google-services-mcp 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Nabheet S. Sandhu
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,225 @@
+# google-services-mcp
+
+MCP (Model Context Protocol) server that gives AI agents direct access to your
+Google services — **Gmail, Calendar, Google Meet, Drive, Contacts, Tasks,
+Sheets, Docs, Slides, YouTube, and Forms** — with multi-account OAuth support.
+
+Add one account, wire the server into any MCP-compatible AI client, and your
+agent can read and send email, manage your calendar, find files in Drive,
+create documents and spreadsheets, and more — using your real Google data.
+
+## Features
+
+- **Gmail** — send, list, read, modify, and reply to messages
+- **Calendar** — list calendars, create/read/update/delete events, create Google Meet links
+- **Drive** — list, read, upload, update, delete, and share files
+- **Contacts** — list, search, and create contacts
+- **Tasks** — list task lists, create/complete/delete tasks
+- **Sheets** — create spreadsheets, read/write/append cell ranges, batch update
+- **Docs** — create documents, read text, insert/replace text, batch update
+- **Slides** — create presentations, add/delete slides, find-and-replace text
+- **YouTube** — search videos, manage uploads/playlists/subscriptions
+- **Forms** — create forms, add questions, read responses
+- **Multi-account** — connect several Google accounts, set a default, or pass an `account` argument to any tool
+- **OAuth 2.0** — one-time browser authorization; tokens are stored locally and refreshed automatically
+
+> **60 tools** across 11 services, all prefixed `google_`. Full reference:
+> [docs/TOOLS.md](docs/TOOLS.md).
+
+## Requirements
+
+- Node.js **18+**
+- A Google Cloud project with the required APIs enabled and an OAuth 2.0
+  **Desktop app** client (one-time setup, ~10 minutes — see below)
+
+## Install
+
+```bash
+npm install -g google-services-mcp
+```
+
+> **Note:** until the first public release lands on npm, install from source
+> instead — see [Local development](#local-development).
+
+## Quick start
+
+1. **Add a Google account** — opens your browser for one-time authorization:
+
+   ```bash
+   google-services-mcp add personal
+   ```
+
+2. **Register the server** with your MCP client (see
+   [MCP client configuration](#mcp-client-configuration) for Claude Desktop,
+   opencode, and generic configs).
+
+3. **Start using it** — ask your agent to "check my email" or "add an event to
+   my calendar". Or add more accounts any time: `google-services-mcp add work`.
+
+## MCP client configuration
+
+The server speaks MCP over stdio. Point your client at the `google-services-mcp`
+executable and pass your OAuth credentials via environment variables.
+
+### opencode
+
+In `opencode.json` (or your global config):
+
+```json
+{
+  "mcp": {
+    "google-services-mcp": {
+      "type": "local",
+      "command": ["google-services-mcp"],
+      "enabled": true,
+      "environment": {
+        "GOOGLE_MCP_CLIENT_ID": "your-client-id",
+        "GOOGLE_MCP_CLIENT_SECRET": "your-client-secret"
+      }
+    }
+  }
+}
+```
+
+### Claude Desktop / Cursor / other MCP clients
+
+In the client's MCP settings file (e.g. `claude_desktop_config.json`):
+
+```json
+{
+  "mcpServers": {
+    "google-services-mcp": {
+      "command": "google-services-mcp",
+      "env": {
+        "GOOGLE_MCP_CLIENT_ID": "your-client-id",
+        "GOOGLE_MCP_CLIENT_SECRET": "your-client-secret"
+      }
+    }
+  }
+}
+```
+
+## Google Cloud setup (one-time)
+
+Each installation uses its own OAuth client — credentials are per-user and
+never shared.
+
+### 1. Create a project
+
+Open the [Google Cloud Console](https://console.cloud.google.com/), choose
+**Select a project → New Project**, and name it (e.g. `google-services-mcp`).
+
+### 2. Configure the OAuth consent screen
+
+**APIs & Services → OAuth consent screen**:
+
+1. User type: **External** (required for regular Google accounts).
+2. App name: anything you like (e.g. `Google Service MCP`); support email = yours.
+3. Under **Audience → Test users**, click **Add users** and enter **every Google
+   account that will use this server**. While the app is in Testing mode,
+   accounts not on this list get `access blocked` on the consent screen.
+
+### 3. Enable the required APIs
+
+**APIs & Services → Library**, search and **Enable** each:
+
+`Gmail API` · `Google Calendar API` · `Google Drive API` · `People API` ·
+`Google Tasks API` · `Google Sheets API` · `Google Docs API` ·
+`Google Slides API` · `YouTube Data API v3` · `Google Forms API`
+
+### 4. Create OAuth client credentials
+
+**APIs & Services → Credentials → Create Credentials → OAuth client ID**:
+
+1. Application type: **Desktop app**.
+2. Authorized redirect URIs: `http://localhost:8787`.
+3. Copy the **Client ID** and **Client Secret**.
+
+### 5. Provide the credentials
+
+Set these environment variables (or put them in your MCP client config as
+above):
+
+```
+GOOGLE_MCP_CLIENT_ID=<your-oauth-client-id>
+GOOGLE_MCP_CLIENT_SECRET=<your-oauth-client-secret>
+```
+
+Optional:
+
+```
+GOOGLE_MCP_DIR=~/.google-services-mcp   # where config and tokens live (default ~/.google-services-mcp)
+GOOGLE_MCP_REDIRECT_PORT=8787          # local loopback port for OAuth (default 8787)
+# Full redirect URI override. Takes precedence over REDIRECT_PORT and must
+# exactly match a URI registered for this OAuth client in the Cloud Console.
+# GOOGLE_MCP_REDIRECT_URI=http://127.0.0.1:8787/oauth2callback
+```
+
+### 6. Connect your first account
+
+```bash
+google-services-mcp add personal
+```
+
+A browser opens to the Google consent screen. After you approve, the account is
+stored in `~/.google-services-mcp/accounts/` and ready to use. Repeat with a
+different name (e.g. `work`) to connect more accounts.
+
+## CLI reference
+
+```
+google-services-mcp                     # run the MCP server over stdio
+google-services-mcp add <name>          # add a Google account (opens browser)
+google-services-mcp list                # list connected accounts
+google-services-mcp remove <name>       # remove an account
+google-services-mcp set-default <name>  # set the default account
+google-services-mcp status              # show config and token health
+google-services-mcp --help              # show help
+```
+
+## For AI agents
+
+- All tools are prefixed `google_`, e.g. `google_gmail_list`,
+  `google_calendar_list_events`, `google_drive_list_files`.
+- The `account` argument selects which connected account a tool uses;
+  omit it to use the default account.
+- Agents can connect new accounts themselves via the **`account_add`** tool —
+  it opens the browser consent flow without needing the CLI.
+- See [docs/TOOLS.md](docs/TOOLS.md) for the full tool reference.
+
+## Security
+
+- OAuth tokens are stored in `~/.google-services-mcp/accounts/<account-name>.json`
+  with restrictive file permissions. Keep them private — never commit them.
+- The server never logs tokens or credentials.
+- Scopes requested: Gmail modify, Calendar, Drive, Contacts, Tasks, Sheets,
+  Docs, Slides, YouTube, Forms, plus `userinfo.email` for account display.
+- If a client secret is ever exposed, rotate it in the Google Cloud Console
+  (Credentials → your OAuth client → rotate secret).
+
+## Troubleshooting
+
+| Symptom | Cause / fix |
+|---|---|
+| `access blocked` on consent | Account not in **Test users** (setup step 2.3) — add it and retry |
+| `redirect_uri_mismatch` | Redirect URI must be exactly `http://localhost:8787` — no trailing slash — and match what your OAuth client allows |
+| Tokens stop working after ~7 days | App is in **Testing** mode — re-run `add`, or **Publish app** on the consent screen |
+| `Google hasn't verified this app` | Normal for unverified apps — click **Advanced → Continue** for personal use |
+
+## Local development
+
+```bash
+git clone https://github.com/nabheet/google-services-mcp.git
+cd google-services-mcp
+npm install
+npm run build        # compile to dist/
+npm test             # vitest, TDD suites
+npm run typecheck    # tsc --noEmit
+npm run dev          # run from source with tsx
+```
+
+See [AGENTS.md](AGENTS.md) for architecture and conventions.
+
+## License
+
+MIT

package/dist/auth/config.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Configuration for the OAuth client and server defaults.
+ *
+ * Credentials come from (in order of precedence):
+ *   1. Environment variables GOOGLE_MCP_CLIENT_ID / GOOGLE_MCP_CLIENT_SECRET
+ *   2. The config file at <dir>/config.json
+ *
+ * The data directory defaults to ~/.google-services-mcp and can be overridden with
+ * GOOGLE_MCP_DIR.
+ */
+export declare const DEFAULT_REDIRECT_PORT = 8787;
+/** Scopes requested when adding an account. Covers all services this server exposes. */
+export declare const DEFAULT_SCOPES: string[];
+export interface Config {
+    clientId: string;
+    clientSecret: string;
+    /** Loopback port used during the OAuth redirect. Default 8787. Ignored when redirectUri is set. */
+    redirectPort?: number;
+    /**
+     * Full redirect URI registered with Google, e.g. "http://127.0.0.1:8787/oauth2callback".
+     * Takes precedence over redirectPort and must exactly match what is registered for
+     * this OAuth client in the Google Cloud Console.
+     */
+    redirectUri?: string;
+    /** Account used when tools are called without an explicit `account`. */
+    defaultAccount?: string;
+    /** Override the scope list requested at authorization time. */
+    scopes?: string[];
+}
+export declare function getDataDir(): string;
+export declare function getConfigPath(): string;
+export declare function getAccountsDir(): string;
+export declare function getAccountPath(name: string): string;
+export declare function sanitizeName(name: string): string;
+export declare function isValidName(name: string): boolean;
+export declare function ensureDirs(): Promise<void>;
+export declare function loadConfig(): Promise<Config>;
+export declare function saveConfig(config: Config): Promise<void>;
+export declare function saveClientCredentials(clientId: string, clientSecret: string): Promise<void>;
+export declare function hasCredentials(config: Config): boolean;
+/** Location of this package's root (for README links etc.). */
+export declare function getPackageRoot(): string;
+//# sourceMappingURL=config.d.ts.map

package/dist/auth/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/auth/config.ts"],"names":[],"mappings":"AAKA;;;;;;;;;GASG;AAEH,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAE1C,wFAAwF;AACxF,eAAO,MAAM,cAAc,EAAE,MAAM,EAuBlC,CAAC;AAEF,MAAM,WAAW,MAAM;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,mGAAmG;IACnG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMjD;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED,wBAAsB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAEhD;AAED,wBAAsB,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,CAwBlD;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ9D;AAED,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKjG;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED,+DAA+D;AAC/D,wBAAgB,cAAc,IAAI,MAAM,CAEvC"}

package/dist/auth/config.js

@@ -0,0 +1,108 @@
+import os from "node:os";
+import path from "node:path";
+import fs from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+/**
+ * Configuration for the OAuth client and server defaults.
+ *
+ * Credentials come from (in order of precedence):
+ *   1. Environment variables GOOGLE_MCP_CLIENT_ID / GOOGLE_MCP_CLIENT_SECRET
+ *   2. The config file at <dir>/config.json
+ *
+ * The data directory defaults to ~/.google-services-mcp and can be overridden with
+ * GOOGLE_MCP_DIR.
+ */
+export const DEFAULT_REDIRECT_PORT = 8787;
+/** Scopes requested when adding an account. Covers all services this server exposes. */
+export const DEFAULT_SCOPES = [
+    // Gmail: read, send, and modify (labels/trash) — not permanent delete
+    "https://www.googleapis.com/auth/gmail.modify",
+    // Calendar + Google Meet (conferenceData on events)
+    "https://www.googleapis.com/auth/calendar",
+    // Drive: full access to the user's Drive
+    "https://www.googleapis.com/auth/drive",
+    // Contacts (read/write)
+    "https://www.googleapis.com/auth/contacts",
+    // Tasks
+    "https://www.googleapis.com/auth/tasks",
+    // Sheets: read/write spreadsheets
+    "https://www.googleapis.com/auth/spreadsheets",
+    // Docs: read/write documents
+    "https://www.googleapis.com/auth/documents",
+    // Slides: read/write presentations
+    "https://www.googleapis.com/auth/presentations",
+    // YouTube: read/write the user's channel data and playlists
+    "https://www.googleapis.com/auth/youtube",
+    // Forms: read/write forms and responses
+    "https://www.googleapis.com/auth/forms",
+    // Identity: lets fetchUserInfo return the signed-in email for account display
+    "https://www.googleapis.com/auth/userinfo.email",
+];
+export function getDataDir() {
+    return process.env.GOOGLE_MCP_DIR || path.join(os.homedir(), ".google-services-mcp");
+}
+export function getConfigPath() {
+    return path.join(getDataDir(), "config.json");
+}
+export function getAccountsDir() {
+    return path.join(getDataDir(), "accounts");
+}
+export function getAccountPath(name) {
+    return path.join(getAccountsDir(), `${sanitizeName(name)}.json`);
+}
+export function sanitizeName(name) {
+    const cleaned = name.replace(/[^a-zA-Z0-9_-]/g, "_").toLowerCase();
+    if (!/[a-zA-Z0-9]/.test(cleaned)) {
+        throw new Error("Account name must contain at least one alphanumeric character.");
+    }
+    return cleaned;
+}
+export function isValidName(name) {
+    return /^[a-zA-Z0-9_-]+$/.test(name);
+}
+export async function ensureDirs() {
+    await fs.mkdir(getAccountsDir(), { recursive: true });
+}
+export async function loadConfig() {
+    await ensureDirs();
+    let file = {};
+    try {
+        const raw = await fs.readFile(getConfigPath(), "utf8");
+        file = JSON.parse(raw);
+    }
+    catch {
+        // No config file yet — env vars may still provide credentials.
+    }
+    const envId = process.env.GOOGLE_MCP_CLIENT_ID;
+    const envSecret = process.env.GOOGLE_MCP_CLIENT_SECRET;
+    const envPort = process.env.GOOGLE_MCP_REDIRECT_PORT;
+    const envUri = process.env.GOOGLE_MCP_REDIRECT_URI;
+    const config = {
+        clientId: envId || file.clientId || "",
+        clientSecret: envSecret || file.clientSecret || "",
+        redirectPort: envPort ? Number(envPort) : file.redirectPort || DEFAULT_REDIRECT_PORT,
+        redirectUri: envUri || file.redirectUri || undefined,
+        defaultAccount: file.defaultAccount,
+        scopes: file.scopes || DEFAULT_SCOPES,
+    };
+    return config;
+}
+export async function saveConfig(config) {
+    await ensureDirs();
+    const { clientId, clientSecret, redirectPort, redirectUri, defaultAccount, scopes } = config;
+    await fs.writeFile(getConfigPath(), JSON.stringify({ clientId, clientSecret, redirectPort, redirectUri, defaultAccount, scopes }, null, 2), "utf8");
+}
+export async function saveClientCredentials(clientId, clientSecret) {
+    const config = await loadConfig();
+    config.clientId = clientId || config.clientId;
+    config.clientSecret = clientSecret || config.clientSecret;
+    await saveConfig(config);
+}
+export function hasCredentials(config) {
+    return Boolean(config.clientId && config.clientSecret);
+}
+/** Location of this package's root (for README links etc.). */
+export function getPackageRoot() {
+    return path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+}
+//# sourceMappingURL=config.js.map

package/dist/auth/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/auth/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;;;;;GASG;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAE1C,wFAAwF;AACxF,MAAM,CAAC,MAAM,cAAc,GAAa;IACtC,sEAAsE;IACtE,8CAA8C;IAC9C,oDAAoD;IACpD,0CAA0C;IAC1C,yCAAyC;IACzC,uCAAuC;IACvC,wBAAwB;IACxB,0CAA0C;IAC1C,QAAQ;IACR,uCAAuC;IACvC,kCAAkC;IAClC,8CAA8C;IAC9C,6BAA6B;IAC7B,2CAA2C;IAC3C,mCAAmC;IACnC,+CAA+C;IAC/C,4DAA4D;IAC5D,yCAAyC;IACzC,wCAAwC;IACxC,uCAAuC;IACvC,8EAA8E;IAC9E,gDAAgD;CACjD,CAAC;AAmBF,MAAM,UAAU,UAAU;IACxB,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,sBAAsB,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,aAAa,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,UAAU,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACnE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,UAAU,EAAE,CAAC;IACnB,IAAI,IAAI,GAAoB,EAAE,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,CAAC,CAAC;QACvD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;IACjE,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;IACvD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IAEnD,MAAM,MAAM,GAAW;QACrB,QAAQ,EAAE,KAAK,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE;QACtC,YAAY,EAAE,SAAS,IAAI,IAAI,CAAC,YAAY,IAAI,EAAE;QAClD,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,IAAI,qBAAqB;QACpF,WAAW,EAAE,MAAM,IAAI,IAAI,CAAC,WAAW,IAAI,SAAS;QACpD,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,cAAc;KACtC,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAc;IAC7C,MAAM,UAAU,EAAE,CAAC;IACnB,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC7F,MAAM,EAAE,CAAC,SAAS,CAChB,aAAa,EAAE,EACf,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EACtG,MAAM,CACP,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,QAAgB,EAAE,YAAoB;IAChF,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,MAAM,CAAC,QAAQ,GAAG,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC;IAC9C,MAAM,CAAC,YAAY,GAAG,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC;IAC1D,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,OAAO,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC;AACzD,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC"}

package/dist/auth/manager.d.ts

@@ -0,0 +1,50 @@
+import { Auth } from "googleapis";
+import { type Config } from "./config.js";
+import { type StoredAccount } from "./store.js";
+export interface AddAccountOptions {
+    /** Set to false to skip opening the browser (headless). */
+    openBrowser?: boolean;
+    /** Milliseconds to wait for the OAuth callback before failing. Default 5 minutes. */
+    timeoutMs?: number;
+}
+export interface AccountStatus {
+    name: string;
+    email?: string;
+    expiresAt?: number;
+    tokenHealthy: boolean;
+    scopes: string[];
+}
+export interface ServerStatus {
+    credentialsConfigured: boolean;
+    dataDir: string;
+    defaultAccount?: string;
+    accounts: AccountStatus[];
+}
+/**
+ * Coordinates credentials, per-account token storage, the interactive OAuth
+ * flow, and refresh. All service modules resolve auth through here.
+ */
+declare class AuthManager {
+    getConfig(): Promise<Config>;
+    listAccounts(): Promise<StoredAccount[]>;
+    /**
+     * Resolve an account to use for a tool call.
+     * Priority: explicit name -> configured default -> sole account.
+     */
+    resolveAccount(name?: string): Promise<StoredAccount>;
+    /** Get an authenticated googleapis OAuth2 client, refreshing first if needed. */
+    getClient(name?: string): Promise<Auth.OAuth2Client>;
+    /**
+     * Run the interactive OAuth flow to add a new account: opens the consent
+     * screen, waits for the loopback callback, exchanges the code, and persists
+     * the account alongside the signed-in email.
+     */
+    addAccount(name: string, options?: AddAccountOptions): Promise<StoredAccount>;
+    removeAccount(name: string): Promise<boolean>;
+    setDefaultAccount(name: string): Promise<void>;
+    saveCredentials(clientId: string, clientSecret: string): Promise<void>;
+    getStatus(): Promise<ServerStatus>;
+}
+export declare const authManager: AuthManager;
+export {};
+//# sourceMappingURL=manager.d.ts.map

package/dist/auth/manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../src/auth/manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,IAAI,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAML,KAAK,MAAM,EACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAA4D,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAY1G,MAAM,WAAW,iBAAiB;IAChC,2DAA2D;IAC3D,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,qFAAqF;IACrF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED;;;GAGG;AACH,cAAM,WAAW;IACT,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC;IAI5B,YAAY,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;IAI9C;;;OAGG;IACG,cAAc,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IA0B3D,iFAAiF;IAC3E,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC;IAwB1D;;;;OAIG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,aAAa,CAAC;IA6CjF,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI7C,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU9C,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAItE,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC;CAgBzC;AAED,eAAO,MAAM,WAAW,aAAoB,CAAC"}

package/dist/auth/manager.js

@@ -0,0 +1,140 @@
+import { google } from "googleapis";
+import { loadConfig, saveConfig, saveClientCredentials, hasCredentials, getDataDir, } from "./config.js";
+import { loadAccount, loadAllAccounts, saveAccount, deleteAccount } from "./store.js";
+import { buildAuthUrl, waitForOAuthCallback, exchangeCode, refreshAccessToken, fetchUserInfo, openBrowser, generateState, DEFAULT_AUTH_TIMEOUT_MS, } from "./oauth.js";
+/**
+ * Coordinates credentials, per-account token storage, the interactive OAuth
+ * flow, and refresh. All service modules resolve auth through here.
+ */
+class AuthManager {
+    async getConfig() {
+        return loadConfig();
+    }
+    async listAccounts() {
+        return loadAllAccounts();
+    }
+    /**
+     * Resolve an account to use for a tool call.
+     * Priority: explicit name -> configured default -> sole account.
+     */
+    async resolveAccount(name) {
+        const accounts = await loadAllAccounts();
+        if (name) {
+            const found = accounts.find((a) => a.name === name);
+            if (!found) {
+                const available = accounts.length ? accounts.map((a) => a.name).join(", ") : "none";
+                throw new Error(`Account "${name}" not found. Available accounts: ${available}`);
+            }
+            return found;
+        }
+        if (accounts.length === 0) {
+            throw new Error("No Google accounts configured. Add one with the account_add tool or run: google-services-mcp add <name>");
+        }
+        const config = await this.getConfig();
+        if (config.defaultAccount) {
+            const found = accounts.find((a) => a.name === config.defaultAccount);
+            if (found)
+                return found;
+        }
+        if (accounts.length === 1)
+            return accounts[0];
+        throw new Error(`Multiple accounts configured but no default set. Pass account="..." or run: google-services-mcp set-default <name>`);
+    }
+    /** Get an authenticated googleapis OAuth2 client, refreshing first if needed. */
+    async getClient(name) {
+        const config = await this.getConfig();
+        let account = await this.resolveAccount(name);
+        if (account.expiryDate && Date.now() > account.expiryDate - 60_000) {
+            const tokens = await refreshAccessToken(config, account.refreshToken);
+            account = {
+                ...account,
+                accessToken: tokens.accessToken,
+                refreshToken: tokens.refreshToken ?? account.refreshToken,
+                expiryDate: tokens.expiryDate,
+            };
+            await saveAccount(account);
+        }
+        const client = new google.auth.OAuth2(config.clientId, config.clientSecret);
+        client.setCredentials({
+            access_token: account.accessToken,
+            refresh_token: account.refreshToken,
+            expiry_date: account.expiryDate,
+        });
+        return client;
+    }
+    /**
+     * Run the interactive OAuth flow to add a new account: opens the consent
+     * screen, waits for the loopback callback, exchanges the code, and persists
+     * the account alongside the signed-in email.
+     */
+    async addAccount(name, options = {}) {
+        const config = await this.getConfig();
+        if (!hasCredentials(config)) {
+            throw new Error("Google OAuth credentials are not configured. Set GOOGLE_MCP_CLIENT_ID and " +
+                "GOOGLE_MCP_CLIENT_SECRET (or add them to config.json) first.");
+        }
+        const state = generateState();
+        const authUrl = buildAuthUrl(config, state);
+        const timeoutMs = options.timeoutMs ?? DEFAULT_AUTH_TIMEOUT_MS;
+        // The callback owns its timeout so an aborted flow always closes the
+        // loopback listener (no stale port left behind).
+        const callbackPromise = waitForOAuthCallback(config, state, { timeoutMs });
+        if (options.openBrowser !== false) {
+            try {
+                await openBrowser(authUrl);
+            }
+            catch {
+                // Browser unavailable (headless server) — the error message carries the URL.
+                throw new Error(`Could not open a browser. Open this URL manually to authorize "${name}": ${authUrl}`);
+            }
+        }
+        const callback = await callbackPromise;
+        const tokens = await exchangeCode(config, callback.code);
+        const user = await fetchUserInfo(tokens.accessToken);
+        const account = {
+            name,
+            email: user.email,
+            accessToken: tokens.accessToken,
+            refreshToken: tokens.refreshToken ?? "",
+            expiryDate: tokens.expiryDate,
+            scopes: config.scopes ?? [],
+            createdAt: new Date().toISOString(),
+        };
+        await saveAccount(account);
+        return account;
+    }
+    async removeAccount(name) {
+        return deleteAccount(name);
+    }
+    async setDefaultAccount(name) {
+        const config = await this.getConfig();
+        if (name) {
+            const exists = await loadAccount(name);
+            if (!exists)
+                throw new Error(`Cannot set default: account "${name}" does not exist.`);
+        }
+        config.defaultAccount = name || undefined;
+        await saveConfig(config);
+    }
+    async saveCredentials(clientId, clientSecret) {
+        await saveClientCredentials(clientId, clientSecret);
+    }
+    async getStatus() {
+        const config = await this.getConfig();
+        const accounts = await loadAllAccounts();
+        return {
+            credentialsConfigured: hasCredentials(config),
+            dataDir: getDataDir(),
+            defaultAccount: config.defaultAccount,
+            accounts: accounts.map((a) => ({
+                name: a.name,
+                email: a.email,
+                expiresAt: a.expiryDate,
+                tokenHealthy: !a.expiryDate || Date.now() < a.expiryDate,
+                scopes: a.scopes,
+            })),
+        };
+    }
+}
+export const authManager = new AuthManager();
+//# sourceMappingURL=manager.js.map

package/dist/auth/manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/auth/manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAQ,MAAM,YAAY,CAAC;AAC1C,OAAO,EACL,UAAU,EACV,UAAU,EACV,qBAAqB,EACrB,cAAc,EACd,UAAU,GAEX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,EAAE,aAAa,EAAsB,MAAM,YAAY,CAAC;AAC1G,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,WAAW,EACX,aAAa,EACb,uBAAuB,GACxB,MAAM,YAAY,CAAC;AAwBpB;;;GAGG;AACH,MAAM,WAAW;IACf,KAAK,CAAC,SAAS;QACb,OAAO,UAAU,EAAE,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,OAAO,eAAe,EAAE,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAAC,IAAa;QAChC,MAAM,QAAQ,GAAG,MAAM,eAAe,EAAE,CAAC;QACzC,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YACpD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;gBACpF,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,oCAAoC,SAAS,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,yGAAyG,CAC1G,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,cAAc,CAAC,CAAC;YACrE,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,oHAAoH,CACrH,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,SAAS,CAAC,IAAa;QAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,IAAI,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAE9C,IAAI,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,UAAU,GAAG,MAAM,EAAE,CAAC;YACnE,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;YACtE,OAAO,GAAG;gBACR,GAAG,OAAO;gBACV,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY;gBACzD,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B,CAAC;YACF,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5E,MAAM,CAAC,cAAc,CAAC;YACpB,YAAY,EAAE,OAAO,CAAC,WAAW;YACjC,aAAa,EAAE,OAAO,CAAC,YAAY;YACnC,WAAW,EAAE,OAAO,CAAC,UAAU;SAChC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,IAAY,EAAE,UAA6B,EAAE;QAC5D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,4EAA4E;gBAC1E,8DAA8D,CACjE,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC;QAC/D,qEAAqE;QACrE,iDAAiD;QACjD,MAAM,eAAe,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAE3E,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,6EAA6E;gBAC7E,MAAM,IAAI,KAAK,CACb,kEAAkE,IAAI,MAAM,OAAO,EAAE,CACtF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC;QAEvC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAErD,MAAM,OAAO,GAAkB;YAC7B,IAAI;YACJ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;YACvC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;QAC3B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,IAAY;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,mBAAmB,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,CAAC,cAAc,GAAG,IAAI,IAAI,SAAS,CAAC;QAC1C,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,QAAgB,EAAE,YAAoB;QAC1D,MAAM,qBAAqB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,eAAe,EAAE,CAAC;QACzC,OAAO;YACL,qBAAqB,EAAE,cAAc,CAAC,MAAM,CAAC;YAC7C,OAAO,EAAE,UAAU,EAAE;YACrB,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC7B,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,SAAS,EAAE,CAAC,CAAC,UAAU;gBACvB,YAAY,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU;gBACxD,MAAM,EAAE,CAAC,CAAC,MAAM;aACjB,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;CACF;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC"}

package/dist/auth/oauth.d.ts

@@ -0,0 +1,49 @@
+import { type Config } from "./config.js";
+export interface TokenSet {
+    accessToken: string;
+    refreshToken?: string;
+    /** Epoch milliseconds at which the access token expires. */
+    expiryDate?: number;
+}
+/** How long the loopback callback server waits for Google's redirect. */
+export declare const DEFAULT_AUTH_TIMEOUT_MS: number;
+/**
+ * Resolve the redirect URI this server registers with Google. A full
+ * `redirectUri` override wins; otherwise the URI is derived from the loopback
+ * port. The value must exactly match a redirect URI registered for the OAuth
+ * client in the Google Cloud Console.
+ */
+export declare function resolveRedirectUri(config: Config): string;
+/** Build the Google consent-screen URL. */
+export declare function buildAuthUrl(config: Config, state: string): string;
+/** Open a URL in the default browser on the current platform. */
+export declare function openBrowser(url: string): Promise<void>;
+export interface AuthCallback {
+    code: string;
+    state: string;
+}
+/**
+ * Start a loopback HTTP server on the configured redirect URI and wait for
+ * Google to redirect back with an authorization code. Resolves with the code
+ * and state; rejects on CSRF state mismatch, a missing code, a bind failure,
+ * or when `timeoutMs` elapses.
+ *
+ * The listener is always closed once the promise settles, so an aborted or
+ * timed-out flow never leaves a stale port occupied (which would otherwise
+ * cause EADDRINUSE on the next attempt).
+ */
+export declare function waitForOAuthCallback(config: Config, expectedState: string, options?: {
+    timeoutMs?: number;
+}): Promise<AuthCallback>;
+/** Exchange an authorization code for tokens. */
+export declare function exchangeCode(config: Config, code: string): Promise<TokenSet>;
+/** Refresh an expired access token. Keeps the existing refresh token if the provider does not rotate it. */
+export declare function refreshAccessToken(config: Config, refreshToken: string): Promise<TokenSet>;
+/** Best-effort fetch of the signed-in user's profile (email/name). Never throws. */
+export declare function fetchUserInfo(accessToken: string): Promise<{
+    email?: string;
+    name?: string;
+}>;
+/** Generate a random state value for CSRF protection. */
+export declare function generateState(): string;
+//# sourceMappingURL=oauth.d.ts.map