: z.object({
+            text: z.string().min(1).max(3000),
+            articleUrl: z.string().url(),
+            title: z.string().optional(),
+            description: z.string().optional(),
+            visibility: z.enum(["PUBLIC", "CONNECTIONS"]).optional(),
+        }),
+        async execute({ text, articleUrl, title, description, visibility }) {
+            const author = await client.personUrn();
+            return client.request("/v2/ugcPosts", {
+                method: "POST",
+                body: JSON.stringify({
+                    author,
+                    lifecycleState: "PUBLISHED",
+                    specificContent: {
+                        "com.linkedin.ugc.ShareContent": {
+                            shareCommentary: { text },
+                            shareMediaCategory: "ARTICLE",
+                            media: [{
+                                    status: "READY",
+                                    originalUrl: articleUrl,
+                                    ...(title ? { title: { text: title } } : {}),
+                                    ...(description ? { description: { text: description } } : {}),
+                                }],
+                        },
+                    },
+                    visibility: {
+                        "com.linkedin.ugc.MemberNetworkVisibility": visibility ?? "PUBLIC",
+                    },
+                }),
+            });
+        },
+    };
+    const deleteShare = {
+        name: "linkedin_delete_share",
+        description: "Delete a post you authored. `shareUrn` is the full URN (e.g. urn:li:share:1234).",
+        category: "channel",
+        source: { kind: "core" },
+        tags: ["linkedin", "delete"],
+        inputSchema: z.object({ shareUrn: z.string().min(1) }),
+        async execute({ shareUrn }) {
+            return client.request(`/v2/ugcPosts/${encodeURIComponent(shareUrn)}`, { method: "DELETE" });
+        },
+    };
+    const getShare = {
+        name: "linkedin_get_share",
+        description: "Fetch a UGC post by its URN.",
+        category: "channel",
+        source: { kind: "core" },
+        tags: ["linkedin", "read"],
+        inputSchema: z.object({ shareUrn: z.string().min(1) }),
+        async execute({ shareUrn }) {
+            return client.request(`/v2/ugcPosts/${encodeURIComponent(shareUrn)}`);
+        },
+    };
+    const commentOnShare = {
+        name: "linkedin_comment",
+        description: "Comment on a UGC post (your own or a colleague's) by its URN.",
+        category: "channel",
+        source: { kind: "core" },
+        tags: ["linkedin", "comment"],
+        inputSchema: z.object({
+            shareUrn: z.string().min(1),
+            text: z.string().min(1).max(1250),
+        }),
+        async execute({ shareUrn, text }) {
+            const actor = await client.personUrn();
+            return client.request(`/v2/socialActions/${encodeURIComponent(shareUrn)}/comments`, {
+                method: "POST",
+                body: JSON.stringify({ actor, message: { text } }),
+            });
+        },
+    };
+    const likeShare = {
+        name: "linkedin_like",
+        description: "Like a UGC post.",
+        category: "channel",
+        source: { kind: "core" },
+        tags: ["linkedin", "like"],
+        inputSchema: z.object({ shareUrn: z.string().min(1) }),
+        async execute({ shareUrn }) {
+            const actor = await client.personUrn();
+            return client.request(`/v2/socialActions/${encodeURIComponent(shareUrn)}/likes`, {
+                method: "POST",
+                body: JSON.stringify({ actor, object: shareUrn }),
+            });
+        },
+    };
+    return [
+        me, shareText, shareArticle, deleteShare, getShare, commentOnShare, likeShare,
+    ];
+}
+//# sourceMappingURL=tools.js.map

package/dist/integrations/linkedin/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../../src/integrations/linkedin/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,MAAM,UAAU,iBAAiB,CAAC,YAAgC;IAChE,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,YAAY,CAAC,CAAC;IAEhD,MAAM,EAAE,GAAyD;QAC/D,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,iEAAiE;QAC9E,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACxB,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,OAAO;YACX,OAAO,MAAM,CAAC,OAAO,CAAU,cAAc,CAAC,CAAC;QACjD,CAAC;KACF,CAAC;IAEF,MAAM,SAAS,GAGA;QACb,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EAAE,4DAA4D;QACzE,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACxB,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;YACjC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE;SACzD,CAAC;QACF,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE;YAChC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;YACxC,OAAO,MAAM,CAAC,OAAO,CAAU,cAAc,EAAE;gBAC7C,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,MAAM;oBACN,cAAc,EAAE,WAAW;oBAC3B,eAAe,EAAE;wBACf,+BAA+B,EAAE;4BAC/B,eAAe,EAAE,EAAE,IAAI,EAAE;4BACzB,kBAAkB,EAAE,MAAM;yBAC3B;qBACF;oBACD,UAAU,EAAE;wBACV,0CAA0C,EAAE,UAAU,IAAI,QAAQ;qBACnE;iBACF,CAAC;aACH,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IAEF,MAAM,YAAY,GAMH;QACb,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EAAE,2FAA2F;QACxG,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACxB,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC;QACrC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;YACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;YAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAClC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE;SACzD,CAAC;QACF,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE;YAChE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;YACxC,OAAO,MAAM,CAAC,OAAO,CAAU,cAAc,EAAE;gBAC7C,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,MAAM;oBACN,cAAc,EAAE,WAAW;oBAC3B,eAAe,EAAE;wBACf,+BAA+B,EAAE;4BAC/B,eAAe,EAAE,EAAE,IAAI,EAAE;4BACzB,kBAAkB,EAAE,SAAS;4BAC7B,KAAK,EAAE,CAAC;oCACN,MAAM,EAAE,OAAO;oCACf,WAAW,EAAE,UAAU;oCACvB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oCAC5C,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iCAC/D,CAAC;yBACH;qBACF;oBACD,UAAU,EAAE;wBACV,0CAA0C,EAAE,UAAU,IAAI,QAAQ;qBACnE;iBACF,CAAC;aACH,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IAEF,MAAM,WAAW,GAA6D;QAC5E,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EAAE,kFAAkF;QAC/F,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACxB,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC;QAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE;YACxB,OAAO,MAAM,CAAC,OAAO,CAAU,gBAAgB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvG,CAAC;KACF,CAAC;IAEF,MAAM,QAAQ,GAA6D;QACzE,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EAAE,8BAA8B;QAC3C,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACxB,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE;YACxB,OAAO,MAAM,CAAC,OAAO,CAAU,gBAAgB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACjF,CAAC;KACF,CAAC;IAEF,MAAM,cAAc,GAGL;QACb,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,+DAA+D;QAC5E,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACxB,IAAI,EAAE,CAAC,UAAU,EAAE,SAAS,CAAC;QAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;SAClC,CAAC;QACF,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC9B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;YACvC,OAAO,MAAM,CAAC,OAAO,CAAU,qBAAqB,kBAAkB,CAAC,QAAQ,CAAC,WAAW,EAAE;gBAC3F,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IAEF,MAAM,SAAS,GAA6D;QAC1E,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,kBAAkB;QAC/B,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACxB,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE;YACxB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;YACvC,OAAO,MAAM,CAAC,OAAO,CAAU,qBAAqB,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,EAAE;gBACxF,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;aAClD,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IAEF,OAAO;QACL,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS;KAC7C,CAAC;AACrC,CAAC"}

package/dist/integrations/pkce.d.ts

@@ -0,0 +1,17 @@
+/**
+ * PKCE helpers for OAuth 2.0 — RFC 7636.
+ *
+ * Twitter and Google require PKCE. Meta does not. We generate a
+ * cryptographically random code_verifier, derive code_challenge via
+ * SHA-256, and hand both back so the caller can stash the verifier
+ * (session-side) and send the challenge to the authorize endpoint.
+ */
+export interface PKCEPair {
+    readonly verifier: string;
+    readonly challenge: string;
+    readonly method: "S256";
+}
+export declare function generatePKCE(): PKCEPair;
+/** Cryptographically random state/nonce — URL-safe. */
+export declare function generateState(): string;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/integrations/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/integrations/pkce.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,YAAY,IAAI,QAAQ,CAIvC;AAED,uDAAuD;AACvD,wBAAgB,aAAa,IAAI,MAAM,CAEtC"}

package/dist/integrations/pkce.js

@@ -0,0 +1,22 @@
+/**
+ * PKCE helpers for OAuth 2.0 — RFC 7636.
+ *
+ * Twitter and Google require PKCE. Meta does not. We generate a
+ * cryptographically random code_verifier, derive code_challenge via
+ * SHA-256, and hand both back so the caller can stash the verifier
+ * (session-side) and send the challenge to the authorize endpoint.
+ */
+import { randomBytes, createHash } from "node:crypto";
+export function generatePKCE() {
+    const verifier = base64url(randomBytes(32));
+    const challenge = base64url(createHash("sha256").update(verifier).digest());
+    return { verifier, challenge, method: "S256" };
+}
+/** Cryptographically random state/nonce — URL-safe. */
+export function generateState() {
+    return base64url(randomBytes(24));
+}
+function base64url(buf) {
+    return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+//# sourceMappingURL=pkce.js.map

package/dist/integrations/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/integrations/pkce.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAQtD,MAAM,UAAU,YAAY;IAC1B,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACjD,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,aAAa;IAC3B,OAAO,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3F,CAAC"}

package/dist/integrations/providers/github.d.ts

@@ -0,0 +1,20 @@
+/**
+ * GitHub OAuth 2.0 Provider.
+ *
+ * Endpoints (GitHub OAuth App / GitHub App user-to-server):
+ *   authorize: https://github.com/login/oauth/authorize
+ *   token:     https://github.com/login/oauth/access_token
+ *
+ * GitHub's classic OAuth Apps issue long-lived tokens with no
+ * `expires_in`. GitHub Apps (recommended) issue 8-hour user tokens
+ * with a refresh_token. We handle both: if the token response includes
+ * `expires_in` we record the expiry; otherwise `expiresAt=0` (no
+ * declared expiry) and the background refresher skips it.
+ *
+ * Scopes are passed as a space-separated list. For fine-grained
+ * personal access (no scopes) the list is empty — we still send the
+ * parameter to keep the consent screen transparent.
+ */
+import type { OAuthProvider } from "../types.js";
+export declare const githubProvider: OAuthProvider;
+//# sourceMappingURL=github.d.ts.map

package/dist/integrations/providers/github.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/github.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAY,MAAM,aAAa,CAAC;AAM3D,eAAO,MAAM,cAAc,EAAE,aAqC5B,CAAC"}

package/dist/integrations/providers/github.js

@@ -0,0 +1,113 @@
+/**
+ * GitHub OAuth 2.0 Provider.
+ *
+ * Endpoints (GitHub OAuth App / GitHub App user-to-server):
+ *   authorize: https://github.com/login/oauth/authorize
+ *   token:     https://github.com/login/oauth/access_token
+ *
+ * GitHub's classic OAuth Apps issue long-lived tokens with no
+ * `expires_in`. GitHub Apps (recommended) issue 8-hour user tokens
+ * with a refresh_token. We handle both: if the token response includes
+ * `expires_in` we record the expiry; otherwise `expiresAt=0` (no
+ * declared expiry) and the background refresher skips it.
+ *
+ * Scopes are passed as a space-separated list. For fine-grained
+ * personal access (no scopes) the list is empty — we still send the
+ * parameter to keep the consent screen transparent.
+ */
+import { ProviderError } from "../../util/errors.js";
+const AUTHORIZE = "https://github.com/login/oauth/authorize";
+const TOKEN = "https://github.com/login/oauth/access_token";
+const USER = "https://api.github.com/user";
+export const githubProvider = {
+    id: "github",
+    usesPKCE: false,
+    authorizeUrl({ clientId, redirectUri, state, scopes }) {
+        const url = new URL(AUTHORIZE);
+        url.searchParams.set("client_id", clientId);
+        url.searchParams.set("redirect_uri", redirectUri);
+        url.searchParams.set("state", state);
+        if (scopes.length > 0)
+            url.searchParams.set("scope", scopes.join(" "));
+        // Forces a fresh consent screen so scope changes show up even when
+        // the user has previously authorized the app.
+        url.searchParams.set("allow_signup", "true");
+        return url.toString();
+    },
+    async exchangeCode({ code, redirectUri, clientId, clientSecret }) {
+        if (!clientSecret)
+            throw new ProviderError("GitHub requires client_secret for token exchange", "github");
+        const json = await tokenCall({
+            client_id: clientId,
+            client_secret: clientSecret,
+            code,
+            redirect_uri: redirectUri,
+        }, "exchange");
+        return enrichWithIdentity(json);
+    },
+    async refresh({ refreshToken, clientId, clientSecret }) {
+        if (!clientSecret)
+            throw new ProviderError("GitHub refresh requires client_secret", "github");
+        const json = await tokenCall({
+            client_id: clientId,
+            client_secret: clientSecret,
+            grant_type: "refresh_token",
+            refresh_token: refreshToken,
+        }, "refresh");
+        return enrichWithIdentity(json);
+    },
+};
+async function tokenCall(params, phase) {
+    const resp = await fetch(TOKEN, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/x-www-form-urlencoded",
+            Accept: "application/json",
+        },
+        body: new URLSearchParams(params).toString(),
+    });
+    if (!resp.ok) {
+        const body = await resp.text().catch(() => "");
+        throw new ProviderError(`GitHub token ${phase} ${resp.status}: ${body.slice(0, 300)}`, "github");
+    }
+    const json = (await resp.json());
+    if (json["error"]) {
+        throw new ProviderError(`GitHub token ${phase}: ${String(json["error_description"] ?? json["error"])}`, "github");
+    }
+    return json;
+}
+async function enrichWithIdentity(json) {
+    const accessToken = String(json["access_token"] ?? "");
+    const refreshToken = typeof json["refresh_token"] === "string" ? json["refresh_token"] : undefined;
+    const expiresIn = Number(json["expires_in"] ?? 0);
+    const expiresAt = expiresIn > 0 ? Math.floor(Date.now() / 1000) + expiresIn : 0;
+    const scope = typeof json["scope"] === "string" ? json["scope"] : "";
+    const scopes = scope.split(/[\s,]+/).filter(Boolean);
+    let accountId = "";
+    let accountLabel = "GitHub account";
+    try {
+        const me = await fetch(USER, {
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                Accept: "application/vnd.github+json",
+                "User-Agent": "daemora",
+            },
+        });
+        if (me.ok) {
+            const body = (await me.json());
+            accountId = String(body.id ?? "");
+            accountLabel = body.login ? `@${body.login}` : body.name ?? accountLabel;
+        }
+    }
+    catch { /* non-fatal */ }
+    return {
+        accessToken,
+        ...(refreshToken ? { refreshToken } : {}),
+        expiresAt,
+        scopes,
+        accountId,
+        accountLabel,
+        raw: json,
+    };
+}
+//# sourceMappingURL=github.js.map