Method startAuthFlow

src/main/lib/oauth.ts:769–824

* Start OAuth flow without waiting for callback (for deeplink-based flows) * Returns the authorization URL and state/verifier for later token exchange * @param preloadedMetadata - Optional pre-fetched OAuth metadata to avoid duplicate fetch

(preloadedMetadata?: OAuthMetadata)

   * @param preloadedMetadata - Optional pre-fetched OAuth metadata to avoid duplicate fetch
   */
  async startAuthFlow(preloadedMetadata?: OAuthMetadata): Promise<{
    authUrl: string;
    state: string;
    codeVerifier: string;
    tokenEndpoint: string;
    clientId: string;
    clientSecret?: string;
  }> {
    this.callbacks.onStatus('Fetching OAuth server configuration...');
    const metadata = preloadedMetadata || await this.getServerMetadata();

    // Register client if endpoint available
    let clientId: string;
    let clientSecret: string | undefined;
    if (metadata.registration_endpoint) {
      // Try primary client name first, fall back to alternative if rejected
      this.callbacks.onStatus(`Registering client as '${CLIENT_NAME}'...`);
      try {
        const client = await this.registerClient(metadata.registration_endpoint, CLIENT_NAME);
        clientId = client.client_id;
        clientSecret = client.client_secret;
        this.callbacks.onStatus(`Registered as client: ${clientId}`);
      } catch (error) {
        // Try fallback client name (some servers have allowlists)
        this.callbacks.onStatus(`Registration as '${CLIENT_NAME}' failed, trying '${FALLBACK_CLIENT_NAME}'...`);
        const client = await this.registerClient(metadata.registration_endpoint, FALLBACK_CLIENT_NAME);
        clientId = client.client_id;
        clientSecret = client.client_secret;
        this.callbacks.onStatus(`Registered as client: ${clientId}`);
      }
    } else {
      // No registration endpoint - use default client ID
      clientId = '1code';
    }

    const pkce = generatePKCE();
    const state = generateState();
    const redirectUri = this.config.redirectUri || `http://localhost:${CALLBACK_PORT}${CALLBACK_PATH}`;

    const authUrl = new URL(metadata.authorization_endpoint);
    authUrl.searchParams.set('response_type', 'code');
    authUrl.searchParams.set('client_id', clientId);
    authUrl.searchParams.set('redirect_uri', redirectUri);
    authUrl.searchParams.set('state', state);
    authUrl.searchParams.set('code_challenge', pkce.challenge);
    authUrl.searchParams.set('code_challenge_method', 'S256');

    return {
      authUrl: authUrl.toString(),
      state,
      codeVerifier: pkce.verifier,
      tokenEndpoint: metadata.token_endpoint,
      clientId,
      clientSecret,
    };
  }

  /**