@oomol-lab/open-connector 1.7.0 → 1.8.0

package/src/server/connect-server.js

@@ -8,6 +8,7 @@ import { PromiseCache } from "../core/promise-cache.js";
 import { MarketplaceError } from "../marketplace/marketplace-service.js";
 import { OAuthClientConfigError, OAuthClientConfigService } from "../oauth/oauth-client-config-service.js";
 import { OAuthCallbackError, OAuthFlowError, OAuthFlowService } from "../oauth/oauth-flow-service.js";
+import { SaasError } from "../saas/saas-client.js";
 import { ActionInputDepthError, createIdempotencyExpiry, hashActionRequest, hashIdempotencyKey, readIdempotencyKey, } from "./actions/action-idempotency.js";
 import { ActionRunner } from "./actions/action-runner.js";
 import { renderActionMarkdown } from "./api/action-markdown.js";
@@ -17,7 +18,9 @@ import { createConnectionRoutes } from "./api/connection-routes.js";
 import { HttpRequestError, internalError, jsonError, notFound, readJsonBody } from "./api/http-utils.js";
 import { renderOAuthCompletionPage } from "./api/oauth-completion-page.js";
 import { policyRequestMaxBytes, readRuntimePolicyRules, readTokenPolicy } from "./api/policy-input.js";
+import { serializeRuntimeTriggerPermissions } from "./api/runtime-api.js";
 import { mapConnectionErrorStatus, serializeRuntimeAction, serializeRuntimeActionResult, serializeRuntimeActionService, serializeRuntimeConnectedApp, serializeRuntimeFailure, serializeRuntimeProvider, serializeRuntimeProviderSetup, unknownActionFailure, unknownServiceFailure, writeRuntimeActionHttpResult, writeRuntimeFailure, writeRuntimeSuccess, } from "./api/runtime-api.js";
+import { renderSaasCompletionPage } from "./api/saas-completion-page.js";
 import { TransitFileError } from "./files/transit-file-store.js";
 import { ProxyRunner } from "./proxy/proxy-runner.js";
 import { decodeRunLogCursor } from "./storage/runtime-store.js";
@@ -78,6 +81,7 @@ export class ConnectServer {
             providerLoader: options.providerLoader,
             connections: options.connections,
             logger: options.logger,
+            saas: options.saas,
         });
     }
     createApp() {
@@ -115,6 +119,21 @@ export class ConnectServer {
         }
         app.get("/v1/health", (context) => writeRuntimeSuccess(context, { ok: true, runtime: "oomol-connect" }));
         app.get("/v1/providers/:service/setup", (context) => this.getRuntimeProviderSetup(context, context.req.param("service")));
+        app.get("/v1/providers/:service/trigger-permissions", (context) => this.getRuntimeTriggerPermissions(context, context.req.param("service")));
+        app.post("/v1/providers/:service/triggers/:triggerId/execute", (context) => this.executeRuntimeTrigger(context));
+        app.get("/api/trigger-subscriptions", async (context) => context.json((await this.options.triggerMaintenance?.list()) ?? []));
+        app.post("/api/trigger-subscriptions/:id/cancel", async (context) => {
+            if (!this.options.triggerMaintenance)
+                throw new HttpRequestError("trigger_not_supported", "Trigger subscriptions are unavailable.", 501);
+            await this.options.triggerMaintenance.cancel(context.req.param("id"), context.req.raw.signal);
+            return context.json({ ok: true });
+        });
+        app.post("/api/trigger-subscriptions/:id/abandon", async (context) => {
+            if (!this.options.triggerMaintenance)
+                throw new HttpRequestError("trigger_not_supported", "Trigger subscriptions are unavailable.", 501);
+            await this.options.triggerMaintenance.abandon(context.req.param("id"), context.req.raw.signal);
+            return context.json({ ok: true });
+        });
         app.get("/v1/providers", (context) => this.listRuntimeProviders(context));
         app.get("/v1/actions", (context) => this.listRuntimeActions(context));
         app.get("/v1/actions/search", (context) => this.searchRuntimeActions(context));
@@ -166,9 +185,66 @@ export class ConnectServer {
         app.delete("/api/runtime-tokens/:id", (context) => this.revokeRuntimeToken(context, context.req.param("id")));
         app.get("/api/runtime-policy", (context) => this.getRuntimePolicy(context));
         app.put("/api/runtime-policy", (context) => this.updateRuntimePolicy(context));
+        const saas = this.options.saasProject;
+        if (saas) {
+            app.get("/api/oauth/managed-project", async (context) => context.json(await saas.getState(context.req.raw.signal)));
+            app.put("/api/oauth/managed-project", async (context) => context.json(await saas.configure(await readJsonBody(context, 16_384), context.req.raw.signal)));
+            app.delete("/api/oauth/managed-project", async (context) => {
+                await saas.remove();
+                return context.json(await saas.getState(context.req.raw.signal));
+            });
+            app.get("/api/oauth/managed-project/provider-configs", async (context) => context.json(await saas.listProviderConfigs(context.req.raw.signal)));
+            app.get("/api/oauth/sources/:service", async (context) => context.json(await saas.getSource(context.req.param("service"))));
+            app.put("/api/oauth/sources/:service", async (context) => context.json(await saas.setSource(context.req.param("service"), await readJsonBody(context, 16_384), context.req.raw.signal)));
+        }
+        if (saas && this.options.saasOAuth) {
+            app.get("/oauth/saas/complete", (context) => {
+                context.header("Content-Security-Policy", "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'");
+                context.header("Referrer-Policy", "no-referrer");
+                return context.html(renderSaasCompletionPage());
+            });
+            app.post("/api/oauth/connection-requests/:id/sync", async (context) => {
+                const expectedOrigin = saas.requireOrigin();
+                if (context.req.header("origin") !== expectedOrigin)
+                    throw new SaasError("oauth_source_origin_mismatch", `Open Console at ${expectedOrigin}, or set OOMOL_CONNECT_ORIGIN to the exact Console address in your browser and restart Connect. localhost and 127.0.0.1 are different origins.`, 403);
+                if (context.req.header("x-openconnector-request") !== "sync" ||
+                    context.req.header("content-type")?.split(";")[0].trim().toLowerCase() !== "application/json")
+                    return context.json({ error: { code: "forbidden", message: "OAuth synchronization requires a same-origin JSON request." } }, 403);
+                const result = await this.options.saasOAuth.syncForBrowser(context.req.param("id"), "local-admin", context.req.raw.signal);
+                if (!result)
+                    return jsonError(context, 404, "connection_request_not_found", "Connection request not found.");
+                context.header("Cache-Control", "private, no-store");
+                return context.json(result);
+            });
+        }
         app.get("/api/oauth/configs", (context) => this.listOAuthConfigs(context));
         app.put("/api/oauth/configs/:service", (context) => this.upsertOAuthConfig(context, context.req.param("service")));
         app.delete("/api/oauth/configs/:service", (context) => this.deleteOAuthConfig(context, context.req.param("service")));
+        app.post("/api/oauth/connection-requests", async (context) => {
+            try {
+                const { consoleOAuthConnectionInput } = await import("./api/connection-input.js");
+                const parsed = consoleOAuthConnectionInput.safeParse(await readJsonBody(context));
+                if (!parsed.success)
+                    return jsonError(context, 400, "invalid_input", "Invalid OAuth connection request.");
+                const { appId, ...input } = parsed.data;
+                const target = appId ? await this.options.connections.getStoredConnection(appId) : undefined;
+                if (target && (target.service !== input.service || target.connectionName !== input.connectionName))
+                    return jsonError(context, 400, "invalid_input", "The selected connection no longer matches.");
+                return context.json(await this.options.oauthFlow.startConnectionRequest({
+                    ...input,
+                    target,
+                    owner: "local-admin",
+                    signal: context.req.raw.signal,
+                }));
+            }
+            catch (error) {
+                if (error instanceof OAuthClientConfigError ||
+                    error instanceof OAuthFlowError ||
+                    error instanceof ConnectionError)
+                    return jsonError(context, error.code === "unknown_service" || error.code === "app_not_found" ? 404 : 400, error.code, error.message);
+                throw error;
+            }
+        });
         app.post("/api/oauth/authorizations", (context) => this.createOAuthAuthorization(context));
         app.get("/oauth/callback", (context) => this.completeOAuth(context));
         app.post("/mcp", (context) => this.handleMcp(context));
@@ -181,6 +257,20 @@ export class ConnectServer {
         else
             app.notFound(notFound);
         app.onError((error, context) => {
+            if (error instanceof SaasError) {
+                this.options.logger?.warn({
+                    method: context.req.method,
+                    path: context.req.path,
+                    code: error.code,
+                    status: error.status,
+                    reason: error.message,
+                }, "SaaS request failed");
+                if (error.retryAfter)
+                    context.header("Retry-After", error.retryAfter);
+                if (context.req.path.startsWith("/v1/"))
+                    return writeRuntimeFailure(context, { status: error.status, errorCode: error.code, message: error.message });
+                return context.json({ error: { code: error.code, message: error.message, reason: error.reason } }, error.status);
+            }
             if (error instanceof HttpRequestError) {
                 if (context.req.path.startsWith("/v1/")) {
                     return writeRuntimeFailure(context, {
@@ -227,7 +317,8 @@ export class ConnectServer {
         }
         catch (error) {
             if (error instanceof MarketplaceError) {
-                return jsonError(context, error.status === 404 ? 404 : 400, error.code, error.message);
+                const status = error.status;
+                return jsonError(context, status === 401 || status === 403 || status === 404 || status === 502 || status === 504 ? status : 400, error.code, error.message);
             }
             throw error;
         }
@@ -254,9 +345,20 @@ export class ConnectServer {
         const provider = this.options.catalog.providers.find((provider) => provider.service === service);
         if (!provider)
             return writeRuntimeFailure(context, unknownServiceFailure(service));
-        const oauth = provider.auth.some((auth) => auth.type === "oauth2")
+        let oauth = provider.auth.some((auth) => auth.type === "oauth2")
             ? await this.options.oauthClientConfigs.getSummary(service)
             : undefined;
+        const source = oauth ? await this.options.saasProject?.getSource(service) : undefined;
+        if (oauth && source?.mode === "saas") {
+            const { config } = await this.options.saasProject.resolveConfig(service, source.providerConfigId, source.managedProjectId, context.req.raw.signal);
+            oauth = {
+                ...oauth,
+                configured: true,
+                customClientAvailable: false,
+                expectedRedirectUri: config.callbackUrl,
+                missingFields: [],
+            };
+        }
         return writeRuntimeSuccess(context, serializeRuntimeProviderSetup(provider, oauth));
     }
     getProvider(context, service) {
@@ -353,11 +455,6 @@ export class ConnectServer {
         catch (error) {
             if (error instanceof ConnectionError) {
                 const status = mapConnectionErrorStatus(error);
-                // agent.md uses the admin JSON error envelope; mapConnectionErrorStatus may
-                // return 409 for OAuth refresh failures, which jsonError does not accept.
-                if (status === 409) {
-                    return context.json({ error: { code: error.code, message: error.message } }, 409);
-                }
                 return jsonError(context, status, error.code, error.message);
             }
             throw error;
@@ -428,6 +525,30 @@ export class ConnectServer {
         }
         return writeRuntimeSuccess(context, serializeRuntimeAction(action));
     }
+    async getRuntimeTriggerPermissions(context, service) {
+        const provider = this.options.catalog.providers.find((item) => item.service === service);
+        if (!provider)
+            throw new HttpRequestError("provider_not_found", "Provider not found.", 404);
+        return writeRuntimeSuccess(context, serializeRuntimeTriggerPermissions(provider));
+    }
+    async executeRuntimeTrigger(context) {
+        if (!this.options.triggers)
+            throw new HttpRequestError("trigger_not_supported", "Trigger execution is unavailable.", 501);
+        const { readTriggerRequest } = await import("../triggers/request.js");
+        const request = readTriggerRequest(await readJsonBody(context, 160 * 1024));
+        const signal = AbortSignal.any([context.req.raw.signal, AbortSignal.timeout(45_000)]);
+        const result = await this.options.triggers.run({
+            service: context.req.param("service"),
+            triggerId: context.req.param("triggerId"),
+            request,
+            connectionName: readConnectionName(context),
+            connectionId: optionalString(context.req.header("x-oo-connector-app-id")),
+            policy: await this.getPolicySnapshot(context),
+            grant: readRuntimeGrant(context),
+            signal,
+        });
+        return writeRuntimeSuccess(context, result);
+    }
     async createRuntimeActionRun(context, actionId) {
         const action = this.options.catalog.actionsById.get(actionId);
         if (!action) {
@@ -436,6 +557,7 @@ export class ConnectServer {
         const body = await readJsonBody(context);
         const input = body.input ?? {};
         const connectionName = readConnectionName(context, body);
+        const connectionId = optionalString(context.req.header("x-oo-connector-app-id"));
         const runtimeGrant = readRuntimeGrant(context);
         let policy;
         try {
@@ -450,7 +572,7 @@ export class ConnectServer {
             });
         }
         if (!policy.evaluate(action).allowed) {
-            return writeRuntimeActionHttpResult(context, await this.executeRuntimeAction(actionId, input, connectionName, policy, runtimeGrant, context.req.raw.signal));
+            return writeRuntimeActionHttpResult(context, await this.executeRuntimeAction(actionId, input, connectionName, policy, runtimeGrant, context.req.raw.signal, connectionId));
         }
         const idempotencyKey = readIdempotencyKey(context.req.header("idempotency-key"));
         if (!idempotencyKey.ok) {
@@ -462,7 +584,7 @@ export class ConnectServer {
             });
         }
         if (!idempotencyKey.key) {
-            return writeRuntimeActionHttpResult(context, await this.executeRuntimeAction(actionId, input, connectionName, policy, runtimeGrant, context.req.raw.signal));
+            return writeRuntimeActionHttpResult(context, await this.executeRuntimeAction(actionId, input, connectionName, policy, runtimeGrant, context.req.raw.signal, connectionId));
         }
         const now = new Date();
         const keyHash = hashIdempotencyKey(idempotencyKey.key);
@@ -471,6 +593,7 @@ export class ConnectServer {
             requestHash = hashActionRequest({
                 actionId,
                 connectionName: connectionName ?? defaultConnectionName,
+                connectionId,
                 input,
                 runtimeTokenId: runtimeGrant?.tokenId,
             });
@@ -513,7 +636,7 @@ export class ConnectServer {
         if (claim.kind === "completed") {
             return writeRuntimeActionHttpResult(context, claim.response);
         }
-        const result = await this.executeRuntimeAction(actionId, input, connectionName, policy, runtimeGrant, context.req.raw.signal);
+        const result = await this.executeRuntimeAction(actionId, input, connectionName, policy, runtimeGrant, context.req.raw.signal, connectionId);
         const completed = await this.options.idempotency.complete({
             keyHash,
             requestHash,
@@ -526,13 +649,14 @@ export class ConnectServer {
         }
         return writeRuntimeActionHttpResult(context, result);
     }
-    async executeRuntimeAction(actionId, input, connectionName, policy, runtimeGrant, signal) {
+    async executeRuntimeAction(actionId, input, connectionName, policy, runtimeGrant, signal, connectionId) {
         try {
             const run = await this.options.actions.run({
                 actionId,
                 input,
                 caller: "http",
                 connectionName,
+                connectionId,
                 policy,
                 runtimeTokenId: runtimeGrant?.tokenId,
                 signal,
@@ -543,6 +667,9 @@ export class ConnectServer {
             return serializeRuntimeActionResult({
                 actionId,
                 executionId: run.executionId,
+                remoteExecutionId: run.remoteExecutionId,
+                failureStatus: run.failureStatus,
+                retryAfter: run.retryAfter,
                 auditPersisted: run.auditPersisted,
                 result: run.result,
             });
@@ -591,11 +718,12 @@ export class ConnectServer {
             service,
             input: body,
             connectionName: readConnectionName(context, body),
+            connectionId: optionalString(context.req.header("x-oo-connector-app-id")),
             policy,
             signal: context.req.raw.signal,
         });
         if (result.ok) {
-            return writeRuntimeSuccess(context, result.response);
+            return writeRuntimeSuccess(context, result.response, result.meta);
         }
         return writeRuntimeFailure(context, {
             status: result.status,
@@ -836,7 +964,13 @@ export class ConnectServer {
         });
     }
     async listOAuthConfigs(context) {
-        return context.json(await this.options.oauthClientConfigs.listConfigs());
+        const configs = await this.options.oauthClientConfigs.listConfigs();
+        const sources = await this.options.saasProject?.listSources();
+        return context.json(configs.map((config) => ({
+            ...config,
+            oauthSource: sources?.get(config.service) ?? { mode: "local" },
+            customClientAvailable: sources?.has(config.service) ? false : config.customClientAvailable,
+        })));
     }
     async upsertOAuthConfig(context, service) {
         const body = await readJsonBody(context);

package/src/server/connector-runtime.d.ts

@@ -44,6 +44,8 @@ export interface ConnectorRuntimeOptions {
     dataDir: string;
     /** External HTTP(S) URL, optionally including a mount path such as /connector. */
     publicOrigin: string;
+    /** False when the host supplied a development fallback instead of an explicit public origin. */
+    publicOriginConfigured?: boolean;
     /** Encrypts stored credentials, OAuth client configuration, pending OAuth state and replayed action responses. Omit to store them in plain text. */
     encryptionKey?: string;
     /** Bearer token required for management requests such as connections, OAuth clients and policies. Omit to leave them open. */
@@ -54,7 +56,7 @@ export interface ConnectorRuntimeOptions {
     jwt?: RuntimeJwtConfig;
     postgres?: ConnectorPostgresOptions;
     network?: ConnectorNetworkOptions;
-    /** Allow or block actions and proxies by name. */
+    /** Allow or block actions, proxies and Triggers by name. */
     actionPolicy?: ActionPolicyConfig;
     /** Services, or `*`, whose connections may carry their own OAuth client instead of the configured one. */
     allowedCustomOAuth?: string[];

package/src/server/connector-runtime.js

@@ -104,13 +104,14 @@ async function openRuntime(options) {
         const tempDir = join(dataDir, "tmp/transit-files");
         await transitFiles.cleanupExpired();
         await cleanupStagedTransitFiles(tempDir, ttlSeconds * 1000);
-        const { app, runtimeAuthConfigured } = await createConnectApp({
+        const { app, runtimeAuthConfigured, saasCleanup, triggerMaintenance } = await createConnectApp({
             catalog,
             providerLoader: new ProviderLoader(executorModules),
             runtimeDatabase: database,
             transitFiles,
             uploadTransitFile: createNodeTransitFileUpload({ transitFiles, tempDir }),
             publicOrigin,
+            configuredOrigin: options.publicOriginConfigured === false ? undefined : publicOrigin,
             secretCodec,
             adminToken: options.adminToken,
             runtimeToken: options.runtimeToken,
@@ -120,6 +121,8 @@ async function openRuntime(options) {
             logger: options.logger,
             serveDocumentation: options.apiReference ?? false,
         });
+        saasCleanup.start();
+        triggerMaintenance.start();
         const shutdown = new AbortController();
         const pending = new Set();
         let closing;
@@ -142,7 +145,7 @@ async function openRuntime(options) {
                 if (!closing) {
                     closing = Promise.resolve().then(async () => {
                         shutdown.abort(new Error("Open Connector runtime is closing."));
-                        await Promise.allSettled([...pending]);
+                        await Promise.allSettled([...pending, saasCleanup.close(), triggerMaintenance.close()]);
                         try {
                             await database.close();
                         }

package/src/server/files/transit-files.js

@@ -130,13 +130,22 @@ export class TransitFileService {
     async writeStream(file, tempPath) {
         let sizeBytes = 0;
         const maxBytes = this.maxBytes;
-        await pipeline(Readable.fromWeb(file.body), async function* (source) {
-            for await (const chunk of source) {
-                sizeBytes += chunk.byteLength;
-                assertFileSize(sizeBytes, maxBytes);
-                yield chunk;
-            }
-        }, createWriteStream(tempPath, { flags: "wx" }), { signal: file.signal });
+        const source = Readable.fromWeb(file.body);
+        const destination = createWriteStream(tempPath, { flags: "wx" });
+        // Pipeline can reject while the file is still opening. Wait for close before unlinking it.
+        const closed = new Promise((resolve) => destination.once("close", resolve));
+        try {
+            await pipeline(source, async function* (source) {
+                for await (const chunk of source) {
+                    sizeBytes += chunk.byteLength;
+                    assertFileSize(sizeBytes, maxBytes);
+                    yield chunk;
+                }
+            }, destination, { signal: file.signal });
+        }
+        finally {
+            await closed;
+        }
         return sizeBytes;
     }
 }

package/src/server/proxy/proxy-runner.d.ts

@@ -3,17 +3,20 @@ import type { ConnectionService } from "../../connection-service.ts";
 import type { ActionPolicySnapshot } from "../../core/action-policy.ts";
 import type { RuntimeLogger, ProxyResponse } from "../../core/types.ts";
 import type { IProviderLoader } from "../../providers/provider-loader.ts";
-export type ProxyFailureStatus = 400 | 402 | 403 | 404 | 409 | 413 | 429 | 500 | 501;
+import type { SaasExecutionService } from "../../saas/saas-execution-service.ts";
+export type ProxyFailureStatus = 400 | 402 | 403 | 404 | 409 | 413 | 429 | 500 | 501 | 502 | 503 | 504;
 export interface ProxyRunnerOptions {
     catalog: CatalogStore;
     providerLoader: IProviderLoader;
     connections: ConnectionService;
     logger?: RuntimeLogger;
+    saas?: SaasExecutionService;
 }
 export interface RunProxyInput {
     service: string;
     input: unknown;
     connectionName?: string;
+    connectionId?: string;
     policy: ActionPolicySnapshot;
     /** Cancellation signal from the HTTP request, handed to the provider proxy executor. */
     signal?: AbortSignal;
@@ -21,6 +24,7 @@ export interface RunProxyInput {
 export type ProxyRunResult = {
     ok: true;
     response: ProxyResponse;
+    meta?: Record<string, unknown>;
 } | ProxyRunFailure;
 export interface ProxyRunFailure {
     ok: false;

package/src/server/proxy/proxy-runner.js

@@ -1,5 +1,6 @@
 import { ConnectionError } from "../../connection-service.js";
 import { optionalInteger, optionalRecord, requiredRecord, requiredString } from "../../core/cast.js";
+import { SaasError } from "../../saas/saas-client.js";
 import { mapConnectionErrorStatus } from "../api/runtime-api.js";
 class ProxyInputError extends Error {
 }
@@ -30,29 +31,6 @@ export class ProxyRunner {
                 meta: { service: provider.service },
             };
         }
-        let executor;
-        try {
-            executor = await this.options.providerLoader.loadProxyExecutor(provider.service, provider.displayName);
-        }
-        catch {
-            this.options.logger?.warn({ service: provider.service, errorCode: "internal_error" }, "proxy request failed");
-            return {
-                ok: false,
-                status: 500,
-                errorCode: "internal_error",
-                message: "Proxy request failed unexpectedly.",
-                meta: { service: provider.service },
-            };
-        }
-        if (!executor) {
-            return {
-                ok: false,
-                status: 501,
-                errorCode: "proxy_not_supported",
-                message: `Proxy execution is not supported for ${provider.service}.`,
-                meta: { service: provider.service },
-            };
-        }
         const request = this.readProxyRequestInput(input.input);
         if (!request.ok) {
             return request;
@@ -64,8 +42,9 @@ export class ProxyRunner {
             connectionName: input.connectionName,
         };
         const startedAtMs = Date.now();
+        let executionId;
         try {
-            const connection = await this.options.connections.getConnectionSummary(provider.service, input.connectionName);
+            const connection = await this.options.connections.getConnectionSummary(provider.service, input.connectionName, input.connectionId);
             const connectionDecision = connection?.authType === "no_auth" ? undefined : input.policy.evaluateConnection(connection?.id);
             if (connectionDecision && !connectionDecision.allowed) {
                 return {
@@ -76,10 +55,58 @@ export class ProxyRunner {
                     meta: { service: provider.service },
                 };
             }
+            const target = await this.options.connections.resolveForExecution(provider.service, input.connectionName, input.connectionId);
+            const targetDecision = target.summary?.authType === "no_auth" ? undefined : input.policy.evaluateConnection(target.summary?.id);
+            if (targetDecision && !targetDecision.allowed)
+                return {
+                    ok: false,
+                    status: 403,
+                    errorCode: targetDecision.code,
+                    message: targetDecision.message,
+                    meta: { service: provider.service },
+                };
             this.options.logger?.info(logContext, "proxy request started");
-            const credentials = this.options.connections.forConnection(input.connectionName);
+            if (target.kind === "saas") {
+                executionId = crypto.randomUUID();
+                input.signal?.throwIfAborted();
+                if (!this.options.saas)
+                    throw new SaasError("oauth_source_unavailable", "SaaS execution is unavailable.", 503);
+                const { alias: _alias, connectionName: _connectionName, ...remoteRequest } = optionalRecord(input.input);
+                remoteRequest.method = request.input.method;
+                const remote = await this.options.saas.executeProxy(target.reference, provider.service, remoteRequest, input.signal);
+                input.signal?.throwIfAborted();
+                this.options.logger?.info({
+                    ...logContext,
+                    executionId,
+                    remoteExecutionId: remote.executionId,
+                    durationMs: Date.now() - startedAtMs,
+                    status: remote.response.status,
+                }, "proxy request completed");
+                return {
+                    ok: true,
+                    response: remote.response,
+                    meta: { service: provider.service, executionId, remoteExecutionId: remote.executionId },
+                };
+            }
+            if (target.kind === "marketplace")
+                return {
+                    ok: false,
+                    status: 501,
+                    errorCode: "proxy_not_supported",
+                    message: "Marketplace connections do not support proxy execution.",
+                    meta: { service: provider.service },
+                };
+            const executor = await this.options.providerLoader.loadProxyExecutor(provider.service, provider.displayName);
+            if (!executor)
+                return {
+                    ok: false,
+                    status: 501,
+                    errorCode: "proxy_not_supported",
+                    message: `Proxy execution is not supported for ${provider.service}.`,
+                    meta: { service: provider.service },
+                };
             const result = await executor(request.input, {
-                getCredential: credentials.getCredential,
+                getCredential: target.getCredential,
                 signal: input.signal,
             });
             const durationMs = Date.now() - startedAtMs;
@@ -103,6 +130,25 @@ export class ProxyRunner {
         }
         catch (error) {
             const durationMs = Date.now() - startedAtMs;
+            if (executionId && input.signal?.aborted)
+                return {
+                    ok: false,
+                    status: 400,
+                    errorCode: "execution_cancelled",
+                    message: "Proxy execution was cancelled.",
+                    meta: { service: provider.service, executionId },
+                };
+            if (error instanceof SaasError) {
+                this.options.logger?.warn({ ...logContext, durationMs, executionId, errorCode: error.code, remoteExecutionId: error.remoteExecutionId }, "proxy request failed");
+                return {
+                    ok: false,
+                    status: error.status,
+                    errorCode: error.code,
+                    message: error.message,
+                    data: error.retryAfter ? { details: { retryAfter: error.retryAfter } } : undefined,
+                    meta: { service: provider.service, executionId, remoteExecutionId: error.remoteExecutionId },
+                };
+            }
             if (error instanceof ConnectionError) {
                 const missingConnectionDecision = error.code === "connection_not_found" ? input.policy.evaluateConnection() : undefined;
                 if (missingConnectionDecision && !missingConnectionDecision.allowed) {

package/src/server/storage/connection-request-store.d.ts

@@ -1,4 +1,4 @@
-import type { StoredConnection } from "../../connection-service.ts";
+import type { StoredConnection, StoredSaasConnection } from "../../connection-service.ts";
 import type { ResolvedCredential } from "../../core/types.ts";
 import type { OAuthAuthorizationState } from "../../oauth/oauth-flow-service.ts";
 import type { ISecretCodec } from "../secrets/secret-codec-core.ts";
@@ -26,6 +26,35 @@ export interface RequestStatement {
     sql: string;
     values: (string | number | null)[];
 }
+export interface PendingSaasRequest {
+    connectionRequestId: string;
+    connectionId: string;
+    owner: string;
+    service: string;
+    connectionName: string;
+    managedProjectId: string;
+    providerConfigId: string;
+    externalUserId: string;
+    createdAt: string;
+    expiresAt: string;
+    returnUri?: string;
+    target?: Pick<StoredConnection, "id" | "revision">;
+    comment?: string | null;
+}
+export interface SaasRequestLease {
+    pending: PendingSaasRequest;
+    leaseId: string;
+    phase: "creating" | "pending" | "candidate";
+    remoteRequestId: string | null;
+    candidate?: SaasCandidate;
+    pollAttempts: number;
+}
+export interface SaasCandidate {
+    connectedAccountId: string;
+    profile: StoredSaasConnection["profile"];
+    status: StoredSaasConnection["status"];
+    comment: string | null;
+}
 /** Executes all statements atomically; each result contains its RETURNING/SELECT rows. */
 export type RequestTransaction = (statements: RequestStatement[]) => Promise<RuntimeRow[][]>;
 /** Shared SQL lifecycle for SQLite, PostgreSQL and D1. Secrets use the runtime's codec. */
@@ -38,4 +67,15 @@ export declare class ConnectionRequestStore {
     claim(state: string): Promise<PendingConnectionRequest | undefined>;
     fail(id: string, errorCode: string, errorMessage: string): Promise<void>;
     complete(pending: PendingConnectionRequest, credential: ResolvedCredential, signal?: AbortSignal): Promise<string | undefined>;
+    private retireRequests;
+    createSaas(pending: PendingSaasRequest): Promise<SaasRequestLease>;
+    claimSaas(id: string, owner: string, now?: number): Promise<SaasRequestLease | undefined>;
+    saveSaasRequest(lease: SaasRequestLease, remoteRequestId: string, expiresAt?: string): Promise<boolean>;
+    saveSaasCandidate(lease: SaasRequestLease, candidate: SaasCandidate): Promise<boolean>;
+    releaseSaas(lease: SaasRequestLease, nextPollAt: number, failed?: boolean): Promise<boolean>;
+    failSaas(lease: SaasRequestLease, code: string, message: string): Promise<boolean>;
+    getSaasReturnUri(id: string, owner: string): Promise<string | undefined>;
+    cancelSaas(id: string, owner: string): Promise<void>;
+    expireSaas(now?: number): Promise<void>;
+    completeSaas(lease: SaasRequestLease): Promise<"connected" | "conflict" | "lease_lost">;
 }