swayrouter 1.0.0

package/src/lib/network/proxyTest.js

@@ -0,0 +1,158 @@
+import http from "node:http";
+import https from "node:https";
+import { Readable } from "node:stream";
+import { ProxyAgent, fetch as undiciFetch } from "undici";
+import { SocksProxyAgent } from "socks-proxy-agent";
+import {
+  isSocksProxyUrl,
+  normalizeProxyUrl,
+  safeProxyError,
+} from "./proxyUrl.js";
+
+function isSocksProxy(proxyUrl, proxyType) {
+  return isSocksProxyUrl(proxyUrl, proxyType);
+}
+
+function createProxyDispatcher(proxyUrl, proxyType) {
+  return isSocksProxy(proxyUrl, proxyType)
+    ? new SocksProxyAgent(proxyUrl)
+    : new ProxyAgent({ uri: proxyUrl });
+}
+
+async function fetchThroughSocks(url, options, proxyUrl) {
+  const agent = new SocksProxyAgent(proxyUrl);
+  const target = new URL(url);
+  const transport = target.protocol === "http:" ? http : https;
+  const requestOptions = {
+    method: options.method || "GET",
+    headers: options.headers,
+    agent,
+  };
+  return new Promise((resolve, reject) => {
+    const request = transport.request(target, requestOptions, (response) => {
+      response.resume();
+      response.once("end", () => resolve({
+        ok: response.statusCode >= 200 && response.statusCode < 400,
+        status: response.statusCode || 0,
+        statusText: response.statusMessage || "",
+        url,
+      }));
+    });
+    request.once("error", reject);
+    if (options.signal) {
+      const abort = () => request.destroy(new Error("Proxy test aborted"));
+      if (options.signal.aborted) abort();
+      else options.signal.addEventListener("abort", abort, { once: true });
+    }
+    request.end();
+  });
+}
+
+function normalizeString(value) {
+  if (value === undefined || value === null) return "";
+  return String(value).trim();
+}
+
+const DEFAULT_TEST_URL = "https://www.google.com/generate_204";
+const DEFAULT_TIMEOUT_MS = 8000;
+
+function getErrorMessage(err) {
+  if (!err) return "Unknown error";
+  const base = err?.message || String(err);
+  const causeCode = err?.cause?.code || err?.code;
+  const causeMessage = err?.cause?.message;
+
+  if (causeMessage && causeMessage !== base) {
+    return causeCode ? `${base}: ${causeMessage} (${causeCode})` : `${base}: ${causeMessage}`;
+  }
+
+  if (causeCode && !base.includes(causeCode)) {
+    return `${base} (${causeCode})`;
+  }
+
+  return base;
+}
+
+export async function testProxyUrl({ proxyUrl, proxyType, testUrl, timeoutMs } = {}) {
+  const rawProxyUrl = normalizeString(proxyUrl);
+  if (!rawProxyUrl) {
+    return { ok: false, status: 400, error: "proxyUrl is required" };
+  }
+
+  let normalizedProxyUrl;
+  try {
+    normalizedProxyUrl = normalizeProxyUrl(rawProxyUrl, proxyType);
+  } catch (err) {
+    return {
+      ok: false,
+      status: 400,
+      error: `Invalid proxy URL: ${safeProxyError(err)}`,
+    };
+  }
+
+  const normalizedTestUrl = normalizeString(testUrl) || DEFAULT_TEST_URL;
+  const timeoutMsRaw = Number(timeoutMs);
+  const normalizedTimeoutMs =
+    Number.isFinite(timeoutMsRaw) && timeoutMsRaw > 0
+      ? Math.min(timeoutMsRaw, 30000)
+      : DEFAULT_TIMEOUT_MS;
+
+  let dispatcher;
+
+  try {
+    try {
+      dispatcher = createProxyDispatcher(normalizedProxyUrl, proxyType);
+    } catch (err) {
+      return {
+        ok: false,
+        status: 400,
+        error: `Invalid proxy URL: ${safeProxyError(err)}`,
+      };
+    }
+
+    const controller = new AbortController();
+    const startedAt = Date.now();
+    const timer = setTimeout(() => controller.abort(), normalizedTimeoutMs);
+
+    try {
+      const requestOptions = {
+        method: "GET",
+        signal: controller.signal,
+        headers: {
+          "User-Agent": "SwayRouter",
+        },
+      };
+      const res = isSocksProxy(normalizedProxyUrl, proxyType)
+        ? await fetchThroughSocks(normalizedTestUrl, requestOptions, normalizedProxyUrl)
+        : await undiciFetch(normalizedTestUrl, { ...requestOptions, dispatcher });
+
+      try {
+        await res.body?.cancel?.();
+      } catch {
+
+      }
+
+      return {
+        ok: res.ok,
+        status: res.status,
+        statusText: res.statusText,
+        url: normalizedTestUrl,
+        elapsedMs: Date.now() - startedAt,
+      };
+    } catch (err) {
+      const message =
+        err?.name === "AbortError"
+          ? "Proxy test timed out"
+          : safeProxyError(getErrorMessage(err));
+      return { ok: false, status: 500, error: message };
+    } finally {
+      clearTimeout(timer);
+    }
+  } finally {
+    try {
+      await dispatcher?.close?.();
+    } catch {
+
+    }
+  }
+}

package/src/lib/network/proxyUrl.js

@@ -0,0 +1,76 @@
+const DEFAULT_PROXY_SCHEME = "http:";
+const PROXY_SCHEMES = new Set(["http:", "https:", "socks5:", "socks5h:"]);
+
+function normalizeString(value) {
+  if (value === undefined || value === null) return "";
+  return String(value).trim();
+}
+
+function defaultSchemeForType(proxyType) {
+  const type = normalizeString(proxyType).toLowerCase();
+  if (type === "https") return "https:";
+  if (type === "socks5" || type === "socks5h") return `${type}:`;
+  return DEFAULT_PROXY_SCHEME;
+}
+
+export function normalizeProxyUrl(value, proxyType) {
+  const input = normalizeString(value);
+  if (!input) return null;
+  if ([...input].some((char) => {
+    const code = char.charCodeAt(0);
+    return code < 0x20 || code === 0x7f || char === "`" || char === "$";
+  })) {
+    throw new TypeError("Proxy URL contains invalid characters");
+  }
+
+  const explicitScheme = /^[a-z][a-z\d+.-]*:\/\//i.test(input);
+  const schemeWithoutAuthority = /^(?:https?|socks5h?):(?!\/\/)/i.test(input);
+  if (schemeWithoutAuthority) {
+    throw new TypeError("Proxy URL must include a host");
+  }
+
+  const candidate = explicitScheme
+    ? input
+    : `${defaultSchemeForType(proxyType)}//${input}`;
+
+  let parsed;
+  try {
+    parsed = new URL(candidate);
+  } catch {
+    throw new TypeError("Proxy URL is invalid");
+  }
+
+  if (!PROXY_SCHEMES.has(parsed.protocol) || !parsed.hostname) {
+    throw new TypeError("Proxy URL must use http, https, socks5, or socks5h");
+  }
+
+  const type = normalizeString(proxyType).toLowerCase();
+  const typeIsSocks = type === "socks5" || type === "socks5h";
+  const urlIsSocks = parsed.protocol === "socks5:" || parsed.protocol === "socks5h:";
+  if (typeIsSocks !== urlIsSocks && explicitScheme) {
+    throw new TypeError(`Proxy type ${type || "http"} does not match URL scheme ${parsed.protocol.slice(0, -1)}`);
+  }
+
+  return parsed.href;
+}
+
+export function isSocksProxyUrl(proxyUrl, proxyType) {
+  try {
+    const protocol = new URL(proxyUrl).protocol;
+    if (protocol === "socks5:" || protocol === "socks5h:") return true;
+    if (protocol === "http:" || protocol === "https:") return false;
+  } catch {
+
+  }
+
+  const type = normalizeString(proxyType).toLowerCase();
+  return type === "socks5" || type === "socks5h";
+}
+
+export function safeProxyError(error) {
+  const message = error?.message || String(error);
+  return message.replace(
+    /((?:https?|socks5h?|socks4a?):\/\/)[^/\s@]+@/gi,
+    "$1[redacted]@",
+  );
+}

package/src/lib/network/relay.js

@@ -0,0 +1,71 @@
+import { randomBytes } from "node:crypto";
+import { fetch as undiciFetch } from "undici";
+
+export const SUPPORTED_PROXY_TYPES = new Set([
+  "http",
+  "https",
+  "socks5",
+  "socks5h",
+  "vercel",
+  "cloudflare",
+]);
+
+export const RELAY_PROXY_TYPES = new Set(["vercel", "cloudflare"]);
+
+export function isSupportedProxyType(type) {
+  return SUPPORTED_PROXY_TYPES.has(String(type || "").trim().toLowerCase());
+}
+
+export function isRelayProxyType(type) {
+  return RELAY_PROXY_TYPES.has(String(type || "").trim().toLowerCase());
+}
+
+export function createRelayToken() {
+  return randomBytes(32).toString("base64url");
+}
+
+export function normalizeRelayProjectName(value, fallback = `relay-${Date.now().toString(36)}`) {
+  const name = String(value || fallback).trim().toLowerCase();
+  if (!/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(name)) {
+    throw new TypeError("Project name must use lowercase letters, numbers, and hyphens (max 63 characters)");
+  }
+  return name;
+}
+
+export function publicProxyPool(pool) {
+  if (!pool || typeof pool !== "object") return pool;
+  const { relayToken: _relayToken, ...safePool } = pool;
+  return safePool;
+}
+
+export async function testRelayEndpoint(relayUrl, relayToken, timeoutMs = 15000) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  const startedAt = Date.now();
+  try {
+    const response = await undiciFetch(relayUrl, {
+      method: "GET",
+      headers: {
+        ...(relayToken ? { "x-sway-relay-token": relayToken } : {}),
+        "x-relay-target": "https://www.google.com",
+        "x-relay-path": "/generate_204",
+      },
+      signal: controller.signal,
+    });
+    await response.body?.cancel();
+    return {
+      ok: response.ok,
+      status: response.status,
+      elapsedMs: Date.now() - startedAt,
+    };
+  } catch (error) {
+    return {
+      ok: false,
+      status: 0,
+      elapsedMs: Date.now() - startedAt,
+      error: error?.name === "AbortError" ? "Relay test timed out" : "Relay request failed",
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+}

package/src/lib/oauth/constants/oauth.js

@@ -0,0 +1,152 @@
+import { platform, arch } from "os";
+import { ANTIGRAVITY_OAUTH_CLIENT, GOOGLE_OAUTH_CLIENT } from "../../../providers/shared.js";
+import { PROVIDER_OAUTH, PROVIDERS as REGISTRY_PROVIDERS } from "../../../providers/index.js";
+
+function getOAuthPlatformEnum() {
+  const os = platform();
+  const architecture = arch();
+  if (os === "darwin") return architecture === "arm64" ? 2 : 1;
+  if (os === "linux") return architecture === "arm64" ? 4 : 3;
+  if (os === "win32") return 5;
+  return 0;
+}
+
+export const CLAUDE_CONFIG = { ...PROVIDER_OAUTH["claude"] };
+
+export const CODEX_CONFIG = { ...PROVIDER_OAUTH["codex"] };
+
+export const GEMINI_CONFIG = { ...GOOGLE_OAUTH_CLIENT, ...PROVIDER_OAUTH["gemini-cli"] };
+
+export const QODER_CONFIG = { ...PROVIDER_OAUTH["qoder"] };
+
+export const ANTIGRAVITY_CONFIG = {
+  ...ANTIGRAVITY_OAUTH_CLIENT,
+  ...PROVIDER_OAUTH["antigravity"],
+  loadCodeAssistClientMetadata: JSON.stringify({ ideType: 9, platform: getOAuthPlatformEnum(), pluginType: 2 }),
+};
+
+export function getOAuthClientMetadata() {
+  return { ideType: 9, platform: getOAuthPlatformEnum(), pluginType: 2 };
+}
+
+export const OPENAI_CONFIG = { ...PROVIDER_OAUTH["openai"] };
+
+export const GITHUB_CONFIG = { ...PROVIDER_OAUTH["github"] };
+
+export const KIRO_CONFIG = { ...PROVIDER_OAUTH["kiro"] };
+
+export const AWS_REGION_PATTERN = /^[a-z]{2}-[a-z]+-\d{1,2}$/;
+
+export function assertValidAwsRegion(region) {
+  if (typeof region !== "string" || !AWS_REGION_PATTERN.test(region)) {
+    throw new Error("Invalid region");
+  }
+  return region;
+}
+
+export const CURSOR_CONFIG = {
+  ...PROVIDER_OAUTH["cursor"],
+  tokenStoragePaths: {
+    linux: "~/.config/Cursor/User/globalStorage/state.vscdb",
+    macos: "/Users/<user>/Library/Application Support/Cursor/User/globalStorage/state.vscdb",
+    windows: "%APPDATA%\\Cursor\\User\\globalStorage\\state.vscdb",
+  },
+};
+
+export const KIMI_CONFIG = {
+  ...PROVIDER_OAUTH["kimi"],
+  clientId:
+    process.env.KIMI_CODING_OAUTH_CLIENT_ID ||
+    process.env.KIMI_OAUTH_CLIENT_ID ||
+    REGISTRY_PROVIDERS["kimi"]?.clientId ||
+    PROVIDER_OAUTH["kimi"]?.clientId,
+};
+
+export const KIMI_CODING_CONFIG = KIMI_CONFIG;
+
+export const KILOCODE_CONFIG = { ...PROVIDER_OAUTH["kilocode"] };
+
+export const CLINE_CONFIG = { ...PROVIDER_OAUTH["cline"] };
+
+export const CLINEPASS_CONFIG = { ...PROVIDER_OAUTH["clinepass"] };
+
+export const CODEBUDDY_CONFIG = { ...PROVIDER_OAUTH["codebuddy-cn"] };
+
+export const CODEBUDDY_INTL_CONFIG = { ...PROVIDER_OAUTH["codebuddy-intl"] };
+
+export const KIMCHI_CONFIG = { ...PROVIDER_OAUTH["kimchi"] };
+
+export const GROK_CLI_CONFIG = { ...PROVIDER_OAUTH["grok-cli"] };
+
+export const TRAE_CONFIG = {
+  clientId: "ono9krqynydwx5",
+  clientSecret: "-",
+  loginGuidanceUrls: [
+    "https://api.marscode.com/cloudide/api/v3/trae/GetLoginGuidance",
+    "https://api.trae.ai/cloudide/api/v3/trae/GetLoginGuidance",
+    "https://www.trae.ai/cloudide/api/v3/trae/GetLoginGuidance",
+  ],
+  apiOrigins: [
+    "https://api.marscode.com",
+    "https://api.trae.ai",
+    "https://www.trae.ai",
+    "https://www.marscode.com",
+  ],
+  exchangeTokenPath: "/cloudide/api/v3/trae/oauth/ExchangeToken",
+  getUserInfoPath: "/cloudide/api/v3/trae/GetUserInfo",
+  authorizationPath: "/authorization",
+  callbackPath: "/callback",
+  minAppVersion: "3.5.54",
+  defaultAppVersion: "3.5.54",
+  defaultAppType: "stable",
+  defaultPluginVersion: "local",
+
+  defaultDeviceId: "0",
+  userAgent: "Trae/1.0.0 antigravity-cockpit-tools",
+  webUrl: "https://www.trae.ai",
+  authScheme: "Cloud-IDE-JWT",
+  tokenLifetimeDays: 14,
+  oauthTimeoutMs: 600_000,
+};
+
+export const WINDSURF_CONFIG = {
+  clientId: "3GUryQ7ldAeKEuD2obYnppsnmj58eP5u",
+  authBaseUrl: "https://www.windsurf.com",
+  signInPath: "/windsurf/signin",
+  registerApiBaseUrl: "https://register.windsurf.com",
+  registerPath: "/exa.seat_management_pb.SeatManagementService/RegisterUser",
+  oneTimeAuthPath: "/exa.seat_management_pb.SeatManagementService/GetOneTimeAuthToken",
+  currentUserPath: "/exa.seat_management_pb.SeatManagementService/GetCurrentUser",
+  planStatusPath: "/exa.seat_management_pb.SeatManagementService/GetPlanStatus",
+  userStatusPath: "/exa.seat_management_pb.SeatManagementService/GetUserStatus",
+  defaultApiServerUrl: "https://server.codeium.com",
+  firebaseApiKey: "AIzaSyDsOl-1XpT5err0Tcn0TFFod1H8gVGIycY", // gitleaks:allow -- public Firebase web client key
+  callbackPath: "/windsurf-auth-callback",
+  userAgent: "antigravity-cockpit-tools",
+  oauthTimeoutMs: 600_000,
+};
+
+export const OAUTH_TIMEOUT = 300000;
+
+export const PROVIDERS = {
+  CLAUDE: "claude",
+  CODEX: "codex",
+  GEMINI: "gemini-cli",
+  QODER: "qoder",
+  ANTIGRAVITY: "antigravity",
+  OPENAI: "openai",
+  GITHUB: "github",
+  KIRO: "kiro",
+  CURSOR: "cursor",
+  KIMI: "kimi",
+  KIMI_CODING: "kimi",
+  KILOCODE: "kilocode",
+  CLINE: "cline",
+  CLINEPASS: "clinepass",
+  CODEBUDDY: "codebuddy-cn",
+  CODEBUDDY_INTL: "codebuddy-intl",
+  KIMCHI: "kimchi",
+  GROK_CLI: "grok-cli",
+  TRAE: "trae",
+  WINDSURF: "windsurf",
+};

package/src/lib/oauth/constants/xai.js

@@ -0,0 +1,43 @@
+import { PROVIDERS } from "../../../providers/index.js";
+
+export const XAI_CLIENT_ID = PROVIDERS["xai"]?.clientId;
+
+export const XAI_ISSUER = "https://auth.x.ai";
+export const XAI_AUTH_ENDPOINT_PATH = "/oauth2/authorize";
+export const XAI_TOKEN_ENDPOINT_PATH = "/oauth2/token";
+export const XAI_DISCOVERY_PATH = "/.well-known/openid-configuration";
+
+export const XAI_SCOPE = "openid profile email offline_access grok-cli:access api:access";
+
+export const XAI_API_BASE = "https://api.x.ai/v1";
+
+export const XAI_LOOPBACK_PORT = 56121;
+export const XAI_CALLBACK_PATH = "/callback";
+export const XAI_REDIRECT_URI = `http://127.0.0.1:${XAI_LOOPBACK_PORT}${XAI_CALLBACK_PATH}`;
+
+export const XAI_PKCE_VERIFIER_BYTES = 96;
+
+export const XAI_REFRESH_LEAD_SECONDS = 5 * 60;
+
+export const XAI_USER_AGENT = "grok-cli/swayrouter";
+
+export const XAI_CONFIG = {
+  clientId: XAI_CLIENT_ID,
+  issuer: XAI_ISSUER,
+  authEndpointPath: XAI_AUTH_ENDPOINT_PATH,
+  tokenEndpointPath: XAI_TOKEN_ENDPOINT_PATH,
+  discoveryPath: XAI_DISCOVERY_PATH,
+
+  authorizeUrl: `${XAI_ISSUER}${XAI_AUTH_ENDPOINT_PATH}`,
+  tokenUrl: `${XAI_ISSUER}${XAI_TOKEN_ENDPOINT_PATH}`,
+  discoveryUrl: `${XAI_ISSUER}${XAI_DISCOVERY_PATH}`,
+  scope: XAI_SCOPE,
+  apiBaseUrl: XAI_API_BASE,
+  redirectUri: XAI_REDIRECT_URI,
+  loopbackPort: XAI_LOOPBACK_PORT,
+  callbackPath: XAI_CALLBACK_PATH,
+  pkceVerifierBytes: XAI_PKCE_VERIFIER_BYTES,
+  refreshLeadSeconds: XAI_REFRESH_LEAD_SECONDS,
+  userAgent: XAI_USER_AGENT,
+  codeChallengeMethod: "S256",
+};

package/src/lib/oauth/kiroExternalIdp.js

@@ -0,0 +1,167 @@
+const MICROSOFT_TOKEN_ENDPOINT_HOSTS = new Set([
+  "login.microsoftonline.com",
+  "login.microsoft.com",
+  "login.windows.net",
+]);
+
+const DEFAULT_REGION = "us-east-1";
+const DEFAULT_EXPIRES_IN = 3600;
+
+function normalizeString(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function firstInputValue(input, ...keys) {
+  for (const key of keys) {
+    if (input[key]) return input[key];
+  }
+  return undefined;
+}
+
+export function validateMicrosoftTokenEndpoint(rawEndpoint) {
+  const tokenEndpoint = normalizeString(rawEndpoint);
+  if (!tokenEndpoint) throw new Error("token_endpoint is required");
+
+  let parsed;
+  try {
+    parsed = new URL(tokenEndpoint);
+  } catch {
+    throw new Error("token_endpoint must be a valid URL");
+  }
+
+  if (parsed.protocol !== "https:") {
+    throw new Error("token_endpoint must use https");
+  }
+
+  const host = parsed.hostname.toLowerCase();
+  if (!MICROSOFT_TOKEN_ENDPOINT_HOSTS.has(host)) {
+    throw new Error("token_endpoint must be a Microsoft login endpoint");
+  }
+
+  return parsed.toString();
+}
+
+export function normalizeScope(scopes) {
+  if (Array.isArray(scopes)) {
+    return scopes.map(normalizeString).filter(Boolean).join(" ");
+  }
+  return normalizeString(scopes);
+}
+
+export function decodeJwtPayload(jwt) {
+  try {
+    if (!jwt || typeof jwt !== "string") return null;
+    const parts = jwt.split(".");
+    if (parts.length !== 3) return null;
+    const base64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const padding = (4 - (base64.length % 4)) % 4;
+    return JSON.parse(Buffer.from(`${base64}${"=".repeat(padding)}`, "base64").toString("utf8"));
+  } catch {
+    return null;
+  }
+}
+
+function resolveExpiresAt(input) {
+  const explicit = firstInputValue(input, "expired", "expires_at", "expiresAt");
+  if (explicit) {
+    const ms = new Date(explicit).getTime();
+    if (Number.isFinite(ms)) return new Date(ms).toISOString();
+  }
+
+  const expiresIn = Number(firstInputValue(input, "expires_in", "expiresIn") || 0);
+  if (Number.isFinite(expiresIn) && expiresIn > 0) {
+    return new Date(Date.now() + expiresIn * 1000).toISOString();
+  }
+
+  const payload = decodeJwtPayload(firstInputValue(input, "access_token", "accessToken"));
+  if (payload?.exp) {
+    return new Date(payload.exp * 1000).toISOString();
+  }
+
+  return new Date(Date.now() + DEFAULT_EXPIRES_IN * 1000).toISOString();
+}
+
+export function normalizeKiroExternalIdpAuth(rawAuth) {
+  let input = rawAuth;
+  if (typeof input === "string") {
+    try {
+      input = JSON.parse(input);
+    } catch {
+      throw new Error("CLIProxyAPI auth JSON is invalid");
+    }
+  }
+
+  if (!input || typeof input !== "object") {
+    throw new Error("CLIProxyAPI auth JSON is required");
+  }
+
+  const authMethod = normalizeString(firstInputValue(input, "auth_method", "authMethod"));
+  if (authMethod && authMethod !== "external_idp") {
+    throw new Error("Only external_idp Kiro auth is supported by this importer");
+  }
+
+  const accessToken = normalizeString(firstInputValue(input, "access_token", "accessToken"));
+  const refreshToken = normalizeString(firstInputValue(input, "refresh_token", "refreshToken"));
+  const clientId = normalizeString(firstInputValue(input, "client_id", "clientId"));
+  const tokenEndpoint = validateMicrosoftTokenEndpoint(firstInputValue(input, "token_endpoint", "tokenEndpoint"));
+  const profileArn = normalizeString(firstInputValue(input, "profile_arn", "profileArn"));
+  const region = normalizeString(input.region) || DEFAULT_REGION;
+  const scope = normalizeScope(firstInputValue(input, "scopes", "scope"));
+
+  if (!accessToken) throw new Error("access_token is required");
+  if (!refreshToken) throw new Error("refresh_token is required");
+  if (!clientId) throw new Error("client_id is required");
+  if (!scope) throw new Error("scopes is required");
+  if (!profileArn) throw new Error("profile_arn is required");
+
+  const payload = decodeJwtPayload(accessToken);
+  const email = firstInputValue(input, "email")
+    || payload?.email
+    || payload?.preferred_username
+    || payload?.upn
+    || payload?.sub
+    || null;
+
+  return {
+    accessToken,
+    refreshToken,
+    expiresAt: resolveExpiresAt(input),
+    email,
+    providerSpecificData: {
+      profileArn,
+      region,
+      authMethod: "external_idp",
+      provider: "CLIProxyAPI",
+      clientId,
+      tokenEndpoint,
+      scope,
+    },
+  };
+}
+
+export function buildExternalIdpRefreshParams(refreshToken, providerSpecificData = {}) {
+  const clientId = normalizeString(firstInputValue(providerSpecificData, "clientId", "client_id"));
+  const tokenEndpoint = validateMicrosoftTokenEndpoint(firstInputValue(providerSpecificData, "tokenEndpoint", "token_endpoint"));
+  const scope = normalizeScope(firstInputValue(providerSpecificData, "scope", "scopes"));
+
+  if (!refreshToken) throw new Error("refresh token is required");
+  if (!clientId) throw new Error("clientId is required for external_idp refresh");
+  if (!scope) throw new Error("scope is required for external_idp refresh");
+
+  return {
+    tokenEndpoint,
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      client_id: clientId,
+      refresh_token: refreshToken,
+      scope,
+    }),
+    providerSpecificData: {
+      ...providerSpecificData,
+      authMethod: "external_idp",
+      clientId,
+      tokenEndpoint,
+      scope,
+    },
+  };
+}