@sixb/core 0.1.1 → 0.1.3

package/dist/connectors/connections/contracts.d.ts

@@ -0,0 +1,127 @@
+import type { ConnectorConnectionRunFailure, ConnectorConnectionRunKind } from "../../storage/connector-connections/types";
+import type { CreateExecutionInput } from "../../storage/executions/types";
+import type { ConnectorAccountCandidate, ConnectorConnectionMetadata, ConnectorConnectionSelector } from "../types";
+/** Durable, already-authorized request provenance carried into the process-owned OAuth service. */
+export interface ConnectorConnectionCommandContext {
+    readonly execution: CreateExecutionInput;
+}
+export interface StartConnectorAuthorizationInput extends ConnectorConnectionSelector {
+    readonly redirectUri: string;
+    readonly reauthorizationId?: string;
+}
+export interface StartConnectorAuthorizationResult {
+    readonly authorizationUrl: string;
+    readonly affectedConnections: readonly ConnectorConnectionView[];
+}
+export interface StartConnectorConnectionRunInput extends ConnectorConnectionSelector {
+    readonly redirectUri: string;
+    readonly returnTo: string;
+    readonly reauthorizationId?: string;
+}
+export interface StartConnectorConnectionRunResult {
+    readonly runId: string;
+    readonly authorizationUrl: string;
+    readonly affectedConnections: readonly ConnectorConnectionView[];
+    /** One-shot browser proof set as an HttpOnly callback cookie by the HTTP boundary. */
+    readonly callbackBinding: {
+        readonly attemptId: string;
+        readonly secret: string;
+        readonly expiresAt: Date;
+    };
+}
+export interface CompleteConnectorAuthorizationInput {
+    readonly state: string;
+    readonly code: string;
+    readonly redirectUri: string;
+}
+export type CompleteConnectorConnectionRunInput = {
+    readonly state: string;
+    readonly code: string;
+    readonly redirectUri: string;
+    readonly callbackBinding: string;
+} | {
+    readonly state: string;
+    readonly error: string;
+    readonly redirectUri: string;
+    readonly callbackBinding: string;
+};
+export interface CompleteConnectorConnectionRunResult {
+    readonly runId: string;
+    readonly connectorId: string;
+    readonly returnTo: string;
+}
+/** Internal selection result. The HTTP boundary maps it to a secret-free representation. */
+export interface CompleteConnectorAuthorizationResult extends ConnectorConnectionSelector {
+    readonly authorizationId: string;
+    readonly accounts: readonly ConnectorAccountCandidate[];
+}
+export interface SelectConnectorAccountInput extends ConnectorConnectionSelector {
+    readonly authorizationId: string;
+    readonly accountId: string;
+    readonly replace?: boolean;
+}
+export interface SelectConnectorConnectionRunAccountInput {
+    readonly runId: string;
+    readonly accountId: string;
+    readonly replace?: boolean;
+}
+export interface AddConnectorConnectionInput extends ConnectorConnectionSelector {
+    readonly fromConnectionId: string;
+}
+export interface ConnectorConnectionView extends ConnectorConnectionMetadata {
+    readonly status: "connected" | "needs_reauthorization" | "disconnected";
+}
+interface ConnectorConnectionRunViewBase extends ConnectorConnectionSelector {
+    readonly id: string;
+    readonly connectorId: string;
+    readonly kind: ConnectorConnectionRunKind;
+    readonly createdAt: Date;
+    readonly updatedAt: Date;
+}
+export type ConnectorConnectionRunView = (ConnectorConnectionRunViewBase & {
+    readonly status: "waiting";
+    readonly waitingFor: "provider_authorization";
+    readonly expiresAt: Date;
+}) | (ConnectorConnectionRunViewBase & {
+    readonly status: "running";
+}) | (ConnectorConnectionRunViewBase & {
+    readonly status: "waiting";
+    readonly waitingFor: "account_selection";
+    readonly accounts: readonly ConnectorAccountCandidate[];
+    readonly expiresAt: Date;
+}) | (ConnectorConnectionRunViewBase & {
+    readonly status: "succeeded";
+    readonly connections: readonly ConnectorConnectionView[];
+    readonly finishedAt: Date;
+}) | (ConnectorConnectionRunViewBase & {
+    readonly status: "failed";
+    readonly error: ConnectorConnectionRunFailure;
+    readonly finishedAt: Date;
+}) | (ConnectorConnectionRunViewBase & {
+    readonly status: "cancelled" | "expired";
+    readonly finishedAt: Date;
+});
+export interface RevokeConnectorAuthorizationResult {
+    readonly affectedConnections: readonly ConnectorConnectionView[];
+}
+export interface ConnectorConnectionCallbackProcess {
+    completeConnectionRun(input: CompleteConnectorConnectionRunInput): Promise<CompleteConnectorConnectionRunResult>;
+}
+/** Process-owned OAuth lifecycle port. Connector definitions are resolved behind this boundary. */
+export interface ConnectorConnectionProcess {
+    readonly callbackProcess: ConnectorConnectionCallbackProcess;
+    listConnections(context: ConnectorConnectionCommandContext, connectorId: string): Promise<readonly ConnectorConnectionView[]>;
+    startConnectionRun(context: ConnectorConnectionCommandContext, connectorId: string, input: StartConnectorConnectionRunInput): Promise<StartConnectorConnectionRunResult>;
+    addConnection(context: ConnectorConnectionCommandContext, connectorId: string, input: AddConnectorConnectionInput): Promise<ConnectorConnectionRunView>;
+    getConnectionRun(context: ConnectorConnectionCommandContext, connectorId: string, runId: string): Promise<ConnectorConnectionRunView | null>;
+    selectConnectionRunAccount(context: ConnectorConnectionCommandContext, connectorId: string, input: SelectConnectorConnectionRunAccountInput): Promise<ConnectorConnectionRunView>;
+    startReauthorization(context: ConnectorConnectionCommandContext, connectorId: string, connectionId: string, input: Pick<StartConnectorConnectionRunInput, "redirectUri" | "returnTo">): Promise<StartConnectorConnectionRunResult>;
+    revokeConnection(context: ConnectorConnectionCommandContext, connectorId: string, connectionId: string): Promise<RevokeConnectorAuthorizationResult>;
+    startAuthorization(context: ConnectorConnectionCommandContext, connectorId: string, input: StartConnectorAuthorizationInput): Promise<StartConnectorAuthorizationResult>;
+    completeAuthorization(context: ConnectorConnectionCommandContext, connectorId: string, input: CompleteConnectorAuthorizationInput): Promise<CompleteConnectorAuthorizationResult>;
+    selectAccount(context: ConnectorConnectionCommandContext, connectorId: string, input: SelectConnectorAccountInput): Promise<ConnectorConnectionView>;
+    disconnect(context: ConnectorConnectionCommandContext, connectorId: string, connectionId: string): Promise<ConnectorConnectionView | null>;
+    revokeAuthorization(context: ConnectorConnectionCommandContext, connectorId: string, authorizationId: string): Promise<RevokeConnectorAuthorizationResult>;
+}
+export {};
+//# sourceMappingURL=contracts.d.ts.map

package/dist/connectors/connections/contracts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../../../src/connectors/connections/contracts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,6BAA6B,EAC7B,0BAA0B,EAC3B,MAAM,2CAA2C,CAAA;AAClD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAA;AAC1E,OAAO,KAAK,EACV,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAC5B,MAAM,UAAU,CAAA;AAEjB,mGAAmG;AACnG,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAA;CACzC;AAED,MAAM,WAAW,gCAAiC,SAAQ,2BAA2B;IACnF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CACpC;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,mBAAmB,EAAE,SAAS,uBAAuB,EAAE,CAAA;CACjE;AAED,MAAM,WAAW,gCAAiC,SAAQ,2BAA2B;IACnF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CACpC;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,mBAAmB,EAAE,SAAS,uBAAuB,EAAE,CAAA;IAChE,sFAAsF;IACtF,QAAQ,CAAC,eAAe,EAAE;QACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;KACzB,CAAA;CACF;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,MAAM,mCAAmC,GAC3C;IACE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CACjC,GACD;IACE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CACjC,CAAA;AAEL,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,4FAA4F;AAC5F,MAAM,WAAW,oCAAqC,SAAQ,2BAA2B;IACvF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,CAAA;CACxD;AAED,MAAM,WAAW,2BAA4B,SAAQ,2BAA2B;IAC9E,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAC3B;AAED,MAAM,WAAW,wCAAwC;IACvD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAC3B;AAED,MAAM,WAAW,2BAA4B,SAAQ,2BAA2B;IAC9E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAClC;AAED,MAAM,WAAW,uBAAwB,SAAQ,2BAA2B;IAC1E,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,uBAAuB,GAAG,cAAc,CAAA;CACxE;AAED,UAAU,8BAA+B,SAAQ,2BAA2B;IAC1E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAA;IACzC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CACzB;AAED,MAAM,MAAM,0BAA0B,GAClC,CAAC,8BAA8B,GAAG;IAChC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,wBAAwB,CAAA;IAC7C,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CACzB,CAAC,GACF,CAAC,8BAA8B,GAAG;IAChC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;CAC3B,CAAC,GACF,CAAC,8BAA8B,GAAG;IAChC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAA;IACxC,QAAQ,CAAC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,CAAA;IACvD,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CACzB,CAAC,GACF,CAAC,8BAA8B,GAAG;IAChC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,SAAS,uBAAuB,EAAE,CAAA;IACxD,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;CAC1B,CAAC,GACF,CAAC,8BAA8B,GAAG;IAChC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,6BAA6B,CAAA;IAC7C,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;CAC1B,CAAC,GACF,CAAC,8BAA8B,GAAG;IAChC,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,CAAA;IACxC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;CAC1B,CAAC,CAAA;AAEN,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,mBAAmB,EAAE,SAAS,uBAAuB,EAAE,CAAA;CACjE;AAED,MAAM,WAAW,kCAAkC;IACjD,qBAAqB,CACnB,KAAK,EAAE,mCAAmC,GACzC,OAAO,CAAC,oCAAoC,CAAC,CAAA;CACjD;AAED,mGAAmG;AACnG,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,eAAe,EAAE,kCAAkC,CAAA;IAC5D,eAAe,CACb,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,SAAS,uBAAuB,EAAE,CAAC,CAAA;IAC9C,kBAAkB,CAChB,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,iCAAiC,CAAC,CAAA;IAC7C,aAAa,CACX,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,0BAA0B,CAAC,CAAA;IACtC,gBAAgB,CACd,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC,CAAA;IAC7C,0BAA0B,CACxB,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,wCAAwC,GAC9C,OAAO,CAAC,0BAA0B,CAAC,CAAA;IACtC,oBAAoB,CAClB,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,IAAI,CAAC,gCAAgC,EAAE,aAAa,GAAG,UAAU,CAAC,GACxE,OAAO,CAAC,iCAAiC,CAAC,CAAA;IAC7C,gBAAgB,CACd,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,kCAAkC,CAAC,CAAA;IAC9C,kBAAkB,CAChB,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,iCAAiC,CAAC,CAAA;IAC7C,qBAAqB,CACnB,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,mCAAmC,GACzC,OAAO,CAAC,oCAAoC,CAAC,CAAA;IAChD,aAAa,CACX,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,uBAAuB,CAAC,CAAA;IACnC,UAAU,CACR,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAA;IAC1C,mBAAmB,CACjB,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,kCAAkC,CAAC,CAAA;CAC/C"}

package/dist/connectors/connections/credential-codec.d.ts

@@ -0,0 +1,15 @@
+import type { ConnectorCredentialProtector, SealedConnectorCredential } from "../credentials";
+import type { ConnectorOAuthCredentials } from "../types";
+export interface ConnectorCredentialCodecOptions {
+    readonly projectId: string;
+    readonly protector: ConnectorCredentialProtector;
+}
+/** Authenticated serialization boundary for one project's OAuth credential envelopes. */
+export declare class ConnectorCredentialCodec {
+    private readonly options;
+    constructor(options: ConnectorCredentialCodecOptions);
+    seal(connectorId: string, authorizationId: string, credentials: ConnectorOAuthCredentials): Promise<SealedConnectorCredential>;
+    open(connectorId: string, authorizationId: string, credentials: SealedConnectorCredential): Promise<ConnectorOAuthCredentials>;
+    private context;
+}
+//# sourceMappingURL=credential-codec.d.ts.map

package/dist/connectors/connections/credential-codec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-codec.d.ts","sourceRoot":"","sources":["../../../src/connectors/connections/credential-codec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,4BAA4B,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAA;AAC7F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAA;AAMzD,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,4BAA4B,CAAA;CACjD;AAED,yFAAyF;AACzF,qBAAa,wBAAwB;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,+BAA+B;IAErE,IAAI,CACF,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,MAAM,EACvB,WAAW,EAAE,yBAAyB,GACrC,OAAO,CAAC,yBAAyB,CAAC;IAO/B,IAAI,CACR,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,MAAM,EACvB,WAAW,EAAE,yBAAyB,GACrC,OAAO,CAAC,yBAAyB,CAAC;IAQrC,OAAO,CAAC,OAAO;CAQhB"}

package/dist/connectors/connections/credential-mutations.d.ts

@@ -0,0 +1,63 @@
+import type { ClaimConnectorCredentialMutationResult, ConnectorAuthorizationRecord, ConnectorConnectionStorage, ConnectorCredentialMutationKind, ConnectorStagedCredentials } from "../../storage";
+import type { SealedConnectorCredential } from "../credentials";
+import { createConnectorCodedError } from "../errors";
+import type { ConnectorAccountCandidate } from "../types";
+export type ConnectorCredentialMutationClaimOutcome = {
+    readonly type: "claimed";
+    readonly claim: ClaimConnectorCredentialMutationResult;
+} | {
+    readonly type: "superseded";
+    readonly authorization: ConnectorAuthorizationRecord;
+};
+export interface ConnectorCredentialMutationCoordinatorOptions {
+    readonly projectId: string;
+    readonly storage: ConnectorConnectionStorage;
+    readonly leaseDurationMs: number;
+    readonly operationTimeoutMs: number;
+    /** Returns the current host signal; the host may replace its controller after closing. */
+    readonly hostSignal: () => AbortSignal;
+    readonly discoverReauthorizationAccounts: (authorization: ConnectorAuthorizationRecord, staged: ConnectorStagedCredentials) => Promise<readonly ConnectorAccountCandidate[]>;
+    /** Injectable for deterministic tests. A unique value is generated in normal operation. */
+    readonly holderId?: string;
+}
+export interface StageConnectorCredentialMutationInput {
+    readonly credentials: SealedConnectorCredential;
+    readonly credentialExpiresAt?: Date;
+    readonly scopes: readonly string[];
+}
+/**
+ * Coordinates every provider-side OAuth credential mutation.
+ *
+ * Storage owns the durable fence and deadline. This coordinator owns process-local serialization,
+ * lease renewal, provider deadlines, ambiguous-outcome handling, and staged-result finalization.
+ */
+export declare class ConnectorCredentialMutationCoordinator {
+    private readonly projectId;
+    private readonly storage;
+    private readonly leaseDurationMs;
+    private readonly operationTimeoutMs;
+    private readonly hostSignal;
+    private readonly discoverReauthorizationAccounts;
+    private readonly holderId;
+    private readonly localMutationTails;
+    constructor(options: ConnectorCredentialMutationCoordinatorOptions);
+    claimCredentialMutation(connectorId: string, initial: ConnectorAuthorizationRecord, kind: ConnectorCredentialMutationKind, expectedConnectionIds?: readonly string[]): Promise<ConnectorCredentialMutationClaimOutcome>;
+    prepareAuthorizationForMutation(connectorId: string, initial: ConnectorAuthorizationRecord, requestedKind: ConnectorCredentialMutationKind): Promise<ConnectorAuthorizationRecord>;
+    recoverExpiredCredentialMutation(connectorId: string, authorizationId: string): Promise<ConnectorAuthorizationRecord | null>;
+    executeCredentialMutation<T>(authorization: ConnectorAuthorizationRecord, run: (executing: ConnectorAuthorizationRecord, signal: AbortSignal) => Promise<T>): Promise<T>;
+    stageCredentialMutationCredentials(executing: ConnectorAuthorizationRecord, signal: AbortSignal, input: StageConnectorCredentialMutationInput): Promise<ConnectorAuthorizationRecord>;
+    stageCredentialMutationRevocation(executing: ConnectorAuthorizationRecord, signal: AbortSignal): Promise<ConnectorAuthorizationRecord>;
+    withBoundedProviderSignal<T>(run: (signal: AbortSignal) => Promise<T> | T, interruptionError?: () => Error): Promise<T>;
+    finalizeStagedMutation(authorization: ConnectorAuthorizationRecord): Promise<ConnectorAuthorizationRecord>;
+    markNeedsReauthorization(authorization: ConnectorAuthorizationRecord): Promise<ConnectorAuthorizationRecord | null>;
+    releaseCredentialMutation(authorization: ConnectorAuthorizationRecord): Promise<boolean>;
+    requireStableActiveAuthorization(connectorId: string, authorizationId: string): Promise<ConnectorAuthorizationRecord>;
+    assertAttachedConnections(connectorId: string, authorizationId: string, expectedConnectionIds: readonly string[]): Promise<void>;
+    runLocallySerialized<T>(authorizationId: string, run: () => Promise<T>): Promise<T>;
+    isStagedMutation(authorization: ConnectorAuthorizationRecord, claimed: ConnectorAuthorizationRecord, kind: ConnectorCredentialMutationKind): boolean;
+    private withCredentialMutationSignal;
+    private requireAuthorization;
+}
+export declare function assertCredentialMutationOperationActive(signal: AbortSignal): void;
+export declare function connectorAuthorizationStatusError(status: ConnectorAuthorizationRecord["status"]): ReturnType<typeof createConnectorCodedError>;
+//# sourceMappingURL=credential-mutations.d.ts.map

package/dist/connectors/connections/credential-mutations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-mutations.d.ts","sourceRoot":"","sources":["../../../src/connectors/connections/credential-mutations.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,sCAAsC,EACtC,4BAA4B,EAC5B,0BAA0B,EAC1B,+BAA+B,EAC/B,0BAA0B,EAC3B,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAA;AAC/D,OAAO,EAEL,yBAAyB,EAK1B,MAAM,WAAW,CAAA;AAClB,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAA;AAQzD,MAAM,MAAM,uCAAuC,GAC/C;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,KAAK,EAAE,sCAAsC,CAAA;CACvD,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;IAC3B,QAAQ,CAAC,aAAa,EAAE,4BAA4B,CAAA;CACrD,CAAA;AAEL,MAAM,WAAW,6CAA6C;IAC5D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAA;IAC5C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IACnC,0FAA0F;IAC1F,QAAQ,CAAC,UAAU,EAAE,MAAM,WAAW,CAAA;IACtC,QAAQ,CAAC,+BAA+B,EAAE,CACxC,aAAa,EAAE,4BAA4B,EAC3C,MAAM,EAAE,0BAA0B,KAC/B,OAAO,CAAC,SAAS,yBAAyB,EAAE,CAAC,CAAA;IAClD,2FAA2F;IAC3F,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,WAAW,EAAE,yBAAyB,CAAA;IAC/C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CACnC;AAED;;;;;GAKG;AACH,qBAAa,sCAAsC;IACjD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4B;IACpD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAQ;IACxC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAQ;IAC3C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,+BAA+B,CAGE;IAClD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;IACjC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAmC;gBAE1D,OAAO,EAAE,6CAA6C;IAgB5D,uBAAuB,CAC3B,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,4BAA4B,EACrC,IAAI,EAAE,+BAA+B,EACrC,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,GACxC,OAAO,CAAC,uCAAuC,CAAC;IA4D7C,+BAA+B,CACnC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,4BAA4B,EACrC,aAAa,EAAE,+BAA+B,GAC7C,OAAO,CAAC,4BAA4B,CAAC;IAiBlC,gCAAgC,CACpC,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC;IAYzC,yBAAyB,CAAC,CAAC,EAC/B,aAAa,EAAE,4BAA4B,EAC3C,GAAG,EAAE,CAAC,SAAS,EAAE,4BAA4B,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,GAChF,OAAO,CAAC,CAAC,CAAC;IAmBP,kCAAkC,CACtC,SAAS,EAAE,4BAA4B,EACvC,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,qCAAqC,GAC3C,OAAO,CAAC,4BAA4B,CAAC;IAmBlC,iCAAiC,CACrC,SAAS,EAAE,4BAA4B,EACvC,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,4BAA4B,CAAC;IAclC,yBAAyB,CAAC,CAAC,EAC/B,GAAG,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EAC5C,iBAAiB,GAAE,MAAM,KAA6C,GACrE,OAAO,CAAC,CAAC,CAAC;IAQP,sBAAsB,CAC1B,aAAa,EAAE,4BAA4B,GAC1C,OAAO,CAAC,4BAA4B,CAAC;IAoElC,wBAAwB,CAC5B,aAAa,EAAE,4BAA4B,GAC1C,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC;IAQzC,yBAAyB,CAAC,aAAa,EAAE,4BAA4B,GAAG,OAAO,CAAC,OAAO,CAAC;IAYxF,gCAAgC,CACpC,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,4BAA4B,CAAC;IA4BlC,yBAAyB,CAC7B,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,MAAM,EACvB,qBAAqB,EAAE,SAAS,MAAM,EAAE,GACvC,OAAO,CAAC,IAAI,CAAC;IAoBV,oBAAoB,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAiBzF,gBAAgB,CACd,aAAa,EAAE,4BAA4B,EAC3C,OAAO,EAAE,4BAA4B,EACrC,IAAI,EAAE,+BAA+B,GACpC,OAAO;YAUI,4BAA4B;YAkD5B,oBAAoB;CAqBnC;AAED,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAEjF;AAED,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,4BAA4B,CAAC,QAAQ,CAAC,GAC7C,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAuB9C"}

package/dist/connectors/connections/execution.d.ts

@@ -0,0 +1,20 @@
+import type { ExecutionContext } from "../../execution/types";
+import type { SixbRuntimeContext } from "../../runtime/types";
+import type { AddConnectorConnectionInput, CompleteConnectorAuthorizationInput, CompleteConnectorAuthorizationResult, ConnectorConnectionProcess, ConnectorConnectionRunView, ConnectorConnectionView, RevokeConnectorAuthorizationResult, SelectConnectorAccountInput, SelectConnectorConnectionRunAccountInput, StartConnectorAuthorizationInput, StartConnectorAuthorizationResult, StartConnectorConnectionRunInput, StartConnectorConnectionRunResult } from "./contracts";
+/** Internal connector-connection lifecycle API bound to one authenticated request execution. */
+export interface ConnectorConnectionsRuntime {
+    listConnections(connectorId: string): Promise<readonly ConnectorConnectionView[]>;
+    startConnectionRun(connectorId: string, input: StartConnectorConnectionRunInput): Promise<StartConnectorConnectionRunResult>;
+    addConnection(connectorId: string, input: AddConnectorConnectionInput): Promise<ConnectorConnectionRunView>;
+    getConnectionRun(connectorId: string, runId: string): Promise<ConnectorConnectionRunView | null>;
+    selectConnectionRunAccount(connectorId: string, input: SelectConnectorConnectionRunAccountInput): Promise<ConnectorConnectionRunView>;
+    startReauthorization(connectorId: string, connectionId: string, input: Pick<StartConnectorConnectionRunInput, "redirectUri" | "returnTo">): Promise<StartConnectorConnectionRunResult>;
+    revokeConnection(connectorId: string, connectionId: string): Promise<RevokeConnectorAuthorizationResult>;
+    startAuthorization(connectorId: string, input: StartConnectorAuthorizationInput): Promise<StartConnectorAuthorizationResult>;
+    completeAuthorization(connectorId: string, input: CompleteConnectorAuthorizationInput): Promise<CompleteConnectorAuthorizationResult>;
+    selectAccount(connectorId: string, input: SelectConnectorAccountInput): Promise<ConnectorConnectionView>;
+    disconnect(connectorId: string, connectionId: string): Promise<ConnectorConnectionView | null>;
+    revokeAuthorization(connectorId: string, authorizationId: string): Promise<RevokeConnectorAuthorizationResult>;
+}
+export declare function createConnectorConnectionsRuntime(runtime: SixbRuntimeContext, execution: ExecutionContext, process: ConnectorConnectionProcess): ConnectorConnectionsRuntime;
+//# sourceMappingURL=execution.d.ts.map

package/dist/connectors/connections/execution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution.d.ts","sourceRoot":"","sources":["../../../src/connectors/connections/execution.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAC7D,OAAO,KAAK,EACV,2BAA2B,EAC3B,mCAAmC,EACnC,oCAAoC,EAEpC,0BAA0B,EAC1B,0BAA0B,EAC1B,uBAAuB,EACvB,kCAAkC,EAClC,2BAA2B,EAC3B,wCAAwC,EACxC,gCAAgC,EAChC,iCAAiC,EACjC,gCAAgC,EAChC,iCAAiC,EAClC,MAAM,aAAa,CAAA;AAEpB,gGAAgG;AAChG,MAAM,WAAW,2BAA2B;IAC1C,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,uBAAuB,EAAE,CAAC,CAAA;IACjF,kBAAkB,CAChB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,iCAAiC,CAAC,CAAA;IAC7C,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,0BAA0B,CAAC,CAAA;IACtC,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC,CAAA;IAChG,0BAA0B,CACxB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,wCAAwC,GAC9C,OAAO,CAAC,0BAA0B,CAAC,CAAA;IACtC,oBAAoB,CAClB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,IAAI,CAAC,gCAAgC,EAAE,aAAa,GAAG,UAAU,CAAC,GACxE,OAAO,CAAC,iCAAiC,CAAC,CAAA;IAC7C,gBAAgB,CACd,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,kCAAkC,CAAC,CAAA;IAC9C,kBAAkB,CAChB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,iCAAiC,CAAC,CAAA;IAC7C,qBAAqB,CACnB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,mCAAmC,GACzC,OAAO,CAAC,oCAAoC,CAAC,CAAA;IAChD,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,uBAAuB,CAAC,CAAA;IACnC,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAA;IAC9F,mBAAmB,CACjB,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,kCAAkC,CAAC,CAAA;CAC/C;AAED,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,kBAAkB,EAC3B,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE,0BAA0B,GAClC,2BAA2B,CA6B7B"}

package/dist/connectors/connections/internal.d.ts

@@ -0,0 +1,5 @@
+export { isOAuthConnectorDefinition } from "../types";
+export { getConnectorConnectionCallbackProcess, getConnectorConnectionsRuntime, } from "./capability";
+export type { AddConnectorConnectionInput, CompleteConnectorConnectionRunInput, CompleteConnectorConnectionRunResult, ConnectorConnectionRunView, ConnectorConnectionView, RevokeConnectorAuthorizationResult, SelectConnectorConnectionRunAccountInput, StartConnectorConnectionRunInput, StartConnectorConnectionRunResult, } from "./contracts";
+export type { ConnectorConnectionsRuntime } from "./execution";
+//# sourceMappingURL=internal.d.ts.map

package/dist/connectors/connections/internal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../../../src/connectors/connections/internal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAA;AACrD,OAAO,EACL,qCAAqC,EACrC,8BAA8B,GAC/B,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,2BAA2B,EAC3B,mCAAmC,EACnC,oCAAoC,EACpC,0BAA0B,EAC1B,uBAAuB,EACvB,kCAAkC,EAClC,wCAAwC,EACxC,gCAAgC,EAChC,iCAAiC,GAClC,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA"}

package/dist/connectors/connections/internal.js

@@ -0,0 +1,16 @@
+// @bun
+import {
+  isOAuthConnectorDefinition
+} from "../../chunk-8m5ejdpn.js";
+import {
+  getConnectorConnectionCallbackProcess,
+  getConnectorConnectionsRuntime
+} from "../../chunk-nf4r78r4.js";
+import"../../chunk-y64skrwp.js";
+export {
+  isOAuthConnectorDefinition,
+  getConnectorConnectionsRuntime,
+  getConnectorConnectionCallbackProcess
+};
+
+//# debugId=EA5CF4070494D18664756E2164756E21

package/dist/connectors/connections/internal.js.map

@@ -0,0 +1,9 @@
+{
+  "version": 3,
+  "sources": [],
+  "sourcesContent": [
+  ],
+  "mappings": "",
+  "debugId": "EA5CF4070494D18664756E2164756E21",
+  "names": []
+}

package/dist/connectors/connections/provider-operation.d.ts

@@ -0,0 +1,7 @@
+export interface BoundedConnectorProviderOperationOptions {
+    readonly hostSignal: AbortSignal;
+    readonly timeoutMs: number;
+}
+/** Bound one provider call to both the current host lifetime and an explicit deadline. */
+export declare function runBoundedConnectorProviderOperation<T>(options: BoundedConnectorProviderOperationOptions, run: (signal: AbortSignal) => Promise<T> | T, interruptionError?: () => Error): Promise<T>;
+//# sourceMappingURL=provider-operation.d.ts.map

package/dist/connectors/connections/provider-operation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-operation.d.ts","sourceRoot":"","sources":["../../../src/connectors/connections/provider-operation.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,wCAAwC;IACvD,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAA;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,0FAA0F;AAC1F,wBAAsB,oCAAoC,CAAC,CAAC,EAC1D,OAAO,EAAE,wCAAwC,EACjD,GAAG,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EAC5C,iBAAiB,GAAE,MAAM,KAA6C,GACrE,OAAO,CAAC,CAAC,CAAC,CAwBZ"}

package/dist/connectors/connections/request.d.ts

@@ -0,0 +1,84 @@
+import type { AuthorizablePrincipal } from "../../execution";
+import type { ConnectorAuthorizationAttemptRecord, ConnectorAuthorizationRecord, ConnectorConnectionRecord, CreateConnectorAuthorizationAttemptInput, Storage } from "../../storage";
+import type { ConnectorCredentialProtector } from "../credentials";
+import type { ConnectorDefinition, OAuthConnectorAdapter } from "../types";
+import { type ConnectorConnectionCommandActor } from "./command-context";
+import type { CompleteConnectorAuthorizationInput, CompleteConnectorAuthorizationResult, ConnectorConnectionCommandContext, ConnectorConnectionView, StartConnectorAuthorizationInput, StartConnectorAuthorizationResult } from "./contracts";
+type OAuthConnectorDefinition = ConnectorDefinition<string, OAuthConnectorAdapter>;
+export type ResolveOAuthConnectorDefinition = (connectorId: string) => OAuthConnectorDefinition;
+export interface PrepareConnectorReauthorizationInput {
+    readonly definition: OAuthConnectorDefinition;
+    readonly authorizationId: string;
+    readonly principal: AuthorizablePrincipal;
+}
+export interface PreparedConnectorReauthorization {
+    readonly authorization: ConnectorAuthorizationRecord;
+    readonly connections: readonly ConnectorConnectionRecord[];
+}
+export interface CompleteNewConnectorAuthorizationInput {
+    readonly definition: OAuthConnectorDefinition;
+    readonly principal: AuthorizablePrincipal;
+    readonly code: string;
+    readonly codeVerifier: string;
+    readonly redirectUri: string;
+    /** Called immediately after the encrypted grant is durable, before account discovery. */
+    readonly onAuthorizationPersisted?: (authorization: ConnectorAuthorizationRecord) => Promise<void>;
+}
+export interface CompleteConnectorReauthorizationInput extends CompleteNewConnectorAuthorizationInput {
+    readonly authorizationId: string;
+    readonly expectedRevision: number;
+    readonly expectedConnectionIds: readonly string[];
+}
+/** Grant lifecycle required after an OAuth request has proved its state and initiating actor. */
+export interface ConnectorAuthorizationLifecycle {
+    prepareReauthorization(input: PrepareConnectorReauthorizationInput): Promise<PreparedConnectorReauthorization>;
+    completeNewAuthorization(input: CompleteNewConnectorAuthorizationInput): Promise<ConnectorAuthorizationRecord>;
+    completeReauthorization(input: CompleteConnectorReauthorizationInput): Promise<ConnectorAuthorizationRecord>;
+}
+export interface ConnectorAuthorizationRequestHandlerOptions {
+    readonly projectId: string;
+    readonly storage: Storage;
+    readonly credentialProtector: ConnectorCredentialProtector;
+    readonly authorizationAttemptTtlMs: number;
+    readonly providerOperationTimeoutMs: number;
+    readonly resolveDefinition: ResolveOAuthConnectorDefinition;
+    readonly lifecycle: ConnectorAuthorizationLifecycle;
+    /** Returns the current host signal; the host may replace its controller after closing. */
+    readonly hostSignal: () => AbortSignal;
+}
+export interface PreparedConnectorAuthorizationRequest {
+    readonly definition: OAuthConnectorDefinition;
+    readonly actor: ConnectorConnectionCommandActor;
+    readonly state: string;
+    readonly authorizationUrl: string;
+    readonly attempt: CreateConnectorAuthorizationAttemptInput;
+    readonly affectedConnections: readonly ConnectorConnectionView[];
+}
+/** Owns OAuth request state, PKCE, callback binding, and durable attempt provenance. */
+export declare class ConnectorAuthorizationRequestHandler {
+    private readonly projectId;
+    private readonly storage;
+    private readonly credentialProtector;
+    private readonly authorizationAttemptTtlMs;
+    private readonly providerOperationTimeoutMs;
+    private readonly resolveDefinition;
+    private readonly lifecycle;
+    private readonly hostSignal;
+    constructor(options: ConnectorAuthorizationRequestHandlerOptions);
+    startAuthorization(command: ConnectorConnectionCommandContext, connectorId: string, input: StartConnectorAuthorizationInput): Promise<StartConnectorAuthorizationResult>;
+    prepareAuthorizationRequest(command: ConnectorConnectionCommandContext, connectorId: string, input: StartConnectorAuthorizationInput): Promise<PreparedConnectorAuthorizationRequest>;
+    completeAuthorization(command: ConnectorConnectionCommandContext, connectorId: string, input: CompleteConnectorAuthorizationInput): Promise<CompleteConnectorAuthorizationResult>;
+    completeAuthorizationAttempt(input: {
+        readonly definition: OAuthConnectorDefinition;
+        readonly attempt: ConnectorAuthorizationAttemptRecord;
+        readonly principal: AuthorizablePrincipal;
+        readonly code: string;
+        readonly redirectUri: string;
+        readonly onAuthorizationPersisted?: (authorization: ConnectorAuthorizationRecord) => Promise<void>;
+    }): Promise<ConnectorAuthorizationRecord>;
+    private prepareReauthorization;
+    private consumeAuthorizationAttempt;
+    private completeGrant;
+}
+export {};
+//# sourceMappingURL=request.d.ts.map

package/dist/connectors/connections/request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../../src/connectors/connections/request.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAE5D,OAAO,KAAK,EACV,mCAAmC,EACnC,4BAA4B,EAC5B,yBAAyB,EAEzB,wCAAwC,EACxC,OAAO,EACR,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAA;AAQlE,OAAO,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AAC1E,OAAO,EAEL,KAAK,+BAA+B,EAErC,MAAM,mBAAmB,CAAA;AAC1B,OAAO,KAAK,EACV,mCAAmC,EACnC,oCAAoC,EACpC,iCAAiC,EACjC,uBAAuB,EACvB,gCAAgC,EAChC,iCAAiC,EAClC,MAAM,aAAa,CAAA;AAepB,KAAK,wBAAwB,GAAG,mBAAmB,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAA;AAElF,MAAM,MAAM,+BAA+B,GAAG,CAAC,WAAW,EAAE,MAAM,KAAK,wBAAwB,CAAA;AAE/F,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,UAAU,EAAE,wBAAwB,CAAA;IAC7C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAA;CAC1C;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,aAAa,EAAE,4BAA4B,CAAA;IACpD,QAAQ,CAAC,WAAW,EAAE,SAAS,yBAAyB,EAAE,CAAA;CAC3D;AAED,MAAM,WAAW,sCAAsC;IACrD,QAAQ,CAAC,UAAU,EAAE,wBAAwB,CAAA;IAC7C,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAA;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,yFAAyF;IACzF,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC,aAAa,EAAE,4BAA4B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACnG;AAED,MAAM,WAAW,qCACf,SAAQ,sCAAsC;IAC9C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAA;CAClD;AAED,iGAAiG;AACjG,MAAM,WAAW,+BAA+B;IAC9C,sBAAsB,CACpB,KAAK,EAAE,oCAAoC,GAC1C,OAAO,CAAC,gCAAgC,CAAC,CAAA;IAC5C,wBAAwB,CACtB,KAAK,EAAE,sCAAsC,GAC5C,OAAO,CAAC,4BAA4B,CAAC,CAAA;IACxC,uBAAuB,CACrB,KAAK,EAAE,qCAAqC,GAC3C,OAAO,CAAC,4BAA4B,CAAC,CAAA;CACzC;AAED,MAAM,WAAW,2CAA2C;IAC1D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,mBAAmB,EAAE,4BAA4B,CAAA;IAC1D,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAA;IAC1C,QAAQ,CAAC,0BAA0B,EAAE,MAAM,CAAA;IAC3C,QAAQ,CAAC,iBAAiB,EAAE,+BAA+B,CAAA;IAC3D,QAAQ,CAAC,SAAS,EAAE,+BAA+B,CAAA;IACnD,0FAA0F;IAC1F,QAAQ,CAAC,UAAU,EAAE,MAAM,WAAW,CAAA;CACvC;AAED,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,UAAU,EAAE,wBAAwB,CAAA;IAC7C,QAAQ,CAAC,KAAK,EAAE,+BAA+B,CAAA;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE,wCAAwC,CAAA;IAC1D,QAAQ,CAAC,mBAAmB,EAAE,SAAS,uBAAuB,EAAE,CAAA;CACjE;AAED,wFAAwF;AACxF,qBAAa,oCAAoC;IAC/C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA8B;IAClE,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAQ;IAClD,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAQ;IACnD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAiC;IACnE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiC;IAC3D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;gBAElC,OAAO,EAAE,2CAA2C;IAiB1D,kBAAkB,CACtB,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,iCAAiC,CAAC;IAqBvC,2BAA2B,CAC/B,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,qCAAqC,CAAC;IA0F3C,qBAAqB,CACzB,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,mCAAmC,GACzC,OAAO,CAAC,oCAAoC,CAAC;IAuB1C,4BAA4B,CAAC,KAAK,EAAE;QACxC,QAAQ,CAAC,UAAU,EAAE,wBAAwB,CAAA;QAC7C,QAAQ,CAAC,OAAO,EAAE,mCAAmC,CAAA;QACrD,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAA;QACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;QACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;QAC5B,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAClC,aAAa,EAAE,4BAA4B,KACxC,OAAO,CAAC,IAAI,CAAC,CAAA;KACnB,GAAG,OAAO,CAAC,4BAA4B,CAAC;YAa3B,sBAAsB;YA6BtB,2BAA2B;IA0DzC,OAAO,CAAC,aAAa;CA0CtB"}

package/dist/connectors/connections/runs.d.ts

@@ -0,0 +1,51 @@
+import { type Storage } from "../../storage";
+import { type DefaultConnectorAuthorizationLifecycle } from "./authorizations";
+import type { CompleteConnectorConnectionRunInput, CompleteConnectorConnectionRunResult, ConnectorConnectionCommandContext, ConnectorConnectionRunView, SelectConnectorConnectionRunAccountInput, StartConnectorConnectionRunInput, StartConnectorConnectionRunResult } from "./contracts";
+import type { ConnectorAuthorizationRequestHandler, ResolveOAuthConnectorDefinition } from "./request";
+export interface ConnectorConnectionRunServiceOptions {
+    readonly projectId: string;
+    readonly storage: Storage;
+    readonly requestHandler: ConnectorAuthorizationRequestHandler;
+    readonly authorizations: DefaultConnectorAuthorizationLifecycle;
+    readonly resolveDefinition: ResolveOAuthConnectorDefinition;
+    readonly processingTtlMs: number;
+    readonly selectionTtlMs: number;
+    readonly now: () => Date;
+}
+/** Durable orchestration for the user-visible connector connection flow. */
+export declare class ConnectorConnectionRunService {
+    private readonly projectId;
+    private readonly storage;
+    private readonly connectionStorage;
+    private readonly requests;
+    private readonly authorizations;
+    private readonly resolveDefinition;
+    private readonly processingTtlMs;
+    private readonly selectionTtlMs;
+    private readonly now;
+    private readonly maintenanceTimers;
+    constructor(options: ConnectorConnectionRunServiceOptions);
+    startSelection(command: ConnectorConnectionCommandContext, connectorId: string, input: {
+        readonly owner: StartConnectorConnectionRunInput["owner"];
+        readonly slot: string;
+        readonly authorizationId: string;
+    }): Promise<ConnectorConnectionRunView>;
+    start(command: ConnectorConnectionCommandContext, connectorId: string, input: StartConnectorConnectionRunInput): Promise<StartConnectorConnectionRunResult>;
+    complete(input: CompleteConnectorConnectionRunInput): Promise<CompleteConnectorConnectionRunResult>;
+    get(command: ConnectorConnectionCommandContext, connectorId: string, runId: string): Promise<ConnectorConnectionRunView | null>;
+    selectAccount(command: ConnectorConnectionCommandContext, connectorId: string, input: SelectConnectorConnectionRunAccountInput): Promise<ConnectorConnectionRunView>;
+    private claimCallback;
+    private finalizeCompletedRun;
+    private failRun;
+    private cancelRun;
+    private readRun;
+    private assertRunActor;
+    private view;
+    close(): void;
+    private continueRunCleanup;
+    private continuePendingRevocation;
+    private scheduleRunMaintenance;
+    private cancelRunMaintenance;
+    private maintainRun;
+}
+//# sourceMappingURL=runs.d.ts.map

package/dist/connectors/connections/runs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runs.d.ts","sourceRoot":"","sources":["../../../src/connectors/connections/runs.ts"],"names":[],"mappings":"AAGA,OAAO,EAML,KAAK,OAAO,EACb,MAAM,eAAe,CAAA;AAEtB,OAAO,EAEL,KAAK,sCAAsC,EAC5C,MAAM,kBAAkB,CAAA;AAKzB,OAAO,KAAK,EACV,mCAAmC,EACnC,oCAAoC,EACpC,iCAAiC,EACjC,0BAA0B,EAC1B,wCAAwC,EACxC,gCAAgC,EAChC,iCAAiC,EAClC,MAAM,aAAa,CAAA;AACpB,OAAO,KAAK,EACV,oCAAoC,EACpC,+BAA+B,EAChC,MAAM,WAAW,CAAA;AAclB,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,cAAc,EAAE,oCAAoC,CAAA;IAC7D,QAAQ,CAAC,cAAc,EAAE,sCAAsC,CAAA;IAC/D,QAAQ,CAAC,iBAAiB,EAAE,+BAA+B,CAAA;IAC3D,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,IAAI,CAAA;CACzB;AAED,4EAA4E;AAC5E,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA4B;IAC9D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsC;IAC/D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwC;IACvE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAiC;IACnE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAQ;IACxC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAQ;IACvC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAY;IAChC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAmD;gBAEzE,OAAO,EAAE,oCAAoC;IAenD,cAAc,CAClB,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE;QACL,QAAQ,CAAC,KAAK,EAAE,gCAAgC,CAAC,OAAO,CAAC,CAAA;QACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;QACrB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;KACjC,GACA,OAAO,CAAC,0BAA0B,CAAC;IA2BhC,KAAK,CACT,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,iCAAiC,CAAC;IAgDvC,QAAQ,CACZ,KAAK,EAAE,mCAAmC,GACzC,OAAO,CAAC,oCAAoC,CAAC;IAiE1C,GAAG,CACP,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC;IAevC,aAAa,CACjB,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,wCAAwC,GAC9C,OAAO,CAAC,0BAA0B,CAAC;YA8ExB,aAAa;YA2Db,oBAAoB;YA8DpB,OAAO;YAoCP,SAAS;YAwBT,OAAO;YAeP,cAAc;YAiBd,IAAI;IAgDlB,KAAK,IAAI,IAAI;YAKC,kBAAkB;YAiBlB,yBAAyB;IAgBvC,OAAO,CAAC,sBAAsB;IAe9B,OAAO,CAAC,oBAAoB;YAMd,WAAW;CAsB1B"}

package/dist/connectors/connections/service.d.ts

@@ -0,0 +1,52 @@
+import type { ConnectorConnectionRecord, Storage } from "../../storage";
+import { type ConnectorCredentialProtector } from "../credentials";
+import type { ConnectorClient, ConnectorConnectionSelector, ConnectorDefinition, OAuthConnectorAdapter } from "../types";
+import type { AddConnectorConnectionInput, CompleteConnectorAuthorizationInput, CompleteConnectorAuthorizationResult, CompleteConnectorConnectionRunInput, CompleteConnectorConnectionRunResult, ConnectorConnectionCallbackProcess, ConnectorConnectionCommandContext, ConnectorConnectionProcess, ConnectorConnectionRunView, ConnectorConnectionView, RevokeConnectorAuthorizationResult, SelectConnectorAccountInput, SelectConnectorConnectionRunAccountInput, StartConnectorAuthorizationInput, StartConnectorAuthorizationResult, StartConnectorConnectionRunInput, StartConnectorConnectionRunResult } from "./contracts";
+export interface ConnectorConnectionServiceOptions {
+    readonly storage?: Storage;
+    readonly credentialProtector?: ConnectorCredentialProtector;
+    readonly authorizationAttemptTtlMs?: number;
+    readonly accountSelectionTtlMs?: number;
+    readonly credentialMutationLeaseMs?: number;
+    readonly providerOperationTimeoutMs?: number;
+    readonly connectionRunProcessingTtlMs?: number;
+    readonly refreshSkewMs?: number;
+    readonly now?: () => Date;
+}
+/** Process-owned composition of connector connection lookup and OAuth lifecycle state. */
+export declare class ConnectorConnectionService implements ConnectorConnectionProcess {
+    private readonly projectId;
+    private readonly definitionsById;
+    private abortController;
+    private readonly connectionStorage;
+    private readonly providerOperationTimeoutMs;
+    private readonly authorizations;
+    private readonly requests;
+    private readonly runs;
+    readonly callbackProcess: ConnectorConnectionCallbackProcess;
+    constructor(projectId: string, definitions: readonly ConnectorDefinition[], options?: ConnectorConnectionServiceOptions);
+    connectConnection<TAdapter extends OAuthConnectorAdapter>(definition: ConnectorDefinition<string, TAdapter>, selector: ConnectorConnectionSelector): Promise<ConnectorClient<TAdapter>>;
+    /** Snapshot the connected records that one trusted primitive execution may consume. */
+    listExecutionConnections<TAdapter extends OAuthConnectorAdapter>(definition: ConnectorDefinition<string, TAdapter>): Promise<readonly ConnectorConnectionRecord[]>;
+    /** Resolve a client from an immutable connection snapshot captured for one execution. */
+    connectExecutionConnection<TAdapter extends OAuthConnectorAdapter>(definition: ConnectorDefinition<string, TAdapter>, connection: ConnectorConnectionRecord, signal?: AbortSignal): Promise<ConnectorClient<TAdapter>>;
+    listConnections(command: ConnectorConnectionCommandContext, connectorId: string): Promise<readonly ConnectorConnectionView[]>;
+    startConnectionRun(command: ConnectorConnectionCommandContext, connectorId: string, input: StartConnectorConnectionRunInput): Promise<StartConnectorConnectionRunResult>;
+    addConnection(command: ConnectorConnectionCommandContext, connectorId: string, input: AddConnectorConnectionInput): Promise<ConnectorConnectionRunView>;
+    getConnectionRun(command: ConnectorConnectionCommandContext, connectorId: string, runId: string): Promise<ConnectorConnectionRunView | null>;
+    selectConnectionRunAccount(command: ConnectorConnectionCommandContext, connectorId: string, input: SelectConnectorConnectionRunAccountInput): Promise<ConnectorConnectionRunView>;
+    startReauthorization(command: ConnectorConnectionCommandContext, connectorId: string, connectionId: string, input: Pick<StartConnectorConnectionRunInput, "redirectUri" | "returnTo">): Promise<StartConnectorConnectionRunResult>;
+    revokeConnection(command: ConnectorConnectionCommandContext, connectorId: string, connectionId: string): Promise<RevokeConnectorAuthorizationResult>;
+    completeConnectionRun(input: CompleteConnectorConnectionRunInput): Promise<CompleteConnectorConnectionRunResult>;
+    startAuthorization(command: ConnectorConnectionCommandContext, connectorId: string, input: StartConnectorAuthorizationInput): Promise<StartConnectorAuthorizationResult>;
+    completeAuthorization(command: ConnectorConnectionCommandContext, connectorId: string, input: CompleteConnectorAuthorizationInput): Promise<CompleteConnectorAuthorizationResult>;
+    selectAccount(command: ConnectorConnectionCommandContext, connectorId: string, input: SelectConnectorAccountInput): Promise<ConnectorConnectionView>;
+    disconnect(command: ConnectorConnectionCommandContext, connectorId: string, connectionId: string): Promise<ConnectorConnectionView | null>;
+    revokeAuthorization(command: ConnectorConnectionCommandContext, connectorId: string, authorizationId: string): Promise<RevokeConnectorAuthorizationResult>;
+    close(): Promise<void>;
+    private assertOAuthRegistered;
+    private requireOAuthDefinition;
+    private continueRevocationIfPending;
+    private continuePendingRevocation;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/connectors/connections/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/connectors/connections/service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,yBAAyB,EAGzB,OAAO,EACR,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,KAAK,4BAA4B,EAElC,MAAM,gBAAgB,CAAA;AAQvB,OAAO,KAAK,EACV,eAAe,EACf,2BAA2B,EAC3B,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,UAAU,CAAA;AAOjB,OAAO,KAAK,EACV,2BAA2B,EAC3B,mCAAmC,EACnC,oCAAoC,EACpC,mCAAmC,EACnC,oCAAoC,EACpC,kCAAkC,EAClC,iCAAiC,EACjC,0BAA0B,EAC1B,0BAA0B,EAC1B,uBAAuB,EACvB,kCAAkC,EAClC,2BAA2B,EAC3B,wCAAwC,EACxC,gCAAgC,EAChC,iCAAiC,EACjC,gCAAgC,EAChC,iCAAiC,EAClC,MAAM,aAAa,CAAA;AAepB,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,mBAAmB,CAAC,EAAE,4BAA4B,CAAA;IAC3D,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,CAAA;IAC3C,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAA;IACvC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,CAAA;IAC3C,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAA;IAC5C,QAAQ,CAAC,4BAA4B,CAAC,EAAE,MAAM,CAAA;IAC9C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;CAC1B;AAED,0FAA0F;AAC1F,qBAAa,0BAA2B,YAAW,0BAA0B;IAWzE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAV5B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0C;IAC1E,OAAO,CAAC,eAAe,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA4B;IAC9D,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAQ;IACnD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwC;IACvE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsC;IAC/D,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA+B;IACpD,QAAQ,CAAC,eAAe,EAAE,kCAAkC,CAAA;gBAGzC,SAAS,EAAE,MAAM,EAClC,WAAW,EAAE,SAAS,mBAAmB,EAAE,EAC3C,OAAO,GAAE,iCAAsC;IAwD3C,iBAAiB,CAAC,QAAQ,SAAS,qBAAqB,EAC5D,UAAU,EAAE,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,EACjD,QAAQ,EAAE,2BAA2B,GACpC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IAsBrC,uFAAuF;IACjF,wBAAwB,CAAC,QAAQ,SAAS,qBAAqB,EACnE,UAAU,EAAE,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,GAChD,OAAO,CAAC,SAAS,yBAAyB,EAAE,CAAC;IAehD,yFAAyF;IACnF,0BAA0B,CAAC,QAAQ,SAAS,qBAAqB,EACrE,UAAU,EAAE,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,EACjD,UAAU,EAAE,yBAAyB,EACrC,MAAM,GAAE,WAAyC,GAChD,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IAiD/B,eAAe,CACnB,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,SAAS,uBAAuB,EAAE,CAAC;IAgC9C,kBAAkB,CAChB,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,iCAAiC,CAAC;IAIvC,aAAa,CACjB,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,0BAA0B,CAAC;IAkCtC,gBAAgB,CACd,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC;IAK7C,0BAA0B,CACxB,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,wCAAwC,GAC9C,OAAO,CAAC,0BAA0B,CAAC;IAIhC,oBAAoB,CACxB,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,IAAI,CAAC,gCAAgC,EAAE,aAAa,GAAG,UAAU,CAAC,GACxE,OAAO,CAAC,iCAAiC,CAAC;IA8BvC,gBAAgB,CACpB,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,kCAAkC,CAAC;IAkB9C,qBAAqB,CACnB,KAAK,EAAE,mCAAmC,GACzC,OAAO,CAAC,oCAAoC,CAAC;IAIhD,kBAAkB,CAChB,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,iCAAiC,CAAC;IAI7C,qBAAqB,CACnB,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,mCAAmC,GACzC,OAAO,CAAC,oCAAoC,CAAC;IAI1C,aAAa,CACjB,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,uBAAuB,CAAC;IAwD7B,UAAU,CACd,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IA8BpC,mBAAmB,CACvB,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,kCAAkC,CAAC;IAmBxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAM5B,OAAO,CAAC,qBAAqB;IAY7B,OAAO,CAAC,sBAAsB;YAgBhB,2BAA2B;YAY3B,yBAAyB;CAWxC"}

package/dist/connectors/connections/storage-boundary.d.ts

@@ -0,0 +1,3 @@
+/** Converts raw connector-storage failures before they can cross a Core boundary. */
+export declare function withConnectorStorageBoundary<T>(message: string, operation: () => Promise<T>): Promise<T>;
+//# sourceMappingURL=storage-boundary.d.ts.map

package/dist/connectors/connections/storage-boundary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-boundary.d.ts","sourceRoot":"","sources":["../../../src/connectors/connections/storage-boundary.ts"],"names":[],"mappings":"AAEA,qFAAqF;AACrF,wBAAsB,4BAA4B,CAAC,CAAC,EAClD,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAC1B,OAAO,CAAC,CAAC,CAAC,CAMZ"}

package/dist/connectors/connections/tokens.d.ts

@@ -0,0 +1,32 @@
+import type { ConnectorAuthorizationRecord, ConnectorConnectionStorage } from "../../storage";
+import type { ConnectorDefinition, ConnectorTokenSource, OAuthConnectorAdapter } from "../types";
+import type { ConnectorCredentialCodec } from "./credential-codec";
+import { type ConnectorCredentialMutationCoordinator } from "./credential-mutations";
+type OAuthConnectorDefinition = ConnectorDefinition<string, OAuthConnectorAdapter>;
+export interface ConnectorTokenAccessOptions {
+    readonly projectId: string;
+    readonly storage: ConnectorConnectionStorage;
+    readonly credentials: ConnectorCredentialCodec;
+    readonly mutations: ConnectorCredentialMutationCoordinator;
+    readonly refreshSkewMs: number;
+    readonly now: () => Date;
+}
+/** Owns revision-aware access-token delivery and refresh. */
+export declare class ConnectorTokenAccess {
+    private readonly projectId;
+    private readonly storage;
+    private readonly credentials;
+    private readonly mutations;
+    private readonly refreshSkewMs;
+    private readonly now;
+    constructor(options: ConnectorTokenAccessOptions);
+    requireStableActiveAuthorization(definition: OAuthConnectorDefinition, authorizationId: string): Promise<ConnectorAuthorizationRecord>;
+    createTokenSource(definition: OAuthConnectorDefinition, authorizationId: string): ConnectorTokenSource;
+    private open;
+    private getAccessToken;
+    private refreshAuthorization;
+    private requireAuthorization;
+    private adapterContext;
+}
+export {};
+//# sourceMappingURL=tokens.d.ts.map

package/dist/connectors/connections/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../../src/connectors/connections/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAA;AAE7F,OAAO,KAAK,EAEV,mBAAmB,EAEnB,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,UAAU,CAAA;AACjB,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AAClE,OAAO,EAEL,KAAK,sCAAsC,EAE5C,MAAM,wBAAwB,CAAA;AAI/B,KAAK,wBAAwB,GAAG,mBAAmB,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAA;AAElF,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAA;IAC5C,QAAQ,CAAC,WAAW,EAAE,wBAAwB,CAAA;IAC9C,QAAQ,CAAC,SAAS,EAAE,sCAAsC,CAAA;IAC1D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,IAAI,CAAA;CACzB;AAED,6DAA6D;AAC7D,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4B;IACpD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA0B;IACtD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAQ;IACtC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAY;gBAEpB,OAAO,EAAE,2BAA2B;IAShD,gCAAgC,CAC9B,UAAU,EAAE,wBAAwB,EACpC,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,4BAA4B,CAAC;IAIxC,iBAAiB,CACf,UAAU,EAAE,wBAAwB,EACpC,eAAe,EAAE,MAAM,GACtB,oBAAoB;IAMvB,OAAO,CAAC,IAAI;YAaE,cAAc;YAuBd,oBAAoB;YA4IpB,oBAAoB;IAsBlC,OAAO,CAAC,cAAc;CAGvB"}

package/dist/connectors/connections/validation.d.ts

@@ -0,0 +1,27 @@
+import type { ConnectorAuthorizationRecord } from "../../storage";
+import type { ConnectorAccountCandidate, ConnectorOAuthCredentials } from "../types";
+/** Internal validation and normalization shared by the connector connection lifecycle. */
+type ConnectorValidationErrorCode = "connector.adapter_invalid" | "connector.authorization_invalid" | "connector.configuration_invalid";
+export declare function validateCredentials(credentials: ConnectorOAuthCredentials): ConnectorOAuthCredentials;
+export declare function validateAccounts(accounts: readonly ConnectorAccountCandidate[]): readonly ConnectorAccountCandidate[];
+export declare function serializeCredentials(credentials: ConnectorOAuthCredentials): string;
+export declare function parseCredentials(serialized: string): ConnectorOAuthCredentials;
+export declare function shouldRefresh(authorization: ConnectorAuthorizationRecord, now: Date, skewMs: number): boolean;
+export declare function tokenView(credentials: ConnectorOAuthCredentials): {
+    tokenType?: string | undefined;
+    accessToken: string;
+};
+export declare function parseAttemptId(state: string): string;
+export declare function hashSecret(value: string): string;
+export declare function normalizedHttpUrl(value: string | URL, field: string, code?: ConnectorValidationErrorCode): string;
+export declare function assertAuthorizationUrlParameters(authorizationUrl: string, expected: {
+    readonly state: string;
+    readonly codeChallenge: string;
+}): void;
+export declare function nonblank(value: unknown, field: string, code?: ConnectorValidationErrorCode): string;
+export declare function positiveDuration(value: number, field: string): number;
+export declare function nonNegativeDuration(value: number, field: string): number;
+export declare function delay(milliseconds: number): Promise<void>;
+export declare function sameIds(left: readonly string[], right: readonly string[]): boolean;
+export {};
+//# sourceMappingURL=validation.d.ts.map

package/dist/connectors/connections/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../src/connectors/connections/validation.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAA;AAEjE,OAAO,KAAK,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAA;AAEpF,0FAA0F;AAE1F,KAAK,4BAA4B,GAC7B,2BAA2B,GAC3B,iCAAiC,GACjC,iCAAiC,CAAA;AAErC,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,yBAAyB,GACrC,yBAAyB,CAiE3B;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,SAAS,yBAAyB,EAAE,GAC7C,SAAS,yBAAyB,EAAE,CA0CtC;AAED,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,yBAAyB,GAAG,MAAM,CAWnF;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,yBAAyB,CA6C9E;AAED,wBAAgB,aAAa,CAC3B,aAAa,EAAE,4BAA4B,EAC3C,GAAG,EAAE,IAAI,EACT,MAAM,EAAE,MAAM,GACb,OAAO,CAKT;AAED,wBAAgB,SAAS,CAAC,WAAW,EAAE,yBAAyB;;;EAK/D;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMpD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,GAAG,GAAG,EACnB,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,4BAAgE,GACrE,MAAM,CAeR;AAED,wBAAgB,gCAAgC,CAC9C,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GACnE,IAAI,CAYN;AAED,wBAAgB,QAAQ,CACtB,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,4BAAgE,GACrE,MAAM,CAKR;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAQrE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAQxE;AAED,wBAAgB,KAAK,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzD;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAOlF"}