swayrouter 1.0.0

package/src/lib/oauth/providers/kimi.js

@@ -0,0 +1,79 @@
+import crypto from "crypto";
+import { KIMI_CONFIG } from "../constants/oauth.js";
+
+const kimi = {
+  config: KIMI_CONFIG,
+  flowType: "device_code",
+  requestDeviceCode: async (config) => {
+    const { buildKimiHeaders } = await import("../../../config/appConstants.js");
+    const deviceId = crypto.randomUUID();
+    const headers = {
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json",
+      ...buildKimiHeaders(deviceId),
+    };
+    const response = await fetch(config.deviceCodeUrl, {
+      method: "POST",
+      headers,
+      body: new URLSearchParams({ client_id: config.clientId }),
+    });
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Device code request failed: ${error}`);
+    }
+    const data = await response.json();
+    const authorizeDeviceUrl = config.authorizeDeviceUrl || "https://www.kimi.com/code/authorize_device";
+    return {
+      device_code: data.device_code,
+      user_code: data.user_code,
+      verification_uri: data.verification_uri || authorizeDeviceUrl,
+      verification_uri_complete:
+        data.verification_uri_complete ||
+        `${authorizeDeviceUrl}?user_code=${data.user_code}`,
+      expires_in: data.expires_in,
+      interval: data.interval || 5,
+      _kimiDeviceId: deviceId,
+    };
+  },
+  pollToken: async (config, deviceCode, _codeVerifier, extraData) => {
+    const { buildKimiHeaders } = await import("../../../config/appConstants.js");
+    const deviceId = extraData?._kimiDeviceId;
+    const headers = {
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json",
+      ...buildKimiHeaders(deviceId),
+    };
+    const response = await fetch(config.tokenUrl, {
+      method: "POST",
+      headers,
+      body: new URLSearchParams({
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        client_id: config.clientId,
+        device_code: deviceCode,
+      }),
+    });
+    let data;
+    try {
+      data = await response.json();
+    } catch {
+      data = { error: "invalid_response", error_description: "non-json token response" };
+    }
+
+    if (data.error === "authorization_pending" || data.error === "slow_down") {
+      return { ok: true, data };
+    }
+    if (data.access_token && deviceId) data._kimiDeviceId = deviceId;
+    return { ok: response.ok || !!data.access_token || !!data.error, data };
+  },
+  mapTokens: (tokens) => ({
+    accessToken: tokens.access_token,
+    refreshToken: tokens.refresh_token,
+    expiresIn: tokens.expires_in,
+    providerSpecificData: {
+      authMethod: "device_code",
+      ...(tokens._kimiDeviceId ? { deviceId: tokens._kimiDeviceId } : {}),
+    },
+  }),
+};
+
+export default kimi;

package/src/lib/oauth/providers/kiro.js

@@ -0,0 +1,147 @@
+import { KIRO_CONFIG, assertValidAwsRegion } from "../constants/oauth.js";
+import { extractEmailFromAccessToken } from "../providerHelpers.js";
+
+const kiro = {
+  config: KIRO_CONFIG,
+  flowType: "device_code",
+
+  requestDeviceCode: async (config, codeChallenge, options = {}) => {
+    const trimmedRegion = typeof options.region === "string" ? options.region.trim() : "";
+    const region = trimmedRegion || "us-east-1";
+    assertValidAwsRegion(region);
+    const trimmedStartUrl = typeof options.startUrl === "string" ? options.startUrl.trim() : "";
+    const startUrl = trimmedStartUrl || config.startUrl;
+    const authMethod = options.authMethod === "idc" ? "idc" : "builder-id";
+    const registerClientUrl = `https://oidc.${region}.amazonaws.com/client/register`;
+    const deviceAuthUrl = `https://oidc.${region}.amazonaws.com/device_authorization`;
+
+    const registerRes = await fetch(registerClientUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json",
+      },
+      body: JSON.stringify({
+        clientName: config.clientName,
+        clientType: config.clientType,
+        scopes: config.scopes,
+        grantTypes: config.grantTypes,
+        issuerUrl: config.issuerUrl,
+      }),
+    });
+
+    if (!registerRes.ok) {
+      const error = await registerRes.text();
+      throw new Error(`Client registration failed: ${error}`);
+    }
+
+    const clientInfo = await registerRes.json();
+
+    const deviceRes = await fetch(deviceAuthUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json",
+      },
+      body: JSON.stringify({
+        clientId: clientInfo.clientId,
+        clientSecret: clientInfo.clientSecret,
+        startUrl,
+      }),
+    });
+
+    if (!deviceRes.ok) {
+      const error = await deviceRes.text();
+      throw new Error(`Device authorization failed: ${error}`);
+    }
+
+    const deviceData = await deviceRes.json();
+
+    return {
+      device_code: deviceData.deviceCode,
+      user_code: deviceData.userCode,
+      verification_uri: deviceData.verificationUri,
+      verification_uri_complete: deviceData.verificationUriComplete,
+      expires_in: deviceData.expiresIn,
+      interval: deviceData.interval || 5,
+
+      _clientId: clientInfo.clientId,
+      _clientSecret: clientInfo.clientSecret,
+      _region: region,
+      _authMethod: authMethod,
+      _startUrl: startUrl,
+    };
+  },
+  pollToken: async (config, deviceCode, codeVerifier, extraData) => {
+    const region = extraData?._region || "us-east-1";
+    assertValidAwsRegion(region);
+    const tokenUrl = `https://oidc.${region}.amazonaws.com/token`;
+    const response = await fetch(tokenUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json",
+      },
+      body: JSON.stringify({
+        clientId: extraData?._clientId,
+        clientSecret: extraData?._clientSecret,
+        deviceCode: deviceCode,
+        grantType: "urn:ietf:params:oauth:grant-type:device_code",
+      }),
+    });
+
+    let data;
+    try {
+      data = await response.json();
+    } catch (e) {
+      const text = await response.text();
+      data = { error: "invalid_response", error_description: text };
+    }
+
+    if (data.accessToken) {
+      return {
+        ok: true,
+        data: {
+          access_token: data.accessToken,
+          refresh_token: data.refreshToken,
+          expires_in: data.expiresIn,
+          profile_arn: data?.profileArn || null,
+
+          _clientId: extraData?._clientId,
+          _clientSecret: extraData?._clientSecret,
+          _region: extraData?._region,
+          _authMethod: extraData?._authMethod,
+          _startUrl: extraData?._startUrl,
+        },
+      };
+    }
+
+    return {
+      ok: false,
+      data: {
+        error: data.error || "authorization_pending",
+        error_description: data.error_description || data.message,
+      },
+    };
+  },
+  mapTokens: (tokens) => {
+    const email = extractEmailFromAccessToken(tokens.access_token);
+    const mapped = {
+      accessToken: tokens.access_token,
+      refreshToken: tokens.refresh_token,
+      expiresIn: tokens.expires_in,
+      email,
+      providerSpecificData: {
+        profileArn: tokens?.profile_arn || null,
+        clientId: tokens._clientId,
+        clientSecret: tokens._clientSecret,
+        region: tokens._region || "us-east-1",
+        authMethod: tokens._authMethod || "builder-id",
+        startUrl: tokens._startUrl || KIRO_CONFIG.startUrl,
+      },
+    };
+    return mapped;
+  },
+};
+
+export default kiro;

package/src/lib/oauth/providers/qoder.js

@@ -0,0 +1,90 @@
+import { QODER_CONFIG } from "../constants/oauth.js";
+
+const qoder = {
+  config: QODER_CONFIG,
+  flowType: "device_code",
+
+  deviceCodePkce: true,
+
+  requestDeviceCode: async (config) => {
+    const { QoderService } = await import("@/lib/oauth/services/qoder");
+    const flow = new QoderService().initiateDeviceFlow();
+
+    return {
+      device_code: flow.nonce,
+      user_code: flow.nonce.slice(0, 8).toUpperCase(),
+      verification_uri: config.loginUrl,
+      verification_uri_complete: flow.verificationUriComplete,
+      expires_in: 300,
+      interval: 2,
+      codeVerifier: flow.codeVerifier,
+      _qoderNonce: flow.nonce,
+      _qoderMachineId: flow.machineId,
+    };
+  },
+  pollToken: async (config, deviceCode, codeVerifier, extraData) => {
+    const { QoderService } = await import("@/lib/oauth/services/qoder");
+    const svc = new QoderService();
+    const nonce = deviceCode || extraData?._qoderNonce;
+    const verifier = codeVerifier || extraData?._qoderVerifier;
+    if (!nonce || !verifier) {
+      return {
+        ok: false,
+        data: { error: "invalid_request", error_description: "Missing nonce/verifier" },
+      };
+    }
+    let result;
+    try {
+      result = await svc.pollDeviceToken({ nonce, codeVerifier: verifier });
+    } catch (err) {
+      return {
+        ok: false,
+        data: { error: "poll_failed", error_description: err.message },
+      };
+    }
+    if (result.status === "pending") {
+      return { ok: false, data: { error: "authorization_pending" } };
+    }
+
+    const userInfo = await svc.fetchUserInfo(result.accessToken);
+
+    const minSeconds = 24 * 60 * 60;
+    const remainingSeconds = Math.floor((result.expireTime - Date.now()) / 1000);
+    const expiresIn = Math.max(minSeconds, remainingSeconds);
+    return {
+      ok: true,
+      data: {
+        access_token: result.accessToken,
+        refresh_token: result.refreshToken,
+        expires_in: expiresIn,
+        _qoderUserId: result.userId,
+        _qoderMachineId: extraData?._qoderMachineId || "",
+        _qoderName: userInfo.name,
+        _qoderEmail: userInfo.email,
+        _qoderOrganizationId: userInfo.organizationId,
+      },
+    };
+  },
+  mapTokens: (tokens) => {
+    const rawEmail = (tokens._qoderEmail || "").trim();
+    const displayName = (tokens._qoderName || "").trim() || null;
+    const userId = tokens._qoderUserId || "";
+
+    const email = rawEmail || (userId ? `qoder-user-${userId}` : null);
+    return {
+      accessToken: tokens.access_token,
+      refreshToken: tokens.refresh_token || null,
+      expiresIn: tokens.expires_in,
+      email,
+      displayName,
+      providerSpecificData: {
+        authMethod: "device",
+        userId,
+        machineId: tokens._qoderMachineId || "",
+        organizationId: tokens._qoderOrganizationId || "",
+      },
+    };
+  },
+};
+
+export default qoder;

package/src/lib/oauth/providers/trae.js

@@ -0,0 +1,244 @@
+import crypto from "crypto";
+import { TRAE_CONFIG } from "../constants/oauth.js";
+import { extractJsonPath } from "./_shared.js";
+
+function buildTraeDeviceContext() {
+  return {
+    plugin_version: TRAE_CONFIG.defaultPluginVersion,
+    machine_id: crypto.randomUUID(),
+    device_id: TRAE_CONFIG.defaultDeviceId,
+    x_device_brand: "unknown",
+    x_device_type: "unknown",
+    x_os_version: "unknown",
+    x_env: "",
+    x_app_version: TRAE_CONFIG.defaultAppVersion,
+    x_app_type: TRAE_CONFIG.defaultAppType,
+  };
+}
+
+async function fetchTraeLoginGuidance(loginTraceId) {
+  const body = JSON.stringify({ loginTraceID: loginTraceId, login_trace_id: loginTraceId });
+  let lastErr = "no successful response";
+  for (const url of TRAE_CONFIG.loginGuidanceUrls) {
+    try {
+      const res = await fetch(url, {
+        method: "POST",
+        headers: {
+          Accept: "application/json",
+          "Content-Type": "application/json",
+          "User-Agent": TRAE_CONFIG.userAgent,
+        },
+        body,
+      });
+      if (!res.ok) { lastErr = `${url} HTTP ${res.status}`; continue; }
+      const data = await res.json();
+      const loginHost = extractJsonPath(data, [
+        ["Result", "LoginHost"], ["Result", "loginHost"], ["Result", "LoginURL"],
+        ["result", "loginHost"], ["data", "Result", "LoginHost"], ["data", "loginHost"],
+        ["LoginHost"], ["loginHost"],
+      ]);
+      if (loginHost) return loginHost;
+      lastErr = `${url} missing LoginHost`;
+    } catch (e) { lastErr = `${url} ${e.message}`; }
+  }
+  throw new Error(`Trae GetLoginGuidance failed: ${lastErr}`);
+}
+
+function buildTraeVerificationUrl(loginHost, loginTraceId, callbackUrl, ctx) {
+  const url = new URL(loginHost.startsWith("http") ? loginHost : `https://${loginHost.replace(/^\/+/, "")}`);
+  url.pathname = TRAE_CONFIG.authorizationPath;
+  const p = new URLSearchParams();
+  p.set("login_version", "1");
+  p.set("auth_from", "trae");
+  p.set("login_channel", "native_ide");
+  p.set("plugin_version", ctx.plugin_version);
+  p.set("auth_type", "local");
+  p.set("client_id", TRAE_CONFIG.clientId);
+  p.set("redirect", "0");
+  p.set("login_trace_id", loginTraceId);
+  p.set("auth_callback_url", callbackUrl);
+  p.set("machine_id", ctx.machine_id);
+  p.set("device_id", ctx.device_id);
+  p.set("x_device_id", ctx.device_id);
+  p.set("x_machine_id", ctx.machine_id);
+  p.set("x_device_brand", ctx.x_device_brand);
+  p.set("x_device_type", ctx.x_device_type);
+  p.set("x_os_version", ctx.x_os_version);
+  p.set("x_env", ctx.x_env);
+  p.set("x_app_version", ctx.x_app_version);
+  p.set("x_app_type", ctx.x_app_type);
+  url.search = p.toString();
+  return url.toString();
+}
+
+function parseTraeCallback(raw) {
+  const text = String(raw || "").trim();
+  let queryStr = text;
+  if (text.includes("?")) queryStr = text.slice(text.indexOf("?") + 1);
+  if (text.startsWith("#")) queryStr = text.slice(1);
+  const params = Object.fromEntries(new URLSearchParams(queryStr));
+  const pick = (keys) => {
+    for (const k of keys) { const v = params[k]; if (v && String(v).trim()) return String(v).trim(); }
+    return null;
+  };
+  const err = pick(["error", "error_code", "errorCode"]);
+  if (err) {
+    const desc = pick(["error_description", "error_desc", "message"]);
+    throw new Error(desc ? `Trae auth failed: ${err} (${desc})` : `Trae auth failed: ${err}`);
+  }
+  const refreshToken = pick(["refreshToken", "refresh_token", "RefreshToken"]);
+  if (!refreshToken) throw new Error("Trae callback missing refreshToken");
+  const loginHost = pick(["loginHost", "login_host", "LoginHost", "host", "consoleHost"]);
+  if (!loginHost) throw new Error("Trae callback missing loginHost");
+  const cloudideToken = pick(["x-cloudide-token", "xCloudideToken", "accessToken", "access_token", "token"]);
+  return { refreshToken, loginHost, cloudideToken };
+}
+
+function traeApiOrigins() {
+  return [...TRAE_CONFIG.apiOrigins];
+}
+
+async function fetchTraeExchangeToken(refreshToken, cloudideToken) {
+  const body = JSON.stringify({
+    ClientID: TRAE_CONFIG.clientId,
+    RefreshToken: refreshToken,
+    ClientSecret: TRAE_CONFIG.clientSecret,
+    UserID: "",
+  });
+  let lastErr = "no successful response";
+  for (const origin of traeApiOrigins()) {
+    const url = `${origin.replace(/\/$/, "")}${TRAE_CONFIG.exchangeTokenPath}`;
+    try {
+      const headers = {
+        Accept: "application/json",
+        "Content-Type": "application/json",
+        "User-Agent": TRAE_CONFIG.userAgent,
+      };
+      if (cloudideToken) headers["x-cloudide-token"] = cloudideToken;
+      const res = await fetch(url, { method: "POST", headers, body });
+      const text = await res.text();
+      if (!res.ok) { lastErr = `${url} HTTP ${res.status}`; continue; }
+      let data; try { data = JSON.parse(text); } catch { lastErr = `${url} invalid JSON`; continue; }
+      const accessToken = extractJsonPath(data, [
+        ["Result", "AccessToken"], ["Result", "accessToken"], ["result", "access_token"], ["accessToken"],
+      ]);
+      if (!accessToken) {
+        const msg = extractJsonPath(data, [["message"], ["msg"], ["error"], ["Result", "Message"]]) || "missing AccessToken";
+        lastErr = `${url} ${msg}`;
+        continue;
+      }
+      return {
+        accessToken,
+        refreshToken: extractJsonPath(data, [["Result", "RefreshToken"], ["result", "refresh_token"], ["refreshToken"]]) || refreshToken,
+        expiresIn: null,
+        expiresAt: extractJsonPath(data, [["Result", "ExpiresAt"], ["Result", "expiresAt"], ["result", "expires_at"], ["expiresAt"]]),
+      };
+    } catch (e) { lastErr = `${url} ${e.message}`; }
+  }
+  throw new Error(`Trae ExchangeToken failed: ${lastErr}`);
+}
+
+async function fetchTraeUserInfo(accessToken) {
+  for (const origin of traeApiOrigins()) {
+    const url = `${origin.replace(/\/$/, "")}${TRAE_CONFIG.getUserInfoPath}`;
+    try {
+      const res = await fetch(url, {
+        method: "POST",
+        headers: {
+          Accept: "application/json",
+          "Content-Type": "application/json",
+          "User-Agent": TRAE_CONFIG.userAgent,
+          "x-cloudide-token": accessToken,
+        },
+        body: JSON.stringify({}),
+      });
+      if (!res.ok) continue;
+      const data = await res.json();
+      return {
+        email: extractJsonPath(data, [
+          ["Result", "NonPlainTextEmail"], ["Result", "Email"], ["Result", "email"],
+          ["email"], ["data", "email"],
+        ]),
+        name: extractJsonPath(data, [
+          ["Result", "ScreenName"], ["Result", "Nickname"], ["Result", "Name"],
+          ["result", "nickname"], ["nickname"], ["name"],
+        ]),
+        aiRegion: extractJsonPath(data, [["Result", "AIRegion"], ["Result", "aiRegion"], ["aiRegion"]]),
+        region: extractJsonPath(data, [["Result", "Region"], ["Result", "region"], ["region"]]),
+        tenant: extractJsonPath(data, [["Result", "TenantID"], ["Result", "tenantId"], ["tenantId"]]),
+        userId: extractJsonPath(data, [["Result", "UserID"], ["Result", "userId"], ["userId"]]),
+      };
+    } catch {                       }
+  }
+  return { email: null, name: null };
+}
+
+function traeScopeForRegion(aiRegion) {
+  const r = (aiRegion || "").toLowerCase();
+  if (r === "sg" || r.includes("singapore")) return "marscode-sg";
+  if (r === "cn" || r.includes("cn") || r.includes("china")) return "marscode-cn";
+  return "marscode-us";
+}
+
+const trae = {
+  config: TRAE_CONFIG,
+  flowType: "authorization_code",
+  callbackPath: TRAE_CONFIG.callbackPath,
+  prepareConfig: async (config) => {
+    const loginTraceID = crypto.randomUUID();
+    const loginHost = await fetchTraeLoginGuidance(loginTraceID);
+    return { ...config, loginTraceID, loginHost };
+  },
+  buildAuthUrl: (config, redirectUri, state) => {
+    const ctx = buildTraeDeviceContext();
+    const traceId = config.loginTraceID || state;
+    return buildTraeVerificationUrl(config.loginHost, traceId, redirectUri, ctx);
+  },
+  exchangeToken: async (config, code) => {
+    const trimmed = String(code || "").trim();
+
+    const looksCallback = /[?=&]/.test(trimmed) && (trimmed.includes("refreshToken") || trimmed.includes("refresh_token"));
+    if (!looksCallback) {
+
+      const clean = trimmed.replace(/^(Cloud-IDE-JWT|Bearer)\s+/i, "");
+      return { accessToken: clean, refreshToken: null, expiresIn: TRAE_CONFIG.tokenLifetimeDays * 24 * 60 * 60, _authMethod: "imported" };
+    }
+    const { refreshToken, cloudideToken } = parseTraeCallback(trimmed);
+    return { ...(await fetchTraeExchangeToken(refreshToken, cloudideToken)), _authMethod: "oauth" };
+  },
+  postExchange: async (tokens) => {
+    const userInfo = await fetchTraeUserInfo(tokens.accessToken);
+    return { userInfo };
+  },
+  mapTokens: (tokens, extra) => {
+    const expiresIn = tokens.expiresIn
+      || (tokens.expiresAt ? Math.max(60, Number(tokens.expiresAt) - Math.floor(Date.now() / 1000)) : TRAE_CONFIG.tokenLifetimeDays * 24 * 60 * 60);
+    const ui = extra?.userInfo || {};
+    const aiRegion = ui.aiRegion || "US-East";
+
+    return {
+      accessToken: tokens.accessToken,
+      refreshToken: tokens.refreshToken,
+      expiresIn,
+      email: ui.email || undefined,
+      displayName: ui.name || undefined,
+      providerSpecificData: {
+        authMethod: tokens._authMethod || "oauth",
+        aiRegion,
+        region: ui.region || aiRegion,
+        tenant: ui.tenant || "marscode",
+        userId: ui.userId || "",
+        scope: traeScopeForRegion(aiRegion),
+        webId: "",
+        bizUserId: "",
+        userUniqueId: "",
+        appLanguage: "en",
+        appVersion: TRAE_CONFIG.defaultAppVersion,
+        userRegion: aiRegion === "SG" ? "SG" : "US",
+        userIdentity: "Free",
+      },
+    };
+  },
+};
+
+export default trae;

package/src/lib/oauth/providers/windsurf.js

@@ -0,0 +1,123 @@
+import { WINDSURF_CONFIG } from "../constants/oauth.js";
+import { extractJsonPath } from "./_shared.js";
+
+async function windsurfSeatRequest(baseUrl, path, body) {
+  const url = `${baseUrl.replace(/\/$/, "")}${path}`;
+  const res = await fetch(url, {
+    method: "POST",
+    headers: {
+      Accept: "application/json",
+      "Content-Type": "application/json",
+      "User-Agent": WINDSURF_CONFIG.userAgent,
+    },
+    body: JSON.stringify(body),
+  });
+  const text = await res.text();
+  if (!res.ok) throw new Error(`Windsurf ${path} HTTP ${res.status}: ${text.slice(0, 200)}`);
+  try { return JSON.parse(text); } catch { throw new Error(`Windsurf ${path} invalid JSON`); }
+}
+
+function parseWindsurfCallback(raw, expectedState) {
+  const text = String(raw || "").trim();
+  let queryStr = text;
+  if (text.includes("?")) queryStr = text.slice(text.indexOf("?") + 1);
+  if (text.startsWith("#")) queryStr = text.slice(1);
+  const params = Object.fromEntries(new URLSearchParams(queryStr));
+  const pick = (keys) => {
+    for (const k of keys) { const v = params[k]; if (v && String(v).trim()) return String(v).trim(); }
+    return null;
+  };
+  const err = pick(["error"]);
+  if (err) {
+    const desc = pick(["error_description"]);
+    throw new Error(desc ? `Windsurf auth failed: ${err} (${desc})` : `Windsurf auth failed: ${err}`);
+  }
+  const accessToken = pick(["access_token", "token"]);
+  if (!accessToken) throw new Error("Windsurf callback missing access_token");
+  const state = pick(["state"]);
+  if (expectedState && state && state !== expectedState) {
+    throw new Error("Windsurf callback state mismatch");
+  }
+  return { firebaseIdToken: accessToken };
+}
+
+async function fetchWindsurfRegisterUser(firebaseIdToken) {
+  const data = await windsurfSeatRequest(WINDSURF_CONFIG.registerApiBaseUrl, WINDSURF_CONFIG.registerPath, {
+    firebase_id_token: firebaseIdToken,
+  });
+  const apiKey = extractJsonPath(data, [["apiKey"], ["api_key"]]);
+  if (!apiKey) throw new Error("Windsurf RegisterUser missing apiKey");
+  const apiServerUrl = extractJsonPath(data, [["apiServerUrl"], ["api_server_url"]]) || WINDSURF_CONFIG.defaultApiServerUrl;
+  const name = extractJsonPath(data, [["name"]]);
+  return { apiKey, apiServerUrl, name };
+}
+
+async function fetchWindsurfUserInfo(apiServerUrl, firebaseIdToken) {
+  try {
+    const authRes = await windsurfSeatRequest(apiServerUrl, WINDSURF_CONFIG.oneTimeAuthPath, { firebaseIdToken });
+    const authToken = extractJsonPath(authRes, [["authToken"], ["auth_token"]]);
+    if (!authToken) return { email: null, name: null };
+    const userRes = await windsurfSeatRequest(apiServerUrl, WINDSURF_CONFIG.currentUserPath, {
+      authToken,
+      includeSubscription: true,
+    });
+    const user = userRes.user || userRes;
+    return {
+      email: extractJsonPath(user, [["email"]]),
+      name: extractJsonPath(user, [["name"]]),
+    };
+  } catch { return { email: null, name: null }; }
+}
+
+const windsurf = {
+  config: WINDSURF_CONFIG,
+  flowType: "authorization_code",
+  callbackPath: WINDSURF_CONFIG.callbackPath,
+  buildAuthUrl: (config, redirectUri, state) => {
+    const params = new URLSearchParams({
+      response_type: "token",
+      client_id: config.clientId,
+      redirect_uri: redirectUri,
+      state,
+      prompt: "login",
+      redirect_parameters_type: "query",
+      workflow: "onboarding",
+    });
+    return `${config.authBaseUrl}${config.signInPath}?${params.toString()}`;
+  },
+  exchangeToken: async (config, code, redirectUri, codeVerifier, state) => {
+    const trimmed = String(code || "").trim();
+    const looksCallback = trimmed.includes("?") || trimmed.includes("access_token=");
+    if (!looksCallback) {
+
+      const clean = trimmed.replace(/^Bearer\s+/i, "");
+      if (clean.startsWith("sk-ws-")) {
+        return { accessToken: clean, refreshToken: null, expiresIn: null, apiServerUrl: config.defaultApiServerUrl, firebaseIdToken: null, _authMethod: "imported" };
+      }
+      const reg = await fetchWindsurfRegisterUser(clean);
+      return { accessToken: reg.apiKey, refreshToken: null, expiresIn: null, apiServerUrl: reg.apiServerUrl, firebaseIdToken: clean, _authMethod: "imported" };
+    }
+    const { firebaseIdToken } = parseWindsurfCallback(trimmed, state);
+    const reg = await fetchWindsurfRegisterUser(firebaseIdToken);
+    return { accessToken: reg.apiKey, refreshToken: null, expiresIn: null, apiServerUrl: reg.apiServerUrl, firebaseIdToken, _authMethod: "oauth" };
+  },
+  postExchange: async (tokens) => {
+    if (!tokens.firebaseIdToken) return { userInfo: { email: null, name: null } };
+    const info = await fetchWindsurfUserInfo(tokens.apiServerUrl, tokens.firebaseIdToken);
+    return { userInfo: info };
+  },
+  mapTokens: (tokens, extra) => ({
+    accessToken: tokens.accessToken,
+    refreshToken: null,
+    expiresIn: null,
+    email: extra?.userInfo?.email || undefined,
+    displayName: extra?.userInfo?.name || undefined,
+    providerSpecificData: {
+      authMethod: tokens._authMethod || "oauth",
+      apiServerUrl: tokens.apiServerUrl,
+      firebaseIdToken: tokens.firebaseIdToken,
+    },
+  }),
+};
+
+export default windsurf;