@sixb/core 0.1.9 → 0.1.11

package/dist/{chunk-52hbv0ak.js → chunk-4zhmdsx6.js}

@@ -5,7 +5,7 @@ import {
 import {
   ProjectionRegistry2,
   createOntologyMaterializer2
-} from "./chunk-an5tt9y0.js";
+} from "./chunk-ftv470j8.js";
 import {
   captureSixbFailure2,
   isSixbError2
@@ -27,28 +27,28 @@ import {
 import {
   RuntimeError2,
   createModelCatalog2
-} from "./chunk-e0d1rzef.js";
+} from "./chunk-jsy70480.js";
 import {
   isMigrationCapableStorage2,
   checkStorageSchema2
-} from "./chunk-mjbk2djy.js";
+} from "./chunk-gqm76kse.js";
 import {
   createAuthorizedObjectReader
-} from "./chunk-ypbtykv6.js";
+} from "./chunk-01kj2pbh.js";
 import {
   attachSixbErrorReporter2,
   shareSixbErrorReporter2
 } from "./chunk-7apz6hg4.js";
 import {
   ActionRegistry2
-} from "./chunk-vf691g1r.js";
+} from "./chunk-sepyxgpc.js";
 import {
   assertDatasetDefinition2
 } from "./chunk-860dwwy0.js";
 import {
   OntologyOutboxDispatcher2,
   createDomainEventService2
-} from "./chunk-3tgwrcyh.js";
+} from "./chunk-wf88w4kp.js";
 import {
   validateSchedulesAtStartup2
 } from "./chunk-e1c18xjx.js";
@@ -62,9 +62,8 @@ import {
   providerBoundaryError,
   isConnectorStorageError,
   storageBoundaryError,
-  recoverConnectorFailure,
-  SyncValidationError2
-} from "./chunk-emyyk7dx.js";
+  recoverConnectorFailure
+} from "./chunk-v2vcg0w6.js";
 import {
   toolsFromProjectConfig
 } from "./chunk-skz0hst3.js";
@@ -73,14 +72,14 @@ import {
   validateWorkflowsAtStartup2,
   validateWorkflowAgentStepGroupReferences2,
   createBoundSixb
-} from "./chunk-hpr1r6av.js";
+} from "./chunk-gq8vhakp.js";
 import {
   registerConnectorConnectionCallbackProcess
 } from "./chunk-5a4a52tq.js";
 import {
   registerOntologyMutationRuntime2,
   createOntologyMutationRuntime2
-} from "./chunk-zcnq6105.js";
+} from "./chunk-85cd7e8c.js";
 import {
   SchedulerRuntime2
 } from "./chunk-z5rnrmz1.js";
@@ -89,17 +88,19 @@ import {
   validateSharesAtStartup,
   discoverOntologySources2,
   discoverProjectDefinitions2
-} from "./chunk-r4tfx1sf.js";
+} from "./chunk-fh8kgex1.js";
 import {
   LoggingService2
-} from "./chunk-kxwa347f.js";
+} from "./chunk-3qms4nax.js";
 import {
   registerProjectionRegistry2
-} from "./chunk-k3cqkkn2.js";
+} from "./chunk-1824gssz.js";
+import {
+  SyncValidationError2
+} from "./chunk-cfvakeax.js";
 import {
-  isOAuthConnectorDefinition2,
-  isStaticConnectorDefinition
-} from "./chunk-3f7veca0.js";
+  isOAuthConnectorDefinition2
+} from "./chunk-9x8dybsb.js";
 import {
   ensureExecutionRecord2
 } from "./chunk-17kfctj6.js";
@@ -110,6 +111,9 @@ import {
 import {
   reportEventDeliveryFailure3
 } from "./chunk-72w2pxk7.js";
+import {
+  isJsonObject2
+} from "./chunk-wy0qdqfm.js";
 // src/webhooks/errors.ts
 class WebhookValidationError2 extends Error {
   name = "WebhookValidationError";
@@ -245,8 +249,6 @@ class WebhookRegistry {
   constructor(options) {
     const registered = [];
     for (const connector of options.connectors) {
-      if (!isStaticConnectorDefinition(connector))
-        continue;
       const webhooks = connector.adapter.webhooks ?? [];
       if (!Array.isArray(webhooks)) {
         throw new WebhookValidationError2(`[Sixb] Connector '${connector.id}' webhooks must be an array when provided.`);
@@ -467,6 +469,12 @@ function validateCredentials(credentials) {
     }
     normalized.expiresAt = new Date(credentials.expiresAt);
   }
+  if (credentials.authorizationContext !== undefined) {
+    if (!isJsonObject2(credentials.authorizationContext)) {
+      throw createConnectorCodedError("connector.adapter_invalid", "OAuth connector adapter returned invalid authorization context; expected a JSON object.");
+    }
+    normalized.authorizationContext = structuredClone(credentials.authorizationContext);
+  }
   return normalized;
 }
 function validateAccounts(accounts) {
@@ -500,7 +508,8 @@ function serializeCredentials(credentials) {
     ...credentials.refreshToken === undefined ? {} : { refreshToken: credentials.refreshToken },
     ...credentials.tokenType === undefined ? {} : { tokenType: credentials.tokenType },
     ...credentials.scopes === undefined ? {} : { scopes: credentials.scopes },
-    ...credentials.expiresAt === undefined ? {} : { expiresAt: credentials.expiresAt.toISOString() }
+    ...credentials.expiresAt === undefined ? {} : { expiresAt: credentials.expiresAt.toISOString() },
+    ...credentials.authorizationContext === undefined ? {} : { authorizationContext: credentials.authorizationContext }
   });
 }
 function parseCredentials(serialized) {
@@ -513,7 +522,7 @@ function parseCredentials(serialized) {
   if (!isRecord2(value) || value.version !== 1 || typeof value.accessToken !== "string") {
     throw createConnectorCodedError("connector.credentials_unavailable", "Stored connector credentials are invalid.");
   }
-  if (value.refreshToken !== undefined && typeof value.refreshToken !== "string" || value.tokenType !== undefined && typeof value.tokenType !== "string" || value.scopes !== undefined && (!Array.isArray(value.scopes) || value.scopes.some((scope) => typeof scope !== "string")) || value.expiresAt !== undefined && typeof value.expiresAt !== "string") {
+  if (value.refreshToken !== undefined && typeof value.refreshToken !== "string" || value.tokenType !== undefined && typeof value.tokenType !== "string" || value.scopes !== undefined && (!Array.isArray(value.scopes) || value.scopes.some((scope) => typeof scope !== "string")) || value.expiresAt !== undefined && typeof value.expiresAt !== "string" || value.authorizationContext !== undefined && !isJsonObject2(value.authorizationContext)) {
     throw createConnectorCodedError("connector.credentials_unavailable", "Stored connector credentials are invalid.");
   }
   const expiresAt = value.expiresAt === undefined ? undefined : new Date(value.expiresAt);
@@ -523,7 +532,8 @@ function parseCredentials(serialized) {
       ...value.refreshToken === undefined ? {} : { refreshToken: value.refreshToken },
       ...value.tokenType === undefined ? {} : { tokenType: value.tokenType },
       ...value.scopes === undefined ? {} : { scopes: value.scopes },
-      ...expiresAt === undefined ? {} : { expiresAt }
+      ...expiresAt === undefined ? {} : { expiresAt },
+      ...value.authorizationContext === undefined ? {} : { authorizationContext: value.authorizationContext }
     });
   } catch (error) {
     throw createConnectorCodedError("connector.credentials_unavailable", "Stored connector credentials are invalid.", { cause: error });
@@ -567,9 +577,44 @@ function normalizedHttpUrl(value, field, code = "connector.configuration_invalid
 }
 function assertAuthorizationUrlParameters(authorizationUrl, expected) {
   const parameters = new URL(authorizationUrl).searchParams;
-  if (!sameSingleParameter(parameters, "state", expected.state) || !sameSingleParameter(parameters, "code_challenge", expected.codeChallenge) || !sameSingleParameter(parameters, "code_challenge_method", "S256")) {
-    throw createConnectorCodedError("connector.adapter_invalid", "OAuth connector authorization URL must preserve the framework-provided state and PKCE S256 parameters.");
-  }
+  if (!sameSingleParameter(parameters, "state", expected.state) || (expected.codeChallenge === undefined ? parameters.has("code_challenge") || parameters.has("code_challenge_method") : !sameSingleParameter(parameters, "code_challenge", expected.codeChallenge) || !sameSingleParameter(parameters, "code_challenge_method", "S256"))) {
+    throw createConnectorCodedError("connector.adapter_invalid", expected.codeChallenge === undefined ? "OAuth connector authorization URL must preserve the framework-provided state and omit disabled PKCE parameters." : "OAuth connector authorization URL must preserve the framework-provided state and PKCE S256 parameters.");
+  }
+}
+function connectorPkceEnabled(pkce) {
+  if (pkce === undefined || pkce === "S256")
+    return true;
+  if (pkce === "disabled")
+    return false;
+  throw createConnectorCodedError("connector.adapter_invalid", "OAuth connector PKCE must be S256 or disabled.");
+}
+var reservedCallbackParameters = new Set([
+  "state",
+  "code",
+  "auth_code",
+  "error",
+  "error_description",
+  "error_uri"
+]);
+function validateCallbackParameterNames(names = []) {
+  if (!Array.isArray(names) || names.some((name) => typeof name !== "string" || !/^[A-Za-z_][A-Za-z0-9_.-]*$/.test(name) || reservedCallbackParameters.has(name)) || new Set(names).size !== names.length) {
+    throw createConnectorCodedError("connector.adapter_invalid", "OAuth callback parameter names must be unique, non-reserved parameter names.");
+  }
+}
+function selectCallbackParameters(names = [], parameters = {}) {
+  validateCallbackParameterNames(names);
+  if (!isRecord2(parameters)) {
+    throw createConnectorCodedError("connector.authorization_invalid", "OAuth provider callback parameters must be an object.");
+  }
+  return Object.fromEntries(names.flatMap((name) => {
+    if (!Object.hasOwn(parameters, name))
+      return [];
+    const value = parameters[name];
+    if (typeof value !== "string") {
+      throw createConnectorCodedError("connector.authorization_invalid", "OAuth provider callback parameters must have a single string value.");
+    }
+    return [[name, value]];
+  }));
 }
 function nonblank(value, field, code = "connector.configuration_invalid") {
   if (typeof value !== "string" || !value.trim()) {
@@ -1069,7 +1114,8 @@ class ConnectorTokenAccess {
             ...refreshed,
             ...refreshed.refreshToken === undefined ? { refreshToken: current.refreshToken } : {},
             ...refreshed.tokenType === undefined && current.tokenType !== undefined ? { tokenType: current.tokenType } : {},
-            scopes: refreshed.scopes ?? current.scopes ?? authorization.scopes
+            scopes: refreshed.scopes ?? current.scopes ?? authorization.scopes,
+            ...refreshed.authorizationContext === undefined && current.authorizationContext !== undefined ? { authorizationContext: current.authorizationContext } : {}
           };
           const envelope = await this.credentials.seal(definition.id, authorization.id, normalized);
           return this.mutations.stageCredentialMutationCredentials(executing, signal, {
@@ -1200,7 +1246,7 @@ class DefaultConnectorAuthorizationLifecycle {
   async completeNewAuthorization(input) {
     this.assertRegistered(input.definition);
     const authorizationId = `cau_${randomUUID2()}`;
-    const credentials = await this.exchangeAuthorizationCode(input.definition, input.code, input.codeVerifier, input.redirectUri);
+    const credentials = await this.exchangeAuthorizationCode(input.definition, input.code, input.codeVerifier, input.redirectUri, input.callbackParameters);
     const credentialsEnvelope = await this.credentials.seal(input.definition.id, authorizationId, credentials);
     let pending;
     try {
@@ -1358,7 +1404,11 @@ class DefaultConnectorAuthorizationLifecycle {
     const { claim } = claimOutcome;
     try {
       await this.mutations.executeCredentialMutation(claim.authorization, async (executing, signal) => {
-        const credentials = validateCredentials(await input.definition.adapter.authentication.exchangeCode(this.authorizationAdapterContext(input.definition.id, input.redirectUri, signal), { code: input.code, codeVerifier: input.codeVerifier }));
+        const credentials = validateCredentials(await input.definition.adapter.authentication.exchangeCode(this.authorizationAdapterContext(input.definition.id, input.redirectUri, signal), {
+          code: input.code,
+          ...input.codeVerifier === undefined ? {} : { codeVerifier: input.codeVerifier },
+          callbackParameters: input.callbackParameters
+        }));
         assertCredentialMutationOperationActive(signal);
         const envelope = await this.credentials.seal(input.definition.id, input.authorizationId, credentials);
         return this.mutations.stageCredentialMutationCredentials(executing, signal, {
@@ -1382,9 +1432,9 @@ class DefaultConnectorAuthorizationLifecycle {
     const staged = await this.requireAuthorization(input.definition.id, input.authorizationId);
     return this.mutations.finalizeStagedMutation(staged);
   }
-  async exchangeAuthorizationCode(definition, code, codeVerifier, redirectUri) {
+  async exchangeAuthorizationCode(definition, code, codeVerifier, redirectUri, callbackParameters) {
     try {
-      return validateCredentials(await this.mutations.withBoundedProviderSignal((signal) => definition.adapter.authentication.exchangeCode(this.authorizationAdapterContext(definition.id, redirectUri, signal), { code, codeVerifier })));
+      return validateCredentials(await this.mutations.withBoundedProviderSignal((signal) => definition.adapter.authentication.exchangeCode(this.authorizationAdapterContext(definition.id, redirectUri, signal), { code, ...codeVerifier === undefined ? {} : { codeVerifier }, callbackParameters })));
     } catch (error) {
       throw providerBoundaryError(error, "connector.provider_failed", "Connector authorization code exchange failed.");
     }
@@ -1436,11 +1486,19 @@ function assertConnectorAuthorizationAttemptInitiator(execution, current) {
   }
 }
 function assertConnectorConnectionRunInitiator(execution, current, connectorId) {
-  const initiating = execution ? connectorConnectionActorFromExecution(execution, execution.projectId) : null;
-  if (!initiating || !sameConnectorConnectionCommandActor(initiating, current)) {
+  if (!isConnectorConnectionRunInitiator(execution, current)) {
     throw new AuthorizationError2(`connection-run:connector:${connectorId}`, "[Sixb] This connector connection run can only be accessed by its initiating actor.");
   }
 }
+function isConnectorConnectionRunInitiator(execution, current) {
+  const initiating = execution ? connectorConnectionActorFromExecution(execution, execution.projectId) : null;
+  if (!initiating)
+    return false;
+  if (initiating.principal.type === "user" && current.principal.type === "user" && initiating.credential.type === "session" && current.credential.type === "session") {
+    return initiating.principal.id === current.principal.id;
+  }
+  return sameConnectorConnectionCommandActor(initiating, current);
+}
 function connectorConnectionActorFromExecution(execution, projectId) {
   const authorization = execution.authorizationRef;
   if (execution.projectId !== projectId || execution.executor.type !== "request" || execution.source.type !== "http" || execution.executor.requestId !== execution.source.requestId || authorization.type !== "principal" || authorization.credential === undefined || execution.requestedBy?.type !== authorization.principal.type || execution.requestedBy.id !== authorization.principal.id) {
@@ -1518,12 +1576,13 @@ class ConnectorAuthorizationRequestHandler {
     const definition = this.resolveDefinition(nonblank(connectorId, "connector id"));
     const actor = requireConnectorConnectionCommandActor(command.execution, this.projectId);
     assertConnectorConnectionSelector(input);
+    validateCallbackParameterNames(definition.adapter.authentication.callbackParameters);
     const redirectUri = normalizedHttpUrl(input.redirectUri, "OAuth callback URL");
     const reauthorization = await this.prepareReauthorization(definition, actor, input.reauthorizationId);
     const attemptId = `cat_${randomUUID3()}`;
     const state = `${attemptId}.${randomBytes2(32).toString("base64url")}`;
-    const codeVerifier = randomBytes2(32).toString("base64url");
-    const codeChallenge = createHash2("sha256").update(codeVerifier).digest("base64url");
+    const codeVerifier = connectorPkceEnabled(definition.adapter.authentication.pkce) ? randomBytes2(32).toString("base64url") : undefined;
+    const codeChallenge = codeVerifier === undefined ? undefined : createHash2("sha256").update(codeVerifier).digest("base64url");
     let authorizationUrlInput;
     try {
       authorizationUrlInput = await runBoundedConnectorProviderOperation({
@@ -1534,13 +1593,16 @@ class ConnectorAuthorizationRequestHandler {
         connectorId: definition.id,
         redirectUri,
         signal
-      }, { state, codeChallenge, codeChallengeMethod: "S256" }), () => createConnectorCodedError("connector.provider_unavailable", "Connector authorization URL generation did not complete."));
+      }, {
+        state,
+        ...codeChallenge === undefined ? {} : { codeChallenge, codeChallengeMethod: "S256" }
+      }), () => createConnectorCodedError("connector.provider_unavailable", "Connector authorization URL generation did not complete."));
     } catch (error) {
       throw providerBoundaryError(error, providerFailureCode(error), "Connector authorization could not be started.");
     }
     const authorizationUrl = normalizedHttpUrl(authorizationUrlInput, "provider authorization URL", "connector.adapter_invalid");
     assertAuthorizationUrlParameters(authorizationUrl, { state, codeChallenge });
-    const codeVerifierEnvelope = await this.credentialProtector.seal(textEncoder2.encode(codeVerifier), {
+    const codeVerifierEnvelope = codeVerifier === undefined ? undefined : await this.credentialProtector.seal(textEncoder2.encode(codeVerifier), {
       projectId: this.projectId,
       connectorId: definition.id,
       recordId: attemptId,
@@ -1559,7 +1621,7 @@ class ConnectorAuthorizationRequestHandler {
         slot: input.slot,
         initiatedByExecutionId: command.execution.id,
         stateHash: hashSecret(state),
-        codeVerifier: codeVerifierEnvelope,
+        ...codeVerifierEnvelope === undefined ? {} : { codeVerifier: codeVerifierEnvelope },
         redirectUri,
         ...reauthorization === undefined ? {} : {
           reauthorizationId: reauthorization.authorization.id,
@@ -1583,7 +1645,8 @@ class ConnectorAuthorizationRequestHandler {
       attempt,
       principal: actor.principal,
       code,
-      redirectUri
+      redirectUri,
+      callbackParameters: input.callbackParameters
     });
     return {
       authorizationId: completed.id,
@@ -1593,7 +1656,11 @@ class ConnectorAuthorizationRequestHandler {
     };
   }
   async completeAuthorizationAttempt(input) {
-    const verifierBytes = await this.credentialProtector.open(input.attempt.codeVerifier, {
+    const enabled = connectorPkceEnabled(input.definition.adapter.authentication.pkce);
+    if (enabled !== (input.attempt.codeVerifier !== undefined)) {
+      throw createConnectorCodedError("connector.authorization_invalid", "OAuth connector PKCE configuration changed; restart authorization.");
+    }
+    const verifierBytes = input.attempt.codeVerifier === undefined ? undefined : await this.credentialProtector.open(input.attempt.codeVerifier, {
       projectId: this.projectId,
       connectorId: input.definition.id,
       recordId: input.attempt.id,
@@ -1601,7 +1668,8 @@ class ConnectorAuthorizationRequestHandler {
     });
     return this.completeGrant({
       ...input,
-      codeVerifier: textDecoder2.decode(verifierBytes)
+      callbackParameters: selectCallbackParameters(input.definition.adapter.authentication.callbackParameters, input.callbackParameters),
+      ...verifierBytes === undefined ? {} : { codeVerifier: textDecoder2.decode(verifierBytes) }
     });
   }
   async prepareReauthorization(definition, actor, reauthorizationId) {
@@ -1664,6 +1732,7 @@ class ConnectorAuthorizationRequestHandler {
         principal: input.principal,
         code: input.code,
         codeVerifier: input.codeVerifier,
+        callbackParameters: input.callbackParameters,
         redirectUri: input.redirectUri,
         ...input.onAuthorizationPersisted === undefined ? {} : { onAuthorizationPersisted: input.onAuthorizationPersisted }
       });
@@ -1680,6 +1749,7 @@ class ConnectorAuthorizationRequestHandler {
       principal: input.principal,
       code: input.code,
       codeVerifier: input.codeVerifier,
+      callbackParameters: input.callbackParameters,
       redirectUri: input.redirectUri
     });
   }
@@ -1808,6 +1878,7 @@ class ConnectorConnectionRunService {
         attempt,
         principal,
         code: nonblank(input.code, "OAuth authorization code", "connector.authorization_invalid"),
+        callbackParameters: input.callbackParameters,
         redirectUri,
         onAuthorizationPersisted: async (persisted) => {
           authorizationId = persisted.id;
@@ -1830,6 +1901,23 @@ class ConnectorConnectionRunService {
       return { runId: failed.id, connectorId: failed.connectorId, returnTo };
     }
   }
+  async listPending(command, connectorId) {
+    const actor = requireConnectorConnectionCommandActor(command.execution, this.projectId);
+    const candidates = await withConnectorStorageBoundary("Pending connector connection runs could not be read.", () => this.connectionStorage.listPendingConnectionRuns({ projectId: this.projectId, connectorId }));
+    const runs = [];
+    for (const candidate of candidates) {
+      const initiating = await withConnectorStorageBoundary("Connector connection run initiating execution could not be read.", () => this.storage.executions.getById({
+        projectId: this.projectId,
+        id: candidate.initiatedByExecutionId
+      }));
+      if (!isConnectorConnectionRunInitiator(initiating, actor))
+        continue;
+      const run = await this.get(command, connectorId, candidate.id);
+      if (run && (run.status === "running" || run.status === "waiting" && run.waitingFor === "account_selection"))
+        runs.push(run);
+    }
+    return runs.sort((left, right) => right.createdAt.getTime() - left.createdAt.getTime() || left.id.localeCompare(right.id));
+  }
   async get(command, connectorId, runId) {
     const id = nonblank(runId, "connection run id");
     const run = await this.readRun(connectorId, id);
@@ -2052,8 +2140,7 @@ class ConnectorConnectionRunService {
         ...base,
         status: "waiting",
         waitingFor: "account_selection",
-        accounts: authorization.accounts,
-        expiresAt: run.expiresAt
+        accounts: authorization.accounts
       };
     }
     if (run.status === "succeeded") {
@@ -2097,6 +2184,8 @@ class ConnectorConnectionRunService {
   }
   scheduleRunMaintenance(run, delayMs = run.status === "waiting" || run.status === "running" ? Math.max(1000, run.expiresAt.getTime() - this.now().getTime()) : CLEANUP_RETRY_DELAY_MS) {
     this.cancelRunMaintenance(run.id);
+    if (run.status === "waiting" && run.waitingFor === "account_selection")
+      return;
     const timer = setTimeout(() => void this.maintainRun(run.connectorId, run.id), Math.min(delayMs, MAX_TIMER_DELAY_MS));
     timer.unref?.();
     this.maintenanceTimers.set(run.id, timer);
@@ -2303,6 +2392,10 @@ class ConnectorConnectionService {
       authorizationId: authorization.id
     });
   }
+  listPendingConnectionRuns(command, connectorId) {
+    this.requireOAuthDefinition(connectorId);
+    return this.runs.listPending(command, connectorId);
+  }
   getConnectionRun(command, connectorId, runId) {
     this.requireOAuthDefinition(connectorId);
     return this.runs.get(command, connectorId, runId);
@@ -2636,6 +2729,8 @@ class OntologyMaintenance {
     };
   }
   runNow() {
+    if (this.stopping)
+      return this.stopping;
     this.pass ??= this.runPass().finally(() => {
       this.pass = null;
     });
@@ -2729,10 +2824,11 @@ class OntologyMaintenance {
       this.timer = null;
     }
     const activePass = this.pass ?? Promise.resolve();
-    const stopping = settlesWithin(activePass, this.shutdownTimeoutMs).then((settled) => {
+    const stopping = settlesWithin(activePass, this.shutdownTimeoutMs).then(async (settled) => {
       if (!settled) {
-        this.reportError(new Error(`[Sixb] Ontology maintenance did not stop within ${this.shutdownTimeoutMs}ms.`));
+        this.reportError(new Error(`[Sixb] Ontology maintenance is still stopping after ${this.shutdownTimeoutMs}ms; waiting for active storage operations.`));
       }
+      await activePass;
     });
     this.stopping = stopping.finally(() => {
       this.stopping = null;
@@ -3138,7 +3234,6 @@ class SixbHost2 {
     });
     validateAuthStrategySecurityReferences(this.auth.getStrategy(), definitions.security);
     const connectors = definitions.connectors.list();
-    assertConnectorConnectionSurfaces(connectors);
     const hasOAuthConnectors = connectors.some(isOAuthConnectorDefinition2);
     const credentialProtector = hasOAuthConnectors && options.connectorConnections?.encryptionKey !== undefined ? createConnectorCredentialProtectorFromKey(options.connectorConnections.encryptionKey) : undefined;
     this.connectorService = new ConnectorService(this.projectId, connectors, {
@@ -3275,15 +3370,6 @@ function assertWebhookRunStorage(connectors, storage) {
     }
   }
 }
-function assertConnectorConnectionSurfaces(connectors) {
-  for (const connector of connectors) {
-    if (!isOAuthConnectorDefinition2(connector))
-      continue;
-    if (connector.adapter.webhooks !== undefined) {
-      throw createConnectorCodedError("connector.configuration_invalid", `OAuth connector '${connector.id}' cannot register webhooks until connection routing is defined.`);
-    }
-  }
-}
 
 // src/runtime/create.ts
 async function createSixb2(options) {
@@ -3330,4 +3416,4 @@ async function createSixb2(options) {
 }
 export { WebhookValidationError2, defineWebhook2, webhookConnector2, UnverifiedWebhookError2, resolveWebhookVerification2, warnUnverifiedWebhook2, SixbHost2, createSixb2 };
 
-//# debugId=37ED6E7D8337016564756E2164756E21
+//# debugId=D39CD002806200FC64756E2164756E21