patchwork-os 0.2.0-alpha.9 → 0.2.0-beta.1

package/dist/connectors/notion.js

@@ -0,0 +1,424 @@
+/**
+ * Notion connector — read/write Notion databases and pages via the Notion API.
+ *
+ * Auth: API token (internal integration) or OAuth 2.0 (public integration).
+ *   - Env var: NOTION_TOKEN overrides stored token for CI/headless use.
+ *   - Stored: getSecretJsonSync("notion") → NotionTokens
+ *
+ * Tools: queryDatabase, getPage, search, createPage, appendBlock
+ *
+ * Extends BaseConnector for unified auth, retry, rate-limit, error handling.
+ */
+import { unlinkSync } from "node:fs";
+import { homedir } from "node:os";
+import path from "node:path";
+import { BaseConnector, } from "./baseConnector.js";
+import { getSecretJsonSync, storeSecretJsonSync } from "./tokenStorage.js";
+const NOTION_API = "https://api.notion.com/v1";
+const NOTION_VERSION = "2022-06-28";
+// ------------------------------------------------------------------ token helpers
+export function loadTokens() {
+    const envToken = process.env.NOTION_TOKEN;
+    if (envToken) {
+        return {
+            accessToken: envToken,
+            connected_at: new Date().toISOString(),
+        };
+    }
+    return getSecretJsonSync("notion");
+}
+export function saveTokens(tokens) {
+    storeSecretJsonSync("notion", tokens);
+}
+export function clearTokens() {
+    try {
+        const p = path.join(homedir(), ".patchwork", "tokens", "notion.json");
+        unlinkSync(p);
+    }
+    catch {
+        /* already gone */
+    }
+}
+// ------------------------------------------------------------------ connector
+export class NotionConnector extends BaseConnector {
+    providerName = "notion";
+    // Cached after authenticate(); re-read in getStatus() to stay fresh
+    cachedTokens = null;
+    getOAuthConfig() {
+        return null;
+    }
+    async authenticate() {
+        const tokens = loadTokens();
+        if (!tokens) {
+            throw new Error("Notion not connected. Run: patchwork connect notion  or set NOTION_TOKEN");
+        }
+        this.cachedTokens = tokens;
+        return { token: tokens.accessToken };
+    }
+    async healthCheck() {
+        try {
+            const result = await this.apiCall(async (token) => {
+                const res = await fetch(`${NOTION_API}/users/me`, {
+                    headers: this.buildHeaders(token),
+                });
+                if (!res.ok)
+                    throw new Error(`HTTP ${res.status}`);
+                return res.json();
+            });
+            if ("error" in result)
+                return { ok: false, error: result.error };
+            return { ok: true };
+        }
+        catch (err) {
+            return { ok: false, error: this.normalizeError(err) };
+        }
+    }
+    normalizeError(error) {
+        if (error instanceof Response ||
+            (error && typeof error === "object" && "status" in error)) {
+            const status = error.status;
+            if (status === 401)
+                return {
+                    code: "auth_expired",
+                    message: "Notion token expired or invalid",
+                    retryable: false,
+                    suggestedAction: "Reconnect: patchwork connect notion",
+                };
+            if (status === 403)
+                return {
+                    code: "permission_denied",
+                    message: "Notion integration lacks permission for this resource",
+                    retryable: false,
+                    suggestedAction: "Share the page/database with your integration",
+                };
+            if (status === 404)
+                return {
+                    code: "not_found",
+                    message: "Notion page or database not found",
+                    retryable: false,
+                };
+            if (status === 429)
+                return {
+                    code: "rate_limited",
+                    message: "Notion API rate limit exceeded",
+                    retryable: true,
+                    suggestedAction: "Wait and retry",
+                };
+            return {
+                code: "provider_error",
+                message: `Notion API error: HTTP ${status}`,
+                retryable: status >= 500,
+            };
+        }
+        if (error instanceof Error) {
+            if (error.message.includes("ENOTFOUND") ||
+                error.message.includes("ECONNREFUSED")) {
+                return {
+                    code: "network_error",
+                    message: `Cannot reach Notion API: ${error.message}`,
+                    retryable: true,
+                };
+            }
+        }
+        return {
+            code: "provider_error",
+            message: error instanceof Error ? error.message : String(error),
+            retryable: false,
+        };
+    }
+    getStatus() {
+        const tokens = loadTokens();
+        return {
+            id: "notion",
+            status: tokens ? "connected" : "disconnected",
+            lastSync: tokens?.connected_at,
+            workspace: tokens?.workspaceName,
+        };
+    }
+    buildHeaders(token) {
+        return {
+            Authorization: `Bearer ${token}`,
+            "Content-Type": "application/json",
+            "Notion-Version": NOTION_VERSION,
+        };
+    }
+    // ---------------------------------------------------------------- read ops
+    async queryDatabase(databaseId, filter, sorts, pageSize = 20) {
+        const result = await this.apiCall(async (token) => {
+            const body = {
+                page_size: Math.min(pageSize, 100),
+            };
+            if (filter)
+                body.filter = filter;
+            if (sorts)
+                body.sorts = sorts;
+            const res = await fetch(`${NOTION_API}/databases/${normalizeId(databaseId)}/query`, {
+                method: "POST",
+                headers: this.buildHeaders(token),
+                body: JSON.stringify(body),
+            });
+            if (!res.ok) {
+                const err = (await res.json().catch(() => ({})));
+                throw Object.assign(new Error(err.message ?? `HTTP ${res.status}`), {
+                    status: res.status,
+                });
+            }
+            return res.json();
+        });
+        if ("error" in result)
+            throw new Error(result.error.message);
+        return result.data;
+    }
+    async getPage(pageId) {
+        const result = await this.apiCall(async (token) => {
+            const res = await fetch(`${NOTION_API}/pages/${normalizeId(pageId)}`, {
+                headers: this.buildHeaders(token),
+            });
+            if (!res.ok) {
+                const err = (await res.json().catch(() => ({})));
+                throw Object.assign(new Error(err.message ?? `HTTP ${res.status}`), {
+                    status: res.status,
+                });
+            }
+            return res.json();
+        });
+        if ("error" in result)
+            throw new Error(result.error.message);
+        return result.data;
+    }
+    async search(query, filterType, pageSize = 10) {
+        const result = await this.apiCall(async (token) => {
+            const body = {
+                query,
+                page_size: Math.min(pageSize, 100),
+            };
+            if (filterType)
+                body.filter = { value: filterType, property: "object" };
+            const res = await fetch(`${NOTION_API}/search`, {
+                method: "POST",
+                headers: this.buildHeaders(token),
+                body: JSON.stringify(body),
+            });
+            if (!res.ok) {
+                const err = (await res.json().catch(() => ({})));
+                throw Object.assign(new Error(err.message ?? `HTTP ${res.status}`), {
+                    status: res.status,
+                });
+            }
+            return res.json();
+        });
+        if ("error" in result)
+            throw new Error(result.error.message);
+        return result.data;
+    }
+    // ---------------------------------------------------------------- write ops
+    async createPage(params) {
+        const result = await this.apiCall(async (token) => {
+            const parent = params.parentType === "database"
+                ? { database_id: normalizeId(params.parentId) }
+                : { page_id: normalizeId(params.parentId) };
+            const properties = params.properties ?? {};
+            // Set title property — key is "title" for pages, "Name" for database rows
+            const titleKey = params.parentType === "database" ? "Name" : "title";
+            properties[titleKey] = {
+                title: [{ text: { content: params.title } }],
+            };
+            const body = { parent, properties };
+            if (params.content) {
+                body.children = [
+                    {
+                        object: "block",
+                        type: "paragraph",
+                        paragraph: {
+                            rich_text: [{ type: "text", text: { content: params.content } }],
+                        },
+                    },
+                ];
+            }
+            const res = await fetch(`${NOTION_API}/pages`, {
+                method: "POST",
+                headers: this.buildHeaders(token),
+                body: JSON.stringify(body),
+            });
+            if (!res.ok) {
+                const err = (await res.json().catch(() => ({})));
+                throw Object.assign(new Error(err.message ?? `HTTP ${res.status}`), {
+                    status: res.status,
+                });
+            }
+            return res.json();
+        });
+        if ("error" in result)
+            throw new Error(result.error.message);
+        return result.data;
+    }
+    async appendBlock(params) {
+        const result = await this.apiCall(async (token) => {
+            const type = params.blockType ?? "paragraph";
+            const richText = [{ type: "text", text: { content: params.content } }];
+            const block = {
+                object: "block",
+                type,
+                [type]: { rich_text: richText },
+            };
+            const res = await fetch(`${NOTION_API}/blocks/${normalizeId(params.pageId)}/children`, {
+                method: "PATCH",
+                headers: this.buildHeaders(token),
+                body: JSON.stringify({ children: [block] }),
+            });
+            if (!res.ok) {
+                const err = (await res.json().catch(() => ({})));
+                throw Object.assign(new Error(err.message ?? `HTTP ${res.status}`), {
+                    status: res.status,
+                });
+            }
+            return res.json();
+        });
+        if ("error" in result)
+            throw new Error(result.error.message);
+        return result.data;
+    }
+}
+// ------------------------------------------------------------------ helpers
+/** Normalize Notion IDs — strip hyphens if present, add back in UUID format. */
+function normalizeId(id) {
+    const stripped = id.replace(/-/g, "");
+    if (stripped.length === 32) {
+        return `${stripped.slice(0, 8)}-${stripped.slice(8, 12)}-${stripped.slice(12, 16)}-${stripped.slice(16, 20)}-${stripped.slice(20)}`;
+    }
+    return id;
+}
+// ------------------------------------------------------------------ singleton
+let _instance = null;
+export function getNotionConnector() {
+    if (!_instance)
+        _instance = new NotionConnector();
+    return _instance;
+}
+export function resetNotionConnector() {
+    _instance = null;
+}
+// ------------------------------------------------------------------ convenience re-exports
+export { loadTokens as isConnected };
+/**
+ * POST /connections/notion/connect  { token: "secret_..." }
+ * Stores the integration token and verifies it by calling /users/me.
+ */
+export async function handleNotionConnect(body) {
+    let token;
+    try {
+        const parsed = JSON.parse(body);
+        if (typeof parsed.token !== "string" ||
+            !parsed.token.startsWith("secret_")) {
+            return {
+                status: 400,
+                contentType: "application/json",
+                body: JSON.stringify({
+                    ok: false,
+                    error: 'Notion integration token must start with "secret_". Find it at https://www.notion.so/my-integrations',
+                }),
+            };
+        }
+        token = parsed.token;
+    }
+    catch {
+        return {
+            status: 400,
+            contentType: "application/json",
+            body: JSON.stringify({ ok: false, error: "Invalid JSON body" }),
+        };
+    }
+    try {
+        const res = await fetch(`${NOTION_API}/users/me`, {
+            headers: {
+                Authorization: `Bearer ${token}`,
+                "Notion-Version": NOTION_VERSION,
+            },
+        });
+        if (!res.ok) {
+            return {
+                status: 401,
+                contentType: "application/json",
+                body: JSON.stringify({
+                    ok: false,
+                    error: "Token rejected by Notion API — check the token is valid and the integration is active",
+                }),
+            };
+        }
+        const user = (await res.json());
+        const tokens = {
+            accessToken: token,
+            workspaceName: user.bot?.workspace_name,
+            workspaceId: user.bot?.owner?.workspace_id,
+            connected_at: new Date().toISOString(),
+        };
+        saveTokens(tokens);
+        resetNotionConnector();
+        return {
+            status: 200,
+            contentType: "application/json",
+            body: JSON.stringify({
+                ok: true,
+                workspace: tokens.workspaceName ?? "unknown",
+                connectedAt: tokens.connected_at,
+            }),
+        };
+    }
+    catch (err) {
+        return {
+            status: 500,
+            contentType: "application/json",
+            body: JSON.stringify({
+                ok: false,
+                error: err instanceof Error ? err.message : String(err),
+            }),
+        };
+    }
+}
+/**
+ * POST /connections/notion/test
+ * Verifies stored token is still valid.
+ */
+export async function handleNotionTest() {
+    const tokens = loadTokens();
+    if (!tokens) {
+        return {
+            status: 400,
+            contentType: "application/json",
+            body: JSON.stringify({ ok: false, error: "Notion not connected" }),
+        };
+    }
+    try {
+        const connector = getNotionConnector();
+        const check = await connector.healthCheck();
+        return {
+            status: check.ok ? 200 : 401,
+            contentType: "application/json",
+            body: JSON.stringify(check.ok ? { ok: true } : { ok: false, error: check.error?.message }),
+        };
+    }
+    catch (err) {
+        return {
+            status: 500,
+            contentType: "application/json",
+            body: JSON.stringify({
+                ok: false,
+                error: err instanceof Error ? err.message : String(err),
+            }),
+        };
+    }
+}
+/**
+ * DELETE /connections/notion
+ * Removes stored token.
+ */
+export function handleNotionDisconnect() {
+    clearTokens();
+    resetNotionConnector();
+    return {
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({ ok: true }),
+    };
+}
+//# sourceMappingURL=notion.js.map

package/dist/connectors/notion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notion.js","sourceRoot":"","sources":["../../src/connectors/notion.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAEL,aAAa,GAGd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE3E,MAAM,UAAU,GAAG,2BAA2B,CAAC;AAC/C,MAAM,cAAc,GAAG,YAAY,CAAC;AA+FpC,mFAAmF;AAEnF,MAAM,UAAU,UAAU;IACxB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC1C,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,WAAW,EAAE,QAAQ;YACrB,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACvC,CAAC;IACJ,CAAC;IACD,OAAO,iBAAiB,CAAe,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAoB;IAC7C,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;QACtE,UAAU,CAAC,CAAC,CAAC,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;AACH,CAAC;AAED,+EAA+E;AAE/E,MAAM,OAAO,eAAgB,SAAQ,aAAa;IACvC,YAAY,GAAG,QAAQ,CAAC;IACjC,oEAAoE;IAC1D,YAAY,GAAwB,IAAI,CAAC;IAEzC,cAAc;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;gBAChD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,WAAW,EAAE;oBAChD,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;iBAClC,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBACnD,OAAO,GAAG,CAAC,IAAI,EAAyB,CAAC;YAC3C,CAAC,CAAC,CAAC;YACH,IAAI,OAAO,IAAI,MAAM;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;YACjE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IAED,cAAc,CAAC,KAAc;QAC3B,IACE,KAAK,YAAY,QAAQ;YACzB,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,QAAQ,IAAI,KAAK,CAAC,EACzD,CAAC;YACD,MAAM,MAAM,GAAI,KAA4B,CAAC,MAAM,CAAC;YACpD,IAAI,MAAM,KAAK,GAAG;gBAChB,OAAO;oBACL,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,iCAAiC;oBAC1C,SAAS,EAAE,KAAK;oBAChB,eAAe,EAAE,qCAAqC;iBACvD,CAAC;YACJ,IAAI,MAAM,KAAK,GAAG;gBAChB,OAAO;oBACL,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,uDAAuD;oBAChE,SAAS,EAAE,KAAK;oBAChB,eAAe,EAAE,+CAA+C;iBACjE,CAAC;YACJ,IAAI,MAAM,KAAK,GAAG;gBAChB,OAAO;oBACL,IAAI,EAAE,WAAW;oBACjB,OAAO,EAAE,mCAAmC;oBAC5C,SAAS,EAAE,KAAK;iBACjB,CAAC;YACJ,IAAI,MAAM,KAAK,GAAG;gBAChB,OAAO;oBACL,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,gCAAgC;oBACzC,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,gBAAgB;iBAClC,CAAC;YACJ,OAAO;gBACL,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,0BAA0B,MAAM,EAAE;gBAC3C,SAAS,EAAE,MAAM,IAAI,GAAG;aACzB,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,IACE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBACnC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EACtC,CAAC;gBACD,OAAO;oBACL,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,4BAA4B,KAAK,CAAC,OAAO,EAAE;oBACpD,SAAS,EAAE,IAAI;iBAChB,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC/D,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IAED,SAAS;QACP,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,OAAO;YACL,EAAE,EAAE,QAAQ;YACZ,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc;YAC7C,QAAQ,EAAE,MAAM,EAAE,YAAY;YAC9B,SAAS,EAAE,MAAM,EAAE,aAAa;SACjC,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,KAAa;QAChC,OAAO;YACL,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;YAClC,gBAAgB,EAAE,cAAc;SACjC,CAAC;IACJ,CAAC;IAED,4EAA4E;IAE5E,KAAK,CAAC,aAAa,CACjB,UAAkB,EAClB,MAAgC,EAChC,KAA0E,EAC1E,QAAQ,GAAG,EAAE;QAEb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAChD,MAAM,IAAI,GAA4B;gBACpC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC;aACnC,CAAC;YACF,IAAI,MAAM;gBAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YACjC,IAAI,KAAK;gBAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;YAC9B,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,UAAU,cAAc,WAAW,CAAC,UAAU,CAAC,QAAQ,EAC1D;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;gBACjC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aAC3B,CACF,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAE9C,CAAC;gBACF,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;oBAClE,MAAM,EAAE,GAAG,CAAC,MAAM;iBACnB,CAAC,CAAC;YACL,CAAC;YACD,OAAO,GAAG,CAAC,IAAI,EAAgC,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,IAAI,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAChD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,UAAU,WAAW,CAAC,MAAM,CAAC,EAAE,EAAE;gBACpE,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;aAClC,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAE9C,CAAC;gBACF,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;oBAClE,MAAM,EAAE,GAAG,CAAC,MAAM;iBACnB,CAAC,CAAC;YACL,CAAC;YACD,OAAO,GAAG,CAAC,IAAI,EAAyB,CAAC;QAC3C,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,IAAI,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,MAAM,CACV,KAAa,EACb,UAAgC,EAChC,QAAQ,GAAG,EAAE;QAEb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAChD,MAAM,IAAI,GAA4B;gBACpC,KAAK;gBACL,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC;aACnC,CAAC;YACF,IAAI,UAAU;gBAAE,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;YACxE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,SAAS,EAAE;gBAC9C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;gBACjC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aAC3B,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAE9C,CAAC;gBACF,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;oBAClE,MAAM,EAAE,GAAG,CAAC,MAAM;iBACnB,CAAC,CAAC;YACL,CAAC;YACD,OAAO,GAAG,CAAC,IAAI,EAAiC,CAAC;QACnD,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,IAAI,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,6EAA6E;IAE7E,KAAK,CAAC,UAAU,CAAC,MAAwB;QACvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAChD,MAAM,MAAM,GACV,MAAM,CAAC,UAAU,KAAK,UAAU;gBAC9B,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;gBAC/C,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAEhD,MAAM,UAAU,GAA4B,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;YACpE,0EAA0E;YAC1E,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YACrE,UAAU,CAAC,QAAQ,CAAC,GAAG;gBACrB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;aAC7C,CAAC;YAEF,MAAM,IAAI,GAA4B,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;YAC7D,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,IAAI,CAAC,QAAQ,GAAG;oBACd;wBACE,MAAM,EAAE,OAAO;wBACf,IAAI,EAAE,WAAW;wBACjB,SAAS,EAAE;4BACT,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;yBACjE;qBACF;iBACF,CAAC;YACJ,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,QAAQ,EAAE;gBAC7C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;gBACjC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aAC3B,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAE9C,CAAC;gBACF,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;oBAClE,MAAM,EAAE,GAAG,CAAC,MAAM;iBACnB,CAAC,CAAC;YACL,CAAC;YACD,OAAO,GAAG,CAAC,IAAI,EAAyB,CAAC;QAC3C,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,IAAI,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,WAAW,CACf,MAAyB;QAEzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAChD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,IAAI,WAAW,CAAC;YAC7C,MAAM,QAAQ,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACvE,MAAM,KAAK,GAA4B;gBACrC,MAAM,EAAE,OAAO;gBACf,IAAI;gBACJ,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE;aAChC,CAAC;YAEF,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,UAAU,WAAW,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAC7D;gBACE,MAAM,EAAE,OAAO;gBACf,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;gBACjC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;aAC5C,CACF,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAE9C,CAAC;gBACF,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;oBAClE,MAAM,EAAE,GAAG,CAAC,MAAM;iBACnB,CAAC,CAAC;YACL,CAAC;YACD,OAAO,GAAG,CAAC,IAAI,EAAyC,CAAC;QAC3D,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,IAAI,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;CACF;AAED,6EAA6E;AAE7E,gFAAgF;AAChF,SAAS,WAAW,CAAC,EAAU;IAC7B,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACtC,IAAI,QAAQ,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC3B,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;IACtI,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,+EAA+E;AAE/E,IAAI,SAAS,GAA2B,IAAI,CAAC;AAE7C,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC,SAAS;QAAE,SAAS,GAAG,IAAI,eAAe,EAAE,CAAC;IAClD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,SAAS,GAAG,IAAI,CAAC;AACnB,CAAC;AAED,4FAA4F;AAE5F,OAAO,EAAE,UAAU,IAAI,WAAW,EAAE,CAAC;AAWrC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY;IAEZ,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwB,CAAC;QACvD,IACE,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAChC,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EACnC,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,kBAAkB;gBAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,EAAE,EAAE,KAAK;oBACT,KAAK,EACH,sGAAsG;iBACzG,CAAC;aACH,CAAC;QACJ,CAAC;QACD,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,kBAAkB;YAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,WAAW,EAAE;YAChD,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,gBAAgB,EAAE,cAAc;aACjC;SACF,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,kBAAkB;gBAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,EAAE,EAAE,KAAK;oBACT,KAAK,EACH,uFAAuF;iBAC1F,CAAC;aACH,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG7B,CAAC;QACF,MAAM,MAAM,GAAiB;YAC3B,WAAW,EAAE,KAAK;YAClB,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,cAAc;YACvC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY;YAC1C,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACvC,CAAC;QACF,UAAU,CAAC,MAAM,CAAC,CAAC;QACnB,oBAAoB,EAAE,CAAC;QACvB,OAAO;YACL,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,kBAAkB;YAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,EAAE,EAAE,IAAI;gBACR,SAAS,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;gBAC5C,WAAW,EAAE,MAAM,CAAC,YAAY;aACjC,CAAC;SACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,kBAAkB;YAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC;SACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,kBAAkB;YAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;SACnE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,kBAAkB,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,WAAW,EAAE,CAAC;QAC5C,OAAO;YACL,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;YAC5B,WAAW,EAAE,kBAAkB;YAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,CACrE;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,kBAAkB;YAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC;SACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB;IACpC,WAAW,EAAE,CAAC;IACd,oBAAoB,EAAE,CAAC;IACvB,OAAO;QACL,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,kBAAkB;QAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;KACnC,CAAC;AACJ,CAAC"}

package/dist/connectors/oauthStateStore.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Shared OAuth `state` parameter store for connector authorize→callback flows.
+ *
+ * Each connector previously kept its own module-scope `Set<string>` keyed by
+ * a `setTimeout` cleanup. That works correctness-wise but is unbounded — a
+ * loop of `/authorize` calls (10k requests in 10 min) would accumulate 10k
+ * states + 10k pending timers, ~640 KB of heap that disappears 10 min later.
+ * On a busy multi-tenant relay this becomes a memory amplification vector
+ * any unauthenticated caller can drive.
+ *
+ * Defenses:
+ *   - Hard cap (default 1000 entries) — when full, new `add()` calls return
+ *     false and the caller surfaces an HTTP 429 / generic error.
+ *   - TTL eviction at access time (consume() or add()) — no per-state timer,
+ *     so 10k states cost 10k Map slots + 10k longs, nothing more.
+ *   - `consume()` is single-use; second call with the same state returns false.
+ */
+export interface OAuthStateStore {
+    /** Returns false if the cap is hit. */
+    add(state: string): boolean;
+    /** Consume on callback. Returns true if the state was valid and unconsumed. */
+    consume(state: string): boolean;
+    /** For tests. */
+    size(): number;
+}
+interface Options {
+    ttlMs?: number;
+    maxEntries?: number;
+}
+export declare function createOAuthStateStore(opts?: Options): OAuthStateStore;
+export {};

package/dist/connectors/oauthStateStore.js

@@ -0,0 +1,52 @@
+/**
+ * Shared OAuth `state` parameter store for connector authorize→callback flows.
+ *
+ * Each connector previously kept its own module-scope `Set<string>` keyed by
+ * a `setTimeout` cleanup. That works correctness-wise but is unbounded — a
+ * loop of `/authorize` calls (10k requests in 10 min) would accumulate 10k
+ * states + 10k pending timers, ~640 KB of heap that disappears 10 min later.
+ * On a busy multi-tenant relay this becomes a memory amplification vector
+ * any unauthenticated caller can drive.
+ *
+ * Defenses:
+ *   - Hard cap (default 1000 entries) — when full, new `add()` calls return
+ *     false and the caller surfaces an HTTP 429 / generic error.
+ *   - TTL eviction at access time (consume() or add()) — no per-state timer,
+ *     so 10k states cost 10k Map slots + 10k longs, nothing more.
+ *   - `consume()` is single-use; second call with the same state returns false.
+ */
+const DEFAULT_TTL_MS = 10 * 60_000;
+const DEFAULT_MAX_ENTRIES = 1000;
+export function createOAuthStateStore(opts = {}) {
+    const ttlMs = opts.ttlMs ?? DEFAULT_TTL_MS;
+    const maxEntries = opts.maxEntries ?? DEFAULT_MAX_ENTRIES;
+    const states = new Map(); // state → expiresAt ms
+    function pruneExpired(now) {
+        for (const [s, expiry] of states) {
+            if (expiry < now)
+                states.delete(s);
+        }
+    }
+    return {
+        add(state) {
+            const now = Date.now();
+            pruneExpired(now);
+            if (states.size >= maxEntries)
+                return false;
+            states.set(state, now + ttlMs);
+            return true;
+        },
+        consume(state) {
+            const now = Date.now();
+            const expiry = states.get(state);
+            if (expiry === undefined)
+                return false;
+            states.delete(state);
+            return expiry >= now;
+        },
+        size() {
+            return states.size;
+        },
+    };
+}
+//# sourceMappingURL=oauthStateStore.js.map

package/dist/connectors/oauthStateStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthStateStore.js","sourceRoot":"","sources":["../../src/connectors/oauthStateStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAgBH,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,CAAC;AACnC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC,MAAM,UAAU,qBAAqB,CAAC,OAAgB,EAAE;IACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,uBAAuB;IAEjE,SAAS,YAAY,CAAC,GAAW;QAC/B,KAAK,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACjC,IAAI,MAAM,GAAG,GAAG;gBAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG,CAAC,KAAa;YACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,YAAY,CAAC,GAAG,CAAC,CAAC;YAClB,IAAI,MAAM,CAAC,IAAI,IAAI,UAAU;gBAAE,OAAO,KAAK,CAAC;YAC5C,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,GAAG,KAAK,CAAC,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,KAAa;YACnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YACvC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACrB,OAAO,MAAM,IAAI,GAAG,CAAC;QACvB,CAAC;QACD,IAAI;YACF,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC"}