feat(oauth): persist provider refresh metadata

Author: elkaix

packages/oauth/src/types.ts

@@ -8,6 +8,8 @@ export interface TokenInfo {
   readonly tokenType: string;
   /** Original expires_in from server response (seconds). */
   readonly expiresIn: number;
+  /** Provider-specific refresh metadata. Never contains access/refresh tokens. */
+  readonly metadata?: Readonly<Record<string, string>> | undefined;
 }
 
 /** JSON wire format for token persistence (snake_case, Python-compatible). */
@@ -18,6 +20,15 @@ export interface TokenInfoWire {
   readonly scope: string;
   readonly token_type: string;
   readonly expires_in: number;
+  readonly metadata?: Readonly<Record<string, string>> | undefined;
+}
+
+function sanitizeMetadata(value: unknown): Readonly<Record<string, string>> | undefined {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) return undefined;
+  const entries = Object.entries(value as Record<string, unknown>).filter(
+    (entry): entry is [string, string] => typeof entry[1] === 'string',
+  );
+  return entries.length > 0 ? Object.fromEntries(entries) : undefined;
 }
 
 export function tokenToWire(token: TokenInfo): TokenInfoWire {
@@ -28,6 +39,7 @@ export function tokenToWire(token: TokenInfo): TokenInfoWire {
     scope: token.scope,
     token_type: token.tokenType,
     expires_in: token.expiresIn,
+    ...(token.metadata === undefined ? {} : { metadata: token.metadata }),
   };
 }
 
@@ -39,5 +51,6 @@ export function tokenFromWire(wire: Partial<TokenInfoWire>): TokenInfo {
     scope: wire.scope ?? '',
     tokenType: wire.token_type ?? '',
     expiresIn: typeof wire.expires_in === 'number' ? wire.expires_in : 0,
+    metadata: sanitizeMetadata(wire.metadata),
   };
 }