@oomol-lab/open-connector 1.7.0 → 1.8.0

package/src/providers/stripe/trigger-on-event.js

@@ -0,0 +1,212 @@
+import { optionalString } from "../../core/cast.js";
+import { randomUUIDv7 } from "../../core/uuid-v7.js";
+import { IntegrationConnectionError, PermanentIntegrationError, TransientIntegrationError, } from "../../triggers/common/integration.js";
+import { bytes, verifyHexHmac } from "../../triggers/signature.js";
+import { snapshot } from "./trigger-on-event.definition.js";
+const signatureToleranceSeconds = 5 * 60;
+const endpoints = "/v1/webhook_endpoints";
+const formHeaders = { "Content-Type": "application/x-www-form-urlencoded" };
+export const stripeEvent = {
+    initialState: { checkpoint: null, subscription: {} },
+    snapshot,
+    async receive(context) {
+        const signingSecret = subscriptionSecret(context.state);
+        if (signingSecret == null ||
+            !(await validSignature(context.header("stripe-signature"), signingSecret, context.rawBody, context.now))) {
+            return { body: "", contentType: "text/plain", outcome: "respond", status: 404 };
+        }
+        if (context.payload == null || typeof context.payload != "object" || Array.isArray(context.payload)) {
+            return { outcome: "ignored", reason: "Stripe event body is missing." };
+        }
+        const payload = context.payload;
+        const event = payload.type;
+        const eventId = payload.id;
+        if (typeof event != "string" || typeof eventId != "string")
+            return { outcome: "ignored", reason: "Stripe event identity is missing." };
+        const config = resolveConfig(context.config);
+        if (!config.events.includes("*") && !config.events.includes(event))
+            return { outcome: "ignored", reason: "Stripe event is not subscribed." };
+        return {
+            dedupeKey: eventId,
+            outcome: "event",
+            outputs: { body: payload, event, eventId, livemode: payload.livemode === true },
+        };
+    },
+    async reconcile(context) {
+        const state = requireState(context.state);
+        const config = resolveConfig(context.config);
+        let endpointId = subscriptionId(state);
+        let signingSecret = subscriptionSecret(state);
+        let createKey = optionalString(state.subscription.createKey);
+        if (!context.active) {
+            endpointId ??= await findByUrl(context);
+            if (endpointId != null) {
+                const result = await request(context, "endpoint delete", {
+                    endpoint: `${endpoints}/${endpointId}`,
+                    method: "DELETE",
+                });
+                if (result.status != 404)
+                    success(result, "endpoint delete");
+            }
+            await state.saveSubscription({}, later(context.now));
+            return { outcome: "ready" };
+        }
+        if (endpointId == null && createKey == null)
+            endpointId = await findByUrl(context);
+        if (endpointId != null && signingSecret == null) {
+            createKey = randomUUIDv7();
+            await state.saveSubscription({ endpointId, createKey }, context.now);
+            const removed = await request(context, "endpoint delete", {
+                endpoint: `${endpoints}/${endpointId}`,
+                method: "DELETE",
+            });
+            if (removed.status != 404)
+                success(removed, "endpoint delete");
+            endpointId = null;
+        }
+        if (endpointId == null) {
+            createKey ??= context.idempotencyKey;
+            await state.saveSubscription({ createKey }, context.now);
+            const created = await request(context, "endpoint create", {
+                body: createForm(context.endpointUrl, config),
+                endpoint: endpoints,
+                headers: { ...formHeaders, "Idempotency-Key": createKey },
+                method: "POST",
+            });
+            success(created, "endpoint create");
+            const endpoint = createdEndpoint(created.data);
+            endpointId = endpoint.id;
+            signingSecret = endpoint.secret;
+        }
+        await state.saveSubscription({ endpointId, signingSecret }, context.now);
+        const aligned = await request(context, "endpoint update", {
+            body: form([
+                ...config.events.map((event, index) => [`enabled_events[${index}]`, event]),
+                ["disabled", "false"],
+                ["description", "Managed by Open Flow."],
+            ]),
+            endpoint: `${endpoints}/${endpointId}`,
+            headers: formHeaders,
+            method: "POST",
+        });
+        if (aligned.status == 404) {
+            await state.saveSubscription({ createKey: randomUUIDv7() }, context.now);
+            return { outcome: "pending" };
+        }
+        success(aligned, "endpoint update");
+        await state.saveSubscription({ endpointId, signingSecret }, later(context.now));
+        return { outcome: "ready" };
+    },
+};
+function resolveConfig(value) {
+    return {
+        apiVersion: value.apiVersion,
+        events: [...new Set(value.events)],
+        includeConnectedAccounts: value.includeConnectedAccounts,
+    };
+}
+function createForm(url, config) {
+    const fields = [
+        ["url", url],
+        ...config.events.map((event, index) => [`enabled_events[${index}]`, event]),
+        ["description", "Managed by Open Flow."],
+    ];
+    if (config.includeConnectedAccounts)
+        fields.push(["connect", "true"]);
+    if (config.apiVersion.length > 0)
+        fields.push(["api_version", config.apiVersion]);
+    return form(fields);
+}
+function form(fields) {
+    const parameters = new URLSearchParams();
+    for (const [name, value] of fields)
+        parameters.append(name, value);
+    return parameters.toString();
+}
+async function findByUrl(context) {
+    let startingAfter;
+    for (let page = 0; page < 10; page += 1) {
+        const result = await request(context, "endpoint list", {
+            endpoint: endpoints,
+            method: "GET",
+            query: { limit: 100, ...(startingAfter == null ? {} : { starting_after: startingAfter }) },
+        });
+        success(result, "endpoint list");
+        const listing = record(result.data);
+        const values = Array.isArray(listing?.data) ? listing.data : [];
+        for (const value of values) {
+            const endpoint = record(value);
+            if (endpoint?.url === context.endpointUrl && typeof endpoint.id == "string")
+                return endpoint.id;
+        }
+        const last = record(values.at(-1))?.id;
+        if (listing?.has_more !== true || typeof last != "string")
+            return null;
+        startingAfter = last;
+    }
+    return null;
+}
+async function request(context, operation, value) {
+    try {
+        return await context.connector.execute(value, context.signal);
+    }
+    catch (cause) {
+        if (cause instanceof IntegrationConnectionError)
+            throw cause;
+        throw new TransientIntegrationError(`Stripe ${operation} request failed.`, { cause });
+    }
+}
+function success(result, operation) {
+    if (result.status >= 200 && result.status < 300)
+        return;
+    if (result.status == 401 || result.status == 403)
+        throw new IntegrationConnectionError(`Stripe ${operation} rejected the Connection.`);
+    if (result.status == 400 || result.status == 404) {
+        const message = record(record(result.data)?.error)?.message;
+        throw new PermanentIntegrationError(`Stripe ${operation} rejected the subscription${typeof message == "string" ? `: ${message}` : "."}`);
+    }
+    throw new TransientIntegrationError(`Stripe ${operation} failed with status ${result.status}.`);
+}
+function createdEndpoint(data) {
+    const value = record(data);
+    if (typeof value?.id != "string" || typeof value.secret != "string" || value.secret.length == 0) {
+        throw new TransientIntegrationError("Stripe endpoint response is missing its ID or signing secret.");
+    }
+    return { id: value.id, secret: value.secret };
+}
+function requireState(value) {
+    if (value == null)
+        throw new PermanentIntegrationError("Stripe Integration state is missing.");
+    return value;
+}
+function subscriptionId(state) {
+    const value = state.subscription.endpointId;
+    return typeof value == "string" && value.length > 0 ? value : null;
+}
+function subscriptionSecret(state) {
+    const value = state?.subscription.signingSecret;
+    return typeof value == "string" && value.length > 0 ? value : null;
+}
+async function validSignature(header, secret, body, now) {
+    if (header == null)
+        return false;
+    const values = header.split(",").map((value) => value.trim().split("=", 2));
+    const timestamp = values.find(([name]) => name == "t")?.[1];
+    if (timestamp == null || !/^\d+$/.test(timestamp))
+        return false;
+    const seconds = Number(timestamp);
+    if (!Number.isSafeInteger(seconds) ||
+        Math.abs(Math.floor(now.getTime() / 1_000) - seconds) > signatureToleranceSeconds)
+        return false;
+    const signatures = values.filter(([name, value]) => name == "v1" && value != null).map(([, value]) => value);
+    const source = [bytes(`${timestamp}.`), body];
+    return (await Promise.all(signatures.map((signature) => verifyHexHmac(secret, source, signature)))).some(Boolean);
+}
+function later(now) {
+    return new Date(now.getTime() + 30 * 24 * 60 * 60 * 1_000);
+}
+function record(value) {
+    return value != null && typeof value == "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}

package/src/providers/telegram/executors.d.ts

@@ -1,4 +1,6 @@
 import type { CredentialValidators, ProviderExecutors, ProviderProxyExecutor } from "../../core/types.ts";
+import type { IntegrationDefinition } from "../../triggers/common/integration.ts";
+import type { PollDefinition } from "../../triggers/common/poll.ts";
 import type { ProviderActionHandlers } from "../provider-runtime.ts";
 import type { ApiKeyProviderContext } from "../provider-runtime.ts";
 type TelegramActionHandler = (input: Record<string, unknown>, context: ApiKeyProviderContext) => Promise<unknown>;
@@ -6,4 +8,5 @@ export declare const telegramActionHandlers: ProviderActionHandlers<"telegram",
 export declare const executors: ProviderExecutors;
 export declare const proxy: ProviderProxyExecutor;
 export declare const credentialValidators: CredentialValidators;
+export declare const triggers: readonly (IntegrationDefinition | PollDefinition)[];
 export {};

package/src/providers/telegram/executors.js

@@ -1,6 +1,7 @@
 import { optionalBoolean, optionalNumber, optionalRecord, optionalString } from "../../core/cast.js";
 import { assertPublicHttpUrl } from "../../core/request.js";
 import { defineApiKeyProviderExecutors, defineProviderProxy, isAbortLikeError, ProviderRequestError, requireApiKeyCredential, } from "../provider-runtime.js";
+import { telegramUpdate } from "./trigger-on-update.js";
 const service = "telegram";
 const telegramApiBaseUrl = "https://api.telegram.org";
 const telegramDefaultRequestTimeoutMs = 30_000;
@@ -1165,3 +1166,4 @@ function assertValidTelegramBotToken(botToken) {
         throw new ProviderRequestError(400, "telegram bot token is malformed");
     }
 }
+export const triggers = [telegramUpdate];

package/src/providers/telegram/trigger-on-update.d.ts

@@ -0,0 +1,2 @@
+import type { IntegrationDefinition } from "../../triggers/common/integration.ts";
+export declare const telegramUpdate: IntegrationDefinition;

package/src/providers/telegram/trigger-on-update.definition.d.ts

@@ -0,0 +1,5 @@
+import type { TriggerKeySnapshot } from "../../triggers/common/types.ts";
+export declare const updateTypes: readonly string[];
+export declare const snapshot: TriggerKeySnapshot & {
+    readonly type: "integration";
+};

package/src/providers/telegram/trigger-on-update.definition.js

@@ -0,0 +1,78 @@
+import { jsonSchema as s } from "../../core/json-schema.js";
+export const updateTypes = [
+    "*",
+    "message",
+    "edited_message",
+    "channel_post",
+    "edited_channel_post",
+    "business_connection",
+    "business_message",
+    "edited_business_message",
+    "deleted_business_messages",
+    "guest_message",
+    "message_reaction",
+    "message_reaction_count",
+    "inline_query",
+    "chosen_inline_result",
+    "callback_query",
+    "shipping_query",
+    "pre_checkout_query",
+    "purchased_paid_media",
+    "poll",
+    "poll_answer",
+    "my_chat_member",
+    "chat_member",
+    "chat_join_request",
+    "chat_boost",
+    "removed_chat_boost",
+    "managed_bot",
+    "subscription",
+];
+export const snapshot = {
+    configInputs: [
+        {
+            handle: "chatIds",
+            jsonSchema: s.array(s.string({ pattern: "^-?[0-9]{1,20}$" }), { maxItems: 100, uniqueItems: true }),
+            nullable: false,
+            value: [],
+            description: "Only accept updates from these numeric Telegram chat IDs. Empty means every chat.",
+        },
+        {
+            handle: "dropPendingUpdates",
+            jsonSchema: s.boolean(),
+            nullable: false,
+            value: true,
+            description: "Discard updates queued before the webhook is created or resumed.",
+        },
+        {
+            handle: "updates",
+            jsonSchema: s.array({ enum: updateTypes }, { minItems: 1, uniqueItems: true }),
+            nullable: false,
+            description: "Telegram update types that trigger a Run. Use * for the Telegram default set.",
+        },
+        {
+            handle: "userIds",
+            jsonSchema: s.array(s.string({ pattern: "^[0-9]{1,20}$" }), { maxItems: 100, uniqueItems: true }),
+            nullable: false,
+            value: [],
+            description: "Only accept updates from these numeric Telegram user IDs. Empty means every user.",
+        },
+    ],
+    definitionVersion: 2,
+    description: "Triggers when the connected Telegram bot receives a selected update.",
+    displayName: "Bot Update",
+    endpoint: {
+        body: { allowArray: false, allowEmpty: false, formats: ["json"] },
+        methods: ["POST"],
+        successStatus: 200,
+    },
+    key: "telegram.on_update",
+    name: "on_update",
+    outputs: [
+        { handle: "body", jsonSchema: { type: "object" }, nullable: false },
+        { handle: "deliveryId", jsonSchema: s.string(), nullable: false },
+        { handle: "event", jsonSchema: s.string(), nullable: false },
+    ],
+    provider: "telegram",
+    type: "integration",
+};

package/src/providers/telegram/trigger-on-update.js

@@ -0,0 +1,141 @@
+import { IntegrationConnectionError, PermanentIntegrationError, TransientIntegrationError, } from "../../triggers/common/integration.js";
+import { snapshot, updateTypes } from "./trigger-on-update.definition.js";
+const optInUpdates = new Set(["chat_member", "message_reaction", "message_reaction_count"]);
+const defaultUpdates = updateTypes.filter((value) => value != "*" && !optInUpdates.has(value));
+export const telegramUpdate = {
+    snapshot,
+    receive(context) {
+        if (!sameSecret(context.header("x-telegram-bot-api-secret-token"), context.callbackSecret)) {
+            return { body: "", contentType: "text/plain", outcome: "respond", status: 404 };
+        }
+        if (!isRecord(context.payload) || !Number.isSafeInteger(context.payload.update_id)) {
+            return { outcome: "ignored", reason: "Telegram update_id is missing." };
+        }
+        const event = Object.keys(context.payload).find((key) => key != "update_id");
+        if (event == null)
+            return { outcome: "ignored", reason: "Telegram update body is missing." };
+        const config = resolveConfig(context.config);
+        const subscribed = subscribedUpdates(config) ?? defaultUpdates;
+        if (!subscribed.includes(event))
+            return { outcome: "ignored", reason: "Telegram update type is not subscribed." };
+        const update = context.payload[event];
+        if (config.chatIds.length > 0) {
+            const chatId = resolveChatId(update);
+            if (chatId == null || !config.chatIds.includes(chatId))
+                return { outcome: "ignored", reason: "Telegram chat does not match." };
+        }
+        if (config.userIds.length > 0) {
+            const userId = resolveUserId(update);
+            if (userId == null || !config.userIds.includes(userId))
+                return { outcome: "ignored", reason: "Telegram user does not match." };
+        }
+        const deliveryId = String(context.payload.update_id);
+        return {
+            dedupeKey: deliveryId,
+            outcome: "event",
+            outputs: { body: context.payload, deliveryId, event },
+        };
+    },
+    async reconcile(context) {
+        const current = await webhookUrl(context);
+        if (!context.active) {
+            if (current == context.endpointUrl)
+                await deleteWebhook(context);
+            return { outcome: "ready" };
+        }
+        if (current != "" && current != context.endpointUrl) {
+            throw new PermanentIntegrationError(`The Telegram bot already sends updates to ${host(current)}.`);
+        }
+        const config = resolveConfig(context.config);
+        await request(context, "setWebhook", {
+            allowed_updates: subscribedUpdates(config) ?? [],
+            drop_pending_updates: current == "" && config.dropPendingUpdates,
+            secret_token: context.callbackSecret,
+            url: context.endpointUrl,
+        });
+        return { outcome: "ready" };
+    },
+};
+function resolveConfig(value) {
+    return {
+        chatIds: value.chatIds,
+        dropPendingUpdates: value.dropPendingUpdates,
+        updates: value.updates,
+        userIds: value.userIds,
+    };
+}
+function subscribedUpdates(config) {
+    if (!config.updates.includes("*"))
+        return config.updates;
+    const named = config.updates.filter((value) => value != "*");
+    return named.length == 0 ? null : [...new Set([...defaultUpdates, ...named])];
+}
+function sameSecret(candidate, expected) {
+    if (candidate == null || candidate.length != expected.length)
+        return false;
+    let difference = 0;
+    for (let index = 0; index < expected.length; index += 1)
+        difference |= candidate.charCodeAt(index) ^ expected.charCodeAt(index);
+    return difference == 0;
+}
+function isRecord(value) {
+    return value != null && typeof value == "object" && !Array.isArray(value);
+}
+function id(value) {
+    if (!isRecord(value))
+        return;
+    return typeof value.id == "string" || typeof value.id == "number" ? String(value.id) : undefined;
+}
+function resolveChatId(value) {
+    if (!isRecord(value))
+        return;
+    return id(value.chat) ?? (isRecord(value.message) ? id(value.message.chat) : undefined);
+}
+function resolveUserId(value) {
+    if (!isRecord(value))
+        return;
+    return id(value.from) ?? id(value.user);
+}
+async function webhookUrl(context) {
+    const envelope = await request(context, "getWebhookInfo");
+    const url = isRecord(envelope.result) ? envelope.result.url : undefined;
+    if (typeof url != "string")
+        throw new TransientIntegrationError("Telegram getWebhookInfo response is missing result.url.");
+    return url;
+}
+async function deleteWebhook(context) {
+    await request(context, "deleteWebhook", { drop_pending_updates: false });
+}
+async function request(context, endpoint, body) {
+    let result;
+    try {
+        result = await context.connector.execute({
+            ...(body == null ? {} : { body }),
+            endpoint: `/${endpoint}`,
+            method: body == null ? "GET" : "POST",
+        }, context.signal);
+    }
+    catch (cause) {
+        if (cause instanceof IntegrationConnectionError)
+            throw cause;
+        throw new TransientIntegrationError(`Telegram ${endpoint} request failed.`, { cause });
+    }
+    const envelope = isRecord(result.data) ? result.data : {};
+    if (result.status >= 200 && result.status < 300 && envelope.ok === true)
+        return envelope;
+    const message = typeof envelope.description == "string" ? envelope.description : `HTTP ${result.status}`;
+    if (result.status == 401 || result.status == 403)
+        throw new IntegrationConnectionError(`Telegram ${endpoint} rejected the Connection.`);
+    if (result.status >= 400 && result.status < 500 && result.status != 429) {
+        throw new PermanentIntegrationError(`Telegram ${endpoint} rejected the subscription: ${message}`);
+    }
+    throw new TransientIntegrationError(`Telegram ${endpoint} failed: ${message}`);
+}
+function host(value) {
+    try {
+        return new URL(value).host;
+    }
+    catch {
+        return "an invalid URL";
+    }
+}

package/src/providers/weixin_store/access-token.d.ts

@@ -45,7 +45,8 @@ export declare function isWechatTokenError(errcode: number | null): boolean;
 /**
  * Map a failed WeChat API call to the shared provider error. Rate limits
  * (45009/45011) become 429, the missing-permission 48001 becomes 403, the
- * 4xxxx client errcodes become 400, and everything else becomes a 502.
+ * 4xxxx client errcodes and the documented invalid-input store errcodes become
+ * 400, and everything else becomes a 502.
  */
 export declare function normalizeWechatApiError(result: WechatApiResult): ProviderRequestError;
 export {};

package/src/providers/weixin_store/access-token.js

@@ -1,9 +1,19 @@
 import { createHash } from "node:crypto";
-import { optionalInteger, optionalNumber, optionalRecord, optionalString } from "../../core/cast.js";
+import { optionalIntegerOrNull, optionalNumber, optionalRecord, optionalString } from "../../core/cast.js";
 import { ProviderRequestError, providerResponseError, providerUserAgent, requiredInputString, runProviderRequest, } from "../provider-runtime.js";
 const wechatStableTokenUrl = "https://api.weixin.qq.com/cgi-bin/stable_token";
 const defaultAccessTokenTtlSeconds = 7200;
 const accessTokenRefreshSkewMs = 120_000;
+/**
+ * WeChat Store errcodes outside the 4xxxx range that the category and
+ * qualification docs describe as bad parameters or materials, such as an
+ * invalid or non-leaf category id, a mismatched certificate group, or a file id
+ * that did not come from the qualification upload. The caller has to fix the
+ * input, so they map to 400 instead of an upstream failure.
+ */
+const wechatInvalidInputErrcodes = new Set([
+    9401020, 9700234, 10020017, 10020059, 10020060, 10020062, 10020063, 10020087, 10020094, 10020127, 10020504,
+]);
 const accessTokenCache = new Map();
 const accessTokenInFlight = new Map();
 const accessTokenRefreshInFlight = new Map();
@@ -115,7 +125,7 @@ export function parseWechatJson(rawText) {
 }
 /** Read the numeric errcode of a WeChat envelope; absent or non-numeric reads as null. */
 export function readWechatErrcode(record) {
-    return optionalInteger(record?.errcode) ?? null;
+    return optionalIntegerOrNull(record?.errcode);
 }
 /** Whether the errcode marks the access token as invalid, so the caller can refresh and retry once. */
 export function isWechatTokenError(errcode) {
@@ -124,7 +134,8 @@ export function isWechatTokenError(errcode) {
 /**
  * Map a failed WeChat API call to the shared provider error. Rate limits
  * (45009/45011) become 429, the missing-permission 48001 becomes 403, the
- * 4xxxx client errcodes become 400, and everything else becomes a 502.
+ * 4xxxx client errcodes and the documented invalid-input store errcodes become
+ * 400, and everything else becomes a 502.
  */
 export function normalizeWechatApiError(result) {
     const errcode = readWechatErrcode(result.record);
@@ -142,7 +153,7 @@ export function normalizeWechatApiError(result) {
     if (errcode === 48001) {
         return new ProviderRequestError(403, message, result.record);
     }
-    if (errcode !== null && errcode >= 40000 && errcode < 50000) {
+    if (errcode !== null && ((errcode >= 40000 && errcode < 50000) || wechatInvalidInputErrcodes.has(errcode))) {
         return new ProviderRequestError(400, message, result.record);
     }
     if (result.status >= 400 && result.status < 500) {