@opengeni/db 6.0.1 → 6.0.3-canary.36199476632001

package/dist/chunk-OYD7FLKH.js

@@ -0,0 +1,796 @@
+import {
+  setSubjectRlsContext,
+  withRlsContext
+} from "./chunk-JEKW3C74.js";
+
+// src/connection-token-resolver.ts
+import {
+  PERSONAL_GITHUB_REQUESTED_SCOPES,
+  PERSONAL_GITHUB_PROVIDER_DOMAIN,
+  PERSONAL_GITHUB_TOKEN_URL,
+  PersonalGitHubConnectionMetadata
+} from "@opengeni/contracts/personal-github";
+import { createHash } from "crypto";
+import {
+  OAUTH_MAX_RESPONSE_BYTES,
+  pinnedFetch,
+  readResponseJsonBounded,
+  undiciFetch,
+  validateHttpUrl
+} from "@opengeni/network";
+import { isPrivateAddress } from "@opengeni/network";
+import { Buffer } from "buffer";
+
+// src/connection-refresh-lock.ts
+import { sql } from "drizzle-orm";
+async function withConnectionRefreshLock(db, credential, work) {
+  return withRlsContext(
+    db,
+    { accountId: credential.accountId, workspaceId: credential.workspaceId },
+    async (tx) => {
+      if (credential.subjectId) await setSubjectRlsContext(tx, credential.subjectId);
+      await tx.execute(
+        sql`select pg_advisory_xact_lock(hashtextextended(${`connection-refresh:${credential.id}`}, 0))`
+      );
+      return work(tx);
+    }
+  );
+}
+
+// src/connection-scopes.ts
+function connectionScopeKey(providerDomain, value) {
+  const scope = value.trim();
+  const domain = providerDomain.toLowerCase();
+  if (domain === "googleapis.com" || domain.endsWith(".googleapis.com")) {
+    if (scope === "email" || scope === "https://www.googleapis.com/auth/userinfo.email") {
+      return "google:email";
+    }
+    if (scope === "profile" || scope === "https://www.googleapis.com/auth/userinfo.profile") {
+      return "google:profile";
+    }
+  }
+  return domain === "graph.microsoft.com" ? scope.toLowerCase() : scope;
+}
+
+// src/connection-token-resolver.ts
+var MAX_CREDENTIAL_PLACEMENTS = 32;
+var MAX_CREDENTIAL_NAME_BYTES = 256;
+var MAX_CREDENTIAL_VALUE_BYTES = 16384;
+var HEADER_NAME_PATTERN = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;
+var QUERY_NAME_PATTERN = /^[A-Za-z0-9._~-]+$/;
+var COOKIE_NAME_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+var FORBIDDEN_CREDENTIAL_HEADERS = /* @__PURE__ */ new Set([
+  "connection",
+  "content-length",
+  "host",
+  "proxy-authorization",
+  "proxy-connection",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade"
+]);
+var OFFICIAL_GMAIL_MCP_RESOURCE = "https://gmailmcp.googleapis.com/mcp/v1";
+var OFFICIAL_GMAIL_REST_HOST = "gmail.googleapis.com";
+function isOfficialGmailRestDestination(destinationUrl, ref) {
+  if (ref.providerDomain.toLowerCase() !== "gmailmcp.googleapis.com" || ref.kind !== "oauth2" || ref.subjectScope !== "subject") {
+    return false;
+  }
+  const destination = new URL(destinationUrl);
+  return destination.protocol === "https:" && destination.hostname.toLowerCase() === OFFICIAL_GMAIL_REST_HOST && (destination.pathname === "/gmail/v1/users/me" || destination.pathname.startsWith("/gmail/v1/users/me/"));
+}
+function copySelectedResources(resources) {
+  if (resources.length === 0 || resources.length > 256) {
+    throw new Error("connection credential returned an invalid selected resource count");
+  }
+  const seen = /* @__PURE__ */ new Set();
+  return resources.map((resource) => {
+    if (resource.kind !== "repository" || typeof resource.id !== "string" || resource.id.length === 0 || resource.id.length > 512) {
+      throw new Error("connection credential returned an invalid selected resource");
+    }
+    const key = `${resource.kind}\0${resource.id}`;
+    if (seen.has(key)) {
+      throw new Error("connection credential returned duplicate selected resources");
+    }
+    seen.add(key);
+    return { kind: resource.kind, id: resource.id };
+  });
+}
+function normalizedCredentialHeaders(headers, allowEmpty = false) {
+  const entries = Object.entries(headers);
+  if (!allowEmpty && entries.length === 0 || entries.length > 32) {
+    throw new Error("connection credential returned an invalid header count");
+  }
+  const normalized = {};
+  for (const [name, value] of entries) {
+    if (name.length > 256 || !HEADER_NAME_PATTERN.test(name) || value.length === 0 || value.length > 16384 || /[\r\n\0]/.test(value) || FORBIDDEN_CREDENTIAL_HEADERS.has(name.toLowerCase()) || name.toLowerCase().startsWith("sec-")) {
+      throw new Error("connection credential returned an invalid header");
+    }
+    if (Object.keys(normalized).some((existing) => existing.toLowerCase() === name.toLowerCase())) {
+      throw new Error("connection credential returned duplicate headers");
+    }
+    normalized[name] = value;
+  }
+  return normalized;
+}
+function normalizedCredentialPlacements(value) {
+  if (!Array.isArray(value) || value.length === 0 || value.length > MAX_CREDENTIAL_PLACEMENTS) {
+    throw new Error("connection credential returned an invalid placement count");
+  }
+  const seen = /* @__PURE__ */ new Set();
+  return value.map((raw) => {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+      throw new Error("connection credential returned an invalid placement");
+    }
+    const record = raw;
+    if (Object.keys(record).some(
+      (key2) => key2 !== "carrier" && key2 !== "name" && key2 !== "value" && key2 !== "prefix"
+    )) {
+      throw new Error("connection credential returned an invalid placement");
+    }
+    const carrier = record.carrier;
+    const name = record.name;
+    const credentialValue = record.value;
+    const prefix = record.prefix;
+    if (carrier !== "header" && carrier !== "query" && carrier !== "cookie" || typeof name !== "string" || name.length === 0 || Buffer.byteLength(name) > MAX_CREDENTIAL_NAME_BYTES || typeof credentialValue !== "string" || credentialValue.length === 0 || typeof prefix !== "undefined" && typeof prefix !== "string" || /[\r\n\0]/.test(name) || /[\r\n\0]/.test(credentialValue) || typeof prefix === "string" && /[\r\n\0]/.test(prefix) || Buffer.byteLength(`${typeof prefix === "string" ? prefix : ""}${credentialValue}`) > MAX_CREDENTIAL_VALUE_BYTES) {
+      throw new Error("connection credential returned an invalid placement");
+    }
+    const normalizedName = carrier === "header" ? name.toLowerCase() : name;
+    if (carrier === "header" && (!HEADER_NAME_PATTERN.test(name) || FORBIDDEN_CREDENTIAL_HEADERS.has(normalizedName) || normalizedName.startsWith("sec-")) || carrier === "query" && !QUERY_NAME_PATTERN.test(name) || carrier === "cookie" && (!COOKIE_NAME_PATTERN.test(name) || /;/.test(`${prefix ?? ""}${credentialValue}`))) {
+      throw new Error("connection credential returned an invalid placement");
+    }
+    const key = `${carrier}\0${normalizedName}`;
+    if (seen.has(key)) {
+      throw new Error("connection credential returned duplicate placements");
+    }
+    seen.add(key);
+    return {
+      carrier,
+      name,
+      value: credentialValue,
+      ...typeof prefix === "string" && prefix.length > 0 ? { prefix } : {}
+    };
+  });
+}
+function headerMapForPlacements(placements) {
+  const headers = {};
+  for (const placement of placements) {
+    if (placement.carrier === "header") {
+      headers[placement.name] = `${placement.prefix ?? ""}${placement.value}`;
+    }
+  }
+  return headers;
+}
+var inflight = /* @__PURE__ */ new Map();
+var REFRESH_WINDOW_MS = 6e4;
+var CONNECTION_REFRESH_TIMEOUT_MS = 1e4;
+function buildConnectionTokenResolver(db, settings, deps, options = {}) {
+  const load = async (input, lookupDb = db) => {
+    const subjectOwned = input.connectionRef.subjectScope === "subject";
+    if (subjectOwned && !input.subjectId) {
+      return null;
+    }
+    const request = {
+      workspaceId: input.workspaceId,
+      providerDomain: input.connectionRef.providerDomain,
+      allowSubjectOwned: subjectOwned,
+      ...subjectOwned ? { subjectId: input.subjectId } : {},
+      ...input.expectedAuthorityGeneration !== void 0 ? { expectedAuthorityGeneration: input.expectedAuthorityGeneration } : {}
+    };
+    if (input.connectionRef.connectionId !== void 0) {
+      request.connectionId = input.connectionRef.connectionId;
+    }
+    if (input.connectionRef.kind !== void 0) {
+      request.kind = input.connectionRef.kind;
+    }
+    const credential = await deps.loadCredential(lookupDb, settings, request);
+    if (!credential) return null;
+    if (input.expectedAuthorityGeneration !== void 0 && credential.authorityGeneration !== input.expectedAuthorityGeneration) {
+      return null;
+    }
+    if (subjectOwned) {
+      return credential.subjectId === input.subjectId ? credential : null;
+    }
+    return credential.subjectId === null ? credential : null;
+  };
+  const snapshot = async (cred, ref, destinationUrl, inputCredentialTarget, connectionUseAttribution, recordUsage = true) => {
+    if (cred.status !== "active") {
+      return authNeededForStatus(cred, ref);
+    }
+    if (!connectionBindingMatches(cred, ref, destinationUrl)) {
+      return authNeeded(ref, "missing_connection", cred.id);
+    }
+    const missingScopes = missingRequestedScopes(
+      ref.scopes,
+      cred.grantedScopes,
+      cred.providerDomain
+    );
+    if (missingScopes.length > 0) {
+      return {
+        status: "auth_needed",
+        reason: "insufficient_scope",
+        providerDomain: ref.providerDomain,
+        ...ref.provider ? { provider: ref.provider } : {},
+        connectionId: cred.id,
+        scopes: missingScopes,
+        ...ref.resource ? { resource: ref.resource } : {},
+        ...ref.selectedResources ? { selectedResources: copySelectedResources(ref.selectedResources) } : {}
+      };
+    }
+    const material = credentialMaterialForConnection(cred, inputCredentialTarget);
+    if (material.status !== "ok") {
+      return {
+        status: "auth_needed",
+        reason: material.status === "unsupported" ? "unsupported_auth" : "refresh_failed",
+        providerDomain: ref.providerDomain,
+        ...ref.provider ? { provider: ref.provider } : {},
+        connectionId: cred.id,
+        ...ref.scopes ? { scopes: ref.scopes } : {},
+        ...ref.resource ? { resource: ref.resource } : {},
+        ...ref.selectedResources ? { selectedResources: copySelectedResources(ref.selectedResources) } : {}
+      };
+    }
+    if (recordUsage) {
+      await deps.recordUsed(db, cred.workspaceId, cred.id, cred.subjectId);
+    }
+    return {
+      status: "ok",
+      headers: material.headers,
+      ...material.placements ? { placements: material.placements } : {},
+      connectionId: cred.id,
+      connectionVersion: cred.version,
+      ...connectionUseAttribution ? { connectionUseAttribution } : {},
+      expiresAt: cred.expiresAt
+    };
+  };
+  const performRefresh = async (cred, ref, lockedDb) => {
+    const key = deps.keyBytes(settings);
+    if (!key) {
+      throw new Error("OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY is not configured");
+    }
+    const refreshed = await deps.refresh(cred, ref, settings, options.refreshTransport);
+    const refreshRecord = {
+      id: cred.id,
+      version: cred.version,
+      workspaceId: cred.workspaceId,
+      credentialEncrypted: deps.encrypt(key, JSON.stringify(refreshed.credential)),
+      expiresAt: refreshed.expiresAt,
+      lastRefreshAt: deps.now(),
+      subjectId: cred.subjectId
+    };
+    if (refreshed.grantedScopes !== void 0) {
+      refreshRecord.grantedScopes = refreshed.grantedScopes;
+    }
+    if (refreshed.metadata !== void 0) {
+      refreshRecord.metadata = refreshed.metadata;
+    }
+    const persisted = await deps.recordRefresh(lockedDb, refreshRecord);
+    if (persisted) {
+      const current = await load(
+        {
+          workspaceId: cred.workspaceId,
+          connectionRef: { ...ref, connectionId: cred.id },
+          ...cred.subjectId ? { subjectId: cred.subjectId } : {}
+        },
+        lockedDb
+      );
+      if (current) {
+        return current;
+      }
+    }
+    const winner = await load(
+      {
+        workspaceId: cred.workspaceId,
+        connectionRef: { ...ref, connectionId: cred.id },
+        ...cred.subjectId ? { subjectId: cred.subjectId } : {}
+      },
+      lockedDb
+    );
+    if (winner?.status === "active") {
+      return winner;
+    }
+    throw new Error("connection credential changed during token refresh");
+  };
+  const refreshSingleFlight = (cred, ref) => {
+    const key = `${cred.subjectId ?? "workspace"}:${cred.id}:${cred.version}`;
+    const existing = inflight.get(key);
+    if (existing) {
+      return existing;
+    }
+    const promise = (deps.withRefreshLock ?? withConnectionRefreshLock)(
+      db,
+      cred,
+      async (lockedDb) => {
+        const current = await load(
+          {
+            workspaceId: cred.workspaceId,
+            connectionRef: { ...ref, connectionId: cred.id },
+            ...cred.subjectId ? { subjectId: cred.subjectId } : {}
+          },
+          lockedDb
+        );
+        if (!current || current.authorityGeneration !== cred.authorityGeneration)
+          throw new Error("Connection authority changed before token refresh");
+        if (current.status !== "active" || current.version !== cred.version) return current;
+        return performRefresh(current, ref, lockedDb);
+      }
+    ).finally(() => {
+      if (inflight.get(key) === promise) {
+        inflight.delete(key);
+      }
+    });
+    inflight.set(key, promise);
+    return promise;
+  };
+  return async (input) => {
+    const credentialResolutionMode = input.credentialResolutionMode ?? "execution";
+    let ref = input.connectionRef;
+    let subjectId = input.subjectId;
+    let credentialWorkspaceId = input.workspaceId;
+    let expectedAuthorityGeneration = input.expectedAuthorityGeneration;
+    let connectionUseAttribution;
+    if (ref.authoritySource === "host") {
+      return authNeeded(ref, "unsupported_auth", ref.connectionId);
+    }
+    if (ref.selectedResources) {
+      return authNeeded(ref, "resource_scope_unavailable", ref.connectionId);
+    }
+    if (input.connectionUseContext !== void 0) {
+      if (!deps.authorizeAcceptedUse) {
+        return authNeeded(
+          ref,
+          ref.subjectScope === "subject" ? "personal_authority_unavailable" : "missing_connection",
+          ref.connectionId
+        );
+      }
+      const authorization = await deps.authorizeAcceptedUse(db, {
+        ...input.connectionUseContext,
+        serverId: input.serverId,
+        ...ref.connectionId ? { connectionId: ref.connectionId } : {},
+        providerDomain: ref.providerDomain,
+        ...ref.kind ? { connectionKind: ref.kind } : {},
+        subjectScope: ref.subjectScope === "subject" ? "subject" : "workspace",
+        // An owner binding belongs only to the personal lanes. Interactive
+        // turns stamp the initiating human's subjectId on every credential
+        // request regardless of ref scope; forwarding it for a workspace ref
+        // would make the 0279 workspace lane deny the ambient shared row.
+        ...ref.subjectScope === "subject" && subjectId ? { ownerSubjectId: subjectId } : {}
+      });
+      if (authorization.status === "denied") {
+        return authNeeded(
+          ref,
+          ref.subjectScope === "subject" ? "personal_authority_unavailable" : "missing_connection",
+          ref.connectionId
+        );
+      }
+      if (expectedAuthorityGeneration !== void 0 && authorization.attribution.connectionGeneration !== expectedAuthorityGeneration) {
+        return authNeeded(
+          ref,
+          authorityReasonForScope(ref.subjectScope === "subject"),
+          ref.connectionId
+        );
+      }
+      connectionUseAttribution = authorization.attribution;
+      expectedAuthorityGeneration = authorization.attribution.connectionGeneration;
+      const expectedPersonal = authorization.attribution.scope !== "workspace";
+      credentialWorkspaceId = authorization.originWorkspaceId;
+      subjectId = authorization.attribution.ownerSubjectId ?? void 0;
+      ref = {
+        ...ref,
+        connectionId: authorization.attribution.connectionId,
+        kind: authorization.connectionKind,
+        subjectScope: expectedPersonal ? "subject" : "workspace"
+      };
+    }
+    if (ref.subjectScope === "subject" && !subjectId) {
+      return authNeeded(ref, "personal_authority_unavailable", ref.connectionId);
+    }
+    let cred;
+    try {
+      cred = await load({
+        workspaceId: credentialWorkspaceId,
+        connectionRef: ref,
+        ...subjectId ? { subjectId } : {},
+        ...expectedAuthorityGeneration !== void 0 ? { expectedAuthorityGeneration } : {}
+      });
+    } catch {
+      return authNeeded(ref, "refresh_failed");
+    }
+    if (!cred) {
+      return authNeeded(ref, "missing_connection");
+    }
+    if (cred.status !== "active") {
+      return authNeededForStatus(cred, ref);
+    }
+    if (!connectionBindingMatches(cred, ref, input.destinationUrl)) {
+      return authNeeded(ref, "missing_connection", cred.id);
+    }
+    const now = deps.now();
+    if (credentialResolutionMode === "preflight" && cred.kind === "oauth2" && (input.forceRefresh === true || cred.expiresAt !== null && cred.expiresAt.getTime() <= now.getTime())) {
+      return authNeeded(ref, "refresh_failed", cred.id);
+    }
+    if (credentialResolutionMode === "execution" && shouldRefresh(cred, input.forceRefresh === true, now)) {
+      try {
+        cred = await refreshSingleFlight(cred, ref);
+      } catch (error) {
+        if (isPermanentRefreshError(error)) {
+          let handled = false;
+          if (options.transitionPermanentRefreshFailure) {
+            try {
+              handled = await options.transitionPermanentRefreshFailure({
+                workspaceId: cred.workspaceId,
+                connectionId: cred.id,
+                connectionVersion: cred.version,
+                subjectId: cred.subjectId,
+                providerDomain: cred.providerDomain,
+                httpStatus: error.httpStatus,
+                oauthErrorCode: error.oauthErrorCode
+              });
+            } catch {
+              handled = false;
+            }
+          }
+          if (!handled) {
+            await deps.setStatus(db, cred.workspaceId, "needs_reauth", error.message, {
+              id: cred.id,
+              version: cred.version,
+              subjectId: cred.subjectId
+            }).catch(() => void 0);
+          }
+        }
+        return authNeeded(ref, "refresh_failed", cred.id);
+      }
+    }
+    if (expectedAuthorityGeneration !== void 0 && cred.authorityGeneration !== expectedAuthorityGeneration) {
+      return authNeeded(ref, authorityReasonForScope(ref.subjectScope === "subject"), cred.id);
+    }
+    return await snapshot(
+      cred,
+      ref,
+      input.destinationUrl,
+      input.credentialTarget ?? "mcp",
+      connectionUseAttribution,
+      credentialResolutionMode === "execution"
+    );
+  };
+}
+function authorityReasonForScope(personal) {
+  return personal ? "personal_authority_unavailable" : "missing_connection";
+}
+function connectionBindingMatches(cred, ref, destinationUrl) {
+  if (cred.providerDomain.toLowerCase() !== ref.providerDomain.toLowerCase()) return false;
+  if (ref.kind && cred.kind !== ref.kind) return false;
+  const credential = cred.credential;
+  const metadata = cred.metadata;
+  const boundMcpUrl = stringValue(credential.mcp_url) ?? stringValue(metadata.mcpUrl);
+  const destination = canonicalHttpUrl(destinationUrl);
+  if (!destination) return false;
+  if (boundMcpUrl) {
+    const binding = canonicalHttpUrl(boundMcpUrl);
+    if (!binding || destination !== binding && !(binding === canonicalHttpUrl(OFFICIAL_GMAIL_MCP_RESOURCE) && isOfficialGmailRestDestination(destination, ref))) {
+      return false;
+    }
+  } else if (!destinationHostMatchesProvider(destination, cred.providerDomain)) {
+    return false;
+  }
+  if (cred.kind !== "oauth2") return true;
+  const boundResource = stringValue(credential.resource) ?? stringValue(metadata.resource);
+  if (ref.resource) {
+    if (!boundResource) return false;
+    if (canonicalResource(ref.resource) !== canonicalResource(boundResource)) return false;
+  }
+  return true;
+}
+function connectionMetadataMatchesBinding(connection, ref, destinationUrl) {
+  return connectionBindingMatches({ ...connection, credential: {} }, ref, destinationUrl) && missingRequestedScopes(ref.scopes, connection.grantedScopes, connection.providerDomain).length === 0;
+}
+function destinationHostMatchesProvider(destinationUrl, providerDomain) {
+  const destinationHost = new URL(destinationUrl).hostname.toLowerCase();
+  const provider = providerDomain.trim().toLowerCase().replace(/^\.+|\.+$/g, "");
+  return Boolean(provider) && (destinationHost === provider || destinationHost.endsWith(`.${provider}`));
+}
+function canonicalHttpUrl(value) {
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+    url.hash = "";
+    url.hostname = url.hostname.toLowerCase();
+    if (url.protocol === "https:" && url.port === "443" || url.protocol === "http:" && url.port === "80") {
+      url.port = "";
+    }
+    url.pathname = url.pathname.replace(/\/+$/, "") || "/";
+    return url.toString();
+  } catch {
+    return null;
+  }
+}
+function canonicalResource(value) {
+  return canonicalHttpUrl(value) ?? value.trim();
+}
+var ConnectionRefreshHttpError = class extends Error {
+  httpStatus;
+  oauthErrorCode;
+  constructor(httpStatus, oauthErrorCode = null) {
+    super(`connection refresh failed with HTTP ${httpStatus}`);
+    this.name = "ConnectionRefreshHttpError";
+    this.httpStatus = httpStatus;
+    this.oauthErrorCode = oauthErrorCode;
+  }
+};
+function isPermanentRefreshError(error) {
+  return error instanceof ConnectionRefreshHttpError && error.httpStatus >= 400 && error.httpStatus < 500 && error.httpStatus !== 408 && error.httpStatus !== 429;
+}
+function shouldRefresh(cred, force, now) {
+  if (cred.kind !== "oauth2") {
+    return false;
+  }
+  if (force) {
+    return true;
+  }
+  if (!cred.expiresAt) {
+    return false;
+  }
+  return cred.expiresAt.getTime() <= now.getTime() + REFRESH_WINDOW_MS;
+}
+function authNeeded(ref, reason, connectionId) {
+  return {
+    status: "auth_needed",
+    reason,
+    providerDomain: ref.providerDomain,
+    ...ref.provider ? { provider: ref.provider } : {},
+    ...connectionId ? { connectionId } : {},
+    ...ref.scopes ? { scopes: ref.scopes } : {},
+    ...ref.resource ? { resource: ref.resource } : {},
+    ...ref.selectedResources ? { selectedResources: copySelectedResources(ref.selectedResources) } : {}
+  };
+}
+function authNeededForStatus(cred, ref) {
+  if (cred.status === "revoked") {
+    return authNeeded(ref, "missing_connection", cred.id);
+  }
+  return authNeeded(
+    ref,
+    cred.expiresAt && cred.expiresAt.getTime() <= Date.now() ? "expired" : "refresh_failed",
+    cred.id
+  );
+}
+function missingRequestedScopes(requested, granted, providerDomain) {
+  if (!requested?.length) {
+    return [];
+  }
+  const grantedSet = new Set(granted.map((scope) => connectionScopeKey(providerDomain, scope)));
+  return requested.filter((scope) => !grantedSet.has(connectionScopeKey(providerDomain, scope)));
+}
+function normalizeBearerScheme(tokenType) {
+  return !tokenType || /^bearer$/i.test(tokenType) ? "Bearer" : tokenType;
+}
+function credentialMaterialForConnection(cred, target) {
+  if (cred.kind === "oauth2") {
+    const accessToken = stringValue(cred.credential.access_token);
+    if (!accessToken) {
+      return { status: "invalid" };
+    }
+    return {
+      status: "ok",
+      headers: {
+        authorization: `${normalizeBearerScheme(stringValue(cred.credential.token_type))} ${accessToken}`
+      }
+    };
+  }
+  const rawPlacements = cred.credential.placements;
+  if (rawPlacements !== void 0) {
+    let placements;
+    try {
+      placements = normalizedCredentialPlacements(rawPlacements);
+    } catch {
+      return { status: "invalid" };
+    }
+    if (target !== "http_api" && placements.some((placement) => placement.carrier !== "header")) {
+      return { status: "unsupported" };
+    }
+    return {
+      status: "ok",
+      headers: headerMapForPlacements(placements),
+      placements
+    };
+  }
+  try {
+    const headers = normalizedCredentialHeaders(
+      stringRecord(cred.credential.headers) ?? {}
+    );
+    return { status: "ok", headers };
+  } catch {
+    return { status: "invalid" };
+  }
+}
+async function refreshOAuthConnectionCredential(cred, ref, settings, transportOptions = {}) {
+  if (cred.kind !== "oauth2") {
+    return {
+      credential: cred.credential,
+      expiresAt: cred.expiresAt,
+      grantedScopes: cred.grantedScopes
+    };
+  }
+  const refreshToken = stringValue(cred.credential.refresh_token);
+  const personalGitHubMetadata = PersonalGitHubConnectionMetadata.safeParse(cred.metadata);
+  const personalGitHub = cred.providerDomain.toLowerCase() === PERSONAL_GITHUB_PROVIDER_DOMAIN && personalGitHubMetadata.success;
+  const storedTokenEndpoint = stringValue(cred.credential.token_endpoint) ?? stringValue(cred.metadata.tokenEndpoint) ?? stringValue(cred.metadata.token_endpoint);
+  const tokenEndpoint = personalGitHub ? PERSONAL_GITHUB_TOKEN_URL : storedTokenEndpoint;
+  if (!refreshToken || !tokenEndpoint) {
+    throw new Error("connection has no refresh token endpoint");
+  }
+  if (personalGitHub && storedTokenEndpoint !== PERSONAL_GITHUB_TOKEN_URL) {
+    throw new ConnectionRefreshHttpError(401, "client_unavailable");
+  }
+  let validatedTokenEndpoint;
+  try {
+    validatedTokenEndpoint = validateHttpUrl(tokenEndpoint, {
+      label: "OAuth refresh token endpoint",
+      allowLoopbackHttp: settings.environment === "local" || settings.environment === "test"
+    });
+  } catch {
+    throw new Error("connection has an invalid refresh token endpoint");
+  }
+  const body = new URLSearchParams();
+  body.set("grant_type", "refresh_token");
+  body.set("refresh_token", refreshToken);
+  const clientId = stringValue(cred.credential.client_id) ?? stringValue(cred.metadata.clientId) ?? stringValue(cred.metadata.client_id);
+  const clientSecret = personalGitHub ? settings.githubPersonalOauthClientSecret : stringValue(cred.credential.client_secret);
+  const authMethod = stringValue(
+    cred.credential.token_endpoint_auth_method
+  ) ?? "none";
+  if (personalGitHub && (!settings.githubPersonalOauthEnabled || !clientId || clientId !== settings.githubPersonalOauthClientId || personalGitHubMetadata.data.oauthEnvironment !== settings.environment || personalGitHubMetadata.data.oauthClientMarker !== createHash("sha256").update(clientId).digest("hex").slice(0, 32) || !clientSecret)) {
+    throw new ConnectionRefreshHttpError(401, "client_unavailable");
+  }
+  if (clientId) {
+    body.set("client_id", clientId);
+  }
+  const tokenRequestEncoding = stringValue(
+    cred.credential.token_request_encoding
+  ) === "json" ? "json" : "form";
+  const headers = {
+    "content-type": tokenRequestEncoding === "json" ? "application/json" : "application/x-www-form-urlencoded"
+  };
+  if (clientSecret && authMethod === "client_secret_post") {
+    body.set("client_secret", clientSecret);
+  } else if (clientId && clientSecret && authMethod === "client_secret_basic") {
+    headers.authorization = `Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString("base64")}`;
+  }
+  const resource = ref.resource ?? stringValue(cred.credential.resource);
+  const resourceParameterSupported = cred.credential.resource_parameter_supported !== false;
+  if (resource && resourceParameterSupported) {
+    body.set("resource", resource);
+  }
+  const scopeParameterSupported = cred.credential.scope_parameter_supported !== false;
+  if (ref.scopes?.length && scopeParameterSupported) {
+    body.set("scope", ref.scopes.join(" "));
+  }
+  const requestBody = tokenRequestEncoding === "json" ? JSON.stringify(Object.fromEntries(body.entries())) : body;
+  const response = await pinnedFetch(
+    validatedTokenEndpoint,
+    {
+      method: "POST",
+      headers,
+      body: requestBody,
+      signal: AbortSignal.timeout(CONNECTION_REFRESH_TIMEOUT_MS)
+    },
+    settings,
+    {
+      fetchImpl: transportOptions.fetchImpl ?? undiciFetch,
+      ...transportOptions.dnsLookup ? { dnsLookup: transportOptions.dnsLookup } : {},
+      label: "OAuth token endpoint",
+      requireHttpsOutsideLocalTest: true
+    }
+  );
+  if (response.status >= 300 && response.status < 400) {
+    await cancelResponseBody(response);
+    throw new ConnectionRefreshHttpError(response.status);
+  }
+  if (!response.ok) {
+    throw new ConnectionRefreshHttpError(
+      response.status,
+      await readOAuthRefreshErrorCode(response)
+    );
+  }
+  const payload = await readResponseJsonBounded(
+    response,
+    OAUTH_MAX_RESPONSE_BYTES,
+    "OAuth refresh token response"
+  );
+  const accessToken = stringValue(payload.access_token);
+  if (!accessToken) {
+    throw new Error("connection refresh response did not include access_token");
+  }
+  const expiresAt = expiresAtFromTokenResponse(payload, cred.expiresAt);
+  const scopeText = stringValue(payload.scope);
+  const returnedScopes = scopeText?.split(/[\s,]+/).filter(Boolean) ?? [];
+  if (scopeText && ref.providerDomain.toLowerCase() === "graph.microsoft.com" && !returnedScopes.some((scope) => scope.toLowerCase() === "offline_access")) {
+    returnedScopes.push("offline_access");
+  }
+  const refreshTokenExpiresIn = typeof payload.refresh_token_expires_in === "number" ? payload.refresh_token_expires_in : void 0;
+  const refreshTokenExpiresAt = personalGitHub && refreshTokenExpiresIn && refreshTokenExpiresIn > 0 ? new Date(Date.now() + refreshTokenExpiresIn * 1e3).toISOString() : null;
+  if (personalGitHub && scopeText && (returnedScopes.length !== PERSONAL_GITHUB_REQUESTED_SCOPES.length || returnedScopes.some((scope) => !PERSONAL_GITHUB_REQUESTED_SCOPES.includes(scope)))) {
+    throw new ConnectionRefreshHttpError(401, "scope_changed");
+  }
+  const nextCredential = {
+    ...cred.credential,
+    access_token: accessToken,
+    refresh_token: stringValue(payload.refresh_token) ?? refreshToken,
+    token_type: stringValue(payload.token_type) ?? stringValue(cred.credential.token_type) ?? "Bearer",
+    ...expiresAt ? { expires_at: expiresAt.toISOString() } : {},
+    ...resource ? { resource } : {},
+    ...scopeText ? {
+      scope: ref.providerDomain.toLowerCase() === "graph.microsoft.com" ? returnedScopes.join(" ") : scopeText
+    } : {},
+    ...refreshTokenExpiresAt ? { refresh_token_expires_at: refreshTokenExpiresAt } : {},
+    ...clientSecret && !personalGitHub ? { client_secret: clientSecret, token_endpoint_auth_method: authMethod } : {}
+  };
+  return {
+    credential: nextCredential,
+    expiresAt,
+    ...personalGitHub ? { grantedScopes: [...PERSONAL_GITHUB_REQUESTED_SCOPES] } : scopeText ? { grantedScopes: returnedScopes } : {},
+    ...refreshTokenExpiresAt ? {
+      metadata: PersonalGitHubConnectionMetadata.parse({
+        ...personalGitHubMetadata.data,
+        refreshTokenExpiresAt
+      })
+    } : {}
+  };
+}
+async function readOAuthRefreshErrorCode(response) {
+  try {
+    const payload = await readResponseJsonBounded(
+      response,
+      OAUTH_MAX_RESPONSE_BYTES,
+      "OAuth refresh error response"
+    );
+    const code = stringValue(payload.error);
+    return code && /^[a-z0-9_.-]{1,64}$/i.test(code) ? code : null;
+  } catch {
+    await cancelResponseBody(response);
+    return null;
+  }
+}
+function expiresAtFromTokenResponse(payload, fallback) {
+  const expiresAt = stringValue(payload.expires_at);
+  if (expiresAt) {
+    const parsed = new Date(expiresAt);
+    return Number.isNaN(parsed.getTime()) ? fallback : parsed;
+  }
+  const expiresIn = typeof payload.expires_in === "number" ? payload.expires_in : void 0;
+  if (expiresIn && Number.isFinite(expiresIn) && expiresIn > 0) {
+    return new Date(Date.now() + expiresIn * 1e3);
+  }
+  return fallback;
+}
+function stringRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  const out = {};
+  for (const [key, raw] of Object.entries(value)) {
+    if (typeof raw !== "string") {
+      return null;
+    }
+    out[key] = raw;
+  }
+  return out;
+}
+function stringValue(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+async function cancelResponseBody(response) {
+  await response.body?.cancel().catch(() => void 0);
+}
+
+export {
+  connectionScopeKey,
+  normalizedCredentialHeaders,
+  buildConnectionTokenResolver,
+  connectionMetadataMatchesBinding,
+  ConnectionRefreshHttpError,
+  normalizeBearerScheme,
+  refreshOAuthConnectionCredential,
+  isPrivateAddress
+};
+//# sourceMappingURL=chunk-OYD7FLKH.js.map