@oomol-lab/open-connector 1.6.5 → 1.8.0

package/assets/open-connector/migrations/0014_saas_project.sql

@@ -0,0 +1,55 @@
+create table instance_identity (
+  id integer primary key check (id = 1),
+  instance_id text not null unique
+);
+create table managed_project (
+  id integer primary key check (id = 1),
+  managed_project_id text not null unique,
+  project_id text not null,
+  base_url text not null,
+  value text not null
+);
+create table oauth_sources (
+  service text primary key,
+  managed_project_id text not null,
+  provider_config_id text not null
+);
+alter table connections add column source text not null default 'local' check (source in ('local', 'saas'));
+alter table connections add column managed_project_id text;
+alter table connections add column provider_config_id text;
+alter table connections add column external_user_id text;
+alter table connections add column remote_account_id text;
+alter table connections add column local_request_id text;
+alter table connection_requests add column kind text not null default 'local' check (kind in ('local', 'saas'));
+alter table connection_requests add column managed_project_id text check (kind = 'local' or managed_project_id is not null);
+alter table connection_requests add column provider_config_id text;
+alter table connection_requests add column external_user_id text;
+alter table connection_requests add column remote_request_id text;
+alter table connection_requests add column remote_account_id text;
+alter table connection_requests add column lease_id text;
+alter table connection_requests add column lease_until bigint;
+alter table connection_requests add column next_poll_at bigint not null default 0;
+create table saas_cleanup (
+  id text primary key,
+  managed_project_id text not null,
+  provider_config_id text not null,
+  external_user_id text not null,
+  remote_request_id text,
+  remote_account_id text,
+  status text not null default 'pending' check (status in ('pending', 'manual')),
+  attempts integer not null default 0,
+  next_attempt_at bigint not null default 0,
+  lease_id text,
+  lease_until bigint,
+  created_at bigint not null,
+  error_code text
+);
+create index saas_cleanup_due on saas_cleanup (status, next_attempt_at, lease_until);
+create index connections_managed_project on connections (managed_project_id);
+create index connection_requests_managed_project on connection_requests (managed_project_id);
+
+alter table connection_requests add column saas_phase text check (saas_phase in ('creating', 'pending', 'candidate'));
+alter table connection_requests add column candidate_value text;
+
+alter table connection_requests add column return_uri text;
+alter table connection_requests add column poll_attempts integer not null default 0;

package/assets/open-connector/migrations/0015_saas_cleanup_runtime.sql

@@ -0,0 +1,8 @@
+alter table managed_project add column cleanup_paused integer not null default 0;
+alter table saas_cleanup add column service text;
+alter table saas_cleanup add column request_expires_at text;
+
+update saas_cleanup set
+  service = (select service from connection_requests where 'request:' || id = saas_cleanup.id),
+  request_expires_at = (select expires_at from connection_requests where 'request:' || id = saas_cleanup.id)
+where remote_request_id is not null;

package/assets/open-connector/migrations/0016_trigger_policy.sql

@@ -0,0 +1 @@
+alter table runtime_tokens add column allowed_triggers text not null default '[]';

package/assets/open-connector/migrations/0017_trigger_subscriptions.sql

@@ -0,0 +1,17 @@
+create table trigger_subscriptions (
+  id text primary key,
+  mode text not null,
+  token_id text not null,
+  connection_id text not null,
+  trigger_id text not null,
+  status text not null,
+  reconcile_at bigint not null,
+  maintenance_at bigint not null default 0,
+  lease_owner text,
+  lease_until bigint,
+  value text not null
+);
+create index trigger_subscriptions_connection on trigger_subscriptions (connection_id, status);
+create index trigger_subscriptions_maintenance on trigger_subscriptions (status, maintenance_at);
+
+alter table connections add column provider_account_id text;

package/assets/open-connector/migrations/postgresql/0014_saas_project.sql

@@ -0,0 +1,55 @@
+create table instance_identity (
+  id integer primary key check (id = 1),
+  instance_id text not null unique
+);
+create table managed_project (
+  id integer primary key check (id = 1),
+  managed_project_id text not null unique,
+  project_id text not null,
+  base_url text not null,
+  value text not null
+);
+create table oauth_sources (
+  service text primary key,
+  managed_project_id text not null,
+  provider_config_id text not null
+);
+alter table connections add column source text not null default 'local' check (source in ('local', 'saas'));
+alter table connections add column managed_project_id text;
+alter table connections add column provider_config_id text;
+alter table connections add column external_user_id text;
+alter table connections add column remote_account_id text;
+alter table connections add column local_request_id text;
+alter table connection_requests add column kind text not null default 'local' check (kind in ('local', 'saas'));
+alter table connection_requests add column managed_project_id text check (kind = 'local' or managed_project_id is not null);
+alter table connection_requests add column provider_config_id text;
+alter table connection_requests add column external_user_id text;
+alter table connection_requests add column remote_request_id text;
+alter table connection_requests add column remote_account_id text;
+alter table connection_requests add column lease_id text;
+alter table connection_requests add column lease_until bigint;
+alter table connection_requests add column next_poll_at bigint not null default 0;
+create table saas_cleanup (
+  id text primary key,
+  managed_project_id text not null,
+  provider_config_id text not null,
+  external_user_id text not null,
+  remote_request_id text,
+  remote_account_id text,
+  status text not null default 'pending' check (status in ('pending', 'manual')),
+  attempts integer not null default 0,
+  next_attempt_at bigint not null default 0,
+  lease_id text,
+  lease_until bigint,
+  created_at bigint not null,
+  error_code text
+);
+create index saas_cleanup_due on saas_cleanup (status, next_attempt_at, lease_until);
+create index connections_managed_project on connections (managed_project_id);
+create index connection_requests_managed_project on connection_requests (managed_project_id);
+
+alter table connection_requests add column saas_phase text check (saas_phase in ('creating', 'pending', 'candidate'));
+alter table connection_requests add column candidate_value text;
+
+alter table connection_requests add column return_uri text;
+alter table connection_requests add column poll_attempts integer not null default 0;

package/assets/open-connector/migrations/postgresql/0015_saas_cleanup_runtime.sql

@@ -0,0 +1,8 @@
+alter table managed_project add column cleanup_paused integer not null default 0;
+alter table saas_cleanup add column service text;
+alter table saas_cleanup add column request_expires_at text;
+
+update saas_cleanup set
+  service = (select service from connection_requests where 'request:' || id = saas_cleanup.id),
+  request_expires_at = (select expires_at from connection_requests where 'request:' || id = saas_cleanup.id)
+where remote_request_id is not null;

package/assets/open-connector/migrations/postgresql/0016_trigger_policy.sql

@@ -0,0 +1 @@
+alter table runtime_tokens add column allowed_triggers text not null default '[]';

package/assets/open-connector/migrations/postgresql/0017_trigger_subscriptions.sql

@@ -0,0 +1,17 @@
+create table trigger_subscriptions (
+  id text primary key,
+  mode text not null,
+  token_id text not null,
+  connection_id text not null,
+  trigger_id text not null,
+  status text not null,
+  reconcile_at bigint not null,
+  maintenance_at bigint not null default 0,
+  lease_owner text,
+  lease_until bigint,
+  value text not null
+);
+create index trigger_subscriptions_connection on trigger_subscriptions (connection_id, status);
+create index trigger_subscriptions_maintenance on trigger_subscriptions (status, maintenance_at);
+
+alter table connections add column provider_account_id text;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oomol-lab/open-connector",
-  "version": "1.6.5",
+  "version": "1.8.0",
   "description": "Embeddable Open Connector runtime for Node.js and Bun.",
   "license": "Apache-2.0",
   "type": "module",
@@ -41,7 +41,7 @@
     "pino": "^10.3.1",
     "rss-parser": "^3.13.0",
     "yaml": "^2.9.0",
-    "zod": "^4.4.3"
+    "zod": "^4.6.5"
   },
   "engines": {
     "node": ">=22.18.0"

package/src/connection-service.d.ts

@@ -22,6 +22,7 @@ export interface ConnectionSummary {
         id: string;
         pricing: MarketplacePricing;
     };
+    saas?: StoredSaasConnection["reference"];
 }
 export interface ManagedConnectionSummary extends ConnectionSummary {
     status: "active" | "reauth_required";
@@ -46,7 +47,28 @@ export interface ConnectionServiceOptions {
     logger?: RuntimeLogger;
     marketplace?: MarketplaceService;
 }
-export interface StoredConnection {
+export interface SaasConnectionReference {
+    managedProjectId: string;
+    providerConfigId: string;
+    externalUserId: string;
+    connectedAccountId: string;
+    localRequestId: string;
+}
+export interface StoredSaasConnection {
+    source: "saas";
+    credential?: never;
+    id: string;
+    revision: string;
+    service: string;
+    connectionName: string;
+    reference: SaasConnectionReference;
+    profile: CredentialProfile;
+    status: "active" | "reauth_required";
+    comment: string | null;
+}
+export type StoredConnection = StoredLocalConnection | StoredSaasConnection;
+export interface StoredLocalConnection {
+    source?: "local";
     id: string;
     revision: string;
     service: string;
@@ -58,18 +80,28 @@ export interface DisconnectedConnectionSummary {
     connectionName: string;
     configured: false;
 }
-export interface ExecutionConnection {
+export type ExecutionConnection = LocalExecutionConnection | MarketplaceExecutionConnection | SaasExecutionConnection;
+interface LocalExecutionConnection {
+    kind: "local";
     summary?: ConnectionSummary;
-    marketplace?: boolean;
     getCredential(service: string): Promise<ResolvedCredential | undefined>;
 }
+interface MarketplaceExecutionConnection {
+    kind: "marketplace";
+    summary: ConnectionSummary;
+}
+interface SaasExecutionConnection {
+    kind: "saas";
+    summary: ManagedConnectionSummary;
+    reference: SaasConnectionReference;
+}
 /**
  * Storage contract for local provider connections.
  */
 export interface IConnectionStore {
     get(service: string, connectionName: string): Promise<StoredConnection | undefined>;
-    set(service: string, connectionName: string, credential: ResolvedCredential): Promise<StoredConnection>;
-    updateCredential(input: StoredConnection): Promise<boolean>;
+    set(service: string, connectionName: string, credential: ResolvedCredential): Promise<StoredLocalConnection>;
+    updateCredential(input: StoredLocalConnection, refresh?: boolean): Promise<boolean>;
     delete(service: string, connectionName: string): Promise<void>;
     list(): Promise<StoredConnection[]>;
 }
@@ -102,8 +134,8 @@ export declare class ConnectionService {
     /** Read which providers the operator enabled in the Marketplace, keyed by service id. */
     private loadProviderPreferences;
     listAuthenticatedServices(services: string[]): Promise<string[]>;
-    getConnectionSummary(service: string, connectionName?: string): Promise<ConnectionSummary | undefined>;
-    resolveForExecution(service: string, connectionName?: string): Promise<ExecutionConnection>;
+    getConnectionSummary(service: string, connectionName?: string, connectionId?: string): Promise<ConnectionSummary | undefined>;
+    resolveForExecution(service: string, connectionName?: string, connectionId?: string): Promise<ExecutionConnection>;
     getCredential(service: string, connectionName?: string): Promise<ResolvedCredential | undefined>;
     /**
      * Return a per-request credential scope for one connection name.
@@ -122,6 +154,7 @@ export declare class ConnectionService {
         authType: "oauth2";
     }>, connectionNameInput?: string, signal?: AbortSignal): Promise<ConnectionSummary>;
     prepareOAuthCredential(service: string, credential: OAuthCredential, signal?: AbortSignal): Promise<OAuthCredential>;
+    private selectStoredConnection;
     getStoredConnection(id: string): Promise<StoredConnection>;
     listManagedConnections(): Promise<ManagedConnectionSummary[]>;
     getManagedConnection(id: string): Promise<ManagedConnectionSummary>;

package/src/connection-service.js

@@ -30,11 +30,7 @@ export class ConnectionService {
         const configuredByService = new Map();
         for (const connection of configured) {
             const serviceConnections = configuredByService.get(connection.service) ?? [];
-            serviceConnections.push({
-                id: connection.id,
-                connectionName: connection.connectionName,
-                credential: connection.credential,
-            });
+            serviceConnections.push(connection);
             configuredByService.set(connection.service, serviceConnections);
         }
         const preferences = await this.loadProviderPreferences();
@@ -52,7 +48,9 @@ export class ConnectionService {
      */
     summarizeProviderConnections(provider, connections, preferences) {
         if (connections.length > 0) {
-            const stored = connections.map((connection) => this.createConfiguredConnectionSummary(provider, connection.id, connection.connectionName, connection.credential));
+            const stored = connections.map((connection) => connection.source === "saas"
+                ? this.createManagedConnectionSummary(connection)
+                : this.createConfiguredConnectionSummary(provider, connection.id, connection.connectionName, connection.credential));
             const marketplace = this.createMarketplaceConnectionSummary(provider, preferences);
             return marketplace ? [...stored, marketplace] : stored;
         }
@@ -71,7 +69,7 @@ export class ConnectionService {
     async listAuthenticatedServices(services) {
         const configured = await this.store.list();
         const authenticated = new Set(configured
-            .filter((connection) => connection.credential.authType !== "no_auth")
+            .filter((connection) => connection.source === "saas" || connection.credential.authType !== "no_auth")
             .map((connection) => connection.service));
         const preferences = await this.loadProviderPreferences();
         for (const service of this.marketplace?.getSnapshot()?.actionsByService.keys() ?? []) {
@@ -80,32 +78,40 @@ export class ConnectionService {
         }
         return services.filter((service) => authenticated.has(service));
     }
-    async getConnectionSummary(service, connectionName) {
+    async getConnectionSummary(service, connectionName, connectionId) {
         const provider = this.getProvider(service);
-        const name = normalizeConnectionName(connectionName);
-        const stored = await this.store.get(service, name);
-        const marketplace = await this.resolveMarketplaceSummary(provider, connectionName, Boolean(stored));
+        const stored = await this.selectStoredConnection(service, connectionName, connectionId);
+        const name = stored?.connectionName ?? normalizeConnectionName(connectionName);
+        const marketplace = connectionId
+            ? undefined
+            : await this.resolveMarketplaceSummary(provider, connectionName, Boolean(stored));
         if (marketplace)
             return marketplace;
         if (!stored && connectionName && !this.supportsAuth(provider, "no_auth")) {
             throw new ConnectionError("connection_not_found", `${service} connection not found: ${name}.`);
         }
+        if (stored?.source === "saas")
+            return this.createManagedConnectionSummary(stored);
         return stored
             ? this.createConfiguredConnectionSummary(provider, stored.id, name, stored.credential)
             : this.supportsAuth(provider, "no_auth")
                 ? this.createNoAuthConnectionSummary(provider, name)
                 : undefined;
     }
-    async resolveForExecution(service, connectionName) {
+    async resolveForExecution(service, connectionName, connectionId) {
         const provider = this.getProvider(service);
-        const name = normalizeConnectionName(connectionName);
-        const stored = await this.store.get(service, name);
-        const marketplace = await this.resolveMarketplaceSummary(provider, connectionName, Boolean(stored));
+        const stored = await this.selectStoredConnection(service, connectionName, connectionId);
+        const name = stored?.connectionName ?? normalizeConnectionName(connectionName);
+        const marketplace = connectionId
+            ? undefined
+            : await this.resolveMarketplaceSummary(provider, connectionName, Boolean(stored));
         if (marketplace)
-            return { summary: marketplace, marketplace: true, getCredential: async () => undefined };
+            return { kind: "marketplace", summary: marketplace };
         if (!stored && connectionName && !this.supportsAuth(provider, "no_auth")) {
             throw new ConnectionError("connection_not_found", `${service} connection not found: ${name}.`);
         }
+        if (stored?.source === "saas")
+            return { kind: "saas", summary: this.createManagedConnectionSummary(stored), reference: stored.reference };
         let credential = stored?.credential;
         if (stored?.credential.authType === "oauth2") {
             credential = await this.resolveOAuthCredential(stored, stored.credential);
@@ -117,6 +123,7 @@ export class ConnectionService {
                 ? this.createNoAuthConnectionSummary(provider, name)
                 : undefined;
         return {
+            kind: "local",
             summary,
             getCredential: async (requestedService) => (requestedService === service ? credential : undefined),
         };
@@ -125,6 +132,8 @@ export class ConnectionService {
         const provider = this.getProvider(service);
         const name = normalizeConnectionName(connectionName);
         const stored = await this.store.get(service, name);
+        if (stored?.source === "saas")
+            throw new ConnectionError("unsupported_auth_type", "SaaS credentials are not available locally.");
         if (stored) {
             return stored.credential.authType === "oauth2"
                 ? await this.resolveOAuthCredential(stored, stored.credential)
@@ -220,6 +229,15 @@ export class ConnectionService {
             ...this.mergeCredentialRuntimeData(provider, "oauth2", credential, validation),
         };
     }
+    async selectStoredConnection(service, name, id) {
+        if (!id)
+            return this.store.get(service, normalizeConnectionName(name));
+        const connection = await this.getStoredConnection(id);
+        if (connection.service !== service ||
+            (name !== undefined && connection.connectionName !== normalizeConnectionName(name)))
+            throw new ConnectionError("connection_not_found", "The selected connection does not match this provider or alias.");
+        return connection;
+    }
     async getStoredConnection(id) {
         const connection = (await this.store.list()).find((item) => item.id === id);
         if (!connection)
@@ -233,6 +251,20 @@ export class ConnectionService {
         return this.createManagedConnectionSummary(await this.getStoredConnection(id));
     }
     createManagedConnectionSummary(stored) {
+        if (stored.source === "saas")
+            return {
+                id: stored.id,
+                service: stored.service,
+                connectionName: stored.connectionName,
+                authType: "oauth2",
+                configured: true,
+                virtual: false,
+                default: stored.connectionName === defaultConnectionName,
+                profile: stored.profile,
+                status: stored.status,
+                comment: stored.comment,
+                saas: stored.reference,
+            };
         const credential = stored.credential;
         return {
             status: credential.authType === "oauth2" && !credential.refreshToken && isOAuthCredentialExpired(credential)
@@ -246,6 +278,8 @@ export class ConnectionService {
     }
     async saveCredential(provider, credential, input) {
         const expected = input.expectedConnection;
+        if (expected?.source === "saas")
+            throw new ConnectionError("unsupported_auth_type", "Use the original source when reconnecting a SaaS connection.");
         const previousComment = expected?.credential.authType !== "no_auth" ? expected?.credential.metadata.connectionComment : undefined;
         if (input.comment !== undefined || previousComment !== undefined) {
             credential.metadata.connectionComment = input.comment === undefined ? previousComment : input.comment;
@@ -432,7 +466,7 @@ export class ConnectionService {
             service,
             connectionName,
             credential: nextCredential,
-        });
+        }, true);
         if (!updated) {
             throw new ConnectionError("connection_not_found", `${service} connection changed while its OAuth credential was refreshing. Retry the action.`);
         }
@@ -460,7 +494,12 @@ export class ConnectionService {
     buildCredentialRuntimeData(provider, authType, credentialFields, credentialValues, validation) {
         return {
             profile: this.createCredentialProfile(provider, authType, credentialFields, credentialValues, validation),
-            metadata: validation.metadata ?? {},
+            metadata: {
+                ...validation.metadata,
+                providerAccountVerified: Boolean(validation.profile?.accountId ??
+                    readLegacyString(validation.metadata, "providerAccountId") ??
+                    readLegacyString(validation.metadata, "accountId")),
+            },
         };
     }
     mergeCredentialRuntimeData(provider, authType, credential, validation) {
@@ -474,6 +513,9 @@ export class ConnectionService {
                 ...(validation.metadata ?? {}),
                 // Provider validation cannot replace or invent completed consent provenance.
                 oauthAuthorizationId: credential.metadata.oauthAuthorizationId,
+                providerAccountVerified: Boolean(validation.profile?.accountId ??
+                    readLegacyString(validation.metadata, "providerAccountId") ??
+                    readLegacyString(validation.metadata, "accountId")) || credential.metadata.providerAccountVerified === true,
             },
         };
     }

package/src/core/action-policy.d.ts

@@ -1,6 +1,6 @@
 import type { ActionDefinition } from "./types.ts";
 export type PolicySource = "deployment" | "runtime" | "token";
-export type PolicyErrorCode = "action_not_allowed" | "action_blocked" | "proxy_not_allowed" | "proxy_blocked" | "connection_not_allowed";
+export type PolicyErrorCode = "action_not_allowed" | "action_blocked" | "proxy_not_allowed" | "proxy_blocked" | "connection_not_allowed" | "trigger_not_allowed" | "trigger_blocked";
 export interface PolicyCheck {
     source: PolicySource;
     outcome: "allow_match" | "block_match" | "allow_miss";
@@ -20,12 +20,15 @@ export interface PolicyRules {
     blockedActions: string[];
     allowedProxies: string[];
     blockedProxies: string[];
+    allowedTriggers?: string[];
+    blockedTriggers?: string[];
 }
 export interface TokenPolicy {
     allowedActions: string[];
     blockedActions: string[];
     allowedProxies: string[];
     allowedConnections?: string[];
+    allowedTriggers?: string[];
 }
 export interface RuntimePolicyState {
     deployment: PolicyRules;
@@ -37,6 +40,8 @@ export interface ActionPolicyConfig {
     blockedActions?: string[];
     allowedProxies?: string[];
     blockedProxies?: string[];
+    allowedTriggers?: string[];
+    blockedTriggers?: string[];
 }
 /**
  * Immutable policy view shared by every policy consumer in one request.
@@ -46,10 +51,12 @@ export declare class ActionPolicySnapshot {
     private readonly layers;
     private readonly proxyLayers;
     private readonly tokenProxyRules?;
+    private readonly tokenTriggerRules?;
     private readonly allowedConnections;
     constructor(deployment: PolicyRules, runtime: PolicyRules, token?: TokenPolicy, updatedAt?: string);
     evaluate(action: ActionDefinition): ActionPolicyDecision;
     evaluateProxy(service: string): ActionPolicyDecision;
+    evaluateTrigger(id: string): ActionPolicyDecision;
     evaluateConnection(connectionId?: string): ActionPolicyDecision;
 }
 /**

package/src/core/action-policy.js

@@ -6,6 +6,7 @@ export class ActionPolicySnapshot {
     layers;
     proxyLayers;
     tokenProxyRules;
+    tokenTriggerRules;
     allowedConnections;
     constructor(deployment, runtime, token, updatedAt) {
         const deploymentRules = immutablePolicyRules(deployment);
@@ -24,6 +25,7 @@ export class ActionPolicySnapshot {
             const tokenLayer = compileLayer("token", tokenRules);
             this.layers.push(tokenLayer);
             this.tokenProxyRules = tokenLayer.allowedProxies;
+            this.tokenTriggerRules = (token.allowedTriggers ?? []).map(compileActionRule);
         }
     }
     evaluate(action) {
@@ -98,6 +100,45 @@ export class ActionPolicySnapshot {
         }
         return { allowed: true, checks };
     }
+    evaluateTrigger(id) {
+        const checks = [];
+        for (const layer of this.proxyLayers) {
+            const blocked = layer.blockedTriggers.find((rule) => rule.matches(id));
+            if (blocked)
+                return {
+                    allowed: false,
+                    code: "trigger_blocked",
+                    message: `${id} is blocked by the Trigger policy.`,
+                    checks: [{ source: layer.source, outcome: "block_match", rule: blocked.pattern }],
+                };
+        }
+        for (const layer of this.proxyLayers) {
+            const allowed = layer.allowedTriggers;
+            if (allowed.length === 0)
+                continue;
+            const match = allowed.find((rule) => rule.matches(id));
+            if (!match)
+                return {
+                    allowed: false,
+                    code: "trigger_not_allowed",
+                    message: `${id} is not included in the Trigger allowlist.`,
+                    checks: [...checks, { source: layer.source, outcome: "allow_miss" }],
+                };
+            checks.push({ source: layer.source, outcome: "allow_match", rule: match.pattern });
+        }
+        if (this.tokenTriggerRules) {
+            const match = this.tokenTriggerRules.find((rule) => rule.matches(id));
+            if (!match)
+                return {
+                    allowed: false,
+                    code: "trigger_not_allowed",
+                    message: `${id} is not granted to this runtime token.`,
+                    checks: [...checks, { source: "token", outcome: "allow_miss" }],
+                };
+            checks.push({ source: "token", outcome: "allow_match", rule: match.pattern });
+        }
+        return { allowed: true, checks };
+    }
     evaluateConnection(connectionId) {
         if (this.allowedConnections.length === 0) {
             return { allowed: true, checks: [] };
@@ -136,6 +177,8 @@ export function emptyPolicyRules() {
         blockedActions: [],
         allowedProxies: [],
         blockedProxies: [],
+        allowedTriggers: [],
+        blockedTriggers: [],
     };
 }
 export function parseActionPolicyList(value) {
@@ -150,6 +193,8 @@ function policyRules(config) {
         blockedActions: config.blockedActions ?? [],
         allowedProxies: config.allowedProxies ?? [],
         blockedProxies: config.blockedProxies ?? [],
+        allowedTriggers: config.allowedTriggers ?? [],
+        blockedTriggers: config.blockedTriggers ?? [],
     });
 }
 function immutablePolicyRules(rules) {
@@ -158,11 +203,15 @@ function immutablePolicyRules(rules) {
         blockedActions: [...rules.blockedActions],
         allowedProxies: [...rules.allowedProxies],
         blockedProxies: [...rules.blockedProxies],
+        allowedTriggers: [...(rules.allowedTriggers ?? [])],
+        blockedTriggers: [...(rules.blockedTriggers ?? [])],
     };
     Object.freeze(immutable.allowedActions);
     Object.freeze(immutable.blockedActions);
     Object.freeze(immutable.allowedProxies);
     Object.freeze(immutable.blockedProxies);
+    Object.freeze(immutable.allowedTriggers);
+    Object.freeze(immutable.blockedTriggers);
     return Object.freeze(immutable);
 }
 function compileLayer(source, rules) {
@@ -172,6 +221,8 @@ function compileLayer(source, rules) {
         blockedActions: rules.blockedActions.map(compileActionRule),
         allowedProxies: rules.allowedProxies.map(compileProxyRule),
         blockedProxies: rules.blockedProxies.map(compileProxyRule),
+        allowedTriggers: (rules.allowedTriggers ?? []).map(compileActionRule),
+        blockedTriggers: (rules.blockedTriggers ?? []).map(compileActionRule),
     };
 }
 function compileActionRule(pattern) {

package/src/core/cast.d.ts

@@ -100,6 +100,9 @@ export declare function optionalNumber(value: unknown): number | undefined;
 /**
  * Return a finite number from a number or numeric string when present. Examples:
  * `optionalNumberLike("1.5") => 1.5`, `optionalNumberLike("x") => undefined`.
+ *
+ * A blank or whitespace-only string is reported as missing rather than parsed, because
+ * `Number(" ")` is `0` and a blank field would otherwise surface as a real zero.
  */
 export declare function optionalNumberLike(value: unknown): number | undefined;
 /**
@@ -151,6 +154,16 @@ export declare function pickOptionalInteger(input: Record<string, unknown>, ...k
  * `nullableString(1) => undefined`.
  */
 export declare function nullableString(value: unknown): string | null | undefined;
+/**
+ * Return a string exactly as provided, null, or undefined when the value is not a string. Examples:
+ * `nullableRawString(null) => null`, `nullableRawString("") => ""`, `nullableRawString(1) => undefined`.
+ */
+export declare function nullableRawString(value: unknown): string | null | undefined;
+/**
+ * Return a boolean, null, or undefined when the value is not a boolean. Examples:
+ * `nullableBoolean(null) => null`, `nullableBoolean(false) => false`, `nullableBoolean("true") => undefined`.
+ */
+export declare function nullableBoolean(value: unknown): boolean | null | undefined;
 /**
  * Return a string or null when the value is not a string.
  */