@aglyn/plugins-marketplace 1.14.0 → 1.15.1

package/src/lib/server/connections/oauth-state.js

@@ -0,0 +1,252 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { platformConsoleOrigin } from "@aglyn/aglyn/app-utils/platform-brand";
+import { createHash, createHmac, randomBytes } from "node:crypto";
+import { consumeOnce } from "@aglyn/tenant-data-admin/server/consume-once";
+import { tokenSigningSecret } from "@aglyn/tenant-data-admin/server/media-signing";
+import { safeEqual } from "@aglyn/tenant-data-admin/server/safe-equal";
+import { PLUGIN_CONNECTIONS_API_ROUTES } from "../../model/plugin-connections.js";
+import { connectionsCollection } from "./connection-store.js";
+/**
+ * THE OAUTH `state` FOR A DECLARED CONNECTION (AGL-4193): signed,
+ * short-lived, single-use, and bound to one member, one site, one listing and
+ * one of its connections. Copied in shape from sales channels' connect state
+ * (`libs/plugins/sales-channels/.../oauth-state.ts`); one plugin never
+ * imports another.
+ *
+ * ## Signed
+ *
+ * `pc1.<payload>.<signature>`: the payload names the site, its workspace, the
+ * member, the listing, the connection, a nonce, the expiry and the console
+ * page to come back to; the signature is an HMAC under the shared,
+ * fail-closed `TOKEN_SIGNING_SECRET` with its own context, so no other signed
+ * token here verifies as one. The provider hands the state back verbatim, so
+ * a state that verifies says whose connect it was — which is how the
+ * callback, a redirect with no bearer token, knows its site, and the release
+ * gate knows its workspace.
+ *
+ * ## Single-use
+ *
+ * Starting a connect also writes one pending record per member, site, listing
+ * and connection on `hosts/{hostId}/pluginConnections/oauth-…`, holding the
+ * SHA-256 of the nonce, the expiry and the redirect address the code is
+ * issued for. The callback consumes it in a transaction, so a replayed state
+ * finds nothing, and a later start replaces it, retiring every earlier state.
+ *
+ * ## Coming back
+ *
+ * The page to return to is checked against the console's own origin when the
+ * connect starts, signed into the state, and checked again on the way back;
+ * the redirect carries only its path, so it can only ever land on the console
+ * that served the callback.
+ */ /** How long a member has to finish the provider's consent screen. */ export const CONNECT_STATE_TTL_MS = 15 * 60 * 1000;
+const STATE_VERSION = 'pc1';
+const STATE_CONTEXT = 'plugin-connections-oauth-state:v1';
+const STATE_MAX_CHARS = 2048;
+const RETURN_TO_MAX_CHARS = 512;
+/** The callback's path. Registered as a redirect URI at providers: never change it. */ export const CONNECT_CALLBACK_PATH = `/api/${PLUGIN_CONNECTIONS_API_ROUTES.connectCallback}`;
+const hmac = (value)=>createHmac('sha256', tokenSigningSecret()).update(`${STATE_CONTEXT}:${value}`).digest('base64url');
+/** Mints a state. Throws when `TOKEN_SIGNING_SECRET` is not configured. */ export function mintConnectState(input) {
+    var _input_nonce;
+    const claims = {
+        hostId: input.hostId,
+        orgId: input.orgId,
+        uid: input.uid,
+        listingId: input.listingId,
+        connectionId: input.connectionId,
+        nonce: (_input_nonce = input.nonce) != null ? _input_nonce : randomBytes(32).toString('base64url'),
+        exp: input.nowMs + CONNECT_STATE_TTL_MS,
+        returnTo: input.returnTo
+    };
+    const wire = {
+        h: claims.hostId,
+        o: claims.orgId,
+        u: claims.uid,
+        l: claims.listingId,
+        c: claims.connectionId,
+        n: claims.nonce,
+        e: claims.exp,
+        r: claims.returnTo
+    };
+    const payload = Buffer.from(JSON.stringify(wire), 'utf8').toString('base64url');
+    return {
+        state: `${STATE_VERSION}.${payload}.${hmac(payload)}`,
+        claims
+    };
+}
+/** Verifies a state's signature and expiry. Never throws. */ export function readConnectState(state, nowMs) {
+    const invalid = {
+        ok: false,
+        refusal: 'state-invalid'
+    };
+    if (typeof state !== 'string' || !state || state.length > STATE_MAX_CHARS) return invalid;
+    const parts = state.split('.');
+    if (parts.length !== 3 || parts[0] !== STATE_VERSION) return invalid;
+    const [, payload, signature] = parts;
+    let expected;
+    try {
+        expected = hmac(payload);
+    } catch (unused) {
+        return invalid;
+    }
+    if (!safeEqual(signature, expected)) return invalid;
+    let wire;
+    try {
+        wire = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+    } catch (unused) {
+        return invalid;
+    }
+    const text = (value)=>typeof value === 'string' ? value : '';
+    const claims = {
+        hostId: text(wire == null ? void 0 : wire.h),
+        orgId: text(wire == null ? void 0 : wire.o),
+        uid: text(wire == null ? void 0 : wire.u),
+        listingId: text(wire == null ? void 0 : wire.l),
+        connectionId: text(wire == null ? void 0 : wire.c),
+        nonce: text(wire == null ? void 0 : wire.n),
+        exp: Number(wire == null ? void 0 : wire.e),
+        returnTo: text(wire == null ? void 0 : wire.r)
+    };
+    if (!claims.hostId || !claims.orgId || !claims.uid || !claims.listingId || !claims.connectionId || !claims.nonce || !Number.isFinite(claims.exp)) {
+        return invalid;
+    }
+    if (claims.exp <= nowMs) return {
+        ok: false,
+        refusal: 'state-expired',
+        claims
+    };
+    return {
+        ok: true,
+        claims
+    };
+}
+/** The pending record's id: the member, listing and connection hashed, so a uid never names a document. */ export function connectStateDocId(uid, listingId, connectionId) {
+    return `oauth-${createHash('sha256').update(`${listingId}\n${connectionId}\n${uid}`).digest('hex').slice(0, 40)}`;
+}
+function connectStateRef(firestore, claims) {
+    return connectionsCollection(firestore, claims.hostId).doc(connectStateDocId(claims.uid, claims.listingId, claims.connectionId));
+}
+const digest = (nonce)=>createHash('sha256').update(nonce).digest('base64url');
+/** Writes the pending record for a freshly minted state, replacing any earlier one. */ export async function recordConnectState(firestore, input) {
+    const { claims } = input;
+    await connectStateRef(firestore, claims).set({
+        kind: 'oauth-state',
+        uid: claims.uid,
+        listingId: claims.listingId,
+        connectionId: claims.connectionId,
+        nonceDigest: digest(claims.nonce),
+        redirectUri: input.redirectUri,
+        expiresAtMs: claims.exp,
+        createdAtMs: input.nowMs
+    });
+}
+/** Consumes the pending record a verified state names — once. */ export async function consumeConnectState(firestore, input) {
+    const { claims } = input;
+    const result = await consumeOnce(firestore, connectStateRef(firestore, claims), (data)=>{
+        var _data_nonceDigest, _data_redirectUri;
+        if (data['kind'] !== 'oauth-state' || data['uid'] !== claims.uid || data['listingId'] !== claims.listingId || data['connectionId'] !== claims.connectionId) {
+            return {
+                accept: false,
+                reason: 'state-superseded'
+            };
+        }
+        if (!safeEqual(String((_data_nonceDigest = data['nonceDigest']) != null ? _data_nonceDigest : ''), digest(claims.nonce))) {
+            return {
+                accept: false,
+                reason: 'state-superseded'
+            };
+        }
+        if (Number(data['expiresAtMs']) <= input.nowMs) {
+            return {
+                accept: false,
+                reason: 'state-expired',
+                remove: true
+            };
+        }
+        return {
+            accept: true,
+            value: String((_data_redirectUri = data['redirectUri']) != null ? _data_redirectUri : ''),
+            remove: true
+        };
+    });
+    if (result.ok && result.value) return {
+        ok: true,
+        redirectUri: result.value
+    };
+    if (result.reason === 'state-superseded') return {
+        ok: false,
+        refusal: 'state-superseded'
+    };
+    if (result.reason === 'state-expired') return {
+        ok: false,
+        refusal: 'state-expired'
+    };
+    return {
+        ok: false,
+        refusal: 'state-replayed'
+    };
+}
+const stripTrailingSlash = (value)=>value.replace(/\/+$/, '');
+/** The canonical console origin, or `null` when it is set to something that is not http(s). */ export function canonicalConsoleOrigin() {
+    const raw = stripTrailingSlash(platformConsoleOrigin());
+    try {
+        const url = new URL(raw);
+        return url.protocol === 'https:' || url.protocol === 'http:' ? url.origin : null;
+    } catch (unused) {
+        return null;
+    }
+}
+/**
+ * The console origin a connect started by `requestUrl` comes back to: the
+ * canonical one — the address registered on each publisher's OAuth app —
+ * except in development, where a request from `http://localhost` or
+ * `127.0.0.1` comes back to itself. Nothing else a request claims about its
+ * origin is believed.
+ */ export function consoleOriginFor(requestUrl) {
+    if (process.env['NODE_ENV'] !== 'production') {
+        try {
+            const url = new URL(requestUrl);
+            if (url.protocol === 'http:' && (url.hostname === 'localhost' || url.hostname === '127.0.0.1')) return url.origin;
+        } catch (unused) {
+        // Not a URL: the canonical origin below.
+        }
+    }
+    return canonicalConsoleOrigin();
+}
+/** Where the provider sends the member back to, or `null` when no origin is usable. */ export function connectRedirectUri(requestUrl) {
+    const origin = consoleOriginFor(requestUrl);
+    return origin ? `${origin}${CONNECT_CALLBACK_PATH}` : null;
+}
+/**
+ * The page to return to as a console path with its query, or `null` when
+ * `returnTo` is not on `origin`. Accepts an absolute URL on the origin or a
+ * single-slash path; anything else — another host, a protocol-relative
+ * `//host`, a `javascript:` URL, the callback itself — is refused.
+ */ export function consolePath(returnTo, origin) {
+    if (typeof returnTo !== 'string' || !returnTo || returnTo.length > RETURN_TO_MAX_CHARS) return null;
+    if (returnTo.startsWith('/') && (returnTo.startsWith('//') || returnTo.startsWith('/\\'))) return null;
+    let url;
+    try {
+        url = new URL(returnTo, origin);
+    } catch (unused) {
+        return null;
+    }
+    if (url.origin !== origin) return null;
+    if (url.pathname.startsWith(CONNECT_CALLBACK_PATH)) return null;
+    return `${url.pathname}${url.search}`;
+}
+
+//# sourceMappingURL=oauth-state.js.map

package/src/lib/server/connections/oauth-state.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/plugins/marketplace/src/lib/server/connections/oauth-state.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { platformConsoleOrigin } from '@aglyn/aglyn/app-utils/platform-brand'\nimport { createHash, createHmac, randomBytes } from 'node:crypto'\nimport { consumeOnce } from '@aglyn/tenant-data-admin/server/consume-once'\nimport { tokenSigningSecret } from '@aglyn/tenant-data-admin/server/media-signing'\nimport { safeEqual } from '@aglyn/tenant-data-admin/server/safe-equal'\nimport { PLUGIN_CONNECTIONS_API_ROUTES } from '../../model/plugin-connections'\nimport { connectionsCollection } from './connection-store'\n\n/**\n * THE OAUTH `state` FOR A DECLARED CONNECTION (AGL-4193): signed,\n * short-lived, single-use, and bound to one member, one site, one listing and\n * one of its connections. Copied in shape from sales channels' connect state\n * (`libs/plugins/sales-channels/.../oauth-state.ts`); one plugin never\n * imports another.\n *\n * ## Signed\n *\n * `pc1.<payload>.<signature>`: the payload names the site, its workspace, the\n * member, the listing, the connection, a nonce, the expiry and the console\n * page to come back to; the signature is an HMAC under the shared,\n * fail-closed `TOKEN_SIGNING_SECRET` with its own context, so no other signed\n * token here verifies as one. The provider hands the state back verbatim, so\n * a state that verifies says whose connect it was — which is how the\n * callback, a redirect with no bearer token, knows its site, and the release\n * gate knows its workspace.\n *\n * ## Single-use\n *\n * Starting a connect also writes one pending record per member, site, listing\n * and connection on `hosts/{hostId}/pluginConnections/oauth-…`, holding the\n * SHA-256 of the nonce, the expiry and the redirect address the code is\n * issued for. The callback consumes it in a transaction, so a replayed state\n * finds nothing, and a later start replaces it, retiring every earlier state.\n *\n * ## Coming back\n *\n * The page to return to is checked against the console's own origin when the\n * connect starts, signed into the state, and checked again on the way back;\n * the redirect carries only its path, so it can only ever land on the console\n * that served the callback.\n */\n\n/** How long a member has to finish the provider's consent screen. */\nexport const CONNECT_STATE_TTL_MS = 15 * 60 * 1000\n\nconst STATE_VERSION = 'pc1'\nconst STATE_CONTEXT = 'plugin-connections-oauth-state:v1'\nconst STATE_MAX_CHARS = 2048\nconst RETURN_TO_MAX_CHARS = 512\n\n/** The callback's path. Registered as a redirect URI at providers: never change it. */\nexport const CONNECT_CALLBACK_PATH = `/api/${PLUGIN_CONNECTIONS_API_ROUTES.connectCallback}`\n\nexport interface ConnectStateClaims {\n  hostId: string\n  orgId: string\n  uid: string\n  listingId: string\n  connectionId: string\n  nonce: string\n  /** Expiry, epoch ms. */\n  exp: number\n  /** The console path (with its query) to return to. */\n  returnTo: string\n}\n\ninterface WireClaims {\n  h: string\n  o: string\n  u: string\n  l: string\n  c: string\n  n: string\n  e: number\n  r: string\n}\n\nconst hmac = (value: string): string =>\n  createHmac('sha256', tokenSigningSecret()).update(`${STATE_CONTEXT}:${value}`).digest('base64url')\n\n/** Mints a state. Throws when `TOKEN_SIGNING_SECRET` is not configured. */\nexport function mintConnectState(\n  input: Omit<ConnectStateClaims, 'nonce' | 'exp'> & { nowMs: number; nonce?: string },\n): { state: string; claims: ConnectStateClaims } {\n  const claims: ConnectStateClaims = {\n    hostId: input.hostId,\n    orgId: input.orgId,\n    uid: input.uid,\n    listingId: input.listingId,\n    connectionId: input.connectionId,\n    nonce: input.nonce ?? randomBytes(32).toString('base64url'),\n    exp: input.nowMs + CONNECT_STATE_TTL_MS,\n    returnTo: input.returnTo,\n  }\n  const wire: WireClaims = {\n    h: claims.hostId,\n    o: claims.orgId,\n    u: claims.uid,\n    l: claims.listingId,\n    c: claims.connectionId,\n    n: claims.nonce,\n    e: claims.exp,\n    r: claims.returnTo,\n  }\n  const payload = Buffer.from(JSON.stringify(wire), 'utf8').toString('base64url')\n  return { state: `${STATE_VERSION}.${payload}.${hmac(payload)}`, claims }\n}\n\nexport type ConnectStateRead =\n  | { ok: true; claims: ConnectStateClaims }\n  /** Authentic and past its expiry: the claims still say whose it was. */\n  | { ok: false; refusal: 'state-expired'; claims: ConnectStateClaims }\n  /** Tampered, truncated, another version, or no secret to check it with. */\n  | { ok: false; refusal: 'state-invalid' }\n\n/** Verifies a state's signature and expiry. Never throws. */\nexport function readConnectState(state: unknown, nowMs: number): ConnectStateRead {\n  const invalid = { ok: false, refusal: 'state-invalid' } as const\n  if (typeof state !== 'string' || !state || state.length > STATE_MAX_CHARS) return invalid\n  const parts = state.split('.')\n  if (parts.length !== 3 || parts[0] !== STATE_VERSION) return invalid\n  const [, payload, signature] = parts\n  let expected: string\n  try {\n    expected = hmac(payload)\n  } catch {\n    return invalid\n  }\n  if (!safeEqual(signature, expected)) return invalid\n  let wire: Partial<WireClaims>\n  try {\n    wire = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8')) as Partial<WireClaims>\n  } catch {\n    return invalid\n  }\n  const text = (value: unknown) => (typeof value === 'string' ? value : '')\n  const claims: ConnectStateClaims = {\n    hostId: text(wire?.h),\n    orgId: text(wire?.o),\n    uid: text(wire?.u),\n    listingId: text(wire?.l),\n    connectionId: text(wire?.c),\n    nonce: text(wire?.n),\n    exp: Number(wire?.e),\n    returnTo: text(wire?.r),\n  }\n  if (\n    !claims.hostId ||\n    !claims.orgId ||\n    !claims.uid ||\n    !claims.listingId ||\n    !claims.connectionId ||\n    !claims.nonce ||\n    !Number.isFinite(claims.exp)\n  ) {\n    return invalid\n  }\n  if (claims.exp <= nowMs) return { ok: false, refusal: 'state-expired', claims }\n  return { ok: true, claims }\n}\n\n/** The pending record's id: the member, listing and connection hashed, so a uid never names a document. */\nexport function connectStateDocId(uid: string, listingId: string, connectionId: string): string {\n  return `oauth-${createHash('sha256').update(`${listingId}\\n${connectionId}\\n${uid}`).digest('hex').slice(0, 40)}`\n}\n\nfunction connectStateRef(firestore: FirebaseFirestore.Firestore, claims: Pick<ConnectStateClaims, 'hostId' | 'uid' | 'listingId' | 'connectionId'>) {\n  return connectionsCollection(firestore, claims.hostId).doc(connectStateDocId(claims.uid, claims.listingId, claims.connectionId))\n}\n\nconst digest = (nonce: string) => createHash('sha256').update(nonce).digest('base64url')\n\n/** Writes the pending record for a freshly minted state, replacing any earlier one. */\nexport async function recordConnectState(\n  firestore: FirebaseFirestore.Firestore,\n  input: { claims: ConnectStateClaims; redirectUri: string; nowMs: number },\n): Promise<void> {\n  const { claims } = input\n  await connectStateRef(firestore, claims).set({\n    kind: 'oauth-state',\n    uid: claims.uid,\n    listingId: claims.listingId,\n    connectionId: claims.connectionId,\n    nonceDigest: digest(claims.nonce),\n    redirectUri: input.redirectUri,\n    expiresAtMs: claims.exp,\n    createdAtMs: input.nowMs,\n  })\n}\n\nexport type ConnectStateConsumed =\n  | { ok: true; redirectUri: string }\n  | { ok: false; refusal: 'state-replayed' | 'state-superseded' | 'state-expired' }\n\n/** Consumes the pending record a verified state names — once. */\nexport async function consumeConnectState(\n  firestore: FirebaseFirestore.Firestore,\n  input: { claims: ConnectStateClaims; nowMs: number },\n): Promise<ConnectStateConsumed> {\n  const { claims } = input\n  const result = await consumeOnce<string>(firestore, connectStateRef(firestore, claims), (data) => {\n    if (\n      data['kind'] !== 'oauth-state' ||\n      data['uid'] !== claims.uid ||\n      data['listingId'] !== claims.listingId ||\n      data['connectionId'] !== claims.connectionId\n    ) {\n      return { accept: false, reason: 'state-superseded' }\n    }\n    if (!safeEqual(String(data['nonceDigest'] ?? ''), digest(claims.nonce))) {\n      return { accept: false, reason: 'state-superseded' }\n    }\n    if (Number(data['expiresAtMs']) <= input.nowMs) {\n      return { accept: false, reason: 'state-expired', remove: true }\n    }\n    return { accept: true, value: String(data['redirectUri'] ?? ''), remove: true }\n  })\n  if (result.ok && result.value) return { ok: true, redirectUri: result.value }\n  if (result.reason === 'state-superseded') return { ok: false, refusal: 'state-superseded' }\n  if (result.reason === 'state-expired') return { ok: false, refusal: 'state-expired' }\n  return { ok: false, refusal: 'state-replayed' }\n}\n\nconst stripTrailingSlash = (value: string) => value.replace(/\\/+$/, '')\n\n/** The canonical console origin, or `null` when it is set to something that is not http(s). */\nexport function canonicalConsoleOrigin(): string | null {\n  const raw = stripTrailingSlash(platformConsoleOrigin())\n  try {\n    const url = new URL(raw)\n    return url.protocol === 'https:' || url.protocol === 'http:' ? url.origin : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * The console origin a connect started by `requestUrl` comes back to: the\n * canonical one — the address registered on each publisher's OAuth app —\n * except in development, where a request from `http://localhost` or\n * `127.0.0.1` comes back to itself. Nothing else a request claims about its\n * origin is believed.\n */\nexport function consoleOriginFor(requestUrl: string): string | null {\n  if (process.env['NODE_ENV'] !== 'production') {\n    try {\n      const url = new URL(requestUrl)\n      if (url.protocol === 'http:' && (url.hostname === 'localhost' || url.hostname === '127.0.0.1')) return url.origin\n    } catch {\n      // Not a URL: the canonical origin below.\n    }\n  }\n  return canonicalConsoleOrigin()\n}\n\n/** Where the provider sends the member back to, or `null` when no origin is usable. */\nexport function connectRedirectUri(requestUrl: string): string | null {\n  const origin = consoleOriginFor(requestUrl)\n  return origin ? `${origin}${CONNECT_CALLBACK_PATH}` : null\n}\n\n/**\n * The page to return to as a console path with its query, or `null` when\n * `returnTo` is not on `origin`. Accepts an absolute URL on the origin or a\n * single-slash path; anything else — another host, a protocol-relative\n * `//host`, a `javascript:` URL, the callback itself — is refused.\n */\nexport function consolePath(returnTo: unknown, origin: string): string | null {\n  if (typeof returnTo !== 'string' || !returnTo || returnTo.length > RETURN_TO_MAX_CHARS) return null\n  if (returnTo.startsWith('/') && (returnTo.startsWith('//') || returnTo.startsWith('/\\\\'))) return null\n  let url: URL\n  try {\n    url = new URL(returnTo, origin)\n  } catch {\n    return null\n  }\n  if (url.origin !== origin) return null\n  if (url.pathname.startsWith(CONNECT_CALLBACK_PATH)) return null\n  return `${url.pathname}${url.search}`\n}\n"],"names":["platformConsoleOrigin","createHash","createHmac","randomBytes","consumeOnce","tokenSigningSecret","safeEqual","PLUGIN_CONNECTIONS_API_ROUTES","connectionsCollection","CONNECT_STATE_TTL_MS","STATE_VERSION","STATE_CONTEXT","STATE_MAX_CHARS","RETURN_TO_MAX_CHARS","CONNECT_CALLBACK_PATH","connectCallback","hmac","value","update","digest","mintConnectState","input","claims","hostId","orgId","uid","listingId","connectionId","nonce","toString","exp","nowMs","returnTo","wire","h","o","u","l","c","n","e","r","payload","Buffer","from","JSON","stringify","state","readConnectState","invalid","ok","refusal","length","parts","split","signature","expected","parse","text","Number","isFinite","connectStateDocId","slice","connectStateRef","firestore","doc","recordConnectState","set","kind","nonceDigest","redirectUri","expiresAtMs","createdAtMs","consumeConnectState","result","data","accept","reason","String","remove","stripTrailingSlash","replace","canonicalConsoleOrigin","raw","url","URL","protocol","origin","consoleOriginFor","requestUrl","process","env","hostname","connectRedirectUri","consolePath","startsWith","pathname","search"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,qBAAqB,QAAQ,wCAAuC;AAC7E,SAASC,UAAU,EAAEC,UAAU,EAAEC,WAAW,QAAQ,cAAa;AACjE,SAASC,WAAW,QAAQ,+CAA8C;AAC1E,SAASC,kBAAkB,QAAQ,gDAA+C;AAClF,SAASC,SAAS,QAAQ,6CAA4C;AACtE,SAASC,6BAA6B,QAAQ,oCAAgC;AAC9E,SAASC,qBAAqB,QAAQ,wBAAoB;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgCC,GAED,mEAAmE,GACnE,OAAO,MAAMC,uBAAuB,KAAK,KAAK,KAAI;AAElD,MAAMC,gBAAgB;AACtB,MAAMC,gBAAgB;AACtB,MAAMC,kBAAkB;AACxB,MAAMC,sBAAsB;AAE5B,qFAAqF,GACrF,OAAO,MAAMC,wBAAwB,CAAC,KAAK,EAAEP,8BAA8BQ,eAAe,EAAE,CAAA;AA0B5F,MAAMC,OAAO,CAACC,QACZf,WAAW,UAAUG,sBAAsBa,MAAM,CAAC,GAAGP,cAAc,CAAC,EAAEM,OAAO,EAAEE,MAAM,CAAC;AAExF,yEAAyE,GACzE,OAAO,SAASC,iBACdC,KAAoF;QAQ3EA;IANT,MAAMC,SAA6B;QACjCC,QAAQF,MAAME,MAAM;QACpBC,OAAOH,MAAMG,KAAK;QAClBC,KAAKJ,MAAMI,GAAG;QACdC,WAAWL,MAAMK,SAAS;QAC1BC,cAAcN,MAAMM,YAAY;QAChCC,KAAK,GAAEP,eAAAA,MAAMO,KAAK,YAAXP,eAAelB,YAAY,IAAI0B,QAAQ,CAAC;QAC/CC,KAAKT,MAAMU,KAAK,GAAGtB;QACnBuB,UAAUX,MAAMW,QAAQ;IAC1B;IACA,MAAMC,OAAmB;QACvBC,GAAGZ,OAAOC,MAAM;QAChBY,GAAGb,OAAOE,KAAK;QACfY,GAAGd,OAAOG,GAAG;QACbY,GAAGf,OAAOI,SAAS;QACnBY,GAAGhB,OAAOK,YAAY;QACtBY,GAAGjB,OAAOM,KAAK;QACfY,GAAGlB,OAAOQ,GAAG;QACbW,GAAGnB,OAAOU,QAAQ;IACpB;IACA,MAAMU,UAAUC,OAAOC,IAAI,CAACC,KAAKC,SAAS,CAACb,OAAO,QAAQJ,QAAQ,CAAC;IACnE,OAAO;QAAEkB,OAAO,GAAGrC,cAAc,CAAC,EAAEgC,QAAQ,CAAC,EAAE1B,KAAK0B,UAAU;QAAEpB;IAAO;AACzE;AASA,2DAA2D,GAC3D,OAAO,SAAS0B,iBAAiBD,KAAc,EAAEhB,KAAa;IAC5D,MAAMkB,UAAU;QAAEC,IAAI;QAAOC,SAAS;IAAgB;IACtD,IAAI,OAAOJ,UAAU,YAAY,CAACA,SAASA,MAAMK,MAAM,GAAGxC,iBAAiB,OAAOqC;IAClF,MAAMI,QAAQN,MAAMO,KAAK,CAAC;IAC1B,IAAID,MAAMD,MAAM,KAAK,KAAKC,KAAK,CAAC,EAAE,KAAK3C,eAAe,OAAOuC;IAC7D,MAAM,GAAGP,SAASa,UAAU,GAAGF;IAC/B,IAAIG;IACJ,IAAI;QACFA,WAAWxC,KAAK0B;IAClB,EAAE,eAAM;QACN,OAAOO;IACT;IACA,IAAI,CAAC3C,UAAUiD,WAAWC,WAAW,OAAOP;IAC5C,IAAIhB;IACJ,IAAI;QACFA,OAAOY,KAAKY,KAAK,CAACd,OAAOC,IAAI,CAACF,SAAS,aAAab,QAAQ,CAAC;IAC/D,EAAE,eAAM;QACN,OAAOoB;IACT;IACA,MAAMS,OAAO,CAACzC,QAAoB,OAAOA,UAAU,WAAWA,QAAQ;IACtE,MAAMK,SAA6B;QACjCC,QAAQmC,KAAKzB,wBAAAA,KAAMC,CAAC;QACpBV,OAAOkC,KAAKzB,wBAAAA,KAAME,CAAC;QACnBV,KAAKiC,KAAKzB,wBAAAA,KAAMG,CAAC;QACjBV,WAAWgC,KAAKzB,wBAAAA,KAAMI,CAAC;QACvBV,cAAc+B,KAAKzB,wBAAAA,KAAMK,CAAC;QAC1BV,OAAO8B,KAAKzB,wBAAAA,KAAMM,CAAC;QACnBT,KAAK6B,OAAO1B,wBAAAA,KAAMO,CAAC;QACnBR,UAAU0B,KAAKzB,wBAAAA,KAAMQ,CAAC;IACxB;IACA,IACE,CAACnB,OAAOC,MAAM,IACd,CAACD,OAAOE,KAAK,IACb,CAACF,OAAOG,GAAG,IACX,CAACH,OAAOI,SAAS,IACjB,CAACJ,OAAOK,YAAY,IACpB,CAACL,OAAOM,KAAK,IACb,CAAC+B,OAAOC,QAAQ,CAACtC,OAAOQ,GAAG,GAC3B;QACA,OAAOmB;IACT;IACA,IAAI3B,OAAOQ,GAAG,IAAIC,OAAO,OAAO;QAAEmB,IAAI;QAAOC,SAAS;QAAiB7B;IAAO;IAC9E,OAAO;QAAE4B,IAAI;QAAM5B;IAAO;AAC5B;AAEA,yGAAyG,GACzG,OAAO,SAASuC,kBAAkBpC,GAAW,EAAEC,SAAiB,EAAEC,YAAoB;IACpF,OAAO,CAAC,MAAM,EAAE1B,WAAW,UAAUiB,MAAM,CAAC,GAAGQ,UAAU,EAAE,EAAEC,aAAa,EAAE,EAAEF,KAAK,EAAEN,MAAM,CAAC,OAAO2C,KAAK,CAAC,GAAG,KAAK;AACnH;AAEA,SAASC,gBAAgBC,SAAsC,EAAE1C,MAAiF;IAChJ,OAAOd,sBAAsBwD,WAAW1C,OAAOC,MAAM,EAAE0C,GAAG,CAACJ,kBAAkBvC,OAAOG,GAAG,EAAEH,OAAOI,SAAS,EAAEJ,OAAOK,YAAY;AAChI;AAEA,MAAMR,SAAS,CAACS,QAAkB3B,WAAW,UAAUiB,MAAM,CAACU,OAAOT,MAAM,CAAC;AAE5E,qFAAqF,GACrF,OAAO,eAAe+C,mBACpBF,SAAsC,EACtC3C,KAAyE;IAEzE,MAAM,EAAEC,MAAM,EAAE,GAAGD;IACnB,MAAM0C,gBAAgBC,WAAW1C,QAAQ6C,GAAG,CAAC;QAC3CC,MAAM;QACN3C,KAAKH,OAAOG,GAAG;QACfC,WAAWJ,OAAOI,SAAS;QAC3BC,cAAcL,OAAOK,YAAY;QACjC0C,aAAalD,OAAOG,OAAOM,KAAK;QAChC0C,aAAajD,MAAMiD,WAAW;QAC9BC,aAAajD,OAAOQ,GAAG;QACvB0C,aAAanD,MAAMU,KAAK;IAC1B;AACF;AAMA,+DAA+D,GAC/D,OAAO,eAAe0C,oBACpBT,SAAsC,EACtC3C,KAAoD;IAEpD,MAAM,EAAEC,MAAM,EAAE,GAAGD;IACnB,MAAMqD,SAAS,MAAMtE,YAAoB4D,WAAWD,gBAAgBC,WAAW1C,SAAS,CAACqD;YASjEA,mBAMeA;QAdrC,IACEA,IAAI,CAAC,OAAO,KAAK,iBACjBA,IAAI,CAAC,MAAM,KAAKrD,OAAOG,GAAG,IAC1BkD,IAAI,CAAC,YAAY,KAAKrD,OAAOI,SAAS,IACtCiD,IAAI,CAAC,eAAe,KAAKrD,OAAOK,YAAY,EAC5C;YACA,OAAO;gBAAEiD,QAAQ;gBAAOC,QAAQ;YAAmB;QACrD;QACA,IAAI,CAACvE,UAAUwE,QAAOH,oBAAAA,IAAI,CAAC,cAAc,YAAnBA,oBAAuB,KAAKxD,OAAOG,OAAOM,KAAK,IAAI;YACvE,OAAO;gBAAEgD,QAAQ;gBAAOC,QAAQ;YAAmB;QACrD;QACA,IAAIlB,OAAOgB,IAAI,CAAC,cAAc,KAAKtD,MAAMU,KAAK,EAAE;YAC9C,OAAO;gBAAE6C,QAAQ;gBAAOC,QAAQ;gBAAiBE,QAAQ;YAAK;QAChE;QACA,OAAO;YAAEH,QAAQ;YAAM3D,OAAO6D,QAAOH,oBAAAA,IAAI,CAAC,cAAc,YAAnBA,oBAAuB;YAAKI,QAAQ;QAAK;IAChF;IACA,IAAIL,OAAOxB,EAAE,IAAIwB,OAAOzD,KAAK,EAAE,OAAO;QAAEiC,IAAI;QAAMoB,aAAaI,OAAOzD,KAAK;IAAC;IAC5E,IAAIyD,OAAOG,MAAM,KAAK,oBAAoB,OAAO;QAAE3B,IAAI;QAAOC,SAAS;IAAmB;IAC1F,IAAIuB,OAAOG,MAAM,KAAK,iBAAiB,OAAO;QAAE3B,IAAI;QAAOC,SAAS;IAAgB;IACpF,OAAO;QAAED,IAAI;QAAOC,SAAS;IAAiB;AAChD;AAEA,MAAM6B,qBAAqB,CAAC/D,QAAkBA,MAAMgE,OAAO,CAAC,QAAQ;AAEpE,6FAA6F,GAC7F,OAAO,SAASC;IACd,MAAMC,MAAMH,mBAAmBhF;IAC/B,IAAI;QACF,MAAMoF,MAAM,IAAIC,IAAIF;QACpB,OAAOC,IAAIE,QAAQ,KAAK,YAAYF,IAAIE,QAAQ,KAAK,UAAUF,IAAIG,MAAM,GAAG;IAC9E,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA;;;;;;CAMC,GACD,OAAO,SAASC,iBAAiBC,UAAkB;IACjD,IAAIC,QAAQC,GAAG,CAAC,WAAW,KAAK,cAAc;QAC5C,IAAI;YACF,MAAMP,MAAM,IAAIC,IAAII;YACpB,IAAIL,IAAIE,QAAQ,KAAK,WAAYF,CAAAA,IAAIQ,QAAQ,KAAK,eAAeR,IAAIQ,QAAQ,KAAK,WAAU,GAAI,OAAOR,IAAIG,MAAM;QACnH,EAAE,eAAM;QACN,yCAAyC;QAC3C;IACF;IACA,OAAOL;AACT;AAEA,qFAAqF,GACrF,OAAO,SAASW,mBAAmBJ,UAAkB;IACnD,MAAMF,SAASC,iBAAiBC;IAChC,OAAOF,SAAS,GAAGA,SAASzE,uBAAuB,GAAG;AACxD;AAEA;;;;;CAKC,GACD,OAAO,SAASgF,YAAY9D,QAAiB,EAAEuD,MAAc;IAC3D,IAAI,OAAOvD,aAAa,YAAY,CAACA,YAAYA,SAASoB,MAAM,GAAGvC,qBAAqB,OAAO;IAC/F,IAAImB,SAAS+D,UAAU,CAAC,QAAS/D,CAAAA,SAAS+D,UAAU,CAAC,SAAS/D,SAAS+D,UAAU,CAAC,MAAK,GAAI,OAAO;IAClG,IAAIX;IACJ,IAAI;QACFA,MAAM,IAAIC,IAAIrD,UAAUuD;IAC1B,EAAE,eAAM;QACN,OAAO;IACT;IACA,IAAIH,IAAIG,MAAM,KAAKA,QAAQ,OAAO;IAClC,IAAIH,IAAIY,QAAQ,CAACD,UAAU,CAACjF,wBAAwB,OAAO;IAC3D,OAAO,GAAGsE,IAAIY,QAAQ,GAAGZ,IAAIa,MAAM,EAAE;AACvC"}

package/src/lib/server/connections/provider-http.d.ts

@@ -0,0 +1,99 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type PluginConnectionDeclaration, type PluginConnectionRequest, type PluginConnectionResource } from '@aglyn/aglyn/app-utils/plugin-connections';
+import type { PluginConnectionChoice } from '../../model/plugin-connections';
+/**
+ * HOW THE PLATFORM TALKS TO A DECLARED CONNECTION'S PROVIDER (AGL-4193).
+ *
+ * Every outbound request a connection causes goes through here: the code
+ * exchange and the refresh at the declared `tokenUrl`, the revoke at the
+ * declared `revocationUrl`, and the templated API requests, which
+ * `preparePluginConnectionRequest` refuses to send anywhere but the declared
+ * `apiHosts`. One runtime object holds the fetch, the clock and the sleep, so
+ * a spec swaps them in one place and no request leaves the process.
+ *
+ * Redirects are NOT followed: a provider answering a token or API request
+ * with a redirect would otherwise carry the grant to a host nobody declared.
+ * Answers are read up to a ceiling, so a hostile or broken endpoint cannot
+ * make the console buffer an unbounded body.
+ */
+export interface PluginConnectionRuntime {
+    fetch: typeof fetch;
+    now: () => number;
+    sleep: (ms: number) => Promise<void>;
+}
+export declare const pluginConnectionRuntime: PluginConnectionRuntime;
+/** Why a provider call failed: the grant is gone (`auth`), try later (`transient`), or the answer is unusable (`refused`). */
+export type PluginConnectionErrorCode = 'auth' | 'transient' | 'refused';
+export declare class PluginConnectionProviderError extends Error {
+    readonly code: PluginConnectionErrorCode;
+    readonly status: number;
+    constructor(code: PluginConnectionErrorCode, message: string, status?: number);
+}
+/** The publisher's OAuth app, opened from its sealed record. */
+export interface PluginConnectionClient {
+    clientId: string;
+    clientSecret: string;
+}
+/** A token endpoint's answer, normalized. */
+export interface PluginConnectionTokenSet {
+    accessToken: string;
+    /** `null` when the provider issued none (or kept the one it issued before). */
+    refreshToken: string | null;
+    /** Epoch ms; an hour from now when the provider did not say. */
+    accessExpiresAtMs: number;
+    /** The scopes granted, when the provider said; else the ones asked for. */
+    scopes: string[];
+}
+/** Bytes of an answer read at most. */
+export declare const PLUGIN_CONNECTION_MAX_RESPONSE_BYTES: number;
+/** Exchanges an authorization code at the declared token endpoint. */
+export declare function exchangePluginConnectionCode(connection: PluginConnectionDeclaration, client: PluginConnectionClient, input: {
+    code: string;
+    redirectUri: string;
+}): Promise<PluginConnectionTokenSet>;
+/** Refreshes a grant at the declared token endpoint. */
+export declare function refreshPluginConnectionToken(connection: PluginConnectionDeclaration, client: PluginConnectionClient, refreshToken: string): Promise<PluginConnectionTokenSet>;
+/** Revokes a grant at the declared revocation endpoint, when there is one. Best effort; throws on failure. */
+export declare function revokePluginConnectionToken(connection: PluginConnectionDeclaration, client: PluginConnectionClient | null, token: string): Promise<boolean>;
+/**
+ * One templated API request with the site's access token, filled from its
+ * choices; answers the parsed JSON. A 401 or 403 is `auth` (the caller may
+ * refresh once and retry), anything else not 2xx is `refused`.
+ */
+export declare function pluginConnectionApiRequest(connection: PluginConnectionDeclaration, request: PluginConnectionRequest, input: {
+    accessToken: string;
+    choices: Readonly<Record<string, string>>;
+    cursor?: string | null;
+}): Promise<unknown>;
+/**
+ * Every item of a paginated request, up to `maxItems` and the declared page
+ * ceiling. Exported for the sync, which reads its requests the same way.
+ */
+export declare function pluginConnectionApiItems(connection: PluginConnectionDeclaration, request: PluginConnectionRequest, input: {
+    accessToken: string;
+    choices: Readonly<Record<string, string>>;
+    maxItems: number;
+}): Promise<{
+    items: unknown[];
+    pages: unknown[];
+}>;
+/** The resource's items as the picker shows them: an id and a label, each a plain bounded string. */
+export declare function listPluginConnectionResource(connection: PluginConnectionDeclaration, resource: PluginConnectionResource, input: {
+    accessToken: string;
+    choices: Readonly<Record<string, string>>;
+}): Promise<PluginConnectionChoice[]>;

package/src/lib/server/connections/provider-http.js

@@ -0,0 +1,253 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { preparePluginConnectionRequest, readPluginConnectionPath } from "@aglyn/aglyn/app-utils/plugin-connections";
+export const pluginConnectionRuntime = {
+    fetch: (input, init)=>globalThis.fetch(input, init),
+    now: ()=>Date.now(),
+    sleep: (ms)=>new Promise((resolve)=>setTimeout(resolve, ms))
+};
+export class PluginConnectionProviderError extends Error {
+    constructor(code, message, status = 0){
+        super(message), this.code = code, this.status = status;
+        this.name = 'PluginConnectionProviderError';
+    }
+}
+/** Bytes of an answer read at most. */ export const PLUGIN_CONNECTION_MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
+const ATTEMPT_TIMEOUT_MS = 30000;
+const RETRIES = 2;
+const BASE_BACKOFF_MS = 500;
+const DEFAULT_ACCESS_LIFETIME_MS = 60 * 60 * 1000;
+/** Reads an answer's body, refusing one past the ceiling. */ async function readBody(response) {
+    const declared = Number(response.headers.get('content-length'));
+    if (Number.isFinite(declared) && declared > PLUGIN_CONNECTION_MAX_RESPONSE_BYTES) {
+        throw new PluginConnectionProviderError('refused', 'The provider’s answer is too large.', response.status);
+    }
+    const text = await response.text();
+    if (text.length > PLUGIN_CONNECTION_MAX_RESPONSE_BYTES) {
+        throw new PluginConnectionProviderError('refused', 'The provider’s answer is too large.', response.status);
+    }
+    return text;
+}
+const parseJson = (text)=>{
+    try {
+        return JSON.parse(text);
+    } catch (unused) {
+        return null;
+    }
+};
+/** The provider's own sentence for a refusal, cut short; never a token. */ function providerSentence(body, status) {
+    if (body && typeof body === 'object') {
+        const record = body;
+        if (typeof record['error_description'] === 'string') return record['error_description'].slice(0, 300);
+        const error = record['error'];
+        if (typeof error === 'string') return error.slice(0, 300);
+        if (error && typeof error === 'object' && typeof error['message'] === 'string') {
+            return String(error['message']).slice(0, 300);
+        }
+    }
+    return `HTTP ${status}`;
+}
+const retryable = (status)=>status === 429 || status >= 500;
+/** One request: no redirects, a timeout per attempt, a throttle or server error retried. */ async function send(url, init) {
+    var _ref;
+    let lastError = null;
+    for(let attempt = 0; attempt <= RETRIES; attempt += 1){
+        let response = null;
+        try {
+            response = await pluginConnectionRuntime.fetch(url, _extends({}, init, {
+                redirect: 'manual',
+                signal: AbortSignal.timeout(ATTEMPT_TIMEOUT_MS)
+            }));
+        } catch (error) {
+            lastError = error;
+        }
+        if (response && !retryable(response.status)) {
+            if (response.status >= 300 && response.status < 400) {
+                throw new PluginConnectionProviderError('refused', 'The provider answered with a redirect, which is not followed.', response.status);
+            }
+            return {
+                status: response.status,
+                body: parseJson(await readBody(response))
+            };
+        }
+        if (attempt === RETRIES) {
+            if (response) {
+                const body = parseJson(await readBody(response).catch(()=>''));
+                throw new PluginConnectionProviderError('transient', providerSentence(body, response.status), response.status);
+            }
+            break;
+        }
+        await pluginConnectionRuntime.sleep(BASE_BACKOFF_MS * 2 ** attempt);
+    }
+    throw new PluginConnectionProviderError('transient', `The provider could not be reached: ${String((_ref = lastError == null ? void 0 : lastError.message) != null ? _ref : lastError).slice(0, 200)}`);
+}
+/** The token endpoint's answer, or the refusal: `invalid_grant` and a 401 mean the grant is gone. */ function readTokenAnswer(answer, connection) {
+    const body = answer.body && typeof answer.body === 'object' ? answer.body : {};
+    if (answer.status < 200 || answer.status >= 300 || typeof body['access_token'] !== 'string' || !body['access_token']) {
+        const sentence = providerSentence(body, answer.status);
+        const grantGone = body['error'] === 'invalid_grant' || answer.status === 401 || body['error'] === 'unauthorized_client';
+        throw new PluginConnectionProviderError(grantGone ? 'auth' : 'refused', sentence, answer.status);
+    }
+    const expiresIn = Number(body['expires_in']);
+    const scope = typeof body['scope'] === 'string' ? body['scope'] : '';
+    return {
+        accessToken: body['access_token'],
+        refreshToken: typeof body['refresh_token'] === 'string' && body['refresh_token'] ? body['refresh_token'] : null,
+        accessExpiresAtMs: pluginConnectionRuntime.now() + (Number.isFinite(expiresIn) && expiresIn > 0 ? expiresIn * 1000 : DEFAULT_ACCESS_LIFETIME_MS),
+        scopes: scope ? scope.split(/[\s,]+/).filter(Boolean) : [
+            ...connection.scopes
+        ]
+    };
+}
+/** Posts a form to the declared token endpoint, authenticating the publisher's app as declared. */ async function postToken(connection, client, fields) {
+    const form = new URLSearchParams(fields);
+    const headers = {
+        'Content-Type': 'application/x-www-form-urlencoded',
+        Accept: 'application/json'
+    };
+    if (connection.tokenAuthMethod === 'basic') {
+        const pair = `${encodeURIComponent(client.clientId)}:${encodeURIComponent(client.clientSecret)}`;
+        headers['Authorization'] = `Basic ${Buffer.from(pair, 'utf8').toString('base64')}`;
+    } else {
+        form.set('client_id', client.clientId);
+        form.set('client_secret', client.clientSecret);
+    }
+    return send(connection.tokenUrl, {
+        method: 'POST',
+        headers,
+        body: form.toString()
+    });
+}
+/** Exchanges an authorization code at the declared token endpoint. */ export async function exchangePluginConnectionCode(connection, client, input) {
+    const answer = await postToken(connection, client, {
+        grant_type: 'authorization_code',
+        code: input.code,
+        redirect_uri: input.redirectUri
+    });
+    return readTokenAnswer(answer, connection);
+}
+/** Refreshes a grant at the declared token endpoint. */ export async function refreshPluginConnectionToken(connection, client, refreshToken) {
+    const answer = await postToken(connection, client, {
+        grant_type: 'refresh_token',
+        refresh_token: refreshToken
+    });
+    return readTokenAnswer(answer, connection);
+}
+/** Revokes a grant at the declared revocation endpoint, when there is one. Best effort; throws on failure. */ export async function revokePluginConnectionToken(connection, client, token) {
+    if (!connection.revocationUrl) return false;
+    const form = new URLSearchParams({
+        token
+    });
+    if (client && connection.tokenAuthMethod !== 'basic') {
+        form.set('client_id', client.clientId);
+        form.set('client_secret', client.clientSecret);
+    }
+    const headers = {
+        'Content-Type': 'application/x-www-form-urlencoded'
+    };
+    if (client && connection.tokenAuthMethod === 'basic') {
+        const pair = `${encodeURIComponent(client.clientId)}:${encodeURIComponent(client.clientSecret)}`;
+        headers['Authorization'] = `Basic ${Buffer.from(pair, 'utf8').toString('base64')}`;
+    }
+    const answer = await send(connection.revocationUrl, {
+        method: 'POST',
+        headers,
+        body: form.toString()
+    });
+    if (answer.status >= 200 && answer.status < 300) return true;
+    throw new PluginConnectionProviderError('refused', providerSentence(answer.body, answer.status), answer.status);
+}
+/**
+ * One templated API request with the site's access token, filled from its
+ * choices; answers the parsed JSON. A 401 or 403 is `auth` (the caller may
+ * refresh once and retry), anything else not 2xx is `refused`.
+ */ export async function pluginConnectionApiRequest(connection, request, input) {
+    var _input_cursor;
+    const prepared = preparePluginConnectionRequest(request, {
+        apiHosts: connection.apiHosts,
+        choices: input.choices,
+        cursor: (_input_cursor = input.cursor) != null ? _input_cursor : null
+    });
+    if (prepared.ok === false) throw new PluginConnectionProviderError('refused', prepared.error);
+    const headers = {
+        Authorization: `Bearer ${input.accessToken}`,
+        Accept: 'application/json'
+    };
+    if (prepared.request.body !== undefined) headers['Content-Type'] = 'application/json';
+    const answer = await send(prepared.request.url, _extends({
+        method: prepared.request.method,
+        headers
+    }, prepared.request.body !== undefined ? {
+        body: prepared.request.body
+    } : {}));
+    if (answer.status === 401 || answer.status === 403) {
+        throw new PluginConnectionProviderError('auth', providerSentence(answer.body, answer.status), answer.status);
+    }
+    if (answer.status < 200 || answer.status >= 300) {
+        throw new PluginConnectionProviderError('refused', providerSentence(answer.body, answer.status), answer.status);
+    }
+    return answer.body;
+}
+/**
+ * Every item of a paginated request, up to `maxItems` and the declared page
+ * ceiling. Exported for the sync, which reads its requests the same way.
+ */ export async function pluginConnectionApiItems(connection, request, input) {
+    var _ref;
+    var _request_pagination;
+    const items = [];
+    const pages = [];
+    let cursor = null;
+    const maxPages = (_ref = (_request_pagination = request.pagination) == null ? void 0 : _request_pagination.maxPages) != null ? _ref : 1;
+    for(let page = 0; page < maxPages; page += 1){
+        const body = await pluginConnectionApiRequest(connection, request, _extends({}, input, {
+            cursor
+        }));
+        pages.push(body);
+        const list = request.itemsPath ? readPluginConnectionPath(body, request.itemsPath) : undefined;
+        if (Array.isArray(list)) items.push(...list.slice(0, Math.max(0, input.maxItems - items.length)));
+        if (items.length >= input.maxItems || !request.pagination) break;
+        const next = readPluginConnectionPath(body, request.pagination.cursorPath);
+        if (typeof next !== 'string' || !next || next.length > 2048 || next === cursor) break;
+        cursor = next;
+    }
+    return {
+        items,
+        pages
+    };
+}
+/** The resource's items as the picker shows them: an id and a label, each a plain bounded string. */ export async function listPluginConnectionResource(connection, resource, input) {
+    const { items } = await pluginConnectionApiItems(connection, resource.request, _extends({}, input, {
+        maxItems: resource.maxItems
+    }));
+    const out = [];
+    const seen = new Set();
+    for (const item of items){
+        const id = readPluginConnectionPath(item, resource.idPath);
+        const label = readPluginConnectionPath(item, resource.labelPath);
+        if (typeof id !== 'string' && typeof id !== 'number') continue;
+        const idText = String(id).slice(0, 256);
+        if (!idText || seen.has(idText)) continue;
+        seen.add(idText);
+        out.push({
+            id: idText,
+            label: typeof label === 'string' && label.trim() ? label.trim().slice(0, 200) : idText
+        });
+    }
+    return out;
+}
+
+//# sourceMappingURL=provider-http.js.map