@superdurable/connectors-sdk 0.0.0-stage → 0.1.1

package/dist/projectconfig/index.js

@@ -0,0 +1,1433 @@
+import {
+  BodyTooLargeError,
+  isLocalStorageHost,
+  isPrivateBrokerHost,
+  readBoundedBody
+} from "../chunk-2IDXFKMY.js";
+import {
+  OperationRefSchema,
+  ReauthorizationRequiredError
+} from "../chunk-SOXYPIMO.js";
+
+// src/projectconfig/model.ts
+import { z } from "zod";
+var ConfigurationSchemaVersion = "connectors.dex.dev/project-configuration/v1alpha3";
+var LocalConnectionsSchemaVersion = "connectors.dex.dev/local-connections/v1alpha1";
+var RFC3339NanoSchema = z.iso.datetime({ offset: true }).refine((value) => {
+  const fraction = /\.(\d+)(?:Z|[+-]\d{2}:\d{2})$/.exec(value)?.[1];
+  return fraction === void 0 || fraction.length <= 9;
+}, "timestamp precision exceeds nanoseconds");
+var ScopeSchema = z.strictObject({ projectId: z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,127}$/), kind: z.enum(["live", "preview"]) });
+function scopePrefix(scope) {
+  const parsed = ScopeSchema.parse(scope);
+  return `projects/${parsed.projectId}/${parsed.kind}`;
+}
+var ApplicationSecretRefSchema = z.strictObject({ key: z.string().min(1), version: z.string().min(1), digest: z.string().regex(/^sha256:[a-f0-9]{64}$/) });
+var EnvironmentValueSchema = z.strictObject({ value: z.string().optional(), secretRef: ApplicationSecretRefSchema.optional() }).refine((value) => value.value === void 0 !== (value.secretRef === void 0));
+var ConnectionConfigurationSchema = z.strictObject({
+  connectorId: z.string().regex(/^[a-z][a-z0-9-]{1,62}$/),
+  connectionName: z.string().min(1),
+  modulePath: z.string().min(1),
+  provider: z.string().min(1),
+  authMethodId: z.string().optional(),
+  sharedConnectionId: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/).optional(),
+  configuration: z.record(z.string(), z.unknown())
+});
+var TriggerConfigurationSchema = z.strictObject({
+  connectorId: z.string().min(1),
+  connectionName: z.string().min(1),
+  triggerName: z.string().min(1),
+  bindingName: z.string().min(1),
+  configuration: z.record(z.string(), z.unknown())
+});
+var OperationConfigurationSchema = z.strictObject({
+  connectorId: z.string().min(1),
+  connectionName: z.string().min(1),
+  operationId: z.string().min(1),
+  flowType: z.string().min(1),
+  stepType: z.string().min(1),
+  configuration: z.record(z.string(), z.unknown())
+});
+var CredentialBrokerConfigurationSchema = z.strictObject({ endpoint: z.url(), tokenSecretRef: ApplicationSecretRefSchema });
+var ConfigurationSchema = z.strictObject({
+  schemaVersion: z.enum(["connectors.dex.dev/project-configuration/v1alpha2", ConfigurationSchemaVersion]),
+  scope: ScopeSchema,
+  revision: z.number().int().positive(),
+  connections: z.array(ConnectionConfigurationSchema),
+  triggerBindings: z.array(TriggerConfigurationSchema),
+  operationConfigurations: z.array(OperationConfigurationSchema),
+  environment: z.record(z.string(), EnvironmentValueSchema).optional(),
+  credentialBroker: CredentialBrokerConfigurationSchema.optional()
+}).superRefine((configuration, context) => {
+  const hasShared = configuration.connections.some((connection) => connection.sharedConnectionId !== void 0);
+  if (hasShared && !configuration.credentialBroker) context.addIssue({ code: "custom", message: "shared connections require a credential broker" });
+  if (configuration.schemaVersion.endsWith("v1alpha2") && (hasShared || configuration.credentialBroker)) context.addIssue({ code: "custom", message: "shared connections require v1alpha3" });
+  if (configuration.credentialBroker) {
+    const broker = configuration.credentialBroker;
+    const expectedPrefix = `${scopePrefix(configuration.scope)}/app-secrets/DEX_CREDENTIAL_BROKER_TOKEN/`;
+    if (!broker.tokenSecretRef.key.startsWith(expectedPrefix) || !/^[a-f0-9]{32}$/.test(broker.tokenSecretRef.key.slice(expectedPrefix.length))) context.addIssue({ code: "custom", message: "broker token reference differs from scope" });
+    const endpoint = new URL(broker.endpoint);
+    if (!["http:", "https:"].includes(endpoint.protocol) || endpoint.username || endpoint.password || endpoint.search || endpoint.hash || endpoint.protocol === "http:" && !isPrivateBrokerHost(endpoint.hostname)) context.addIssue({ code: "custom", message: "broker endpoint is invalid" });
+  }
+  const connections = configuration.connections.map((item) => `${item.connectorId}\0${item.connectionName}`);
+  const triggers = configuration.triggerBindings.map((item) => `${item.connectorId}\0${item.connectionName}\0${item.triggerName}\0${item.bindingName}`);
+  const operations = configuration.operationConfigurations.map((item) => `${item.connectorId}\0${item.connectionName}\0${item.operationId}\0${item.flowType}\0${item.stepType}`);
+  for (const keys of [connections, triggers, operations]) {
+    if (new Set(keys).size !== keys.length) context.addIssue({ code: "custom", message: "duplicate configuration identity" });
+  }
+});
+var SnapshotRefSchema = z.strictObject({ key: z.string().min(1), version: z.string().min(1), digest: z.string().regex(/^sha256:[a-f0-9]{64}$/), mediaType: z.literal("application/json") });
+var LocalConnectionSchema = z.object({
+  connectorId: z.string().min(1),
+  connectionName: z.string().min(1),
+  modulePath: z.string().min(1),
+  provider: z.string().min(1),
+  authMethodId: z.string().optional(),
+  authMethodIds: z.array(z.string()).nullable().optional(),
+  configuration: z.record(z.string(), z.unknown()),
+  credentials: z.record(z.string(), z.unknown()),
+  credentialExpiresAt: RFC3339NanoSchema.nullable().optional()
+});
+var LocalConnectionsFileSchema = z.object({
+  schemaVersion: z.literal(LocalConnectionsSchemaVersion),
+  connections: z.array(LocalConnectionSchema),
+  triggerBindings: z.array(TriggerConfigurationSchema).optional()
+});
+
+// src/projectconfig/storage.ts
+import { createHash } from "crypto";
+import { inspect } from "util";
+import { GetBucketVersioningCommand, GetObjectCommand, PutObjectCommand } from "@aws-sdk/client-s3";
+var ObjectNotFoundError = class extends Error {
+  constructor() {
+    super("project configuration object is absent");
+    this.name = "ObjectNotFoundError";
+  }
+};
+var ConflictError = class extends Error {
+  constructor() {
+    super("project configuration revision changed");
+    this.name = "ConflictError";
+  }
+};
+var OutcomeUnknownError = class extends Error {
+  constructor() {
+    super("project configuration write outcome is unknown");
+    this.name = "OutcomeUnknownError";
+  }
+};
+var ProjectObject = class {
+  /** Keep private bytes outside Node inspection; key, version, and ETag identify the exact object. */
+  constructor(key, version, etag, contents) {
+    this.key = key;
+    this.version = version;
+    this.etag = etag;
+    this.#contents = contents;
+  }
+  key;
+  version;
+  etag;
+  #contents;
+  /** Exact private bytes; callers must not log or persist them. */
+  get contents() {
+    return this.#contents;
+  }
+  /** Never format private contents. */
+  toString() {
+    return `ProjectObject{${this.key} version=${this.version}}`;
+  }
+  /** Keep Node inspection and console output secret-safe. */
+  [inspect.custom]() {
+    return this.toString();
+  }
+  /** Reject accidental JSON transport. */
+  toJSON() {
+    throw new TypeError("private project objects cannot be serialized");
+  }
+};
+var InMemoryObjectStore = class {
+  #versions = /* @__PURE__ */ new Map();
+  /** Read the latest object or an exact immutable version. */
+  async readObject(key, version = "") {
+    validateObjectKey(key);
+    const versions = this.#versions.get(key) ?? [];
+    const found = version ? versions.find((object) => object.version === version) : versions.at(-1);
+    if (!found) throw new ObjectNotFoundError();
+    return found;
+  }
+  /** Create only when no object exists under this key. */
+  async createObject(key, contents) {
+    validateObjectKey(key);
+    validateContents(contents);
+    if (this.#versions.has(key)) throw new ConflictError();
+    return this.#write(key, contents);
+  }
+  /** Compare and swap the latest object by ETag. */
+  async compareAndSwapObject(key, expectedETag, contents) {
+    validateObjectKey(key);
+    validateContents(contents);
+    const current = (this.#versions.get(key) ?? []).at(-1);
+    if (!current || current.etag !== expectedETag) throw new ConflictError();
+    return this.#write(key, contents);
+  }
+  #write(key, contents) {
+    const version = String((this.#versions.get(key)?.length ?? 0) + 1);
+    const object = new ProjectObject(key, version, `${digestBytes(contents).slice(7)}-${version}`, new Uint8Array(contents));
+    this.#versions.set(key, [...this.#versions.get(key) ?? [], object]);
+    return object;
+  }
+};
+var S3ObjectStore = class _S3ObjectStore {
+  constructor(configuration, prefix) {
+    this.configuration = configuration;
+    this.prefix = prefix;
+  }
+  configuration;
+  prefix;
+  /** Verify bucket versioning before any application request. */
+  static async create(configuration) {
+    if (!configuration.client || !configuration.bucket || /[/\\\0]/.test(configuration.bucket)) throw new TypeError("versioned project storage is required");
+    const hasExactKmsKey = /^arn:[a-z0-9-]+:kms:[a-z0-9-]+:[0-9]{12}:key\/[a-zA-Z0-9-]+$/.test(configuration.kmsKeyId ?? "");
+    if (!hasExactKmsKey && !(configuration.allowUnencrypted && !configuration.kmsKeyId)) throw new TypeError("exact hosted KMS key ARN is required");
+    const prefix = configuration.prefix?.replace(/\/$/, "") ?? "";
+    if (prefix) validateObjectKey(prefix);
+    if (await configuration.client.config.maxAttempts() !== 1) throw new TypeError("S3 client must disable automatic write retries with maxAttempts: 1");
+    const versioning = await configuration.client.send(new GetBucketVersioningCommand({ Bucket: configuration.bucket }));
+    if (versioning.Status !== "Enabled") throw new Error("project object bucket versioning must be enabled");
+    return new _S3ObjectStore(configuration, prefix ? `${prefix}/` : "");
+  }
+  /** Read bounded private bytes and validate exact version and KMS key. */
+  async readObject(key, version = "") {
+    validateObjectKey(key);
+    let result;
+    try {
+      result = await this.configuration.client.send(new GetObjectCommand({ Bucket: this.configuration.bucket, Key: this.prefix + key, ...version ? { VersionId: version } : {} }));
+    } catch (error) {
+      throw classifyStorageError(error, false);
+    }
+    if (!result.VersionId || result.VersionId === "null" || !result.ETag || version && result.VersionId !== version) throw new Error("project object lacks exact version identity");
+    if (this.configuration.kmsKeyId && (result.ServerSideEncryption !== "aws:kms" || result.SSEKMSKeyId !== this.configuration.kmsKeyId)) throw new Error("project object encryption boundary differs");
+    if (!result.Body) throw new Error("project object body is unavailable");
+    const contents = await readBoundedBody(result.Body, 4 << 20);
+    validateContents(contents);
+    return new ProjectObject(key, result.VersionId, result.ETag, contents);
+  }
+  /** Write once with If-None-Match. */
+  async createObject(key, contents) {
+    return this.writeObject(key, "", contents);
+  }
+  /** Write once with If-Match; ambiguous outcomes stay unknown. */
+  async compareAndSwapObject(key, expectedETag, contents) {
+    if (!expectedETag) throw new TypeError("expected ETag is required");
+    return this.writeObject(key, expectedETag, contents);
+  }
+  async writeObject(key, etag, contents) {
+    validateObjectKey(key);
+    validateContents(contents);
+    let result;
+    try {
+      result = await this.configuration.client.send(new PutObjectCommand({
+        Bucket: this.configuration.bucket,
+        Key: this.prefix + key,
+        Body: contents,
+        ContentType: "application/json",
+        ...etag ? { IfMatch: etag } : { IfNoneMatch: "*" },
+        ...this.configuration.kmsKeyId ? { ServerSideEncryption: "aws:kms", SSEKMSKeyId: this.configuration.kmsKeyId } : {}
+      }));
+    } catch (error) {
+      throw classifyStorageError(error, true);
+    }
+    if (!result.VersionId || result.VersionId === "null" || !result.ETag) throw new OutcomeUnknownError();
+    return new ProjectObject(key, result.VersionId, result.ETag, contents);
+  }
+};
+var ConfigurationStore = class {
+  /** Bind a private object store to one validated project scope. */
+  constructor(objects, scope) {
+    this.objects = objects;
+    this.scope = scope;
+    if (!objects) throw new TypeError("configuration object store is required");
+    this.#key = `${scopePrefix(scope)}/configuration/head`;
+  }
+  objects;
+  scope;
+  #key;
+  /** Read and validate current ordinary configuration. */
+  async readConfiguration() {
+    const object = await this.objects.readObject(this.#key);
+    return { configuration: this.decodeConfiguration(object), object };
+  }
+  /** Conditionally replace ordinary settings using an expected revision. */
+  async writeConfiguration(expectedRevision, document) {
+    let previous;
+    let priorObject;
+    try {
+      const current = await this.readConfiguration();
+      previous = current.configuration;
+      priorObject = current.object;
+    } catch (error) {
+      if (!(error instanceof ObjectNotFoundError && expectedRevision === 0)) throw error;
+    }
+    if ((previous?.revision ?? 0) !== expectedRevision) throw new ConflictError();
+    const schemaVersion = document.credentialBroker || document.connections.some((connection) => connection.sharedConnectionId) ? ConfigurationSchemaVersion : "connectors.dex.dev/project-configuration/v1alpha2";
+    const configuration = ConfigurationSchema.parse({ schemaVersion, scope: this.scope, revision: expectedRevision + 1, ...document });
+    const contents = Buffer.from(encodeGoCompatibleJSON(configuration));
+    try {
+      if (!priorObject) await this.objects.createObject(this.#key, contents);
+      else await this.objects.compareAndSwapObject(this.#key, priorObject.etag, contents);
+    } catch (error) {
+      if (!(error instanceof OutcomeUnknownError)) throw error;
+      try {
+        const observed = await this.objects.readObject(this.#key);
+        if (!Buffer.from(observed.contents).equals(contents)) throw error;
+      } catch {
+        throw error;
+      }
+    }
+    return configuration;
+  }
+  /** Read an exact pinned snapshot after checking its digest. */
+  async readSnapshot(reference) {
+    if (reference.key !== this.#key || !reference.version || reference.version === "null" || reference.mediaType !== "application/json") throw new TypeError("invalid configuration snapshot reference");
+    const object = await this.objects.readObject(reference.key, reference.version);
+    if (digestBytes(object.contents) !== reference.digest) throw new Error("configuration snapshot digest differs");
+    return this.decodeConfiguration(object);
+  }
+  /** Pin the current version when its revision is still expected. */
+  async freezeConfiguration(expectedRevision) {
+    const { configuration, object } = await this.readConfiguration();
+    if (configuration.revision !== expectedRevision) throw new ConflictError();
+    return { key: object.key, version: object.version, digest: digestBytes(object.contents), mediaType: "application/json" };
+  }
+  decodeConfiguration(object) {
+    if (object.key !== this.#key || !object.version || !object.etag) throw new Error("configuration document identity is invalid");
+    let decoded;
+    try {
+      decoded = JSON.parse(Buffer.from(object.contents).toString("utf8"));
+    } catch {
+      throw new Error("configuration document is not valid JSON");
+    }
+    const configuration = ConfigurationSchema.parse(decoded);
+    if (configuration.scope.projectId !== this.scope.projectId || configuration.scope.kind !== this.scope.kind) throw new Error("configuration scope differs");
+    return configuration;
+  }
+};
+function validateObjectKey(key) {
+  if (!key || key.length > 1024 || key.startsWith("/") || /[\\\0\r\n]/.test(key) || key.split("/").some((segment) => !segment || segment === "." || segment === "..")) throw new TypeError("invalid project object key");
+}
+function connectionHeadKey(scope, connectorId, connectionName) {
+  if (!/^[a-z][a-z0-9-]{1,62}$/.test(connectorId) || !connectionName.trim()) throw new TypeError("connection identity is invalid");
+  return `${scopePrefix(scope)}/connections/${connectorId}/${Buffer.from(connectionName).toString("base64url")}/head`;
+}
+function digestBytes(contents) {
+  return `sha256:${createHash("sha256").update(contents).digest("hex")}`;
+}
+function encodeGoCompatibleJSON(document) {
+  if (document === null || typeof document !== "object") throw new TypeError("project document must be a JSON object");
+  return encodeCanonicalValue(document);
+}
+function encodeCanonicalValue(value, context = "structured") {
+  if (typeof value === "number" && !Number.isFinite(value)) throw new TypeError("project document contains a non-finite number");
+  if (value === null || typeof value === "boolean" || typeof value === "number") return JSON.stringify(value);
+  if (typeof value === "string") return JSON.stringify(value).replace(/[<>&\u2028\u2029]/g, (character) => {
+    const escapes = { "<": "\\u003c", ">": "\\u003e", "&": "\\u0026", "\u2028": "\\u2028", "\u2029": "\\u2029" };
+    return escapes[character] ?? character;
+  });
+  if (Array.isArray(value)) return `[${value.map((item) => encodeCanonicalValue(item, context)).join(",")}]`;
+  if (typeof value !== "object") throw new TypeError("project document contains a non-JSON value");
+  const object = value;
+  const isStructured = context === "structured";
+  const keys = isStructured ? canonicalFieldOrder(object) : Object.keys(object).sort((left, right) => Buffer.compare(Buffer.from(left), Buffer.from(right)));
+  return `{${keys.filter((key) => object[key] !== void 0 && (!isStructured || !shouldOmitGoField(object, key))).map((key) => {
+    const childContext = context === "environment" ? "structured" : context === "map" ? "map" : key === "environment" ? "environment" : ["configuration", "credentials", "event"].includes(key) ? "map" : "structured";
+    const fieldValue = isStructured && ["expiresAt", "deadline", "issuedAt", "credentialExpiresAt", "observedAt"].includes(key) && typeof object[key] === "string" ? canonicalRFC3339Nano(object[key]) : object[key];
+    return `${encodeCanonicalValue(key)}:${encodeCanonicalValue(fieldValue, childContext)}`;
+  }).join(",")}}`;
+}
+function canonicalRFC3339Nano(value) {
+  const parts = /^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})(?:\.(\d{1,9}))?(Z|[+-]\d{2}:\d{2})$/.exec(value);
+  if (!parts || Number.isNaN(Date.parse(value))) throw new TypeError("project timestamp must be RFC3339Nano with at most nine fractional digits");
+  const fraction = (parts[2] ?? "").replace(/0+$/, "");
+  const offset = parts[3] === "+00:00" || parts[3] === "-00:00" ? "Z" : parts[3];
+  return `${parts[1]}${fraction ? `.${fraction}` : ""}${offset}`;
+}
+function shouldOmitGoField(object, key) {
+  const value = object[key];
+  if (value === void 0) return true;
+  if (["expiresAt", "credential", "mutation", "credentialBroker", "secretRef"].includes(key)) return value === null;
+  if (["authMethodId", "sharedConnectionId", "attemptId"].includes(key)) return value === "";
+  if (key === "environment") return value === null || typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === 0;
+  return false;
+}
+function canonicalFieldOrder(object) {
+  const keys = Object.keys(object);
+  let preferred = [];
+  if ("schemaVersion" in object && "operationConfigurations" in object) preferred = ["schemaVersion", "scope", "revision", "connections", "triggerBindings", "operationConfigurations", "environment", "credentialBroker"];
+  else if ("schemaVersion" in object && "status" in object) preferred = ["schemaVersion", "connection", "scope", "revision", "fence", "status", "expiresAt", "authMethod", "credential", "mutation"];
+  else if ("schemaVersion" in object && "credentials" in object) preferred = ["schemaVersion", "scope", "connection", "fence", "attemptId", "credentials", "expiresAt", "authMethod"];
+  else if ("projectId" in object && "kind" in object) preferred = ["projectId", "kind"];
+  else if ("connectorId" in object && "modulePath" in object) preferred = ["connectorId", "connectionName", "modulePath", "provider", "authMethodId", "sharedConnectionId", "configuration"];
+  else if ("connectorId" in object && "triggerName" in object) preferred = ["connectorId", "connectionName", "triggerName", "bindingName", "configuration"];
+  else if ("connectorId" in object && "flowType" in object) preferred = ["connectorId", "connectionName", "operationId", "flowType", "stepType", "configuration"];
+  else if ("connectorId" in object && "connectionName" in object) preferred = ["connectorId", "connectionName"];
+  else if ("kind" in object && "invocationId" in object) preferred = ["kind", "invocationId", "id", "fence", "baseRevision", "deadline", "resultKey"];
+  else if ("endpoint" in object && "tokenSecretRef" in object) preferred = ["endpoint", "tokenSecretRef"];
+  else if ("value" in object || "secretRef" in object) preferred = ["value", "secretRef"];
+  else if ("key" in object && "version" in object && "digest" in object) preferred = ["key", "version", "digest"];
+  const selected = preferred.filter((key) => keys.includes(key));
+  return selected.concat(keys.filter((key) => !selected.includes(key)).sort((left, right) => Buffer.compare(Buffer.from(left), Buffer.from(right))));
+}
+function validateContents(contents) {
+  if (!contents.length || contents.length > 4 << 20) throw new TypeError("project object body is empty or oversized");
+}
+function classifyStorageError(error, isWrite) {
+  const code = error !== null && typeof error === "object" && "name" in error ? String(error.name) : "";
+  if (["NoSuchKey", "NoSuchVersion", "NotFound"].includes(code)) return new ObjectNotFoundError();
+  if (["PreconditionFailed", "ConditionalRequestConflict", "OperationAborted"].includes(code)) return new ConflictError();
+  return isWrite ? new OutcomeUnknownError() : new Error("project object read failed");
+}
+
+// src/projectconfig/environment.ts
+import { readFile as readFile2, lstat as lstat2 } from "fs/promises";
+import { dirname as dirname2, join as join2 } from "path";
+import { S3Client as S3Client2 } from "@aws-sdk/client-s3";
+import { z as z4 } from "zod";
+
+// src/projectconfig/connection_schema.ts
+import { z as z2 } from "zod";
+var ConnectionRecordSchema = z2.strictObject({
+  schemaVersion: z2.literal("connectors.dex.dev/project-connection/v1alpha2"),
+  connection: z2.strictObject({ connectorId: z2.string(), connectionName: z2.string() }),
+  scope: ScopeSchema,
+  revision: z2.number().int().positive(),
+  fence: z2.number().int().positive(),
+  status: z2.enum(["READY", "AUTHORIZING", "REFRESHING", "REAUTHORIZATION_REQUIRED", "REVOKED"]),
+  authMethod: z2.string(),
+  expiresAt: RFC3339NanoSchema.nullable().optional(),
+  credential: z2.strictObject({ key: z2.string(), version: z2.string(), digest: z2.string() }).optional(),
+  mutation: z2.strictObject({ kind: z2.string(), invocationId: z2.string(), id: z2.string(), fence: z2.number(), baseRevision: z2.number(), deadline: RFC3339NanoSchema, resultKey: z2.string() }).optional()
+});
+var CredentialEnvelopeSchema = z2.strictObject({
+  schemaVersion: z2.literal("connectors.dex.dev/project-connection/v1alpha2"),
+  scope: ScopeSchema,
+  connection: z2.strictObject({ connectorId: z2.string(), connectionName: z2.string() }),
+  fence: z2.number().int().positive(),
+  attemptId: z2.string().optional(),
+  credentials: z2.record(z2.string(), z2.unknown()),
+  expiresAt: RFC3339NanoSchema.nullable().optional(),
+  authMethod: z2.string()
+});
+
+// src/projectconfig/connections.ts
+import { inspect as inspect2 } from "util";
+function connectionPath(scope, key) {
+  if (!/^[a-z][a-z0-9-]{1,62}$/.test(key.connectorId) || !key.connectionName || key.connectionName.trim() !== key.connectionName || key.connectionName.length > 256 || /[\0\r\n]/.test(key.connectionName)) throw new TypeError("invalid project connection key");
+  return `${scopePrefix(scope)}/connections/${key.connectorId}/${Buffer.from(key.connectionName).toString("base64url")}`;
+}
+var CredentialMaterial = class {
+  /** Capture complete private credentials and optional access expiry. */
+  constructor(credentials, expiresAt, authMethod) {
+    this.credentials = credentials;
+    this.expiresAt = expiresAt;
+    this.authMethod = authMethod;
+  }
+  credentials;
+  expiresAt;
+  authMethod;
+  /** Reject accidental durable JSON serialization. */
+  toJSON() {
+    throw new TypeError("credential material cannot be serialized");
+  }
+  /** Redact private material in logs. */
+  [inspect2.custom]() {
+    return "CredentialMaterial([REDACTED])";
+  }
+};
+var ConnectionStore = class {
+  /** Bind one object store and validated project scope. */
+  constructor(objects, scope, shared) {
+    this.objects = objects;
+    this.scope = scope;
+    this.shared = shared;
+    if (!objects) throw new TypeError("project connection object store is required");
+    scopePrefix(scope);
+  }
+  objects;
+  scope;
+  shared;
+  /** Read safe connection metadata without credential material. */
+  async readConnection(key) {
+    const { record } = await this.readRecord(key);
+    return this.#connection(key, record);
+  }
+  /** Read exact current private material from a READY connection. */
+  async readCredentialMaterial(key) {
+    const { record } = await this.readRecord(key);
+    const connection = this.#connection(key, record);
+    if (record.status !== "READY") throw new Error("project credential is unavailable");
+    return { material: await this.readMaterial(key, record), connection };
+  }
+  /** Read and validate a current head for refresh admission. */
+  async readRecord(key) {
+    const path = connectionPath(this.scope, key);
+    const object = await this.objects.readObject(`${path}/head`);
+    if (!object.version || !object.etag) throw new Error("project connection head lacks version identity");
+    const parsed = ConnectionRecordSchema.safeParse(parsePrivateJSON(object.contents));
+    if (!parsed.success) throw new Error("project connection identity is invalid");
+    const record = parsed.data;
+    if (record.scope.projectId !== this.scope.projectId || record.scope.kind !== this.scope.kind || record.connection.connectorId !== key.connectorId || record.connection.connectionName !== key.connectionName) throw new Error("project connection identity is invalid");
+    if (record.status === "REVOKED" && (record.credential || record.mutation)) throw new Error("revoked connection retains active material");
+    if (["READY", "REFRESHING"].includes(record.status) && !record.credential) throw new Error("project credential reference is absent");
+    if (record.credential && (!record.credential.key.startsWith(`${path}/`) || !record.credential.version || !/^[a-f0-9]{64}$/.test(record.credential.digest))) throw new Error("project credential reference is invalid");
+    if (record.status === "REFRESHING" || record.status === "AUTHORIZING") {
+      const mutation = record.mutation;
+      if (!mutation || mutation.kind !== record.status || mutation.fence !== record.fence || mutation.baseRevision !== record.revision - 1 || !/^[A-Za-z0-9_-]{1,128}$/.test(mutation.id) || !mutation.invocationId || mutation.resultKey !== `${path}/exchange-results/${mutation.id}`) throw new Error("credential exchange admission is invalid");
+    } else if (record.mutation) throw new Error("inactive credential exchange admission is invalid");
+    return { record, object };
+  }
+  /** Read private material by an already validated head. */
+  async readMaterial(key, record) {
+    const reference = record.credential;
+    if (!reference) throw new Error("project credential reference is absent");
+    const object = await this.objects.readObject(reference.key, reference.version);
+    if (digestBytes(object.contents).slice(7) !== reference.digest) throw new Error("project credential integrity differs");
+    const parsed = CredentialEnvelopeSchema.safeParse(parsePrivateJSON(object.contents));
+    if (!parsed.success) throw new Error("project credential envelope violates its schema");
+    const envelope = parsed.data;
+    if (envelope.scope.projectId !== this.scope.projectId || envelope.scope.kind !== this.scope.kind || envelope.connection.connectorId !== key.connectorId || envelope.connection.connectionName !== key.connectionName || envelope.authMethod !== record.authMethod || !sameExpiry(envelope.expiresAt, record.expiresAt)) throw new Error("project credential identity differs");
+    return new CredentialMaterial(envelope.credentials, parseExpiry(envelope.expiresAt), envelope.authMethod);
+  }
+  /** Fence prior work and publish one complete immutable credential version. */
+  async replaceCredential(key, expectedRevision, material) {
+    if (!material.authMethod || !material.credentials || typeof material.credentials !== "object" || Array.isArray(material.credentials)) throw new TypeError("invalid credential material");
+    const path = connectionPath(this.scope, key);
+    let previous;
+    try {
+      previous = await this.readRecord(key);
+    } catch (error) {
+      if (!(error instanceof ObjectNotFoundError && expectedRevision === 0)) throw error;
+    }
+    if ((previous?.record.revision ?? 0) !== expectedRevision) throw new ConflictError();
+    const fence = (previous?.record.fence ?? 0) + 1;
+    const envelope = credentialEnvelope(this.scope, key, fence, material);
+    const contents = Buffer.from(encodeGoCompatibleJSON(envelope));
+    const immutableKey = `${path}/credentials/${digestBytes(contents).slice(7)}`;
+    let created;
+    try {
+      created = await this.objects.createObject(immutableKey, contents);
+    } catch (error) {
+      if (!(error instanceof ConflictError || error instanceof OutcomeUnknownError)) throw error;
+      created = await this.objects.readObject(immutableKey);
+      if (!Buffer.from(created.contents).equals(contents)) throw new Error("immutable credential content differs");
+    }
+    const reference = { key: immutableKey, version: created.version, digest: digestBytes(contents).slice(7) };
+    const record = connectionRecord(this.scope, key, expectedRevision + 1, fence, "READY", material.expiresAt, material.authMethod, reference);
+    await this.writeHead(key, previous?.object, record);
+    return this.#connection(key, record);
+  }
+  /** Conditionally publish a new head and reconcile an unknown write outcome. */
+  async writeHead(key, previous, record) {
+    const path = connectionPath(this.scope, key);
+    const contents = Buffer.from(encodeGoCompatibleJSON(record));
+    try {
+      return previous ? await this.objects.compareAndSwapObject(`${path}/head`, previous.etag, contents) : await this.objects.createObject(`${path}/head`, contents);
+    } catch (error) {
+      if (!(error instanceof OutcomeUnknownError)) throw error;
+      const observed = await this.objects.readObject(`${path}/head`);
+      if (!Buffer.from(observed.contents).equals(contents)) throw error;
+      return observed;
+    }
+  }
+  #connection(key, record) {
+    const expiresAt = parseExpiry(record.expiresAt);
+    return { key, scope: this.scope, revision: record.revision, fence: record.fence, status: record.status, authMethod: record.authMethod, ...expiresAt ? { expiresAt } : {} };
+  }
+};
+function credentialEnvelope(scope, key, fence, material, attemptId) {
+  return { schemaVersion: "connectors.dex.dev/project-connection/v1alpha2", scope, connection: key, fence, ...attemptId ? { attemptId } : {}, credentials: material.credentials, ...material.expiresAt ? { expiresAt: material.expiresAt.toISOString() } : {}, authMethod: material.authMethod };
+}
+function connectionRecord(scope, key, revision, fence, status, expiresAt, authMethod, credential, mutation) {
+  return ConnectionRecordSchema.parse({ schemaVersion: "connectors.dex.dev/project-connection/v1alpha2", connection: key, scope, revision, fence, status, ...expiresAt ? { expiresAt: expiresAt.toISOString() } : {}, authMethod, ...credential ? { credential } : {}, ...mutation ? { mutation } : {} });
+}
+function parsePrivateJSON(contents) {
+  try {
+    return JSON.parse(Buffer.from(contents).toString("utf8"));
+  } catch {
+    throw new Error("project credential is not valid JSON");
+  }
+}
+function parseExpiry(value) {
+  return value ? new Date(value) : void 0;
+}
+function sameExpiry(left, right) {
+  return left && right ? rfc3339Nanoseconds(left) === rfc3339Nanoseconds(right) : !left && !right;
+}
+function rfc3339Nanoseconds(value) {
+  const parts = /^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})(?:\.(\d{1,9}))?(Z|[+-]\d{2}:\d{2})$/.exec(value);
+  if (!parts) throw new Error("project credential expiry is invalid");
+  const milliseconds = Date.parse(`${parts[1]}${parts[3]}`);
+  if (!Number.isFinite(milliseconds)) throw new Error("project credential expiry is invalid");
+  return BigInt(milliseconds) * 1000000n + BigInt((parts[2] ?? "").padEnd(9, "0") || "0");
+}
+
+// src/projectconfig/dexweb_store.ts
+import { randomUUID, createHash as createHash2 } from "crypto";
+import { lstat, open, readFile, rename, unlink } from "fs/promises";
+import { dirname, join } from "path";
+var DexWebObjectStore = class {
+  /** Bind a mode-0600 connections.json file and local project scope. */
+  constructor(path, scope) {
+    this.path = path;
+    this.#connections = new ConnectionStore(this.#memory, scope);
+  }
+  path;
+  #memory = new InMemoryObjectStore();
+  #connections;
+  #imported = /* @__PURE__ */ new Map();
+  #lockTail = Promise.resolve();
+  /** Import current Dex Web credentials before application registration. */
+  async initialize() {
+    await this.#withLock(() => this.#sync());
+  }
+  /** Adopt Dex Web updates before reading a connection head. */
+  async readObject(key, version = "") {
+    if (isConnectionHead(key)) return this.#withLock(async () => {
+      await this.#sync();
+      return this.#memory.readObject(key, version);
+    });
+    return this.#memory.readObject(key, version);
+  }
+  /** Create an immutable private object in process memory. */
+  async createObject(key, contents) {
+    return this.#memory.createObject(key, contents);
+  }
+  /** CAS a head, then write back a refreshed credential if the file is still current. */
+  async compareAndSwapObject(key, expectedETag, contents) {
+    if (!isConnectionHead(key)) return this.#memory.compareAndSwapObject(key, expectedETag, contents);
+    return this.#withLock(async () => {
+      await this.#sync();
+      const object = await this.#memory.compareAndSwapObject(key, expectedETag, contents);
+      await this.#writeBack(object);
+      return object;
+    });
+  }
+  async #sync() {
+    const file = await readDexWebFile(this.path);
+    for (const connection of file.connections) {
+      const key = { connectorId: connection.connectorId, connectionName: connection.connectionName };
+      const expiresAt = connection.credentialExpiresAt ? new Date(connection.credentialExpiresAt) : void 0;
+      const authMethod = connection.authMethodId || (connection.authMethodIds?.length === 1 ? connection.authMethodIds[0] : "local");
+      const material = new CredentialMaterial(connection.credentials, expiresAt, authMethod);
+      const digest = credentialDigest(connection.credentials, connection.credentialExpiresAt);
+      if (this.#imported.get(keyString(key)) === digest) continue;
+      let revision = 0;
+      try {
+        revision = (await this.#connections.readConnection(key)).revision;
+      } catch (error) {
+        if (!(error instanceof ObjectNotFoundError)) throw error;
+      }
+      await this.#connections.replaceCredential(key, revision, material);
+      this.#imported.set(keyString(key), digest);
+    }
+  }
+  async #writeBack(head) {
+    const parsed = ConnectionRecordSchema.safeParse(parseJSON(head.contents));
+    if (!parsed.success || parsed.data.status !== "READY" || !parsed.data.credential) return;
+    const key = parsed.data.connection;
+    try {
+      const material = await this.#connections.readMaterial(key, parsed.data);
+      const digest = credentialDigest(material.credentials, material.expiresAt?.toISOString());
+      if (digest === this.#imported.get(keyString(key))) return;
+      await this.#replaceInFile(key, material);
+      this.#imported.set(keyString(key), digest);
+    } catch {
+      console.warn("local connector credential write-back skipped");
+    }
+  }
+  async #replaceInFile(key, material) {
+    const file = await readDexWebFile(this.path);
+    const record = file.connections.find((connection) => connection.connectorId === key.connectorId && connection.connectionName === key.connectionName);
+    if (!record) throw new Error("the connection is no longer in the file");
+    if (credentialDigest(record.credentials, record.credentialExpiresAt) !== this.#imported.get(keyString(key))) throw new Error("the file holds a newer credential");
+    record.credentials = material.credentials;
+    if (material.expiresAt) record.credentialExpiresAt = material.expiresAt.toISOString();
+    else delete record.credentialExpiresAt;
+    await writePrivateFile(this.path, Buffer.from(`${JSON.stringify(file, null, 2)}
+`));
+  }
+  async #withLock(action) {
+    const previous = this.#lockTail;
+    let release;
+    this.#lockTail = new Promise((resolve) => {
+      release = resolve;
+    });
+    await previous;
+    try {
+      return await action();
+    } finally {
+      release();
+    }
+  }
+};
+function isConnectionHead(key) {
+  return key.includes("/connections/") && key.endsWith("/head");
+}
+function keyString(key) {
+  return `${key.connectorId}\0${key.connectionName}`;
+}
+function credentialDigest(credentials, expiresAt) {
+  const canonical = encodeGoCompatibleJSON(credentials);
+  const expiry = expiresAt ? JSON.parse(encodeGoCompatibleJSON({ expiry: expiresAt })).expiry : "";
+  return createHash2("sha256").update(`${canonical}${expiry ? `|${expiry}` : ""}`).digest("hex");
+}
+async function readDexWebFile(path) {
+  const stat = await lstat(path);
+  if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 511) !== 384) throw new Error("connector configuration file must be a regular mode-0600 file");
+  let raw;
+  try {
+    raw = JSON.parse(await readFile(path, "utf8"));
+  } catch {
+    throw new Error("connector configuration file is not valid JSON or not private");
+  }
+  const validated = LocalConnectionsFileSchema.safeParse(raw);
+  if (!validated.success || !raw || typeof raw !== "object" || Array.isArray(raw)) throw new Error("connector configuration file violates its schema");
+  return raw;
+}
+function parseJSON(contents) {
+  try {
+    return JSON.parse(Buffer.from(contents).toString("utf8"));
+  } catch {
+    return void 0;
+  }
+}
+async function writePrivateFile(path, contents) {
+  const temporary = join(dirname(path), `.write-${randomUUID()}`);
+  const handle = await open(temporary, "wx", 384);
+  let isClosed = false;
+  try {
+    await handle.writeFile(contents);
+    await handle.sync();
+    await handle.close();
+    isClosed = true;
+    await rename(temporary, path);
+  } finally {
+    if (!isClosed) await handle.close();
+    await unlink(temporary).catch(() => void 0);
+  }
+}
+
+// src/projectconfig/broker.ts
+import { z as z3 } from "zod";
+var CredentialBrokerUnavailableError = class extends Error {
+  constructor() {
+    super("credential broker is unavailable");
+    this.name = "CredentialBrokerUnavailableError";
+  }
+};
+var CredentialBrokerRejectedError = class extends Error {
+  constructor() {
+    super("credential broker rejected the request or answered invalidly");
+    this.name = "CredentialBrokerRejectedError";
+  }
+};
+var ConnectionNotSelectedError = class extends Error {
+  constructor() {
+    super("project connection is not selected by this scope");
+    this.name = "ConnectionNotSelectedError";
+  }
+};
+var RejectedCredentialNotRefreshedError = class extends Error {
+  constructor() {
+    super("the rejected credential was not refreshed");
+    this.name = "RejectedCredentialNotRefreshedError";
+  }
+};
+var BrokerAnswerSchema = z3.object({
+  status: z3.enum(["READY", "REAUTHORIZATION_REQUIRED", "CONNECTION_NOT_SELECTED"]),
+  credential: z3.record(z3.string(), z3.unknown()).nullable().optional(),
+  revision: z3.number().int().nonnegative().optional(),
+  issuedAt: RFC3339NanoSchema.nullable().optional(),
+  expiresAt: RFC3339NanoSchema.nullable().optional()
+});
+var CredentialBrokerClient = class {
+  /** Bind a trusted endpoint, token source, and optional transport; tokens renew only after 401. */
+  constructor(endpoint, readToken, transport = fetch) {
+    this.endpoint = endpoint;
+    this.readToken = readToken;
+    this.transport = transport;
+    let parsed;
+    try {
+      parsed = new URL(endpoint);
+    } catch {
+      throw new TypeError("credential broker endpoint is invalid");
+    }
+    if (!["https:", "http:"].includes(parsed.protocol) || parsed.username || parsed.password || parsed.search || parsed.hash || parsed.protocol === "http:" && !isPrivateBrokerHost(parsed.hostname)) throw new TypeError("credential broker endpoint is invalid");
+  }
+  endpoint;
+  readToken;
+  transport;
+  #token;
+  /** Read a shared credential; rejectedRevision is sent only when positive. */
+  async read(sharedConnectionId, rejectedRevision = 0, signal) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(sharedConnectionId)) throw new TypeError("shared connection ID is invalid");
+    const timeoutSignal = AbortSignal.timeout(4e4);
+    const requestSignal = signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal;
+    return new Promise((resolve, reject) => {
+      const onAbort = () => reject(new CredentialBrokerUnavailableError());
+      if (requestSignal.aborted) {
+        onAbort();
+        return;
+      }
+      requestSignal.addEventListener("abort", onAbort, { once: true });
+      void this.readWithinDeadline(sharedConnectionId, rejectedRevision, requestSignal).then(resolve, reject).finally(() => requestSignal.removeEventListener("abort", onAbort));
+    });
+  }
+  async readWithinDeadline(sharedConnectionId, rejectedRevision, requestSignal) {
+    let token = this.#token ?? await this.readToken();
+    if (!isHeaderSafeBrokerToken(token)) throw new CredentialBrokerRejectedError();
+    this.#token = token;
+    const payload = JSON.stringify({ sharedConnectionId, ...rejectedRevision > 0 ? { rejectedRevision } : {} });
+    let response;
+    response = await this.post(token, payload, requestSignal);
+    if (response.status === 401) {
+      const renewedToken = await this.readToken(true);
+      if (!isHeaderSafeBrokerToken(renewedToken) || renewedToken === token) throw new CredentialBrokerRejectedError();
+      token = renewedToken;
+      this.#token = token;
+      response = await this.post(token, payload, requestSignal);
+    }
+    if (response.status !== 200) {
+      if ([408, 425, 429].includes(response.status) || response.status >= 500) throw new CredentialBrokerUnavailableError();
+      throw new CredentialBrokerRejectedError();
+    }
+    let body;
+    try {
+      body = await readBoundedBody(responseChunks(response.body), 1 << 20);
+    } catch (error) {
+      throw error instanceof BodyTooLargeError || error instanceof CredentialBrokerRejectedError ? new CredentialBrokerRejectedError() : new CredentialBrokerUnavailableError();
+    }
+    let decoded;
+    try {
+      decoded = JSON.parse(Buffer.from(body).toString("utf8"));
+    } catch {
+      throw new CredentialBrokerRejectedError();
+    }
+    const parsed = BrokerAnswerSchema.safeParse(decoded);
+    if (!parsed.success) throw new CredentialBrokerRejectedError();
+    if (parsed.data.status === "REAUTHORIZATION_REQUIRED") throw new ReauthorizationRequiredError();
+    if (parsed.data.status === "CONNECTION_NOT_SELECTED") throw new ConnectionNotSelectedError();
+    if (!parsed.data.credential || !parsed.data.revision || Buffer.byteLength(JSON.stringify(parsed.data.credential)) > 64 << 10) throw new CredentialBrokerRejectedError();
+    if (parsed.data.expiresAt && Date.parse(parsed.data.expiresAt) <= Date.now()) throw new CredentialBrokerUnavailableError();
+    return {
+      credential: parsed.data.credential,
+      revision: parsed.data.revision,
+      ...parsed.data.issuedAt ? { issuedAt: parsed.data.issuedAt } : {},
+      ...parsed.data.expiresAt !== void 0 ? { expiresAt: parsed.data.expiresAt } : {}
+    };
+  }
+  async post(token, payload, signal) {
+    try {
+      return await this.transport(this.endpoint, {
+        method: "POST",
+        redirect: "manual",
+        signal: signal ?? null,
+        headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json", Accept: "application/json" },
+        body: payload
+      });
+    } catch {
+      throw new CredentialBrokerUnavailableError();
+    }
+  }
+};
+function isHeaderSafeBrokerToken(token) {
+  return Boolean(token) && ![...token].some((character) => {
+    const code = character.charCodeAt(0);
+    return code < 33 || code > 126;
+  });
+}
+async function* responseChunks(body) {
+  if (!body) throw new CredentialBrokerRejectedError();
+  const reader = body.getReader();
+  try {
+    while (true) {
+      const next = await reader.read();
+      if (next.done) return;
+      yield next.value;
+    }
+  } finally {
+    try {
+      await reader.cancel();
+    } catch {
+    }
+    reader.releaseLock();
+  }
+}
+
+// src/projectconfig/shared_connections.ts
+var SharedConnections = class {
+  /** Bind shared entries to the project's trusted credential broker. */
+  constructor(configuration, broker) {
+    this.broker = broker;
+    for (const connection of configuration.connections) {
+      if (connection.sharedConnectionId) this.#entries.set(keyString2(connection), {
+        id: connection.sharedConnectionId,
+        cached: void 0,
+        readAt: 0,
+        notBefore: 0,
+        issuedByCall: /* @__PURE__ */ new Map(),
+        pending: void 0
+      });
+    }
+  }
+  broker;
+  #entries = /* @__PURE__ */ new Map();
+  /** Whether a loaded connection resolves through the broker. */
+  has(key) {
+    return this.#entries.has(keyString2(key));
+  }
+  /** Read a current shared credential and remember the revision issued to this call. */
+  async read(key, callId, signal) {
+    const entry = this.#entry(key);
+    const now = Date.now();
+    let credential;
+    if (entry.cached && isFresh(entry, now)) credential = entry.cached;
+    else if (entry.pending && entry.cached && isUnexpired(entry.cached, now)) credential = entry.cached;
+    else {
+      try {
+        credential = await this.#readBroker(entry, 0, signal);
+      } catch (error) {
+        if (error instanceof CredentialBrokerUnavailableError && entry.cached && isUnexpired(entry.cached, Date.now())) {
+          entry.notBefore = Date.now() + 1e4;
+          credential = entry.cached;
+        } else throw error;
+      }
+    }
+    rememberIssued(entry, callId, credential.revision);
+    return credential;
+  }
+  /** Ask the broker for a revision newer than the one issued to this call. */
+  async readAfterRejection(key, callId, signal) {
+    const entry = this.#entry(key);
+    const issued = entry.issuedByCall.get(callId) ?? 0;
+    if (entry.pending) await entry.pending;
+    if (entry.cached && entry.cached.revision > issued && isUnexpired(entry.cached, Date.now())) {
+      rememberIssued(entry, callId, entry.cached.revision);
+      return entry.cached;
+    }
+    const credential = await this.#readBroker(entry, issued, signal);
+    if (issued > 0 && credential.revision === issued) throw new RejectedCredentialNotRefreshedError();
+    rememberIssued(entry, callId, credential.revision);
+    return credential;
+  }
+  #entry(key) {
+    const entry = this.#entries.get(keyString2(key));
+    if (!entry) throw new TypeError("connection is not a loaded shared selection");
+    return entry;
+  }
+  async #readBroker(entry, rejectedRevision, signal) {
+    if (entry.pending) return entry.pending;
+    const pending = this.broker.read(entry.id, rejectedRevision, signal).then((credential) => {
+      entry.cached = credential;
+      entry.readAt = Date.now();
+      entry.notBefore = entry.readAt + 1e3;
+      return credential;
+    }, (error) => {
+      if (error instanceof ReauthorizationRequiredError || error instanceof ConnectionNotSelectedError) entry.cached = void 0;
+      throw error;
+    });
+    entry.pending = pending;
+    try {
+      return await pending;
+    } finally {
+      if (entry.pending === pending) entry.pending = void 0;
+    }
+  }
+};
+function keyString2(key) {
+  return `${key.connectorId}\0${key.connectionName}`;
+}
+function isUnexpired(credential, now) {
+  return !credential.expiresAt || Date.parse(credential.expiresAt) > now;
+}
+function isFresh(entry, now) {
+  const credential = entry.cached;
+  if (!credential || !isUnexpired(credential, now)) return false;
+  if (now < entry.notBefore) return true;
+  if (!credential.expiresAt) return now - entry.readAt < 15 * 6e4;
+  const lifetime = credential.issuedAt ? Date.parse(credential.expiresAt) - Date.parse(credential.issuedAt) : 0;
+  const skew = lifetime > 0 ? Math.min(5 * 6e4, lifetime / 4) : 5 * 6e4;
+  return Date.parse(credential.expiresAt) > now + skew;
+}
+function rememberIssued(entry, callId, revision) {
+  entry.issuedByCall.set(callId, revision);
+  if (entry.issuedByCall.size > 4096) entry.issuedByCall.delete(entry.issuedByCall.keys().next().value);
+}
+
+// src/projectconfig/environment.ts
+var LocalConnectionsFileEnvironment = "DEX_CONNECTOR_CONFIG_FILE";
+var LoadedProject = class {
+  /** Bind startup-pinned configuration to exactly one private credential source. */
+  constructor(configuration, snapshot, objects, _localFilePath, broker) {
+    this.configuration = configuration;
+    this.snapshot = snapshot;
+    this.broker = broker;
+    ConfigurationSchema.parse(configuration);
+    this.connections = new ConnectionStore(objects ?? new InMemoryObjectStore(), configuration.scope, broker ? new SharedConnections(configuration, broker) : void 0);
+  }
+  configuration;
+  snapshot;
+  broker;
+  #sharedCredentials = /* @__PURE__ */ new Map();
+  /** Versioned private connection store for generated provider adapters. */
+  connections;
+  /** Read a current private credential, never returning it through a Flow result. */
+  async resolveCredential(connectorId, connectionName, signal) {
+    const connection = this.configuration.connections.find((entry) => entry.connectorId === connectorId && entry.connectionName === connectionName);
+    if (!connection) throw new Error("project connection is not configured");
+    if (connection.sharedConnectionId) {
+      if (!this.broker) throw new Error("credential broker is not configured");
+      const cached = this.#sharedCredentials.get(connection.sharedConnectionId);
+      if (cached && isSharedCredentialFresh(cached, Date.now())) return cached.result.credential;
+      try {
+        const result = await this.broker.read(connection.sharedConnectionId, 0, signal);
+        this.#sharedCredentials.set(connection.sharedConnectionId, { result, readAt: Date.now(), notBefore: Date.now() + 1e3 });
+        return result.credential;
+      } catch (error) {
+        if (error instanceof CredentialBrokerUnavailableError && cached && isSharedCredentialUnexpired(cached.result, Date.now())) {
+          cached.notBefore = Date.now() + 1e4;
+          return cached.result.credential;
+        }
+        throw error;
+      }
+    }
+    const key = { connectorId, connectionName };
+    const connectionState = await this.connections.readConnection(key);
+    if (connectionState.status === "REAUTHORIZATION_REQUIRED" || connectionState.status === "REVOKED") throw new ReauthorizationRequiredError();
+    const { material } = await this.connections.readCredentialMaterial(key);
+    if (material.expiresAt && material.expiresAt.getTime() <= Date.now()) throw new Error("expired project credential requires refresh");
+    return material.credentials;
+  }
+  /** Resolve a newer shared credential after the provider rejected one revision. */
+  async resolveCredentialAfterRejection(connectorId, connectionName, rejectedRevision, signal) {
+    const connection = this.configuration.connections.find((entry) => entry.connectorId === connectorId && entry.connectionName === connectionName);
+    if (!connection?.sharedConnectionId || !this.broker || !Number.isSafeInteger(rejectedRevision) || rejectedRevision < 1) throw new TypeError("shared credential rejection identity is invalid");
+    const cached = this.#sharedCredentials.get(connection.sharedConnectionId);
+    if (cached && cached.result.revision > rejectedRevision && isSharedCredentialUnexpired(cached.result, Date.now())) return cached.result.credential;
+    const result = await this.broker.read(connection.sharedConnectionId, rejectedRevision, signal);
+    if (result.revision === rejectedRevision) throw new RejectedCredentialNotRefreshedError();
+    this.#sharedCredentials.set(connection.sharedConnectionId, { result, readAt: Date.now(), notBefore: Date.now() + 1e3 });
+    return result.credential;
+  }
+};
+function isSharedCredentialUnexpired(result, now) {
+  return !result.expiresAt || Date.parse(result.expiresAt) > now;
+}
+function isSharedCredentialFresh(cached, now) {
+  if (!isSharedCredentialUnexpired(cached.result, now)) return false;
+  if (now < cached.notBefore) return true;
+  if (!cached.result.expiresAt) return now - cached.readAt < 15 * 60 * 1e3;
+  const lifetime = cached.result.issuedAt ? Date.parse(cached.result.expiresAt) - Date.parse(cached.result.issuedAt) : 0;
+  const skew = lifetime > 0 ? Math.min(5 * 60 * 1e3, lifetime / 4) : 5 * 60 * 1e3;
+  return Date.parse(cached.result.expiresAt) > now + skew;
+}
+async function loadFromEnvironment(environment = process.env) {
+  const localFilePath = environment[LocalConnectionsFileEnvironment];
+  if (localFilePath) {
+    for (const name of ["DEX_PROJECT_ID", "DEX_PROJECT_SCOPE", "DEX_PROJECT_CONFIG_KEY", "DEX_PROJECT_STORAGE_BUCKET"]) {
+      if (environment[name]) throw new Error(`${LocalConnectionsFileEnvironment} and ${name} select different project configurations`);
+    }
+    const file = await readLocalConnectionsFile(localFilePath);
+    const scope2 = { projectId: "local", kind: "preview" };
+    const useFilePath = join2(dirname2(localFilePath), "use-configurations.json");
+    let operationConfigurations = [];
+    try {
+      const useFile = z4.object({ schemaVersion: z4.literal("connectors.dex.dev/local-use-configurations/v1alpha1"), operationConfigurations: z4.array(z4.object({ connectorId: z4.string(), connectionName: z4.string(), operationId: z4.string(), flowType: z4.string(), stepType: z4.string(), configuration: z4.record(z4.string(), z4.unknown()) })) }).parse(JSON.parse(await readPrivateFile(useFilePath)));
+      operationConfigurations = useFile.operationConfigurations;
+    } catch (error) {
+      if (!(error !== null && typeof error === "object" && "code" in error && error.code === "ENOENT")) throw new Error("connector use configuration file is invalid");
+    }
+    const configuration2 = {
+      schemaVersion: "connectors.dex.dev/project-configuration/v1alpha2",
+      scope: scope2,
+      revision: 1,
+      connections: file.connections.map(localConnectionConfiguration),
+      triggerBindings: file.triggerBindings ?? [],
+      operationConfigurations
+    };
+    const localObjects = new DexWebObjectStore(localFilePath, scope2);
+    await localObjects.initialize();
+    return new LoadedProject(configuration2, void 0, localObjects, localFilePath, void 0);
+  }
+  const scope = { projectId: environment.DEX_PROJECT_ID ?? "", kind: environment.DEX_PROJECT_SCOPE ?? "" };
+  scopePrefix(scope);
+  const allowLocalStorage = environment.DEX_PROJECT_ALLOW_LOCAL_STORAGE === "true";
+  if (!["", "true", "false"].includes(environment.DEX_PROJECT_ALLOW_LOCAL_STORAGE ?? "")) throw new Error("project local storage opt-in must be true or false");
+  const endpoint = environment.DEX_PROJECT_STORAGE_ENDPOINT;
+  if (Boolean(endpoint) !== allowLocalStorage) throw new Error("local project storage requires explicit local endpoint and opt-in");
+  if (endpoint && !isLocalStorageEndpoint(endpoint)) throw new Error("custom project storage endpoint requires a local fixture boundary");
+  const bucket = environment.DEX_PROJECT_STORAGE_BUCKET;
+  if (!bucket) throw new Error("project storage bucket is required");
+  const client = new S3Client2(endpoint ? { endpoint, forcePathStyle: true, maxAttempts: 1 } : { maxAttempts: 1 });
+  const objects = await S3ObjectStore.create({
+    client,
+    bucket,
+    allowUnencrypted: allowLocalStorage,
+    ...environment.DEX_PROJECT_STORAGE_PREFIX ? { prefix: environment.DEX_PROJECT_STORAGE_PREFIX } : {},
+    ...environment.DEX_PROJECT_STORAGE_KMS_KEY_ARN ? { kmsKeyId: environment.DEX_PROJECT_STORAGE_KMS_KEY_ARN } : {}
+  });
+  const snapshot = {
+    key: environment.DEX_PROJECT_CONFIG_KEY ?? "",
+    version: environment.DEX_PROJECT_CONFIG_VERSION ?? "",
+    digest: environment.DEX_PROJECT_CONFIG_DIGEST ?? "",
+    mediaType: "application/json"
+  };
+  const configuration = await new ConfigurationStore(objects, scope).readSnapshot(snapshot);
+  let tokenReference = configuration.credentialBroker?.tokenSecretRef;
+  const broker = configuration.credentialBroker ? new CredentialBrokerClient(configuration.credentialBroker.endpoint, async (renew = false) => {
+    if (renew) tokenReference = (await new ConfigurationStore(objects, scope).readConfiguration()).configuration.credentialBroker?.tokenSecretRef;
+    if (!tokenReference) throw new Error("credential broker token reference is unavailable");
+    const tokenObject = await objects.readObject(tokenReference.key, tokenReference.version);
+    if (digestBytes(tokenObject.contents) !== tokenReference.digest) throw new Error("credential broker token integrity differs");
+    return Buffer.from(tokenObject.contents).toString("utf8");
+  }) : void 0;
+  return new LoadedProject(configuration, snapshot, objects, void 0, broker);
+}
+async function readLocalConnectionsFile(path) {
+  let parsed;
+  try {
+    parsed = JSON.parse(await readPrivateFile(path));
+  } catch {
+    throw new Error("connector configuration file is not valid JSON or not private");
+  }
+  const result = LocalConnectionsFileSchema.safeParse(parsed);
+  if (!result.success) throw new Error("connector configuration file violates its schema");
+  return { connections: result.data.connections, ...result.data.triggerBindings ? { triggerBindings: result.data.triggerBindings } : {} };
+}
+async function readPrivateFile(path) {
+  const info = await lstat2(path);
+  if (!info.isFile() || info.isSymbolicLink() || (info.mode & 511) !== 384) throw new Error("connector configuration file must be a regular mode-0600 file");
+  return readFile2(path, "utf8");
+}
+function localConnectionConfiguration(entry) {
+  return {
+    connectorId: entry.connectorId,
+    connectionName: entry.connectionName,
+    modulePath: entry.modulePath,
+    provider: entry.provider,
+    configuration: entry.configuration,
+    ...entry.authMethodId ? { authMethodId: entry.authMethodId } : {}
+  };
+}
+function isLocalStorageEndpoint(value) {
+  try {
+    const endpoint = new URL(value);
+    const hostname = endpoint.hostname;
+    return ["http:", "https:"].includes(endpoint.protocol) && !endpoint.username && !endpoint.password && !endpoint.search && !endpoint.hash && (!endpoint.pathname || endpoint.pathname === "/") && isLocalStorageHost(hostname);
+  } catch {
+    return false;
+  }
+}
+
+// src/projectconfig/provider.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import { setTimeout as wait } from "timers/promises";
+var ExchangePendingError = class extends Error {
+  constructor() {
+    super("credential exchange is pending");
+    this.name = "ExchangePendingError";
+  }
+};
+var RefreshFailedError = class extends Error {
+  constructor(message = "project credential refresh failed; current authorization is kept") {
+    super(message);
+    this.name = "RefreshFailedError";
+  }
+};
+var CredentialProvider = class {
+  /** Bind one validated project connection and a credential decoder. */
+  constructor(store, key, decode, decodeShared) {
+    this.store = store;
+    this.key = key;
+    this.decode = decode;
+    this.decodeShared = decodeShared;
+    if (!store || !decode) throw new TypeError("project credential store and decoder are required");
+    connectionPath(store.scope, key);
+  }
+  store;
+  key;
+  decode;
+  decodeShared;
+  /** Read current private material without refreshing known-expired credentials. */
+  async resolve(call, signal) {
+    this.validateCall(call);
+    const effectiveSignal = signal ?? call.context.cancellationSignal;
+    throwIfAborted(effectiveSignal);
+    if (this.store.shared?.has(this.key)) return this.decodeSharedMaterial((await this.store.shared.read(this.key, call.id, effectiveSignal)).credential);
+    const { material, connection } = await this.store.readCredentialMaterial(this.key);
+    if (connection.expiresAt && connection.expiresAt.getTime() <= Date.now()) throw new Error("expired project credential requires refresh");
+    return this.decodeMaterial(material);
+  }
+  /** Read current material under an explicit cancellation signal. */
+  async resolveContext(call, signal) {
+    return this.resolve(call, signal);
+  }
+  /** Reject a call aimed at another configured connection. */
+  validateCall(call) {
+    if (!call || call.operation.connectorId !== this.key.connectorId || call.connection.name !== this.key.connectionName) throw new TypeError("connector call differs from configured project connection");
+    OperationRefSchema.parse(call.operation);
+  }
+  /** Decode private material without leaking invalid values in errors. */
+  decodeMaterial(material) {
+    try {
+      return this.decode(material.credentials);
+    } catch {
+      throw new TypeError("project credential decoding failed");
+    }
+  }
+  /** Decode a broker response with the connector's shared credential rules. */
+  decodeSharedMaterial(document) {
+    try {
+      return (this.decodeShared ?? this.decode)(document);
+    } catch {
+      throw new TypeError(this.decodeShared ? "shared project credential decoding failed" : "project credential decoding failed: this connector version does not support shared credentials");
+    }
+  }
+};
+var RefreshingCredentialProvider = class extends CredentialProvider {
+  #encode;
+  /** Bind a complete replacement encoder in addition to the decoder. */
+  constructor(store, key, decode, encode, decodeShared) {
+    super(store, key, decode, decodeShared);
+    if (!encode) throw new TypeError("project credential encoder is required");
+    this.#encode = encode;
+  }
+  /** Admit a durable refresh before one provider request; observers recover its result. */
+  async resolveWithRefresh(call, driver, signal) {
+    this.validateCall(call);
+    if (!driver) throw new TypeError("credential refresh driver is required");
+    const effectiveSignal = signal ?? call.context.cancellationSignal;
+    if (this.store.shared?.has(this.key)) return this.decodeSharedMaterial((await this.store.shared.read(this.key, call.id, effectiveSignal)).credential);
+    for (; ; ) {
+      throwIfAborted(effectiveSignal);
+      const { record, object } = await this.store.readRecord(this.key);
+      if (record.status === "REAUTHORIZATION_REQUIRED" || record.status === "REVOKED") throw new ReauthorizationRequiredError();
+      if (record.status === "AUTHORIZING" || record.status === "REFRESHING") {
+        if (record.status === "AUTHORIZING" && record.mutation && Date.now() < new Date(record.mutation.deadline).getTime()) throw new ExchangePendingError();
+        try {
+          await this.#recoverOrWait(record, effectiveSignal);
+        } catch (error) {
+          if (error instanceof ConflictError) continue;
+          throw error;
+        }
+        continue;
+      }
+      if (record.status !== "READY") throw new TypeError("project credential status is invalid");
+      const material = await this.store.readMaterial(this.key, record);
+      const credentials = this.decodeMaterial(material);
+      const now = /* @__PURE__ */ new Date();
+      const state = { credentials, now, ...material.expiresAt ? { expiresAt: material.expiresAt } : {} };
+      if ((!material.expiresAt || material.expiresAt.getTime() > now.getTime()) && !driver.refreshRequired(state)) return credentials;
+      let admission;
+      try {
+        admission = await this.#admitRefresh(record, object, now);
+      } catch (error) {
+        if (error instanceof ConflictError) continue;
+        throw error;
+      }
+      return this.#refreshAdmitted(admission, material, state, driver, effectiveSignal);
+    }
+  }
+  /** Force refresh only when stored expiry proves the rejected token expired. */
+  async resolveAfterRejection(call, driver, signal) {
+    this.validateCall(call);
+    if (!driver) throw new TypeError("credential refresh driver is required");
+    if (this.store.shared?.has(this.key)) return this.decodeSharedMaterial((await this.store.shared.readAfterRejection(this.key, call.id, signal ?? call.context.cancellationSignal)).credential);
+    const connection = await this.store.readConnection(this.key);
+    if (!connection.expiresAt || connection.expiresAt.getTime() > Date.now()) throw new RejectedCredentialNotRefreshedError();
+    return this.resolveWithRefresh(call, driver, signal);
+  }
+  async #admitRefresh(record, object, now) {
+    const attemptId = randomUUID2().replaceAll("-", "");
+    const deadline = new Date(now.getTime() + 4e4);
+    const resultKey = `${connectionPath(this.store.scope, this.key)}/exchange-results/${attemptId}`;
+    const mutation = { kind: "REFRESHING", invocationId: randomUUID2().replaceAll("-", ""), id: attemptId, fence: record.fence + 1, baseRevision: record.revision, deadline: deadline.toISOString(), resultKey };
+    const updated = connectionRecord(this.store.scope, this.key, record.revision + 1, record.fence + 1, "REFRESHING", parseExpiry2(record.expiresAt), record.authMethod, record.credential, mutation);
+    await this.store.writeHead(this.key, object, updated);
+    return { key: this.key, kind: "REFRESHING", attemptId, fence: updated.fence, deadline, resultKey };
+  }
+  async #refreshAdmitted(admission, prior, state, driver, signal) {
+    let result;
+    try {
+      result = await refreshWithinTimeout(driver, state, signal);
+    } catch (error) {
+      if (error instanceof ReauthorizationRequiredError) {
+        await this.#finishExchange(admission, "REAUTHORIZATION_REQUIRED");
+        throw error;
+      }
+      await this.#finishExchange(admission, "READY");
+      throw new RefreshFailedError();
+    }
+    if (!(result.expiresAt instanceof Date) || !Number.isFinite(result.expiresAt.getTime()) || result.expiresAt.getTime() <= Date.now()) {
+      await this.#finishExchange(admission, "READY");
+      throw new RefreshFailedError("refreshed credential has no future expiry");
+    }
+    let encoded;
+    try {
+      encoded = this.#encode(result.credentials);
+      if (!encoded || typeof encoded !== "object" || Array.isArray(encoded) || Object.keys(encoded).length === 0) throw new TypeError();
+    } catch {
+      await this.#finishExchange(admission, "READY");
+      throw new RefreshFailedError("refreshed credential encoding failed");
+    }
+    await this.#commitRefresh(admission, new CredentialMaterial(encoded, result.expiresAt, prior.authMethod));
+    return result.credentials;
+  }
+  async #recoverOrWait(record, signal) {
+    const mutation = record.mutation;
+    if (!mutation) throw new TypeError("credential exchange admission is absent");
+    const admission = { key: this.key, kind: record.status === "AUTHORIZING" ? "AUTHORIZING" : "REFRESHING", attemptId: mutation.id, fence: record.fence, deadline: new Date(mutation.deadline), resultKey: mutation.resultKey };
+    let result;
+    try {
+      result = await this.store.objects.readObject(admission.resultKey);
+    } catch (error) {
+      if (!(error instanceof ObjectNotFoundError)) throw error;
+      if (Date.now() < admission.deadline.getTime()) {
+        await wait(100, void 0, signal ? { signal } : void 0);
+        return;
+      }
+      await this.#finishExchange(admission, admission.kind === "AUTHORIZING" ? "REAUTHORIZATION_REQUIRED" : "READY");
+      return;
+    }
+    await this.#publishResult(admission, result);
+  }
+  async #commitRefresh(admission, material) {
+    const envelope = credentialEnvelope(this.store.scope, this.key, admission.fence, material, admission.attemptId);
+    const contents = Buffer.from(encodeGoCompatibleJSON(envelope));
+    let result;
+    try {
+      result = await this.store.objects.createObject(admission.resultKey, contents);
+    } catch (error) {
+      if (!(error instanceof ConflictError || error instanceof OutcomeUnknownError)) throw error;
+      result = await this.store.objects.readObject(admission.resultKey);
+      if (!Buffer.from(result.contents).equals(contents)) throw new Error("immutable credential result differs");
+    }
+    await this.#publishResult(admission, result);
+  }
+  async #publishResult(admission, result) {
+    const { record, object } = await this.store.readRecord(this.key);
+    if (record.status === "READY" && record.credential?.key === result.key) return;
+    requireAdmission(record, admission);
+    const parsed = CredentialEnvelopeSchema.safeParse(parsePrivateJSON2(result.contents));
+    if (!parsed.success) throw new TypeError("credential exchange result is invalid");
+    const envelope = parsed.data;
+    if (envelope.scope.projectId !== this.store.scope.projectId || envelope.scope.kind !== this.store.scope.kind || envelope.connection.connectorId !== this.key.connectorId || envelope.connection.connectionName !== this.key.connectionName || envelope.fence !== admission.fence || envelope.attemptId !== admission.attemptId) throw new TypeError("credential exchange result identity is invalid");
+    const reference = { key: result.key, version: result.version, digest: digestBytes(result.contents).slice(7) };
+    const updated = connectionRecord(this.store.scope, this.key, record.revision + 1, record.fence, "READY", parseExpiry2(envelope.expiresAt), envelope.authMethod, reference);
+    try {
+      await this.store.writeHead(this.key, object, updated);
+    } catch (error) {
+      if (!(error instanceof ConflictError)) throw error;
+      const observed = await this.store.readRecord(this.key);
+      if (observed.record.status !== "READY" || observed.record.credential?.key !== result.key) throw error;
+    }
+  }
+  async #finishExchange(admission, status) {
+    const { record, object } = await this.store.readRecord(this.key);
+    requireAdmission(record, admission);
+    const updated = connectionRecord(this.store.scope, this.key, record.revision + 1, record.fence + 1, status, parseExpiry2(record.expiresAt), record.authMethod, record.credential);
+    await this.store.writeHead(this.key, object, updated);
+  }
+};
+function newCredentialProvider(store, key, decode, decodeShared) {
+  return new CredentialProvider(store, key, decode, decodeShared);
+}
+function newRefreshingCredentialProvider(store, key, decode, encode, decodeShared) {
+  return new RefreshingCredentialProvider(store, key, decode, encode, decodeShared);
+}
+function requireAdmission(record, admission) {
+  if (record.status !== admission.kind || record.fence !== admission.fence || record.mutation?.id !== admission.attemptId || record.mutation.kind !== admission.kind) throw new ConflictError();
+}
+function parsePrivateJSON2(contents) {
+  try {
+    return JSON.parse(Buffer.from(contents).toString("utf8"));
+  } catch {
+    throw new TypeError("project credential is not valid JSON");
+  }
+}
+function parseExpiry2(value) {
+  return value ? new Date(value) : void 0;
+}
+function throwIfAborted(signal) {
+  if (signal?.aborted) throw signal.reason instanceof Error ? signal.reason : new Error("credential operation cancelled");
+}
+async function refreshWithinTimeout(driver, state, signal) {
+  const timeoutController = new AbortController();
+  const timer = setTimeout(() => timeoutController.abort(new Error("credential refresh timed out")), 3e4);
+  const refreshSignal = signal ? AbortSignal.any([signal, timeoutController.signal]) : timeoutController.signal;
+  let rejectInterruption;
+  const interrupted = new Promise((_resolve, reject) => {
+    rejectInterruption = reject;
+  });
+  const onAbort = () => rejectInterruption(new Error("credential refresh interrupted"));
+  if (refreshSignal.aborted) onAbort();
+  else refreshSignal.addEventListener("abort", onAbort, { once: true });
+  try {
+    return await Promise.race([driver.refresh(state, refreshSignal), interrupted]);
+  } finally {
+    clearTimeout(timer);
+    refreshSignal.removeEventListener("abort", onAbort);
+  }
+}
+export {
+  ApplicationSecretRefSchema,
+  BrokerAnswerSchema,
+  ConfigurationSchema,
+  ConfigurationSchemaVersion,
+  ConfigurationStore,
+  ConflictError,
+  ConnectionConfigurationSchema,
+  ConnectionNotSelectedError,
+  ConnectionRecordSchema,
+  ConnectionStore,
+  CredentialBrokerClient,
+  CredentialBrokerConfigurationSchema,
+  CredentialBrokerRejectedError,
+  CredentialBrokerUnavailableError,
+  CredentialEnvelopeSchema,
+  CredentialMaterial,
+  CredentialProvider,
+  DexWebObjectStore,
+  EnvironmentValueSchema,
+  ExchangePendingError,
+  InMemoryObjectStore,
+  LoadedProject,
+  LocalConnectionSchema,
+  LocalConnectionsFileEnvironment,
+  LocalConnectionsFileSchema,
+  LocalConnectionsSchemaVersion,
+  ObjectNotFoundError,
+  OperationConfigurationSchema,
+  OutcomeUnknownError,
+  ProjectObject,
+  RFC3339NanoSchema,
+  RefreshFailedError,
+  RefreshingCredentialProvider,
+  RejectedCredentialNotRefreshedError,
+  S3ObjectStore,
+  ScopeSchema,
+  SharedConnections,
+  SnapshotRefSchema,
+  TriggerConfigurationSchema,
+  connectionHeadKey,
+  connectionPath,
+  connectionRecord,
+  credentialEnvelope,
+  digestBytes,
+  encodeGoCompatibleJSON,
+  loadFromEnvironment,
+  newCredentialProvider,
+  newRefreshingCredentialProvider,
+  readLocalConnectionsFile,
+  scopePrefix,
+  validateObjectKey
+};