@mycreat-labs/integrations-sdk 0.0.0-stage → 0.1.0

package/dist/index.cjs

@@ -0,0 +1,1328 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  IntegrationError: () => IntegrationError,
+  createIntegrationSdk: () => createIntegrationSdk,
+  createRuntime: () => createRuntime,
+  createTokenVault: () => createTokenVault,
+  integrationError: () => integrationError
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/errors.ts
+var IntegrationError = class extends Error {
+  constructor(code, disposition = "permanent_failure", retryAfterMs) {
+    super(code);
+    this.code = code;
+    this.disposition = disposition;
+    this.retryAfterMs = retryAfterMs;
+    this.name = "IntegrationError";
+  }
+  code;
+  disposition;
+  retryAfterMs;
+  sdkError = "@mycreat-labs/integrations-sdk/v1";
+};
+function integrationError(error) {
+  if (error instanceof IntegrationError) return error;
+  if (error instanceof Error && "sdkError" in error && error.sdkError === "@mycreat-labs/integrations-sdk/v1" && "code" in error && typeof error.code === "string" && /^[a-zA-Z0-9_]{1,100}$/.test(error.code) && "disposition" in error && [
+    "retryable",
+    "requires_reauth",
+    "outcome_unknown",
+    "permanent_failure"
+  ].includes(String(error.disposition))) {
+    const delay = "retryAfterMs" in error && typeof error.retryAfterMs === "number" && Number.isFinite(error.retryAfterMs) && error.retryAfterMs >= 0 ? error.retryAfterMs : void 0;
+    return new IntegrationError(
+      error.code,
+      error.disposition,
+      delay
+    );
+  }
+  return new IntegrationError("provider_unavailable", "outcome_unknown");
+}
+
+// src/crypto.ts
+var import_node_crypto = require("crypto");
+function createTokenVault(options) {
+  const keys = new Map(
+    Object.entries(options.keys).map(([id, value]) => [
+      id,
+      Buffer.from(value, "base64")
+    ])
+  );
+  if (!keys.has(options.activeKeyId) || [...keys.values()].some((value) => value.length !== 32))
+    throw new IntegrationError("invalid_vault_configuration");
+  return {
+    async seal(value, context) {
+      const iv = (0, import_node_crypto.randomBytes)(12);
+      const cipher = (0, import_node_crypto.createCipheriv)(
+        "aes-256-gcm",
+        keys.get(options.activeKeyId),
+        iv
+      );
+      cipher.setAAD(
+        Buffer.from(`integration-sdk:v1:${options.activeKeyId}:${context}`)
+      );
+      const data = Buffer.concat([
+        cipher.update(JSON.stringify(value), "utf8"),
+        cipher.final()
+      ]);
+      return {
+        keyId: options.activeKeyId,
+        value: Buffer.concat([iv, cipher.getAuthTag(), data]).toString(
+          "base64url"
+        )
+      };
+    },
+    async open(sealed, context) {
+      try {
+        const key = keys.get(sealed.keyId);
+        if (!key) throw new Error("unknown key");
+        const buffer = Buffer.from(sealed.value, "base64url");
+        if (buffer.length < 28) throw new Error("invalid ciphertext");
+        const decipher = (0, import_node_crypto.createDecipheriv)(
+          "aes-256-gcm",
+          key,
+          buffer.subarray(0, 12)
+        );
+        decipher.setAAD(
+          Buffer.from(`integration-sdk:v1:${sealed.keyId}:${context}`)
+        );
+        decipher.setAuthTag(buffer.subarray(12, 28));
+        return JSON.parse(
+          Buffer.concat([
+            decipher.update(buffer.subarray(28)),
+            decipher.final()
+          ]).toString("utf8")
+        );
+      } catch {
+        throw new IntegrationError("credential_decryption_failed");
+      }
+    }
+  };
+}
+
+// src/sdk.ts
+var import_node_crypto2 = require("crypto");
+var hash = (value) => (0, import_node_crypto2.createHash)("sha256").update(value).digest("hex");
+var pkce = (value) => (0, import_node_crypto2.createHash)("sha256").update(value).digest("base64url");
+var random = () => (0, import_node_crypto2.randomBytes)(32).toString("base64url");
+function canonical(value) {
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  if (value !== null && typeof value === "object")
+    return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`).join(",")}}`;
+  return JSON.stringify(value);
+}
+var required = (value, name, max = 512) => {
+  if (typeof value !== "string" || !value.trim() || value.length > max)
+    throw new IntegrationError(`invalid_${name}`);
+  return value;
+};
+function createIntegrationSdk(options) {
+  required(options.namespace, "namespace", 128);
+  const providers = /* @__PURE__ */ new Map();
+  for (const provider of options.providers) {
+    if (providers.has(provider.key))
+      throw new IntegrationError("duplicate_provider");
+    required(provider.registrationId, "registration");
+    providers.set(provider.key, provider);
+  }
+  const now = options.clock ?? Date.now;
+  const request = options.fetch ?? globalThis.fetch;
+  const apiFetch = (provider, budget = "api") => async (input, init) => {
+    if (options.rateLimiter) {
+      const signal = init?.signal;
+      const deadline = Date.now() + 1e4;
+      for (; ; ) {
+        let admission;
+        let timeout;
+        try {
+          admission = await Promise.race([
+            options.rateLimiter.take(
+              hash(
+                `${options.namespace}\0${provider.key}\0${provider.registrationId}\0${budget}`
+              )
+            ),
+            new Promise((_, reject) => {
+              timeout = setTimeout(
+                () => reject(new Error("admission timeout")),
+                1e3
+              );
+            })
+          ]);
+          if (typeof admission.allowed !== "boolean" || !Number.isFinite(admission.retryAfterMs) || admission.retryAfterMs < 0)
+            throw new Error("invalid admission");
+        } catch {
+          throw Object.assign(
+            new IntegrationError("rate_limited", "retryable", 1e3),
+            { definite: true }
+          );
+        } finally {
+          if (timeout) clearTimeout(timeout);
+        }
+        if (signal?.aborted)
+          throw Object.assign(
+            new IntegrationError("rate_limited", "retryable", 1e3),
+            { definite: true }
+          );
+        if (admission.allowed) break;
+        const delay = Math.max(1, admission.retryAfterMs);
+        if (Date.now() + delay > deadline)
+          throw Object.assign(
+            new IntegrationError(
+              "rate_limited",
+              "retryable",
+              Math.min(delay, 864e5)
+            ),
+            { definite: true }
+          );
+        await new Promise((resolve, reject) => {
+          const onAbort = () => {
+            clearTimeout(wait);
+            signal?.removeEventListener("abort", onAbort);
+            reject(
+              Object.assign(
+                new IntegrationError("rate_limited", "retryable", 1e3),
+                { definite: true }
+              )
+            );
+          };
+          const wait = setTimeout(() => {
+            signal?.removeEventListener("abort", onAbort);
+            resolve();
+          }, delay);
+          signal?.addEventListener("abort", onAbort, { once: true });
+          if (signal?.aborted) onAbort();
+        });
+      }
+    }
+    return request(input, init);
+  };
+  const leaseMs = options.leaseMs ?? 12e4;
+  const maxAttempts = options.maximumAttempts ?? 12;
+  const scope = (ownerId) => ({
+    namespace: options.namespace,
+    ownerId: required(ownerId, "owner")
+  });
+  const providerFor = (key, registrationId) => {
+    const provider = providers.get(key);
+    if (!provider || registrationId && provider.registrationId !== registrationId)
+      throw new IntegrationError("provider_unavailable");
+    return provider;
+  };
+  const authorizationKey = (provider) => hash(`${provider.key}\0${provider.registrationId}`);
+  const grantContext = (grant) => `${grant.namespace}:grant:${grant.ownerId}:${grant.registrationId}:${grant.id}`;
+  const flowContext = (flow) => `${flow.namespace}:flow:${flow.purpose}:${flow.id}`;
+  const operationContext = (op) => `${op.namespace}:operation:${op.ownerId}:${op.id}`;
+  async function connection(ownerId, id) {
+    const value = await options.store.transaction(async (tx) => {
+      await tx.lockScope(scope(ownerId));
+      return tx.getConnection(scope(ownerId), id);
+    });
+    if (!value) throw new IntegrationError("connection_not_found");
+    providerFor(value.provider, value.registrationId);
+    if (value.status !== "active")
+      throw new IntegrationError("reauth_required", "requires_reauth");
+    return value;
+  }
+  async function start(input, purpose, native = false) {
+    const owner = scope(input.ownerId);
+    required(input.binding, "binding");
+    if (input.binding.length < 32)
+      throw new IntegrationError("invalid_binding");
+    const provider = providerFor(input.provider);
+    if (!provider.purposes.includes(purpose) || !native && !provider.authorization || native && !provider.verifyNative)
+      throw new IntegrationError("unsupported_capability");
+    let current;
+    if (input.connectionId) {
+      const existing = await options.store.transaction(
+        (tx) => tx.getConnection(owner, input.connectionId)
+      );
+      if (!existing || existing.provider !== provider.key || existing.registrationId !== provider.registrationId || existing.status === "revoked")
+        throw new IntegrationError("connection_not_found");
+      current = existing;
+    }
+    const state = random();
+    const verifier = random();
+    const nonce = random();
+    const flow = {
+      id: hash(state),
+      ...owner,
+      provider: provider.key,
+      registrationId: provider.registrationId,
+      purpose,
+      bindingHash: hash(input.binding),
+      expiresAt: now() + 6e5,
+      secret: { keyId: "", value: "" },
+      ...current ? { connectionId: current.id, generation: current.generation } : {}
+    };
+    flow.secret = await options.vault.seal(
+      { verifier, nonce, native },
+      flowContext(flow)
+    );
+    await options.store.transaction(async (tx) => {
+      if (purpose === "connect") {
+        await tx.lockScope(owner);
+        const connections = await tx.listConnections(owner);
+        for (const connection2 of connections.filter(
+          (c) => c.provider === provider.key && c.registrationId === provider.registrationId && c.status === "revoked"
+        )) {
+          if (await tx.hasPendingRevocation(owner, connection2.id))
+            throw new IntegrationError("revocation_pending", "retryable", 3e3);
+        }
+        flow.authorizationEpoch = await tx.authorizationEpoch(
+          owner,
+          authorizationKey(provider),
+          true
+        );
+      }
+      await tx.insertFlow(flow);
+    });
+    return {
+      state,
+      nonce,
+      authorizationUrl: native ? "" : provider.authorization.url({
+        state,
+        verifier,
+        challenge: pkce(verifier),
+        nonce,
+        purpose
+      })
+    };
+  }
+  async function consume(input, purpose, native = false) {
+    required(input.state, "state");
+    required(input.binding, "binding");
+    const flow = await options.store.transaction(
+      (tx) => tx.consumeFlow(
+        options.namespace,
+        hash(input.state),
+        hash(input.binding),
+        purpose,
+        now()
+      )
+    );
+    if (!flow || flow.ownerId !== input.ownerId)
+      throw new IntegrationError("authorization_expired");
+    const secret = await options.vault.open(
+      flow.secret,
+      flowContext(flow)
+    );
+    if (secret.native !== native)
+      throw new IntegrationError("authorization_purpose_mismatch");
+    return {
+      flow,
+      secret,
+      provider: providerFor(flow.provider, flow.registrationId)
+    };
+  }
+  async function credentials(current, signal, force = false, rejectedAccessToken) {
+    const provider = providerFor(current.provider, current.registrationId);
+    const owner = scope(current.ownerId);
+    const lease = (0, import_node_crypto2.randomUUID)();
+    const result = await options.store.transaction(async (tx) => {
+      await tx.lockScope(owner);
+      const live = await tx.getConnection(owner, current.id, true);
+      if (!live || live.status !== "active" || live.generation !== current.generation)
+        throw new IntegrationError("connection_revoked", "requires_reauth");
+      const grant = await tx.getGrant(owner, live.grantId, true);
+      if (!grant || grant.status !== "active")
+        throw new IntegrationError("reauth_required", "requires_reauth");
+      if (grant.authorizationLease) {
+        if ((grant.authorizationUntil ?? 0) > now())
+          throw new IntegrationError(
+            "authorization_in_progress",
+            "retryable",
+            2e3
+          );
+        const invalidated = {
+          ...grant,
+          status: "reauth_required",
+          version: grant.version + 1,
+          authorizationLease: void 0,
+          authorizationUntil: void 0
+        };
+        await tx.saveGrant(invalidated, grant.version);
+        return { grant: invalidated, refresh: false };
+      }
+      if (!force && (!grant.expiresAt || grant.expiresAt > now() + 3e4))
+        return { grant, refresh: false };
+      if (force && rejectedAccessToken !== void 0) {
+        const latest = await options.vault.open(
+          grant.credentials,
+          grantContext(grant)
+        );
+        if (latest.accessToken !== rejectedAccessToken)
+          return { grant, refresh: false };
+      }
+      if (!provider.refresh)
+        throw new IntegrationError("reauth_required", "requires_reauth");
+      if (grant.refreshLease && (grant.refreshUntil ?? 0) > now())
+        throw new IntegrationError("refresh_in_progress", "retryable", 2e3);
+      if (grant.refreshLease) {
+        const invalidated = {
+          ...grant,
+          status: "reauth_required",
+          version: grant.version + 1,
+          refreshLease: void 0,
+          refreshUntil: void 0
+        };
+        await tx.saveGrant(invalidated, grant.version);
+        return { grant: invalidated, refresh: false };
+      }
+      if (!await tx.saveGrant(
+        { ...grant, refreshLease: lease, refreshUntil: now() + leaseMs },
+        grant.version
+      ))
+        throw new IntegrationError("credential_conflict", "retryable", 2e3);
+      return { grant, refresh: true };
+    });
+    if (result.grant.status !== "active")
+      throw new IntegrationError("reauth_required", "requires_reauth");
+    const material = await options.vault.open(
+      result.grant.credentials,
+      grantContext(result.grant)
+    );
+    if (!result.refresh) return material;
+    let refreshReturned = false;
+    try {
+      const refreshed = await provider.refresh(material, {
+        fetch: apiFetch(provider, "credentials"),
+        signal
+      });
+      refreshReturned = true;
+      const sealed = await options.vault.seal(
+        refreshed,
+        grantContext(result.grant)
+      );
+      await options.store.transaction(async (tx) => {
+        const live = await tx.getConnection(owner, current.id, true);
+        const grant = await tx.getGrant(owner, current.grantId, true);
+        if (!live || live.status !== "active" || live.generation !== current.generation || !grant || grant.status !== "active" || grant.version !== result.grant.version || grant.refreshLease !== lease || (grant.refreshUntil ?? 0) <= now())
+          throw new IntegrationError("credential_conflict", "requires_reauth");
+        if (!await tx.saveGrant(
+          {
+            ...grant,
+            credentials: sealed,
+            expiresAt: refreshed.expiresAt,
+            version: grant.version + 1,
+            refreshLease: void 0,
+            refreshUntil: void 0
+          },
+          grant.version
+        ))
+          throw new IntegrationError("credential_conflict", "requires_reauth");
+      });
+      return refreshed;
+    } catch (error) {
+      const failure = integrationError(error);
+      const definiteRetry = !refreshReturned && failure.disposition === "retryable" && error instanceof Error && "definite" in error && error.definite === true;
+      await options.store.transaction(async (tx) => {
+        const grant = await tx.getGrant(owner, current.grantId, true);
+        if (grant?.version === result.grant.version && grant.refreshLease === lease)
+          await tx.saveGrant(
+            {
+              ...grant,
+              status: definiteRetry ? "active" : "reauth_required",
+              version: grant.version + 1,
+              refreshLease: void 0,
+              refreshUntil: void 0
+            },
+            grant.version
+          );
+      });
+      if (definiteRetry) throw failure;
+      options.logger?.warn?.(
+        { provider: provider.key, code: integrationError(error).code },
+        "Credential refresh requires authorization"
+      );
+      throw new IntegrationError("reauth_required", "requires_reauth");
+    }
+  }
+  async function enqueue(input) {
+    required(input.idempotencyKey, "idempotency_key");
+    const current = await connection(input.ownerId, input.connectionId);
+    const action = providerFor(current.provider, current.registrationId).actions?.[input.action];
+    if (!action) throw new IntegrationError("unsupported_action");
+    const validated = action.validate(input.input);
+    const payload = canonical(validated);
+    if (Buffer.byteLength(payload) > 2e6)
+      throw new IntegrationError("input_too_large");
+    const operation = {
+      id: (0, import_node_crypto2.randomUUID)(),
+      ...scope(input.ownerId),
+      connectionId: current.id,
+      generation: current.generation,
+      action: input.action,
+      idempotencyKey: input.idempotencyKey,
+      fingerprint: hash(
+        canonical({
+          connectionId: current.id,
+          generation: current.generation,
+          input: validated,
+          hostContext: input.hostContext ?? null
+        })
+      ),
+      input: { keyId: "", value: "" },
+      ...input.hostContext !== void 0 ? { hostContext: input.hostContext } : {},
+      status: "pending",
+      version: 1,
+      attempts: 0,
+      availableAt: now(),
+      checkpoint: null,
+      dispatching: false,
+      createdAt: now(),
+      updatedAt: now()
+    };
+    operation.input = await options.vault.seal(
+      validated,
+      operationContext(operation)
+    );
+    return options.store.transaction(async (tx) => {
+      await tx.lockScope(scope(input.ownerId));
+      const live = await tx.getConnection(
+        scope(input.ownerId),
+        current.id,
+        true
+      );
+      if (!live || live.status !== "active" || live.generation !== current.generation)
+        throw new IntegrationError("connection_revoked");
+      const persisted = await tx.insertOperation(operation);
+      if (persisted.fingerprint !== operation.fingerprint)
+        throw new IntegrationError("idempotency_conflict");
+      return persisted;
+    });
+  }
+  async function getOperation(ownerId, id) {
+    const op = await options.store.transaction(
+      (tx) => tx.getOperation(scope(ownerId), id)
+    );
+    if (!op) throw new IntegrationError("operation_not_found");
+    return op;
+  }
+  async function process(message) {
+    const lease = (0, import_node_crypto2.randomUUID)();
+    let operation = await options.store.transaction(
+      (tx) => tx.claimOperation(
+        options.namespace,
+        message.taskId,
+        message.version,
+        now(),
+        lease,
+        now() + leaseMs
+      )
+    );
+    if (!operation) return;
+    const owner = scope(operation.ownerId);
+    let lost = false;
+    let renewing;
+    const abort = new AbortController();
+    const renew = async () => {
+      await options.store.transaction(async (tx) => {
+        const live = await tx.getOperation(owner, operation.id, true);
+        if (!live || live.status !== "running" || live.leaseToken !== lease || (live.leaseUntil ?? 0) <= now())
+          throw new IntegrationError("lease_lost");
+        const next = { ...live, leaseUntil: now() + leaseMs, updatedAt: now() };
+        if (!await tx.saveOperation(next, live.version, lease))
+          throw new IntegrationError("lease_lost");
+        operation = next;
+      });
+    };
+    const timer = setInterval(
+      () => {
+        if (renewing) return;
+        renewing = renew().catch(() => {
+          lost = true;
+          abort.abort();
+        }).finally(() => {
+          renewing = void 0;
+        });
+      },
+      Math.max(100, Math.floor(leaseMs / 3))
+    );
+    timer.unref?.();
+    let input = null;
+    let attemptedWrite = false;
+    let remoteSucceeded = false;
+    let dispatchedConnection;
+    let dispatchedAccessToken;
+    let authenticationRecovered = false;
+    try {
+      input = await options.vault.open(
+        operation.input,
+        operationContext(operation)
+      );
+      const current = await options.store.transaction(
+        (tx) => tx.getConnection(owner, operation.connectionId)
+      );
+      if (!current || current.generation !== operation.generation || current.status !== "active" && operation.action !== "__sdk.revoke")
+        throw new IntegrationError("connection_revoked");
+      if (operation.action === "__sdk.revoke" && !providers.has(current.provider))
+        throw new IntegrationError(
+          "provider_configuration_missing",
+          "retryable",
+          6e4
+        );
+      const provider = providerFor(current.provider, current.registrationId);
+      let material;
+      if (operation.action === "__sdk.revoke") {
+        const grant = await options.store.transaction(
+          (tx) => tx.getGrant(owner, current.grantId)
+        );
+        if (!grant || grant.status !== "revoked")
+          throw new IntegrationError("invalid_revocation");
+        material = await options.vault.open(
+          grant.credentials,
+          grantContext(grant)
+        );
+      } else material = await credentials(current, abort.signal);
+      const context = {
+        credentials: material,
+        fetch: apiFetch(provider),
+        signal: abort.signal,
+        operationId: operation.id,
+        checkpoint: operation.checkpoint,
+        saveCheckpoint: async (checkpoint) => {
+          await options.store.transaction(async (tx) => {
+            const live = await tx.getOperation(owner, operation.id, true);
+            if (!live || live.leaseToken !== lease || live.status !== "running")
+              throw new IntegrationError("lease_lost");
+            const next = { ...live, checkpoint, updatedAt: now() };
+            if (!await tx.saveOperation(next, live.version, lease))
+              throw new IntegrationError("lease_lost");
+            operation = next;
+          });
+        }
+      };
+      let result;
+      const action = provider.actions?.[operation.action];
+      if (operation.action === "__sdk.revoke") {
+        await provider.revoke?.(material, {
+          fetch: request,
+          signal: abort.signal
+        });
+        result = { revoked: true };
+        remoteSucceeded = true;
+      } else if (!action) throw new IntegrationError("unsupported_action");
+      else if (operation.dispatching) {
+        await options.store.transaction(async (tx) => {
+          await tx.lockScope(owner);
+          await options.hooks?.beforeExecute?.(
+            tx.nativeContext,
+            operation,
+            input
+          );
+        });
+        if (!action.reconcile)
+          throw new IntegrationError("outcome_unknown", "outcome_unknown");
+        const reconciled = await action.reconcile(input, context);
+        if (!reconciled.resolved)
+          throw new IntegrationError("outcome_unknown", "outcome_unknown");
+        result = reconciled.result;
+        remoteSucceeded = true;
+      } else {
+        await options.store.transaction(async (tx) => {
+          await tx.lockScope(owner);
+          const live = await tx.getOperation(owner, operation.id, true);
+          const active = await tx.getConnection(owner, current.id, true);
+          if (!active || active.generation !== current.generation || active.status !== "active")
+            throw new IntegrationError("connection_revoked");
+          if (!live || live.leaseToken !== lease)
+            throw new IntegrationError("lease_lost");
+          await options.hooks?.beforeExecute?.(tx.nativeContext, live, input);
+          const next = { ...live, dispatching: true, updatedAt: now() };
+          if (!await tx.saveOperation(next, live.version, lease))
+            throw new IntegrationError("lease_lost");
+          operation = next;
+        });
+        attemptedWrite = true;
+        dispatchedConnection = current;
+        dispatchedAccessToken = material.accessToken;
+        result = await action.execute(input, context);
+        remoteSucceeded = true;
+      }
+      if (renewing) await renewing;
+      if (lost || abort.signal.aborted) return;
+      await options.store.transaction(async (tx) => {
+        const erased = await tx.lockScope(
+          owner,
+          operation.action === "__sdk.revoke"
+        );
+        const live = await tx.getOperation(owner, operation.id, true);
+        const active = await tx.getConnection(owner, current.id, true);
+        if (!live || live.leaseToken !== lease || live.status !== "running")
+          throw new IntegrationError("lease_lost");
+        if (!active || active.generation !== current.generation || active.status !== "active" && operation.action !== "__sdk.revoke")
+          throw new IntegrationError("connection_revoked");
+        const next = {
+          ...live,
+          status: "succeeded",
+          result,
+          input: await options.vault.seal(null, operationContext(live)),
+          checkpoint: null,
+          leaseToken: void 0,
+          leaseUntil: void 0,
+          errorCode: void 0,
+          version: live.version + 1,
+          updatedAt: now()
+        };
+        const event = {
+          id: (0, import_node_crypto2.randomUUID)(),
+          ...owner,
+          operationId: next.id,
+          type: "operation.succeeded",
+          createdAt: now(),
+          data: result
+        };
+        if (!await tx.saveOperation(next, live.version, lease))
+          throw new IntegrationError("lease_lost");
+        await tx.insertEvent(event);
+        if (operation.action !== "__sdk.revoke")
+          await options.hooks?.onResult?.(tx.nativeContext, next, event, input);
+        if (operation.action === "__sdk.revoke" && erased)
+          await tx.eraseOwner(owner, true);
+      });
+    } catch (error) {
+      if (renewing) await renewing;
+      if (lost) return;
+      let failure = integrationError(error);
+      const definiteUnauthorized = failure.disposition === "requires_reauth" && error instanceof Error && "status" in error && error.status === 401 && "definite" in error && error.definite === true;
+      if (definiteUnauthorized && attemptedWrite && !remoteSucceeded && dispatchedConnection && providerFor(
+        dispatchedConnection.provider,
+        dispatchedConnection.registrationId
+      ).refresh) {
+        if ((operation.authRecoveries ?? 0) > 0) {
+          failure = new IntegrationError(
+            "credential_refresh_exhausted",
+            "requires_reauth"
+          );
+        } else {
+          try {
+            await credentials(
+              dispatchedConnection,
+              abort.signal,
+              true,
+              dispatchedAccessToken
+            );
+            authenticationRecovered = true;
+            failure = new IntegrationError(
+              "credential_refreshed",
+              "retryable",
+              0
+            );
+          } catch (refreshError) {
+            failure = integrationError(refreshError);
+          }
+        }
+      }
+      await options.store.transaction(async (tx) => {
+        const live = await tx.getOperation(owner, operation.id, true);
+        if (!live || live.leaseToken !== lease || live.status !== "running" || (live.leaseUntil ?? 0) <= now())
+          return;
+        const retry = failure.disposition === "retryable" && live.attempts < maxAttempts;
+        const unknown = failure.disposition === "outcome_unknown" || live.dispatching && (!attemptedWrite || remoteSucceeded);
+        const next = {
+          ...live,
+          authRecoveries: Math.min(
+            1,
+            (live.authRecoveries ?? 0) + (authenticationRecovered ? 1 : 0)
+          ),
+          status: ["connection_revoked", "owner_erased"].includes(failure.code) ? "cancelled" : unknown ? "outcome_unknown" : retry ? "pending" : failure.disposition === "requires_reauth" ? "blocked" : "failed",
+          dispatching: unknown ? live.dispatching : false,
+          availableAt: now() + Math.max(
+            failure.retryAfterMs ?? 0,
+            Math.min(36e5, 15e3 * 2 ** Math.min(live.attempts, 8))
+          ),
+          leaseToken: void 0,
+          leaseUntil: void 0,
+          errorCode: failure.code,
+          version: live.version + 1,
+          updatedAt: now()
+        };
+        if (unknown && live.attempts >= maxAttempts)
+          next.availableAt = Number.MAX_SAFE_INTEGER;
+        if (!await tx.saveOperation(next, live.version, lease)) return;
+        await tx.insertEvent({
+          id: (0, import_node_crypto2.randomUUID)(),
+          ...owner,
+          operationId: next.id,
+          type: `operation.${next.status}`,
+          createdAt: now(),
+          data: { code: failure.code }
+        });
+      });
+      options.logger?.warn?.(
+        { code: failure.code },
+        "Integration operation interrupted"
+      );
+    } finally {
+      clearInterval(timer);
+      abort.abort();
+    }
+  }
+  const sdk = {
+    namespace: options.namespace,
+    withStore: (store) => createIntegrationSdk({ ...options, store }),
+    assertCompatible: () => options.store.assertCompatible(),
+    catalog: () => [...providers.values()].map((p) => ({
+      key: p.key,
+      registrationId: p.registrationId,
+      purposes: [...p.purposes],
+      resources: Boolean(p.resources),
+      actions: Object.keys(p.actions ?? {}),
+      remoteRevocationSupported: Boolean(p.revoke)
+    })),
+    identity: {
+      start: (input) => start(input, "identity"),
+      startNative: (input) => start(input, "identity", true),
+      async complete(input) {
+        const { provider, secret } = await consume(input, "identity");
+        const result = await provider.authorization.exchange(
+          {
+            code: required(input.code, "code", 4096),
+            verifier: secret.verifier,
+            nonce: secret.nonce,
+            purpose: "identity"
+          },
+          request
+        );
+        if (!result.identity) throw new IntegrationError("invalid_identity");
+        return result.identity;
+      },
+      async verifyNative(input) {
+        const { provider, secret } = await consume(input, "identity", true);
+        return provider.verifyNative(
+          {
+            idToken: input.idToken,
+            nonce: secret.nonce,
+            authorizationCode: input.authorizationCode
+          },
+          request
+        );
+      }
+    },
+    connections: {
+      start: (input) => start(input, "connect"),
+      async complete(input) {
+        const { flow, secret, provider } = await consume(input, "connect");
+        const reservation = (0, import_node_crypto2.randomUUID)();
+        const reserved = [];
+        await options.store.transaction(async (tx) => {
+          await tx.lockScope(scope(input.ownerId));
+          if (flow.authorizationEpoch !== await tx.authorizationEpoch(
+            scope(input.ownerId),
+            authorizationKey(provider)
+          ))
+            throw new IntegrationError("authorization_conflict");
+          for (const current of (await tx.listConnections(scope(input.ownerId))).filter(
+            (c) => c.provider === provider.key && c.registrationId === provider.registrationId && c.status !== "revoked"
+          )) {
+            const previous = await tx.getGrant(
+              scope(input.ownerId),
+              current.grantId,
+              true
+            );
+            if (!previous || previous.status === "revoked") continue;
+            if (previous.refreshLease || previous.authorizationLease && (previous.authorizationUntil ?? 0) > now())
+              throw new IntegrationError("credential_busy", "retryable", 2e3);
+            if (!await tx.saveGrant(
+              {
+                ...previous,
+                version: previous.version + 1,
+                authorizationLease: reservation,
+                authorizationUntil: now() + 6e4
+              },
+              previous.version
+            ))
+              throw new IntegrationError("authorization_conflict");
+            reserved.push(previous.id);
+          }
+        });
+        let completed = false;
+        try {
+          const result = await provider.authorization.exchange(
+            {
+              code: required(input.code, "code", 4096),
+              verifier: secret.verifier,
+              nonce: secret.nonce,
+              purpose: "connect"
+            },
+            request
+          );
+          if (!result.credentials || !result.account)
+            throw new IntegrationError("invalid_connection");
+          const grant = {
+            id: (0, import_node_crypto2.randomUUID)(),
+            ...scope(input.ownerId),
+            provider: provider.key,
+            registrationId: provider.registrationId,
+            account: result.account,
+            version: 1,
+            status: "active",
+            credentials: { keyId: "", value: "" },
+            expiresAt: result.credentials.expiresAt
+          };
+          grant.credentials = await options.vault.seal(
+            result.credentials,
+            grantContext(grant)
+          );
+          const connected = await options.store.transaction(async (tx) => {
+            await tx.lockScope(scope(input.ownerId));
+            if (flow.authorizationEpoch !== await tx.authorizationEpoch(
+              scope(input.ownerId),
+              authorizationKey(provider)
+            ))
+              throw new IntegrationError("authorization_conflict");
+            await tx.assertAccountOwner(
+              scope(input.ownerId),
+              provider.key,
+              provider.registrationId,
+              result.account.id
+            );
+            const existing = flow.connectionId ? await tx.getConnection(
+              scope(input.ownerId),
+              flow.connectionId,
+              true
+            ) : (await tx.listConnections(scope(input.ownerId))).find(
+              (c) => c.provider === provider.key && c.registrationId === provider.registrationId && c.account.id === result.account.id
+            );
+            if (flow.connectionId && (!existing || existing.generation !== flow.generation || existing.status === "revoked" || existing.account.id !== result.account.id))
+              throw new IntegrationError("authorization_conflict");
+            if (existing) {
+              const previous = await tx.getGrant(
+                scope(input.ownerId),
+                existing.grantId,
+                true
+              );
+              if (previous && previous.status !== "revoked" && (previous.authorizationLease !== reservation || (previous.authorizationUntil ?? 0) <= now()))
+                throw new IntegrationError("authorization_conflict");
+              if (previous)
+                await tx.saveGrant(
+                  {
+                    ...previous,
+                    status: "revoked",
+                    version: previous.version + 1,
+                    authorizationLease: void 0,
+                    authorizationUntil: void 0
+                  },
+                  previous.version
+                );
+              await tx.insertGrant(grant);
+              const updated = {
+                ...existing,
+                grantId: grant.id,
+                generation: existing.generation + 1,
+                status: "active",
+                account: result.account,
+                updatedAt: now()
+              };
+              if (!await tx.saveConnection(updated, existing.generation))
+                throw new IntegrationError("authorization_conflict");
+              return updated;
+            }
+            await tx.insertGrant(grant);
+            const created = {
+              id: (0, import_node_crypto2.randomUUID)(),
+              ...scope(input.ownerId),
+              provider: provider.key,
+              registrationId: provider.registrationId,
+              grantId: grant.id,
+              account: result.account,
+              generation: 1,
+              status: "active",
+              createdAt: now(),
+              updatedAt: now()
+            };
+            await tx.insertConnection(created);
+            return created;
+          });
+          completed = true;
+          return connected;
+        } finally {
+          await options.store.transaction(async (tx) => {
+            await tx.lockScope(scope(input.ownerId), true);
+            for (const id of reserved) {
+              const grant = await tx.getGrant(scope(input.ownerId), id, true);
+              if (grant?.authorizationLease !== reservation) continue;
+              await tx.saveGrant(
+                {
+                  ...grant,
+                  status: !completed && grant.status === "active" ? "reauth_required" : grant.status,
+                  version: grant.version + 1,
+                  authorizationLease: void 0,
+                  authorizationUntil: void 0
+                },
+                grant.version
+              );
+            }
+          }).catch(() => {
+            options.logger?.warn?.(
+              { code: "authorization_cleanup_pending" },
+              "Authorization lease awaits recovery"
+            );
+          });
+        }
+      },
+      async list(ownerId) {
+        return options.store.transaction(async (tx) => {
+          const values = await tx.listConnections(scope(ownerId));
+          return Promise.all(
+            values.map(async (value) => {
+              const grant = await tx.getGrant(scope(ownerId), value.grantId);
+              return value.status === "active" && grant?.status === "reauth_required" ? { ...value, status: "reauth_required" } : value;
+            })
+          );
+        });
+      },
+      async disconnect(ownerId, id) {
+        return options.store.transaction(async (tx) => {
+          await tx.lockScope(scope(ownerId), true);
+          const current = await tx.getConnection(scope(ownerId), id, true);
+          if (!current) throw new IntegrationError("connection_not_found");
+          const provider = providers.get(current.provider);
+          if (current.status === "revoked")
+            return {
+              disconnected: true,
+              remoteRevocationSupported: Boolean(provider?.revoke)
+            };
+          await tx.authorizationEpoch(
+            scope(ownerId),
+            hash(`${current.provider}\0${current.registrationId}`),
+            true
+          );
+          const grant = await tx.getGrant(
+            scope(ownerId),
+            current.grantId,
+            true
+          );
+          const next = {
+            ...current,
+            status: "revoked",
+            generation: current.generation + 1,
+            updatedAt: now()
+          };
+          if (!await tx.saveConnection(next, current.generation))
+            throw new IntegrationError("connection_conflict");
+          if (grant)
+            await tx.saveGrant(
+              {
+                ...grant,
+                status: "revoked",
+                version: grant.version + 1,
+                refreshLease: void 0,
+                refreshUntil: void 0,
+                authorizationLease: void 0,
+                authorizationUntil: void 0
+              },
+              grant.version
+            );
+          if (grant && (!provider || provider.revoke)) {
+            const op = {
+              id: (0, import_node_crypto2.randomUUID)(),
+              ...scope(ownerId),
+              connectionId: id,
+              generation: next.generation,
+              action: "__sdk.revoke",
+              idempotencyKey: `disconnect:${id}:${next.generation}`,
+              fingerprint: hash(id),
+              input: { keyId: "", value: "" },
+              status: "pending",
+              version: 1,
+              attempts: 0,
+              availableAt: now(),
+              checkpoint: null,
+              dispatching: false,
+              createdAt: now(),
+              updatedAt: now()
+            };
+            op.input = await options.vault.seal(null, operationContext(op));
+            await tx.insertOperation(op);
+          }
+          return {
+            disconnected: true,
+            remoteRevocationSupported: Boolean(provider?.revoke)
+          };
+        });
+      }
+    },
+    async eraseOwner(ownerId) {
+      await options.store.transaction(async (tx) => {
+        await tx.lockScope(scope(ownerId), true);
+        await tx.markOwnerErased(scope(ownerId));
+      });
+      const existing = await options.store.transaction(
+        (tx) => tx.listConnections(scope(ownerId))
+      );
+      for (const current of existing)
+        await sdk.connections.disconnect(ownerId, current.id);
+      await options.store.transaction(async (tx) => {
+        await tx.eraseOwner(scope(ownerId), true);
+      });
+    },
+    resources: {
+      async list(input) {
+        const current = await connection(input.ownerId, input.connectionId);
+        const provider = providerFor(current.provider, current.registrationId);
+        if (!provider.resources)
+          throw new IntegrationError("unsupported_capability");
+        let material = await credentials(current);
+        let result;
+        try {
+          result = await provider.resources(input, {
+            credentials: material,
+            fetch: apiFetch(provider)
+          });
+        } catch (error) {
+          const failure = integrationError(error);
+          const definiteUnauthorized = failure.disposition === "requires_reauth" && error instanceof Error && "status" in error && error.status === 401 && "definite" in error && error.definite === true;
+          if (!definiteUnauthorized || !provider.refresh) throw error;
+          material = await credentials(
+            current,
+            void 0,
+            true,
+            material.accessToken
+          );
+          result = await provider.resources(input, {
+            credentials: material,
+            fetch: apiFetch(provider)
+          });
+        }
+        const live = await connection(input.ownerId, input.connectionId);
+        if (live.generation !== current.generation)
+          throw new IntegrationError("connection_changed");
+        return result;
+      }
+    },
+    operations: {
+      enqueue,
+      get: getOperation,
+      list: (ownerId, connectionId) => options.store.transaction(
+        (tx) => tx.listOperations(scope(ownerId), connectionId)
+      ),
+      async recover(ownerId, id) {
+        return options.store.transaction(async (tx) => {
+          const current = await tx.getOperation(scope(ownerId), id, true);
+          if (!current) throw new IntegrationError("operation_not_found");
+          if (current.errorCode === "payload_expired")
+            throw new IntegrationError("payload_expired");
+          if (!["outcome_unknown", "blocked", "failed"].includes(current.status))
+            return current;
+          const connection2 = await tx.getConnection(
+            scope(ownerId),
+            current.connectionId,
+            true
+          );
+          const revoke = current.action === "__sdk.revoke";
+          if (!connection2 || connection2.generation !== current.generation || (revoke ? connection2.status !== "revoked" : connection2.status !== "active"))
+            throw new IntegrationError("connection_revoked");
+          const next = {
+            ...current,
+            status: current.dispatching ? "outcome_unknown" : "pending",
+            attempts: 0,
+            availableAt: now(),
+            version: current.version + 1,
+            updatedAt: now()
+          };
+          if (!await tx.saveOperation(next, current.version))
+            throw new IntegrationError("operation_conflict");
+          return next;
+        });
+      }
+    },
+    events: {
+      list: (ownerId, after) => options.store.transaction((tx) => tx.listEvents(scope(ownerId), after))
+    },
+    runtime: {
+      process,
+      async due(limit = 100) {
+        await options.store.transaction(async (tx) => {
+          await tx.recoverOperations(options.namespace, now());
+          await tx.collectGarbage(
+            options.namespace,
+            now(),
+            options.failedPayloadRetentionMs ?? 7 * 864e5
+          );
+        });
+        return options.store.transaction(
+          (tx) => tx.dueOperations(options.namespace, now(), limit)
+        );
+      }
+    }
+  };
+  return sdk;
+}
+
+// src/runtime.ts
+function createRuntime(options) {
+  let timer;
+  let ticking;
+  let lifecycle = Promise.resolve();
+  let starting;
+  let stopping;
+  let desiredRunning = false;
+  let running = false;
+  let generation = 0;
+  let queueStarted = false;
+  let lastSuccess;
+  let lastError;
+  const current = (epoch) => desiredRunning && running && generation === epoch;
+  const clearTimer = () => {
+    if (timer) clearInterval(timer);
+    timer = void 0;
+  };
+  const serialize = (work) => {
+    const pending = lifecycle.then(work);
+    lifecycle = pending.catch(() => void 0);
+    return pending;
+  };
+  const tick = (epoch) => {
+    if (!current(epoch)) return Promise.resolve();
+    if (ticking) return ticking;
+    ticking = (async () => {
+      try {
+        const messages = await options.sdk.runtime.due(
+          options.batchSize ?? 100
+        );
+        if (!current(epoch)) return;
+        await options.queue.publish(
+          messages.map((message) => ({
+            taskId: message.id,
+            version: message.version
+          }))
+        );
+        if (!current(epoch)) return;
+        lastSuccess = Date.now();
+        lastError = void 0;
+      } catch {
+        if (current(epoch)) lastError = "dispatch_unavailable";
+      }
+    })().finally(() => {
+      ticking = void 0;
+    });
+    return ticking;
+  };
+  return {
+    start() {
+      if (desiredRunning && (starting || running))
+        return starting ?? Promise.resolve();
+      desiredRunning = true;
+      const epoch = ++generation;
+      const pending = serialize(async () => {
+        if (!desiredRunning || generation !== epoch) return;
+        let queueAttempted = false;
+        try {
+          if (queueStarted) {
+            await options.queue.stop();
+            queueStarted = false;
+          }
+          await options.sdk.assertCompatible();
+          if (!desiredRunning || generation !== epoch) return;
+          queueAttempted = true;
+          queueStarted = true;
+          await options.queue.start((message) => {
+            if (!desiredRunning || generation !== epoch)
+              return Promise.resolve();
+            return options.sdk.runtime.process(message);
+          });
+          if (!desiredRunning || generation !== epoch) return;
+          lastSuccess = void 0;
+          lastError = void 0;
+          running = true;
+          await tick(epoch);
+          if (!current(epoch)) return;
+          timer = setInterval(() => {
+            void tick(epoch);
+          }, options.intervalMs ?? 3e3);
+          timer.unref?.();
+        } catch (error) {
+          running = false;
+          clearTimer();
+          if (generation === epoch) desiredRunning = false;
+          if (queueAttempted) {
+            try {
+              await options.queue.stop();
+              queueStarted = false;
+            } catch {
+            }
+          }
+          throw error;
+        }
+      });
+      starting = pending;
+      void pending.then(
+        () => {
+          if (starting === pending) starting = void 0;
+        },
+        () => {
+          if (starting === pending) starting = void 0;
+        }
+      );
+      return pending;
+    },
+    stop() {
+      if (!desiredRunning && stopping) return stopping;
+      desiredRunning = false;
+      running = false;
+      generation++;
+      clearTimer();
+      const pending = serialize(async () => {
+        if (ticking) await ticking;
+        if (queueStarted) {
+          await options.queue.stop();
+          queueStarted = false;
+        }
+      });
+      stopping = pending;
+      void pending.then(
+        () => {
+          if (stopping === pending) stopping = void 0;
+        },
+        () => {
+          if (stopping === pending) stopping = void 0;
+        }
+      );
+      return pending;
+    },
+    async dispatch() {
+      if (!running || !desiredRunning)
+        throw new IntegrationError("runtime_not_started");
+      await tick(generation);
+    },
+    health() {
+      return {
+        running,
+        ready: running && !lastError && lastSuccess !== void 0 && Date.now() - lastSuccess < 9e4,
+        lastSuccess,
+        lastError
+      };
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  IntegrationError,
+  createIntegrationSdk,
+  createRuntime,
+  createTokenVault,
+  integrationError
+});
+//# sourceMappingURL=index.cjs.map