@tangle-network/agent-integrations 0.53.47 → 0.53.49

package/dist/{chunk-C7SE5X44.js → chunk-GUZA3U6T.js}

@@ -7,13 +7,14 @@ import {
   canonicalIntegrationKind,
   integrationSpecToConnector,
   listIntegrationSpecs
-} from "./chunk-U36WHHML.js";
+} from "./chunk-ZSXRS7D7.js";
 import {
   listBundledConnectorAdapters
-} from "./chunk-DHF5EXLO.js";
+} from "./chunk-5UCHLQ3D.js";
 import {
-  CONNECTOR_ADAPTER_FACTORIES
-} from "./chunk-AGXTCR34.js";
+  CONNECTOR_ADAPTER_FACTORIES,
+  createOAuthTokenRequestHeaders
+} from "./chunk-H5UCSRF4.js";
 
 // src/activepieces-catalog.ts
 import { readFileSync } from "fs";
@@ -208,7 +209,7 @@ function dataClassFor(category) {
 }
 
 // src/index.ts
-import { createHmac, randomUUID as randomUUID3, timingSafeEqual } from "crypto";
+import { createHash as createHash3, createHmac, randomBytes, randomUUID as randomUUID3, timingSafeEqual } from "crypto";
 
 // src/core-error.ts
 var IntegrationError = class extends Error {
@@ -248,7 +249,11 @@ function createConnectorAdapterProvider(options) {
           "auth_not_supported"
         );
       }
-      resolveTokenClientAuthMethod(auth.tokenClientAuthMethod, request.connectorId);
+      const pkce = resolveOAuthPkceMode(auth.pkce, request.connectorId);
+      const tokenClientAuthMethod = resolveTokenClientAuthMethod(
+        auth.tokenClientAuthMethod,
+        request.connectorId
+      );
       if (!options.resolveOAuthClient) {
         throw new IntegrationError(
           `OAuth client resolver missing on adapter provider; cannot start auth for ${request.connectorId}.`,
@@ -256,7 +261,7 @@ function createConnectorAdapterProvider(options) {
         );
       }
       const client = await options.resolveOAuthClient({ connectorId: request.connectorId });
-      if (!client || !client.clientId || !client.clientSecret) {
+      if (!client || !client.clientId || tokenClientAuthMethod !== "none" && !client.clientSecret) {
         throw new IntegrationError(
           `OAuth client credentials unavailable for ${request.connectorId}.`,
           "config_missing"
@@ -275,7 +280,14 @@ function createConnectorAdapterProvider(options) {
         request.connectorId
       ));
       url.searchParams.set("response_type", "code");
-      url.searchParams.set("client_id", client.clientId);
+      url.searchParams.set(
+        resolveOAuthParameterName(
+          auth.authorizationClientIdParam,
+          "client_id",
+          request.connectorId
+        ),
+        client.clientId
+      );
       url.searchParams.set("redirect_uri", request.redirectUri);
       if (scopes.length > 0) {
         url.searchParams.set("scope", scopes.join(auth.scopeSeparator ?? " "));
@@ -287,6 +299,16 @@ function createConnectorAdapterProvider(options) {
           url.searchParams.set(key, value);
         }
       }
+      if (pkce === "unsupported") {
+        url.searchParams.delete("code_challenge");
+        url.searchParams.delete("code_challenge_method");
+      } else {
+        url.searchParams.set(
+          "code_challenge",
+          requirePkceChallenge(request.codeChallenge, request.connectorId)
+        );
+        url.searchParams.set("code_challenge_method", "S256");
+      }
       return {
         providerId,
         connectorId: request.connectorId,
@@ -314,6 +336,7 @@ function createConnectorAdapterProvider(options) {
         auth.tokenClientAuthMethod,
         request.connectorId
       );
+      const pkce = resolveOAuthPkceMode(auth.pkce, request.connectorId);
       if (!request.code) {
         throw new IntegrationError(
           `Authorization code missing on completeAuth for ${request.connectorId}.`,
@@ -327,7 +350,7 @@ function createConnectorAdapterProvider(options) {
         );
       }
       const client = await options.resolveOAuthClient({ connectorId: request.connectorId });
-      if (!client || !client.clientId || !client.clientSecret) {
+      if (!client || !client.clientId || tokenClientAuthMethod !== "none" && !client.clientSecret) {
         throw new IntegrationError(
           `OAuth client credentials unavailable for ${request.connectorId}.`,
           "config_missing"
@@ -344,14 +367,41 @@ function createConnectorAdapterProvider(options) {
         code: request.code,
         redirect_uri: request.redirectUri
       });
-      const headers = {
-        "content-type": "application/x-www-form-urlencoded",
-        accept: "application/json"
-      };
-      const redactionValues = [request.code, client.clientId, client.clientSecret];
-      if (tokenClientAuthMethod === "client_secret_post") {
-        body.set("client_id", client.clientId);
-        body.set("client_secret", client.clientSecret);
+      const codeVerifier = pkce === "unsupported" ? void 0 : requirePkceVerifier(request.codeVerifier, request.connectorId);
+      if (codeVerifier) body.set("code_verifier", codeVerifier);
+      const headers = createOAuthTokenRequestHeaders(auth.tokenRequestHeaders);
+      const redactionValues = [
+        request.code,
+        client.clientId,
+        ...client.clientSecret ? [client.clientSecret] : [],
+        ...codeVerifier ? [codeVerifier] : []
+      ];
+      if (tokenClientAuthMethod === "none") {
+        body.set(
+          resolveOAuthParameterName(
+            auth.tokenClientIdParam,
+            "client_id",
+            request.connectorId
+          ),
+          client.clientId
+        );
+      } else if (tokenClientAuthMethod === "client_secret_post") {
+        body.set(
+          resolveOAuthParameterName(
+            auth.tokenClientIdParam,
+            "client_id",
+            request.connectorId
+          ),
+          client.clientId
+        );
+        body.set(
+          resolveOAuthParameterName(
+            auth.tokenClientSecretParam,
+            "client_secret",
+            request.connectorId
+          ),
+          client.clientSecret
+        );
       } else {
         const authorization = `Basic ${base64Encode(`${client.clientId}:${client.clientSecret}`)}`;
         headers.authorization = authorization;
@@ -433,7 +483,16 @@ function createConnectorAdapterProvider(options) {
         throw new IntegrationError(`Capability ${request.action} is not defined by ${connection.connectorId}.`, "action_not_found");
       }
       const source = await options.resolveDataSource(connection);
-      let rotated;
+      let rotationPersistence = Promise.resolve();
+      const persistRotation = (credentials) => {
+        if (!options.onCredentialsRotated) return Promise.resolve();
+        rotationPersistence = rotationPersistence.then(
+          () => options.onCredentialsRotated({ connection, credentials })
+        );
+        void rotationPersistence.catch(() => {
+        });
+        return rotationPersistence;
+      };
       const invocation = {
         source,
         capabilityName: request.action,
@@ -441,32 +500,27 @@ function createConnectorAdapterProvider(options) {
         idempotencyKey: request.idempotencyKey ?? `idem_${connection.id}_${request.action}_${now().getTime()}`,
         expectedEtag: typeof request.metadata?.expectedEtag === "string" ? request.metadata.expectedEtag : void 0,
         callSessionId: typeof request.metadata?.callSessionId === "string" ? request.metadata.callSessionId : void 0,
-        onCredentialsRotated: options.onCredentialsRotated ? (credentials) => {
-          rotated = credentials;
-        } : void 0
-      };
-      const persistRotation = async () => {
-        if (rotated && options.onCredentialsRotated) {
-          await options.onCredentialsRotated({ connection, credentials: rotated });
-        }
+        onCredentialsRotated: options.onCredentialsRotated ? persistRotation : void 0
       };
-      if (capability.class === "read") {
-        if (!adapter.executeRead) {
-          throw new IntegrationError(`Connector ${connection.connectorId} does not implement reads.`, "action_not_found");
+      try {
+        if (capability.class === "read") {
+          if (!adapter.executeRead) {
+            throw new IntegrationError(`Connector ${connection.connectorId} does not implement reads.`, "action_not_found");
+          }
+          const result = await adapter.executeRead(invocation);
+          return readResultToAction(request, result);
         }
-        const result = await adapter.executeRead(invocation);
-        await persistRotation();
-        return readResultToAction(request, result);
-      }
-      if (capability.class === "mutation") {
-        if (!adapter.executeMutation) {
-          throw new IntegrationError(`Connector ${connection.connectorId} does not implement mutations.`, "action_not_found");
+        if (capability.class === "mutation") {
+          if (!adapter.executeMutation) {
+            throw new IntegrationError(`Connector ${connection.connectorId} does not implement mutations.`, "action_not_found");
+          }
+          const result = await adapter.executeMutation(invocation);
+          return mutationResultToAction(request, result);
         }
-        const result = await adapter.executeMutation(invocation);
-        await persistRotation();
-        return mutationResultToAction(request, result);
+        throw new IntegrationError(`Capability ${request.action} is not invokable as an action.`, "action_not_found");
+      } finally {
+        await rotationPersistence;
       }
-      throw new IntegrationError(`Capability ${request.action} is not invokable as an action.`, "action_not_found");
     }
   };
 }
@@ -484,6 +538,7 @@ function createConnectorAdapterCatalogSource(options) {
 function manifestToConnector(providerId, adapter) {
   const manifest = adapter.manifest;
   const primaryAuth = primaryManifestAuth(manifest.auth);
+  const oauthAuth = oauthManifestAuth(manifest.auth);
   return {
     id: manifest.kind,
     providerId,
@@ -505,6 +560,7 @@ function manifestToConnector(providerId, adapter) {
       source: "first-party-adapter",
       supportTier: "firstPartyExecutable",
       executable: true,
+      oauthPkce: oauthAuth ? resolveOAuthPkceMode(oauthAuth.pkce, manifest.kind) : void 0,
       authOptions: manifest.auth.kind === "one_of" ? manifest.auth.options.map((auth) => auth.kind) : [manifest.auth.kind],
       preferredAuth: manifest.auth.kind === "one_of" ? manifest.auth.preferred : manifest.auth.kind
     }
@@ -576,12 +632,48 @@ function resolveTokenClientAuthMethod(value, connectorId) {
   if (value === void 0 || value === "client_secret_post") {
     return "client_secret_post";
   }
-  if (value === "client_secret_basic") return value;
+  if (value === "none" || value === "client_secret_basic") return value;
   throw new IntegrationError(
     `Connector ${connectorId} has an unsupported OAuth token client authentication method.`,
     "config_missing"
   );
 }
+function resolveOAuthPkceMode(value, connectorId) {
+  if (value === void 0 || value === "required") return "required";
+  if (value === "supported" || value === "unsupported") return value;
+  throw new IntegrationError(
+    `Connector ${connectorId} has an invalid OAuth PKCE posture.`,
+    "config_missing"
+  );
+}
+function requirePkceChallenge(value, connectorId) {
+  if (!value || !/^[A-Za-z0-9_-]{43}$/.test(value)) {
+    throw new IntegrationError(
+      `OAuth PKCE S256 challenge missing or invalid for ${connectorId}.`,
+      "config_missing"
+    );
+  }
+  return value;
+}
+function requirePkceVerifier(value, connectorId) {
+  if (!value || !/^[A-Za-z0-9._~-]{43,128}$/.test(value)) {
+    throw new IntegrationError(
+      `OAuth PKCE verifier missing or invalid for ${connectorId}.`,
+      "config_missing"
+    );
+  }
+  return value;
+}
+function resolveOAuthParameterName(value, fallback, connectorId) {
+  const name = value ?? fallback;
+  if (!/^[A-Za-z][A-Za-z0-9_.-]{0,63}$/.test(name)) {
+    throw new IntegrationError(
+      `Connector ${connectorId} declares an invalid OAuth parameter name.`,
+      "config_missing"
+    );
+  }
+  return name;
+}
 function base64Encode(value) {
   const btoa2 = globalThis.btoa;
   if (typeof btoa2 !== "function") {
@@ -698,6 +790,15 @@ function base64UrlEncode(bytes) {
 }
 
 // src/credentials.ts
+var CredentialRefreshRevokedError = class extends Error {
+  constructor() {
+    super("Connection was revoked during credential refresh.");
+    this.name = "CredentialRefreshRevokedError";
+  }
+};
+var credentialRefreshes = /* @__PURE__ */ new WeakMap();
+var credentialPersistences = /* @__PURE__ */ new WeakMap();
+var credentialRevocations = /* @__PURE__ */ new WeakMap();
 var InMemoryIntegrationSecretStore = class {
   secrets = /* @__PURE__ */ new Map();
   get(ref) {
@@ -755,35 +856,141 @@ function createConnectionCredentialResolver(options) {
 async function resolveConnectionCredentials(input, options) {
   if (input.status !== "active") throw new Error(`Connection ${input.id} is ${input.status}.`);
   if (!input.secretRef) return { kind: "none" };
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
   const current = await options.secrets.get(input.secretRef);
   if (!current) throw new Error(`Secret ${input.secretRef.provider}/${input.secretRef.id} not found.`);
-  if (!isExpiredOauth(current, options.now ?? (() => /* @__PURE__ */ new Date()))) return current;
+  if (!isExpiredOauth(current, now)) return current;
   const adapter = options.adapters?.find((candidate) => candidate.manifest.kind === input.connectorId);
   if (!adapter?.refreshToken) return current;
+  let refresh;
   try {
-    const refreshed = await adapter.refreshToken(current);
-    await options.secrets.put(input.secretRef, refreshed);
+    await assertCredentialRefreshActive(input, options, now);
+    refresh = acquireCredentialRefresh({
+      connectorId: input.connectorId,
+      secretRef: input.secretRef,
+      secrets: options.secrets,
+      now,
+      refreshToken: adapter.refreshToken.bind(adapter)
+    });
+    const refreshed = await refresh.promise;
+    await assertCredentialRefreshActive(input, options, now, refresh);
     if (options.connections) {
       await options.connections.put({
         ...input,
         status: "active",
-        updatedAt: (options.now?.() ?? /* @__PURE__ */ new Date()).toISOString(),
+        updatedAt: now().toISOString(),
         expiresAt: refreshed.kind === "oauth2" && refreshed.expiresAt ? new Date(refreshed.expiresAt).toISOString() : input.expiresAt
       });
+      await assertCredentialRefreshActive(input, options, now, refresh);
     }
     return refreshed;
   } catch (error) {
     const err = error instanceof Error ? error : new Error("Credential refresh failed.");
+    if (err instanceof CredentialRefreshRevokedError) throw err;
     await options.markConnectionError?.(input, err);
     if (options.connections) {
       await options.connections.put({
         ...input,
         status: "expired",
-        updatedAt: (options.now?.() ?? /* @__PURE__ */ new Date()).toISOString()
+        updatedAt: now().toISOString()
       });
     }
     throw err;
+  } finally {
+    if (refresh) {
+      releaseCredentialRefresh(
+        options.secrets,
+        input.connectorId,
+        input.secretRef,
+        refresh
+      );
+    }
+  }
+}
+function acquireCredentialRefresh(input) {
+  let refreshes = credentialRefreshes.get(input.secrets);
+  if (!refreshes) {
+    refreshes = /* @__PURE__ */ new Map();
+    credentialRefreshes.set(input.secrets, refreshes);
+  }
+  const key = credentialRefreshKey(input.connectorId, input.secretRef);
+  if (credentialRevocations.get(input.secrets)?.has(key)) {
+    throw new CredentialRefreshRevokedError();
+  }
+  const existing = refreshes.get(key);
+  if (existing) {
+    existing.waiters += 1;
+    return existing;
+  }
+  let flight;
+  const promise = Promise.resolve().then(async () => {
+    const latest = await input.secrets.get(input.secretRef);
+    if (!latest) {
+      throw new Error(
+        `Secret ${input.secretRef.provider}/${input.secretRef.id} not found.`
+      );
+    }
+    if (!isExpiredOauth(latest, input.now)) return latest;
+    const refreshed = await input.refreshToken(latest);
+    if (flight.cancelled) throw new CredentialRefreshRevokedError();
+    await input.secrets.put(input.secretRef, refreshed);
+    if (flight.cancelled) {
+      await input.secrets.delete?.(input.secretRef);
+      throw new CredentialRefreshRevokedError();
+    }
+    return refreshed;
+  });
+  flight = {
+    promise,
+    cancelled: false,
+    settled: false,
+    waiters: 1
+  };
+  refreshes.set(key, flight);
+  const settle = () => {
+    flight.settled = true;
+    clearCredentialRefresh(input.secrets, key, flight);
+  };
+  void promise.then(settle, settle);
+  return flight;
+}
+function releaseCredentialRefresh(secrets, connectorId, secretRef, flight) {
+  flight.waiters -= 1;
+  clearCredentialRefresh(
+    secrets,
+    credentialRefreshKey(connectorId, secretRef),
+    flight
+  );
+}
+function clearCredentialRefresh(secrets, key, flight) {
+  if (!flight.settled || flight.waiters !== 0) return;
+  const refreshes = credentialRefreshes.get(secrets);
+  if (refreshes?.get(key) !== flight) return;
+  refreshes.delete(key);
+  if (refreshes.size === 0) credentialRefreshes.delete(secrets);
+}
+async function assertCredentialRefreshActive(input, options, now, operation) {
+  const key = input.secretRef ? credentialRefreshKey(input.connectorId, input.secretRef) : void 0;
+  let revoked = operation?.cancelled === true || key !== void 0 && credentialRevocations.get(options.secrets)?.has(key) === true;
+  let stored;
+  if (options.connections) {
+    stored = await options.connections.get(input.id);
+    revoked ||= stored?.status === "revoked";
+  }
+  if (!revoked && input.secretRef) {
+    revoked = await options.secrets.get(input.secretRef) === void 0;
+  }
+  if (!revoked) return;
+  if (operation) operation.cancelled = true;
+  if (input.secretRef) await options.secrets.delete?.(input.secretRef);
+  if (options.connections && stored?.status !== "revoked") {
+    await options.connections.put({
+      ...stored ?? input,
+      status: "revoked",
+      updatedAt: now().toISOString()
+    });
   }
+  throw new CredentialRefreshRevokedError();
 }
 function createCredentialBackedAdapterProvider(options) {
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
@@ -791,30 +998,106 @@ function createCredentialBackedAdapterProvider(options) {
     ...options,
     resolveDataSource: createConnectionCredentialResolver(options),
     onCredentialsRotated: async ({ connection, credentials }) => {
-      if (connection.secretRef) {
-        await options.secrets.put(connection.secretRef, credentials);
-      }
-      if (options.connections) {
-        await options.connections.put({
-          ...connection,
-          status: "active",
-          updatedAt: now().toISOString(),
-          expiresAt: credentials.kind === "oauth2" && credentials.expiresAt ? new Date(credentials.expiresAt).toISOString() : connection.expiresAt
-        });
+      const persistence = connection.secretRef ? acquireCredentialPersistence(
+        options.secrets,
+        connection.connectorId,
+        connection.secretRef
+      ) : void 0;
+      try {
+        await assertCredentialRefreshActive(connection, options, now, persistence);
+        if (connection.secretRef) {
+          await options.secrets.put(connection.secretRef, credentials);
+        }
+        await assertCredentialRefreshActive(connection, options, now, persistence);
+        if (options.connections) {
+          await options.connections.put({
+            ...connection,
+            status: "active",
+            updatedAt: now().toISOString(),
+            expiresAt: credentials.kind === "oauth2" && credentials.expiresAt ? new Date(credentials.expiresAt).toISOString() : connection.expiresAt
+          });
+          await assertCredentialRefreshActive(connection, options, now, persistence);
+        }
+        await options.onCredentialsRotated?.({ connection, secretRef: connection.secretRef, credentials });
+        await assertCredentialRefreshActive(connection, options, now, persistence);
+      } finally {
+        if (persistence && connection.secretRef) {
+          releaseCredentialPersistence(
+            options.secrets,
+            connection.connectorId,
+            connection.secretRef,
+            persistence
+          );
+        }
       }
-      await options.onCredentialsRotated?.({ connection, secretRef: connection.secretRef, credentials });
     }
   });
 }
+function acquireCredentialPersistence(secrets, connectorId, secretRef) {
+  let persistences = credentialPersistences.get(secrets);
+  if (!persistences) {
+    persistences = /* @__PURE__ */ new Map();
+    credentialPersistences.set(secrets, persistences);
+  }
+  const key = credentialRefreshKey(connectorId, secretRef);
+  let leases = persistences.get(key);
+  if (!leases) {
+    leases = /* @__PURE__ */ new Set();
+    persistences.set(key, leases);
+  }
+  const lease = {
+    cancelled: credentialRevocations.get(secrets)?.has(key) === true
+  };
+  leases.add(lease);
+  return lease;
+}
+function releaseCredentialPersistence(secrets, connectorId, secretRef, lease) {
+  const persistences = credentialPersistences.get(secrets);
+  if (!persistences) return;
+  const key = credentialRefreshKey(connectorId, secretRef);
+  const leases = persistences.get(key);
+  leases?.delete(lease);
+  if (leases?.size === 0) persistences.delete(key);
+  if (persistences.size === 0) credentialPersistences.delete(secrets);
+}
 async function revokeConnection(input) {
-  if (input.connection.secretRef) await input.secrets?.delete?.(input.connection.secretRef);
-  const revoked = {
-    ...input.connection,
-    status: "revoked",
-    updatedAt: (input.now?.() ?? /* @__PURE__ */ new Date()).toISOString()
+  const finishRevocation = input.connection.secretRef && input.secrets ? beginCredentialRevocation(
+    input.secrets,
+    input.connection.connectorId,
+    input.connection.secretRef
+  ) : void 0;
+  try {
+    if (input.connection.secretRef) await input.secrets?.delete?.(input.connection.secretRef);
+    const revoked = {
+      ...input.connection,
+      status: "revoked",
+      updatedAt: (input.now?.() ?? /* @__PURE__ */ new Date()).toISOString()
+    };
+    await input.connections?.put(revoked);
+    return revoked;
+  } finally {
+    finishRevocation?.();
+  }
+}
+function beginCredentialRevocation(secrets, connectorId, secretRef) {
+  const key = credentialRefreshKey(connectorId, secretRef);
+  let revocations = credentialRevocations.get(secrets);
+  if (!revocations) {
+    revocations = /* @__PURE__ */ new Map();
+    credentialRevocations.set(secrets, revocations);
+  }
+  revocations.set(key, (revocations.get(key) ?? 0) + 1);
+  const flight = credentialRefreshes.get(secrets)?.get(key);
+  if (flight) flight.cancelled = true;
+  for (const persistence of credentialPersistences.get(secrets)?.get(key) ?? []) {
+    persistence.cancelled = true;
+  }
+  return () => {
+    const remaining = (revocations?.get(key) ?? 1) - 1;
+    if (remaining > 0) revocations?.set(key, remaining);
+    else revocations?.delete(key);
+    if (revocations?.size === 0) credentialRevocations.delete(secrets);
   };
-  await input.connections?.put(revoked);
-  return revoked;
 }
 function isExpiredOauth(credentials, now) {
   return credentials.kind === "oauth2" && typeof credentials.expiresAt === "number" && credentials.expiresAt <= now().getTime() && Boolean(credentials.refreshToken);
@@ -822,6 +1105,9 @@ function isExpiredOauth(credentials, now) {
 function secretKey(ref) {
   return `${ref.provider}:${ref.id}`;
 }
+function credentialRefreshKey(connectorId, ref) {
+  return JSON.stringify([connectorId, ref.provider, ref.id]);
+}
 
 // src/audit.ts
 import { randomUUID } from "crypto";
@@ -3302,8 +3588,13 @@ var IntegrationHub = class {
   async startAuth(providerId, request) {
     const provider = this.requireProvider(providerId);
     if (!provider.startAuth) throw new IntegrationError(`Provider ${providerId} does not support auth start.`, "auth_not_supported");
-    await this.requireConnector(provider, request.connectorId);
-    const result = await provider.startAuth(request);
+    const connector = await this.requireConnector(provider, request.connectorId);
+    const pkce = connectorOAuthPkceMode(connector);
+    const pkcePair = pkce === "unsupported" ? void 0 : createPkcePair();
+    const result = await provider.startAuth({
+      ...request,
+      codeChallenge: pkcePair?.challenge
+    });
     const record = {
       state: result.state,
       providerId,
@@ -3311,6 +3602,7 @@ var IntegrationHub = class {
       owner: request.owner,
       requestedScopes: request.requestedScopes,
       redirectUri: request.redirectUri,
+      codeVerifier: pkcePair?.verifier,
       expiresAt: this.now().getTime() + this.oauthStateTtlMs,
       metadata: request.metadata
     };
@@ -3330,7 +3622,16 @@ var IntegrationHub = class {
     if (outcome.state.redirectUri !== request.redirectUri) {
       throw new IntegrationError("Integration OAuth redirect URI does not match the start request.", "capability_invalid");
     }
-    const connection = await provider.completeAuth(request);
+    const pinnedMetadata = request.metadata || outcome.state.metadata ? { ...request.metadata, ...outcome.state.metadata } : void 0;
+    const connection = await provider.completeAuth({
+      ...request,
+      connectorId: outcome.state.connectorId,
+      owner: outcome.state.owner,
+      state: outcome.state.state,
+      redirectUri: outcome.state.redirectUri,
+      codeVerifier: outcome.state.codeVerifier,
+      metadata: pinnedMetadata
+    });
     await this.store.put(connection);
     return connection;
   }
@@ -3587,6 +3888,20 @@ function assertScopes(connection, requiredScopes2) {
   const missing2 = requiredScopes2.filter((scope) => !connection.grantedScopes.includes(scope));
   if (missing2.length > 0) throw new IntegrationError(`Missing integration scopes: ${missing2.join(", ")}`, "scope_denied");
 }
+function connectorOAuthPkceMode(connector) {
+  const value = connector.metadata?.oauthPkce;
+  if (value === void 0) return "required";
+  if (value === "required" || value === "supported" || value === "unsupported") return value;
+  throw new IntegrationError(
+    `Connector ${connector.id} declares an invalid OAuth PKCE posture.`,
+    "config_missing"
+  );
+}
+function createPkcePair() {
+  const verifier = randomBytes(48).toString("base64url");
+  const challenge = createHash3("sha256").update(verifier).digest("base64url");
+  return { verifier, challenge };
+}
 function hmac(payload, secret) {
   return createHmac("sha256", secret).update(payload).digest("base64url");
 }
@@ -4426,4 +4741,4 @@ export {
   signCapability,
   verifyCapabilityToken
 };
-//# sourceMappingURL=chunk-C7SE5X44.js.map
+//# sourceMappingURL=chunk-GUZA3U6T.js.map