daemora 1.0.0-alpha.0

package/dist/integrations/providers/github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../../src/integrations/providers/github.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrD,MAAM,SAAS,GAAG,0CAA0C,CAAC;AAC7D,MAAM,KAAK,GAAG,6CAA6C,CAAC;AAC5D,MAAM,IAAI,GAAG,6BAA6B,CAAC;AAE3C,MAAM,CAAC,MAAM,cAAc,GAAkB;IAC3C,EAAE,EAAE,QAAQ;IACZ,QAAQ,EAAE,KAAK;IAEf,YAAY,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE;QACnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC5C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACvE,mEAAmE;QACnE,8CAA8C;QAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QAC7C,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE;QAC9D,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,aAAa,CAAC,kDAAkD,EAAE,QAAQ,CAAC,CAAC;QACzG,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC;YAC3B,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,YAAY;YAC3B,IAAI;YACJ,YAAY,EAAE,WAAW;SAC1B,EAAE,UAAU,CAAC,CAAC;QACf,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE;QACpD,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,aAAa,CAAC,uCAAuC,EAAE,QAAQ,CAAC,CAAC;QAC9F,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC;YAC3B,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;SAC5B,EAAE,SAAS,CAAC,CAAC;QACd,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;CACF,CAAC;AAEF,KAAK,UAAU,SAAS,CACtB,MAA8B,EAC9B,KAAa;IAEb,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE;QAC9B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;SAC3B;QACD,IAAI,EAAE,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;KAC7C,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,IAAI,aAAa,CAAC,gBAAgB,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC5D,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,aAAa,CACrB,gBAAgB,KAAK,KAAK,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,EAC9E,QAAQ,CACT,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,IAA6B;IAC7D,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,eAAe,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/G,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,OAAO,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAErD,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,YAAY,GAAG,gBAAgB,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE;YAC3B,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,MAAM,EAAE,6BAA6B;gBACrC,YAAY,EAAE,SAAS;aACxB;SACF,CAAC,CAAC;QACH,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAmD,CAAC;YACjF,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAClC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,YAAY,CAAC;QAC3E,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IAE3B,OAAO;QACL,WAAW;QACX,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,SAAS;QACT,MAAM;QACN,SAAS;QACT,YAAY;QACZ,GAAG,EAAE,IAAI;KACV,CAAC;AACJ,CAAC"}

package/dist/integrations/providers/google.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Google OAuth 2.0 Provider — used for YouTube Data API.
+ *
+ * Endpoints:
+ *   authorize: https://accounts.google.com/o/oauth2/v2/auth
+ *   token:     https://oauth2.googleapis.com/token
+ *
+ * Google supports PKCE for confidential clients too, and we use it —
+ * keeps the flow uniform with Twitter and protects the code grant.
+ *
+ * `access_type=offline` + `prompt=consent` is what ensures a
+ * refresh_token is returned on first consent (Google omits it on
+ * subsequent consents if you don't force prompt=consent).
+ */
+import type { OAuthProvider } from "../types.js";
+export declare const googleProvider: OAuthProvider;
+//# sourceMappingURL=google.d.ts.map

package/dist/integrations/providers/google.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/google.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAY,MAAM,aAAa,CAAC;AAM3D,eAAO,MAAM,cAAc,EAAE,aAyD5B,CAAC"}

package/dist/integrations/providers/google.js

@@ -0,0 +1,115 @@
+/**
+ * Google OAuth 2.0 Provider — used for YouTube Data API.
+ *
+ * Endpoints:
+ *   authorize: https://accounts.google.com/o/oauth2/v2/auth
+ *   token:     https://oauth2.googleapis.com/token
+ *
+ * Google supports PKCE for confidential clients too, and we use it —
+ * keeps the flow uniform with Twitter and protects the code grant.
+ *
+ * `access_type=offline` + `prompt=consent` is what ensures a
+ * refresh_token is returned on first consent (Google omits it on
+ * subsequent consents if you don't force prompt=consent).
+ */
+import { createHash } from "node:crypto";
+import { ProviderError } from "../../util/errors.js";
+const AUTHORIZE = "https://accounts.google.com/o/oauth2/v2/auth";
+const TOKEN = "https://oauth2.googleapis.com/token";
+const USERINFO = "https://www.googleapis.com/oauth2/v2/userinfo";
+export const googleProvider = {
+    id: "google",
+    usesPKCE: true,
+    authorizeUrl({ clientId, redirectUri, state, pkceVerifier, scopes }) {
+        if (!pkceVerifier)
+            throw new ProviderError("Google PKCE verifier missing", "google");
+        const challenge = sha256B64url(pkceVerifier);
+        const url = new URL(AUTHORIZE);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("client_id", clientId);
+        url.searchParams.set("redirect_uri", redirectUri);
+        url.searchParams.set("scope", scopes.join(" "));
+        url.searchParams.set("state", state);
+        url.searchParams.set("code_challenge", challenge);
+        url.searchParams.set("code_challenge_method", "S256");
+        url.searchParams.set("access_type", "offline");
+        url.searchParams.set("prompt", "consent");
+        url.searchParams.set("include_granted_scopes", "true");
+        return url.toString();
+    },
+    async exchangeCode({ code, redirectUri, pkceVerifier, clientId, clientSecret }) {
+        const form = new URLSearchParams({
+            grant_type: "authorization_code",
+            code,
+            client_id: clientId,
+            redirect_uri: redirectUri,
+            ...(clientSecret ? { client_secret: clientSecret } : {}),
+            ...(pkceVerifier ? { code_verifier: pkceVerifier } : {}),
+        });
+        const resp = await fetch(TOKEN, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: form.toString(),
+        });
+        const json = await readTokenResponse(resp, "exchange");
+        return enrichWithIdentity(json);
+    },
+    async refresh({ refreshToken, clientId, clientSecret }) {
+        const form = new URLSearchParams({
+            grant_type: "refresh_token",
+            refresh_token: refreshToken,
+            client_id: clientId,
+            ...(clientSecret ? { client_secret: clientSecret } : {}),
+        });
+        const resp = await fetch(TOKEN, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: form.toString(),
+        });
+        const json = await readTokenResponse(resp, "refresh");
+        // Google often omits refresh_token on refresh responses — carry
+        // the old one forward by letting the caller merge. Here we just
+        // return what was given so `expiresAt` / `accessToken` get updated.
+        return enrichWithIdentity(json);
+    },
+};
+async function readTokenResponse(resp, phase) {
+    if (!resp.ok) {
+        const body = await resp.text().catch(() => "");
+        throw new ProviderError(`Google token ${phase} ${resp.status}: ${body.slice(0, 300)}`, "google");
+    }
+    return (await resp.json());
+}
+async function enrichWithIdentity(json) {
+    const accessToken = String(json["access_token"] ?? "");
+    const refreshToken = typeof json["refresh_token"] === "string" ? json["refresh_token"] : undefined;
+    const expiresIn = Number(json["expires_in"] ?? 0);
+    const expiresAt = expiresIn > 0 ? Math.floor(Date.now() / 1000) + expiresIn : 0;
+    const scope = typeof json["scope"] === "string" ? json["scope"] : "";
+    const scopes = scope.split(/[\s,]+/).filter(Boolean);
+    let accountId = "";
+    let accountLabel = "Google account";
+    try {
+        const me = await fetch(USERINFO, { headers: { Authorization: `Bearer ${accessToken}` } });
+        if (me.ok) {
+            const body = (await me.json());
+            accountId = body.id ?? "";
+            accountLabel = body.email ?? body.name ?? accountLabel;
+        }
+    }
+    catch { /* non-fatal */ }
+    return {
+        accessToken,
+        ...(refreshToken ? { refreshToken } : {}),
+        expiresAt,
+        scopes,
+        accountId,
+        accountLabel,
+        raw: json,
+    };
+}
+function sha256B64url(input) {
+    return createHash("sha256").update(input).digest("base64")
+        .replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+//# sourceMappingURL=google.js.map

package/dist/integrations/providers/google.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.js","sourceRoot":"","sources":["../../../src/integrations/providers/google.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrD,MAAM,SAAS,GAAG,8CAA8C,CAAC;AACjE,MAAM,KAAK,GAAG,qCAAqC,CAAC;AACpD,MAAM,QAAQ,GAAG,+CAA+C,CAAC;AAEjE,MAAM,CAAC,MAAM,cAAc,GAAkB;IAC3C,EAAE,EAAE,QAAQ;IACZ,QAAQ,EAAE,IAAI;IAEd,YAAY,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE;QACjE,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,aAAa,CAAC,8BAA8B,EAAE,QAAQ,CAAC,CAAC;QACrF,MAAM,SAAS,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC5C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAChD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC1C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC;QACvD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE;QAC5E,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,WAAW;YACzB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE;YAC9B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACvD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE;QACpD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;YAC3B,SAAS,EAAE,QAAQ;YACnB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE;YAC9B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACtD,gEAAgE;QAChE,gEAAgE;QAChE,oEAAoE;QACpE,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;CACF,CAAC;AAEF,KAAK,UAAU,iBAAiB,CAAC,IAAc,EAAE,KAAa;IAC5D,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,IAAI,aAAa,CAAC,gBAAgB,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,IAA6B;IAC7D,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,eAAe,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/G,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,OAAO,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAErD,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,YAAY,GAAG,gBAAgB,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1F,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAmD,CAAC;YACjF,SAAS,GAAG,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;YAC1B,YAAY,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,IAAI,YAAY,CAAC;QACzD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IAE3B,OAAO;QACL,WAAW;QACX,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,SAAS;QACT,MAAM;QACN,SAAS;QACT,YAAY;QACZ,GAAG,EAAE,IAAI;KACV,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;SACvD,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAChE,CAAC"}

package/dist/integrations/providers/linkedin.d.ts

@@ -0,0 +1,22 @@
+/**
+ * LinkedIn OAuth 2.0 Provider (Sign In with LinkedIn v2 / OpenID).
+ *
+ * Endpoints (LinkedIn — "Authorization Code Flow (3-legged OAuth)"):
+ *   authorize: https://www.linkedin.com/oauth/v2/authorization
+ *   token:     https://www.linkedin.com/oauth/v2/accessToken
+ *   userinfo:  https://api.linkedin.com/v2/userinfo   (OpenID endpoint)
+ *
+ * Access tokens live 60 days and refresh tokens live 365 days. LinkedIn
+ * only issues refresh_token for apps enrolled in the refresh-token
+ * programme — if the response omits it, the integration is one-shot
+ * and the user reconnects every 60 days.
+ *
+ * Scopes requested by default (see IntegrationManager):
+ *   openid profile email w_member_social
+ * w_member_social grants "post on your behalf" on the authenticated
+ * user's feed. Company-page scopes (w_organization_social) need the
+ * Marketing Developer Platform partnership.
+ */
+import type { OAuthProvider } from "../types.js";
+export declare const linkedinProvider: OAuthProvider;
+//# sourceMappingURL=linkedin.d.ts.map

package/dist/integrations/providers/linkedin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"linkedin.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/linkedin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAY,MAAM,aAAa,CAAC;AAM3D,eAAO,MAAM,gBAAgB,EAAE,aAoC9B,CAAC"}

package/dist/integrations/providers/linkedin.js

@@ -0,0 +1,103 @@
+/**
+ * LinkedIn OAuth 2.0 Provider (Sign In with LinkedIn v2 / OpenID).
+ *
+ * Endpoints (LinkedIn — "Authorization Code Flow (3-legged OAuth)"):
+ *   authorize: https://www.linkedin.com/oauth/v2/authorization
+ *   token:     https://www.linkedin.com/oauth/v2/accessToken
+ *   userinfo:  https://api.linkedin.com/v2/userinfo   (OpenID endpoint)
+ *
+ * Access tokens live 60 days and refresh tokens live 365 days. LinkedIn
+ * only issues refresh_token for apps enrolled in the refresh-token
+ * programme — if the response omits it, the integration is one-shot
+ * and the user reconnects every 60 days.
+ *
+ * Scopes requested by default (see IntegrationManager):
+ *   openid profile email w_member_social
+ * w_member_social grants "post on your behalf" on the authenticated
+ * user's feed. Company-page scopes (w_organization_social) need the
+ * Marketing Developer Platform partnership.
+ */
+import { ProviderError } from "../../util/errors.js";
+const AUTHORIZE = "https://www.linkedin.com/oauth/v2/authorization";
+const TOKEN = "https://www.linkedin.com/oauth/v2/accessToken";
+const USERINFO = "https://api.linkedin.com/v2/userinfo";
+export const linkedinProvider = {
+    id: "linkedin",
+    usesPKCE: false,
+    authorizeUrl({ clientId, redirectUri, state, scopes }) {
+        const url = new URL(AUTHORIZE);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("client_id", clientId);
+        url.searchParams.set("redirect_uri", redirectUri);
+        url.searchParams.set("state", state);
+        url.searchParams.set("scope", scopes.join(" "));
+        return url.toString();
+    },
+    async exchangeCode({ code, redirectUri, clientId, clientSecret }) {
+        if (!clientSecret)
+            throw new ProviderError("LinkedIn requires client_secret for token exchange", "linkedin");
+        const json = await tokenCall({
+            grant_type: "authorization_code",
+            code,
+            redirect_uri: redirectUri,
+            client_id: clientId,
+            client_secret: clientSecret,
+        }, "exchange");
+        return enrichWithIdentity(json);
+    },
+    async refresh({ refreshToken, clientId, clientSecret }) {
+        if (!clientSecret)
+            throw new ProviderError("LinkedIn refresh requires client_secret", "linkedin");
+        const json = await tokenCall({
+            grant_type: "refresh_token",
+            refresh_token: refreshToken,
+            client_id: clientId,
+            client_secret: clientSecret,
+        }, "refresh");
+        return enrichWithIdentity(json);
+    },
+};
+async function tokenCall(params, phase) {
+    const resp = await fetch(TOKEN, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams(params).toString(),
+    });
+    if (!resp.ok) {
+        const body = await resp.text().catch(() => "");
+        throw new ProviderError(`LinkedIn token ${phase} ${resp.status}: ${body.slice(0, 300)}`, "linkedin");
+    }
+    return (await resp.json());
+}
+async function enrichWithIdentity(json) {
+    const accessToken = String(json["access_token"] ?? "");
+    const refreshToken = typeof json["refresh_token"] === "string" ? json["refresh_token"] : undefined;
+    const expiresIn = Number(json["expires_in"] ?? 0);
+    const expiresAt = expiresIn > 0 ? Math.floor(Date.now() / 1000) + expiresIn : 0;
+    const scope = typeof json["scope"] === "string" ? json["scope"] : "";
+    const scopes = scope.split(/[\s,]+/).filter(Boolean);
+    let accountId = "";
+    let accountLabel = "LinkedIn account";
+    try {
+        const me = await fetch(USERINFO, {
+            headers: { Authorization: `Bearer ${accessToken}` },
+        });
+        if (me.ok) {
+            // OpenID userinfo response — { sub, name, email, ... }
+            const body = (await me.json());
+            accountId = body.sub ?? "";
+            accountLabel = body.name ?? body.email ?? accountLabel;
+        }
+    }
+    catch { /* non-fatal */ }
+    return {
+        accessToken,
+        ...(refreshToken ? { refreshToken } : {}),
+        expiresAt,
+        scopes,
+        accountId,
+        accountLabel,
+        raw: json,
+    };
+}
+//# sourceMappingURL=linkedin.js.map

package/dist/integrations/providers/linkedin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"linkedin.js","sourceRoot":"","sources":["../../../src/integrations/providers/linkedin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrD,MAAM,SAAS,GAAG,iDAAiD,CAAC;AACpE,MAAM,KAAK,GAAG,+CAA+C,CAAC;AAC9D,MAAM,QAAQ,GAAG,sCAAsC,CAAC;AAExD,MAAM,CAAC,MAAM,gBAAgB,GAAkB;IAC7C,EAAE,EAAE,UAAU;IACd,QAAQ,EAAE,KAAK;IAEf,YAAY,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE;QACnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC5C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAChD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE;QAC9D,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,aAAa,CAAC,oDAAoD,EAAE,UAAU,CAAC,CAAC;QAC7G,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC;YAC3B,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,YAAY,EAAE,WAAW;YACzB,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,YAAY;SAC5B,EAAE,UAAU,CAAC,CAAC;QACf,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE;QACpD,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,aAAa,CAAC,yCAAyC,EAAE,UAAU,CAAC,CAAC;QAClG,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC;YAC3B,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;YAC3B,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,YAAY;SAC5B,EAAE,SAAS,CAAC,CAAC;QACd,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;CACF,CAAC;AAEF,KAAK,UAAU,SAAS,CACtB,MAA8B,EAC9B,KAAa;IAEb,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE;QAC9B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;KAC7C,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,IAAI,aAAa,CAAC,kBAAkB,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,IAA6B;IAC7D,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,eAAe,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/G,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,OAAO,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAErD,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,YAAY,GAAG,kBAAkB,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YAC/B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SACpD,CAAC,CAAC;QACH,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;YACV,uDAAuD;YACvD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAoD,CAAC;YAClF,SAAS,GAAG,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;YAC3B,YAAY,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;QACzD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IAE3B,OAAO;QACL,WAAW;QACX,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,SAAS;QACT,MAAM;QACN,SAAS;QACT,YAAY;QACZ,GAAG,EAAE,IAAI;KACV,CAAC;AACJ,CAAC"}

package/dist/integrations/providers/meta.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Meta (Facebook + Instagram) OAuth 2.0 Provider.
+ *
+ * Endpoints (Facebook Login for Business / Graph API v19):
+ *   authorize: https://www.facebook.com/v19.0/dialog/oauth
+ *   token:     https://graph.facebook.com/v19.0/oauth/access_token
+ *
+ * Meta does NOT use PKCE — it uses the classic confidential-client
+ * flow with a bundled `client_secret`. Refresh is implicit: short-lived
+ * user tokens can be exchanged for a long-lived (~60 day) token via
+ * `fb_exchange_token`. There is no refresh_token grant.
+ *
+ * For Instagram: the same OAuth flow is used with IG scopes; the IG
+ * integration picks the right Business account off the user's Pages
+ * after connect.
+ */
+import type { OAuthProvider } from "../types.js";
+export declare const metaProvider: OAuthProvider;
+//# sourceMappingURL=meta.d.ts.map

package/dist/integrations/providers/meta.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"meta.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/meta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAY,MAAM,aAAa,CAAC;AAO3D,eAAO,MAAM,YAAY,EAAE,aA4D1B,CAAC"}

package/dist/integrations/providers/meta.js

@@ -0,0 +1,116 @@
+/**
+ * Meta (Facebook + Instagram) OAuth 2.0 Provider.
+ *
+ * Endpoints (Facebook Login for Business / Graph API v19):
+ *   authorize: https://www.facebook.com/v19.0/dialog/oauth
+ *   token:     https://graph.facebook.com/v19.0/oauth/access_token
+ *
+ * Meta does NOT use PKCE — it uses the classic confidential-client
+ * flow with a bundled `client_secret`. Refresh is implicit: short-lived
+ * user tokens can be exchanged for a long-lived (~60 day) token via
+ * `fb_exchange_token`. There is no refresh_token grant.
+ *
+ * For Instagram: the same OAuth flow is used with IG scopes; the IG
+ * integration picks the right Business account off the user's Pages
+ * after connect.
+ */
+import { ProviderError } from "../../util/errors.js";
+const GRAPH_VERSION = "v19.0";
+const AUTHORIZE = `https://www.facebook.com/${GRAPH_VERSION}/dialog/oauth`;
+const TOKEN = `https://graph.facebook.com/${GRAPH_VERSION}/oauth/access_token`;
+const ME = `https://graph.facebook.com/${GRAPH_VERSION}/me`;
+export const metaProvider = {
+    id: "meta",
+    usesPKCE: false,
+    authorizeUrl({ clientId, redirectUri, state, scopes }) {
+        const url = new URL(AUTHORIZE);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("client_id", clientId);
+        url.searchParams.set("redirect_uri", redirectUri);
+        url.searchParams.set("scope", scopes.join(","));
+        url.searchParams.set("state", state);
+        return url.toString();
+    },
+    async exchangeCode({ code, redirectUri, clientId, clientSecret }) {
+        if (!clientSecret)
+            throw new ProviderError("Meta requires client_secret for token exchange", "meta");
+        // Step 1: exchange code for a short-lived user token.
+        const short = await metaTokenCall({
+            grant_type: "authorization_code",
+            client_id: clientId,
+            client_secret: clientSecret,
+            redirect_uri: redirectUri,
+            code,
+        }, "exchange");
+        // Step 2: exchange for a long-lived token (best-effort; falls back
+        // to the short-lived token if the long-lived exchange errors out).
+        let finalToken = String(short["access_token"] ?? "");
+        let expiresIn = Number(short["expires_in"] ?? 0);
+        try {
+            const longLived = await metaTokenCall({
+                grant_type: "fb_exchange_token",
+                client_id: clientId,
+                client_secret: clientSecret,
+                fb_exchange_token: finalToken,
+            }, "long-lived exchange");
+            finalToken = String(longLived["access_token"] ?? finalToken);
+            expiresIn = Number(longLived["expires_in"] ?? expiresIn);
+        }
+        catch {
+            // Short-lived token still works — log upstream.
+        }
+        return enrichWithIdentity(finalToken, expiresIn, short);
+    },
+    async refresh({ refreshToken, clientId, clientSecret }) {
+        // Meta doesn't issue refresh_tokens — instead we treat the stored
+        // long-lived user token as both access and refresh, and use
+        // `fb_exchange_token` to extend it when it's close to expiry.
+        if (!clientSecret)
+            throw new ProviderError("Meta refresh requires client_secret", "meta");
+        const json = await metaTokenCall({
+            grant_type: "fb_exchange_token",
+            client_id: clientId,
+            client_secret: clientSecret,
+            fb_exchange_token: refreshToken,
+        }, "refresh");
+        const token = String(json["access_token"] ?? "");
+        const expiresIn = Number(json["expires_in"] ?? 0);
+        return enrichWithIdentity(token, expiresIn, json);
+    },
+};
+async function metaTokenCall(params, phase) {
+    const url = `${TOKEN}?${new URLSearchParams(params).toString()}`;
+    const resp = await fetch(url, { method: "GET" });
+    if (!resp.ok) {
+        const body = await resp.text().catch(() => "");
+        throw new ProviderError(`Meta token ${phase} ${resp.status}: ${body.slice(0, 300)}`, "meta");
+    }
+    return (await resp.json());
+}
+async function enrichWithIdentity(accessToken, expiresIn, raw) {
+    const expiresAt = expiresIn > 0 ? Math.floor(Date.now() / 1000) + expiresIn : 0;
+    let accountId = "";
+    let accountLabel = "Meta account";
+    try {
+        const meResp = await fetch(`${ME}?fields=id,name,email`, {
+            headers: { Authorization: `Bearer ${accessToken}` },
+        });
+        if (meResp.ok) {
+            const me = (await meResp.json());
+            accountId = me.id ?? "";
+            accountLabel = me.name ?? me.email ?? accountLabel;
+        }
+    }
+    catch { /* non-fatal */ }
+    return {
+        accessToken,
+        // Meta's long-lived user token doubles as the refresh credential.
+        refreshToken: accessToken,
+        expiresAt,
+        scopes: [],
+        accountId,
+        accountLabel,
+        raw,
+    };
+}
+//# sourceMappingURL=meta.js.map

package/dist/integrations/providers/meta.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"meta.js","sourceRoot":"","sources":["../../../src/integrations/providers/meta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrD,MAAM,aAAa,GAAG,OAAO,CAAC;AAC9B,MAAM,SAAS,GAAG,4BAA4B,aAAa,eAAe,CAAC;AAC3E,MAAM,KAAK,GAAG,8BAA8B,aAAa,qBAAqB,CAAC;AAC/E,MAAM,EAAE,GAAG,8BAA8B,aAAa,KAAK,CAAC;AAE5D,MAAM,CAAC,MAAM,YAAY,GAAkB;IACzC,EAAE,EAAE,MAAM;IACV,QAAQ,EAAE,KAAK;IAEf,YAAY,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE;QACnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC5C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAChD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrC,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE;QAC9D,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,aAAa,CAAC,gDAAgD,EAAE,MAAM,CAAC,CAAC;QACrG,sDAAsD;QACtD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC;YAChC,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,YAAY;YAC3B,YAAY,EAAE,WAAW;YACzB,IAAI;SACL,EAAE,UAAU,CAAC,CAAC;QAEf,mEAAmE;QACnE,mEAAmE;QACnE,IAAI,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;QACrD,IAAI,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC;gBACpC,UAAU,EAAE,mBAAmB;gBAC/B,SAAS,EAAE,QAAQ;gBACnB,aAAa,EAAE,YAAY;gBAC3B,iBAAiB,EAAE,UAAU;aAC9B,EAAE,qBAAqB,CAAC,CAAC;YAC1B,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,UAAU,CAAC,CAAC;YAC7D,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;QAClD,CAAC;QAED,OAAO,kBAAkB,CAAC,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE;QACpD,kEAAkE;QAClE,4DAA4D;QAC5D,8DAA8D;QAC9D,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,aAAa,CAAC,qCAAqC,EAAE,MAAM,CAAC,CAAC;QAC1F,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC;YAC/B,UAAU,EAAE,mBAAmB;YAC/B,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,YAAY;YAC3B,iBAAiB,EAAE,YAAY;SAChC,EAAE,SAAS,CAAC,CAAC;QACd,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAClD,OAAO,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACpD,CAAC;CACF,CAAC;AAEF,KAAK,UAAU,aAAa,CAC1B,MAA8B,EAC9B,KAAa;IAEb,MAAM,GAAG,GAAG,GAAG,KAAK,IAAI,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;IACjE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,IAAI,aAAa,CAAC,cAAc,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,WAAmB,EACnB,SAAiB,EACjB,GAA4B;IAE5B,MAAM,SAAS,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhF,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,YAAY,GAAG,cAAc,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,uBAAuB,EAAE;YACvD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SACpD,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAmD,CAAC;YACnF,SAAS,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;YACxB,YAAY,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,KAAK,IAAI,YAAY,CAAC;QACrD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IAE3B,OAAO;QACL,WAAW;QACX,kEAAkE;QAClE,YAAY,EAAE,WAAW;QACzB,SAAS;QACT,MAAM,EAAE,EAAE;QACV,SAAS;QACT,YAAY;QACZ,GAAG;KACJ,CAAC;AACJ,CAAC"}

package/dist/integrations/providers/notion.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Notion OAuth 2.0 Provider (public integration flow).
+ *
+ * Endpoints (Notion docs — "Authorize users and grant access"):
+ *   authorize: https://api.notion.com/v1/oauth/authorize
+ *   token:     https://api.notion.com/v1/oauth/token
+ *
+ * Notion does NOT use scopes — at consent time the user picks which
+ * pages/databases the integration can see. That selection is bound to
+ * the `bot_id` returned by the token exchange.
+ *
+ * Notion tokens have no declared expiry and Notion does not issue
+ * refresh tokens for public integrations — access is revoked only when
+ * the user removes the integration from their workspace. We therefore
+ * leave `expiresAt=0` and implement `refresh()` as a stub that returns
+ * the existing token (Notion expects the refresh_token grant to never
+ * fire; the stub keeps our refresh interface total).
+ */
+import type { OAuthProvider } from "../types.js";
+export declare const notionProvider: OAuthProvider;
+//# sourceMappingURL=notion.d.ts.map

package/dist/integrations/providers/notion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notion.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/notion.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAY,MAAM,aAAa,CAAC;AAK3D,eAAO,MAAM,cAAc,EAAE,aAoD5B,CAAC"}

package/dist/integrations/providers/notion.js

@@ -0,0 +1,96 @@
+/**
+ * Notion OAuth 2.0 Provider (public integration flow).
+ *
+ * Endpoints (Notion docs — "Authorize users and grant access"):
+ *   authorize: https://api.notion.com/v1/oauth/authorize
+ *   token:     https://api.notion.com/v1/oauth/token
+ *
+ * Notion does NOT use scopes — at consent time the user picks which
+ * pages/databases the integration can see. That selection is bound to
+ * the `bot_id` returned by the token exchange.
+ *
+ * Notion tokens have no declared expiry and Notion does not issue
+ * refresh tokens for public integrations — access is revoked only when
+ * the user removes the integration from their workspace. We therefore
+ * leave `expiresAt=0` and implement `refresh()` as a stub that returns
+ * the existing token (Notion expects the refresh_token grant to never
+ * fire; the stub keeps our refresh interface total).
+ */
+import { ProviderError } from "../../util/errors.js";
+const AUTHORIZE = "https://api.notion.com/v1/oauth/authorize";
+const TOKEN = "https://api.notion.com/v1/oauth/token";
+export const notionProvider = {
+    id: "notion",
+    usesPKCE: false,
+    authorizeUrl({ clientId, redirectUri, state }) {
+        const url = new URL(AUTHORIZE);
+        url.searchParams.set("client_id", clientId);
+        url.searchParams.set("redirect_uri", redirectUri);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("owner", "user");
+        url.searchParams.set("state", state);
+        return url.toString();
+    },
+    async exchangeCode({ code, redirectUri, clientId, clientSecret }) {
+        if (!clientSecret)
+            throw new ProviderError("Notion requires client_secret for token exchange", "notion");
+        const basic = Buffer.from(`${clientId}:${clientSecret}`).toString("base64");
+        const resp = await fetch(TOKEN, {
+            method: "POST",
+            headers: {
+                Authorization: `Basic ${basic}`,
+                "Content-Type": "application/json",
+                "Notion-Version": "2022-06-28",
+            },
+            body: JSON.stringify({
+                grant_type: "authorization_code",
+                code,
+                redirect_uri: redirectUri,
+            }),
+        });
+        if (!resp.ok) {
+            const body = await resp.text().catch(() => "");
+            throw new ProviderError(`Notion token exchange ${resp.status}: ${body.slice(0, 300)}`, "notion");
+        }
+        const json = (await resp.json());
+        return shapeTokenSet(json);
+    },
+    async refresh({ refreshToken }) {
+        // Notion public integrations don't issue refresh tokens. If we
+        // ever get called, the best we can do is echo the token we were
+        // handed — the caller stores it under `refreshToken` as a dual-
+        // purpose long-lived access token.
+        return {
+            accessToken: refreshToken,
+            refreshToken,
+            expiresAt: 0,
+            scopes: [],
+            accountId: "",
+            accountLabel: "Notion workspace",
+        };
+    },
+};
+function shapeTokenSet(json) {
+    const accessToken = String(json["access_token"] ?? "");
+    const botId = String(json["bot_id"] ?? "");
+    const workspaceId = String(json["workspace_id"] ?? "");
+    const workspaceName = typeof json["workspace_name"] === "string"
+        ? json["workspace_name"]
+        : "Notion workspace";
+    // Use bot_id (unique per install) as accountId; workspace_name as the
+    // user-facing label.
+    const accountId = botId || workspaceId || "notion";
+    return {
+        accessToken,
+        // Notion tokens don't rotate; we stash the same string under
+        // refreshToken so our refresh path (and the bridge token cache)
+        // always has a value to echo back.
+        refreshToken: accessToken,
+        expiresAt: 0,
+        scopes: [],
+        accountId,
+        accountLabel: workspaceName,
+        raw: json,
+    };
+}
+//# sourceMappingURL=notion.js.map

package/dist/integrations/providers/notion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notion.js","sourceRoot":"","sources":["../../../src/integrations/providers/notion.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrD,MAAM,SAAS,GAAG,2CAA2C,CAAC;AAC9D,MAAM,KAAK,GAAG,uCAAuC,CAAC;AAEtD,MAAM,CAAC,MAAM,cAAc,GAAkB;IAC3C,EAAE,EAAE,QAAQ;IACZ,QAAQ,EAAE,KAAK;IAEf,YAAY,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE;QAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC5C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACtC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrC,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE;QAC9D,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,aAAa,CAAC,kDAAkD,EAAE,QAAQ,CAAC,CAAC;QACzG,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC5E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE;YAC9B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,SAAS,KAAK,EAAE;gBAC/B,cAAc,EAAE,kBAAkB;gBAClC,gBAAgB,EAAE,YAAY;aAC/B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,UAAU,EAAE,oBAAoB;gBAChC,IAAI;gBACJ,YAAY,EAAE,WAAW;aAC1B,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC/C,MAAM,IAAI,aAAa,CAAC,yBAAyB,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC5D,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE;QAC5B,+DAA+D;QAC/D,gEAAgE;QAChE,gEAAgE;QAChE,mCAAmC;QACnC,OAAO;YACL,WAAW,EAAE,YAAY;YACzB,YAAY;YACZ,SAAS,EAAE,CAAC;YACZ,MAAM,EAAE,EAAE;YACV,SAAS,EAAE,EAAE;YACb,YAAY,EAAE,kBAAkB;SACjC,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,SAAS,aAAa,CAAC,IAA6B;IAClD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,aAAa,GAAG,OAAO,IAAI,CAAC,gBAAgB,CAAC,KAAK,QAAQ;QAC9D,CAAC,CAAE,IAAI,CAAC,gBAAgB,CAAY;QACpC,CAAC,CAAC,kBAAkB,CAAC;IAEvB,sEAAsE;IACtE,qBAAqB;IACrB,MAAM,SAAS,GAAG,KAAK,IAAI,WAAW,IAAI,QAAQ,CAAC;IACnD,OAAO;QACL,WAAW;QACX,6DAA6D;QAC7D,gEAAgE;QAChE,mCAAmC;QACnC,YAAY,EAAE,WAAW;QACzB,SAAS,EAAE,CAAC;QACZ,MAAM,EAAE,EAAE;QACV,SAAS;QACT,YAAY,EAAE,aAAa;QAC3B,GAAG,EAAE,IAAI;KACV,CAAC;AACJ,CAAC"}

package/dist/integrations/providers/reddit.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Reddit OAuth 2.0 Provider.
+ *
+ * Endpoints (Reddit API docs — "OAuth2"):
+ *   authorize: https://www.reddit.com/api/v1/authorize
+ *   token:     https://www.reddit.com/api/v1/access_token
+ *   me:        https://oauth.reddit.com/api/v1/me
+ *
+ * Token exchange uses HTTP Basic auth with client_id:client_secret
+ * (even for installed-app flows, where the secret is empty). A
+ * refresh_token is only issued when `duration=permanent` is requested.
+ *
+ * Reddit REQUIRES a descriptive User-Agent header on API calls or it
+ * rate-limits aggressively ("changeme" / default UAs get 429'd).
+ */
+import type { OAuthProvider } from "../types.js";
+export declare const redditProvider: OAuthProvider;
+//# sourceMappingURL=reddit.d.ts.map

package/dist/integrations/providers/reddit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reddit.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/reddit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAY,MAAM,aAAa,CAAC;AAO3D,eAAO,MAAM,cAAc,EAAE,aAmC5B,CAAC"}