@opencoredev/social-sdk 0.1.0 → 0.1.2

package/dist/server/connections.d.ts

@@ -1,124 +0,0 @@
-import type { ConnectedAccountRef, Platform } from "../core/types.js";
-export interface ConnectionAttempt {
-    readonly id: string;
-    readonly backend: string;
-    readonly tenantId: string;
-    readonly principalId: string;
-    readonly platforms: readonly Platform[];
-    readonly capabilities: readonly string[];
-    readonly redirectUri: string;
-    readonly state: string;
-    readonly codeVerifier: string;
-    readonly providerState?: string;
-    readonly createdAt: string;
-    readonly expiresAt: string;
-}
-export interface ConnectionStart {
-    readonly authorizationUrl: string;
-    readonly attempt: Omit<ConnectionAttempt, "state" | "codeVerifier"> & {
-        readonly state: string;
-    };
-}
-export interface ConnectionAccount {
-    readonly ref: ConnectedAccountRef;
-    readonly displayName: string;
-}
-export interface ConnectionProvider {
-    start(input: {
-        readonly platforms: readonly Platform[];
-        readonly capabilities: readonly string[];
-        readonly redirectUri: string;
-        readonly state: string;
-        readonly codeChallenge: string;
-    }): Promise<{
-        readonly authorizationUrl: string;
-        readonly providerState?: string;
-    }>;
-    complete(input: {
-        readonly callbackUrl: string;
-        readonly attempt: ConnectionAttempt;
-    }): Promise<readonly ConnectionAccount[]>;
-}
-export interface ConnectionStore {
-    save(attempt: ConnectionAttempt): Promise<void>;
-    get(attemptId: string): Promise<ConnectionAttempt | undefined>;
-    /** Atomically claim a one-use code exchange. Never expire or release this claim automatically. */
-    claimDiscovery(attemptId: string): Promise<boolean>;
-    /** Persist discovered accounts before presenting the account picker. */
-    saveDiscoveredAccounts(attemptId: string, accounts: readonly ConnectionAccount[]): Promise<void>;
-    getDiscoveredAccounts(attemptId: string): Promise<readonly ConnectionAccount[] | undefined>;
-    /**
-     * Implementations must consume an attempt and insert all selected grants in
-     * one durable transaction. If the transaction fails, the attempt must remain
-     * retryable (or expose an explicit recovery marker); never commit a consumed
-     * attempt with only a subset of its grants.
-     */
-    complete(input: {
-        readonly attemptId: string;
-        readonly state: string;
-        readonly accounts: readonly ConnectionAccount[];
-        readonly selectedAccountIds: readonly string[];
-    }): Promise<readonly ConnectionGrant[]>;
-}
-export interface ConnectionGrant {
-    readonly grantId: string;
-    readonly tenantId: string;
-    readonly principalId: string;
-    readonly account: ConnectedAccountRef;
-    readonly capabilities: readonly string[];
-}
-export interface ConnectionManagerOptions {
-    readonly store: ConnectionStore;
-    readonly now?: () => Date;
-    readonly randomBytes?: (length: number) => Uint8Array;
-    readonly ttlMs?: number;
-}
-export declare class ConnectionManager {
-    #private;
-    constructor(options: ConnectionManagerOptions);
-    begin(input: {
-        readonly backend: string;
-        readonly tenantId: string;
-        readonly principalId: string;
-        readonly platforms: readonly Platform[];
-        readonly capabilities?: readonly string[];
-        readonly redirectUri: string;
-        readonly allowedRedirectUris: readonly string[];
-        readonly provider: ConnectionProvider;
-    }): Promise<ConnectionStart>;
-    discover(input: {
-        readonly attemptId: string;
-        readonly tenantId: string;
-        readonly principalId: string;
-        readonly callbackUrl: string;
-        readonly returnedState: string;
-        readonly allowedRedirectUris: readonly string[];
-        readonly provider: ConnectionProvider;
-    }): Promise<readonly ConnectionAccount[]>;
-    select(input: {
-        readonly attemptId: string;
-        readonly tenantId: string;
-        readonly principalId: string;
-        readonly selectedAccountIds: readonly string[];
-    }): Promise<readonly ConnectionGrant[]>;
-    /** Convenience for callers that already know which discovered accounts to select. */
-    complete(input: Parameters<ConnectionManager["discover"]>[0] & {
-        readonly selectedAccountIds: readonly string[];
-    }): Promise<readonly ConnectionGrant[]>;
-}
-export declare class MemoryConnectionStore implements ConnectionStore {
-    #private;
-    save(attempt: ConnectionAttempt): Promise<void>;
-    get(attemptId: string): Promise<ConnectionAttempt | undefined>;
-    claimDiscovery(attemptId: string): Promise<boolean>;
-    saveDiscoveredAccounts(attemptId: string, accounts: readonly ConnectionAccount[]): Promise<void>;
-    getDiscoveredAccounts(attemptId: string): Promise<readonly ConnectionAccount[] | undefined>;
-    complete(input: {
-        readonly attemptId: string;
-        readonly state: string;
-        readonly accounts: readonly ConnectionAccount[];
-        readonly selectedAccountIds: readonly string[];
-    }): Promise<readonly ConnectionGrant[]>;
-    grants(): readonly ConnectionGrant[];
-}
-//# sourceMappingURL=connections.d.ts.map

package/dist/server/connections.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"connections.d.ts","sourceRoot":"","sources":["../../src/server/connections.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAEtE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,QAAQ,EAAE,CAAC;IACxC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,OAAO,GAAG,cAAc,CAAC,GAAG;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAClG;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,mBAAmB,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,KAAK,EAAE;QACX,QAAQ,CAAC,SAAS,EAAE,SAAS,QAAQ,EAAE,CAAC;QACxC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;QACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;KAChC,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpF,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;KACrC,GAAG,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAAC;IAC/D,kGAAkG;IAClG,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,wEAAwE;IACxE,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,iBAAiB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjG,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,iBAAiB,EAAE,GAAG,SAAS,CAAC,CAAC;IAC5F;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;QAChD,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;KAChD,GAAG,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,UAAU,CAAC;IACtD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAwED,qBAAa,iBAAiB;;gBAKhB,OAAO,EAAE,wBAAwB;IAgBvC,KAAK,CAAC,KAAK,EAAE;QACjB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,QAAQ,EAAE,CAAC;QACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QAChD,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;KACvC,GAAG,OAAO,CAAC,eAAe,CAAC;IAqDtB,QAAQ,CAAC,KAAK,EAAE;QACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QAChD,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;KACvC,GAAG,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC;IAoFnC,MAAM,CAAC,KAAK,EAAE;QAClB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;KAChD,GAAG,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC;IAgDvC,qFAAqF;IAC/E,QAAQ,CACZ,KAAK,EAAE,UAAU,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG;QACpD,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;KAChD,GACA,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC;CAIvC;AAED,qBAAa,qBAAsB,YAAW,eAAe;;IAarD,IAAI,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAc/C,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAK9D,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAOnD,sBAAsB,CAC1B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,SAAS,iBAAiB,EAAE,GACrC,OAAO,CAAC,IAAI,CAAC;IAWV,qBAAqB,CACzB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,SAAS,iBAAiB,EAAE,GAAG,SAAS,CAAC;IAK9C,QAAQ,CAAC,KAAK,EAAE;QACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;QAChD,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;KAChD,GAAG,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC;IA6BvC,MAAM,IAAI,SAAS,eAAe,EAAE;CAGrC"}

package/dist/server/connections.js

@@ -1,334 +0,0 @@
-import { SocialError } from "../core/errors.js";
-function randomBytes(length) {
-    const result = new Uint8Array(length);
-    crypto.getRandomValues(result);
-    return result;
-}
-function base64Url(bytes) {
-    let binary = "";
-    for (const byte of bytes)
-        binary += String.fromCharCode(byte);
-    return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
-}
-async function challenge(verifier) {
-    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
-    return base64Url(new Uint8Array(digest));
-}
-function allowedRedirect(value, allowlist, callback = false) {
-    let candidate;
-    try {
-        candidate = new URL(value);
-    }
-    catch {
-        return false;
-    }
-    if (candidate.username ||
-        candidate.password ||
-        candidate.hash ||
-        (candidate.protocol !== "https:" &&
-            !(candidate.protocol === "http:" &&
-                ["localhost", "127.0.0.1", "[::1]"].includes(candidate.hostname))))
-        return false;
-    return allowlist.some((entry) => {
-        try {
-            const allowed = new URL(entry);
-            if (!callback)
-                return candidate.href === allowed.href;
-            if (candidate.origin !== allowed.origin || candidate.pathname !== allowed.pathname)
-                return false;
-            for (const [key, value] of allowed.searchParams)
-                if (candidate.searchParams.getAll(key).length !== 1 ||
-                    candidate.searchParams.get(key) !== value)
-                    return false;
-            return true;
-        }
-        catch {
-            return false;
-        }
-    });
-}
-function ensureState(expected, actual) {
-    const expectedBytes = new TextEncoder().encode(expected);
-    const actualBytes = new TextEncoder().encode(actual);
-    let difference = expectedBytes.length ^ actualBytes.length;
-    const length = Math.max(expectedBytes.length, actualBytes.length);
-    for (let index = 0; index < length; index++)
-        difference |= (expectedBytes[index] ?? 0) ^ (actualBytes[index] ?? 0);
-    if (difference !== 0) {
-        throw new SocialError({
-            code: "unauthorized",
-            operation: "connections.complete",
-            message: "Connection state did not match this authenticated attempt",
-        });
-    }
-}
-export class ConnectionManager {
-    #options;
-    constructor(options) {
-        const ttlMs = options.ttlMs ?? 10 * 60 * 1000;
-        if (!Number.isSafeInteger(ttlMs) || ttlMs < 1)
-            throw new SocialError({
-                code: "invalid_config",
-                operation: "connections.constructor",
-                message: "ttlMs must be a positive safe integer",
-            });
-        this.#options = {
-            store: options.store,
-            now: options.now ?? (() => new Date()),
-            randomBytes: options.randomBytes ?? randomBytes,
-            ttlMs,
-        };
-    }
-    async begin(input) {
-        if (!input.tenantId || !input.principalId)
-            throw new SocialError({
-                code: "unauthorized",
-                operation: "connections.begin",
-                message: "An authenticated tenant and principal are required",
-            });
-        if (!allowedRedirect(input.redirectUri, input.allowedRedirectUris))
-            throw new SocialError({
-                code: "invalid_input",
-                operation: "connections.begin",
-                message: "redirectUri is not on the exact callback allowlist",
-            });
-        if (input.platforms.length === 0)
-            throw new SocialError({
-                code: "invalid_input",
-                operation: "connections.begin",
-                message: "At least one platform is required",
-            });
-        const now = this.#options.now();
-        const state = base64Url(this.#options.randomBytes(32));
-        const codeVerifier = base64Url(this.#options.randomBytes(48));
-        const attemptId = base64Url(this.#options.randomBytes(18));
-        const expiresAt = new Date(now.getTime() + this.#options.ttlMs).toISOString();
-        const started = await input.provider.start({
-            platforms: input.platforms,
-            capabilities: input.capabilities ?? [],
-            redirectUri: input.redirectUri,
-            state,
-            codeChallenge: await challenge(codeVerifier),
-        });
-        const attempt = {
-            id: attemptId,
-            backend: input.backend,
-            tenantId: input.tenantId,
-            principalId: input.principalId,
-            platforms: [...input.platforms],
-            capabilities: [...(input.capabilities ?? [])],
-            redirectUri: input.redirectUri,
-            state,
-            codeVerifier,
-            ...(started.providerState === undefined ? {} : { providerState: started.providerState }),
-            createdAt: now.toISOString(),
-            expiresAt,
-        };
-        await this.#options.store.save(attempt);
-        const { state: publicState, codeVerifier: _privateVerifier, ...publicAttempt } = attempt;
-        return {
-            authorizationUrl: started.authorizationUrl,
-            attempt: { ...publicAttempt, state: publicState },
-        };
-    }
-    async discover(input) {
-        const attempt = await this.#options.store.get(input.attemptId);
-        if (attempt === undefined)
-            throw new SocialError({
-                code: "invalid_input",
-                operation: "connections.complete",
-                message: "Connection attempt was not found",
-            });
-        if (attempt.tenantId !== input.tenantId || attempt.principalId !== input.principalId)
-            throw new SocialError({
-                code: "unauthorized",
-                operation: "connections.complete",
-                message: "Connection attempt belongs to a different authenticated principal",
-            });
-        if (!allowedRedirect(input.callbackUrl, input.allowedRedirectUris, true) ||
-            !allowedRedirect(input.callbackUrl, [attempt.redirectUri], true))
-            throw new SocialError({
-                code: "invalid_input",
-                operation: "connections.complete",
-                message: "Callback URL is not the exact registered redirect",
-            });
-        ensureState(attempt.state, input.returnedState);
-        const states = new URL(input.callbackUrl).searchParams.getAll("state");
-        // Callers may pass a callback URL after extracting its state parameter; when
-        // present, reject duplicates or a value that differs from the authenticated state.
-        if (states.length > 1 || (states.length === 1 && states[0] !== input.returnedState))
-            throw new SocialError({
-                code: "unauthorized",
-                operation: "connections.complete",
-                message: "Callback state differs from the authenticated callback parameter",
-            });
-        if (this.#options.now().getTime() >= Date.parse(attempt.expiresAt))
-            throw new SocialError({
-                code: "timeout",
-                operation: "connections.complete",
-                message: "Connection attempt expired",
-            });
-        const saved = await this.#options.store.getDiscoveredAccounts(attempt.id);
-        if (saved)
-            return saved;
-        if (!(await this.#options.store.claimDiscovery(attempt.id))) {
-            const completed = await this.#options.store.getDiscoveredAccounts(attempt.id);
-            if (completed)
-                return completed;
-            throw new SocialError({
-                code: "reconnect_required",
-                operation: "connections.discover",
-                message: "Code exchange is already in progress or its result was lost. Wait for discovery or begin a new connection; the code will not be exchanged again.",
-            });
-        }
-        const accounts = await input.provider.complete({ callbackUrl: input.callbackUrl, attempt });
-        this.#validateAccounts(attempt, accounts);
-        await this.#options.store.saveDiscoveredAccounts(attempt.id, accounts);
-        return structuredClone(accounts);
-    }
-    #validateAccounts(attempt, accounts) {
-        if (accounts.length === 0)
-            throw new SocialError({
-                code: "invalid_input",
-                operation: "connections.discover",
-                message: "The provider returned no connected accounts",
-            });
-        const known = new Set(accounts.map((account) => account.ref.accountId));
-        if (known.size !== accounts.length ||
-            accounts.some(({ ref }) => ref.kind !== "connected-account" ||
-                ref.version !== 1 ||
-                ref.backend !== attempt.backend ||
-                !attempt.platforms.includes(ref.platform) ||
-                !ref.accountId))
-            throw new SocialError({
-                code: "unauthorized",
-                operation: "connections.discover",
-                message: "Provider returned ambiguous accounts or references outside this connection attempt",
-            });
-    }
-    async select(input) {
-        const attempt = await this.#options.store.get(input.attemptId);
-        if (!attempt ||
-            attempt.tenantId !== input.tenantId ||
-            attempt.principalId !== input.principalId)
-            throw new SocialError({
-                code: "unauthorized",
-                operation: "connections.select",
-                message: "Connection attempt was not found for this authenticated principal",
-            });
-        if (this.#options.now().getTime() >= Date.parse(attempt.expiresAt))
-            throw new SocialError({
-                code: "timeout",
-                operation: "connections.select",
-                message: "Connection attempt expired",
-            });
-        const accounts = await this.#options.store.getDiscoveredAccounts(attempt.id);
-        if (!accounts)
-            throw new SocialError({
-                code: "invalid_input",
-                operation: "connections.select",
-                message: "Complete account discovery before selecting accounts",
-            });
-        this.#validateAccounts(attempt, accounts);
-        const selected = new Set(input.selectedAccountIds);
-        if (!selected.size || selected.size !== input.selectedAccountIds.length)
-            throw new SocialError({
-                code: "invalid_input",
-                operation: "connections.select",
-                message: "Select one or more distinct discovered accounts",
-            });
-        const known = new Set(accounts.map(({ ref }) => ref.accountId));
-        if ([...selected].some((id) => !known.has(id)))
-            throw new SocialError({
-                code: "unauthorized",
-                operation: "connections.select",
-                message: "Selected account was not returned by the provider",
-            });
-        return this.#options.store.complete({
-            attemptId: attempt.id,
-            state: attempt.state,
-            accounts,
-            selectedAccountIds: input.selectedAccountIds,
-        });
-    }
-    /** Convenience for callers that already know which discovered accounts to select. */
-    async complete(input) {
-        await this.discover(input);
-        return this.select(input);
-    }
-}
-export class MemoryConnectionStore {
-    #attempts = new Map();
-    #grants = [];
-    #sequence = 0;
-    async save(attempt) {
-        if (this.#attempts.has(attempt.id))
-            throw new SocialError({
-                code: "upstream_failure",
-                operation: "connections.begin",
-                message: "Connection attempt ID collision",
-            });
-        this.#attempts.set(attempt.id, {
-            attempt: structuredClone(attempt),
-            consumed: false,
-            discoveryClaimed: false,
-        });
-    }
-    async get(attemptId) {
-        const stored = this.#attempts.get(attemptId);
-        return stored && !stored.consumed ? structuredClone(stored.attempt) : undefined;
-    }
-    async claimDiscovery(attemptId) {
-        const stored = this.#attempts.get(attemptId);
-        if (!stored || stored.consumed || stored.discoveryClaimed)
-            return false;
-        stored.discoveryClaimed = true;
-        return true;
-    }
-    async saveDiscoveredAccounts(attemptId, accounts) {
-        const stored = this.#attempts.get(attemptId);
-        if (!stored || stored.consumed || !stored.discoveryClaimed || stored.accounts)
-            throw new SocialError({
-                code: "unauthorized",
-                operation: "connections.discover",
-                message: "Discovery cannot be saved for this attempt",
-            });
-        stored.accounts = structuredClone(accounts);
-    }
-    async getDiscoveredAccounts(attemptId) {
-        const stored = this.#attempts.get(attemptId);
-        return stored?.accounts && !stored.consumed ? structuredClone(stored.accounts) : undefined;
-    }
-    async complete(input) {
-        const stored = this.#attempts.get(input.attemptId);
-        if (stored === undefined || stored.consumed || stored.attempt.state !== input.state)
-            throw new SocialError({
-                code: "unauthorized",
-                operation: "connections.complete",
-                message: "Connection callback is invalid or already consumed",
-            });
-        if (!stored.accounts || JSON.stringify(stored.accounts) !== JSON.stringify(input.accounts))
-            throw new SocialError({
-                code: "unauthorized",
-                operation: "connections.select",
-                message: "Grants must match persisted discovery",
-            });
-        const selected = new Set(input.selectedAccountIds);
-        const grants = input.accounts
-            .filter((account) => selected.has(account.ref.accountId))
-            .map((account) => ({
-            grantId: `grant-${++this.#sequence}`,
-            tenantId: stored.attempt.tenantId,
-            principalId: stored.attempt.principalId,
-            account: account.ref,
-            capabilities: stored.attempt.capabilities,
-        }));
-        this.#grants.push(...structuredClone(grants));
-        stored.consumed = true;
-        return structuredClone(grants);
-    }
-    grants() {
-        return structuredClone(this.#grants);
-    }
-}
-//# sourceMappingURL=connections.js.map

package/dist/server/connections.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"connections.js","sourceRoot":"","sources":["../../src/server/connections.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AA+EhD,SAAS,WAAW,CAAC,MAAc;IACjC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACpF,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,QAAgB;IACvC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzF,OAAO,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,SAA4B,EAAE,QAAQ,GAAG,KAAK;IACpF,IAAI,SAAc,CAAC;IACnB,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IACE,SAAS,CAAC,QAAQ;QAClB,SAAS,CAAC,QAAQ;QAClB,SAAS,CAAC,IAAI;QACd,CAAC,SAAS,CAAC,QAAQ,KAAK,QAAQ;YAC9B,CAAC,CACC,SAAS,CAAC,QAAQ,KAAK,OAAO;gBAC9B,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,CACjE,CAAC;QAEJ,OAAO,KAAK,CAAC;IACf,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC9B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC;YACtD,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ;gBAChF,OAAO,KAAK,CAAC;YACf,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,YAAY;gBAC7C,IACE,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;oBAC/C,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK;oBAEzC,OAAO,KAAK,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,MAAc;IACnD,MAAM,aAAa,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,UAAU,GAAG,aAAa,CAAC,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAClE,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,KAAK,EAAE;QACzC,UAAU,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACxE,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,WAAW,CAAC;YACpB,IAAI,EAAE,cAAc;YACpB,SAAS,EAAE,sBAAsB;YACjC,OAAO,EAAE,2DAA2D;SACrE,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,OAAO,iBAAiB;IACnB,QAAQ,CAEf;IAEF,YAAY,OAAiC;QAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;YAC3C,MAAM,IAAI,WAAW,CAAC;gBACpB,IAAI,EAAE,gBAAgB;gBACtB,SAAS,EAAE,yBAAyB;gBACpC,OAAO,EAAE,uCAAuC;aACjD,CAAC,CAAC;QACL,IAAI,CAAC,QAAQ,GAAG;YACd,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;YACtC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,WAAW;YAC/C,KAAK;SACN,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KASX;QACC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,WAAW;YACvC,MAAM,IAAI,WAAW,CAAC;gBACpB,IAAI,EAAE,cAAc;gBACpB,SAAS,EAAE,mBAAmB;gBAC9B,OAAO,EAAE,oDAAoD;aAC9D,CAAC,CAAC;QACL,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,mBAAmB,CAAC;YAChE,MAAM,IAAI,WAAW,CAAC;gBACpB,IAAI,EAAE,eAAe;gBACrB,SAAS,EAAE,mBAAmB;gBAC9B,OAAO,EAAE,oDAAoD;aAC9D,CAAC,CAAC;QACL,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAC9B,MAAM,IAAI,WAAW,CAAC;gBACpB,IAAI,EAAE,eAAe;gBACrB,SAAS,EAAE,mBAAmB;gBAC9B,OAAO,EAAE,mCAAmC;aAC7C,CAAC,CAAC;QACL,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;YACzC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,EAAE;YACtC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,KAAK;YACL,aAAa,EAAE,MAAM,SAAS,CAAC,YAAY,CAAC;SAC7C,CAAC,CAAC;QACH,MAAM,OAAO,GAAsB;YACjC,EAAE,EAAE,SAAS;YACb,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC;YAC/B,YAAY,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;YAC7C,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,KAAK;YACL,YAAY;YACZ,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;YACxF,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;YAC5B,SAAS;SACV,CAAC;QACF,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,GAAG,aAAa,EAAE,GAAG,OAAO,CAAC;QACzF,OAAO;YACL,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,OAAO,EAAE,EAAE,GAAG,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE;SAClD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAQd;QACC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/D,IAAI,OAAO,KAAK,SAAS;YACvB,MAAM,IAAI,WAAW,CAAC;gBACpB,IAAI,EAAE,eAAe;gBACrB,SAAS,EAAE,sBAAsB;gBACjC,OAAO,EAAE,kCAAkC;aAC5C,CAAC,CAAC;QACL,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;YAClF,MAAM,IAAI,WAAW,CAAC;gBACpB,IAAI,EAAE,cAAc;gBACpB,SAAS,EAAE,sBAAsB;gBACjC,OAAO,EAAE,mEAAmE;aAC7E,CAAC,CAAC;QACL,IACE,CAAC,eAAe,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,mBAAmB,EAAE,IAAI,CAAC;YACpE,CAAC,eAAe,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC;YAEhE,MAAM,IAAI,WAAW,CAAC;gBACpB,IAAI,EAAE,eAAe;gBACrB,SAAS,EAAE,sBAAsB;gBACjC,OAAO,EAAE,mDAAmD;aAC7D,CAAC,CAAC;QACL,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvE,6EAA6E;QAC7E,mFAAmF;QACnF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,aAAa,CAAC;YACjF,MAAM,IAAI,WAAW,CAAC;gBACpB,IAAI,EAAE,cAAc;gBACpB,SAAS,EAAE,sBAAsB;gBACjC,OAAO,EAAE,kEAAkE;aAC5E,CAAC,CAAC;QACL,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YAChE,MAAM,IAAI,WAAW,CAAC;gBACpB,IAAI,EAAE,SAAS;gBACf,SAAS,EAAE,sBAAsB;gBACjC,OAAO,EAAE,4BAA4B;aACtC,CAAC,CAAC;QACL,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1E,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC9E,IAAI,SAAS;gBAAE,OAAO,SAAS,CAAC;YAChC,MAAM,IAAI,WAAW,CAAC;gBACpB,IAAI,EAAE,oBAAoB;gBAC1B,SAAS,EAAE,sBAAsB;gBACjC,OAAO,EACL,kJAAkJ;aACrJ,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5F,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC1C,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QACvE,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED,iBAAiB,CAAC,OAA0B,EAAE,QAAsC;QAClF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YACvB,MAAM,IAAI,WAAW,CAAC;gBACpB,IAAI,EAAE,eAAe;gBACrB,SAAS,EAAE,sBAAsB;gBACjC,OAAO,EAAE,6CAA6C;aACvD,CAAC,CAAC;QACL,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QACxE,IACE,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM;YAC9B,QAAQ,CAAC,IAAI,CACX,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CACV,GAAG,CAAC,IAAI,KAAK,mBAAmB;gBAChC,GAAG,CAAC,OAAO,KAAK,CAAC;gBACjB,GAAG,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO;gBAC/B,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACzC,CAAC,GAAG,CAAC,SAAS,CACjB;YAED,MAAM,IAAI,WAAW,CAAC;gBACpB,IAAI,EAAE,cAAc;gBACpB,SAAS,EAAE,sBAAsB;gBACjC,OAAO,EACL,oFAAoF;aACvF,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAKZ;QACC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/D,IACE,CAAC,OAAO;YACR,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;YACnC,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;YAEzC,MAAM,IAAI,WAAW,CAAC;gBACpB,IAAI,EAAE,cAAc;gBACpB,SAAS,EAAE,oBAAoB;gBAC/B,OAAO,EAAE,mEAAmE;aAC7E,CAAC,CAAC;QACL,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YAChE,MAAM,IAAI,WAAW,CAAC;gBACpB,IAAI,EAAE,SAAS;gBACf,SAAS,EAAE,oBAAoB;gBAC/B,OAAO,EAAE,4BAA4B;aACtC,CAAC,CAAC;QACL,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,QAAQ;YACX,MAAM,IAAI,WAAW,CAAC;gBACpB,IAAI,EAAE,eAAe;gBACrB,SAAS,EAAE,oBAAoB;gBAC/B,OAAO,EAAE,sDAAsD;aAChE,CAAC,CAAC;QACL,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,kBAAkB,CAAC,MAAM;YACrE,MAAM,IAAI,WAAW,CAAC;gBACpB,IAAI,EAAE,eAAe;gBACrB,SAAS,EAAE,oBAAoB;gBAC/B,OAAO,EAAE,iDAAiD;aAC3D,CAAC,CAAC;QACL,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5C,MAAM,IAAI,WAAW,CAAC;gBACpB,IAAI,EAAE,cAAc;gBACpB,SAAS,EAAE,oBAAoB;gBAC/B,OAAO,EAAE,mDAAmD;aAC7D,CAAC,CAAC;QACL,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;YAClC,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ;YACR,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,QAAQ,CACZ,KAEC;QAED,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,OAAO,qBAAqB;IACvB,SAAS,GAAG,IAAI,GAAG,EAQzB,CAAC;IACK,OAAO,GAAsB,EAAE,CAAC;IACzC,SAAS,GAAG,CAAC,CAAC;IAEd,KAAK,CAAC,IAAI,CAAC,OAA0B;QACnC,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,WAAW,CAAC;gBACpB,IAAI,EAAE,kBAAkB;gBACxB,SAAS,EAAE,mBAAmB;gBAC9B,OAAO,EAAE,iCAAiC;aAC3C,CAAC,CAAC;QACL,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE;YAC7B,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC;YACjC,QAAQ,EAAE,KAAK;YACf,gBAAgB,EAAE,KAAK;SACxB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,SAAiB;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,gBAAgB;YAAE,OAAO,KAAK,CAAC;QACxE,MAAM,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,SAAiB,EACjB,QAAsC;QAEtC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,QAAQ;YAC3E,MAAM,IAAI,WAAW,CAAC;gBACpB,IAAI,EAAE,cAAc;gBACpB,SAAS,EAAE,sBAAsB;gBACjC,OAAO,EAAE,4CAA4C;aACtD,CAAC,CAAC;QACL,MAAM,CAAC,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,SAAiB;QAEjB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,MAAM,EAAE,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAKd;QACC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;YACjF,MAAM,IAAI,WAAW,CAAC;gBACpB,IAAI,EAAE,cAAc;gBACpB,SAAS,EAAE,sBAAsB;gBACjC,OAAO,EAAE,oDAAoD;aAC9D,CAAC,CAAC;QACL,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC;YACxF,MAAM,IAAI,WAAW,CAAC;gBACpB,IAAI,EAAE,cAAc;gBACpB,SAAS,EAAE,oBAAoB;gBAC/B,OAAO,EAAE,uCAAuC;aACjD,CAAC,CAAC;QACL,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ;aAC1B,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;aACxD,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACjB,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;YACpC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ;YACjC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;YACvC,OAAO,EAAE,OAAO,CAAC,GAAG;YACpB,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY;SAC1C,CAAC,CAAC,CAAC;QACN,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAED,MAAM;QACJ,OAAO,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;CACF"}

package/dist/server/credentials.d.ts

@@ -1,52 +0,0 @@
-import type { CredentialStore } from "../core/adapter.js";
-export interface CredentialLease {
-    readonly key: string;
-    readonly token: string;
-    readonly expiresAt: string;
-}
-export interface CredentialLock {
-    acquire(key: string, ttlMs: number): Promise<CredentialLease | undefined>;
-    release(lease: CredentialLease): Promise<void>;
-}
-export interface StoredCredential {
-    readonly accessToken: string;
-    readonly refreshToken?: string;
-    readonly expiresAt?: string;
-    readonly scopes?: readonly string[];
-    readonly metadata?: Readonly<Record<string, string>>;
-}
-export declare class MemoryCredentialStore implements CredentialStore<StoredCredential> {
-    #private;
-    get(key: string): Promise<{
-        readonly value: StoredCredential;
-        readonly revision: string;
-    } | undefined>;
-    compareAndSet(input: {
-        readonly key: string;
-        readonly expectedRevision: string | undefined;
-        readonly value: StoredCredential;
-    }): Promise<{
-        readonly updated: boolean;
-        readonly revision?: string;
-    }>;
-    delete(key: string): Promise<void>;
-}
-export declare class MemoryCredentialLock implements CredentialLock {
-    #private;
-    acquire(key: string, ttlMs: number): Promise<CredentialLease | undefined>;
-    release(lease: CredentialLease): Promise<void>;
-}
-export declare class CredentialManager {
-    private readonly store;
-    private readonly lock;
-    private readonly lockTtlMs;
-    constructor(store: CredentialStore<StoredCredential>, lock: CredentialLock, lockTtlMs?: number);
-    get(key: string): Promise<{
-        readonly value: StoredCredential;
-        readonly revision: string;
-    } | undefined>;
-    save(key: string, value: StoredCredential, expectedRevision?: string): Promise<string>;
-    rotate(key: string, refresh: (current: StoredCredential) => Promise<StoredCredential>): Promise<StoredCredential>;
-    delete(key: string): Promise<void>;
-}
-//# sourceMappingURL=credentials.d.ts.map

package/dist/server/credentials.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/server/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAG1D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;IAC1E,OAAO,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACtD;AAED,qBAAa,qBAAsB,YAAW,eAAe,CAAC,gBAAgB,CAAC;;IAIvE,GAAG,CACP,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;QAAE,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAajF,aAAa,CAAC,KAAK,EAAE;QACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9C,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;KAClC,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAchE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGzC;AAED,qBAAa,oBAAqB,YAAW,cAAc;;IAInD,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAYzE,OAAO,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;CAGrD;AAED,qBAAa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAFT,KAAK,EAAE,eAAe,CAAC,gBAAgB,CAAC,EACxC,IAAI,EAAE,cAAc,EACpB,SAAS,SAAS;IAGrC,GAAG,CACD,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;QAAE,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAIjF,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAWtF,MAAM,CACV,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,gBAAgB,CAAC,GAChE,OAAO,CAAC,gBAAgB,CAAC;IAmC5B,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGnC"}

package/dist/server/credentials.js

@@ -1,115 +0,0 @@
-import { SocialError } from "../core/errors.js";
-export class MemoryCredentialStore {
-    #values = new Map();
-    #sequence = 0;
-    async get(key) {
-        const found = this.#values.get(key);
-        return found === undefined
-            ? undefined
-            : {
-                value: {
-                    ...found.value,
-                    ...(found.value.scopes === undefined ? {} : { scopes: [...found.value.scopes] }),
-                },
-                revision: found.revision,
-            };
-    }
-    async compareAndSet(input) {
-        const current = this.#values.get(input.key);
-        if ((current?.revision ?? undefined) !== input.expectedRevision)
-            return { updated: false };
-        const revision = `credential-${++this.#sequence}`;
-        this.#values.set(input.key, {
-            value: {
-                ...input.value,
-                ...(input.value.scopes === undefined ? {} : { scopes: [...input.value.scopes] }),
-            },
-            revision,
-        });
-        return { updated: true, revision };
-    }
-    async delete(key) {
-        this.#values.delete(key);
-    }
-}
-export class MemoryCredentialLock {
-    #leases = new Map();
-    #sequence = 0;
-    async acquire(key, ttlMs) {
-        const current = this.#leases.get(key);
-        if (current !== undefined && Date.parse(current.expiresAt) > Date.now())
-            return undefined;
-        const lease = {
-            key,
-            token: `lease-${++this.#sequence}`,
-            expiresAt: new Date(Date.now() + ttlMs).toISOString(),
-        };
-        this.#leases.set(key, lease);
-        return lease;
-    }
-    async release(lease) {
-        if (this.#leases.get(lease.key)?.token === lease.token)
-            this.#leases.delete(lease.key);
-    }
-}
-export class CredentialManager {
-    store;
-    lock;
-    lockTtlMs;
-    constructor(store, lock, lockTtlMs = 30_000) {
-        this.store = store;
-        this.lock = lock;
-        this.lockTtlMs = lockTtlMs;
-    }
-    get(key) {
-        return this.store.get(key);
-    }
-    async save(key, value, expectedRevision) {
-        const result = await this.store.compareAndSet({ key, expectedRevision, value });
-        if (!result.updated || result.revision === undefined)
-            throw new SocialError({
-                code: "upstream_failure",
-                operation: "credentials.save",
-                message: "Credential revision changed; reload before saving",
-            });
-        return result.revision;
-    }
-    async rotate(key, refresh) {
-        const lease = await this.lock.acquire(key, this.lockTtlMs);
-        if (lease === undefined)
-            throw new SocialError({
-                code: "upstream_failure",
-                operation: "credentials.rotate",
-                message: "Another worker is already refreshing this credential",
-            });
-        try {
-            const current = await this.store.get(key);
-            if (current === undefined)
-                throw new SocialError({
-                    code: "reconnect_required",
-                    operation: "credentials.rotate",
-                    message: "No credential is stored for this account",
-                });
-            const next = await refresh(current.value);
-            const saved = await this.store.compareAndSet({
-                key,
-                expectedRevision: current.revision,
-                value: next,
-            });
-            if (!saved.updated)
-                throw new SocialError({
-                    code: "upstream_failure",
-                    operation: "credentials.rotate",
-                    message: "Credential changed while refreshing; do not repeat the provider request blindly",
-                });
-            return next;
-        }
-        finally {
-            await this.lock.release(lease);
-        }
-    }
-    delete(key) {
-        return this.store.delete(key);
-    }
-}
-//# sourceMappingURL=credentials.js.map