@mycreat-labs/integrations-sdk 0.0.0-stage → 0.1.0

package/dist/providers/index.cjs

@@ -0,0 +1,1287 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/providers/index.ts
+var providers_exports = {};
+__export(providers_exports, {
+  NOTION_API_VERSION: () => NOTION_API_VERSION,
+  ProviderHttpError: () => ProviderHttpError,
+  RAINDROP_TOKEN_ENDPOINT: () => RAINDROP_TOKEN_ENDPOINT,
+  createAppleProvider: () => createAppleProvider,
+  createGitHubProvider: () => createGitHubProvider,
+  createGoogleProvider: () => createGoogleProvider,
+  createNotionClient: () => createNotionClient,
+  createNotionProvider: () => createNotionProvider,
+  createRaindropClient: () => createRaindropClient,
+  createRaindropProvider: () => createRaindropProvider,
+  notionRequest: () => notionRequest,
+  raindropRequest: () => raindropRequest,
+  validateNotionCreatePage: () => validateNotionCreatePage,
+  validateRaindropCreateBookmark: () => validateRaindropCreateBookmark
+});
+module.exports = __toCommonJS(providers_exports);
+
+// src/providers/identity.ts
+var import_jose = require("jose");
+var import_node_crypto = require("crypto");
+
+// src/errors.ts
+var IntegrationError = class extends Error {
+  constructor(code, disposition = "permanent_failure", retryAfterMs) {
+    super(code);
+    this.code = code;
+    this.disposition = disposition;
+    this.retryAfterMs = retryAfterMs;
+    this.name = "IntegrationError";
+  }
+  code;
+  disposition;
+  retryAfterMs;
+  sdkError = "@mycreat-labs/integrations-sdk/v1";
+};
+
+// src/providers/http.ts
+var ProviderHttpError = class extends IntegrationError {
+  status;
+  providerCode;
+  definite;
+  committedResourceId;
+  committedChildIds;
+  constructor(code, disposition, options = {}) {
+    super(code, disposition, options.retryAfterMs);
+    this.name = "ProviderHttpError";
+    this.status = options.status ?? null;
+    this.providerCode = options.providerCode;
+    this.definite = options.definite ?? false;
+    this.committedResourceId = options.committedResourceId;
+    this.committedChildIds = options.committedChildIds;
+  }
+};
+function record(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new IntegrationError("invalid_response");
+  return value;
+}
+function text(value, max = 4096) {
+  if (typeof value !== "string" || value.length === 0 || value.length > max)
+    throw new IntegrationError("invalid_response");
+  return value;
+}
+function optionalText(value, max = 4096) {
+  return value === void 0 || value === null ? void 0 : text(value, max);
+}
+function inputRecord(value, keys2) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new IntegrationError("invalid_input");
+  const input = value;
+  if (Object.keys(input).some((key) => !keys2.includes(key)))
+    throw new IntegrationError("invalid_input");
+  return input;
+}
+function inputText(value, maximum, required = true) {
+  if (value === void 0 && !required) return void 0;
+  if (typeof value !== "string" || required && !value.trim() || value.length > maximum)
+    throw new IntegrationError("invalid_input");
+  return value;
+}
+function webUrl(value) {
+  const result = inputText(value, 1e4);
+  try {
+    const url = new URL(result);
+    if (!["https:", "http:"].includes(url.protocol) || url.username || url.password)
+      throw new Error();
+  } catch {
+    throw new IntegrationError("invalid_input");
+  }
+  return result;
+}
+function jsonMetadata(value) {
+  if (value === void 0) return void 0;
+  const visit = (item, depth) => depth <= 10 && (item === null || typeof item === "string" || typeof item === "boolean" || typeof item === "number" && Number.isFinite(item) || Array.isArray(item) && item.every((child) => visit(child, depth + 1)) || typeof item === "object" && item !== null && Object.getPrototypeOf(item) === Object.prototype && Object.values(item).every((child) => visit(child, depth + 1)));
+  if (!visit(value, 0) || JSON.stringify(value).length > 16384)
+    throw new IntegrationError("invalid_input");
+  return value;
+}
+var safeCodes = /* @__PURE__ */ new Set([
+  "invalid_client",
+  "unauthorized_client",
+  "invalid_grant",
+  "bad_authorization_code",
+  "invalid_request",
+  "invalid_json",
+  "validation_error",
+  "restricted_resource",
+  "unauthorized",
+  "object_not_found",
+  "rate_limited",
+  "conflict_error",
+  "internal_server_error",
+  "service_unavailable",
+  "gateway_timeout",
+  "service_overload",
+  "row_limit_exceeded",
+  "invalid_token",
+  "bad_verification_code",
+  "incorrect_client_credentials",
+  "redirect_uri_mismatch",
+  "access_denied"
+]);
+var uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var isUuid = (value) => typeof value === "string" && uuid.test(value);
+function retryDelay(value) {
+  if (!value) return void 0;
+  const milliseconds = /^\d+(?:\.\d+)?$/.test(value) ? Number(value) * 1e3 : Date.parse(value) - Date.now();
+  return Number.isFinite(milliseconds) ? Math.max(0, Math.min(milliseconds, 864e5)) : void 0;
+}
+function failure(status, body, write, retryAfterMs) {
+  const payload = body && typeof body === "object" && !Array.isArray(body) ? body : {};
+  const vendorCode = typeof payload.code === "string" ? payload.code : typeof payload.error === "string" ? payload.error : void 0;
+  const providerCode = vendorCode && safeCodes.has(vendorCode) ? vendorCode : void 0;
+  const extra = payload.additional_data && typeof payload.additional_data === "object" ? payload.additional_data : {};
+  const committedResourceId = isUuid(extra.committed_resource_id) ? extra.committed_resource_id : void 0;
+  const committedChildIds = Array.isArray(extra.committed_child_ids) && extra.committed_child_ids.length <= 100 && extra.committed_child_ids.every(isUuid) ? extra.committed_child_ids : void 0;
+  const definite = status >= 400 && status < 500 && status !== 408 && !committedResourceId && !committedChildIds?.length;
+  let code = status === 401 ? "auth_required" : status === 404 ? "resource_unavailable" : status === 403 ? "permission_required" : status === 429 || status === 529 ? "rate_limited" : status >= 500 ? "upstream_unavailable" : "invalid_payload";
+  if (providerCode === "invalid_client" || providerCode === "unauthorized_client" || providerCode === "incorrect_client_credentials" || payload.errorMessage === "client_id or client_secret is invalid")
+    code = "application_unavailable";
+  else if (providerCode === "invalid_grant" || providerCode === "bad_authorization_code" || providerCode === "invalid_token" || providerCode === "bad_verification_code")
+    code = "auth_required";
+  else if (extra.rate_limit_reason === "public_api_request_blocked")
+    code = "access_restricted";
+  else if (status === 403 && providerCode === "restricted_resource")
+    code = "resource_unavailable";
+  else if (status === 403 && typeof payload.message === "string" && /block.*limit|limit.*block/i.test(payload.message))
+    code = "workspace_capacity";
+  const disposition = code === "auth_required" ? "requires_reauth" : write && !definite ? "outcome_unknown" : code === "rate_limited" || status >= 500 || status === 408 ? "retryable" : "permanent_failure";
+  return new ProviderHttpError(code, disposition, {
+    status,
+    providerCode,
+    definite,
+    retryAfterMs,
+    committedResourceId,
+    committedChildIds
+  });
+}
+async function requestJson(url, init, fetcher, options = {}) {
+  const write = options.write ?? !["GET", "HEAD"].includes(init.method ?? "GET");
+  const signal = init.signal ? AbortSignal.any([init.signal, AbortSignal.timeout(3e4)]) : AbortSignal.timeout(3e4);
+  let response;
+  try {
+    response = await fetcher(url, { ...init, signal, redirect: "error" });
+  } catch (error) {
+    if (error instanceof Error && "sdkError" in error && error.sdkError === "@mycreat-labs/integrations-sdk/v1" && "code" in error && error.code === "rate_limited" && "definite" in error && error.definite === true) {
+      const delay = "retryAfterMs" in error && typeof error.retryAfterMs === "number" && Number.isFinite(error.retryAfterMs) ? Math.max(0, Math.min(error.retryAfterMs, 864e5)) : void 0;
+      throw new ProviderHttpError("rate_limited", "retryable", {
+        status: 429,
+        definite: true,
+        retryAfterMs: delay
+      });
+    }
+    throw new ProviderHttpError(
+      "upstream_unavailable",
+      write ? "outcome_unknown" : "retryable"
+    );
+  }
+  if (response.status === 204 && response.ok) return {};
+  let body;
+  try {
+    if (options.requireJson && !response.headers.get("content-type")?.toLowerCase().includes("json"))
+      throw new Error();
+    if (!response.body) throw new Error();
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+      for (; ; ) {
+        const part = await reader.read();
+        if (part.done) break;
+        size += part.value.length;
+        if (size > 2097152) {
+          await reader.cancel();
+          throw new Error();
+        }
+        chunks.push(part.value);
+      }
+    } finally {
+      reader.releaseLock();
+    }
+    body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+  } catch {
+    if (!response.ok)
+      throw failure(
+        response.status,
+        {},
+        write,
+        retryDelay(response.headers.get("retry-after"))
+      );
+    throw new ProviderHttpError(
+      "invalid_response",
+      write ? "outcome_unknown" : "retryable",
+      { status: response.status }
+    );
+  }
+  if (!response.ok)
+    throw failure(
+      response.status,
+      body,
+      write,
+      retryDelay(response.headers.get("retry-after"))
+    );
+  if (body && typeof body === "object" && !Array.isArray(body)) {
+    const value = body;
+    if (typeof value.error === "string" || options.raindrop && value.result === false) {
+      const status = typeof value.status === "number" && Number.isInteger(value.status) && value.status >= 400 && value.status < 600 ? value.status : 400;
+      throw failure(
+        status,
+        body,
+        write,
+        retryDelay(response.headers.get("retry-after"))
+      );
+    }
+  }
+  return body;
+}
+function providerPath(path, prefix) {
+  if (path.length > 4096 || !/^\/[a-zA-Z0-9_/-]+(?:\?[a-zA-Z0-9_%=&.~-]+)?$/.test(path) || path.includes("//") || path.includes(".."))
+    throw new ProviderHttpError("invalid_upstream_path", "permanent_failure", {
+      status: 400,
+      definite: true
+    });
+  return path.startsWith(`${prefix}/`) || path === prefix ? path : `${prefix}${path}`;
+}
+function notionRequest(path, options) {
+  const normalized = providerPath(path, "/v1");
+  if (!options.accessToken && (!options.clientId || !options.clientSecret))
+    throw new ProviderHttpError(
+      "application_unavailable",
+      "permanent_failure",
+      { definite: true }
+    );
+  const authorization = options.accessToken ? `Bearer ${options.accessToken}` : `Basic ${Buffer.from(`${options.clientId}:${options.clientSecret}`).toString("base64")}`;
+  return requestJson(
+    `https://api.notion.com${normalized}`,
+    {
+      method: options.method ?? (options.body === void 0 ? "GET" : "POST"),
+      headers: {
+        "Notion-Version": options.apiVersion ?? "2026-03-11",
+        "Content-Type": "application/json",
+        Accept: "application/json",
+        Authorization: authorization
+      },
+      ...options.body === void 0 ? {} : { body: JSON.stringify(options.body) },
+      ...options.signal ? { signal: options.signal } : {}
+    },
+    options.fetch ?? globalThis.fetch,
+    {
+      write: normalized !== "/v1/search" && (options.method ?? (options.body === void 0 ? "GET" : "POST")) !== "GET"
+    }
+  );
+}
+function raindropRequest(path, options) {
+  const normalized = path === "/v1/oauth/access_token" ? path : providerPath(path, "/rest/v1");
+  if (normalized !== "/v1/oauth/access_token" && !options.accessToken)
+    throw new ProviderHttpError("auth_required", "requires_reauth", {
+      status: 401,
+      definite: true
+    });
+  return requestJson(
+    `https://api.raindrop.io${normalized}`,
+    {
+      method: options.method ?? (options.body === void 0 ? "GET" : "POST"),
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json",
+        ...options.accessToken ? { Authorization: `Bearer ${options.accessToken}` } : {}
+      },
+      ...options.body === void 0 ? {} : { body: JSON.stringify(options.body) },
+      ...options.signal ? { signal: options.signal } : {}
+    },
+    options.fetch ?? globalThis.fetch,
+    { raindrop: true, requireJson: true }
+  );
+}
+
+// src/providers/identity.ts
+function configure(config) {
+  if (!config.registrationId || !config.clientId || !config.redirectUri || config.identityNamespace === "")
+    throw new IntegrationError("invalid_provider_configuration");
+  let url;
+  try {
+    url = new URL(config.redirectUri);
+  } catch {
+    throw new IntegrationError("invalid_provider_configuration");
+  }
+  if (url.username || url.password || url.hash || url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)))
+    throw new IntegrationError("invalid_provider_configuration");
+}
+function identityPurpose(purpose) {
+  if (purpose !== "identity") throw new IntegrationError("unsupported_purpose");
+}
+function authorizationURL(base, parameters) {
+  const url = new URL(base);
+  for (const [key, value] of Object.entries(parameters))
+    url.searchParams.set(key, value);
+  return url.toString();
+}
+var keyCaches = /* @__PURE__ */ new WeakMap();
+var keyLoads = /* @__PURE__ */ new WeakMap();
+async function keys(url, fetcher, force = false) {
+  let cache = keyCaches.get(fetcher);
+  if (!cache) {
+    cache = /* @__PURE__ */ new Map();
+    keyCaches.set(fetcher, cache);
+  }
+  const existing = cache.get(url);
+  if (!force && existing && existing.expires > Date.now())
+    return existing.resolve;
+  if (force && existing && existing.refreshedAt + 3e4 > Date.now())
+    return existing.resolve;
+  let loads = keyLoads.get(fetcher);
+  if (!loads) {
+    loads = /* @__PURE__ */ new Map();
+    keyLoads.set(fetcher, loads);
+  }
+  const pending = loads.get(url);
+  if (pending) return pending;
+  const load = (async () => {
+    try {
+      const value = record(await requestJson(url, {}, fetcher));
+      if (!Array.isArray(value.keys) || value.keys.length > 100)
+        throw new Error();
+      const resolve = (0, import_jose.createLocalJWKSet)(value);
+      const now = Date.now();
+      cache.set(url, { expires: now + 3e5, refreshedAt: now, resolve });
+      return resolve;
+    } catch {
+      throw new IntegrationError("identity_unavailable", "retryable");
+    }
+  })();
+  loads.set(url, load);
+  try {
+    return await load;
+  } finally {
+    loads.delete(url);
+  }
+}
+async function verifyToken(input, config, fetcher, options) {
+  if (!input.nonce || input.nonce.length > 1024 || !input.idToken || input.idToken.length > 32768 || !options.audiences.length || options.audiences.some((item) => !item))
+    throw new IntegrationError("invalid_identity");
+  const google = options.provider === "google";
+  const issuer = google ? "https://accounts.google.com" : "https://appleid.apple.com";
+  const jwks = google ? "https://www.googleapis.com/oauth2/v3/certs" : "https://appleid.apple.com/auth/keys";
+  const verificationOptions = {
+    algorithms: ["RS256"],
+    issuer: google ? [issuer, "accounts.google.com"] : issuer,
+    audience: [...options.audiences],
+    requiredClaims: ["sub", "exp", "iat", "nonce"],
+    clockTolerance: 30
+  };
+  let payload;
+  try {
+    let resolve = await keys(jwks, fetcher);
+    try {
+      ({ payload } = await (0, import_jose.jwtVerify)(
+        input.idToken,
+        resolve,
+        verificationOptions
+      ));
+    } catch (error) {
+      if (!(error && typeof error === "object" && "code" in error && error.code === "ERR_JWKS_NO_MATCHING_KEY"))
+        throw error;
+      resolve = await keys(jwks, fetcher, true);
+      ({ payload } = await (0, import_jose.jwtVerify)(
+        input.idToken,
+        resolve,
+        verificationOptions
+      ));
+    }
+    const expected = Buffer.from(input.nonce);
+    const actual = Buffer.from(
+      typeof payload.nonce === "string" ? payload.nonce : ""
+    );
+    if (expected.length !== actual.length || !(0, import_node_crypto.timingSafeEqual)(expected, actual) || typeof payload.iat !== "number" || payload.iat > Date.now() / 1e3 + 30 || typeof payload.sub !== "string" || !payload.sub || payload.sub.length > 255)
+      throw new Error();
+    if (Array.isArray(payload.aud) && payload.aud.length > 1 && (typeof payload.azp !== "string" || !options.audiences.includes(payload.azp)))
+      throw new Error();
+  } catch (error) {
+    if (error instanceof IntegrationError && (error.disposition === "retryable" || error.disposition === "outcome_unknown"))
+      throw new IntegrationError("identity_unavailable", "retryable");
+    throw new IntegrationError("invalid_identity");
+  }
+  const email = optionalText(payload.email, 320);
+  const name = optionalText(payload.name, 1024);
+  return {
+    provider: options.provider,
+    issuer,
+    subject: payload.sub,
+    identityNamespace: config.identityNamespace ?? config.registrationId,
+    emailVerified: payload.email_verified === true || options.provider === "apple" && payload.email_verified === "true",
+    ...email ? { email } : {},
+    ...name ? { name } : {}
+  };
+}
+function createGoogleProvider(config) {
+  configure(config);
+  return {
+    key: "google",
+    registrationId: config.registrationId,
+    purposes: ["identity"],
+    authorization: {
+      url(input) {
+        identityPurpose(input.purpose);
+        return authorizationURL(
+          "https://accounts.google.com/o/oauth2/v2/auth",
+          {
+            client_id: config.clientId,
+            redirect_uri: config.redirectUri,
+            response_type: "code",
+            scope: "openid email profile",
+            state: input.state,
+            nonce: input.nonce,
+            code_challenge: input.challenge,
+            code_challenge_method: "S256"
+          }
+        );
+      },
+      async exchange(input, fetcher) {
+        identityPurpose(input.purpose);
+        if (!config.clientSecret)
+          throw new IntegrationError("application_unavailable");
+        const tokens = record(
+          await requestJson(
+            "https://oauth2.googleapis.com/token",
+            {
+              method: "POST",
+              headers: {
+                "Content-Type": "application/x-www-form-urlencoded",
+                Accept: "application/json"
+              },
+              body: new URLSearchParams({
+                client_id: config.clientId,
+                client_secret: config.clientSecret,
+                redirect_uri: config.redirectUri,
+                grant_type: "authorization_code",
+                code: input.code,
+                code_verifier: input.verifier
+              }),
+              ...input.signal ? { signal: input.signal } : {}
+            },
+            fetcher
+          )
+        );
+        const identity = await verifyToken(
+          { idToken: text(tokens.id_token, 32768), nonce: input.nonce },
+          config,
+          fetcher,
+          { provider: "google", audiences: [config.clientId] }
+        );
+        return { identity };
+      }
+    },
+    verifyNative(input, fetcher) {
+      return verifyToken(input, config, fetcher, {
+        provider: "google",
+        audiences: config.nativeClientIds ?? [config.clientId]
+      });
+    }
+  };
+}
+function createAppleProvider(config) {
+  configure(config);
+  async function clientSecret() {
+    if (!config.teamId || !config.keyId || !config.privateKey)
+      throw new IntegrationError("application_unavailable");
+    try {
+      const key = await (0, import_jose.importPKCS8)(config.privateKey, "ES256");
+      return await new import_jose.SignJWT({}).setProtectedHeader({ alg: "ES256", kid: config.keyId }).setIssuer(config.teamId).setSubject(config.clientId).setAudience("https://appleid.apple.com").setIssuedAt().setExpirationTime("5m").sign(key);
+    } catch {
+      throw new IntegrationError("application_unavailable");
+    }
+  }
+  return {
+    key: "apple",
+    registrationId: config.registrationId,
+    purposes: ["identity"],
+    authorization: {
+      url(input) {
+        identityPurpose(input.purpose);
+        return authorizationURL("https://appleid.apple.com/auth/authorize", {
+          client_id: config.clientId,
+          redirect_uri: config.redirectUri,
+          response_type: "code",
+          response_mode: "form_post",
+          scope: "name email",
+          state: input.state,
+          nonce: input.nonce
+        });
+      },
+      async exchange(input, fetcher) {
+        identityPurpose(input.purpose);
+        const result = record(
+          await requestJson(
+            "https://appleid.apple.com/auth/token",
+            {
+              method: "POST",
+              headers: {
+                "Content-Type": "application/x-www-form-urlencoded",
+                Accept: "application/json"
+              },
+              body: new URLSearchParams({
+                client_id: config.clientId,
+                client_secret: await clientSecret(),
+                redirect_uri: config.redirectUri,
+                grant_type: "authorization_code",
+                code: input.code
+              }),
+              ...input.signal ? { signal: input.signal } : {}
+            },
+            fetcher
+          )
+        );
+        return {
+          identity: await verifyToken(
+            { idToken: text(result.id_token, 32768), nonce: input.nonce },
+            config,
+            fetcher,
+            { provider: "apple", audiences: [config.clientId] }
+          )
+        };
+      }
+    },
+    // nonce is the actual expected token nonce; a native host using SHA256 supplies that hash.
+    verifyNative(input, fetcher) {
+      return verifyToken(input, config, fetcher, {
+        provider: "apple",
+        audiences: config.nativeClientIds ?? [config.clientId]
+      });
+    }
+  };
+}
+function createGitHubProvider(config) {
+  configure(config);
+  if (!config.clientSecret)
+    throw new IntegrationError("invalid_provider_configuration");
+  return {
+    key: "github",
+    registrationId: config.registrationId,
+    purposes: ["identity"],
+    authorization: {
+      url(input) {
+        identityPurpose(input.purpose);
+        return authorizationURL("https://github.com/login/oauth/authorize", {
+          client_id: config.clientId,
+          redirect_uri: config.redirectUri,
+          scope: "read:user user:email",
+          state: input.state,
+          code_challenge: input.challenge,
+          code_challenge_method: "S256"
+        });
+      },
+      async exchange(input, fetcher) {
+        identityPurpose(input.purpose);
+        const tokens = record(
+          await requestJson(
+            "https://github.com/login/oauth/access_token",
+            {
+              method: "POST",
+              headers: {
+                Accept: "application/json",
+                "Content-Type": "application/x-www-form-urlencoded"
+              },
+              body: new URLSearchParams({
+                client_id: config.clientId,
+                client_secret: config.clientSecret,
+                redirect_uri: config.redirectUri,
+                code: input.code,
+                code_verifier: input.verifier
+              }),
+              ...input.signal ? { signal: input.signal } : {}
+            },
+            fetcher
+          )
+        );
+        const accessToken = text(tokens.access_token);
+        const headers = {
+          Accept: "application/vnd.github+json",
+          Authorization: `Bearer ${accessToken}`,
+          "X-GitHub-Api-Version": "2026-03-10",
+          "User-Agent": "mycreat-labs-integrations-sdk"
+        };
+        const user = record(
+          await requestJson(
+            "https://api.github.com/user",
+            { headers, ...input.signal ? { signal: input.signal } : {} },
+            fetcher
+          )
+        );
+        if (!Number.isSafeInteger(user.id) || Number(user.id) <= 0)
+          throw new IntegrationError("invalid_identity");
+        const emails = await requestJson(
+          "https://api.github.com/user/emails?per_page=100",
+          { headers, ...input.signal ? { signal: input.signal } : {} },
+          fetcher
+        );
+        if (!Array.isArray(emails) || emails.length > 100)
+          throw new IntegrationError("invalid_identity");
+        const primary = emails.find(
+          (item) => item && typeof item === "object" && item.primary === true && item.verified === true
+        );
+        const email = primary ? text(primary.email, 320) : void 0;
+        const name = optionalText(user.name, 1024);
+        const username = text(user.login, 255);
+        return {
+          identity: {
+            provider: "github",
+            issuer: "https://github.com",
+            subject: String(user.id),
+            identityNamespace: config.identityNamespace ?? config.registrationId,
+            emailVerified: Boolean(email),
+            username,
+            ...email ? { email } : {},
+            ...name ? { name } : {}
+          }
+        };
+      }
+    }
+  };
+}
+
+// src/providers/notion.ts
+var NOTION_API_VERSION = "2026-03-11";
+function uuid2(value) {
+  if (!isUuid(value)) throw new IntegrationError("invalid_input");
+  return value;
+}
+var validCursor = (value) => typeof value === "string" && value.length > 0 && value.length <= 4096;
+function validateNotionCreatePage(value) {
+  const input = inputRecord(value, [
+    "parentId",
+    "parentType",
+    "title",
+    "content",
+    "url",
+    "metadata"
+  ]);
+  const result = {
+    parentId: uuid2(input.parentId),
+    title: inputText(input.title, 2e3)
+  };
+  if (input.parentType !== void 0) {
+    if (input.parentType !== "page" && input.parentType !== "data_source")
+      throw new IntegrationError("invalid_input");
+    result.parentType = input.parentType;
+  }
+  if (input.content !== void 0)
+    result.content = inputText(input.content, 1e5, false);
+  if (input.url !== void 0) result.url = webUrl(input.url);
+  if (input.metadata !== void 0) {
+    const metadata = jsonMetadata(input.metadata);
+    if (!metadata || Array.isArray(metadata) || typeof metadata !== "object")
+      throw new IntegrationError("invalid_input");
+    result.metadata = metadata;
+  }
+  return result;
+}
+function richText(value) {
+  const result = [];
+  for (let index = 0; index < value.length; ) {
+    let end = Math.min(index + 2e3, value.length);
+    if (end < value.length && /[\uD800-\uDBFF]/.test(value.charAt(end - 1)))
+      end--;
+    result.push({ type: "text", text: { content: value.slice(index, end) } });
+    index = end;
+  }
+  return result;
+}
+function resourceTitle(value) {
+  if (!Array.isArray(value)) throw new IntegrationError("invalid_response");
+  return value.map((item) => {
+    const piece = record(item);
+    if (typeof piece.plain_text === "string") return piece.plain_text;
+    return text(record(piece.text).content, 2e3);
+  }).join("");
+}
+function pageResult(value) {
+  try {
+    const page = record(value);
+    if (page.object !== "page" || !isUuid(page.id)) throw new Error();
+    const url = text(page.url, 4096);
+    if (new URL(url).protocol !== "https:") throw new Error();
+    return { id: page.id, url };
+  } catch {
+    throw new IntegrationError("invalid_response", "outcome_unknown");
+  }
+}
+function createNotionClient(config) {
+  if (!config.accessToken)
+    throw new IntegrationError("auth_required", "requires_reauth");
+  const request = (path, options = {}) => notionRequest(path, { ...config, ...options });
+  async function listResources(input = {}) {
+    if (input.parentId !== void 0)
+      throw new IntegrationError("unsupported_resource_filter");
+    if (input.cursor !== void 0 && !validCursor(input.cursor))
+      throw new IntegrationError("invalid_input");
+    if (input.query !== void 0) inputText(input.query, 1e3, false);
+    const response = record(
+      await request("/search", {
+        body: {
+          page_size: 100,
+          ...input.cursor ? { start_cursor: input.cursor } : {},
+          ...input.query !== void 0 ? { query: input.query } : {}
+        }
+      })
+    );
+    if (!Array.isArray(response.results) || response.results.length > 100 || typeof response.has_more !== "boolean")
+      throw new IntegrationError("invalid_response");
+    if (response.request_status !== void 0 && record(response.request_status).type !== "complete")
+      throw new IntegrationError("resource_listing_incomplete");
+    if (response.has_more && !validCursor(response.next_cursor))
+      throw new IntegrationError("invalid_response");
+    const items = [];
+    for (const item of response.results) {
+      const entry = record(item);
+      if (!isUuid(entry.id) || entry.object !== "page" && entry.object !== "data_source")
+        throw new IntegrationError("invalid_response");
+      if (entry.in_trash === true || entry.archived === true || entry.is_archived === true)
+        continue;
+      let name;
+      if (entry.object === "data_source") name = resourceTitle(entry.title);
+      else {
+        const properties = record(entry.properties);
+        const title = Object.values(properties).map(record).find((property) => property.type === "title");
+        name = title ? resourceTitle(title.title) : "";
+      }
+      const url = optionalText(entry.url);
+      items.push({
+        id: entry.id,
+        type: entry.object,
+        name: name || "Untitled",
+        ...url ? { url } : {}
+      });
+    }
+    return {
+      items,
+      ...response.has_more ? { nextCursor: response.next_cursor } : {}
+    };
+  }
+  async function createPage(value) {
+    const input = validateNotionCreatePage(value);
+    const parentType = input.parentType ?? "page";
+    let titleKey = "title";
+    if (parentType === "data_source") {
+      const source = record(await request(`/data_sources/${input.parentId}`));
+      if (source.id !== input.parentId || source.object !== "data_source")
+        throw new IntegrationError("invalid_response");
+      const property = Object.entries(record(source.properties)).find(
+        ([, definition]) => record(definition).type === "title"
+      );
+      if (!property) throw new IntegrationError("invalid_resource");
+      titleKey = property[0];
+    }
+    const children = [];
+    if (input.content) {
+      for (const part of richText(input.content))
+        children.push({
+          object: "block",
+          type: "paragraph",
+          paragraph: { rich_text: [part] }
+        });
+    }
+    if (input.url)
+      children.push({
+        object: "block",
+        type: "bookmark",
+        bookmark: { url: input.url }
+      });
+    return pageResult(
+      await request("/pages", {
+        body: {
+          parent: parentType === "page" ? { page_id: input.parentId } : { data_source_id: input.parentId },
+          properties: {
+            [titleKey]: { type: "title", title: richText(input.title) }
+          },
+          ...children.length ? { children } : {}
+        }
+      })
+    );
+  }
+  return { request, listResources, resources: listResources, createPage };
+}
+function tokenCredentials(value, previous) {
+  try {
+    const response = record(value);
+    const accessToken = text(response.access_token, 8192);
+    const refreshToken = text(response.refresh_token, 8192);
+    if (typeof response.token_type !== "string" || response.token_type.toLowerCase() !== "bearer")
+      throw new Error();
+    const expires = response.expires_in;
+    if (expires !== void 0 && (typeof expires !== "number" || !Number.isInteger(expires) || expires <= 0 || expires > 31536e3))
+      throw new Error();
+    return {
+      accessToken,
+      refreshToken,
+      ...expires !== void 0 ? { expiresAt: Date.now() + Number(expires) * 1e3 } : {},
+      ...previous?.scopes ? { scopes: previous.scopes } : {},
+      ...previous?.extra ? { extra: previous.extra } : {}
+    };
+  } catch {
+    throw new IntegrationError("invalid_response", "outcome_unknown");
+  }
+}
+function createNotionProvider(config) {
+  if (!config.registrationId || !config.clientId || !config.clientSecret || !config.redirectUri)
+    throw new IntegrationError("invalid_provider_configuration");
+  const tokenRequest = (body, fetcher, signal) => notionRequest("/oauth/token", {
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    apiVersion: config.apiVersion,
+    body,
+    fetch: fetcher,
+    ...signal ? { signal } : {}
+  });
+  return {
+    key: "notion",
+    registrationId: config.registrationId,
+    purposes: ["connect"],
+    authorization: {
+      url(input) {
+        if (input.purpose !== "connect")
+          throw new IntegrationError("unsupported_purpose");
+        const url = new URL("https://api.notion.com/v1/oauth/authorize");
+        url.search = new URLSearchParams({
+          client_id: config.clientId,
+          redirect_uri: config.redirectUri,
+          response_type: "code",
+          owner: "user",
+          state: input.state
+        }).toString();
+        return url.toString();
+      },
+      async exchange(input, fetcher) {
+        if (input.purpose !== "connect")
+          throw new IntegrationError("unsupported_purpose");
+        const response = record(
+          await tokenRequest(
+            {
+              grant_type: "authorization_code",
+              code: input.code,
+              redirect_uri: config.redirectUri
+            },
+            fetcher,
+            input.signal
+          )
+        );
+        const credentials = tokenCredentials(response);
+        const workspaceId = text(response.workspace_id);
+        const botId = text(response.bot_id);
+        if (!isUuid(workspaceId) || !isUuid(botId))
+          throw new IntegrationError("invalid_response", "outcome_unknown");
+        const owner = record(response.owner);
+        if (owner.type !== "user")
+          throw new IntegrationError("invalid_response");
+        const userId = text(record(owner.user).id);
+        if (!isUuid(userId)) throw new IntegrationError("invalid_response");
+        const label = optionalText(response.workspace_name) ?? "Notion workspace";
+        credentials.extra = { workspaceId, botId, ownerId: userId };
+        return {
+          credentials,
+          account: {
+            id: `${workspaceId}:${botId}:${userId}`,
+            label,
+            metadata: { workspaceId, botId, ownerId: userId }
+          }
+        };
+      }
+    },
+    resources(input, context) {
+      return createNotionClient({
+        accessToken: context.credentials.accessToken,
+        fetch: context.fetch,
+        signal: context.signal,
+        apiVersion: config.apiVersion
+      }).listResources(input);
+    },
+    async refresh(credentials, context) {
+      if (!credentials.refreshToken)
+        throw new IntegrationError("auth_required", "requires_reauth");
+      return tokenCredentials(
+        await tokenRequest(
+          {
+            grant_type: "refresh_token",
+            refresh_token: credentials.refreshToken
+          },
+          context.fetch,
+          context.signal
+        ),
+        credentials
+      );
+    },
+    async revoke(credentials, context) {
+      await notionRequest("/oauth/revoke", {
+        clientId: config.clientId,
+        clientSecret: config.clientSecret,
+        apiVersion: config.apiVersion,
+        body: { token: credentials.accessToken },
+        fetch: context.fetch,
+        signal: context.signal
+      });
+    },
+    actions: {
+      create_page: {
+        validate(value) {
+          return validateNotionCreatePage(value);
+        },
+        async execute(value, context) {
+          const checkpoint = context.checkpoint && typeof context.checkpoint === "object" && !Array.isArray(context.checkpoint) ? context.checkpoint : {};
+          if (typeof checkpoint.id === "string" && typeof checkpoint.url === "string")
+            return { id: checkpoint.id, url: checkpoint.url };
+          const result = await createNotionClient({
+            accessToken: context.credentials.accessToken,
+            fetch: context.fetch,
+            signal: context.signal,
+            apiVersion: config.apiVersion
+          }).createPage(value);
+          await context.saveCheckpoint(result);
+          return result;
+        },
+        async reconcile(_value, context) {
+          const checkpoint = context.checkpoint && typeof context.checkpoint === "object" && !Array.isArray(context.checkpoint) ? context.checkpoint : {};
+          if (!isUuid(checkpoint.id)) return { resolved: false };
+          const result = pageResult(
+            await notionRequest(`/pages/${checkpoint.id}`, {
+              accessToken: context.credentials.accessToken,
+              fetch: context.fetch,
+              signal: context.signal,
+              apiVersion: config.apiVersion
+            })
+          );
+          if (result.id !== checkpoint.id)
+            throw new IntegrationError("invalid_response");
+          return { resolved: true, result };
+        }
+      }
+    }
+  };
+}
+
+// src/providers/raindrop.ts
+var RAINDROP_TOKEN_ENDPOINT = "https://api.raindrop.io/v1/oauth/access_token";
+function collectionId(value) {
+  if (!Number.isSafeInteger(value) || Number(value) !== -1 && Number(value) <= 0)
+    throw new IntegrationError("invalid_input");
+  return value;
+}
+function validateRaindropCreateBookmark(value) {
+  const input = inputRecord(value, [
+    "collectionId",
+    "url",
+    "title",
+    "note",
+    "excerpt",
+    "tags",
+    "metadata"
+  ]);
+  const result = { url: webUrl(input.url) };
+  if (input.collectionId !== void 0)
+    result.collectionId = collectionId(input.collectionId);
+  if (input.title !== void 0)
+    result.title = inputText(input.title, 1e4, false);
+  if (input.note !== void 0)
+    result.note = inputText(input.note, 1e5, false);
+  if (input.excerpt !== void 0)
+    result.excerpt = inputText(input.excerpt, 1e4, false);
+  if (input.tags !== void 0) {
+    if (!Array.isArray(input.tags) || input.tags.length > 100 || input.tags.some(
+      (tag) => typeof tag !== "string" || !tag.trim() || tag.length > 255
+    ))
+      throw new IntegrationError("invalid_input");
+    result.tags = [...new Set(input.tags)];
+  }
+  if (input.metadata !== void 0) {
+    const metadata = jsonMetadata(input.metadata);
+    if (!metadata || Array.isArray(metadata) || typeof metadata !== "object")
+      throw new IntegrationError("invalid_input");
+    result.metadata = metadata;
+  }
+  return result;
+}
+function bookmarkResult(value, input) {
+  try {
+    const response = record(value);
+    if (response.result !== true) throw new Error();
+    const item = record(response.item);
+    if (!Number.isSafeInteger(item._id) || Number(item._id) <= 0)
+      throw new Error();
+    const destination = collectionId(record(item.collection).$id);
+    const link = text(item.link, 1e4);
+    if (input && (new URL(link).toString() !== new URL(input.url).toString() || destination !== (input.collectionId ?? -1)))
+      throw new Error();
+    return {
+      id: String(item._id),
+      collectionId: destination,
+      url: `https://app.raindrop.io/my/${destination}/item/${item._id}`
+    };
+  } catch {
+    throw new IntegrationError("invalid_response", "outcome_unknown");
+  }
+}
+function createRaindropClient(config) {
+  if (!config.accessToken)
+    throw new IntegrationError("auth_required", "requires_reauth");
+  const request = (path, options = {}) => raindropRequest(path, { ...config, ...options });
+  async function listCollections(input = {}) {
+    if (input.cursor !== void 0) throw new IntegrationError("invalid_input");
+    if (input.query !== void 0) inputText(input.query, 1e3, false);
+    if (input.parentId !== void 0 && !/^[1-9][0-9]*$/.test(input.parentId))
+      throw new IntegrationError("invalid_input");
+    const pages = await Promise.all([
+      request("/collections"),
+      request("/collections/childrens")
+    ]);
+    const resources = /* @__PURE__ */ new Map();
+    resources.set("-1", { id: "-1", type: "collection", name: "Unsorted" });
+    for (const value of pages) {
+      const response = record(value);
+      if (response.result !== true || !Array.isArray(response.items) || response.items.length > 1e4)
+        throw new IntegrationError("invalid_response");
+      for (const value2 of response.items) {
+        const item = record(value2);
+        if (!Number.isSafeInteger(item._id) || Number(item._id) <= 0)
+          throw new IntegrationError("invalid_response");
+        const level = record(item.access).level;
+        if (!Number.isInteger(level) || Number(level) < 1 || Number(level) > 4)
+          throw new IntegrationError("invalid_response");
+        if (Number(level) < 3) continue;
+        let parentId;
+        if (item.parent !== void 0 && item.parent !== null) {
+          const parent = record(item.parent);
+          const id = parent.$id ?? parent._id;
+          if (!Number.isSafeInteger(id) || Number(id) <= 0)
+            throw new IntegrationError("invalid_response");
+          parentId = String(id);
+        }
+        resources.set(String(item._id), {
+          id: String(item._id),
+          type: "collection",
+          name: text(item.title),
+          metadata: {
+            accessLevel: Number(level),
+            ...parentId ? { parentId } : {}
+          }
+        });
+      }
+    }
+    return {
+      items: [...resources.values()].filter(
+        (item) => (!input.parentId || item.metadata?.parentId === input.parentId) && (!input.query || item.name.toLocaleLowerCase().includes(input.query.toLocaleLowerCase()))
+      )
+    };
+  }
+  async function createBookmark(value) {
+    const input = validateRaindropCreateBookmark(value);
+    const id = input.collectionId ?? -1;
+    if (id !== -1) {
+      const response = record(await request(`/collection/${id}`));
+      const item = record(response.item);
+      if (response.result !== true || item._id !== id)
+        throw new IntegrationError("invalid_response");
+      const level = record(item.access).level;
+      if (level !== 3 && level !== 4)
+        throw new IntegrationError("permission_required");
+    }
+    const payload = {
+      link: input.url,
+      collection: { $id: id },
+      ...input.title !== void 0 ? { title: input.title } : {},
+      ...input.note !== void 0 ? { note: input.note } : {},
+      ...input.excerpt !== void 0 ? { excerpt: input.excerpt } : {},
+      ...input.tags ? { tags: input.tags } : {}
+    };
+    return bookmarkResult(await request("/raindrop", { body: payload }), input);
+  }
+  return {
+    request,
+    listCollections,
+    resources: listCollections,
+    createBookmark
+  };
+}
+function tokenCredentials2(value, previous) {
+  try {
+    const response = record(value);
+    const accessToken = text(response.access_token, 8192);
+    const refreshToken = text(response.refresh_token, 8192);
+    const expires = response.expires_in;
+    if (typeof response.token_type !== "string" || response.token_type.toLowerCase() !== "bearer" || typeof expires !== "number" || !Number.isInteger(expires) || expires <= 0 || expires > 31536e3)
+      throw new Error();
+    return {
+      accessToken,
+      refreshToken,
+      expiresAt: Date.now() + expires * 1e3,
+      ...previous?.extra ? { extra: previous.extra } : {}
+    };
+  } catch {
+    throw new IntegrationError("invalid_response", "outcome_unknown");
+  }
+}
+function createRaindropProvider(config) {
+  if (!config.registrationId || !config.clientId || !config.clientSecret || !config.redirectUri)
+    throw new IntegrationError("invalid_provider_configuration");
+  const tokenRequest = (body, fetcher, signal) => raindropRequest("/v1/oauth/access_token", {
+    body: {
+      client_id: config.clientId,
+      client_secret: config.clientSecret,
+      ...body
+    },
+    fetch: fetcher,
+    ...signal ? { signal } : {}
+  });
+  return {
+    key: "raindrop",
+    registrationId: config.registrationId,
+    purposes: ["connect"],
+    authorization: {
+      url(input) {
+        if (input.purpose !== "connect")
+          throw new IntegrationError("unsupported_purpose");
+        const url = new URL("https://raindrop.io/oauth/authorize");
+        url.search = new URLSearchParams({
+          client_id: config.clientId,
+          redirect_uri: config.redirectUri,
+          response_type: "code",
+          state: input.state
+        }).toString();
+        return url.toString();
+      },
+      async exchange(input, fetcher) {
+        if (input.purpose !== "connect")
+          throw new IntegrationError("unsupported_purpose");
+        const credentials = tokenCredentials2(
+          await tokenRequest(
+            {
+              grant_type: "authorization_code",
+              code: input.code,
+              redirect_uri: config.redirectUri
+            },
+            fetcher,
+            input.signal
+          )
+        );
+        const response = record(
+          await raindropRequest("/user", {
+            accessToken: credentials.accessToken,
+            fetch: fetcher,
+            signal: input.signal
+          })
+        );
+        const user = record(response.user);
+        if (response.result !== true || !Number.isSafeInteger(user._id) || Number(user._id) <= 0)
+          throw new IntegrationError("invalid_response");
+        const id = String(user._id);
+        return {
+          credentials,
+          account: {
+            id,
+            label: optionalText(user.fullName) ?? `Raindrop ${id}`
+          }
+        };
+      }
+    },
+    resources(input, context) {
+      return createRaindropClient({
+        accessToken: context.credentials.accessToken,
+        fetch: context.fetch,
+        signal: context.signal
+      }).listCollections(input);
+    },
+    async refresh(credentials, context) {
+      if (!credentials.refreshToken)
+        throw new IntegrationError("auth_required", "requires_reauth");
+      return tokenCredentials2(
+        await tokenRequest(
+          {
+            grant_type: "refresh_token",
+            refresh_token: credentials.refreshToken
+          },
+          context.fetch,
+          context.signal
+        ),
+        credentials
+      );
+    },
+    // Raindrop does not document a revocation API; local disconnect must not pretend to revoke the upstream grant.
+    actions: {
+      create_bookmark: {
+        validate(value) {
+          return validateRaindropCreateBookmark(value);
+        },
+        async execute(value, context) {
+          const checkpoint = context.checkpoint && typeof context.checkpoint === "object" && !Array.isArray(context.checkpoint) ? context.checkpoint : {};
+          if (typeof checkpoint.id === "string" && typeof checkpoint.url === "string" && typeof checkpoint.collectionId === "number")
+            return {
+              id: checkpoint.id,
+              url: checkpoint.url,
+              collectionId: checkpoint.collectionId
+            };
+          const result = await createRaindropClient({
+            accessToken: context.credentials.accessToken,
+            fetch: context.fetch,
+            signal: context.signal
+          }).createBookmark(value);
+          await context.saveCheckpoint(result);
+          return result;
+        },
+        async reconcile(value, context) {
+          const checkpoint = context.checkpoint && typeof context.checkpoint === "object" && !Array.isArray(context.checkpoint) ? context.checkpoint : {};
+          if (typeof checkpoint.id !== "string" || !/^[1-9][0-9]*$/.test(checkpoint.id))
+            return { resolved: false };
+          const result = bookmarkResult(
+            await raindropRequest(`/raindrop/${checkpoint.id}`, {
+              accessToken: context.credentials.accessToken,
+              fetch: context.fetch,
+              signal: context.signal
+            }),
+            validateRaindropCreateBookmark(value)
+          );
+          if (result.id !== checkpoint.id)
+            throw new IntegrationError("invalid_response");
+          return { resolved: true, result };
+        }
+      }
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  NOTION_API_VERSION,
+  ProviderHttpError,
+  RAINDROP_TOKEN_ENDPOINT,
+  createAppleProvider,
+  createGitHubProvider,
+  createGoogleProvider,
+  createNotionClient,
+  createNotionProvider,
+  createRaindropClient,
+  createRaindropProvider,
+  notionRequest,
+  raindropRequest,
+  validateNotionCreatePage,
+  validateRaindropCreateBookmark
+});
+//# sourceMappingURL=index.cjs.map