@fragno-dev/project-connector-fragment 0.0.0-stage → 0.0.1

package/LICENSE.md

@@ -0,0 +1,16 @@
+Copyright 2025 - present "ReJot Nederland B.V.", and individual contributors.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
+associated documentation files (the “Software”), to deal in the Software without restriction,
+including without limitation the rights to use, copy, modify, merge, publish, distribute,
+sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial
+portions of the Software.
+
+THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT
+NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES
+OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -1,3 +1,286 @@
-# Temporary Holding Version
+# @fragno-dev/project-connector-fragment
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+A DB-backed Fragno fragment for the hosted OOMOL **Project Connector** API. It connects product
+users to Gmail and other configured OAuth providers, verifies account bindings, reads provider
+profiles, and executes actions using an explicit connected account.
+
+Account operations use `oo_proj_...` project keys. Authoritative action contracts use a separate
+server-only catalog credential through the SDK's `Connector.catalog` surface; it is never used to
+execute actions or connect users. Create a project and provider configuration in OOMOL Console
+first; see the [Project Connector guide](https://oomol.com/docs/project-connector/).
+
+## Try the CLI
+
+From the repository root, using the same Node version used to install `better-sqlite3`:
+
+```bash
+pnpm --filter @fragno-dev/project-connector-fragment cli -- check \
+  --env-file ../../apps/backoffice/.dev.vars
+
+pnpm --filter @fragno-dev/project-connector-fragment cli -- connect gmail \
+  --env-file ../../apps/backoffice/.dev.vars \
+  --user-id wilco --connection-name work --beep
+```
+
+The environment file is relative to the package directory for these `pnpm` commands. With the built
+package, commands can also run from the repository root:
+
+```bash
+node packages/project-connector-fragment/bin/run.js check --env-file apps/backoffice/.dev.vars
+```
+
+After installation, use `fragno-project-connector` instead of the `node .../bin/run.js` prefix.
+
+The required server environment variables are:
+
+```dotenv
+OOMOL_CONNECTOR_BASE_URL=https://connector.oomol.com/v1
+OOMOL_PROJECT_API_KEY=oo_proj_...
+```
+
+`OOMOL_CONNECTOR_BASE_URL` is the Connector API root and must end in `/v1`. Environment variables
+override values in `--env-file`. The key never travels through the browser and is not stored in
+SQLite or printed in diagnostics.
+
+Action discovery additionally requires `OOMOL_CONNECTOR_CATALOG_API_KEY`, a separate credential with
+catalog access on the same gateway (for hosted OOMOL, a personal `api_...` key). Project credentials
+are never substituted for catalog credentials. Omit it to leave account operations available but
+fail action discovery with `catalog_not_configured` when the selected configuration allows actions.
+A known configuration with an empty allowlist still returns an empty action list without catalog
+access.
+
+`connect` opens the authorization link, temporarily listens on `127.0.0.1:3930`, and polls the saved
+request. On success it stores the verified binding and performs a **read-only provider profile
+check**. It does not read Gmail messages or send email. `--beep` requests an audible authorization
+prompt; `--no-open` only prints the link. `--provider-config-id` selects a particular provider
+config instead of asking the gateway to resolve the service.
+
+Local state defaults to `~/.fragno/project-connector-fragment`; override it with `--data-dir`. Keep
+`--user-id` and `--data-dir` consistent across commands. Use `--port` for a different callback port
+and `--timeout-ms` to shorten the OAuth wait (maximum ten minutes).
+
+Additional commands:
+
+```bash
+fragno-project-connector accounts --user-id wilco --env-file ./connector.env
+fragno-project-connector status <request-id> --user-id wilco --env-file ./connector.env
+fragno-project-connector profile <account-id> --user-id wilco --env-file ./connector.env
+
+# Explicit action calls may read or modify provider data. Nothing executes automatically.
+fragno-project-connector execute <account-id> gmail.search_threads \
+  --user-id wilco --env-file ./connector.env --input '{"query":"is:unread"}'
+```
+
+All CLI operations exercise the fragment's real HTTP handler and SQLite migrations. The callback
+page is navigation feedback only: even a forged callback account ID cannot create a binding. The
+local CLI chooses its own user identity; do not expose it as an application server.
+
+A successful `check` establishes gateway reachability and project-key authentication, not Gmail
+availability. The SaaS API has no health endpoint, so this check expects the authenticated
+`connection_request_not_found` response for a fresh, nonexistent request ID. All provider calls go
+through the official `@oomol-lab/connector` `ProjectConnector` client; action metadata uses its
+separate `Connector.catalog` surface.
+
+## Server integration
+
+```ts
+import { createProjectConnectorFragment } from "@fragno-dev/project-connector-fragment";
+
+const callbackUrl = "https://app.example.com/integrations/connected";
+const fragment = createProjectConnectorFragment(
+  {
+    baseUrl: env.OOMOL_CONNECTOR_BASE_URL,
+    apiKey: env.OOMOL_PROJECT_API_KEY,
+    catalogApiKey: env.OOMOL_CONNECTOR_CATALOG_API_KEY ?? null,
+    // Implement this using your application's authenticated session, not a user-supplied ID.
+    getExternalUserId: resolveAuthenticatedUserId,
+    allowedReturnUrls: (url) => url.toString() === callbackUrl,
+  },
+  { databaseAdapter },
+);
+```
+
+`getExternalUserId(headers)` returns the authenticated product user's external ID or `null`. Mount
+and migrate the fragment using your application's usual Fragno integration. The default mount is
+`/api/project-connector-fragment`. Restrict provider/action access with your application's
+authorization policy when needed; the fragment enforces account ownership and action/service
+matching.
+
+## Provider configuration discovery
+
+`GET /provider-configs` returns live OAuth configuration metadata for the configured project:
+`projectId` and `providerConfigs`, whose entries contain `id`, `service`, `displayName`,
+`callbackUrl`, `effectiveScopes`, and `proxyAvailable`, without action IDs. Use the
+`useProviderConfigs` client hook to load this catalog, then pass the selected entry's `id` as
+`providerConfigId` when connecting, especially when several configurations use the same service.
+
+`GET /provider-configs/:providerConfigId/actions` and the `useProviderActions` client hook retrieve
+`{ projectId, providerConfigId, actions }` for one exact configuration. Each action has `id`,
+`service`, `name`, nullable `description`, and authoritative `inputSchema`/`outputSchema` JSON
+Schemas. An unknown configuration returns `PROVIDER_CONFIG_NOT_FOUND` (404); a known configuration
+with no allowed actions returns an empty `actions` list. Discovery never executes actions.
+
+Discovery requires an authenticated product user but is project-scoped, not an account list. It
+neither creates connections nor verifies provider accounts, and does not include API-key or custom
+credential configurations. The server calls `/v1/saas/oauth/provider-configs` with the project key;
+then retrieves the selected service's catalog in one `/v1/actions?service=...` request through
+`Connector.catalog.actions` using only the separate catalog credential. Definitions are indexed by
+unique action ID and selected in the configuration's allowlist order; duplicate allowlist IDs are
+returned once. Only allowed definitions are returned. Their service must match the configuration,
+and both schemas must be present; missing or invalid contracts fail the entire discovery response.
+Catalog presence never expands the configuration's allowlist or bypasses account ownership/execution
+authorization. Credentials and extra upstream fields stay outside the public response. Unsupported
+deployments and upstream failures return `PROJECT_CONNECTOR_ERROR`, rather than an invented,
+partial, or cached catalog.
+
+## Named connections and resumable OAuth
+
+A named connection is the exact tuple `{ projectId, providerConfigId, connectionName }` within the
+user identity established by `getExternalUserId`. Use the project/configuration IDs from discovery;
+connection names follow the gateway's alias rule: lowercase letters, digits, underscores, and
+hyphens, starting with a letter or digit. Every request and account has a name.
+
+- `GET /connection-requests/by-name?projectId=...&providerConfigId=...&connectionName=...` returns
+  the single matching saved OAuth request as `{ request }`, with `request: null` when absent.
+- `GET /accounts/by-name` with the same query returns `{ account }`, with `account: null` when
+  absent.
+
+Both reads use indexed local state. They do not contact the gateway, refresh consent, execute
+actions, or establish provider health. An OAuth request and its confirmed account have separate
+meanings: a replacement authorization may be pending while the previously confirmed account remains
+available.
+
+Named lookup is additive: `POST /connection-requests` still starts a fresh attempt on every call,
+including repeated or concurrent calls with the same name. Earlier request IDs remain usable, and
+confirmed accounts remain addressable by their account IDs. Refreshing a new account does not remove
+other accounts sharing its name. Reauthorization returning the same owned account ID updates that
+binding without duplicating it; an incoming ID belonging to another user cannot replace their
+binding.
+
+If either lookup matches more than one record, it returns `CONNECTION_AMBIGUOUS` (409), even when
+only one request is pending. The fragment does not choose the newest record, prefer a status, or
+infer a current attempt. Lookups inspect at most two matching records plus the pagination lookahead;
+no historical reconciliation or current-selection store is introduced. Use an already-known request
+or account ID when a name is ambiguous.
+
+After a page reload or server restart, recover the source-owned request instead of keeping a
+separate setup handle:
+
+```ts
+const selector = {
+  projectId: "your-project-id",
+  providerConfigId: "your-gmail-provider-config-id",
+  connectionName: "work",
+};
+const query = new URLSearchParams(selector);
+const response = await fetch(
+  `/api/project-connector-fragment/connection-requests/by-name?${query}`,
+);
+if (!response.ok) throw new Error("Could not read the named authorization request");
+const { request: pending } = await response.json();
+if (pending) {
+  await connector.refreshConnection().mutate({ path: { requestId: pending.id } });
+}
+```
+
+`useNamedConnectionRequest` and `useNamedAccount` provide the same reads as client stores. Creating
+an OAuth request invalidates named request stores; refreshing invalidates named request, named
+account, and account-list stores. Missing/empty selector fields return `INVALID_SELECTOR` (400).
+User identity is never accepted in the selector; another user's records remain absent.
+
+The gateway alias is not an idempotency key. Each start creates its own remote authorization link;
+link creation happens outside the retried local save. A lost gateway response or failed local save
+is not claimed to be recoverable by alias, and this fragment does not introduce remote cleanup
+machinery. Repeating a start is not a way to resume an existing attempt.
+
+**Schema migration:** version 4 adds non-unique named lookup indexes; databases keep duplicate names
+without reconciliation or a reset. Version 6 makes `connectionName` non-null on requests and
+accounts. Every start has required a name, so stored rows are expected to have one; the migration
+fails on a database that holds a null name.
+
+### Readiness hook
+
+`onConnectionReadinessChanged` is an optional durable hook in the fragment config. It receives
+`{ externalUserId, service, connection, ready }`, where `connection` is the named selector, when a
+write changes whether the name has a confirmed account: `ready: false` when the first request for a
+name starts, and `ready: true` when a refresh confirms the name's first account. A refresh that
+moves an existing account ID to another name also reports the old name `ready: false` when it has no
+other account. Further attempts for a name that already has an account fire nothing. The gateway
+does not notify the fragment of consent or revocation, so readiness changes only when
+`POST /connection-requests/:requestId/refresh` runs.
+
+## Client flow
+
+```ts
+import { createProjectConnectorFragmentClient } from "@fragno-dev/project-connector-fragment/vanilla";
+
+const connector = createProjectConnectorFragmentClient();
+const request = await connector.connect().mutate({
+  body: {
+    providerConfigId: "your-gmail-provider-config-id",
+    connectionName: "work",
+    returnUri: "https://app.example.com/integrations/connected",
+  },
+});
+
+// Remember request.id before navigating. Do not trust callback query parameters.
+window.location.assign(request.authorizationUrl);
+
+// After returning, or while polling in the initiating UI:
+const confirmed = await connector.refreshConnection().mutate({ path: { requestId: request.id } });
+if (confirmed.state.status === "connected") {
+  const profile = await fetch(
+    `/api/project-connector-fragment/accounts/${confirmed.state.connectedAccountId}/profile`,
+  ).then((response) => response.json());
+}
+```
+
+Use exactly one of `providerConfigId` or `service` when connecting. Explicit provider IDs are
+preferred for projects with multiple configurations for one service. React, Vue, Svelte, and Solid
+entrypoints also export `createProjectConnectorFragmentClient` with their native adapter
+conventions.
+
+Client operations: `useProviderConfigs`, `useProviderActions`, `useStatus`, `useAccounts`,
+`useNamedAccount`, `useNamedConnectionRequest`, `useProfile`, `connect`, `refreshConnection`, and
+`executeAction`. Refreshing a connection invalidates account and named-request stores. The account
+list is cursor-paginated (25 items per page); it lists local verified bindings, not live provider
+availability.
+
+## Routes
+
+| Method | Path                                                                                 | Purpose                                                         |
+| ------ | ------------------------------------------------------------------------------------ | --------------------------------------------------------------- |
+| GET    | `/provider-configs`                                                                  | Overview of this project's available OAuth configurations       |
+| GET    | `/provider-configs/:providerConfigId/actions`                                        | List allowed action contracts for one exact OAuth configuration |
+| GET    | `/status`                                                                            | Check project-key authentication                                |
+| GET    | `/connection-requests/by-name?projectId=...&providerConfigId=...&connectionName=...` | Read an unambiguous request by exact name                       |
+| POST   | `/connection-requests`                                                               | Start a fresh OAuth request                                     |
+| POST   | `/connection-requests/:requestId/refresh`                                            | Verify gateway status and bind a completed account              |
+| GET    | `/accounts?cursor=...`                                                               | List this user's locally verified account bindings              |
+| GET    | `/accounts/by-name?projectId=...&providerConfigId=...&connectionName=...`            | Read an unambiguous confirmed account by exact name             |
+| GET    | `/accounts/:accountId/profile`                                                       | Read and verify the provider account profile                    |
+| POST   | `/accounts/:accountId/actions/:actionId`                                             | Execute `{ "input": { ... } }` using the saved selector         |
+
+A connection is bound only when the authenticated gateway response is `connected` and matches the
+saved request ID, project, provider config, external user, service, and connection name. `failed`
+and `expired` are terminal and never create account bindings. Product users cannot select a
+different user ID in request bodies, read other users' bindings, or execute actions on them.
+
+Action output stays opaque; responses preserve `executionId` and `actionId` for troubleshooting.
+Requests have a 30-second timeout. Action POSTs are **not automatically retried**, since retrying a
+write such as `gmail.send_email` can duplicate its side effects. Upstream errors return safe
+connector codes without exposing raw response bodies. Database errors still surface as database
+errors.
+
+This first version deliberately excludes provider setup/admin APIs, credential import, account
+disconnect, a personal catalog API, and background synchronization. OAuth tokens are managed by
+Project Connector, not by this fragment.
+
+## Development
+
+```bash
+pnpm exec turbo build types:check test --filter=@fragno-dev/project-connector-fragment --output-logs=errors-only
+```
+
+Scenario tests exercise a real local HTTP gateway, SQLite operations, authenticated routes, client
+store invalidation, cursor pagination, and persistent CLI state. They do not use your real API key.

package/bin/run.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runProjectConnectorCli } from "../dist/cli/cli.js";
+
+process.exitCode = await runProjectConnectorCli(process.argv.slice(2));

package/dist/browser/client/react.d.ts

@@ -0,0 +1,174 @@
+import { a as FragnoClientRequestError, c as InferOr, d as MaybeExtractPathParamsOrWiden, f as QueryParamsHint, i as ReadableAtom, l as ExtractPathParamsOrWiden, o as NonGetHTTPMethod, r as FetcherValue, s as FragnoPublicClientConfig, u as HasPathParams } from "../client-BCzNDSlW.js";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region ../fragno/dist/client/react.d.ts
+//#region src/client/react.d.ts
+type FragnoReactHook<_TMethod extends "GET", TPath extends string, TOutputSchema extends StandardSchemaV1, TErrorCode extends string, TQueryParameters extends string> = (args?: {
+  path?: MaybeExtractPathParamsOrWiden<TPath, string | ReadableAtom<string>>;
+  query?: QueryParamsHint<TQueryParameters, string | ReadableAtom<string>>;
+}) => FetcherValue<StandardSchemaV1.InferOutput<TOutputSchema>, FragnoClientRequestError<NonNullable<TErrorCode>>> & {
+  refetch: () => void;
+};
+type FragnoReactMutator<_TMethod extends NonGetHTTPMethod, TPath extends string, TInputSchema extends StandardSchemaV1 | undefined, TOutputSchema extends StandardSchemaV1 | undefined, TErrorCode extends string, TQueryParameters extends string> = () => {
+  mutate: ({ body, path, query }: {
+    body?: InferOr<TInputSchema, undefined>;
+    path?: HasPathParams<TPath> extends true ? ExtractPathParamsOrWiden<TPath, string | ReadableAtom<string>> : undefined;
+    query?: QueryParamsHint<TQueryParameters, string | ReadableAtom<string>>;
+  }) => Promise<InferOr<TOutputSchema, undefined>>;
+  loading?: boolean | undefined;
+  error?: FragnoClientRequestError<NonNullable<TErrorCode>[number]> | undefined;
+  data?: InferOr<TOutputSchema, undefined> | undefined;
+};
+//#endregion
+//#region src/client/react.d.ts
+/** Creates the React client for the ProjectConnector fragment. */
+declare function createProjectConnectorFragmentClient(config?: FragnoPublicClientConfig): {
+  useProviderConfigs: FragnoReactHook<"GET", "/provider-configs", import("zod").ZodObject<{
+    projectId: import("zod").ZodString;
+    providerConfigs: import("zod").ZodArray<import("zod").ZodObject<{
+      id: import("zod").ZodString;
+      service: import("zod").ZodString;
+      displayName: import("zod").ZodString;
+      callbackUrl: import("zod").ZodURL;
+      effectiveScopes: import("zod").ZodArray<import("zod").ZodString>;
+      proxyAvailable: import("zod").ZodBoolean;
+    }, import("zod/v4/core").$strip>>;
+  }, import("zod/v4/core").$strip>, "UNAUTHENTICATED" | "PROJECT_CONNECTOR_ERROR", string>;
+  useProviderActions: FragnoReactHook<"GET", "/provider-configs/:providerConfigId/actions", import("zod").ZodObject<{
+    projectId: import("zod").ZodString;
+    providerConfigId: import("zod").ZodString;
+    actions: import("zod").ZodArray<import("zod").ZodObject<{
+      id: import("zod").ZodString;
+      service: import("zod").ZodString;
+      name: import("zod").ZodString;
+      description: import("zod").ZodNullable<import("zod").ZodString>;
+      inputSchema: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>;
+      outputSchema: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>;
+    }, import("zod/v4/core").$strip>>;
+  }, import("zod/v4/core").$strip>, "UNAUTHENTICATED" | "PROJECT_CONNECTOR_ERROR" | "PROVIDER_CONFIG_NOT_FOUND", string>;
+  useStatus: FragnoReactHook<"GET", "/status", import("zod").ZodObject<{
+    authenticated: import("zod").ZodLiteral<true>;
+  }, import("zod/v4/core").$strip>, "UNAUTHENTICATED" | "PROJECT_CONNECTOR_ERROR", string>;
+  useAccounts: FragnoReactHook<"GET", "/accounts", import("zod").ZodObject<{
+    accounts: import("zod").ZodArray<import("zod").ZodObject<{
+      id: import("zod").ZodString;
+      projectId: import("zod").ZodString;
+      providerConfigId: import("zod").ZodString;
+      externalUserId: import("zod").ZodString;
+      service: import("zod").ZodString;
+      connectionName: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>>;
+    cursor: import("zod").ZodNullable<import("zod").ZodString>;
+    hasNextPage: import("zod").ZodBoolean;
+  }, import("zod/v4/core").$strip>, "UNAUTHENTICATED" | "INVALID_CURSOR", "cursor">;
+  useNamedAccount: FragnoReactHook<"GET", "/accounts/by-name", import("zod").ZodObject<{
+    account: import("zod").ZodNullable<import("zod").ZodObject<{
+      id: import("zod").ZodString;
+      projectId: import("zod").ZodString;
+      providerConfigId: import("zod").ZodString;
+      externalUserId: import("zod").ZodString;
+      service: import("zod").ZodString;
+      connectionName: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>>;
+  }, import("zod/v4/core").$strict>, "UNAUTHENTICATED" | "INVALID_SELECTOR" | "CONNECTION_AMBIGUOUS", "projectId" | "providerConfigId" | "connectionName">;
+  useNamedConnectionRequest: FragnoReactHook<"GET", "/connection-requests/by-name", import("zod").ZodObject<{
+    request: import("zod").ZodNullable<import("zod").ZodObject<{
+      id: import("zod").ZodString;
+      projectId: import("zod").ZodString;
+      providerConfigId: import("zod").ZodString;
+      externalUserId: import("zod").ZodString;
+      service: import("zod").ZodString;
+      connectionName: import("zod").ZodString;
+      authorizationUrl: import("zod").ZodURL;
+      expiresAt: import("zod").ZodString;
+      state: import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
+        status: import("zod").ZodLiteral<"initiated">;
+      }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+        status: import("zod").ZodLiteral<"connected">;
+        connectedAccountId: import("zod").ZodString;
+      }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+        status: import("zod").ZodLiteral<"failed">;
+        errorCode: import("zod").ZodNullable<import("zod").ZodString>;
+        errorMessage: import("zod").ZodNullable<import("zod").ZodString>;
+      }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+        status: import("zod").ZodLiteral<"expired">;
+      }, import("zod/v4/core").$strip>], "status">;
+    }, import("zod/v4/core").$strip>>;
+  }, import("zod/v4/core").$strict>, "UNAUTHENTICATED" | "INVALID_SELECTOR" | "CONNECTION_AMBIGUOUS", "projectId" | "providerConfigId" | "connectionName">;
+  useProfile: FragnoReactHook<"GET", "/accounts/:accountId/profile", import("zod").ZodObject<{
+    connectedAccountId: import("zod").ZodString;
+    externalUserId: import("zod").ZodString;
+    service: import("zod").ZodString;
+    profile: import("zod").ZodObject<{
+      id: import("zod").ZodString;
+      kind: import("zod").ZodString;
+      username: import("zod").ZodNullable<import("zod").ZodString>;
+      displayName: import("zod").ZodNullable<import("zod").ZodString>;
+      avatarUrl: import("zod").ZodNullable<import("zod").ZodString>;
+      email: import("zod").ZodNullable<import("zod").ZodString>;
+      metadata: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>;
+    }, import("zod/v4/core").$strip>;
+    fetchedAt: import("zod").ZodNumber;
+  }, import("zod/v4/core").$strip>, "UNAUTHENTICATED" | "PROJECT_CONNECTOR_ERROR" | "ACCOUNT_NOT_FOUND", string>;
+  connect: FragnoReactMutator<NonGetHTTPMethod, "/connection-requests", import("zod").ZodUnion<readonly [import("zod").ZodObject<{
+    service: import("zod").ZodString;
+    connectionName: import("zod").ZodString;
+    returnUri: import("zod").ZodURL;
+  }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+    providerConfigId: import("zod").ZodString;
+    connectionName: import("zod").ZodString;
+    returnUri: import("zod").ZodURL;
+  }, import("zod/v4/core").$strict>]> | undefined, import("zod").ZodObject<{
+    id: import("zod").ZodString;
+    projectId: import("zod").ZodString;
+    providerConfigId: import("zod").ZodString;
+    externalUserId: import("zod").ZodString;
+    service: import("zod").ZodString;
+    connectionName: import("zod").ZodString;
+    authorizationUrl: import("zod").ZodURL;
+    expiresAt: import("zod").ZodString;
+    state: import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
+      status: import("zod").ZodLiteral<"initiated">;
+    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+      status: import("zod").ZodLiteral<"connected">;
+      connectedAccountId: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+      status: import("zod").ZodLiteral<"failed">;
+      errorCode: import("zod").ZodNullable<import("zod").ZodString>;
+      errorMessage: import("zod").ZodNullable<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+      status: import("zod").ZodLiteral<"expired">;
+    }, import("zod/v4/core").$strip>], "status">;
+  }, import("zod/v4/core").$strip> | undefined, "UNAUTHENTICATED" | "PROJECT_CONNECTOR_ERROR" | "RETURN_URI_NOT_ALLOWED", string>;
+  refreshConnection: FragnoReactMutator<NonGetHTTPMethod, "/connection-requests/:requestId/refresh", import("@standard-schema/spec").StandardSchemaV1<unknown, unknown> | undefined, import("zod").ZodObject<{
+    id: import("zod").ZodString;
+    projectId: import("zod").ZodString;
+    providerConfigId: import("zod").ZodString;
+    externalUserId: import("zod").ZodString;
+    service: import("zod").ZodString;
+    connectionName: import("zod").ZodString;
+    authorizationUrl: import("zod").ZodURL;
+    expiresAt: import("zod").ZodString;
+    state: import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
+      status: import("zod").ZodLiteral<"initiated">;
+    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+      status: import("zod").ZodLiteral<"connected">;
+      connectedAccountId: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+      status: import("zod").ZodLiteral<"failed">;
+      errorCode: import("zod").ZodNullable<import("zod").ZodString>;
+      errorMessage: import("zod").ZodNullable<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+      status: import("zod").ZodLiteral<"expired">;
+    }, import("zod/v4/core").$strip>], "status">;
+  }, import("zod/v4/core").$strip> | undefined, "UNAUTHENTICATED" | "PROJECT_CONNECTOR_ERROR" | "REQUEST_NOT_FOUND", string>;
+  executeAction: FragnoReactMutator<NonGetHTTPMethod, "/accounts/:accountId/actions/:actionId", import("zod").ZodObject<{
+    input: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>;
+  }, import("zod/v4/core").$strict> | undefined, import("zod").ZodObject<{
+    executionId: import("zod").ZodString;
+    actionId: import("zod").ZodString;
+    output: import("zod").ZodUnknown & import("zod").ZodType<{} | null, unknown, import("zod/v4/core").$ZodTypeInternals<{} | null, unknown>>;
+  }, import("zod/v4/core").$strip> | undefined, "UNAUTHENTICATED" | "PROJECT_CONNECTOR_ERROR" | "ACCOUNT_NOT_FOUND" | "ACTION_SERVICE_MISMATCH", string>;
+};
+//#endregion
+export { createProjectConnectorFragmentClient };
+//# sourceMappingURL=react.d.ts.map

package/dist/browser/client/react.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"react.d.ts","names":[],"sources":["../../../../fragno/dist/client/react.d.ts","../../../src/client/react.ts"],"mappings":";;;;KASK,gBAAgB,wBAAwB,sBAAsB,sBAAsB,kBAAkB,2BAA2B,oCAAoC;EACxK,OAAO,8BAA8B,gBAAgB;EACrD,QAAQ,gBAAgB,2BAA2B;MAC/C,aAAa,iBAAiB,YAAY,gBAAgB,yBAAyB,YAAY;EACnG;;KAEG,mBAAmB,iBAAiB,kBAAkB,sBAAsB,qBAAqB,8BAA8B,sBAAsB,8BAA8B,2BAA2B;EACjN,WAAW,MAAM,MAAM;IACrB,OAAO,QAAQ;IACf,OAAO,cAAc,sBAAsB,yBAAyB,gBAAgB;IACpF,QAAQ,gBAAgB,2BAA2B;QAC/C,QAAQ,QAAQ;EACtB;EACA,QAAQ,yBAAyB,YAAY;EAC7C,OAAO,QAAQ;;;;;iBCjBD,qCAAqC,SAAQ;sBAAA"}