@zackbart/connecta 0.34.0 → 0.35.0

package/dist/auth/oauth-token-response.js

@@ -1,3 +1,5 @@
+import { runEdge } from "../runtime/run.js";
+import { authCall, authFlow, authInvoke, authProgram, registerAuth } from "./native.js";
 // The token endpoint's answers as downstream OAuth classifies them and the SDK
 // gets to parse them: a refresh's re-consent verdict, and every failure
 // rebuilt from its OAuth `error` code alone, so nothing else a token endpoint
@@ -55,47 +57,54 @@ class OversizedRefreshResponse extends Error {
         super(`OAuth refresh response exceeded ${MAX_REFRESH_RESPONSE_BYTES} bytes.`);
     }
 }
-async function readRefreshResponse(response, signal, clone = true) {
-    if (Number(response.headers.get("content-length")) > MAX_REFRESH_RESPONSE_BYTES) {
-        void response.body?.cancel().catch(() => { });
-        throw new OversizedRefreshResponse();
-    }
-    const reader = (clone ? response.clone() : response).body?.getReader();
-    if (!reader)
-        return undefined;
-    void reader.closed.catch(() => { });
-    const cancel = () => {
-        void reader.cancel().catch(() => { });
-        void response.body?.cancel().catch(() => { });
-    };
-    signal?.addEventListener("abort", cancel, { once: true });
-    if (signal?.aborted)
-        cancel();
-    const decoder = new TextDecoder();
-    let size = 0;
-    let text = "";
-    try {
-        while (true) {
-            const { done, value } = await reader.read();
-            if (done)
-                break;
-            size += value.byteLength;
-            if (size > MAX_REFRESH_RESPONSE_BYTES) {
-                // A cloned body's cancellation can await its sibling. Cancel both,
-                // without making the refusal wait for the provider to finish sending.
-                void reader.cancel().catch(() => { });
-                void response.body?.cancel().catch(() => { });
-                throw new OversizedRefreshResponse();
+function readRefreshResponse(response, signal, clone = true) {
+    return runEdge(authProgram(readRefreshResponseNative, [response, signal, clone]));
+}
+const readRefreshResponseNative = /* @__PURE__ */ registerAuth(readRefreshResponse, function (response, signal, clone = true) {
+    return authFlow(function* () {
+        if (Number(response.headers.get("content-length")) > MAX_REFRESH_RESPONSE_BYTES) {
+            void response.body?.cancel().catch(() => { });
+            throw new OversizedRefreshResponse();
+        }
+        const reader = (clone ? response.clone() : response).body?.getReader();
+        if (!reader)
+            return undefined;
+        void reader.closed.catch(() => { });
+        const cancel = () => {
+            void reader.cancel().catch(() => { });
+            void response.body?.cancel().catch(() => { });
+        };
+        signal?.addEventListener("abort", cancel, { once: true });
+        if (signal?.aborted)
+            cancel();
+        const decoder = new TextDecoder();
+        let size = 0;
+        let text = "";
+        try {
+            while (true) {
+                const { done, value } = (yield authInvoke(reader, "read", []));
+                if (done)
+                    break;
+                size += value.byteLength;
+                if (size > MAX_REFRESH_RESPONSE_BYTES) {
+                    // A cloned body's cancellation can await its sibling. Cancel both,
+                    // without making the refusal wait for the provider to finish sending.
+                    void reader.cancel().catch(() => { });
+                    void response.body?.cancel().catch(() => { });
+                    throw new OversizedRefreshResponse();
+                }
+                text += decoder.decode(value, { stream: true });
             }
-            text += decoder.decode(value, { stream: true });
+            return JSON.parse(text + decoder.decode());
         }
-        return JSON.parse(text + decoder.decode());
-    }
-    finally {
-        signal?.removeEventListener("abort", cancel);
-        reader.releaseLock();
-    }
-}
+        finally {
+            if (signal?.aborted)
+                cancel();
+            signal?.removeEventListener("abort", cancel);
+            reader.releaseLock();
+        }
+    });
+});
 function oauthErrorCode(body) {
     if (!body || typeof body !== "object" || Array.isArray(body))
         return undefined;
@@ -148,24 +157,29 @@ function sdkTokenFailure(original, code, status = original.status) {
  * the registered set becomes `invalid_request`, and a body without a string
  * code becomes `server_error`, the classes the SDK already gave them.
  */
-export async function sdkSafeTokenResponse(response, accept) {
-    if (response.status >= 300 && response.status < 400) {
-        return sdkTokenFailure(response, "invalid_request", 400);
-    }
-    let parsed;
-    try {
-        parsed = await readRefreshResponse(response);
-    }
-    catch {
-        // Not JSON, or too large to be a token response: only the status is left.
-        return sdkTokenFailure(response, "server_error");
-    }
-    if (response.ok && sdkAcceptsOAuthTokens(parsed)) {
-        await accept?.(parsed);
-        return response;
-    }
-    return sdkTokenFailure(response, oauthErrorCode(parsed) ?? "server_error");
+export function sdkSafeTokenResponse(response, accept) {
+    return runEdge(authProgram(sdkSafeTokenResponseNative, [response, accept]));
 }
+const sdkSafeTokenResponseNative = /* @__PURE__ */ registerAuth(sdkSafeTokenResponse, function (response, accept) {
+    return authFlow(function* () {
+        if (response.status >= 300 && response.status < 400) {
+            return sdkTokenFailure(response, "invalid_request", 400);
+        }
+        let parsed;
+        try {
+            parsed = (yield authCall(readRefreshResponse, [response]));
+        }
+        catch {
+            // Not JSON, or too large to be a token response: only the status is left.
+            return sdkTokenFailure(response, "server_error");
+        }
+        if (response.ok && sdkAcceptsOAuthTokens(parsed)) {
+            (yield authCall(accept, [parsed]));
+            return response;
+        }
+        return sdkTokenFailure(response, oauthErrorCode(parsed) ?? "server_error");
+    });
+});
 /**
  * Classify the token endpoint's answer once with a bounded read, and keep the parsed
  * tokens: a valid response has already consumed the rotating refresh token, so
@@ -180,52 +194,57 @@ export async function sdkSafeTokenResponse(response, accept) {
  * Provider hooks preserve the re-consent verdict for passive calls. Rebuilding
  * the response keeps provider text out of SDK output.
  */
-export async function refreshResponseOutcome(response, signal) {
-    if (response.status >= 300 && response.status < 400) {
-        return {
-            failure: new Error("OAuth token endpoint redirected; authorization required."),
-            verdict: { kind: "dead" },
-            forSdk: sdkTokenFailure(response, "invalid_grant", 400),
-        };
-    }
-    if (!response.ok) {
-        let code;
-        try {
-            const body = await readRefreshResponse(response, signal, false);
-            if (body && typeof body === "object" && ("access_token" in body || "refresh_token" in body)) {
-                // A provider issuing tokens while reporting failure may have rotated.
-                throw new Error("OAuth refresh failure response may contain a rotation.");
+export function refreshResponseOutcome(response, signal) {
+    return runEdge(authProgram(refreshResponseOutcomeNative, [response, signal]));
+}
+const refreshResponseOutcomeNative = /* @__PURE__ */ registerAuth(refreshResponseOutcome, function (response, signal) {
+    return authFlow(function* () {
+        if (response.status >= 300 && response.status < 400) {
+            return {
+                failure: new Error("OAuth token endpoint redirected; authorization required."),
+                verdict: { kind: "dead" },
+                forSdk: sdkTokenFailure(response, "invalid_grant", 400),
+            };
+        }
+        if (!response.ok) {
+            let code;
+            try {
+                const body = (yield authCall(readRefreshResponse, [response, signal, false]));
+                if (body && typeof body === "object" && ("access_token" in body || "refresh_token" in body)) {
+                    // A provider issuing tokens while reporting failure may have rotated.
+                    throw new Error("OAuth refresh failure response may contain a rotation.");
+                }
+                code = oauthErrorCode(body);
             }
-            code = oauthErrorCode(body);
+            catch (error) {
+                // Complete non-JSON failures still require re-consent. A lost body or
+                // evidence of issued tokens cannot prove a committed outcome.
+                if (!(error instanceof SyntaxError))
+                    throw error;
+            }
+            const failure = new Error(`OAuth refresh failed with HTTP ${response.status}.`);
+            return {
+                failure,
+                verdict: { kind: "dead" },
+                forSdk: sdkTokenFailure(response, code === "invalid_client" || code === "unauthorized_client" ? code : "invalid_grant", 400),
+            };
         }
-        catch (error) {
-            // Complete non-JSON failures still require re-consent. A lost body or
-            // evidence of issued tokens cannot prove a committed outcome.
-            if (!(error instanceof SyntaxError))
-                throw error;
+        // A successful HTTP status may have consumed the token even when its
+        // body cannot be read or parsed. The coordinator refuses the fingerprint.
+        const parsed = (yield authCall(readRefreshResponse, [response, signal, false]));
+        if (sdkAcceptsOAuthTokens(parsed)) {
+            // An `issuer` names the server a grant is bound to, and only the client
+            // stamps it — never the server answering, as the SDK's own parse agrees.
+            const { issuer: _ignored, ...tokens } = parsed;
+            return { tokens };
         }
-        const failure = new Error(`OAuth refresh failed with HTTP ${response.status}.`);
-        return {
-            failure,
-            verdict: { kind: "dead" },
-            forSdk: sdkTokenFailure(response, code === "invalid_client" || code === "unauthorized_client" ? code : "invalid_grant", 400),
-        };
-    }
-    // A successful HTTP status may have consumed the token even when its
-    // body cannot be read or parsed. The coordinator refuses the fingerprint.
-    const parsed = await readRefreshResponse(response, signal, false);
-    if (sdkAcceptsOAuthTokens(parsed)) {
-        // An `issuer` names the server a grant is bound to, and only the client
-        // stamps it — never the server answering, as the SDK's own parse agrees.
-        const { issuer: _ignored, ...tokens } = parsed;
-        return { tokens };
-    }
-    if (oauthErrorCode(parsed) !== undefined) {
-        return {
-            failure: new Error("OAuth refresh was refused by the authorization server."),
-            verdict: { kind: "dead" },
-            forSdk: sdkTokenFailure(response, "invalid_grant", 400),
-        };
-    }
-    throw new Error("OAuth refresh response did not match the token schema.");
-}
+        if (oauthErrorCode(parsed) !== undefined) {
+            return {
+                failure: new Error("OAuth refresh was refused by the authorization server."),
+                verdict: { kind: "dead" },
+                forSdk: sdkTokenFailure(response, "invalid_grant", 400),
+            };
+        }
+        throw new Error("OAuth refresh response did not match the token schema.");
+    });
+});

package/dist/auth/oauth-v2-migration.js

@@ -1,4 +1,6 @@
+import { runEdge } from "../runtime/run.js";
 import { oauthV2Keys } from "../storage/keys.js";
+import { authAll, authCall, authFlow, authInvoke, authMap, authMethod, authProgram, authStorage, registerAuth, } from "./native.js";
 function plainObject(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -29,88 +31,105 @@ export function discoveryIssuer(state) {
  * discovery names, if any; otherwise it migrates empty and needs consent.
  * One-shot consent state (pending URL, verifier, state) is not carried.
  */
-export async function readV2Grant(storage, sealer) {
-    const keys = await listV2Keys(storage);
-    if (keys.length === 0)
-        return undefined;
-    const generation = (await storage.get(oauthV2Keys.generation)) ?? "legacy";
-    if (generation.startsWith("disconnected:"))
-        return { disconnected: true, body: {} };
-    if (!generation.startsWith("v2:") && generation !== "legacy") {
-        // An unfinished reset, or a numeric generation from before epochs.
-        return { disconnected: false, body: {} };
-    }
-    const epoch = generation === "legacy" ? null : generation;
-    const read = async (field) => {
-        const physicalKey = oauthV2Keys.value(field, epoch);
-        const raw = await storage.get(physicalKey);
-        if (raw === null)
+export function readV2Grant(storage, sealer) {
+    return runEdge(authProgram(readV2GrantNative, [storage, sealer]));
+}
+const readV2GrantNative = /* @__PURE__ */ registerAuth(readV2Grant, function (storage, sealer) {
+    return authFlow(function* () {
+        const keys = (yield authCall(listV2Keys, [storage]));
+        if (keys.length === 0)
             return undefined;
-        let parsed = parse(raw);
-        if (plainObject(parsed) && parsed.connectaOAuthSealed === 1 && typeof parsed.sealed === "string") {
-            if (!sealer)
-                return undefined;
-            try {
-                parsed = parse(await sealer.open(physicalKey, parsed.sealed));
-            }
-            catch {
-                return undefined;
-            }
+        const generation = (yield authStorage(storage, "get", [oauthV2Keys.generation])) ?? "legacy";
+        if (generation.startsWith("disconnected:"))
+            return { disconnected: true, body: {} };
+        if (!generation.startsWith("v2:") && generation !== "legacy") {
+            // An unfinished reset, or a numeric generation from before epochs.
+            return { disconnected: false, body: {} };
         }
-        if (plainObject(parsed) &&
-            parsed.connectaOAuthVersion === 2 &&
-            parsed.generation === generation &&
-            (parsed.issuer === undefined || typeof parsed.issuer === "string") &&
-            (parsed.binding === undefined || typeof parsed.binding === "string")) {
-            return {
-                value: parsed.value,
-                ...(parsed.issuer !== undefined ? { issuer: parsed.issuer } : {}),
-                ...(parsed.binding !== undefined ? { binding: parsed.binding } : {}),
-                ...(parsed.carried === true ? { carried: true } : {}),
-            };
-        }
-        // Layout 2 wrote discovery bare under the legacy generation.
-        return field === oauthV2Keys.field.discovery && epoch === null && discoveryIssuer(parsed)
-            ? { value: parsed }
-            : undefined;
-    };
-    const [client, tokens, discovery] = await Promise.all([
-        read(oauthV2Keys.field.client),
-        read(oauthV2Keys.field.tokens),
-        read(oauthV2Keys.field.discovery),
-    ]);
-    const named = discovery ? discoveryIssuer(discovery.value) : undefined;
-    const credentials = [client, tokens].filter((value) => value !== undefined);
-    const issuer = credentials[0]?.issuer ?? named;
-    const consistent = credentials.every((value) => value.issuer !== undefined && value.issuer === issuer && plainObject(value.value)) &&
-        (named === undefined || named === issuer);
-    if (!consistent || issuer === undefined)
-        return { disconnected: false, body: {} };
-    return {
-        disconnected: false,
-        body: {
-            issuer,
-            ...(client
-                ? {
-                    client: {
-                        value: client.value,
-                        ...(client.binding !== undefined ? { binding: client.binding } : {}),
-                        ...(client.carried ? { carried: true } : {}),
-                    },
+        const epoch = generation === "legacy" ? null : generation;
+        const read = authMethod((field) => {
+            return authFlow(function* () {
+                const physicalKey = oauthV2Keys.value(field, epoch);
+                const raw = (yield authStorage(storage, "get", [physicalKey]));
+                if (raw === null)
+                    return undefined;
+                let parsed = parse(raw);
+                if (plainObject(parsed) && parsed.connectaOAuthSealed === 1 && typeof parsed.sealed === "string") {
+                    if (!sealer)
+                        return undefined;
+                    try {
+                        parsed = parse((yield authInvoke(sealer, "open", [physicalKey, parsed.sealed])));
+                    }
+                    catch {
+                        return undefined;
+                    }
                 }
-                : {}),
-            ...(tokens ? { tokens: tokens.value } : {}),
-            ...(discovery && named !== undefined ? { discovery: discovery.value } : {}),
-        },
-    };
-}
+                if (plainObject(parsed) &&
+                    parsed.connectaOAuthVersion === 2 &&
+                    parsed.generation === generation &&
+                    (parsed.issuer === undefined || typeof parsed.issuer === "string") &&
+                    (parsed.binding === undefined || typeof parsed.binding === "string")) {
+                    return {
+                        value: parsed.value,
+                        ...(parsed.issuer !== undefined ? { issuer: parsed.issuer } : {}),
+                        ...(parsed.binding !== undefined ? { binding: parsed.binding } : {}),
+                        ...(parsed.carried === true ? { carried: true } : {}),
+                    };
+                }
+                // Layout 2 wrote discovery bare under the legacy generation.
+                return field === oauthV2Keys.field.discovery && epoch === null && discoveryIssuer(parsed)
+                    ? { value: parsed }
+                    : undefined;
+            });
+        });
+        const [client, tokens, discovery] = (yield authAll([
+            authCall(read, [oauthV2Keys.field.client]),
+            authCall(read, [oauthV2Keys.field.tokens]),
+            authCall(read, [oauthV2Keys.field.discovery]),
+        ], false));
+        const named = discovery ? discoveryIssuer(discovery.value) : undefined;
+        const credentials = [client, tokens].filter((value) => value !== undefined);
+        const issuer = credentials[0]?.issuer ?? named;
+        const consistent = credentials.every((value) => value.issuer !== undefined && value.issuer === issuer && plainObject(value.value)) &&
+            (named === undefined || named === issuer);
+        if (!consistent || issuer === undefined)
+            return { disconnected: false, body: {} };
+        return {
+            disconnected: false,
+            body: {
+                issuer,
+                ...(client
+                    ? {
+                        client: {
+                            value: client.value,
+                            ...(client.binding !== undefined ? { binding: client.binding } : {}),
+                            ...(client.carried ? { carried: true } : {}),
+                        },
+                    }
+                    : {}),
+                ...(tokens ? { tokens: tokens.value } : {}),
+                ...(discovery && named !== undefined ? { discovery: discovery.value } : {}),
+            },
+        };
+    });
+});
 /** Only historical families are removed, never grants, flows, or leases. */
-async function listV2Keys(storage) {
-    return (await storage.list(oauthV2Keys.scan)).filter((key) => oauthV2Keys.family.prefixes.some((prefix) => key.startsWith(prefix)));
+function listV2Keys(storage) {
+    return runEdge(authProgram(listV2KeysNative, [storage]));
 }
+const listV2KeysNative = /* @__PURE__ */ registerAuth(listV2Keys, function (storage) {
+    return authFlow(function* () {
+        return (yield authStorage(storage, "list", [oauthV2Keys.scan])).filter((key) => oauthV2Keys.family.prefixes.some((prefix) => key.startsWith(prefix)));
+    });
+});
 /** Return true only when every historical key was deleted. */
-export async function deleteV2Keys(storage) {
-    const keys = await listV2Keys(storage);
-    const results = await Promise.allSettled(keys.map((key) => storage.delete(key)));
-    return results.every((result) => result.status === "fulfilled");
+export function deleteV2Keys(storage) {
+    return runEdge(authProgram(deleteV2KeysNative, [storage]));
 }
+const deleteV2KeysNative = /* @__PURE__ */ registerAuth(deleteV2Keys, function (storage) {
+    return authFlow(function* () {
+        const keys = (yield authCall(listV2Keys, [storage]));
+        const results = (yield authMap(keys, (key) => authStorage(storage, "delete", [key]), true));
+        return results.every((result) => result.status === "fulfilled");
+    });
+});

package/dist/auth/renewable-grant.js

@@ -0,0 +1,10 @@
+const grants = new WeakMap();
+/** The raw OAuth facade has no provider response ceiling; bound discarded 401 challenges independently. */
+export const OAUTH_CHALLENGE_MAX_BYTES = 1024 * 1024;
+export function bindRenewableGrant(facade, grant) {
+    grants.set(facade, grant);
+    return facade;
+}
+export function renewableGrantFor(facade) {
+    return grants.get(facade);
+}