import { a as buildAuthUrl, d as saveMailboxToken, o as createOAuthClient, r as requestDeviceCode, s as exchangeCodeForTokens, t as pollForToken } from "./microsoft-DgbVlHdT.js";
//#region src/sync/oauth/login.ts
/** Accept either a raw auth code or the full loopback redirect URL and return the code. */
function extractAuthCode(input) {
	const trimmed = input.trim();
	if (trimmed.includes("code=")) {
		const m = trimmed.match(/[?&]code=([^&\s]+)/);
		if (m?.[1]) return decodeURIComponent(m[1]);
	}
	return trimmed;
}
/**
* Drive the Gmail installed-app OAuth flow: show the consent URL, read back the
* authorization code (or the pasted redirect URL), exchange it for tokens with
* the full `mail.google.com` IMAP scope, and persist them.
*/
async function runGmailLogin(opts) {
	const redirect = opts.redirectUri ?? "http://127.0.0.1";
	const create = opts.createClient ?? createOAuthClient;
	const exchange = opts.exchange ?? exchangeCodeForTokens;
	const client = create(opts.clientId, opts.clientSecret, redirect);
	const authUrl = buildAuthUrl(client, redirect);
	opts.print("Authorize Gmail IMAP access by visiting this URL:\n");
	opts.print(authUrl + "\n");
	opts.print("After approving, your browser is redirected to a 127.0.0.1 URL that won't load — copy that whole URL (or just the code) and paste it here.");
	const code = extractAuthCode(await opts.prompt("Paste the redirect URL or code: "));
	if (!code) throw new Error("No authorization code provided.");
	const tokens = await exchange(client, code);
	if (!tokens.refreshToken) opts.print("Warning: Google did not return a refresh token. Remove the app's access at myaccount.google.com/permissions and log in again to force a fresh consent.");
	const token = {
		provider: "gmail",
		user: opts.user,
		accessToken: tokens.accessToken,
		...tokens.refreshToken ? { refreshToken: tokens.refreshToken } : {},
		expiresAt: tokens.expiresAt,
		scope: "https://mail.google.com/"
	};
	saveMailboxToken(opts.dataDir, token);
	return token;
}
/**
* Drive the Microsoft device-code flow: print the short user code + URL, poll
* until the user authorizes, and persist the IMAP tokens.
*/
async function runMicrosoftLogin(opts) {
	const tenant = opts.tenant ?? "common";
	const requestCode = opts.requestDeviceCodeFn ?? ((id, t) => requestDeviceCode(id, t));
	const poll = opts.pollFn ?? ((o) => pollForToken(o));
	const device = await requestCode(opts.clientId, tenant);
	opts.print(`\nTo sign in, open ${device.verification_uri} and enter code: ${device.user_code}\n`);
	opts.print("Waiting for authorization…");
	const tokens = await poll({
		clientId: opts.clientId,
		deviceCode: device.device_code,
		tenant,
		interval: device.interval,
		expiresIn: device.expires_in
	});
	const token = {
		provider: "microsoft",
		user: opts.user,
		accessToken: tokens.accessToken,
		...tokens.refreshToken ? { refreshToken: tokens.refreshToken } : {},
		expiresAt: tokens.expiresAt,
		scope: "https://outlook.office365.com/IMAP.AccessAsUser.All"
	};
	saveMailboxToken(opts.dataDir, token);
	return token;
}
//#endregion
export { runGmailLogin, runMicrosoftLogin };

//# sourceMappingURL=login-CYgla6-A.js.map