@0xmaxma/claude-gateway 1.8.7 → 1.8.8

package/dist/connectors/oauth-refresh-sweep.js

@@ -0,0 +1,337 @@
+"use strict";
+/**
+ * Periodic refresh for connectors whose credential this gateway owns
+ * (CustomConnectorEntry.credentialOwner === 'gateway') — the gateway-side
+ * counterpart to whatever refresh loop an external control plane runs for the
+ * 'external' entries it pushes in. Runs on the same 60s
+ * interval as cliPairingStore.prune() (see gateway-router.ts) via
+ * refreshExpiringOAuthConnectors().
+ *
+ * Storage note: the refresh_token, its client_id, the access_token expiry and this
+ * sweep's failure bookkeeping all live in the same mcp-token.env as connector secrets,
+ * but under `internalSecretKey()`'s `CUSTOMINT__` prefix, which `customSecretKey()`
+ * cannot produce. `PLACEHOLDER_RE` accepts a leading underscore, so it is the prefix —
+ * not the `__` naming convention — that keeps a pasted `{__refresh_token}` from
+ * resolving to this sweep's slot. See custom.ts's `internalSecretKey`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.transientBackoffMs = transientBackoffMs;
+exports.refreshTokenSecretKey = refreshTokenSecretKey;
+exports.clientIdSecretKey = clientIdSecretKey;
+exports.expiresAtSecretKey = expiresAtSecretKey;
+exports.refreshFailCountSecretKey = refreshFailCountSecretKey;
+exports.refreshBackoffUntilSecretKey = refreshBackoffUntilSecretKey;
+exports.refreshTransientCountSecretKey = refreshTransientCountSecretKey;
+exports.tokenGenerationSecretKey = tokenGenerationSecretKey;
+exports.dcrClientIdSecretKey = dcrClientIdSecretKey;
+exports.clientRedirectUriSecretKey = clientRedirectUriSecretKey;
+exports.internalSecretKeysOf = internalSecretKeysOf;
+exports.refreshExpiringOAuthConnectors = refreshExpiringOAuthConnectors;
+const custom_1 = require("./custom");
+const token_env_1 = require("./token-env");
+const mcp_oauth_1 = require("./mcp-oauth");
+const REFRESH_SKEW_MS = 5 * 60 * 1000;
+// Base wait after a failed refresh. Without it, a permanently-broken refresh_token
+// (a blip self-heals next tick; a revoked one never will) is hammered every 60s.
+const REFRESH_BACKOFF_MS = 5 * 60 * 1000;
+// Ceiling for the transient-failure backoff. A connector whose MCP URL is gone for
+// good never produces an RFC 6749 error, so it can never reach the permanent
+// give-up — it just fails transiently forever. A flat REFRESH_BACKOFF_MS would
+// retry (and log) every five minutes for the life of the process; backing off
+// exponentially to this cap makes that four attempts a day, while still recovering
+// on its own the moment the provider comes back.
+const MAX_REFRESH_BACKOFF_MS = 6 * 60 * 60 * 1000;
+// Consecutive failures before giving up entirely: clear the tokens so status flips
+// to "not connected" instead of an indefinitely-retrying green checkmark.
+//
+// Only failures the authorization server itself declared count (see
+// OAuthTokenError.isPermanent). Giving up deletes the user's credentials, and an
+// unreachable provider says nothing about whether the grant is still good —
+// counting those meant a routine outage landing inside a token's refresh window
+// silently destroyed a working sign-in. Transient failures back off instead, and
+// are counted separately so status can show "still retrying".
+const MAX_CONSECUTIVE_FAILURES = 3;
+/** Backoff for the nth consecutive transient failure, capped. */
+function transientBackoffMs(consecutiveFailures) {
+    const n = Math.max(1, consecutiveFailures);
+    // 2 ** n overflows to Infinity long before this matters, and Infinity * x is still
+    // Infinity — clamp the exponent, not just the product.
+    const exponent = Math.min(n - 1, 32);
+    return Math.min(REFRESH_BACKOFF_MS * 2 ** exponent, MAX_REFRESH_BACKOFF_MS);
+}
+/** A failure counter read fresh out of mcp-token.env, floored by `parseCounter`. Used
+ *  only in the failure branches, which read-modify-write the counter after the network
+ *  round trip — the due-check up front reads from one snapshot instead. */
+function readCounter(key) {
+    return (0, token_env_1.parseCounter)((0, token_env_1.getSecret)(key));
+}
+function refreshTokenSecretKey(id) {
+    return (0, custom_1.internalSecretKey)(id, '__refresh_token');
+}
+function clientIdSecretKey(id) {
+    return (0, custom_1.internalSecretKey)(id, '__client_id');
+}
+function expiresAtSecretKey(id) {
+    return (0, custom_1.internalSecretKey)(id, '__token_expires_at');
+}
+function refreshFailCountSecretKey(id) {
+    return (0, custom_1.internalSecretKey)(id, '__refresh_fail_count');
+}
+function refreshBackoffUntilSecretKey(id) {
+    return (0, custom_1.internalSecretKey)(id, '__refresh_backoff_until');
+}
+/** Consecutive *transient* failures — kept apart from `__refresh_fail_count` so an
+ *  outage can never accumulate toward deleting a live grant. Drives the exponential
+ *  backoff and status's `refresh` block; cleared on the first success. */
+function refreshTransientCountSecretKey(id) {
+    return (0, custom_1.internalSecretKey)(id, '__refresh_transient_count');
+}
+/** Bumped on every access_token write — by the OAuth callback on a fresh sign-in
+ *  AND by this sweep on a successful refresh. Read back before this sweep commits,
+ *  so a manual reconnect landing mid-refresh wins instead of being clobbered by a
+ *  slower, now-stale refresh. */
+function tokenGenerationSecretKey(id) {
+    return (0, custom_1.internalSecretKey)(id, '__token_generation');
+}
+/**
+ * DCR registration cache — deliberately NOT `clientIdSecretKey`.
+ *
+ * `oauth/start` registers a client before the user has done anything, and the flow can
+ * be abandoned. Writing that client_id into the key this sweep reads left the connector
+ * pairing refresh_token R1 (issued to the OLD client C1) with client_id C2; the next
+ * refresh POSTs that mismatched pair, the AS answers `invalid_client` — permanent, and
+ * correctly so for that pair — and three ticks later a working sign-in is deleted
+ * because an admin opened a Connect dialog and closed it again.
+ *
+ * `clientIdSecretKey` is written only by the callback, i.e. only once a token has
+ * actually been issued to that client. This key is just a cache so retried Connect
+ * clicks don't orphan a fresh registration at the provider every attempt. It lives
+ * beside the keys the sweep owns because the give-up path and DELETE /v1/connectors/:id
+ * both have to invalidate it (see `clearsDcrRegistration`).
+ */
+function dcrClientIdSecretKey(id) {
+    return (0, custom_1.internalSecretKey)(id, '__dcr_client_id');
+}
+/** The redirect_uri `dcrClientIdSecretKey`'s cached client was registered with. Reuse
+ *  that client_id only while this matches the current callback URL — otherwise the
+ *  provider would reject it, so re-registering is correct, not a skipped optimization. */
+function clientRedirectUriSecretKey(id) {
+    return (0, custom_1.internalSecretKey)(id, '__client_redirect_uri');
+}
+/** Every key this sweep and the OAuth routers store for one connector, for the paths
+ *  that clear a connector out entirely. Enumerated once so a new key cannot be added to
+ *  the writers and forgotten by the deleters — the bug that left dead DCR registrations
+ *  behind forever. `includeDcrRegistration: false` keeps the cached DCR client (see
+ *  `clearsDcrRegistration`). */
+function internalSecretKeysOf(id, opts = {}) {
+    const { includeDcrRegistration = true } = opts;
+    return [
+        refreshTokenSecretKey(id),
+        clientIdSecretKey(id),
+        expiresAtSecretKey(id),
+        refreshFailCountSecretKey(id),
+        refreshBackoffUntilSecretKey(id),
+        refreshTransientCountSecretKey(id),
+        // Cleared with the rest: a generation left behind for a token-less id means the
+        // next sign-in starts from a value a still-running refresh may already have read,
+        // and the optimistic-concurrency check silently stops guarding.
+        tokenGenerationSecretKey(id),
+        ...(includeDcrRegistration ? [dcrClientIdSecretKey(id), clientRedirectUriSecretKey(id)] : []),
+    ];
+}
+/**
+ * Whether a give-up should also drop the cached DCR registration.
+ *
+ * Not on every give-up. `invalid_grant` means the refresh_token is dead while the
+ * registered client is still good — dropping it orphans a registration for nothing.
+ * `invalid_client`/`unauthorized_client` is the opposite: the provider does not
+ * recognise the client at all, and a cache holding a deleted client_id is
+ * unrecoverable through the UI — Connect finds the redirect_uri still matching,
+ * skips re-registration and fails again forever.
+ */
+function clearsDcrRegistration(err) {
+    return (err instanceof mcp_oauth_1.OAuthTokenError &&
+        (err.errorCode === 'invalid_client' || err.errorCode === 'unauthorized_client'));
+}
+/**
+ * Guards against overlapping sweeps. The caller (gateway-router.ts) fires this on a
+ * fixed 60s interval without awaiting it, so a slow token endpoint leaves a sweep in
+ * flight when the next tick starts. Both would read the same `__refresh_token` and POST
+ * it; against a provider that rotates refresh tokens (the OAuth 2.1 default for a
+ * public client) the second use is replay, and the whole grant is revoked.
+ *
+ * A plain boolean suffices: one process-wide job, and skipping a tick is free — the
+ * next is 60s away and the work is idempotent.
+ */
+let sweepInFlight = false;
+/**
+ * Scan every gateway-owned connector; refresh any whose access_token is within
+ * REFRESH_SKEW_MS of its recorded expiry. Best-effort per connector — a failure is
+ * logged and skipped, never thrown, so one broken connector can't stop the rest.
+ * `agents` lets a successful refresh restart sessions already using the connector (a
+ * live MCP subprocess has the OLD token baked in and can't be hot-patched).
+ */
+async function refreshExpiringOAuthConnectors(store, agents) {
+    if (sweepInFlight)
+        return; // previous tick still running — see sweepInFlight
+    sweepInFlight = true;
+    try {
+        await sweepOnce(store, agents);
+    }
+    finally {
+        sweepInFlight = false; // released even if a connector loop threw
+    }
+}
+async function sweepOnce(store, agents) {
+    const connectors = await store.read();
+    for (const [id, entry] of Object.entries(connectors)) {
+        // Only 'gateway': this sweep refreshes with a refresh_token THIS gateway
+        // holds, and it holds one for no other owner. An 'external' entry is the
+        // control plane's to renew.
+        if (entry.credentialOwner !== 'gateway')
+            continue;
+        try {
+            await refreshOne(id, entry, agents);
+        }
+        catch (err) {
+            // The per-connector guard, around the WHOLE step rather than the network call
+            // alone: `refreshOne`'s own try/catch covers the refresh, but the getSecret
+            // reads deciding whether it is due and the updateSecrets/deleteSecrets in its
+            // failure branches all touch mcp-token.env and can throw an errno. Uncaught,
+            // one blip on the first connector abandoned the sweep for every connector
+            // after it, with gateway-router.ts's `.catch()` swallowing the reason.
+            console.error(`oauth-refresh-sweep: connector=${id} sweep step failed: ${err.message}`);
+        }
+    }
+}
+async function refreshOne(id, entry, agents) {
+    // One read+parse of mcp-token.env for the whole due-check. Every value below is
+    // answering the same question at the same instant, and there is no await between
+    // them, so five separate getSecret() calls were five reads of one file per connector
+    // per tick with no added freshness — the read pattern listConnectorStatus already
+    // uses. (The generation re-read AFTER the network round trip is a different thing
+    // entirely and stays a fresh read — see below.)
+    const secrets = (0, token_env_1.readTokenEnv)();
+    const backoffUntilRaw = (0, token_env_1.getSecretFrom)(secrets, refreshBackoffUntilSecretKey(id));
+    if (backoffUntilRaw && Number(backoffUntilRaw) > Date.now())
+        return; // recent failure — still backing off
+    // An absent, non-numeric or infinite expiry falls through to a refresh rather than
+    // "not due yet". Refreshing on an unknown expiry costs one round trip and
+    // self-corrects (the success path always writes a fresh expiry); trusting a corrupt
+    // one — Infinity reads as "expires never" — silently never refreshes at all.
+    const expiresAt = Number((0, token_env_1.getSecretFrom)(secrets, expiresAtSecretKey(id)) ?? '');
+    if (Number.isFinite(expiresAt) && expiresAt - Date.now() >= REFRESH_SKEW_MS)
+        return; // not due yet
+    const refreshToken = (0, token_env_1.getSecretFrom)(secrets, refreshTokenSecretKey(id));
+    const clientId = (0, token_env_1.getSecretFrom)(secrets, clientIdSecretKey(id));
+    const mcpUrl = typeof entry.config.url === 'string' ? entry.config.url : null;
+    // Nothing to refresh with (disconnected, or a provider that issued no
+    // refresh_token). Skipped silently, and no failure recorded — nothing failed.
+    // `refreshStatusOf` surfaces this instead, deriving `unrefreshable` from an expired
+    // access_token with no refresh_token beside it.
+    if (!refreshToken || !clientId || !mcpUrl)
+        return;
+    // Captured before the two network round-trips so a concurrent manual reconnect (a
+    // fresh /oauth/mcp/callback exchange racing this refresh) is detected before this
+    // sweep commits a write derived from a now-stale refresh_token. Taken from the same
+    // snapshot as the values above — it is the "before" side of the comparison, read
+    // synchronously alongside them; it is the "after" side that must hit the file again.
+    const generationBefore = (0, token_env_1.getSecretFrom)(secrets, tokenGenerationSecretKey(id));
+    try {
+        const metadata = await (0, mcp_oauth_1.discoverOAuthMetadataCached)(mcpUrl);
+        const token = await (0, mcp_oauth_1.refreshAccessToken)({ metadata, clientId, refreshToken });
+        if ((0, token_env_1.getSecret)(tokenGenerationSecretKey(id)) !== generationBefore) {
+            // A manual reconnect wrote a newer token mid-flight — strictly fresher than
+            // this one, so abandon ours. Not a failure: leave the backoff/counters alone.
+            return;
+        }
+        // One rewrite for the whole result: a crash between separate writes could file a
+        // new access_token under the OLD expiry (read as "already due" every tick after),
+        // or leave a fresh token carrying a stale backoff.
+        (0, token_env_1.updateSecrets)({
+            [(0, custom_1.customSecretKey)(id, 'access_token')]: token.access_token,
+            ...(token.refresh_token ? { [refreshTokenSecretKey(id)]: token.refresh_token } : {}),
+            [expiresAtSecretKey(id)]: String(Date.now() + (token.expires_in ?? 3600) * 1000),
+            [tokenGenerationSecretKey(id)]: String(Date.now()),
+        }, [
+            refreshFailCountSecretKey(id),
+            refreshBackoffUntilSecretKey(id),
+            refreshTransientCountSecretKey(id),
+        ]);
+        if (agents) {
+            await Promise.all([...agents.values()].map((runner) => 
+            // Guarded per runner, as the two routers guard their own restarts.
+            // Unguarded, a rejecting `proc.stop()` fell into the catch below — which
+            // treats any non-OAuthTokenError as a transient *refresh* failure — so an
+            // already-succeeded refresh got logged as failed, backed off, and counted
+            // toward the transient streak.
+            runner.restartSessionsUsingConnector(id).catch((e) => {
+                console.error(`oauth-refresh-sweep: restart for connector=${id} failed: ${e.message}`);
+            })));
+        }
+    }
+    catch (err) {
+        // Only an explicit refusal from the authorization server counts toward giving up.
+        // DNS, timeouts, a 502, a malformed discovery response — all mean the provider is
+        // unreachable, which says nothing about whether the grant is still valid.
+        const permanent = err instanceof mcp_oauth_1.OAuthTokenError && err.isPermanent;
+        const failCount = permanent ? readCounter(refreshFailCountSecretKey(id)) + 1 : 0;
+        const transientCount = permanent
+            ? 0 // the AS answered, so it is reachable — the transient streak is over
+            : readCounter(refreshTransientCountSecretKey(id)) + 1;
+        const backoffMs = permanent ? REFRESH_BACKOFF_MS : transientBackoffMs(transientCount);
+        // Decided before the log line: this branch deletes the user's credentials, and a
+        // "retrying in 5m" printed immediately above that deletion is the one message an
+        // admin reads while working out why a connector dropped.
+        const givingUp = permanent && failCount >= MAX_CONSECUTIVE_FAILURES;
+        console.error(`oauth-refresh-sweep: connector=${id} refresh failed` +
+            ` (${permanent ? `permanent, attempt ${failCount}` : `transient, attempt ${transientCount}`};` +
+            ` ${givingUp
+                ? 'giving up — clearing stored credentials'
+                : `retrying in ${Math.round(backoffMs / 60000)}m`}): ${err.message}`);
+        if (givingUp) {
+            // The AS refused this grant this many times in a row — it is not coming back on
+            // its own. Clear everything so status reports "not connected" and this loop
+            // stops calling a dead token endpoint on every future tick.
+            (0, token_env_1.deleteSecrets)([
+                (0, custom_1.customSecretKey)(id, 'access_token'),
+                ...internalSecretKeysOf(id, { includeDcrRegistration: clearsDcrRegistration(err) }),
+            ]);
+            // …and restart, for the same reason the success path above does and the
+            // unified DELETE route does. A live session's MCP subprocess was spawned with
+            // the token just deleted baked into its env and cannot be hot-patched, so
+            // without this it keeps advertising the connector's tools and failing every
+            // call against them with a 401 the model has no way to interpret. Respawned,
+            // the connector resolves with no secret, session/process.ts leaves it out of
+            // the MCP config, and the tools are simply absent — which is the truth.
+            //
+            // Guarded per runner for the reason spelled out on the success path: an
+            // unguarded rejection lands in this same catch block and would be re-counted
+            // as a refresh failure.
+            if (agents) {
+                await Promise.all([...agents.values()].map((runner) => runner.restartSessionsUsingConnector(id).catch((e) => {
+                    console.error(`oauth-refresh-sweep: restart after give-up for connector=${id} failed: ${e.message}`);
+                })));
+            }
+        }
+        else if (permanent) {
+            // One rewrite, same reason as the success path: splitting the new permanent
+            // count from the cleared transient one left a window where both were set,
+            // which status renders as a transient backoff that no longer exists.
+            (0, token_env_1.updateSecrets)({
+                [refreshFailCountSecretKey(id)]: String(failCount),
+                [refreshBackoffUntilSecretKey(id)]: String(Date.now() + backoffMs),
+            }, [refreshTransientCountSecretKey(id)]);
+        }
+        else {
+            // Transient: back off exponentially (a provider gone for good decays to a few
+            // attempts a day) but leave the *permanent* counter untouched — an outage must
+            // never accumulate toward deleting a working sign-in.
+            (0, token_env_1.setSecrets)({
+                [refreshTransientCountSecretKey(id)]: String(transientCount),
+                [refreshBackoffUntilSecretKey(id)]: String(Date.now() + backoffMs),
+            });
+        }
+    }
+}
+//# sourceMappingURL=oauth-refresh-sweep.js.map

package/dist/connectors/oauth-refresh-sweep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-refresh-sweep.js","sourceRoot":"","sources":["../../src/connectors/oauth-refresh-sweep.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AAuCH,gDAMC;AASD,sDAEC;AACD,8CAEC;AACD,gDAEC;AACD,8DAEC;AACD,oEAEC;AAID,wEAEC;AAKD,4DAEC;AAkBD,oDAEC;AAKD,gEAEC;AAOD,oDAkBC;AAsCD,wEAWC;AAlLD,qCAA8D;AAC9D,2CAQqB;AACrB,2CAA+F;AAE/F,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACtC,mFAAmF;AACnF,iFAAiF;AACjF,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,mFAAmF;AACnF,6EAA6E;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,mFAAmF;AACnF,iDAAiD;AACjD,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAClD,mFAAmF;AACnF,0EAA0E;AAC1E,EAAE;AACF,oEAAoE;AACpE,iFAAiF;AACjF,4EAA4E;AAC5E,gFAAgF;AAChF,iFAAiF;AACjF,8DAA8D;AAC9D,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAEnC,iEAAiE;AACjE,SAAgB,kBAAkB,CAAC,mBAA2B;IAC5D,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;IAC3C,mFAAmF;IACnF,uDAAuD;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC,GAAG,CAAC,kBAAkB,GAAG,CAAC,IAAI,QAAQ,EAAE,sBAAsB,CAAC,CAAC;AAC9E,CAAC;AAED;;2EAE2E;AAC3E,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,IAAA,wBAAY,EAAC,IAAA,qBAAS,EAAC,GAAG,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,SAAgB,qBAAqB,CAAC,EAAU;IAC9C,OAAO,IAAA,0BAAiB,EAAC,EAAE,EAAE,iBAAiB,CAAC,CAAC;AAClD,CAAC;AACD,SAAgB,iBAAiB,CAAC,EAAU;IAC1C,OAAO,IAAA,0BAAiB,EAAC,EAAE,EAAE,aAAa,CAAC,CAAC;AAC9C,CAAC;AACD,SAAgB,kBAAkB,CAAC,EAAU;IAC3C,OAAO,IAAA,0BAAiB,EAAC,EAAE,EAAE,oBAAoB,CAAC,CAAC;AACrD,CAAC;AACD,SAAgB,yBAAyB,CAAC,EAAU;IAClD,OAAO,IAAA,0BAAiB,EAAC,EAAE,EAAE,sBAAsB,CAAC,CAAC;AACvD,CAAC;AACD,SAAgB,4BAA4B,CAAC,EAAU;IACrD,OAAO,IAAA,0BAAiB,EAAC,EAAE,EAAE,yBAAyB,CAAC,CAAC;AAC1D,CAAC;AACD;;0EAE0E;AAC1E,SAAgB,8BAA8B,CAAC,EAAU;IACvD,OAAO,IAAA,0BAAiB,EAAC,EAAE,EAAE,2BAA2B,CAAC,CAAC;AAC5D,CAAC;AACD;;;iCAGiC;AACjC,SAAgB,wBAAwB,CAAC,EAAU;IACjD,OAAO,IAAA,0BAAiB,EAAC,EAAE,EAAE,oBAAoB,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,oBAAoB,CAAC,EAAU;IAC7C,OAAO,IAAA,0BAAiB,EAAC,EAAE,EAAE,iBAAiB,CAAC,CAAC;AAClD,CAAC;AAED;;0FAE0F;AAC1F,SAAgB,0BAA0B,CAAC,EAAU;IACnD,OAAO,IAAA,0BAAiB,EAAC,EAAE,EAAE,uBAAuB,CAAC,CAAC;AACxD,CAAC;AAED;;;;gCAIgC;AAChC,SAAgB,oBAAoB,CAClC,EAAU,EACV,OAA6C,EAAE;IAE/C,MAAM,EAAE,sBAAsB,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IAC/C,OAAO;QACL,qBAAqB,CAAC,EAAE,CAAC;QACzB,iBAAiB,CAAC,EAAE,CAAC;QACrB,kBAAkB,CAAC,EAAE,CAAC;QACtB,yBAAyB,CAAC,EAAE,CAAC;QAC7B,4BAA4B,CAAC,EAAE,CAAC;QAChC,8BAA8B,CAAC,EAAE,CAAC;QAClC,gFAAgF;QAChF,kFAAkF;QAClF,gEAAgE;QAChE,wBAAwB,CAAC,EAAE,CAAC;QAC5B,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,EAAE,CAAC,EAAE,0BAA0B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9F,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,qBAAqB,CAAC,GAAY;IACzC,OAAO,CACL,GAAG,YAAY,2BAAe;QAC9B,CAAC,GAAG,CAAC,SAAS,KAAK,gBAAgB,IAAI,GAAG,CAAC,SAAS,KAAK,qBAAqB,CAAC,CAChF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,IAAI,aAAa,GAAG,KAAK,CAAC;AAE1B;;;;;;GAMG;AACI,KAAK,UAAU,8BAA8B,CAClD,KAA4B,EAC5B,MAAiC;IAEjC,IAAI,aAAa;QAAE,OAAO,CAAC,kDAAkD;IAC7E,aAAa,GAAG,IAAI,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;YAAS,CAAC;QACT,aAAa,GAAG,KAAK,CAAC,CAAC,0CAA0C;IACnE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,KAA4B,EAC5B,MAAiC;IAEjC,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IACtC,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACrD,yEAAyE;QACzE,yEAAyE;QACzE,4BAA4B;QAC5B,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS;YAAE,SAAS;QAClD,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,8EAA8E;YAC9E,4EAA4E;YAC5E,8EAA8E;YAC9E,6EAA6E;YAC7E,0EAA0E;YAC1E,uEAAuE;YACvE,OAAO,CAAC,KAAK,CACX,kCAAkC,EAAE,uBAAwB,GAAa,CAAC,OAAO,EAAE,CACpF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,EAAU,EACV,KAA0C,EAC1C,MAAiC;IAEjC,gFAAgF;IAChF,iFAAiF;IACjF,qFAAqF;IACrF,kFAAkF;IAClF,kFAAkF;IAClF,gDAAgD;IAChD,MAAM,OAAO,GAAG,IAAA,wBAAY,GAAE,CAAC;IAE/B,MAAM,eAAe,GAAG,IAAA,yBAAa,EAAC,OAAO,EAAE,4BAA4B,CAAC,EAAE,CAAC,CAAC,CAAC;IACjF,IAAI,eAAe,IAAI,MAAM,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,CAAC,qCAAqC;IAE1G,mFAAmF;IACnF,0EAA0E;IAC1E,oFAAoF;IACpF,6EAA6E;IAC7E,MAAM,SAAS,GAAG,MAAM,CAAC,IAAA,yBAAa,EAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/E,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,eAAe;QAAE,OAAO,CAAC,cAAc;IAEnG,MAAM,YAAY,GAAG,IAAA,yBAAa,EAAC,OAAO,EAAE,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,IAAA,yBAAa,EAAC,OAAO,EAAE,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9E,sEAAsE;IACtE,8EAA8E;IAC9E,oFAAoF;IACpF,gDAAgD;IAChD,IAAI,CAAC,YAAY,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM;QAAE,OAAO;IAElD,kFAAkF;IAClF,kFAAkF;IAClF,oFAAoF;IACpF,iFAAiF;IACjF,qFAAqF;IACrF,MAAM,gBAAgB,GAAG,IAAA,yBAAa,EAAC,OAAO,EAAE,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC;IAE9E,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAA,uCAA2B,EAAC,MAAM,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,IAAA,8BAAkB,EAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QAE7E,IAAI,IAAA,qBAAS,EAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,KAAK,gBAAgB,EAAE,CAAC;YACjE,4EAA4E;YAC5E,8EAA8E;YAC9E,OAAO;QACT,CAAC;QAED,iFAAiF;QACjF,kFAAkF;QAClF,mDAAmD;QACnD,IAAA,yBAAa,EACX;YACE,CAAC,IAAA,wBAAe,EAAC,EAAE,EAAE,cAAc,CAAC,CAAC,EAAE,KAAK,CAAC,YAAY;YACzD,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC;YAChF,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;SACnD,EACD;YACE,yBAAyB,CAAC,EAAE,CAAC;YAC7B,4BAA4B,CAAC,EAAE,CAAC;YAChC,8BAA8B,CAAC,EAAE,CAAC;SACnC,CACF,CAAC;QAEF,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,OAAO,CAAC,GAAG,CACf,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;YAClC,mEAAmE;YACnE,yEAAyE;YACzE,0EAA0E;YAC1E,0EAA0E;YAC1E,+BAA+B;YAC/B,MAAM,CAAC,6BAA6B,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAQ,EAAE,EAAE;gBAC1D,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzF,CAAC,CAAC,CACH,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,kFAAkF;QAClF,kFAAkF;QAClF,0EAA0E;QAC1E,MAAM,SAAS,GAAG,GAAG,YAAY,2BAAe,IAAI,GAAG,CAAC,WAAW,CAAC;QACpE,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,yBAAyB,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjF,MAAM,cAAc,GAAG,SAAS;YAC9B,CAAC,CAAC,CAAC,CAAC,qEAAqE;YACzE,CAAC,CAAC,WAAW,CAAC,8BAA8B,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;QACtF,iFAAiF;QACjF,iFAAiF;QACjF,yDAAyD;QACzD,MAAM,QAAQ,GAAG,SAAS,IAAI,SAAS,IAAI,wBAAwB,CAAC;QAEpE,OAAO,CAAC,KAAK,CACX,kCAAkC,EAAE,iBAAiB;YACnD,KAAK,SAAS,CAAC,CAAC,CAAC,sBAAsB,SAAS,EAAE,CAAC,CAAC,CAAC,sBAAsB,cAAc,EAAE,GAAG;YAC9F,IACE,QAAQ;gBACN,CAAC,CAAC,yCAAyC;gBAC3C,CAAC,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,GAClD,MAAO,GAAa,CAAC,OAAO,EAAE,CACjC,CAAC;QAEF,IAAI,QAAQ,EAAE,CAAC;YACb,gFAAgF;YAChF,4EAA4E;YAC5E,4DAA4D;YAC5D,IAAA,yBAAa,EAAC;gBACZ,IAAA,wBAAe,EAAC,EAAE,EAAE,cAAc,CAAC;gBACnC,GAAG,oBAAoB,CAAC,EAAE,EAAE,EAAE,sBAAsB,EAAE,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;aACpF,CAAC,CAAC;YACH,wEAAwE;YACxE,8EAA8E;YAC9E,0EAA0E;YAC1E,4EAA4E;YAC5E,6EAA6E;YAC7E,6EAA6E;YAC7E,wEAAwE;YACxE,EAAE;YACF,wEAAwE;YACxE,6EAA6E;YAC7E,wBAAwB;YACxB,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,OAAO,CAAC,GAAG,CACf,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAClC,MAAM,CAAC,6BAA6B,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAQ,EAAE,EAAE;oBAC1D,OAAO,CAAC,KAAK,CACX,4DAA4D,EAAE,YAAY,CAAC,CAAC,OAAO,EAAE,CACtF,CAAC;gBACJ,CAAC,CAAC,CACH,CACF,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,IAAI,SAAS,EAAE,CAAC;YACrB,4EAA4E;YAC5E,0EAA0E;YAC1E,qEAAqE;YACrE,IAAA,yBAAa,EACX;gBACE,CAAC,yBAAyB,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC;gBAClD,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;aACnE,EACD,CAAC,8BAA8B,CAAC,EAAE,CAAC,CAAC,CACrC,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,8EAA8E;YAC9E,+EAA+E;YAC/E,sDAAsD;YACtD,IAAA,sBAAU,EAAC;gBACT,CAAC,8BAA8B,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;gBAC5D,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;aACnE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/connectors/pending-oauth-store.d.ts

@@ -0,0 +1,39 @@
+import type { OAuthMetadata } from './mcp-oauth';
+/**
+ * In-memory bridge between a `POST .../oauth/start` call and the later
+ * `GET /oauth/mcp/callback` the provider redirects the user's browser to.
+ * Modeled directly on `cli-viewer/pairing-store.ts`'s `CliPairingStore`: a
+ * `Map` keyed by a random, single-use, TTL'd id (the OAuth `state` value
+ * here), pruned on the same interval as that store.
+ *
+ * Deliberately NOT persisted to disk — a flow is only ever a few minutes
+ * from start to callback; a gateway restart mid-flow just means the user
+ * clicks "Connect" again.
+ */
+export interface PendingOAuth {
+    connectorId: string;
+    metadata: OAuthMetadata;
+    clientId: string;
+    redirectUri: string;
+    codeVerifier: string;
+    createdAt: number;
+    expiresAt: number;
+}
+export declare class PendingOAuthStore {
+    private readonly flows;
+    /** Start a flow, returning the `state` value to embed in the authorize URL. */
+    create(entry: Omit<PendingOAuth, 'createdAt' | 'expiresAt'>): string;
+    /**
+     * Consume (single-use) the flow for `state`. Returns null if unknown,
+     * expired, or already consumed — the callback handler treats all three the
+     * same way (a generic "this sign-in link expired, try again" response).
+     */
+    consume(state: string): PendingOAuth | null;
+    /** Drop expired flows. Call on the same interval as `cliPairingStore.prune()`. */
+    prune(): void;
+    /** Test/introspection helper. */
+    size(): number;
+}
+/** Process-wide singleton — mirrors `cliPairingStore`'s shape. */
+export declare const pendingOAuthStore: PendingOAuthStore;
+//# sourceMappingURL=pending-oauth-store.d.ts.map

package/dist/connectors/pending-oauth-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-oauth-store.d.ts","sourceRoot":"","sources":["../../src/connectors/pending-oauth-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,aAAa,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAmC;IAEzD,+EAA+E;IAC/E,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,WAAW,GAAG,WAAW,CAAC,GAAG,MAAM;IAOpE;;;;OAIG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAQ3C,kFAAkF;IAClF,KAAK,IAAI,IAAI;IAOb,iCAAiC;IACjC,IAAI,IAAI,MAAM;CAGf;AAED,kEAAkE;AAClE,eAAO,MAAM,iBAAiB,mBAA0B,CAAC"}

package/dist/connectors/pending-oauth-store.js

@@ -0,0 +1,50 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pendingOAuthStore = exports.PendingOAuthStore = void 0;
+const crypto_1 = __importDefault(require("crypto"));
+const FLOW_TTL_MS = 5 * 60 * 1000;
+class PendingOAuthStore {
+    constructor() {
+        this.flows = new Map();
+    }
+    /** Start a flow, returning the `state` value to embed in the authorize URL. */
+    create(entry) {
+        const state = crypto_1.default.randomBytes(16).toString('base64url');
+        const now = Date.now();
+        this.flows.set(state, { ...entry, createdAt: now, expiresAt: now + FLOW_TTL_MS });
+        return state;
+    }
+    /**
+     * Consume (single-use) the flow for `state`. Returns null if unknown,
+     * expired, or already consumed — the callback handler treats all three the
+     * same way (a generic "this sign-in link expired, try again" response).
+     */
+    consume(state) {
+        const flow = this.flows.get(state);
+        if (!flow)
+            return null;
+        this.flows.delete(state);
+        if (flow.expiresAt <= Date.now())
+            return null;
+        return flow;
+    }
+    /** Drop expired flows. Call on the same interval as `cliPairingStore.prune()`. */
+    prune() {
+        const now = Date.now();
+        for (const [state, flow] of this.flows) {
+            if (flow.expiresAt <= now)
+                this.flows.delete(state);
+        }
+    }
+    /** Test/introspection helper. */
+    size() {
+        return this.flows.size;
+    }
+}
+exports.PendingOAuthStore = PendingOAuthStore;
+/** Process-wide singleton — mirrors `cliPairingStore`'s shape. */
+exports.pendingOAuthStore = new PendingOAuthStore();
+//# sourceMappingURL=pending-oauth-store.js.map

package/dist/connectors/pending-oauth-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-oauth-store.js","sourceRoot":"","sources":["../../src/connectors/pending-oauth-store.ts"],"names":[],"mappings":";;;;;;AAAA,oDAA4B;AAwB5B,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAElC,MAAa,iBAAiB;IAA9B;QACmB,UAAK,GAAG,IAAI,GAAG,EAAwB,CAAC;IAmC3D,CAAC;IAjCC,+EAA+E;IAC/E,MAAM,CAAC,KAAoD;QACzD,MAAM,KAAK,GAAG,gBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,GAAG,WAAW,EAAE,CAAC,CAAC;QAClF,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,KAAa;QACnB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kFAAkF;IAClF,KAAK;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,iCAAiC;IACjC,IAAI;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;CACF;AApCD,8CAoCC;AAED,kEAAkE;AACrD,QAAA,iBAAiB,GAAG,IAAI,iBAAiB,EAAE,CAAC"}

package/dist/connectors/resolve.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Connector resolution — the single source of truth shared by the session spawner
+ * and the HTTP API.
+ *
+ * resolveEnabledConnectors(): for the injection point in SessionProcess.writeMcpConfig.
+ * listConnectorStatus(): for GET /v1/connectors.
+ */
+import type { AgentConfig, CustomConnectorEntry } from '../types';
+import { type ConnectorStatus } from './types';
+/**
+ * Build the mcpServers entries for every connector that is (a) in customConnectors,
+ * (b) enabled for this agent, and (c) connected (every `{placeholder}` secret it
+ * declares is present). Returns a map keyed by connector id, ready to merge into
+ * mcp-config.json.
+ *
+ * Enablement defaults to opt-OUT: a globally-connected connector is available to
+ * every agent the moment it's connected — an agent only misses it if explicitly
+ * disabled (`{enabled: false}`). Connecting a connector at all is the security gate;
+ * per-agent is a refinement, not a second required step.
+ *
+ * `defaultEnabled: false` (gateway.connectorsDefaultEnabled in config.json) flips
+ * that to opt-IN. The default suits the common single-operator install, but a
+ * gateway hosting agents for several different people is a different situation:
+ * there, connecting one connector hands its credential to every agent on the box,
+ * including agents whose chat users are not the person who connected it. Opting in
+ * per agent is the safer posture for that deployment, so it is available — as a
+ * deliberate choice, not a silent change of meaning for existing installs.
+ */
+export declare function resolveEnabledConnectors(agentConfig: Pick<AgentConfig, 'connectors'>, customConnectors?: Record<string, CustomConnectorEntry>, defaultEnabled?: boolean): Record<string, unknown>;
+/**
+ * The `refresh` block of ConnectorStatus, or undefined when the connector's
+ * background refresh is healthy (or was never failing). Reads the sweep's own
+ * bookkeeping out of an already-loaded token env rather than re-reading the file
+ * per connector.
+ *
+ * Both failure streaks are reported, not just the transient one. A connector two
+ * refusals into the three-strike permanent count is one tick away from having its
+ * credentials deleted — the most actionable state this block can describe, and the
+ * one a caller most needs to see before it happens.
+ *
+ * `unrefreshable` covers the cases with no streak at all. A provider that issues no
+ * refresh_token (an AS advertising scopes that don't include `offline_access` — see
+ * the scope fallback in mcp-oauth.ts's `resolveScope`) leaves the sweep nothing to
+ * refresh with, so it skips the connector on every tick and never records a failure.
+ * Without this flag that connector keeps a green checkmark forever over an
+ * access_token that expired an hour in, which is the exact state the sweep's module
+ * comment says it exists to prevent.
+ */
+export declare function refreshStatusOf(id: string, tokenEnv: Record<string, string>): ConnectorStatus['refresh'];
+/** Connector list + connected state for the API. `connected` reflects secret presence. */
+export declare function listConnectorStatus(customConnectors?: Record<string, CustomConnectorEntry>): ConnectorStatus[];
+//# sourceMappingURL=resolve.d.ts.map

package/dist/connectors/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/connectors/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAClE,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,SAAS,CAAC;AAW/C;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,EAC5C,gBAAgB,GAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAM,EAC3D,cAAc,UAAO,GACpB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA0CzB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,eAAe,CAC7B,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,eAAe,CAAC,SAAS,CAAC,CAkC5B;AAED,0FAA0F;AAC1F,wBAAgB,mBAAmB,CACjC,gBAAgB,GAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAM,GAC1D,eAAe,EAAE,CA6CnB"}