@superdurable/connectors-sdk 0.1.0 → 0.2.0

package/dist/index.d.ts

@@ -1,7 +1,9 @@
-import { C as Call, b as MutationResult, c as QueryResult, d as ConnectorConfigurationUI, e as ConnectionRef, P as ProgressUpdate } from './credentials-vrvW0d4j.js';
-export { f as BranchDefinition, g as BranchDefinitionSchema, B as BranchID, a as CallID, h as CallIDNamespace, i as CallIDSchema, j as CallProgressOptions, k as ConnectionRefSchema, l as ConnectorConfigurationRef, m as ConnectorConfigurationRefSchema, n as ConnectorConfigurationUISchema, o as ConnectorUIBinding, p as ConnectorUIBindingSchema, q as ConnectorUIUnit, r as ConnectorUIUnitSchema, s as ContextCredentialProvider, t as CredentialProvider, u as CredentialRefreshDriver, v as CredentialRefreshResult, w as CredentialRefreshState, D as DefectBranchID, F as Failure, x as FailureKind, y as FailureKindSchema, z as FailureSchema, I as IdempotencyKey, M as MutationAttempt, A as MutationDefinitionWire, E as MutationDefinitionWireSchema, G as MutationResultSchema, O as OperationRef, H as OperationRefSchema, J as Progress, Q as QueryAttempt, K as QueryDefinitionWire, L as QueryDefinitionWireSchema, N as QueryResultSchema, R as ReauthorizationRequiredError, S as Receipt, T as ReceiptDraft, V as ReceiptSchema, W as RefreshingCredentialProvider, X as RejectedCredentialRefreshingProvider, Y as RetryError, Z as RetryPolicy, _ as SecretString, $ as StaticCredentialProvider, a0 as StepDefaultsWire, a1 as StepDefaultsWireSchema, U as UncertainBranchID, a2 as createCall, a3 as defaultConnectorStepExecuteRetryPolicy, a4 as defaultIdempotencyKey, a5 as deriveCallID, a6 as newMutationBranch, a7 as newMutationRetry, a8 as newMutationUncertain, a9 as newQueryBranch, aa as newQueryRetry, ab as resolveCredential, ac as resolveCredentialAfterRejection, ad as retryPolicyToGoWire, ae as zeroReceipt } from './credentials-vrvW0d4j.js';
-import { M as Mutation, b as Query } from './operation-Ca8rfacf.js';
-export { a as MutationDefinition, Q as QueryDefinition, S as StepDefaults, v as validateMutationDefinition, c as validateQueryDefinition } from './operation-Ca8rfacf.js';
+import { a as MutationResult, b as QueryResult, c as ConnectorConfigurationUI, d as ConnectionRef } from './types-D6De3sry.js';
+export { e as BranchDefinition, f as BranchDefinitionSchema, B as BranchID, C as CallID, g as CallIDNamespace, h as CallIDSchema, i as ConnectionRefSchema, j as ConnectorConfigurationRef, k as ConnectorConfigurationRefSchema, l as ConnectorConfigurationUISchema, m as ConnectorUIBinding, n as ConnectorUIBindingSchema, o as ConnectorUIUnit, p as ConnectorUIUnitSchema, D as DefectBranchID, F as Failure, q as FailureKind, r as FailureKindSchema, s as FailureSchema, I as IdempotencyKey, M as MutationAttempt, t as MutationDefinitionWire, u as MutationDefinitionWireSchema, v as MutationResultSchema, O as OperationRef, w as OperationRefSchema, Q as QueryAttempt, x as QueryDefinitionWire, y as QueryDefinitionWireSchema, z as QueryResultSchema, R as ReauthorizationRequiredError, A as Receipt, E as ReceiptDraft, G as ReceiptSchema, H as RetryError, J as RetryPolicy, S as StepDefaultsWire, K as StepDefaultsWireSchema, U as UncertainBranchID, L as defaultConnectorStepExecuteRetryPolicy, N as defaultIdempotencyKey, P as deriveCallID, T as newMutationBranch, V as newMutationRetry, W as newMutationUncertain, X as newQueryBranch, Y as newQueryRetry, Z as retryPolicyToGoWire, _ as zeroReceipt } from './types-D6De3sry.js';
+import { C as Call, P as ProgressUpdate } from './credentials-JqG97kJ5.js';
+export { a as CallProgressOptions, b as ContextCredentialProvider, c as CredentialProvider, d as CredentialRefreshDriver, e as CredentialRefreshResult, f as CredentialRefreshState, g as Progress, R as RefreshingCredentialProvider, h as RejectedCredentialRefreshingProvider, S as SecretString, i as StaticCredentialProvider, j as createCall, r as resolveCredential, k as resolveCredentialAfterRejection } from './credentials-JqG97kJ5.js';
+import { M as Mutation, b as Query } from './operation-CASLOg86.js';
+export { a as MutationDefinition, Q as QueryDefinition, S as StepDefaults, v as validateMutationDefinition, c as validateQueryDefinition } from './operation-CASLOg86.js';
 import { StepTarget, Step, Codec, Attribute, Stream, BufferedTextStreamOptions, StepOptions, AsyncContext, StepDecision, StepRef } from '@superdurable/dex';
 import 'zod';
 

package/dist/index.js

@@ -1,14 +1,24 @@
+import {
+  MutationStep,
+  QueryStep,
+  goToBranch,
+  newMutationStep,
+  newQueryStep,
+  runMutation,
+  runQuery,
+  stepRef
+} from "./chunk-NQQJS6OC.js";
 import {
   validateMutationDefinition,
   validateQueryDefinition
-} from "./chunk-2NBM7P4T.js";
+} from "./chunk-32YJXBE4.js";
 import {
   SecretString,
   StaticCredentialProvider,
   createCall,
   resolveCredential,
   resolveCredentialAfterRejection
-} from "./chunk-KD5DYYSU.js";
+} from "./chunk-QDMBAWXD.js";
 import {
   BranchDefinitionSchema,
   CallIDNamespace,
@@ -19,16 +29,12 @@ import {
   ConnectorUIBindingSchema,
   ConnectorUIUnitSchema,
   DefectBranchID,
-  FailureKindSchema,
-  FailureSchema,
   MutationDefinitionWireSchema,
   MutationResultSchema,
   OperationRefSchema,
   QueryDefinitionWireSchema,
   QueryResultSchema,
-  ReauthorizationRequiredError,
   ReceiptSchema,
-  RetryError,
   StepDefaultsWireSchema,
   UncertainBranchID,
   defaultConnectorStepExecuteRetryPolicy,
@@ -41,291 +47,13 @@ import {
   newQueryRetry,
   retryPolicyToGoWire,
   zeroReceipt
-} from "./chunk-SOXYPIMO.js";
-
-// src/run_operation.ts
-async function runQuery(operation, call, input) {
-  if (!operation) return defectResult(void 0, call, "connector query is required");
-  const definition = operation.definition();
-  try {
-    validateQueryDefinition(definition);
-  } catch (error) {
-    return defectResult(definition, call, `invalid query definition: ${safeErrorMessage(error)}`);
-  }
-  const invalidCall = validateCall(call, definition.operation);
-  if (invalidCall) return defectResult(definition, call, invalidCall);
-  const attempt = await operation.invoke(call, input);
-  return resultFromAttempt(definition, call, attempt, "query");
-}
-async function runMutation(operation, call, input) {
-  if (!operation) return defectResult(void 0, call, "connector mutation is required");
-  const definition = operation.definition();
-  try {
-    validateMutationDefinition(definition);
-  } catch (error) {
-    return defectResult(definition, call, `invalid mutation definition: ${safeErrorMessage(error)}`);
-  }
-  const invalidCall = validateCall(call, definition.operation);
-  if (invalidCall) return defectResult(definition, call, invalidCall);
-  const chosenKey = operation.idempotencyKey(call.id, input) || call.id;
-  if (!chosenKey.trim()) return defectResult(definition, call, "mutation returned an invalid idempotency key");
-  const mutationCall = { ...call, context: call.context, idempotencyKey: chosenKey };
-  Object.defineProperty(mutationCall, "context", { value: call.context, enumerable: false });
-  for (const method of ["reportProgress", "writeText", "hasProgressStream", "hasTextStream"]) Object.defineProperty(mutationCall, method, { value: call[method], enumerable: false });
-  const attempt = await operation.invoke(mutationCall, input);
-  return resultFromAttempt(definition, mutationCall, attempt, "mutation");
-}
-function resultFromAttempt(definition, call, attempt, operationKind) {
-  if (!attempt || typeof attempt !== "object") return defectResult(definition, call, `${operationKind} returned an invalid attempt`);
-  if (attempt.kind === "retry") {
-    const failure = FailureSchema.safeParse(attempt.failure);
-    if (!failure.success || !Number.isSafeInteger(attempt.retryAfterMs) || attempt.retryAfterMs < 0) return defectResult(definition, call, `${operationKind} returned an invalid retry attempt`);
-    throw new RetryError(failure.data, attempt.retryAfterMs);
-  }
-  if (attempt.kind === "branch" || operationKind === "mutation" && attempt.kind === "uncertain") {
-    const branch = attempt.kind === "uncertain" ? UncertainBranchID : attempt.branch;
-    if (!definition.branches.some((declared) => declared.id === branch)) {
-      return defectResult(definition, call, attempt.kind === "uncertain" ? "mutation returned uncertainty without declaring the uncertain branch" : `${operationKind} returned an unknown branch`);
-    }
-    const failure = "failure" in attempt && attempt.failure !== void 0 ? FailureSchema.safeParse(attempt.failure) : void 0;
-    if (failure && !failure.success) return defectResult(definition, call, `${operationKind} returned an invalid failure`);
-    if (attempt.kind === "uncertain" && !failure) return defectResult(definition, call, "mutation returned an invalid uncertainty failure");
-    let receipt;
-    try {
-      receipt = completeReceipt(attempt.receipt, call);
-    } catch (error) {
-      return defectResult(definition, call, safeErrorMessage(error));
-    }
-    const result = { branch, value: attempt.value, receipt };
-    if (failure?.success) result.failure = failure.data;
-    return result;
-  }
-  return defectResult(definition, call, `${operationKind} returned an invalid attempt`);
-}
-function completeReceipt(draft, call) {
-  if (draft.callId && draft.callId !== call.id) throw new TypeError("operation returned a receipt for another call");
-  if (draft.idempotencyKey && draft.idempotencyKey !== call.idempotencyKey) throw new TypeError("operation returned a receipt with another idempotency key");
-  return ReceiptSchema.parse({ ...draft, callId: call.id, ...call.idempotencyKey ? { idempotencyKey: call.idempotencyKey } : {}, provider: draft.provider || call.operation.connectorId, observedAt: draft.observedAt && draft.observedAt !== "0001-01-01T00:00:00Z" ? draft.observedAt : (/* @__PURE__ */ new Date()).toISOString() });
-}
-function validateCall(call, operation) {
-  if (!call) return "connector call is required";
-  if (!CallIDSchema.safeParse(call.id).success) return "call ID must be a UUID";
-  if (!ConnectionRefSchema.safeParse(call.connection).success) return "connection provider and name are required";
-  if (!OperationRefSchema.safeParse(call.operation).success || call.operation.connectorId !== operation.connectorId || call.operation.operationId !== operation.operationId) return "connector call operation does not match the definition";
-  return void 0;
-}
-function defectResult(definition, call, message) {
-  const operation = definition?.operation;
-  const failure = { kind: "LOCAL_DEFECT", provider: operation?.connectorId || "connector", operation: operation?.operationId || "invoke", message };
-  const receipt = call && CallIDSchema.safeParse(call.id).success ? completeReceipt({}, call) : void 0;
-  return { branch: DefectBranchID, value: void 0, receipt, failure };
-}
-function safeErrorMessage(error) {
-  return error instanceof Error ? error.message : "invalid value";
-}
-
-// src/step.ts
-import { StepRef, forceFail, goTo, retryAfter } from "@superdurable/dex";
-function goToBranch(branch, target) {
-  return target ? { branch, target } : { branch };
-}
-function stepRef(stepType) {
-  return new StepRef(stepType);
-}
-var QueryStep = class {
-  inputCodec;
-  #configuration;
-  #options;
-  #ui;
-  #targets;
-  #optional;
-  #identity;
-  /** Validate static wiring before registering the Step in a Flow. */
-  constructor(configuration) {
-    if (!configuration?.operation) throw new TypeError("query operation is required");
-    const definition = configuration.operation.definition();
-    validateQueryDefinition(definition);
-    validateFactoryConfiguration(configuration);
-    const routes = validateBranchTargets(definition.branches, configuration.branches);
-    this.#configuration = configuration;
-    this.#options = mergeStepOptions(definition.stepDefaults, configuration.stepOptionsOverride);
-    this.#ui = ConnectorConfigurationUISchema.parse(configuration.configurationUI ?? { units: [] });
-    this.#targets = routes.targets;
-    this.#optional = routes.optional;
-    this.#identity = { operation: definition.operation, connection: configuration.connection };
-    if (configuration.inputCodec) this.inputCodec = configuration.inputCodec;
-  }
-  /** Stable Dex Step type. */
-  getStepType() {
-    return this.#configuration.stepType;
-  }
-  /** Isolated Execute options, including connector retry defaults. */
-  getStepOptions() {
-    return cloneStepOptions(this.#options);
-  }
-  /** Group metadata for Connector Studio. */
-  annotations() {
-    return { ...this.#configuration.annotations };
-  }
-  /** Isolated connector UI composition. */
-  configurationUI() {
-    return structuredClone(this.#ui);
-  }
-  /** Invoke, persist the optional terminal Attribute, and route the selected branch. */
-  async execute(context, input) {
-    const operationInput = this.#configuration.mapToOperationInput(input);
-    const call = createCall(context, this.#identity.connection, this.#identity.operation, {
-      ...this.#configuration.progressStream ? { progressStream: this.#configuration.progressStream } : {},
-      ...this.#configuration.textStream ? { textStream: this.#configuration.textStream } : {},
-      ...this.#configuration.textOptions ? { textOptions: this.#configuration.textOptions } : {}
-    });
-    let result;
-    try {
-      result = await runQuery(this.#configuration.operation, call, operationInput);
-    } catch (error) {
-      throwDexRetry(error);
-    }
-    if (this.#configuration.resultAttribute) context.setAttribute(this.#configuration.resultAttribute, result);
-    return routeBranch(this.#targets, this.#optional, result, this.#identity, "query");
-  }
-};
-var MutationStep = class {
-  inputCodec;
-  #configuration;
-  #options;
-  #ui;
-  #targets;
-  #optional;
-  #identity;
-  /** Validate static wiring before registering the Step in a Flow. */
-  constructor(configuration) {
-    if (!configuration?.operation) throw new TypeError("mutation operation is required");
-    const definition = configuration.operation.definition();
-    validateMutationDefinition(definition);
-    validateFactoryConfiguration(configuration);
-    const routes = validateBranchTargets(definition.branches, configuration.branches);
-    this.#configuration = configuration;
-    this.#options = mergeStepOptions(definition.stepDefaults, configuration.stepOptionsOverride);
-    this.#ui = ConnectorConfigurationUISchema.parse(configuration.configurationUI ?? { units: [] });
-    this.#targets = routes.targets;
-    this.#optional = routes.optional;
-    this.#identity = { operation: definition.operation, connection: configuration.connection };
-    if (configuration.inputCodec) this.inputCodec = configuration.inputCodec;
-  }
-  /** Stable Dex Step type. */
-  getStepType() {
-    return this.#configuration.stepType;
-  }
-  /** Isolated Execute options, including connector retry defaults. */
-  getStepOptions() {
-    return cloneStepOptions(this.#options);
-  }
-  /** Group metadata for Connector Studio. */
-  annotations() {
-    return { ...this.#configuration.annotations };
-  }
-  /** Isolated connector UI composition. */
-  configurationUI() {
-    return structuredClone(this.#ui);
-  }
-  /** Invoke, persist the optional terminal Attribute, and route the selected branch. */
-  async execute(context, input) {
-    const operationInput = this.#configuration.mapToOperationInput(input);
-    const call = createCall(context, this.#identity.connection, this.#identity.operation, {
-      ...this.#configuration.progressStream ? { progressStream: this.#configuration.progressStream } : {},
-      ...this.#configuration.textStream ? { textStream: this.#configuration.textStream } : {},
-      ...this.#configuration.textOptions ? { textOptions: this.#configuration.textOptions } : {}
-    });
-    let result;
-    try {
-      result = await runMutation(this.#configuration.operation, call, operationInput);
-    } catch (error) {
-      throwDexRetry(error);
-    }
-    if (this.#configuration.resultAttribute) context.setAttribute(this.#configuration.resultAttribute, result);
-    return routeBranch(this.#targets, this.#optional, result, this.#identity, "mutation");
-  }
-};
-function newQueryStep(configuration) {
-  return new QueryStep(configuration);
-}
-function newMutationStep(configuration) {
-  return new MutationStep(configuration);
-}
-function validateFactoryConfiguration(configuration) {
-  if (!configuration.stepType?.trim()) throw new TypeError("stable Step type is required");
-  if (!/^[a-z][a-z0-9-]*$/.test(configuration.annotations?.groupId ?? "") || !configuration.annotations.groupLabel?.trim() || !configuration.annotations.explanation?.trim()) throw new TypeError("Step group, group label, and explanation are required");
-  ConnectionRefSchema.parse(configuration.connection);
-  if (typeof configuration.mapToOperationInput !== "function") throw new TypeError("mapToOperationInput is required");
-}
-function validateBranchTargets(definitions, routes) {
-  const expected = new Map(definitions.map((branch) => [branch.id, branch]));
-  const targets = /* @__PURE__ */ new Map();
-  const optional = new Set(definitions.filter((branch) => branch.optional).map((branch) => branch.id));
-  for (const route of routes) {
-    if (!expected.has(route.branch)) throw new TypeError(`branch target ${route.branch} is not declared by the operation`);
-    if (!route.target) {
-      if (!optional.has(route.branch)) throw new TypeError(`branch target ${route.branch} must name a Step`);
-      continue;
-    }
-    if (route.target instanceof StepRef && !route.target.stepType.trim()) throw new TypeError(`branch target ${route.branch} must name a Step`);
-    if (typeof route.target === "object" && !(route.target instanceof StepRef) && !route.target.getStepType().trim()) throw new TypeError(`branch target ${route.branch} must name a Step`);
-    if (targets.has(route.branch)) throw new TypeError(`branch target ${route.branch} is duplicated`);
-    targets.set(route.branch, route.target);
-  }
-  for (const branch of definitions) if (!branch.optional && !targets.has(branch.id)) throw new TypeError(`branch target ${branch.id} is required`);
-  return { targets, optional };
-}
-function mergeStepOptions(defaults, override) {
-  if (override && Object.keys(override).some((key) => key.startsWith("waitFor") && override[key] !== void 0)) throw new TypeError("execute-only connector Step rejects WaitFor options");
-  const merged = {
-    ...override?.executeMethodTimeoutMs || defaults.executeMethodTimeoutMs ? { executeMethodTimeoutMs: override?.executeMethodTimeoutMs || defaults.executeMethodTimeoutMs } : {},
-    ...override?.heartbeatTimeoutMs || defaults.heartbeatTimeoutMs ? { heartbeatTimeoutMs: override?.heartbeatTimeoutMs || defaults.heartbeatTimeoutMs } : {},
-    executeRetry: { ...override?.executeRetry ?? defaults.executeRetry ?? defaultConnectorStepExecuteRetryPolicy() },
-    ...override?.executeDurability || (defaults.executeDurability !== "default" ? defaults.executeDurability : void 0) ? { executeDurability: override?.executeDurability ?? defaults.executeDurability } : {},
-    ...override?.executeFailure ? { executeFailure: override.executeFailure } : {},
-    ...override?.executeLockAttributes ? { executeLockAttributes: override.executeLockAttributes } : {},
-    ...override?.executeLoadAttributeMaps ? { executeLoadAttributeMaps: override.executeLoadAttributeMaps } : {},
-    ...override?.executeLoadAttributeMapInstances ? { executeLoadAttributeMapInstances: override.executeLoadAttributeMapInstances } : {},
-    ...override?.executeLoadChannels ? { executeLoadChannels: override.executeLoadChannels } : {},
-    ...override?.executeLoadChannelMaps ? { executeLoadChannelMaps: override.executeLoadChannelMaps } : {},
-    ...override?.executeLoadChannelMapInstances ? { executeLoadChannelMapInstances: override.executeLoadChannelMapInstances } : {}
-  };
-  return cloneStepOptions(merged);
-}
-function cloneStepOptions(options) {
-  return {
-    ...options,
-    ...options.executeRetry ? { executeRetry: { ...options.executeRetry } } : {},
-    ...options.executeLockAttributes ? { executeLockAttributes: [...options.executeLockAttributes] } : {},
-    ...options.executeLoadAttributeMaps ? { executeLoadAttributeMaps: [...options.executeLoadAttributeMaps] } : {},
-    ...options.executeLoadAttributeMapInstances ? { executeLoadAttributeMapInstances: [...options.executeLoadAttributeMapInstances] } : {},
-    ...options.executeLoadChannels ? { executeLoadChannels: [...options.executeLoadChannels] } : {},
-    ...options.executeLoadChannelMaps ? { executeLoadChannelMaps: [...options.executeLoadChannelMaps] } : {},
-    ...options.executeLoadChannelMapInstances ? { executeLoadChannelMapInstances: [...options.executeLoadChannelMapInstances] } : {}
-  };
-}
-function routeBranch(targets, optional, result, identity, operationKind) {
-  const target = targets.get(result.branch);
-  if (target) return goTo(target, result);
-  if (optional.has(result.branch)) {
-    let reason = `${identity.operation.connectorId} ${identity.operation.operationId} (connection ${identity.connection.name}) selected branch ${result.branch} with no target`;
-    if (result.failure) reason += `: ${result.failure.kind}: ${boundedFailureMessage(result.failure.message)}`;
-    return forceFail(reason);
-  }
-  throw new TypeError(`${operationKind} result selected unconfigured branch ${result.branch}`);
-}
-function boundedFailureMessage(message) {
-  const bytes = Buffer.from(message);
-  if (bytes.length <= 1024) return message;
-  let end = 1024;
-  while (end > 0 && (bytes[end] & 192) === 128) end--;
-  return `${bytes.subarray(0, end).toString("utf8")} (truncated)`;
-}
-function throwDexRetry(error) {
-  if (error instanceof RetryError && error.retryAfterMs >= 1e3) throw retryAfter(Math.floor(error.retryAfterMs / 1e3), error);
-  throw error;
-}
+} from "./chunk-BQGYGCOQ.js";
+import {
+  FailureKindSchema,
+  FailureSchema,
+  ReauthorizationRequiredError,
+  RetryError
+} from "./chunk-IHG6ADQG.js";
 export {
   BranchDefinitionSchema,
   CallIDNamespace,

package/dist/oauthtoken/index.d.ts

@@ -1,8 +1,36 @@
 import { KeyObject } from 'node:crypto';
-import { _ as SecretString } from '../credentials-vrvW0d4j.js';
+import { d as CredentialRefreshDriver, f as CredentialRefreshState, e as CredentialRefreshResult, S as SecretString } from '../credentials-JqG97kJ5.js';
+import '../types-D6De3sry.js';
 import 'zod';
 import '@superdurable/dex';
 
+type ManifestObject = Record<string, unknown>;
+/** Manifest-backed OAuth and service-account grant options emitted by connectorctl. */
+interface ManifestCredentialRefreshOptions {
+    /** Safe provider name used in token endpoint errors. */ providerName: string;
+    /** Validated spec.auth declaration, encoded using the manifest JSON contract. */ auth: ManifestObject;
+    /** Credential wire field name to connector runtime property. */ credentialFields: Readonly<Record<string, string>>;
+    /** Startup-pinned connection settings that value sources may read. */ settings?: Readonly<Record<string, string>>;
+    /** Caller-owned token HTTP transport. */ fetch?: typeof fetch;
+    /** Clock for deterministic tests. */ now?: () => Date;
+}
+/** Exchange manifest-declared grants while a credential provider owns admission and storage.
+ *
+ * Missing expiry keeps an existing access token. Refresh sends each active grant
+ * and reports the earliest expiry. Declared sub-500 terminal errors require
+ * reauthorization; other token endpoint failures remain retryable. A credential
+ * with multiple methods must carry authMethodId.
+ */
+declare class ManifestCredentialRefreshDriver<C extends object> implements CredentialRefreshDriver<C> {
+    #private;
+    /** Bind validated auth data, pinned settings, a caller-owned transport, and a clock. */
+    constructor(options: ManifestCredentialRefreshOptions);
+    /** Check declared access fields against the host's single credential expiry. */
+    refreshRequired(state: CredentialRefreshState<C>): boolean;
+    /** Send each active grant and return one complete credential with the earliest expiry. */
+    refresh(state: CredentialRefreshState<C>, signal: AbortSignal): Promise<CredentialRefreshResult<C>>;
+}
+
 /** Longest early-refresh window in milliseconds. */
 declare const RefreshSkewMs = 300000;
 /** OAuth token endpoint client authentication. */
@@ -15,6 +43,7 @@ interface ClientCredentials {
 }
 /** Successful replacement material from one OAuth grant. */
 declare class TokenResponse {
+    #private;
     /** Replacement access token. */ readonly accessToken: SecretString;
     /** Rotated refresh token, empty when the provider retained it. */ readonly refreshToken: SecretString;
     /** Access lifetime in milliseconds; zero only when explicitly accepted. */ readonly expiresInMs: number;
@@ -31,9 +60,12 @@ declare class TokenResponse {
         scope: string;
         tokenType: string;
         retainedFields: Record<string, unknown>;
+        mappedCredentialFields?: Record<string, SecretString>;
     });
     /** Keep the previous refresh token when no rotated value was returned. */
     nextRefreshToken(prior: SecretString): SecretString;
+    /** Reveal only one declared credential mapping at the provider boundary. */
+    mappedCredentialValue(path: string): string | undefined;
 }
 /** One provider token endpoint and its declared response rules. */
 interface TokenEndpointOptions {
@@ -44,6 +76,7 @@ interface TokenEndpointOptions {
     /** Accept a successful response without token_type. */ acceptsMissingTokenType?: boolean;
     /** Accept a successful response without expires_in. */ acceptsMissingExpiresIn?: boolean;
     /** Non-standard, non-secret top-level fields to retain. */ retainedResponseFields?: readonly string[];
+    /** Dotted response paths mapped into private connector credentials. */ credentialMappingPaths?: readonly string[];
     /** Send JSON instead of form encoding when the provider requires it. */ usesJSONRequestBody?: boolean;
     /** Permit a declared HTTP endpoint, including private-network identity servers. */ allowsPlainHTTP?: boolean;
     /** Fixed non-secret grant parameters that cannot override OAuth grant fields. */ additionalRequestParameters?: Readonly<Record<string, string>>;
@@ -73,6 +106,7 @@ declare function isRefreshRequiredWithIssueTime(hasAccessToken: boolean, issuedA
 declare function hasAllScopes(returnedScope: string, requiredScopes: readonly string[]): boolean;
 /** Check set equality of returned and required scopes. */
 declare function hasExactScopes(returnedScope: string, requiredScopes: readonly string[]): boolean;
+
 /** Claims of an RS256 JWT bearer assertion. */
 interface JWTBearerAssertion {
     /** iss claim. */ issuer: string;
@@ -87,4 +121,4 @@ declare function parseRSAPrivateKeyPEM(pemText: string): KeyObject;
 /** Sign a JWT bearer grant assertion with RS256. */
 declare function signJWTBearerAssertion(assertion: JWTBearerAssertion, privateKey: KeyObject): SecretString;
 
-export { type ClientAuthenticationMethod, type ClientCredentials, type JWTBearerAssertion, RefreshSkewMs, TokenEndpoint, type TokenEndpointOptions, TokenResponse, forcedRefreshFloorMs, hasAllScopes, hasExactScopes, isRefreshRequired, isRefreshRequiredWithIssueTime, parseRSAPrivateKeyPEM, proportionalRefreshSkewMs, signJWTBearerAssertion };
+export { type ClientAuthenticationMethod, type ClientCredentials, type JWTBearerAssertion, ManifestCredentialRefreshDriver, RefreshSkewMs, TokenEndpoint, type TokenEndpointOptions, TokenResponse, forcedRefreshFloorMs, hasAllScopes, hasExactScopes, isRefreshRequired, isRefreshRequiredWithIssueTime, parseRSAPrivateKeyPEM, proportionalRefreshSkewMs, signJWTBearerAssertion };