aimeat 2.4.0 → 2.6.0

package/dist/src/services/connections/publish.js

@@ -0,0 +1,340 @@
+/**
+ * @file publish.ts
+ * @description The recipes that actually put something on a provider (TARGET-057 phase 7b). One
+ *   function per provider, behind one interface, driven by the gate in publish-gate.ts.
+ *
+ *   WHERE THIS LIVES, AND A DELIBERATE DEVIATION FROM THE SPEC. doc-t057-connect-spec puts recipes
+ *   in an extension so a provider's endpoints can change without a node deploy. That reason is
+ *   real and it still holds. It is not done yet, because the extension path needs two things that
+ *   do not exist — a `ctx.connection()` binding into the sandbox and a streaming upload that keeps
+ *   the bytes out of QuickJS — and building both before a single publish has ever succeeded would
+ *   be designing the seam before knowing its shape. The house rule applies: a primitive is
+ *   extracted when it has a second consumer, not before. `PublishRecipe` below is the seam, kept
+ *   deliberately narrow so the move is a relocation rather than a redesign.
+ *
+ *   PERMANENT AND TEMPORARY ARE DIFFERENT ANSWERS. A provider refusing the CONTENT is final and
+ *   must never be retried; a provider being unreachable is not. Collapsing the two is how a
+ *   rejected video gets resubmitted forever, and how an outage looks like a rejection.
+ * @structure PublishRecipe · publishToProvider · mastodonPublish · blueskyPost · youtubeUpload
+ * @usage import { publishToProvider } from './publish.js';
+ * @version-history
+ *   v1.0.0 — 2026-08-02 — TARGET-057 phase 7b. Mastodon video, Bluesky text, YouTube resumable.
+ */
+import { safeFetch } from '../../utils/url-validator.js';
+import { logger } from '../../utils/logger.js';
+/** Read a param the app or the delegation supplied, as a string. */
+function str(params, key, fallback = '') {
+    const v = params[key];
+    return typeof v === 'string' && v.length > 0 ? v : fallback;
+}
+/** A provider's own words, trimmed to something loggable and showable without dumping a page. */
+async function providerSaid(res) {
+    const body = await res.text().catch((err) => {
+        // An unreadable body and an empty one would otherwise produce the same message, and the first
+        // is a transport fault while the second is just a terse provider.
+        logger.warn('connections: could not read a provider error body', { status: res.status, error: String(err) });
+        return '';
+    });
+    return body.slice(0, 400).replace(/\s+/g, ' ').trim();
+}
+/**
+ * Mastodon: upload the media, WAIT for it to finish processing, then post the status.
+ *
+ * The wait is the part that looks optional and is not. `POST /api/v2/media` answers 202 while the
+ * server is still transcoding, and a status posted with that id lands with no video attached — a
+ * post that looks successful to everyone including us, and is empty to a reader.
+ */
+const mastodonPublish = async (input) => {
+    const base = input.connection.instance;
+    if (!base)
+        return { ok: false, permanent: true, reason: 'this Mastodon connection has no instance' };
+    if (!input.file)
+        return { ok: false, permanent: true, reason: 'Mastodon needs a file to attach' };
+    const auth = { Authorization: `Bearer ${input.credential.accessToken}` };
+    let mediaId;
+    try {
+        const form = new FormData();
+        form.append('file', new Blob([new Uint8Array(input.file.bytes)], { type: input.file.mimeType }), input.file.name);
+        const alt = str(input.params, 'alt');
+        if (alt)
+            form.append('description', alt);
+        const res = await safeFetch(`${base}/api/v2/media`, {
+            method: 'POST', headers: auth, body: form, signal: AbortSignal.timeout(300_000),
+        });
+        // 422 is "we will not take this file" — wrong codec, too long, too large. Final.
+        if (res.status === 422)
+            return { ok: false, permanent: true, reason: `the instance refused the file: ${await providerSaid(res)}` };
+        if (!res.ok)
+            return { ok: false, permanent: res.status === 401 || res.status === 403, reason: `media upload failed (HTTP ${res.status})` };
+        const j = await res.json();
+        mediaId = typeof j.id === 'string' ? j.id : '';
+        if (!mediaId)
+            return { ok: false, permanent: false, reason: 'the instance returned no media id' };
+        if (res.status === 202) {
+            // Still transcoding. GET answers 206 while it works and 200 when it is ready.
+            const deadline = Date.now() + 300_000;
+            for (;;) {
+                if (Date.now() > deadline) {
+                    return { ok: false, permanent: false, reason: 'the instance was still processing the video after five minutes' };
+                }
+                await new Promise((r) => setTimeout(r, 3000));
+                const poll = await safeFetch(`${base}/api/v1/media/${mediaId}`, { headers: auth, signal: AbortSignal.timeout(30_000) });
+                if (poll.status === 200)
+                    break;
+                if (poll.status !== 206) {
+                    return { ok: false, permanent: false, reason: `processing check failed (HTTP ${poll.status})` };
+                }
+            }
+        }
+    }
+    catch (err) {
+        return { ok: false, permanent: false, reason: `could not reach the instance: ${err.message}` };
+    }
+    try {
+        const body = new URLSearchParams({
+            status: input.caption,
+            // The delegation's fixed value wins; `unlisted` is the safer default for something posted by
+            // machinery rather than by a person sitting there.
+            visibility: str(input.params, 'visibility', 'unlisted'),
+        });
+        body.append('media_ids[]', mediaId);
+        const res = await safeFetch(`${base}/api/v1/statuses`, {
+            method: 'POST',
+            headers: { ...auth, 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: body.toString(),
+            signal: AbortSignal.timeout(60_000),
+        });
+        if (!res.ok) {
+            return { ok: false, permanent: res.status === 422 || res.status === 401, reason: `posting failed (HTTP ${res.status}): ${await providerSaid(res)}` };
+        }
+        const j = await res.json();
+        return { ok: true, externalRef: typeof j.url === 'string' ? j.url : String(j.id ?? mediaId) };
+    }
+    catch (err) {
+        // The MEDIA is uploaded at this point and the status is not. Temporary, so a retry re-posts —
+        // and the idempotency key is what stops that retry becoming a second post.
+        return { ok: false, permanent: false, reason: `could not post the status: ${err.message}` };
+    }
+};
+/**
+ * Bluesky: a text post.
+ *
+ * Text only, on purpose. Video on Bluesky goes through a separate video service with its own job
+ * queue and its own limits, and until that is built and proven, advertising `publish-video` here
+ * would be the same "a button that cannot work" mistake the attach route was just fixed for. The
+ * provider's capability list says publish-post alone for exactly that reason.
+ */
+const blueskyPost = async (input) => {
+    const pds = input.credential.extra?.pds ?? 'https://bsky.social';
+    const did = input.credential.extra?.did ?? '';
+    if (!did)
+        return { ok: false, permanent: true, reason: 'this Bluesky connection has no account id' };
+    try {
+        const res = await safeFetch(`${pds}/xrpc/com.atproto.repo.createRecord`, {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${input.credential.accessToken}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                repo: did,
+                collection: 'app.bsky.feed.post',
+                record: {
+                    $type: 'app.bsky.feed.post',
+                    text: input.caption,
+                    createdAt: new Date().toISOString(),
+                },
+            }),
+            signal: AbortSignal.timeout(60_000),
+        });
+        if (!res.ok) {
+            return { ok: false, permanent: res.status === 400 || res.status === 401, reason: `Bluesky refused the post (HTTP ${res.status}): ${await providerSaid(res)}` };
+        }
+        const j = await res.json();
+        return { ok: true, externalRef: typeof j.uri === 'string' ? j.uri : '' };
+    }
+    catch (err) {
+        return { ok: false, permanent: false, reason: `could not reach Bluesky: ${err.message}` };
+    }
+};
+/** Chunk size for the resumable upload. A multiple of 256 KiB, which the protocol requires. */
+const RESUMABLE_CHUNK = 8 * 256 * 1024;
+/**
+ * YouTube: a resumable upload, in chunks, that resumes from where the SERVER says it stopped.
+ *
+ * The resume is the whole reason this protocol exists and the reason it is implemented properly
+ * rather than as one big PUT: on an interruption the client does not know how much arrived, so it
+ * asks. Guessing "start again from zero" wastes an upload out of a daily allowance of six, and
+ * guessing "continue from what I sent" corrupts the file.
+ */
+const youtubeUpload = async (input) => {
+    if (!input.file)
+        return { ok: false, permanent: true, reason: 'YouTube needs a file' };
+    const auth = { Authorization: `Bearer ${input.credential.accessToken}` };
+    const total = input.file.bytes.length;
+    let sessionUrl;
+    try {
+        const meta = {
+            snippet: {
+                title: str(input.params, 'title', input.caption.slice(0, 100) || 'Untitled'),
+                description: str(input.params, 'description', input.caption),
+                ...(Array.isArray(input.params.tags) ? { tags: input.params.tags } : {}),
+            },
+            status: {
+                // The delegation's fixed value wins. `unlisted` rather than `private`: a private video
+                // renders no thumbnail and its link 404s for everyone else, so it cannot be checked.
+                privacyStatus: str(input.params, 'privacyStatus', 'unlisted'),
+                selfDeclaredMadeForKids: false,
+            },
+        };
+        const res = await safeFetch('https://www.googleapis.com/upload/youtube/v3/videos?uploadType=resumable&part=snippet,status', {
+            method: 'POST',
+            headers: {
+                ...auth,
+                'Content-Type': 'application/json',
+                'X-Upload-Content-Length': String(total),
+                'X-Upload-Content-Type': input.file.mimeType,
+            },
+            body: JSON.stringify(meta),
+            signal: AbortSignal.timeout(60_000),
+        });
+        if (!res.ok) {
+            // 403 here is usually the quota: six uploads a day for the whole project, and it is spent.
+            const permanent = res.status === 400 || res.status === 401;
+            return { ok: false, permanent, reason: `YouTube would not start the upload (HTTP ${res.status}): ${await providerSaid(res)}` };
+        }
+        sessionUrl = res.headers.get('location') ?? '';
+        if (!sessionUrl)
+            return { ok: false, permanent: false, reason: 'YouTube returned no upload session' };
+    }
+    catch (err) {
+        return { ok: false, permanent: false, reason: `could not reach YouTube: ${err.message}` };
+    }
+    let offset = 0;
+    let consecutiveFailures = 0;
+    while (offset < total) {
+        const end = Math.min(offset + RESUMABLE_CHUNK, total) - 1;
+        try {
+            const res = await safeFetch(sessionUrl, {
+                method: 'PUT',
+                headers: {
+                    'Content-Length': String(end - offset + 1),
+                    'Content-Range': `bytes ${offset}-${end}/${total}`,
+                },
+                body: new Uint8Array(input.file.bytes.subarray(offset, end + 1)),
+                signal: AbortSignal.timeout(300_000),
+            });
+            if (res.status === 200 || res.status === 201) {
+                const j = await res.json().catch((err) => {
+                    logger.warn('connections: YouTube upload finished with an unreadable body', { error: String(err) });
+                    return null;
+                });
+                const id = typeof j?.id === 'string' ? j.id : '';
+                return id
+                    ? { ok: true, externalRef: `https://youtu.be/${id}` }
+                    : { ok: false, permanent: false, reason: 'YouTube accepted the upload but named no video' };
+            }
+            // 308 = keep going. The Range header is the SERVER's account of what arrived, and it is the
+            // only trustworthy one — a client that assumes its own bytes landed will corrupt the file.
+            if (res.status === 308) {
+                const range = res.headers.get('range');
+                const received = range ? Number(range.split('-')[1]) : NaN;
+                offset = Number.isFinite(received) ? received + 1 : end + 1;
+                consecutiveFailures = 0;
+                continue;
+            }
+            if (res.status === 404)
+                return { ok: false, permanent: true, reason: 'the upload session expired; start again' };
+            if (res.status >= 400 && res.status < 500) {
+                return { ok: false, permanent: true, reason: `YouTube rejected the upload (HTTP ${res.status}): ${await providerSaid(res)}` };
+            }
+            // 5xx: ask the server where it got to rather than resending blindly.
+            consecutiveFailures++;
+        }
+        catch (err) {
+            consecutiveFailures++;
+            logger.warn('connections: a resumable chunk failed; asking YouTube where it got to', {
+                offset, total, error: String(err),
+            });
+        }
+        if (consecutiveFailures > 5) {
+            return { ok: false, permanent: false, reason: 'the upload kept failing; the bytes already sent are still held by YouTube' };
+        }
+        // THE RESUME QUERY. An empty PUT with a range of `*` makes the server state how much it has,
+        // which is the question a client cannot answer for itself after an interruption.
+        try {
+            await new Promise((r) => setTimeout(r, 1000 * consecutiveFailures));
+            const probe = await safeFetch(sessionUrl, {
+                method: 'PUT',
+                headers: { 'Content-Length': '0', 'Content-Range': `bytes */${total}` },
+                signal: AbortSignal.timeout(60_000),
+            });
+            if (probe.status === 200 || probe.status === 201) {
+                const j = await probe.json().catch((err) => {
+                    logger.warn('connections: the resume probe answered 200 with an unreadable body', { error: String(err) });
+                    return null;
+                });
+                const id = typeof j?.id === 'string' ? j.id : '';
+                if (id)
+                    return { ok: true, externalRef: `https://youtu.be/${id}` };
+            }
+            if (probe.status === 308) {
+                const range = probe.headers.get('range');
+                const received = range ? Number(range.split('-')[1]) : NaN;
+                offset = Number.isFinite(received) ? received + 1 : offset;
+            }
+        }
+        catch (err) {
+            logger.warn('connections: the resume probe itself failed', { error: String(err) });
+        }
+    }
+    return { ok: false, permanent: false, reason: 'the upload ended without YouTube confirming a video' };
+};
+/**
+ * The test provider's recipe. Reached only when the test provider is configured, which nothing but
+ * the E2E environment does. It exists so the ROUTE -- gate, credential, recipe, outcome, attempt
+ * update -- can be proven end to end without posting to anyone's real account, and so the
+ * permanent-versus-temporary distinction has a test rather than only a comment.
+ */
+const fakePublish = async (input) => {
+    const base = input.provider.endpoints(null)?.token.replace(/\/token$/, '') ?? '';
+    if (!base)
+        return { ok: false, permanent: true, reason: 'the test provider has no base URL' };
+    try {
+        const res = await safeFetch(`${base}/publish`, {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${input.credential.accessToken}`, 'Content-Type': 'application/octet-stream' },
+            body: input.file ? new Uint8Array(input.file.bytes) : new Uint8Array(0),
+            signal: AbortSignal.timeout(60_000),
+        });
+        // 422 is the provider refusing the CONTENT: final, and a retry would only repeat it.
+        if (res.status === 422)
+            return { ok: false, permanent: true, reason: `refused: ${await providerSaid(res)}` };
+        if (!res.ok)
+            return { ok: false, permanent: false, reason: `publish failed (HTTP ${res.status})` };
+        const j = await res.json();
+        return { ok: true, externalRef: typeof j.url === 'string' ? j.url : '' };
+    }
+    catch (err) {
+        return { ok: false, permanent: false, reason: `could not reach the test provider: ${err.message}` };
+    }
+};
+const RECIPES = {
+    mastodon: mastodonPublish,
+    bluesky: blueskyPost,
+    youtube: youtubeUpload,
+    fake: fakePublish,
+    'fake-static': fakePublish,
+};
+/**
+ * Run the recipe for a connection's provider.
+ *
+ * A provider with no recipe is a refusal rather than a silent no-op: the gate has already recorded
+ * an attempt by the time this is called, and leaving it in flight forever would be worse than
+ * saying so.
+ */
+export async function publishToProvider(input) {
+    const recipe = RECIPES[input.provider.id];
+    if (!recipe) {
+        return { ok: false, permanent: true, reason: `no publish recipe for ${input.connection.provider}` };
+    }
+    return recipe(input);
+}
+//# sourceMappingURL=publish.js.map

package/dist/src/services/connections/publish.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish.js","sourceRoot":"","sources":["../../../../src/services/connections/publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AA6B/C,oEAAoE;AACpE,SAAS,GAAG,CAAC,MAA+B,EAAE,GAAW,EAAE,QAAQ,GAAG,EAAE;IACtE,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC9D,CAAC;AAED,iGAAiG;AACjG,KAAK,UAAU,YAAY,CAAC,GAAa;IACvC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QACnD,8FAA8F;QAC9F,kEAAkE;QAClE,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7G,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACxD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,eAAe,GAAkB,KAAK,EAAE,KAAK,EAAE,EAAE;IACrD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;IACvC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;IACrG,IAAI,CAAC,KAAK,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;IAClG,MAAM,IAAI,GAAG,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;IAEzE,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClH,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACrC,IAAI,GAAG;YAAE,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,eAAe,EAAE;YAClD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;SAChF,CAAC,CAAC;QACH,iFAAiF;QACjF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,kCAAkC,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACnI,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,6BAA6B,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;QAC3I,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,EAAsB,CAAC;QAC/C,OAAO,GAAG,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;QAElG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,8EAA8E;YAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;YACtC,SAAS,CAAC;gBACR,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;oBAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,gEAAgE,EAAE,CAAC;gBACnH,CAAC;gBACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC9C,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,iBAAiB,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxH,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;oBAAE,MAAM;gBAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;gBAClG,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAkC,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IAC5G,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,MAAM,EAAE,KAAK,CAAC,OAAO;YACrB,6FAA6F;YAC7F,mDAAmD;YACnD,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC;SACxD,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,kBAAkB,EAAE;YACrD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,mCAAmC,EAAE;YACzE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,wBAAwB,GAAG,CAAC,MAAM,MAAM,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACvJ,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,EAAqC,CAAC;QAC9D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,EAAE,CAAC;IAChG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,8FAA8F;QAC9F,2EAA2E;QAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA+B,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IACzG,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,WAAW,GAAkB,KAAK,EAAE,KAAK,EAAE,EAAE;IACjD,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,IAAI,qBAAqB,CAAC;IACjE,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC;IAC9C,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;IACrG,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,GAAG,qCAAqC,EAAE;YACvE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACxG,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI,EAAE,GAAG;gBACT,UAAU,EAAE,oBAAoB;gBAChC,MAAM,EAAE;oBACN,KAAK,EAAE,oBAAoB;oBAC3B,IAAI,EAAE,KAAK,CAAC,OAAO;oBACnB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC;aACF,CAAC;YACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,kCAAkC,GAAG,CAAC,MAAM,MAAM,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACjK,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,EAAuB,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC3E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA6B,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IACvG,CAAC;AACH,CAAC,CAAC;AAEF,+FAA+F;AAC/F,MAAM,eAAe,GAAG,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,aAAa,GAAkB,KAAK,EAAE,KAAK,EAAE,EAAE;IACnD,IAAI,CAAC,KAAK,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACvF,MAAM,IAAI,GAAG,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;IACzE,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;IAEtC,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG;YACX,OAAO,EAAE;gBACP,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,UAAU,CAAC;gBAC5E,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC;gBAC5D,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzE;YACD,MAAM,EAAE;gBACN,uFAAuF;gBACvF,qFAAqF;gBACrF,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,eAAe,EAAE,UAAU,CAAC;gBAC7D,uBAAuB,EAAE,KAAK;aAC/B;SACF,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,SAAS,CACzB,8FAA8F,EAC9F;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,GAAG,IAAI;gBACP,cAAc,EAAE,kBAAkB;gBAClC,yBAAyB,EAAE,MAAM,CAAC,KAAK,CAAC;gBACxC,uBAAuB,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;aAC7C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CACF,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,2FAA2F;YAC3F,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;YAC3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,4CAA4C,GAAG,CAAC,MAAM,MAAM,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACjI,CAAC;QACD,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;IACxG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA6B,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IACvG,CAAC;IAED,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAC5B,OAAO,MAAM,GAAG,KAAK,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,eAAe,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE;gBACtC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE;oBACP,gBAAgB,EAAE,MAAM,CAAC,GAAG,GAAG,MAAM,GAAG,CAAC,CAAC;oBAC1C,eAAe,EAAE,SAAS,MAAM,IAAI,GAAG,IAAI,KAAK,EAAE;iBACnD;gBACD,IAAI,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;gBAChE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;aACrC,CAAC,CAAC;YAEH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7C,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;oBAChD,MAAM,CAAC,IAAI,CAAC,8DAA8D,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACpG,OAAO,IAAI,CAAC;gBACd,CAAC,CAA4B,CAAC;gBAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,OAAO,EAAE;oBACP,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,oBAAoB,EAAE,EAAE,EAAE;oBACrD,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,gDAAgD,EAAE,CAAC;YAChG,CAAC;YAED,4FAA4F;YAC5F,2FAA2F;YAC3F,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC3D,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;gBAC5D,mBAAmB,GAAG,CAAC,CAAC;gBACxB,SAAS;YACX,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;YACjH,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,qCAAqC,GAAG,CAAC,MAAM,MAAM,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YAChI,CAAC;YACD,qEAAqE;YACrE,mBAAmB,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mBAAmB,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,uEAAuE,EAAE;gBACnF,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;aAClC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,mBAAmB,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,2EAA2E,EAAE,CAAC;QAC9H,CAAC;QACD,6FAA6F;QAC7F,iFAAiF;QACjF,IAAI,CAAC;YACH,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC;YACpE,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE;gBACxC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,gBAAgB,EAAE,GAAG,EAAE,eAAe,EAAE,WAAW,KAAK,EAAE,EAAE;gBACvE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;YACH,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACjD,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;oBAClD,MAAM,CAAC,IAAI,CAAC,oEAAoE,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAC1G,OAAO,IAAI,CAAC;gBACd,CAAC,CAA4B,CAAC;gBAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,IAAI,EAAE;oBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,oBAAoB,EAAE,EAAE,EAAE,CAAC;YACrE,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC3D,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAC7D,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,qDAAqD,EAAE,CAAC;AACxG,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,GAAkB,KAAK,EAAE,KAAK,EAAE,EAAE;IACjD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IACjF,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;IAC9F,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,UAAU,EAAE;YAC7C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;YAChH,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC;YACvE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QACH,qFAAqF;QACrF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QAC7G,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;QACnG,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,EAAuB,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC3E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAuC,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IACjH,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,OAAO,GAAkC;IAC7C,QAAQ,EAAE,eAAe;IACzB,OAAO,EAAE,WAAW;IACpB,OAAO,EAAE,aAAa;IACtB,IAAI,EAAE,WAAW;IACjB,aAAa,EAAE,WAAW;CAC3B,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAmB;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,yBAAyB,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC;IACtG,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC"}

package/dist/src/services/connections/refresh.d.ts

@@ -0,0 +1,55 @@
+/**
+ * @file refresh.ts
+ * @description Keeping a connection's credential usable, and taking it away (TARGET-057).
+ *
+ *   SINGLE FLIGHT, AND WHY. Several providers invalidate the old refresh token as part of issuing a
+ *   new one. Two concurrent publishes on one connection therefore refresh twice, and the second
+ *   exchange presents a token the provider has already retired: one publish works, the other parks
+ *   the connection in `needs_reauth`, and the owner is told to reconnect an account that was never
+ *   broken. The claim in the store makes exactly one caller refresh; the others wait and re-read.
+ *
+ *   REFRESH BEFORE EXPIRY, NOT AFTER. A token that expires mid-upload fails a request that has
+ *   already moved bytes. The skew below is what turns "it expired" into "it was replaced".
+ *
+ *   REVOKING MEANS REVOKING. Deleting our row while the provider still honours the token is not a
+ *   revocation, it is forgetting. The provider is told first, wherever it offers a way to be told.
+ * @structure ensureFreshCredential · revokeConnection
+ * @usage import { ensureFreshCredential } from './refresh.js';
+ * @version-history
+ *   v1.0.0 — 2026-08-02 — TARGET-057 Phase 1c.
+ */
+import type { ConnectContext } from './oauth.js';
+import type { ConnectionCredential, ConnectionRecord } from '../../models/connection-schemas.js';
+export type FreshResult = {
+    ok: true;
+    credential: ConnectionCredential;
+    connection: ConnectionRecord;
+} | {
+    ok: false;
+    code: string;
+    reason: string;
+};
+/**
+ * A credential that will still be valid when it is used.
+ *
+ * Returns a failure rather than throwing for every expected outcome — a dead refresh token, a
+ * missing key, a provider that is gone — because every caller has to show the owner something, and
+ * an exception at this depth surfaces as a 500 in whatever background job touched it first.
+ */
+export declare function ensureFreshCredential(ctx: ConnectContext, connectionId: string): Promise<FreshResult>;
+/**
+ * Revoke: tell the provider first where it offers a way to be told, then drop the credential.
+ *
+ * The provider call is best-effort and its failure does NOT stop the local removal. An owner who
+ * asked to disconnect an account must end up disconnected even when the provider is down; the
+ * alternative is a button that sometimes silently does nothing.
+ */
+export declare function revokeConnection(ctx: ConnectContext, connectionId: string): Promise<{
+    ok: true;
+    toldProvider: boolean;
+} | {
+    ok: false;
+    code: string;
+    reason: string;
+}>;
+//# sourceMappingURL=refresh.d.ts.map

package/dist/src/services/connections/refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../../src/services/connections/refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAOH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAYjG,MAAM,MAAM,WAAW,GACnB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,oBAAoB,CAAC;IAAC,UAAU,EAAE,gBAAgB,CAAA;CAAE,GAC5E;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAWhD;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,GACxC,OAAO,CAAC,WAAW,CAAC,CAiDtB;AAwKD;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,GACxC,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA4C5F"}