@sixb/core 0.1.9 → 0.1.10

package/dist/{chunk-52hbv0ak.js → chunk-r7fj830t.js}

@@ -5,7 +5,7 @@ import {
 import {
   ProjectionRegistry2,
   createOntologyMaterializer2
-} from "./chunk-an5tt9y0.js";
+} from "./chunk-ftv470j8.js";
 import {
   captureSixbFailure2,
   isSixbError2
@@ -31,24 +31,24 @@ import {
 import {
   isMigrationCapableStorage2,
   checkStorageSchema2
-} from "./chunk-mjbk2djy.js";
+} from "./chunk-p6a4npdx.js";
 import {
   createAuthorizedObjectReader
-} from "./chunk-ypbtykv6.js";
+} from "./chunk-nmbxcaqx.js";
 import {
   attachSixbErrorReporter2,
   shareSixbErrorReporter2
 } from "./chunk-7apz6hg4.js";
 import {
   ActionRegistry2
-} from "./chunk-vf691g1r.js";
+} from "./chunk-p5vcsw9c.js";
 import {
   assertDatasetDefinition2
 } from "./chunk-860dwwy0.js";
 import {
   OntologyOutboxDispatcher2,
   createDomainEventService2
-} from "./chunk-3tgwrcyh.js";
+} from "./chunk-nt99sxd6.js";
 import {
   validateSchedulesAtStartup2
 } from "./chunk-e1c18xjx.js";
@@ -62,9 +62,8 @@ import {
   providerBoundaryError,
   isConnectorStorageError,
   storageBoundaryError,
-  recoverConnectorFailure,
-  SyncValidationError2
-} from "./chunk-emyyk7dx.js";
+  recoverConnectorFailure
+} from "./chunk-v2vcg0w6.js";
 import {
   toolsFromProjectConfig
 } from "./chunk-skz0hst3.js";
@@ -73,14 +72,14 @@ import {
   validateWorkflowsAtStartup2,
   validateWorkflowAgentStepGroupReferences2,
   createBoundSixb
-} from "./chunk-hpr1r6av.js";
+} from "./chunk-5p1v802y.js";
 import {
   registerConnectorConnectionCallbackProcess
 } from "./chunk-5a4a52tq.js";
 import {
   registerOntologyMutationRuntime2,
   createOntologyMutationRuntime2
-} from "./chunk-zcnq6105.js";
+} from "./chunk-85cd7e8c.js";
 import {
   SchedulerRuntime2
 } from "./chunk-z5rnrmz1.js";
@@ -89,17 +88,19 @@ import {
   validateSharesAtStartup,
   discoverOntologySources2,
   discoverProjectDefinitions2
-} from "./chunk-r4tfx1sf.js";
+} from "./chunk-agbbygvh.js";
 import {
   LoggingService2
-} from "./chunk-kxwa347f.js";
+} from "./chunk-3qms4nax.js";
 import {
   registerProjectionRegistry2
-} from "./chunk-k3cqkkn2.js";
+} from "./chunk-1824gssz.js";
+import {
+  SyncValidationError2
+} from "./chunk-5c7ga8zz.js";
 import {
-  isOAuthConnectorDefinition2,
-  isStaticConnectorDefinition
-} from "./chunk-3f7veca0.js";
+  isOAuthConnectorDefinition2
+} from "./chunk-9x8dybsb.js";
 import {
   ensureExecutionRecord2
 } from "./chunk-17kfctj6.js";
@@ -110,6 +111,9 @@ import {
 import {
   reportEventDeliveryFailure3
 } from "./chunk-72w2pxk7.js";
+import {
+  isJsonObject2
+} from "./chunk-wy0qdqfm.js";
 // src/webhooks/errors.ts
 class WebhookValidationError2 extends Error {
   name = "WebhookValidationError";
@@ -245,8 +249,6 @@ class WebhookRegistry {
   constructor(options) {
     const registered = [];
     for (const connector of options.connectors) {
-      if (!isStaticConnectorDefinition(connector))
-        continue;
       const webhooks = connector.adapter.webhooks ?? [];
       if (!Array.isArray(webhooks)) {
         throw new WebhookValidationError2(`[Sixb] Connector '${connector.id}' webhooks must be an array when provided.`);
@@ -467,6 +469,12 @@ function validateCredentials(credentials) {
     }
     normalized.expiresAt = new Date(credentials.expiresAt);
   }
+  if (credentials.authorizationContext !== undefined) {
+    if (!isJsonObject2(credentials.authorizationContext)) {
+      throw createConnectorCodedError("connector.adapter_invalid", "OAuth connector adapter returned invalid authorization context; expected a JSON object.");
+    }
+    normalized.authorizationContext = structuredClone(credentials.authorizationContext);
+  }
   return normalized;
 }
 function validateAccounts(accounts) {
@@ -500,7 +508,8 @@ function serializeCredentials(credentials) {
     ...credentials.refreshToken === undefined ? {} : { refreshToken: credentials.refreshToken },
     ...credentials.tokenType === undefined ? {} : { tokenType: credentials.tokenType },
     ...credentials.scopes === undefined ? {} : { scopes: credentials.scopes },
-    ...credentials.expiresAt === undefined ? {} : { expiresAt: credentials.expiresAt.toISOString() }
+    ...credentials.expiresAt === undefined ? {} : { expiresAt: credentials.expiresAt.toISOString() },
+    ...credentials.authorizationContext === undefined ? {} : { authorizationContext: credentials.authorizationContext }
   });
 }
 function parseCredentials(serialized) {
@@ -513,7 +522,7 @@ function parseCredentials(serialized) {
   if (!isRecord2(value) || value.version !== 1 || typeof value.accessToken !== "string") {
     throw createConnectorCodedError("connector.credentials_unavailable", "Stored connector credentials are invalid.");
   }
-  if (value.refreshToken !== undefined && typeof value.refreshToken !== "string" || value.tokenType !== undefined && typeof value.tokenType !== "string" || value.scopes !== undefined && (!Array.isArray(value.scopes) || value.scopes.some((scope) => typeof scope !== "string")) || value.expiresAt !== undefined && typeof value.expiresAt !== "string") {
+  if (value.refreshToken !== undefined && typeof value.refreshToken !== "string" || value.tokenType !== undefined && typeof value.tokenType !== "string" || value.scopes !== undefined && (!Array.isArray(value.scopes) || value.scopes.some((scope) => typeof scope !== "string")) || value.expiresAt !== undefined && typeof value.expiresAt !== "string" || value.authorizationContext !== undefined && !isJsonObject2(value.authorizationContext)) {
     throw createConnectorCodedError("connector.credentials_unavailable", "Stored connector credentials are invalid.");
   }
   const expiresAt = value.expiresAt === undefined ? undefined : new Date(value.expiresAt);
@@ -523,7 +532,8 @@ function parseCredentials(serialized) {
       ...value.refreshToken === undefined ? {} : { refreshToken: value.refreshToken },
       ...value.tokenType === undefined ? {} : { tokenType: value.tokenType },
       ...value.scopes === undefined ? {} : { scopes: value.scopes },
-      ...expiresAt === undefined ? {} : { expiresAt }
+      ...expiresAt === undefined ? {} : { expiresAt },
+      ...value.authorizationContext === undefined ? {} : { authorizationContext: value.authorizationContext }
     });
   } catch (error) {
     throw createConnectorCodedError("connector.credentials_unavailable", "Stored connector credentials are invalid.", { cause: error });
@@ -567,9 +577,44 @@ function normalizedHttpUrl(value, field, code = "connector.configuration_invalid
 }
 function assertAuthorizationUrlParameters(authorizationUrl, expected) {
   const parameters = new URL(authorizationUrl).searchParams;
-  if (!sameSingleParameter(parameters, "state", expected.state) || !sameSingleParameter(parameters, "code_challenge", expected.codeChallenge) || !sameSingleParameter(parameters, "code_challenge_method", "S256")) {
-    throw createConnectorCodedError("connector.adapter_invalid", "OAuth connector authorization URL must preserve the framework-provided state and PKCE S256 parameters.");
-  }
+  if (!sameSingleParameter(parameters, "state", expected.state) || (expected.codeChallenge === undefined ? parameters.has("code_challenge") || parameters.has("code_challenge_method") : !sameSingleParameter(parameters, "code_challenge", expected.codeChallenge) || !sameSingleParameter(parameters, "code_challenge_method", "S256"))) {
+    throw createConnectorCodedError("connector.adapter_invalid", expected.codeChallenge === undefined ? "OAuth connector authorization URL must preserve the framework-provided state and omit disabled PKCE parameters." : "OAuth connector authorization URL must preserve the framework-provided state and PKCE S256 parameters.");
+  }
+}
+function connectorPkceEnabled(pkce) {
+  if (pkce === undefined || pkce === "S256")
+    return true;
+  if (pkce === "disabled")
+    return false;
+  throw createConnectorCodedError("connector.adapter_invalid", "OAuth connector PKCE must be S256 or disabled.");
+}
+var reservedCallbackParameters = new Set([
+  "state",
+  "code",
+  "auth_code",
+  "error",
+  "error_description",
+  "error_uri"
+]);
+function validateCallbackParameterNames(names = []) {
+  if (!Array.isArray(names) || names.some((name) => typeof name !== "string" || !/^[A-Za-z_][A-Za-z0-9_.-]*$/.test(name) || reservedCallbackParameters.has(name)) || new Set(names).size !== names.length) {
+    throw createConnectorCodedError("connector.adapter_invalid", "OAuth callback parameter names must be unique, non-reserved parameter names.");
+  }
+}
+function selectCallbackParameters(names = [], parameters = {}) {
+  validateCallbackParameterNames(names);
+  if (!isRecord2(parameters)) {
+    throw createConnectorCodedError("connector.authorization_invalid", "OAuth provider callback parameters must be an object.");
+  }
+  return Object.fromEntries(names.flatMap((name) => {
+    if (!Object.hasOwn(parameters, name))
+      return [];
+    const value = parameters[name];
+    if (typeof value !== "string") {
+      throw createConnectorCodedError("connector.authorization_invalid", "OAuth provider callback parameters must have a single string value.");
+    }
+    return [[name, value]];
+  }));
 }
 function nonblank(value, field, code = "connector.configuration_invalid") {
   if (typeof value !== "string" || !value.trim()) {
@@ -1069,7 +1114,8 @@ class ConnectorTokenAccess {
             ...refreshed,
             ...refreshed.refreshToken === undefined ? { refreshToken: current.refreshToken } : {},
             ...refreshed.tokenType === undefined && current.tokenType !== undefined ? { tokenType: current.tokenType } : {},
-            scopes: refreshed.scopes ?? current.scopes ?? authorization.scopes
+            scopes: refreshed.scopes ?? current.scopes ?? authorization.scopes,
+            ...refreshed.authorizationContext === undefined && current.authorizationContext !== undefined ? { authorizationContext: current.authorizationContext } : {}
           };
           const envelope = await this.credentials.seal(definition.id, authorization.id, normalized);
           return this.mutations.stageCredentialMutationCredentials(executing, signal, {
@@ -1200,7 +1246,7 @@ class DefaultConnectorAuthorizationLifecycle {
   async completeNewAuthorization(input) {
     this.assertRegistered(input.definition);
     const authorizationId = `cau_${randomUUID2()}`;
-    const credentials = await this.exchangeAuthorizationCode(input.definition, input.code, input.codeVerifier, input.redirectUri);
+    const credentials = await this.exchangeAuthorizationCode(input.definition, input.code, input.codeVerifier, input.redirectUri, input.callbackParameters);
     const credentialsEnvelope = await this.credentials.seal(input.definition.id, authorizationId, credentials);
     let pending;
     try {
@@ -1358,7 +1404,11 @@ class DefaultConnectorAuthorizationLifecycle {
     const { claim } = claimOutcome;
     try {
       await this.mutations.executeCredentialMutation(claim.authorization, async (executing, signal) => {
-        const credentials = validateCredentials(await input.definition.adapter.authentication.exchangeCode(this.authorizationAdapterContext(input.definition.id, input.redirectUri, signal), { code: input.code, codeVerifier: input.codeVerifier }));
+        const credentials = validateCredentials(await input.definition.adapter.authentication.exchangeCode(this.authorizationAdapterContext(input.definition.id, input.redirectUri, signal), {
+          code: input.code,
+          ...input.codeVerifier === undefined ? {} : { codeVerifier: input.codeVerifier },
+          callbackParameters: input.callbackParameters
+        }));
         assertCredentialMutationOperationActive(signal);
         const envelope = await this.credentials.seal(input.definition.id, input.authorizationId, credentials);
         return this.mutations.stageCredentialMutationCredentials(executing, signal, {
@@ -1382,9 +1432,9 @@ class DefaultConnectorAuthorizationLifecycle {
     const staged = await this.requireAuthorization(input.definition.id, input.authorizationId);
     return this.mutations.finalizeStagedMutation(staged);
   }
-  async exchangeAuthorizationCode(definition, code, codeVerifier, redirectUri) {
+  async exchangeAuthorizationCode(definition, code, codeVerifier, redirectUri, callbackParameters) {
     try {
-      return validateCredentials(await this.mutations.withBoundedProviderSignal((signal) => definition.adapter.authentication.exchangeCode(this.authorizationAdapterContext(definition.id, redirectUri, signal), { code, codeVerifier })));
+      return validateCredentials(await this.mutations.withBoundedProviderSignal((signal) => definition.adapter.authentication.exchangeCode(this.authorizationAdapterContext(definition.id, redirectUri, signal), { code, ...codeVerifier === undefined ? {} : { codeVerifier }, callbackParameters })));
     } catch (error) {
       throw providerBoundaryError(error, "connector.provider_failed", "Connector authorization code exchange failed.");
     }
@@ -1518,12 +1568,13 @@ class ConnectorAuthorizationRequestHandler {
     const definition = this.resolveDefinition(nonblank(connectorId, "connector id"));
     const actor = requireConnectorConnectionCommandActor(command.execution, this.projectId);
     assertConnectorConnectionSelector(input);
+    validateCallbackParameterNames(definition.adapter.authentication.callbackParameters);
     const redirectUri = normalizedHttpUrl(input.redirectUri, "OAuth callback URL");
     const reauthorization = await this.prepareReauthorization(definition, actor, input.reauthorizationId);
     const attemptId = `cat_${randomUUID3()}`;
     const state = `${attemptId}.${randomBytes2(32).toString("base64url")}`;
-    const codeVerifier = randomBytes2(32).toString("base64url");
-    const codeChallenge = createHash2("sha256").update(codeVerifier).digest("base64url");
+    const codeVerifier = connectorPkceEnabled(definition.adapter.authentication.pkce) ? randomBytes2(32).toString("base64url") : undefined;
+    const codeChallenge = codeVerifier === undefined ? undefined : createHash2("sha256").update(codeVerifier).digest("base64url");
     let authorizationUrlInput;
     try {
       authorizationUrlInput = await runBoundedConnectorProviderOperation({
@@ -1534,13 +1585,16 @@ class ConnectorAuthorizationRequestHandler {
         connectorId: definition.id,
         redirectUri,
         signal
-      }, { state, codeChallenge, codeChallengeMethod: "S256" }), () => createConnectorCodedError("connector.provider_unavailable", "Connector authorization URL generation did not complete."));
+      }, {
+        state,
+        ...codeChallenge === undefined ? {} : { codeChallenge, codeChallengeMethod: "S256" }
+      }), () => createConnectorCodedError("connector.provider_unavailable", "Connector authorization URL generation did not complete."));
     } catch (error) {
       throw providerBoundaryError(error, providerFailureCode(error), "Connector authorization could not be started.");
     }
     const authorizationUrl = normalizedHttpUrl(authorizationUrlInput, "provider authorization URL", "connector.adapter_invalid");
     assertAuthorizationUrlParameters(authorizationUrl, { state, codeChallenge });
-    const codeVerifierEnvelope = await this.credentialProtector.seal(textEncoder2.encode(codeVerifier), {
+    const codeVerifierEnvelope = codeVerifier === undefined ? undefined : await this.credentialProtector.seal(textEncoder2.encode(codeVerifier), {
       projectId: this.projectId,
       connectorId: definition.id,
       recordId: attemptId,
@@ -1559,7 +1613,7 @@ class ConnectorAuthorizationRequestHandler {
         slot: input.slot,
         initiatedByExecutionId: command.execution.id,
         stateHash: hashSecret(state),
-        codeVerifier: codeVerifierEnvelope,
+        ...codeVerifierEnvelope === undefined ? {} : { codeVerifier: codeVerifierEnvelope },
         redirectUri,
         ...reauthorization === undefined ? {} : {
           reauthorizationId: reauthorization.authorization.id,
@@ -1583,7 +1637,8 @@ class ConnectorAuthorizationRequestHandler {
       attempt,
       principal: actor.principal,
       code,
-      redirectUri
+      redirectUri,
+      callbackParameters: input.callbackParameters
     });
     return {
       authorizationId: completed.id,
@@ -1593,7 +1648,11 @@ class ConnectorAuthorizationRequestHandler {
     };
   }
   async completeAuthorizationAttempt(input) {
-    const verifierBytes = await this.credentialProtector.open(input.attempt.codeVerifier, {
+    const enabled = connectorPkceEnabled(input.definition.adapter.authentication.pkce);
+    if (enabled !== (input.attempt.codeVerifier !== undefined)) {
+      throw createConnectorCodedError("connector.authorization_invalid", "OAuth connector PKCE configuration changed; restart authorization.");
+    }
+    const verifierBytes = input.attempt.codeVerifier === undefined ? undefined : await this.credentialProtector.open(input.attempt.codeVerifier, {
       projectId: this.projectId,
       connectorId: input.definition.id,
       recordId: input.attempt.id,
@@ -1601,7 +1660,8 @@ class ConnectorAuthorizationRequestHandler {
     });
     return this.completeGrant({
       ...input,
-      codeVerifier: textDecoder2.decode(verifierBytes)
+      callbackParameters: selectCallbackParameters(input.definition.adapter.authentication.callbackParameters, input.callbackParameters),
+      ...verifierBytes === undefined ? {} : { codeVerifier: textDecoder2.decode(verifierBytes) }
     });
   }
   async prepareReauthorization(definition, actor, reauthorizationId) {
@@ -1664,6 +1724,7 @@ class ConnectorAuthorizationRequestHandler {
         principal: input.principal,
         code: input.code,
         codeVerifier: input.codeVerifier,
+        callbackParameters: input.callbackParameters,
         redirectUri: input.redirectUri,
         ...input.onAuthorizationPersisted === undefined ? {} : { onAuthorizationPersisted: input.onAuthorizationPersisted }
       });
@@ -1680,6 +1741,7 @@ class ConnectorAuthorizationRequestHandler {
       principal: input.principal,
       code: input.code,
       codeVerifier: input.codeVerifier,
+      callbackParameters: input.callbackParameters,
       redirectUri: input.redirectUri
     });
   }
@@ -1808,6 +1870,7 @@ class ConnectorConnectionRunService {
         attempt,
         principal,
         code: nonblank(input.code, "OAuth authorization code", "connector.authorization_invalid"),
+        callbackParameters: input.callbackParameters,
         redirectUri,
         onAuthorizationPersisted: async (persisted) => {
           authorizationId = persisted.id;
@@ -3138,7 +3201,6 @@ class SixbHost2 {
     });
     validateAuthStrategySecurityReferences(this.auth.getStrategy(), definitions.security);
     const connectors = definitions.connectors.list();
-    assertConnectorConnectionSurfaces(connectors);
     const hasOAuthConnectors = connectors.some(isOAuthConnectorDefinition2);
     const credentialProtector = hasOAuthConnectors && options.connectorConnections?.encryptionKey !== undefined ? createConnectorCredentialProtectorFromKey(options.connectorConnections.encryptionKey) : undefined;
     this.connectorService = new ConnectorService(this.projectId, connectors, {
@@ -3275,15 +3337,6 @@ function assertWebhookRunStorage(connectors, storage) {
     }
   }
 }
-function assertConnectorConnectionSurfaces(connectors) {
-  for (const connector of connectors) {
-    if (!isOAuthConnectorDefinition2(connector))
-      continue;
-    if (connector.adapter.webhooks !== undefined) {
-      throw createConnectorCodedError("connector.configuration_invalid", `OAuth connector '${connector.id}' cannot register webhooks until connection routing is defined.`);
-    }
-  }
-}
 
 // src/runtime/create.ts
 async function createSixb2(options) {
@@ -3330,4 +3383,4 @@ async function createSixb2(options) {
 }
 export { WebhookValidationError2, defineWebhook2, webhookConnector2, UnverifiedWebhookError2, resolveWebhookVerification2, warnUnverifiedWebhook2, SixbHost2, createSixb2 };
 
-//# debugId=37ED6E7D8337016564756E2164756E21
+//# debugId=4CB6C5C3405BADC164756E2164756E21