@oomol-lab/open-connector 1.6.3 → 1.6.5

package/src/providers/cronfree/executors.js

@@ -0,0 +1,89 @@
+import { looseArray, optionalString } from "../../core/cast.js";
+import { defineApiKeyProviderExecutors, defineProviderProxy, providerInputError, ProviderRequestError, providerUserAgent, readProviderJsonBody, requiredInputString, runProviderRequest, } from "../provider-runtime.js";
+const service = "cronfree";
+const cronfreeApiBaseUrl = "https://login.cronfree.com/zapier";
+const handlers = {
+    async create_schedule(input, context) {
+        const result = await requestCronfree({
+            path: "/schedule",
+            body: {
+                hookUrl: requiredInputString(input.hookUrl, "hookUrl"),
+                wdays: readStringArray(input.weekdays),
+                months: readStringArray(input.months),
+                mdays: readStringArray(input.monthDays),
+                hours: readStringArray(input.hours),
+                minutes: readStringArray(input.minutes),
+                timezone: [requiredInputString(input.timezone, "timezone")],
+            },
+            context,
+            phase: "execute",
+        });
+        return { result };
+    },
+    async delete_schedule(input, context) {
+        const result = await requestCronfree({
+            path: "/unschedule",
+            body: { hookUrl: requiredInputString(input.hookUrl, "hookUrl") },
+            context,
+            phase: "execute",
+        });
+        return { result };
+    },
+};
+export const executors = defineApiKeyProviderExecutors(service, handlers, {
+    skipDnsValidation: true,
+});
+export const proxy = defineProviderProxy({
+    service,
+    baseUrl: cronfreeApiBaseUrl,
+    auth: { type: "api_key_json_body", name: "license_key" },
+    skipDnsValidation: true,
+    customizeRequest({ headers }) {
+        headers.set("accept", "application/json");
+        headers.set("content-type", "application/json");
+    },
+});
+export const credentialValidators = {
+    async apiKey(input, { fetcher, signal }) {
+        await requestCronfree({
+            path: "/unschedule",
+            body: { hookUrl: `https://connector.oomol.com/cronfree-validation/${crypto.randomUUID()}` },
+            context: { apiKey: input.apiKey, fetcher, signal },
+            phase: "validate",
+        });
+        return {
+            profile: { accountId: "cronfree-license-key", displayName: "Cronfree License Key" },
+            grantedScopes: [],
+            metadata: { apiBaseUrl: cronfreeApiBaseUrl, validationEndpoint: "/unschedule" },
+        };
+    },
+};
+function readStringArray(value) {
+    return looseArray(value)
+        .map((item) => optionalString(item))
+        .filter((item) => item != null);
+}
+async function requestCronfree(input) {
+    return runProviderRequest({ signal: input.context.signal, label: "Cronfree" }, async (signal) => {
+        const response = await input.context.fetcher(`${cronfreeApiBaseUrl}${input.path}`, {
+            method: "POST",
+            headers: {
+                accept: "application/json",
+                "content-type": "application/json",
+                "user-agent": providerUserAgent,
+            },
+            body: JSON.stringify({ ...input.body, license_key: input.context.apiKey }),
+            signal,
+        });
+        if (!response.ok) {
+            if (response.status === 401 && input.phase === "validate") {
+                throw providerInputError("Cronfree rejected the license key");
+            }
+            throw new ProviderRequestError(response.status, `Cronfree request failed with HTTP ${response.status}`);
+        }
+        return readProviderJsonBody(response, {
+            emptyBody: null,
+            invalidJsonMessage: "Cronfree returned invalid JSON",
+        });
+    });
+}

package/src/providers/cufinder/executors.d.ts

@@ -0,0 +1,4 @@
+import type { CredentialValidators, ProviderExecutors, ProviderProxyExecutor } from "../../core/types.ts";
+export declare const executors: ProviderExecutors;
+export declare const proxy: ProviderProxyExecutor;
+export declare const credentialValidators: CredentialValidators;

package/src/providers/cufinder/executors.js

@@ -0,0 +1,105 @@
+import { compactObject, optionalRecord, optionalString } from "../../core/cast.js";
+import { defineApiKeyProviderExecutors, defineProviderProxy, providerInputError, ProviderRequestError, providerResponseError, providerUserAgent, readProviderJsonBody, requiredResponseRecord, runProviderRequest, } from "../provider-runtime.js";
+const service = "cufinder";
+const baseUrl = "https://api.cufinder.io/v3";
+const handlers = {
+    find_company_domain(input, context) {
+        return execute("/companies/name-to-domain", { name: trim(input.name), country_code: upper(input.countryCode), address: trim(input.address) }, context, (data, meta) => ({ domain: requireString(data.domain, "domain"), meta }));
+    },
+    find_company_name(input, context) {
+        return execute("/companies/domain-to-name", { domain: trim(input.domain) }, context, (data, meta) => ({
+            name: requireString(data.name, "name"),
+            meta,
+        }));
+    },
+    enrich_company(input, context) {
+        return execute("/companies/enrich", { query: trim(input.query) }, context, (data, meta) => ({
+            company: requiredResponseRecord(data.company, "cufinder company"),
+            meta,
+        }));
+    },
+    enrich_person(input, context) {
+        return execute("/people/enrich-by-name", { full_name: trim(input.fullName), company: trim(input.company) }, context, (data, meta) => ({ person: requiredResponseRecord(data.person, "cufinder person"), meta }));
+    },
+    enrich_person_by_email(input, context) {
+        return execute("/people/enrich-by-email", { email: trim(input.email) }, context, (data, meta) => ({
+            person: requiredResponseRecord(data.person, "cufinder person"),
+            meta,
+        }));
+    },
+};
+export const executors = defineApiKeyProviderExecutors(service, handlers, {
+    skipDnsValidation: true,
+});
+export const proxy = defineProviderProxy({
+    service,
+    baseUrl,
+    auth: { type: "api_key_header", name: "x-api-key" },
+    skipDnsValidation: true,
+});
+export const credentialValidators = {
+    async apiKey(input, { fetcher, signal }) {
+        await request("/normalize/url", { value: "https://cufinder.io" }, { apiKey: input.apiKey, fetcher, signal }, "validate");
+        return {
+            profile: { accountId: "cufinder-api-key", displayName: "CUFinder API Key" },
+            grantedScopes: [],
+            metadata: { apiBaseUrl: baseUrl, validationEndpoint: "/normalize/url" },
+        };
+    },
+};
+async function execute(path, body, context, normalize) {
+    const payload = await request(path, body, context, "execute");
+    return normalize(requiredResponseRecord(payload.data, "cufinder data"), requiredResponseRecord(payload.meta, "cufinder metadata"));
+}
+async function request(path, body, context, phase) {
+    return runProviderRequest({ signal: context.signal, label: "cufinder" }, async (signal) => {
+        const response = await context.fetcher(`${baseUrl}${path}`, {
+            method: "POST",
+            headers: {
+                accept: "application/json",
+                "content-type": "application/json",
+                "user-agent": providerUserAgent,
+                "x-api-key": context.apiKey,
+            },
+            body: JSON.stringify(compactObject(body)),
+            signal,
+        });
+        const decoded = await readProviderJsonBody(response, {
+            emptyBody: {},
+            invalidJsonMessage: "cufinder returned malformed JSON",
+            invalidJsonFallback: response.ok ? undefined : () => ({}),
+        });
+        const payload = optionalRecord(decoded) ?? {};
+        if (!response.ok)
+            throw makeError(response.status, payload, phase);
+        if (payload.success !== true)
+            throw makeError(response.status, payload, phase);
+        return payload;
+    });
+}
+function makeError(status, payload, phase) {
+    const error = optionalRecord(payload.error);
+    const code = optionalString(error?.code);
+    const message = optionalString(error?.message) ?? `cufinder request failed with status ${status}`;
+    if (code === "unauthorized")
+        return phase === "validate" ? providerInputError(message) : new ProviderRequestError(409, message, payload);
+    if (code === "rate_limited")
+        return new ProviderRequestError(429, message, payload);
+    if (["invalid_request", "validation_failed", "not_found"].includes(code ?? ""))
+        return providerInputError(message);
+    if (code === "request_timeout")
+        return new ProviderRequestError(504, message, payload);
+    return new ProviderRequestError(status >= 400 ? status : 502, message, payload);
+}
+function trim(value) {
+    return typeof value === "string" ? value.trim() : value;
+}
+function upper(value) {
+    return typeof value === "string" ? value.trim().toUpperCase() : value;
+}
+function requireString(value, field) {
+    const result = optionalString(value);
+    if (!result)
+        throw providerResponseError(`cufinder data.${field} must be a string`);
+    return result;
+}

package/src/providers/dropbox/executors.js

@@ -209,6 +209,24 @@ async function getMetadata(input, accessToken, fetcher) {
         metadata: mapDropboxMetadata(payload),
     };
 }
+/**
+ * Serialize a `Dropbox-API-Arg` header value.
+ *
+ * Dropbox requires this header to be ASCII: its own docs say `0x7F` and every
+ * non-ASCII character must be escaped as `\uXXXX`, which is also the range the
+ * official JS SDK escapes. `JSON.stringify` does not escape, and Node's `Headers`
+ * refuses a value outside ByteString, so a path containing any non-ASCII
+ * character threw `TypeError: Cannot convert argument to a ByteString` inside
+ * the runtime BEFORE the request was made. `provider-runtime.ts`'s fallback
+ * then reported it as a bare `internal_error`, discarding the cause.
+ *
+ * Measured 2026-09-18 against a real account: `/kkndme 天涯.pdf` failed in 1ms
+ * with no network call, while ASCII-path siblings downloaded in ~400ms. Dropbox
+ * itself accepts either spelling on the wire; only the header build was broken.
+ */
+function dropboxApiArg(arg) {
+    return JSON.stringify(arg).replace(/[\u007f-\uffff]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
 async function downloadFile(input, context) {
     const { accessToken, fetcher, transitFiles } = context;
     if (!transitFiles) {
@@ -218,7 +236,7 @@ async function downloadFile(input, context) {
         method: "POST",
         headers: {
             ...dropboxAuthHeaders(accessToken),
-            "Dropbox-API-Arg": JSON.stringify({
+            "Dropbox-API-Arg": dropboxApiArg({
                 path: requireString(input.path, "dropbox download path"),
             }),
         },
@@ -251,7 +269,7 @@ async function uploadFile(input, accessToken, fetcher) {
         headers: {
             ...dropboxAuthHeaders(accessToken),
             "Content-Type": source.mimeType || "application/octet-stream",
-            "Dropbox-API-Arg": JSON.stringify(arg),
+            "Dropbox-API-Arg": dropboxApiArg(arg),
         },
         body: Buffer.from(source.bytes),
     });
@@ -491,7 +509,7 @@ async function getSharedLinkFile(input, context) {
         method: "POST",
         headers: {
             ...dropboxAuthHeaders(accessToken),
-            "Dropbox-API-Arg": JSON.stringify(arg),
+            "Dropbox-API-Arg": dropboxApiArg(arg),
         },
         signal: context.signal,
     });

package/src/providers/elevenreader/runtime.js

@@ -1,7 +1,7 @@
 import { booleanString, compactObject, optionalBoolean, optionalInteger, optionalRecord, optionalString, requiredString, stringRecord, } from "../../core/cast.js";
 import { readBoundedResponseBytes } from "../../core/request.js";
 import { providerInputError, providerUserAgent, ProviderRequestError } from "../provider-runtime.js";
-const elevenreaderApiBaseUrl = "https://api.elevenlabs.io/v1";
+const elevenreaderApiOrigin = "https://api.elevenlabs.io";
 export const elevenreaderActionHandlers = {
     get_user_info(_input, context) {
         return getElevenreaderUserInfo(context);
@@ -74,7 +74,8 @@ async function getElevenreaderModels(context) {
 }
 async function searchElevenreaderVoices(input, context) {
     const payload = await requestElevenreaderJson({
-        path: "/voices/search",
+        path: "/voices",
+        version: "v2",
         query: compactObject({
             search: optionalString(input.search),
             category: optionalString(input.category),
@@ -163,7 +164,7 @@ async function readElevenreaderText(input, context) {
 }
 async function requestElevenreaderJson(input) {
     const hasBody = input.body !== undefined;
-    const response = await input.fetcher(buildElevenreaderUrl(input.path, input.query), {
+    const response = await input.fetcher(buildElevenreaderUrl(input.path, input.query, input.version), {
         method: hasBody ? "POST" : "GET",
         headers: hasBody ? elevenreaderJsonHeaders(input.apiKey) : elevenreaderHeaders(input.apiKey),
         body: hasBody ? JSON.stringify(input.body) : undefined,
@@ -174,8 +175,8 @@ async function requestElevenreaderJson(input) {
     }
     return readElevenreaderJson(response);
 }
-function buildElevenreaderUrl(path, query) {
-    const url = new URL(`${elevenreaderApiBaseUrl}${path}`);
+function buildElevenreaderUrl(path, query, version = "v1") {
+    const url = new URL(`${elevenreaderApiOrigin}/${version}${path}`);
     for (const [key, value] of Object.entries(query ?? {})) {
         if (value !== undefined) {
             url.searchParams.set(key, value);

package/src/providers/feishu_app_bot/scopes.js

@@ -15,6 +15,6 @@ export const feishuAppBotScopes = {
     groupAtReadonly: "im:message.group_at_msg:readonly",
     groupAtWithBotReadonly: "im:message.group_at_msg.include_bot:readonly",
     groupReadonly: "im:message.group_msg:readonly",
-    applicationRead: "application:application:readonly",
+    applicationRead: "application:application:self_manage",
     applicationVersionRead: "application:application.app_version:readonly",
 };

package/src/providers/gmail/attachment-stream.d.ts

@@ -0,0 +1,2 @@
+/** Decode MessagePartBody.data while retaining only a small JSON envelope and one base64 block. */
+export declare function decodeGmailAttachment(body: ReadableStream<Uint8Array>, maxBytes: number): ReadableStream<Uint8Array>;

package/src/providers/gmail/attachment-stream.js

@@ -0,0 +1,162 @@
+import { providerResponseError, ProviderRequestError } from "../provider-runtime.js";
+const chunkSize = 16 * 1024;
+const maxEnvelopeCharacters = 16 * 1024;
+/** Decode MessagePartBody.data while retaining only a small JSON envelope and one base64 block. */
+export function decodeGmailAttachment(body, maxBytes) {
+    const decoder = new TextDecoder("utf-8", { fatal: true });
+    const parser = new AttachmentParser(maxBytes);
+    return body.pipeThrough(new TransformStream({
+        transform(chunk, controller) {
+            for (let offset = 0; offset < chunk.length; offset += chunkSize) {
+                parser.push(decoder.decode(chunk.subarray(offset, offset + chunkSize), { stream: true }), controller);
+            }
+        },
+        flush(controller) {
+            parser.push(decoder.decode(), controller);
+            parser.finish();
+        },
+    }));
+}
+/** Strip only the top-level data string; JSON.parse validates the remaining bounded envelope at EOF. */
+class AttachmentParser {
+    maxBytes;
+    envelope = "";
+    depth = 0;
+    previous = "";
+    stringKind;
+    escaped = false;
+    keyToken = "";
+    key = "";
+    keys = new Set();
+    sawData = false;
+    dataEscape = "";
+    base64 = "";
+    padding = false;
+    sizeBytes = 0;
+    constructor(maxBytes) {
+        this.maxBytes = maxBytes;
+    }
+    push(text, controller) {
+        for (const character of text) {
+            if (this.stringKind === "data") {
+                this.pushData(character, controller);
+                continue;
+            }
+            this.envelope += character;
+            if (this.envelope.length > maxEnvelopeCharacters) {
+                throw providerResponseError("Gmail attachment JSON envelope is too large");
+            }
+            if (this.stringKind) {
+                if (this.stringKind === "key")
+                    this.keyToken += character;
+                if (this.escaped) {
+                    this.escaped = false;
+                }
+                else if (character === "\\") {
+                    this.escaped = true;
+                }
+                else if (character === '"') {
+                    if (this.stringKind === "key") {
+                        this.key = JSON.parse(this.keyToken);
+                        if (this.keys.has(this.key))
+                            throw providerResponseError("Duplicate Gmail attachment field");
+                        this.keys.add(this.key);
+                    }
+                    this.stringKind = undefined;
+                    this.previous = '"';
+                }
+                continue;
+            }
+            if (character === '"') {
+                if (this.depth === 1 && (this.previous === "{" || this.previous === ",")) {
+                    this.stringKind = "key";
+                    this.keyToken = '"';
+                }
+                else if (this.depth === 1 && this.previous === ":" && this.key === "data") {
+                    this.stringKind = "data";
+                    this.sawData = true;
+                }
+                else {
+                    this.stringKind = "other";
+                }
+            }
+            else if (character === "{" || character === "[") {
+                this.depth++;
+            }
+            else if (character === "}" || character === "]") {
+                this.depth--;
+            }
+            if (!/\s/.test(character))
+                this.previous = character;
+        }
+    }
+    finish() {
+        let envelope;
+        try {
+            envelope = JSON.parse(this.envelope);
+        }
+        catch {
+            throw providerResponseError("Invalid Gmail attachment JSON");
+        }
+        if (!this.sawData ||
+            this.stringKind ||
+            envelope?.data !== "" ||
+            !Number.isSafeInteger(envelope.size) ||
+            envelope.size !== this.sizeBytes) {
+            throw providerResponseError("Gmail attachment is incomplete or its size does not match");
+        }
+    }
+    pushData(character, controller) {
+        if (this.dataEscape) {
+            this.dataEscape += character;
+            if (this.dataEscape === "\\u" || (this.dataEscape.startsWith("\\u") && this.dataEscape.length < 6))
+                return;
+            try {
+                character = JSON.parse(`"${this.dataEscape}"`);
+            }
+            catch {
+                throw providerResponseError("Invalid Gmail attachment JSON escape");
+            }
+            this.dataEscape = "";
+        }
+        else if (character === "\\") {
+            this.dataEscape = character;
+            return;
+        }
+        else if (character === '"') {
+            // Buffer's decoder is permissive. Round-tripping the tail rejects bad padding and unused bits.
+            const tail = Buffer.from(this.base64, "base64url");
+            if (!/^[A-Za-z0-9_-]*={0,2}$/.test(this.base64) ||
+                (this.padding && this.base64.length % 4 !== 0) ||
+                tail.toString("base64url") !== this.base64.replace(/=+$/, "")) {
+                throw providerResponseError("Invalid Gmail attachment base64url data");
+            }
+            this.emit(tail, controller);
+            this.base64 = "";
+            this.stringKind = undefined;
+            this.previous = '"';
+            this.envelope += '"';
+            return;
+        }
+        if (!/^[A-Za-z0-9_=-]$/.test(character) || (this.padding && character !== "=")) {
+            throw providerResponseError("Invalid Gmail attachment base64url data");
+        }
+        this.padding ||= character === "=";
+        this.base64 += character;
+        if (this.padding && this.base64.length > chunkSize + 2) {
+            throw providerResponseError("Invalid Gmail attachment base64url padding");
+        }
+        if (!this.padding && this.base64.length === chunkSize) {
+            this.emit(Buffer.from(this.base64, "base64url"), controller);
+            this.base64 = "";
+        }
+    }
+    emit(bytes, controller) {
+        this.sizeBytes += bytes.length;
+        if (this.sizeBytes > this.maxBytes) {
+            throw new ProviderRequestError(413, `Gmail attachment exceeds transit file limit of ${this.maxBytes} bytes`);
+        }
+        if (bytes.length)
+            controller.enqueue(bytes);
+    }
+}

package/src/providers/gmail/executors.d.ts

@@ -1,10 +1,12 @@
-import type { CredentialValidators, ProviderExecutors, ProviderProxyExecutor } from "../../core/types.ts";
+import type { CredentialValidators, ExecutionContext, ProviderExecutors, ProviderProxyExecutor } from "../../core/types.ts";
 import type { ProviderActionHandlers } from "../provider-runtime.ts";
 declare const service = "gmail";
 interface ActionContext {
     userId: string;
     accessToken: string;
     fetcher: typeof fetch;
+    transitFiles?: ExecutionContext["transitFiles"];
+    signal?: AbortSignal;
 }
 type ActionHandler = (input: Record<string, unknown>, context: ActionContext) => Promise<unknown>;
 export declare const gmailActionHandlers: ProviderActionHandlers<typeof service, ActionHandler>;

package/src/providers/gmail/executors.js

@@ -1,12 +1,40 @@
+import { looseArray, optionalRecord, optionalString } from "../../core/cast.js";
+import { encodePathSegment } from "../../core/request.js";
 import { googleBearerProxyAuth, googleServiceAccountValidator, resolveGoogleAccessToken } from "../google-auth.js";
-import { defineProviderExecutors, defineProviderProxy, ProviderRequestError, readProviderJsonBody, } from "../provider-runtime.js";
+import { defineProviderExecutors, defineProviderProxy, ProviderRequestError, readProviderErrorTextBody, readProviderJsonBody, requiredInputString, runProviderRequest, } from "../provider-runtime.js";
+import { decodeGmailAttachment } from "./attachment-stream.js";
 import { buildRecipients, encodeMimeMessage, extractBodyContent, firstAddress, normalizeGmailMessage, normalizeMessageId, normalizeThreadId, parseAddressList, readHeader, resolveReplyHeaders, summarizeGmailMessage, } from "./message.js";
 import { gmailOAuthScopes } from "./scopes.js";
 const service = "gmail";
 const gmailApiBaseUrl = "https://gmail.googleapis.com/gmail/v1";
 const detailHydrationBatchSize = 10;
+// Attachments may reach Gmail's 25 MB cap, and the base64 JSON envelope is a third larger again;
+// the default 30 s request budget covers fetch, decode, and disk write, so give this transfer longer.
+const attachmentDownloadTimeoutMs = 120_000;
 const defaultFetchEmailsMaxResults = 20;
 export const gmailActionHandlers = {
+    async download_attachment(input, context) {
+        const { transitFiles, fetcher, accessToken } = context;
+        if (!transitFiles?.createFromStream) {
+            throw new ProviderRequestError(400, "Gmail attachment downloads require a streaming transit file backend (filesystem).");
+        }
+        const messageId = requiredInputString(input.messageId, "messageId");
+        const attachmentId = requiredInputString(input.attachmentId, "attachmentId");
+        const userId = optionalString(input.userId) ?? context.userId;
+        const url = `${gmailUserUrl(userId, "messages")}/${encodePathSegment(messageId)}/attachments/${encodePathSegment(attachmentId)}?fields=data,size`;
+        return runProviderRequest({ signal: context.signal, label: "Gmail attachment", timeoutMs: attachmentDownloadTimeoutMs }, async (signal) => {
+            const response = await fetcher(url, { headers: { authorization: `Bearer ${accessToken}` }, signal });
+            await assertGmailResponse(response);
+            if (!response.body)
+                throw new ProviderRequestError(502, "Gmail attachment response has no body");
+            return transitFiles.createFromStream({
+                body: decodeGmailAttachment(response.body, transitFiles.maxBytes),
+                name: optionalString(input.fileName) ?? "attachment",
+                mimeType: optionalString(input.mimeType) ?? "application/octet-stream",
+                signal,
+            });
+        });
+    },
     async search_threads(input, { userId, accessToken, fetcher }) {
         const output = await listThreads(input, userId, accessToken, fetcher);
         return {
@@ -175,13 +203,20 @@ export const executors = defineProviderExecutors({
             fetcher,
             signal: context.signal,
         });
-        return { userId: "me", accessToken: resolved.accessToken, fetcher };
+        return {
+            userId: "me",
+            accessToken: resolved.accessToken,
+            fetcher,
+            transitFiles: context.transitFiles,
+            signal: context.signal,
+        };
     },
 });
 export const proxy = defineProviderProxy({
     service,
     baseUrl: gmailApiBaseUrl,
     auth: googleBearerProxyAuth(gmailOAuthScopes),
+    readError: readGmailError,
 });
 export const credentialValidators = {
     async oauth2(input, { fetcher }) {
@@ -733,31 +768,24 @@ async function assertGmailResponse(response) {
     if (response.ok) {
         return;
     }
-    const text = await response.text().catch(() => "");
-    const message = readGmailErrorMessage(text) || `gmail request failed with ${response.status}`;
-    if (response.status === 400) {
-        throw new ProviderRequestError(400, message);
-    }
-    if (response.status === 401 || response.status === 403) {
-        throw new ProviderRequestError(response.status, message);
-    }
-    if (response.status === 429) {
-        throw new ProviderRequestError(429, message);
-    }
-    throw new ProviderRequestError(response.status, message);
-}
-function readGmailErrorMessage(text) {
-    if (!text) {
-        return "";
-    }
+    throw await readGmailError(response);
+}
+const gmailQuotaReasons = new Set([
+    "rateLimitExceeded",
+    "userRateLimitExceeded",
+    "dailyLimitExceeded",
+    "quotaExceeded",
+]);
+async function readGmailError(response) {
+    const text = await readProviderErrorTextBody(response, "gmail error response");
+    let error;
     try {
-        const payload = JSON.parse(text);
-        if (typeof payload.error === "string") {
-            return payload.error;
-        }
-        return payload.error?.message ?? text;
+        error = optionalRecord(optionalRecord(JSON.parse(text))?.error);
     }
     catch {
-        return text;
+        // A malformed response must not expose its raw body or change status classification.
     }
+    const rateLimited = response.status === 403 &&
+        looseArray(error?.errors).some((entry) => gmailQuotaReasons.has(optionalString(optionalRecord(entry)?.reason) ?? ""));
+    return new ProviderRequestError(response.status, optionalString(error?.message) ?? `gmail request failed with ${response.status}`, undefined, rateLimited ? "rate_limited" : undefined);
 }