@oomol-lab/open-connector 1.6.3 → 1.6.5

package/src/providers/bilibili/runtime.d.ts

@@ -0,0 +1,95 @@
+import type { ExecutionContext, TransitFileWriter } from "../../core/types.ts";
+import type { OAuthTokenResult } from "../../oauth/oauth-token.ts";
+import type { ProviderFetch, ProviderRuntimeHandler } from "../provider-runtime.ts";
+export declare const bilibiliUposBaseUrl = "https://openupos.bilivideo.com";
+export declare const bilibiliOAuthRefreshTokenUrl = "https://api.bilibili.com/x/account-oauth2/v1/refresh_token";
+export interface BilibiliActionContext {
+    accessToken: string;
+    clientId: string;
+    appSecret: string;
+    fetcher: ProviderFetch;
+    transitFiles?: TransitFileWriter;
+    signal?: AbortSignal;
+}
+/** Provider-native handler shape for Bilibili actions. */
+export type BilibiliActionHandler = ProviderRuntimeHandler<BilibiliActionContext>;
+/**
+ * Reject an edit call that carries no editable field: it would resubmit
+ * unchanged content and still cost a provider-side review round.
+ */
+export declare function assertAnyInputField(input: Record<string, unknown>, fields: readonly string[]): void;
+/** Read the signing material stored on the connection metadata by the OAuth client config. */
+export declare function readBilibiliSigningMaterial(metadata: Record<string, unknown>): {
+    clientId: string;
+    appSecret: string;
+} | undefined;
+/**
+ * Resolve the access token plus the signing material of the configured OAuth
+ * client. The Bilibili signature signs with the application App Secret, which
+ * the OAuth client config stores as the `appSecret` secretExtra field.
+ */
+export declare function createBilibiliContext(context: ExecutionContext, fetcher: ProviderFetch): Promise<BilibiliActionContext>;
+export interface BilibiliSignedHeadersInput {
+    clientId: string;
+    appSecret: string;
+    accessToken: string;
+    /** Exact request body string; GET and empty-body requests sign the MD5 of "". */
+    body?: string;
+}
+/**
+ * Create the signed common header set (signature version 2.0) for one arcopen
+ * request. The HMAC-SHA256 signature covers the sorted x-bili-* header lines
+ * joined by "\n"; per Bilibili's official demos the trailing newline of the
+ * last line is trimmed before signing.
+ */
+export declare function createBilibiliSignedHeaders(input: BilibiliSignedHeadersInput): Record<string, string>;
+export interface BilibiliApiRequestOptions {
+    method?: "GET" | "POST";
+    /** Endpoint path under https://member.bilibili.com/arcopen/fn, for example /archive/viewlist. */
+    path: string;
+    query?: Record<string, string | undefined>;
+    body?: Record<string, unknown>;
+    /** Short request label used in error messages. */
+    label: string;
+}
+/** Call one signed member.bilibili.com arcopen endpoint and unwrap its data envelope. */
+export declare function bilibiliApiRequest(context: BilibiliActionContext, options: BilibiliApiRequestOptions): Promise<unknown>;
+export interface BilibiliFormRequestOptions {
+    /** Endpoint path under https://member.bilibili.com/arcopen/fn. */
+    path: string;
+    /** Form fields; undefined values are skipped. */
+    fields?: Record<string, string | undefined>;
+    /** Optional file part, sent as the `file` form field. */
+    file?: File;
+    /** Short request label used in error messages. */
+    label: string;
+}
+/**
+ * POST one arcopen endpoint as multipart/form-data. Bilibili article
+ * endpoints take form fields instead of JSON, and per the signing rules the
+ * content MD5 of a form body is computed over an empty string.
+ */
+export declare function bilibiliFormRequest(context: BilibiliActionContext, options: BilibiliFormRequestOptions): Promise<unknown>;
+/** Read one arcopen/openupos response into its envelope data, mapping HTTP and envelope failures. */
+export declare function readBilibiliApiResponse(response: Response, label: string): Promise<unknown>;
+/** Unwrap the shared Bilibili { code, message, data } envelope of arcopen and openupos responses. */
+export declare function readBilibiliEnvelopeData(payload: unknown, label: string): unknown;
+/**
+ * Read the comment increment of an inc-stats response. The field table of the
+ * official document spells this counter icn_reply; the sample payload uses inc_reply.
+ */
+export declare function readBilibiliReplyIncrement(data: Record<string, unknown>): number | undefined;
+export interface BilibiliOAuthTokenRequest {
+    url: string;
+    fields: Record<string, string>;
+    fetcher: ProviderFetch;
+    signal?: AbortSignal;
+    createError: (message: string) => Error;
+}
+/**
+ * Exchange or refresh a Bilibili OAuth token. Two Bilibili quirks force this
+ * provider-local request: the parameters travel in the URL query (the
+ * documents list them as url 参数), and `expires_in` is an absolute UTC Unix
+ * timestamp rather than a lifetime in seconds.
+ */
+export declare function requestBilibiliOAuthToken(input: BilibiliOAuthTokenRequest): Promise<OAuthTokenResult>;

package/src/providers/bilibili/runtime.js

@@ -0,0 +1,238 @@
+import { createHash, createHmac, randomUUID } from "node:crypto";
+import { compactObject, optionalNumber, optionalRecord, optionalString, requiredString } from "../../core/cast.js";
+import { ProviderRequestError, createProviderTimeout, isAbortLikeError, providerInputError, providerResponseError, providerUserAgent, readProviderErrorTextBody, readProviderJsonBody, requireOAuthCredential, requiredResponseRecord, runProviderRequest, setSearchParams, } from "../provider-runtime.js";
+const bilibiliMemberBaseUrl = "https://member.bilibili.com";
+export const bilibiliUposBaseUrl = "https://openupos.bilivideo.com";
+export const bilibiliOAuthRefreshTokenUrl = "https://api.bilibili.com/x/account-oauth2/v1/refresh_token";
+const bilibiliApiBasePath = "/arcopen/fn";
+const bilibiliSignatureMethod = "HMAC-SHA256";
+const bilibiliSignatureVersion = "2.0";
+// Business codes from the 接口签名实现标准和状态码 document. -101 is the
+// main-site "not logged in" code that arcopen also returns for a dead token.
+const bilibiliCredentialErrorCodes = new Set([-101, 127000, 127001, 127002, 127004]);
+const bilibiliPermissionErrorCodes = new Set([123001, 127005, 127006, 127007, 127011, 127304, 127305]);
+const bilibiliRateLimitErrorCodes = new Set([127009, 127306]);
+const bilibiliInvalidInputErrorCodes = new Set([
+    4000, 123003, 123004, 123005, 123008, 123009, 123010, 123012, 123013, 123014, 123015, 123016, 123017, 123018, 123024,
+    123029, 123030, 123038, 123040, 123041, 129000, 129001, 129002, 129003, 129004, 129005, 129006, 129009, 129010,
+    129012, 129015, 129018,
+]);
+/**
+ * Reject an edit call that carries no editable field: it would resubmit
+ * unchanged content and still cost a provider-side review round.
+ */
+export function assertAnyInputField(input, fields) {
+    if (!fields.some((field) => input[field] !== undefined)) {
+        throw providerInputError(`Provide at least one field to edit: ${fields.join(", ")}.`);
+    }
+}
+/** Read the signing material stored on the connection metadata by the OAuth client config. */
+export function readBilibiliSigningMaterial(metadata) {
+    const clientId = optionalString(metadata.oauthClientId);
+    const appSecret = optionalString(optionalRecord(metadata.oauthClientSecretExtra)?.appSecret);
+    return clientId && appSecret ? { clientId, appSecret } : undefined;
+}
+/**
+ * Resolve the access token plus the signing material of the configured OAuth
+ * client. The Bilibili signature signs with the application App Secret, which
+ * the OAuth client config stores as the `appSecret` secretExtra field.
+ */
+export async function createBilibiliContext(context, fetcher) {
+    const credential = await requireOAuthCredential(context, "bilibili");
+    const signing = readBilibiliSigningMaterial(credential.metadata);
+    if (!signing) {
+        throw new ProviderRequestError(401, "Bilibili OAuth client is missing clientId or appSecret. Reconfigure the Bilibili OAuth client first.");
+    }
+    return {
+        accessToken: credential.accessToken,
+        clientId: signing.clientId,
+        appSecret: signing.appSecret,
+        fetcher,
+        transitFiles: context.transitFiles,
+        signal: context.signal,
+    };
+}
+/**
+ * Create the signed common header set (signature version 2.0) for one arcopen
+ * request. The HMAC-SHA256 signature covers the sorted x-bili-* header lines
+ * joined by "\n"; per Bilibili's official demos the trailing newline of the
+ * last line is trimmed before signing.
+ */
+export function createBilibiliSignedHeaders(input) {
+    const contentMd5 = createHash("md5")
+        .update(input.body ?? "")
+        .digest("hex");
+    const nonce = randomUUID();
+    const timestamp = Math.floor(Date.now() / 1000).toString();
+    const signedLines = [
+        `x-bili-accesskeyid:${input.clientId}`,
+        `x-bili-content-md5:${contentMd5}`,
+        `x-bili-signature-method:${bilibiliSignatureMethod}`,
+        `x-bili-signature-nonce:${nonce}`,
+        `x-bili-signature-version:${bilibiliSignatureVersion}`,
+        `x-bili-timestamp:${timestamp}`,
+    ];
+    const authorization = createHmac("sha256", input.appSecret).update(signedLines.join("\n")).digest("hex");
+    return {
+        accept: "application/json",
+        "access-token": input.accessToken,
+        authorization,
+        "x-bili-accesskeyid": input.clientId,
+        "x-bili-content-md5": contentMd5,
+        "x-bili-signature-method": bilibiliSignatureMethod,
+        "x-bili-signature-nonce": nonce,
+        "x-bili-signature-version": bilibiliSignatureVersion,
+        "x-bili-timestamp": timestamp,
+    };
+}
+/** Call one signed member.bilibili.com arcopen endpoint and unwrap its data envelope. */
+export async function bilibiliApiRequest(context, options) {
+    const method = options.method ?? "GET";
+    const url = new URL(`${bilibiliMemberBaseUrl}${bilibiliApiBasePath}${options.path}`);
+    setSearchParams(url, options.query ?? {});
+    const body = options.body === undefined ? undefined : JSON.stringify(options.body);
+    const headers = createBilibiliSignedHeaders({
+        clientId: context.clientId,
+        appSecret: context.appSecret,
+        accessToken: context.accessToken,
+        body,
+    });
+    // The document's samples send Content-Type: application/json on every
+    // JSON-channel request, including GETs and body-less POSTs.
+    headers["content-type"] = "application/json";
+    const response = await runProviderRequest({ signal: context.signal, label: options.label }, (signal) => context.fetcher(url.toString(), { method, headers, body, signal }));
+    return readBilibiliApiResponse(response, options.label);
+}
+/**
+ * POST one arcopen endpoint as multipart/form-data. Bilibili article
+ * endpoints take form fields instead of JSON, and per the signing rules the
+ * content MD5 of a form body is computed over an empty string.
+ */
+export async function bilibiliFormRequest(context, options) {
+    const url = new URL(`${bilibiliMemberBaseUrl}${bilibiliApiBasePath}${options.path}`);
+    const form = new FormData();
+    for (const [key, value] of Object.entries(options.fields ?? {})) {
+        if (value !== undefined) {
+            form.set(key, value);
+        }
+    }
+    if (options.file) {
+        form.set("file", options.file, options.file.name);
+    }
+    const headers = createBilibiliSignedHeaders({
+        clientId: context.clientId,
+        appSecret: context.appSecret,
+        accessToken: context.accessToken,
+    });
+    const response = await runProviderRequest({ signal: context.signal, label: options.label }, (signal) => context.fetcher(url.toString(), { method: "POST", headers, body: form, signal }));
+    return readBilibiliApiResponse(response, options.label);
+}
+/** Read one arcopen/openupos response into its envelope data, mapping HTTP and envelope failures. */
+export async function readBilibiliApiResponse(response, label) {
+    if (!response.ok) {
+        const text = await readProviderErrorTextBody(response, `${label} error response`);
+        throw new ProviderRequestError(response.status >= 500 ? 502 : response.status, text || `${label} failed with HTTP ${response.status}`);
+    }
+    const payload = await readProviderJsonBody(response, {
+        emptyBody: {},
+        invalidJsonMessage: `${label} returned invalid JSON`,
+    });
+    return readBilibiliEnvelopeData(payload, label);
+}
+/** Unwrap the shared Bilibili { code, message, data } envelope of arcopen and openupos responses. */
+export function readBilibiliEnvelopeData(payload, label) {
+    const envelope = requiredResponseRecord(payload, label);
+    const code = optionalNumber(envelope.code);
+    if (code === 0) {
+        return envelope.data;
+    }
+    const message = optionalString(envelope.message) ?? "unknown error";
+    if (code !== undefined && bilibiliCredentialErrorCodes.has(code)) {
+        throw new ProviderRequestError(401, `Bilibili credential expired or invalid (code ${code}): ${message}`, envelope);
+    }
+    const status = code === undefined ? 502 : mapBilibiliErrorStatus(code);
+    if (status === 502) {
+        throw providerResponseError(`${label} failed (code ${code ?? "unknown"}): ${message}`);
+    }
+    throw new ProviderRequestError(status, `${label} failed (code ${code}): ${message}`, envelope);
+}
+/** Map a documented non-zero business code to the runtime status it means; unknown codes stay upstream failures. */
+function mapBilibiliErrorStatus(code) {
+    if (bilibiliPermissionErrorCodes.has(code)) {
+        return 403;
+    }
+    if (bilibiliRateLimitErrorCodes.has(code)) {
+        return 429;
+    }
+    if (bilibiliInvalidInputErrorCodes.has(code)) {
+        return 400;
+    }
+    return 502;
+}
+/**
+ * Read the comment increment of an inc-stats response. The field table of the
+ * official document spells this counter icn_reply; the sample payload uses inc_reply.
+ */
+export function readBilibiliReplyIncrement(data) {
+    return optionalNumber(data.inc_reply) ?? optionalNumber(data.icn_reply);
+}
+/**
+ * Exchange or refresh a Bilibili OAuth token. Two Bilibili quirks force this
+ * provider-local request: the parameters travel in the URL query (the
+ * documents list them as url 参数), and `expires_in` is an absolute UTC Unix
+ * timestamp rather than a lifetime in seconds.
+ */
+export async function requestBilibiliOAuthToken(input) {
+    const url = new URL(input.url);
+    setSearchParams(url, input.fields);
+    const timeout = createProviderTimeout(input.signal);
+    let response;
+    try {
+        response = await input.fetcher(url.toString(), {
+            method: "POST",
+            headers: {
+                accept: "application/json",
+                "content-type": "application/x-www-form-urlencoded",
+                "user-agent": providerUserAgent,
+            },
+            redirect: "manual",
+            signal: timeout.signal,
+        });
+    }
+    catch (error) {
+        timeout.cleanup();
+        if (input.signal?.aborted) {
+            throw input.createError("Bilibili OAuth token request was cancelled.");
+        }
+        if (timeout.didTimeout() || isAbortLikeError(error)) {
+            throw input.createError("Bilibili OAuth token request timed out.");
+        }
+        throw input.createError("Bilibili OAuth token request failed without an HTTP response.");
+    }
+    try {
+        const payload = optionalRecord(await readProviderJsonBody(response, {
+            emptyBody: {},
+            invalidJsonMessage: "Bilibili OAuth token request returned invalid JSON",
+        }));
+        const code = optionalNumber(payload?.code);
+        if (!response.ok || code !== 0) {
+            throw input.createError(optionalString(payload?.message) ?? `Bilibili OAuth token request failed (HTTP ${response.status}).`);
+        }
+        const data = optionalRecord(payload?.data);
+        const accessToken = requiredString(data?.access_token, "access_token", input.createError);
+        return {
+            accessToken,
+            refreshToken: optionalString(data?.refresh_token),
+            tokenType: "Bearer",
+            expiresAt: readBilibiliExpiresAt(optionalNumber(data?.expires_in)),
+            metadata: compactObject({ scopes: data?.scopes }),
+        };
+    }
+    finally {
+        timeout.cleanup();
+    }
+}
+function readBilibiliExpiresAt(expiresAtUnixSeconds) {
+    const millis = (expiresAtUnixSeconds ?? 0) * 1000;
+    return millis > 0 && millis <= 8.64e15 ? new Date(millis).toISOString() : undefined;
+}

package/src/providers/bilibili/upload.d.ts

@@ -0,0 +1,14 @@
+import type { BilibiliActionContext } from "./runtime.ts";
+/**
+ * Upload one video through Bilibili's upload-token flow: initialize, then a
+ * single openupos upload (files up to 100MB) or equal-sized 10MB parts plus
+ * the merge call. Returns the upload token used by archive submission.
+ */
+export declare function uploadBilibiliVideo(context: BilibiliActionContext, file: File): Promise<string>;
+/** Upload one cover image (jpeg/png, up to 5MB) and return its Bilibili-hosted URL. */
+export declare function uploadBilibiliCover(context: BilibiliActionContext, file: File): Promise<string>;
+/** Upload one article image (jpg/png, up to 5MB) and return its Bilibili-hosted URL. */
+export declare function uploadBilibiliArticleImage(context: BilibiliActionContext, file: File, watermark?: boolean): Promise<{
+    url: string;
+    size?: number;
+}>;

package/src/providers/bilibili/upload.js

@@ -0,0 +1,105 @@
+import { optionalNumber, requiredString } from "../../core/cast.js";
+import { providerInputError, providerResponseError, requiredResponseRecord, runProviderRequest, setSearchParams, } from "../provider-runtime.js";
+import { bilibiliApiRequest, bilibiliFormRequest, bilibiliUposBaseUrl, readBilibiliApiResponse } from "./runtime.js";
+const smallVideoUploadMaxBytes = 100 * 1024 * 1024;
+const videoUploadPartBytes = 10 * 1024 * 1024;
+const videoUploadMaxBytes = 4 * 1024 * 1024 * 1024;
+const imageUploadMaxBytes = 5 * 1024 * 1024;
+/**
+ * Upload one video through Bilibili's upload-token flow: initialize, then a
+ * single openupos upload (files up to 100MB) or equal-sized 10MB parts plus
+ * the merge call. Returns the upload token used by archive submission.
+ */
+export async function uploadBilibiliVideo(context, file) {
+    if (file.size === 0) {
+        throw providerInputError("The video file is empty.");
+    }
+    if (file.size > videoUploadMaxBytes) {
+        throw providerInputError("The video file exceeds the Bilibili 4GB upload limit.");
+    }
+    const initData = requiredResponseRecord(await bilibiliApiRequest(context, {
+        method: "POST",
+        path: "/archive/video/init",
+        body: {
+            name: normalizeUploadFileName(file.name),
+            utype: file.size <= smallVideoUploadMaxBytes ? "1" : "0",
+        },
+        label: "Bilibili video upload init",
+    }), "Bilibili video upload init");
+    const uploadToken = requiredString(initData.upload_token, "upload_token", providerResponseError);
+    if (file.size <= smallVideoUploadMaxBytes) {
+        await postBilibiliUposBytes(context, "/video/v2/upload", { upload_token: uploadToken }, file, "Bilibili video upload");
+        return uploadToken;
+    }
+    let offset = 0;
+    let partNumber = 1;
+    while (offset < file.size) {
+        const part = file.slice(offset, offset + videoUploadPartBytes);
+        await postBilibiliUposBytes(context, "/video/v2/part/upload", { upload_token: uploadToken, part_number: String(partNumber) }, part, `Bilibili video part ${partNumber} upload`);
+        offset += videoUploadPartBytes;
+        partNumber += 1;
+    }
+    await bilibiliApiRequest(context, {
+        method: "POST",
+        path: "/archive/video/complete",
+        query: { upload_token: uploadToken },
+        label: "Bilibili video upload complete",
+    });
+    return uploadToken;
+}
+/** Upload one cover image (jpeg/png, up to 5MB) and return its Bilibili-hosted URL. */
+export async function uploadBilibiliCover(context, file) {
+    if (file.size === 0) {
+        throw providerInputError("The cover image is empty.");
+    }
+    if (file.size > imageUploadMaxBytes) {
+        throw providerInputError("The cover image exceeds the Bilibili 5MB limit.");
+    }
+    const data = requiredResponseRecord(await bilibiliFormRequest(context, {
+        path: "/archive/cover/upload",
+        file,
+        label: "Bilibili cover upload",
+    }), "Bilibili cover upload");
+    return requiredString(data.url, "url", providerResponseError);
+}
+/** Upload one article image (jpg/png, up to 5MB) and return its Bilibili-hosted URL. */
+export async function uploadBilibiliArticleImage(context, file, watermark) {
+    if (file.size === 0) {
+        throw providerInputError("The article image is empty.");
+    }
+    if (file.size > imageUploadMaxBytes) {
+        throw providerInputError("The article image exceeds the Bilibili 5MB limit.");
+    }
+    const data = requiredResponseRecord(await bilibiliFormRequest(context, {
+        path: "/article/upload/image",
+        fields: { watermark: watermark === undefined ? undefined : String(watermark) },
+        file,
+        label: "Bilibili article image upload",
+    }), "Bilibili article image upload");
+    const url = requiredString(data.url, "url", providerResponseError);
+    const size = optionalNumber(data.size);
+    return size === undefined ? { url } : { url, size };
+}
+/**
+ * Post raw file bytes to the openupos upload host. These endpoints
+ * authenticate through the upload_token query parameter and must not carry
+ * multipart packaging around the bare binary body.
+ */
+async function postBilibiliUposBytes(context, path, query, body, label) {
+    const url = new URL(`${bilibiliUposBaseUrl}${path}`);
+    setSearchParams(url, query);
+    const response = await runProviderRequest({ signal: context.signal, label }, (signal) => context.fetcher(url.toString(), {
+        method: "POST",
+        headers: { "content-type": "application/octet-stream" },
+        body,
+        signal,
+    }));
+    await readBilibiliApiResponse(response, label);
+}
+function normalizeUploadFileName(name) {
+    const trimmed = name.trim();
+    if (!trimmed) {
+        return "video.mp4";
+    }
+    return trimmed.includes(".") ? trimmed : `${trimmed}.mp4`;
+}

package/src/providers/bitwarden/executors.d.ts

@@ -0,0 +1,3 @@
+import type { CredentialValidators, ProviderExecutors } from "../../core/types.ts";
+export declare const executors: ProviderExecutors;
+export declare const credentialValidators: CredentialValidators;

package/src/providers/bitwarden/executors.js

@@ -0,0 +1,146 @@
+import { compactObject, looseArray, optionalRecord, optionalString } from "../../core/cast.js";
+import { defineProviderExecutors, providerInputError, ProviderRequestError, providerResponseError, providerUserAgent, readProviderJsonBody, requireCustomCredential, requiredInputString, requiredResponseRecord, runProviderRequest, } from "../provider-runtime.js";
+const service = "bitwarden";
+const regions = {
+    us: { api: "https://api.bitwarden.com", identity: "https://identity.bitwarden.com" },
+    eu: { api: "https://api.bitwarden.eu", identity: "https://identity.bitwarden.eu" },
+};
+const handlers = {
+    list_collections: list("/public/collections", "collections"),
+    get_collection: get("/public/collections", "collection"),
+    async list_events(input, context) {
+        const payload = requiredResponseRecord(await request("/public/events", "list events", context, compactObject({
+            start: optionalString(input.start),
+            end: optionalString(input.end),
+            actingUserId: optionalString(input.actingUserId),
+            itemId: optionalString(input.itemId),
+            secretId: optionalString(input.secretId),
+            projectId: optionalString(input.projectId),
+            continuationToken: optionalString(input.continuationToken),
+        })), "Bitwarden event list");
+        return { events: looseArray(payload.data), continuationToken: optionalString(payload.continuationToken) ?? null };
+    },
+    list_groups: list("/public/groups", "groups"),
+    get_group: get("/public/groups", "group"),
+    get_group_member_ids: ids("/public/groups", "member-ids", "memberIds"),
+    list_members: list("/public/members", "members"),
+    get_member: get("/public/members", "member"),
+    get_member_group_ids: ids("/public/members", "group-ids", "groupIds"),
+    list_policies: list("/public/policies", "policies"),
+    async get_policy(input, context) {
+        if (!Number.isInteger(input.type))
+            throw providerInputError("type is required");
+        return {
+            policy: requiredResponseRecord(await request(`/public/policies/${input.type}`, "get policy", context), "Bitwarden policy"),
+        };
+    },
+    async get_subscription(_input, context) {
+        return requiredResponseRecord(await request("/public/organization/subscription", "get subscription", context), "Bitwarden subscription");
+    },
+};
+export const executors = defineProviderExecutors({
+    service,
+    handlers,
+    async createContext(context, fetcher) {
+        const stored = await requireCustomCredential(context, service);
+        return { ...credential(stored.values), fetcher, signal: context.signal };
+    },
+});
+export const credentialValidators = {
+    async customCredential(input, { fetcher, signal }) {
+        const value = credential(input.values);
+        await token(value, fetcher, signal, true);
+        return {
+            profile: { accountId: value.clientId, displayName: `Bitwarden Organization (${value.region.toUpperCase()})` },
+            grantedScopes: ["api.organization"],
+            metadata: { region: value.region, apiBaseUrl: regions[value.region].api },
+        };
+    },
+};
+function credential(values) {
+    const region = requiredInputString(values.region, "region").toLowerCase();
+    if (region !== "us" && region !== "eu")
+        throw providerInputError("region must be us or eu");
+    return {
+        clientId: requiredInputString(values.clientId, "clientId"),
+        clientSecret: requiredInputString(values.clientSecret, "clientSecret"),
+        region,
+    };
+}
+function list(path, field) {
+    return async (input, context) => {
+        const payload = requiredResponseRecord(await request(path, `list ${field}`, context, compactObject({ continuationToken: optionalString(input.continuationToken) })), `Bitwarden ${field}`);
+        return { [field]: looseArray(payload.data), continuationToken: optionalString(payload.continuationToken) ?? null };
+    };
+}
+function get(path, field) {
+    return async (input, context) => ({
+        [field]: requiredResponseRecord(await request(`${path}/${encodeURIComponent(requiredInputString(input.id, "id"))}`, `get ${field}`, context), `Bitwarden ${field}`),
+    });
+}
+function ids(path, suffix, field) {
+    return async (input, context) => ({
+        [field]: looseArray(await request(`${path}/${encodeURIComponent(requiredInputString(input.id, "id"))}/${suffix}`, `get ${field}`, context)),
+    });
+}
+async function token(value, fetcher, parentSignal, validating) {
+    const response = await runProviderRequest({ signal: parentSignal, label: "Bitwarden token exchange" }, (signal) => fetcher(`${regions[value.region].identity}/connect/token`, {
+        method: "POST",
+        headers: {
+            accept: "application/json",
+            "content-type": "application/x-www-form-urlencoded",
+            "user-agent": providerUserAgent,
+        },
+        body: new URLSearchParams({
+            grant_type: "client_credentials",
+            scope: "api.organization",
+            client_id: value.clientId,
+            client_secret: value.clientSecret,
+        }).toString(),
+        signal,
+    }));
+    const payload = await readProviderJsonBody(response, {
+        emptyBody: null,
+        invalidJsonMessage: "Bitwarden token exchange returned invalid JSON",
+    });
+    if (!response.ok)
+        throw error(response.status, payload, validating);
+    const accessToken = optionalString(optionalRecord(payload)?.access_token)?.trim();
+    if (!accessToken)
+        throw providerResponseError("Bitwarden access token is missing");
+    return accessToken;
+}
+async function request(path, operation, context, query = {}) {
+    const accessToken = await token(context, context.fetcher, context.signal, false);
+    const url = new URL(path, `${regions[context.region].api}/`);
+    for (const [key, value] of Object.entries(query))
+        if (value != null)
+            url.searchParams.set(key, String(value));
+    const response = await runProviderRequest({ signal: context.signal, label: `Bitwarden ${operation}` }, (signal) => context.fetcher(url, {
+        headers: { accept: "application/json", authorization: `Bearer ${accessToken}`, "user-agent": providerUserAgent },
+        signal,
+    }));
+    const payload = await readProviderJsonBody(response, {
+        emptyBody: null,
+        invalidJsonMessage: `Bitwarden ${operation} returned invalid JSON`,
+    });
+    if (!response.ok)
+        throw error(response.status, payload, false);
+    if (payload == null)
+        throw providerResponseError(`Bitwarden ${operation} returned an empty response`);
+    return payload;
+}
+function error(status, payload, validating) {
+    const body = optionalRecord(payload);
+    const code = optionalString(body?.error);
+    const message = optionalString(body?.error_description) ??
+        optionalString(body?.message) ??
+        `Bitwarden request failed with ${status}`;
+    if (status === 429)
+        return new ProviderRequestError(429, message, payload);
+    if (code === "invalid_client")
+        return validating ? providerInputError(message) : new ProviderRequestError(409, message, payload);
+    if (status === 400)
+        return providerInputError(message);
+    return new ProviderRequestError(status, message, payload);
+}

package/src/providers/cronfree/executors.d.ts

@@ -0,0 +1,4 @@
+import type { CredentialValidators, ProviderExecutors, ProviderProxyExecutor } from "../../core/types.ts";
+export declare const executors: ProviderExecutors;
+export declare const proxy: ProviderProxyExecutor;
+export declare const credentialValidators: CredentialValidators;