@sixb/core 0.1.0 → 0.1.2

package/dist/storage/connector-connections/provider.js

@@ -0,0 +1,1025 @@
+// @bun
+import {
+  CONNECTOR_CONNECTION_RUN_FAILURE_CODES,
+  ConnectorConnectionStorageError
+} from "../../chunk-5gd7tpv6.js";
+import {
+  createSixbError,
+  parseSixbFailure,
+  toSixbFailure
+} from "../../chunk-0172wgm9.js";
+import"../../chunk-t8t39h7v.js";
+import"../../chunk-y64skrwp.js";
+
+// src/storage/connector-connections/provider/shared.ts
+import { timingSafeEqual } from "crypto";
+class ConnectorConnectionOperations {
+  backend;
+  constructor(backend) {
+    this.backend = backend;
+  }
+  read(scope, run) {
+    return this.backend.read(scope, run);
+  }
+  write(scope, run) {
+    return this.backend.transaction(scope, run);
+  }
+}
+async function currentConnectionRun(persistence, runId) {
+  const run = await persistence.getConnectionRun(runId);
+  if (!run || run.status !== "waiting" && run.status !== "running")
+    return run;
+  const now = await persistence.now();
+  if (run.expiresAt.getTime() > now.getTime())
+    return run;
+  if (run.status === "waiting" && run.waitingFor === "provider_authorization") {
+    const attempt = await persistence.getAuthorizationAttemptByConnectionRunId(run.id);
+    if (attempt)
+      await persistence.deleteAuthorizationAttempt(attempt.id);
+  }
+  if (run.status === "waiting") {
+    if (run.kind === "connect" && run.waitingFor === "account_selection") {
+      await markPendingAuthorizationForCleanup(persistence, run.authorizationId, now);
+    }
+    const expired = expireConnectionRun(run, now);
+    await persistence.updateConnectionRun(expired);
+    return expired;
+  }
+  if (run.kind === "connect" && run.authorizationId) {
+    await markPendingAuthorizationForCleanup(persistence, run.authorizationId, now);
+  }
+  const failed = failExpiredProcessingRun(run, now);
+  await persistence.updateConnectionRun(failed);
+  return failed;
+}
+async function markPendingAuthorizationForCleanup(persistence, authorizationId, now) {
+  const authorization = await persistence.getAuthorization(authorizationId);
+  if (!authorization || authorization.status !== "pending_selection")
+    return;
+  await persistence.updateAuthorization(markAuthorizationRevocationPending(authorization, now));
+}
+function connectionRunBase(record, updatedAt) {
+  return {
+    id: record.id,
+    projectId: record.projectId,
+    connectorId: record.connectorId,
+    kind: record.kind,
+    owner: structuredClone(record.owner),
+    slot: record.slot,
+    initiatedByExecutionId: record.initiatedByExecutionId,
+    createdAt: new Date(record.createdAt),
+    updatedAt: new Date(updatedAt)
+  };
+}
+function expireConnectionRun(record, now) {
+  return {
+    ...connectionRunBase(record, now),
+    status: "expired",
+    ...record.waitingFor === "account_selection" ? { authorizationId: record.authorizationId } : {},
+    finishedAt: new Date(now)
+  };
+}
+function failExpiredProcessingRun(record, now) {
+  return {
+    ...connectionRunBase(record, now),
+    status: "failed",
+    ...record.authorizationId === undefined ? {} : { authorizationId: record.authorizationId },
+    error: toSixbFailure(createSixbError("internal.unexpected", "[Sixb] Connector callback processing did not complete before its deadline."), { allowedCodes: CONNECTOR_CONNECTION_RUN_FAILURE_CODES, at: now }),
+    finishedAt: new Date(now)
+  };
+}
+function disconnectConnectionRecord(connection, now) {
+  return {
+    ...connection,
+    status: "disconnected",
+    disconnectedAt: new Date(now),
+    updatedAt: new Date(now)
+  };
+}
+function markAuthorizationRevocationPending(authorization, now) {
+  if (authorization.status === "revocation_pending" || authorization.status === "revoked") {
+    return authorization;
+  }
+  if (authorization.credentialMutation) {
+    throw new ConnectorConnectionStorageError("authorization_conflict", "[Sixb] Connector authorization cannot begin revocation while credentials are being mutated.");
+  }
+  return {
+    ...authorization,
+    status: "revocation_pending",
+    selectionExpiresAt: undefined,
+    revision: authorization.revision + 1,
+    updatedAt: new Date(now)
+  };
+}
+function assertConnectionCanMove(authorization, removingLastConnection = true) {
+  const mutation = authorization.credentialMutation;
+  if (mutation?.kind === "reauthorization") {
+    throw new ConnectorConnectionStorageError("authorization_conflict", "[Sixb] Connections cannot change while their connector authorization is being reauthorized.");
+  }
+  if (removingLastConnection && mutation) {
+    throw new ConnectorConnectionStorageError("authorization_conflict", "[Sixb] The last connector connection cannot be removed while credentials are being mutated.");
+  }
+}
+function safeEqual(left, right) {
+  const leftBytes = Buffer.from(left);
+  const rightBytes = Buffer.from(right);
+  return leftBytes.length === rightBytes.length && timingSafeEqual(leftBytes, rightBytes);
+}
+function invalidRun() {
+  return new ConnectorConnectionStorageError("run_invalid", "[Sixb] Connector connection run is invalid, expired, or already used.");
+}
+function sameIds(left, right) {
+  const leftSorted = [...left].sort();
+  const rightSorted = [...right].sort();
+  return leftSorted.length === rightSorted.length && leftSorted.every((value, index) => value === rightSorted[index]);
+}
+function invalidAttempt() {
+  return new ConnectorConnectionStorageError("attempt_invalid", "[Sixb] Connector authorization attempt is invalid, expired, or already used.");
+}
+function authorizationConflict() {
+  return new ConnectorConnectionStorageError("authorization_conflict", "[Sixb] Connector connection requires a selectable authorization from the same project and connector.");
+}
+function assertPositiveDuration(value, name) {
+  if (!Number.isFinite(value) || value <= 0) {
+    throw new ConnectorConnectionStorageError("invalid_input", `[Sixb] Connector ${name} must be positive.`);
+  }
+}
+function canClaimMutation(status, kind) {
+  if (kind === "refresh")
+    return status === "active";
+  if (kind === "reauthorization") {
+    return status === "active" || status === "needs_reauthorization";
+  }
+  return status !== "revoked";
+}
+function isSelectable(status) {
+  return status === "pending_selection" || status === "active";
+}
+function leaseExpiry(now, durationMs, deadlineAt) {
+  return new Date(Math.min(now.getTime() + durationMs, deadlineAt.getTime()));
+}
+function mutationExpired(record, now) {
+  return record.credentialMutation.expiresAt.getTime() <= now.getTime() || record.credentialMutation.deadlineAt.getTime() <= now.getTime();
+}
+function matchesMutation(record, input, holderId) {
+  return record !== null && record.revision === input.expectedRevision && record.credentialMutation?.id === input.mutationId && (holderId === undefined || record.credentialMutation.holderId === holderId);
+}
+function stagedCredentials(record, input, kind) {
+  if (!matchesMutation(record, input) || record.credentialMutation.kind !== kind || record.credentialMutation.phase !== "result_staged") {
+    return null;
+  }
+  return record.credentialMutation.stagedCredentials ?? null;
+}
+function applyStagedCredentials(record, staged, now, input) {
+  return {
+    ...record,
+    credentials: structuredClone(staged.credentials),
+    credentialExpiresAt: staged.credentialExpiresAt === undefined ? undefined : new Date(staged.credentialExpiresAt),
+    scopes: [...staged.scopes],
+    accounts: structuredClone(input.accounts),
+    status: "active",
+    selectionExpiresAt: undefined,
+    revision: record.revision + 1,
+    credentialMutation: undefined,
+    updatedAt: now
+  };
+}
+
+// src/storage/connector-connections/provider/authorizations.ts
+class DurableConnectorAuthorizations extends ConnectorConnectionOperations {
+  createAuthorization(input) {
+    assertPositiveDuration(input.selectionTtlMs, "account selection TTL");
+    return this.write(input, async (persistence) => {
+      const now = await persistence.now();
+      const record = {
+        id: input.id,
+        projectId: input.projectId,
+        connectorId: input.connectorId,
+        authorizedBy: structuredClone(input.authorizedBy),
+        credentials: structuredClone(input.credentials),
+        ...input.credentialExpiresAt === undefined ? {} : { credentialExpiresAt: new Date(input.credentialExpiresAt) },
+        scopes: [...input.scopes],
+        accounts: structuredClone(input.accounts),
+        status: "pending_selection",
+        selectionExpiresAt: new Date(now.getTime() + input.selectionTtlMs),
+        revision: 0,
+        createdAt: now,
+        updatedAt: now
+      };
+      if (!await persistence.insertAuthorization(record)) {
+        throw authorizationConflict2("[Sixb] Connector authorization already exists.");
+      }
+      return structuredClone(record);
+    });
+  }
+  initializeAuthorizationAccounts(input) {
+    return this.write(input, async (persistence) => {
+      const record = await persistence.getAuthorization(input.authorizationId);
+      if (!record || record.revision !== input.expectedRevision || record.status !== "pending_selection" || record.credentialMutation) {
+        return null;
+      }
+      const updated = {
+        ...record,
+        accounts: structuredClone(input.accounts),
+        revision: record.revision + 1,
+        updatedAt: await persistence.now()
+      };
+      await persistence.updateAuthorization(updated);
+      return structuredClone(updated);
+    });
+  }
+  getAuthorization(input) {
+    return this.read(input, async (persistence) => {
+      const authorization = await persistence.getAuthorization(input.authorizationId);
+      return authorization ? structuredClone(authorization) : null;
+    });
+  }
+  getAuthorizationByConnectionId(input) {
+    return this.read(input, async (persistence) => {
+      const connection = await persistence.getConnectionById(input.connectionId);
+      if (!connection)
+        return null;
+      const authorization = await persistence.getAuthorization(connection.authorizationId);
+      return authorization ? structuredClone(authorization) : null;
+    });
+  }
+  claimCredentialMutation(input) {
+    assertPositiveDuration(input.leaseDurationMs, "credential mutation lease duration");
+    assertPositiveDuration(input.operationTimeoutMs, "credential mutation timeout");
+    return this.write(input, async (persistence) => {
+      const now = await persistence.now();
+      const record = await persistence.getAuthorization(input.authorizationId);
+      if (!record || record.revision !== input.expectedRevision || !canClaimMutation(record.status, input.mutation.kind)) {
+        return null;
+      }
+      if (record.credentialMutation) {
+        const canReplacePrepared = record.credentialMutation.phase === "prepared" && record.credentialMutation.expiresAt.getTime() <= now.getTime();
+        if (!canReplacePrepared)
+          return null;
+      }
+      const attached = await persistence.listConnectionsByAuthorization(record.id, {
+        connectedOnly: true
+      });
+      if (input.mutation.kind === "reauthorization" && !sameIds(attached.map((connection) => connection.id), input.expectedConnectionIds ?? [])) {
+        return null;
+      }
+      const deadlineAt = new Date(now.getTime() + input.operationTimeoutMs);
+      const mutation = {
+        ...structuredClone(input.mutation),
+        phase: "prepared",
+        expiresAt: leaseExpiry(now, input.leaseDurationMs, deadlineAt),
+        deadlineAt,
+        ...input.mutation.kind === "reauthorization" ? { expectedConnectionIds: [...input.expectedConnectionIds ?? []] } : {}
+      };
+      const startsRevocation = input.mutation.kind === "revocation" && record.status !== "revocation_pending";
+      const updated = {
+        ...record,
+        status: input.mutation.kind === "revocation" ? "revocation_pending" : record.status,
+        selectionExpiresAt: input.mutation.kind === "revocation" ? undefined : record.selectionExpiresAt,
+        revision: startsRevocation ? record.revision + 1 : record.revision,
+        credentialMutation: mutation,
+        updatedAt: now
+      };
+      await persistence.updateAuthorization(updated);
+      const disconnected = [];
+      if (input.mutation.kind === "revocation") {
+        for (const connection of attached) {
+          const updatedConnection = disconnectConnectionRecord(connection, now);
+          await persistence.updateConnection(updatedConnection);
+          disconnected.push(structuredClone(updatedConnection));
+        }
+      }
+      return { authorization: structuredClone(updated), disconnected };
+    });
+  }
+  markCredentialMutationExecuting(input) {
+    return this.write(input, async (persistence) => {
+      const now = await persistence.now();
+      const record = await persistence.getAuthorization(input.authorizationId);
+      if (!matchesMutation(record, input, input.holderId) || record.credentialMutation.phase !== "prepared" || mutationExpired(record, now)) {
+        return null;
+      }
+      const updated = {
+        ...record,
+        credentialMutation: { ...record.credentialMutation, phase: "executing" },
+        updatedAt: now
+      };
+      await persistence.updateAuthorization(updated);
+      return structuredClone(updated);
+    });
+  }
+  renewCredentialMutation(input) {
+    assertPositiveDuration(input.leaseDurationMs, "credential mutation lease duration");
+    return this.write(input, async (persistence) => {
+      const now = await persistence.now();
+      const record = await persistence.getAuthorization(input.authorizationId);
+      if (!matchesMutation(record, input, input.holderId) || record.credentialMutation.phase === "result_staged" || mutationExpired(record, now)) {
+        return null;
+      }
+      const updated = {
+        ...record,
+        credentialMutation: {
+          ...record.credentialMutation,
+          expiresAt: leaseExpiry(now, input.leaseDurationMs, record.credentialMutation.deadlineAt)
+        }
+      };
+      await persistence.updateAuthorization(updated);
+      return structuredClone(updated);
+    });
+  }
+  stageCredentialMutationCredentials(input) {
+    return this.write(input, async (persistence) => {
+      const now = await persistence.now();
+      const record = await persistence.getAuthorization(input.authorizationId);
+      if (!matchesMutation(record, input, input.holderId) || record.credentialMutation.phase !== "executing" || mutationExpired(record, now) || record.credentialMutation.kind === "revocation") {
+        return null;
+      }
+      const updated = {
+        ...record,
+        credentialMutation: {
+          ...record.credentialMutation,
+          phase: "result_staged",
+          stagedCredentials: {
+            credentials: structuredClone(input.credentials),
+            ...input.credentialExpiresAt === undefined ? {} : { credentialExpiresAt: new Date(input.credentialExpiresAt) },
+            scopes: [...input.scopes]
+          }
+        },
+        updatedAt: now
+      };
+      await persistence.updateAuthorization(updated);
+      return structuredClone(updated);
+    });
+  }
+  stageCredentialMutationRevocation(input) {
+    return this.write(input, async (persistence) => {
+      const now = await persistence.now();
+      const record = await persistence.getAuthorization(input.authorizationId);
+      if (!matchesMutation(record, input, input.holderId) || record.credentialMutation.phase !== "executing" || record.credentialMutation.kind !== "revocation" || mutationExpired(record, now)) {
+        return null;
+      }
+      const updated = {
+        ...record,
+        credentialMutation: { ...record.credentialMutation, phase: "result_staged" },
+        updatedAt: now
+      };
+      await persistence.updateAuthorization(updated);
+      return structuredClone(updated);
+    });
+  }
+  releaseCredentialMutation(input) {
+    return this.write(input, async (persistence) => {
+      const record = await persistence.getAuthorization(input.authorizationId);
+      if (!matchesMutation(record, input, input.holderId) || record.credentialMutation.phase === "result_staged") {
+        return false;
+      }
+      await persistence.updateAuthorization({
+        ...record,
+        credentialMutation: undefined,
+        updatedAt: await persistence.now()
+      });
+      return true;
+    });
+  }
+  recoverExpiredCredentialMutation(input) {
+    return this.write(input, async (persistence) => {
+      const record = await persistence.getAuthorization(input.authorizationId);
+      if (!record?.credentialMutation)
+        return null;
+      if (record.credentialMutation.phase === "result_staged")
+        return structuredClone(record);
+      const now = await persistence.now();
+      if (!mutationExpired(record, now))
+        return null;
+      const ambiguous = record.credentialMutation.phase === "executing";
+      const failClosed = ambiguous && record.credentialMutation.kind !== "revocation";
+      const updated = {
+        ...record,
+        status: failClosed ? "needs_reauthorization" : record.status,
+        selectionExpiresAt: failClosed ? undefined : record.selectionExpiresAt,
+        revision: failClosed ? record.revision + 1 : record.revision,
+        credentialMutation: undefined,
+        updatedAt: now
+      };
+      await persistence.updateAuthorization(updated);
+      return structuredClone(updated);
+    });
+  }
+  markNeedsReauthorization(input) {
+    return this.write(input, async (persistence) => {
+      const record = await persistence.getAuthorization(input.authorizationId);
+      if (!matchesMutation(record, input))
+        return null;
+      const staged = record.credentialMutation.stagedCredentials;
+      const updated = {
+        ...record,
+        ...staged ? {
+          credentials: structuredClone(staged.credentials),
+          credentialExpiresAt: staged.credentialExpiresAt === undefined ? undefined : new Date(staged.credentialExpiresAt),
+          scopes: [...staged.scopes]
+        } : {},
+        status: "needs_reauthorization",
+        selectionExpiresAt: undefined,
+        revision: record.revision + 1,
+        credentialMutation: undefined,
+        updatedAt: await persistence.now()
+      };
+      await persistence.updateAuthorization(updated);
+      return structuredClone(updated);
+    });
+  }
+  finalizeRefresh(input) {
+    return this.write(input, async (persistence) => {
+      const record = await persistence.getAuthorization(input.authorizationId);
+      const staged = stagedCredentials(record, input, "refresh");
+      if (!record || !staged)
+        return null;
+      const updated = applyStagedCredentials(record, staged, await persistence.now(), {
+        accounts: record.accounts
+      });
+      await persistence.updateAuthorization(updated);
+      return structuredClone(updated);
+    });
+  }
+  finalizeReauthorization(input) {
+    return this.write(input, async (persistence) => {
+      const record = await persistence.getAuthorization(input.authorizationId);
+      const staged = stagedCredentials(record, input, "reauthorization");
+      if (!record || !staged || !record.credentialMutation)
+        return null;
+      const attached = await persistence.listConnectionsByAuthorization(record.id, {
+        connectedOnly: true
+      });
+      if (!sameIds(attached.map((connection) => connection.id), record.credentialMutation.expectedConnectionIds ?? [])) {
+        throw authorizationConflict2("[Sixb] Connections attached to the connector authorization changed during reauthorization.");
+      }
+      const accountsById = new Map(input.accounts.map((account) => [account.id, account]));
+      if (attached.some((connection) => !accountsById.has(connection.account.id))) {
+        throw authorizationConflict2("[Sixb] Reauthorized connector grant no longer exposes every attached account.");
+      }
+      const now = await persistence.now();
+      const updated = applyStagedCredentials(record, staged, now, { accounts: input.accounts });
+      await persistence.updateAuthorization(updated);
+      for (const connection of attached) {
+        await persistence.updateConnection({
+          ...connection,
+          account: structuredClone(accountsById.get(connection.account.id)),
+          updatedAt: now
+        });
+      }
+      return structuredClone(updated);
+    });
+  }
+  finalizeRevocation(input) {
+    return this.write(input, async (persistence) => {
+      const record = await persistence.getAuthorization(input.authorizationId);
+      if (!matchesMutation(record, input) || record.credentialMutation.kind !== "revocation" || record.credentialMutation.phase !== "result_staged") {
+        return null;
+      }
+      const updated = {
+        ...record,
+        status: "revoked",
+        credentials: undefined,
+        credentialExpiresAt: undefined,
+        scopes: [],
+        accounts: [],
+        selectionExpiresAt: undefined,
+        revision: record.revision + 1,
+        credentialMutation: undefined,
+        updatedAt: await persistence.now()
+      };
+      await persistence.updateAuthorization(updated);
+      return structuredClone(updated);
+    });
+  }
+}
+function authorizationConflict2(message) {
+  return new ConnectorConnectionStorageError("authorization_conflict", message);
+}
+
+// src/storage/connector-connections/provider/connections.ts
+class DurableConnectorConnections extends ConnectorConnectionOperations {
+  async putConnection(input) {
+    const outcome = await this.write(input, async (persistence) => this.putConnectionNow(persistence, input, await persistence.now()));
+    if ("error" in outcome)
+      throw outcome.error;
+    return outcome;
+  }
+  async putConnectionFromRun(input) {
+    const outcome = await this.write(input, async (persistence) => {
+      const run = await currentConnectionRun(persistence, input.runId);
+      if (!run || run.status !== "waiting" || run.waitingFor !== "account_selection") {
+        return { error: invalidRun() };
+      }
+      const now = await persistence.now();
+      const result = await this.putConnectionNow(persistence, {
+        id: input.id,
+        projectId: input.projectId,
+        connectorId: input.connectorId,
+        owner: run.owner,
+        slot: run.slot,
+        authorizationId: run.authorizationId,
+        account: input.account,
+        replace: input.replace
+      }, now);
+      if ("error" in result)
+        return result;
+      const succeeded = {
+        ...connectionRunBase(run, now),
+        status: "succeeded",
+        authorizationId: run.authorizationId,
+        ...result.revocationPendingAuthorizationId === undefined ? {} : { cleanupAuthorizationId: result.revocationPendingAuthorizationId },
+        connections: [structuredClone(result.connection)],
+        finishedAt: now
+      };
+      await persistence.updateConnectionRun(succeeded);
+      return { ...result, run: structuredClone(succeeded) };
+    });
+    if ("error" in outcome)
+      throw outcome.error;
+    return outcome;
+  }
+  getConnection(input) {
+    return this.read(input, async (persistence) => {
+      const connection = await persistence.getConnectionBySelector(input);
+      return connection?.status === "connected" ? structuredClone(connection) : null;
+    });
+  }
+  getConnectionById(input) {
+    return this.read(input, async (persistence) => {
+      const connection = await persistence.getConnectionById(input.connectionId);
+      return connection ? structuredClone(connection) : null;
+    });
+  }
+  listConnections(input) {
+    return this.read(input, async (persistence) => structuredClone(await persistence.listConnections()));
+  }
+  listConnectionsByAuthorization(input) {
+    return this.read(input, async (persistence) => {
+      if (!await persistence.getAuthorization(input.authorizationId))
+        return [];
+      return structuredClone(await persistence.listConnectionsByAuthorization(input.authorizationId, {
+        connectedOnly: true
+      }));
+    });
+  }
+  disconnectConnection(input) {
+    return this.write(input, async (persistence) => {
+      const connection = await persistence.getConnectionById(input.connectionId);
+      if (!connection)
+        return null;
+      const authorization = await persistence.getAuthorization(connection.authorizationId);
+      if (!authorization) {
+        throw new ConnectorConnectionStorageError("authorization_conflict", "[Sixb] Connector connection references an unavailable authorization.");
+      }
+      if (connection.status === "disconnected") {
+        return {
+          connection: structuredClone(connection),
+          authorization: structuredClone(authorization),
+          ...authorization.status === "revocation_pending" ? { revocationPendingAuthorizationId: authorization.id } : {}
+        };
+      }
+      const now = await persistence.now();
+      const remaining = (await persistence.listConnectionsByAuthorization(authorization.id, {
+        connectedOnly: true
+      })).filter((candidate) => candidate.id !== connection.id);
+      assertConnectionCanMove(authorization, remaining.length === 0);
+      const disconnected = disconnectConnectionRecord(connection, now);
+      await persistence.updateConnection(disconnected);
+      const updatedAuthorization = remaining.length === 0 ? markAuthorizationRevocationPending(authorization, now) : authorization;
+      if (updatedAuthorization !== authorization) {
+        await persistence.updateAuthorization(updatedAuthorization);
+      }
+      return {
+        connection: structuredClone(disconnected),
+        authorization: structuredClone(updatedAuthorization),
+        ...updatedAuthorization.status === "revocation_pending" && remaining.length === 0 ? { revocationPendingAuthorizationId: updatedAuthorization.id } : {}
+      };
+    });
+  }
+  async putConnectionNow(persistence, input, now) {
+    let authorization = await persistence.getAuthorization(input.authorizationId);
+    if (!authorization || !isSelectable(authorization.status) || authorization.credentialMutation?.kind === "reauthorization") {
+      throw authorizationConflict();
+    }
+    if (authorization.status === "pending_selection" && authorization.selectionExpiresAt.getTime() <= now.getTime()) {
+      authorization = {
+        ...authorization,
+        status: "revocation_pending",
+        selectionExpiresAt: undefined,
+        revision: authorization.revision + 1,
+        updatedAt: now
+      };
+      await persistence.updateAuthorization(authorization);
+      return { error: authorizationConflict() };
+    }
+    const account = authorization.accounts.find((candidate) => candidate.id === input.account.id);
+    if (!account) {
+      throw new ConnectorConnectionStorageError("authorization_conflict", "[Sixb] Connector connection account is not exposed by its authorization.");
+    }
+    const existing = await persistence.getConnectionBySelector(input);
+    const sameAccount = existing?.account.id === account.id;
+    if (existing && !sameAccount && !input.replace) {
+      throw new ConnectorConnectionStorageError("connection_conflict", `[Sixb] Connector slot '${input.slot}' is already connected to another account; explicit replacement is required.`);
+    }
+    if (!existing && await persistence.getConnectionById(input.id)) {
+      throw new ConnectorConnectionStorageError("connection_conflict", "[Sixb] Connector connection id already exists.");
+    }
+    let revocationPendingAuthorizationId;
+    if (existing?.status === "connected" && existing.authorizationId !== authorization.id) {
+      const previous = await persistence.getAuthorization(existing.authorizationId);
+      if (!previous) {
+        throw new ConnectorConnectionStorageError("authorization_conflict", "[Sixb] Existing connector connection references an unavailable authorization.");
+      }
+      const remaining = (await persistence.listConnectionsByAuthorization(previous.id, { connectedOnly: true })).filter((connection2) => connection2.id !== existing.id);
+      assertConnectionCanMove(previous, remaining.length === 0);
+      if (remaining.length === 0) {
+        await persistence.updateAuthorization(markAuthorizationRevocationPending(previous, now));
+        revocationPendingAuthorizationId = previous.id;
+      }
+    } else if (existing?.status === "connected") {
+      const previous = await persistence.getAuthorization(existing.authorizationId);
+      if (previous)
+        assertConnectionCanMove(previous, false);
+    }
+    const updatedAuthorization = authorization.status === "pending_selection" ? {
+      ...authorization,
+      status: "active",
+      selectionExpiresAt: undefined,
+      revision: authorization.revision + 1,
+      updatedAt: now
+    } : authorization;
+    const connection = existing ? {
+      ...existing,
+      authorizationId: input.authorizationId,
+      account: structuredClone(account),
+      status: "connected",
+      disconnectedAt: undefined,
+      updatedAt: now
+    } : {
+      id: input.id,
+      projectId: input.projectId,
+      connectorId: input.connectorId,
+      owner: structuredClone(input.owner),
+      slot: input.slot,
+      authorizationId: input.authorizationId,
+      account: structuredClone(account),
+      status: "connected",
+      createdAt: now,
+      updatedAt: now
+    };
+    if (updatedAuthorization !== authorization) {
+      await persistence.updateAuthorization(updatedAuthorization);
+    }
+    if (existing) {
+      await persistence.updateConnection(connection);
+    } else if (!await persistence.insertConnection(connection)) {
+      throw new ConnectorConnectionStorageError("connection_conflict", "[Sixb] Connector connection id already exists.");
+    }
+    return {
+      connection: structuredClone(connection),
+      authorization: structuredClone(updatedAuthorization),
+      ...revocationPendingAuthorizationId === undefined ? {} : { revocationPendingAuthorizationId },
+      created: existing === null,
+      replaced: existing !== null && !sameAccount
+    };
+  }
+}
+
+// src/storage/connector-connections/provider/runs.ts
+class DurableConnectorConnectionRuns extends ConnectorConnectionOperations {
+  createAuthorizationAttempt(input) {
+    assertPositiveDuration(input.ttlMs, "authorization attempt TTL");
+    return this.write(input, async (persistence) => {
+      if (input.connectionRunId !== undefined) {
+        const run = await persistence.getConnectionRun(input.connectionRunId);
+        const existingAttempt = await persistence.getAuthorizationAttemptByConnectionRunId(input.connectionRunId);
+        if (!run || existingAttempt || run.status !== "waiting" || run.waitingFor !== "provider_authorization" || run.slot !== input.slot || run.initiatedByExecutionId !== input.initiatedByExecutionId) {
+          throw new ConnectorConnectionStorageError("attempt_conflict", "[Sixb] Connector authorization attempt does not match its connection run.");
+        }
+      }
+      const now = await persistence.now();
+      const record = {
+        id: input.id,
+        projectId: input.projectId,
+        connectorId: input.connectorId,
+        owner: structuredClone(input.owner),
+        slot: input.slot,
+        initiatedByExecutionId: input.initiatedByExecutionId,
+        stateHash: input.stateHash,
+        codeVerifier: structuredClone(input.codeVerifier),
+        redirectUri: input.redirectUri,
+        ...input.connectionRunId === undefined ? {} : { connectionRunId: input.connectionRunId },
+        ...input.returnTo === undefined ? {} : { returnTo: input.returnTo },
+        ...input.callbackBindingHash === undefined ? {} : { callbackBindingHash: input.callbackBindingHash },
+        ...input.reauthorizationId === undefined ? {} : { reauthorizationId: input.reauthorizationId },
+        ...input.reauthorizationRevision === undefined ? {} : { reauthorizationRevision: input.reauthorizationRevision },
+        ...input.reauthorizationConnectionIds === undefined ? {} : { reauthorizationConnectionIds: [...input.reauthorizationConnectionIds] },
+        createdAt: now,
+        expiresAt: new Date(now.getTime() + input.ttlMs)
+      };
+      if (!await persistence.insertAuthorizationAttempt(record)) {
+        throw new ConnectorConnectionStorageError("attempt_conflict", "[Sixb] Connector authorization attempt already exists.");
+      }
+      return structuredClone(record);
+    });
+  }
+  async consumeAuthorizationAttempt(input) {
+    const record = await this.write(input, async (persistence) => {
+      const record2 = await persistence.getAuthorizationAttempt(input.id);
+      const now = await persistence.now();
+      if (record2 && record2.expiresAt.getTime() <= now.getTime()) {
+        await persistence.deleteAuthorizationAttempt(record2.id);
+        return null;
+      }
+      if (!record2 || record2.redirectUri !== input.redirectUri || !safeEqual(record2.stateHash, input.stateHash)) {
+        return null;
+      }
+      await persistence.deleteAuthorizationAttempt(input.id);
+      return structuredClone(record2);
+    });
+    if (!record)
+      throw invalidAttempt();
+    return record;
+  }
+  createConnectionRun(input) {
+    assertPositiveDuration(input.ttlMs, "connection run TTL");
+    return this.write(input, async (persistence) => {
+      const now = await persistence.now();
+      const record = {
+        id: input.id,
+        projectId: input.projectId,
+        connectorId: input.connectorId,
+        kind: input.kind,
+        owner: structuredClone(input.owner),
+        slot: input.slot,
+        initiatedByExecutionId: input.initiatedByExecutionId,
+        status: "waiting",
+        waitingFor: "provider_authorization",
+        createdAt: now,
+        updatedAt: now,
+        expiresAt: new Date(now.getTime() + input.ttlMs)
+      };
+      if (!await persistence.insertConnectionRun(record)) {
+        throw new ConnectorConnectionStorageError("run_conflict", "[Sixb] Connector connection run already exists.");
+      }
+      return structuredClone(record);
+    });
+  }
+  createConnectionSelectionRun(input) {
+    assertPositiveDuration(input.ttlMs, "connection run TTL");
+    return this.write(input, async (persistence) => {
+      const authorization = await persistence.getAuthorization(input.authorizationId);
+      if (!authorization || authorization.status !== "active" || authorization.credentialMutation) {
+        throw authorizationConflict();
+      }
+      const now = await persistence.now();
+      const record = {
+        id: input.id,
+        projectId: input.projectId,
+        connectorId: input.connectorId,
+        kind: "connect",
+        owner: structuredClone(input.owner),
+        slot: input.slot,
+        initiatedByExecutionId: input.initiatedByExecutionId,
+        status: "waiting",
+        waitingFor: "account_selection",
+        authorizationId: input.authorizationId,
+        createdAt: now,
+        updatedAt: now,
+        expiresAt: new Date(now.getTime() + input.ttlMs)
+      };
+      if (!await persistence.insertConnectionRun(record)) {
+        throw new ConnectorConnectionStorageError("run_conflict", "[Sixb] Connector connection run already exists.");
+      }
+      return structuredClone(record);
+    });
+  }
+  async claimConnectionRunCallback(input) {
+    assertPositiveDuration(input.processingTtlMs, "connection run processing TTL");
+    const candidate = await this.read({ projectId: input.projectId }, (persistence) => persistence.getAuthorizationAttempt(input.attemptId));
+    if (!candidate)
+      return null;
+    return this.write({ projectId: input.projectId, connectorId: candidate.connectorId }, async (persistence) => {
+      const attempt = await persistence.getAuthorizationAttempt(input.attemptId);
+      if (!attempt || attempt.connectionRunId === undefined || attempt.returnTo === undefined || attempt.callbackBindingHash === undefined || attempt.redirectUri !== input.redirectUri || !safeEqual(attempt.stateHash, input.stateHash) || !safeEqual(attempt.callbackBindingHash, input.callbackBindingHash)) {
+        return null;
+      }
+      const run = await persistence.getConnectionRun(attempt.connectionRunId);
+      if (!run || run.status !== "waiting" || run.waitingFor !== "provider_authorization" || run.slot !== attempt.slot || run.initiatedByExecutionId !== attempt.initiatedByExecutionId) {
+        return null;
+      }
+      const now = await persistence.now();
+      await persistence.deleteAuthorizationAttempt(attempt.id);
+      if (attempt.expiresAt.getTime() <= now.getTime() || run.expiresAt.getTime() <= now.getTime()) {
+        const expired = {
+          ...connectionRunBase(run, now),
+          status: "expired",
+          finishedAt: now
+        };
+        await persistence.updateConnectionRun(expired);
+        return { type: "expired", run: structuredClone(expired), returnTo: attempt.returnTo };
+      }
+      const processing = {
+        ...connectionRunBase(run, now),
+        status: "running",
+        processingId: input.processingId,
+        callbackStartedAt: now,
+        expiresAt: new Date(now.getTime() + input.processingTtlMs),
+        ...attempt.reauthorizationId === undefined ? {} : { authorizationId: attempt.reauthorizationId }
+      };
+      await persistence.updateConnectionRun(processing);
+      return {
+        type: "claimed",
+        run: structuredClone(processing),
+        attempt: structuredClone(attempt),
+        returnTo: attempt.returnTo
+      };
+    });
+  }
+  attachConnectionRunAuthorization(input) {
+    return this.write(input, async (persistence) => {
+      const run = await currentConnectionRun(persistence, input.runId);
+      const authorization = await persistence.getAuthorization(input.authorizationId);
+      if (!run || run.status !== "running" || run.processingId !== input.processingId || run.authorizationId !== undefined && run.authorizationId !== input.authorizationId || !authorization || authorization.status !== "pending_selection") {
+        return null;
+      }
+      const updated = {
+        ...run,
+        authorizationId: input.authorizationId,
+        updatedAt: await persistence.now()
+      };
+      await persistence.updateConnectionRun(updated);
+      return structuredClone(updated);
+    });
+  }
+  waitForConnectionRunSelection(input) {
+    return this.write(input, async (persistence) => {
+      const run = await currentConnectionRun(persistence, input.runId);
+      if (!run || run.status !== "running" || run.kind !== "connect" || run.processingId !== input.processingId || run.authorizationId !== input.authorizationId) {
+        return null;
+      }
+      const now = await persistence.now();
+      const waiting = {
+        ...connectionRunBase(run, now),
+        status: "waiting",
+        waitingFor: "account_selection",
+        authorizationId: input.authorizationId,
+        expiresAt: new Date(input.expiresAt)
+      };
+      await persistence.updateConnectionRun(waiting);
+      return structuredClone(waiting);
+    });
+  }
+  finishConnectionRun(input) {
+    return this.write(input, async (persistence) => {
+      const run = await currentConnectionRun(persistence, input.runId);
+      if (!run || run.status !== "running" || input.processingId !== run.processingId)
+        return null;
+      const now = await persistence.now();
+      const authorizationId = input.status === "succeeded" ? input.authorizationId : input.status === "failed" ? input.authorizationId ?? run.authorizationId : run.authorizationId;
+      if (input.status !== "succeeded" && run.kind === "connect" && authorizationId) {
+        await markPendingAuthorizationForCleanup(persistence, authorizationId, now);
+      }
+      const base = connectionRunBase(run, now);
+      const finished = input.status === "succeeded" ? {
+        ...base,
+        status: "succeeded",
+        authorizationId: input.authorizationId,
+        ...input.cleanupAuthorizationId === undefined ? {} : { cleanupAuthorizationId: input.cleanupAuthorizationId },
+        connections: structuredClone(input.connections),
+        finishedAt: now
+      } : input.status === "failed" ? {
+        ...base,
+        status: "failed",
+        ...authorizationId === undefined ? {} : { authorizationId },
+        error: parseSixbFailure(input.error, CONNECTOR_CONNECTION_RUN_FAILURE_CODES),
+        finishedAt: now
+      } : {
+        ...base,
+        status: "cancelled",
+        ...authorizationId === undefined ? {} : { authorizationId },
+        finishedAt: now
+      };
+      await persistence.updateConnectionRun(finished);
+      return structuredClone(finished);
+    });
+  }
+  getConnectionRun(input) {
+    return this.write(input, async (persistence) => {
+      const run = await currentConnectionRun(persistence, input.runId);
+      return run ? structuredClone(run) : null;
+    });
+  }
+}
+
+// src/storage/connector-connections/provider.ts
+class DurableConnectorConnectionStorage {
+  durability = "durable";
+  runs;
+  authorizations;
+  connections;
+  constructor(backend) {
+    this.runs = new DurableConnectorConnectionRuns(backend);
+    this.authorizations = new DurableConnectorAuthorizations(backend);
+    this.connections = new DurableConnectorConnections(backend);
+  }
+  async createAuthorizationAttempt(...args) {
+    return this.runs.createAuthorizationAttempt(...args);
+  }
+  async consumeAuthorizationAttempt(...args) {
+    return this.runs.consumeAuthorizationAttempt(...args);
+  }
+  async createConnectionRun(...args) {
+    return this.runs.createConnectionRun(...args);
+  }
+  async createConnectionSelectionRun(...args) {
+    return this.runs.createConnectionSelectionRun(...args);
+  }
+  async claimConnectionRunCallback(...args) {
+    return this.runs.claimConnectionRunCallback(...args);
+  }
+  async attachConnectionRunAuthorization(...args) {
+    return this.runs.attachConnectionRunAuthorization(...args);
+  }
+  async waitForConnectionRunSelection(...args) {
+    return this.runs.waitForConnectionRunSelection(...args);
+  }
+  async finishConnectionRun(...args) {
+    return this.runs.finishConnectionRun(...args);
+  }
+  async getConnectionRun(...args) {
+    return this.runs.getConnectionRun(...args);
+  }
+  async createAuthorization(...args) {
+    return this.authorizations.createAuthorization(...args);
+  }
+  async initializeAuthorizationAccounts(...args) {
+    return this.authorizations.initializeAuthorizationAccounts(...args);
+  }
+  async getAuthorization(...args) {
+    return this.authorizations.getAuthorization(...args);
+  }
+  async getAuthorizationByConnectionId(...args) {
+    return this.authorizations.getAuthorizationByConnectionId(...args);
+  }
+  async claimCredentialMutation(...args) {
+    return this.authorizations.claimCredentialMutation(...args);
+  }
+  async markCredentialMutationExecuting(...args) {
+    return this.authorizations.markCredentialMutationExecuting(...args);
+  }
+  async renewCredentialMutation(...args) {
+    return this.authorizations.renewCredentialMutation(...args);
+  }
+  async stageCredentialMutationCredentials(...args) {
+    return this.authorizations.stageCredentialMutationCredentials(...args);
+  }
+  async stageCredentialMutationRevocation(...args) {
+    return this.authorizations.stageCredentialMutationRevocation(...args);
+  }
+  async releaseCredentialMutation(...args) {
+    return this.authorizations.releaseCredentialMutation(...args);
+  }
+  async recoverExpiredCredentialMutation(...args) {
+    return this.authorizations.recoverExpiredCredentialMutation(...args);
+  }
+  async markNeedsReauthorization(...args) {
+    return this.authorizations.markNeedsReauthorization(...args);
+  }
+  async finalizeRefresh(...args) {
+    return this.authorizations.finalizeRefresh(...args);
+  }
+  async finalizeReauthorization(...args) {
+    return this.authorizations.finalizeReauthorization(...args);
+  }
+  async finalizeRevocation(...args) {
+    return this.authorizations.finalizeRevocation(...args);
+  }
+  async putConnection(...args) {
+    return this.connections.putConnection(...args);
+  }
+  async putConnectionFromRun(...args) {
+    return this.connections.putConnectionFromRun(...args);
+  }
+  async getConnection(...args) {
+    return this.connections.getConnection(...args);
+  }
+  async getConnectionById(...args) {
+    return this.connections.getConnectionById(...args);
+  }
+  async listConnections(...args) {
+    return this.connections.listConnections(...args);
+  }
+  async listConnectionsByAuthorization(...args) {
+    return this.connections.listConnectionsByAuthorization(...args);
+  }
+  async disconnectConnection(...args) {
+    return this.connections.disconnectConnection(...args);
+  }
+}
+export {
+  DurableConnectorConnectionStorage
+};
+
+//# debugId=5D13E1A973240FE264756E2164756E21