@oomol-lab/open-connector 1.7.0 → 1.8.0

package/src/saas/saas-project-service.d.ts

@@ -0,0 +1,61 @@
+import type { CatalogStore } from "../catalog-store.ts";
+import type { ISecretCodec } from "../server/secrets/secret-codec-core.ts";
+import type { ManagedProject, SaasProjectStore } from "../server/storage/saas-project-store.ts";
+import type { SaasProviderConfig } from "./saas-client.ts";
+import { SaasClient } from "./saas-client.ts";
+export interface SaasProjectState {
+    configured: boolean;
+    managedProjectId: string | null;
+    projectId: string | null;
+    baseUrl: string | null;
+    status: "unconfigured" | "available" | "unavailable" | "auth_error";
+    cleanup: {
+        pending: number;
+        manual: number;
+        paused: boolean;
+    };
+}
+export type OAuthSource = {
+    mode: "local";
+} | {
+    mode: "saas";
+    managedProjectId: string;
+    projectId: string;
+    providerConfigId: string;
+};
+export interface SaasProjectServiceOptions {
+    catalog: CatalogStore;
+    store: SaasProjectStore;
+    secretCodec: ISecretCodec;
+    configuredOrigin?: string;
+    client?: SaasClient;
+}
+/** Owns configuration and capability checks; account lifecycle stays in the connection request service. */
+export declare class SaasProjectService {
+    private readonly options;
+    private readonly client;
+    constructor(options: SaasProjectServiceOptions);
+    requireOrigin(): string;
+    externalUserId(): Promise<string>;
+    getState(signal?: AbortSignal): Promise<SaasProjectState>;
+    configure(input: unknown, signal?: AbortSignal): Promise<SaasProjectState>;
+    remove(): Promise<void>;
+    listProviderConfigs(signal?: AbortSignal): Promise<{
+        projectId: string;
+        providerConfigs: SaasProviderConfig[];
+    }>;
+    listSources(): Promise<Map<string, OAuthSource>>;
+    getSource(service: string): Promise<OAuthSource>;
+    setSource(service: string, input: unknown, signal?: AbortSignal): Promise<OAuthSource>;
+    resolveConfig(service: string, configId: string, managedProjectId?: string, signal?: AbortSignal): Promise<{
+        project: ManagedProject;
+        config: SaasProviderConfig;
+    }>;
+    resolveExecutionConfig(service: string, configId: string, managedProjectId: string | undefined, signal?: AbortSignal): Promise<{
+        project: ManagedProject;
+        config: SaasProviderConfig;
+    }>;
+    requireProject(managedProjectId?: string): Promise<ManagedProject>;
+    private discover;
+    private getProvider;
+}

package/src/saas/saas-project-service.js

@@ -0,0 +1,211 @@
+import { normalizeSaasBaseUrl, SaasClient, SaasError } from "./saas-client.js";
+/** Owns configuration and capability checks; account lifecycle stays in the connection request service. */
+export class SaasProjectService {
+    options;
+    client;
+    constructor(options) {
+        this.options = options;
+        this.client = options.client ?? new SaasClient();
+    }
+    requireOrigin() {
+        try {
+            const value = this.options.configuredOrigin;
+            if (!value)
+                throw new Error();
+            const url = new URL(value);
+            if (!["http:", "https:"].includes(url.protocol) ||
+                url.username ||
+                url.password ||
+                url.search ||
+                url.hash ||
+                url.pathname !== "/")
+                throw new Error();
+            return url.origin;
+        }
+        catch {
+            throw new SaasError("oauth_source_configuration_error", "Set OOMOL_CONNECT_ORIGIN to an explicit HTTP(S) origin before enabling SaaS OAuth.", 400, undefined, "origin_required");
+        }
+    }
+    async externalUserId() {
+        return `open-connector:${await this.options.store.getInstanceId()}`;
+    }
+    async getState(signal) {
+        const project = await this.options.store.getProject();
+        const cleanup = await this.options.store.getCleanupStats();
+        if (!project)
+            return {
+                configured: false,
+                managedProjectId: null,
+                projectId: null,
+                baseUrl: null,
+                status: "unconfigured",
+                cleanup,
+            };
+        let status = "available";
+        for (let attempt = 0; attempt < 2; attempt++) {
+            try {
+                await this.discover(project, signal);
+                break;
+            }
+            catch (error) {
+                signal?.throwIfAborted();
+                if (!(error instanceof SaasError))
+                    throw error;
+                if (attempt === 0 &&
+                    error.code === "oauth_source_unavailable" &&
+                    (error.reason === undefined || ["network", "dns", "timeout"].includes(error.reason)))
+                    continue;
+                status = error.code === "oauth_source_unauthorized" ? "auth_error" : "unavailable";
+                break;
+            }
+        }
+        return {
+            configured: true,
+            managedProjectId: project.id,
+            projectId: project.projectId,
+            baseUrl: project.baseUrl,
+            status,
+            cleanup,
+        };
+    }
+    async configure(input, signal) {
+        const { z } = await import("zod");
+        const projectInput = z.strictObject({
+            baseUrl: z.string().min(1),
+            projectApiKey: z
+                .string()
+                .trim()
+                .min(1)
+                .regex(/^[^\r\n]+$/),
+        });
+        const parsed = projectInput.safeParse(input);
+        if (!parsed.success)
+            throw new SaasError("invalid_input", "Provide baseUrl and projectApiKey only.");
+        if (!this.options.secretCodec.encrypted)
+            throw new SaasError("oauth_source_configuration_error", "Configure encryption before saving a SaaS project key.", 400, undefined, "encryption_required");
+        this.requireOrigin();
+        const baseUrl = normalizeSaasBaseUrl(parsed.data.baseUrl);
+        const current = await this.options.store.getProject();
+        if (current && current.baseUrl !== baseUrl)
+            throw new SaasError("oauth_source_mismatch", "Remove the existing project before changing its origin.", 409);
+        const discovery = await this.client.discover({ baseUrl, apiKey: parsed.data.projectApiKey }, signal);
+        const project = {
+            id: current?.id ?? crypto.randomUUID(),
+            projectId: discovery.projectId,
+            baseUrl,
+            apiKey: parsed.data.projectApiKey,
+        };
+        if (!(await this.options.store.saveProject(project)))
+            throw new SaasError("oauth_source_mismatch", "The project identity changed. Reload the configuration before retrying.", 409);
+        return {
+            configured: true,
+            managedProjectId: project.id,
+            projectId: project.projectId,
+            baseUrl,
+            status: "available",
+            cleanup: await this.options.store.getCleanupStats(),
+        };
+    }
+    async remove() {
+        const project = await this.options.store.getProject();
+        if (project && !(await this.options.store.deleteProject(project.id)))
+            throw new SaasError("oauth_source_in_use", "Clear service defaults, connections, pending requests and cleanup tasks before removing this project.", 409);
+    }
+    async listProviderConfigs(signal) {
+        const project = await this.requireProject();
+        const discovery = await this.discover(project, signal);
+        return {
+            projectId: project.projectId,
+            providerConfigs: discovery.providerConfigs.flatMap((config) => {
+                const provider = this.options.catalog.providers.find((provider) => provider.service === config.service);
+                if (!provider?.auth.some((auth) => auth.type === "oauth2"))
+                    return [];
+                const actionIds = config.actionIds.filter((id) => this.options.catalog.actionsById.get(id)?.service === config.service);
+                return [{ ...config, actionIds }];
+            }),
+        };
+    }
+    async listSources() {
+        return new Map((await this.options.store.listSources()).map(({ service, ...source }) => [service, { mode: "saas", ...source }]));
+    }
+    async getSource(service) {
+        this.getProvider(service);
+        const source = await this.options.store.getSource(service);
+        if (!source)
+            return { mode: "local" };
+        const project = await this.requireProject();
+        if (project.id !== source.managedProjectId)
+            throw new SaasError("oauth_source_mismatch", "The configured OAuth source no longer matches the project.", 409);
+        return {
+            mode: "saas",
+            managedProjectId: source.managedProjectId,
+            projectId: project.projectId,
+            providerConfigId: source.providerConfigId,
+        };
+    }
+    async setSource(service, input, signal) {
+        this.getProvider(service);
+        const { z } = await import("zod");
+        const sourceInput = z.discriminatedUnion("mode", [
+            z.strictObject({ mode: z.literal("local") }),
+            z.strictObject({ mode: z.literal("saas"), providerConfigId: z.string().min(1) }),
+        ]);
+        const parsed = sourceInput.safeParse(input);
+        if (!parsed.success)
+            throw new SaasError("invalid_input", "Use mode local, or mode saas with providerConfigId.");
+        if (parsed.data.mode === "local") {
+            await this.options.store.setSource(service, undefined);
+            return { mode: "local" };
+        }
+        const { project, config } = await this.resolveConfig(service, parsed.data.providerConfigId, undefined, signal);
+        if (!(await this.options.store.setSource(service, { managedProjectId: project.id, providerConfigId: config.id })))
+            throw new SaasError("oauth_source_mismatch", "The project was removed while selecting the OAuth source.", 409);
+        return { mode: "saas", managedProjectId: project.id, projectId: project.projectId, providerConfigId: config.id };
+    }
+    async resolveConfig(service, configId, managedProjectId, signal) {
+        const provider = this.getProvider(service);
+        this.requireOrigin();
+        const { project, config } = await this.resolveExecutionConfig(service, configId, managedProjectId, signal);
+        const auth = provider.auth.find((auth) => auth.type === "oauth2");
+        const required = new Set(auth.authorizationOptions?.filter((option) => option.required).map((option) => option.id));
+        for (const id of required)
+            for (const dependency of auth.authorizationOptions?.find((option) => option.id === id)?.requires ?? [])
+                required.add(dependency);
+        if ([...required].some((scope) => !config.effectiveScopes.includes(scope)))
+            throw new SaasError("oauth_source_scope_missing", "The SaaS configuration is missing required OAuth scopes.");
+        const supportsAction = config.actionIds.some((id) => this.options.catalog.actionsById.get(id)?.service === service);
+        if (!supportsAction && !config.proxyAvailable)
+            throw new SaasError("oauth_source_unsupported", "This configuration has no compatible actions or proxy capability.");
+        return { project, config };
+    }
+    async resolveExecutionConfig(service, configId, managedProjectId, signal) {
+        const project = await this.requireProject(managedProjectId);
+        const discovery = await this.discover(project, signal);
+        const config = discovery.providerConfigs.find((config) => config.id === configId && config.service === service);
+        if (!config)
+            throw new SaasError("oauth_source_mismatch", "Select an available OAuth configuration for this service.", 409);
+        return { project, config };
+    }
+    async requireProject(managedProjectId) {
+        const project = await this.options.store.getProject();
+        if (!project)
+            throw new SaasError("oauth_source_not_configured", "Configure a SaaS project first.");
+        if (managedProjectId && managedProjectId !== project.id)
+            throw new SaasError("oauth_source_mismatch", "The OAuth project binding no longer matches.", 409);
+        return project;
+    }
+    async discover(project, signal) {
+        const discovery = await this.client.discover(project, signal);
+        if (discovery.projectId !== project.projectId)
+            throw new SaasError("oauth_source_mismatch", "SaaS project identity does not match the saved configuration.", 409);
+        return discovery;
+    }
+    getProvider(service) {
+        const provider = this.options.catalog.providers.find((provider) => provider.service === service);
+        if (!provider)
+            throw new SaasError("unknown_service", "Provider was not found.", 404);
+        if (!provider.auth.some((auth) => auth.type === "oauth2"))
+            throw new SaasError("unsupported_auth_type", "This provider does not support OAuth.");
+        return provider;
+    }
+}

package/src/server/actions/action-idempotency.d.ts

@@ -19,6 +19,7 @@ export type IdempotencyKeyResult = {
 export interface ActionRequestFingerprintInput {
     actionId: string;
     connectionName: string;
+    connectionId?: string;
     input: unknown;
     runtimeTokenId?: string;
 }

package/src/server/actions/action-idempotency.js

@@ -42,6 +42,7 @@ export function hashActionRequest(input) {
     return sha256(JSON.stringify({
         actionId: input.actionId,
         connectionName: input.connectionName,
+        connectionId: input.connectionId,
         input: canonicalize(input.input, 1),
         runtimeTokenId: input.runtimeTokenId,
     }));

package/src/server/actions/action-runner.d.ts

@@ -4,7 +4,9 @@ import type { ActionPolicySnapshot } from "../../core/action-policy.ts";
 import type { RuntimeLogger, ExecutionResult, TransitFileWriter } from "../../core/types.ts";
 import type { MarketplaceService } from "../../marketplace/marketplace-service.ts";
 import type { IProviderLoader } from "../../providers/provider-loader.ts";
+import type { SaasExecutionService } from "../../saas/saas-execution-service.ts";
 import type { IRunLogStore, RunLog, RunLogCaller, RunLogListInput, RunLogPage } from "../storage/runtime-store.ts";
+import { SaasError } from "../../saas/saas-client.ts";
 export interface ActionRunnerOptions {
     catalog: CatalogStore;
     providerLoader: IProviderLoader;
@@ -13,12 +15,14 @@ export interface ActionRunnerOptions {
     transitFiles?: TransitFileWriter;
     logger?: RuntimeLogger;
     marketplace?: MarketplaceService;
+    saas?: SaasExecutionService;
 }
 export interface RunActionInput {
     actionId: string;
     input: unknown;
     caller: RunLogCaller;
     connectionName?: string;
+    connectionId?: string;
     policy: ActionPolicySnapshot;
     runtimeTokenId?: string;
     signal?: AbortSignal;
@@ -26,6 +30,9 @@ export interface RunActionInput {
 export interface ActionRunResult {
     executionId: string;
     auditPersisted: boolean;
+    remoteExecutionId?: string;
+    failureStatus?: SaasError["status"];
+    retryAfter?: string;
     result: ExecutionResult;
     connection?: ConnectionSummary;
 }

package/src/server/actions/action-runner.js

@@ -1,5 +1,6 @@
 import { ConnectionError } from "../../connection-service.js";
 import { executeAction as executeProviderAction } from "../../core/execution.js";
+import { SaasError } from "../../saas/saas-client.js";
 import { safeRunLogError, summarizeForRunLog } from "./run-log-summary.js";
 /**
  * Shared execution boundary for HTTP, MCP, and future local callers.
@@ -32,6 +33,9 @@ export class ActionRunner {
         let policy = input.policy.evaluate(action);
         let connection;
         let result;
+        let remoteExecutionId;
+        let failureStatus;
+        let retryAfter;
         if (!policy.allowed) {
             result = { ok: false, error: { code: policy.code, message: policy.message } };
         }
@@ -40,7 +44,7 @@ export class ActionRunner {
         }
         else {
             try {
-                const summary = await this.options.connections.getConnectionSummary(action.service, input.connectionName);
+                const summary = await this.options.connections.getConnectionSummary(action.service, input.connectionName, input.connectionId);
                 input.signal?.throwIfAborted();
                 const connectionPolicy = summary?.authType === "no_auth" ? undefined : input.policy.evaluateConnection(summary?.id);
                 if (connectionPolicy && !connectionPolicy.allowed) {
@@ -57,15 +61,31 @@ export class ActionRunner {
                     };
                 }
                 else {
-                    connection = await this.options.connections.resolveForExecution(action.service, input.connectionName);
+                    connection = await this.options.connections.resolveForExecution(action.service, input.connectionName, input.connectionId);
                     input.signal?.throwIfAborted();
-                    const executor = action.execution.locallyExecutable && !connection.marketplace
+                    const targetPolicy = connection.summary?.authType === "no_auth"
+                        ? undefined
+                        : input.policy.evaluateConnection(connection.summary?.id);
+                    if (targetPolicy && !targetPolicy.allowed) {
+                        policy = targetPolicy;
+                        throw new ConnectionError(targetPolicy.code, targetPolicy.message);
+                    }
+                    const executor = action.execution.locallyExecutable && connection.kind === "local"
                         ? await this.options.providerLoader.loadActionExecutor(action.service, action.id, this.options.catalog.providers.find((provider) => provider.service === action.service)?.displayName)
                         : undefined;
                     input.signal?.throwIfAborted();
-                    result = await executeProviderAction(action, connection.marketplace
-                        ? (actionInput) => this.options.marketplace.execute(action.id, actionInput, input.signal)
-                        : executor, input.input, this.createExecutionContext(connection.getCredential, input.signal));
+                    const saasReference = connection.kind === "saas" ? connection.reference : undefined;
+                    result = await executeProviderAction(action, saasReference
+                        ? async (actionInput) => {
+                            if (!this.options.saas)
+                                throw new SaasError("oauth_source_unavailable", "SaaS execution is unavailable.", 503);
+                            const remote = await this.options.saas.executeAction(saasReference, action.service, action.id, actionInput, input.signal);
+                            remoteExecutionId = remote.executionId;
+                            return { ok: true, output: remote.output };
+                        }
+                        : connection.kind === "marketplace"
+                            ? (actionInput) => this.options.marketplace.execute(action.id, actionInput, input.signal)
+                            : executor, input.input, this.createExecutionContext(connection.kind === "local" ? connection.getCredential : async () => undefined, input.signal));
                     if (input.signal?.aborted) {
                         result = cancelledExecutionResult();
                     }
@@ -82,6 +102,12 @@ export class ActionRunner {
                     policy = missingConnectionPolicy;
                     result = { ok: false, error: { code: policy.code, message: policy.message } };
                 }
+                else if (error instanceof SaasError) {
+                    remoteExecutionId = error.remoteExecutionId;
+                    failureStatus = error.status;
+                    retryAfter = error.retryAfter;
+                    result = { ok: false, error: { code: error.code, message: error.message } };
+                }
                 else {
                     result =
                         error instanceof ConnectionError
@@ -98,6 +124,7 @@ export class ActionRunner {
         const auditError = safeRunLogError(result.error);
         const runLog = {
             id: executionId,
+            remoteExecutionId,
             service: action.service,
             actionId: input.actionId,
             caller: input.caller,
@@ -126,6 +153,7 @@ export class ActionRunner {
         }
         const completedLogContext = {
             ...logContext,
+            remoteExecutionId,
             connectionId: connection?.summary?.id,
             durationMs,
             ok: result.ok,
@@ -141,7 +169,15 @@ export class ActionRunner {
         else {
             this.options.logger?.warn(completedLogContext, "action run failed");
         }
-        return { executionId, auditPersisted, result, connection: connection?.summary };
+        return {
+            executionId,
+            remoteExecutionId,
+            failureStatus,
+            retryAfter,
+            auditPersisted,
+            result,
+            connection: connection?.summary,
+        };
     }
     listRuns(input) {
         return this.options.runs.list(input);

package/src/server/actions/run-log-summary.js

@@ -21,6 +21,15 @@ const safeErrorMessages = {
     oauth_token_expired: "The OAuth credential has expired.",
     provider_error: "The provider request failed.",
     rate_limited: "The provider rate limit was reached.",
+    execution_cancelled: "Action execution was cancelled; remote side effects may have completed.",
+    scope_missing: "The SaaS account is missing required scopes.",
+    credential_expired: "The SaaS account requires reauthorization.",
+    insufficient_credit: "Execution has insufficient credit.",
+    oauth_source_unavailable: "SaaS execution is unavailable.",
+    oauth_source_unauthorized: "The SaaS project key was rejected.",
+    oauth_source_protocol_error: "SaaS returned an incompatible response.",
+    oauth_source_unsupported: "The SaaS connection does not support this action.",
+    oauth_source_response_too_large: "The SaaS execution response exceeded the size limit.",
 };
 /** Return a bounded, redacted value suitable for run audit storage. */
 export function summarizeForRunLog(value) {

package/src/server/api/auth.d.ts

@@ -15,6 +15,7 @@ export interface LocalAuthSession {
     adminAuthConfigured: boolean;
     authenticated: boolean;
 }
+export declare function hasAdminBearer(context: Context): boolean;
 export declare function readRuntimeGrant(context: Context): RuntimeGrant | undefined;
 export declare function createLocalAuthMiddleware(options: LocalAuthOptions): MiddlewareHandler;
 export declare function readLocalAuthSession(context: Context, options: LocalAuthOptions): Promise<LocalAuthSession>;

package/src/server/api/auth.js

@@ -7,6 +7,10 @@ const authCookieName = "oomol_connect_admin_session";
 const authCookieVersion = "v1";
 const authCookieMaxAgeSeconds = 2_592_000;
 const authCookieMaxAgeMs = authCookieMaxAgeSeconds * 1000;
+const adminBearerRequests = new WeakSet();
+export function hasAdminBearer(context) {
+    return adminBearerRequests.has(context.req.raw);
+}
 const runtimeGrants = new WeakMap();
 export function readRuntimeGrant(context) {
     return runtimeGrants.get(context.req.raw);
@@ -40,6 +44,8 @@ export function createLocalAuthMiddleware(options) {
                 message: "Configure an admin token to manage connections.",
             });
         }
+        if (adminToken && matchesConfiguredToken(context, adminToken))
+            adminBearerRequests.add(context.req.raw);
         if (await hasValidToken(context, options, scope)) {
             if (scope === "admin") {
                 await installAdminCookieForBearer(context, options);
@@ -82,6 +88,7 @@ async function installLocalAuthCookie(context, options) {
 }
 function isPublicPath(path, method) {
     return (path === "/health" ||
+        (method === "GET" && path === "/oauth/saas/complete") ||
         path === "/oauth/callback" ||
         path.startsWith("/oauth/callback/") ||
         (method === "GET" && path === "/api/auth/session") ||
@@ -137,7 +144,9 @@ async function hasValidToken(context, options, scope) {
     return scope === "runtime" ? await hasValidRuntimeToken(context, options) : false;
 }
 async function hasRequestToken(context, token) {
-    return matchesConfiguredToken(context, token) || (await hasValidAuthCookie(context, token));
+    if (context.req.header("authorization") !== undefined)
+        return matchesConfiguredToken(context, token);
+    return await hasValidAuthCookie(context, token);
 }
 async function hasValidAuthCookie(context, token) {
     const cookie = getCookie(context, authCookieName);
@@ -239,5 +248,7 @@ function isConnectionManagementPath(path) {
     return (/^\/v1\/providers\/[^/]+\/setup$/.test(path) ||
         path === "/v1/connections" ||
         path.startsWith("/v1/connections/") ||
-        path.startsWith("/v1/connection-requests/"));
+        path.startsWith("/v1/connection-requests/") ||
+        path === "/api/oauth/connection-requests" ||
+        path.startsWith("/api/oauth/connection-requests/"));
 }

package/src/server/api/cache-policy.js

@@ -8,7 +8,10 @@ export function getResponseCachePolicy(method, path, status) {
             vary: "Authorization, Cookie, Accept-Encoding",
         };
     }
-    if (path.startsWith("/v1/connection-requests/"))
+    if (path.startsWith("/v1/connection-requests/") ||
+        path === "/api/oauth/connection-requests" ||
+        path.startsWith("/api/oauth/connection-requests/") ||
+        path === "/oauth/saas/complete")
         return { cacheControl: "private, no-store" };
     if (isRuntimeResponsePath(path)) {
         return { cacheControl: "no-store" };

package/src/server/api/connection-input.d.ts

@@ -1,6 +1,12 @@
 import type { OAuthConnectionRequestInput } from "../../oauth/oauth-flow-service.ts";
 import { z } from "zod";
-export declare const oauthConnectionInput: z.ZodType<Omit<OAuthConnectionRequestInput, "owner" | "service" | "target">>;
+export declare const oauthConnectionInput: z.ZodType<Omit<OAuthConnectionRequestInput, "owner" | "service" | "target" | "signal" | "connectionName">>;
+export declare const consoleOAuthConnectionInput: z.ZodType<{
+    service: string;
+    connectionName: string;
+    appId?: string;
+    authorizationOptionIds?: string[];
+}>;
 export declare const apiKeyConnectionInput: z.ZodType<{
     apiKey: string;
     extra?: Record<string, string>;

package/src/server/api/connection-input.js

@@ -1,10 +1,16 @@
 import { z } from "zod";
-export const oauthConnectionInput = z.object({
+export const oauthConnectionInput = z.strictObject({
     returnUri: z.string().optional(),
     authorizationOptionIds: z.array(z.string().trim().min(1)).optional(),
     extra: z.record(z.string(), z.unknown()).optional(),
     secretExtra: z.record(z.string(), z.string().trim().min(1)).optional(),
 });
+export const consoleOAuthConnectionInput = z.strictObject({
+    service: z.string().trim().min(1),
+    connectionName: z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/),
+    appId: z.string().min(1).optional(),
+    authorizationOptionIds: z.array(z.string().trim().min(1)).optional(),
+});
 export const apiKeyConnectionInput = z
     .object({
     apiKey: z.string(),

package/src/server/api/connection-routes.d.ts

@@ -1,10 +1,12 @@
 import type { ConnectionService } from "../../connection-service.ts";
 import type { OAuthFlowService } from "../../oauth/oauth-flow-service.ts";
+import type { SaasOAuthService } from "../../saas/saas-oauth-service.ts";
 import { Hono } from "hono";
 interface ConnectionRoutesOptions {
     connections: ConnectionService;
     oauthFlow: OAuthFlowService;
+    saasOAuth?: SaasOAuthService;
 }
 /** Personal connection management. Authentication runs in the parent app. */
-export declare function createConnectionRoutes({ connections, oauthFlow }: ConnectionRoutesOptions): Hono;
+export declare function createConnectionRoutes({ connections, oauthFlow, saasOAuth }: ConnectionRoutesOptions): Hono;
 export {};

package/src/server/api/connection-routes.js

@@ -2,14 +2,26 @@ import { Hono } from "hono";
 import { ConnectionError } from "../../connection-service.js";
 import { OAuthClientConfigError } from "../../oauth/oauth-client-config-service.js";
 import { OAuthFlowError } from "../../oauth/oauth-flow-service.js";
+import { SaasError } from "../../saas/saas-client.js";
+import { hasAdminBearer } from "./auth.js";
 import { readJsonBody, HttpRequestError } from "./http-utils.js";
 import { connectionManagementFailure, serializeManagedConnection, writeRuntimeSuccess, writeRuntimeFailure, } from "./runtime-api.js";
 /** Personal connection management. Authentication runs in the parent app. */
-export function createConnectionRoutes({ connections, oauthFlow }) {
+export function createConnectionRoutes({ connections, oauthFlow, saasOAuth }) {
     const app = new Hono();
     // The local runtime has one administrator principal, including its bearer and browser sessions.
     const owner = "local-admin";
     app.onError((error, context) => {
+        if (error instanceof SaasError) {
+            if (error.retryAfter)
+                context.header("Retry-After", error.retryAfter);
+            return writeRuntimeFailure(context, {
+                status: error.status,
+                errorCode: error.code,
+                message: error.message,
+                data: error.connectionRequestId ? { connectionRequestId: error.connectionRequestId } : undefined,
+            });
+        }
         if (error instanceof ConnectionError ||
             error instanceof OAuthFlowError ||
             error instanceof OAuthClientConfigError) {
@@ -27,7 +39,10 @@ export function createConnectionRoutes({ connections, oauthFlow }) {
         return writeRuntimeSuccess(context, serializeManagedConnection(await connections.getManagedConnection(context.req.param("appId"))));
     });
     app.get("/connection-requests/:connectionRequestId", async (context) => {
-        const request = await oauthFlow.getConnectionRequest(context.req.param("connectionRequestId"), owner);
+        const id = context.req.param("connectionRequestId");
+        const request = saasOAuth && hasAdminBearer(context)
+            ? await saasOAuth.sync(id, owner, context.req.raw.signal)
+            : await oauthFlow.getConnectionRequest(id, owner);
         if (!request)
             return writeRuntimeFailure(context, {
                 status: 404,
@@ -46,6 +61,7 @@ export function createConnectionRoutes({ connections, oauthFlow }) {
                 ...input,
                 service: target?.service ?? context.req.param("service"),
                 owner,
+                signal: context.req.raw.signal,
                 target,
             }));
         });
@@ -54,7 +70,9 @@ export function createConnectionRoutes({ connections, oauthFlow }) {
                 const { apiKeyConnectionInput, customConnectionInput } = await import("./connection-input.js");
                 const body = await readJsonBody(context);
                 const target = reconnect ? await connections.getStoredConnection(context.req.param("appId")) : undefined;
-                if (target && target.credential.authType !== (authType === "api-key" ? "api_key" : "custom_credential")) {
+                if (target &&
+                    (target.source === "saas" ||
+                        target.credential.authType !== (authType === "api-key" ? "api_key" : "custom_credential"))) {
                     throw new ConnectionError("unsupported_auth_type", "The connection uses a different credential type.");
                 }
                 const service = target?.service ?? context.req.param("service");

package/src/server/api/http-utils.d.ts

@@ -1,3 +1,4 @@
+import type { RuntimeStatus } from "./runtime-api.ts";
 import type { Context } from "hono";
 /**
  * Loose JSON body shape accepted by local HTTP handlers.
@@ -22,7 +23,7 @@ export declare function readJsonBody(context: Context, maxBytes?: number): Promi
 /**
  * Write the standard JSON error envelope used by local HTTP routes.
  */
-export declare function jsonError(context: Context, status: 400 | 401 | 404 | 413 | 500, code: string, message: string): Response;
+export declare function jsonError(context: Context, status: RuntimeStatus, code: string, message: string): Response;
 /**
  * Write the standard not-found response.
  */
@@ -33,6 +34,6 @@ export declare function notFound(context: Context): Response;
 export declare function internalError(context: Context, _error: unknown): Response;
 export declare class HttpRequestError extends Error {
     readonly code: string;
-    readonly status: 400 | 413;
-    constructor(code: string, message: string, status?: 400 | 413);
+    readonly status: RuntimeStatus;
+    constructor(code: string, message: string, status?: RuntimeStatus);
 }