ucpify 1.2.0 → 1.2.1

package/dist/express-app.js

@@ -1,495 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createExpressApp = createExpressApp;
-const express_1 = __importDefault(require("express"));
-const express_rate_limit_1 = __importDefault(require("express-rate-limit"));
-const ucp_server_1 = require("./ucp-server");
-const ucp_server_db_1 = require("./ucp-server-db");
-const schema_1 = require("./schema");
-const db_1 = require("./db");
-const logger_1 = require("./logger");
-const stripe_1 = require("./stripe");
-const paypal_1 = require("./paypal");
-const oauth_1 = require("./oauth");
-// Rate limiters
-const apiLimiter = (0, express_rate_limit_1.default)({
-    windowMs: 60 * 1000, // 1 minute
-    max: 100, // 100 requests per minute
-    standardHeaders: true,
-    legacyHeaders: false,
-    message: { error: 'Too many requests, please try again later' },
-});
-const checkoutLimiter = (0, express_rate_limit_1.default)({
-    windowMs: 60 * 1000,
-    max: 20, // 20 checkout creates per minute
-    standardHeaders: true,
-    legacyHeaders: false,
-    message: { error: 'Too many checkout requests' },
-});
-function createExpressApp(config, options) {
-    const app = (0, express_1.default)();
-    const ucpServer = options?.useDb
-        ? new ucp_server_db_1.UCPServerDB(config)
-        : new ucp_server_1.UCPServer(config);
-    const useDb = options?.useDb ?? false;
-    // OAuth setup (built-in or external)
-    const oauthEnabled = !!config.oauth;
-    const oauthManager = oauthEnabled && config.oauth?.provider === 'built-in'
-        ? new oauth_1.OAuthManager()
-        : null;
-    // Apply rate limiting to API routes
-    app.use('/ucp/v1/', apiLimiter);
-    // Stripe webhook needs raw body - must come before json parser
-    app.post('/webhooks/stripe', express_1.default.raw({ type: 'application/json' }), (req, res) => {
-        const signature = req.headers['stripe-signature'];
-        if (!signature) {
-            res.status(400).json({ error: 'Missing stripe-signature header' });
-            return;
-        }
-        const event = (0, stripe_1.constructWebhookEvent)(req.body, signature);
-        if (!event) {
-            res.status(400).json({ error: 'Invalid webhook signature' });
-            return;
-        }
-        logger_1.logger.info({ type: event.type }, 'Stripe webhook received');
-        switch (event.type) {
-            case 'payment_intent.succeeded': {
-                const paymentIntent = event.data.object;
-                const checkoutId = paymentIntent.metadata?.checkout_id;
-                const orderId = paymentIntent.metadata?.order_id;
-                if (checkoutId && useDb) {
-                    db_1.db.prepare(`UPDATE checkouts SET payment_status = 'succeeded', updated_at = ? WHERE id = ?`)
-                        .run(new Date().toISOString(), checkoutId);
-                    if (orderId) {
-                        db_1.db.prepare(`UPDATE orders SET payment_status = 'succeeded' WHERE id = ?`).run(orderId);
-                    }
-                    logger_1.logger.info({ checkoutId, orderId, paymentIntentId: paymentIntent.id }, 'Payment succeeded');
-                }
-                break;
-            }
-            case 'payment_intent.payment_failed': {
-                const paymentIntent = event.data.object;
-                const checkoutId = paymentIntent.metadata?.checkout_id;
-                const orderId = paymentIntent.metadata?.order_id;
-                if (checkoutId && useDb) {
-                    db_1.db.prepare(`UPDATE checkouts SET payment_status = 'failed', updated_at = ? WHERE id = ?`)
-                        .run(new Date().toISOString(), checkoutId);
-                    if (orderId) {
-                        db_1.db.prepare(`UPDATE orders SET payment_status = 'failed' WHERE id = ?`).run(orderId);
-                    }
-                    logger_1.logger.error({
-                        checkoutId, orderId, paymentIntentId: paymentIntent.id,
-                        error: paymentIntent.last_payment_error?.message
-                    }, 'Payment failed');
-                }
-                break;
-            }
-        }
-        res.json({ received: true });
-    });
-    // PayPal webhook - capture completed orders
-    app.post('/webhooks/paypal', express_1.default.json(), async (req, res) => {
-        const eventType = req.body.event_type;
-        const resource = req.body.resource;
-        logger_1.logger.info({ eventType, resourceId: resource?.id }, 'PayPal webhook received');
-        if (eventType === 'CHECKOUT.ORDER.APPROVED' && resource?.id) {
-            try {
-                // Capture the payment
-                const capturedOrder = await (0, paypal_1.capturePayPalOrder)(resource.id);
-                if (capturedOrder && capturedOrder.status === 'COMPLETED') {
-                    // Get the checkout ID from the order
-                    const orderDetails = await (0, paypal_1.getPayPalOrder)(resource.id);
-                    const checkoutId = orderDetails?.customId;
-                    if (checkoutId && useDb) {
-                        const now = new Date().toISOString();
-                        db_1.db.prepare(`UPDATE checkouts SET payment_status = 'succeeded', updated_at = ? WHERE paypal_order_id = ?`)
-                            .run(now, resource.id);
-                        db_1.db.prepare(`UPDATE orders SET payment_status = 'succeeded' WHERE paypal_order_id = ?`)
-                            .run(resource.id);
-                        logger_1.logger.info({ checkoutId, paypalOrderId: resource.id }, 'PayPal payment captured and succeeded');
-                    }
-                }
-            }
-            catch (error) {
-                logger_1.logger.error({ error, paypalOrderId: resource.id }, 'Failed to capture PayPal order');
-            }
-        }
-        else if (eventType === 'PAYMENT.CAPTURE.DENIED' && resource?.id) {
-            if (useDb) {
-                const now = new Date().toISOString();
-                db_1.db.prepare(`UPDATE checkouts SET payment_status = 'failed', updated_at = ? WHERE paypal_order_id = ?`)
-                    .run(now, resource.supplementary_data?.related_ids?.order_id);
-                db_1.db.prepare(`UPDATE orders SET payment_status = 'failed' WHERE paypal_order_id = ?`)
-                    .run(resource.supplementary_data?.related_ids?.order_id);
-                logger_1.logger.error({ paypalOrderId: resource.id }, 'PayPal payment denied');
-            }
-        }
-        res.json({ received: true });
-    });
-    app.use(express_1.default.json());
-    // Request logging middleware
-    app.use((req, res, next) => {
-        const start = Date.now();
-        res.on('finish', () => {
-            logger_1.logger.info({
-                method: req.method,
-                path: req.path,
-                status: res.statusCode,
-                duration: Date.now() - start,
-            }, 'Request completed');
-        });
-        next();
-    });
-    // CORS middleware
-    app.use((_req, res, next) => {
-        res.header('Access-Control-Allow-Origin', '*');
-        res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
-        res.header('Access-Control-Allow-Headers', 'Content-Type, UCP-Agent, Authorization');
-        next();
-    });
-    // ─── OAuth 2.0 Identity Linking ─────────────────────────────────────
-    // RFC 8414: OAuth Authorization Server Metadata
-    app.get('/.well-known/oauth-authorization-server', (_req, res) => {
-        if (!oauthEnabled) {
-            res.status(404).json({ error: 'OAuth not configured' });
-            return;
-        }
-        if (config.oauth?.provider === 'external') {
-            // Proxy the merchant's external OAuth metadata
-            res.json({
-                issuer: config.oauth.issuer,
-                authorization_endpoint: config.oauth.authorization_endpoint,
-                token_endpoint: config.oauth.token_endpoint,
-                revocation_endpoint: config.oauth.revocation_endpoint,
-                jwks_uri: config.oauth.jwks_uri,
-                scopes_supported: ['ucp:scopes:checkout_session'],
-                response_types_supported: ['code'],
-                grant_types_supported: ['authorization_code', 'refresh_token'],
-                token_endpoint_auth_methods_supported: ['client_secret_basic'],
-            });
-        }
-        else if (oauthManager) {
-            res.json(oauthManager.getServerMetadata(config.domain));
-        }
-    });
-    // Built-in OAuth endpoints (only when provider is "built-in")
-    if (oauthManager) {
-        // Authorization endpoint - renders consent screen
-        app.get('/oauth2/authorize', (req, res) => {
-            const { client_id, redirect_uri, scope, state, response_type, code_challenge, code_challenge_method } = req.query;
-            if (response_type !== 'code') {
-                res.status(400).json({ error: 'unsupported_response_type' });
-                return;
-            }
-            const client = oauthManager.getClient(client_id);
-            if (!client) {
-                res.status(400).json({ error: 'invalid_client' });
-                return;
-            }
-            if (!client.redirect_uris.includes(redirect_uri)) {
-                res.status(400).json({ error: 'invalid_redirect_uri' });
-                return;
-            }
-            // Render a minimal consent page
-            res.send(`<!DOCTYPE html>
-<html><head><title>Authorize - ${config.name}</title>
-<style>
-body { font-family: system-ui, sans-serif; max-width: 400px; margin: 80px auto; padding: 0 20px; }
-h2 { margin-bottom: 4px; }
-p { color: #666; }
-.scope { background: #f0f0f0; padding: 8px 12px; border-radius: 6px; font-family: monospace; }
-button { padding: 10px 24px; border: none; border-radius: 6px; cursor: pointer; font-size: 14px; margin-right: 8px; }
-.allow { background: #000; color: #fff; }
-.deny { background: #e5e5e5; }
-</style></head>
-<body>
-<h2>${config.name}</h2>
-<p><strong>${client.name}</strong> wants to access your account.</p>
-<div class="scope">${scope || 'ucp:scopes:checkout_session'}</div>
-<p>This will allow the app to manage checkout sessions on your behalf.</p>
-<form method="POST" action="/oauth2/authorize">
-  <input type="hidden" name="client_id" value="${client_id}">
-  <input type="hidden" name="redirect_uri" value="${redirect_uri}">
-  <input type="hidden" name="scope" value="${scope || 'ucp:scopes:checkout_session'}">
-  <input type="hidden" name="state" value="${state || ''}">
-  <input type="hidden" name="code_challenge" value="${code_challenge || ''}">
-  <input type="hidden" name="code_challenge_method" value="${code_challenge_method || ''}">
-  <input type="hidden" name="user_id" value="user_1">
-  <button type="submit" name="action" value="allow" class="allow">Allow</button>
-  <button type="submit" name="action" value="deny" class="deny">Deny</button>
-</form>
-</body></html>`);
-        });
-        // Handle consent form submission
-        app.post('/oauth2/authorize', express_1.default.urlencoded({ extended: false }), (req, res) => {
-            const { client_id, redirect_uri, scope, state, action, user_id, code_challenge, code_challenge_method } = req.body;
-            if (action === 'deny') {
-                const url = new URL(redirect_uri);
-                url.searchParams.set('error', 'access_denied');
-                if (state)
-                    url.searchParams.set('state', state);
-                res.redirect(url.toString());
-                return;
-            }
-            const code = oauthManager.createAuthorizationCode(client_id, user_id, scope, redirect_uri, code_challenge || undefined, code_challenge_method || undefined);
-            const url = new URL(redirect_uri);
-            url.searchParams.set('code', code);
-            if (state)
-                url.searchParams.set('state', state);
-            res.redirect(url.toString());
-        });
-        // Token endpoint
-        app.post('/oauth2/token', (req, res) => {
-            // Client auth via HTTP Basic (RFC 7617)
-            const authHeader = req.headers.authorization;
-            let clientId = req.body.client_id;
-            let clientSecret = req.body.client_secret;
-            if (authHeader && authHeader.startsWith('Basic ')) {
-                const decoded = Buffer.from(authHeader.slice(6), 'base64').toString();
-                const [id, secret] = decoded.split(':');
-                clientId = id;
-                clientSecret = secret;
-            }
-            if (!oauthManager.authenticateClient(clientId, clientSecret)) {
-                res.status(401).json({ error: 'invalid_client' });
-                return;
-            }
-            const grantType = req.body.grant_type;
-            if (grantType === 'authorization_code') {
-                const result = oauthManager.exchangeCode(req.body.code, clientId, req.body.redirect_uri, req.body.code_verifier);
-                if ('error' in result) {
-                    res.status(400).json(result);
-                    return;
-                }
-                res.json({ ...result, token_type: 'Bearer' });
-            }
-            else if (grantType === 'refresh_token') {
-                const result = oauthManager.refreshAccessToken(req.body.refresh_token, clientId);
-                if ('error' in result) {
-                    res.status(400).json(result);
-                    return;
-                }
-                res.json({ ...result, token_type: 'Bearer' });
-            }
-            else {
-                res.status(400).json({ error: 'unsupported_grant_type' });
-            }
-        });
-        // Token revocation (RFC 7009)
-        app.post('/oauth2/revoke', (req, res) => {
-            const authHeader = req.headers.authorization;
-            let clientId = req.body.client_id;
-            let clientSecret = req.body.client_secret;
-            if (authHeader && authHeader.startsWith('Basic ')) {
-                const decoded = Buffer.from(authHeader.slice(6), 'base64').toString();
-                const [id, secret] = decoded.split(':');
-                clientId = id;
-                clientSecret = secret;
-            }
-            if (!oauthManager.authenticateClient(clientId, clientSecret)) {
-                res.status(401).json({ error: 'invalid_client' });
-                return;
-            }
-            oauthManager.revokeToken(req.body.token);
-            // RFC 7009: always respond 200, even if token was invalid
-            res.status(200).json({});
-        });
-    }
-    // Bearer token middleware for UCP routes (when OAuth is enabled)
-    if (oauthEnabled && oauthManager) {
-        app.use('/ucp/v1', (req, res, next) => {
-            const authHeader = req.headers.authorization;
-            if (!authHeader || !authHeader.startsWith('Bearer ')) {
-                res.status(401).json({ error: 'missing_token', message: 'Authorization: Bearer <token> required' });
-                return;
-            }
-            const token = authHeader.slice(7);
-            const validToken = oauthManager.validateAccessToken(token);
-            if (!validToken) {
-                res.status(401).json({ error: 'invalid_token', message: 'Token is expired, revoked, or invalid' });
-                return;
-            }
-            // Attach user info to request
-            req.oauthUserId = validToken.user_id;
-            req.oauthClientId = validToken.client_id;
-            req.oauthScope = validToken.scope;
-            next();
-        });
-    }
-    // UCP Discovery endpoint
-    app.get('/.well-known/ucp', (_req, res) => {
-        res.json(ucpServer.getProfile());
-    });
-    // Create Checkout Session
-    app.post('/ucp/v1/checkout-sessions', checkoutLimiter, (req, res) => {
-        const parsed = schema_1.CreateCheckoutRequestSchema.safeParse(req.body);
-        if (!parsed.success) {
-            res.status(400).json({ error: 'Validation failed', details: parsed.error.issues });
-            return;
-        }
-        try {
-            const session = ucpServer.createCheckout(parsed.data);
-            res.status(201).json(session);
-        }
-        catch (error) {
-            res.status(400).json({ error: 'Invalid request', details: String(error) });
-        }
-    });
-    // Get Checkout Session
-    app.get('/ucp/v1/checkout-sessions/:id', (req, res) => {
-        const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
-        const session = ucpServer.getCheckout(id);
-        if (!session) {
-            res.status(404).json({ error: 'Checkout session not found' });
-            return;
-        }
-        res.json(session);
-    });
-    // Update Checkout Session
-    app.put('/ucp/v1/checkout-sessions/:id', (req, res) => {
-        const parsed = schema_1.UpdateCheckoutRequestSchema.safeParse(req.body);
-        if (!parsed.success) {
-            res.status(400).json({ error: 'Validation failed', details: parsed.error.issues });
-            return;
-        }
-        try {
-            const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
-            const session = ucpServer.updateCheckout(id, parsed.data);
-            if (!session) {
-                res.status(404).json({ error: 'Checkout session not found' });
-                return;
-            }
-            res.json(session);
-        }
-        catch (error) {
-            res.status(400).json({ error: 'Invalid request', details: String(error) });
-        }
-    });
-    // Complete Checkout
-    app.post('/ucp/v1/checkout-sessions/:id/complete', async (req, res) => {
-        const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
-        try {
-            const result = await ucpServer.completeCheckout(id);
-            if ('error' in result) {
-                res.status(400).json(result);
-                return;
-            }
-            res.status(201).json(result);
-        }
-        catch (error) {
-            logger_1.logger.error({ error, checkoutId: id }, 'Failed to complete checkout');
-            res.status(500).json({ error: 'Internal server error' });
-        }
-    });
-    // Cancel Checkout
-    app.post('/ucp/v1/checkout-sessions/:id/cancel', (req, res) => {
-        const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
-        const session = ucpServer.cancelCheckout(id);
-        if (!session) {
-            res.status(404).json({ error: 'Checkout session not found' });
-            return;
-        }
-        res.json(session);
-    });
-    // Get Order
-    app.get('/ucp/v1/orders/:id', (req, res) => {
-        const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
-        const order = ucpServer.getOrder(id);
-        if (!order) {
-            res.status(404).json({ error: 'Order not found' });
-            return;
-        }
-        res.json(order);
-    });
-    // List Orders
-    app.get('/ucp/v1/orders', (_req, res) => {
-        res.json(ucpServer.listOrders());
-    });
-    // Product catalog (convenience endpoint)
-    app.get('/ucp/v1/items', (_req, res) => {
-        res.json(ucpServer.getConfig().items);
-    });
-    // Admin stats endpoint
-    app.get('/admin/stats', (_req, res) => {
-        if (!useDb) {
-            res.status(501).json({ error: 'Stats require database mode' });
-            return;
-        }
-        try {
-            const checkoutStats = db_1.db.prepare(`
-        SELECT status, COUNT(*) as count FROM checkouts GROUP BY status
-      `).all();
-            const orderStats = db_1.db.prepare(`
-        SELECT payment_status, payment_provider, COUNT(*) as count 
-        FROM orders GROUP BY payment_status, payment_provider
-      `).all();
-            const revenueResult = db_1.db.prepare(`
-        SELECT SUM(json_extract(totals_json, '$[?(@.type=="total")].amount')) as total
-        FROM orders WHERE payment_status = 'succeeded'
-      `).get();
-            const todayOrders = db_1.db.prepare(`
-        SELECT COUNT(*) as count FROM orders 
-        WHERE date(created_at) = date('now')
-      `).get();
-            res.json({
-                checkouts: Object.fromEntries(checkoutStats.map(s => [s.status, s.count])),
-                orders: {
-                    by_payment_status: Object.fromEntries(orderStats.map(s => [`${s.payment_provider || 'none'}_${s.payment_status}`, s.count])),
-                    today: todayOrders.count,
-                },
-                revenue: {
-                    total_succeeded: revenueResult.total || 0,
-                },
-                timestamp: new Date().toISOString(),
-            });
-        }
-        catch (error) {
-            logger_1.logger.error({ error }, 'Failed to get admin stats');
-            res.status(500).json({ error: 'Failed to get stats' });
-        }
-    });
-    // Admin dashboard HTML
-    app.get('/admin', (_req, res) => {
-        const statsScript = useDb
-            ? `fetch('/admin/stats').then(r=>r.json()).then(d=>{
-  document.getElementById('stats').innerHTML = \`
-    <div class="card"><div class="stat">\${Object.values(d.checkouts).reduce((a,b)=>a+b,0)}</div><div class="label">Total Checkouts</div></div>
-    <div class="card"><div class="stat">\${d.checkouts.completed||0}</div><div class="label">Completed</div></div>
-    <div class="card"><div class="stat">\${d.orders.today||0}</div><div class="label">Orders Today</div></div>
-    <div class="card"><div class="stat">$\${(d.revenue.total_succeeded/100).toFixed(2)}</div><div class="label">Revenue</div></div>
-  \`;
-}).catch(e=>document.getElementById('stats').innerHTML='Error loading stats');`
-            : `document.getElementById('stats').innerHTML = '<div class="card" style="grid-column:1/-1"><div class="label">Running in <strong>in-memory mode</strong>. Stats require <code>--db</code> mode.</div><div style="margin-top:8px;font-size:0.85em;color:#999">Restart with: <code>ucpify serve config.json</code> (DB is on by default)</div></div>';`;
-        res.send(`<!DOCTYPE html>
-<html><head><title>UCP Admin</title>
-<style>
-  body { font-family: system-ui; max-width: 800px; margin: 40px auto; padding: 20px; }
-  .card { background: #f5f5f5; padding: 20px; border-radius: 8px; margin: 10px 0; }
-  .stat { font-size: 2em; font-weight: bold; color: #333; }
-  .label { color: #666; font-size: 0.9em; }
-  .grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(200px, 1fr)); gap: 15px; }
-  h1 { color: #333; }
-  code { background: #e5e5e5; padding: 2px 6px; border-radius: 3px; font-size: 0.85em; }
-</style>
-</head><body>
-<h1>🛒 UCP Server Admin</h1>
-<div class="grid" id="stats">Loading...</div>
-<script>${statsScript}</script>
-</body></html>`);
-    });
-    // Health check
-    app.get('/health', (_req, res) => {
-        const dbHealthy = (0, db_1.isDbHealthy)();
-        const status = dbHealthy ? 'ok' : 'degraded';
-        res.status(dbHealthy ? 200 : 503).json({
-            status,
-            ucp_version: schema_1.UCP_VERSION,
-            database: dbHealthy ? 'connected' : 'disconnected',
-            timestamp: new Date().toISOString(),
-        });
-    });
-    return app;
-}

package/dist/index.d.ts

@@ -1,4 +0,0 @@
-export { MerchantConfigSchema, ItemSchema, ShippingOptionSchema, PaymentHandlerSchema } from './schema';
-export type { MerchantConfig, Item, ShippingOption, PaymentHandler, CheckoutSession, Order } from './schema';
-export { UCPServer } from './ucp-server';
-export { createExpressApp } from './express-app';

package/dist/index.js

@@ -1,12 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createExpressApp = exports.UCPServer = exports.PaymentHandlerSchema = exports.ShippingOptionSchema = exports.ItemSchema = exports.MerchantConfigSchema = void 0;
-var schema_1 = require("./schema");
-Object.defineProperty(exports, "MerchantConfigSchema", { enumerable: true, get: function () { return schema_1.MerchantConfigSchema; } });
-Object.defineProperty(exports, "ItemSchema", { enumerable: true, get: function () { return schema_1.ItemSchema; } });
-Object.defineProperty(exports, "ShippingOptionSchema", { enumerable: true, get: function () { return schema_1.ShippingOptionSchema; } });
-Object.defineProperty(exports, "PaymentHandlerSchema", { enumerable: true, get: function () { return schema_1.PaymentHandlerSchema; } });
-var ucp_server_1 = require("./ucp-server");
-Object.defineProperty(exports, "UCPServer", { enumerable: true, get: function () { return ucp_server_1.UCPServer; } });
-var express_app_1 = require("./express-app");
-Object.defineProperty(exports, "createExpressApp", { enumerable: true, get: function () { return express_app_1.createExpressApp; } });

package/dist/logger.d.ts

@@ -1,3 +0,0 @@
-import pino from 'pino';
-export declare const logger: pino.Logger<never, boolean>;
-export type Logger = typeof logger;

package/dist/logger.js

@@ -1,15 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.logger = void 0;
-const pino_1 = __importDefault(require("pino"));
-const config_1 = require("./config");
-exports.logger = (0, pino_1.default)({
-    level: config_1.config.logLevel,
-    transport: config_1.config.nodeEnv === 'development'
-        ? { target: 'pino-pretty', options: { colorize: true } }
-        : undefined,
-    base: { service: 'ucpify' },
-});

package/dist/oauth.d.ts

@@ -1,60 +0,0 @@
-export interface OAuthClient {
-    client_id: string;
-    client_secret: string;
-    client_secret_hash: string;
-    name: string;
-    redirect_uris: string[];
-    created_at: string;
-}
-export interface AuthorizationCode {
-    code: string;
-    client_id: string;
-    user_id: string;
-    scope: string;
-    redirect_uri: string;
-    code_challenge?: string;
-    code_challenge_method?: string;
-    expires_at: number;
-    used: boolean;
-}
-export interface OAuthToken {
-    token: string;
-    token_type: 'access' | 'refresh';
-    client_id: string;
-    user_id: string;
-    scope: string;
-    parent_token?: string;
-    expires_at: number;
-    revoked: boolean;
-}
-export declare const UCP_SCOPES: readonly ["ucp:scopes:checkout_session"];
-export declare class OAuthManager {
-    private clients;
-    private codes;
-    private accessTokens;
-    private refreshTokens;
-    createClient(name: string, redirectUris: string[]): OAuthClient;
-    getClient(clientId: string): OAuthClient | undefined;
-    authenticateClient(clientId: string, clientSecret: string): boolean;
-    createAuthorizationCode(clientId: string, userId: string, scope: string, redirectUri: string, codeChallenge?: string, codeChallengeMethod?: string): string;
-    exchangeCode(code: string, clientId: string, redirectUri: string, codeVerifier?: string): {
-        access_token: string;
-        refresh_token: string;
-        expires_in: number;
-        scope: string;
-    } | {
-        error: string;
-    };
-    private createAccessToken;
-    private createRefreshToken;
-    refreshAccessToken(refreshToken: string, clientId: string): {
-        access_token: string;
-        expires_in: number;
-        scope: string;
-    } | {
-        error: string;
-    };
-    validateAccessToken(token: string): OAuthToken | null;
-    revokeToken(token: string): boolean;
-    getServerMetadata(issuer: string): Record<string, unknown>;
-}