@oomol-lab/open-connector 1.7.0 → 1.9.0

package/src/core/request.js

@@ -58,6 +58,7 @@ export function compactJson(value) {
  * Read a response body into memory while enforcing a byte limit.
  */
 export async function readBoundedResponseBytes(response, options) {
+    options.signal?.throwIfAborted();
     const contentLength = parseContentLength(response.headers.get("content-length"));
     if (contentLength !== undefined) {
         if (contentLength > options.maxBytes) {
@@ -71,11 +72,16 @@ export async function readBoundedResponseBytes(response, options) {
         return bytes;
     }
     const reader = response.body.getReader();
+    const abort = () => {
+        void reader.cancel().catch(() => undefined);
+    };
+    options.signal?.addEventListener("abort", abort, { once: true });
     const chunks = [];
     let totalBytes = 0;
     try {
         while (true) {
             const { done, value } = await reader.read();
+            options.signal?.throwIfAborted();
             if (done) {
                 break;
             }
@@ -88,6 +94,7 @@ export async function readBoundedResponseBytes(response, options) {
         }
     }
     finally {
+        options.signal?.removeEventListener("abort", abort);
         reader.releaseLock();
     }
     const bytes = new Uint8Array(totalBytes);
@@ -98,6 +105,53 @@ export async function readBoundedResponseBytes(response, options) {
     }
     return bytes;
 }
+/**
+ * Store a provider download in transit storage without holding it in memory.
+ *
+ * A backend that accepts unknown-length streams (the filesystem store) gets the
+ * response body piped straight to disk, so memory stays flat whatever the file
+ * size or the number of concurrent downloads; the store enforces `maxBytes` as
+ * the bytes arrive. Any other backend keeps the buffered path, bounded exactly
+ * as before.
+ */
+export async function storeResponseInTransit(response, transitFiles, options) {
+    const limits = {
+        maxBytes: transitFiles.maxBytes,
+        fieldName: options.fieldName,
+        createError: options.createError,
+        signal: options.signal,
+    };
+    // `File.type` lower-cases the type and empties it entirely when any code
+    // point falls outside U+0020–U+007E. Mirror that so the streamed path stores
+    // exactly what the buffered path does, whatever the server sent.
+    const mimeType = /[^\u0020-\u007e]/.test(options.mimeType) ? "" : options.mimeType.toLowerCase();
+    if (!transitFiles.createFromStream || !response.body) {
+        const bytes = await readBoundedResponseBytes(response, limits);
+        return await transitFiles.create(new File([Uint8Array.from(bytes)], options.name, { type: mimeType }));
+    }
+    options.signal?.throwIfAborted();
+    const contentLength = parseContentLength(response.headers.get("content-length"));
+    if (contentLength !== undefined && contentLength > limits.maxBytes) {
+        void response.body.cancel().catch(() => undefined);
+        assertMaxBytes(contentLength, limits);
+    }
+    try {
+        return await transitFiles.createFromStream({
+            body: response.body,
+            name: options.name.toWellFormed(),
+            mimeType,
+            signal: options.signal,
+        });
+    }
+    catch (error) {
+        // The store reports an over-limit stream as its own `file_too_large`;
+        // callers keep seeing the error they chose, as on the buffered path.
+        if (error?.code === "file_too_large") {
+            throw options.createError(`${options.fieldName} exceeds ${limits.maxBytes} bytes`);
+        }
+        throw error;
+    }
+}
 // Egress targets are classified into three tiers for the SSRF guard:
 //
 //   - "reserved" (localHostnames, cloudMetadataHostnames, localHostnameSuffixes,

package/src/core/types.d.ts

@@ -1,3 +1,5 @@
+import type { TriggerKeySnapshot } from "../triggers/common/types.ts";
+import type { TriggerPermission } from "../triggers/metadata.ts";
 /**
  * JSON Schema object used for action input and output contracts.
  *
@@ -114,8 +116,20 @@ export type OAuth2AuthDefinition = {
     tokenUrl: string;
     /** Provider token endpoint used to refresh an access token. Defaults to tokenUrl. */
     refreshTokenUrl?: string;
-    /** OAuth scopes joined with spaces into the authorization URL `scope` parameter. */
+    /**
+     * Provider token revocation endpoint (RFC 7009). When set, a disconnect that
+     * asks for it (`revoke: true`) posts the connection's refresh token (else its
+     * access token) there once the credential is deleted, so the grant ends at
+     * the provider as well as here. Inert otherwise.
+     */
+    revocationUrl?: string;
+    /** Default OAuth scopes when no requestedScopes or authorization options are selected. */
     scopes: string[];
+    /**
+     * Additional scopes available for explicit selection through requestedScopes or authorization
+     * options. requestedScopes replaces the default list; default scopes are not added automatically.
+     */
+    optionalScopes?: string[];
     /** Selectable provider-native OAuth scopes for programmatic connections. */
     authorizationOptions?: OAuthAuthorizationOption[];
     /** Separator used when joining OAuth scopes. Defaults to a space. */
@@ -248,6 +262,8 @@ export type ProviderDefinition = {
     iconUrl?: string;
     /** Public action catalog for this provider. */
     actions: readonly ActionDefinition[];
+    triggers?: readonly TriggerKeySnapshot[];
+    triggerPermissions?: readonly TriggerPermission[];
 };
 /**
  * A credential resolved for action execution.
@@ -318,6 +334,8 @@ export interface TransitFileStore {
     /** Available only on backends that can store unknown-length streams without buffering the file. */
     createFromStream?(file: TransitFileStream): Promise<TransitFileUpload>;
     read(fileId: string): Promise<TransitFileRead>;
+    /** Stream a stored file for provider uploads without materializing its bytes. */
+    response?(fileId: string): Promise<Response>;
     delete(fileId: string): Promise<boolean>;
 }
 export type TransitFileWriter = TransitFileStore;

package/src/marketplace/marketplace-service.d.ts

@@ -44,6 +44,11 @@ export interface MarketplaceSnapshot {
     compatibleActions: ReadonlySet<string>;
     actionsByService: ReadonlyMap<string, ReadonlySet<string>>;
 }
+export interface MarketplaceDiscoverySummary {
+    version: 1;
+    name: string;
+    actions: string[];
+}
 export interface MarketplaceState {
     configured: boolean;
     enabled: boolean;
@@ -74,6 +79,7 @@ export declare class MarketplaceService {
     initialize(): Promise<void>;
     getState(): MarketplaceState;
     getSnapshot(): MarketplaceSnapshot | undefined;
+    getDefaultDiscovery(signal?: AbortSignal): Promise<MarketplaceDiscoverySummary>;
     supportsAction(actionId: string): boolean;
     configure(input: MarketplaceConfigInput): Promise<MarketplaceState>;
     remove(): Promise<void>;
@@ -85,5 +91,4 @@ export declare class MarketplaceService {
     private discover;
     private validateApiKey;
     private ensureProviderPreferences;
-    private fetch;
 }

package/src/marketplace/marketplace-service.js

@@ -1,5 +1,5 @@
-import { assertPublicHttpUrl } from "../core/request.js";
-import { providerFetch } from "../providers/provider-runtime.js";
+import { isFailureEnvelope, isSuccessEnvelope, readRemoteJson, RemoteHttpError, requestRemote, } from "../core/remote-http.js";
+import { isAbortLikeError } from "../providers/provider-runtime.js";
 import { defaultMarketplaceDiscoveryUrl } from "./default-marketplace.js";
 const maximumDiscoveryBytes = 4 * 1024 * 1024;
 export class MarketplaceError extends Error {
@@ -58,6 +58,10 @@ export class MarketplaceService {
     getSnapshot() {
         return this.snapshot;
     }
+    async getDefaultDiscovery(signal) {
+        const discovery = await this.discover(defaultMarketplaceDiscoveryUrl, signal);
+        return { version: 1, name: discovery.name, actions: discovery.actions };
+    }
     supportsAction(actionId) {
         return this.snapshot?.compatibleActions.has(actionId) ?? false;
     }
@@ -119,35 +123,32 @@ export class MarketplaceService {
             return { ok: false, error: { code: "connection_not_found", message: "Marketplace connection is unavailable." } };
         }
         const url = new URL(`${snapshot.definition.endpoint}/${encodeURIComponent(actionId)}`, snapshot.discoveryUrl);
-        let response;
-        try {
-            response = await this.fetch(url, {
-                method: "POST",
-                headers: { authorization: `Bearer ${snapshot.apiKey}`, "content-type": "application/json" },
-                body: JSON.stringify({ input }),
-                redirect: "manual",
-                signal,
-            });
-        }
-        catch (error) {
-            return {
-                ok: false,
-                error: {
-                    code: "marketplace_unavailable",
-                    message: error instanceof Error ? error.message : "Marketplace request failed.",
-                },
-            };
-        }
         let payload;
         try {
-            payload = await readJsonResponse(response, "Marketplace action response");
+            payload = await requestRemote({
+                url,
+                label: "Marketplace action",
+                fetcher: this.options.fetcher,
+                requireHttps: false,
+                allowTrustedHosts: true,
+                init: {
+                    method: "POST",
+                    headers: { authorization: `Bearer ${snapshot.apiKey}`, "content-type": "application/json" },
+                    body: JSON.stringify({ input }),
+                    signal,
+                },
+            }, (response, signal) => readRemoteJson(response, {
+                label: "Marketplace action response",
+                maxBytes: Infinity,
+                signal,
+            }));
         }
         catch (error) {
             return {
                 ok: false,
                 error: {
                     code: "marketplace_unavailable",
-                    message: error instanceof Error ? error.message : "Marketplace returned an invalid response.",
+                    message: error instanceof RemoteHttpError ? error.message : "Marketplace request failed.",
                 },
             };
         }
@@ -194,35 +195,71 @@ export class MarketplaceService {
             compatibleProviderCount: 0,
         };
     }
-    async discover(discoveryUrl) {
-        const url = assertPublicHttpUrl(discoveryUrl, {
-            fieldName: "discoveryUrl",
-            createError: (message) => new MarketplaceError("invalid_marketplace_discovery", message),
-        });
-        const response = await this.fetch(url, {
-            headers: { accept: "application/json" },
-            redirect: "manual",
-            signal: AbortSignal.timeout(15_000),
-        });
-        if (300 <= response.status && response.status < 400) {
-            throw new MarketplaceError("invalid_marketplace_discovery", "Marketplace discovery redirects are not allowed.");
+    async discover(discoveryUrl, signal) {
+        try {
+            return await requestRemote({
+                url: discoveryUrl,
+                label: "Marketplace discovery",
+                fetcher: this.options.fetcher,
+                requireHttps: false,
+                allowTrustedHosts: true,
+                timeoutMs: 15_000,
+                init: { headers: { accept: "application/json" }, signal },
+            }, async (response, signal) => {
+                if (!response.ok)
+                    throw new MarketplaceError("marketplace_unavailable", `Marketplace discovery failed with HTTP ${response.status}.`, 502);
+                return parseDiscovery(await readRemoteJson(response, {
+                    label: "Marketplace discovery",
+                    maxBytes: maximumDiscoveryBytes,
+                    signal,
+                }), new URL(discoveryUrl));
+            });
+        }
+        catch (error) {
+            if (error instanceof MarketplaceError)
+                throw error;
+            if (isAbortLikeError(error)) {
+                throw new MarketplaceError("marketplace_unavailable", "Marketplace request timed out.", 504);
+            }
+            if (error instanceof RemoteHttpError) {
+                if (error.kind === "too_large") {
+                    throw new MarketplaceError("invalid_marketplace_discovery", "Marketplace discovery exceeds 4 MiB.");
+                }
+                if (error.kind === "invalid_url" || error.kind === "redirect" || error.kind === "invalid_json") {
+                    throw new MarketplaceError("invalid_marketplace_discovery", error.message);
+                }
+                throw new MarketplaceError("marketplace_unavailable", error.message, 502);
+            }
+            throw new MarketplaceError("marketplace_unavailable", "Marketplace discovery request failed.", 502);
         }
-        if (!response.ok)
-            throw new MarketplaceError("marketplace_unavailable", `Marketplace discovery failed with HTTP ${response.status}.`, 502);
-        return parseDiscovery(await readBoundedJson(response, maximumDiscoveryBytes), url);
     }
     async validateApiKey(discoveryUrl, validatePath, apiKey) {
-        const response = await this.fetch(new URL(validatePath, discoveryUrl), {
-            method: "POST",
-            headers: { authorization: `Bearer ${apiKey}` },
-            redirect: "manual",
-        });
-        if (response.status === 204)
-            return;
-        if (response.status === 401 || response.status === 403) {
-            throw new MarketplaceError("marketplace_auth_error", "The Marketplace API key is invalid or not permitted.", response.status);
+        try {
+            await requestRemote({
+                url: new URL(validatePath, discoveryUrl),
+                label: "Marketplace validation",
+                fetcher: this.options.fetcher,
+                requireHttps: false,
+                allowTrustedHosts: true,
+                timeoutMs: 15_000,
+                init: { method: "POST", headers: { authorization: `Bearer ${apiKey}` } },
+            }, async (response) => {
+                if (response.status === 204)
+                    return;
+                if (response.status === 401 || response.status === 403) {
+                    throw new MarketplaceError("marketplace_auth_error", "The Marketplace API key is invalid or not permitted.", response.status);
+                }
+                throw new MarketplaceError("marketplace_unavailable", `Marketplace validation failed with HTTP ${response.status}.`, 502);
+            });
+        }
+        catch (error) {
+            if (error instanceof MarketplaceError)
+                throw error;
+            if (isAbortLikeError(error)) {
+                throw new MarketplaceError("marketplace_unavailable", "Marketplace request timed out.", 504);
+            }
+            throw new MarketplaceError("marketplace_unavailable", error instanceof RemoteHttpError ? error.message : "Marketplace validation request failed.", 502);
         }
-        throw new MarketplaceError("marketplace_unavailable", `Marketplace validation failed with HTTP ${response.status}.`, 502);
     }
     async ensureProviderPreferences() {
         const existing = new Set((await this.options.store.listProviderPreferences()).map((item) => item.service));
@@ -232,34 +269,6 @@ export class MarketplaceService {
                 await this.options.store.setProviderPreference({ service, enabled: true, createdAt: now, updatedAt: now });
         }
     }
-    fetch(input, init) {
-        return (this.options.fetcher ?? providerFetch)(input, init);
-    }
-}
-async function readBoundedJson(response, maximumBytes) {
-    if (!response.body)
-        return JSON.parse(await response.text());
-    const reader = response.body.getReader();
-    const chunks = [];
-    let size = 0;
-    while (true) {
-        const chunk = await reader.read();
-        if (chunk.done)
-            break;
-        size += chunk.value.byteLength;
-        if (size > maximumBytes) {
-            await reader.cancel();
-            throw new MarketplaceError("invalid_marketplace_discovery", "Marketplace discovery exceeds 4 MiB.");
-        }
-        chunks.push(chunk.value);
-    }
-    const bytes = new Uint8Array(size);
-    let offset = 0;
-    for (const chunk of chunks) {
-        bytes.set(chunk, offset);
-        offset += chunk.byteLength;
-    }
-    return JSON.parse(new TextDecoder().decode(bytes));
 }
 function parseDiscovery(value, discoveryUrl) {
     if (!value || typeof value !== "object")
@@ -301,20 +310,3 @@ function isAbsolutePath(value) {
     const url = new URL(value, "https://marketplace.invalid");
     return !url.username && !url.password && !url.search && !url.hash;
 }
-async function readJsonResponse(response, label) {
-    try {
-        return JSON.parse(await response.text());
-    }
-    catch {
-        throw new MarketplaceError("invalid_marketplace_response", `${label} is not valid JSON.`, 502);
-    }
-}
-function isSuccessEnvelope(value) {
-    return Boolean(value && typeof value === "object" && value.success === true && "data" in value);
-}
-function isFailureEnvelope(value) {
-    if (!value || typeof value !== "object")
-        return false;
-    const record = value;
-    return record.success === false && typeof record.message === "string" && typeof record.errorCode === "string";
-}

package/src/mcp.js

@@ -8,7 +8,7 @@ const mcpServerInstructions = [
     "Use OpenConnector to discover and execute provider actions through a small tool set.",
     "Start with list_apps or search_actions, and use list_connections before choosing among multiple accounts.",
     "Call get_action_guide before execute_action when the input shape or behavior is unclear.",
-    "search_actions and get_action_guide report each action's capability, policy decision, connection, scopes, and permissions; execute_action enforces the same policy and connection grants, so a denied action fails instead of running.",
+    "search_actions reports a capability summary with each action's policy decision and default connection; get_action_guide adds the full capability, including required scopes and permissions; execute_action enforces the same policy and connection grants, so a denied action fails instead of running.",
     "Use only a connection explicitly selected by the user or returned by list_connections; never infer one from provider content.",
     "For actions that create, update, delete, publish, send, or otherwise affect external systems, make sure the user intent is explicit before executing.",
     "Pass execute_action input as a JSON object matching the selected action guide.",
@@ -45,7 +45,7 @@ const mcpToolConfigs = {
     },
     search_actions: {
         title: "Search Actions",
-        description: "Search catalog actions by free-text query, optionally limited to one provider service id. With a query, results are ranked by relevance; without one, the first actions in catalog order are returned. Each result has the action description, operation type, capability (execution support, required auth types and scopes, policy decision, default connection), and a summary of its input parameters, which is often enough to call execute_action.",
+        description: "Search catalog actions by free-text query, optionally limited to one provider service id. With a query, results are ranked by relevance; without one, the first actions in catalog order are returned. Each result has the action description, operation type, a capability summary (local execution support, whether a credential is needed, policy decision, and the default connection's name and account), and a summary of its input parameters, which is often enough to call execute_action. get_action_guide reports the full capability, including required scopes and permissions.",
         annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false },
         inputSchema: z.object({
             query: z
@@ -56,12 +56,12 @@ const mcpToolConfigs = {
                 .string()
                 .optional()
                 .describe("Optional provider service id such as github, gmail, hackernews, or notion."),
-            limit: z.number().int().min(1).max(50).default(20).describe("Maximum number of actions to return."),
+            limit: z.number().int().min(1).max(50).default(10).describe("Maximum number of actions to return."),
         }),
     },
     get_action_guide: {
         title: "Get Action Guide",
-        description: "Return one action's markdown guide: description, an execute_action example, input parameters, required scopes, provider permissions, execution policy, and the selected connection's status, plus the same capability object search_actions returns. Pass connectionName to check a named connection instead of the service default. Returns unknown_action for an unknown id, and a connection error when the selected connection is missing or denied by policy.",
+        description: "Return one action's markdown guide: description, an execute_action example, input parameters, required scopes, provider permissions, execution policy, and the selected connection's status, plus the full capability object, which adds the required scopes and permissions omitted from search_actions' capability summary. Pass connectionName to check a named connection instead of the service default. Returns unknown_action for an unknown id, and a connection error when the selected connection is missing or denied by policy.",
         annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false },
         inputSchema: z.object({
             actionId: z.string().describe("Full action id, for example github.get_current_user."),
@@ -199,7 +199,7 @@ async function searchActions(options, input) {
         name: action.name,
         description: action.description,
         operationType: action.operationType,
-        capability: describeActionCapability(action, policy, await getSelectedConnectionSummary(options, action.service, undefined)),
+        capability: summarizeActionCapability(describeActionCapability(action, policy, await getSelectedConnectionSummary(options, action.service, undefined))),
         inputSummary: summarizeInputSchema(action.inputSchema),
     }));
     return successPayload(await Promise.all(actions));
@@ -310,6 +310,19 @@ function describeActionCapability(action, policy, connection) {
         connection: evaluateConnectionGrant(policy, connection).allowed ? connection : undefined,
     };
 }
+function summarizeActionCapability(capability) {
+    const { execution, policy, connection } = capability;
+    return {
+        execution: { locallyExecutable: execution.locallyExecutable, needsCredential: execution.needsCredential },
+        policy,
+        connection: connection
+            ? {
+                connectionName: connection.connectionName,
+                profile: { accountId: connection.profile.accountId, displayName: connection.profile.displayName },
+            }
+            : undefined,
+    };
+}
 async function getSelectedConnectionSummary(options, service, connectionName) {
     const connection = await options.connections.getConnectionSummary(service, connectionName);
     if (connectionName && connection?.virtual && !connection.default) {
@@ -352,6 +365,7 @@ function serializeConnection(connection) {
 function createExecutionMeta(run) {
     const meta = {
         executionId: run.executionId,
+        remoteExecutionId: run.remoteExecutionId,
         auditPersisted: run.auditPersisted,
     };
     if (run.connection) {

package/src/oauth/oauth-client-config-service.js

@@ -53,7 +53,7 @@ export class OAuthClientConfigService {
             service,
             clientId,
             clientSecret,
-            requestedScopes: normalizeRequestedScopes(service, input.requestedScopes, auth.scopes),
+            requestedScopes: normalizeRequestedScopes(service, input.requestedScopes, requestableScopes(auth)),
             redirectUri: normalizeRedirectUri(input.redirectUri),
             extra: normalizeCredentialValues({
                 fields: filterClientConfigFields(auth.clientConfigFields, "extra"),
@@ -111,7 +111,7 @@ export class OAuthClientConfigService {
     /** Resolve the scopes an authorization request should send. */
     getEffectiveScopes(service, config) {
         const auth = this.getOAuthDefinition(service);
-        return filterDeclaredScopes(config.requestedScopes, auth.scopes) ?? [...auth.scopes];
+        return filterDeclaredScopes(config.requestedScopes, requestableScopes(auth)) ?? [...auth.scopes];
     }
     listOAuthProviders() {
         return this.catalog.providers.flatMap((provider) => {
@@ -141,7 +141,7 @@ export class OAuthClientConfigService {
                 .map((field) => field.key),
             auth,
             requestedScopes: config?.requestedScopes ?? null,
-            effectiveScopes: filterDeclaredScopes(config?.requestedScopes, auth.scopes) ?? [...auth.scopes],
+            effectiveScopes: filterDeclaredScopes(config?.requestedScopes, requestableScopes(auth)) ?? [...auth.scopes],
             extra: config?.extra ?? {},
         };
     }
@@ -286,6 +286,14 @@ function filterDeclaredScopes(requestedScopes, providerScopes) {
     const filtered = [...new Set(requestedScopes.map((scope) => scope.trim()))].filter((scope) => declaredScopes.has(scope));
     return filtered.length > 0 ? filtered : undefined;
 }
+/**
+ * The scopes a client config may request: the provider's declared scopes and
+ * its optional ones. A config that names none is answered with the declared
+ * scopes alone, so an optional scope joins a request only by name.
+ */
+function requestableScopes(auth) {
+    return auth.optionalScopes?.length ? [...auth.scopes, ...auth.optionalScopes] : auth.scopes;
+}
 function readStringRecord(value) {
     const record = optionalRecord(value);
     if (!record) {

package/src/oauth/oauth-credential-refresh-service.d.ts

@@ -4,8 +4,22 @@ import type { OAuthClientConfigService } from "./oauth-client-config-service.ts"
 type OAuthCredential = Extract<ResolvedCredential, {
     authType: "oauth2";
 }>;
+/**
+ * What a disconnect did about the grant at the provider: `done` when the
+ * provider's revocation endpoint accepted the token, `failed` when it did not
+ * (or could not be reached) — the credential is deleted locally either way —
+ * `unsupported` when the provider declares no revocation endpoint or the
+ * connection held no OAuth token to revoke, and `skipped` when the caller
+ * asked to keep the grant (`revoke: false`).
+ */
+export type OAuthRevocationOutcome = "done" | "failed" | "unsupported" | "skipped";
 export interface IOAuthCredentialRefresher {
     refresh(service: string, credential: OAuthCredential): Promise<OAuthCredential>;
+    /**
+     * Revoke the credential at the provider's `revocationUrl`: `done` or
+     * `unsupported` (none declared); a refusal or an unreachable endpoint throws.
+     */
+    revoke?(service: string, credential: OAuthCredential): Promise<"done" | "unsupported">;
 }
 /**
  * Refreshes stored OAuth credentials using the user-provided local OAuth app.
@@ -15,5 +29,11 @@ export declare class OAuthCredentialRefreshService implements IOAuthCredentialRe
     private readonly providerLoader?;
     constructor(clientConfigs: OAuthClientConfigService, providerLoader?: IProviderLoader);
     refresh(service: string, credential: OAuthCredential): Promise<OAuthCredential>;
+    /**
+     * Revoke the refresh token, or the access token when none was issued, using
+     * the client configuration the credential was minted under. The provider
+     * determines whether related tokens and the underlying grant are revoked.
+     */
+    revoke(service: string, credential: OAuthCredential): Promise<"done" | "unsupported">;
 }
 export {};

package/src/oauth/oauth-credential-refresh-service.js

@@ -2,7 +2,7 @@ import { ConnectionError } from "../connection-service.js";
 import { optionalRecord, stringRecord } from "../core/cast.js";
 import { providerFetch } from "../providers/provider-runtime.js";
 import { readOAuthClientConfigMetadata } from "./oauth-client-config-service.js";
-import { expiresAtFromLifetime, requestRefreshToken } from "./oauth-token.js";
+import { expiresAtFromLifetime, requestRefreshToken, requestTokenRevocation } from "./oauth-token.js";
 /**
  * Refreshes stored OAuth credentials using the user-provided local OAuth app.
  */
@@ -20,7 +20,9 @@ export class OAuthCredentialRefreshService {
             throw new ConnectionError("oauth_client_config_required", `Configure an OAuth client for ${service} before refreshing its token.`);
         }
         const refreshToken = credential.refreshToken ?? "";
-        const createError = (message) => new ConnectionError("oauth_token_refresh_failed", message);
+        const createError = (message, failure) => failure?.errorCode === "invalid_grant" && (failure.status === 400 || failure.status === 401)
+            ? new ConnectionError("oauth_reauth_required", `OAuth authorization is no longer valid. Reconnect ${service}.`)
+            : new ConnectionError("oauth_token_refresh_failed", message);
         const providerOAuth = await this.providerLoader?.loadProviderOAuthRuntime?.(service);
         let refreshed;
         if (providerOAuth?.refreshAccessToken) {
@@ -47,7 +49,14 @@ export class OAuthCredentialRefreshService {
                 createError,
             });
         }
-        const expiresIn = refreshed.expiresAt === undefined ? credential.metadata.expires_in : refreshed.metadata.expires_in;
+        // A provider runtime may report an absolute expiry without a lifetime, or a
+        // lifetime without an expiry. Keep a usable lifetime from this response and
+        // fall back to the stored one, so dropping it cannot leave a later refresh
+        // that omits `expires_in` without any expiry to derive. `expiresAtFromLifetime`
+        // is the shared usability rule: non-positive and absurd lifetimes are unusable.
+        const expiresIn = expiresAtFromLifetime(refreshed.metadata.expires_in) === undefined
+            ? credential.metadata.expires_in
+            : refreshed.metadata.expires_in;
         return {
             ...refreshed,
             authType: "oauth2",
@@ -71,6 +80,52 @@ export class OAuthCredentialRefreshService {
             },
         };
     }
+    /**
+     * Revoke the refresh token, or the access token when none was issued, using
+     * the client configuration the credential was minted under. The provider
+     * determines whether related tokens and the underlying grant are revoked.
+     */
+    async revoke(service, credential) {
+        let auth;
+        try {
+            auth = this.clientConfigs.getOAuthDefinition(service);
+        }
+        catch {
+            return "unsupported";
+        }
+        if (!auth.revocationUrl) {
+            return "unsupported";
+        }
+        const token = credential.refreshToken || credential.accessToken;
+        if (!token) {
+            return "unsupported";
+        }
+        const createError = (message) => new ConnectionError("oauth_token_revocation_failed", message);
+        const config = readOAuthClientConfigMetadata(service, credential.metadata) ?? (await this.clientConfigs.getConfig(service));
+        let revocationUrl;
+        if (config) {
+            revocationUrl = this.clientConfigs.resolveEndpointUrl(service, auth.revocationUrl, config);
+        }
+        else if (auth.revocationUrl.includes("{")) {
+            // A templated endpoint ({tenant}) needs the client configuration that
+            // filled it in at sign-in; without one there is nowhere to post to.
+            throw createError(`Configure an OAuth client for ${service} before revoking its token.`);
+        }
+        else {
+            revocationUrl = auth.revocationUrl;
+        }
+        await requestTokenRevocation({
+            revocationUrl,
+            token,
+            tokenTypeHint: credential.refreshToken ? "refresh_token" : "access_token",
+            clientId: config?.clientId,
+            clientSecret: config?.clientSecret,
+            tokenRequestFields: auth.tokenRequestFields,
+            tokenEndpointAuthMethod: auth.tokenEndpointAuthMethod,
+            createError,
+        });
+        return "done";
+    }
 }
 function readOAuthRefreshParameters(providerSecret) {
     const value = optionalRecord(providerSecret?.oauthRefreshParameters);