@polpo-ai/connect-server 0.15.143 → 0.16.0

package/dist/memory-store.js

@@ -1,4 +1,4 @@
-import { ConnectError, } from "@polpo-ai/connect";
+import { ConnectError, canCommitMcpOAuthConnection, canCommitMcpOAuthSetup, canFailMcpOAuthSetup, failedMcpOAuthState, completedMcpOAuthState, matchesOAuthReconnect, canConsumeConnectionSetup, finishConnectionSetup, prepareConnectionSetupCompletion, reconcileConnectionSetup, } from "@polpo-ai/connect";
 export class MemoryConnectStore {
     connections = new Map();
     oauthStates = new Map();
@@ -26,6 +26,14 @@ export class MemoryConnectStore {
     async deleteConnection(id) {
         this.connections.delete(id);
     }
+    async replaceOAuthCredential(expected, replacement) {
+        const current = this.connections.get(expected.connectionId);
+        if (!current || !matchesOAuthReconnect(current, expected))
+            return null;
+        const next = { ...current, ...clone(replacement) };
+        this.connections.set(current.id, next);
+        return clone(next);
+    }
     async saveOAuthState(record) {
         this.oauthStates.set(record.state, clone(record));
     }
@@ -38,10 +46,40 @@ export class MemoryConnectStore {
         const record = this.oauthStates.get(state);
         return record ? clone(record) : null;
     }
+    async commitMcpOAuthConnection(input) {
+        const state = this.oauthStates.get(input.state);
+        if (!state || !canCommitMcpOAuthConnection(state, input) || this.connections.has(input.connection.id))
+            return null;
+        const connection = clone(input.connection);
+        this.connections.set(connection.id, connection);
+        this.oauthStates.set(input.state, clone(completedMcpOAuthState(state, connection.id)));
+        return clone(connection);
+    }
+    async commitMcpOAuthSetup(input) {
+        const state = this.oauthStates.get(input.state), setup = this.setupSessions.get(input.setupReference);
+        if (!state || !setup || !canCommitMcpOAuthSetup(state, setup, input)
+            || this.connections.has(input.connection.id) || this.links.has(input.link.id)
+            || [...this.links.values()].some(link => link.connectionId === input.connection.id && link.projectId === input.link.projectId))
+            return null;
+        this.connections.set(input.connection.id, clone(input.connection));
+        this.links.set(input.link.id, clone(input.link));
+        this.setupSessions.set(setup.id, clone(finishConnectionSetup(setup, { status: "completed", connectionId: input.connection.id })));
+        this.oauthStates.set(input.state, clone(completedMcpOAuthState(state, input.connection.id)));
+        return clone(input.connection);
+    }
+    async failMcpOAuthSetup(input) {
+        const state = this.oauthStates.get(input.state), setup = this.setupSessions.get(input.setupReference);
+        if (!state || !setup || !canFailMcpOAuthSetup(state, setup, input))
+            return null;
+        const failed = finishConnectionSetup(setup, { status: "error" });
+        this.setupSessions.set(setup.id, clone(failed));
+        this.oauthStates.set(input.state, clone(failedMcpOAuthState(state)));
+        return clone(failed);
+    }
     async claimOAuthState(state, claimToken, claimExpiresAt, now) {
         const record = this.oauthStates.get(state);
-        if (!record || record.status === "completed")
-            return record ? clone(record) : null;
+        if (!record || record.status === "completed" || record.status === "failed" || !(Date.parse(record.expiresAt) > Date.parse(now)))
+            return null;
         if (record.status === "processing"
             && record.claimExpiresAt
             && new Date(record.claimExpiresAt).getTime() > new Date(now).getTime())
@@ -114,14 +152,51 @@ export class MemoryConnectStore {
         const session = this.setupSessions.get(id);
         return session ? clone(session) : null;
     }
-    async consumeConnectionSetupSession(id, consumedAt) {
+    getConnectionSetupSessionByReference(reference) {
+        return this.getConnectionSetupSession(reference);
+    }
+    async consumeConnectionSetupSession(id, consumedAt, authorizationExpiresAt) {
         const session = this.setupSessions.get(id);
-        if (!session || session.consumedAt)
+        if (!session || !canConsumeConnectionSetup(session, consumedAt))
             return null;
-        const consumed = { ...session, consumedAt };
+        const consumed = { ...session, status: "started", consumedAt, authorizationExpiresAt };
         this.setupSessions.set(id, clone(consumed));
         return clone(session);
     }
+    async cancelConnectionSetupSession(id, cancelledAt) {
+        const session = this.setupSessions.get(id);
+        if (!session || !canConsumeConnectionSetup(session, cancelledAt))
+            return null;
+        const cancelled = { ...session, status: "cancelled" };
+        this.setupSessions.set(id, clone(cancelled));
+        return clone(cancelled);
+    }
+    async prepareConnectionSetupCompletion(reference, intent) {
+        const session = this.setupSessions.get(reference);
+        const prepared = session ? prepareConnectionSetupCompletion(session, intent) : null;
+        if (!prepared)
+            return null;
+        this.setupSessions.set(reference, clone(prepared));
+        return clone(prepared);
+    }
+    async reconcileConnectionSetupSession(reference) {
+        const session = this.setupSessions.get(reference);
+        if (!session)
+            return null;
+        const intent = session.completionIntent;
+        const reconciled = intent ? reconcileConnectionSetup(session, this.connections.get(intent.connection.connectionId) ?? null, this.links.get(intent.link.id) ?? null) : null;
+        if (reconciled)
+            this.setupSessions.set(reference, clone(reconciled));
+        return clone(reconciled ?? session);
+    }
+    async finishConnectionSetupSession(reference, outcome, _finishedAt) {
+        const session = this.setupSessions.get(reference);
+        const finished = session ? finishConnectionSetup(session, outcome) : null;
+        if (!finished)
+            return null;
+        this.setupSessions.set(reference, clone(finished));
+        return clone(finished);
+    }
 }
 function matchesFilter(connection, filter) {
     if (filter.providerId && connection.providerId !== filter.providerId)

package/dist/memory-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"memory-store.js","sourceRoot":"","sources":["../src/memory-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,GAUb,MAAM,mBAAmB,CAAC;AAE3B,MAAM,OAAO,kBAAkB;IACZ,WAAW,GAAG,IAAI,GAAG,EAA4B,CAAC;IAClD,WAAW,GAAG,IAAI,GAAG,EAA4B,CAAC;IAClD,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC1C,aAAa,GAAG,IAAI,GAAG,EAAkC,CAAC;IAE3E,KAAK,CAAC,eAAe,CAAC,SAA+B,EAAE;QACrD,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7G,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,EAAU;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxC,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAwB;QAC7C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/C,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,EAAU,EAAE,KAA0D;QAC3F,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,YAAY,CAAC,sBAAsB,EAAE,yBAAyB,EAAE,EAAE,CAAC,CAAC;QAC7F,MAAM,OAAO,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC7E,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACzC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,EAAU;QAC/B,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAwB;QAC3C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,KAAa,EACb,UAAkB,EAClB,cAAsB,EACtB,GAAW;QAEX,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnF,IACE,MAAM,CAAC,MAAM,KAAK,YAAY;eAC3B,MAAM,CAAC,cAAc;eACrB,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE;YACtE,OAAO,IAAI,CAAC;QACd,MAAM,OAAO,GAAqB;YAChC,GAAG,MAAM;YACT,MAAM,EAAE,YAAY;YACpB,UAAU;YACV,cAAc;YACd,QAAQ,EAAE,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC;SACrC,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,KAAa,EACb,UAAkB,EAClB,YAAoB;QAEpB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC;QAC7D,MAAM,SAAS,GAAqB;YAClC,GAAG,MAAM;YACT,MAAM,EAAE,WAAW;YACnB,qBAAqB,EAAE,YAAY;YACnC,UAAU,EAAE,SAAS;YACrB,cAAc,EAAE,SAAS;YACzB,aAAa,EAAE,SAAS;SACzB,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QAC9C,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,KAAa,EACb,UAAkB,EAClB,SAAiB;QAEjB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC;QAC7D,MAAM,QAAQ,GAAqB;YACjC,GAAG,MAAM;YACT,MAAM,EAAE,SAAS;YACjB,UAAU,EAAE,SAAS;YACrB,cAAc,EAAE,SAAS;YACzB,aAAa,EAAE,SAAS;SACzB,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7C,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,SAAmC,EAAE;QAC7D,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAC9C,CAAC,CAAC,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,CAAC;eAChE,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,CAAC;eAC1D,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC;aACpD,GAAG,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,EAAU;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,IAAoB;QAC7C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACrC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,EAAU,EACV,KAAwD;QAExD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,YAAY,CAAC,sBAAsB,EAAE,8BAA8B,EAAE,EAAE,CAAC,CAAC;QAClG,MAAM,OAAO,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC7E,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACnC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,0BAA0B,CAAC,OAA+B;QAC9D,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,yBAAyB,CAAC,EAAU;QACxC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3C,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,6BAA6B,CACjC,EAAU,EACV,UAAkB;QAElB,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAChD,MAAM,QAAQ,GAAG,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,CAAC;QAC5C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;CACF;AAED,SAAS,aAAa,CAAC,UAA4B,EAAE,MAA4B;IAC/E,IAAI,MAAM,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IACnF,IAAI,MAAM,CAAC,SAAS,IAAI,UAAU,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAChF,IAAI,MAAM,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACpE,IAAI,MAAM,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACvE,IAAI,MAAM,CAAC,KAAK,IAAI,CAClB,UAAU,CAAC,KAAK,EAAE,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI;WACzC,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE;WACvC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,eAAe;eACpC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,eAAe,IAAI,UAAU,CAAC,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAC3G;QAAE,OAAO,KAAK,CAAC;IAChB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,KAAK,CAAI,KAAQ;IACxB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAM,CAAC;AAChD,CAAC"}
+{"version":3,"file":"memory-store.js","sourceRoot":"","sources":["../src/memory-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,2BAA2B,EAC3B,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EAItB,qBAAqB,EACrB,yBAAyB,EACzB,qBAAqB,EACrB,gCAAgC,EAChC,wBAAwB,GAczB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,OAAO,kBAAkB;IACZ,WAAW,GAAG,IAAI,GAAG,EAA4B,CAAC;IAClD,WAAW,GAAG,IAAI,GAAG,EAA4B,CAAC;IAClD,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC1C,aAAa,GAAG,IAAI,GAAG,EAAkC,CAAC;IAE3E,KAAK,CAAC,eAAe,CAAC,SAA+B,EAAE;QACrD,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7G,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,EAAU;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxC,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAwB;QAC7C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/C,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,EAAU,EAAE,KAA0D;QAC3F,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,YAAY,CAAC,sBAAsB,EAAE,yBAAyB,EAAE,EAAE,CAAC,CAAC;QAC7F,MAAM,OAAO,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC7E,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACzC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,EAAU;QAC/B,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,QAAgC,EAAE,WAAuC;QACpG,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACvE,MAAM,IAAI,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACvC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAwB;QAC3C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,KAA+B;QAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,IAAI,CAAC,2BAA2B,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACnH,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,sBAAsB,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACvF,OAAO,KAAK,CAAC,UAAU,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,KAA0B;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACtG,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;eAC/D,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;eAC1E,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9I,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,qBAAqB,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,CAAE,CAAC,CAAC,CAAC;QACnI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,sBAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7F,OAAO,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAA2B;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACtG,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAChF,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAE,CAAC;QAClE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,KAAa,EACb,UAAkB,EAClB,cAAsB,EACtB,GAAW;QAEX,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7I,IACE,MAAM,CAAC,MAAM,KAAK,YAAY;eAC3B,MAAM,CAAC,cAAc;eACrB,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE;YACtE,OAAO,IAAI,CAAC;QACd,MAAM,OAAO,GAAqB;YAChC,GAAG,MAAM;YACT,MAAM,EAAE,YAAY;YACpB,UAAU;YACV,cAAc;YACd,QAAQ,EAAE,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC;SACrC,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,KAAa,EACb,UAAkB,EAClB,YAAoB;QAEpB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC;QAC7D,MAAM,SAAS,GAAqB;YAClC,GAAG,MAAM;YACT,MAAM,EAAE,WAAW;YACnB,qBAAqB,EAAE,YAAY;YACnC,UAAU,EAAE,SAAS;YACrB,cAAc,EAAE,SAAS;YACzB,aAAa,EAAE,SAAS;SACzB,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QAC9C,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,KAAa,EACb,UAAkB,EAClB,SAAiB;QAEjB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC;QAC7D,MAAM,QAAQ,GAAqB;YACjC,GAAG,MAAM;YACT,MAAM,EAAE,SAAS;YACjB,UAAU,EAAE,SAAS;YACrB,cAAc,EAAE,SAAS;YACzB,aAAa,EAAE,SAAS;SACzB,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7C,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,SAAmC,EAAE;QAC7D,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAC9C,CAAC,CAAC,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,CAAC;eAChE,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,CAAC;eAC1D,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC;aACpD,GAAG,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,EAAU;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,IAAoB;QAC7C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACrC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,EAAU,EACV,KAAwD;QAExD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,YAAY,CAAC,sBAAsB,EAAE,8BAA8B,EAAE,EAAE,CAAC,CAAC;QAClG,MAAM,OAAO,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC7E,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACnC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,0BAA0B,CAAC,OAA+B;QAC9D,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,yBAAyB,CAAC,EAAU;QACxC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3C,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAED,oCAAoC,CAAC,SAAiB;QACpD,OAAO,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,6BAA6B,CACjC,EAAU,EACV,UAAkB,EAClB,sBAA+B;QAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,IAAI,CAAC,yBAAyB,CAAC,OAAO,EAAE,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7E,MAAM,QAAQ,GAAG,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,SAAkB,EAAE,UAAU,EAAE,sBAAsB,EAAE,CAAC;QAChG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,4BAA4B,CAAC,EAAU,EAAE,WAAmB;QAChE,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,IAAI,CAAC,yBAAyB,CAAC,OAAO,EAAE,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9E,MAAM,SAAS,GAAG,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,WAAoB,EAAE,CAAC;QAC/D,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QAC7C,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,gCAAgC,CAAC,SAAiB,EAAE,MAAuC;QAC/F,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,gCAAgC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpF,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnD,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,+BAA+B,CAAC,SAAiB;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACxC,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,wBAAwB,CAAC,OAAO,EAC1D,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/G,IAAI,UAAU;YAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QACrE,OAAO,KAAK,CAAC,UAAU,IAAI,OAAO,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,4BAA4B,CAAC,SAAiB,EAAE,OAA+B,EAAE,WAAmB;QACxG,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1E,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnD,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;CACF;AAED,SAAS,aAAa,CAAC,UAA4B,EAAE,MAA4B;IAC/E,IAAI,MAAM,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IACnF,IAAI,MAAM,CAAC,SAAS,IAAI,UAAU,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAChF,IAAI,MAAM,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACpE,IAAI,MAAM,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACvE,IAAI,MAAM,CAAC,KAAK,IAAI,CAClB,UAAU,CAAC,KAAK,EAAE,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI;WACzC,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE;WACvC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,eAAe;eACpC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,eAAe,IAAI,UAAU,CAAC,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAC3G;QAAE,OAAO,KAAK,CAAC;IAChB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,KAAK,CAAI,KAAQ;IACxB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAM,CAAC;AAChD,CAAC"}

package/dist/oauth-identity.d.ts

@@ -0,0 +1,6 @@
+import { type OAuth2AuthConfig, type OAuthAccountIdentity, type OAuthUserInfoPolicy } from "@polpo-ai/connect";
+import { type TokenTransportOptions } from "./oauth-token-transport.js";
+export declare function oauthIdentityPolicyFingerprint(policy?: OAuthUserInfoPolicy): string | undefined;
+export declare function normalizeOAuthTokenScopes(auth: OAuth2AuthConfig, scopes: string[]): string[];
+export declare function resolveOAuthAccountIdentity(options: TokenTransportOptions, policy: OAuthUserInfoPolicy, accessToken: string, now: Date): Promise<OAuthAccountIdentity>;
+//# sourceMappingURL=oauth-identity.d.ts.map

package/dist/oauth-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-identity.d.ts","sourceRoot":"","sources":["../src/oauth-identity.ts"],"names":[],"mappings":"AACA,OAAO,EAAiC,KAAK,gBAAgB,EAAE,KAAK,oBAAoB,EAAE,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC9I,OAAO,EAAoB,KAAK,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAE1F,wBAAgB,8BAA8B,CAAC,MAAM,CAAC,EAAE,mBAAmB,GAAG,MAAM,GAAG,SAAS,CAK/F;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAG5F;AAED,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,qBAAqB,EAC9B,MAAM,EAAE,mBAAmB,EAC3B,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,oBAAoB,CAAC,CAa/B"}

package/dist/oauth-identity.js

@@ -0,0 +1,30 @@
+import { createHash } from "node:crypto";
+import { ConnectError, normalizeScopes } from "@polpo-ai/connect";
+import { requestOAuthJson } from "./oauth-token-transport.js";
+export function oauthIdentityPolicyFingerprint(policy) {
+    return policy ? createHash("sha256").update(JSON.stringify([
+        policy.method, policy.issuer, policy.url, [...policy.requiredScopes].sort(),
+        Object.entries(policy.scopeAliases ?? {}).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0),
+    ])).digest("hex") : undefined;
+}
+export function normalizeOAuthTokenScopes(auth, scopes) {
+    const aliases = auth.identity?.scopeAliases;
+    return normalizeScopes(scopes.map(scope => aliases && Object.hasOwn(aliases, scope) ? aliases[scope] : scope));
+}
+export async function resolveOAuthAccountIdentity(options, policy, accessToken, now) {
+    const fail = (category, status) => new ConnectError("setup_invalid", "OAuth account identity could not be verified", {
+        details: { category, ...(status === undefined ? {} : { providerStatus: status }) },
+    });
+    const body = await requestOAuthJson({ ...options, requireJsonContentType: true }, policy.url, {
+        method: "GET", headers: { authorization: `Bearer ${accessToken}`, accept: "application/json" },
+    }, fail);
+    if (!body || typeof body !== "object" || Array.isArray(body))
+        throw fail("invalid_identity");
+    const value = body;
+    if (typeof value.sub !== "string" || !/^[\x21-\x7e]{1,255}$/.test(value.sub)
+        || (value.iss !== undefined && value.iss !== policy.issuer))
+        throw fail("invalid_identity");
+    return { issuer: policy.issuer, subject: value.sub, verifiedAt: now.toISOString(),
+        policyFingerprint: oauthIdentityPolicyFingerprint(policy) };
+}
+//# sourceMappingURL=oauth-identity.js.map

package/dist/oauth-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-identity.js","sourceRoot":"","sources":["../src/oauth-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,eAAe,EAA8E,MAAM,mBAAmB,CAAC;AAC9I,OAAO,EAAE,gBAAgB,EAA8B,MAAM,4BAA4B,CAAC;AAE1F,MAAM,UAAU,8BAA8B,CAAC,MAA4B;IACzE,OAAO,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QACzD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE;QAC3E,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACzF,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAAsB,EAAE,MAAgB;IAChF,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC;IAC5C,OAAO,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AACjH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAA8B,EAC9B,MAA2B,EAC3B,WAAmB,EACnB,GAAS;IAET,MAAM,IAAI,GAAG,CAAC,QAAgB,EAAE,MAAe,EAAE,EAAE,CAAC,IAAI,YAAY,CAAC,eAAe,EAAE,8CAA8C,EAAE;QACpI,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,EAAE;KACnF,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,EAAE,GAAG,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,GAAG,EAAE;QAC5F,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KAC/F,EAAE,IAAI,CAAC,CAAC;IACT,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAG,IAA+B,CAAC;IAC9C,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;WACvE,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC9F,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE;QAC/E,iBAAiB,EAAE,8BAA8B,CAAC,MAAM,CAAE,EAAE,CAAC;AACjE,CAAC"}

package/dist/oauth-token-transport.d.ts

@@ -0,0 +1,19 @@
+import { ConnectError } from "@polpo-ai/connect";
+export interface ProviderTokenResponse {
+    access_token: string;
+    refresh_token?: string;
+    token_type?: string;
+    expires_in?: number;
+    scope?: string;
+}
+export interface TokenTransportOptions {
+    fetch: typeof fetch;
+    resolveHostname: (hostname: string) => Promise<readonly string[]>;
+    timeoutMs?: number;
+    requireJsonContentType?: boolean;
+}
+/** The same bounded transport is used for code exchange and refresh. No error contains a provider body. */
+export declare function requestOAuthToken(options: TokenTransportOptions, tokenUrl: string, body: Record<string, string | undefined>): Promise<ProviderTokenResponse>;
+/** Bounded server-to-provider transport shared by token exchange and account identity checks. */
+export declare function requestOAuthJson(options: TokenTransportOptions, tokenUrl: string, request: Pick<RequestInit, "method" | "headers" | "body">, errorFactory: (category: string, status?: number) => ConnectError): Promise<unknown>;
+//# sourceMappingURL=oauth-token-transport.d.ts.map

package/dist/oauth-token-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-token-transport.d.ts","sourceRoot":"","sources":["../src/oauth-token-transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA6B,MAAM,mBAAmB,CAAC;AAG5E,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,eAAe,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AASD,2GAA2G;AAC3G,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,qBAAqB,EAC9B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACvC,OAAO,CAAC,qBAAqB,CAAC,CAKhC;AAED,iGAAiG;AACjG,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,qBAAqB,EAC9B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC,EACzD,YAAY,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,YAAY,GAChE,OAAO,CAAC,OAAO,CAAC,CAoElB"}

package/dist/oauth-token-transport.js

@@ -0,0 +1,133 @@
+import { ConnectError, connectorHostnameIsUnsafe } from "@polpo-ai/connect";
+import { toFormBody } from "./oauth.js";
+const MAX_RESPONSE_BYTES = 256 * 1024;
+function failed(category, status) {
+    return new ConnectError("token_exchange_failed", "OAuth token exchange failed", {
+        details: { category, ...(status === undefined ? {} : { providerStatus: status }) },
+    });
+}
+/** The same bounded transport is used for code exchange and refresh. No error contains a provider body. */
+export async function requestOAuthToken(options, tokenUrl, body) {
+    return normalizeResponse(await requestOAuthJson(options, tokenUrl, {
+        method: "POST", headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+        body: toFormBody(body),
+    }, failed));
+}
+/** Bounded server-to-provider transport shared by token exchange and account identity checks. */
+export async function requestOAuthJson(options, tokenUrl, request, errorFactory) {
+    const failed = errorFactory;
+    let url;
+    try {
+        url = new URL(tokenUrl);
+    }
+    catch {
+        throw failed("invalid_endpoint");
+    }
+    if (url.protocol !== "https:" || url.username || url.password || url.hash || connectorHostnameIsUnsafe(url.hostname)) {
+        throw failed("network_denied");
+    }
+    const controller = new AbortController();
+    let reader;
+    let timer;
+    const deadline = new Promise((_, reject) => {
+        timer = setTimeout(() => {
+            controller.abort();
+            void reader?.cancel().catch(() => undefined);
+            reject(failed("timeout"));
+        }, options.timeoutMs ?? 10_000);
+    });
+    try {
+        return await Promise.race([deadline, (async () => {
+                const addresses = await options.resolveHostname(url.hostname);
+                if (controller.signal.aborted)
+                    throw failed("timeout");
+                if (!addresses.length || addresses.some(connectorHostnameIsUnsafe))
+                    throw failed("network_denied");
+                const response = await options.fetch(url, {
+                    ...request, redirect: "error", signal: controller.signal,
+                });
+                if (!response.ok) {
+                    void response.body?.cancel().catch(() => undefined);
+                    throw failed("provider_rejected", response.status);
+                }
+                if (options.requireJsonContentType && response.headers.get("content-type")?.split(";", 1)[0].trim().toLowerCase() !== "application/json") {
+                    void response.body?.cancel().catch(() => undefined);
+                    throw failed("invalid_response");
+                }
+                if (Number(response.headers.get("content-length")) > MAX_RESPONSE_BYTES) {
+                    void response.body?.cancel().catch(() => undefined);
+                    throw failed("response_too_large");
+                }
+                if (controller.signal.aborted) {
+                    void response.body?.cancel().catch(() => undefined);
+                    throw failed("timeout");
+                }
+                reader = response.body?.getReader();
+                const chunks = [];
+                let size = 0;
+                while (reader) {
+                    const { value, done } = await reader.read();
+                    if (controller.signal.aborted)
+                        throw failed("timeout");
+                    if (done)
+                        break;
+                    size += value.byteLength;
+                    if (size > MAX_RESPONSE_BYTES) {
+                        void reader.cancel().catch(() => undefined);
+                        throw failed("response_too_large");
+                    }
+                    chunks.push(value);
+                }
+                const bytes = new Uint8Array(size);
+                let offset = 0;
+                for (const chunk of chunks) {
+                    bytes.set(chunk, offset);
+                    offset += chunk.byteLength;
+                }
+                let value;
+                try {
+                    value = JSON.parse(new TextDecoder().decode(bytes));
+                }
+                catch {
+                    throw failed("invalid_response");
+                }
+                return value;
+            })()]);
+    }
+    catch (error) {
+        if (error instanceof ConnectError)
+            throw error;
+        throw failed(controller.signal.aborted ? "timeout" : "transport_failed");
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+function normalizeResponse(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw failed("invalid_response");
+    const input = value;
+    for (const key of ["access_token", "refresh_token"]) {
+        if (key === "refresh_token" && input[key] === undefined)
+            continue;
+        if (typeof input[key] !== "string" || !input[key].trim() || input[key].length > 65_536 || /[\r\n]/.test(input[key])) {
+            throw failed("invalid_response");
+        }
+    }
+    if (input.token_type !== undefined && (typeof input.token_type !== "string" || !/^[A-Za-z][A-Za-z0-9-]{0,31}$/.test(input.token_type))) {
+        throw failed("invalid_response");
+    }
+    if (input.scope !== undefined && (typeof input.scope !== "string" || input.scope.length > 32_768))
+        throw failed("invalid_response");
+    if (input.expires_in !== undefined && (typeof input.expires_in !== "number" || !Number.isSafeInteger(input.expires_in)
+        || input.expires_in < 0 || input.expires_in > 1_000_000_000))
+        throw failed("invalid_response");
+    return {
+        access_token: input.access_token,
+        ...(input.refresh_token === undefined ? {} : { refresh_token: input.refresh_token }),
+        ...(input.token_type === undefined ? {} : { token_type: input.token_type }),
+        ...(input.scope === undefined ? {} : { scope: input.scope }),
+        ...(input.expires_in === undefined ? {} : { expires_in: input.expires_in }),
+    };
+}
+//# sourceMappingURL=oauth-token-transport.js.map

package/dist/oauth-token-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-token-transport.js","sourceRoot":"","sources":["../src/oauth-token-transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAiBxC,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,CAAC;AACtC,SAAS,MAAM,CAAC,QAAgB,EAAE,MAAe;IAC/C,OAAO,IAAI,YAAY,CAAC,uBAAuB,EAAE,6BAA6B,EAAE;QAC9E,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,EAAE;KACnF,CAAC,CAAC;AACL,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAA8B,EAC9B,QAAgB,EAChB,IAAwC;IAExC,OAAO,iBAAiB,CAAC,MAAM,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE;QACjE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC5G,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC;KACvB,EAAE,MAAM,CAAC,CAAC,CAAC;AACd,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAA8B,EAC9B,QAAgB,EAChB,OAAyD,EACzD,YAAiE;IAEjE,MAAM,MAAM,GAAG,YAAY,CAAC;IAC5B,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAAC,CAAC;IAC5E,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,IAAI,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrH,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,MAA2D,CAAC;IAChE,IAAI,KAAoC,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QAChD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,KAAK,MAAM,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC7C,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAC5B,CAAC,EAAE,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,IAAI,EAAE;gBAC/C,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC9D,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;oBAAE,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;gBACvD,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,yBAAyB,CAAC;oBAAE,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;gBACnG,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;oBACxC,GAAG,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM;iBACzD,CAAC,CAAC;gBACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,KAAK,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;oBACpD,MAAM,MAAM,CAAC,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACrD,CAAC;gBACD,IAAI,OAAO,CAAC,sBAAsB,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,kBAAkB,EAAE,CAAC;oBACzI,KAAK,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;oBACpD,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;gBACnC,CAAC;gBACD,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,GAAG,kBAAkB,EAAE,CAAC;oBACxE,KAAK,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;oBACpD,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;gBACrC,CAAC;gBACD,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC9B,KAAK,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;oBACpD,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC1B,CAAC;gBACD,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;gBACpC,MAAM,MAAM,GAAiB,EAAE,CAAC;gBAChC,IAAI,IAAI,GAAG,CAAC,CAAC;gBACb,OAAO,MAAM,EAAE,CAAC;oBACd,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;oBAC5C,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;wBAAE,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;oBACvD,IAAI,IAAI;wBAAE,MAAM;oBAChB,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;oBACzB,IAAI,IAAI,GAAG,kBAAkB,EAAE,CAAC;wBAC9B,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;wBAC5C,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;oBACrC,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC;gBACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;gBACnC,IAAI,MAAM,GAAG,CAAC,CAAC;gBACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;oBAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;oBAAC,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;gBAAC,CAAC;gBACrF,IAAI,KAAc,CAAC;gBACnB,IAAI,CAAC;oBAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;gBAAC,CAAC;gBACxG,OAAO,KAAK,CAAC;YACf,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACT,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY;YAAE,MAAM,KAAK,CAAC;QAC/C,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAC3E,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAM,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAClG,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,KAAK,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,eAAe,CAAU,EAAE,CAAC;QAC7D,IAAI,GAAG,KAAK,eAAe,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,SAAS;QAClE,IAAI,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACpH,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACvI,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;QAAE,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACpI,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC;WACjH,KAAK,CAAC,UAAU,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,GAAG,aAAa,CAAC;QAAE,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACjG,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,YAAsB;QAC1C,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAuB,EAAE,CAAC;QAC9F,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAoB,EAAE,CAAC;QACrF,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAe,EAAE,CAAC;QACtE,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAoB,EAAE,CAAC;KACtF,CAAC;AACJ,CAAC"}

package/dist/oauth.js

@@ -16,7 +16,7 @@ export function toFormBody(input) {
     return body;
 }
 export function parseScopes(scope, fallback) {
-    if (!scope)
+    if (scope === undefined)
         return [...fallback];
     return scope.split(/[,\s]+/).map((part) => part.trim()).filter(Boolean);
 }

package/dist/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,UAAU,iBAAiB,CAAC,KAAK,GAAG,EAAE;IAC1C,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAyC;IAClE,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAyB,EAAE,QAA2B;IAChF,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC1E,CAAC"}
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,UAAU,iBAAiB,CAAC,KAAK,GAAG,EAAE;IAC1C,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAyC;IAClE,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAyB,EAAE,QAA2B;IAChF,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC9C,OAAO,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC1E,CAAC"}

package/dist/public-network.d.ts

@@ -0,0 +1,11 @@
+import { type LookupFunction } from "node:net";
+type ResolveHostname = (hostname: string) => Promise<readonly string[]>;
+/** Validate the exact addresses returned to net/tls.connect; no second DNS lookup. */
+export declare function publicAddressLookup(resolve: ResolveHostname): LookupFunction;
+export declare function createPublicNetworkTransport(resolve?: ResolveHostname): {
+    fetch: typeof fetch;
+    close: () => Promise<void>;
+};
+export declare const publicNetworkFetch: typeof fetch;
+export {};
+//# sourceMappingURL=public-network.d.ts.map

package/dist/public-network.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-network.d.ts","sourceRoot":"","sources":["../src/public-network.ts"],"names":[],"mappings":"AACA,OAAO,EAAQ,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AAIrD,KAAK,eAAe,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;AAKxE,sFAAsF;AACtF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,GAAG,cAAc,CAgB5E;AAED,wBAAgB,4BAA4B,CAAC,OAAO,GAAE,eAAiC;;;EAgBtF;AAID,eAAO,MAAM,kBAAkB,cAAuC,CAAC"}

package/dist/public-network.js

@@ -0,0 +1,49 @@
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
+import { Agent } from "undici";
+import { connectorHostnameIsUnsafe } from "@polpo-ai/connect";
+const resolveHostname = async (hostname) => (await lookup(hostname, { all: true, verbatim: true })).map(answer => answer.address);
+const denied = () => new Error("Public network destination required");
+/** Validate the exact addresses returned to net/tls.connect; no second DNS lookup. */
+export function publicAddressLookup(resolve) {
+    return (hostname, options, callback) => {
+        void resolve(hostname).then(addresses => {
+            if (!addresses.length || addresses.some(address => !isIP(address) || connectorHostnameIsUnsafe(address))) {
+                callback(denied(), "");
+                return;
+            }
+            const answers = addresses.map(address => ({ address, family: isIP(address) }));
+            if (options.all)
+                callback(null, answers);
+            else {
+                const selected = answers.find(answer => !options.family || answer.family === options.family);
+                if (!selected)
+                    callback(denied(), "");
+                else
+                    callback(null, selected.address, selected.family);
+            }
+        }, () => callback(denied(), ""));
+    };
+}
+export function createPublicNetworkTransport(resolve = resolveHostname) {
+    const dispatcher = new Agent({
+        connect: { lookup: publicAddressLookup(resolve), timeout: 10_000 },
+        connections: 8, headersTimeout: 10_000, bodyTimeout: 10_000,
+    });
+    const fetchPublic = async (input, init) => {
+        const url = new URL(input instanceof Request ? input.url : String(input));
+        if (url.protocol !== "https:" || url.username || url.password || url.hash || connectorHostnameIsUnsafe(url.hostname))
+            throw denied();
+        // The service owns redirect policy. Never let fetch follow an unvalidated
+        // Location before the service can reapply origin/path/auth restrictions.
+        const request = {
+            ...init, redirect: init?.redirect === "manual" ? "manual" : "error", dispatcher,
+        };
+        return globalThis.fetch(input, request);
+    };
+    return { fetch: fetchPublic, close: () => dispatcher.destroy() };
+}
+// A process-wide dispatcher reuses validated sockets across short-lived service
+// instances. Custom fetch adapters own equivalent socket/egress enforcement.
+export const publicNetworkFetch = createPublicNetworkTransport().fetch;
+//# sourceMappingURL=public-network.js.map

package/dist/public-network.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-network.js","sourceRoot":"","sources":["../src/public-network.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAuB,MAAM,UAAU,CAAC;AACrD,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAC/B,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAG9D,MAAM,eAAe,GAAoB,KAAK,EAAC,QAAQ,EAAC,EAAE,CACxD,CAAC,MAAM,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACxF,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;AAEtE,sFAAsF;AACtF,MAAM,UAAU,mBAAmB,CAAC,OAAwB;IAC1D,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QACrC,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;YACtC,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,yBAAyB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBACzG,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;gBACvB,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/E,IAAI,OAAO,CAAC,GAAG;gBAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;iBACpC,CAAC;gBACJ,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC7F,IAAI,CAAC,QAAQ;oBAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;;oBACjC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YACzD,CAAC;QACH,CAAC,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACnC,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,UAA2B,eAAe;IACrF,MAAM,UAAU,GAAG,IAAI,KAAK,CAAC;QAC3B,OAAO,EAAE,EAAE,MAAM,EAAE,mBAAmB,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE;QAClE,WAAW,EAAE,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM;KAC5D,CAAC,CAAC;IACH,MAAM,WAAW,GAAiB,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1E,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,IAAI,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,MAAM,MAAM,EAAE,CAAC;QACrI,0EAA0E;QAC1E,yEAAyE;QACzE,MAAM,OAAO,GAAwC;YACnD,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU;SAChF,CAAC;QACF,OAAO,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;AACnE,CAAC;AAED,gFAAgF;AAChF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,kBAAkB,GAAG,4BAA4B,EAAE,CAAC,KAAK,CAAC"}

package/dist/refresh-lineage.d.ts

@@ -0,0 +1,21 @@
+import { type StoredConnectionSecret } from "@polpo-ai/connect";
+import { type ConnectionSecretStore, type VersionedConnectionSecret } from "./secrets.js";
+export declare function hasPendingRefresh(secret: StoredConnectionSecret): boolean;
+export declare function assertRefreshAvailable(secret: StoredConnectionSecret): void;
+/** Persist intent BEFORE consuming a potentially single-use refresh token.
+ * A coordinator lease is an optimization: CAS is the durable exclusion fence.
+ * An uncertain provider outcome remains pending until reconnection; guessing a
+ * retry could invalidate the only refresh-token lineage we still possess.
+ * Unversioned single-process stores retain their existing coordinator contract.
+ */
+export declare function refreshConnectionSecret(input: {
+    store: ConnectionSecretStore;
+    ref: string;
+    previous: StoredConnectionSecret;
+    snapshot?: VersionedConnectionSecret | null;
+    now: () => Date;
+    /** Authorization and local metadata only; must never send a token to a provider. */
+    beforeRefresh?: () => Promise<void>;
+    refresh: () => Promise<StoredConnectionSecret>;
+}): Promise<StoredConnectionSecret>;
+//# sourceMappingURL=refresh-lineage.d.ts.map

package/dist/refresh-lineage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-lineage.d.ts","sourceRoot":"","sources":["../src/refresh-lineage.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,KAAK,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAoC,KAAK,qBAAqB,EAAE,KAAK,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAO5H,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAQzE;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,sBAAsB,GAAG,IAAI,CAE3E;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,KAAK,EAAE,qBAAqB,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,sBAAsB,CAAC;IACjC,QAAQ,CAAC,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC5C,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB,oFAAoF;IACpF,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,EAAE,MAAM,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAChD,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAyClC"}

package/dist/refresh-lineage.js

@@ -0,0 +1,83 @@
+import { randomUUID } from "node:crypto";
+import { isDeepStrictEqual } from "node:util";
+import { ConnectError } from "@polpo-ai/connect";
+import { isVersionedConnectionSecretStore } from "./secrets.js";
+// Private encrypted material only. Never Connection metadata or a public DTO.
+const KEY = "polpo:oauth-refresh:v1";
+const unavailable = () => new ConnectError("refresh_unavailable", "Connection refresh is in progress or its outcome is uncertain; retry later or reconnect the account", { status: 503 });
+export function hasPendingRefresh(secret) {
+    const state = secret.metadata?.[KEY];
+    if (state === undefined)
+        return false;
+    if (!state || typeof state !== "object" || Array.isArray(state))
+        return true;
+    const record = state;
+    return record.status !== "completed" || typeof record.id !== "string" || !record.id
+        || typeof record.startedAt !== "string" || !Number.isFinite(Date.parse(record.startedAt))
+        || typeof record.completedAt !== "string" || !Number.isFinite(Date.parse(record.completedAt));
+}
+export function assertRefreshAvailable(secret) {
+    if (hasPendingRefresh(secret))
+        throw unavailable();
+}
+/** Persist intent BEFORE consuming a potentially single-use refresh token.
+ * A coordinator lease is an optimization: CAS is the durable exclusion fence.
+ * An uncertain provider outcome remains pending until reconnection; guessing a
+ * retry could invalidate the only refresh-token lineage we still possess.
+ * Unversioned single-process stores retain their existing coordinator contract.
+ */
+export async function refreshConnectionSecret(input) {
+    assertRefreshAvailable(input.previous);
+    const store = input.store;
+    if (!isVersionedConnectionSecretStore(store)) {
+        await input.beforeRefresh?.();
+        const refreshed = await input.refresh();
+        await store.setSecret(input.ref, refreshed);
+        return refreshed;
+    }
+    if (!input.snapshot)
+        throw unavailable();
+    const id = randomUUID();
+    const startedAt = input.now().toISOString();
+    const pending = { ...input.previous, metadata: { ...input.previous.metadata,
+            [KEY]: { id, status: "pending", startedAt } } };
+    let claimed;
+    try {
+        claimed = await store.compareAndSet(input.ref, input.snapshot.version, pending);
+    }
+    catch { /* An acknowledgement can be lost after the durable write. */ }
+    if (claimed === false)
+        throw unavailable();
+    const claim = await store.getVersioned(input.ref);
+    if (!claim || !sameSecret(claim.secret, pending))
+        throw unavailable();
+    try {
+        await input.beforeRefresh?.();
+    }
+    catch (error) {
+        // No provider dispatch has occurred. Restore only the exact intent we own;
+        // never overwrite a reconnect, revocation or another credential generation.
+        // If storage cannot confirm restoration, retain the conservative fence.
+        await store.compareAndSet(input.ref, claim.version, input.previous).catch(() => false);
+        throw error;
+    }
+    // Do not clear a pending intent on provider error or process death: we cannot
+    // know whether a single-use token was consumed before the response was lost.
+    const result = await input.refresh();
+    const completed = { ...result, metadata: { ...result.metadata,
+            [KEY]: { id, status: "completed", startedAt, completedAt: input.now().toISOString() } } };
+    try {
+        if (await store.compareAndSet(input.ref, claim.version, completed))
+            return completed;
+    }
+    catch { /* Recover only our exact committed result, never another writer. */ }
+    const persisted = await store.getVersioned(input.ref);
+    if (persisted && sameSecret(persisted.secret, completed))
+        return persisted.secret;
+    throw unavailable();
+}
+function sameSecret(left, right) {
+    // JSON stores omit undefined fields and may reorder object properties.
+    return isDeepStrictEqual(JSON.parse(JSON.stringify(left)), JSON.parse(JSON.stringify(right)));
+}
+//# sourceMappingURL=refresh-lineage.js.map

package/dist/refresh-lineage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-lineage.js","sourceRoot":"","sources":["../src/refresh-lineage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,YAAY,EAA+B,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAE,gCAAgC,EAA8D,MAAM,cAAc,CAAC;AAE5H,8EAA8E;AAC9E,MAAM,GAAG,GAAG,wBAAwB,CAAC;AACrC,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,IAAI,YAAY,CAAC,qBAAqB,EAC9D,qGAAqG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AAE1H,MAAM,UAAU,iBAAiB,CAAC,MAA8B;IAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,OAAO,MAAM,CAAC,MAAM,KAAK,WAAW,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,EAAE;WAC9E,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;WACtF,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAA8B;IACnE,IAAI,iBAAiB,CAAC,MAAM,CAAC;QAAE,MAAM,WAAW,EAAE,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAS7C;IACC,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,IAAI,CAAC,gCAAgC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QACxC,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC5C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,QAAQ;QAAE,MAAM,WAAW,EAAE,CAAC;IACzC,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,OAAO,GAA2B,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,QAAQ;YACjG,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAClD,IAAI,OAA4B,CAAC;IACjC,IAAI,CAAC;QAAC,OAAO,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAAC,CAAC;IACxF,MAAM,CAAC,CAAC,6DAA6D,CAAC,CAAC;IACvE,IAAI,OAAO,KAAK,KAAK;QAAE,MAAM,WAAW,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,WAAW,EAAE,CAAC;IAEtE,IAAI,CAAC;QAAC,MAAM,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC;IAAC,CAAC;IACtC,OAAO,KAAK,EAAE,CAAC;QACb,2EAA2E;QAC3E,4EAA4E;QAC5E,wEAAwE;QACxE,MAAM,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QACvF,MAAM,KAAK,CAAC;IACd,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;IACrC,MAAM,SAAS,GAA2B,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,CAAC,QAAQ;YACnF,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC;IAC5F,IAAI,CAAC;QACH,IAAI,MAAM,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC,CAAC,oEAAoE,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,SAAS,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC,MAAM,CAAC;IAClF,MAAM,WAAW,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,UAAU,CAAC,IAA4B,EAAE,KAA6B;IAC7E,uEAAuE;IACvE,OAAO,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAChG,CAAC"}

package/dist/secrets.d.ts

@@ -2,6 +2,8 @@ import type { StoredConnectionSecret } from "@polpo-ai/connect";
 export interface ConnectionSecretStore {
     setSecret(ref: string, secret: StoredConnectionSecret): Promise<void>;
     getSecret(ref: string): Promise<StoredConnectionSecret | null>;
+    /** Destructive: does not check Connection/OAuth references. Do not use as
+     * compensation after an uncertain reference write. */
     deleteSecret(ref: string): Promise<void>;
 }
 export interface VersionedConnectionSecret {

package/dist/secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAEhE,MAAM,WAAW,qBAAqB;IACpC,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IAC/D,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,8BAA+B,SAAQ,qBAAqB;IAC3E,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;IACrE,aAAa,CACX,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,OAAO,CAAC,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,YAAY,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACzE;AAED,qBAAa,2BAA4B,YAAW,qBAAqB;IACvE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6C;IACrE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IAEhD,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrE,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAK9D,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKxC,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC;IASpE,aAAa,CACjB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,OAAO,CAAC;CAOpB;AAED,qBAAa,6BAA8B,YAAW,uBAAuB;IAC3E,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoC;IAEpD,YAAY,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAc9E;AAED,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,qBAAqB,GAC3B,KAAK,IAAI,8BAA8B,CAIzC"}
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAEhE,MAAM,WAAW,qBAAqB;IACpC,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IAC/D;0DACsD;IACtD,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,8BAA+B,SAAQ,qBAAqB;IAC3E,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;IACrE,aAAa,CACX,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,OAAO,CAAC,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,YAAY,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACzE;AAED,qBAAa,2BAA4B,YAAW,qBAAqB;IACvE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6C;IACrE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IAEhD,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrE,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAK9D,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKxC,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC;IASpE,aAAa,CACjB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,OAAO,CAAC;CAOpB;AAED,qBAAa,6BAA8B,YAAW,uBAAuB;IAC3E,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoC;IAEpD,YAAY,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAc9E;AAED,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,qBAAqB,GAC3B,KAAK,IAAI,8BAA8B,CAIzC"}