runline 0.29.0 → 0.30.0

package/dist/plugins/_shared/googleAuth.js

@@ -1,113 +1,99 @@
-import { createSign } from "node:crypto";
-const TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
-const REFRESH_SKEW_MS = 60_000;
-export async function googleAccessToken(ctx, pluginName, scopes) {
-    const cfg = ctx.connection.config;
-    if (cfg.accessToken &&
-        typeof cfg.accessTokenExpiresAt === "number" &&
-        Date.now() < cfg.accessTokenExpiresAt - REFRESH_SKEW_MS) {
-        return cfg.accessToken;
-    }
-    if (hasServiceAccountConfig(cfg)) {
-        return refreshServiceAccountAccessToken(ctx, pluginName, cfg, scopes);
-    }
-    return refreshOAuthAccessToken(ctx, pluginName, cfg);
-}
-function hasServiceAccountConfig(cfg) {
-    return !!cfg.serviceAccountJson || !!(cfg.serviceAccountEmail && cfg.serviceAccountPrivateKey);
-}
-async function refreshOAuthAccessToken(ctx, pluginName, cfg) {
-    const { clientId, clientSecret, refreshToken } = cfg;
-    if (!clientId || !clientSecret || !refreshToken) {
-        throw new Error(`${pluginName}: missing OAuth clientId/clientSecret/refreshToken or service account credentials. Run the OAuth helper or set serviceAccountJson.`);
-    }
-    const body = new URLSearchParams({
-        client_id: clientId,
-        client_secret: clientSecret,
-        refresh_token: refreshToken,
-        grant_type: "refresh_token",
-    });
-    const res = await fetch(TOKEN_ENDPOINT, {
-        method: "POST",
-        headers: { "Content-Type": "application/x-www-form-urlencoded" },
-        body: body.toString(),
+import { AuthError, downloadResource, } from "runline";
+import { credentialRuntime } from "./credentialAdapter.js";
+import { googleCredentialType, googleIdentity, googleMethod, googleResources, } from "./googleCredentials.js";
+/** Explicit storage adapter: the registry owns token protocols and renewal. */
+export function googleRuntime(ctx, pluginName, scopes) {
+    const config = ctx.connection.config;
+    const method = googleMethod(config);
+    const runtime = credentialRuntime(ctx, googleCredentialType(scopes, pluginName), method, (current) => {
+        const cfg = current;
+        return [
+            pluginName,
+            scopes,
+            googleMethod(cfg),
+            ...(method === "serviceAccount"
+                ? [googleIdentity(cfg)]
+                : [cfg.clientId, cfg.clientSecret]),
+        ];
     });
-    if (!res.ok) {
-        throw new Error(`${pluginName}: token refresh failed (${res.status}): ${await res.text()}`);
-    }
-    const data = (await res.json());
-    const expiresAt = Date.now() + data.expires_in * 1000;
-    await ctx.updateConnection({
-        accessToken: data.access_token,
-        accessTokenExpiresAt: expiresAt,
-    });
-    return data.access_token;
+    if (method === "serviceAccount")
+        runtime.binding.jwtIdentity = googleIdentity(config);
+    return runtime;
 }
-async function refreshServiceAccountAccessToken(ctx, pluginName, cfg, scopes) {
-    const serviceAccount = parseServiceAccount(pluginName, cfg);
-    const now = Math.floor(Date.now() / 1000);
-    const assertion = signJwt({
-        alg: "RS256",
-        typ: "JWT",
-    }, {
-        iss: serviceAccount.client_email,
-        scope: scopes.join(" "),
-        aud: TOKEN_ENDPOINT,
-        iat: now,
-        exp: now + 3600,
-        ...(cfg.serviceAccountSubject ? { sub: cfg.serviceAccountSubject } : {}),
-    }, serviceAccount.private_key);
-    const body = new URLSearchParams({
-        grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
-        assertion,
-    });
-    const res = await fetch(TOKEN_ENDPOINT, {
-        method: "POST",
-        headers: { "Content-Type": "application/x-www-form-urlencoded" },
-        body: body.toString(),
-    });
-    if (!res.ok) {
-        throw new Error(`${pluginName}: service account token failed (${res.status}): ${await res.text()}`);
+/** Trusted-runtime token compatibility only; resource consumers use googleResponse. */
+export async function googleAccessToken(ctx, pluginName, scopes) {
+    const { binding, transport } = googleRuntime(ctx, pluginName, scopes);
+    return transport.accessToken(binding);
+}
+/** Translate builtin absolute URLs at one boundary; validate the raw path before URL normalization. */
+export async function googleResponse(ctx, plugin, scopes, url, init = {}, query) {
+    const resources = googleResources(plugin);
+    const selected = Object.entries(resources.targets).find(([, target]) => url.startsWith(target.baseUrl));
+    if (!selected)
+        throw new AuthError("request_not_allowed");
+    const [target, policy] = selected;
+    let path = url.slice(policy.baseUrl.length);
+    if (query) {
+        const separator = path.indexOf("?");
+        const params = new URLSearchParams(separator < 0 ? "" : path.slice(separator + 1));
+        for (const [key, value] of Object.entries(query)) {
+            if (value === undefined || value === null)
+                continue;
+            params.delete(key);
+            for (const entry of Array.isArray(value) ? value : [value])
+                params.append(key, String(entry));
+        }
+        path = `${separator < 0 ? path : path.slice(0, separator)}?${params}`;
     }
-    const data = (await res.json());
-    const expiresAt = Date.now() + data.expires_in * 1000;
-    await ctx.updateConnection({
-        accessToken: data.access_token,
-        accessTokenExpiresAt: expiresAt,
+    const { binding, transport } = googleRuntime(ctx, plugin, scopes);
+    return transport.request(binding, {
+        target,
+        path,
+        method: (init.method ?? "GET"),
+        headers: init.headers,
+        body: init.body,
     });
-    return data.access_token;
 }
-function parseServiceAccount(pluginName, cfg) {
-    if (cfg.serviceAccountJson) {
-        try {
-            const parsed = JSON.parse(cfg.serviceAccountJson);
-            if (parsed.client_email && parsed.private_key) {
-                return { client_email: parsed.client_email, private_key: parsed.private_key };
-            }
-        }
-        catch (err) {
-            throw new Error(`${pluginName}: invalid serviceAccountJson: ${err.message}`);
-        }
+export async function googleJsonRequest(ctx, plugin, scopes, method, url, body, query) {
+    const response = await googleResponse(ctx, plugin, scopes, url, {
+        method,
+        headers: {
+            Accept: "application/json",
+            ...(body === undefined ? {} : { "Content-Type": "application/json" }),
+        },
+        body: body === undefined ? undefined : JSON.stringify(body),
+    }, query);
+    if (!response.ok)
+        throw new Error(`${plugin}: request failed (HTTP ${response.status})`);
+    if (response.status === 204)
+        return { success: true };
+    const text = await response.text();
+    try {
+        return text ? JSON.parse(text) : { success: true };
     }
-    if (cfg.serviceAccountEmail && cfg.serviceAccountPrivateKey) {
-        return {
-            client_email: cfg.serviceAccountEmail,
-            private_key: cfg.serviceAccountPrivateKey.replace(/\\n/g, "\n"),
-        };
+    catch {
+        throw new AuthError("invalid_response");
     }
-    throw new Error(`${pluginName}: service account requires serviceAccountJson or serviceAccountEmail/serviceAccountPrivateKey`);
 }
-function signJwt(header, payload, privateKey) {
-    const encodedHeader = base64url(JSON.stringify(header));
-    const encodedPayload = base64url(JSON.stringify(payload));
-    const signingInput = `${encodedHeader}.${encodedPayload}`;
-    const signer = createSign("RSA-SHA256");
-    signer.update(signingInput);
-    signer.end();
-    const signature = signer.sign(privateKey.replace(/\\n/g, "\n"));
-    return `${signingInput}.${base64url(signature)}`;
+export async function googleProbe(ctx, plugin, scopes) {
+    const { binding, transport } = googleRuntime(ctx, plugin, scopes);
+    return transport.probe(binding);
 }
-function base64url(input) {
-    const buf = typeof input === "string" ? Buffer.from(input, "utf-8") : input;
-    return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+/** Only Google-issued thumbnail hosts; never attach credentials to signed URLs. */
+export async function googleDownload(value) {
+    let url;
+    try {
+        url = new URL(value);
+        if (url.port ||
+            !(url.hostname === "googleusercontent.com" ||
+                url.hostname.endsWith(".googleusercontent.com")))
+            throw new Error();
+    }
+    catch {
+        throw new AuthError("request_not_allowed");
+    }
+    return downloadResource(value, {
+        allowedOrigins: [url.origin],
+        fetch: globalThis.fetch,
+    });
 }

package/dist/plugins/_shared/googleCredentials.js

@@ -0,0 +1,160 @@
+import { AuthError, OAuthGrantSchema, } from "runline";
+import * as t from "typebox";
+/** Only legacy storage infers a method; host bindings always select it explicitly. */
+export function googleMethod(cfg) {
+    if (cfg.authMethod !== undefined) {
+        if (cfg.authMethod !== "delegated" && cfg.authMethod !== "serviceAccount")
+            throw new AuthError("invalid_credentials");
+        return cfg.authMethod;
+    }
+    return cfg.serviceAccountJson ||
+        cfg.serviceAccountEmail ||
+        cfg.serviceAccountPrivateKey
+        ? "serviceAccount"
+        : "delegated";
+}
+export function googleIdentity(cfg) {
+    try {
+        const parsed = cfg.serviceAccountJson
+            ? JSON.parse(cfg.serviceAccountJson)
+            : {
+                client_email: cfg.serviceAccountEmail,
+                private_key: cfg.serviceAccountPrivateKey,
+            };
+        if (!parsed ||
+            typeof parsed.client_email !== "string" ||
+            !parsed.client_email ||
+            typeof parsed.private_key !== "string" ||
+            !parsed.private_key)
+            throw new Error();
+        return {
+            issuer: parsed.client_email,
+            privateKey: parsed.private_key.replace(/\\n/g, "\n"),
+            ...(cfg.serviceAccountSubject === undefined
+                ? {}
+                : { subject: cfg.serviceAccountSubject }),
+        };
+    }
+    catch {
+        throw new AuthError("invalid_credentials");
+    }
+}
+const API_BASES = {
+    drive: "https://www.googleapis.com/drive/v3/",
+    upload: "https://www.googleapis.com/upload/drive/v3/",
+    docs: "https://docs.googleapis.com/v1/",
+    sheets: "https://sheets.googleapis.com/v4/",
+    slides: "https://slides.googleapis.com/v1/",
+    script: "https://script.googleapis.com/v1/",
+    tasks: "https://tasks.googleapis.com/tasks/v1/",
+    people: "https://people.googleapis.com/",
+    calendar: "https://www.googleapis.com/calendar/v3/",
+    gmail: "https://gmail.googleapis.com/gmail/v1/users/me/",
+};
+const PLUGIN_TARGETS = {
+    googleDrive: ["drive", "upload", "docs"],
+    googleDocs: ["docs", "drive"],
+    googleSheets: ["sheets", "drive"],
+    googleSlides: ["slides"],
+    googleAppsScript: ["script", "drive"],
+    googleTasks: ["tasks"],
+    googleContacts: ["people"],
+    googleCalendar: ["calendar"],
+    gmail: ["gmail"],
+};
+/** Builtin routing policy, never derived from action input or a returned URL. */
+export function googleResources(plugin) {
+    if (!Object.hasOwn(PLUGIN_TARGETS, plugin))
+        throw new AuthError("request_not_allowed");
+    const names = PLUGIN_TARGETS[plugin];
+    const targets = Object.fromEntries(names.map((name) => [
+        name,
+        {
+            baseUrl: API_BASES[name],
+            methods: ["GET", "POST", "PUT", "PATCH", "DELETE"],
+            ...(name === "upload"
+                ? {
+                    allowedHeaders: [
+                        "X-Upload-Content-Type",
+                        "X-Upload-Content-Length",
+                        "Content-Range",
+                    ],
+                    resumableUpload: true,
+                }
+                : {}),
+        },
+    ]));
+    const probes = {
+        googleDrive: ["drive", "files?pageSize=1&fields=files(id)"],
+        googleTasks: ["tasks", "users/@me/lists?maxResults=1"],
+        googleContacts: [
+            "people",
+            "v1/people/me/connections?pageSize=1&personFields=names",
+        ],
+        googleCalendar: ["calendar", "users/me/calendarList?maxResults=1"],
+        gmail: ["gmail", "profile"],
+        googleAppsScript: ["drive", "files?pageSize=1&fields=files(id)"],
+    };
+    const probe = probes[plugin];
+    // Docs/Sheets/Slides have no fixed scoped document to probe. Do not guess an ID
+    // or require broader Drive permissions merely to manufacture a successful check.
+    return {
+        targets,
+        ...(probe
+            ? {
+                probe: {
+                    target: probe[0],
+                    path: probe[1],
+                    method: "GET",
+                    acceptedStatuses: [200],
+                },
+            }
+            : {}),
+    };
+}
+/** Fixed vendor endpoints; a JSON credential's token_uri can never select egress. */
+export function googleCredentialType(scopes, plugin) {
+    const url = "https://oauth2.googleapis.com/token";
+    const schema = t.Object({ grant: t.Optional(OAuthGrantSchema) }, { additionalProperties: false });
+    const { targets, probe } = googleResources(plugin);
+    return {
+        id: "google.oauth",
+        methods: {
+            delegated: {
+                schema,
+                authentication: {
+                    kind: "oauth2",
+                    grantField: "grant",
+                    renewal: "refresh",
+                    definition: {
+                        id: "google.oauth",
+                        provider: "google",
+                        refresh: { url, clientAuthentication: "client_secret_post" },
+                    },
+                },
+                targets,
+                probe,
+            },
+            ...(scopes.length
+                ? {
+                    serviceAccount: {
+                        schema,
+                        authentication: {
+                            kind: "oauth2",
+                            grantField: "grant",
+                            renewal: "jwtBearer",
+                            scopes,
+                            definition: {
+                                id: "google.serviceAccount",
+                                provider: "google",
+                                jwtBearer: { url, clientAuthentication: "none" },
+                            },
+                        },
+                        targets,
+                        probe,
+                    },
+                }
+                : {}),
+        },
+    };
+}

package/dist/plugins/_shared/microsoftAuth.js

@@ -1,87 +1,94 @@
-const REFRESH_SKEW_MS = 60_000;
-function authority(cfg) {
-    return `https://login.microsoftonline.com/${cfg.tenantId || "common"}/oauth2/v2.0/token`;
-}
+import { AuthError, downloadResource, } from "runline";
+import { credentialRuntime } from "./credentialAdapter.js";
+import { microsoftCredentialType, microsoftMethod, microsoftUserBase, } from "./microsoftCredentials.js";
+export { microsoftDriveBase } from "./microsoftCredentials.js";
 export function isAppOnly(cfg) {
-    return !cfg.refreshToken && !!(cfg.tenantId && cfg.clientId && cfg.clientSecret);
+    return microsoftMethod(cfg) === "appOnly";
 }
-/** Graph path prefix for the acting principal: /me (delegated) or /users/{upn} (app-only). */
 export function userBase(ctx) {
-    const cfg = ctx.connection.config;
-    if (cfg.refreshToken)
-        return "/me";
-    if (cfg.userUpn)
-        return `/users/${encodeURIComponent(cfg.userUpn)}`;
-    throw new Error("microsoft: app-only mode requires userUpn (target mailbox/drive). Set MS_GRAPH_USER_UPN, or connect via OAuth.");
+    return microsoftUserBase(ctx.connection.config);
 }
-export async function microsoftAccessToken(ctx, pluginName, scopes) {
+function runtime(ctx, plugin, scopes) {
     const cfg = ctx.connection.config;
-    if (cfg.accessToken &&
-        typeof cfg.accessTokenExpiresAt === "number" &&
-        Date.now() < cfg.accessTokenExpiresAt - REFRESH_SKEW_MS) {
-        return cfg.accessToken;
-    }
-    let body;
-    if (cfg.refreshToken) {
-        if (!cfg.clientId || !cfg.clientSecret) {
-            throw new Error(`${pluginName}: missing clientId/clientSecret for OAuth refresh.`);
-        }
-        body = new URLSearchParams({
-            client_id: cfg.clientId,
-            client_secret: cfg.clientSecret,
-            refresh_token: cfg.refreshToken,
-            grant_type: "refresh_token",
-            scope: [...scopes, "offline_access"].join(" "),
-        });
-    }
-    else if (isAppOnly(cfg)) {
-        body = new URLSearchParams({
-            client_id: cfg.clientId,
-            client_secret: cfg.clientSecret,
-            grant_type: "client_credentials",
-            scope: "https://graph.microsoft.com/.default",
-        });
-    }
-    else {
-        throw new Error(`${pluginName}: no credentials. Connect via OAuth, or set tenantId/clientId/clientSecret (app-only).`);
-    }
-    const res = await fetch(authority(cfg), {
-        method: "POST",
-        headers: { "Content-Type": "application/x-www-form-urlencoded" },
-        body: body.toString(),
+    const method = microsoftMethod(cfg);
+    if (method === "appOnly" &&
+        (!cfg.tenantId ||
+            ["common", "organizations", "consumers"].includes(cfg.tenantId)))
+        throw new AuthError("invalid_credentials");
+    return credentialRuntime(ctx, microsoftCredentialType(cfg, plugin, scopes), method, (current) => {
+        const c = current;
+        return [
+            microsoftMethod(c),
+            c.tenantId,
+            c.clientId,
+            c.clientSecret,
+            scopes,
+        ];
     });
-    if (!res.ok) {
-        throw new Error(`${pluginName}: token request failed (${res.status}): ${await res.text()}`);
-    }
-    const data = (await res.json());
-    const patch = {
-        accessToken: data.access_token,
-        accessTokenExpiresAt: Date.now() + data.expires_in * 1000,
-    };
-    // Microsoft rotates refresh tokens — persist the new one when present.
-    if (data.refresh_token)
-        patch.refreshToken = data.refresh_token;
-    await ctx.updateConnection(patch);
-    return data.access_token;
 }
-/** Authenticated Graph v1.0 request. Returns parsed JSON ({success:true} for 204). */
-export async function graphRequest(ctx, pluginName, scopes, method, path, body) {
-    const token = await microsoftAccessToken(ctx, pluginName, scopes);
-    const init = {
-        method,
-        headers: { Authorization: `Bearer ${token}`, Accept: "application/json" },
-    };
-    if (body !== undefined) {
-        init.headers["Content-Type"] = "application/json";
-        init.body = JSON.stringify(body);
-    }
-    const res = await fetch(`https://graph.microsoft.com/v1.0${path}`, init);
+/** Compatibility token access uses the same grant runtime as resource requests. */
+export async function microsoftAccessToken(ctx, plugin, scopes) {
+    const { binding, transport } = runtime(ctx, plugin, scopes);
+    return transport.accessToken(binding);
+}
+export async function microsoftProbe(ctx, plugin, scopes) {
+    const { binding, transport } = runtime(ctx, plugin, scopes);
+    return transport.probe(binding);
+}
+export async function graphResponse(ctx, plugin, scopes, method, path, body, contentType) {
+    if (!path.startsWith("/") || path.startsWith("//"))
+        throw new AuthError("request_not_allowed");
+    const { binding, transport } = runtime(ctx, plugin, scopes);
+    return transport.request(binding, {
+        target: "graph",
+        path: path.slice(1),
+        method: method,
+        headers: {
+            Accept: "application/json",
+            ...(contentType ? { "Content-Type": contentType } : {}),
+        },
+        body,
+    });
+}
+/** JSON and binary requests share the same destination, renewal and replay policy. */
+export async function graphRequest(ctx, plugin, scopes, method, path, body) {
+    const res = await graphResponse(ctx, plugin, scopes, method, path, body === undefined ? undefined : JSON.stringify(body), body === undefined ? undefined : "application/json");
+    if (!res.ok)
+        throw new Error(`${plugin}: Graph request failed (HTTP ${res.status})`);
     if (res.status === 204)
         return { success: true };
     const text = await res.text();
-    if (!res.ok)
-        throw new Error(`${pluginName}: ${method} ${path} → ${res.status} ${text}`);
-    return text ? JSON.parse(text) : { success: true };
+    try {
+        return text ? JSON.parse(text) : { success: true };
+    }
+    catch {
+        throw new Error(`${plugin}: invalid Graph response`);
+    }
+}
+/** Graph-issued signed download URLs carry their own authority, never a bearer header. */
+export async function microsoftDownload(value) {
+    if (typeof value !== "string")
+        throw new AuthError("invalid_response");
+    let url;
+    try {
+        url = new URL(value);
+        const domains = [
+            "sharepoint.com",
+            "1drv.com",
+            "storage.live.com",
+            "onedrive.com",
+        ];
+        if (url.port ||
+            !domains.some((domain) => url.hostname === domain || url.hostname.endsWith(`.${domain}`)))
+            throw new Error();
+    }
+    catch {
+        throw new AuthError("request_not_allowed");
+    }
+    return downloadResource(value, {
+        allowedOrigins: [url.origin],
+        fetch: globalThis.fetch,
+    });
 }
 /** Setup help shown by the OAuth wizard for all Microsoft plugins. */
 export function microsoftSetupHelp(apiName) {

package/dist/plugins/_shared/microsoftCredentials.js

@@ -0,0 +1,90 @@
+import { AuthError, OAuthGrantSchema, } from "runline";
+import * as t from "typebox";
+/** Compatibility inference is confined to legacy configs without an explicit method. */
+export function microsoftMethod(cfg) {
+    if (cfg.authMethod !== undefined) {
+        if (cfg.authMethod !== "delegated" && cfg.authMethod !== "appOnly")
+            throw new AuthError("invalid_credentials");
+        return cfg.authMethod;
+    }
+    return !cfg.refreshToken && cfg.tenantId && cfg.clientId && cfg.clientSecret
+        ? "appOnly"
+        : "delegated";
+}
+export function microsoftUserBase(cfg) {
+    if (microsoftMethod(cfg) === "delegated")
+        return "/me";
+    if (!cfg.userUpn)
+        throw new AuthError("invalid_credentials");
+    return `/users/${encodeURIComponent(cfg.userUpn)}`;
+}
+export function microsoftDriveBase(cfg) {
+    if (cfg.driveId)
+        return `/drives/${encodeURIComponent(cfg.driveId)}`;
+    if (cfg.siteId)
+        return `/sites/${encodeURIComponent(cfg.siteId)}/drive`;
+    return `${microsoftUserBase(cfg)}/drive`;
+}
+/** Scope-appropriate probes never require User.Read merely to check mail/calendar/files. */
+export function microsoftCredentialType(cfg, plugin, scopes) {
+    const tenant = cfg.tenantId || "common";
+    if (!/^[a-zA-Z0-9.-]+$/.test(tenant))
+        throw new AuthError("invalid_credentials");
+    const endpoint = {
+        url: `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token`,
+        clientAuthentication: "client_secret_post",
+    };
+    const schema = t.Object({ grant: t.Optional(OAuthGrantSchema) }, { additionalProperties: false });
+    const methods = Object.fromEntries(["delegated", "appOnly"].map((method) => {
+        let probe;
+        const selected = { ...cfg, authMethod: method };
+        if (method === "delegated" ||
+            cfg.userUpn ||
+            (plugin === "microsoftFiles" && (cfg.driveId || cfg.siteId))) {
+            const path = plugin === "microsoftMail"
+                ? `${microsoftUserBase(selected)}/messages?$top=1&$select=id`
+                : plugin === "microsoftCalendar"
+                    ? `${microsoftUserBase(selected)}/events?$top=1&$select=id`
+                    : plugin === "microsoftFiles"
+                        ? `${microsoftDriveBase(selected)}/root?$select=id`
+                        : undefined;
+            if (path)
+                probe = {
+                    target: "graph",
+                    path: path.slice(1),
+                    method: "GET",
+                    acceptedStatuses: [200],
+                };
+        }
+        return [
+            method,
+            {
+                schema,
+                authentication: {
+                    kind: "oauth2",
+                    grantField: "grant",
+                    renewal: method === "delegated"
+                        ? "refresh"
+                        : "clientCredentials",
+                    definition: {
+                        id: "microsoft.oauth",
+                        provider: "microsoft",
+                        refresh: endpoint,
+                        clientCredentials: endpoint,
+                    },
+                    scopes: method === "delegated"
+                        ? [...scopes, "offline_access"]
+                        : ["https://graph.microsoft.com/.default"],
+                },
+                targets: {
+                    graph: {
+                        baseUrl: "https://graph.microsoft.com/v1.0/",
+                        methods: ["GET", "POST", "PUT", "PATCH", "DELETE"],
+                    },
+                },
+                ...(probe ? { probe } : {}),
+            },
+        ];
+    }));
+    return { id: "microsoft.graph", methods };
+}

package/dist/plugins/_shared/tokenRefresh.js

@@ -0,0 +1,39 @@
+import { requestOAuth2Token, } from "runline";
+const REFRESH_SKEW_MS = 60_000;
+function usableToken(config) {
+    return typeof config.accessToken === "string" &&
+        config.accessToken &&
+        (config.accessTokenExpiresAt === undefined ||
+            (typeof config.accessTokenExpiresAt === "number" &&
+                Number.isFinite(config.accessTokenExpiresAt) &&
+                Date.now() < config.accessTokenExpiresAt - REFRESH_SKEW_MS))
+        ? config.accessToken
+        : undefined;
+}
+/** Refresh ownership includes the provider request and persistence of rotated tokens. */
+export async function coordinatedAccessToken(ctx, refresh) {
+    const cached = usableToken(ctx.connection.config);
+    if (cached)
+        return cached;
+    await ctx.updateConnection(async (current) => {
+        if (usableToken(current))
+            return;
+        return refresh(current);
+    });
+    const token = ctx.connection.config.accessToken;
+    if (typeof token !== "string" || !token)
+        throw new Error("Token refresh committed no access token");
+    return token;
+}
+/** Token errors exclude response bodies, parser diagnostics, and request credentials. */
+export async function requestToken(endpoint, body, application) {
+    const tokens = await requestOAuth2Token(endpoint, body, application);
+    return {
+        accessToken: tokens.accessToken,
+        // Unknown expiry replaces an old expiry; it never inherits a stale timestamp.
+        accessTokenExpiresAt: tokens.expiresAt,
+        ...(tokens.refreshToken === undefined
+            ? {}
+            : { refreshToken: tokens.refreshToken }),
+    };
+}