@fragno-dev/project-connector-fragment 0.0.0-stage → 0.0.1

package/dist/cli/project-connector-contracts.js

@@ -0,0 +1,125 @@
+import { z } from "zod";
+//#region src/project-connector-contracts.ts
+/** Only HTTP(S) URLs can be used as OAuth return destinations. */
+const projectConnectorHttpUrlSchema = z.url().refine((value) => {
+	const url = new URL(value);
+	return (url.protocol === "https:" || url.protocol === "http:") && !url.username && !url.password;
+}, "Expected an HTTP(S) URL without embedded credentials");
+/** A connection becomes usable only after the gateway confirms its account ID. */
+const projectConnectorConnectionStateSchema = z.discriminatedUnion("status", [
+	z.object({ status: z.literal("initiated") }),
+	z.object({
+		status: z.literal("connected"),
+		connectedAccountId: z.string().min(1)
+	}),
+	z.object({
+		status: z.literal("failed"),
+		errorCode: z.string().nullable(),
+		errorMessage: z.string().nullable()
+	}),
+	z.object({ status: z.literal("expired") })
+]);
+/** Mirrors the gateway's alias rule so invalid names fail here with a usable message. */
+const projectConnectorConnectionNameSchema = z.string().regex(/^[a-z0-9][a-z0-9_-]*$/, "Connection names may only contain lowercase letters, digits, underscores, and hyphens, and must start with a letter or digit").describe("Lowercase letters, digits, underscores, and hyphens; starts with a letter or digit.");
+/** Named selectors preserve exact source identity; user ownership comes only from authentication. */
+const projectConnectorNamedConnectionSchema = z.strictObject({
+	projectId: z.string().min(1),
+	providerConfigId: z.string().min(1),
+	connectionName: projectConnectorConnectionNameSchema
+});
+/** Select exactly one provider and name every connection explicitly. */
+const projectConnectorConnectInputSchema = z.union([z.strictObject({
+	service: z.string().regex(/^[a-z0-9_-]+$/),
+	connectionName: projectConnectorNamedConnectionSchema.shape.connectionName,
+	returnUri: projectConnectorHttpUrlSchema
+}), z.strictObject({
+	providerConfigId: projectConnectorNamedConnectionSchema.shape.providerConfigId,
+	connectionName: projectConnectorNamedConnectionSchema.shape.connectionName,
+	returnUri: projectConnectorHttpUrlSchema
+})]);
+/** Public connection request projection, including its verified lifecycle. */
+const projectConnectorConnectionSchema = z.object({
+	id: z.string(),
+	projectId: z.string(),
+	providerConfigId: z.string(),
+	externalUserId: z.string(),
+	service: z.string(),
+	connectionName: projectConnectorNamedConnectionSchema.shape.connectionName,
+	authorizationUrl: projectConnectorHttpUrlSchema,
+	expiresAt: z.string(),
+	state: projectConnectorConnectionStateSchema
+});
+/** Stored account selectors bind actions to a specific product user and provider. */
+const projectConnectorAccountSchema = z.object({
+	id: z.string(),
+	projectId: z.string(),
+	providerConfigId: z.string(),
+	externalUserId: z.string(),
+	service: z.string(),
+	connectionName: projectConnectorNamedConnectionSchema.shape.connectionName
+});
+/** Missing named requests remain JSON results rather than empty HTTP responses. */
+const projectConnectorNamedRequestSchema = z.strictObject({ request: projectConnectorConnectionSchema.nullable() });
+/** Missing named accounts remain JSON results rather than empty HTTP responses. */
+const projectConnectorNamedAccountSchema = z.strictObject({ account: projectConnectorAccountSchema.nullable() });
+/** Account pagination is owned by the fragment rather than the provider gateway. */
+const projectConnectorAccountsSchema = z.object({
+	accounts: z.array(projectConnectorAccountSchema),
+	cursor: z.string().nullable(),
+	hasNextPage: z.boolean()
+});
+/** Project-scoped OAuth provider overview excludes action IDs and credentials. */
+const projectConnectorProviderConfigsSchema = z.object({
+	projectId: z.string().min(1),
+	providerConfigs: z.array(z.object({
+		id: z.string().min(1),
+		service: z.string().min(1),
+		displayName: z.string(),
+		callbackUrl: projectConnectorHttpUrlSchema,
+		effectiveScopes: z.array(z.string().min(1)),
+		proxyAvailable: z.boolean()
+	}))
+}).refine(({ providerConfigs }) => new Set(providerConfigs.map((config) => config.id)).size === providerConfigs.length, "Provider configuration IDs must be unique");
+/** Authoritative catalog contracts describe action values, not a provider's execution permissions. */
+const projectConnectorActionSchema = z.object({
+	id: z.string().min(1),
+	service: z.string().min(1),
+	name: z.string(),
+	description: z.string().nullable(),
+	inputSchema: z.record(z.string(), z.unknown()),
+	outputSchema: z.record(z.string(), z.unknown())
+});
+/** Only actions allowed by this exact project OAuth configuration are included. */
+const projectConnectorProviderActionsSchema = z.object({
+	projectId: projectConnectorProviderConfigsSchema.shape.projectId,
+	providerConfigId: projectConnectorProviderConfigsSchema.shape.providerConfigs.element.shape.id,
+	actions: z.array(projectConnectorActionSchema)
+});
+/** Project authentication does not imply that an individual provider account is usable. */
+const projectConnectorStatusSchema = z.object({ authenticated: z.literal(true) });
+/** Read-only provider identity associated with one verified account. */
+const projectConnectorProfileSchema = z.object({
+	connectedAccountId: z.string(),
+	externalUserId: z.string(),
+	service: z.string(),
+	profile: z.object({
+		id: z.string(),
+		kind: z.string(),
+		username: z.string().nullable(),
+		displayName: z.string().nullable(),
+		avatarUrl: z.string().nullable(),
+		email: z.string().nullable(),
+		metadata: z.record(z.string(), z.unknown())
+	}),
+	fetchedAt: z.number()
+});
+/** Action output stays opaque; execution IDs support upstream troubleshooting. */
+const projectConnectorExecutionSchema = z.object({
+	executionId: z.string(),
+	actionId: z.string(),
+	output: z.unknown().refine((value) => value !== void 0, "Expected action output")
+});
+//#endregion
+export { projectConnectorAccountSchema, projectConnectorAccountsSchema, projectConnectorActionSchema, projectConnectorConnectInputSchema, projectConnectorConnectionSchema, projectConnectorConnectionStateSchema, projectConnectorExecutionSchema, projectConnectorHttpUrlSchema, projectConnectorNamedAccountSchema, projectConnectorNamedConnectionSchema, projectConnectorNamedRequestSchema, projectConnectorProfileSchema, projectConnectorProviderActionsSchema, projectConnectorProviderConfigsSchema, projectConnectorStatusSchema };
+
+//# sourceMappingURL=project-connector-contracts.js.map

package/dist/cli/project-connector-contracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-connector-contracts.js","names":[],"sources":["../../src/project-connector-contracts.ts"],"sourcesContent":["import { z } from \"zod\";\n\n/** Only HTTP(S) URLs can be used as OAuth return destinations. */\nexport const projectConnectorHttpUrlSchema = z.url().refine((value) => {\n  const url = new URL(value);\n  return (url.protocol === \"https:\" || url.protocol === \"http:\") && !url.username && !url.password;\n}, \"Expected an HTTP(S) URL without embedded credentials\");\n\n/** A connection becomes usable only after the gateway confirms its account ID. */\nexport const projectConnectorConnectionStateSchema = z.discriminatedUnion(\"status\", [\n  z.object({ status: z.literal(\"initiated\") }),\n  z.object({ status: z.literal(\"connected\"), connectedAccountId: z.string().min(1) }),\n  z.object({\n    status: z.literal(\"failed\"),\n    errorCode: z.string().nullable(),\n    errorMessage: z.string().nullable(),\n  }),\n  z.object({ status: z.literal(\"expired\") }),\n]);\n\n/** Persisted connection lifecycle; provider credentials never enter this fragment. */\nexport type ProjectConnectorConnectionState = z.infer<typeof projectConnectorConnectionStateSchema>;\n\n/** Mirrors the gateway's alias rule so invalid names fail here with a usable message. */\nconst projectConnectorConnectionNameSchema = z\n  .string()\n  .regex(\n    /^[a-z0-9][a-z0-9_-]*$/,\n    \"Connection names may only contain lowercase letters, digits, underscores, and hyphens, and must start with a letter or digit\",\n  )\n  .describe(\"Lowercase letters, digits, underscores, and hyphens; starts with a letter or digit.\");\n\n/** Named selectors preserve exact source identity; user ownership comes only from authentication. */\nexport const projectConnectorNamedConnectionSchema = z.strictObject({\n  projectId: z.string().min(1),\n  providerConfigId: z.string().min(1),\n  connectionName: projectConnectorConnectionNameSchema,\n});\n\n/** Select exactly one provider and name every connection explicitly. */\nexport const projectConnectorConnectInputSchema = z.union([\n  z.strictObject({\n    service: z.string().regex(/^[a-z0-9_-]+$/),\n    connectionName: projectConnectorNamedConnectionSchema.shape.connectionName,\n    returnUri: projectConnectorHttpUrlSchema,\n  }),\n  z.strictObject({\n    providerConfigId: projectConnectorNamedConnectionSchema.shape.providerConfigId,\n    connectionName: projectConnectorNamedConnectionSchema.shape.connectionName,\n    returnUri: projectConnectorHttpUrlSchema,\n  }),\n]);\n\n/** Public connection request projection, including its verified lifecycle. */\nexport const projectConnectorConnectionSchema = z.object({\n  id: z.string(),\n  projectId: z.string(),\n  providerConfigId: z.string(),\n  externalUserId: z.string(),\n  service: z.string(),\n  connectionName: projectConnectorNamedConnectionSchema.shape.connectionName,\n  authorizationUrl: projectConnectorHttpUrlSchema,\n  expiresAt: z.string(),\n  state: projectConnectorConnectionStateSchema,\n});\n\n/** Stored account selectors bind actions to a specific product user and provider. */\nexport const projectConnectorAccountSchema = z.object({\n  id: z.string(),\n  projectId: z.string(),\n  providerConfigId: z.string(),\n  externalUserId: z.string(),\n  service: z.string(),\n  connectionName: projectConnectorNamedConnectionSchema.shape.connectionName,\n});\n\n/** Missing named requests remain JSON results rather than empty HTTP responses. */\nexport const projectConnectorNamedRequestSchema = z.strictObject({\n  request: projectConnectorConnectionSchema.nullable(),\n});\n\n/** Missing named accounts remain JSON results rather than empty HTTP responses. */\nexport const projectConnectorNamedAccountSchema = z.strictObject({\n  account: projectConnectorAccountSchema.nullable(),\n});\n\n/** Account pagination is owned by the fragment rather than the provider gateway. */\nexport const projectConnectorAccountsSchema = z.object({\n  accounts: z.array(projectConnectorAccountSchema),\n  cursor: z.string().nullable(),\n  hasNextPage: z.boolean(),\n});\n\n/** Project-scoped OAuth provider overview excludes action IDs and credentials. */\nexport const projectConnectorProviderConfigsSchema = z\n  .object({\n    projectId: z.string().min(1),\n    providerConfigs: z.array(\n      z.object({\n        id: z.string().min(1),\n        service: z.string().min(1),\n        displayName: z.string(),\n        callbackUrl: projectConnectorHttpUrlSchema,\n        effectiveScopes: z.array(z.string().min(1)),\n        proxyAvailable: z.boolean(),\n      }),\n    ),\n  })\n  .refine(\n    ({ providerConfigs }) =>\n      new Set(providerConfigs.map((config) => config.id)).size === providerConfigs.length,\n    \"Provider configuration IDs must be unique\",\n  );\n\n/** Authoritative catalog contracts describe action values, not a provider's execution permissions. */\nexport const projectConnectorActionSchema = z.object({\n  id: z.string().min(1),\n  service: z.string().min(1),\n  name: z.string(),\n  description: z.string().nullable(),\n  inputSchema: z.record(z.string(), z.unknown()),\n  outputSchema: z.record(z.string(), z.unknown()),\n});\n\n/** Only actions allowed by this exact project OAuth configuration are included. */\nexport const projectConnectorProviderActionsSchema = z.object({\n  projectId: projectConnectorProviderConfigsSchema.shape.projectId,\n  providerConfigId: projectConnectorProviderConfigsSchema.shape.providerConfigs.element.shape.id,\n  actions: z.array(projectConnectorActionSchema),\n});\n\n/** Project authentication does not imply that an individual provider account is usable. */\nexport const projectConnectorStatusSchema = z.object({ authenticated: z.literal(true) });\n\n/** Read-only provider identity associated with one verified account. */\nexport const projectConnectorProfileSchema = z.object({\n  connectedAccountId: z.string(),\n  externalUserId: z.string(),\n  service: z.string(),\n  profile: z.object({\n    id: z.string(),\n    kind: z.string(),\n    username: z.string().nullable(),\n    displayName: z.string().nullable(),\n    avatarUrl: z.string().nullable(),\n    email: z.string().nullable(),\n    metadata: z.record(z.string(), z.unknown()),\n  }),\n  fetchedAt: z.number(),\n});\n\n/** Action output stays opaque; execution IDs support upstream troubleshooting. */\nexport const projectConnectorExecutionSchema = z.object({\n  executionId: z.string(),\n  actionId: z.string(),\n  output: z.unknown().refine((value) => value !== undefined, \"Expected action output\"),\n});\n"],"mappings":";;;AAGA,MAAa,gCAAgC,EAAE,IAAI,CAAC,CAAC,QAAQ,UAAU;CACrE,MAAM,MAAM,IAAI,IAAI,KAAK;CACzB,QAAQ,IAAI,aAAa,YAAY,IAAI,aAAa,YAAY,CAAC,IAAI,YAAY,CAAC,IAAI;AAC1F,GAAG,sDAAsD;;AAGzD,MAAa,wCAAwC,EAAE,mBAAmB,UAAU;CAClF,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,WAAW,EAAE,CAAC;CAC3C,EAAE,OAAO;EAAE,QAAQ,EAAE,QAAQ,WAAW;EAAG,oBAAoB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAAE,CAAC;CAClF,EAAE,OAAO;EACP,QAAQ,EAAE,QAAQ,QAAQ;EAC1B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;EAC/B,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS;CACpC,CAAC;CACD,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,SAAS,EAAE,CAAC;AAC3C,CAAC;;AAMD,MAAM,uCAAuC,EAC1C,OAAO,CAAC,CACR,MACC,yBACA,8HACF,CAAC,CACA,SAAS,qFAAqF;;AAGjG,MAAa,wCAAwC,EAAE,aAAa;CAClE,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC3B,kBAAkB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAClC,gBAAgB;AAClB,CAAC;;AAGD,MAAa,qCAAqC,EAAE,MAAM,CACxD,EAAE,aAAa;CACb,SAAS,EAAE,OAAO,CAAC,CAAC,MAAM,eAAe;CACzC,gBAAgB,sCAAsC,MAAM;CAC5D,WAAW;AACb,CAAC,GACD,EAAE,aAAa;CACb,kBAAkB,sCAAsC,MAAM;CAC9D,gBAAgB,sCAAsC,MAAM;CAC5D,WAAW;AACb,CAAC,CACH,CAAC;;AAGD,MAAa,mCAAmC,EAAE,OAAO;CACvD,IAAI,EAAE,OAAO;CACb,WAAW,EAAE,OAAO;CACpB,kBAAkB,EAAE,OAAO;CAC3B,gBAAgB,EAAE,OAAO;CACzB,SAAS,EAAE,OAAO;CAClB,gBAAgB,sCAAsC,MAAM;CAC5D,kBAAkB;CAClB,WAAW,EAAE,OAAO;CACpB,OAAO;AACT,CAAC;;AAGD,MAAa,gCAAgC,EAAE,OAAO;CACpD,IAAI,EAAE,OAAO;CACb,WAAW,EAAE,OAAO;CACpB,kBAAkB,EAAE,OAAO;CAC3B,gBAAgB,EAAE,OAAO;CACzB,SAAS,EAAE,OAAO;CAClB,gBAAgB,sCAAsC,MAAM;AAC9D,CAAC;;AAGD,MAAa,qCAAqC,EAAE,aAAa,EAC/D,SAAS,iCAAiC,SAAS,EACrD,CAAC;;AAGD,MAAa,qCAAqC,EAAE,aAAa,EAC/D,SAAS,8BAA8B,SAAS,EAClD,CAAC;;AAGD,MAAa,iCAAiC,EAAE,OAAO;CACrD,UAAU,EAAE,MAAM,6BAA6B;CAC/C,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,aAAa,EAAE,QAAQ;AACzB,CAAC;;AAGD,MAAa,wCAAwC,EAClD,OAAO;CACN,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC3B,iBAAiB,EAAE,MACjB,EAAE,OAAO;EACP,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACpB,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACzB,aAAa,EAAE,OAAO;EACtB,aAAa;EACb,iBAAiB,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC;EAC1C,gBAAgB,EAAE,QAAQ;CAC5B,CAAC,CACH;AACF,CAAC,CAAC,CACD,QACE,EAAE,sBACD,IAAI,IAAI,gBAAgB,KAAK,WAAW,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,gBAAgB,QAC/E,2CACF;;AAGF,MAAa,+BAA+B,EAAE,OAAO;CACnD,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACpB,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACzB,MAAM,EAAE,OAAO;CACf,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;CACjC,aAAa,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;CAC7C,cAAc,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAChD,CAAC;;AAGD,MAAa,wCAAwC,EAAE,OAAO;CAC5D,WAAW,sCAAsC,MAAM;CACvD,kBAAkB,sCAAsC,MAAM,gBAAgB,QAAQ,MAAM;CAC5F,SAAS,EAAE,MAAM,4BAA4B;AAC/C,CAAC;;AAGD,MAAa,+BAA+B,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,IAAI,EAAE,CAAC;;AAGvF,MAAa,gCAAgC,EAAE,OAAO;CACpD,oBAAoB,EAAE,OAAO;CAC7B,gBAAgB,EAAE,OAAO;CACzB,SAAS,EAAE,OAAO;CAClB,SAAS,EAAE,OAAO;EAChB,IAAI,EAAE,OAAO;EACb,MAAM,EAAE,OAAO;EACf,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;EAC9B,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;EACjC,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;EAC/B,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;EAC3B,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;CAC5C,CAAC;CACD,WAAW,EAAE,OAAO;AACtB,CAAC;;AAGD,MAAa,kCAAkC,EAAE,OAAO;CACtD,aAAa,EAAE,OAAO;CACtB,UAAU,EAAE,OAAO;CACnB,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,UAAU,UAAU,KAAA,GAAW,wBAAwB;AACrF,CAAC"}

package/dist/cli/routes.js

@@ -0,0 +1,449 @@
+import { projectConnectorAccountsSchema, projectConnectorConnectInputSchema, projectConnectorConnectionSchema, projectConnectorExecutionSchema, projectConnectorNamedAccountSchema, projectConnectorNamedConnectionSchema, projectConnectorNamedRequestSchema, projectConnectorProfileSchema, projectConnectorProviderActionsSchema, projectConnectorProviderConfigsSchema, projectConnectorStatusSchema } from "./project-connector-contracts.js";
+import { ProjectConnectorClientError, confirmProjectConnectorRequest } from "./project-connector-client.js";
+import { projectConnectorSchema } from "./schema.js";
+import { projectConnectorFragmentDefinition } from "./definition.js";
+import { z } from "zod";
+import { defineRoutes } from "@fragno-dev/core";
+import { decodeCursor } from "@fragno-dev/db/cursor";
+//#region src/routes.ts
+function serializeProjectConnectorRequest(saved) {
+	return {
+		id: saved.id.toString(),
+		projectId: saved.projectId,
+		providerConfigId: saved.providerConfigId,
+		externalUserId: saved.externalUserId,
+		service: saved.service,
+		connectionName: saved.connectionName,
+		authorizationUrl: saved.authorizationUrl,
+		expiresAt: saved.expiresAt,
+		state: saved.state
+	};
+}
+/** Authenticated routes never accept a product user ID or account binding from the browser. */
+const projectConnectorRoutes = defineRoutes(projectConnectorFragmentDefinition).create(({ config, deps, defineRoute }) => [
+	defineRoute({
+		method: "GET",
+		path: "/provider-configs",
+		outputSchema: projectConnectorProviderConfigsSchema,
+		errorCodes: ["UNAUTHENTICATED", "PROJECT_CONNECTOR_ERROR"],
+		handler: async function({ headers }, { json, error }) {
+			if (!await config.getExternalUserId(headers)) return error({
+				code: "UNAUTHENTICATED",
+				message: "Authentication required"
+			}, 401);
+			try {
+				return json(await deps.projectConnector.listProviderConfigs());
+			} catch (cause) {
+				if (!(cause instanceof ProjectConnectorClientError)) throw cause;
+				return error({
+					code: "PROJECT_CONNECTOR_ERROR",
+					message: cause.message
+				}, 502);
+			}
+		}
+	}),
+	defineRoute({
+		method: "GET",
+		path: "/provider-configs/:providerConfigId/actions",
+		outputSchema: projectConnectorProviderActionsSchema,
+		errorCodes: [
+			"UNAUTHENTICATED",
+			"PROVIDER_CONFIG_NOT_FOUND",
+			"PROJECT_CONNECTOR_ERROR"
+		],
+		handler: async function({ headers, pathParams }, { json, error }) {
+			if (!await config.getExternalUserId(headers)) return error({
+				code: "UNAUTHENTICATED",
+				message: "Authentication required"
+			}, 401);
+			try {
+				const actions = await deps.projectConnector.listProviderActions(pathParams.providerConfigId);
+				if (!actions) return error({
+					code: "PROVIDER_CONFIG_NOT_FOUND",
+					message: "Provider configuration not found"
+				}, 404);
+				return json(actions);
+			} catch (cause) {
+				if (!(cause instanceof ProjectConnectorClientError)) throw cause;
+				return error({
+					code: "PROJECT_CONNECTOR_ERROR",
+					message: cause.message
+				}, 502);
+			}
+		}
+	}),
+	defineRoute({
+		method: "GET",
+		path: "/status",
+		outputSchema: projectConnectorStatusSchema,
+		errorCodes: ["UNAUTHENTICATED", "PROJECT_CONNECTOR_ERROR"],
+		handler: async function({ headers }, { json, error }) {
+			if (!await config.getExternalUserId(headers)) return error({
+				code: "UNAUTHENTICATED",
+				message: "Authentication required"
+			}, 401);
+			try {
+				return json(await deps.projectConnector.check());
+			} catch (cause) {
+				if (!(cause instanceof ProjectConnectorClientError)) throw cause;
+				return error({
+					code: "PROJECT_CONNECTOR_ERROR",
+					message: cause.message
+				}, 502);
+			}
+		}
+	}),
+	defineRoute({
+		method: "POST",
+		path: "/connection-requests",
+		inputSchema: projectConnectorConnectInputSchema,
+		outputSchema: projectConnectorConnectionSchema,
+		errorCodes: [
+			"UNAUTHENTICATED",
+			"RETURN_URI_NOT_ALLOWED",
+			"PROJECT_CONNECTOR_ERROR"
+		],
+		handler: async function({ headers, input }, { json, error }) {
+			const externalUserId = await config.getExternalUserId(headers);
+			if (!externalUserId) return error({
+				code: "UNAUTHENTICATED",
+				message: "Authentication required"
+			}, 401);
+			const body = await input.valid();
+			if (!config.allowedReturnUrls(new URL(body.returnUri))) return error({
+				code: "RETURN_URI_NOT_ALLOWED",
+				message: "OAuth return URL is not allowed"
+			}, 400);
+			try {
+				const remote = await deps.projectConnector.connect(externalUserId, body);
+				if (remote.externalUserId !== externalUserId || remote.connectionName !== body.connectionName || ("providerConfigId" in body ? remote.providerConfigId !== body.providerConfigId : remote.service !== body.service)) throw new ProjectConnectorClientError("connection_identity_mismatch", 502);
+				const connection = {
+					id: remote.id,
+					projectId: remote.projectId,
+					providerConfigId: remote.providerConfigId,
+					externalUserId,
+					service: remote.service,
+					connectionName: remote.connectionName,
+					authorizationUrl: remote.authorizationUrl,
+					expiresAt: remote.expiresAt,
+					state: { status: "initiated" }
+				};
+				const named = {
+					projectId: remote.projectId,
+					providerConfigId: remote.providerConfigId,
+					connectionName: body.connectionName
+				};
+				await this.handlerTx().retrieve(({ forSchema }) => forSchema(projectConnectorSchema).findFirst("connectedAccount", (b) => b.whereIndex("idx_account_named_connection", (eb) => eb.and(eb("externalUserId", "=", externalUserId), eb("projectId", "=", named.projectId), eb("providerConfigId", "=", named.providerConfigId), eb("connectionName", "=", named.connectionName))))).mutate(({ forSchema, retrieveResult: [account] }) => {
+					const uow = forSchema(projectConnectorSchema);
+					uow.create("connectionRequest", connection);
+					if (!account) uow.triggerHook("onConnectionReadinessChanged", {
+						externalUserId,
+						service: remote.service,
+						connection: named,
+						ready: false
+					});
+				}).execute();
+				return json(connection);
+			} catch (cause) {
+				if (!(cause instanceof ProjectConnectorClientError)) throw cause;
+				return error({
+					code: "PROJECT_CONNECTOR_ERROR",
+					message: cause.message
+				}, 502);
+			}
+		}
+	}),
+	defineRoute({
+		method: "GET",
+		path: "/connection-requests/by-name",
+		queryParameters: [
+			"projectId",
+			"providerConfigId",
+			"connectionName"
+		],
+		outputSchema: projectConnectorNamedRequestSchema,
+		errorCodes: [
+			"UNAUTHENTICATED",
+			"INVALID_SELECTOR",
+			"CONNECTION_AMBIGUOUS"
+		],
+		handler: async function({ headers, query }, { json, error }) {
+			const externalUserId = await config.getExternalUserId(headers);
+			if (!externalUserId) return error({
+				code: "UNAUTHENTICATED",
+				message: "Authentication required"
+			}, 401);
+			const selector = projectConnectorNamedConnectionSchema.safeParse({
+				projectId: query.get("projectId"),
+				providerConfigId: query.get("providerConfigId"),
+				connectionName: query.get("connectionName")
+			});
+			if (!selector.success) return error({
+				code: "INVALID_SELECTOR",
+				message: "Invalid named connection selector"
+			}, 400);
+			const [page] = await this.handlerTx().retrieve(({ forSchema }) => forSchema(projectConnectorSchema).findWithCursor("connectionRequest", (b) => b.whereIndex("idx_request_named_connection", (eb) => eb.and(eb("externalUserId", "=", externalUserId), eb("projectId", "=", selector.data.projectId), eb("providerConfigId", "=", selector.data.providerConfigId), eb("connectionName", "=", selector.data.connectionName))).orderByIndex("idx_request_named_connection", "asc").pageSize(2))).execute();
+			if (page.items.length > 1) return error({
+				code: "CONNECTION_AMBIGUOUS",
+				message: "Project Connector named connection matches multiple OAuth requests."
+			}, 409);
+			const [saved] = page.items;
+			return json({ request: saved ? serializeProjectConnectorRequest(saved) : null });
+		}
+	}),
+	defineRoute({
+		method: "POST",
+		path: "/connection-requests/:requestId/refresh",
+		outputSchema: projectConnectorConnectionSchema,
+		errorCodes: [
+			"UNAUTHENTICATED",
+			"REQUEST_NOT_FOUND",
+			"PROJECT_CONNECTOR_ERROR"
+		],
+		handler: async function({ headers, pathParams }, { json, error }) {
+			const externalUserId = await config.getExternalUserId(headers);
+			if (!externalUserId) return error({
+				code: "UNAUTHENTICATED",
+				message: "Authentication required"
+			}, 401);
+			let confirmed = null;
+			try {
+				const result = await this.handlerTx().retrieve(({ forSchema }) => forSchema(projectConnectorSchema).findFirst("connectionRequest", (b) => b.whereIndex("primary", (eb) => eb("id", "=", pathParams.requestId))).find("connectedAccount", (b) => b.whereIndex("idx_account_external_user_id", (eb) => eb("externalUserId", "=", externalUserId)).select([
+					"id",
+					"projectId",
+					"providerConfigId",
+					"service",
+					"connectionName"
+				]))).afterRetrieve(async (_uow, [saved]) => {
+					confirmed = null;
+					if (!saved || saved.externalUserId !== externalUserId || saved.state.status !== "initiated") return;
+					const remote = await deps.projectConnector.getConnectionRequest(saved.id.toString());
+					confirmed = confirmProjectConnectorRequest({
+						...saved,
+						id: saved.id.toString()
+					}, remote);
+				}).mutate(({ forSchema, retrieveResult: [saved, accounts] }) => {
+					if (!saved || saved.externalUserId !== externalUserId) return null;
+					const state = confirmed ?? saved.state;
+					const uow = forSchema(projectConnectorSchema);
+					if (saved.state.status === "initiated" && state.status !== "initiated") {
+						uow.update("connectionRequest", saved.id, (b) => b.set({ state }).check());
+						if (state.status === "connected") {
+							const existing = accounts.find((account) => account.id.toString() === state.connectedAccountId);
+							if (existing) uow.delete("connectedAccount", existing.id, (b) => b.check());
+							uow.create("connectedAccount", {
+								id: state.connectedAccountId,
+								projectId: saved.projectId,
+								providerConfigId: saved.providerConfigId,
+								externalUserId: saved.externalUserId,
+								service: saved.service,
+								connectionName: saved.connectionName
+							});
+							const sameName = (named) => (account) => account.projectId === named.projectId && account.providerConfigId === named.providerConfigId && account.connectionName === named.connectionName;
+							if (existing && !sameName(saved)(existing) && !accounts.some((account) => account !== existing && sameName(existing)(account))) uow.triggerHook("onConnectionReadinessChanged", {
+								externalUserId,
+								service: existing.service,
+								connection: {
+									projectId: existing.projectId,
+									providerConfigId: existing.providerConfigId,
+									connectionName: existing.connectionName
+								},
+								ready: false
+							});
+							if (!accounts.some(sameName(saved))) uow.triggerHook("onConnectionReadinessChanged", {
+								externalUserId,
+								service: saved.service,
+								connection: {
+									projectId: saved.projectId,
+									providerConfigId: saved.providerConfigId,
+									connectionName: saved.connectionName
+								},
+								ready: true
+							});
+						}
+					}
+					return serializeProjectConnectorRequest({
+						...saved,
+						state
+					});
+				}).execute();
+				if (!result) return error({
+					code: "REQUEST_NOT_FOUND",
+					message: "Connection request not found"
+				}, 404);
+				return json(result);
+			} catch (cause) {
+				if (!(cause instanceof ProjectConnectorClientError)) throw cause;
+				return error({
+					code: "PROJECT_CONNECTOR_ERROR",
+					message: cause.message
+				}, 502);
+			}
+		}
+	}),
+	defineRoute({
+		method: "GET",
+		path: "/accounts",
+		queryParameters: ["cursor"],
+		outputSchema: projectConnectorAccountsSchema,
+		errorCodes: ["UNAUTHENTICATED", "INVALID_CURSOR"],
+		handler: async function({ headers, query }, { json, error }) {
+			const externalUserId = await config.getExternalUserId(headers);
+			if (!externalUserId) return error({
+				code: "UNAUTHENTICATED",
+				message: "Authentication required"
+			}, 401);
+			let cursor = null;
+			const rawCursor = query.get("cursor");
+			if (rawCursor) try {
+				cursor = decodeCursor(rawCursor);
+				const accountId = cursor.indexValues["id"];
+				if (cursor.indexName !== "idx_account_external_user_id" || cursor.orderDirection !== "asc" || cursor.pageSize !== 25 || cursor.indexValues["externalUserId"] !== externalUserId || typeof accountId !== "string" || accountId.length === 0) throw new Error("Account cursor does not match this user or query");
+			} catch {
+				return error({
+					code: "INVALID_CURSOR",
+					message: "Invalid account cursor"
+				}, 400);
+			}
+			const [page] = await this.handlerTx().retrieve(({ forSchema }) => forSchema(projectConnectorSchema).findWithCursor("connectedAccount", (b) => {
+				const ordered = b.whereIndex("idx_account_external_user_id", (eb) => eb("externalUserId", "=", externalUserId)).orderByIndex("idx_account_external_user_id", "asc").pageSize(25);
+				return cursor ? ordered.after(cursor) : ordered;
+			})).execute();
+			return json({
+				accounts: page.items.map((account) => ({
+					id: account.id.toString(),
+					projectId: account.projectId,
+					providerConfigId: account.providerConfigId,
+					externalUserId: account.externalUserId,
+					service: account.service,
+					connectionName: account.connectionName
+				})),
+				cursor: page.cursor?.encode() ?? null,
+				hasNextPage: page.hasNextPage
+			});
+		}
+	}),
+	defineRoute({
+		method: "GET",
+		path: "/accounts/by-name",
+		queryParameters: [
+			"projectId",
+			"providerConfigId",
+			"connectionName"
+		],
+		outputSchema: projectConnectorNamedAccountSchema,
+		errorCodes: [
+			"UNAUTHENTICATED",
+			"INVALID_SELECTOR",
+			"CONNECTION_AMBIGUOUS"
+		],
+		handler: async function({ headers, query }, { json, error }) {
+			const externalUserId = await config.getExternalUserId(headers);
+			if (!externalUserId) return error({
+				code: "UNAUTHENTICATED",
+				message: "Authentication required"
+			}, 401);
+			const selector = projectConnectorNamedConnectionSchema.safeParse({
+				projectId: query.get("projectId"),
+				providerConfigId: query.get("providerConfigId"),
+				connectionName: query.get("connectionName")
+			});
+			if (!selector.success) return error({
+				code: "INVALID_SELECTOR",
+				message: "Invalid named connection selector"
+			}, 400);
+			const [page] = await this.handlerTx().retrieve(({ forSchema }) => forSchema(projectConnectorSchema).findWithCursor("connectedAccount", (b) => b.whereIndex("idx_account_named_connection", (eb) => eb.and(eb("externalUserId", "=", externalUserId), eb("projectId", "=", selector.data.projectId), eb("providerConfigId", "=", selector.data.providerConfigId), eb("connectionName", "=", selector.data.connectionName))).orderByIndex("idx_account_named_connection", "asc").pageSize(2))).execute();
+			if (page.items.length > 1) return error({
+				code: "CONNECTION_AMBIGUOUS",
+				message: "Project Connector named connection matches multiple confirmed accounts."
+			}, 409);
+			const [account] = page.items;
+			return json({ account: account ? {
+				id: account.id.toString(),
+				projectId: account.projectId,
+				providerConfigId: account.providerConfigId,
+				externalUserId: account.externalUserId,
+				service: account.service,
+				connectionName: account.connectionName
+			} : null });
+		}
+	}),
+	defineRoute({
+		method: "GET",
+		path: "/accounts/:accountId/profile",
+		outputSchema: projectConnectorProfileSchema,
+		errorCodes: [
+			"UNAUTHENTICATED",
+			"ACCOUNT_NOT_FOUND",
+			"PROJECT_CONNECTOR_ERROR"
+		],
+		handler: async function({ headers, pathParams }, { json, error }) {
+			const externalUserId = await config.getExternalUserId(headers);
+			if (!externalUserId) return error({
+				code: "UNAUTHENTICATED",
+				message: "Authentication required"
+			}, 401);
+			const [account] = await this.handlerTx().retrieve(({ forSchema }) => forSchema(projectConnectorSchema).findFirst("connectedAccount", (b) => b.whereIndex("primary", (eb) => eb("id", "=", pathParams.accountId)))).execute();
+			if (!account || account.externalUserId !== externalUserId) return error({
+				code: "ACCOUNT_NOT_FOUND",
+				message: "Connected account not found"
+			}, 404);
+			try {
+				const profile = await deps.projectConnector.getProfile(account.id.toString());
+				if (profile.connectedAccountId !== account.id.toString() || profile.externalUserId !== externalUserId || profile.service !== account.service) throw new ProjectConnectorClientError("account_identity_mismatch", 502);
+				return json(profile);
+			} catch (cause) {
+				if (!(cause instanceof ProjectConnectorClientError)) throw cause;
+				return error({
+					code: "PROJECT_CONNECTOR_ERROR",
+					message: cause.message
+				}, 502);
+			}
+		}
+	}),
+	defineRoute({
+		method: "POST",
+		path: "/accounts/:accountId/actions/:actionId",
+		inputSchema: z.strictObject({ input: z.record(z.string(), z.unknown()) }),
+		outputSchema: projectConnectorExecutionSchema,
+		errorCodes: [
+			"UNAUTHENTICATED",
+			"ACCOUNT_NOT_FOUND",
+			"ACTION_SERVICE_MISMATCH",
+			"PROJECT_CONNECTOR_ERROR"
+		],
+		handler: async function({ headers, pathParams, input }, { json, error }) {
+			const externalUserId = await config.getExternalUserId(headers);
+			if (!externalUserId) return error({
+				code: "UNAUTHENTICATED",
+				message: "Authentication required"
+			}, 401);
+			const body = await input.valid();
+			const [account] = await this.handlerTx().retrieve(({ forSchema }) => forSchema(projectConnectorSchema).findFirst("connectedAccount", (b) => b.whereIndex("primary", (eb) => eb("id", "=", pathParams.accountId)))).execute();
+			if (!account || account.externalUserId !== externalUserId) return error({
+				code: "ACCOUNT_NOT_FOUND",
+				message: "Connected account not found"
+			}, 404);
+			if (!pathParams.actionId.startsWith(`${account.service}.`) || !/^[a-z0-9_-]+\.[a-z0-9_-]+$/.test(pathParams.actionId)) return error({
+				code: "ACTION_SERVICE_MISMATCH",
+				message: "Action must belong to the connected account service"
+			}, 400);
+			try {
+				return json(await deps.projectConnector.execute({
+					...account,
+					id: account.id.toString()
+				}, pathParams.actionId, body.input));
+			} catch (cause) {
+				if (!(cause instanceof ProjectConnectorClientError)) throw cause;
+				return error({
+					code: "PROJECT_CONNECTOR_ERROR",
+					message: cause.message
+				}, 502);
+			}
+		}
+	})
+]);
+//#endregion
+export { projectConnectorRoutes };
+
+//# sourceMappingURL=routes.js.map