@zackbart/connecta 0.34.1 → 0.35.0

package/dist/auth/downstream-revocation.js

@@ -3,6 +3,7 @@ import { ConnectorCallError } from "../errors.js";
 import { fromSignal, runEdge } from "../runtime/run.js";
 import { classifyHost } from "../url-safety.js";
 import { authenticateRemoteClient, remoteClientAuthMethod, } from "./downstream-client-metadata.js";
+import { authCall, authFlow, authProgram, registerAuth } from "./native.js";
 import { discoveryIssuer } from "./oauth-v2-migration.js";
 /** Local removal succeeded; provider-side removal needs the operator's attention. */
 export class OAuthRevocationError extends ConnectorCallError {
@@ -12,95 +13,94 @@ export class OAuthRevocationError extends ConnectorCallError {
 }
 const REVOCATION_DEADLINE_MS = 20_000;
 /** Revoke only the issuer-bound snapshot removed by a successful reset CAS, once. */
-export async function revokeDownstreamGrant(body, send, configuredClient) {
-    const metadata = body.discovery?.authorizationServerMetadata;
-    const revocation = metadata;
-    const endpoint = revocation?.revocation_endpoint;
-    if (endpoint === undefined || !body.tokens)
-        return;
-    const deadline = new AbortController();
-    const timer = setTimeout(() => deadline.abort(), REVOCATION_DEADLINE_MS);
-    try {
-        if (typeof endpoint !== "string" ||
-            !body.issuer ||
-            discoveryIssuer(body.discovery) !== body.issuer ||
-            !body.client ||
-            (body.client.value.issuer !== undefined && body.client.value.issuer !== body.issuer))
-            throw new OAuthRevocationError();
-        const target = new URL(endpoint);
-        // An operator-trusted HTTP MCP origin does not authorize plaintext
-        // credential endpoints. Only the existing loopback development exception
-        // is eligible; the connector's destination guard still checks that scope.
-        if ((target.protocol !== "https:" &&
-            !(target.protocol === "http:" && classifyHost(target.hostname) === "loopback")) ||
-            target.username ||
-            target.password ||
-            target.hash)
-            throw new OAuthRevocationError();
-        const information = body.client.value;
-        const secret = configuredClient ? configuredClient.clientSecret : information.client_secret;
-        if (configuredClient &&
-            (body.issuer !== configuredClient.issuer || information.client_id !== configuredClient.clientId))
-            throw new OAuthRevocationError();
-        const advertisedMethods = revocation?.revocation_endpoint_auth_methods_supported;
-        if (advertisedMethods !== undefined &&
-            (!Array.isArray(advertisedMethods) || !advertisedMethods.every((method) => typeof method === "string")))
-            throw new OAuthRevocationError();
-        const methods = advertisedMethods;
-        const declared = configuredClient
-            ? remoteClientAuthMethod(configuredClient)
-            : "token_endpoint_auth_method" in information
-                ? information.token_endpoint_auth_method
-                : undefined;
-        const method = declared ??
-            (secret === undefined
-                ? "none"
-                : methods?.includes("client_secret_basic") || !methods
-                    ? "client_secret_basic"
-                    : "client_secret_post");
-        if ((method !== "none" && method !== "client_secret_basic" && method !== "client_secret_post") ||
-            (method === "none") !== (secret === undefined) ||
-            (methods && !methods.includes(method)))
-            throw new OAuthRevocationError();
-        const token = body.tokens.refresh_token ?? body.tokens.access_token;
-        if (typeof token !== "string" || !token)
-            throw new OAuthRevocationError();
-        const params = new URLSearchParams({
-            token,
-            token_type_hint: body.tokens.refresh_token ? "refresh_token" : "access_token",
-        });
-        const headers = new Headers({ "Content-Type": "application/x-www-form-urlencoded" });
-        authenticateRemoteClient({
-            issuer: body.issuer,
-            clientId: information.client_id,
-            ...(secret !== undefined ? { clientSecret: secret } : {}),
-            tokenEndpointAuthMethod: method,
-        }, headers, params);
-        await runEdge(Effect.raceAllFirst([
-            fromSignal(deadline.signal),
-            Effect.tryPromise({
-                try: async () => {
-                    const response = await send(target, {
-                        method: "POST",
-                        headers,
-                        body: params,
-                        redirect: "manual",
-                        signal: deadline.signal,
-                    });
+export function revokeDownstreamGrant(body, send, configuredClient) {
+    return runEdge(authProgram(revokeDownstreamGrantNative, [body, send, configuredClient]));
+}
+const revokeDownstreamGrantNative = /* @__PURE__ */ registerAuth(revokeDownstreamGrant, function (body, send, configuredClient) {
+    return authFlow(function* () {
+        const metadata = body.discovery?.authorizationServerMetadata;
+        const revocation = metadata;
+        const endpoint = revocation?.revocation_endpoint;
+        if (endpoint === undefined || !body.tokens)
+            return;
+        const deadline = new AbortController();
+        const timer = setTimeout(() => deadline.abort(), REVOCATION_DEADLINE_MS);
+        try {
+            if (typeof endpoint !== "string" ||
+                !body.issuer ||
+                discoveryIssuer(body.discovery) !== body.issuer ||
+                !body.client ||
+                (body.client.value.issuer !== undefined && body.client.value.issuer !== body.issuer))
+                throw new OAuthRevocationError();
+            const target = new URL(endpoint);
+            // An operator-trusted HTTP MCP origin does not authorize plaintext
+            // credential endpoints. Only the existing loopback development exception
+            // is eligible; the connector's destination guard still checks that scope.
+            if ((target.protocol !== "https:" &&
+                !(target.protocol === "http:" && classifyHost(target.hostname) === "loopback")) ||
+                target.username ||
+                target.password ||
+                target.hash)
+                throw new OAuthRevocationError();
+            const information = body.client.value;
+            const secret = configuredClient ? configuredClient.clientSecret : information.client_secret;
+            if (configuredClient &&
+                (body.issuer !== configuredClient.issuer || information.client_id !== configuredClient.clientId))
+                throw new OAuthRevocationError();
+            const advertisedMethods = revocation?.revocation_endpoint_auth_methods_supported;
+            if (advertisedMethods !== undefined &&
+                (!Array.isArray(advertisedMethods) || !advertisedMethods.every((method) => typeof method === "string")))
+                throw new OAuthRevocationError();
+            const methods = advertisedMethods;
+            const declared = configuredClient
+                ? remoteClientAuthMethod(configuredClient)
+                : "token_endpoint_auth_method" in information
+                    ? information.token_endpoint_auth_method
+                    : undefined;
+            const method = declared ??
+                (secret === undefined
+                    ? "none"
+                    : methods?.includes("client_secret_basic") || !methods
+                        ? "client_secret_basic"
+                        : "client_secret_post");
+            if ((method !== "none" && method !== "client_secret_basic" && method !== "client_secret_post") ||
+                (method === "none") !== (secret === undefined) ||
+                (methods && !methods.includes(method)))
+                throw new OAuthRevocationError();
+            const token = body.tokens.refresh_token ?? body.tokens.access_token;
+            if (typeof token !== "string" || !token)
+                throw new OAuthRevocationError();
+            const params = new URLSearchParams({
+                token,
+                token_type_hint: body.tokens.refresh_token ? "refresh_token" : "access_token",
+            });
+            const headers = new Headers({ "Content-Type": "application/x-www-form-urlencoded" });
+            authenticateRemoteClient({
+                issuer: body.issuer,
+                clientId: information.client_id,
+                ...(secret !== undefined ? { clientSecret: secret } : {}),
+                tokenEndpointAuthMethod: method,
+            }, headers, params);
+            (yield Effect.raceAllFirst([
+                fromSignal(deadline.signal),
+                authFlow(function* () {
+                    const response = (yield authCall(send, [
+                        target,
+                        { method: "POST", headers, body: params, redirect: "manual", signal: deadline.signal },
+                    ]));
                     // RFC 7009's success is HTTP 200. Bodies and headers never explain a failure.
                     void response.body?.cancel().catch(() => { });
                     if (response.status !== 200)
                         throw new OAuthRevocationError();
-                },
-                catch: () => new OAuthRevocationError(),
-            }),
-        ]));
-    }
-    catch {
-        // No provider text, credential-bearing URL, original exception, or cause survives.
-        throw new OAuthRevocationError();
-    }
-    finally {
-        clearTimeout(timer);
-    }
-}
+                }),
+            ]));
+        }
+        catch {
+            // No provider text, credential-bearing URL, original exception, or cause survives.
+            throw new OAuthRevocationError();
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    });
+});

package/dist/auth/native-call.js

@@ -0,0 +1,20 @@
+// Request/call Context belongs only to downstream auth, outside metadata/UI.
+import { Effect } from "effect";
+import { viewServices, viewSignal } from "../runtime/call.js";
+import { RequestScope } from "../runtime/request-scope.js";
+import { fromSignal } from "../runtime/run.js";
+import { authCall } from "./native.js";
+export function authView(ctx, work, requestOwned = false) {
+    return RequestScope.use((owner) => {
+        const signal = viewSignal(ctx, requestOwned);
+        if (!owner.open || signal.aborted)
+            return Effect.fail(signal.reason);
+        // Settlement facts from all synchronous abort observers precede cleanup,
+        // as they did at the Promise boundary. This grants no live authority.
+        const abort = Effect.catch(fromSignal(signal), (error) => Effect.andThen(Effect.yieldNow, Effect.fail(error)));
+        return Effect.raceFirst(authCall(work, [signal]), abort).pipe(Effect.flatMap((value) => {
+            const current = viewSignal(ctx, requestOwned);
+            return current.aborted ? Effect.fail(current.reason) : Effect.succeed(value);
+        }));
+    }).pipe(Effect.provideContext(viewServices(ctx)));
+}

package/dist/auth/native.js

@@ -0,0 +1,184 @@
+// Private auth programs. Promise methods are SDK/custom edges; owned programs
+// compose directly by function identity, including inherited implementations.
+import { Cause, Context, Effect, Exit, Scheduler } from "effect";
+import { getNativeStorage } from "../runtime/native-storage.js";
+import { causeError, detach, fromSignal, runEdge } from "../runtime/run.js";
+const programs = new WeakMap();
+const methods = new WeakMap();
+export class AuthenticationWork extends Context.Service()("connecta/auth/Work") {
+}
+export function hasAuthProgram(edge) {
+    return programs.has(edge);
+}
+/** A bounded coordinator/submitted platform operation has its own settlement. */
+export function authDetached(effect, waitUntil) {
+    return Effect.flatMap(Effect.serviceOption(AuthenticationWork), (work) => Effect.callback((resume) => {
+        const settlement = detach(effect.pipe(Effect.onExit((exit) => Effect.sync(() => {
+            resume(Exit.isSuccess(exit) ? Effect.succeed(exit.value) : Effect.failCause(exit.cause));
+        }))));
+        if (work._tag === "Some")
+            work.value.track(settlement);
+        try {
+            waitUntil?.(settlement);
+        }
+        catch {
+            /* The bounded coordinator is already running. */
+        }
+    }));
+}
+export function registerAuth(edge, program) {
+    programs.set(edge, program);
+    return program;
+}
+export function authProgram(program, args) {
+    return Effect.suspend(() => program(...args)).pipe(Effect.catchDefect(Effect.fail));
+}
+export function registerAuthMethod(prototype, key, program, own) {
+    let entries = methods.get(prototype);
+    if (!entries)
+        methods.set(prototype, (entries = new Map()));
+    entries.set(key, program);
+    registerAuth(own, program);
+}
+export function authOwnMethod(prototype, receiver, key, args) {
+    return Effect.suspend(() => methods.get(prototype).get(key).apply(receiver, args)).pipe(Effect.catchDefect(Effect.fail));
+}
+function authOwn(edge, receiver, args) {
+    return Effect.suspend(() => programs.get(edge).apply(receiver, args)).pipe(Effect.catchDefect(Effect.fail));
+}
+export function authMethod(program) {
+    function edge(...args) {
+        return runEdge(authOwn(edge, this, args));
+    }
+    registerAuth(edge, program);
+    return edge;
+}
+export function authValue(work) {
+    return Effect.suspend(() => {
+        const value = work();
+        if (Effect.isEffect(value))
+            return value;
+        if (!value || typeof value.then !== "function")
+            return Effect.succeed(value);
+        const pending = Promise.resolve(value);
+        return Effect.flatMap(Effect.serviceOption(AuthenticationWork), (lifetime) => {
+            if (lifetime._tag === "Some")
+                lifetime.value.track(pending);
+            return awaitAuthPromise(pending);
+        });
+    }).pipe(Effect.catchDefect(Effect.fail));
+}
+// Keep the platform wait separate from the synchronous service lookup.
+// Accounting remains attached to the actual platform promise's settlement.
+function awaitAuthPromise(pending) {
+    return Effect.tryPromise({ try: () => pending, catch: (error) => error });
+}
+export function authCall(fn, args, receiver) {
+    return fn === undefined
+        ? Effect.succeed(undefined)
+        : Effect.suspend(() => programs.has(fn) ? authOwn(fn, receiver, args) : authValue(() => fn.apply(receiver, args)));
+}
+export function authInvoke(receiver, key, args) {
+    return Effect.suspend(() => {
+        const method = receiver[key];
+        return typeof method === "function"
+            ? authCall(method, args, receiver)
+            : authValue(() => Reflect.apply(method, receiver, args));
+    }).pipe(Effect.catchDefect(Effect.fail));
+}
+export function authStorage(storage, key, args, beforeSubmit) {
+    return Effect.suspend(() => {
+        const native = getNativeStorage(storage);
+        const operation = native
+            ? authValue(() => Reflect.get(native, key).apply(native, args))
+            : authInvoke(storage, key, args);
+        // Ownership transfer and native/custom storage submission are one JS
+        // reaction, including D2's lazy typed wrapper. Actual I/O can still wait.
+        const submitted = beforeSubmit ? authSubmission(operation, beforeSubmit) : operation;
+        if (!native)
+            return submitted;
+        return Effect.flatMap(Effect.serviceOption(AuthenticationWork), (work) => work._tag === "Some" ? authDetached(submitted) : submitted);
+    });
+}
+function authSubmission(operation, beforeSubmit) {
+    return Effect.flatMap(Scheduler.Scheduler, (parent) => {
+        let submitting = false;
+        const scheduler = {
+            executionMode: parent.executionMode,
+            shouldYield: (fiber) => !submitting && parent.shouldYield(fiber),
+            makeDispatcher: () => parent.makeDispatcher(),
+        };
+        return Effect.suspend(() => {
+            submitting = true;
+            // Resume ordinary scheduling before any pending I/O can continue. This
+            // gate covers only submission's current JS reaction, including throws.
+            queueMicrotask(() => {
+                submitting = false;
+            });
+            beforeSubmit();
+            return operation;
+        }).pipe(Effect.provideService(Scheduler.Scheduler, scheduler));
+    });
+}
+export function authThen(effect, success, failure) {
+    return Effect.matchEffect(effect, {
+        onSuccess: (value) => (success ? authCall(success, [value]) : Effect.succeed(value)),
+        onFailure: (error) => (failure ? authCall(failure, [error]) : Effect.fail(error)),
+    });
+}
+export function authCatch(effect, failure) {
+    return Effect.catch(effect, (error) => authCall(failure, [error]));
+}
+export function authAll(values, settled = false) {
+    return Effect.all(Array.from(values, (value) => {
+        const effect = authValue(() => value);
+        return settled
+            ? Effect.match(effect, {
+                onSuccess: (value) => ({ status: "fulfilled", value }),
+                onFailure: (reason) => ({ status: "rejected", reason }),
+            })
+            : effect;
+    }), { concurrency: "unbounded" });
+}
+export function authAwait(effect, signal) {
+    return signal ? Effect.raceFirst(effect, fromSignal(signal)) : effect;
+}
+/**
+ * Drive native auth control flow, delivering typed failures to its local
+ * catch clauses. Interruption remains interruption and closes the generator;
+ * its yielded finally blocks still run, including asynchronous body cleanup.
+ * Every yielded operation is an Effect, never an async orchestration thunk.
+ */
+export function authFlow(make) {
+    return Effect.suspend(() => {
+        const iterator = make();
+        let done = false;
+        const drive = (step) => Effect.gen(function* () {
+            while (!step.done) {
+                const result = yield* Effect.exit(step.value.pipe(Effect.catchDefect(Effect.fail)));
+                if (Exit.isSuccess(result))
+                    step = iterator.next(result.value);
+                else {
+                    if (result.cause.reasons.some(Cause.isInterruptReason))
+                        return yield* Effect.failCause(result.cause);
+                    step = iterator.throw(causeError(result.cause));
+                }
+            }
+            done = true;
+            return step.value;
+        }).pipe(Effect.catchDefect(Effect.fail));
+        return Effect.suspend(() => drive(iterator.next())).pipe(Effect.ensuring(Effect.suspend(() => done ? Effect.void : drive(iterator.return(undefined)).pipe(Effect.orDie, Effect.asVoid))));
+    });
+}
+/** Parallel native mapping without eagerly starting Promise shells. */
+export function authMap(values, program, settled = false) {
+    return authAll(values.map((value) => program(value)), settled);
+}
+/** The physical fetch leaf also owns cancellation of a late response body. */
+export function authFetch(input, init) {
+    return authValue(() => fetch(input, init).then((response) => {
+        if (init?.signal?.aborted)
+            void response.body?.cancel().catch(() => { });
+        return response;
+    }));
+}

package/dist/auth/oauth-start-reset.js

@@ -1,3 +1,5 @@
+import { runEdge } from "../runtime/run.js";
+import { authAll, authFlow, authProgram, registerAuth } from "./native.js";
 // The operator route must not answer while a storage reset it started can
 // still publish an older generation. Storage has no cancellation contract.
 const startResets = new WeakMap();
@@ -12,9 +14,13 @@ export function trackOAuthStartReset(scope, reset) {
     // unhandled rejection merely because its caller timed out first.
     void reset.then(() => pending.delete(reset), () => pending.delete(reset));
 }
-export async function drainOAuthStartResets(scope) {
-    const pending = startResets.get(scope);
-    while (pending && pending.size > 0) {
-        await Promise.allSettled(pending);
-    }
+export function drainOAuthStartResets(scope) {
+    return runEdge(authProgram(drainOAuthStartResetsNative, [scope]));
 }
+const drainOAuthStartResetsNative = /* @__PURE__ */ registerAuth(drainOAuthStartResets, function (scope) {
+    return authFlow(function* () {
+        const pending = startResets.get(scope);
+        while (pending && pending.size > 0)
+            yield authAll(pending, true);
+    });
+});