oh-my-claude-sisyphus 1.10.0 → 1.10.2

package/dist/auth/oauth-google.js

@@ -0,0 +1,280 @@
+/**
+ * Google OAuth 2.0 implementation for consumer Google accounts
+ *
+ * Uses the same OAuth flow as Gemini CLI
+ */
+import * as http from 'http';
+import * as net from 'net';
+import { exec } from 'child_process';
+import { URL, URLSearchParams } from 'url';
+import { generatePKCE, verifyState } from './pkce.js';
+/**
+ * Open URL in default browser (cross-platform)
+ */
+function openBrowser(url) {
+    const platform = process.platform;
+    let command;
+    if (platform === 'darwin') {
+        command = `open "${url}"`;
+    }
+    else if (platform === 'win32') {
+        command = `start "" "${url}"`;
+    }
+    else {
+        // Linux and others
+        command = `xdg-open "${url}"`;
+    }
+    exec(command, (error) => {
+        if (error) {
+            console.log('Could not open browser automatically.');
+            console.log(`Please visit: ${url}`);
+        }
+    });
+}
+/**
+ * Google OAuth configuration
+ * These are the same credentials used by Gemini CLI
+ */
+export const GOOGLE_OAUTH_CONFIG = {
+    clientId: '681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com',
+    clientSecret: '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',
+    authUrl: 'https://accounts.google.com/o/oauth2/auth',
+    tokenUrl: 'https://oauth2.googleapis.com/token',
+    redirectUri: 'http://localhost:45289', // Will be updated with dynamic port
+    scopes: ['https://www.googleapis.com/auth/cloud-platform'],
+};
+/**
+ * Find an available port for the OAuth callback
+ */
+async function findAvailablePort(startPort = 45289) {
+    return new Promise((resolve, reject) => {
+        const server = net.createServer();
+        server.unref();
+        server.on('error', (err) => {
+            if (err.code === 'EADDRINUSE') {
+                // Try next port
+                findAvailablePort(startPort + 1).then(resolve).catch(reject);
+            }
+            else {
+                reject(err);
+            }
+        });
+        server.listen(startPort, '127.0.0.1', () => {
+            const address = server.address();
+            server.close(() => resolve(address.port));
+        });
+    });
+}
+/**
+ * Google OAuth handler
+ */
+export class GoogleOAuth {
+    config;
+    constructor(config = GOOGLE_OAUTH_CONFIG) {
+        this.config = config;
+    }
+    /**
+     * Generate the authorization URL for the OAuth flow
+     */
+    getAuthorizationUrl(pkce, redirectUri) {
+        const params = new URLSearchParams({
+            response_type: 'code',
+            client_id: this.config.clientId,
+            redirect_uri: redirectUri,
+            scope: this.config.scopes.join(' '),
+            code_challenge: pkce.codeChallenge,
+            code_challenge_method: 'S256',
+            access_type: 'offline',
+            prompt: 'consent',
+            state: pkce.state,
+        });
+        return `${this.config.authUrl}?${params.toString()}`;
+    }
+    /**
+     * Exchange authorization code for tokens
+     */
+    async exchangeCodeForTokens(code, codeVerifier, redirectUri) {
+        const response = await fetch(this.config.tokenUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+            body: new URLSearchParams({
+                grant_type: 'authorization_code',
+                code,
+                redirect_uri: redirectUri,
+                client_id: this.config.clientId,
+                client_secret: this.config.clientSecret || '',
+                code_verifier: codeVerifier,
+            }),
+        });
+        if (!response.ok) {
+            const error = await response.text();
+            throw new Error(`Token exchange failed: ${error}`);
+        }
+        const data = await response.json();
+        return {
+            accessToken: data.access_token,
+            refreshToken: data.refresh_token,
+            idToken: data.id_token,
+            expiresAt: Date.now() + (data.expires_in * 1000),
+            tokenType: data.token_type,
+        };
+    }
+    /**
+     * Refresh tokens using refresh token
+     */
+    async refreshTokens(refreshToken) {
+        const response = await fetch(this.config.tokenUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+            body: new URLSearchParams({
+                grant_type: 'refresh_token',
+                refresh_token: refreshToken,
+                client_id: this.config.clientId,
+                client_secret: this.config.clientSecret || '',
+            }),
+        });
+        if (!response.ok) {
+            const error = await response.text();
+            throw new Error(`Token refresh failed: ${error}`);
+        }
+        const data = await response.json();
+        return {
+            accessToken: data.access_token,
+            refreshToken: data.refresh_token || refreshToken,
+            idToken: data.id_token,
+            expiresAt: Date.now() + (data.expires_in * 1000),
+            tokenType: data.token_type,
+        };
+    }
+    /**
+     * Get user info from Google
+     */
+    async getUserInfo(accessToken) {
+        try {
+            const response = await fetch('https://www.googleapis.com/oauth2/v2/userinfo', {
+                headers: {
+                    Authorization: `Bearer ${accessToken}`,
+                },
+            });
+            if (response.ok) {
+                const data = await response.json();
+                return { email: data.email };
+            }
+        }
+        catch {
+            // Ignore errors
+        }
+        return {};
+    }
+    /**
+     * Run the full OAuth authentication flow
+     * Opens a browser and waits for callback
+     */
+    async authenticate() {
+        // Find available port
+        const port = await findAvailablePort();
+        const redirectUri = `http://localhost:${port}`;
+        const pkce = generatePKCE();
+        const authUrl = this.getAuthorizationUrl(pkce, redirectUri);
+        return new Promise((resolve) => {
+            const server = http.createServer(async (req, res) => {
+                const url = new URL(req.url, `http://localhost:${port}`);
+                // Handle the root callback (Google redirects to root)
+                if (url.pathname === '/' || url.pathname === '/callback') {
+                    const code = url.searchParams.get('code');
+                    const returnedState = url.searchParams.get('state');
+                    const error = url.searchParams.get('error');
+                    // Handle errors
+                    if (error) {
+                        res.writeHead(400, { 'Content-Type': 'text/html' });
+                        res.end(`
+              <html>
+                <body style="font-family: system-ui; padding: 40px; text-align: center;">
+                  <h1>Authentication Failed</h1>
+                  <p>Error: ${error}</p>
+                  <p>You can close this window.</p>
+                </body>
+              </html>
+            `);
+                        server.close();
+                        resolve({ success: false, error });
+                        return;
+                    }
+                    // Verify state
+                    if (!returnedState || !verifyState(pkce.state, returnedState)) {
+                        res.writeHead(400, { 'Content-Type': 'text/html' });
+                        res.end(`
+              <html>
+                <body style="font-family: system-ui; padding: 40px; text-align: center;">
+                  <h1>Authentication Failed</h1>
+                  <p>State mismatch - possible CSRF attack.</p>
+                  <p>You can close this window.</p>
+                </body>
+              </html>
+            `);
+                        server.close();
+                        resolve({ success: false, error: 'State mismatch' });
+                        return;
+                    }
+                    // Exchange code for tokens
+                    if (code) {
+                        try {
+                            const tokens = await this.exchangeCodeForTokens(code, pkce.codeVerifier, redirectUri);
+                            // Get user email
+                            const { email } = await this.getUserInfo(tokens.accessToken);
+                            res.writeHead(200, { 'Content-Type': 'text/html' });
+                            res.end(`
+                <html>
+                  <body style="font-family: system-ui; padding: 40px; text-align: center;">
+                    <h1>Authentication Successful!</h1>
+                    <p>You are now connected to Google${email ? ` as ${email}` : ''}.</p>
+                    <p>You can close this window and return to the terminal.</p>
+                  </body>
+                </html>
+              `);
+                            server.close();
+                            resolve({ success: true, tokens, email });
+                        }
+                        catch (err) {
+                            res.writeHead(500, { 'Content-Type': 'text/html' });
+                            res.end(`
+                <html>
+                  <body style="font-family: system-ui; padding: 40px; text-align: center;">
+                    <h1>Authentication Failed</h1>
+                    <p>Error: ${err instanceof Error ? err.message : 'Unknown error'}</p>
+                    <p>You can close this window.</p>
+                  </body>
+                </html>
+              `);
+                            server.close();
+                            resolve({ success: false, error: err instanceof Error ? err.message : 'Unknown error' });
+                        }
+                    }
+                }
+            });
+            // Start server
+            server.listen(port, '127.0.0.1', () => {
+                console.log('\nOpening browser for Google authentication...');
+                console.log(`If the browser doesn't open, visit: ${authUrl}\n`);
+                // Try to open browser
+                openBrowser(authUrl);
+            });
+            // Timeout after 5 minutes
+            setTimeout(() => {
+                server.close();
+                resolve({ success: false, error: 'Authentication timeout (5 minutes)' });
+            }, 5 * 60 * 1000);
+        });
+    }
+}
+/**
+ * Create Google OAuth handler instance
+ */
+export function createGoogleOAuth() {
+    return new GoogleOAuth();
+}
+//# sourceMappingURL=oauth-google.js.map

package/dist/auth/oauth-google.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-google.js","sourceRoot":"","sources":["../../src/auth/oauth-google.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,GAAG,MAAM,KAAK,CAAC;AAC3B,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,KAAK,CAAC;AAG3C,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAEtD;;GAEG;AACH,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,IAAI,OAAe,CAAC;IAEpB,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,GAAG,SAAS,GAAG,GAAG,CAAC;IAC5B,CAAC;SAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,OAAO,GAAG,aAAa,GAAG,GAAG,CAAC;IAChC,CAAC;SAAM,CAAC;QACN,mBAAmB;QACnB,OAAO,GAAG,aAAa,GAAG,GAAG,CAAC;IAChC,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;QACtB,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;YACrD,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,EAAE,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAgB;IAC9C,QAAQ,EAAE,0EAA0E;IACpF,YAAY,EAAE,qCAAqC;IACnD,OAAO,EAAE,2CAA2C;IACpD,QAAQ,EAAE,qCAAqC;IAC/C,WAAW,EAAE,wBAAwB,EAAE,oCAAoC;IAC3E,MAAM,EAAE,CAAC,gDAAgD,CAAC;CAC3D,CAAC;AAEF;;GAEG;AACH,KAAK,UAAU,iBAAiB,CAAC,YAAoB,KAAK;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;QAClC,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;YAChD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC9B,gBAAgB;gBAChB,iBAAiB,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC/D,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,EAAE;YACzC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAqB,CAAC;YACpD,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,WAAW;IACd,MAAM,CAAc;IAE5B,YAAY,SAAsB,mBAAmB;QACnD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,IAAc,EAAE,WAAmB;QACrD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,aAAa,EAAE,MAAM;YACrB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,WAAW;YACzB,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YACnC,cAAc,EAAE,IAAI,CAAC,aAAa;YAClC,qBAAqB,EAAE,MAAM;YAC7B,WAAW,EAAE,SAAS;YACtB,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QAEH,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACvD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,qBAAqB,CACzB,IAAY,EACZ,YAAoB,EACpB,WAAmB;QAEnB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;aACpD;YACD,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,oBAAoB;gBAChC,IAAI;gBACJ,YAAY,EAAE,WAAW;gBACzB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE;gBAC7C,aAAa,EAAE,YAAY;aAC5B,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,0BAA0B,KAAK,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAM/B,CAAC;QAEF,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;YAChD,SAAS,EAAE,IAAI,CAAC,UAAU;SAC3B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,YAAoB;QACtC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;aACpD;YACD,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,YAAY;gBAC3B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE;aAC9C,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAM/B,CAAC;QAEF,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa,IAAI,YAAY;YAChD,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;YAChD,SAAS,EAAE,IAAI,CAAC,UAAU;SAC3B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,WAAmB;QACnC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,+CAA+C,EAAE;gBAC5E,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,WAAW,EAAE;iBACvC;aACF,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAwB,CAAC;gBACzD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAC/B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB;QAClB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY;QAChB,sBAAsB;QACtB,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,oBAAoB,IAAI,EAAE,CAAC;QAE/C,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAE5D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;gBAClD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAI,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;gBAE1D,sDAAsD;gBACtD,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;oBACzD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBAC1C,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBACpD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBAE5C,gBAAgB;oBAChB,IAAI,KAAK,EAAE,CAAC;wBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;wBACpD,GAAG,CAAC,GAAG,CAAC;;;;8BAIU,KAAK;;;;aAItB,CAAC,CAAC;wBACH,MAAM,CAAC,KAAK,EAAE,CAAC;wBACf,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;wBACnC,OAAO;oBACT,CAAC;oBAED,eAAe;oBACf,IAAI,CAAC,aAAa,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,CAAC;wBAC9D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;wBACpD,GAAG,CAAC,GAAG,CAAC;;;;;;;;aAQP,CAAC,CAAC;wBACH,MAAM,CAAC,KAAK,EAAE,CAAC;wBACf,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;wBACrD,OAAO;oBACT,CAAC;oBAED,2BAA2B;oBAC3B,IAAI,IAAI,EAAE,CAAC;wBACT,IAAI,CAAC;4BACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAC7C,IAAI,EACJ,IAAI,CAAC,YAAY,EACjB,WAAW,CACZ,CAAC;4BAEF,iBAAiB;4BACjB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;4BAE7D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;4BACpD,GAAG,CAAC,GAAG,CAAC;;;;wDAIkC,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE;;;;eAIpE,CAAC,CAAC;4BACH,MAAM,CAAC,KAAK,EAAE,CAAC;4BACf,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;wBAC5C,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;4BACpD,GAAG,CAAC,GAAG,CAAC;;;;gCAIU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;;;;eAIrE,CAAC,CAAC;4BACH,MAAM,CAAC,KAAK,EAAE,CAAC;4BACf,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;wBAC3F,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,eAAe;YACf,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;gBACpC,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;gBAC9D,OAAO,CAAC,GAAG,CAAC,uCAAuC,OAAO,IAAI,CAAC,CAAC;gBAEhE,sBAAsB;gBACtB,WAAW,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC,CAAC,CAAC;YAEH,0BAA0B;YAC1B,UAAU,CAAC,GAAG,EAAE;gBACd,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;YAC3E,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,WAAW,EAAE,CAAC;AAC3B,CAAC"}

package/dist/auth/oauth-openai.d.ts

@@ -0,0 +1,46 @@
+/**
+ * OpenAI OAuth 2.0 implementation for ChatGPT Plus/Pro subscriptions
+ *
+ * Uses the same OAuth flow as OpenAI's Codex CLI
+ */
+import type { OAuthTokens, OAuthConfig } from '../providers/types.js';
+import type { OAuthResult, PKCEData } from './types.js';
+/**
+ * OpenAI OAuth configuration
+ * These are the same credentials used by OpenAI's Codex CLI
+ */
+export declare const OPENAI_OAUTH_CONFIG: OAuthConfig;
+/**
+ * OpenAI OAuth handler
+ */
+export declare class OpenAIOAuth {
+    private config;
+    constructor(config?: OAuthConfig);
+    /**
+     * Generate the authorization URL for the OAuth flow
+     */
+    getAuthorizationUrl(pkce: PKCEData): string;
+    /**
+     * Exchange authorization code for tokens
+     */
+    exchangeCodeForTokens(code: string, codeVerifier: string): Promise<OAuthTokens>;
+    /**
+     * Refresh tokens using refresh token
+     */
+    refreshTokens(refreshToken: string): Promise<OAuthTokens>;
+    /**
+     * Exchange ID token for an API key (optional)
+     * This can be used if you want a traditional API key instead of OAuth tokens
+     */
+    exchangeForApiKey(idToken: string): Promise<string>;
+    /**
+     * Run the full OAuth authentication flow
+     * Opens a browser and waits for callback
+     */
+    authenticate(): Promise<OAuthResult>;
+}
+/**
+ * Create OpenAI OAuth handler instance
+ */
+export declare function createOpenAIOAuth(): OpenAIOAuth;
+//# sourceMappingURL=oauth-openai.d.ts.map

package/dist/auth/oauth-openai.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-openai.d.ts","sourceRoot":"","sources":["../../src/auth/oauth-openai.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AA2BxD;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAMjC,CAAC;AAEF;;GAEG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,MAAM,CAAc;gBAEhB,MAAM,GAAE,WAAiC;IAIrD;;OAEG;IACH,mBAAmB,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM;IAgB3C;;OAEG;IACG,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAqCrF;;OAEG;IACG,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAmC/D;;;OAGG;IACG,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAwBzD;;;OAGG;IACG,YAAY,IAAI,OAAO,CAAC,WAAW,CAAC;CA+G3C;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,WAAW,CAE/C"}

package/dist/auth/oauth-openai.js

@@ -0,0 +1,264 @@
+/**
+ * OpenAI OAuth 2.0 implementation for ChatGPT Plus/Pro subscriptions
+ *
+ * Uses the same OAuth flow as OpenAI's Codex CLI
+ */
+import * as http from 'http';
+import { exec } from 'child_process';
+import { URL, URLSearchParams } from 'url';
+import { generatePKCE, verifyState } from './pkce.js';
+/**
+ * Open URL in default browser (cross-platform)
+ */
+function openBrowser(url) {
+    const platform = process.platform;
+    let command;
+    if (platform === 'darwin') {
+        command = `open "${url}"`;
+    }
+    else if (platform === 'win32') {
+        command = `start "" "${url}"`;
+    }
+    else {
+        // Linux and others
+        command = `xdg-open "${url}"`;
+    }
+    exec(command, (error) => {
+        if (error) {
+            console.log('Could not open browser automatically.');
+            console.log(`Please visit: ${url}`);
+        }
+    });
+}
+/**
+ * OpenAI OAuth configuration
+ * These are the same credentials used by OpenAI's Codex CLI
+ */
+export const OPENAI_OAUTH_CONFIG = {
+    clientId: 'app_EMoamEEZ73f0CkXaXp7hrann',
+    authUrl: 'https://auth.openai.com/oauth/authorize',
+    tokenUrl: 'https://auth.openai.com/oauth/token',
+    redirectUri: 'http://localhost:1455/auth/callback',
+    scopes: ['openid', 'profile', 'email', 'offline_access'],
+};
+/**
+ * OpenAI OAuth handler
+ */
+export class OpenAIOAuth {
+    config;
+    constructor(config = OPENAI_OAUTH_CONFIG) {
+        this.config = config;
+    }
+    /**
+     * Generate the authorization URL for the OAuth flow
+     */
+    getAuthorizationUrl(pkce) {
+        const params = new URLSearchParams({
+            response_type: 'code',
+            client_id: this.config.clientId,
+            redirect_uri: this.config.redirectUri,
+            scope: this.config.scopes.join(' '),
+            code_challenge: pkce.codeChallenge,
+            code_challenge_method: 'S256',
+            id_token_add_organizations: 'true',
+            codex_cli_simplified_flow: 'true',
+            state: pkce.state,
+        });
+        return `${this.config.authUrl}?${params.toString()}`;
+    }
+    /**
+     * Exchange authorization code for tokens
+     */
+    async exchangeCodeForTokens(code, codeVerifier) {
+        const response = await fetch(this.config.tokenUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+            body: new URLSearchParams({
+                grant_type: 'authorization_code',
+                code,
+                redirect_uri: this.config.redirectUri,
+                client_id: this.config.clientId,
+                code_verifier: codeVerifier,
+            }),
+        });
+        if (!response.ok) {
+            const error = await response.text();
+            throw new Error(`Token exchange failed: ${error}`);
+        }
+        const data = await response.json();
+        return {
+            accessToken: data.access_token,
+            refreshToken: data.refresh_token,
+            idToken: data.id_token,
+            expiresAt: Date.now() + (data.expires_in * 1000),
+            tokenType: data.token_type,
+        };
+    }
+    /**
+     * Refresh tokens using refresh token
+     */
+    async refreshTokens(refreshToken) {
+        const response = await fetch(this.config.tokenUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+            body: new URLSearchParams({
+                grant_type: 'refresh_token',
+                refresh_token: refreshToken,
+                client_id: this.config.clientId,
+            }),
+        });
+        if (!response.ok) {
+            const error = await response.text();
+            throw new Error(`Token refresh failed: ${error}`);
+        }
+        const data = await response.json();
+        return {
+            accessToken: data.access_token,
+            refreshToken: data.refresh_token || refreshToken,
+            idToken: data.id_token,
+            expiresAt: Date.now() + (data.expires_in * 1000),
+            tokenType: data.token_type,
+        };
+    }
+    /**
+     * Exchange ID token for an API key (optional)
+     * This can be used if you want a traditional API key instead of OAuth tokens
+     */
+    async exchangeForApiKey(idToken) {
+        const response = await fetch(this.config.tokenUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+            body: new URLSearchParams({
+                grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',
+                requested_token: 'openai-api-key',
+                subject_token: idToken,
+                subject_token_type: 'urn:ietf:params:oauth:token-type:id_token',
+                client_id: this.config.clientId,
+            }),
+        });
+        if (!response.ok) {
+            const error = await response.text();
+            throw new Error(`API key exchange failed: ${error}`);
+        }
+        const data = await response.json();
+        return data.access_token;
+    }
+    /**
+     * Run the full OAuth authentication flow
+     * Opens a browser and waits for callback
+     */
+    async authenticate() {
+        const pkce = generatePKCE();
+        const authUrl = this.getAuthorizationUrl(pkce);
+        return new Promise((resolve) => {
+            const server = http.createServer(async (req, res) => {
+                const url = new URL(req.url, `http://localhost:1455`);
+                if (url.pathname === '/auth/callback') {
+                    const code = url.searchParams.get('code');
+                    const returnedState = url.searchParams.get('state');
+                    const error = url.searchParams.get('error');
+                    // Handle errors
+                    if (error) {
+                        res.writeHead(400, { 'Content-Type': 'text/html' });
+                        res.end(`
+              <html>
+                <body style="font-family: system-ui; padding: 40px; text-align: center;">
+                  <h1>Authentication Failed</h1>
+                  <p>Error: ${error}</p>
+                  <p>You can close this window.</p>
+                </body>
+              </html>
+            `);
+                        server.close();
+                        resolve({ success: false, error });
+                        return;
+                    }
+                    // Verify state
+                    if (!returnedState || !verifyState(pkce.state, returnedState)) {
+                        res.writeHead(400, { 'Content-Type': 'text/html' });
+                        res.end(`
+              <html>
+                <body style="font-family: system-ui; padding: 40px; text-align: center;">
+                  <h1>Authentication Failed</h1>
+                  <p>State mismatch - possible CSRF attack.</p>
+                  <p>You can close this window.</p>
+                </body>
+              </html>
+            `);
+                        server.close();
+                        resolve({ success: false, error: 'State mismatch' });
+                        return;
+                    }
+                    // Exchange code for tokens
+                    if (code) {
+                        try {
+                            const tokens = await this.exchangeCodeForTokens(code, pkce.codeVerifier);
+                            // Extract email from ID token if available
+                            let email;
+                            if (tokens.idToken) {
+                                try {
+                                    const payload = JSON.parse(Buffer.from(tokens.idToken.split('.')[1], 'base64').toString());
+                                    email = payload.email;
+                                }
+                                catch {
+                                    // Ignore ID token parsing errors
+                                }
+                            }
+                            res.writeHead(200, { 'Content-Type': 'text/html' });
+                            res.end(`
+                <html>
+                  <body style="font-family: system-ui; padding: 40px; text-align: center;">
+                    <h1>Authentication Successful!</h1>
+                    <p>You are now connected to OpenAI${email ? ` as ${email}` : ''}.</p>
+                    <p>You can close this window and return to the terminal.</p>
+                  </body>
+                </html>
+              `);
+                            server.close();
+                            resolve({ success: true, tokens, email });
+                        }
+                        catch (err) {
+                            res.writeHead(500, { 'Content-Type': 'text/html' });
+                            res.end(`
+                <html>
+                  <body style="font-family: system-ui; padding: 40px; text-align: center;">
+                    <h1>Authentication Failed</h1>
+                    <p>Error: ${err instanceof Error ? err.message : 'Unknown error'}</p>
+                    <p>You can close this window.</p>
+                  </body>
+                </html>
+              `);
+                            server.close();
+                            resolve({ success: false, error: err instanceof Error ? err.message : 'Unknown error' });
+                        }
+                    }
+                }
+            });
+            // Start server
+            server.listen(1455, '127.0.0.1', () => {
+                console.log('\nOpening browser for OpenAI authentication...');
+                console.log(`If the browser doesn't open, visit: ${authUrl}\n`);
+                // Try to open browser
+                openBrowser(authUrl);
+            });
+            // Timeout after 5 minutes
+            setTimeout(() => {
+                server.close();
+                resolve({ success: false, error: 'Authentication timeout (5 minutes)' });
+            }, 5 * 60 * 1000);
+        });
+    }
+}
+/**
+ * Create OpenAI OAuth handler instance
+ */
+export function createOpenAIOAuth() {
+    return new OpenAIOAuth();
+}
+//# sourceMappingURL=oauth-openai.js.map

package/dist/auth/oauth-openai.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-openai.js","sourceRoot":"","sources":["../../src/auth/oauth-openai.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,KAAK,CAAC;AAG3C,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAEtD;;GAEG;AACH,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,IAAI,OAAe,CAAC;IAEpB,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,GAAG,SAAS,GAAG,GAAG,CAAC;IAC5B,CAAC;SAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,OAAO,GAAG,aAAa,GAAG,GAAG,CAAC;IAChC,CAAC;SAAM,CAAC;QACN,mBAAmB;QACnB,OAAO,GAAG,aAAa,GAAG,GAAG,CAAC;IAChC,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;QACtB,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;YACrD,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,EAAE,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAgB;IAC9C,QAAQ,EAAE,8BAA8B;IACxC,OAAO,EAAE,yCAAyC;IAClD,QAAQ,EAAE,qCAAqC;IAC/C,WAAW,EAAE,qCAAqC;IAClD,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC;CACzD,CAAC;AAEF;;GAEG;AACH,MAAM,OAAO,WAAW;IACd,MAAM,CAAc;IAE5B,YAAY,SAAsB,mBAAmB;QACnD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,IAAc;QAChC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,aAAa,EAAE,MAAM;YACrB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACrC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YACnC,cAAc,EAAE,IAAI,CAAC,aAAa;YAClC,qBAAqB,EAAE,MAAM;YAC7B,0BAA0B,EAAE,MAAM;YAClC,yBAAyB,EAAE,MAAM;YACjC,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QAEH,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACvD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,qBAAqB,CAAC,IAAY,EAAE,YAAoB;QAC5D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;aACpD;YACD,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,oBAAoB;gBAChC,IAAI;gBACJ,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;gBACrC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC/B,aAAa,EAAE,YAAY;aAC5B,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,0BAA0B,KAAK,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAM/B,CAAC;QAEF,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;YAChD,SAAS,EAAE,IAAI,CAAC,UAAU;SAC3B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,YAAoB;QACtC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;aACpD;YACD,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,YAAY;gBAC3B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;aAChC,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAM/B,CAAC;QAEF,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa,IAAI,YAAY;YAChD,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;YAChD,SAAS,EAAE,IAAI,CAAC,UAAU;SAC3B,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB,CAAC,OAAe;QACrC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;aACpD;YACD,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,iDAAiD;gBAC7D,eAAe,EAAE,gBAAgB;gBACjC,aAAa,EAAE,OAAO;gBACtB,kBAAkB,EAAE,2CAA2C;gBAC/D,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;aAChC,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA8B,CAAC;QAC/D,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAE/C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;gBAClD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAI,EAAE,uBAAuB,CAAC,CAAC;gBAEvD,IAAI,GAAG,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;oBACtC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBAC1C,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBACpD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBAE5C,gBAAgB;oBAChB,IAAI,KAAK,EAAE,CAAC;wBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;wBACpD,GAAG,CAAC,GAAG,CAAC;;;;8BAIU,KAAK;;;;aAItB,CAAC,CAAC;wBACH,MAAM,CAAC,KAAK,EAAE,CAAC;wBACf,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;wBACnC,OAAO;oBACT,CAAC;oBAED,eAAe;oBACf,IAAI,CAAC,aAAa,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,CAAC;wBAC9D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;wBACpD,GAAG,CAAC,GAAG,CAAC;;;;;;;;aAQP,CAAC,CAAC;wBACH,MAAM,CAAC,KAAK,EAAE,CAAC;wBACf,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;wBACrD,OAAO;oBACT,CAAC;oBAED,2BAA2B;oBAC3B,IAAI,IAAI,EAAE,CAAC;wBACT,IAAI,CAAC;4BACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;4BAEzE,2CAA2C;4BAC3C,IAAI,KAAyB,CAAC;4BAC9B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gCACnB,IAAI,CAAC;oCACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAC/D,CAAC;oCACF,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;gCACxB,CAAC;gCAAC,MAAM,CAAC;oCACP,iCAAiC;gCACnC,CAAC;4BACH,CAAC;4BAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;4BACpD,GAAG,CAAC,GAAG,CAAC;;;;wDAIkC,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE;;;;eAIpE,CAAC,CAAC;4BACH,MAAM,CAAC,KAAK,EAAE,CAAC;4BACf,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;wBAC5C,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;4BACpD,GAAG,CAAC,GAAG,CAAC;;;;gCAIU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;;;;eAIrE,CAAC,CAAC;4BACH,MAAM,CAAC,KAAK,EAAE,CAAC;4BACf,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;wBAC3F,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,eAAe;YACf,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;gBACpC,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;gBAC9D,OAAO,CAAC,GAAG,CAAC,uCAAuC,OAAO,IAAI,CAAC,CAAC;gBAEhE,sBAAsB;gBACtB,WAAW,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC,CAAC,CAAC;YAEH,0BAA0B;YAC1B,UAAU,CAAC,GAAG,EAAE;gBACd,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;YAC3E,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,WAAW,EAAE,CAAC;AAC3B,CAAC"}

package/dist/auth/pkce.d.ts

@@ -0,0 +1,14 @@
+/**
+ * PKCE (Proof Key for Code Exchange) utilities for OAuth 2.0
+ */
+import type { PKCEData } from './types.js';
+/**
+ * Generate PKCE code verifier and challenge
+ * RFC 7636: https://datatracker.ietf.org/doc/html/rfc7636
+ */
+export declare function generatePKCE(): PKCEData;
+/**
+ * Verify that a state matches the expected state
+ */
+export declare function verifyState(expected: string, received: string): boolean;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/auth/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/auth/pkce.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;GAGG;AACH,wBAAgB,YAAY,IAAI,QAAQ,CAkBvC;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CASvE"}