@synap-core/sdk 1.2.0 → 1.4.0

package/dist/connect.js

@@ -0,0 +1,1365 @@
+import {
+  base64url,
+  constantTimeEqual,
+  fromBase64url,
+  fromUtf8,
+  parseCookies,
+  pkceChallenge,
+  randomBytes,
+  randomToken,
+  serializeCookie,
+  utf8
+} from "./chunk-J7XHAAFJ.js";
+
+// src/connect/guard.ts
+var BROWSER_REFUSAL = "@synap-core/sdk/connect is server-only: it holds the pod's tokens and the app secret. Import it from route handlers, proxy.ts or server code, never from a client component.";
+function isBrowserRuntime() {
+  const g = globalThis;
+  return typeof g.window !== "undefined" && typeof g.document !== "undefined";
+}
+function assertServerRuntime() {
+  if (isBrowserRuntime()) throw new Error(BROWSER_REFUSAL);
+}
+
+// src/connect/errors.ts
+var ConnectError = class extends Error {
+  code;
+  /** Seconds to wait, from `Retry-After`, when `code` is `rate_limited`. */
+  retryAfterSec;
+  /** The OAuth error code the pod sent, when there was one (logs only). */
+  oauthError;
+  constructor(code, message, extra = {}) {
+    super(message);
+    this.name = "ConnectError";
+    this.code = code;
+    if (extra.retryAfterSec !== void 0) this.retryAfterSec = extra.retryAfterSec;
+    if (extra.oauthError !== void 0) this.oauthError = extra.oauthError;
+  }
+};
+function isConnectError(err) {
+  return err instanceof ConnectError;
+}
+var CONNECT_ERROR_CODES = [
+  "invalid_pod_address",
+  "not_a_pod",
+  "pod_unreachable",
+  "pod_unsupported",
+  "cp_unavailable",
+  "denied",
+  "expired_transaction",
+  "mismatch",
+  "misconfigured",
+  "rate_limited",
+  "expired",
+  "revoked",
+  "server_error"
+];
+function parseConnectErrorCode(value) {
+  return CONNECT_ERROR_CODES.includes(value ?? "") ? value : null;
+}
+function fromOAuthError(oauthError, during) {
+  switch (oauthError) {
+    case "access_denied":
+      return "denied";
+    case "temporarily_unavailable":
+    case "server_error":
+      return "pod_unreachable";
+    case "invalid_grant":
+      return during === "refresh" ? "revoked" : "expired_transaction";
+    case "invalid_request":
+    case "invalid_client":
+    case "invalid_scope":
+    case "invalid_target":
+    case "unauthorized_client":
+    case "unsupported_grant_type":
+    case "unsupported_response_type":
+      return "misconfigured";
+    default:
+      return "server_error";
+  }
+}
+function retryAfterSeconds(header, now) {
+  if (!header) return void 0;
+  const trimmed = header.trim();
+  if (/^\d{1,9}$/.test(trimmed)) return Number(trimmed);
+  const at = Date.parse(trimmed);
+  if (Number.isNaN(at)) return void 0;
+  return Math.max(0, Math.ceil((at - now) / 1e3));
+}
+
+// src/connect/discovery.ts
+var METADATA_PATH = "/.well-known/oauth-authorization-server";
+var TIMEOUT_MS = 5e3;
+var MAX_METADATA_BYTES = 64 * 1024;
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+function isPrivateIpv4(host) {
+  const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+  if (!m) return false;
+  const [a, b] = [Number(m[1]), Number(m[2])];
+  return a === 0 || a === 10 || a === 127 || a === 100 && b >= 64 && b <= 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a >= 224;
+}
+function canonicalPodUrl(input, opts = {}) {
+  const raw = input.trim();
+  if (!raw || raw.length > 512) throw new ConnectError("invalid_pod_address", "Empty or overlong pod address");
+  let url;
+  try {
+    url = new URL(/^[a-z][a-z0-9+.-]*:\/\//i.test(raw) ? raw : `https://${raw}`);
+  } catch {
+    throw new ConnectError("invalid_pod_address", "Not a URL");
+  }
+  const host = url.hostname.toLowerCase();
+  const loopback = LOOPBACK_HOSTS.has(host);
+  if (url.protocol === "http:" && !(loopback && opts.allowInsecureLoopback)) {
+    throw new ConnectError("invalid_pod_address", "A pod address must use https");
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") {
+    throw new ConnectError("invalid_pod_address", "A pod address must use https");
+  }
+  if (url.username || url.password || url.search || url.hash) {
+    throw new ConnectError("invalid_pod_address", "A pod address has no credentials, query or fragment");
+  }
+  if (!(loopback && opts.allowInsecureLoopback)) {
+    if (loopback || host.startsWith("[") || isPrivateIpv4(host) || /^\d+$/.test(host)) {
+      throw new ConnectError("invalid_pod_address", "A pod address must be a public host name");
+    }
+    if (!host.includes(".") || /\.(local|internal|localhost|lan|home\.arpa)$/.test(host)) {
+      throw new ConnectError("invalid_pod_address", "A pod address must be a public host name");
+    }
+  }
+  const path = url.pathname.replace(/\/+$/, "");
+  return `${url.origin}${path}`;
+}
+function metadataUrl(issuer) {
+  const url = new URL(issuer);
+  const path = url.pathname === "/" ? "" : url.pathname;
+  return `${url.origin}${METADATA_PATH}${path}`;
+}
+function sameOriginEndpoint(value, issuer) {
+  if (typeof value !== "string") return null;
+  try {
+    const url = new URL(value);
+    return url.origin === new URL(issuer).origin && !url.username && !url.hash ? url.href : null;
+  } catch {
+    return null;
+  }
+}
+async function readJsonCapped(res) {
+  const text = await res.text();
+  if (text.length > MAX_METADATA_BYTES) throw new ConnectError("not_a_pod", "Metadata document too large");
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new ConnectError("not_a_pod", "Metadata is not JSON");
+  }
+}
+async function discoverIssuer(issuer, opts) {
+  const doFetch = opts.fetch ?? fetch;
+  let res;
+  try {
+    res = await doFetch(metadataUrl(issuer), {
+      method: "GET",
+      headers: { Accept: "application/json" },
+      redirect: "manual",
+      signal: typeof AbortSignal.timeout === "function" ? AbortSignal.timeout(TIMEOUT_MS) : void 0
+    });
+  } catch {
+    throw new ConnectError("pod_unreachable", "The pod did not answer");
+  }
+  if (res.status === 429) {
+    throw new ConnectError("rate_limited", "The pod asked to slow down", {
+      retryAfterSec: retryAfterSeconds(res.headers.get("retry-after"), (opts.now ?? Date.now)())
+    });
+  }
+  if (res.status >= 500) throw new ConnectError("pod_unreachable", `The pod answered ${res.status}`);
+  if (res.status !== 200) throw new ConnectError("not_a_pod", `No authorization server metadata (${res.status})`);
+  const doc = await readJsonCapped(res);
+  if (!doc || typeof doc !== "object" || Array.isArray(doc)) throw new ConnectError("not_a_pod", "Metadata is not an object");
+  const m = doc;
+  if (m.issuer !== issuer) {
+    throw new ConnectError("not_a_pod", "The metadata names a different issuer than the address it was fetched from");
+  }
+  const list = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string") : null;
+  const pkce = list(m.code_challenge_methods_supported);
+  const responseTypes = list(m.response_types_supported);
+  if (m.authorization_response_iss_parameter_supported !== true || m.client_id_metadata_document_supported !== true || !pkce?.includes("S256") || responseTypes !== null && !responseTypes.includes("code")) {
+    throw new ConnectError("pod_unsupported", "This pod does not support app sign-in (CIMD, iss, S256)");
+  }
+  const authorizationEndpoint = sameOriginEndpoint(m.authorization_endpoint, issuer);
+  const tokenEndpoint = sameOriginEndpoint(m.token_endpoint, issuer);
+  if (!authorizationEndpoint || !tokenEndpoint) {
+    throw new ConnectError("pod_unsupported", "The pod's endpoints are missing or not on its own origin");
+  }
+  return {
+    issuer,
+    authorizationEndpoint,
+    tokenEndpoint,
+    revocationEndpoint: sameOriginEndpoint(m.revocation_endpoint, issuer),
+    refreshSupported: list(m.grant_types_supported)?.includes("refresh_token") ?? false
+  };
+}
+async function discoverPod(input, opts = {}) {
+  const first = canonicalPodUrl(input, opts);
+  try {
+    return await discoverIssuer(first, opts);
+  } catch (err) {
+    const url = new URL(first);
+    const retry = err instanceof ConnectError && (err.code === "not_a_pod" || err.code === "pod_unreachable") && !url.hostname.startsWith("pod.") && url.pathname === "/" && url.hostname.includes(".");
+    if (!retry) throw err;
+    const second = `${url.protocol}//pod.${url.host}`;
+    try {
+      return await discoverIssuer(second, opts);
+    } catch (err2) {
+      throw err2 instanceof ConnectError && err2.code === "pod_unsupported" ? err2 : err;
+    }
+  }
+}
+function safeNextPath(value, appOrigin) {
+  if (!value || value.length > 2048) return null;
+  if (value.startsWith("/") && !value.startsWith("//") && !value.startsWith("/\\")) {
+    try {
+      const url = new URL(value, appOrigin);
+      return url.origin === appOrigin ? `${url.pathname}${url.search}${url.hash}` : null;
+    } catch {
+      return null;
+    }
+  }
+  try {
+    const url = new URL(value);
+    return url.origin === appOrigin ? `${url.pathname}${url.search}${url.hash}` : null;
+  } catch {
+    return null;
+  }
+}
+function acceptLaunch(url, appOrigin, opts = {}) {
+  const params = new URL(url).searchParams;
+  let pod = null;
+  const iss = params.get("iss");
+  if (iss) {
+    try {
+      pod = canonicalPodUrl(iss, opts);
+    } catch {
+      pod = null;
+    }
+  }
+  const hint = params.get("synap_space_hint");
+  const state = params.get("state");
+  return {
+    pod,
+    next: safeNextPath(params.get("target_link_uri"), appOrigin),
+    spaceHint: hint && /^[A-Za-z0-9_-]{1,64}$/.test(hint) ? hint : null,
+    // A browser launch never carries a state: any well-formed one is a Synap Cloud return
+    // (a pick: iss + state; a cancel: state + error=access_denied, no iss).
+    cloudState: state && /^[A-Za-z0-9._~-]{16,256}$/.test(state) ? state : null
+  };
+}
+
+// src/connect/seal.ts
+var VERSION = "v1";
+var IV_BYTES = 12;
+var TAG_BYTES = 16;
+var MIN_SECRET_LENGTH = 32;
+var SALT = utf8("synap-connect/v1");
+var keyCache = /* @__PURE__ */ new Map();
+function secretsOf(secret) {
+  const list = typeof secret === "string" ? [secret] : secret;
+  if (list.length === 0 || list.some((s) => typeof s !== "string" || s.length < MIN_SECRET_LENGTH)) {
+    throw new ConnectError(
+      "misconfigured",
+      `The app session secret must be at least ${MIN_SECRET_LENGTH} characters (set SYNAP_APP_SESSION_SECRET on the server).`
+    );
+  }
+  return list;
+}
+function assertAppSecret(secret) {
+  secretsOf(secret);
+}
+function keyFor(secret, purpose) {
+  const cacheKey = `${purpose}\0${secret}`;
+  let key = keyCache.get(cacheKey);
+  if (!key) {
+    key = crypto.subtle.importKey("raw", utf8(secret), "HKDF", false, ["deriveKey"]).then(
+      (base) => crypto.subtle.deriveKey(
+        { name: "HKDF", hash: "SHA-256", salt: SALT, info: utf8(purpose) },
+        base,
+        { name: "AES-GCM", length: 256 },
+        false,
+        ["encrypt", "decrypt"]
+      )
+    );
+    keyCache.set(cacheKey, key);
+  }
+  return key;
+}
+async function seal(value, opts) {
+  const [current] = secretsOf(opts.secret);
+  const iv = randomBytes(IV_BYTES);
+  const plaintext = utf8(JSON.stringify({ exp: opts.expiresAt, data: value }));
+  const ciphertext = await crypto.subtle.encrypt(
+    { name: "AES-GCM", iv, additionalData: utf8(opts.purpose) },
+    await keyFor(current, opts.purpose),
+    plaintext
+  );
+  const out = new Uint8Array(IV_BYTES + ciphertext.byteLength);
+  out.set(iv, 0);
+  out.set(new Uint8Array(ciphertext), IV_BYTES);
+  return `${VERSION}.${base64url(out)}`;
+}
+async function unseal(sealed, opts) {
+  const secrets = secretsOf(opts.secret);
+  const dot = sealed.indexOf(".");
+  if (dot < 0 || sealed.slice(0, dot) !== VERSION) return { ok: false, reason: "invalid" };
+  const bytes = fromBase64url(sealed.slice(dot + 1));
+  if (!bytes || bytes.length < IV_BYTES + TAG_BYTES) return { ok: false, reason: "invalid" };
+  const iv = bytes.slice(0, IV_BYTES);
+  const ciphertext = bytes.slice(IV_BYTES);
+  for (const secret of secrets) {
+    let plaintext;
+    try {
+      plaintext = await crypto.subtle.decrypt(
+        { name: "AES-GCM", iv, additionalData: utf8(opts.purpose) },
+        await keyFor(secret, opts.purpose),
+        ciphertext
+      );
+    } catch {
+      continue;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(fromUtf8(new Uint8Array(plaintext)));
+    } catch {
+      return { ok: false, reason: "invalid" };
+    }
+    if (typeof parsed.exp !== "number") return { ok: false, reason: "invalid" };
+    if (parsed.exp <= opts.now) return { ok: false, reason: "expired" };
+    return { ok: true, value: parsed.data, expiresAt: parsed.exp };
+  }
+  return { ok: false, reason: "invalid" };
+}
+
+// src/connect/cloud.ts
+var CLOUD_TRANSACTION_TTL_MS = 10 * 60 * 1e3;
+var STATE_RE = /^[A-Za-z0-9._~-]{16,256}$/;
+var LOOPBACK_HOSTS2 = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+function cloudBaseUrl(cloudUrl, opts = {}) {
+  let url;
+  try {
+    url = new URL(cloudUrl.trim());
+  } catch {
+    throw new ConnectError("misconfigured", "cloudUrl is not a URL");
+  }
+  const loopback = LOOPBACK_HOSTS2.has(url.hostname);
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback && opts.allowInsecureLoopback)) {
+    throw new ConnectError("misconfigured", "cloudUrl must be https (http only on localhost in development)");
+  }
+  if (url.username || url.password || url.search || url.hash) {
+    throw new ConnectError("misconfigured", "cloudUrl has no credentials, query or fragment");
+  }
+  return `${url.origin}${url.pathname.replace(/\/+$/, "")}`;
+}
+function cloudConnectAvailable(config) {
+  if (!config?.cloudUrl) return false;
+  try {
+    cloudBaseUrl(config.cloudUrl, config);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function startCloudConnect(opts) {
+  if (!cloudConnectAvailable(opts)) {
+    throw new ConnectError("cp_unavailable", "cp: not configured \u2014 pass cloudUrl (the Control Plane URL) to offer Synap Cloud");
+  }
+  if (!opts.secret) throw new ConnectError("misconfigured", "startCloudConnect needs the app secret to seal its state");
+  const base = cloudBaseUrl(opts.cloudUrl, opts);
+  const secret = opts.secret;
+  return (async () => {
+    const now = (opts.now ?? Date.now)();
+    const state = randomToken();
+    const url = new URL(`${base}/connect/pod`);
+    url.searchParams.set("client_id", opts.clientId);
+    url.searchParams.set("state", state);
+    const tx = {
+      v: 1,
+      state,
+      clientId: opts.clientId,
+      cloudUrl: base,
+      next: opts.next ?? null,
+      spaceHint: opts.spaceHint ?? null,
+      prompt: opts.prompt === "consent" ? "consent" : null,
+      createdAt: now
+    };
+    const expiresAt = now + CLOUD_TRANSACTION_TTL_MS;
+    const transaction = await seal(tx, { secret, purpose: "synap-connect/cloud", expiresAt });
+    return { url: url.href, transaction, expiresAt };
+  })();
+}
+async function acceptCloudReturn(opts) {
+  if (!opts.transaction) throw new ConnectError("expired_transaction", "No Synap Cloud sign-in in progress in this browser");
+  const opened = await unseal(opts.transaction, {
+    secret: opts.secret,
+    purpose: "synap-connect/cloud",
+    now: (opts.now ?? Date.now)()
+  });
+  if (!opened.ok) {
+    throw new ConnectError(
+      "expired_transaction",
+      opened.reason === "expired" ? "The Synap Cloud sign-in is older than 10 minutes" : "The Synap Cloud cookie is not one this app sealed"
+    );
+  }
+  const tx = opened.value;
+  if (!tx || tx.v !== 1 || typeof tx.state !== "string") {
+    throw new ConnectError("expired_transaction", "The Synap Cloud cookie is not one this app sealed");
+  }
+  if (tx.clientId !== opts.clientId) {
+    throw new ConnectError("misconfigured", "The Synap Cloud sign-in was started for another client_id");
+  }
+  const params = new URL(opts.url).searchParams;
+  const state = params.get("state");
+  if (state === null || !STATE_RE.test(state) || !constantTimeEqual(state, tx.state)) {
+    throw new ConnectError("mismatch", "The Synap Cloud answer does not belong to the sign-in this browser started");
+  }
+  const error = params.get("error");
+  if (error !== null) {
+    throw new ConnectError(fromOAuthError(error, "authorize"), `Synap Cloud answered ${error}`, { oauthError: error });
+  }
+  const iss = params.get("iss");
+  if (!iss) throw new ConnectError("mismatch", "The Synap Cloud answer names no pod");
+  return {
+    pod: canonicalPodUrl(iss, opts),
+    next: tx.next,
+    spaceHint: tx.spaceHint,
+    prompt: tx.prompt === "consent" ? "consent" : null
+  };
+}
+
+// src/connect/client.ts
+function can(connection, permission, workspaceId) {
+  return connection.grant.some((g) => g.permission === permission && (workspaceId === void 0 || g.workspaceId === workspaceId));
+}
+function spaces(connection) {
+  const bySpace = /* @__PURE__ */ new Map();
+  for (const g of connection.grant) {
+    const space = bySpace.get(g.workspaceId) ?? { workspaceId: g.workspaceId, workspaceName: g.workspaceName, permissions: [] };
+    if (!space.workspaceName && g.workspaceName) space.workspaceName = g.workspaceName;
+    if (!space.permissions.includes(g.permission)) space.permissions.push(g.permission);
+    bySpace.set(g.workspaceId, space);
+  }
+  return [...bySpace.values()];
+}
+var SAFE_PATH = /^\/(?!\/)[A-Za-z0-9\-._~!$&'()*+,;=:@%/]*$/;
+function hubUrl(podUrl, path, query) {
+  if (!SAFE_PATH.test(path) || /(^|\/)\.\.?(\/|$)/.test(path) || path.includes("\\")) {
+    throw new TypeError(`Not a Hub API path: ${path}`);
+  }
+  const url = new URL(`${podUrl}/api/hub${path}`);
+  for (const [key, value] of Object.entries(query ?? {})) {
+    if (value === void 0 || value === null) continue;
+    for (const v of Array.isArray(value) ? value : [value]) url.searchParams.append(key, String(v));
+  }
+  return url;
+}
+function errorFor(status, body, retryAfter, now) {
+  const obj = body && typeof body === "object" ? body : {};
+  const detail = typeof obj.error === "string" ? obj.error : typeof obj.message === "string" ? obj.message : void 0;
+  const base = { status, ...detail !== void 0 ? { detail } : {} };
+  if (status === 401) return { code: "unauthorized", ...base };
+  if (status === 403) return { code: obj.code === "GRANT_DOOR_UNSUPPORTED" ? "door_unsupported" : "forbidden", ...base };
+  if (status === 404) return { code: "not_found", ...base };
+  if (status === 409) return { code: "conflict", ...base };
+  if (status === 400 || status === 422) return { code: "invalid", ...base };
+  if (status === 429) {
+    const retryAfterSec = retryAfterSeconds(retryAfter, now);
+    return { code: "rate_limited", ...base, ...retryAfterSec !== void 0 ? { retryAfterSec } : {} };
+  }
+  if (status === 502 || status === 503 || status === 504) return { code: "pod_unreachable", ...base };
+  return { code: "server", ...base };
+}
+function reviewUrlFor(podUrl, reviewUrl, proposalId) {
+  if (typeof reviewUrl === "string" && reviewUrl) {
+    try {
+      const url = new URL(reviewUrl, `${podUrl}/`);
+      if (url.origin === new URL(podUrl).origin) return url.href;
+    } catch {
+    }
+  }
+  return proposalId ? `${podUrl}/open/${encodeURIComponent(proposalId)}` : podUrl;
+}
+function createPodClient(connection, opts = {}) {
+  const now = opts.now ?? Date.now;
+  const doFetch = () => opts.fetch ?? fetch;
+  async function request(method, path, body, query) {
+    const url = hubUrl(connection.podUrl, path, query);
+    if (connection.accessExpiresAt <= now()) return { ok: false, error: { code: "expired", status: null } };
+    const headers = { Accept: "application/json", Authorization: `Bearer ${connection.accessToken}` };
+    if (body !== void 0) headers["Content-Type"] = "application/json";
+    let res;
+    try {
+      res = await doFetch()(url.href, {
+        method,
+        headers,
+        body: body === void 0 ? void 0 : JSON.stringify(body),
+        redirect: "manual"
+      });
+    } catch {
+      return { ok: false, error: { code: "pod_unreachable", status: null } };
+    }
+    let data = null;
+    const text = await res.text().catch(() => "");
+    if (text) {
+      try {
+        data = JSON.parse(text);
+      } catch {
+        data = null;
+      }
+    }
+    if (res.status >= 200 && res.status < 300) return { ok: true, data };
+    return { ok: false, error: errorFor(res.status, data, res.headers.get("retry-after"), now()) };
+  }
+  async function write(method, path, body) {
+    const result = await request(method, path, body);
+    if (!result.ok) return result;
+    const obj = result.data && typeof result.data === "object" ? result.data : {};
+    const proposalId = typeof obj.proposalId === "string" && obj.proposalId ? obj.proposalId : null;
+    if (obj.status === "proposed" || obj.status === "pending" && proposalId) {
+      return {
+        ok: true,
+        status: "proposed",
+        proposalId,
+        reviewUrl: reviewUrlFor(connection.podUrl, obj.reviewUrl, proposalId),
+        data: result.data
+      };
+    }
+    return { ok: true, status: "applied", data: result.data };
+  }
+  async function listPendingProposals(opts2 = {}) {
+    if (!can(connection, "proposal.read", opts2.workspaceId)) {
+      return {
+        ok: false,
+        error: { code: "forbidden", status: null, detail: "The connection was not granted proposal.read in that space" }
+      };
+    }
+    const limit = Math.min(Math.max(Math.floor(opts2.limit ?? 20), 1), 200);
+    const offset = Math.max(Math.floor(opts2.offset ?? 0), 0);
+    const result = await request("GET", "/proposals", void 0, {
+      status: "pending",
+      view: "basic",
+      limit,
+      offset,
+      workspaceId: opts2.workspaceId
+    });
+    if (!result.ok) return result;
+    const obj = result.data && typeof result.data === "object" ? result.data : {};
+    if (!Array.isArray(obj.proposals) || typeof obj.total !== "number") {
+      return { ok: false, error: { code: "server", status: 200, detail: "The pod's /proposals answer has no proposals or total" } };
+    }
+    const str = (v) => typeof v === "string" && v ? v : null;
+    const proposals = [];
+    for (const row of obj.proposals) {
+      if (!row || typeof row !== "object") continue;
+      const r = row;
+      const id = str(r.id);
+      if (!id) continue;
+      proposals.push({
+        id,
+        proposalType: str(r.proposalType) ?? "",
+        targetType: str(r.targetType) ?? "",
+        targetId: str(r.targetId),
+        workspaceId: str(r.workspaceId),
+        createdAt: str(r.createdAt) ?? "",
+        agentUserId: str(r.agentUserId),
+        sessionId: str(r.sessionId),
+        ...str(r.summary) ? { summary: str(r.summary) } : {},
+        reviewUrl: reviewUrlFor(connection.podUrl, null, id)
+      });
+    }
+    return {
+      ok: true,
+      data: { total: obj.total, proposals, hasMore: obj.hasMore === true || offset + proposals.length < obj.total }
+    };
+  }
+  return {
+    podUrl: connection.podUrl,
+    user: connection.user,
+    grant: connection.grant,
+    can: (permission, workspaceId) => can(connection, permission, workspaceId),
+    spaces: () => spaces(connection),
+    listPendingProposals,
+    get(path, query) {
+      return request("GET", path, void 0, query);
+    },
+    post(path, body) {
+      return write("POST", path, body);
+    },
+    patch(path, body) {
+      return write("PATCH", path, body);
+    },
+    put(path, body) {
+      return write("PUT", path, body);
+    },
+    delete(path, body) {
+      return write("DELETE", path, body);
+    }
+  };
+}
+
+// src/connect/flow.ts
+var TRANSACTION_TTL_MS = 10 * 60 * 1e3;
+var DEFAULT_REFRESH_IDLE_MS = 30 * 24 * 60 * 60 * 1e3;
+var DEFAULT_ACCESS_TTL_SEC = 3600;
+var TIMEOUT_MS2 = 1e4;
+var PERMISSION_RE = /^[a-z][a-z0-9_-]*(\.[a-z0-9_-]+)+$/i;
+function assertPermissions(permissions) {
+  const unique = [...new Set(permissions)];
+  if (unique.length === 0 || unique.length > 32 || unique.some((p) => !PERMISSION_RE.test(p))) {
+    throw new ConnectError(
+      "misconfigured",
+      "permissions must be 1-32 grant-grammar strings such as entity.post.read (no *)"
+    );
+  }
+  return unique;
+}
+async function startConnect(opts) {
+  const now = (opts.now ?? Date.now)();
+  const permissions = assertPermissions(opts.permissions);
+  const issuer = typeof opts.pod === "string" ? await discoverPod(opts.pod, { fetch: opts.fetch, now: opts.now, allowInsecureLoopback: opts.allowInsecureLoopback }) : opts.pod;
+  const verifier = randomToken();
+  const state = randomToken();
+  const resourceKind = opts.resource === void 0 ? "api/hub" : opts.resource;
+  const resource = resourceKind ? `${issuer.issuer}/${resourceKind}` : null;
+  const url = new URL(issuer.authorizationEndpoint);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", opts.clientId);
+  url.searchParams.set("redirect_uri", opts.redirectUri);
+  url.searchParams.set("scope", permissions.join(" "));
+  url.searchParams.set("state", state);
+  url.searchParams.set("code_challenge", await pkceChallenge(verifier));
+  url.searchParams.set("code_challenge_method", "S256");
+  if (resource) url.searchParams.set("resource", resource);
+  if (opts.spaceHint) url.searchParams.set("synap_space_hint", opts.spaceHint);
+  if (opts.prompt === "consent") url.searchParams.set("prompt", "consent");
+  const tx = {
+    v: 1,
+    issuer: issuer.issuer,
+    tokenEndpoint: issuer.tokenEndpoint,
+    revocationEndpoint: issuer.revocationEndpoint,
+    clientId: opts.clientId,
+    redirectUri: opts.redirectUri,
+    state,
+    verifier,
+    resource,
+    next: opts.next ?? null,
+    createdAt: now
+  };
+  const expiresAt = now + TRANSACTION_TTL_MS;
+  const transaction = await seal(tx, {
+    secret: opts.secret,
+    purpose: "synap-connect/transaction",
+    expiresAt
+  });
+  return { authorizeUrl: url.toString(), transaction, expiresAt, issuer };
+}
+async function openTransaction(sealed, opts) {
+  if (!sealed) throw new ConnectError("expired_transaction", "No sign-in in progress in this browser");
+  const opened = await unseal(sealed, {
+    secret: opts.secret,
+    purpose: "synap-connect/transaction",
+    now: (opts.now ?? Date.now)()
+  });
+  if (!opened.ok) {
+    throw new ConnectError(
+      "expired_transaction",
+      opened.reason === "expired" ? "The sign-in is older than 10 minutes" : "The sign-in cookie is not one this app sealed"
+    );
+  }
+  const tx = opened.value;
+  if (!tx || tx.v !== 1 || typeof tx.state !== "string" || typeof tx.issuer !== "string") {
+    throw new ConnectError("expired_transaction", "The sign-in cookie is not one this app sealed");
+  }
+  return tx;
+}
+async function handleCallback(opts) {
+  const tx = await openTransaction(opts.transaction, opts);
+  if (tx.clientId !== opts.clientId || tx.redirectUri !== opts.redirectUri) {
+    throw new ConnectError("misconfigured", "The sign-in was started for another client_id or redirect_uri");
+  }
+  const params = new URL(opts.callbackUrl).searchParams;
+  const iss = params.get("iss");
+  if (iss === null || iss !== tx.issuer) {
+    throw new ConnectError("mismatch", iss === null ? "The answer names no issuer" : "The answer comes from another pod than the one asked");
+  }
+  const state = params.get("state");
+  if (state === null || !constantTimeEqual(state, tx.state)) {
+    throw new ConnectError("mismatch", "The answer does not belong to the sign-in this browser started");
+  }
+  const error = params.get("error");
+  if (error !== null) {
+    throw new ConnectError(fromOAuthError(error, "authorize"), `The pod answered ${error}`, { oauthError: error });
+  }
+  const code = params.get("code");
+  if (!code) throw new ConnectError("server_error", "The answer carries no code");
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    code,
+    redirect_uri: tx.redirectUri,
+    client_id: tx.clientId,
+    code_verifier: tx.verifier
+  });
+  if (tx.resource) body.set("resource", tx.resource);
+  const json = await tokenRequest(tx.tokenEndpoint, body, "token", opts);
+  const connection = parseTokenResponse(json, {
+    podUrl: tx.issuer,
+    clientId: tx.clientId,
+    tokenEndpoint: tx.tokenEndpoint,
+    revocationEndpoint: tx.revocationEndpoint,
+    now: (opts.now ?? Date.now)()
+  });
+  return { connection, next: tx.next };
+}
+async function tokenRequest(endpoint, body, during, opts) {
+  const doFetch = opts.fetch ?? fetch;
+  let res;
+  try {
+    res = await doFetch(endpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
+      body: body.toString(),
+      redirect: "manual",
+      signal: typeof AbortSignal.timeout === "function" ? AbortSignal.timeout(TIMEOUT_MS2) : void 0
+    });
+  } catch {
+    throw new ConnectError("pod_unreachable", "The pod's token endpoint did not answer");
+  }
+  if (res.status === 429) {
+    throw new ConnectError("rate_limited", "The pod asked to slow down", {
+      retryAfterSec: retryAfterSeconds(res.headers.get("retry-after"), (opts.now ?? Date.now)())
+    });
+  }
+  if (res.status >= 500) throw new ConnectError("pod_unreachable", `The token endpoint answered ${res.status}`);
+  let json;
+  try {
+    json = await res.json();
+  } catch {
+    throw new ConnectError("server_error", `The token endpoint answered ${res.status} without JSON`);
+  }
+  const obj = json && typeof json === "object" && !Array.isArray(json) ? json : {};
+  if (res.status !== 200) {
+    const oauthError = typeof obj.error === "string" ? obj.error : "server_error";
+    throw new ConnectError(fromOAuthError(oauthError, during), `The token endpoint answered ${oauthError}`, { oauthError });
+  }
+  return obj;
+}
+function parseGrant(value) {
+  if (!Array.isArray(value)) return null;
+  const out = [];
+  for (const g of value) {
+    if (!g || typeof g !== "object") return null;
+    const { permission, workspaceId, workspaceName } = g;
+    if (typeof permission !== "string" || typeof workspaceId !== "string") return null;
+    out.push({ permission, workspaceId, workspaceName: typeof workspaceName === "string" ? workspaceName : "" });
+  }
+  return out;
+}
+var APP_ID_RE = /^[A-Za-z0-9_-]{1,128}$/;
+var LOOPBACK_HOSTS3 = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+function parseApp(value) {
+  if (!value || typeof value !== "object") return {};
+  const { id, manageUrl } = value;
+  const out = {};
+  if (typeof id === "string" && APP_ID_RE.test(id)) out.appId = id;
+  if (typeof manageUrl === "string" && manageUrl.length <= 2048) {
+    try {
+      const url = new URL(manageUrl);
+      const secure = url.protocol === "https:" || url.protocol === "http:" && LOOPBACK_HOSTS3.has(url.hostname);
+      if (secure && !url.username && !url.password) out.manageUrl = url.href;
+    } catch {
+    }
+  }
+  return out;
+}
+function parseUser(value) {
+  if (!value || typeof value !== "object") return null;
+  const { id, name } = value;
+  return typeof id === "string" ? { id, name: typeof name === "string" ? name : "" } : null;
+}
+function parseTokenResponse(body, ctx) {
+  const { access_token, token_type, expires_in, scope, refresh_token, refresh_token_expires_in } = body;
+  if (typeof access_token !== "string" || access_token === "") {
+    throw new ConnectError("server_error", "The token response has no access_token");
+  }
+  if (typeof token_type !== "string" || token_type.toLowerCase() !== "bearer") {
+    throw new ConnectError("server_error", "The token response is not a Bearer token");
+  }
+  if (expires_in !== void 0 && (typeof expires_in !== "number" || !Number.isFinite(expires_in) || expires_in < 0)) {
+    throw new ConnectError("server_error", "The token response has an invalid expires_in");
+  }
+  const grant = parseGrant(body.synap_grant) ?? ctx.previous?.grant ?? null;
+  const user = parseUser(body.synap_user) ?? ctx.previous?.user ?? null;
+  if (!grant || !user) {
+    throw new ConnectError("pod_unsupported", "The token response lacks synap_grant / synap_user (pod older than app sign-in)");
+  }
+  const scopes = typeof scope === "string" ? scope.split(/\s+/).filter(Boolean) : ctx.previous?.scope ?? [...new Set(grant.map((g) => g.permission))];
+  const connection = {
+    podUrl: ctx.podUrl,
+    clientId: ctx.clientId,
+    tokenEndpoint: ctx.tokenEndpoint,
+    revocationEndpoint: ctx.revocationEndpoint,
+    accessToken: access_token,
+    accessExpiresAt: ctx.now + (typeof expires_in === "number" ? expires_in : DEFAULT_ACCESS_TTL_SEC) * 1e3,
+    scope: scopes,
+    grant,
+    user,
+    connectedAt: ctx.previous?.connectedAt ?? ctx.now
+  };
+  const app = parseApp(body.synap_app);
+  const appId = app.appId ?? ctx.previous?.appId;
+  const manageUrl = app.manageUrl ?? ctx.previous?.manageUrl;
+  if (appId !== void 0) connection.appId = appId;
+  if (manageUrl !== void 0) connection.manageUrl = manageUrl;
+  if (typeof refresh_token === "string" && refresh_token !== "") {
+    connection.refreshToken = refresh_token;
+    const idle = typeof refresh_token_expires_in === "number" && Number.isFinite(refresh_token_expires_in) && refresh_token_expires_in > 0 ? refresh_token_expires_in * 1e3 : DEFAULT_REFRESH_IDLE_MS;
+    connection.refreshExpiresAt = ctx.now + idle;
+  }
+  return connection;
+}
+var ROTATION_MEMORY_MS = 2 * 60 * 1e3;
+var rotations = /* @__PURE__ */ new Map();
+function pruneRotations(now) {
+  for (const [token, r] of rotations) {
+    if (r.settledAt !== void 0 && now - r.settledAt > ROTATION_MEMORY_MS) rotations.delete(token);
+  }
+}
+function refreshConnection(connection, opts = {}) {
+  const clock = opts.now ?? Date.now;
+  const now = clock();
+  const token = connection.refreshToken;
+  if (!token) return Promise.reject(new ConnectError("expired", "The pod issued no refresh token; connect again"));
+  pruneRotations(now);
+  const known = rotations.get(token);
+  if (known) return known.result;
+  if (connection.refreshExpiresAt !== void 0 && connection.refreshExpiresAt <= now) {
+    return Promise.reject(new ConnectError("expired", "The connection was idle too long; connect again"));
+  }
+  const body = new URLSearchParams({ grant_type: "refresh_token", refresh_token: token, client_id: connection.clientId });
+  const rotation = {
+    result: tokenRequest(connection.tokenEndpoint, body, "refresh", opts).then((json) => {
+      const next = parseTokenResponse(json, {
+        podUrl: connection.podUrl,
+        clientId: connection.clientId,
+        tokenEndpoint: connection.tokenEndpoint,
+        revocationEndpoint: connection.revocationEndpoint,
+        now: clock(),
+        previous: connection
+      });
+      rotation.settledAt = clock();
+      return next;
+    }).catch((err) => {
+      rotations.delete(token);
+      if (err instanceof ConnectError && err.code === "revoked" && connection.refreshExpiresAt !== void 0 && connection.refreshExpiresAt <= clock()) {
+        throw new ConnectError("expired", err.message, { oauthError: err.oauthError });
+      }
+      throw err;
+    })
+  };
+  rotations.set(token, rotation);
+  return rotation.result;
+}
+async function revokeConnection(connection, opts = {}) {
+  if (!connection.revocationEndpoint) return { revoked: false };
+  const doFetch = opts.fetch ?? fetch;
+  let revoked = true;
+  const tokens = [
+    [connection.refreshToken, "refresh_token"],
+    [connection.accessToken, "access_token"]
+  ];
+  for (const [token, hint] of tokens) {
+    if (!token) continue;
+    try {
+      const res = await doFetch(connection.revocationEndpoint, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ token, token_type_hint: hint, client_id: connection.clientId }).toString(),
+        redirect: "manual",
+        signal: typeof AbortSignal.timeout === "function" ? AbortSignal.timeout(TIMEOUT_MS2) : void 0
+      });
+      if (res.status !== 200) revoked = false;
+    } catch {
+      revoked = false;
+    }
+  }
+  return { revoked };
+}
+
+// src/connect/store.ts
+function cookieNames(secure) {
+  return secure ? { session: "__Host-synap_session", transaction: "__Host-synap_tx", cloud: "__Host-synap_cloud", marker: "__Host-synap_seen" } : { session: "synap_session", transaction: "synap_tx", cloud: "synap_cloud", marker: "synap_seen" };
+}
+var MARKER_TTL_SEC = 400 * 24 * 60 * 60;
+function markerCookie(podUrl, opts) {
+  return serializeCookie(opts.name ?? cookieNames(opts.secure).marker, base64url(utf8(podUrl)), {
+    maxAgeSec: MARKER_TTL_SEC,
+    secure: opts.secure
+  });
+}
+function readMarker(cookieHeader, opts) {
+  const raw = parseCookies(cookieHeader).get(opts.name ?? cookieNames(opts.secure).marker);
+  const bytes = raw ? fromBase64url(raw) : null;
+  if (!bytes || bytes.length > 512) return null;
+  const podUrl = fromUtf8(bytes);
+  try {
+    return canonicalPodUrl(podUrl, opts) === podUrl ? podUrl : null;
+  } catch {
+    return null;
+  }
+}
+var CHUNK_SIZE = 3800;
+var MAX_CHUNKS = 4;
+function chunkName(name, i) {
+  return i === 0 ? name : `${name}.${i}`;
+}
+function pack(c) {
+  const bySpace = /* @__PURE__ */ new Map();
+  for (const g of c.grant) {
+    const row = bySpace.get(g.workspaceId) ?? [g.workspaceId, g.workspaceName, []];
+    row[2].push(g.permission);
+    bySpace.set(g.workspaceId, row);
+  }
+  const { grant: _grant, ...rest } = c;
+  return { ...rest, g: [...bySpace.values()] };
+}
+function unpack(s) {
+  if (!s || typeof s.podUrl !== "string" || typeof s.accessToken !== "string" || !Array.isArray(s.g)) return null;
+  const { g, ...rest } = s;
+  const grant = g.flatMap(
+    ([workspaceId, workspaceName, permissions]) => permissions.map((permission) => ({ permission, workspaceId, workspaceName }))
+  );
+  return { ...rest, grant };
+}
+function connectionExpiresAt(c) {
+  return c.refreshToken && c.refreshExpiresAt !== void 0 ? Math.max(c.refreshExpiresAt, c.accessExpiresAt) : c.accessExpiresAt;
+}
+function createSealedCookieStore(opts) {
+  const name = opts.name ?? cookieNames(opts.secure).session;
+  const now = opts.now ?? Date.now;
+  const presentChunks = (request) => {
+    const cookies = parseCookies(request.headers.get("cookie"));
+    const names = [];
+    for (let i = 0; i < MAX_CHUNKS; i++) if (cookies.has(chunkName(name, i))) names.push(chunkName(name, i));
+    return { cookies, names };
+  };
+  return {
+    async read(request) {
+      const { cookies } = presentChunks(request);
+      let sealed = "";
+      for (let i = 0; i < MAX_CHUNKS; i++) {
+        const part = cookies.get(chunkName(name, i));
+        if (part === void 0) break;
+        sealed += part;
+      }
+      if (!sealed) return null;
+      const opened = await unseal(sealed, { secret: opts.secret, purpose: "synap-connect/session", now: now() });
+      return opened.ok ? unpack(opened.value) : null;
+    },
+    async write(connection, request) {
+      const expiresAt = connectionExpiresAt(connection);
+      const sealed = await seal(pack(connection), { secret: opts.secret, purpose: "synap-connect/session", expiresAt });
+      const parts = [];
+      for (let i = 0; i < sealed.length; i += CHUNK_SIZE) parts.push(sealed.slice(i, i + CHUNK_SIZE));
+      if (parts.length > MAX_CHUNKS) {
+        throw new ConnectError(
+          "misconfigured",
+          "The connection is too large for a cookie (a very wide grant); pass a server-side ConnectionStore"
+        );
+      }
+      const maxAgeSec = (expiresAt - now()) / 1e3;
+      const out = parts.map((value, i) => serializeCookie(chunkName(name, i), value, { maxAgeSec, secure: opts.secure }));
+      for (const stale of presentChunks(request).names.slice(parts.length)) {
+        out.push(serializeCookie(stale, "", { maxAgeSec: 0, secure: opts.secure }));
+      }
+      return out;
+    },
+    async clear(request) {
+      const { names } = presentChunks(request);
+      return (names.length > 0 ? names : [name]).map((n) => serializeCookie(n, "", { maxAgeSec: 0, secure: opts.secure }));
+    }
+  };
+}
+function applySetCookies(cookieHeader, setCookies) {
+  const cookies = parseCookies(cookieHeader);
+  for (const sc of setCookies) {
+    const [pair, ...attrs] = sc.split(";");
+    const eq = pair.indexOf("=");
+    if (eq < 0) continue;
+    const name = pair.slice(0, eq).trim();
+    const removed = attrs.some((a) => /^\s*max-age\s*=\s*0\s*$/i.test(a));
+    if (removed) cookies.delete(name);
+    else cookies.set(name, pair.slice(eq + 1).trim());
+  }
+  return [...cookies].map(([k, v]) => `${k}=${v}`).join("; ");
+}
+
+// src/connect/auth.ts
+var DEFAULT_PATHS = {
+  metadata: "/.well-known/synap-client.json",
+  connect: "/api/synap/connect",
+  callback: "/api/synap/callback",
+  disconnect: "/api/synap/disconnect",
+  cloud: "/api/synap/cloud",
+  connectPage: "/connect",
+  resultPage: "/connect/result",
+  afterConnect: "/"
+};
+var REFRESH_WINDOW_MS = 5 * 60 * 1e3;
+var LOOPBACK = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+var TEMPLATE_SLUG_RE = /^[a-z0-9][a-z0-9._/-]{0,99}$/;
+var MAX_METADATA_BYTES2 = 5 * 1024;
+function appOriginOf(appUrl) {
+  let url;
+  try {
+    url = new URL(appUrl);
+  } catch {
+    throw new ConnectError("misconfigured", "appUrl is not a URL");
+  }
+  const secure = url.protocol === "https:";
+  if (!secure && !(url.protocol === "http:" && LOOPBACK.has(url.hostname))) {
+    throw new ConnectError("misconfigured", "appUrl must be https (http only on localhost)");
+  }
+  if (url.pathname !== "/" || url.search || url.hash || url.username || url.password) {
+    throw new ConnectError("misconfigured", "appUrl is an origin: no path, query, fragment or credentials");
+  }
+  return { origin: url.origin, secure };
+}
+function assertPath(name, path) {
+  if (!path.startsWith("/") || path.startsWith("//") || /[?#\\]/.test(path)) {
+    throw new ConnectError("misconfigured", `paths.${name} must be an absolute path on the app`);
+  }
+}
+function buildClientMetadata(opts) {
+  const { origin } = appOriginOf(opts.appUrl);
+  const paths = { ...DEFAULT_PATHS, ...opts.paths };
+  for (const [name, path] of Object.entries(paths)) assertPath(name, path);
+  const clientName = opts.clientName.trim();
+  if (!clientName || clientName.length > 100) throw new ConnectError("misconfigured", "clientName must be 1-100 characters");
+  assertPermissions(opts.requests.map((r) => r.permission));
+  for (const r of opts.requests) {
+    if (r.permission.includes("*")) throw new ConnectError("misconfigured", "a permission cannot contain *");
+    if (typeof r.reason !== "string" || !r.reason.trim() || r.reason.length > 200) {
+      throw new ConnectError("misconfigured", `the reason for ${r.permission} must be 1-200 characters`);
+    }
+  }
+  const templates = [...new Set(opts.templates ?? [])];
+  if (templates.length > 8 || templates.some((t) => !TEMPLATE_SLUG_RE.test(t))) {
+    throw new ConnectError("misconfigured", "at most 8 template slugs (lowercase letters, digits, . _ / -)");
+  }
+  const doc = {
+    client_id: `${origin}${paths.metadata}`,
+    client_name: clientName,
+    client_uri: origin,
+    redirect_uris: [`${origin}${paths.callback}`],
+    grant_types: ["authorization_code", "refresh_token"],
+    response_types: ["code"],
+    token_endpoint_auth_method: "none",
+    initiate_login_uri: `${origin}${paths.connectPage}`,
+    synap_requests: opts.requests.map((r) => ({ permission: r.permission, reason: r.reason.trim() })),
+    ...templates.length > 0 ? { synap_templates: templates } : {}
+  };
+  if (new TextEncoder().encode(JSON.stringify(doc)).length > MAX_METADATA_BYTES2) {
+    throw new ConnectError("misconfigured", "the client metadata document exceeds the pod's 5 KB limit");
+  }
+  return doc;
+}
+function redirect(location, setCookies = []) {
+  const headers = new Headers({ Location: location, "Cache-Control": "no-store" });
+  for (const c of setCookies) headers.append("Set-Cookie", c);
+  return new Response(null, { status: 303, headers });
+}
+function withQuery(origin, path, params) {
+  const url = new URL(path, origin);
+  for (const [k, v] of Object.entries(params)) if (v) url.searchParams.set(k, v);
+  return url.href;
+}
+function sameOrigin(request, origin) {
+  const from = request.headers.get("origin");
+  if (from !== null) return from === origin;
+  return request.headers.get("sec-fetch-site") === "same-origin";
+}
+function formField(form, name) {
+  const v = form?.get(name);
+  return typeof v === "string" ? v : null;
+}
+async function readForm(request) {
+  try {
+    return await request.formData();
+  } catch {
+    return null;
+  }
+}
+function isPrefetchOrAsset(request) {
+  const h = request.headers;
+  if (h.get("next-router-prefetch") || h.get("next-router-segment-prefetch") || h.get("x-middleware-prefetch")) return true;
+  if (/prefetch/i.test(h.get("purpose") ?? "") || /prefetch/i.test(h.get("sec-purpose") ?? "")) return true;
+  const path = new URL(request.url).pathname;
+  return path.startsWith("/_next/") || /\.[A-Za-z0-9]{1,8}$/.test(path);
+}
+function createPodAppAuth(config) {
+  assertServerRuntime();
+  assertAppSecret(config.secret);
+  const { origin, secure } = appOriginOf(config.appUrl);
+  const paths = { ...DEFAULT_PATHS, ...config.paths };
+  const metadata = buildClientMetadata({ ...config, paths });
+  const cloudUrl = config.cloudUrl?.trim() ? cloudBaseUrl(config.cloudUrl, config) : null;
+  const clientId = metadata.client_id;
+  const redirectUri = metadata.redirect_uris[0];
+  const permissions = config.requests.map((r) => r.permission);
+  const names = cookieNames(secure);
+  const now = config.now ?? Date.now;
+  const store = config.store ?? createSealedCookieStore({ secret: config.secret, secure, now });
+  const flow = { fetch: config.fetch, now: config.now };
+  const report = config.onError ?? ((err, where) => {
+    console.warn(`[synap/connect] ${where}: ${err.code}: ${err.message}`);
+  });
+  const fail = (err, where) => {
+    const e = isConnectError(err) ? err : new ConnectError("server_error", err instanceof Error ? err.message : "Unexpected failure");
+    report(e, where);
+    return e;
+  };
+  const clearTx = serializeCookie(names.transaction, "", { maxAgeSec: 0, secure });
+  const clearCloud = serializeCookie(names.cloud, "", { maxAgeSec: 0, secure });
+  const clearMarker = serializeCookie(names.marker, "", { maxAgeSec: 0, secure });
+  const marker = (podUrl) => markerCookie(podUrl, { secure, name: names.marker });
+  const asRequest = (source) => source instanceof Request ? source : new Request(origin, { headers: source ? { cookie: source } : {} });
+  const lapsedIn = (request) => {
+    const podUrl = readMarker(request.headers.get("cookie"), { secure, name: names.marker, allowInsecureLoopback: config.allowInsecureLoopback });
+    return podUrl ? { podUrl } : null;
+  };
+  async function toPod(opts, extra = []) {
+    const started = await startConnect({
+      ...flow,
+      pod: opts.pod,
+      clientId,
+      redirectUri,
+      permissions,
+      secret: config.secret,
+      resource: config.resource,
+      spaceHint: opts.space && /^[A-Za-z0-9_-]{1,64}$/.test(opts.space) ? opts.space : null,
+      next: opts.next,
+      prompt: opts.prompt,
+      allowInsecureLoopback: config.allowInsecureLoopback
+    });
+    return redirect(started.authorizeUrl, [
+      ...extra,
+      serializeCookie(names.transaction, started.transaction, { maxAgeSec: TRANSACTION_TTL_MS / 1e3, secure })
+    ]);
+  }
+  async function liveConnectionTo(request, pod) {
+    const existing = await store.read(request);
+    return Boolean(existing && existing.accessExpiresAt > now() && existing.podUrl === canonicalPodUrl(pod, config));
+  }
+  async function clientMetadata() {
+    return new Response(JSON.stringify(metadata), {
+      status: 200,
+      headers: { "Content-Type": "application/json", "Cache-Control": "public, max-age=300" }
+    });
+  }
+  async function connect(request) {
+    if (request.method !== "POST") return new Response("Method Not Allowed", { status: 405, headers: { Allow: "POST" } });
+    if (!sameOrigin(request, origin)) return new Response("Forbidden", { status: 403 });
+    const form = await readForm(request);
+    const pod = formField(form, "pod")?.slice(0, 512) ?? "";
+    const next = safeNextPath(formField(form, "next"), origin) ?? paths.afterConnect;
+    const space = formField(form, "space");
+    const prompt = formField(form, "prompt") === "consent" ? "consent" : null;
+    try {
+      if (!prompt && await liveConnectionTo(request, pod)) return redirect(new URL(next, origin).href);
+      return await toPod({ pod, next, space, prompt });
+    } catch (err) {
+      const e = fail(err, "connect");
+      return redirect(withQuery(origin, paths.connectPage, { error: e.code, pod }));
+    }
+  }
+  async function callback(request) {
+    if (request.method !== "GET") return new Response("Method Not Allowed", { status: 405, headers: { Allow: "GET" } });
+    const transaction = parseCookies(request.headers.get("cookie")).get(names.transaction) ?? null;
+    try {
+      const { connection, next } = await handleCallback({
+        ...flow,
+        callbackUrl: request.url,
+        transaction,
+        clientId,
+        redirectUri,
+        secret: config.secret
+      });
+      const cookies = await store.write(connection, request);
+      return redirect(new URL(next ?? paths.afterConnect, origin).href, [clearTx, ...cookies, marker(connection.podUrl)]);
+    } catch (err) {
+      const e = fail(err, "callback");
+      return redirect(withQuery(origin, paths.resultPage, { error: e.code }), [clearTx]);
+    }
+  }
+  async function disconnect(request) {
+    if (request.method !== "POST") return new Response("Method Not Allowed", { status: 405, headers: { Allow: "POST" } });
+    if (!sameOrigin(request, origin)) return new Response("Forbidden", { status: 403 });
+    const next = safeNextPath(formField(await readForm(request), "next"), origin) ?? paths.connectPage;
+    const connection = await store.read(request);
+    if (connection) {
+      const { revoked } = await revokeConnection(connection, flow);
+      if (!revoked) report(new ConnectError("pod_unreachable", "The pod did not confirm the revocation; the cookie is cleared anyway"), "disconnect");
+    }
+    return redirect(new URL(next, origin).href, [...await store.clear(request), clearMarker]);
+  }
+  async function cloudConnect(request) {
+    if (request.method !== "POST") return new Response("Method Not Allowed", { status: 405, headers: { Allow: "POST" } });
+    if (!sameOrigin(request, origin)) return new Response("Forbidden", { status: 403 });
+    const form = await readForm(request);
+    const next = safeNextPath(formField(form, "next"), origin) ?? paths.afterConnect;
+    const space = formField(form, "space");
+    try {
+      const started = await startCloudConnect({
+        cloudUrl,
+        allowInsecureLoopback: config.allowInsecureLoopback,
+        clientId,
+        secret: config.secret,
+        next,
+        spaceHint: space && /^[A-Za-z0-9_-]{1,64}$/.test(space) ? space : null,
+        prompt: formField(form, "prompt") === "consent" ? "consent" : null,
+        now
+      });
+      return redirect(started.url, [
+        serializeCookie(names.cloud, started.transaction, { maxAgeSec: CLOUD_TRANSACTION_TTL_MS / 1e3, secure })
+      ]);
+    } catch (err) {
+      const e = fail(err, "connect");
+      return redirect(withQuery(origin, paths.connectPage, { error: e.code }));
+    }
+  }
+  async function cloudReturn(request) {
+    if (request.method !== "GET") return new Response("Method Not Allowed", { status: 405, headers: { Allow: "GET" } });
+    let pod = null;
+    try {
+      const back = await acceptCloudReturn({
+        url: request.url,
+        transaction: parseCookies(request.headers.get("cookie")).get(names.cloud) ?? null,
+        clientId,
+        secret: config.secret,
+        allowInsecureLoopback: config.allowInsecureLoopback,
+        now
+      });
+      pod = back.pod;
+      const next = back.next ?? paths.afterConnect;
+      if (!back.prompt && await liveConnectionTo(request, back.pod)) return redirect(new URL(next, origin).href, [clearCloud]);
+      return await toPod({ pod: back.pod, next, space: back.spaceHint, prompt: back.prompt }, [clearCloud]);
+    } catch (err) {
+      const e = fail(err, "connect");
+      return redirect(withQuery(origin, paths.connectPage, { error: e.code, pod: pod ? new URL(pod).host : null }), [clearCloud]);
+    }
+  }
+  async function refreshIfNeeded(request) {
+    const connection = await store.read(request);
+    const unchanged = (status, conn, error) => ({
+      status,
+      connection: conn,
+      setCookies: [],
+      cookieHeader: null,
+      ...error ? { error } : {}
+    });
+    if (!connection) {
+      const lapsed = lapsedIn(request);
+      return lapsed ? { ...unchanged("none", null), lapsed } : unchanged("none", null);
+    }
+    if (isPrefetchOrAsset(request)) return unchanged("skipped", connection);
+    const t = now();
+    const accessLives = connection.accessExpiresAt > t;
+    if (connection.accessExpiresAt - t > REFRESH_WINDOW_MS) return unchanged("fresh", connection);
+    if (!connection.refreshToken) {
+      return accessLives ? unchanged("fresh", connection) : unchanged("expired", null, new ConnectError("expired", "No refresh token; connect again"));
+    }
+    let next;
+    try {
+      next = await refreshConnection(connection, flow);
+    } catch (err) {
+      const e = fail(err, "refresh");
+      if (accessLives) return unchanged("kept", connection, e);
+      if (e.code === "revoked" || e.code === "expired") return unchanged(e.code, null, e);
+      return unchanged("unavailable", null, e);
+    }
+    let setCookies;
+    try {
+      setCookies = await store.write(next, request);
+    } catch (err) {
+      const e = fail(err, "refresh");
+      const cleared = await store.clear(request).catch(() => []);
+      return { status: "expired", connection: null, setCookies: cleared, cookieHeader: null, error: e };
+    }
+    setCookies = [...setCookies, marker(next.podUrl)];
+    return {
+      status: "refreshed",
+      connection: next,
+      setCookies,
+      cookieHeader: applySetCookies(request.headers.get("cookie"), setCookies)
+    };
+  }
+  return {
+    clientId,
+    redirectUri,
+    metadata,
+    paths,
+    cloudConnectAvailable: cloudUrl !== null,
+    handlers: { clientMetadata, connect, callback, disconnect, cloudConnect, cloudReturn },
+    readConnection: (source) => store.read(asRequest(source)),
+    async readLapsed(source) {
+      const request = asRequest(source);
+      return await store.read(request) ? null : lapsedIn(request);
+    },
+    refreshIfNeeded,
+    client: (connection, opts) => createPodClient(connection, { fetch: config.fetch, now: config.now, ...opts })
+  };
+}
+
+// src/connect/index.ts
+assertServerRuntime();
+export {
+  CLOUD_TRANSACTION_TTL_MS,
+  CONNECT_ERROR_CODES,
+  ConnectError,
+  DEFAULT_PATHS,
+  DEFAULT_REFRESH_IDLE_MS,
+  MARKER_TTL_SEC,
+  MIN_SECRET_LENGTH,
+  REFRESH_WINDOW_MS,
+  ROTATION_MEMORY_MS,
+  TRANSACTION_TTL_MS,
+  acceptCloudReturn,
+  acceptLaunch,
+  applySetCookies,
+  buildClientMetadata,
+  can,
+  canonicalPodUrl,
+  cloudBaseUrl,
+  cloudConnectAvailable,
+  connectionExpiresAt,
+  cookieNames,
+  createPodAppAuth,
+  createPodClient,
+  createSealedCookieStore,
+  discoverPod,
+  handleCallback,
+  isBrowserRuntime,
+  isConnectError,
+  isPrefetchOrAsset,
+  markerCookie,
+  openTransaction,
+  parseConnectErrorCode,
+  parseTokenResponse,
+  pkceChallenge,
+  readMarker,
+  refreshConnection,
+  reviewUrlFor,
+  revokeConnection,
+  safeNextPath,
+  seal,
+  spaces,
+  startCloudConnect,
+  startConnect,
+  unseal
+};
+//# sourceMappingURL=connect.js.map