Function nestedAuthedUserGrant

packages/core/sdk/src/oauth-helpers.ts:653–681

(
  response: Response,
)

 * absent or empty, and normalize Slack's comma separator back to RFC space-delimited
 * scope syntax at this boundary. */
const nestedAuthedUserGrant = async (
  response: Response,
): Promise<NestedAuthedUserGrant | undefined> => {
  const body = await response
    .clone()
    .json()
    .then(
      (value: unknown) => value,
      () => null,
    );
  const decoded = decodeNestedAuthedUserScope(body);
  if (Option.isNone(decoded)) return undefined;
  const normalized = decoded.value.authed_user.scope
    .split(/[\s,]+/)
    .filter(Boolean)
    .join(" ");
  if (normalized.length === 0) return undefined;
  const nestedAccessToken = decoded.value.authed_user.access_token;
  const nestedTokenType = decoded.value.authed_user.token_type;
  const nestedRefreshToken = decoded.value.authed_user.refresh_token;
  const nestedExpiresIn = decoded.value.authed_user.expires_in;
  return {
    scope: normalized,
    ...(nestedAccessToken === undefined ? {} : { accessToken: nestedAccessToken }),
    ...(nestedTokenType === undefined ? {} : { tokenType: nestedTokenType }),
    ...(nestedRefreshToken === undefined ? {} : { refreshToken: nestedRefreshToken }),
    ...(nestedExpiresIn === undefined ? {} : { expiresIn: nestedExpiresIn }),
  };
};

// MCP source connections are pure OAuth 2.0. Some providers (PostHog, etc.)
// front an OIDC backend and emit an `id_token` anyway; oauth4webapi then