@oomol-lab/open-connector 1.6.5 → 1.7.0

package/src/providers/futunn/executors.js

@@ -0,0 +1,24 @@
+import { defineOAuthProviderExecutors, defineProviderProxy } from "../provider-runtime.js";
+import { futunnActions } from "./actions.js";
+import { executeFutunnAction } from "./runtime.js";
+import { futunnApiBaseUrl } from "./transport.js";
+const service = "futunn";
+function createHandler(actionName) {
+    return (input, context) => executeFutunnAction({
+        actionName,
+        input,
+        accessToken: context.accessToken,
+        signal: context.signal,
+    }, context.fetcher);
+}
+const handlers = Object.fromEntries(futunnActions.map((action) => [action.name, createHandler(action.name)]));
+export const executors = defineOAuthProviderExecutors(service, handlers);
+export const proxy = defineProviderProxy({
+    service,
+    baseUrl: futunnApiBaseUrl,
+    auth: { type: "oauth_bearer" },
+    skipDnsValidation: true,
+    customizeRequest({ headers }) {
+        headers.set("accept", "application/json");
+    },
+});

package/src/providers/futunn/runtime-research.d.ts

@@ -0,0 +1,3 @@
+import type { FutunnActionInput } from "./transport.ts";
+export declare function isFutunnResearchAction(name: string): boolean;
+export declare function executeFutunnResearchAction(input: FutunnActionInput, fetcher: typeof fetch): Promise<unknown>;

package/src/providers/futunn/runtime-research.js

@@ -0,0 +1,133 @@
+import { optionalNumber, optionalRecord } from "../../core/cast.js";
+import { ProviderRequestError, requiredInputString, requiredResponseRecord } from "../provider-runtime.js";
+import { futunnResearchActions } from "./actions.research.js";
+import { readFutunnData, readFutunnList, requestFutunn } from "./transport.js";
+const researchNames = new Set(futunnResearchActions.map((action) => action.name));
+export function isFutunnResearchAction(name) {
+    return researchNames.has(name);
+}
+export async function executeFutunnResearchAction(input, fetcher) {
+    const v = input.input;
+    const request = (path, query, body, allowNoData = false) => requestFutunn(input, fetcher, path, query, body, allowNoData);
+    const securityPath = (suffix) => `/api/v1.0/quote/${encodeURIComponent(requiredInputString(v.symbol, "symbol"))}/${suffix}`;
+    switch (input.actionName) {
+        case "search_news":
+        case "search_community": {
+            const news = input.actionName === "search_news";
+            const envelope = await request(`/api/v1.0/quote/${news ? "find-news" : "find-community"}`, {
+                symbol: v.keyword,
+                size: v.size,
+                [news ? "news_type" : "community_type"]: v.type,
+                sort_type: v.sortType,
+                lang: v.language,
+            });
+            return { items: readFutunnList(readFutunnData(envelope), "search results") };
+        }
+        case "get_security_info": {
+            const data = requiredResponseRecord(readFutunnData(await request("/api/v1.0/quote/stock-basicinfo", {}, { code_list: v.symbols })), "Futunn security info");
+            return { securities: readFutunnList(data.basic_list, "basic_list") };
+        }
+        case "get_market_state": {
+            const data = requiredResponseRecord(readFutunnData(await request("/api/v1.0/quote/market-state", {}, {
+                code_list: v.symbols,
+                is_contain_ba: v.includePreAfterMarket,
+                is_contain_overnight: v.includeOvernight,
+                is_need_crypto_multi_broker: v.includeCryptoBrokers,
+            })), "Futunn market state");
+            return { states: readFutunnList(data.market_state_list, "market_state_list") };
+        }
+        case "screen_stocks": {
+            const envelope = await request("/api/v1.0/quote/stock-screen", {}, {
+                screen_queries: v.screenQueries,
+                retrieve_queries: v.retrieveQueries,
+                sort: v.sort,
+                sorts: v.sorts,
+                next_key: v.nextKey,
+                limit: v.limit,
+                watchlist_stock_ids: v.watchlistStockIds,
+                holding_stock_ids: v.holdingStockIds,
+                user_stock_list_mode: v.userStockListMode,
+            });
+            const data = requiredResponseRecord(readFutunnData(envelope), "Futunn screening data");
+            return {
+                items: readFutunnList(data.items, "screening items"),
+                pagination: optionalRecord(envelope.pagination) ?? null,
+            };
+        }
+        case "get_financial_statements": {
+            const envelope = await request(securityPath("financials/statements"), {
+                statement_type: v.statementType,
+                financial_type: v.financialType,
+                currency_code: v.currencyCode,
+                next_key: v.nextKey,
+                limit: v.limit,
+            }, undefined, true);
+            const noData = envelope.ret_code === -10;
+            const data = noData ? null : requiredResponseRecord(readFutunnData(envelope), "Futunn financial statements");
+            return {
+                reports: data === null ? [] : readFutunnList(data.report_list, "report_list"),
+                pagination: optionalRecord(envelope.pagination) ?? null,
+                noData,
+            };
+        }
+        case "get_revenue_breakdown": {
+            const envelope = await request(securityPath("financials/revenue-breakdown"), { date: v.date, financial_type: v.financialType, currency_code: v.currencyCode }, undefined, true);
+            const noData = envelope.ret_code === -10;
+            return {
+                revenue: noData ? null : requiredResponseRecord(readFutunnData(envelope), "Futunn revenue breakdown"),
+                noData,
+            };
+        }
+        case "get_operational_efficiency": {
+            const envelope = await request(securityPath("company/operational-efficiency"), {
+                limit: v.limit,
+                financial_type: v.financialType,
+                currency_code: v.currencyCode,
+                next_key: v.nextKey,
+            }, undefined, true);
+            const noData = envelope.ret_code === -10;
+            return {
+                efficiency: noData ? null : requiredResponseRecord(readFutunnData(envelope), "Futunn operational efficiency"),
+                pagination: optionalRecord(envelope.pagination) ?? null,
+                noData,
+            };
+        }
+        case "get_valuation":
+            return {
+                valuation: requiredResponseRecord(readFutunnData(await request(securityPath("valuation/detail"), {
+                    valuation_type: v.valuationType,
+                    interval_type: v.intervalType,
+                })), "Futunn valuation"),
+            };
+        case "get_capital_flow": {
+            const data = requiredResponseRecord(readFutunnData(await request(securityPath("capital-flow"), { section: v.section })), "Futunn capital flow");
+            return {
+                flows: readFutunnList(data.flow_list, "flow_list"),
+                lastValidTime: optionalNumber(data.last_valid_time) ?? null,
+            };
+        }
+        case "get_capital_flow_history": {
+            const envelope = await request(securityPath("capital-flow/history"), {
+                period_type: v.periodType,
+                start: v.start,
+                end: v.end,
+                count: v.count,
+            });
+            const data = requiredResponseRecord(readFutunnData(envelope), "Futunn capital flow history");
+            return {
+                flows: readFutunnList(data.flow_list, "flow_list"),
+                pagination: optionalRecord(envelope.pagination) ?? null,
+            };
+        }
+        case "get_capital_distribution": {
+            const envelope = await request(securityPath("capital-distribution"), {}, undefined, true);
+            const noData = envelope.ret_code === -10;
+            return {
+                distribution: noData ? null : requiredResponseRecord(readFutunnData(envelope), "Futunn capital distribution"),
+                noData,
+            };
+        }
+        default:
+            throw new ProviderRequestError(400, `Unknown Futunn research action: ${input.actionName}`);
+    }
+}

package/src/providers/futunn/runtime-trading.d.ts

@@ -0,0 +1,3 @@
+import type { FutunnActionInput } from "./transport.ts";
+export declare function isFutunnTradingAction(name: string): boolean;
+export declare function executeFutunnTradingAction(input: FutunnActionInput, fetcher: typeof fetch): Promise<unknown>;

package/src/providers/futunn/runtime-trading.js

@@ -0,0 +1,39 @@
+import { optionalBoolean, optionalString } from "../../core/cast.js";
+import { ProviderRequestError, requiredInputString, requiredResponseRecord } from "../provider-runtime.js";
+import { futunnTradingActions } from "./actions.trading.js";
+import { readFutunnData, readFutunnList, requestFutunn } from "./transport.js";
+const tradingNames = new Set(futunnTradingActions.map((action) => action.name));
+export function isFutunnTradingAction(name) {
+    return tradingNames.has(name);
+}
+const listEndpoints = {
+    list_open_orders: { path: "orders", field: "orders", history: false },
+    list_history_orders: { path: "orders_history", field: "orders", history: true },
+    list_today_deals: { path: "order_fills", field: "order_fills", history: false },
+    list_history_deals: { path: "fills_history", field: "order_fills", history: true },
+};
+export async function executeFutunnTradingAction(input, fetcher) {
+    const v = input.input;
+    const path = `/api/v1.0/accounts/${encodeURIComponent(requiredInputString(v.accountId, "accountId"))}`;
+    if (input.actionName === "get_order_details") {
+        const envelope = await requestFutunn(input, fetcher, `${path}/orders/detail`, {}, { exchange: v.exchange, order_ids: v.orderIds });
+        return { orders: readFutunnList(readFutunnData(envelope), "order details") };
+    }
+    const endpoint = listEndpoints[input.actionName];
+    if (!endpoint)
+        throw new ProviderRequestError(400, `Unknown Futunn trading action: ${input.actionName}`);
+    const envelope = await requestFutunn(input, fetcher, `${path}/${endpoint.path}`, {
+        trd_market: v.market,
+        page_flag: v.pageFlag ?? "",
+        page_size: v.pageSize,
+        code: endpoint.history ? v.code : undefined,
+        start: endpoint.history ? v.start : undefined,
+        end: endpoint.history ? v.end : undefined,
+    });
+    const data = requiredResponseRecord(readFutunnData(envelope), "Futunn account records");
+    return {
+        [endpoint.field === "orders" ? "orders" : "deals"]: readFutunnList(data[endpoint.field], endpoint.field),
+        pageFlag: optionalString(data.page_flag) ?? null,
+        completed: optionalBoolean(data.completed) ?? null,
+    };
+}

package/src/providers/futunn/runtime.d.ts

@@ -0,0 +1,2 @@
+import type { FutunnActionInput } from "./transport.ts";
+export declare function executeFutunnAction(input: FutunnActionInput, fetcher: typeof fetch): Promise<unknown>;

package/src/providers/futunn/runtime.js

@@ -0,0 +1,50 @@
+import { optionalNumber } from "../../core/cast.js";
+import { requiredInputString, requiredResponseRecord } from "../provider-runtime.js";
+import { executeFutunnResearchAction, isFutunnResearchAction } from "./runtime-research.js";
+import { executeFutunnTradingAction, isFutunnTradingAction } from "./runtime-trading.js";
+import { readFutunnData, readFutunnList, requestFutunn } from "./transport.js";
+export async function executeFutunnAction(input, fetcher) {
+    const values = input.input;
+    const request = (path, query, body) => requestFutunn(input, fetcher, path, query, body).then(readFutunnData);
+    if (isFutunnResearchAction(input.actionName))
+        return executeFutunnResearchAction(input, fetcher);
+    if (isFutunnTradingAction(input.actionName))
+        return executeFutunnTradingAction(input, fetcher);
+    switch (input.actionName) {
+        case "get_market_snapshot": {
+            const data = requiredResponseRecord(await request("/api/v1.0/quote/snapshot", {}, { code_list: values.symbols }), "Futunn snapshot data");
+            return { snapshots: readFutunnList(data.snapshot_list, "snapshot_list") };
+        }
+        case "get_history_kline": {
+            const data = requiredResponseRecord(await request(`/api/v1.0/quote/${encodeURIComponent(requiredInputString(values.symbol, "symbol"))}/history-kline`, {
+                start: values.start,
+                end: values.end,
+                ktype: values.ktype,
+                autype: values.autype,
+                num: values.num,
+                extended_time: values.extendedTime,
+            }), "Futunn history data");
+            return {
+                bars: readFutunnList(data.kline_list, "kline_list"),
+                nextTime: optionalNumber(data.next_time) ?? null,
+                volumePrecision: optionalNumber(data.volume_precision) ?? null,
+            };
+        }
+        case "list_trading_days": {
+            const data = requiredResponseRecord(await request("/api/v1.0/quote/trading-days", values), "Futunn calendar data");
+            return { tradingDays: readFutunnList(data.trading_days, "trading_days") };
+        }
+        case "list_accounts": {
+            const data = requiredResponseRecord(await request("/api/v1.0/accounts/authorized_trd_accs"), "Futunn account data");
+            return { accounts: readFutunnList(data.accounts, "accounts") };
+        }
+        case "get_account_funds":
+            return {
+                funds: requiredResponseRecord(await request(`/api/v1.0/accounts/${encodeURIComponent(requiredInputString(values.accountId, "accountId"))}/funds`, { currency: values.currency }), "Futunn funds"),
+            };
+        case "list_positions":
+            return {
+                positions: readFutunnList(await request(`/api/v1.0/accounts/${encodeURIComponent(requiredInputString(values.accountId, "accountId"))}/positions`, { code: values.code, pl_ratio_min: values.plRatioMin, pl_ratio_max: values.plRatioMax }), "positions"),
+            };
+    }
+}

package/src/providers/futunn/transport.d.ts

@@ -0,0 +1,11 @@
+export interface FutunnActionInput {
+    actionName: string;
+    input: Record<string, unknown>;
+    accessToken: string;
+    signal?: AbortSignal;
+}
+export declare const futunnApiBaseUrl = "https://webapi.futunn.com";
+export declare function readFutunnResponse(response: Response, allowNoData?: boolean): Promise<Record<string, unknown>>;
+export declare function requestFutunn(input: FutunnActionInput, fetcher: typeof fetch, path: string, query?: Record<string, unknown>, body?: unknown, allowNoData?: boolean): Promise<Record<string, unknown>>;
+export declare function readFutunnList(value: unknown, label: string): unknown[];
+export declare function readFutunnData(envelope: Record<string, unknown>): unknown;

package/src/providers/futunn/transport.js

@@ -0,0 +1,76 @@
+import { optionalRecord, optionalString } from "../../core/cast.js";
+import { ProviderRequestError, providerUserAgent, requiredResponseRecord, runProviderRequest, } from "../provider-runtime.js";
+export const futunnApiBaseUrl = "https://webapi.futunn.com";
+export async function readFutunnResponse(response, allowNoData = false) {
+    let payload;
+    try {
+        payload = JSON.parse(await response.text(), (key, value, context) => {
+            // Preserve the source decimal text of uint64 trading account IDs during JSON parsing.
+            if (key !== "account_id" || typeof value !== "number")
+                return value;
+            if (!Number.isInteger(value))
+                throw new Error("Invalid Futunn account ID");
+            if (Number.isSafeInteger(value))
+                return String(value);
+            if (!context?.source)
+                throw new Error("Futunn account ID source is unavailable");
+            return BigInt(context.source).toString();
+        });
+    }
+    catch {
+        throw new ProviderRequestError(response.ok ? 502 : response.status, "Futunn returned invalid JSON");
+    }
+    const envelope = requiredResponseRecord(payload, "Futunn response");
+    if (response.ok && allowNoData && envelope.ret_code === -10)
+        return envelope;
+    const error = optionalRecord(envelope.error);
+    if (!response.ok ||
+        envelope.s === "error" ||
+        (envelope.ret_code !== undefined && envelope.ret_code !== 0) ||
+        envelope.error) {
+        const message = optionalString(envelope.errmsg) ??
+            optionalString(envelope.ret_msg) ??
+            optionalString(envelope.error_description) ??
+            optionalString(error?.message) ??
+            optionalString(envelope.error) ??
+            "request failed";
+        const code = envelope.errcode ?? envelope.ret_code ?? error?.code;
+        throw new ProviderRequestError(response.ok ? 502 : response.status, `Futunn${code === undefined ? "" : ` (${String(code)})`}: ${message}`);
+    }
+    return envelope;
+}
+export async function requestFutunn(input, fetcher, path, query = {}, body, allowNoData = false) {
+    const url = new URL(path, futunnApiBaseUrl);
+    for (const [key, value] of Object.entries(query)) {
+        if (value !== undefined)
+            url.searchParams.set(key, String(value));
+    }
+    return runProviderRequest({ label: "Futunn", signal: input.signal }, async (signal) => {
+        const response = await fetcher(url, {
+            method: body === undefined ? "GET" : "POST",
+            headers: {
+                authorization: `Bearer ${input.accessToken}`,
+                accept: "application/json",
+                "content-type": "application/json",
+                "user-agent": providerUserAgent,
+            },
+            body: body === undefined ? undefined : JSON.stringify(body),
+            signal,
+            redirect: "manual",
+        });
+        const envelope = await readFutunnResponse(response, allowNoData);
+        if (envelope.s === "ok" || envelope.ret_code === 0 || (allowNoData && envelope.ret_code === -10))
+            return envelope;
+        throw new ProviderRequestError(502, "Futunn response is missing its success envelope");
+    });
+}
+export function readFutunnList(value, label) {
+    if (!Array.isArray(value))
+        throw new ProviderRequestError(502, `Futunn ${label} must be an array`);
+    return value;
+}
+export function readFutunnData(envelope) {
+    if (envelope.ret_code === -10)
+        return null;
+    return envelope.s === "ok" ? envelope.d : envelope.data;
+}

package/src/providers/gildata/executors.js

@@ -202,7 +202,7 @@ function buildGildataMcpInput(serverType, apiKey, fetcher, parentSignal, request
             }
             return response;
         },
-        redirect: "error",
+        redirect: "manual",
         terminateSession: true,
         signal: parentSignal,
         requestTimeoutMs,

package/src/providers/gmail/executors.js

@@ -1,7 +1,7 @@
 import { looseArray, optionalRecord, optionalString } from "../../core/cast.js";
 import { encodePathSegment } from "../../core/request.js";
-import { googleBearerProxyAuth, googleServiceAccountValidator, resolveGoogleAccessToken } from "../google-auth.js";
-import { defineProviderExecutors, defineProviderProxy, ProviderRequestError, readProviderErrorTextBody, readProviderJsonBody, requiredInputString, runProviderRequest, } from "../provider-runtime.js";
+import { googleBearerProxyAuth, googleServiceAccountValidator, resolveGoogleAccessToken, } from "../googledrive/runtime-auth.js";
+import { defineProviderExecutors, defineProviderProxy, ProviderRequestError, readProviderErrorTextBody, readProviderJsonBody, requiredInputString, runProviderRequest, withRetryAfterSeconds, } from "../provider-runtime.js";
 import { decodeGmailAttachment } from "./attachment-stream.js";
 import { buildRecipients, encodeMimeMessage, extractBodyContent, firstAddress, normalizeGmailMessage, normalizeMessageId, normalizeThreadId, parseAddressList, readHeader, resolveReplyHeaders, summarizeGmailMessage, } from "./message.js";
 import { gmailOAuthScopes } from "./scopes.js";
@@ -787,5 +787,5 @@ async function readGmailError(response) {
     }
     const rateLimited = response.status === 403 &&
         looseArray(error?.errors).some((entry) => gmailQuotaReasons.has(optionalString(optionalRecord(entry)?.reason) ?? ""));
-    return new ProviderRequestError(response.status, optionalString(error?.message) ?? `gmail request failed with ${response.status}`, undefined, rateLimited ? "rate_limited" : undefined);
+    return new ProviderRequestError(response.status, optionalString(error?.message) ?? `gmail request failed with ${response.status}`, withRetryAfterSeconds(response), rateLimited ? "rate_limited" : undefined);
 }

package/src/providers/gmail/message.d.ts

@@ -20,6 +20,7 @@ export interface GmailMessageResource {
     internalDate?: string;
     labelIds?: string[];
     snippet?: string;
+    sizeEstimate?: number;
     raw?: string;
     payload?: GmailMessagePart;
 }
@@ -39,13 +40,7 @@ export interface GmailAttachmentSummary {
     mimeType: string;
     size: number;
 }
-export interface NormalizedGmailMessage {
-    messageId: string;
-    threadId: string;
-    labelIds: string[];
-    subject: string;
-    sender: string;
-    to: string;
+export interface NormalizedGmailMessage extends GmailMessageSummary {
     preview: {
         subject: string;
         body: string;
@@ -53,7 +48,6 @@ export interface NormalizedGmailMessage {
     payload: GmailMessagePart | null;
     messageText: string;
     attachmentList: GmailAttachmentSummary[];
-    messageTimestamp: string;
     raw?: string;
 }
 export interface GmailMessageSummary {
@@ -64,6 +58,10 @@ export interface GmailMessageSummary {
     sender: string;
     to: string;
     messageTimestamp: string;
+    historyId?: string;
+    internalDate?: string;
+    sizeEstimate?: number;
+    snippet?: string;
 }
 export interface MimeMessageInput {
     to: string[];

package/src/providers/gmail/message.js

@@ -8,6 +8,10 @@ export function summarizeGmailMessage(resource) {
         sender: readHeader(headers, "From"),
         to: readHeader(headers, "To"),
         messageTimestamp: toMessageTimestamp(resource.internalDate, readHeader(headers, "Date")),
+        historyId: resource.historyId,
+        internalDate: resource.internalDate,
+        sizeEstimate: resource.sizeEstimate,
+        snippet: resource.snippet,
     };
 }
 export function normalizeGmailMessage(resource) {

package/src/providers/gmail/scopes.d.ts

@@ -10,4 +10,36 @@ export declare const gmailComposeScopes: string[];
 export declare const gmailSendScopes: string[];
 export declare const gmailLabelScopes: string[];
 export declare const gmailSettingsBasicScopes: string[];
+/**
+ * The scopes a SERVICE ACCOUNT token is minted for, and the ones the proxy
+ * resolves with. Unchanged: a domain-wide-delegation grant lists these exact
+ * scopes in the Workspace admin console, and a token request naming a scope the
+ * admin has not authorized fails outright — so this list cannot grow without
+ * breaking every existing service-account connection.
+ */
 export declare const gmailOAuthScopes: string[];
+/**
+ * The scopes a user OAuth authorization may request — the menu, not a minimum.
+ *
+ * `gmail.readonly` is here and not in {@link gmailOAuthScopes} because the two
+ * lists answer different questions. That one asks "what does a service account
+ * token need to cover every action"; `modify` subsumes `readonly` there, so
+ * adding it would be redundant at best and, through domain-wide delegation,
+ * breaking at worst.
+ *
+ * This one is what `filterDeclaredScopes` intersects a caller's
+ * `requestedScopes` against, so a scope absent here cannot be requested AT ALL.
+ * Leaving `readonly` out therefore forced every read-only integration to
+ * authorize `gmail.modify` — write, label and trash on the user's mailbox — in
+ * order to call actions that declare `gmailReadScopes`. That is the opposite of
+ * least privilege, and it is invisible: consent succeeds, so nothing reports
+ * that more was granted than the integration can use.
+ *
+ * Note for anyone storing a client config WITHOUT `requestedScopes`:
+ * `getEffectiveScopes` falls back to this whole list, so such a config now asks
+ * for four scopes rather than three. `readonly` is subsumed by `modify`, so no
+ * new capability is granted — but the consent screen gains a line, and a
+ * deployment that wants the narrow set should say so explicitly with
+ * `requestedScopes`, which is the correct posture regardless.
+ */
+export declare const gmailAuthorizableScopes: string[];

package/src/providers/gmail/scopes.js

@@ -10,4 +10,41 @@ export const gmailComposeScopes = [gmailComposeScope];
 export const gmailSendScopes = [gmailSendScope];
 export const gmailLabelScopes = [gmailLabelsScope];
 export const gmailSettingsBasicScopes = [gmailSettingsBasicScope];
+/**
+ * The scopes a SERVICE ACCOUNT token is minted for, and the ones the proxy
+ * resolves with. Unchanged: a domain-wide-delegation grant lists these exact
+ * scopes in the Workspace admin console, and a token request naming a scope the
+ * admin has not authorized fails outright — so this list cannot grow without
+ * breaking every existing service-account connection.
+ */
 export const gmailOAuthScopes = [gmailModifyScope, gmailLabelsScope, gmailSettingsBasicScope];
+/**
+ * The scopes a user OAuth authorization may request — the menu, not a minimum.
+ *
+ * `gmail.readonly` is here and not in {@link gmailOAuthScopes} because the two
+ * lists answer different questions. That one asks "what does a service account
+ * token need to cover every action"; `modify` subsumes `readonly` there, so
+ * adding it would be redundant at best and, through domain-wide delegation,
+ * breaking at worst.
+ *
+ * This one is what `filterDeclaredScopes` intersects a caller's
+ * `requestedScopes` against, so a scope absent here cannot be requested AT ALL.
+ * Leaving `readonly` out therefore forced every read-only integration to
+ * authorize `gmail.modify` — write, label and trash on the user's mailbox — in
+ * order to call actions that declare `gmailReadScopes`. That is the opposite of
+ * least privilege, and it is invisible: consent succeeds, so nothing reports
+ * that more was granted than the integration can use.
+ *
+ * Note for anyone storing a client config WITHOUT `requestedScopes`:
+ * `getEffectiveScopes` falls back to this whole list, so such a config now asks
+ * for four scopes rather than three. `readonly` is subsumed by `modify`, so no
+ * new capability is granted — but the consent screen gains a line, and a
+ * deployment that wants the narrow set should say so explicitly with
+ * `requestedScopes`, which is the correct posture regardless.
+ */
+export const gmailAuthorizableScopes = [
+    gmailReadonlyScope,
+    gmailModifyScope,
+    gmailLabelsScope,
+    gmailSettingsBasicScope,
+];

package/src/providers/google_analytics/executors.js

@@ -1,6 +1,6 @@
 import { compactObject, objectArray, optionalBooleanOrNull, optionalIntegerOrNull, optionalObjectArray, optionalRecord as asOptionalObject, optionalScalarString, optionalString as optionalNonEmptyString, optionalStringOrNull, requiredRecord, } from "../../core/cast.js";
-import { defineGoogleProviderExecutors, googleBearerProxyAuth, googleServiceAccountValidator } from "../google-auth.js";
-import { googleJsonRequest } from "../google-runtime.js";
+import { defineGoogleProviderExecutors, googleBearerProxyAuth, googleServiceAccountValidator, } from "../googledrive/runtime-auth.js";
+import { googleJsonRequest } from "../googledrive/runtime-request.js";
 import { defineProviderProxy, ProviderRequestError } from "../provider-runtime.js";
 import { googleAnalyticsOAuthScopes } from "./scopes.js";
 const service = "google_analytics";

package/src/providers/google_analytics/scopes.js

@@ -1,5 +1,10 @@
+import { googleIdentityScopes } from "../googleads/scopes.js";
 export const googleAnalyticsReadonlyScope = "https://www.googleapis.com/auth/analytics.readonly";
 export const googleAnalyticsEditScope = "https://www.googleapis.com/auth/analytics.edit";
 export const googleAnalyticsReadScopes = [googleAnalyticsReadonlyScope];
 export const googleAnalyticsWriteScopes = [googleAnalyticsEditScope];
-export const googleAnalyticsOAuthScopes = [googleAnalyticsReadonlyScope, googleAnalyticsEditScope];
+export const googleAnalyticsOAuthScopes = [
+    googleAnalyticsReadonlyScope,
+    googleAnalyticsEditScope,
+    ...googleIdentityScopes,
+];

package/src/providers/google_bigquery/executors.js

@@ -1,6 +1,6 @@
 import { booleanString, compactObject, optionalBoolean, optionalInteger as asOptionalInteger, requiredRecord, } from "../../core/cast.js";
-import { defineGoogleProviderExecutors, googleBearerProxyAuth, googleServiceAccountValidator } from "../google-auth.js";
-import { googleJsonRequest, googleRequest } from "../google-runtime.js";
+import { defineGoogleProviderExecutors, googleBearerProxyAuth, googleServiceAccountValidator, } from "../googledrive/runtime-auth.js";
+import { googleJsonRequest, googleRequest } from "../googledrive/runtime-request.js";
 import { defineProviderProxy, ProviderRequestError } from "../provider-runtime.js";
 import { googleBigQueryOAuthScopes } from "./scopes.js";
 const bigQueryApiBaseUrl = "https://bigquery.googleapis.com/bigquery/v2";

package/src/providers/google_bigquery/scopes.js

@@ -1,3 +1,4 @@
+import { googleIdentityScopes } from "../googleads/scopes.js";
 export const bigQueryScope = "https://www.googleapis.com/auth/bigquery";
 export const bigQueryReadOnlyScope = "https://www.googleapis.com/auth/bigquery.readonly";
 export const bigQueryInsertDataScope = "https://www.googleapis.com/auth/bigquery.insertdata";
@@ -14,4 +15,5 @@ export const googleBigQueryOAuthScopes = [
     bigQueryInsertDataScope,
     devStorageReadOnlyScope,
     devStorageReadWriteScope,
+    ...googleIdentityScopes,
 ];

package/src/providers/google_search_console/executors.js

@@ -1,6 +1,6 @@
 import { compactObject, optionalNumber, optionalRecord as asOptionalObject, optionalString as asOptionalString, pickOptionalInteger, pickOptionalString as pickNonEmptyString, } from "../../core/cast.js";
-import { defineGoogleProviderExecutors, googleBearerProxyAuth, googleServiceAccountValidator } from "../google-auth.js";
-import { googleJsonRequest, googleRequest } from "../google-runtime.js";
+import { defineGoogleProviderExecutors, googleBearerProxyAuth, googleServiceAccountValidator, } from "../googledrive/runtime-auth.js";
+import { googleJsonRequest, googleRequest } from "../googledrive/runtime-request.js";
 import { defineProviderProxy, ProviderRequestError } from "../provider-runtime.js";
 import { googleSearchConsoleOAuthScopes } from "./scopes.js";
 const service = "google_search_console";

package/src/providers/google_search_console/scopes.js

@@ -1,3 +1,4 @@
+import { googleIdentityScopes } from "../googleads/scopes.js";
 export const googleSearchConsoleReadonlyScope = "https://www.googleapis.com/auth/webmasters.readonly";
 export const googleSearchConsoleFullScope = "https://www.googleapis.com/auth/webmasters";
 export const googleSearchConsoleReadScopes = [googleSearchConsoleReadonlyScope];
@@ -5,4 +6,5 @@ export const googleSearchConsoleWriteScopes = [googleSearchConsoleFullScope];
 export const googleSearchConsoleOAuthScopes = [
     googleSearchConsoleReadonlyScope,
     googleSearchConsoleFullScope,
+    ...googleIdentityScopes,
 ];

package/src/providers/googleads/executors.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { compactObject, objectArray, optionalBoolean, optionalRecord, optionalScalarString, optionalString, } from "../../core/cast.js";
-import { googleJsonRequest, googleRequest } from "../google-runtime.js";
+import { googleJsonRequest, googleRequest } from "../googledrive/runtime-request.js";
 import { defineProviderExecutors, defineProviderProxy, ProviderRequestError, requireOAuthCredential, requiredInputString, } from "../provider-runtime.js";
 import { googleAdsScope } from "./scopes.js";
 export const googleAdsApiBaseUrl = "https://googleads.googleapis.com/v22";

package/src/providers/googleads/scopes.d.ts

@@ -1,5 +1,3 @@
 export declare const googleAdsScope = "https://www.googleapis.com/auth/adwords";
-export declare const googleOpenIdScope = "openid";
-export declare const googleEmailScope = "email";
-export declare const googleProfileScope = "profile";
+export declare const googleIdentityScopes: string[];
 export declare const googleAdsOAuthScopes: string[];

package/src/providers/googleads/scopes.js

@@ -1,5 +1,3 @@
 export const googleAdsScope = "https://www.googleapis.com/auth/adwords";
-export const googleOpenIdScope = "openid";
-export const googleEmailScope = "email";
-export const googleProfileScope = "profile";
-export const googleAdsOAuthScopes = [googleAdsScope, googleOpenIdScope, googleEmailScope, googleProfileScope];
+export const googleIdentityScopes = ["openid", "email", "profile"];
+export const googleAdsOAuthScopes = [googleAdsScope, ...googleIdentityScopes];

package/src/providers/googlecalendar/executors.js

@@ -1,5 +1,5 @@
 import { compactObject, optionalString, pickOptionalBoolean, pickOptionalInteger, pickOptionalString, requiredRecord, } from "../../core/cast.js";
-import { defineGoogleProviderExecutors, googleBearerProxyAuth, googleServiceAccountValidator } from "../google-auth.js";
+import { defineGoogleProviderExecutors, googleBearerProxyAuth, googleServiceAccountValidator, } from "../googledrive/runtime-auth.js";
 import { combineProviderActionHandlers, defineProviderProxy, ProviderRequestError } from "../provider-runtime.js";
 import { googlecalendarEventActionHandlers } from "./runtime-events.js";
 import { googlecalendarApiBaseUrl, googlecalendarJsonRequest, googlecalendarRequest, resolveCalendarId, resolveRuleId, resolveSettingId, } from "./runtime-shared.js";

package/src/providers/googlecalendar/runtime-shared.js

@@ -1,5 +1,5 @@
 import { optionalRecord, optionalString as asOptionalString, pickOptionalString } from "../../core/cast.js";
-import { providerUserAgent, ProviderRequestError } from "../provider-runtime.js";
+import { providerUserAgent, ProviderRequestError, withRetryAfterSeconds } from "../provider-runtime.js";
 export const googlecalendarApiBaseUrl = "https://www.googleapis.com/calendar/v3";
 const service = "googlecalendar";
 const googleDefaultRequestTimeoutMs = 30_000;
@@ -142,7 +142,7 @@ async function assertGoogleResponse(response) {
         return;
     }
     const { message, details } = await extractGoogleError(response);
-    throw new ProviderRequestError(response.status, message, details);
+    throw new ProviderRequestError(response.status, message, withRetryAfterSeconds(response, details));
 }
 async function extractGoogleError(response) {
     const rawText = await response.text().catch(() => "");