@protobase/server 0.68.6 → 0.69.0

package/dist/better-auth/auth-settings.d.ts

@@ -5,12 +5,13 @@ import { StaffSignIn } from "./staff-log.js";
 import { Person } from "./organizations/people-endpoint.js";
 import { RoleDefinitions } from "./organizations/role-definitions.js";
 import { ConnectedApp } from "./mcp/connected-apps.js";
-import { ReplacingContext } from "./end-replaced-session.js";
 import { VersionedSecret } from "./secret-versions.js";
 import { UserDeletionListener } from "./user-deletion.js";
 import { OrganizationRole, StoredMember, StoredOrganization } from "./organizations/store.js";
 import { OrganizationsOptions, ResolvedOrganizations } from "./organizations/options.js";
 import { PersonalMailProvider } from "../personal-mail/personal-mail-provider.js";
+import { ResolvedConnection } from "./connections/declared-connections.js";
+import { ConnectionListener } from "./connections/connection-events.js";
 import { McpAuthOptions } from "./mcp/mcp-plugins.js";
 import "../index.js";
 import { CreateAuthOptions, UserCreatedHook } from "./create-auth.js";
@@ -48,7 +49,7 @@ export type AuthHooks = {
  * `auth` in `protobase.config.ts`: the sign-in settings as data. The store is the app's own database, in `schema`;
  * the hooks and a mailer of the project's own are found in auth/hooks.ts and auth/mailer.ts.
  */
-export type AuthSettings = Omit<CreateAuthOptions, 'database' | 'secret' | 'generateUserId' | 'onUserCreated' | 'mailer' | 'organizations' | 'mcp'> & {
+export type AuthSettings = Omit<CreateAuthOptions, 'database' | 'secret' | 'generateUserId' | 'onUserCreated' | 'mailer' | 'organizations' | 'mcp' | 'workflowConnections'> & {
   /** Signs cookies and encrypts the JWT private keys, such as `PROTOBASE_SECRET`. Generate with `openssl rand -base64 32`. */
   secret?: string;
   /** The schema of the auth store in the app's database; default `auth`. */
@@ -70,9 +71,11 @@ export type AppAuthInput = {
   hooks?: AuthHooks;
   /** A mailer of the project's own, in place of the default. */
   mailer?: Mailer;
+  /** The connections the app's workflow plugins declare, which people connect accounts through. */
+  workflowConnections?: CreateAuthOptions['workflowConnections'];
 };
 /** createAuth's options for the `auth` settings, the store in the app's own database. */
-export declare const appAuthOptions: (settings: AuthSettings, { pool, db, hooks, mailer }: AppAuthInput) => CreateAuthOptions;
+export declare const appAuthOptions: (settings: AuthSettings, { pool, db, hooks, mailer, workflowConnections }: AppAuthInput) => CreateAuthOptions;
 /** The app's Better Auth from its `auth` settings, built at serve time with only the plugins they turn on. */
 export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput) => Promise<import("better-auth").Auth<{
   user: {
@@ -166,6 +169,7 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
   account: {
     encryptOAuthTokens?: true | undefined;
     accountLinking: {
+      trustedProviders?: string[] | undefined;
       allowDifferentEmails: true;
     };
     fields: {
@@ -3276,6 +3280,102 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
       INVALID_OAUTH_CONFIGURATION: import("better-auth").RawError<"INVALID_OAUTH_CONFIGURATION">;
       TOKEN_URL_NOT_FOUND: import("better-auth").RawError<"TOKEN_URL_NOT_FOUND">;
     };
+  } | {
+    id: "protobase-connection-providers";
+    init: (ctx: import("better-auth").AuthContext) => {
+      context: {
+        socialProviders: import("better-auth").OAuthProvider<object, Partial<import("better-auth").ProviderOptions<object>>>[];
+      };
+    };
+  } | {
+    id: "protobase-connections";
+    endpoints: {
+      listConnections: import("better-call").StrictEndpoint<string, {
+        method: "GET";
+        use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+      }, {
+        connections: {
+          key: string;
+          label: string;
+          provider: string;
+          scopes: string[];
+          link_params: Record<string, string>;
+          accounts: {
+            id: string;
+            scopes: string[];
+            created_at: Date;
+            needs_sign_in: boolean;
+          }[];
+        }[];
+      }>;
+      disconnectConnection: import("better-call").StrictEndpoint<string, {
+        method: "POST";
+        use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+        body: import("zod").ZodObject<{
+          accountId: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        disconnected: boolean;
+        revoked: boolean;
+      }>;
+    };
+    hooks: {
+      before: {
+        matcher: (context: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
+  } | {
+    id: "protobase-refresh-refusals";
+    init: (ctx: import("better-auth").AuthContext) => {
+      context: {
+        socialProviders: import("better-auth").OAuthProvider<object, Partial<import("better-auth").ProviderOptions<object>>>[];
+      };
+    };
   } | {
     id: "sso";
     version: string;
@@ -4407,9 +4507,7 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
               email: string;
               emailVerified: boolean;
               name: string;
-              image?
-              /** Turns on the OAuth provider for MCP clients: `true`, or the endpoint's `path` and the `connectPage`. */
-              /** Turns on the OAuth provider for MCP clients: `true`, or the endpoint's `path` and the `connectPage`. */ : string | null | undefined;
+              image?: string | null | undefined;
             } & Record<string, any>;
           };
         }>>[];
@@ -4511,9 +4609,7 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
               email: string;
               emailVerified: boolean;
               name: string;
-              image?
-              /** Turns on the OAuth provider for MCP clients: `true`, or the endpoint's `path` and the `connectPage`. */
-              /** Turns on the OAuth provider for MCP clients: `true`, or the endpoint's `path` and the `connectPage`. */ : string | null | undefined;
+              image?: string | null | undefined;
             } & Record<string, any>;
           };
         }>>[];
@@ -4939,9 +5035,7 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
               email: string;
               emailVerified: boolean;
               name: string;
-              image?
-              /** Turns on the OAuth provider for MCP clients: `true`, or the endpoint's `path` and the `connectPage`. */
-              /** Turns on the OAuth provider for MCP clients: `true`, or the endpoint's `path` and the `connectPage`. */ : string | null | undefined;
+              image?: string | null | undefined;
             } & Record<string, any>;
           };
         }>>[];
@@ -5773,9 +5867,7 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
               email: string;
               emailVerified: boolean;
               name: string;
-              image?
-              /** Turns on the OAuth provider for MCP clients: `true`, or the endpoint's `path` and the `connectPage`. */
-              /** Turns on the OAuth provider for MCP clients: `true`, or the endpoint's `path` and the `connectPage`. */ : string | null | undefined;
+              image?: string | null | undefined;
             } & Record<string, any>;
           };
         }>>[];
@@ -5878,9 +5970,7 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
               email: string;
               emailVerified: boolean;
               name: string;
-              image?
-              /** Turns on the OAuth provider for MCP clients: `true`, or the endpoint's `path` and the `connectPage`. */
-              /** Turns on the OAuth provider for MCP clients: `true`, or the endpoint's `path` and the `connectPage`. */ : string | null | undefined;
+              image?: string | null | undefined;
             } & Record<string, any>;
           };
         }>>[];
@@ -5981,9 +6071,7 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
               email: string;
               emailVerified: boolean;
               name: string;
-              image?
-              /** Turns on the OAuth provider for MCP clients: `true`, or the endpoint's `path` and the `connectPage`. */
-              /** Turns on the OAuth provider for MCP clients: `true`, or the endpoint's `path` and the `connectPage`. */ : string | null | undefined;
+              image?: string | null | undefined;
             } & Record<string, any>;
           };
         }>>[];
@@ -6082,9 +6170,7 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
               email: string;
               emailVerified: boolean;
               name: string;
-              image?
-              /** Turns on the OAuth provider for MCP clients: `true`, or the endpoint's `path` and the `connectPage`. */
-              /** Turns on the OAuth provider for MCP clients: `true`, or the endpoint's `path` and the `connectPage`. */ : string | null | undefined;
+              image?: string | null | undefined;
             } & Record<string, any>;
           };
         }>>[];
@@ -8849,10 +8935,40 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
       };
     };
     session: {
-      create: {
-        after: (session: {
-          token: string;
-        }, ctx: ReplacingContext | null) => Promise<void>;
+      create?: {
+        before?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+          data: {
+            id?: string | undefined;
+            createdAt?: Date | undefined;
+            updatedAt?: Date | undefined;
+            userId?: string | undefined;
+            expiresAt?: Date | undefined;
+            token?: string | undefined;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+          } & Record<string, any>;
+        }>;
+        after?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+      };
+      update?: {
+        before?: (session: Partial<import("better-auth").Session> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+          data: {
+            [x: string]: any;
+            id?: string | undefined;
+            createdAt?: Date | undefined;
+            updatedAt?: Date | undefined;
+            userId?: string | undefined;
+            expiresAt?: Date | undefined;
+            token?: string | undefined;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+          };
+        }>;
+        after?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+      };
+      delete?: {
+        before?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+        after?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
       };
     };
     account: {
@@ -9031,6 +9147,17 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
   }[];
   personalMail: PersonalMailProvider[];
   personalMailer: (userId: string) => Mailer;
+  connectionSupport: {
+    encrypted: boolean;
+    signInProviders: string[];
+    clients: string[];
+  };
+  connections: {
+    declared: ResolvedConnection[];
+    events: {
+      set: (next: ConnectionListener) => undefined;
+    };
+  };
   mcp: {
     resource: string;
     path: string;

package/dist/better-auth/auth-settings.js

@@ -14,7 +14,7 @@ const organizationOptions = (organizations, hooks, app) => {
 	};
 };
 /** createAuth's options for the `auth` settings, the store in the app's own database. */
-const appAuthOptions = (settings, { pool, db, hooks = {}, mailer }) => {
+const appAuthOptions = (settings, { pool, db, hooks = {}, mailer, workflowConnections }) => {
 	const { schema = "auth", secret, generateUserId, mailer: mail, organizations, mcp, ...rest } = settings;
 	if (!secret) throw new Error("the auth secret is not set: give it the app's secret, PROTOBASE_SECRET, made with `openssl rand -base64 32`");
 	const app = { db };
@@ -34,7 +34,8 @@ const appAuthOptions = (settings, { pool, db, hooks = {}, mailer }) => {
 		...onUserCreated && { onUserCreated },
 		...mail === false ? { mailer: false } : mailer && { mailer },
 		...organizationsOptions && { organizations: organizationsOptions },
-		...mcp && { mcp }
+		...mcp && { mcp },
+		...workflowConnections && { workflowConnections }
 	};
 };
 /** The app's Better Auth from its `auth` settings, built at serve time with only the plugins they turn on. */

package/dist/better-auth/connections/connection-account-hooks.js

@@ -0,0 +1,62 @@
+import { APIError, getOAuthState } from "better-auth/api";
+//#region src/better-auth/connections/connection-account-hooks.ts
+const refused = () => new APIError("FORBIDDEN", {
+	code: "CONNECTION_NOT_SIGN_IN",
+	message: "This provider connects an account to a workflow; it does not sign in."
+});
+/**
+* The account and session hooks of workflow connections. An account of a connection's provider written by a link
+* resumes the triggers waiting on it. On the OAuth callback of a provider only connections use, an account written
+* without a link, and any session, are refused: a connected account never signs anyone in. Refreshing a token writes
+* the account off the callback, so it passes.
+*/
+const connectionAccountHooks = (connections, events) => {
+	const providers = new Set(connections.map(({ providerId }) => providerId));
+	const own = new Set(connections.filter(({ declaration }) => "oauth" in declaration).map(({ providerId }) => providerId));
+	const onOwnCallback = (context) => context?.path === "/callback/:id" && own.has(context.params?.id ?? "");
+	const guard = async (_, context) => {
+		if (onOwnCallback(context) && !(await getOAuthState())?.link) throw refused();
+	};
+	const resume = async (account) => {
+		if (providers.has(account.providerId) && (await getOAuthState())?.link) await events.linked(account.id);
+	};
+	return {
+		account: {
+			create: {
+				before: guard,
+				after: resume
+			},
+			update: {
+				before: guard,
+				after: resume
+			}
+		},
+		session: { create: { before: async (_, context) => {
+			if (onOwnCallback(context)) throw refused();
+		} } }
+	};
+};
+/** Runs each hook of `first` and then of `second`; their `before` hooks change no data, as neither returns any. */
+const bothAccountHooks = (first, second) => {
+	const join = (stage, operation) => {
+		const a = first[operation]?.[stage];
+		const b = second[operation]?.[stage];
+		if (!a || !b) return a ?? b;
+		return async (record, context) => {
+			await a(record, context);
+			return b(record, context);
+		};
+	};
+	return {
+		create: {
+			before: join("before", "create"),
+			after: join("after", "create")
+		},
+		update: {
+			before: join("before", "update"),
+			after: join("after", "update")
+		}
+	};
+};
+//#endregion
+export { bothAccountHooks, connectionAccountHooks };

package/dist/better-auth/connections/connection-events.d.ts

@@ -0,0 +1,11 @@
+//#region src/better-auth/connections/connection-events.d.ts
+/** What the workflows do when an account of a connection is linked or disconnected, and which accounts their triggers wait on. */
+export type ConnectionListener = {
+  /** An account was linked again: the triggers waiting on its sign-in poll again. */
+  linked: (accountId: string) => Promise<void>;
+  /** An account was disconnected: the triggers on it wait for a new sign-in. */
+  disconnected: (accountId: string) => Promise<void>;
+  /** The accounts among `accountIds` that a trigger waits on to be signed in again. */
+  needsSignIn: (accountIds: string[]) => Promise<string[]>;
+};
+//#endregion

package/dist/better-auth/connections/connection-events.js

@@ -0,0 +1,16 @@
+//#region src/better-auth/connections/connection-events.ts
+/**
+* The listener sign-in tells of connections, which the workflows set once they are made, after the auth instance;
+* until then, and in an app without workflows, nothing listens.
+*/
+const connectionEvents = () => {
+	let listener;
+	return {
+		set: (next) => void (listener = next),
+		linked: async (accountId) => listener?.linked(accountId),
+		disconnected: async (accountId) => listener?.disconnected(accountId),
+		needsSignIn: async (accountIds) => listener && accountIds.length > 0 ? listener.needsSignIn(accountIds) : []
+	};
+};
+//#endregion
+export { connectionEvents };

package/dist/better-auth/connections/connection-oauth-provider.js

@@ -0,0 +1,129 @@
+import { pinnedRequest } from "../../webhooks/table/pinned-request.js";
+import { readLimited } from "../../webhooks/table/read-limited.js";
+import { authorizationCodeRequest, createAuthorizationURL, getOAuth2Tokens, refreshAccessTokenRequest } from "@better-auth/core/oauth2";
+//#region src/better-auth/connections/connection-oauth-provider.ts
+/** The most of a provider's token or user answer read: enough for any token response, and no more. */
+const answerBytes = 65536;
+const requestTimeoutMs = 1e4;
+const guardedJson = async (url, init, { allowPrivateAddresses }) => {
+	const response = await pinnedRequest(url, {
+		...init,
+		signal: AbortSignal.timeout(requestTimeoutMs)
+	}, { allowPrivateAddresses });
+	const bytes = await readLimited(response, answerBytes);
+	if (!response.ok) throw new ProviderAnswerError(response.status, oauthError(bytes));
+	return JSON.parse(new TextDecoder().decode(bytes));
+};
+/** A provider's answer that is not a success: its status, and its OAuth `error` code when it gives one, as `invalid_grant`. */
+var ProviderAnswerError = class extends Error {
+	status;
+	error;
+	constructor(status, error) {
+		super(`The provider answered ${status}${error ? ` (${error})` : ""}`);
+		this.status = status;
+		this.error = error;
+	}
+};
+const oauthError = (bytes) => {
+	let body;
+	try {
+		body = JSON.parse(new TextDecoder().decode(bytes));
+	} catch (error) {
+		if (error instanceof SyntaxError) return;
+		throw error;
+	}
+	const code = typeof body === "object" && body !== null ? body.error : void 0;
+	return typeof code === "string" ? code : void 0;
+};
+const tokenRequest = async (url, request, guarded) => getOAuth2Tokens(await guardedJson(url, {
+	method: "POST",
+	headers: request.headers,
+	body: request.body.toString()
+}, guarded));
+const userOf = (raw) => {
+	const id = raw.sub ?? raw.id;
+	if (typeof id !== "string" && typeof id !== "number") return null;
+	const text = (value) => typeof value === "string" && value !== "" ? value : void 0;
+	const email = text(raw.email);
+	return {
+		user: {
+			id: String(id),
+			email,
+			name: text(raw.name) ?? email ?? String(id),
+			emailVerified: raw.email_verified === true
+		},
+		data: raw
+	};
+};
+/**
+* A Better Auth provider for a connection with an OAuth provider of its own: it never signs up anyone, and sends its
+* code exchange, refresh and user request only to the URLs the plugin declares, each through the guarded request.
+*/
+const connectionOAuthProvider = (connection, endpoints, guarded) => {
+	const options = {
+		clientId: connection.client.clientId,
+		clientSecret: connection.client.clientSecret
+	};
+	const pkce = endpoints.pkce ?? true;
+	return {
+		id: connection.providerId,
+		name: connection.declaration.label,
+		disableSignUp: true,
+		disableImplicitSignUp: true,
+		options,
+		accountSubject: ({ profile }) => String(profile.sub ?? profile.id ?? ""),
+		createAuthorizationURL: (data) => createAuthorizationURL({
+			id: connection.providerId,
+			options,
+			authorizationEndpoint: endpoints.authorization_url,
+			state: data.state,
+			...pkce && { codeVerifier: data.codeVerifier },
+			scopes: [...connection.declaration.scopes ?? [], ...data.scopes ?? []],
+			redirectURI: data.redirectURI,
+			additionalParams: { ...connection.declaration.link_params }
+		}),
+		validateAuthorizationCode: async (data) => {
+			const request = await authorizationCodeRequest({
+				code: data.code,
+				...pkce && { codeVerifier: data.codeVerifier },
+				redirectURI: data.redirectURI,
+				options,
+				tokenEndpoint: endpoints.token_url,
+				authentication: "post"
+			});
+			return tokenRequest(endpoints.token_url, request, guarded);
+		},
+		refreshAccessToken: async (refreshToken) => {
+			const request = await refreshAccessTokenRequest({
+				refreshToken,
+				options,
+				tokenEndpoint: endpoints.token_url,
+				authentication: "post"
+			});
+			return tokenRequest(endpoints.token_url, request, guarded);
+		},
+		getUserInfo: async (tokens) => {
+			const raw = await guardedJson(endpoints.user_info_url, {
+				method: "GET",
+				headers: {
+					accept: "application/json",
+					authorization: `Bearer ${tokens.accessToken}`
+				}
+			}, guarded);
+			return userOf(raw);
+		}
+	};
+};
+/** Adds the connections' own OAuth providers to the instance's providers, so `/link-social` connects through them. */
+const connectionProvidersPlugin = (connections, guarded) => {
+	const providers = connections.flatMap((connection) => "oauth" in connection.declaration && connection.client ? [connectionOAuthProvider({
+		...connection,
+		client: connection.client
+	}, connection.declaration.oauth, guarded)] : []);
+	return {
+		id: "protobase-connection-providers",
+		init: (ctx) => ({ context: { socialProviders: [...providers, ...ctx.socialProviders] } })
+	};
+};
+//#endregion
+export { ProviderAnswerError, connectionOAuthProvider, connectionProvidersPlugin };

package/dist/better-auth/connections/connections-plugin.js

@@ -0,0 +1,98 @@
+import { storedScopes } from "../../personal-mail/linked-accounts.js";
+import { holdsScopes } from "../../workflows/connections/connection-provider.js";
+import { revokeToken } from "./revoke-token.js";
+import * as z$1 from "zod";
+import { decryptOAuthToken } from "better-auth/oauth2";
+import { APIError, createAuthEndpoint, createAuthMiddleware, sessionMiddleware } from "better-auth/api";
+//#region src/better-auth/connections/connections-plugin.ts
+const connectionPaths = {
+	list: "/connections",
+	disconnect: "/connections/disconnect"
+};
+const notFound = () => new APIError("NOT_FOUND", {
+	code: "CONNECTION_NOT_FOUND",
+	message: "You have no connected account with this id."
+});
+/**
+* The signed-in person's connections: `GET /connections` lists each connection the app's workflow plugins declare with
+* the person's accounts that fit it, and whether a trigger waits for one to be signed in again, never a token.
+* `POST /connections/disconnect` revokes an account's token at its provider, then deletes it whatever the provider
+* answered, and stops the triggers on it; their own account only, and never the last account they sign in with. Connecting is
+* Better Auth's `/link-social`; a sign-in (not a link) through a provider only connections use is refused.
+*/
+const connectionsPlugin = ({ connections, events, allowPrivateAddresses }) => {
+	const own = new Set(connections.filter(({ declaration }) => "oauth" in declaration).map(({ providerId }) => providerId));
+	return {
+		id: "protobase-connections",
+		endpoints: {
+			listConnections: createAuthEndpoint(connectionPaths.list, {
+				method: "GET",
+				use: [sessionMiddleware]
+			}, async (ctx) => {
+				const accounts = await ctx.context.internalAdapter.findAccounts(ctx.context.session.user.id);
+				const fitting = (connection) => accounts.filter((account) => account.providerId === connection.providerId && holdsScopes(storedScopes(account.scope), connection.declaration));
+				const waiting = new Set(await events.needsSignIn(connections.flatMap((connection) => fitting(connection).map((account) => account.id))));
+				return ctx.json({ connections: connections.map((connection) => ({
+					key: connection.key,
+					label: connection.declaration.label,
+					provider: connection.providerId,
+					scopes: connection.declaration.scopes ?? [],
+					link_params: connection.declaration.link_params ?? {},
+					accounts: fitting(connection).map((account) => ({
+						id: account.id,
+						scopes: storedScopes(account.scope),
+						created_at: account.createdAt,
+						needs_sign_in: waiting.has(account.id)
+					}))
+				})) });
+			}),
+			disconnectConnection: createAuthEndpoint(connectionPaths.disconnect, {
+				method: "POST",
+				use: [sessionMiddleware],
+				body: z$1.object({ accountId: z$1.string() })
+			}, async (ctx) => {
+				const adapter = ctx.context.internalAdapter;
+				const accounts = await adapter.findAccounts(ctx.context.session.user.id);
+				const account = accounts.find((candidate) => candidate.id === ctx.body.accountId);
+				const connection = account && connections.find((candidate) => candidate.providerId === account.providerId);
+				if (!account || !connection) throw notFound();
+				const signIns = accounts.filter((candidate) => !own.has(candidate.providerId));
+				if (!own.has(account.providerId) && signIns.length === 1) throw new APIError("BAD_REQUEST", {
+					code: "FAILED_TO_UNLINK_LAST_ACCOUNT",
+					message: "This is your only way to sign in: add another before you disconnect it."
+				});
+				const stored = account.refreshToken ?? account.accessToken;
+				const token = stored ? await decryptOAuthToken(stored, ctx.context) : void 0;
+				let revoked = false;
+				try {
+					if (connection.revocationUrl && token) revoked = await revokeToken({
+						url: connection.revocationUrl,
+						client: connection.client,
+						token,
+						hint: account.refreshToken ? "refresh_token" : "access_token",
+						allowPrivateAddresses
+					});
+				} finally {
+					await adapter.deleteAccount(account.id);
+					await events.disconnected(account.id);
+				}
+				return ctx.json({
+					disconnected: true,
+					revoked
+				});
+			})
+		},
+		hooks: { before: [{
+			matcher: (context) => context.path === "/sign-in/social",
+			handler: createAuthMiddleware(async (ctx) => {
+				const provider = ctx.body?.provider;
+				if (typeof provider === "string" && own.has(provider)) throw new APIError("FORBIDDEN", {
+					code: "CONNECTION_NOT_SIGN_IN",
+					message: "This provider connects an account to a workflow; it does not sign in."
+				});
+			})
+		}] }
+	};
+};
+//#endregion
+export { connectionPaths, connectionsPlugin };

package/dist/better-auth/connections/declared-connections.d.ts

@@ -0,0 +1,21 @@
+import { ConnectionDeclaration } from "@protobase/workflows/plugin";
+//#region src/better-auth/connections/declared-connections.d.ts
+/** A connection a workflow plugin declares, as the app loaded it. */
+export type DeclaredConnection = {
+  plugin: string;
+  name: string;
+  declaration: ConnectionDeclaration;
+};
+/** The OAuth client an app's owner made at a provider for a workflow connection. */
+export type ConnectionClient = {
+  clientId: string;
+  clientSecret: string;
+};
+/** A connection as sign-in keeps it: its Better Auth provider, and the client and URL that revoke its tokens. */
+export type ResolvedConnection = DeclaredConnection & {
+  key: string;
+  providerId: string;
+  client?: ConnectionClient;
+  revocationUrl?: string;
+};
+//#endregion