@sixb/core 0.1.1 → 0.1.3

package/dist/chunk-bv41fmjn.js

@@ -0,0 +1,3294 @@
+// @bun
+import {
+  SchedulerRuntime
+} from "./chunk-9t8f5xfx.js";
+import {
+  registerProjectionRegistry
+} from "./chunk-wb4051cx.js";
+import {
+  LoggingService
+} from "./chunk-ghteq96b.js";
+import {
+  OntologyOutboxDispatcher,
+  createDomainEventService
+} from "./chunk-f2rt4vkh.js";
+import {
+  discoverOntologySources,
+  discoverProjectDefinitions,
+  validateRulesAtStartup
+} from "./chunk-1ywq4hzk.js";
+import {
+  validateSchedulesAtStartup
+} from "./chunk-5sz8ta9r.js";
+import {
+  assertDatasetDefinition
+} from "./chunk-a31h57d5.js";
+import {
+  createBoundSixb,
+  validateAgentGroupReferences,
+  validateAgentToolsAtStartup,
+  validateWorkflowsAtStartup
+} from "./chunk-177ed2mp.js";
+import {
+  ConnectorError,
+  ConnectorNotFoundError,
+  SyncValidationError,
+  createAmbiguousProviderOperationError,
+  createConnectorCodedError,
+  isConnectorStorageError,
+  oauthErrorKind,
+  providerBoundaryError,
+  providerFailureCode,
+  recoverConnectorFailure,
+  storageBoundaryError
+} from "./chunk-km4rkj4t.js";
+import {
+  RuntimeError
+} from "./chunk-3rsf30p4.js";
+import {
+  createOntologyMutationRuntime,
+  registerOntologyMutationRuntime
+} from "./chunk-xhy826cz.js";
+import {
+  isOAuthConnectorDefinition,
+  isStaticConnectorDefinition
+} from "./chunk-8m5ejdpn.js";
+import {
+  registerConnectorConnectionCallbackProcess
+} from "./chunk-nf4r78r4.js";
+import {
+  ActionRegistry
+} from "./chunk-ttba8x6z.js";
+import {
+  ProjectionRegistry,
+  createOntologyMaterializer
+} from "./chunk-ettb0cy4.js";
+import {
+  ensureExecutionRecord
+} from "./chunk-4aw0jwk0.js";
+import {
+  checkStorageSchema,
+  isMigrationCapableStorage
+} from "./chunk-xmggaxg4.js";
+import {
+  CONNECTOR_CONNECTION_RUN_FAILURE_CODES,
+  ConnectorConnectionStorageError
+} from "./chunk-5gd7tpv6.js";
+import {
+  OntologyRegistry
+} from "./chunk-3j7573mj.js";
+import {
+  attachSixbErrorReporter,
+  shareSixbErrorReporter
+} from "./chunk-dsrkgtnh.js";
+import {
+  reportEventDeliveryFailure
+} from "./chunk-bhxaq2nn.js";
+import {
+  AuthRuntime,
+  SecurityRegistry
+} from "./chunk-d2adj15j.js";
+import {
+  AuthRuntimeError,
+  isMagicLinkAuthStrategy,
+  isOidcAuthStrategy
+} from "./chunk-xwnf87e1.js";
+import {
+  AuthorizationError,
+  resolveExecutionScopeAuthorization
+} from "./chunk-4z3n1dzt.js";
+import {
+  captureSixbFailure,
+  isSixbError
+} from "./chunk-0172wgm9.js";
+// src/webhooks/errors.ts
+class WebhookValidationError extends Error {
+  name = "WebhookValidationError";
+}
+
+// src/webhooks/builders.ts
+function defineWebhook(id) {
+  assertNonEmpty(id, "Webhook id");
+  return new WebhookMethodBuilder(id);
+}
+
+class WebhookMethodBuilder {
+  id;
+  constructor(id) {
+    this.id = id;
+  }
+  post() {
+    return new WebhookBodyBuilder(this.id, "POST");
+  }
+}
+
+class WebhookBodyBuilder {
+  id;
+  method;
+  constructor(id, method) {
+    this.id = id;
+    this.method = method;
+  }
+  json(schema) {
+    if (schema !== undefined && typeof schema.parse !== "function") {
+      throw new WebhookValidationError("[Sixb] Webhook JSON schema must provide parse(value).");
+    }
+    return new WebhookBuilder({
+      id: this.id,
+      method: this.method,
+      body: {
+        format: "json",
+        parse(value) {
+          return schema ? schema.parse(value) : value;
+        }
+      }
+    });
+  }
+  text() {
+    return new WebhookBuilder({
+      id: this.id,
+      method: this.method,
+      body: {
+        format: "text",
+        parse(value) {
+          if (typeof value !== "string") {
+            throw new Error("Expected webhook body to be text.");
+          }
+          return value;
+        }
+      }
+    });
+  }
+  raw() {
+    return new WebhookBuilder({
+      id: this.id,
+      method: this.method,
+      body: {
+        format: "raw",
+        parse(value) {
+          if (!(value instanceof Uint8Array)) {
+            throw new Error("Expected webhook body to be raw bytes.");
+          }
+          return value;
+        }
+      }
+    });
+  }
+}
+
+class WebhookBuilder {
+  draft;
+  constructor(draft) {
+    this.draft = draft;
+  }
+  verify(verify) {
+    if (typeof verify !== "function") {
+      throw new WebhookValidationError("[Sixb] Webhook verify must be a function.");
+    }
+    return new WebhookBuilder({
+      ...this.draft,
+      verify
+    });
+  }
+  idempotencyKey(resolver) {
+    if (typeof resolver !== "function") {
+      throw new WebhookValidationError("[Sixb] Webhook idempotencyKey must be a function.");
+    }
+    return new WebhookBuilder({
+      ...this.draft,
+      idempotencyKey: resolver
+    });
+  }
+  handle(handle) {
+    if (typeof handle !== "function") {
+      throw new WebhookValidationError("[Sixb] Webhook handle must be a function.");
+    }
+    return {
+      kind: "webhook",
+      id: this.draft.id,
+      method: this.draft.method,
+      body: this.draft.body,
+      idempotencyKey: this.draft.idempotencyKey,
+      verify: this.draft.verify,
+      handle
+    };
+  }
+}
+function assertNonEmpty(value, field) {
+  if (!value.trim()) {
+    throw new WebhookValidationError(`[Sixb] ${field} must not be empty.`);
+  }
+}
+// src/webhooks/connector.ts
+function webhookConnector(options) {
+  return {
+    type: "webhook",
+    webhooks: options.webhooks,
+    connect() {
+      return { kind: "webhook" };
+    }
+  };
+}
+// src/webhooks/registry.ts
+class WebhookRegistry {
+  webhooks;
+  byRoute = new Map;
+  constructor(options) {
+    const registered = [];
+    for (const connector of options.connectors) {
+      if (!isStaticConnectorDefinition(connector))
+        continue;
+      const webhooks = connector.adapter.webhooks ?? [];
+      if (!Array.isArray(webhooks)) {
+        throw new WebhookValidationError(`[Sixb] Connector '${connector.id}' webhooks must be an array when provided.`);
+      }
+      const ids = new Set;
+      for (const webhook of webhooks) {
+        assertValidWebhook(connector.id, webhook);
+        if (ids.has(webhook.id)) {
+          throw new WebhookValidationError(`[Sixb] Duplicate webhook id '${webhook.id}' for connector '${connector.id}'.`);
+        }
+        ids.add(webhook.id);
+        const route = webhookRoute(connector.id, webhook.id);
+        const duplicate = this.byRoute.get(route);
+        if (duplicate) {
+          throw new WebhookValidationError(`[Sixb] Duplicate webhook route '${route}' for connectors '${duplicate.connector.id}' and '${connector.id}'.`);
+        }
+        const registeredWebhook = {
+          connector,
+          webhook,
+          route
+        };
+        this.byRoute.set(route, registeredWebhook);
+        registered.push(registeredWebhook);
+      }
+    }
+    this.webhooks = Object.freeze(registered);
+  }
+  list() {
+    return this.webhooks;
+  }
+  getByRoute(route) {
+    return this.byRoute.get(route) ?? null;
+  }
+  getById(connectorId, webhookId) {
+    return this.getByRoute(webhookRoute(connectorId, webhookId));
+  }
+}
+function webhookRoute(connectorId, webhookId) {
+  return `/api/webhooks/${connectorId}/${webhookId}`;
+}
+function assertValidWebhook(connectorId, webhook) {
+  if (!isRecord(webhook)) {
+    throw new WebhookValidationError(`[Sixb] Connector '${connectorId}' has an invalid webhook.`);
+  }
+  if (webhook.kind !== "webhook") {
+    throw new WebhookValidationError(`[Sixb] Connector '${connectorId}' webhook must be created with defineWebhook(...).`);
+  }
+  if (typeof webhook.id !== "string" || !webhook.id.trim()) {
+    throw new WebhookValidationError(`[Sixb] Connector '${connectorId}' webhook id must not be empty.`);
+  }
+  if (webhook.method !== "POST") {
+    throw new WebhookValidationError(`[Sixb] Webhook '${connectorId}/${webhook.id}' must use method POST.`);
+  }
+  if (!isRecord(webhook.body)) {
+    throw new WebhookValidationError(`[Sixb] Webhook '${connectorId}/${webhook.id}' body is required.`);
+  }
+  if (webhook.body.format !== "json" && webhook.body.format !== "text" && webhook.body.format !== "raw") {
+    throw new WebhookValidationError(`[Sixb] Webhook '${connectorId}/${webhook.id}' body format must be json, text, or raw.`);
+  }
+  if (typeof webhook.body.parse !== "function") {
+    throw new WebhookValidationError(`[Sixb] Webhook '${connectorId}/${webhook.id}' body parser must provide parse(value).`);
+  }
+  if (webhook.verify !== undefined && typeof webhook.verify !== "function") {
+    throw new WebhookValidationError(`[Sixb] Webhook '${connectorId}/${webhook.id}' verify must be a function.`);
+  }
+  if (webhook.idempotencyKey !== undefined && typeof webhook.idempotencyKey !== "function") {
+    throw new WebhookValidationError(`[Sixb] Webhook '${connectorId}/${webhook.id}' idempotencyKey must be a function.`);
+  }
+  if (typeof webhook.handle !== "function") {
+    throw new WebhookValidationError(`[Sixb] Webhook '${connectorId}/${webhook.id}' handle must be a function.`);
+  }
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+// src/webhooks/unverified.ts
+class UnverifiedWebhookError extends Error {
+  name = "UnverifiedWebhookError";
+}
+function resolveWebhookVerification(subject, options) {
+  if (options.credential)
+    return { credential: options.credential };
+  if (!options.allowUnverified) {
+    throw new UnverifiedWebhookError(`[${subject.connector}] This webhook has no credential, so ${subject.verifies} cannot be ` + `checked and the route would accept unverified requests from anyone who can reach it. ` + `Set ${subject.credentialOption}, or pass ${subject.allowOption} to accept that.`);
+  }
+  return { allowUnverified: true };
+}
+function warnUnverifiedWebhook(subject, verification) {
+  if (verification.credential)
+    return;
+  console.warn(`[${subject.connector}] ${subject.allowOption}, so ${subject.verifies} is not checked ` + `and this route accepts unverified requests from anyone who can reach it. ` + `Set ${subject.credentialOption} before exposing it.`);
+}
+// src/runtime/create.ts
+import { resolve as resolve2 } from "path";
+
+// src/runtime/host.ts
+import { resolve } from "path";
+
+// src/connectors/credentials.ts
+import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
+function createConnectorCredentialProtectorFromKey(encodedKey) {
+  let key;
+  try {
+    key = decodeBase64Url(encodedKey);
+  } catch (error) {
+    throw createConnectorCodedError("connector.configuration_invalid", "connectorConnections.encryptionKey must be canonical base64url encoding.", { cause: error });
+  }
+  if (key.byteLength !== 32) {
+    throw createConnectorCodedError("connector.configuration_invalid", "connectorConnections.encryptionKey must encode exactly 32 random bytes.");
+  }
+  return createAesGcmConnectorCredentialProtector(key);
+}
+function createAesGcmConnectorCredentialProtector(encryptionKey) {
+  if (encryptionKey.byteLength !== 32) {
+    throw createConnectorCodedError("connector.configuration_invalid", "Connector credential encryption key must contain exactly 32 bytes.");
+  }
+  const key = Buffer.from(encryptionKey);
+  return {
+    async seal(plaintext, context) {
+      assertCredentialContext(context);
+      const nonce = randomBytes(12);
+      const cipher = createCipheriv("aes-256-gcm", key, nonce);
+      cipher.setAAD(credentialAad(context));
+      const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+      return {
+        version: 1,
+        algorithm: "A256GCM",
+        nonce: nonce.toString("base64url"),
+        ciphertext: ciphertext.toString("base64url"),
+        tag: cipher.getAuthTag().toString("base64url")
+      };
+    },
+    async open(envelope, context) {
+      assertCredentialContext(context);
+      if (envelope.version !== 1 || envelope.algorithm !== "A256GCM") {
+        throw createConnectorCodedError("connector.credentials_unavailable", "Connector credential envelope format is not supported.");
+      }
+      try {
+        const nonce = decodeBase64Url(envelope.nonce);
+        const ciphertext = decodeBase64Url(envelope.ciphertext);
+        const tag = decodeBase64Url(envelope.tag);
+        if (nonce.byteLength !== 12 || tag.byteLength !== 16)
+          throw new Error("invalid envelope");
+        const decipher = createDecipheriv("aes-256-gcm", key, nonce);
+        decipher.setAAD(credentialAad(context));
+        decipher.setAuthTag(tag);
+        return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+      } catch (error) {
+        throw createConnectorCodedError("connector.credentials_unavailable", "Connector credential envelope authentication failed.", { cause: error });
+      }
+    }
+  };
+}
+function decodeBase64Url(value) {
+  if (!/^[A-Za-z0-9_-]*$/.test(value))
+    throw new Error("invalid base64url");
+  const decoded = Buffer.from(value, "base64url");
+  if (decoded.toString("base64url") !== value)
+    throw new Error("non-canonical base64url");
+  return decoded;
+}
+function createEphemeralConnectorCredentialProtector() {
+  return createAesGcmConnectorCredentialProtector(randomBytes(32));
+}
+function credentialAad(context) {
+  return Buffer.from(JSON.stringify({
+    version: 1,
+    projectId: context.projectId,
+    connectorId: context.connectorId,
+    recordId: context.recordId,
+    purpose: context.purpose
+  }));
+}
+function assertCredentialContext(context) {
+  assertNonblank(context.projectId, "context projectId");
+  assertNonblank(context.connectorId, "context connectorId");
+  assertNonblank(context.recordId, "context recordId");
+}
+function assertNonblank(value, field) {
+  if (!value.trim()) {
+    throw createConnectorCodedError("connector.configuration_invalid", `Connector credential ${field} must not be empty.`);
+  }
+  return value;
+}
+
+// src/connectors/connections/service.ts
+import { randomUUID as randomUUID5 } from "crypto";
+
+// src/connectors/connections/authorizations.ts
+import { randomUUID as randomUUID2 } from "crypto";
+
+// src/connectors/connections/validation.ts
+import { createHash } from "crypto";
+function validateCredentials(credentials) {
+  if (!isRecord2(credentials)) {
+    throw createConnectorCodedError("connector.adapter_invalid", "OAuth connector adapter returned invalid credentials.");
+  }
+  const normalized = {
+    accessToken: nonblank(credentials.accessToken, "provider access token", "connector.adapter_invalid")
+  };
+  if (credentials.refreshToken !== undefined) {
+    normalized.refreshToken = nonblank(credentials.refreshToken, "provider refresh token", "connector.adapter_invalid");
+  }
+  if (credentials.tokenType !== undefined) {
+    normalized.tokenType = nonblank(credentials.tokenType, "provider token type", "connector.adapter_invalid");
+  }
+  if (credentials.scopes !== undefined) {
+    if (!Array.isArray(credentials.scopes)) {
+      throw createConnectorCodedError("connector.adapter_invalid", "OAuth connector adapter returned invalid scopes.");
+    }
+    normalized.scopes = [
+      ...new Set(credentials.scopes.map((scope) => nonblank(scope, "provider scope", "connector.adapter_invalid")))
+    ];
+  }
+  if (credentials.expiresAt !== undefined) {
+    if (!(credentials.expiresAt instanceof Date) || Number.isNaN(credentials.expiresAt.getTime())) {
+      throw createConnectorCodedError("connector.adapter_invalid", "OAuth connector adapter returned an invalid token expiry.");
+    }
+    normalized.expiresAt = new Date(credentials.expiresAt);
+  }
+  return normalized;
+}
+function validateAccounts(accounts) {
+  if (!Array.isArray(accounts)) {
+    throw createConnectorCodedError("connector.adapter_invalid", "OAuth connector adapter returned an invalid account list.");
+  }
+  const ids = new Set;
+  return accounts.map((account) => {
+    if (!isRecord2(account)) {
+      throw createConnectorCodedError("connector.adapter_invalid", "OAuth connector adapter returned an invalid account.");
+    }
+    const id = nonblank(account.id, "external account id", "connector.adapter_invalid");
+    if (ids.has(id)) {
+      throw createConnectorCodedError("connector.adapter_invalid", `OAuth connector adapter returned duplicate account '${id}'.`);
+    }
+    ids.add(id);
+    const description = account.description === undefined ? undefined : nonblank(account.description, "external account description", "connector.adapter_invalid");
+    const avatarUrl = account.avatarUrl === undefined ? undefined : normalizedHttpUrl(nonblank(account.avatarUrl, "external account avatar URL", "connector.adapter_invalid"), "external account avatar URL", "connector.adapter_invalid");
+    return {
+      id,
+      label: nonblank(account.label, "external account label", "connector.adapter_invalid"),
+      ...description === undefined ? {} : { description },
+      ...avatarUrl === undefined ? {} : { avatarUrl }
+    };
+  });
+}
+function serializeCredentials(credentials) {
+  return JSON.stringify({
+    version: 1,
+    accessToken: credentials.accessToken,
+    ...credentials.refreshToken === undefined ? {} : { refreshToken: credentials.refreshToken },
+    ...credentials.tokenType === undefined ? {} : { tokenType: credentials.tokenType },
+    ...credentials.scopes === undefined ? {} : { scopes: credentials.scopes },
+    ...credentials.expiresAt === undefined ? {} : { expiresAt: credentials.expiresAt.toISOString() }
+  });
+}
+function parseCredentials(serialized) {
+  let value;
+  try {
+    value = JSON.parse(serialized);
+  } catch (error) {
+    throw createConnectorCodedError("connector.credentials_unavailable", "Stored connector credentials are invalid.", { cause: error });
+  }
+  if (!isRecord2(value) || value.version !== 1 || typeof value.accessToken !== "string") {
+    throw createConnectorCodedError("connector.credentials_unavailable", "Stored connector credentials are invalid.");
+  }
+  if (value.refreshToken !== undefined && typeof value.refreshToken !== "string" || value.tokenType !== undefined && typeof value.tokenType !== "string" || value.scopes !== undefined && (!Array.isArray(value.scopes) || value.scopes.some((scope) => typeof scope !== "string")) || value.expiresAt !== undefined && typeof value.expiresAt !== "string") {
+    throw createConnectorCodedError("connector.credentials_unavailable", "Stored connector credentials are invalid.");
+  }
+  const expiresAt = value.expiresAt === undefined ? undefined : new Date(value.expiresAt);
+  try {
+    return validateCredentials({
+      accessToken: value.accessToken,
+      ...value.refreshToken === undefined ? {} : { refreshToken: value.refreshToken },
+      ...value.tokenType === undefined ? {} : { tokenType: value.tokenType },
+      ...value.scopes === undefined ? {} : { scopes: value.scopes },
+      ...expiresAt === undefined ? {} : { expiresAt }
+    });
+  } catch (error) {
+    throw createConnectorCodedError("connector.credentials_unavailable", "Stored connector credentials are invalid.", { cause: error });
+  }
+}
+function shouldRefresh(authorization, now, skewMs) {
+  return authorization.credentialExpiresAt !== undefined && authorization.credentialExpiresAt.getTime() <= now.getTime() + skewMs;
+}
+function tokenView(credentials) {
+  return {
+    accessToken: credentials.accessToken,
+    ...credentials.tokenType === undefined ? {} : { tokenType: credentials.tokenType }
+  };
+}
+function parseAttemptId(state) {
+  const separator = state.indexOf(".");
+  if (separator <= 0 || separator === state.length - 1) {
+    throw createConnectorCodedError("connector.authorization_invalid", "OAuth state is invalid.");
+  }
+  return state.slice(0, separator);
+}
+function hashSecret(value) {
+  return createHash("sha256").update(value).digest("base64url");
+}
+function normalizedHttpUrl(value, field, code = "connector.configuration_invalid") {
+  let url;
+  try {
+    if (typeof value !== "string" && !(value instanceof URL))
+      throw new Error("invalid URL");
+    url = new URL(value);
+  } catch (error) {
+    throw createConnectorCodedError(code, `${field} must be an absolute URL.`, { cause: error });
+  }
+  if (url.username || url.password) {
+    throw createConnectorCodedError(code, `${field} must not contain credentials.`);
+  }
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && isLoopbackHost(url.hostname))) {
+    throw createConnectorCodedError(code, `${field} must use HTTPS, except on a loopback host.`);
+  }
+  return url.toString();
+}
+function assertAuthorizationUrlParameters(authorizationUrl, expected) {
+  const parameters = new URL(authorizationUrl).searchParams;
+  if (!sameSingleParameter(parameters, "state", expected.state) || !sameSingleParameter(parameters, "code_challenge", expected.codeChallenge) || !sameSingleParameter(parameters, "code_challenge_method", "S256")) {
+    throw createConnectorCodedError("connector.adapter_invalid", "OAuth connector authorization URL must preserve the framework-provided state and PKCE S256 parameters.");
+  }
+}
+function nonblank(value, field, code = "connector.configuration_invalid") {
+  if (typeof value !== "string" || !value.trim()) {
+    throw createConnectorCodedError(code, `${field} must be a non-empty string.`);
+  }
+  return value;
+}
+function positiveDuration(value, field) {
+  if (!Number.isFinite(value) || value <= 0) {
+    throw createConnectorCodedError("connector.configuration_invalid", `Connector ${field} must be a positive duration.`);
+  }
+  return value;
+}
+function nonNegativeDuration(value, field) {
+  if (!Number.isFinite(value) || value < 0) {
+    throw createConnectorCodedError("connector.configuration_invalid", `Connector ${field} must not be negative.`);
+  }
+  return value;
+}
+function delay(milliseconds) {
+  return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+function sameIds(left, right) {
+  const leftSorted = [...left].sort();
+  const rightSorted = [...right].sort();
+  return leftSorted.length === rightSorted.length && leftSorted.every((value, index) => value === rightSorted[index]);
+}
+function sameSingleParameter(parameters, name, expected) {
+  const values = parameters.getAll(name);
+  return values.length === 1 && values[0] === expected;
+}
+function isLoopbackHost(hostname) {
+  return hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null;
+}
+
+// src/connectors/connections/credential-codec.ts
+var textEncoder = new TextEncoder;
+var textDecoder = new TextDecoder;
+
+class ConnectorCredentialCodec {
+  options;
+  constructor(options) {
+    this.options = options;
+  }
+  seal(connectorId, authorizationId, credentials) {
+    return this.options.protector.seal(textEncoder.encode(serializeCredentials(credentials)), this.context(connectorId, authorizationId));
+  }
+  async open(connectorId, authorizationId, credentials) {
+    const plaintext = await this.options.protector.open(credentials, this.context(connectorId, authorizationId));
+    return parseCredentials(textDecoder.decode(plaintext));
+  }
+  context(connectorId, authorizationId) {
+    return {
+      projectId: this.options.projectId,
+      connectorId,
+      recordId: authorizationId,
+      purpose: "oauth-authorization"
+    };
+  }
+}
+
+// src/connectors/connections/credential-mutations.ts
+import { randomUUID } from "crypto";
+
+// src/connectors/connections/provider-operation.ts
+async function runBoundedConnectorProviderOperation(options, run, interruptionError = createAmbiguousProviderOperationError) {
+  const controller = new AbortController;
+  const abortFromHost = () => controller.abort(interruptionError());
+  if (options.hostSignal.aborted)
+    abortFromHost();
+  else
+    options.hostSignal.addEventListener("abort", abortFromHost, { once: true });
+  const timeout = setTimeout(() => controller.abort(interruptionError()), options.timeoutMs);
+  const aborted = new Promise((_resolve, reject) => {
+    const rejectAborted = () => reject(abortReason(controller.signal));
+    if (controller.signal.aborted)
+      rejectAborted();
+    else
+      controller.signal.addEventListener("abort", rejectAborted, { once: true });
+  });
+  const operation = Promise.resolve().then(() => {
+    if (controller.signal.aborted)
+      throw abortReason(controller.signal);
+    return run(controller.signal);
+  });
+  operation.catch(() => {});
+  try {
+    return await Promise.race([operation, aborted]);
+  } finally {
+    clearTimeout(timeout);
+    options.hostSignal.removeEventListener("abort", abortFromHost);
+  }
+}
+function abortReason(signal) {
+  return signal.reason instanceof Error ? signal.reason : createAmbiguousProviderOperationError();
+}
+
+// src/connectors/connections/storage-boundary.ts
+async function withConnectorStorageBoundary(message, operation) {
+  try {
+    return await operation();
+  } catch (error) {
+    throw storageBoundaryError(error, message);
+  }
+}
+
+// src/connectors/connections/credential-mutations.ts
+var MUTATION_POLL_MS = 25;
+var MUTATION_WAIT_MS = 5000;
+
+class ConnectorCredentialMutationCoordinator {
+  projectId;
+  storage;
+  leaseDurationMs;
+  operationTimeoutMs;
+  hostSignal;
+  discoverReauthorizationAccounts;
+  holderId;
+  localMutationTails = new Map;
+  constructor(options) {
+    this.projectId = options.projectId;
+    this.storage = options.storage;
+    this.leaseDurationMs = positiveDuration(options.leaseDurationMs, "credential mutation lease duration");
+    this.operationTimeoutMs = positiveDuration(options.operationTimeoutMs, "credential mutation timeout");
+    this.hostSignal = options.hostSignal;
+    this.discoverReauthorizationAccounts = options.discoverReauthorizationAccounts;
+    this.holderId = options.holderId ?? `connector-service-${randomUUID()}`;
+  }
+  async claimCredentialMutation(connectorId, initial, kind, expectedConnectionIds) {
+    const waitDeadline = Date.now() + MUTATION_WAIT_MS;
+    const initialRevision = initial.revision;
+    let authorization = initial;
+    while (true) {
+      const claimed = await withConnectorStorageBoundary("Connector credential mutation could not be claimed.", () => this.storage.claimCredentialMutation({
+        projectId: this.projectId,
+        connectorId,
+        authorizationId: authorization.id,
+        expectedRevision: authorization.revision,
+        mutation: { id: `ccm_${randomUUID()}`, kind, holderId: this.holderId },
+        ...expectedConnectionIds === undefined ? {} : { expectedConnectionIds },
+        leaseDurationMs: this.leaseDurationMs,
+        operationTimeoutMs: this.operationTimeoutMs
+      }));
+      if (claimed)
+        return { type: "claimed", claim: claimed };
+      await delay(MUTATION_POLL_MS);
+      authorization = await this.prepareAuthorizationForMutation(connectorId, authorization, kind);
+      if (kind === "reauthorization" && authorization.status === "revoked") {
+        throw createConnectorCodedError("connector.authorization_invalid", "Revoked connector credentials cannot be reauthorized.");
+      }
+      if (kind === "reauthorization" && authorization.status === "revocation_pending") {
+        throw createConnectorCodedError("connector.authorization_invalid", "Connector authorization revocation is pending.");
+      }
+      if (kind === "reauthorization" && authorization.revision !== initialRevision) {
+        throw staleReauthorizationError();
+      }
+      if (kind === "revocation" && authorization.status === "revoked") {
+        return { type: "superseded", authorization };
+      }
+      if (kind === "refresh" && authorization.revision !== initialRevision) {
+        if (authorization.status !== "active") {
+          throw connectorAuthorizationStatusError(authorization.status);
+        }
+        return { type: "superseded", authorization };
+      }
+      if (kind === "reauthorization" && expectedConnectionIds) {
+        await this.assertAttachedConnections(connectorId, authorization.id, expectedConnectionIds);
+      }
+      if (Date.now() >= waitDeadline) {
+        throw createConnectorCodedError("connector.operation_in_progress", "Connector credentials are being changed by another operation; retry shortly.");
+      }
+    }
+  }
+  async prepareAuthorizationForMutation(connectorId, initial, requestedKind) {
+    const authorization = await this.requireAuthorization(connectorId, initial.id);
+    const mutation = authorization.credentialMutation;
+    if (!mutation)
+      return authorization;
+    if (mutation.phase === "result_staged") {
+      if (requestedKind === "revocation" && mutation.kind !== "revocation") {
+        const marked = await this.markNeedsReauthorization(authorization);
+        return marked ?? this.requireAuthorization(connectorId, authorization.id);
+      }
+      return this.finalizeStagedMutation(authorization);
+    }
+    const recovered = await this.recoverExpiredCredentialMutation(connectorId, authorization.id);
+    return recovered ?? authorization;
+  }
+  async recoverExpiredCredentialMutation(connectorId, authorizationId) {
+    return withConnectorStorageBoundary("Expired connector credential mutation could not be recovered.", () => this.storage.recoverExpiredCredentialMutation({
+      projectId: this.projectId,
+      connectorId,
+      authorizationId
+    }));
+  }
+  async executeCredentialMutation(authorization, run) {
+    if (!authorization.credentialMutation) {
+      throw createConnectorCodedError("internal.unexpected", "Connector credential mutation was not claimed.");
+    }
+    const executing = await withConnectorStorageBoundary("Connector credential mutation could not be marked as executing.", () => this.storage.markCredentialMutationExecuting({
+      ...credentialMutationFence(authorization),
+      holderId: this.holderId
+    }));
+    if (!executing)
+      throw createAmbiguousProviderOperationError();
+    return this.withCredentialMutationSignal(executing, (signal) => run(executing, signal));
+  }
+  async stageCredentialMutationCredentials(executing, signal, input) {
+    assertCredentialMutationOperationActive(signal);
+    const staged = await withConnectorStorageBoundary("Connector credential mutation result could not be staged.", () => this.storage.stageCredentialMutationCredentials({
+      ...credentialMutationFence(executing),
+      holderId: this.holderId,
+      credentials: input.credentials,
+      ...input.credentialExpiresAt === undefined ? {} : { credentialExpiresAt: input.credentialExpiresAt },
+      scopes: input.scopes
+    }));
+    if (!staged)
+      throw createAmbiguousProviderOperationError();
+    return staged;
+  }
+  async stageCredentialMutationRevocation(executing, signal) {
+    assertCredentialMutationOperationActive(signal);
+    const staged = await withConnectorStorageBoundary("Connector revocation result could not be staged.", () => this.storage.stageCredentialMutationRevocation({
+      ...credentialMutationFence(executing),
+      holderId: this.holderId
+    }));
+    if (!staged)
+      throw createAmbiguousProviderOperationError();
+    return staged;
+  }
+  async withBoundedProviderSignal(run, interruptionError = createAmbiguousProviderOperationError) {
+    return runBoundedConnectorProviderOperation({ hostSignal: this.hostSignal(), timeoutMs: this.operationTimeoutMs }, run, interruptionError);
+  }
+  async finalizeStagedMutation(authorization) {
+    const mutation = authorization.credentialMutation;
+    if (!mutation || mutation.phase !== "result_staged")
+      return authorization;
+    const fence = credentialMutationFence(authorization);
+    let finalized;
+    if (mutation.kind === "refresh") {
+      finalized = await withConnectorStorageBoundary("Connector credential refresh could not be finalized.", () => this.storage.finalizeRefresh(fence));
+    } else if (mutation.kind === "revocation") {
+      finalized = await withConnectorStorageBoundary("Connector credential revocation could not be finalized.", () => this.storage.finalizeRevocation(fence));
+    } else {
+      const staged = mutation.stagedCredentials;
+      if (!staged) {
+        throw createConnectorCodedError("internal.unexpected", "Staged connector credentials are missing.");
+      }
+      let accounts;
+      try {
+        accounts = await this.discoverReauthorizationAccounts(authorization, staged);
+      } catch (error) {
+        throw providerBoundaryError(error, "connector.provider_failed", "Connector account discovery failed; reauthorization remains safely staged.");
+      }
+      try {
+        finalized = await this.storage.finalizeReauthorization({
+          ...fence,
+          accounts
+        });
+      } catch (error) {
+        if (isConnectorStorageError(error)) {
+          await recoverConnectorFailure(error, "Connector authorization could not be failed closed after incompatible account discovery.", () => this.markNeedsReauthorization(authorization));
+          throw createConnectorCodedError("connector.authorization_required", "Reauthorized connector accounts changed incompatibly; reauthorization is required.", { cause: error });
+        }
+        throw storageBoundaryError(error, "Connector credential reauthorization could not be finalized.");
+      }
+    }
+    if (finalized)
+      return finalized;
+    const latest = await this.requireAuthorization(authorization.connectorId, authorization.id);
+    if (latest.revision !== authorization.revision || !latest.credentialMutation)
+      return latest;
+    throw createConnectorCodedError("internal.unexpected", "Connector credential mutation could not be finalized safely.");
+  }
+  async markNeedsReauthorization(authorization) {
+    if (!authorization.credentialMutation)
+      return null;
+    return withConnectorStorageBoundary("Connector authorization could not be marked for reauthorization.", () => this.storage.markNeedsReauthorization(credentialMutationFence(authorization)));
+  }
+  async releaseCredentialMutation(authorization) {
+    if (!authorization.credentialMutation)
+      return false;
+    return withConnectorStorageBoundary("Connector credential mutation could not be released.", () => this.storage.releaseCredentialMutation({
+      ...credentialMutationFence(authorization),
+      holderId: this.holderId
+    }));
+  }
+  async requireStableActiveAuthorization(connectorId, authorizationId) {
+    const waitDeadline = Date.now() + MUTATION_WAIT_MS;
+    while (true) {
+      let authorization = await this.requireAuthorization(connectorId, authorizationId);
+      if (authorization.credentialMutation) {
+        authorization = await this.prepareAuthorizationForMutation(connectorId, authorization, "refresh");
+        if (authorization.credentialMutation) {
+          if (Date.now() >= waitDeadline) {
+            throw createConnectorCodedError("connector.operation_in_progress", "Connector credentials are being changed by another operation; retry shortly.");
+          }
+          await delay(MUTATION_POLL_MS);
+          continue;
+        }
+      }
+      if (authorization.status !== "active") {
+        throw connectorAuthorizationStatusError(authorization.status);
+      }
+      return authorization;
+    }
+  }
+  async assertAttachedConnections(connectorId, authorizationId, expectedConnectionIds) {
+    const attachedIds = (await withConnectorStorageBoundary("Connector authorization connections could not be read.", () => this.storage.listConnectionsByAuthorization({
+      projectId: this.projectId,
+      connectorId,
+      authorizationId
+    }))).map((connection) => connection.id);
+    if (!sameIds(attachedIds, expectedConnectionIds)) {
+      throw createConnectorCodedError("connector.operation_conflict", "Connections attached to this authorization changed; restart reauthorization.");
+    }
+  }
+  async runLocallySerialized(authorizationId, run) {
+    const previous = this.localMutationTails.get(authorizationId) ?? Promise.resolve();
+    const operation = previous.catch(() => {}).then(run);
+    const tail = operation.then(() => {
+      return;
+    }, () => {
+      return;
+    });
+    this.localMutationTails.set(authorizationId, tail);
+    try {
+      return await operation;
+    } finally {
+      if (this.localMutationTails.get(authorizationId) === tail) {
+        this.localMutationTails.delete(authorizationId);
+      }
+    }
+  }
+  isStagedMutation(authorization, claimed, kind) {
+    const claimedMutation = claimed.credentialMutation;
+    return claimedMutation !== undefined && authorization.credentialMutation?.id === claimedMutation.id && authorization.credentialMutation.kind === kind && authorization.credentialMutation.phase === "result_staged";
+  }
+  async withCredentialMutationSignal(authorization, run) {
+    const controller = new AbortController;
+    const hostSignal = this.hostSignal();
+    const abortFromHost = () => controller.abort(createAmbiguousProviderOperationError());
+    if (hostSignal.aborted)
+      abortFromHost();
+    else
+      hostSignal.addEventListener("abort", abortFromHost, { once: true });
+    const timeout = setTimeout(() => controller.abort(createAmbiguousProviderOperationError()), this.operationTimeoutMs);
+    const heartbeat = setInterval(() => {
+      this.storage.renewCredentialMutation({
+        ...credentialMutationFence(authorization),
+        holderId: this.holderId,
+        leaseDurationMs: this.leaseDurationMs
+      }).then((renewed) => {
+        if (!renewed)
+          controller.abort(createAmbiguousProviderOperationError());
+      }).catch((error) => controller.abort(createAmbiguousProviderOperationError({ cause: error })));
+    }, Math.max(5, Math.floor(this.leaseDurationMs / 3)));
+    const aborted = new Promise((_resolve, reject) => {
+      const rejectAborted = () => reject(abortReason2(controller.signal));
+      if (controller.signal.aborted)
+        rejectAborted();
+      else
+        controller.signal.addEventListener("abort", rejectAborted, { once: true });
+    });
+    const operation = Promise.resolve().then(() => {
+      assertCredentialMutationOperationActive(controller.signal);
+      return run(controller.signal);
+    });
+    operation.catch(() => {});
+    try {
+      return await Promise.race([operation, aborted]);
+    } finally {
+      clearInterval(heartbeat);
+      clearTimeout(timeout);
+      hostSignal.removeEventListener("abort", abortFromHost);
+    }
+  }
+  async requireAuthorization(connectorId, authorizationId) {
+    const authorization = await withConnectorStorageBoundary("Connector authorization could not be read.", () => this.storage.getAuthorization({
+      projectId: this.projectId,
+      connectorId,
+      authorizationId
+    }));
+    if (!authorization) {
+      throw createConnectorCodedError("connector.not_found", "Connector authorization was not found.");
+    }
+    return authorization;
+  }
+}
+function assertCredentialMutationOperationActive(signal) {
+  if (signal.aborted)
+    throw abortReason2(signal);
+}
+function connectorAuthorizationStatusError(status) {
+  if (status === "needs_reauthorization") {
+    return createConnectorCodedError("connector.authorization_required", "Connector credentials require reauthorization.");
+  }
+  if (status === "pending_selection") {
+    return createConnectorCodedError("connector.authorization_required", "Connector authorization requires account selection.");
+  }
+  if (status === "revocation_pending") {
+    return createConnectorCodedError("connector.authorization_required", "Connector authorization revocation is pending.");
+  }
+  return createConnectorCodedError("connector.authorization_required", "Connector authorization has been revoked.");
+}
+function credentialMutationFence(authorization) {
+  const mutation = authorization.credentialMutation;
+  if (!mutation) {
+    throw createConnectorCodedError("internal.unexpected", "Connector credential mutation is missing.");
+  }
+  return {
+    projectId: authorization.projectId,
+    connectorId: authorization.connectorId,
+    authorizationId: authorization.id,
+    expectedRevision: authorization.revision,
+    mutationId: mutation.id
+  };
+}
+function abortReason2(signal) {
+  return signal.reason instanceof Error ? signal.reason : createAmbiguousProviderOperationError();
+}
+function staleReauthorizationError() {
+  return createConnectorCodedError("connector.authorization_invalid", "Connector reauthorization attempt is stale; restart authorization.");
+}
+
+// src/connectors/connections/tokens.ts
+class ConnectorTokenAccess {
+  projectId;
+  storage;
+  credentials;
+  mutations;
+  refreshSkewMs;
+  now;
+  constructor(options) {
+    this.projectId = options.projectId;
+    this.storage = options.storage;
+    this.credentials = options.credentials;
+    this.mutations = options.mutations;
+    this.refreshSkewMs = nonNegativeDuration(options.refreshSkewMs, "refresh skew");
+    this.now = options.now;
+  }
+  requireStableActiveAuthorization(definition, authorizationId) {
+    return this.mutations.requireStableActiveAuthorization(definition.id, authorizationId);
+  }
+  createTokenSource(definition, authorizationId) {
+    return new RevisionAwareConnectorTokenSource((rejectedRevision) => this.getAccessToken(definition, authorizationId, rejectedRevision));
+  }
+  open(connectorId, authorization) {
+    if (!authorization.credentials) {
+      throw createConnectorCodedError("connector.credentials_unavailable", "Stored connector credentials are unavailable.");
+    }
+    return this.credentials.open(connectorId, authorization.id, authorization.credentials);
+  }
+  async getAccessToken(definition, authorizationId, rejectedRevision) {
+    let authorization = await this.mutations.requireStableActiveAuthorization(definition.id, authorizationId);
+    const credentials = await this.open(definition.id, authorization);
+    const refreshRejectedToken = rejectedRevision !== undefined && rejectedRevision === authorization.revision;
+    if (refreshRejectedToken || shouldRefresh(authorization, this.now(), this.refreshSkewMs)) {
+      authorization = await this.refreshAuthorization(definition, authorization);
+      const refreshed = await this.open(definition.id, authorization);
+      return { token: tokenView(refreshed), revision: authorization.revision };
+    }
+    return { token: tokenView(credentials), revision: authorization.revision };
+  }
+  async refreshAuthorization(definition, initial) {
+    return this.mutations.runLocallySerialized(initial.id, async () => {
+      let authorization = await this.mutations.requireStableActiveAuthorization(definition.id, initial.id);
+      if (authorization.revision !== initial.revision)
+        return authorization;
+      authorization = await this.mutations.prepareAuthorizationForMutation(definition.id, authorization, "refresh");
+      if (authorization.revision !== initial.revision)
+        return authorization;
+      const claimOutcome = await this.mutations.claimCredentialMutation(definition.id, authorization, "refresh");
+      if (claimOutcome.type === "superseded")
+        return claimOutcome.authorization;
+      const { claim } = claimOutcome;
+      let current;
+      try {
+        current = await this.open(definition.id, claim.authorization);
+      } catch (error) {
+        await recoverConnectorFailure(error, "Connector credential mutation could not be released after credential decryption failed.", () => this.mutations.releaseCredentialMutation(claim.authorization));
+        throw createConnectorCodedError("connector.credentials_unavailable", "Stored connector credentials could not be opened.", { cause: error });
+      }
+      if (!current.refreshToken) {
+        const error = createConnectorCodedError("connector.authorization_required", "Connector credentials require reauthorization.");
+        await recoverConnectorFailure(error, "Connector authorization could not be marked for reauthorization after finding no refresh token.", () => this.mutations.markNeedsReauthorization(claim.authorization));
+        throw error;
+      }
+      try {
+        await this.mutations.executeCredentialMutation(claim.authorization, async (executing, signal) => {
+          const refreshed = validateCredentials(await definition.adapter.authentication.refresh(this.adapterContext(definition.id, signal), current));
+          assertCredentialMutationOperationActive(signal);
+          const normalized = {
+            ...refreshed,
+            ...refreshed.refreshToken === undefined ? { refreshToken: current.refreshToken } : {},
+            ...refreshed.tokenType === undefined && current.tokenType !== undefined ? { tokenType: current.tokenType } : {},
+            scopes: refreshed.scopes ?? current.scopes ?? authorization.scopes
+          };
+          const envelope = await this.credentials.seal(definition.id, authorization.id, normalized);
+          return this.mutations.stageCredentialMutationCredentials(executing, signal, {
+            credentials: envelope,
+            ...normalized.expiresAt === undefined ? {} : { credentialExpiresAt: normalized.expiresAt },
+            scopes: normalized.scopes
+          });
+        });
+      } catch (error) {
+        const latest = await recoverConnectorFailure(error, "Connector refresh outcome could not be recovered from storage.", () => this.requireAuthorization(definition.id, authorization.id));
+        if (this.mutations.isStagedMutation(latest, claim.authorization, "refresh")) {
+          return recoverConnectorFailure(error, "Staged connector refresh could not be finalized during recovery.", () => this.mutations.finalizeStagedMutation(latest));
+        }
+        if (oauthErrorKind(error) === "retryable") {
+          await recoverConnectorFailure(error, "Connector refresh mutation could not be released after a retryable provider failure.", () => this.mutations.releaseCredentialMutation(claim.authorization));
+          throw createConnectorCodedError("connector.provider_unavailable", "Connector credential refresh failed; retry later.", { cause: error });
+        }
+        const marked = await recoverConnectorFailure(error, "Connector authorization could not be failed closed after an ambiguous refresh.", () => this.mutations.markNeedsReauthorization(claim.authorization));
+        if (marked) {
+          throw createConnectorCodedError("connector.authorization_required", "Connector credentials require reauthorization.", { cause: error });
+        }
+        const recovered = await recoverConnectorFailure(error, "Connector refresh state could not be reloaded after failed closed recovery.", () => this.requireAuthorization(definition.id, authorization.id));
+        if (recovered.revision !== authorization.revision && recovered.status === "active") {
+          return recovered;
+        }
+        throw connectorAuthorizationStatusError(recovered.status);
+      }
+      const staged = await this.requireAuthorization(definition.id, authorization.id);
+      return this.mutations.finalizeStagedMutation(staged);
+    });
+  }
+  async requireAuthorization(connectorId, authorizationId) {
+    const authorization = await withConnectorStorageBoundary("Connector authorization could not be read.", () => this.storage.getAuthorization({
+      projectId: this.projectId,
+      connectorId,
+      authorizationId
+    }));
+    if (!authorization) {
+      throw createConnectorCodedError("connector.not_found", "Connector authorization was not found.");
+    }
+    return authorization;
+  }
+  adapterContext(connectorId, signal) {
+    return { projectId: this.projectId, connectorId, signal };
+  }
+}
+
+class RevisionAwareConnectorTokenSource {
+  resolveToken;
+  rejectedRevision;
+  constructor(resolveToken) {
+    this.resolveToken = resolveToken;
+  }
+  async get() {
+    const consumedRejection = this.rejectedRevision;
+    const result = await this.resolveToken(consumedRejection);
+    if (this.rejectedRevision === consumedRejection)
+      this.rejectedRevision = undefined;
+    let invalidated = false;
+    return Object.freeze({
+      ...result.token,
+      invalidate: () => {
+        if (invalidated)
+          return;
+        invalidated = true;
+        this.rejectedRevision = Math.max(this.rejectedRevision ?? -1, result.revision);
+      }
+    });
+  }
+}
+
+// src/connectors/connections/authorizations.ts
+class DefaultConnectorAuthorizationLifecycle {
+  projectId;
+  storage;
+  resolveDefinition;
+  accountSelectionTtlMs;
+  mutations;
+  credentials;
+  tokens;
+  constructor(options) {
+    this.projectId = options.projectId;
+    this.storage = options.storage;
+    this.resolveDefinition = options.resolveDefinition;
+    this.accountSelectionTtlMs = positiveDuration(options.accountSelectionTtlMs, "account selection TTL");
+    this.credentials = new ConnectorCredentialCodec({
+      projectId: options.projectId,
+      protector: options.credentialProtector
+    });
+    this.mutations = new ConnectorCredentialMutationCoordinator({
+      projectId: options.projectId,
+      storage: options.storage,
+      leaseDurationMs: options.credentialMutationLeaseMs,
+      operationTimeoutMs: options.providerOperationTimeoutMs,
+      hostSignal: options.hostSignal,
+      discoverReauthorizationAccounts: async (authorization, staged) => {
+        const definition = this.definitionFor(authorization.connectorId);
+        const credentials = await this.credentials.open(definition.id, authorization.id, staged.credentials);
+        return this.discoverAccounts(definition, credentials);
+      }
+    });
+    this.tokens = new ConnectorTokenAccess({
+      projectId: options.projectId,
+      storage: options.storage,
+      credentials: this.credentials,
+      mutations: this.mutations,
+      refreshSkewMs: options.refreshSkewMs,
+      now: options.now
+    });
+  }
+  async prepareReauthorization(input) {
+    this.assertRegistered(input.definition);
+    const authorization = await this.requireAuthorization(input.definition.id, input.authorizationId);
+    if (authorization.status === "pending_selection") {
+      throw createConnectorCodedError("connector.authorization_invalid", "Pending connector credentials cannot be reauthorized; restart authorization or select an account.");
+    }
+    if (authorization.status === "revoked" || authorization.status === "revocation_pending") {
+      throw createConnectorCodedError("connector.authorization_invalid", "Revoked connector credentials cannot be reauthorized.");
+    }
+    assertConnectorAuthorizationActor(authorization, input.principal);
+    const connections = await withConnectorStorageBoundary("Connector authorization connections could not be read.", () => this.storage.listConnectionsByAuthorization({
+      projectId: this.projectId,
+      connectorId: input.definition.id,
+      authorizationId: authorization.id
+    }));
+    return { authorization, connections };
+  }
+  async completeNewAuthorization(input) {
+    this.assertRegistered(input.definition);
+    const authorizationId = `cau_${randomUUID2()}`;
+    const credentials = await this.exchangeAuthorizationCode(input.definition, input.code, input.codeVerifier, input.redirectUri);
+    const credentialsEnvelope = await this.credentials.seal(input.definition.id, authorizationId, credentials);
+    let pending;
+    try {
+      pending = await this.storage.createAuthorization({
+        id: authorizationId,
+        projectId: this.projectId,
+        connectorId: input.definition.id,
+        authorizedBy: input.principal,
+        credentials: credentialsEnvelope,
+        ...credentials.expiresAt === undefined ? {} : { credentialExpiresAt: credentials.expiresAt },
+        scopes: credentials.scopes ?? [],
+        accounts: [],
+        selectionTtlMs: this.accountSelectionTtlMs
+      });
+    } catch (error) {
+      throw storageBoundaryError(error, "Connector authorization could not be persisted.");
+    }
+    if (input.onAuthorizationPersisted) {
+      try {
+        await input.onAuthorizationPersisted(pending);
+      } catch (error) {
+        await this.revokeAbandonedAuthorization(input.definition, authorizationId, input.principal, error);
+        throw error;
+      }
+    }
+    let accounts;
+    try {
+      accounts = await this.discoverAccounts(input.definition, credentials);
+    } catch (error) {
+      const discoveryError = providerBoundaryError(error, "connector.provider_failed", "Connector account discovery failed; the unused authorization is being revoked.");
+      await this.revokeAbandonedAuthorization(input.definition, authorizationId, input.principal, discoveryError);
+      throw discoveryError;
+    }
+    const initialized = await withConnectorStorageBoundary("Connector authorization accounts could not be persisted.", () => this.storage.initializeAuthorizationAccounts({
+      projectId: this.projectId,
+      connectorId: input.definition.id,
+      authorizationId,
+      expectedRevision: pending.revision,
+      accounts
+    }));
+    if (!initialized) {
+      throw createConnectorCodedError("connector.operation_conflict", "Connector authorization changed while accounts were discovered.");
+    }
+    return initialized;
+  }
+  async completeReauthorization(input) {
+    this.assertRegistered(input.definition);
+    return this.mutations.runLocallySerialized(input.authorizationId, () => this.completeReauthorizationMutation(input));
+  }
+  async revokeAuthorization(input) {
+    this.assertRegistered(input.definition);
+    return this.mutations.runLocallySerialized(input.authorizationId, async () => {
+      const authorization = await this.requireAuthorization(input.definition.id, input.authorizationId);
+      assertConnectorAuthorizationActor(authorization, input.principal);
+      return this.revokeAuthorizationRecord(input.definition, authorization);
+    });
+  }
+  async continuePendingRevocation(definition, authorizationId) {
+    this.assertRegistered(definition);
+    return this.mutations.runLocallySerialized(authorizationId, async () => {
+      const authorization = await this.requireAuthorization(definition.id, authorizationId);
+      if (authorization.status !== "revocation_pending" && authorization.status !== "revoked") {
+        throw createConnectorCodedError("internal.unexpected", "Connector cleanup requires an authorization already pending revocation.");
+      }
+      return this.revokeAuthorizationRecord(definition, authorization);
+    });
+  }
+  async requireStableActiveAuthorization(definition, authorizationId) {
+    this.assertRegistered(definition);
+    return this.tokens.requireStableActiveAuthorization(definition, authorizationId);
+  }
+  createTokenSource(definition, authorizationId) {
+    this.assertRegistered(definition);
+    return this.tokens.createTokenSource(definition, authorizationId);
+  }
+  async requireAuthorization(connectorId, authorizationId) {
+    const authorization = await withConnectorStorageBoundary("Connector authorization could not be read.", () => this.storage.getAuthorization({
+      projectId: this.projectId,
+      connectorId,
+      authorizationId
+    }));
+    if (!authorization) {
+      throw createConnectorCodedError("connector.not_found", "Connector authorization was not found.");
+    }
+    return authorization;
+  }
+  async revokeAuthorizationRecord(definition, initial) {
+    if (initial.status === "revoked")
+      return { disconnected: [] };
+    const authorization = await this.mutations.prepareAuthorizationForMutation(definition.id, initial, "revocation");
+    if (authorization.status === "revoked")
+      return { disconnected: [] };
+    const claimOutcome = await this.mutations.claimCredentialMutation(definition.id, authorization, "revocation");
+    if (claimOutcome.type === "superseded")
+      return { disconnected: [] };
+    const { claim } = claimOutcome;
+    let credentials;
+    if (definition.adapter.authentication.revoke) {
+      try {
+        if (!claim.authorization.credentials) {
+          throw createConnectorCodedError("connector.credentials_unavailable", "Stored connector credentials are unavailable.");
+        }
+        credentials = await this.credentials.open(definition.id, claim.authorization.id, claim.authorization.credentials);
+      } catch (error) {
+        await recoverConnectorFailure(error, "Connector credential mutation could not be released after credential decryption failed.", () => this.mutations.releaseCredentialMutation(claim.authorization));
+        throw createConnectorCodedError("connector.credentials_unavailable", "Connector revocation is pending, but stored credentials could not be opened.", { cause: error });
+      }
+    }
+    try {
+      await this.mutations.executeCredentialMutation(claim.authorization, async (executing, signal) => {
+        if (definition.adapter.authentication.revoke && credentials) {
+          await definition.adapter.authentication.revoke(this.adapterContext(definition.id, signal), credentials);
+        }
+        return this.mutations.stageCredentialMutationRevocation(executing, signal);
+      });
+    } catch (error) {
+      const latest = await recoverConnectorFailure(error, "Connector revocation outcome could not be recovered from storage.", () => this.requireAuthorization(definition.id, authorization.id));
+      if (this.mutations.isStagedMutation(latest, claim.authorization, "revocation")) {
+        await recoverConnectorFailure(error, "Staged connector revocation could not be finalized during recovery.", () => this.mutations.finalizeStagedMutation(latest));
+        return { disconnected: claim.disconnected };
+      }
+      await recoverConnectorFailure(error, "Connector revocation mutation could not be released for retry.", () => this.mutations.releaseCredentialMutation(claim.authorization));
+      throw createConnectorCodedError("connector.revocation_pending", "Connector revocation is pending; provider revocation can be retried safely.", { cause: error });
+    }
+    const staged = await this.requireAuthorization(definition.id, authorization.id);
+    await this.mutations.finalizeStagedMutation(staged);
+    return { disconnected: claim.disconnected };
+  }
+  async revokeAbandonedAuthorization(definition, authorizationId, principal, primaryError) {
+    try {
+      await this.revokeAuthorization({ definition, authorizationId, principal });
+    } catch (cleanupError) {
+      if (isSixbError(cleanupError) && cleanupError.code === "connector.revocation_pending")
+        return;
+      throw createConnectorCodedError("internal.unexpected", "Unused connector credentials could not be scheduled for revocation.", {
+        cause: new AggregateError([primaryError, cleanupError], "Connector authorization failed and cleanup could not be secured.")
+      });
+    }
+  }
+  async completeReauthorizationMutation(input) {
+    let authorization = await this.requireAuthorization(input.definition.id, input.authorizationId);
+    assertReauthorizationRevision(authorization, input.expectedRevision);
+    if (authorization.status === "revoked" || authorization.status === "revocation_pending") {
+      throw createConnectorCodedError("connector.authorization_invalid", "Revoked connector credentials cannot be reauthorized.");
+    }
+    assertConnectorAuthorizationActor(authorization, input.principal);
+    await this.mutations.assertAttachedConnections(input.definition.id, authorization.id, input.expectedConnectionIds);
+    authorization = await this.mutations.prepareAuthorizationForMutation(input.definition.id, authorization, "reauthorization");
+    assertReauthorizationRevision(authorization, input.expectedRevision);
+    await this.mutations.assertAttachedConnections(input.definition.id, authorization.id, input.expectedConnectionIds);
+    const claimOutcome = await this.mutations.claimCredentialMutation(input.definition.id, authorization, "reauthorization", input.expectedConnectionIds);
+    if (claimOutcome.type === "superseded") {
+      throw createConnectorCodedError("internal.unexpected", "Connector reauthorization was superseded unexpectedly.");
+    }
+    const { claim } = claimOutcome;
+    try {
+      await this.mutations.executeCredentialMutation(claim.authorization, async (executing, signal) => {
+        const credentials = validateCredentials(await input.definition.adapter.authentication.exchangeCode(this.authorizationAdapterContext(input.definition.id, input.redirectUri, signal), { code: input.code, codeVerifier: input.codeVerifier }));
+        assertCredentialMutationOperationActive(signal);
+        const envelope = await this.credentials.seal(input.definition.id, input.authorizationId, credentials);
+        return this.mutations.stageCredentialMutationCredentials(executing, signal, {
+          credentials: envelope,
+          ...credentials.expiresAt === undefined ? {} : { credentialExpiresAt: credentials.expiresAt },
+          scopes: credentials.scopes ?? []
+        });
+      });
+    } catch (error) {
+      const latest = await recoverConnectorFailure(error, "Connector reauthorization outcome could not be recovered from storage.", () => this.requireAuthorization(input.definition.id, input.authorizationId));
+      if (this.mutations.isStagedMutation(latest, claim.authorization, "reauthorization")) {
+        return recoverConnectorFailure(error, "Staged connector reauthorization could not be finalized during recovery.", () => this.mutations.finalizeStagedMutation(latest));
+      }
+      if (oauthErrorKind(error) === "retryable" || oauthErrorKind(error) === "terminal") {
+        await recoverConnectorFailure(error, "Connector reauthorization mutation could not be released after provider failure.", () => this.mutations.releaseCredentialMutation(claim.authorization));
+        throw createConnectorCodedError("connector.provider_failed", "Connector authorization code exchange failed; restart authorization.", { cause: error });
+      }
+      await recoverConnectorFailure(error, "Connector authorization could not be failed closed after an ambiguous code exchange.", () => this.mutations.markNeedsReauthorization(claim.authorization));
+      throw createConnectorCodedError("connector.authorization_required", "Connector authorization code exchange had an ambiguous outcome; reauthorization is required.", { cause: error });
+    }
+    const staged = await this.requireAuthorization(input.definition.id, input.authorizationId);
+    return this.mutations.finalizeStagedMutation(staged);
+  }
+  async exchangeAuthorizationCode(definition, code, codeVerifier, redirectUri) {
+    try {
+      return validateCredentials(await this.mutations.withBoundedProviderSignal((signal) => definition.adapter.authentication.exchangeCode(this.authorizationAdapterContext(definition.id, redirectUri, signal), { code, codeVerifier })));
+    } catch (error) {
+      throw providerBoundaryError(error, "connector.provider_failed", "Connector authorization code exchange failed.");
+    }
+  }
+  async discoverAccounts(definition, credentials) {
+    return validateAccounts(await this.mutations.withBoundedProviderSignal((signal) => definition.adapter.discoverAccounts(this.adapterContext(definition.id, signal), credentials), () => createConnectorCodedError("connector.provider_failed", "Connector account discovery did not complete.")));
+  }
+  adapterContext(connectorId, signal) {
+    return { projectId: this.projectId, connectorId, signal };
+  }
+  authorizationAdapterContext(connectorId, redirectUri, signal) {
+    return { ...this.adapterContext(connectorId, signal), redirectUri };
+  }
+  definitionFor(connectorId) {
+    const definition = this.resolveDefinition(connectorId);
+    if (definition.id !== connectorId) {
+      throw createConnectorCodedError("internal.unexpected", "Connector definition resolver returned a mismatched definition.");
+    }
+    return definition;
+  }
+  assertRegistered(definition) {
+    if (this.definitionFor(definition.id) !== definition) {
+      throw createConnectorCodedError("connector.configuration_invalid", `Connector '${definition.id}' is not the registered definition instance.`);
+    }
+  }
+}
+function assertConnectorAuthorizationActor(authorization, principal) {
+  if (authorization.authorizedBy.type !== principal.type || authorization.authorizedBy.id !== principal.id) {
+    throw new AuthorizationError(`authorization:connector:${authorization.connectorId}`, "[Sixb] This connector authorization can only be changed by its authorizing principal.");
+  }
+}
+function assertReauthorizationRevision(authorization, expectedRevision) {
+  if (authorization.revision !== expectedRevision) {
+    throw createConnectorCodedError("connector.authorization_invalid", "Connector reauthorization attempt is stale; restart authorization.");
+  }
+}
+
+// src/connectors/connections/command-context.ts
+function requireConnectorConnectionCommandActor(execution, projectId) {
+  const actor = connectorConnectionActorFromExecution(execution, projectId);
+  if (actor)
+    return actor;
+  throw new AuthorizationError("manage:connector", "[Sixb] Connector connection commands require an authenticated request execution.");
+}
+function assertConnectorAuthorizationAttemptInitiator(execution, current) {
+  const initiating = execution ? connectorConnectionActorFromExecution(execution, execution.projectId) : null;
+  if (!initiating || !sameConnectorConnectionCommandActor(initiating, current)) {
+    throw new ConnectorConnectionStorageError("attempt_invalid", "[Sixb] Connector authorization attempt is invalid, expired, or already used.");
+  }
+}
+function assertConnectorConnectionRunInitiator(execution, current, connectorId) {
+  const initiating = execution ? connectorConnectionActorFromExecution(execution, execution.projectId) : null;
+  if (!initiating || !sameConnectorConnectionCommandActor(initiating, current)) {
+    throw new AuthorizationError(`connection-run:connector:${connectorId}`, "[Sixb] This connector connection run can only be accessed by its initiating actor.");
+  }
+}
+function connectorConnectionActorFromExecution(execution, projectId) {
+  const authorization = execution.authorizationRef;
+  if (execution.projectId !== projectId || execution.executor.type !== "request" || execution.source.type !== "http" || execution.executor.requestId !== execution.source.requestId || authorization.type !== "principal" || authorization.credential === undefined || execution.requestedBy?.type !== authorization.principal.type || execution.requestedBy.id !== authorization.principal.id) {
+    return null;
+  }
+  return {
+    principal: authorization.principal,
+    credential: authorization.credential
+  };
+}
+function sameConnectorConnectionCommandActor(left, right) {
+  return left.principal.type === right.principal.type && left.principal.id === right.principal.id && left.credential.type === right.credential.type && left.credential.id === right.credential.id;
+}
+
+// src/connectors/connections/request.ts
+import { createHash as createHash2, randomBytes as randomBytes2, randomUUID as randomUUID3 } from "crypto";
+
+// src/connectors/connections/views.ts
+function assertConnectorConnectionSelector(selector) {
+  if (selector.owner.type !== "project") {
+    throw createConnectorCodedError("connector.configuration_invalid", "Connector connections only support project ownership in V1.");
+  }
+  nonblank(selector.slot, "connection slot");
+}
+function connectorConnectionView(connection, status) {
+  return {
+    id: connection.id,
+    connectorId: connection.connectorId,
+    owner: connection.owner,
+    slot: connection.slot,
+    account: connection.account,
+    status: connection.status === "disconnected" || status === "revoked" || status === "revocation_pending" ? "disconnected" : status === "active" ? "connected" : "needs_reauthorization"
+  };
+}
+
+// src/connectors/connections/request.ts
+var textEncoder2 = new TextEncoder;
+var textDecoder2 = new TextDecoder;
+
+class ConnectorAuthorizationRequestHandler {
+  projectId;
+  storage;
+  credentialProtector;
+  authorizationAttemptTtlMs;
+  providerOperationTimeoutMs;
+  resolveDefinition;
+  lifecycle;
+  hostSignal;
+  constructor(options) {
+    this.projectId = options.projectId;
+    this.storage = options.storage;
+    this.credentialProtector = options.credentialProtector;
+    this.authorizationAttemptTtlMs = positiveDuration(options.authorizationAttemptTtlMs, "authorization attempt TTL");
+    this.providerOperationTimeoutMs = positiveDuration(options.providerOperationTimeoutMs, "provider operation timeout");
+    this.resolveDefinition = options.resolveDefinition;
+    this.lifecycle = options.lifecycle;
+    this.hostSignal = options.hostSignal;
+  }
+  async startAuthorization(command, connectorId, input) {
+    const prepared = await this.prepareAuthorizationRequest(command, connectorId, input);
+    try {
+      await this.storage.transaction(async (tx) => {
+        await ensureExecutionRecord(tx.executions, command.execution);
+        await requireConnectorConnectionStorage(tx).createAuthorizationAttempt(prepared.attempt);
+      }, { isolation: "serializable" });
+    } catch (error) {
+      throw storageBoundaryError(error, "Connector authorization attempt could not be persisted.");
+    }
+    return {
+      authorizationUrl: prepared.authorizationUrl,
+      affectedConnections: prepared.affectedConnections
+    };
+  }
+  async prepareAuthorizationRequest(command, connectorId, input) {
+    const definition = this.resolveDefinition(nonblank(connectorId, "connector id"));
+    const actor = requireConnectorConnectionCommandActor(command.execution, this.projectId);
+    assertConnectorConnectionSelector(input);
+    const redirectUri = normalizedHttpUrl(input.redirectUri, "OAuth callback URL");
+    const reauthorization = await this.prepareReauthorization(definition, actor, input.reauthorizationId);
+    const attemptId = `cat_${randomUUID3()}`;
+    const state = `${attemptId}.${randomBytes2(32).toString("base64url")}`;
+    const codeVerifier = randomBytes2(32).toString("base64url");
+    const codeChallenge = createHash2("sha256").update(codeVerifier).digest("base64url");
+    let authorizationUrlInput;
+    try {
+      authorizationUrlInput = await runBoundedConnectorProviderOperation({
+        hostSignal: this.hostSignal(),
+        timeoutMs: this.providerOperationTimeoutMs
+      }, (signal) => definition.adapter.authentication.authorizationUrl({
+        projectId: this.projectId,
+        connectorId: definition.id,
+        redirectUri,
+        signal
+      }, { state, codeChallenge, codeChallengeMethod: "S256" }), () => createConnectorCodedError("connector.provider_unavailable", "Connector authorization URL generation did not complete."));
+    } catch (error) {
+      throw providerBoundaryError(error, providerFailureCode(error), "Connector authorization could not be started.");
+    }
+    const authorizationUrl = normalizedHttpUrl(authorizationUrlInput, "provider authorization URL", "connector.adapter_invalid");
+    assertAuthorizationUrlParameters(authorizationUrl, { state, codeChallenge });
+    const codeVerifierEnvelope = await this.credentialProtector.seal(textEncoder2.encode(codeVerifier), {
+      projectId: this.projectId,
+      connectorId: definition.id,
+      recordId: attemptId,
+      purpose: "pkce-verifier"
+    });
+    return {
+      definition,
+      actor,
+      state,
+      authorizationUrl,
+      attempt: {
+        id: attemptId,
+        projectId: this.projectId,
+        connectorId: definition.id,
+        owner: input.owner,
+        slot: input.slot,
+        initiatedByExecutionId: command.execution.id,
+        stateHash: hashSecret(state),
+        codeVerifier: codeVerifierEnvelope,
+        redirectUri,
+        ...reauthorization === undefined ? {} : {
+          reauthorizationId: reauthorization.authorization.id,
+          reauthorizationRevision: reauthorization.authorization.revision,
+          reauthorizationConnectionIds: reauthorization.connectionIds
+        },
+        ttlMs: this.authorizationAttemptTtlMs
+      },
+      affectedConnections: reauthorization?.affectedConnections ?? []
+    };
+  }
+  async completeAuthorization(command, connectorId, input) {
+    const definition = this.resolveDefinition(nonblank(connectorId, "connector id"));
+    const actor = requireConnectorConnectionCommandActor(command.execution, this.projectId);
+    const state = nonblank(input.state, "OAuth state", "connector.authorization_invalid");
+    const code = nonblank(input.code, "OAuth authorization code", "connector.authorization_invalid");
+    const redirectUri = normalizedHttpUrl(input.redirectUri, "OAuth callback URL");
+    const attempt = await this.consumeAuthorizationAttempt(definition.id, actor, state, redirectUri);
+    const completed = await this.completeAuthorizationAttempt({
+      definition,
+      attempt,
+      principal: actor.principal,
+      code,
+      redirectUri
+    });
+    return {
+      authorizationId: completed.id,
+      owner: attempt.owner,
+      slot: attempt.slot,
+      accounts: completed.accounts
+    };
+  }
+  async completeAuthorizationAttempt(input) {
+    const verifierBytes = await this.credentialProtector.open(input.attempt.codeVerifier, {
+      projectId: this.projectId,
+      connectorId: input.definition.id,
+      recordId: input.attempt.id,
+      purpose: "pkce-verifier"
+    });
+    return this.completeGrant({
+      ...input,
+      codeVerifier: textDecoder2.decode(verifierBytes)
+    });
+  }
+  async prepareReauthorization(definition, actor, reauthorizationId) {
+    if (reauthorizationId === undefined)
+      return;
+    const prepared = await this.lifecycle.prepareReauthorization({
+      definition,
+      authorizationId: nonblank(reauthorizationId, "reauthorization id"),
+      principal: actor.principal
+    });
+    const connectionIds = prepared.connections.map((connection) => connection.id).sort();
+    return {
+      authorization: prepared.authorization,
+      connectionIds,
+      affectedConnections: prepared.connections.map((connection) => connectorConnectionView(connection, prepared.authorization.status))
+    };
+  }
+  async consumeAuthorizationAttempt(connectorId, actor, state, redirectUri) {
+    const attemptId = parseAttemptId(state);
+    let outcome;
+    try {
+      outcome = await this.storage.transaction(async (tx) => {
+        let attempt;
+        try {
+          attempt = await requireConnectorConnectionStorage(tx).consumeAuthorizationAttempt({
+            id: attemptId,
+            projectId: this.projectId,
+            connectorId,
+            stateHash: hashSecret(state),
+            redirectUri
+          });
+        } catch (error) {
+          if (isConnectorStorageError(error, "attempt_invalid")) {
+            return { type: "invalid", cause: error };
+          }
+          throw error;
+        }
+        const initiator = await tx.executions.getById({
+          projectId: this.projectId,
+          id: attempt.initiatedByExecutionId
+        });
+        assertConnectorAuthorizationAttemptInitiator(initiator, actor);
+        return { type: "consumed", attempt };
+      }, { isolation: "serializable" });
+    } catch (error) {
+      if (isConnectorStorageError(error, "attempt_invalid")) {
+        throw createConnectorCodedError("connector.authorization_invalid", "Connector authorization attempt is invalid, expired, or already used.", { cause: error });
+      }
+      throw storageBoundaryError(error, "Connector authorization attempt could not be consumed.");
+    }
+    if (outcome.type === "invalid") {
+      throw createConnectorCodedError("connector.authorization_invalid", "Connector authorization attempt is invalid, expired, or already used.", { cause: outcome.cause });
+    }
+    return outcome.attempt;
+  }
+  completeGrant(input) {
+    if (input.attempt.reauthorizationId === undefined) {
+      return this.lifecycle.completeNewAuthorization({
+        definition: input.definition,
+        principal: input.principal,
+        code: input.code,
+        codeVerifier: input.codeVerifier,
+        redirectUri: input.redirectUri,
+        ...input.onAuthorizationPersisted === undefined ? {} : { onAuthorizationPersisted: input.onAuthorizationPersisted }
+      });
+    }
+    const expectedRevision = input.attempt.reauthorizationRevision;
+    if (expectedRevision === undefined) {
+      throw createConnectorCodedError("internal.unexpected", "Connector reauthorization attempt is missing its revision.");
+    }
+    return this.lifecycle.completeReauthorization({
+      definition: input.definition,
+      authorizationId: input.attempt.reauthorizationId,
+      expectedRevision,
+      expectedConnectionIds: input.attempt.reauthorizationConnectionIds ?? [],
+      principal: input.principal,
+      code: input.code,
+      codeVerifier: input.codeVerifier,
+      redirectUri: input.redirectUri
+    });
+  }
+}
+function requireConnectorConnectionStorage(storage) {
+  if (storage.connectorConnections)
+    return storage.connectorConnections;
+  throw createConnectorCodedError("internal.unexpected", "Connector connection storage is unavailable inside the storage transaction.");
+}
+
+// src/connectors/connections/runs.ts
+import { randomBytes as randomBytes3, randomUUID as randomUUID4 } from "crypto";
+var CLEANUP_RETRY_DELAY_MS = 30000;
+var MAX_TIMER_DELAY_MS = 2147483647;
+
+class ConnectorConnectionRunService {
+  projectId;
+  storage;
+  connectionStorage;
+  requests;
+  authorizations;
+  resolveDefinition;
+  processingTtlMs;
+  selectionTtlMs;
+  now;
+  maintenanceTimers = new Map;
+  constructor(options) {
+    this.projectId = options.projectId;
+    this.storage = options.storage;
+    this.connectionStorage = requireConnectorConnectionStorage2(options.storage);
+    this.requests = options.requestHandler;
+    this.authorizations = options.authorizations;
+    this.resolveDefinition = options.resolveDefinition;
+    this.processingTtlMs = positiveDuration(options.processingTtlMs, "connection run processing TTL");
+    this.selectionTtlMs = positiveDuration(options.selectionTtlMs, "account selection TTL");
+    this.now = options.now;
+  }
+  async startSelection(command, connectorId, input) {
+    const runId = `ccr_${randomUUID4()}`;
+    let run;
+    try {
+      run = await this.storage.transaction(async (tx) => {
+        await ensureExecutionRecord(tx.executions, command.execution);
+        return requireConnectorConnectionStorage2(tx).createConnectionSelectionRun({
+          id: runId,
+          projectId: this.projectId,
+          connectorId,
+          owner: input.owner,
+          slot: input.slot,
+          initiatedByExecutionId: command.execution.id,
+          authorizationId: input.authorizationId,
+          ttlMs: this.selectionTtlMs
+        });
+      }, { isolation: "serializable" });
+    } catch (error) {
+      throw storageBoundaryError(error, "Connector account-selection run could not be persisted.");
+    }
+    this.scheduleRunMaintenance(run, this.selectionTtlMs + 1);
+    return this.view(run);
+  }
+  async start(command, connectorId, input) {
+    const returnTo = normalizedHttpUrl(input.returnTo, "connector return URL");
+    const prepared = await this.requests.prepareAuthorizationRequest(command, connectorId, input);
+    const runId = `ccr_${randomUUID4()}`;
+    const callbackBinding = randomBytes3(32).toString("base64url");
+    let expiresAt;
+    try {
+      expiresAt = await this.storage.transaction(async (tx) => {
+        await ensureExecutionRecord(tx.executions, command.execution);
+        const connections = requireConnectorConnectionStorage2(tx);
+        await connections.createConnectionRun({
+          id: runId,
+          projectId: this.projectId,
+          connectorId: prepared.definition.id,
+          kind: prepared.attempt.reauthorizationId === undefined ? "connect" : "reauthorize",
+          owner: prepared.attempt.owner,
+          slot: prepared.attempt.slot,
+          initiatedByExecutionId: command.execution.id,
+          ttlMs: prepared.attempt.ttlMs
+        });
+        const attempt = await connections.createAuthorizationAttempt({
+          ...prepared.attempt,
+          connectionRunId: runId,
+          returnTo,
+          callbackBindingHash: hashSecret(callbackBinding)
+        });
+        return attempt.expiresAt;
+      }, { isolation: "serializable" });
+    } catch (error) {
+      throw storageBoundaryError(error, "Connector connection run could not be persisted.");
+    }
+    return {
+      runId,
+      authorizationUrl: prepared.authorizationUrl,
+      affectedConnections: prepared.affectedConnections,
+      callbackBinding: {
+        attemptId: prepared.attempt.id,
+        secret: callbackBinding,
+        expiresAt
+      }
+    };
+  }
+  async complete(input) {
+    const state = nonblank(input.state, "OAuth state", "connector.authorization_invalid");
+    const redirectUri = normalizedHttpUrl(input.redirectUri, "OAuth callback URL");
+    const callbackBinding = nonblank(input.callbackBinding, "OAuth callback binding", "connector.authorization_invalid");
+    const claimed = await this.claimCallback(state, callbackBinding, redirectUri);
+    if (claimed.type === "expired") {
+      return {
+        runId: claimed.run.id,
+        connectorId: claimed.run.connectorId,
+        returnTo: claimed.returnTo
+      };
+    }
+    const { run, attempt, principal, returnTo } = claimed;
+    this.scheduleRunMaintenance(run, this.processingTtlMs + 1);
+    if ("error" in input) {
+      const finished = input.error === "access_denied" ? await this.cancelRun(run) : await this.failRun(run, providerCallbackError(input.error));
+      return { runId: finished.id, connectorId: finished.connectorId, returnTo };
+    }
+    let authorizationId = run.authorizationId;
+    try {
+      const definition = this.resolveDefinition(attempt.connectorId);
+      const authorization = await this.requests.completeAuthorizationAttempt({
+        definition,
+        attempt,
+        principal,
+        code: nonblank(input.code, "OAuth authorization code", "connector.authorization_invalid"),
+        redirectUri,
+        onAuthorizationPersisted: async (persisted) => {
+          authorizationId = persisted.id;
+          const attached = await withConnectorStorageBoundary("Connector authorization could not be attached to its run.", () => this.connectionStorage.attachConnectionRunAuthorization({
+            projectId: this.projectId,
+            connectorId: run.connectorId,
+            runId: run.id,
+            processingId: run.processingId,
+            authorizationId: persisted.id
+          }));
+          if (!attached) {
+            throw createConnectorCodedError("internal.unexpected", "Connector authorization arrived after its run stopped accepting results.");
+          }
+        }
+      });
+      const finished = await this.finalizeCompletedRun(run, authorization);
+      return { runId: finished.id, connectorId: finished.connectorId, returnTo };
+    } catch (error) {
+      const failed = await this.failRun(run, error, authorizationId);
+      return { runId: failed.id, connectorId: failed.connectorId, returnTo };
+    }
+  }
+  async get(command, connectorId, runId) {
+    const id = nonblank(runId, "connection run id");
+    const run = await this.readRun(connectorId, id);
+    if (!run)
+      return null;
+    await this.assertRunActor(command, run);
+    if (run.status === "waiting" || run.status === "running") {
+      if (!this.maintenanceTimers.has(run.id))
+        this.scheduleRunMaintenance(run);
+    } else if (!await this.continueRunCleanup(run)) {
+      this.scheduleRunMaintenance(run, CLEANUP_RETRY_DELAY_MS);
+    } else {
+      this.cancelRunMaintenance(run.id);
+    }
+    return this.view(run);
+  }
+  async selectAccount(command, connectorId, input) {
+    const definition = this.resolveDefinition(connectorId);
+    const runId = nonblank(input.runId, "connection run id");
+    const run = await this.readRun(definition.id, runId);
+    if (!run) {
+      throw createConnectorCodedError("connector.not_found", "Connector connection run not found.");
+    }
+    const actor = await this.assertRunActor(command, run);
+    if (run.status !== "waiting" || run.waitingFor !== "account_selection") {
+      throw createConnectorCodedError("connector.operation_conflict", "Connector connection run is not waiting for account selection.");
+    }
+    const authorization = await this.authorizations.requireAuthorization(definition.id, run.authorizationId);
+    assertConnectorAuthorizationActor(authorization, actor.principal);
+    const account = authorization.accounts.find((candidate) => candidate.id === input.accountId);
+    if (!account) {
+      throw createConnectorCodedError("connector.not_found", `Account '${input.accountId}' is not exposed by this connector connection run.`);
+    }
+    let selected;
+    try {
+      selected = await this.connectionStorage.putConnectionFromRun({
+        id: `ccn_${randomUUID4()}`,
+        projectId: this.projectId,
+        connectorId: definition.id,
+        runId: run.id,
+        account,
+        replace: input.replace === true
+      });
+    } catch (error) {
+      if (isConnectorStorageError(error, "run_invalid")) {
+        const latest = await this.readRun(definition.id, run.id);
+        if (latest)
+          await this.continueRunCleanup(latest);
+        throw createConnectorCodedError("connector.operation_conflict", "Connector connection run is no longer waiting for account selection.", { cause: error });
+      }
+      if (isConnectorStorageError(error, "authorization_conflict")) {
+        throw createConnectorCodedError("connector.operation_conflict", "Connector authorization cannot be selected in its current state.", { cause: error });
+      }
+      if (isConnectorStorageError(error, "connection_conflict")) {
+        throw createConnectorCodedError("connector.replacement_required", "Connector slot is already occupied; explicit replacement is required.", { cause: error });
+      }
+      throw storageBoundaryError(error, "Connector account selection could not be persisted.");
+    }
+    const cleanupCompleted = selected.revocationPendingAuthorizationId ? await this.continuePendingRevocation(definition.id, selected.revocationPendingAuthorizationId) : true;
+    if (cleanupCompleted) {
+      this.cancelRunMaintenance(run.id);
+    } else {
+      this.scheduleRunMaintenance(selected.run, CLEANUP_RETRY_DELAY_MS);
+    }
+    return this.view(selected.run);
+  }
+  async claimCallback(state, callbackBinding, redirectUri) {
+    let claimed;
+    try {
+      claimed = await this.storage.transaction(async (tx) => {
+        const result = await requireConnectorConnectionStorage2(tx).claimConnectionRunCallback({
+          projectId: this.projectId,
+          attemptId: parseAttemptId(state),
+          stateHash: hashSecret(state),
+          callbackBindingHash: hashSecret(callbackBinding),
+          redirectUri,
+          processingId: `ccp_${randomUUID4()}`,
+          processingTtlMs: this.processingTtlMs
+        });
+        if (!result || result.type === "expired")
+          return result;
+        const execution = await tx.executions.getById({
+          projectId: this.projectId,
+          id: result.attempt.initiatedByExecutionId
+        });
+        if (!execution) {
+          throw createConnectorCodedError("internal.unexpected", "Connector connection run initiating execution is unavailable.");
+        }
+        const actor = requireConnectorConnectionCommandActor(execution, this.projectId);
+        return { ...result, principal: actor.principal };
+      }, { isolation: "serializable" });
+    } catch (error) {
+      throw storageBoundaryError(error, "Connector connection run callback could not be claimed.");
+    }
+    if (!claimed) {
+      throw createConnectorCodedError("connector.authorization_invalid", "Connector connection run is invalid, expired, or already used.");
+    }
+    return claimed;
+  }
+  async finalizeCompletedRun(run, authorization) {
+    if (run.kind === "connect") {
+      if (!authorization.selectionExpiresAt) {
+        throw createConnectorCodedError("internal.unexpected", "Connector authorization is missing its account-selection deadline.");
+      }
+      const selectionExpiresAt = authorization.selectionExpiresAt;
+      const waiting = await withConnectorStorageBoundary("Connector connection run could not wait for account selection.", () => this.connectionStorage.waitForConnectionRunSelection({
+        projectId: this.projectId,
+        connectorId: run.connectorId,
+        runId: run.id,
+        processingId: run.processingId,
+        authorizationId: authorization.id,
+        expiresAt: selectionExpiresAt
+      }));
+      if (waiting) {
+        this.scheduleRunMaintenance(waiting, this.selectionTtlMs + 1);
+        return waiting;
+      }
+    } else {
+      const connections = await withConnectorStorageBoundary("Reauthorized connector connections could not be read.", () => this.connectionStorage.listConnectionsByAuthorization({
+        projectId: this.projectId,
+        connectorId: run.connectorId,
+        authorizationId: authorization.id
+      }));
+      const succeeded = await withConnectorStorageBoundary("Connector reauthorization run could not be finalized.", () => this.connectionStorage.finishConnectionRun({
+        projectId: this.projectId,
+        connectorId: run.connectorId,
+        runId: run.id,
+        processingId: run.processingId,
+        status: "succeeded",
+        authorizationId: authorization.id,
+        connections
+      }));
+      if (succeeded) {
+        this.cancelRunMaintenance(run.id);
+        return succeeded;
+      }
+    }
+    throw createConnectorCodedError("internal.unexpected", "Connector connection run could not be finalized.");
+  }
+  async failRun(run, error, authorizationId = run.authorizationId) {
+    const failed = await withConnectorStorageBoundary("Connector connection run failure could not be persisted.", () => this.connectionStorage.finishConnectionRun({
+      projectId: this.projectId,
+      connectorId: run.connectorId,
+      runId: run.id,
+      processingId: run.processingId,
+      status: "failed",
+      ...authorizationId === undefined ? {} : { authorizationId },
+      error: captureSixbFailure(error, {
+        allowedCodes: CONNECTOR_CONNECTION_RUN_FAILURE_CODES,
+        defaultCode: "internal.unexpected",
+        at: this.now()
+      })
+    }));
+    if (failed) {
+      this.cancelRunMaintenance(run.id);
+      if (!await this.continueRunCleanup(failed)) {
+        this.scheduleRunMaintenance(failed, CLEANUP_RETRY_DELAY_MS);
+      }
+      return failed;
+    }
+    throw createConnectorCodedError("internal.unexpected", "Connector connection run failure could not be persisted.", { cause: error });
+  }
+  async cancelRun(run) {
+    const cancelled = await withConnectorStorageBoundary("Connector connection run cancellation could not be persisted.", () => this.connectionStorage.finishConnectionRun({
+      projectId: this.projectId,
+      connectorId: run.connectorId,
+      runId: run.id,
+      processingId: run.processingId,
+      status: "cancelled"
+    }));
+    if (cancelled) {
+      this.cancelRunMaintenance(run.id);
+      return cancelled;
+    }
+    throw createConnectorCodedError("internal.unexpected", "Connector connection run cancellation could not be persisted.");
+  }
+  async readRun(connectorId, runId) {
+    try {
+      return await this.connectionStorage.getConnectionRun({
+        projectId: this.projectId,
+        connectorId,
+        runId
+      });
+    } catch (error) {
+      throw storageBoundaryError(error, "Connector connection run could not be read.");
+    }
+  }
+  async assertRunActor(command, run) {
+    const actor = requireConnectorConnectionCommandActor(command.execution, this.projectId);
+    const initiating = await withConnectorStorageBoundary("Connector connection run initiating execution could not be read.", () => this.storage.executions.getById({
+      projectId: this.projectId,
+      id: run.initiatedByExecutionId
+    }));
+    assertConnectorConnectionRunInitiator(initiating, actor, run.connectorId);
+    return actor;
+  }
+  async view(run) {
+    const base = {
+      id: run.id,
+      connectorId: run.connectorId,
+      kind: run.kind,
+      owner: run.owner,
+      slot: run.slot,
+      createdAt: run.createdAt,
+      updatedAt: run.updatedAt
+    };
+    if (run.status === "running")
+      return { ...base, status: "running" };
+    if (run.status === "waiting" && run.waitingFor === "provider_authorization") {
+      return {
+        ...base,
+        status: "waiting",
+        waitingFor: "provider_authorization",
+        expiresAt: run.expiresAt
+      };
+    }
+    if (run.status === "waiting") {
+      const authorization = await this.authorizations.requireAuthorization(run.connectorId, run.authorizationId);
+      return {
+        ...base,
+        status: "waiting",
+        waitingFor: "account_selection",
+        accounts: authorization.accounts,
+        expiresAt: run.expiresAt
+      };
+    }
+    if (run.status === "succeeded") {
+      return {
+        ...base,
+        status: "succeeded",
+        connections: run.connections.map((connection) => connectorConnectionView(connection, "active")),
+        finishedAt: run.finishedAt
+      };
+    }
+    if (run.status === "failed") {
+      return { ...base, status: "failed", error: run.error, finishedAt: run.finishedAt };
+    }
+    return { ...base, status: run.status, finishedAt: run.finishedAt };
+  }
+  close() {
+    for (const timer of this.maintenanceTimers.values())
+      clearTimeout(timer);
+    this.maintenanceTimers.clear();
+  }
+  async continueRunCleanup(run) {
+    if (run.kind !== "connect")
+      return true;
+    const authorizationId = run.status === "succeeded" ? run.cleanupAuthorizationId : run.status === "failed" || run.status === "expired" || run.status === "cancelled" ? run.authorizationId : undefined;
+    if (authorizationId === undefined)
+      return true;
+    const authorization = await this.authorizations.requireAuthorization(run.connectorId, authorizationId);
+    if (authorization.status !== "revocation_pending")
+      return true;
+    return this.continuePendingRevocation(run.connectorId, authorization.id);
+  }
+  async continuePendingRevocation(connectorId, authorizationId) {
+    try {
+      await this.authorizations.continuePendingRevocation(this.resolveDefinition(connectorId), authorizationId);
+      return true;
+    } catch (error) {
+      if (isSixbError(error) && error.code === "connector.revocation_pending")
+        return false;
+      throw error;
+    }
+  }
+  scheduleRunMaintenance(run, delayMs = run.status === "waiting" || run.status === "running" ? Math.max(1000, run.expiresAt.getTime() - this.now().getTime()) : CLEANUP_RETRY_DELAY_MS) {
+    this.cancelRunMaintenance(run.id);
+    const timer = setTimeout(() => void this.maintainRun(run.connectorId, run.id), Math.min(delayMs, MAX_TIMER_DELAY_MS));
+    timer.unref?.();
+    this.maintenanceTimers.set(run.id, timer);
+  }
+  cancelRunMaintenance(runId) {
+    const timer = this.maintenanceTimers.get(runId);
+    if (timer)
+      clearTimeout(timer);
+    this.maintenanceTimers.delete(runId);
+  }
+  async maintainRun(connectorId, runId) {
+    this.maintenanceTimers.delete(runId);
+    try {
+      const run = await this.readRun(connectorId, runId);
+      if (!run)
+        return;
+      if (run.status === "waiting" || run.status === "running") {
+        this.scheduleRunMaintenance(run);
+        return;
+      }
+      if (!await this.continueRunCleanup(run)) {
+        this.scheduleRunMaintenance(run, CLEANUP_RETRY_DELAY_MS);
+      }
+    } catch {
+      console.warn("[Sixb] Connector connection run cleanup failed and will be retried.");
+      const timer = setTimeout(() => void this.maintainRun(connectorId, runId), CLEANUP_RETRY_DELAY_MS);
+      timer.unref?.();
+      this.maintenanceTimers.set(runId, timer);
+    }
+  }
+}
+function requireConnectorConnectionStorage2(storage) {
+  if (storage.connectorConnections)
+    return storage.connectorConnections;
+  throw createConnectorCodedError("internal.unexpected", "Connector connection storage is unavailable.");
+}
+function providerCallbackError(error) {
+  const code = error === "server_error" || error === "temporarily_unavailable" ? "connector.provider_unavailable" : "connector.provider_failed";
+  return createConnectorCodedError(code, "Connector provider could not complete the authorization request.");
+}
+
+// src/connectors/connections/service.ts
+var DEFAULT_ATTEMPT_TTL_MS = 10 * 60000;
+var DEFAULT_SELECTION_TTL_MS = 15 * 60000;
+var DEFAULT_CREDENTIAL_MUTATION_LEASE_MS = 30000;
+var DEFAULT_PROVIDER_OPERATION_TIMEOUT_MS = 2 * 60000;
+var DEFAULT_REFRESH_SKEW_MS = 60000;
+
+class ConnectorConnectionService {
+  projectId;
+  definitionsById;
+  abortController = new AbortController;
+  connectionStorage;
+  providerOperationTimeoutMs;
+  authorizations;
+  requests;
+  runs;
+  callbackProcess;
+  constructor(projectId, definitions, options = {}) {
+    this.projectId = projectId;
+    this.definitionsById = new Map(definitions.map((definition) => [definition.id, definition]));
+    const storage = requireConnectionStorage(options.storage);
+    this.connectionStorage = storage.connectorConnections;
+    const credentialProtector = credentialProtectorFor(storage.connectorConnections, options);
+    const resolveDefinition = (connectorId) => this.requireOAuthDefinition(connectorId);
+    const hostSignal = () => this.abortController.signal;
+    const now = options.now ?? (() => new Date);
+    const accountSelectionTtlMs = options.accountSelectionTtlMs ?? DEFAULT_SELECTION_TTL_MS;
+    const providerOperationTimeoutMs = positiveDuration(options.providerOperationTimeoutMs ?? DEFAULT_PROVIDER_OPERATION_TIMEOUT_MS, "provider operation timeout");
+    this.providerOperationTimeoutMs = providerOperationTimeoutMs;
+    this.authorizations = new DefaultConnectorAuthorizationLifecycle({
+      projectId,
+      storage: storage.connectorConnections,
+      credentialProtector,
+      resolveDefinition,
+      hostSignal,
+      accountSelectionTtlMs,
+      credentialMutationLeaseMs: options.credentialMutationLeaseMs ?? DEFAULT_CREDENTIAL_MUTATION_LEASE_MS,
+      providerOperationTimeoutMs,
+      refreshSkewMs: options.refreshSkewMs ?? DEFAULT_REFRESH_SKEW_MS,
+      now
+    });
+    this.requests = new ConnectorAuthorizationRequestHandler({
+      projectId,
+      storage: storage.root,
+      credentialProtector,
+      authorizationAttemptTtlMs: options.authorizationAttemptTtlMs ?? DEFAULT_ATTEMPT_TTL_MS,
+      providerOperationTimeoutMs,
+      resolveDefinition,
+      lifecycle: this.authorizations,
+      hostSignal
+    });
+    this.runs = new ConnectorConnectionRunService({
+      projectId,
+      storage: storage.root,
+      requestHandler: this.requests,
+      authorizations: this.authorizations,
+      resolveDefinition,
+      processingTtlMs: options.connectionRunProcessingTtlMs ?? providerOperationTimeoutMs * 2 + 30000,
+      selectionTtlMs: accountSelectionTtlMs,
+      now
+    });
+    this.callbackProcess = Object.freeze({
+      completeConnectionRun: (input) => this.completeConnectionRun(input)
+    });
+  }
+  async connectConnection(definition, selector) {
+    this.assertOAuthRegistered(definition);
+    assertConnectorConnectionSelector(selector);
+    const connection = await withConnectorStorageBoundary("Connector connection could not be read.", () => this.connectionStorage.getConnection({
+      projectId: this.projectId,
+      connectorId: definition.id,
+      ...selector
+    }));
+    if (!connection) {
+      throw createConnectorCodedError("connector.not_found", `Connector '${definition.id}' has no connection for project slot '${selector.slot}'.`);
+    }
+    return this.connectExecutionConnection(definition, connection);
+  }
+  async listExecutionConnections(definition) {
+    this.assertOAuthRegistered(definition);
+    const connections = await withConnectorStorageBoundary("Connector connections could not be listed.", () => this.connectionStorage.listConnections({
+      projectId: this.projectId,
+      connectorId: definition.id
+    }));
+    return connections.filter((connection) => connection.status === "connected").sort((left, right) => left.id.localeCompare(right.id));
+  }
+  async connectExecutionConnection(definition, connection, signal = this.abortController.signal) {
+    this.assertOAuthRegistered(definition);
+    if (connection.projectId !== this.projectId || connection.connectorId !== definition.id || connection.status !== "connected") {
+      throw createConnectorCodedError("connector.not_found", `Connector '${definition.id}' connection '${connection.id}' is not active in this project.`);
+    }
+    const authorization = await this.authorizations.requireStableActiveAuthorization(definition, connection.authorizationId);
+    const hostSignal = this.abortController.signal;
+    const operationSignal = signal === hostSignal ? hostSignal : AbortSignal.any([hostSignal, signal]);
+    try {
+      return await runBoundedConnectorProviderOperation({
+        hostSignal: operationSignal,
+        timeoutMs: this.providerOperationTimeoutMs
+      }, (providerSignal) => {
+        const clientSignal = AbortSignal.any([operationSignal, providerSignal]);
+        return definition.adapter.connect({
+          projectId: this.projectId,
+          connectorId: definition.id,
+          connectionId: connection.id,
+          account: connection.account,
+          tokenSource: this.authorizations.createTokenSource(definition, authorization.id),
+          signal: clientSignal
+        });
+      }, () => connectorClientInterruptionError(operationSignal));
+    } catch (error) {
+      if (operationSignal.aborted)
+        throw error;
+      throw providerBoundaryError(error, providerFailureCode(error), "Connector connection client creation failed.");
+    }
+  }
+  async listConnections(command, connectorId) {
+    const definition = this.requireOAuthDefinition(connectorId);
+    requireConnectorConnectionCommandActor(command.execution, this.projectId);
+    let connections;
+    try {
+      connections = await this.connectionStorage.listConnections({
+        projectId: this.projectId,
+        connectorId: definition.id
+      });
+    } catch (error) {
+      throw storageBoundaryError(error, "Connector connections could not be listed.");
+    }
+    return withConnectorStorageBoundary("Connector authorizations could not be read.", () => Promise.all(connections.map(async (connection) => {
+      const authorization = await this.connectionStorage.getAuthorization({
+        projectId: this.projectId,
+        connectorId: definition.id,
+        authorizationId: connection.authorizationId
+      });
+      if (!authorization) {
+        throw createConnectorCodedError("internal.unexpected", "Connector connection references an unavailable authorization.");
+      }
+      return connectorConnectionView(connection, authorization.status);
+    })));
+  }
+  startConnectionRun(command, connectorId, input) {
+    return this.runs.start(command, connectorId, input);
+  }
+  async addConnection(command, connectorId, input) {
+    const definition = this.requireOAuthDefinition(connectorId);
+    const actor = requireConnectorConnectionCommandActor(command.execution, this.projectId);
+    assertConnectorConnectionSelector(input);
+    const source = await withConnectorStorageBoundary("Source connector connection could not be read.", () => this.connectionStorage.getConnectionById({
+      projectId: this.projectId,
+      connectorId: definition.id,
+      connectionId: nonblank(input.fromConnectionId, "source connection id")
+    }));
+    if (!source) {
+      throw createConnectorCodedError("connector.not_found", "Source connection was not found.");
+    }
+    if (source.status !== "connected") {
+      throw createConnectorCodedError("connector.authorization_required", "Source connection is disconnected.");
+    }
+    const authorization = await this.authorizations.requireStableActiveAuthorization(definition, source.authorizationId);
+    assertConnectorAuthorizationActor(authorization, actor.principal);
+    return this.runs.startSelection(command, definition.id, {
+      owner: input.owner,
+      slot: input.slot,
+      authorizationId: authorization.id
+    });
+  }
+  getConnectionRun(command, connectorId, runId) {
+    this.requireOAuthDefinition(connectorId);
+    return this.runs.get(command, connectorId, runId);
+  }
+  selectConnectionRunAccount(command, connectorId, input) {
+    return this.runs.selectAccount(command, connectorId, input);
+  }
+  async startReauthorization(command, connectorId, connectionId, input) {
+    const definition = this.requireOAuthDefinition(connectorId);
+    requireConnectorConnectionCommandActor(command.execution, this.projectId);
+    const connection = await withConnectorStorageBoundary("Connector connection could not be read.", () => this.connectionStorage.getConnectionById({
+      projectId: this.projectId,
+      connectorId: definition.id,
+      connectionId: nonblank(connectionId, "connection id")
+    }));
+    if (!connection) {
+      throw createConnectorCodedError("connector.not_found", "Connector connection was not found.");
+    }
+    if (connection.status !== "connected") {
+      throw createConnectorCodedError("connector.authorization_required", "Disconnected connector connections cannot be reauthorized; start a new connection.");
+    }
+    return this.runs.start(command, definition.id, {
+      owner: connection.owner,
+      slot: connection.slot,
+      redirectUri: input.redirectUri,
+      returnTo: input.returnTo,
+      reauthorizationId: connection.authorizationId
+    });
+  }
+  async revokeConnection(command, connectorId, connectionId) {
+    const definition = this.requireOAuthDefinition(connectorId);
+    requireConnectorConnectionCommandActor(command.execution, this.projectId);
+    const authorization = await withConnectorStorageBoundary("Connector authorization could not be resolved from its connection.", () => this.connectionStorage.getAuthorizationByConnectionId({
+      projectId: this.projectId,
+      connectorId: definition.id,
+      connectionId: nonblank(connectionId, "connection id")
+    }));
+    if (!authorization) {
+      throw createConnectorCodedError("connector.not_found", "Connector connection was not found.");
+    }
+    return this.revokeAuthorization(command, definition.id, authorization.id);
+  }
+  completeConnectionRun(input) {
+    return this.runs.complete(input);
+  }
+  startAuthorization(command, connectorId, input) {
+    return this.requests.startAuthorization(command, connectorId, input);
+  }
+  completeAuthorization(command, connectorId, input) {
+    return this.requests.completeAuthorization(command, connectorId, input);
+  }
+  async selectAccount(command, connectorId, input) {
+    const definition = this.requireOAuthDefinition(connectorId);
+    const actor = requireConnectorConnectionCommandActor(command.execution, this.projectId);
+    assertConnectorConnectionSelector(input);
+    const authorization = await this.authorizations.requireAuthorization(definition.id, input.authorizationId);
+    if (authorization.status !== "pending_selection" && authorization.status !== "active") {
+      throw connectorAuthorizationStatusError(authorization.status);
+    }
+    assertConnectorAuthorizationActor(authorization, actor.principal);
+    const account = authorization.accounts.find((candidate) => candidate.id === input.accountId);
+    if (!account) {
+      throw createConnectorCodedError("connector.not_found", `Account '${input.accountId}' is not exposed by this connector authorization.`);
+    }
+    let result;
+    try {
+      result = await this.connectionStorage.putConnection({
+        id: `ccn_${randomUUID5()}`,
+        projectId: this.projectId,
+        connectorId: definition.id,
+        owner: input.owner,
+        slot: input.slot,
+        authorizationId: authorization.id,
+        account,
+        replace: input.replace === true
+      });
+    } catch (error) {
+      if (isConnectorStorageError(error, "authorization_conflict")) {
+        await this.continueRevocationIfPending(definition, authorization.id);
+        throw createConnectorCodedError("connector.operation_conflict", "Connector authorization cannot be selected in its current state.", { cause: error });
+      }
+      if (isConnectorStorageError(error, "connection_conflict")) {
+        throw createConnectorCodedError("connector.operation_conflict", "Connector slot is already occupied; explicit replacement is required.", { cause: error });
+      }
+      throw storageBoundaryError(error, "Connector account selection could not be persisted.");
+    }
+    if (result.revocationPendingAuthorizationId) {
+      await this.continuePendingRevocation(definition, result.revocationPendingAuthorizationId);
+    }
+    return connectorConnectionView(result.connection, result.authorization.status);
+  }
+  async disconnect(command, connectorId, connectionId) {
+    const definition = this.requireOAuthDefinition(connectorId);
+    requireConnectorConnectionCommandActor(command.execution, this.projectId);
+    const normalizedConnectionId = nonblank(connectionId, "connection id");
+    try {
+      const disconnected = await this.connectionStorage.disconnectConnection({
+        projectId: this.projectId,
+        connectorId: definition.id,
+        connectionId: normalizedConnectionId
+      });
+      if (!disconnected)
+        return null;
+      if (disconnected.revocationPendingAuthorizationId) {
+        await this.continuePendingRevocation(definition, disconnected.revocationPendingAuthorizationId);
+      }
+      return connectorConnectionView(disconnected.connection, disconnected.authorization.status);
+    } catch (error) {
+      if (isConnectorStorageError(error, "authorization_conflict")) {
+        throw createConnectorCodedError("connector.operation_conflict", "Connector connection cannot be disconnected while its authorization is changing.", { cause: error });
+      }
+      throw storageBoundaryError(error, "Connector disconnection could not be persisted.");
+    }
+  }
+  async revokeAuthorization(command, connectorId, authorizationId) {
+    const definition = this.requireOAuthDefinition(connectorId);
+    const actor = requireConnectorConnectionCommandActor(command.execution, this.projectId);
+    const revoked = await this.authorizations.revokeAuthorization({
+      definition,
+      authorizationId: nonblank(authorizationId, "authorization id", "connector.authorization_invalid"),
+      principal: actor.principal
+    });
+    return {
+      affectedConnections: revoked.disconnected.map((connection) => connectorConnectionView(connection, "revoked"))
+    };
+  }
+  async close() {
+    this.runs.close();
+    this.abortController.abort();
+    this.abortController = new AbortController;
+  }
+  assertOAuthRegistered(definition) {
+    const registered = this.requireOAuthDefinition(definition.id);
+    if (registered !== definition) {
+      throw createConnectorCodedError("connector.configuration_invalid", `Connector '${definition.id}' is not the registered definition instance.`);
+    }
+  }
+  requireOAuthDefinition(connectorId) {
+    const definition = this.definitionsById.get(nonblank(connectorId, "connector id"));
+    if (!definition) {
+      throw createConnectorCodedError("connector.not_found", `Unknown connector '${connectorId}'.`);
+    }
+    if (!isOAuthConnectorDefinition(definition)) {
+      throw createConnectorCodedError("connector.configuration_invalid", `Connector '${connectorId}' does not use OAuth authentication.`);
+    }
+    return definition;
+  }
+  async continueRevocationIfPending(definition, authorizationId) {
+    const authorization = await this.authorizations.requireAuthorization(definition.id, authorizationId);
+    if (authorization.status !== "revocation_pending")
+      return;
+    await this.continuePendingRevocation(definition, authorization.id);
+  }
+  async continuePendingRevocation(definition, authorizationId) {
+    try {
+      await this.authorizations.continuePendingRevocation(definition, authorizationId);
+    } catch (error) {
+      if (isSixbError(error) && error.code === "connector.revocation_pending")
+        return;
+      throw error;
+    }
+  }
+}
+function connectorClientInterruptionError(signal) {
+  if (signal.aborted) {
+    if (signal.reason instanceof Error)
+      return signal.reason;
+    const error = new Error("[Sixb] Connector client creation was cancelled.");
+    error.name = "AbortError";
+    return error;
+  }
+  return createConnectorCodedError("connector.provider_unavailable", "Connector client creation timed out.");
+}
+function requireConnectionStorage(storage) {
+  const connectorConnections = storage?.connectorConnections;
+  if (!storage || !connectorConnections) {
+    throw createConnectorCodedError("connector.configuration_invalid", "OAuth connectors require storage.connectorConnections to be configured.");
+  }
+  if (connectorConnections.durability !== "ephemeral" && connectorConnections.durability !== "durable") {
+    throw createConnectorCodedError("connector.configuration_invalid", "Connector connection storage must declare 'ephemeral' or 'durable' durability.");
+  }
+  return { root: storage, connectorConnections };
+}
+function credentialProtectorFor(storage, options) {
+  if (storage.durability === "durable" && !options.credentialProtector) {
+    throw createConnectorCodedError("connector.configuration_invalid", "Durable connector connection storage requires connectorConnections.encryptionKey to be configured.");
+  }
+  return options.credentialProtector ?? createEphemeralConnectorCredentialProtector();
+}
+
+// src/connectors/service.ts
+class ConnectorService {
+  projectId;
+  definitionsById;
+  staticConnectionStates = new Map;
+  connections;
+  constructor(projectId, definitions, options = {}) {
+    this.projectId = projectId;
+    this.definitionsById = new Map(definitions.map((definition) => [definition.id, definition]));
+    if (definitions.some(isOAuthConnectorDefinition)) {
+      this.connections = new ConnectorConnectionService(projectId, definitions, options);
+    }
+  }
+  async connect(definition) {
+    this.assertRegistered(definition);
+    let state = this.staticConnectionStates.get(definition);
+    if (!state) {
+      const controller = new AbortController;
+      const clientPromise = Promise.resolve(definition.adapter.connect({
+        projectId: this.projectId,
+        connectorId: definition.id,
+        signal: controller.signal
+      }));
+      state = { controller, clientPromise };
+      this.staticConnectionStates.set(definition, state);
+    }
+    try {
+      return await state.clientPromise;
+    } catch (error) {
+      if (this.staticConnectionStates.get(definition) === state) {
+        this.staticConnectionStates.delete(definition);
+      }
+      throw error;
+    }
+  }
+  connectConnection(definition, selector) {
+    return this.requireConnections().connectConnection(definition, selector);
+  }
+  listExecutionConnections(definition) {
+    return this.requireConnections().listExecutionConnections(definition);
+  }
+  connectExecutionConnection(definition, connection, signal) {
+    return this.requireConnections().connectExecutionConnection(definition, connection, signal);
+  }
+  get connectionProcess() {
+    return this.connections;
+  }
+  async close() {
+    await this.connections?.close();
+    const activeConnections = [...this.staticConnectionStates.entries()];
+    this.staticConnectionStates.clear();
+    for (const [definition, state] of activeConnections) {
+      await this.disconnectStaticState(definition, state);
+    }
+  }
+  assertRegistered(definition) {
+    const registeredDefinition = this.definitionsById.get(definition.id);
+    if (!registeredDefinition)
+      throw new ConnectorNotFoundError(definition.id);
+    if (registeredDefinition !== definition) {
+      throw new ConnectorError(`Connector '${definition.id}' is not the registered definition instance.`);
+    }
+  }
+  requireConnections() {
+    if (!this.connections) {
+      throw createConnectorCodedError("connector.configuration_invalid", "No OAuth connectors are registered with this runtime.");
+    }
+    return this.connections;
+  }
+  async disconnectStaticState(definition, state) {
+    state.controller.abort();
+    let client;
+    try {
+      client = await state.clientPromise;
+    } catch {
+      return;
+    }
+    if (typeof definition.adapter.disconnect === "function") {
+      await definition.adapter.disconnect(client);
+    }
+  }
+}
+
+// src/maintenance/ontology-maintenance.ts
+var DEFAULT_INTERVAL_MS = 60000;
+var DEFAULT_RETENTION_MS = 24 * 60 * 60000;
+var DEFAULT_CLEANUP_LIMIT = 1000;
+var DEFAULT_SHUTDOWN_TIMEOUT_MS = 30000;
+var DEGRADED_ATTEMPT_THRESHOLD = 3;
+var DEGRADED_FAILURE_THRESHOLD = 2;
+
+class OntologyMaintenance {
+  projectId;
+  storage;
+  dispatcher;
+  intervalMs;
+  publishedOutboxRetentionMs;
+  terminalSourceRetentionMs;
+  cleanupLimit;
+  shutdownTimeoutMs;
+  now;
+  onError;
+  owners = new Set;
+  timer = null;
+  pass = null;
+  stopping = null;
+  snapshot;
+  constructor(dependencies) {
+    assertNonblank2(dependencies.projectId, "projectId");
+    const options = dependencies.options ?? {};
+    this.projectId = dependencies.projectId;
+    this.storage = dependencies.storage;
+    this.dispatcher = dependencies.dispatcher;
+    this.intervalMs = positiveInteger(options.intervalMs ?? DEFAULT_INTERVAL_MS, "intervalMs");
+    this.publishedOutboxRetentionMs = nonnegativeInteger(options.publishedOutboxRetentionMs ?? DEFAULT_RETENTION_MS, "publishedOutboxRetentionMs");
+    this.terminalSourceRetentionMs = nonnegativeInteger(options.terminalSourceRetentionMs ?? DEFAULT_RETENTION_MS, "terminalSourceRetentionMs");
+    this.cleanupLimit = positiveInteger(options.cleanupLimit ?? DEFAULT_CLEANUP_LIMIT, "cleanupLimit");
+    this.shutdownTimeoutMs = nonnegativeInteger(options.shutdownTimeoutMs ?? DEFAULT_SHUTDOWN_TIMEOUT_MS, "shutdownTimeoutMs");
+    this.now = dependencies.now ?? (() => new Date);
+    this.onError = dependencies.onError ?? ((error) => console.error("[Sixb] Ontology maintenance error:", error));
+    this.snapshot = emptySnapshot(this.intervalMs);
+  }
+  async start() {
+    if (this.stopping)
+      await this.stopping;
+    const owner = Symbol("ontology-maintenance-owner");
+    const startsHosting = this.owners.size === 0;
+    this.owners.add(owner);
+    if (startsHosting)
+      this.startHostedPass();
+    let released = false;
+    return {
+      stop: async () => {
+        if (released)
+          return;
+        released = true;
+        this.owners.delete(owner);
+        if (this.owners.size === 0)
+          await this.stopLoop();
+      }
+    };
+  }
+  runNow() {
+    this.pass ??= this.runPass().finally(() => {
+      this.pass = null;
+    });
+    return this.pass;
+  }
+  async stop() {
+    this.owners.clear();
+    await this.stopLoop();
+  }
+  getSnapshot() {
+    return structuredClone(this.snapshot);
+  }
+  getOperationalStatus() {
+    const snapshot = this.getSnapshot();
+    const lastActivityAt = latestTimestamp(snapshot.lastStartedAt, snapshot.lastCompletedAt);
+    const overdue = lastActivityAt !== null && this.now().getTime() - Date.parse(lastActivityAt) > this.intervalMs * 2;
+    const oldestPendingAt = snapshot.outbox?.oldestPendingAt ?? null;
+    const pendingTooLong = oldestPendingAt !== null && this.now().getTime() - Date.parse(oldestPendingAt) > this.intervalMs * 2;
+    const repeatedlyFailing = (snapshot.outbox?.maxAttempts ?? 0) >= DEGRADED_ATTEMPT_THRESHOLD;
+    const degraded = snapshot.consecutiveFailures >= DEGRADED_FAILURE_THRESHOLD || repeatedlyFailing || pendingTooLong || overdue;
+    return { status: degraded ? "degraded" : "ok", maintenance: snapshot };
+  }
+  startHostedPass() {
+    this.runNow().catch((error) => this.reportError(error)).finally(() => this.scheduleNextPass());
+  }
+  async runPass() {
+    const started = this.now();
+    this.snapshot = { ...this.snapshot, running: true, lastStartedAt: started.toISOString() };
+    const failures = [];
+    await captureFailure(() => this.dispatcher.drain(), failures);
+    const cleanup = await this.cleanupExpiredRows(started, failures);
+    const { outbox, terminalSources } = await this.readOperationalSummaries(failures);
+    this.completePass({ started, failures, cleanup, outbox, terminalSources });
+  }
+  async cleanupExpiredRows(started, failures) {
+    const publishedOutboxRowsDeleted = await captureFailure(() => this.storage.ontology.outbox.purgePublished({
+      projectId: this.projectId,
+      publishedBefore: new Date(started.getTime() - this.publishedOutboxRetentionMs).toISOString(),
+      limit: this.cleanupLimit
+    }), failures, 0);
+    const terminalSources = await captureFailure(() => this.storage.ontology.sources.cleanupTerminal({
+      projectId: this.projectId,
+      terminalBefore: new Date(started.getTime() - this.terminalSourceRetentionMs).toISOString(),
+      limit: this.cleanupLimit
+    }), failures, { rowsDeleted: 0, materializationsDeleted: 0 });
+    return {
+      publishedOutboxRowsDeleted,
+      terminalSourceRowsDeleted: terminalSources.rowsDeleted,
+      terminalSourceMaterializationsDeleted: terminalSources.materializationsDeleted
+    };
+  }
+  async readOperationalSummaries(failures) {
+    const outbox = await captureFailure(() => this.storage.ontology.outbox.summarize({ projectId: this.projectId }), failures, this.snapshot.outbox);
+    const terminalSummary = await captureFailure(() => this.storage.ontology.sources.summarizeTerminal({ projectId: this.projectId }), failures, this.snapshot.terminalSources);
+    return { outbox, terminalSources: terminalSummary };
+  }
+  completePass(input) {
+    const completed = this.now();
+    const failure = input.failures.length > 0 ? new AggregateError(input.failures, "Maintenance pass failed.") : null;
+    this.snapshot = {
+      running: false,
+      intervalMs: this.intervalMs,
+      lastStartedAt: input.started.toISOString(),
+      lastCompletedAt: completed.toISOString(),
+      lastDurationMs: Math.max(0, completed.getTime() - input.started.getTime()),
+      consecutiveFailures: failure ? this.snapshot.consecutiveFailures + 1 : 0,
+      lastError: failure ? errorMessage(failure) : null,
+      outbox: input.outbox,
+      terminalSources: input.terminalSources,
+      cleanup: input.cleanup
+    };
+    if (failure)
+      this.reportError(failure);
+  }
+  scheduleNextPass() {
+    if (this.owners.size === 0 || this.timer !== null)
+      return;
+    this.timer = setTimeout(() => {
+      this.timer = null;
+      if (this.owners.size === 0)
+        return;
+      this.runNow().catch((error) => this.reportError(error)).finally(() => this.scheduleNextPass());
+    }, this.intervalMs);
+    this.timer.unref?.();
+  }
+  stopLoop() {
+    if (this.stopping)
+      return this.stopping;
+    if (this.timer !== null) {
+      clearTimeout(this.timer);
+      this.timer = null;
+    }
+    const activePass = this.pass ?? Promise.resolve();
+    const stopping = settlesWithin(activePass, this.shutdownTimeoutMs).then((settled) => {
+      if (!settled) {
+        this.reportError(new Error(`[Sixb] Ontology maintenance did not stop within ${this.shutdownTimeoutMs}ms.`));
+      }
+    });
+    this.stopping = stopping.finally(() => {
+      this.stopping = null;
+    });
+    return this.stopping;
+  }
+  reportError(error) {
+    try {
+      this.onError(error);
+    } catch {}
+  }
+}
+function emptySnapshot(intervalMs) {
+  return {
+    running: false,
+    intervalMs,
+    lastStartedAt: null,
+    lastCompletedAt: null,
+    lastDurationMs: null,
+    consecutiveFailures: 0,
+    lastError: null,
+    outbox: null,
+    terminalSources: null,
+    cleanup: null
+  };
+}
+function positiveInteger(value, name) {
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    throw new Error(`[Sixb] Ontology maintenance ${name} must be a positive integer.`);
+  }
+  return value;
+}
+function nonnegativeInteger(value, name) {
+  if (!Number.isSafeInteger(value) || value < 0) {
+    throw new Error(`[Sixb] Ontology maintenance ${name} must be a nonnegative integer.`);
+  }
+  return value;
+}
+function assertNonblank2(value, name) {
+  if (value.trim().length === 0) {
+    throw new Error(`[Sixb] Ontology maintenance ${name} must not be blank.`);
+  }
+}
+function errorMessage(error) {
+  if (error instanceof AggregateError) {
+    return [...error.errors].map(errorMessage).join(" | ").slice(0, 2000);
+  }
+  const message = error instanceof Error ? `${error.name}: ${error.message}` : String(error);
+  return message.slice(0, 2000);
+}
+function latestTimestamp(left, right) {
+  if (left === null)
+    return right;
+  if (right === null)
+    return left;
+  return Date.parse(left) >= Date.parse(right) ? left : right;
+}
+async function settlesWithin(promise, timeoutMs) {
+  let timer;
+  const timedOut = new Promise((resolve) => {
+    timer = setTimeout(() => resolve(false), timeoutMs);
+  });
+  const result = await Promise.race([
+    promise.then(() => true, () => true),
+    timedOut
+  ]);
+  if (timer !== undefined)
+    clearTimeout(timer);
+  return result;
+}
+async function captureFailure(run, failures, fallback) {
+  try {
+    return await run();
+  } catch (error) {
+    failures.push(error);
+    return fallback;
+  }
+}
+// src/syncs/validation.ts
+function validateKeyedDatasetWriterTopology(input) {
+  for (const sync of input.syncs) {
+    const dataset = input.datasetsById.get(sync.target.dataset.id);
+    if (sync.config.mode === "merge" && dataset?.primaryKey === undefined) {
+      throw new SyncValidationError(`[Sixb] Merge sync '${sync.id}' targets dataset '${sync.target.dataset.id}', which must define a primaryKey.`);
+    }
+  }
+  const firstWriterByDataset = new Map;
+  for (const writer of datasetWriters(input.syncs, input.pipelines)) {
+    const dataset = input.datasetsById.get(writer.datasetId);
+    if (dataset?.primaryKey === undefined)
+      continue;
+    const first = firstWriterByDataset.get(writer.datasetId);
+    if (!first) {
+      firstWriterByDataset.set(writer.datasetId, writer);
+      continue;
+    }
+    throw new SyncValidationError(`[Sixb] Keyed dataset '${writer.datasetId}' has multiple registered writers: ${first.label} and ${writer.label}. V1 allows one writer per keyed dataset.`);
+  }
+}
+function validateMergeSyncProjectionSafety(input) {
+  const mergeSyncByDataset = new Map(input.syncs.filter((sync) => sync.config.mode === "merge").map((sync) => [sync.target.dataset.id, sync]));
+  for (const projection of input.telemetryProjections) {
+    const sync = mergeSyncByDataset.get(projection.datasetId);
+    if (!sync)
+      continue;
+    throw new SyncValidationError(`[Sixb] Telemetry projection '${projection.id}' cannot read merge-written dataset '${projection.datasetId}' from sync '${sync.id}'. V1 merge syncs support object and link replacement projections only.`);
+  }
+}
+function* datasetWriters(syncs, pipelines) {
+  for (const sync of syncs) {
+    yield { datasetId: sync.target.dataset.id, label: `sync '${sync.id}'` };
+  }
+  for (const pipeline of pipelines) {
+    for (const node of pipeline.graph.nodes) {
+      yield {
+        datasetId: node.step.output.id,
+        label: `pipeline '${pipeline.id}' step '${node.step.id}'`
+      };
+    }
+  }
+}
+
+// src/runtime/definitions.ts
+function createDefinitionCatalog(definitionsById) {
+  return Object.freeze({
+    list: () => [...definitionsById.values()],
+    getById: (id) => definitionsById.get(id) ?? null
+  });
+}
+
+// src/runtime/resolve-definitions.ts
+function resolveDefinitions(options) {
+  const ontology = new OntologyRegistry({ sources: options.ontology });
+  const actionRegistry = new ActionRegistry({ actions: options.actions ?? [], ontology });
+  const registeredActionIds = new Set(actionRegistry.list().map((action) => action.id));
+  const agents = options.agents ?? [];
+  validateAgentToolsAtStartup(agents);
+  const agentsById = indexUniqueDefinitions("agent", agents);
+  const connectorsById = indexUniqueDefinitions("connector", options.connectors ?? []);
+  const datasetsById = new Map;
+  for (const dataset of options.datasets ?? []) {
+    assertDatasetDefinition(dataset, (message) => new RuntimeError(message));
+    assertUniqueDefinitionId("dataset", dataset.id, datasetsById);
+    datasetsById.set(dataset.id, dataset);
+  }
+  const schedulesById = indexUniqueDefinitions("schedule", options.schedules ?? []);
+  const syncsById = new Map;
+  for (const sync of options.syncs ?? []) {
+    assertUniqueDefinitionId("sync", sync.id, syncsById);
+    if (!datasetsById.has(sync.target.dataset.id)) {
+      throw new RuntimeError(`Sync '${sync.id}' targets unknown dataset '${sync.target.dataset.id}'. Add it to 'datasets' in createSixb() or export it from 'datasets/'.`);
+    }
+    syncsById.set(sync.id, sync);
+  }
+  const pipelinesById = new Map;
+  for (const pipeline of options.pipelines ?? []) {
+    assertUniqueDefinitionId("pipeline", pipeline.id, pipelinesById);
+    validatePipelineDatasets(pipeline, datasetsById);
+    pipelinesById.set(pipeline.id, pipeline);
+  }
+  const schedules = [...schedulesById.values()];
+  const syncs = [...syncsById.values()];
+  const pipelines = [...pipelinesById.values()];
+  validateKeyedDatasetWriterTopology({ datasetsById, syncs, pipelines });
+  const rules = options.rules ?? [];
+  validateRulesAtStartup(rules, ontology);
+  const rulesById = indexUniqueDefinitions("rule", rules);
+  validateSchedulesAtStartup(schedules, ontology, {
+    registeredRuleIds: new Set(rulesById.keys()),
+    registeredActionIds,
+    registeredDatasetIds: new Set(datasetsById.keys()),
+    registeredSyncIds: new Set(syncsById.keys()),
+    registeredPipelineIds: new Set(pipelinesById.keys())
+  });
+  for (const sync of syncs) {
+    validateScheduleReferences("Sync", sync.id, sync.triggers, schedulesById);
+  }
+  for (const pipeline of pipelines) {
+    validateScheduleReferences("Pipeline", pipeline.id, pipeline.triggers, schedulesById);
+  }
+  const workflows = validateWorkflowsAtStartup({
+    workflows: options.workflows ?? [],
+    registeredSchedules: schedulesById,
+    registeredActionIds,
+    registeredAgentIds: new Set(agentsById.keys())
+  });
+  const workflowsById = indexUniqueDefinitions("workflow", workflows);
+  const security = new SecurityRegistry({
+    groups: options.groups ?? [],
+    roles: options.roles ?? [],
+    membershipPolicies: options.membershipPolicies ?? [],
+    objectTypeIds: new Set(ontology.getObjectTypesById().keys()),
+    datasetIds: new Set(datasetsById.keys()),
+    actionIds: registeredActionIds,
+    workflowIds: new Set(workflowsById.keys()),
+    syncIds: new Set(syncsById.keys()),
+    pipelineIds: new Set(pipelinesById.keys()),
+    agentIds: new Set(agentsById.keys()),
+    connectorIds: new Set(connectorsById.keys()),
+    getSubTypes: (objectTypeId) => ontology.listSubTypes(objectTypeId)
+  });
+  validateAgentGroupReferences(agents, security);
+  const projectionRegistry = new ProjectionRegistry({
+    projections: options.projections ?? [],
+    ontology,
+    datasetsById
+  });
+  validateMergeSyncProjectionSafety({
+    syncs,
+    telemetryProjections: projectionRegistry.listTelemetry()
+  });
+  return Object.freeze({
+    ontology,
+    actions: actionRegistry,
+    agents: createDefinitionCatalog(agentsById),
+    connectors: createDefinitionCatalog(connectorsById),
+    datasets: createDefinitionCatalog(datasetsById),
+    pipelines: createDefinitionCatalog(pipelinesById),
+    projections: projectionRegistry,
+    rules: createDefinitionCatalog(rulesById),
+    schedules: createDefinitionCatalog(schedulesById),
+    security,
+    syncs: createDefinitionCatalog(syncsById),
+    workflows: createDefinitionCatalog(workflowsById)
+  });
+}
+function indexUniqueDefinitions(kind, definitions) {
+  const definitionsById = new Map;
+  for (const definition of definitions) {
+    assertUniqueDefinitionId(kind, definition.id, definitionsById);
+    definitionsById.set(definition.id, definition);
+  }
+  return definitionsById;
+}
+function assertUniqueDefinitionId(kind, id, definitionsById) {
+  if (definitionsById.has(id)) {
+    throw new RuntimeError(`Duplicate ${kind} id: ${id}`);
+  }
+}
+function validatePipelineDatasets(pipeline, datasetsById) {
+  if (pipeline.graph.nodes.length === 0) {
+    throw new RuntimeError(`Pipeline '${pipeline.id}' must contain at least one step.`);
+  }
+  const stepIds = new Set;
+  for (const node of pipeline.graph.nodes) {
+    const { step } = node;
+    if (stepIds.has(step.id)) {
+      throw new RuntimeError(`Pipeline '${pipeline.id}' contains duplicate step id '${step.id}'.`);
+    }
+    stepIds.add(step.id);
+    for (const [inputName, dataset] of Object.entries(step.inputs)) {
+      if (!datasetsById.has(dataset.id)) {
+        throw new RuntimeError(`Pipeline '${pipeline.id}' step '${step.id}' input '${inputName}' references unknown dataset '${dataset.id}'. Add it to 'datasets' in createSixb() or export it from 'datasets/'.`);
+      }
+    }
+    if (!datasetsById.has(step.output.id)) {
+      throw new RuntimeError(`Pipeline '${pipeline.id}' step '${step.id}' outputs unknown dataset '${step.output.id}'. Add it to 'datasets' in createSixb() or export it from 'datasets/'.`);
+    }
+  }
+}
+function validateScheduleReferences(consumerKind, consumerId, references, schedulesById) {
+  for (const reference of references) {
+    if (!schedulesById.has(reference.scheduleId)) {
+      throw new RuntimeError(`${consumerKind} '${consumerId}' references unknown schedule '${reference.scheduleId}'. Add it to 'schedules' in createSixb() or export it from 'schedules/'.`);
+    }
+  }
+}
+
+// src/runtime/storage-readiness.ts
+var DEFAULT_SCHEMA_RETRY_DELAY_MS = 60000;
+
+class StorageReadiness {
+  storage;
+  schema;
+  schemaRetryDelayMs;
+  now;
+  constructor(storage, options = {}) {
+    this.storage = storage;
+    this.schemaRetryDelayMs = positiveInteger2(options.schemaRetryDelayMs ?? DEFAULT_SCHEMA_RETRY_DELAY_MS, "schemaRetryDelayMs");
+    this.now = options.now ?? (() => new Date);
+    this.schema = isMigrationCapableStorage(storage) ? { status: "unchecked" } : { status: "valid" };
+  }
+  startSchemaValidation() {
+    if (this.schema.status === "checking" || this.schema.status === "valid")
+      return;
+    if (this.schema.status === "invalid" && this.now().getTime() < this.schema.retryAt)
+      return;
+    this.schema = { status: "checking" };
+    this.validateSchema();
+  }
+  async check() {
+    try {
+      await this.storage.ping();
+    } catch {
+      return {
+        status: "unready",
+        storage: { reachable: false, schemaValid: false },
+        reason: "Storage is unreachable."
+      };
+    }
+    this.startSchemaValidation();
+    if (this.schema.status === "valid") {
+      return { status: "ready", storage: { reachable: true, schemaValid: true } };
+    }
+    return {
+      status: "unready",
+      storage: { reachable: true, schemaValid: false },
+      reason: this.schema.status === "invalid" ? this.schema.reason : "Storage schema validation is in progress."
+    };
+  }
+  async validateSchema() {
+    const result = await checkStorageSchema(this.storage);
+    this.schema = result.ok ? { status: "valid" } : this.invalidSchema(result.reason ?? "Storage schema is not usable.");
+  }
+  invalidSchema(reason) {
+    return {
+      status: "invalid",
+      reason,
+      retryAt: this.now().getTime() + this.schemaRetryDelayMs
+    };
+  }
+}
+function positiveInteger2(value, name) {
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    throw new Error(`[Sixb] Storage readiness ${name} must be a positive integer.`);
+  }
+  return value;
+}
+
+// src/runtime/host.ts
+class SixbHost {
+  projectId;
+  webhookRegistry;
+  hostContext;
+  committedFacts;
+  eventService;
+  ontologyMaintenance;
+  storageReadiness;
+  connectorService;
+  materializer;
+  definitions;
+  broker;
+  events;
+  logging;
+  storage;
+  lakeStorage;
+  blobStorage;
+  queues;
+  sandboxes;
+  projectRoot;
+  scheduler;
+  auth;
+  constructor(options) {
+    const errorReporter = attachSixbErrorReporter(this, options.onError);
+    this.projectId = options.id ?? "default";
+    this.broker = options.broker;
+    this.eventService = createDomainEventService({
+      projectId: this.projectId,
+      broker: this.broker,
+      errorReporter
+    });
+    this.events = this.eventService;
+    this.logging = new LoggingService({
+      projectId: this.projectId,
+      broker: this.broker,
+      logger: options.logger,
+      observability: options.observability?.logs
+    });
+    this.storage = options.storage;
+    this.storageReadiness = new StorageReadiness(this.storage);
+    this.lakeStorage = options.lakeStorage;
+    this.blobStorage = options.blobStorage;
+    this.queues = options.queues;
+    this.sandboxes = options.sandboxes;
+    this.projectRoot = resolve(options.projectRoot ?? process.cwd());
+    const definitions = resolveDefinitions(options);
+    this.definitions = definitions;
+    registerProjectionRegistry(this, definitions.projections);
+    this.auth = new AuthRuntime({
+      projectId: this.projectId,
+      storage: this.storage,
+      security: definitions.security,
+      config: options.auth
+    });
+    validateAuthStrategySecurityReferences(this.auth.getStrategy(), definitions.security);
+    const connectors = definitions.connectors.list();
+    assertConnectorConnectionSurfaces(connectors);
+    const hasOAuthConnectors = connectors.some(isOAuthConnectorDefinition);
+    const credentialProtector = hasOAuthConnectors && options.connectorConnections?.encryptionKey !== undefined ? createConnectorCredentialProtectorFromKey(options.connectorConnections.encryptionKey) : undefined;
+    this.connectorService = new ConnectorService(this.projectId, connectors, {
+      storage: this.storage,
+      credentialProtector
+    });
+    if (this.connectorService.connectionProcess) {
+      registerConnectorConnectionCallbackProcess(this, this.connectorService.connectionProcess.callbackProcess);
+    }
+    assertWebhookRunStorage(connectors, this.storage);
+    this.webhookRegistry = new WebhookRegistry({ connectors });
+    this.materializer = createOntologyMaterializer({
+      projectId: this.projectId,
+      ontology: definitions.ontology,
+      projections: definitions.projections,
+      storage: this.storage
+    });
+    this.committedFacts = new OntologyOutboxDispatcher({
+      projectId: this.projectId,
+      storage: this.storage,
+      events: this.eventService,
+      onDeliveryFailure: (error, failure) => reportEventDeliveryFailure(errorReporter, error, {
+        projectId: this.projectId,
+        ...failure
+      })
+    });
+    this.ontologyMaintenance = new OntologyMaintenance({
+      projectId: this.projectId,
+      storage: this.storage,
+      dispatcher: this.committedFacts,
+      options: options.ontologyMaintenance
+    });
+    this.hostContext = {
+      projectId: this.projectId,
+      broker: this.broker,
+      ontology: definitions.ontology,
+      actionRegistry: definitions.actions,
+      events: this.events,
+      storage: this.storage,
+      queues: this.queues
+    };
+    registerProjectionRegistry(this.hostContext, definitions.projections);
+    shareSixbErrorReporter(this, this.hostContext);
+    this.scheduler = new SchedulerRuntime({
+      schedules: definitions.schedules.list(),
+      events: this.eventService
+    });
+  }
+  withScope(scope) {
+    const authorization = resolveExecutionScopeAuthorization(this.projectId, scope);
+    if (authorization.ref.type === "kernel") {
+      throw new Error("[Sixb] Kernel authority cannot be bound to the domain SDK.");
+    }
+    const runtime = {
+      ...this.hostContext,
+      runtimeAuthorization: scope.authorization,
+      ...authorization.type === "principal" ? { authorization: authorization.context } : {}
+    };
+    registerOntologyMutationRuntime(runtime, createOntologyMutationRuntime({
+      materializer: this.materializer.withScope(scope),
+      notifyCommittedFacts: () => this.committedFacts.notify()
+    }));
+    return createBoundSixb(runtime, this.sixbDependencies(), scope.execution);
+  }
+  get id() {
+    return this.projectId;
+  }
+  listWebhooks() {
+    return this.webhookRegistry.list();
+  }
+  getWebhookById(connectorId, webhookId) {
+    return this.webhookRegistry.getById(connectorId, webhookId);
+  }
+  startOntologyMaintenance() {
+    this.storageReadiness.startSchemaValidation();
+    return this.ontologyMaintenance.start();
+  }
+  getOntologyOperationalStatus() {
+    return this.ontologyMaintenance.getOperationalStatus();
+  }
+  async checkReadiness() {
+    return this.storageReadiness.check();
+  }
+  async closeLogger() {
+    await this.logging.close();
+  }
+  async closeConnectors() {
+    await this.connectorService.close();
+  }
+  async closeBlobs() {
+    await this.blobStorage.close?.();
+  }
+  async closeBroker() {
+    await this.committedFacts.stop();
+    await this.ontologyMaintenance.stop();
+    await this.broker.close?.();
+  }
+  sixbDependencies() {
+    return {
+      definitions: this.definitions,
+      logging: this.logging,
+      connectorService: this.connectorService,
+      ...this.connectorService.connectionProcess === undefined ? {} : { connectorConnections: this.connectorService.connectionProcess },
+      blobStorage: this.blobStorage
+    };
+  }
+}
+function validateAuthStrategySecurityReferences(strategy, security) {
+  if (!isMagicLinkAuthStrategy(strategy) && !isOidcAuthStrategy(strategy)) {
+    return;
+  }
+  for (const groupId of strategy.bootstrapGroupIds ?? []) {
+    if (!security.getGroupById(groupId)) {
+      throw new AuthRuntimeError("invalid_auth_config", `[Sixb] Auth bootstrapGroups references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
+    }
+  }
+}
+function assertWebhookRunStorage(connectors, storage) {
+  if (storage.webhookRuns !== undefined) {
+    return;
+  }
+  for (const connector of connectors) {
+    const webhooks = connector.adapter.webhooks;
+    if (Array.isArray(webhooks) && webhooks.length > 0) {
+      throw new WebhookValidationError("[Sixb] Webhooks require storage.webhookRuns to be configured.");
+    }
+  }
+}
+function assertConnectorConnectionSurfaces(connectors) {
+  for (const connector of connectors) {
+    if (!isOAuthConnectorDefinition(connector))
+      continue;
+    if (connector.adapter.webhooks !== undefined) {
+      throw createConnectorCodedError("connector.configuration_invalid", `OAuth connector '${connector.id}' cannot register webhooks until connection routing is defined.`);
+    }
+  }
+}
+
+// src/runtime/create.ts
+async function createSixb(options) {
+  const projectRoot = resolve2(options.projectRoot ?? process.cwd());
+  const discoveredOntology = await discoverOntologySources(projectRoot);
+  const allSources = [...options.ontologies ?? [], ...discoveredOntology];
+  if (allSources.length === 0) {
+    throw new RuntimeError("No ontology found. Create an 'ontology/' folder or pass 'ontologies' to createSixb().");
+  }
+  const definitions = await discoverProjectDefinitions(projectRoot);
+  return new SixbHost({
+    id: options.id,
+    ontology: allSources,
+    broker: options.broker,
+    storage: options.storage,
+    lakeStorage: options.lakeStorage,
+    blobStorage: options.blobStorage,
+    queues: options.queues,
+    sandboxes: options.sandboxes,
+    logger: options.logger,
+    observability: options.observability,
+    onError: options.onError,
+    ontologyMaintenance: options.ontologyMaintenance,
+    projectRoot,
+    actions: [...options.actions ?? [], ...definitions.actions],
+    datasets: [...options.datasets ?? [], ...definitions.datasets],
+    connectors: [...options.connectors ?? [], ...definitions.connectors],
+    connectorConnections: options.connectorConnections,
+    schedules: [...options.schedules ?? [], ...definitions.schedules],
+    syncs: [...options.syncs ?? [], ...definitions.syncs],
+    pipelines: [...options.pipelines ?? [], ...definitions.pipelines],
+    projections: [...options.projections ?? [], ...definitions.projections],
+    rules: [...options.rules ?? [], ...definitions.rules],
+    workflows: [...options.workflows ?? [], ...definitions.workflows],
+    groups: [...options.groups ?? [], ...definitions.groups],
+    roles: [...options.roles ?? [], ...definitions.roles],
+    membershipPolicies: [...options.membershipPolicies ?? [], ...definitions.membershipPolicies],
+    agents: [...options.agents ?? [], ...definitions.agents],
+    auth: options.auth
+  });
+}
+export { WebhookValidationError, defineWebhook, webhookConnector, UnverifiedWebhookError, resolveWebhookVerification, warnUnverifiedWebhook, SixbHost, createSixb };
+
+//# debugId=D5CA320A2421D32564756E2164756E21