@oomol-lab/open-connector 1.7.0 → 1.8.0

package/src/saas/saas-client.js

@@ -0,0 +1,369 @@
+import { optionalRecord, optionalString } from "../core/cast.js";
+import { isFailureEnvelope, isSuccessEnvelope, readRemoteJson, RemoteHttpError, requestRemote, } from "../core/remote-http.js";
+import { assertPublicHttpUrl, encodePathSegment } from "../core/request.js";
+export class SaasError extends Error {
+    code;
+    status;
+    retryAfter;
+    reason;
+    connectionRequestId;
+    remoteExecutionId;
+    constructor(code, message, status = 400, retryAfter, reason) {
+        super(message);
+        this.code = code;
+        this.status = status;
+        this.retryAfter = retryAfter;
+        this.reason = reason;
+    }
+}
+const executionErrors = {
+    invalid_input: { status: 400, message: "SaaS rejected the action or proxy input. Check the remote schema." },
+    scope_missing: { status: 403, message: "The SaaS account is missing required scopes." },
+    policy_denied: { status: 403, message: "SaaS execution policy denied this request." },
+    credential_expired: { status: 409, message: "The SaaS account requires reauthorization." },
+    app_not_ready: { status: 409, message: "The SaaS account is not ready for execution." },
+    connected_account_not_found: { status: 404, message: "The selected SaaS account was not found." },
+    provider_config_not_found: { status: 404, message: "The selected SaaS provider configuration was not found." },
+    provider_not_found: { status: 404, message: "The requested SaaS provider was not found." },
+    provider_not_configured: { status: 503, message: "The SaaS provider is not configured." },
+    proxy_not_supported: { status: 501, message: "This SaaS connection does not support proxy execution." },
+    proxy_upstream_error: { status: 502, message: "The SaaS proxy upstream request failed." },
+    proxy_upstream_timeout: { status: 504, message: "The SaaS proxy upstream request timed out." },
+    proxy_response_too_large: { status: 502, message: "The SaaS proxy response exceeded its size limit." },
+    rate_limited: { status: 429, message: "SaaS execution was rate limited." },
+    insufficient_credit: { status: 402, message: "SaaS execution has insufficient credit." },
+    provider_error: { status: 502, message: "The SaaS provider request failed." },
+};
+const remoteFailureMessages = {
+    invalid_url: "Connect blocked the SaaS address because the URL or its DNS result is not allowed. Check proxy Fake-IP and DNS settings: the SaaS hostname must resolve to a public IP address. Trusted-host overrides are not supported for SaaS requests.",
+    dns: "Connect could not resolve the SaaS hostname. Check DNS and network settings on the machine running Connect.",
+    network: "Connect could not complete the SaaS network request. Check connectivity, proxy settings and TLS certificates on the machine running Connect.",
+    redirect: "SaaS returned an HTTP redirect. Redirects are blocked to protect the project key. Check the SaaS address.",
+    invalid_json: "SaaS returned a response that is not valid UTF-8 JSON. Check the SaaS endpoint and any intervening proxy or login page.",
+    too_large: "SaaS returned a response exceeding the 4 MiB limit for project and account requests.",
+};
+/** Reject values that the project proxy protocol cannot represent before any remote request. */
+export async function parseSaasProxyRequest(input) {
+    const { proxyInputSchema } = await getSchemas();
+    try {
+        const result = proxyInputSchema.safeParse(input);
+        if (result.success) {
+            const headers = new Headers(result.data.headers);
+            if (["authorization", "proxy-authorization", "cookie", "set-cookie", "host", "x-api-key"].some((name) => headers.has(name)))
+                throw new Error("Authentication headers are not supported.");
+            const contentType = headers.get("content-type");
+            if (contentType && !supportsProxyContentType(contentType))
+                throw new Error("Only JSON and text bodies are supported.");
+            return result.data;
+        }
+    }
+    catch {
+        // Cyclic or excessively nested non-HTTP inputs cannot be serialized as JSON.
+    }
+    throw new SaasError("invalid_input", "SaaS proxy supports only GET/POST/PUT/PATCH/DELETE, primitive query values, non-authentication string headers and UTF-8 JSON or text bodies; unknown fields are not allowed.");
+}
+/** The project API never supplies credentials to the local provider runtime. */
+export class SaasClient {
+    fetcher;
+    constructor(fetcher) {
+        this.fetcher = fetcher;
+    }
+    async discover(project, signal) {
+        const { discoverySchema } = await getSchemas();
+        const discovery = await this.request(project, "/oauth/provider-configs", discoverySchema, { signal });
+        if (new Set(discovery.providerConfigs.map((config) => config.id)).size !== discovery.providerConfigs.length)
+            throw new SaasError("oauth_source_protocol_error", "SaaS discovery contains duplicate configuration IDs.", 502);
+        return discovery;
+    }
+    async getAccount(project, selector, service, signal) {
+        const { accountSchema } = await getSchemas();
+        const account = await this.request(project, `/connected-accounts/${encodePathSegment(selector.connectedAccountId)}`, accountSchema, { signal });
+        if (account.projectId !== project.projectId ||
+            account.providerConfigId !== selector.providerConfigId ||
+            account.externalUserId !== selector.externalUserId ||
+            account.connectedAccountId !== selector.connectedAccountId ||
+            account.service !== service)
+            throw new SaasError("oauth_source_mismatch", "SaaS account does not match the requested identity.", 409);
+        return account;
+    }
+    async getRequest(project, id, signal) {
+        const { requestSchema } = await getSchemas();
+        const request = await this.request(project, `/connection-requests/${encodePathSegment(id)}`, requestSchema, {
+            signal,
+        });
+        if (request.projectId !== project.projectId || request.id !== id)
+            throw new SaasError("oauth_source_mismatch", "SaaS authorization request identity does not match.", 409);
+        return request;
+    }
+    async createLink(project, input, signal) {
+        const { requestSchema } = await getSchemas();
+        const result = await this.request(project, "/connected-accounts/link", requestSchema, {
+            method: "POST",
+            signal,
+            body: JSON.stringify({
+                providerConfigId: input.providerConfigId,
+                userId: input.externalUserId,
+                alias: input.alias,
+                returnUri: input.returnUri,
+            }),
+        });
+        if (result.projectId !== project.projectId ||
+            result.providerConfigId !== input.providerConfigId ||
+            result.externalUserId !== input.externalUserId ||
+            result.alias !== input.alias)
+            throw new SaasError("oauth_source_mismatch", "SaaS authorization request identity does not match.", 409);
+        const authorizationUrl = new URL(result.authorizationUrl);
+        if (authorizationUrl.protocol !== "https:" ||
+            authorizationUrl.username ||
+            authorizationUrl.password ||
+            authorizationUrl.origin !== new URL(project.baseUrl).origin)
+            throw new SaasError("oauth_source_protocol_error", "SaaS authorization URL must use the configured origin.", 502);
+        return result;
+    }
+    async deleteAccount(project, selector, signal) {
+        const { z, identifier } = await getSchemas();
+        const query = new URLSearchParams({ providerConfigId: selector.providerConfigId, userId: selector.externalUserId });
+        const result = await this.request(project, `/connected-accounts/${encodePathSegment(selector.connectedAccountId)}?${query}`, z.strictObject({ connectedAccountId: identifier, deleted: z.literal(true) }), { method: "DELETE", signal });
+        if (result.connectedAccountId !== selector.connectedAccountId)
+            throw new SaasError("oauth_source_mismatch", "SaaS deletion result identity does not match.", 409);
+    }
+    async executeAction(project, selector, actionId, input, signal) {
+        const { z, actionResultSchema } = await getSchemas();
+        const envelope = await this.requestEnvelope(project, `/actions/${encodePathSegment(actionId)}`, z.object({ success: z.literal(true), data: actionResultSchema }), {
+            method: "POST",
+            signal,
+            body: JSON.stringify({
+                providerConfigId: selector.providerConfigId,
+                userId: selector.externalUserId,
+                connectedAccountId: selector.connectedAccountId,
+                input,
+            }),
+        }, true);
+        if (envelope.data.actionId !== actionId || !("output" in envelope.data))
+            throw new SaasError("oauth_source_protocol_error", "SaaS returned an incompatible action result.", 502);
+        return envelope.data;
+    }
+    async executeProxy(project, selector, service, request, signal) {
+        const { proxyResultSchema } = await getSchemas();
+        const envelope = await this.requestEnvelope(project, `/proxy/${encodePathSegment(service)}`, proxyResultSchema, {
+            method: "POST",
+            signal,
+            body: JSON.stringify({
+                providerConfigId: selector.providerConfigId,
+                userId: selector.externalUserId,
+                connectedAccountId: selector.connectedAccountId,
+                request: {
+                    endpoint: request.endpoint,
+                    method: request.method,
+                    query: request.query,
+                    headers: request.headers,
+                    body: request.body,
+                },
+            }),
+        }, true);
+        if (envelope.meta.service !== service || !("data" in envelope.data))
+            throw new SaasError("oauth_source_protocol_error", "SaaS returned an incompatible proxy result.", 502);
+        let contentType;
+        try {
+            contentType = new Headers(envelope.data.headers).get("content-type");
+        }
+        catch {
+            throw new SaasError("oauth_source_protocol_error", "SaaS returned invalid proxy headers.", 502);
+        }
+        if (contentType && !supportsProxyContentType(contentType))
+            throw new SaasError("oauth_source_protocol_error", "SaaS proxy supports only JSON and UTF-8 text responses.", 502);
+        return { executionId: envelope.meta.executionId, response: envelope.data };
+    }
+    async request(project, path, schema, init) {
+        const { z } = await getSchemas();
+        const envelope = await this.requestEnvelope(project, path, z.object({ success: z.literal(true), data: schema }), init);
+        return envelope.data;
+    }
+    async requestEnvelope(project, path, schema, init, execution = false) {
+        const { executionFailureSchema, executionIdentifier } = await getSchemas();
+        try {
+            return await requestRemote({
+                url: `${project.baseUrl}/v1/saas${path}`,
+                label: "SaaS",
+                timeoutMs: execution ? 300_000 : 30_000,
+                fetcher: this.fetcher,
+                init: { ...init, headers: { authorization: `Bearer ${project.apiKey}`, "content-type": "application/json" } },
+            }, async (response, signal) => {
+                const json = await readRemoteJson(response, {
+                    label: "SaaS response",
+                    maxBytes: (execution ? 64 : 4) * 1024 * 1024,
+                    signal,
+                }).catch((error) => {
+                    if (!response.ok && error instanceof RemoteHttpError && error.kind === "invalid_json")
+                        return undefined;
+                    throw error;
+                });
+                const failure = execution && !response.ok ? executionFailureSchema.safeParse(json) : undefined;
+                if (execution && (failure?.success || isFailureEnvelope(json))) {
+                    const errorCode = failure?.success
+                        ? failure.data.errorCode
+                        : optionalString(optionalRecord(json)?.errorCode);
+                    const known = Object.hasOwn(executionErrors, errorCode) ? executionErrors[errorCode] : undefined;
+                    const error = new SaasError(known ? errorCode : "oauth_source_unavailable", known?.message ?? "SaaS execution failed.", known?.status ?? 502, readRetryAfter(response));
+                    const remoteId = executionIdentifier.safeParse(failure?.success ? failure.data.executionId : optionalRecord(optionalRecord(json)?.meta)?.executionId);
+                    if (remoteId.success)
+                        error.remoteExecutionId = remoteId.data;
+                    throw error;
+                }
+                if (!response.ok) {
+                    if (response.status === 401 || response.status === 403)
+                        throw new SaasError("oauth_source_unauthorized", "SaaS project key was rejected. Update the project configuration.", 503);
+                    if (response.status === 404)
+                        throw new SaasError("oauth_source_not_found", "SaaS resource was not found.", 404);
+                    if (response.status === 429) {
+                        const retryAfter = readRetryAfter(response);
+                        throw new SaasError("oauth_source_rate_limited", "SaaS request was rate limited.", 429, retryAfter);
+                    }
+                    throw new SaasError("oauth_source_unavailable", `SaaS returned HTTP ${response.status}. Check the SaaS service logs.`, 502);
+                }
+                if (!isSuccessEnvelope(json))
+                    throw new SaasError("oauth_source_protocol_error", "SaaS returned an invalid response envelope.", 502);
+                const result = schema.safeParse(json);
+                if (!result.success)
+                    throw new SaasError("oauth_source_protocol_error", "SaaS returned fields that do not match the expected API contract. Check that the deployed SaaS version supports this Connect version.", 502);
+                return result.data;
+            });
+        }
+        catch (error) {
+            init.signal?.throwIfAborted();
+            if (error instanceof SaasError)
+                throw error;
+            if (error instanceof Error && error.name === "TimeoutError")
+                throw new SaasError("oauth_source_unavailable", "SaaS request timed out.", 504, undefined, "timeout");
+            if (execution && error instanceof RemoteHttpError && error.kind === "too_large")
+                throw new SaasError("oauth_source_response_too_large", "SaaS execution response exceeds the 64 MiB JSON limit.", 502);
+            if (error instanceof RemoteHttpError)
+                throw new SaasError("oauth_source_unavailable", remoteFailureMessages[error.kind], 502, undefined, error.kind);
+            throw error;
+        }
+    }
+}
+export function normalizeSaasBaseUrl(value) {
+    const url = assertPublicHttpUrl(value, {
+        fieldName: "SaaS baseUrl",
+        createError: () => new SaasError("invalid_input", "SaaS baseUrl must be a public HTTPS origin."),
+    });
+    if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash || url.pathname !== "/")
+        throw new SaasError("invalid_input", "SaaS baseUrl must be a public HTTPS origin.");
+    return url.origin;
+}
+function readRetryAfter(response) {
+    const header = optionalString(response.headers.get("retry-after"));
+    return header && (/^\d+$/.test(header) || Number.isFinite(Date.parse(header))) ? header : undefined;
+}
+function supportsProxyContentType(value) {
+    const [mediaType, ...parameters] = value
+        .toLowerCase()
+        .split(";")
+        .map((part) => part.trim());
+    if (!(mediaType.startsWith("text/") || mediaType === "application/json" || mediaType.endsWith("+json")))
+        return false;
+    return parameters
+        .filter((part) => /^charset\s*=/.test(part))
+        .every((part) => {
+        const charset = part
+            .slice(part.indexOf("=") + 1)
+            .trim()
+            .replace(/^"|"$/g, "");
+        return charset === "utf-8" || charset === "utf8" || charset === "us-ascii";
+    });
+}
+let schemasPromise;
+function getSchemas() {
+    return (schemasPromise ??= createSchemas());
+}
+async function createSchemas() {
+    const { z } = await import("zod");
+    const identifier = z.string().min(1);
+    const providerConfigSchema = z.strictObject({
+        id: identifier,
+        service: identifier,
+        displayName: z.string(),
+        callbackUrl: z.url({ protocol: /^https?$/ }),
+        effectiveScopes: z.array(identifier),
+        actionIds: z.array(identifier),
+        proxyAvailable: z.boolean(),
+    });
+    const discoverySchema = z.strictObject({
+        projectId: identifier,
+        providerConfigs: z.array(providerConfigSchema),
+    });
+    const accountSchema = z.strictObject({
+        projectId: identifier,
+        providerConfigId: identifier,
+        service: identifier,
+        externalUserId: identifier,
+        connectedAccountId: identifier,
+        alias: z.string().nullable(),
+        status: z.enum(["active", "reauth_required", "error", "disconnected"]),
+        providerAccountId: z.string().nullable(),
+        accountLabel: z.string().nullable(),
+        scopes: z.array(z.string()),
+    });
+    const requestSchema = z
+        .strictObject({
+        id: identifier,
+        status: z.enum(["initiated", "connected", "failed", "expired"]),
+        projectId: identifier,
+        providerConfigId: identifier,
+        externalUserId: identifier,
+        service: identifier,
+        alias: z.string().nullable(),
+        authorizationUrl: z.url({ protocol: /^https$/ }),
+        connectedAccountId: identifier.nullable(),
+        errorCode: z.string().nullable(),
+        errorMessage: z.string().nullable(),
+        expiresAt: z.iso.datetime(),
+        createdAt: z.number().finite(),
+        updatedAt: z.number().finite(),
+    })
+        .refine((value) => value.status !== "connected" || value.connectedAccountId !== null);
+    const executionIdentifier = z
+        .string()
+        .min(1)
+        .max(256)
+        .regex(/^[a-zA-Z0-9_.:-]+$/);
+    const actionResultSchema = z.strictObject({
+        executionId: executionIdentifier,
+        actionId: identifier,
+        output: z.unknown(),
+    });
+    const proxyResultSchema = z.object({
+        success: z.literal(true),
+        data: z.strictObject({
+            status: z.number().int().min(200).max(599),
+            headers: z.record(z.string(), z.string()),
+            data: z.unknown(),
+        }),
+        meta: z.object({ executionId: executionIdentifier, service: identifier }),
+    });
+    const proxyInputSchema = z.strictObject({
+        endpoint: z.string().min(1),
+        method: z.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]),
+        query: z.record(z.string(), z.union([z.string(), z.number().finite(), z.boolean(), z.null()])).optional(),
+        headers: z.record(z.string(), z.string()).optional(),
+        body: z.json().optional(),
+    });
+    const executionFailureSchema = z.object({
+        errorCode: identifier,
+        errorMessage: z.string(),
+        executionId: executionIdentifier.optional(),
+    });
+    return {
+        z,
+        identifier,
+        discoverySchema,
+        accountSchema,
+        requestSchema,
+        actionResultSchema,
+        proxyResultSchema,
+        proxyInputSchema,
+        executionFailureSchema,
+        executionIdentifier,
+    };
+}

package/src/saas/saas-execution-service.d.ts

@@ -0,0 +1,15 @@
+import type { SaasConnectionReference } from "../connection-service.ts";
+import type { SaasActionResult, SaasProxyResult } from "./saas-client.ts";
+import type { SaasProjectService } from "./saas-project-service.ts";
+import { SaasClient } from "./saas-client.ts";
+export interface SaasExecutionServiceOptions {
+    projects: SaasProjectService;
+    client: SaasClient;
+}
+/** Resolves capabilities for the selected connection without fetching provider credentials or profiles. */
+export declare class SaasExecutionService {
+    private readonly options;
+    constructor(options: SaasExecutionServiceOptions);
+    executeAction(reference: SaasConnectionReference, service: string, actionId: string, input: unknown, signal?: AbortSignal): Promise<SaasActionResult>;
+    executeProxy(reference: SaasConnectionReference, service: string, input: unknown, signal?: AbortSignal): Promise<SaasProxyResult>;
+}

package/src/saas/saas-execution-service.js

@@ -0,0 +1,21 @@
+import { parseSaasProxyRequest, SaasClient, SaasError } from "./saas-client.js";
+/** Resolves capabilities for the selected connection without fetching provider credentials or profiles. */
+export class SaasExecutionService {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    async executeAction(reference, service, actionId, input, signal) {
+        const { project, config } = await this.options.projects.resolveExecutionConfig(service, reference.providerConfigId, reference.managedProjectId, signal);
+        if (!config.actionIds.includes(actionId))
+            throw new SaasError("oauth_source_unsupported", "The selected SaaS connection does not support this action.");
+        return this.options.client.executeAction(project, reference, actionId, input, signal);
+    }
+    async executeProxy(reference, service, input, signal) {
+        const request = await parseSaasProxyRequest(input);
+        const { project, config } = await this.options.projects.resolveExecutionConfig(service, reference.providerConfigId, reference.managedProjectId, signal);
+        if (!config.proxyAvailable)
+            throw new SaasError("proxy_not_supported", "The selected SaaS connection does not support proxy execution.", 501);
+        return this.options.client.executeProxy(project, reference, service, request, signal);
+    }
+}

package/src/saas/saas-oauth-service.d.ts

@@ -0,0 +1,25 @@
+import type { OAuthConnectionRequestInput, OAuthConnectionRequestStart } from "../oauth/oauth-flow-service.ts";
+import type { ConnectionRequest, ConnectionRequestStore } from "../server/storage/connection-request-store.ts";
+import type { SaasProjectService } from "./saas-project-service.ts";
+import { SaasClient } from "./saas-client.ts";
+export interface SaasOAuthServiceOptions {
+    projects: SaasProjectService;
+    requests: ConnectionRequestStore;
+    client: SaasClient;
+}
+export interface SaasSyncResult {
+    request: ConnectionRequest;
+    returnUri?: string;
+}
+/** One owner for bearer polling and browser synchronization; no network work runs inside a database transaction. */
+export declare class SaasOAuthService {
+    private readonly options;
+    private readonly syncing;
+    constructor(options: SaasOAuthServiceOptions);
+    assertLocalAuthorization(service: string): Promise<void>;
+    start(input: OAuthConnectionRequestInput): Promise<OAuthConnectionRequestStart | undefined>;
+    sync(id: string, owner: string, signal?: AbortSignal): Promise<ConnectionRequest | undefined>;
+    syncForBrowser(id: string, owner: string, signal?: AbortSignal): Promise<SaasSyncResult | undefined>;
+    private advance;
+    private nextPollAt;
+}

package/src/saas/saas-oauth-service.js

@@ -0,0 +1,197 @@
+import { callbackReturnUri, validateReturnUri } from "../oauth/oauth-flow-service.js";
+import { SaasClient, SaasError } from "./saas-client.js";
+/** One owner for bearer polling and browser synchronization; no network work runs inside a database transaction. */
+export class SaasOAuthService {
+    options;
+    syncing = new Map();
+    constructor(options) {
+        this.options = options;
+    }
+    async assertLocalAuthorization(service) {
+        if ((await this.options.projects.getSource(service)).mode === "saas")
+            throw new SaasError("invalid_input", "Use /v1/connections/:service/connect for SaaS OAuth authorization.");
+    }
+    async start(input) {
+        const source = input.target
+            ? input.target.source === "saas"
+                ? { mode: "saas", ...input.target.reference }
+                : { mode: "local" }
+            : await this.options.projects.getSource(input.service);
+        if (source.mode === "local")
+            return undefined;
+        if (input.authorizationOptionIds !== undefined || input.extra !== undefined || input.secretExtra !== undefined)
+            throw new SaasError("invalid_input", "Configure SaaS OAuth scopes and credentials on the SaaS provider config; per-request overrides are not supported.");
+        validateReturnUri(input.returnUri);
+        const signal = input.signal
+            ? AbortSignal.any([input.signal, AbortSignal.timeout(30_000)])
+            : AbortSignal.timeout(30_000);
+        const { project } = await this.options.projects.resolveConfig(input.service, source.providerConfigId, source.managedProjectId, signal);
+        const id = crypto.randomUUID();
+        const completion = new URL("/oauth/saas/complete", this.options.projects.requireOrigin());
+        completion.searchParams.set("request", id);
+        const pending = {
+            connectionRequestId: id,
+            connectionId: input.target?.id ?? crypto.randomUUID(),
+            owner: input.owner,
+            service: input.service,
+            connectionName: input.target?.connectionName ?? input.connectionName ?? crypto.randomUUID(),
+            managedProjectId: project.id,
+            providerConfigId: source.providerConfigId,
+            externalUserId: await this.options.projects.externalUserId(),
+            createdAt: new Date().toISOString(),
+            expiresAt: new Date(Date.now() + 600_000).toISOString(),
+            returnUri: input.returnUri,
+            target: input.target ? { id: input.target.id, revision: input.target.revision } : undefined,
+            comment: input.target?.source === "saas" ? input.target.comment : null,
+        };
+        signal.throwIfAborted();
+        const lease = await this.options.requests.createSaas(pending);
+        try {
+            const remote = await this.options.client.createLink(project, {
+                providerConfigId: pending.providerConfigId,
+                externalUserId: pending.externalUserId,
+                alias: `connect-${id}`,
+                returnUri: completion.toString(),
+            }, signal);
+            if (remote.service !== input.service)
+                throw new SaasError("oauth_source_mismatch", "SaaS authorization service does not match.", 409);
+            if (!(await this.options.requests.saveSaasRequest(lease, remote.id, remote.expiresAt)))
+                throw new SaasError("request_superseded", "This authorization request was replaced or its lease was lost.", 409);
+            await this.options.requests.releaseSaas(lease, Date.now() + 2_000);
+            return {
+                connectionRequestId: id,
+                stateHandle: id,
+                status: "initiated",
+                expiresAt: remote.expiresAt,
+                authorizationUrl: remote.authorizationUrl,
+            };
+        }
+        catch {
+            await this.options.requests.failSaas(lease, "oauth_source_result_unknown", "Authorization creation could not be confirmed. Check SaaS accounts before starting again.");
+            const error = new SaasError("oauth_source_result_unknown", "Authorization creation could not be confirmed. Check SaaS accounts before starting again.", 502);
+            error.connectionRequestId = id;
+            throw error;
+        }
+    }
+    async sync(id, owner, signal) {
+        signal?.throwIfAborted();
+        const key = `${owner}\0${id}`;
+        let promise = this.syncing.get(key);
+        if (!promise) {
+            promise = this.advance(id, owner).finally(() => {
+                this.syncing.delete(key);
+            });
+            this.syncing.set(key, promise);
+        }
+        if (!signal)
+            await promise;
+        else {
+            const onAbort = () => rejectAbort(signal.reason);
+            let rejectAbort;
+            const aborted = new Promise((_resolve, reject) => {
+                rejectAbort = reject;
+                signal.addEventListener("abort", onAbort, { once: true });
+            });
+            try {
+                await Promise.race([promise, aborted]);
+            }
+            finally {
+                signal.removeEventListener("abort", onAbort);
+            }
+        }
+        signal?.throwIfAborted();
+        return this.options.requests.get(id, owner);
+    }
+    async syncForBrowser(id, owner, signal) {
+        const request = await this.sync(id, owner, signal);
+        if (!request)
+            return undefined;
+        const uri = await this.options.requests.getSaasReturnUri(id, owner);
+        const returnUri = uri && (request.status === "connected" || request.status === "failed")
+            ? callbackReturnUri({ returnUri: uri, service: request.service }, request.status === "connected" ? "success" : "error", request.errorCode ?? undefined, request.errorMessage ?? undefined)
+            : undefined;
+        return { request, returnUri };
+    }
+    async advance(id, owner) {
+        const signal = AbortSignal.timeout(30_000);
+        signal.throwIfAborted();
+        const lease = await this.options.requests.claimSaas(id, owner);
+        if (!lease)
+            return;
+        try {
+            signal.throwIfAborted();
+            if (lease.phase === "creating") {
+                await this.options.requests.failSaas(lease, "oauth_source_result_unknown", "Authorization creation could not be confirmed. Check SaaS accounts before starting again.");
+                return;
+            }
+            if (lease.candidate) {
+                signal.throwIfAborted();
+                await this.options.requests.completeSaas(lease);
+                return;
+            }
+            const pending = lease.pending;
+            const project = await this.options.projects.requireProject(pending.managedProjectId);
+            const remote = await this.options.client.getRequest(project, lease.remoteRequestId, signal);
+            if (remote.providerConfigId !== pending.providerConfigId ||
+                remote.externalUserId !== pending.externalUserId ||
+                remote.service !== pending.service ||
+                remote.alias !== `connect-${pending.connectionRequestId}`)
+                throw new SaasError("oauth_source_mismatch", "SaaS authorization result does not match the saved request.", 409);
+            if (remote.status === "initiated") {
+                await this.options.requests.releaseSaas(lease, Date.now() + 2_000);
+                return;
+            }
+            if (remote.status !== "connected") {
+                await this.options.requests.failSaas(lease, "oauth_authorization_failed", "SaaS authorization failed or expired.");
+                return;
+            }
+            const account = await this.options.client.getAccount(project, {
+                providerConfigId: pending.providerConfigId,
+                externalUserId: pending.externalUserId,
+                connectedAccountId: remote.connectedAccountId,
+            }, pending.service, signal);
+            if (account.alias !== remote.alias)
+                throw new SaasError("oauth_source_mismatch", "SaaS account alias does not match this authorization attempt.", 409);
+            if (account.status !== "active" && account.status !== "reauth_required") {
+                await this.options.requests.failSaas(lease, "oauth_authorization_failed", "The SaaS account is not available.");
+                return;
+            }
+            signal.throwIfAborted();
+            if (!(await this.options.requests.saveSaasCandidate(lease, {
+                connectedAccountId: account.connectedAccountId,
+                profile: {
+                    accountId: account.providerAccountId ?? account.connectedAccountId,
+                    displayName: account.accountLabel ?? account.service,
+                    grantedScopes: account.scopes,
+                },
+                status: account.status,
+                comment: pending.comment ?? null,
+            })))
+                return;
+            signal.throwIfAborted();
+            await this.options.requests.completeSaas(lease);
+        }
+        catch (error) {
+            if (error instanceof SaasError &&
+                (error.code === "oauth_source_mismatch" || error.code === "oauth_source_protocol_error")) {
+                await this.options.requests.failSaas(lease, error.code, error.message);
+            }
+            else {
+                await this.options.requests.releaseSaas(lease, this.nextPollAt(lease, error), true);
+            }
+            if (signal.aborted)
+                throw new SaasError("oauth_source_unavailable", "SaaS authorization synchronization timed out.", 504);
+            throw error;
+        }
+    }
+    nextPollAt(lease, error) {
+        let delay = Math.min(30_000, 2_000 * 2 ** Math.min(lease.pollAttempts, 4));
+        if (error instanceof SaasError && error.retryAfter) {
+            const seconds = Number(error.retryAfter);
+            const retryAt = Number.isFinite(seconds) ? Date.now() + seconds * 1_000 : Date.parse(error.retryAfter);
+            if (Number.isFinite(retryAt))
+                delay = Math.max(delay, retryAt - Date.now());
+        }
+        return Date.now() + delay;
+    }
+}