daemora 1.0.0-alpha.0

package/dist/integrations/providers/reddit.js

@@ -0,0 +1,104 @@
+/**
+ * Reddit OAuth 2.0 Provider.
+ *
+ * Endpoints (Reddit API docs — "OAuth2"):
+ *   authorize: https://www.reddit.com/api/v1/authorize
+ *   token:     https://www.reddit.com/api/v1/access_token
+ *   me:        https://oauth.reddit.com/api/v1/me
+ *
+ * Token exchange uses HTTP Basic auth with client_id:client_secret
+ * (even for installed-app flows, where the secret is empty). A
+ * refresh_token is only issued when `duration=permanent` is requested.
+ *
+ * Reddit REQUIRES a descriptive User-Agent header on API calls or it
+ * rate-limits aggressively ("changeme" / default UAs get 429'd).
+ */
+import { ProviderError } from "../../util/errors.js";
+const AUTHORIZE = "https://www.reddit.com/api/v1/authorize";
+const TOKEN = "https://www.reddit.com/api/v1/access_token";
+const ME = "https://oauth.reddit.com/api/v1/me";
+const USER_AGENT = "daemora/1.0 (by /u/daemora)";
+export const redditProvider = {
+    id: "reddit",
+    usesPKCE: false,
+    authorizeUrl({ clientId, redirectUri, state, scopes }) {
+        const url = new URL(AUTHORIZE);
+        url.searchParams.set("client_id", clientId);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("state", state);
+        url.searchParams.set("redirect_uri", redirectUri);
+        // permanent → refresh_token included in the token response.
+        url.searchParams.set("duration", "permanent");
+        url.searchParams.set("scope", scopes.join(" "));
+        return url.toString();
+    },
+    async exchangeCode({ code, redirectUri, clientId, clientSecret }) {
+        if (!clientSecret && clientSecret !== "") {
+            throw new ProviderError("Reddit requires client_secret (use empty string for installed apps)", "reddit");
+        }
+        const json = await tokenCall({
+            grant_type: "authorization_code",
+            code,
+            redirect_uri: redirectUri,
+        }, clientId, clientSecret ?? "", "exchange");
+        return enrichWithIdentity(json);
+    },
+    async refresh({ refreshToken, clientId, clientSecret }) {
+        const json = await tokenCall({
+            grant_type: "refresh_token",
+            refresh_token: refreshToken,
+        }, clientId, clientSecret ?? "", "refresh");
+        return enrichWithIdentity(json);
+    },
+};
+async function tokenCall(params, clientId, clientSecret, phase) {
+    const basic = Buffer.from(`${clientId}:${clientSecret}`).toString("base64");
+    const resp = await fetch(TOKEN, {
+        method: "POST",
+        headers: {
+            Authorization: `Basic ${basic}`,
+            "Content-Type": "application/x-www-form-urlencoded",
+            "User-Agent": USER_AGENT,
+        },
+        body: new URLSearchParams(params).toString(),
+    });
+    if (!resp.ok) {
+        const body = await resp.text().catch(() => "");
+        throw new ProviderError(`Reddit token ${phase} ${resp.status}: ${body.slice(0, 300)}`, "reddit");
+    }
+    return (await resp.json());
+}
+async function enrichWithIdentity(json) {
+    const accessToken = String(json["access_token"] ?? "");
+    const refreshToken = typeof json["refresh_token"] === "string" ? json["refresh_token"] : undefined;
+    const expiresIn = Number(json["expires_in"] ?? 0);
+    const expiresAt = expiresIn > 0 ? Math.floor(Date.now() / 1000) + expiresIn : 0;
+    const scope = typeof json["scope"] === "string" ? json["scope"] : "";
+    const scopes = scope.split(/[\s,]+/).filter(Boolean);
+    let accountId = "";
+    let accountLabel = "Reddit account";
+    try {
+        const me = await fetch(ME, {
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                "User-Agent": USER_AGENT,
+            },
+        });
+        if (me.ok) {
+            const body = (await me.json());
+            accountId = body.id ?? "";
+            accountLabel = body.name ? `u/${body.name}` : accountLabel;
+        }
+    }
+    catch { /* non-fatal */ }
+    return {
+        accessToken,
+        ...(refreshToken ? { refreshToken } : {}),
+        expiresAt,
+        scopes,
+        accountId,
+        accountLabel,
+        raw: json,
+    };
+}
+//# sourceMappingURL=reddit.js.map

package/dist/integrations/providers/reddit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reddit.js","sourceRoot":"","sources":["../../../src/integrations/providers/reddit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrD,MAAM,SAAS,GAAG,yCAAyC,CAAC;AAC5D,MAAM,KAAK,GAAG,4CAA4C,CAAC;AAC3D,MAAM,EAAE,GAAG,oCAAoC,CAAC;AAChD,MAAM,UAAU,GAAG,6BAA6B,CAAC;AAEjD,MAAM,CAAC,MAAM,cAAc,GAAkB;IAC3C,EAAE,EAAE,QAAQ;IACZ,QAAQ,EAAE,KAAK;IAEf,YAAY,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE;QACnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC5C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAClD,4DAA4D;QAC5D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAChD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE;QAC9D,IAAI,CAAC,YAAY,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;YACzC,MAAM,IAAI,aAAa,CAAC,qEAAqE,EAAE,QAAQ,CAAC,CAAC;QAC3G,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC;YAC3B,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,YAAY,EAAE,WAAW;SAC1B,EAAE,QAAQ,EAAE,YAAY,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC;QAC7C,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE;QACpD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC;YAC3B,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;SAC5B,EAAE,QAAQ,EAAE,YAAY,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC;QAC5C,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;CACF,CAAC;AAEF,KAAK,UAAU,SAAS,CACtB,MAA8B,EAC9B,QAAgB,EAChB,YAAoB,EACpB,KAAa;IAEb,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE;QAC9B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,SAAS,KAAK,EAAE;YAC/B,cAAc,EAAE,mCAAmC;YACnD,YAAY,EAAE,UAAU;SACzB;QACD,IAAI,EAAE,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;KAC7C,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,IAAI,aAAa,CAAC,gBAAgB,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,IAA6B;IAC7D,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,eAAe,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/G,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,OAAO,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAErD,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,YAAY,GAAG,gBAAgB,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,EAAE,EAAE;YACzB,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,YAAY,EAAE,UAAU;aACzB;SACF,CAAC,CAAC;QACH,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAmC,CAAC;YACjE,SAAS,GAAG,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;YAC1B,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;QAC7D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IAE3B,OAAO;QACL,WAAW;QACX,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,SAAS;QACT,MAAM;QACN,SAAS;QACT,YAAY;QACZ,GAAG,EAAE,IAAI;KACV,CAAC;AACJ,CAAC"}

package/dist/integrations/providers/tiktok.d.ts

@@ -0,0 +1,28 @@
+/**
+ * TikTok for Developers OAuth 2.0 Provider (Login Kit v2).
+ *
+ * Endpoints (TikTok docs — "Login Kit for Web"):
+ *   authorize: https://www.tiktok.com/v2/auth/authorize/
+ *   token:     https://open.tiktokapis.com/v2/oauth/token/
+ *   userinfo:  https://open.tiktokapis.com/v2/user/info/
+ *
+ * TikTok uses `client_key` (not client_id) at the authorize endpoint
+ * but `client_id` is also accepted on some endpoints — we send both
+ * where the docs permit to keep the behaviour stable.
+ *
+ * PKCE is REQUIRED for /v2/auth/authorize/ — without `code_challenge`
+ * + `code_challenge_method=S256` TikTok rejects the request with
+ * `errCode=10007 error_type=code_challenge`. We compute the challenge
+ * here from the verifier the IntegrationManager generates.
+ *
+ * Access tokens live 24 hours; refresh tokens live 365 days and rotate
+ * on every refresh — we always forward the newly returned
+ * refresh_token instead of reusing the old one.
+ *
+ * IMPORTANT: until your TikTok app passes audit, `video.publish` tokens
+ * still authenticate but uploaded videos are forced to SELF_ONLY
+ * visibility. Treat "pre-audit" as a read/test mode.
+ */
+import type { OAuthProvider } from "../types.js";
+export declare const tiktokProvider: OAuthProvider;
+//# sourceMappingURL=tiktok.d.ts.map

package/dist/integrations/providers/tiktok.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tiktok.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/tiktok.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAY,MAAM,aAAa,CAAC;AAM3D,eAAO,MAAM,cAAc,EAAE,aA0C5B,CAAC"}

package/dist/integrations/providers/tiktok.js

@@ -0,0 +1,138 @@
+/**
+ * TikTok for Developers OAuth 2.0 Provider (Login Kit v2).
+ *
+ * Endpoints (TikTok docs — "Login Kit for Web"):
+ *   authorize: https://www.tiktok.com/v2/auth/authorize/
+ *   token:     https://open.tiktokapis.com/v2/oauth/token/
+ *   userinfo:  https://open.tiktokapis.com/v2/user/info/
+ *
+ * TikTok uses `client_key` (not client_id) at the authorize endpoint
+ * but `client_id` is also accepted on some endpoints — we send both
+ * where the docs permit to keep the behaviour stable.
+ *
+ * PKCE is REQUIRED for /v2/auth/authorize/ — without `code_challenge`
+ * + `code_challenge_method=S256` TikTok rejects the request with
+ * `errCode=10007 error_type=code_challenge`. We compute the challenge
+ * here from the verifier the IntegrationManager generates.
+ *
+ * Access tokens live 24 hours; refresh tokens live 365 days and rotate
+ * on every refresh — we always forward the newly returned
+ * refresh_token instead of reusing the old one.
+ *
+ * IMPORTANT: until your TikTok app passes audit, `video.publish` tokens
+ * still authenticate but uploaded videos are forced to SELF_ONLY
+ * visibility. Treat "pre-audit" as a read/test mode.
+ */
+import { createHash } from "node:crypto";
+import { ProviderError } from "../../util/errors.js";
+const AUTHORIZE = "https://www.tiktok.com/v2/auth/authorize/";
+const TOKEN = "https://open.tiktokapis.com/v2/oauth/token/";
+const USERINFO = "https://open.tiktokapis.com/v2/user/info/";
+export const tiktokProvider = {
+    id: "tiktok",
+    usesPKCE: true,
+    authorizeUrl({ clientId, redirectUri, state, scopes, pkceVerifier }) {
+        if (!pkceVerifier)
+            throw new ProviderError("TikTok requires PKCE; verifier missing", "tiktok");
+        const challenge = sha256B64url(pkceVerifier);
+        const url = new URL(AUTHORIZE);
+        url.searchParams.set("client_key", clientId);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("scope", scopes.join(","));
+        url.searchParams.set("redirect_uri", redirectUri);
+        url.searchParams.set("state", state);
+        url.searchParams.set("code_challenge", challenge);
+        url.searchParams.set("code_challenge_method", "S256");
+        return url.toString();
+    },
+    async exchangeCode({ code, redirectUri, clientId, clientSecret, pkceVerifier }) {
+        if (!clientSecret)
+            throw new ProviderError("TikTok requires client_secret for token exchange", "tiktok");
+        if (!pkceVerifier)
+            throw new ProviderError("TikTok requires PKCE verifier for token exchange", "tiktok");
+        const json = await tokenCall({
+            client_key: clientId,
+            client_secret: clientSecret,
+            code,
+            grant_type: "authorization_code",
+            redirect_uri: redirectUri,
+            code_verifier: pkceVerifier,
+        }, "exchange");
+        return enrichWithIdentity(json);
+    },
+    async refresh({ refreshToken, clientId, clientSecret }) {
+        if (!clientSecret)
+            throw new ProviderError("TikTok refresh requires client_secret", "tiktok");
+        const json = await tokenCall({
+            client_key: clientId,
+            client_secret: clientSecret,
+            grant_type: "refresh_token",
+            refresh_token: refreshToken,
+        }, "refresh");
+        return enrichWithIdentity(json);
+    },
+};
+async function tokenCall(params, phase) {
+    const resp = await fetch(TOKEN, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/x-www-form-urlencoded",
+            "Cache-Control": "no-cache",
+        },
+        body: new URLSearchParams(params).toString(),
+    });
+    if (!resp.ok) {
+        const body = await resp.text().catch(() => "");
+        throw new ProviderError(`TikTok token ${phase} ${resp.status}: ${body.slice(0, 300)}`, "tiktok");
+    }
+    const json = (await resp.json());
+    if (json["error"] && json["error"] !== "ok") {
+        throw new ProviderError(`TikTok token ${phase}: ${String(json["error_description"] ?? json["error"])}`, "tiktok");
+    }
+    return json;
+}
+async function enrichWithIdentity(json) {
+    const accessToken = String(json["access_token"] ?? "");
+    const refreshToken = typeof json["refresh_token"] === "string" ? json["refresh_token"] : undefined;
+    const expiresIn = Number(json["expires_in"] ?? 0);
+    const expiresAt = expiresIn > 0 ? Math.floor(Date.now() / 1000) + expiresIn : 0;
+    const scope = typeof json["scope"] === "string" ? json["scope"] : "";
+    const scopes = scope.split(/[\s,]+/).filter(Boolean);
+    const openId = typeof json["open_id"] === "string" ? json["open_id"] : "";
+    let accountId = openId;
+    let accountLabel = "TikTok account";
+    try {
+        const url = new URL(USERINFO);
+        url.searchParams.set("fields", "open_id,union_id,avatar_url,display_name,username");
+        const me = await fetch(url.toString(), {
+            headers: { Authorization: `Bearer ${accessToken}` },
+        });
+        if (me.ok) {
+            const body = (await me.json());
+            const user = body.data?.user;
+            if (user?.open_id)
+                accountId = user.open_id;
+            accountLabel = user?.username ? `@${user.username}` : user?.display_name ?? accountLabel;
+        }
+    }
+    catch { /* non-fatal */ }
+    return {
+        accessToken,
+        ...(refreshToken ? { refreshToken } : {}),
+        expiresAt,
+        scopes,
+        accountId,
+        accountLabel,
+        raw: json,
+    };
+}
+/**
+ * SHA-256 of the PKCE verifier, base64url-encoded without padding —
+ * exactly what TikTok (and the OAuth 2.0 PKCE spec, RFC 7636) expects
+ * as the `code_challenge` when `code_challenge_method=S256`.
+ */
+function sha256B64url(input) {
+    return createHash("sha256").update(input).digest("base64")
+        .replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+//# sourceMappingURL=tiktok.js.map

package/dist/integrations/providers/tiktok.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tiktok.js","sourceRoot":"","sources":["../../../src/integrations/providers/tiktok.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrD,MAAM,SAAS,GAAG,2CAA2C,CAAC;AAC9D,MAAM,KAAK,GAAG,6CAA6C,CAAC;AAC5D,MAAM,QAAQ,GAAG,2CAA2C,CAAC;AAE7D,MAAM,CAAC,MAAM,cAAc,GAAkB;IAC3C,EAAE,EAAE,QAAQ;IACZ,QAAQ,EAAE,IAAI;IAEd,YAAY,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE;QACjE,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,aAAa,CAAC,wCAAwC,EAAE,QAAQ,CAAC,CAAC;QAC/F,MAAM,SAAS,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAChD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QACtD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE;QAC5E,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,aAAa,CAAC,kDAAkD,EAAE,QAAQ,CAAC,CAAC;QACzG,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,aAAa,CAAC,kDAAkD,EAAE,QAAQ,CAAC,CAAC;QACzG,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC;YAC3B,UAAU,EAAE,QAAQ;YACpB,aAAa,EAAE,YAAY;YAC3B,IAAI;YACJ,UAAU,EAAE,oBAAoB;YAChC,YAAY,EAAE,WAAW;YACzB,aAAa,EAAE,YAAY;SAC5B,EAAE,UAAU,CAAC,CAAC;QACf,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE;QACpD,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,aAAa,CAAC,uCAAuC,EAAE,QAAQ,CAAC,CAAC;QAC9F,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC;YAC3B,UAAU,EAAE,QAAQ;YACpB,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;SAC5B,EAAE,SAAS,CAAC,CAAC;QACd,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;CACF,CAAC;AAEF,KAAK,UAAU,SAAS,CACtB,MAA8B,EAC9B,KAAa;IAEb,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE;QAC9B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;YACnD,eAAe,EAAE,UAAU;SAC5B;QACD,IAAI,EAAE,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;KAC7C,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,IAAI,aAAa,CAAC,gBAAgB,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC5D,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,aAAa,CACrB,gBAAgB,KAAK,KAAK,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,EAC9E,QAAQ,CACT,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,IAA6B;IAC7D,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,eAAe,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/G,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,OAAO,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,SAAS,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IAEtF,IAAI,SAAS,GAAG,MAAM,CAAC;IACvB,IAAI,YAAY,GAAG,gBAAgB,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,mDAAmD,CAAC,CAAC;QACpF,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YACrC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SACpD,CAAC,CAAC;QACH,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAyF,CAAC;YACvH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;YAC7B,IAAI,IAAI,EAAE,OAAO;gBAAE,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC;YAC5C,YAAY,GAAG,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,YAAY,IAAI,YAAY,CAAC;QAC3F,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IAE3B,OAAO;QACL,WAAW;QACX,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,SAAS;QACT,MAAM;QACN,SAAS;QACT,YAAY;QACZ,GAAG,EAAE,IAAI;KACV,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;SACvD,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAChE,CAAC"}

package/dist/integrations/providers/twitter.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Twitter / X OAuth 2.0 Provider with PKCE.
+ *
+ * Endpoints (per https://docs.x.com/fundamentals/authentication/oauth-2-0/user-access-token):
+ *   authorize: https://x.com/i/oauth2/authorize
+ *   token:     https://api.x.com/2/oauth2/token
+ *
+ * PKCE is always required. `client_secret` is OPTIONAL and depends on
+ * the app type registered in the X developer portal:
+ *
+ *   - Public client    → no secret. Token exchange sends `client_id` in
+ *                        the form body; PKCE alone authenticates.
+ *   - Confidential cli → secret is required. Token exchange MUST send
+ *                        `Authorization: Basic base64(client_id:secret)`
+ *                        per the X docs.
+ *
+ * We support both: when `clientSecret` is provided we attach the Basic
+ * header; otherwise we fall through to public-client behaviour.
+ *
+ * Default scopes we request: tweet.read, tweet.write, users.read,
+ * follows.read, follows.write, like.read, like.write, offline.access.
+ * `offline.access` is what grants a refresh_token.
+ */
+import type { OAuthProvider } from "../types.js";
+export declare const twitterProvider: OAuthProvider;
+//# sourceMappingURL=twitter.d.ts.map

package/dist/integrations/providers/twitter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"twitter.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/twitter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAY,MAAM,aAAa,CAAC;AAM3D,eAAO,MAAM,eAAe,EAAE,aAuD7B,CAAC"}

package/dist/integrations/providers/twitter.js

@@ -0,0 +1,141 @@
+/**
+ * Twitter / X OAuth 2.0 Provider with PKCE.
+ *
+ * Endpoints (per https://docs.x.com/fundamentals/authentication/oauth-2-0/user-access-token):
+ *   authorize: https://x.com/i/oauth2/authorize
+ *   token:     https://api.x.com/2/oauth2/token
+ *
+ * PKCE is always required. `client_secret` is OPTIONAL and depends on
+ * the app type registered in the X developer portal:
+ *
+ *   - Public client    → no secret. Token exchange sends `client_id` in
+ *                        the form body; PKCE alone authenticates.
+ *   - Confidential cli → secret is required. Token exchange MUST send
+ *                        `Authorization: Basic base64(client_id:secret)`
+ *                        per the X docs.
+ *
+ * We support both: when `clientSecret` is provided we attach the Basic
+ * header; otherwise we fall through to public-client behaviour.
+ *
+ * Default scopes we request: tweet.read, tweet.write, users.read,
+ * follows.read, follows.write, like.read, like.write, offline.access.
+ * `offline.access` is what grants a refresh_token.
+ */
+import { createHash } from "node:crypto";
+import { ProviderError } from "../../util/errors.js";
+const AUTHORIZE = "https://x.com/i/oauth2/authorize";
+const TOKEN = "https://api.x.com/2/oauth2/token";
+const ME = "https://api.x.com/2/users/me";
+export const twitterProvider = {
+    id: "twitter",
+    usesPKCE: true,
+    authorizeUrl({ clientId, redirectUri, state, pkceVerifier, scopes }) {
+        if (!pkceVerifier)
+            throw new ProviderError("Twitter requires PKCE; verifier missing", "twitter");
+        // Recompute the challenge so callers only need to remember the verifier.
+        const challenge = sha256B64url(pkceVerifier);
+        const url = new URL(AUTHORIZE);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("client_id", clientId);
+        url.searchParams.set("redirect_uri", redirectUri);
+        url.searchParams.set("scope", scopes.join(" "));
+        url.searchParams.set("state", state);
+        url.searchParams.set("code_challenge", challenge);
+        url.searchParams.set("code_challenge_method", "S256");
+        return url.toString();
+    },
+    async exchangeCode({ code, redirectUri, pkceVerifier, clientId, clientSecret }) {
+        if (!pkceVerifier)
+            throw new ProviderError("Twitter requires PKCE verifier for exchange", "twitter");
+        const form = new URLSearchParams({
+            grant_type: "authorization_code",
+            code,
+            // Public clients identify themselves via client_id in the body.
+            // Confidential clients also use Basic auth, but X tolerates having
+            // client_id in both places, so we always include it.
+            client_id: clientId,
+            redirect_uri: redirectUri,
+            code_verifier: pkceVerifier,
+        });
+        const resp = await fetch(TOKEN, {
+            method: "POST",
+            headers: tokenAuthHeaders(clientId, clientSecret),
+            body: form.toString(),
+        });
+        const json = await readTokenResponse(resp, "exchange");
+        const tokenSet = await enrichWithIdentity(json);
+        return tokenSet;
+    },
+    async refresh({ refreshToken, clientId, clientSecret }) {
+        const form = new URLSearchParams({
+            grant_type: "refresh_token",
+            refresh_token: refreshToken,
+            client_id: clientId,
+        });
+        const resp = await fetch(TOKEN, {
+            method: "POST",
+            headers: tokenAuthHeaders(clientId, clientSecret),
+            body: form.toString(),
+        });
+        const json = await readTokenResponse(resp, "refresh");
+        return enrichWithIdentity(json);
+    },
+};
+/**
+ * Build the headers for a token-endpoint request. Confidential clients
+ * (clientSecret present) get an HTTP Basic auth header; public clients
+ * just send the form-encoded body.
+ */
+function tokenAuthHeaders(clientId, clientSecret) {
+    const headers = {
+        "Content-Type": "application/x-www-form-urlencoded",
+    };
+    if (clientSecret) {
+        const basic = Buffer.from(`${clientId}:${clientSecret}`).toString("base64");
+        headers["Authorization"] = `Basic ${basic}`;
+    }
+    return headers;
+}
+async function readTokenResponse(resp, phase) {
+    if (!resp.ok) {
+        const body = await resp.text().catch(() => "");
+        throw new ProviderError(`Twitter token ${phase} ${resp.status}: ${body.slice(0, 300)}`, "twitter");
+    }
+    return (await resp.json());
+}
+async function enrichWithIdentity(json) {
+    const accessToken = String(json["access_token"] ?? "");
+    const refreshToken = typeof json["refresh_token"] === "string" ? json["refresh_token"] : undefined;
+    const expiresIn = Number(json["expires_in"] ?? 0);
+    const expiresAt = expiresIn > 0 ? Math.floor(Date.now() / 1000) + expiresIn : 0;
+    const scopes = typeof json["scope"] === "string"
+        ? json["scope"].split(" ").filter(Boolean)
+        : [];
+    // Fetch the authenticated user so we can label the connection.
+    let accountId = "";
+    let accountLabel = "Twitter account";
+    try {
+        const me = await fetch(ME, { headers: { Authorization: `Bearer ${accessToken}` } });
+        if (me.ok) {
+            const body = (await me.json());
+            const d = body.data ?? {};
+            accountId = String(d.id ?? "");
+            accountLabel = d.username ? `@${d.username}` : d.name ?? accountLabel;
+        }
+    }
+    catch { /* non-fatal */ }
+    return {
+        accessToken,
+        ...(refreshToken ? { refreshToken } : {}),
+        expiresAt,
+        scopes,
+        accountId,
+        accountLabel,
+        raw: json,
+    };
+}
+function sha256B64url(input) {
+    return createHash("sha256").update(input).digest("base64")
+        .replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+//# sourceMappingURL=twitter.js.map

package/dist/integrations/providers/twitter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"twitter.js","sourceRoot":"","sources":["../../../src/integrations/providers/twitter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrD,MAAM,SAAS,GAAG,kCAAkC,CAAC;AACrD,MAAM,KAAK,GAAG,kCAAkC,CAAC;AACjD,MAAM,EAAE,GAAG,8BAA8B,CAAC;AAE1C,MAAM,CAAC,MAAM,eAAe,GAAkB;IAC5C,EAAE,EAAE,SAAS;IACb,QAAQ,EAAE,IAAI;IAEd,YAAY,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE;QACjE,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,aAAa,CAAC,yCAAyC,EAAE,SAAS,CAAC,CAAC;QACjG,yEAAyE;QACzE,MAAM,SAAS,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC5C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAChD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QACtD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE;QAC5E,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,aAAa,CAAC,6CAA6C,EAAE,SAAS,CAAC,CAAC;QACrG,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,gEAAgE;YAChE,mEAAmE;YACnE,qDAAqD;YACrD,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,WAAW;YACzB,aAAa,EAAE,YAAY;SAC5B,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE;YAC9B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,gBAAgB,CAAC,QAAQ,EAAE,YAAY,CAAC;YACjD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAChD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE;QACpD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;YAC3B,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE;YAC9B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,gBAAgB,CAAC,QAAQ,EAAE,YAAY,CAAC;YACjD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACtD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;CACF,CAAC;AAEF;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,QAAgB,EAAE,YAAgC;IAC1E,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,mCAAmC;KACpD,CAAC;IACF,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC5E,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,KAAK,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,IAAc,EAAE,KAAa;IAC5D,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,IAAI,aAAa,CAAC,iBAAiB,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,IAA6B;IAC7D,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,eAAe,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/G,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAChF,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ;QAC9C,CAAC,CAAE,IAAI,CAAC,OAAO,CAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QACtD,CAAC,CAAC,EAAE,CAAC;IAEP,+DAA+D;IAC/D,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,YAAY,GAAG,iBAAiB,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;QACpF,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAiE,CAAC;YAC/F,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;YAC1B,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/B,YAAY,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,YAAY,CAAC;QACxE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IAE3B,OAAO;QACL,WAAW;QACX,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,SAAS;QACT,MAAM;QACN,SAAS;QACT,YAAY;QACZ,GAAG,EAAE,IAAI;KACV,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;SACvD,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAChE,CAAC"}

package/dist/integrations/reddit/RedditClient.d.ts

@@ -0,0 +1,18 @@
+/**
+ * RedditClient — thin wrapper over Reddit's oauth.reddit.com surface.
+ *
+ * Reddit strongly requires a descriptive User-Agent; without one
+ * requests get rate-limited hard. We set `daemora/1.0` on every call.
+ *
+ * Submit / comment / vote / save endpoints all take form-urlencoded
+ * bodies, not JSON — the helper methods below handle that.
+ */
+import type { IntegrationManager } from "../IntegrationManager.js";
+export declare class RedditClient {
+    private readonly integrations;
+    constructor(integrations: IntegrationManager);
+    request<T>(path: string, init?: RequestInit): Promise<T>;
+    /** POST a form-urlencoded body — Reddit's write endpoints expect this, not JSON. */
+    form<T>(path: string, params: Record<string, string | number | boolean>): Promise<T>;
+}
+//# sourceMappingURL=RedditClient.d.ts.map

package/dist/integrations/reddit/RedditClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RedditClient.d.ts","sourceRoot":"","sources":["../../../src/integrations/reddit/RedditClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAKnE,qBAAa,YAAY;IACX,OAAO,CAAC,QAAQ,CAAC,YAAY;gBAAZ,YAAY,EAAE,kBAAkB;IAEvD,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,CAAC,CAAC;IA4BlE,oFAAoF;IAC9E,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAS3F"}

package/dist/integrations/reddit/RedditClient.js

@@ -0,0 +1,54 @@
+/**
+ * RedditClient — thin wrapper over Reddit's oauth.reddit.com surface.
+ *
+ * Reddit strongly requires a descriptive User-Agent; without one
+ * requests get rate-limited hard. We set `daemora/1.0` on every call.
+ *
+ * Submit / comment / vote / save endpoints all take form-urlencoded
+ * bodies, not JSON — the helper methods below handle that.
+ */
+import { ProviderError } from "../../util/errors.js";
+import { authFetch } from "../authFetch.js";
+const API = "https://oauth.reddit.com";
+const USER_AGENT = "daemora/1.0 (by /u/daemora)";
+export class RedditClient {
+    integrations;
+    constructor(integrations) {
+        this.integrations = integrations;
+    }
+    async request(path, init = {}) {
+        const resp = await authFetch(this.integrations, "reddit", (token) => fetch(`${API}${path}`, {
+            ...init,
+            headers: {
+                Authorization: `Bearer ${token}`,
+                "User-Agent": USER_AGENT,
+                ...(init.headers ?? {}),
+            },
+        }));
+        if (!resp.ok) {
+            const body = await resp.text().catch(() => "");
+            if (resp.status === 401) {
+                throw new ProviderError(`Reddit auth failed after refresh (${resp.status}). Reconnect in Settings → Integrations. ${body.slice(0, 200)}`, "reddit");
+            }
+            if (resp.status === 429) {
+                throw new ProviderError(`Reddit rate-limited (429). Retry-After: ${resp.headers.get("retry-after") ?? "unknown"}`, "reddit");
+            }
+            throw new ProviderError(`Reddit ${resp.status} ${path}: ${body.slice(0, 300)}`, "reddit");
+        }
+        if (resp.status === 204)
+            return {};
+        return (await resp.json());
+    }
+    /** POST a form-urlencoded body — Reddit's write endpoints expect this, not JSON. */
+    async form(path, params) {
+        const body = new URLSearchParams();
+        for (const [k, v] of Object.entries(params))
+            body.set(k, String(v));
+        return this.request(path, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: body.toString(),
+        });
+    }
+}
+//# sourceMappingURL=RedditClient.js.map

package/dist/integrations/reddit/RedditClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RedditClient.js","sourceRoot":"","sources":["../../../src/integrations/reddit/RedditClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAG5C,MAAM,GAAG,GAAG,0BAA0B,CAAC;AACvC,MAAM,UAAU,GAAG,6BAA6B,CAAC;AAEjD,MAAM,OAAO,YAAY;IACM;IAA7B,YAA6B,YAAgC;QAAhC,iBAAY,GAAZ,YAAY,CAAoB;IAAG,CAAC;IAEjE,KAAK,CAAC,OAAO,CAAI,IAAY,EAAE,OAAoB,EAAE;QACnD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAClE,KAAK,CAAC,GAAG,GAAG,GAAG,IAAI,EAAE,EAAE;YACrB,GAAG,IAAI;YACP,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,YAAY,EAAE,UAAU;gBACxB,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;aACxB;SACF,CAAC,CACH,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxB,MAAM,IAAI,aAAa,CACrB,qCAAqC,IAAI,CAAC,MAAM,4CAA4C,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAChH,QAAQ,CACT,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxB,MAAM,IAAI,aAAa,CAAC,2CAA2C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,SAAS,EAAE,EAAE,QAAQ,CAAC,CAAC;YAC/H,CAAC;YACD,MAAM,IAAI,aAAa,CAAC,UAAU,IAAI,CAAC,MAAM,IAAI,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAO,CAAC;QACxC,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAM,CAAC;IAClC,CAAC;IAED,oFAAoF;IACpF,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,MAAiD;QAC3E,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC,OAAO,CAAI,IAAI,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/integrations/reddit/tools.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Reddit tools exposed to the `reddit-crew`.
+ *
+ * Reddit's automation rules vary by subreddit — many ban LLM-written
+ * content. The reddit-crew's system prompt owns the ToS guardrails;
+ * these tools trust the crew to have checked subreddit rules before
+ * calling anything that posts.
+ *
+ * Coverage from Reddit API docs:
+ *   identity (me), subreddit search, subreddit listing, submit,
+ *   comment, reply, vote, save/unsave, user posts, subscribe, inbox.
+ */
+import type { ToolDef } from "../../tools/types.js";
+import type { IntegrationManager } from "../IntegrationManager.js";
+export declare function makeRedditTools(integrations: IntegrationManager): readonly ToolDef[];
+//# sourceMappingURL=tools.d.ts.map

package/dist/integrations/reddit/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../../src/integrations/reddit/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAGnE,wBAAgB,eAAe,CAAC,YAAY,EAAE,kBAAkB,GAAG,SAAS,OAAO,EAAE,CA2TpF"}