veryfront 0.0.49 → 0.0.50

package/dist/oauth/index.js

@@ -0,0 +1,1157 @@
+// src/platform/compat/runtime.ts
+var isDeno = typeof Deno !== "undefined";
+var isNode = typeof globalThis.process !== "undefined" && globalThis.process?.versions?.node !== void 0;
+var isBun = typeof globalThis.Bun !== "undefined";
+var isCloudflare = typeof globalThis !== "undefined" && "caches" in globalThis && "WebSocketPair" in globalThis;
+
+// src/platform/compat/process.ts
+var nodeProcess = globalThis.process;
+var hasNodeProcess = !!nodeProcess?.versions?.node;
+function getEnv(key) {
+  if (isDeno) {
+    return process.env(key);
+  }
+  if (hasNodeProcess) {
+    return nodeProcess.env[key];
+  }
+  return void 0;
+}
+
+// src/core/oauth/providers/base.ts
+function generateRandomString(length) {
+  const array = new Uint8Array(length);
+  crypto.getRandomValues(array);
+  return Array.from(array, (byte) => byte.toString(16).padStart(2, "0")).join("").slice(0, length);
+}
+function generateCodeVerifier() {
+  return generateRandomString(64);
+}
+async function generateCodeChallenge(verifier) {
+  const encoder = new TextEncoder();
+  const data = encoder.encode(verifier);
+  const hash = await crypto.subtle.digest("SHA-256", data);
+  return btoa(String.fromCharCode(...new Uint8Array(hash))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+var OAuthProvider = class {
+  constructor(config) {
+    this.config = config;
+  }
+  /**
+   * Get client ID from environment
+   */
+  getClientId() {
+    return getEnv(this.config.clientIdEnvVar) || null;
+  }
+  /**
+   * Get client secret from environment
+   */
+  getClientSecret() {
+    return getEnv(this.config.clientSecretEnvVar) || null;
+  }
+  /**
+   * Check if provider is configured
+   */
+  isConfigured() {
+    return !!(this.getClientId() && this.getClientSecret());
+  }
+  /**
+   * Create authorization URL
+   */
+  async createAuthorizationUrl(options = {}) {
+    const clientId = this.getClientId();
+    if (!clientId) {
+      throw new Error(`${this.config.clientIdEnvVar} not configured`);
+    }
+    const state = options.state || generateRandomString(32);
+    const scopes = options.scopes || options.defaultScopes || [];
+    const redirectUri = options.redirectUri || "";
+    const usePkce = options.usePkce !== false;
+    let codeVerifier;
+    let codeChallenge;
+    if (usePkce) {
+      codeVerifier = generateCodeVerifier();
+      codeChallenge = await generateCodeChallenge(codeVerifier);
+    }
+    const params = new URLSearchParams({
+      client_id: clientId,
+      redirect_uri: redirectUri,
+      response_type: "code",
+      state,
+      ...scopes.length > 0 && { scope: scopes.join(" ") },
+      ...codeChallenge && {
+        code_challenge: codeChallenge,
+        code_challenge_method: "S256"
+      },
+      ...this.config.additionalAuthParams,
+      ...options.additionalParams
+    });
+    const oauthState = {
+      state,
+      codeVerifier,
+      redirectUri,
+      scopes,
+      createdAt: Date.now()
+    };
+    return {
+      url: `${this.config.authorizationUrl}?${params.toString()}`,
+      state: oauthState
+    };
+  }
+  /**
+   * Exchange authorization code for tokens
+   */
+  async exchangeCode(options) {
+    const clientId = this.getClientId();
+    const clientSecret = this.getClientSecret();
+    if (!clientId || !clientSecret) {
+      return {
+        success: false,
+        error: "OAuth not configured",
+        errorDescription: `Missing ${this.config.clientIdEnvVar} or ${this.config.clientSecretEnvVar}`
+      };
+    }
+    const body = new URLSearchParams({
+      grant_type: "authorization_code",
+      code: options.code,
+      redirect_uri: options.redirectUri,
+      ...options.codeVerifier && { code_verifier: options.codeVerifier },
+      ...!this.config.useBasicAuth && {
+        client_id: clientId,
+        client_secret: clientSecret
+      },
+      ...this.config.additionalTokenParams
+    });
+    const headers = {
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json"
+    };
+    if (this.config.useBasicAuth) {
+      const credentials = btoa(`${clientId}:${clientSecret}`);
+      headers.Authorization = `Basic ${credentials}`;
+    }
+    try {
+      const response = await fetch(this.config.tokenUrl, {
+        method: "POST",
+        headers,
+        body: body.toString()
+      });
+      const data = await response.json();
+      if (!response.ok) {
+        return {
+          success: false,
+          error: data.error || "token_exchange_failed",
+          errorDescription: data.error_description || `Status ${response.status}`
+        };
+      }
+      const mapping = this.config.tokenResponseMapping || {};
+      const tokens = {
+        accessToken: data[mapping.accessToken || "access_token"],
+        refreshToken: data[mapping.refreshToken || "refresh_token"],
+        tokenType: data[mapping.tokenType || "token_type"],
+        scope: data[mapping.scope || "scope"],
+        idToken: data.id_token
+      };
+      const expiresIn = data[mapping.expiresIn || "expires_in"];
+      if (expiresIn) {
+        tokens.expiresAt = Date.now() + expiresIn * 1e3;
+      }
+      return { success: true, tokens };
+    } catch (error) {
+      return {
+        success: false,
+        error: "network_error",
+        errorDescription: error instanceof Error ? error.message : "Unknown error"
+      };
+    }
+  }
+  /**
+   * Refresh access token
+   */
+  async refreshTokens(refreshToken) {
+    const clientId = this.getClientId();
+    const clientSecret = this.getClientSecret();
+    if (!clientId || !clientSecret) {
+      return {
+        success: false,
+        error: "OAuth not configured"
+      };
+    }
+    const body = new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: refreshToken,
+      ...!this.config.useBasicAuth && {
+        client_id: clientId,
+        client_secret: clientSecret
+      }
+    });
+    const headers = {
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json"
+    };
+    if (this.config.useBasicAuth) {
+      const credentials = btoa(`${clientId}:${clientSecret}`);
+      headers.Authorization = `Basic ${credentials}`;
+    }
+    try {
+      const response = await fetch(this.config.tokenUrl, {
+        method: "POST",
+        headers,
+        body: body.toString()
+      });
+      const data = await response.json();
+      if (!response.ok) {
+        return {
+          success: false,
+          error: data.error || "refresh_failed",
+          errorDescription: data.error_description
+        };
+      }
+      const mapping = this.config.tokenResponseMapping || {};
+      const tokens = {
+        accessToken: data[mapping.accessToken || "access_token"],
+        refreshToken: data[mapping.refreshToken || "refresh_token"] || refreshToken,
+        tokenType: data[mapping.tokenType || "token_type"],
+        scope: data[mapping.scope || "scope"]
+      };
+      const expiresIn = data[mapping.expiresIn || "expires_in"];
+      if (expiresIn) {
+        tokens.expiresAt = Date.now() + expiresIn * 1e3;
+      }
+      return { success: true, tokens };
+    } catch (error) {
+      return {
+        success: false,
+        error: "network_error",
+        errorDescription: error instanceof Error ? error.message : "Unknown error"
+      };
+    }
+  }
+  /**
+   * Revoke tokens
+   */
+  async revokeToken(token) {
+    if (!this.config.revocationUrl) {
+      return false;
+    }
+    try {
+      const response = await fetch(this.config.revocationUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded"
+        },
+        body: new URLSearchParams({ token }).toString()
+      });
+      return response.ok;
+    } catch {
+      return false;
+    }
+  }
+};
+var OAuthService = class extends OAuthProvider {
+  constructor(config, tokenStore) {
+    super(config);
+    this.serviceConfig = config;
+    this.tokenStore = tokenStore;
+  }
+  /**
+   * Get service ID
+   */
+  get serviceId() {
+    return this.serviceConfig.serviceId;
+  }
+  /**
+   * Get API base URL
+   */
+  get apiBaseUrl() {
+    return this.serviceConfig.apiBaseUrl;
+  }
+  /**
+   * Create authorization URL with service defaults
+   */
+  createAuthorizationUrl(options = {}) {
+    return super.createAuthorizationUrl({
+      ...options,
+      defaultScopes: this.serviceConfig.defaultScopes
+    });
+  }
+  /**
+   * Get valid access token (refreshing if needed)
+   */
+  async getAccessToken() {
+    if (!this.tokenStore) {
+      return null;
+    }
+    const tokens = await this.tokenStore.getTokens(this.serviceId);
+    if (!tokens) {
+      return null;
+    }
+    if (tokens.expiresAt && Date.now() > tokens.expiresAt - 3e5) {
+      if (tokens.refreshToken) {
+        const result = await this.refreshTokens(tokens.refreshToken);
+        if (result.success && result.tokens) {
+          await this.tokenStore.setTokens(this.serviceId, result.tokens);
+          return result.tokens.accessToken;
+        }
+      }
+      return null;
+    }
+    return tokens.accessToken;
+  }
+  /**
+   * Make authenticated API request
+   */
+  async fetch(endpoint, options = {}) {
+    const token = await this.getAccessToken();
+    if (!token) {
+      throw new Error(`Not authenticated with ${this.serviceConfig.displayName}`);
+    }
+    const url = endpoint.startsWith("http") ? endpoint : `${this.apiBaseUrl}${endpoint}`;
+    const response = await fetch(url, {
+      ...options,
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json",
+        ...options.headers
+      }
+    });
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`${this.serviceConfig.displayName} API error: ${response.status} ${error}`);
+    }
+    return response.json();
+  }
+};
+
+// src/core/oauth/providers/google.ts
+var googleBase = {
+  providerId: "google",
+  displayName: "Google",
+  authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+  tokenUrl: "https://oauth2.googleapis.com/token",
+  userInfoUrl: "https://www.googleapis.com/oauth2/v2/userinfo",
+  revocationUrl: "https://oauth2.googleapis.com/revoke",
+  clientIdEnvVar: "GOOGLE_CLIENT_ID",
+  clientSecretEnvVar: "GOOGLE_CLIENT_SECRET",
+  additionalAuthParams: {
+    access_type: "offline",
+    prompt: "consent"
+  }
+};
+var gmailConfig = {
+  ...googleBase,
+  serviceId: "gmail",
+  displayName: "Gmail",
+  apiBaseUrl: "https://gmail.googleapis.com/gmail/v1",
+  defaultScopes: [
+    "https://www.googleapis.com/auth/gmail.readonly",
+    "https://www.googleapis.com/auth/gmail.send",
+    "https://www.googleapis.com/auth/gmail.compose",
+    "https://www.googleapis.com/auth/gmail.labels"
+  ]
+};
+var calendarConfig = {
+  ...googleBase,
+  serviceId: "calendar",
+  displayName: "Google Calendar",
+  apiBaseUrl: "https://www.googleapis.com/calendar/v3",
+  defaultScopes: [
+    "https://www.googleapis.com/auth/calendar.readonly",
+    "https://www.googleapis.com/auth/calendar.events"
+  ]
+};
+var sheetsConfig = {
+  ...googleBase,
+  serviceId: "sheets",
+  displayName: "Google Sheets",
+  apiBaseUrl: "https://sheets.googleapis.com/v4",
+  defaultScopes: [
+    "https://www.googleapis.com/auth/spreadsheets.readonly",
+    "https://www.googleapis.com/auth/spreadsheets"
+  ]
+};
+var driveConfig = {
+  ...googleBase,
+  serviceId: "drive",
+  displayName: "Google Drive",
+  apiBaseUrl: "https://www.googleapis.com/drive/v3",
+  defaultScopes: [
+    "https://www.googleapis.com/auth/drive.readonly",
+    "https://www.googleapis.com/auth/drive.file"
+  ]
+};
+var googleServices = {
+  gmail: gmailConfig,
+  calendar: calendarConfig,
+  sheets: sheetsConfig,
+  drive: driveConfig
+};
+
+// src/core/oauth/providers/microsoft.ts
+var microsoftBase = {
+  providerId: "microsoft",
+  displayName: "Microsoft",
+  authorizationUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
+  tokenUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/token",
+  userInfoUrl: "https://graph.microsoft.com/v1.0/me",
+  clientIdEnvVar: "MICROSOFT_CLIENT_ID",
+  clientSecretEnvVar: "MICROSOFT_CLIENT_SECRET",
+  additionalAuthParams: {
+    response_mode: "query"
+  }
+};
+var outlookConfig = {
+  ...microsoftBase,
+  serviceId: "outlook",
+  displayName: "Outlook",
+  apiBaseUrl: "https://graph.microsoft.com/v1.0",
+  defaultScopes: [
+    "Mail.Read",
+    "Mail.Send",
+    "Mail.ReadWrite",
+    "Calendars.Read",
+    "Calendars.ReadWrite",
+    "User.Read",
+    "offline_access"
+  ]
+};
+var teamsConfig = {
+  ...microsoftBase,
+  serviceId: "teams",
+  displayName: "Microsoft Teams",
+  apiBaseUrl: "https://graph.microsoft.com/v1.0",
+  defaultScopes: [
+    "Team.ReadBasic.All",
+    "Channel.ReadBasic.All",
+    "Chat.Read",
+    "Chat.ReadWrite",
+    "ChannelMessage.Read.All",
+    "User.Read",
+    "offline_access"
+  ]
+};
+var sharePointConfig = {
+  ...microsoftBase,
+  serviceId: "sharepoint",
+  displayName: "SharePoint",
+  apiBaseUrl: "https://graph.microsoft.com/v1.0",
+  defaultScopes: [
+    "Sites.Read.All",
+    "Sites.ReadWrite.All",
+    "Files.Read.All",
+    "Files.ReadWrite.All",
+    "User.Read",
+    "offline_access"
+  ]
+};
+var oneDriveConfig = {
+  ...microsoftBase,
+  serviceId: "onedrive",
+  displayName: "OneDrive",
+  apiBaseUrl: "https://graph.microsoft.com/v1.0",
+  defaultScopes: [
+    "Files.Read",
+    "Files.ReadWrite",
+    "Files.Read.All",
+    "Files.ReadWrite.All",
+    "User.Read",
+    "offline_access"
+  ]
+};
+var microsoftServices = {
+  outlook: outlookConfig,
+  teams: teamsConfig,
+  sharepoint: sharePointConfig,
+  onedrive: oneDriveConfig
+};
+
+// src/core/oauth/providers/atlassian.ts
+var atlassianBase = {
+  providerId: "atlassian",
+  displayName: "Atlassian",
+  authorizationUrl: "https://auth.atlassian.com/authorize",
+  tokenUrl: "https://auth.atlassian.com/oauth/token",
+  userInfoUrl: "https://api.atlassian.com/me",
+  clientIdEnvVar: "ATLASSIAN_CLIENT_ID",
+  clientSecretEnvVar: "ATLASSIAN_CLIENT_SECRET",
+  additionalAuthParams: {
+    audience: "api.atlassian.com",
+    prompt: "consent"
+  }
+};
+var jiraConfig = {
+  ...atlassianBase,
+  serviceId: "jira",
+  displayName: "Jira",
+  apiBaseUrl: "https://api.atlassian.com/ex/jira",
+  defaultScopes: [
+    "read:jira-work",
+    "write:jira-work",
+    "read:jira-user",
+    "offline_access"
+  ]
+};
+var confluenceConfig = {
+  ...atlassianBase,
+  serviceId: "confluence",
+  displayName: "Confluence",
+  apiBaseUrl: "https://api.atlassian.com/ex/confluence",
+  defaultScopes: [
+    "read:confluence-content.all",
+    "write:confluence-content",
+    "read:confluence-space.summary",
+    "read:confluence-user",
+    "offline_access"
+  ]
+};
+var bitbucketConfig = {
+  ...atlassianBase,
+  serviceId: "bitbucket",
+  displayName: "Bitbucket",
+  // Bitbucket has its own OAuth endpoints
+  authorizationUrl: "https://bitbucket.org/site/oauth2/authorize",
+  tokenUrl: "https://bitbucket.org/site/oauth2/access_token",
+  clientIdEnvVar: "BITBUCKET_CLIENT_ID",
+  clientSecretEnvVar: "BITBUCKET_CLIENT_SECRET",
+  apiBaseUrl: "https://api.bitbucket.org/2.0",
+  additionalAuthParams: {},
+  defaultScopes: [
+    "repository",
+    "repository:write",
+    "pullrequest",
+    "pullrequest:write",
+    "account"
+  ]
+};
+var atlassianServices = {
+  jira: jiraConfig,
+  confluence: confluenceConfig,
+  bitbucket: bitbucketConfig
+};
+
+// src/core/oauth/providers/common.ts
+var githubConfig = {
+  providerId: "github",
+  serviceId: "github",
+  displayName: "GitHub",
+  authorizationUrl: "https://github.com/login/oauth/authorize",
+  tokenUrl: "https://github.com/login/oauth/access_token",
+  clientIdEnvVar: "GITHUB_CLIENT_ID",
+  clientSecretEnvVar: "GITHUB_CLIENT_SECRET",
+  apiBaseUrl: "https://api.github.com",
+  defaultScopes: ["repo", "user"],
+  additionalAuthParams: {}
+};
+var slackConfig = {
+  providerId: "slack",
+  serviceId: "slack",
+  displayName: "Slack",
+  authorizationUrl: "https://slack.com/oauth/v2/authorize",
+  tokenUrl: "https://slack.com/api/oauth.v2.access",
+  clientIdEnvVar: "SLACK_CLIENT_ID",
+  clientSecretEnvVar: "SLACK_CLIENT_SECRET",
+  apiBaseUrl: "https://slack.com/api",
+  defaultScopes: ["channels:read", "chat:write", "users:read"],
+  additionalAuthParams: {}
+};
+var notionConfig = {
+  providerId: "notion",
+  serviceId: "notion",
+  displayName: "Notion",
+  authorizationUrl: "https://api.notion.com/v1/oauth/authorize",
+  tokenUrl: "https://api.notion.com/v1/oauth/token",
+  clientIdEnvVar: "NOTION_CLIENT_ID",
+  clientSecretEnvVar: "NOTION_CLIENT_SECRET",
+  apiBaseUrl: "https://api.notion.com/v1",
+  defaultScopes: [],
+  useBasicAuth: true,
+  additionalAuthParams: {
+    owner: "user"
+  }
+};
+var figmaConfig = {
+  providerId: "figma",
+  serviceId: "figma",
+  displayName: "Figma",
+  authorizationUrl: "https://www.figma.com/oauth",
+  tokenUrl: "https://www.figma.com/api/oauth/token",
+  clientIdEnvVar: "FIGMA_CLIENT_ID",
+  clientSecretEnvVar: "FIGMA_CLIENT_SECRET",
+  apiBaseUrl: "https://api.figma.com/v1",
+  defaultScopes: ["file_read"],
+  additionalAuthParams: {}
+};
+var discordConfig = {
+  providerId: "discord",
+  serviceId: "discord",
+  displayName: "Discord",
+  authorizationUrl: "https://discord.com/api/oauth2/authorize",
+  tokenUrl: "https://discord.com/api/oauth2/token",
+  clientIdEnvVar: "DISCORD_CLIENT_ID",
+  clientSecretEnvVar: "DISCORD_CLIENT_SECRET",
+  apiBaseUrl: "https://discord.com/api/v10",
+  defaultScopes: ["identify", "guilds"],
+  additionalAuthParams: {}
+};
+var linearConfig = {
+  providerId: "linear",
+  serviceId: "linear",
+  displayName: "Linear",
+  authorizationUrl: "https://linear.app/oauth/authorize",
+  tokenUrl: "https://api.linear.app/oauth/token",
+  clientIdEnvVar: "LINEAR_CLIENT_ID",
+  clientSecretEnvVar: "LINEAR_CLIENT_SECRET",
+  apiBaseUrl: "https://api.linear.app",
+  defaultScopes: ["read", "write"],
+  additionalAuthParams: {}
+};
+var gitlabConfig = {
+  providerId: "gitlab",
+  serviceId: "gitlab",
+  displayName: "GitLab",
+  authorizationUrl: "https://gitlab.com/oauth/authorize",
+  tokenUrl: "https://gitlab.com/oauth/token",
+  clientIdEnvVar: "GITLAB_CLIENT_ID",
+  clientSecretEnvVar: "GITLAB_CLIENT_SECRET",
+  apiBaseUrl: "https://gitlab.com/api/v4",
+  defaultScopes: ["read_user", "api"],
+  additionalAuthParams: {}
+};
+var airtableConfig = {
+  providerId: "airtable",
+  serviceId: "airtable",
+  displayName: "Airtable",
+  authorizationUrl: "https://airtable.com/oauth2/v1/authorize",
+  tokenUrl: "https://airtable.com/oauth2/v1/token",
+  clientIdEnvVar: "AIRTABLE_CLIENT_ID",
+  clientSecretEnvVar: "AIRTABLE_CLIENT_SECRET",
+  apiBaseUrl: "https://api.airtable.com/v0",
+  defaultScopes: ["data.records:read", "data.records:write", "schema.bases:read"],
+  useBasicAuth: true,
+  additionalAuthParams: {}
+};
+var dropboxConfig = {
+  providerId: "dropbox",
+  serviceId: "dropbox",
+  displayName: "Dropbox",
+  authorizationUrl: "https://www.dropbox.com/oauth2/authorize",
+  tokenUrl: "https://api.dropbox.com/oauth2/token",
+  clientIdEnvVar: "DROPBOX_CLIENT_ID",
+  clientSecretEnvVar: "DROPBOX_CLIENT_SECRET",
+  apiBaseUrl: "https://api.dropboxapi.com/2",
+  defaultScopes: [],
+  additionalAuthParams: {
+    token_access_type: "offline"
+  }
+};
+var hubspotConfig = {
+  providerId: "hubspot",
+  serviceId: "hubspot",
+  displayName: "HubSpot",
+  authorizationUrl: "https://app.hubspot.com/oauth/authorize",
+  tokenUrl: "https://api.hubapi.com/oauth/v1/token",
+  clientIdEnvVar: "HUBSPOT_CLIENT_ID",
+  clientSecretEnvVar: "HUBSPOT_CLIENT_SECRET",
+  apiBaseUrl: "https://api.hubapi.com",
+  defaultScopes: ["crm.objects.contacts.read", "crm.objects.contacts.write"],
+  additionalAuthParams: {}
+};
+var salesforceConfig = {
+  providerId: "salesforce",
+  serviceId: "salesforce",
+  displayName: "Salesforce",
+  authorizationUrl: "https://login.salesforce.com/services/oauth2/authorize",
+  tokenUrl: "https://login.salesforce.com/services/oauth2/token",
+  clientIdEnvVar: "SALESFORCE_CLIENT_ID",
+  clientSecretEnvVar: "SALESFORCE_CLIENT_SECRET",
+  apiBaseUrl: "https://login.salesforce.com/services/data/v59.0",
+  defaultScopes: ["api", "refresh_token"],
+  additionalAuthParams: {}
+};
+var twitterConfig = {
+  providerId: "twitter",
+  serviceId: "twitter",
+  displayName: "Twitter/X",
+  authorizationUrl: "https://twitter.com/i/oauth2/authorize",
+  tokenUrl: "https://api.twitter.com/2/oauth2/token",
+  clientIdEnvVar: "TWITTER_CLIENT_ID",
+  clientSecretEnvVar: "TWITTER_CLIENT_SECRET",
+  apiBaseUrl: "https://api.twitter.com/2",
+  defaultScopes: ["tweet.read", "users.read", "offline.access"],
+  useBasicAuth: true,
+  additionalAuthParams: {}
+};
+var asanaConfig = {
+  providerId: "asana",
+  serviceId: "asana",
+  displayName: "Asana",
+  authorizationUrl: "https://app.asana.com/-/oauth_authorize",
+  tokenUrl: "https://app.asana.com/-/oauth_token",
+  clientIdEnvVar: "ASANA_CLIENT_ID",
+  clientSecretEnvVar: "ASANA_CLIENT_SECRET",
+  apiBaseUrl: "https://app.asana.com/api/1.0",
+  defaultScopes: ["default"],
+  additionalAuthParams: {}
+};
+var mondayConfig = {
+  providerId: "monday",
+  serviceId: "monday",
+  displayName: "Monday.com",
+  authorizationUrl: "https://auth.monday.com/oauth2/authorize",
+  tokenUrl: "https://auth.monday.com/oauth2/token",
+  clientIdEnvVar: "MONDAY_CLIENT_ID",
+  clientSecretEnvVar: "MONDAY_CLIENT_SECRET",
+  apiBaseUrl: "https://api.monday.com/v2",
+  defaultScopes: ["me:read", "boards:read", "boards:write"],
+  additionalAuthParams: {}
+};
+var zoomConfig = {
+  providerId: "zoom",
+  serviceId: "zoom",
+  displayName: "Zoom",
+  authorizationUrl: "https://zoom.us/oauth/authorize",
+  tokenUrl: "https://zoom.us/oauth/token",
+  clientIdEnvVar: "ZOOM_CLIENT_ID",
+  clientSecretEnvVar: "ZOOM_CLIENT_SECRET",
+  apiBaseUrl: "https://api.zoom.us/v2",
+  defaultScopes: ["meeting:read", "meeting:write", "user:read"],
+  useBasicAuth: true,
+  additionalAuthParams: {}
+};
+var intercomConfig = {
+  providerId: "intercom",
+  serviceId: "intercom",
+  displayName: "Intercom",
+  authorizationUrl: "https://app.intercom.com/oauth",
+  tokenUrl: "https://api.intercom.io/auth/eagle/token",
+  clientIdEnvVar: "INTERCOM_CLIENT_ID",
+  clientSecretEnvVar: "INTERCOM_CLIENT_SECRET",
+  apiBaseUrl: "https://api.intercom.io",
+  defaultScopes: [],
+  additionalAuthParams: {}
+};
+var freshdeskConfig = {
+  providerId: "freshdesk",
+  serviceId: "freshdesk",
+  displayName: "Freshdesk",
+  authorizationUrl: "https://accounts.freshworks.com/authorize",
+  tokenUrl: "https://accounts.freshworks.com/oauth/token",
+  clientIdEnvVar: "FRESHDESK_CLIENT_ID",
+  clientSecretEnvVar: "FRESHDESK_CLIENT_SECRET",
+  apiBaseUrl: "https://domain.freshdesk.com/api/v2",
+  defaultScopes: ["freshdesk"],
+  additionalAuthParams: {}
+};
+var mailchimpConfig = {
+  providerId: "mailchimp",
+  serviceId: "mailchimp",
+  displayName: "Mailchimp",
+  authorizationUrl: "https://login.mailchimp.com/oauth2/authorize",
+  tokenUrl: "https://login.mailchimp.com/oauth2/token",
+  clientIdEnvVar: "MAILCHIMP_CLIENT_ID",
+  clientSecretEnvVar: "MAILCHIMP_CLIENT_SECRET",
+  apiBaseUrl: "https://server.api.mailchimp.com/3.0",
+  defaultScopes: [],
+  additionalAuthParams: {}
+};
+var shopifyConfig = {
+  providerId: "shopify",
+  serviceId: "shopify",
+  displayName: "Shopify",
+  authorizationUrl: "https://shop.myshopify.com/admin/oauth/authorize",
+  tokenUrl: "https://shop.myshopify.com/admin/oauth/access_token",
+  clientIdEnvVar: "SHOPIFY_CLIENT_ID",
+  clientSecretEnvVar: "SHOPIFY_CLIENT_SECRET",
+  apiBaseUrl: "https://shop.myshopify.com/admin/api/2024-01",
+  defaultScopes: ["read_products", "write_products", "read_orders"],
+  additionalAuthParams: {}
+};
+var quickbooksConfig = {
+  providerId: "quickbooks",
+  serviceId: "quickbooks",
+  displayName: "QuickBooks",
+  authorizationUrl: "https://appcenter.intuit.com/connect/oauth2",
+  tokenUrl: "https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer",
+  clientIdEnvVar: "QUICKBOOKS_CLIENT_ID",
+  clientSecretEnvVar: "QUICKBOOKS_CLIENT_SECRET",
+  apiBaseUrl: "https://quickbooks.api.intuit.com/v3",
+  defaultScopes: ["com.intuit.quickbooks.accounting"],
+  additionalAuthParams: {}
+};
+var xeroConfig = {
+  providerId: "xero",
+  serviceId: "xero",
+  displayName: "Xero",
+  authorizationUrl: "https://login.xero.com/identity/connect/authorize",
+  tokenUrl: "https://identity.xero.com/connect/token",
+  clientIdEnvVar: "XERO_CLIENT_ID",
+  clientSecretEnvVar: "XERO_CLIENT_SECRET",
+  apiBaseUrl: "https://api.xero.com/api.xro/2.0",
+  defaultScopes: ["openid", "profile", "email", "accounting.transactions", "offline_access"],
+  additionalAuthParams: {}
+};
+var boxConfig = {
+  providerId: "box",
+  serviceId: "box",
+  displayName: "Box",
+  authorizationUrl: "https://account.box.com/api/oauth2/authorize",
+  tokenUrl: "https://api.box.com/oauth2/token",
+  clientIdEnvVar: "BOX_CLIENT_ID",
+  clientSecretEnvVar: "BOX_CLIENT_SECRET",
+  apiBaseUrl: "https://api.box.com/2.0",
+  defaultScopes: [],
+  additionalAuthParams: {}
+};
+var webexConfig = {
+  providerId: "webex",
+  serviceId: "webex",
+  displayName: "Webex",
+  authorizationUrl: "https://webexapis.com/v1/authorize",
+  tokenUrl: "https://webexapis.com/v1/access_token",
+  clientIdEnvVar: "WEBEX_CLIENT_ID",
+  clientSecretEnvVar: "WEBEX_CLIENT_SECRET",
+  apiBaseUrl: "https://webexapis.com/v1",
+  defaultScopes: ["spark:all", "spark:kms"],
+  additionalAuthParams: {}
+};
+var trelloConfig = {
+  providerId: "trello",
+  serviceId: "trello",
+  displayName: "Trello",
+  authorizationUrl: "https://trello.com/1/authorize",
+  tokenUrl: "https://trello.com/1/OAuthGetAccessToken",
+  clientIdEnvVar: "TRELLO_CLIENT_ID",
+  clientSecretEnvVar: "TRELLO_CLIENT_SECRET",
+  apiBaseUrl: "https://api.trello.com/1",
+  defaultScopes: ["read", "write"],
+  additionalAuthParams: {
+    expiration: "never"
+  }
+};
+var clickupConfig = {
+  providerId: "clickup",
+  serviceId: "clickup",
+  displayName: "ClickUp",
+  authorizationUrl: "https://app.clickup.com/api",
+  tokenUrl: "https://api.clickup.com/api/v2/oauth/token",
+  clientIdEnvVar: "CLICKUP_CLIENT_ID",
+  clientSecretEnvVar: "CLICKUP_CLIENT_SECRET",
+  apiBaseUrl: "https://api.clickup.com/api/v2",
+  defaultScopes: [],
+  additionalAuthParams: {}
+};
+var pipedriveConfig = {
+  providerId: "pipedrive",
+  serviceId: "pipedrive",
+  displayName: "Pipedrive",
+  authorizationUrl: "https://oauth.pipedrive.com/oauth/authorize",
+  tokenUrl: "https://oauth.pipedrive.com/oauth/token",
+  clientIdEnvVar: "PIPEDRIVE_CLIENT_ID",
+  clientSecretEnvVar: "PIPEDRIVE_CLIENT_SECRET",
+  apiBaseUrl: "https://api.pipedrive.com/v1",
+  defaultScopes: [],
+  additionalAuthParams: {}
+};
+var commonServices = {
+  github: githubConfig,
+  slack: slackConfig,
+  notion: notionConfig,
+  figma: figmaConfig,
+  discord: discordConfig,
+  linear: linearConfig,
+  gitlab: gitlabConfig,
+  airtable: airtableConfig,
+  dropbox: dropboxConfig,
+  hubspot: hubspotConfig,
+  salesforce: salesforceConfig,
+  twitter: twitterConfig,
+  asana: asanaConfig,
+  monday: mondayConfig,
+  zoom: zoomConfig,
+  intercom: intercomConfig,
+  freshdesk: freshdeskConfig,
+  mailchimp: mailchimpConfig,
+  shopify: shopifyConfig,
+  quickbooks: quickbooksConfig,
+  xero: xeroConfig,
+  box: boxConfig,
+  webex: webexConfig,
+  trello: trelloConfig,
+  clickup: clickupConfig,
+  pipedrive: pipedriveConfig
+};
+
+// src/core/oauth/token-store/memory.ts
+var MemoryTokenStore = class {
+  constructor() {
+    this.tokens = /* @__PURE__ */ new Map();
+    this.states = /* @__PURE__ */ new Map();
+    /** State expiration time in ms (10 minutes) */
+    this.stateExpirationMs = 10 * 60 * 1e3;
+  }
+  getTokens(serviceId) {
+    return Promise.resolve(this.tokens.get(serviceId) || null);
+  }
+  setTokens(serviceId, tokens) {
+    this.tokens.set(serviceId, tokens);
+    return Promise.resolve();
+  }
+  clearTokens(serviceId) {
+    this.tokens.delete(serviceId);
+    return Promise.resolve();
+  }
+  getState(state) {
+    const oauthState = this.states.get(state);
+    if (!oauthState) {
+      return Promise.resolve(null);
+    }
+    if (Date.now() - oauthState.createdAt > this.stateExpirationMs) {
+      this.states.delete(state);
+      return Promise.resolve(null);
+    }
+    return Promise.resolve(oauthState);
+  }
+  setState(oauthState) {
+    this.states.set(oauthState.state, oauthState);
+    this.cleanupExpiredStates();
+    return Promise.resolve();
+  }
+  clearState(state) {
+    this.states.delete(state);
+    return Promise.resolve();
+  }
+  /**
+   * Clean up expired states
+   */
+  cleanupExpiredStates() {
+    const now = Date.now();
+    for (const [state, oauthState] of this.states) {
+      if (now - oauthState.createdAt > this.stateExpirationMs) {
+        this.states.delete(state);
+      }
+    }
+  }
+  /**
+   * Get all stored service IDs
+   */
+  getConnectedServices() {
+    return Array.from(this.tokens.keys());
+  }
+  /**
+   * Check if a service is connected
+   */
+  isConnected(serviceId) {
+    const tokens = this.tokens.get(serviceId);
+    if (!tokens)
+      return false;
+    if (tokens.expiresAt && Date.now() > tokens.expiresAt) {
+      return !!tokens.refreshToken;
+    }
+    return true;
+  }
+  /**
+   * Clear all tokens
+   */
+  clearAll() {
+    this.tokens.clear();
+    this.states.clear();
+  }
+};
+var memoryTokenStore = new MemoryTokenStore();
+
+// src/core/oauth/handlers/callback-handler.ts
+function createOAuthCallbackHandler(config, options = {}) {
+  const {
+    tokenStore = memoryTokenStore,
+    baseUrl,
+    successRedirect = "/",
+    errorRedirect = "/",
+    onSuccess,
+    onError
+  } = options;
+  return async (request) => {
+    const url = new URL(request.url);
+    const code = url.searchParams.get("code");
+    const state = url.searchParams.get("state");
+    const error = url.searchParams.get("error");
+    const errorDescription = url.searchParams.get("error_description");
+    const appUrl = baseUrl || getEnv("APP_URL") || getEnv("NEXT_PUBLIC_APP_URL") || "http://localhost:3000";
+    if (error) {
+      console.error(`OAuth error for ${config.serviceId}:`, error, errorDescription);
+      if (onError) {
+        await onError(config.serviceId, error);
+      }
+      const errorUrl = new URL(errorRedirect, appUrl);
+      errorUrl.searchParams.set("error", error);
+      if (errorDescription) {
+        errorUrl.searchParams.set("error_description", errorDescription);
+      }
+      return Response.redirect(errorUrl.toString());
+    }
+    if (!code) {
+      if (onError) {
+        await onError(config.serviceId, "no_code");
+      }
+      const errorUrl = new URL(errorRedirect, appUrl);
+      errorUrl.searchParams.set("error", "no_code");
+      return Response.redirect(errorUrl.toString());
+    }
+    let oauthState = null;
+    if (state) {
+      oauthState = await tokenStore.getState(state);
+      if (!oauthState) {
+        console.warn(`Invalid or expired state for ${config.serviceId}`);
+      }
+    }
+    const service = new OAuthService(config, tokenStore);
+    const redirectUri = `${appUrl}/api/auth/${config.serviceId}/callback`;
+    try {
+      const result = await service.exchangeCode({
+        code,
+        redirectUri,
+        codeVerifier: oauthState?.codeVerifier
+      });
+      if (!result.success || !result.tokens) {
+        console.error(`Token exchange failed for ${config.serviceId}:`, result.error);
+        if (onError) {
+          await onError(config.serviceId, result.error || "exchange_failed");
+        }
+        const errorUrl = new URL(errorRedirect, appUrl);
+        errorUrl.searchParams.set("error", result.error || "token_exchange_failed");
+        return Response.redirect(errorUrl.toString());
+      }
+      await tokenStore.setTokens(config.serviceId, result.tokens);
+      if (state) {
+        await tokenStore.clearState(state);
+      }
+      if (onSuccess) {
+        await onSuccess(config.serviceId, result.tokens);
+      }
+      const successUrl = new URL(successRedirect, appUrl);
+      successUrl.searchParams.set("connected", config.serviceId);
+      return Response.redirect(successUrl.toString());
+    } catch (err) {
+      console.error(`OAuth callback error for ${config.serviceId}:`, err);
+      if (onError) {
+        await onError(config.serviceId, "callback_error");
+      }
+      const errorUrl = new URL(errorRedirect, appUrl);
+      errorUrl.searchParams.set("error", "callback_error");
+      return Response.redirect(errorUrl.toString());
+    }
+  };
+}
+
+// src/core/oauth/handlers/init-handler.ts
+function createOAuthInitHandler(config, options = {}) {
+  const { tokenStore = memoryTokenStore, baseUrl, authOptions = {} } = options;
+  return async () => {
+    const service = new OAuthService(config, tokenStore);
+    if (!service.isConfigured()) {
+      return Response.json(
+        {
+          error: `${config.displayName} OAuth not configured`,
+          details: `Missing ${config.clientIdEnvVar} or ${config.clientSecretEnvVar}`
+        },
+        { status: 500 }
+      );
+    }
+    const appUrl = baseUrl || getEnv("APP_URL") || getEnv("NEXT_PUBLIC_APP_URL") || "http://localhost:3000";
+    const redirectUri = `${appUrl}/api/auth/${config.serviceId}/callback`;
+    try {
+      const { url, state } = await service.createAuthorizationUrl({
+        ...authOptions,
+        redirectUri
+      });
+      await tokenStore.setState(state);
+      return Response.redirect(url);
+    } catch (error) {
+      console.error(`OAuth init error for ${config.serviceId}:`, error);
+      return Response.json(
+        {
+          error: "Failed to initiate OAuth flow",
+          details: error instanceof Error ? error.message : "Unknown error"
+        },
+        { status: 500 }
+      );
+    }
+  };
+}
+function createOAuthStatusHandler(config, options = {}) {
+  const { tokenStore = memoryTokenStore } = options;
+  return async () => {
+    const tokens = await tokenStore.getTokens(config.serviceId);
+    const isConnected = !!tokens?.accessToken;
+    const isExpired = tokens?.expiresAt ? Date.now() > tokens.expiresAt : false;
+    const hasRefreshToken = !!tokens?.refreshToken;
+    return Response.json({
+      service: config.serviceId,
+      displayName: config.displayName,
+      connected: isConnected && (!isExpired || hasRefreshToken),
+      configured: !!(getEnv(config.clientIdEnvVar) && getEnv(config.clientSecretEnvVar)),
+      expiresAt: tokens?.expiresAt,
+      hasRefreshToken
+    });
+  };
+}
+function createOAuthDisconnectHandler(config, options = {}) {
+  const { tokenStore = memoryTokenStore } = options;
+  return async () => {
+    await tokenStore.clearTokens(config.serviceId);
+    return Response.json({
+      success: true,
+      message: `Disconnected from ${config.displayName}`
+    });
+  };
+}
+export {
+  MemoryTokenStore,
+  OAuthProvider,
+  OAuthService,
+  airtableConfig,
+  asanaConfig,
+  atlassianServices,
+  bitbucketConfig,
+  boxConfig,
+  calendarConfig,
+  clickupConfig,
+  commonServices,
+  confluenceConfig,
+  createOAuthCallbackHandler,
+  createOAuthDisconnectHandler,
+  createOAuthInitHandler,
+  createOAuthStatusHandler,
+  discordConfig,
+  driveConfig,
+  dropboxConfig,
+  figmaConfig,
+  freshdeskConfig,
+  githubConfig,
+  gitlabConfig,
+  gmailConfig,
+  googleServices,
+  hubspotConfig,
+  intercomConfig,
+  jiraConfig,
+  linearConfig,
+  mailchimpConfig,
+  memoryTokenStore,
+  microsoftServices,
+  mondayConfig,
+  notionConfig,
+  oneDriveConfig,
+  outlookConfig,
+  pipedriveConfig,
+  quickbooksConfig,
+  salesforceConfig,
+  sharePointConfig,
+  sheetsConfig,
+  shopifyConfig,
+  slackConfig,
+  teamsConfig,
+  trelloConfig,
+  twitterConfig,
+  webexConfig,
+  xeroConfig,
+  zoomConfig
+};
+//# sourceMappingURL=index.js.map