@oomol-lab/open-connector 1.7.0 → 1.9.0

package/src/providers/linear/trigger-on-issue-changed.js

@@ -0,0 +1,215 @@
+import { isJsonObject } from "../../triggers/common/json.js";
+import { eventsPollOutputs, PermanentPollError, PollConnectionError, TransientPollError, } from "../../triggers/common/poll.js";
+import { snapshot, uuidPattern } from "./trigger-on-issue-changed.definition.js";
+const uuid = new RegExp(uuidPattern);
+const overlapMs = 60_000;
+const pageSize = 50;
+export const linearIssueChanged = {
+    buildOutputs: eventsPollOutputs,
+    snapshot,
+    configOptions: options,
+    async poll(context) {
+        const teamId = typeof context.config.teamId == "string" ? context.config.teamId.toLowerCase() : context.config.teamId;
+        const stateIds = context.config.stateIds;
+        if (typeof teamId != "string" ||
+            !uuid.test(teamId) ||
+            !Array.isArray(stateIds) ||
+            stateIds.length > 50 ||
+            stateIds.some((name) => typeof name != "string" || !uuid.test(name)))
+            throw new PermanentPollError("Linear Issue configuration is invalid.");
+        if (context.checkpoint == null) {
+            const data = await query(context, "query LinearTeam($teamId: String!) { team(id: $teamId) { id } }", { teamId });
+            requireTeam(data.team, teamId);
+            const startedAt = context.now.toISOString();
+            return { checkpoint: { startedAt, since: startedAt }, events: [] };
+        }
+        const checkpoint = readCheckpoint(context.checkpoint);
+        const until = checkpoint.until ?? new Date(Math.max(context.now.getTime(), Date.parse(checkpoint.since))).toISOString();
+        const since = new Date(Math.max(Date.parse(checkpoint.startedAt), Date.parse(checkpoint.since) - overlapMs)).toISOString();
+        const data = await query(context, `query LinearIssueChanges($teamId: String!, $filter: IssueFilter!, $after: String) {
+      team(id: $teamId) {
+        id
+        issues(first: ${pageSize}, after: $after, orderBy: updatedAt, includeArchived: true, filter: $filter) {
+          nodes { id identifier title url createdAt updatedAt state { id name type } }
+          pageInfo { hasNextPage endCursor }
+        }
+      }
+    }`, {
+            teamId,
+            after: checkpoint.after ?? null,
+            filter: {
+                updatedAt: { gte: since, lte: until },
+                ...(stateIds.length == 0 ? {} : { state: { id: { in: stateIds } } }),
+            },
+        });
+        const team = requireTeam(data.team, teamId);
+        const page = team.issues;
+        if (!isJsonObject(page) ||
+            !Array.isArray(page.nodes) ||
+            page.nodes.length > pageSize ||
+            !isJsonObject(page.pageInfo) ||
+            typeof page.pageInfo.hasNextPage != "boolean") {
+            throw new TransientPollError("Linear returned an invalid Issue page.");
+        }
+        const { hasNextPage, endCursor } = page.pageInfo;
+        if (hasNextPage &&
+            (typeof endCursor != "string" ||
+                endCursor.length == 0 ||
+                endCursor.length > 4096 ||
+                endCursor == checkpoint.after ||
+                page.nodes.length == 0)) {
+            throw new TransientPollError("Linear returned an invalid continuation cursor.");
+        }
+        const events = page.nodes.map((value) => {
+            if (!isJsonObject(value) ||
+                typeof value.id != "string" ||
+                !uuid.test(value.id) ||
+                typeof value.identifier != "string" ||
+                value.identifier.length == 0 ||
+                typeof value.title != "string" ||
+                typeof value.url != "string" ||
+                !timestamp(value.createdAt) ||
+                !timestamp(value.updatedAt) ||
+                Date.parse(value.createdAt) > Date.parse(value.updatedAt) ||
+                Date.parse(value.updatedAt) < Date.parse(since) ||
+                Date.parse(value.updatedAt) > Date.parse(until) ||
+                !isJsonObject(value.state) ||
+                typeof value.state.id != "string" ||
+                !uuid.test(value.state.id) ||
+                typeof value.state.name != "string" ||
+                typeof value.state.type != "string" ||
+                (stateIds.length > 0 && !stateIds.includes(value.state.id)))
+                throw new TransientPollError("Linear returned an invalid Issue.");
+            return {
+                dedupeKey: `${value.id}:${value.updatedAt}`,
+                payload: {
+                    id: value.id,
+                    identifier: value.identifier,
+                    title: value.title,
+                    url: value.url,
+                    teamId,
+                    createdAt: value.createdAt,
+                    updatedAt: value.updatedAt,
+                    state: { id: value.state.id, name: value.state.name, type: value.state.type },
+                },
+            };
+        });
+        return {
+            checkpoint: hasNextPage
+                ? { ...checkpoint, until, after: endCursor }
+                : { startedAt: checkpoint.startedAt, since: until },
+            events,
+            hasMore: hasNextPage,
+        };
+    },
+};
+function readCheckpoint(value) {
+    if (!isJsonObject(value) ||
+        !timestamp(value.startedAt) ||
+        !timestamp(value.since) ||
+        Date.parse(value.since) < Date.parse(value.startedAt) ||
+        (value.until != null && (!timestamp(value.until) || Date.parse(value.until) < Date.parse(value.since))) ||
+        (value.after != null &&
+            (typeof value.after != "string" || value.after.length == 0 || value.after.length > 4096 || value.until == null)))
+        throw new PermanentPollError("Linear Issue checkpoint is invalid.");
+    return {
+        startedAt: value.startedAt,
+        since: value.since,
+        ...(typeof value.until == "string" ? { until: value.until } : {}),
+        ...(typeof value.after == "string" ? { after: value.after } : {}),
+    };
+}
+function timestamp(value) {
+    return (typeof value == "string" &&
+        value.length <= 40 &&
+        /^\d{4}-\d{2}-\d{2}T/.test(value) &&
+        Number.isFinite(Date.parse(value)));
+}
+function requireTeam(value, teamId) {
+    if (value === null)
+        throw new PermanentPollError("The Linear team is unavailable or not accessible to this Connection.");
+    if (!isJsonObject(value) || value.id !== teamId)
+        throw new TransientPollError("Linear returned an invalid Team.");
+    return value;
+}
+async function query(context, document, variables) {
+    context.signal?.throwIfAborted();
+    const result = await context.connector.execute({ endpoint: "/graphql", method: "POST", body: { query: document, variables } }, context.signal);
+    context.signal?.throwIfAborted();
+    if (result.status == 401 || result.status == 403)
+        throw new PollConnectionError("Linear Issue access requires authorization.");
+    if (result.status == 429)
+        throw new TransientPollError("Linear Issue checks were rate limited.");
+    const body = result.data;
+    if (isJsonObject(body) && Array.isArray(body.errors) && body.errors.length > 0) {
+        const codes = new Set(body.errors.flatMap((error) => isJsonObject(error) && isJsonObject(error.extensions) ? [error.extensions.code] : []));
+        if (codes.has("UNAUTHENTICATED") || codes.has("FORBIDDEN") || codes.has("AUTHENTICATION_ERROR")) {
+            throw new PollConnectionError("Linear Issue access requires authorization.");
+        }
+        if (codes.has("RATELIMITED"))
+            throw new TransientPollError("Linear Issue checks were rate limited.");
+        if (codes.has("GRAPHQL_VALIDATION_FAILED") || codes.has("BAD_USER_INPUT"))
+            throw new PermanentPollError("Linear rejected the Issue query configuration.");
+        throw new TransientPollError("Linear Issue query failed; progress was retained.");
+    }
+    if (result.status != 200 ||
+        !isJsonObject(body) ||
+        !isJsonObject(body.data) ||
+        (body.errors != null && !Array.isArray(body.errors))) {
+        throw new TransientPollError(`Linear returned an invalid query response (HTTP ${result.status}).`);
+    }
+    return body.data;
+}
+async function options(context) {
+    const { field, config } = context;
+    if (field != "teamId" && field != "stateIds")
+        throw new PermanentPollError("Unknown Linear configuration field.");
+    if (field == "stateIds" && (typeof config.teamId != "string" || !uuid.test(config.teamId)))
+        throw new PermanentPollError("Select a Linear Team first.");
+    const choices = [];
+    const cursors = new Set();
+    let after = null;
+    for (let page = 0; page < 10; page++) {
+        const data = await query(context, field == "teamId"
+            ? "query LinearTeams($after: String) { teams(first: 100, after: $after) { nodes { id name key } pageInfo { hasNextPage endCursor } } }"
+            : "query LinearStates($teamId: String!, $after: String) { team(id: $teamId) { id states(first: 100, after: $after) { nodes { id name color position } pageInfo { hasNextPage endCursor } } } }", { after, ...(field == "teamId" ? {} : { teamId: config.teamId }) });
+        const values = field == "teamId" ? data.teams : requireTeam(data.team, String(config.teamId)).states;
+        if (!isJsonObject(values) ||
+            !Array.isArray(values.nodes) ||
+            values.nodes.length > 100 ||
+            !isJsonObject(values.pageInfo) ||
+            typeof values.pageInfo.hasNextPage != "boolean") {
+            throw new TransientPollError("Linear returned invalid configuration options.");
+        }
+        for (const item of values.nodes) {
+            if (!isJsonObject(item) ||
+                typeof item.id != "string" ||
+                !uuid.test(item.id) ||
+                typeof item.name != "string" ||
+                item.name.length == 0 ||
+                (field == "teamId"
+                    ? typeof item.key != "string"
+                    : typeof item.color != "string" || !/^#[0-9a-fA-F]{6}$/.test(item.color))) {
+                throw new TransientPollError("Linear returned an invalid configuration option.");
+            }
+            choices.push({
+                value: item.id,
+                label: field == "teamId" ? `${item.name} (${item.key})` : item.name,
+                ...(field == "stateIds" ? { color: String(item.color) } : {}),
+            });
+        }
+        if (!values.pageInfo.hasNextPage)
+            return choices;
+        const cursor = values.pageInfo.endCursor;
+        if (typeof cursor != "string" ||
+            cursor.length == 0 ||
+            cursor.length > 4096 ||
+            cursors.has(cursor) ||
+            values.nodes.length == 0) {
+            throw new TransientPollError("Linear returned an invalid options cursor.");
+        }
+        cursors.add(cursor);
+        after = cursor;
+    }
+    throw new PermanentPollError("The Linear options list exceeds the supported limit of 1000 entries.");
+}

package/src/providers/lingxing_mcp/runtime.js

@@ -2,7 +2,7 @@ import { UnauthorizedError } from "@modelcontextprotocol/client";
 import { SdkHttpError } from "@modelcontextprotocol/client";
 import { ProtocolError, SdkError, SdkErrorCode } from "@modelcontextprotocol/client";
 import { createHash } from "node:crypto";
-import { optionalRecord, requiredString } from "../../core/cast.js";
+import { optionalNumber, optionalRecord, optionalString, requiredString } from "../../core/cast.js";
 import { assertPublicHttpUrl } from "../../core/request.js";
 import { withMcpClient } from "../mcp-client.js";
 import { providerUserAgent, ProviderRequestError, toProviderExecutionError } from "../provider-runtime.js";
@@ -107,7 +107,7 @@ export function normalizeLingxingMcpEndpoint(value) {
 }
 export async function validateLingxingCredential(values, fetcher, signal) {
     const context = createLingxingContext(values, fetcher, signal);
-    const tools = await runLingxingMcp("validate", () => discoverLingxingTools(context));
+    const tools = await discoverLingxingTools(context);
     if (tools.length === 0) {
         throw new ProviderRequestError(502, "Lingxing MCP did not expose any tools for this account");
     }
@@ -126,13 +126,13 @@ export async function validateLingxingCredential(values, fetcher, signal) {
 }
 export async function listLingxingTools(context) {
     return {
-        tools: await runLingxingMcp("execute", () => discoverLingxingTools(context)),
+        tools: await discoverLingxingTools(context),
     };
 }
 export async function callLingxingTool(context, input) {
     const toolName = requiredString(input.toolName, "toolName", (message) => new ProviderRequestError(400, message));
     const argumentsValue = readToolArguments(input.arguments);
-    const result = await runLingxingMcp("execute", () => withLingxingMcpClient(context, async (client) => {
+    const result = await withLingxingMcpClient(context, async (client) => {
         const toolResult = await client.callTool({
             name: toolName,
             arguments: argumentsValue,
@@ -141,7 +141,7 @@ export async function callLingxingTool(context, input) {
             signal: context.signal,
         });
         return normalizeLingxingMcpToolResult(toolName, toolResult);
-    }));
+    });
     return { result };
 }
 async function discoverLingxingTools(context) {
@@ -200,6 +200,38 @@ function readToolArguments(value) {
     return argumentsValue;
 }
 function normalizeLingxingMcpToolResult(toolName, result) {
+    if ("content" in result) {
+        const candidates = [result.structuredContent];
+        for (const content of result.content) {
+            if (content.type !== "text")
+                continue;
+            const prefix = "call failed, status: 429, response: ";
+            const text = result.isError && content.text.startsWith(prefix) ? content.text.slice(prefix.length) : content.text;
+            try {
+                candidates.push(JSON.parse(text));
+            }
+            catch {
+                /* Unstructured tool content is passed through. */
+            }
+        }
+        for (const candidate of candidates) {
+            const envelope = optionalRecord(candidate);
+            if (envelope?.success !== false)
+                continue;
+            const code = optionalNumber(envelope.code);
+            const message = optionalString(envelope.msg)?.trim();
+            if (code === undefined || !message)
+                continue;
+            // Code 102 also reports changed tool parameters; only the verified key signal permits recovery.
+            if (code === 102 && message.startsWith("MCP Key无效或已失效，请检查x-mcp-key配置")) {
+                throw new ProviderRequestError(401, message, undefined, "authorization_failed");
+            }
+            if (code === 429 && message === "认证请求过于频繁，请稍后重试") {
+                throw new ProviderRequestError(429, message, undefined, "rate_limited");
+            }
+            throw new ProviderRequestError(502, `Lingxing MCP tool failed (${code}): ${message}`);
+        }
+    }
     if ("content" in result && result.isError) {
         throw new ProviderRequestError(502, `Lingxing MCP tool ${toolName} returned an error: ${formatLingxingMcpToolContent(result)}`, result);
     }
@@ -232,17 +264,11 @@ function mapLingxingMcpError(error) {
         return error;
     }
     if (error instanceof UnauthorizedError) {
-        return new ProviderRequestError(401, "Lingxing MCP token is invalid or expired", error);
+        return new ProviderRequestError(401, "Lingxing MCP authentication request failed", error, "provider_error");
     }
     if (error instanceof SdkHttpError) {
         const status = error.status;
-        return new ProviderRequestError(status === 401 || status === 403
-            ? 401
-            : status === 429
-                ? 429
-                : status && status >= 400 && status < 500
-                    ? 400
-                    : 502, `Lingxing MCP request failed: ${error.message}`, error);
+        return new ProviderRequestError(status && status >= 400 ? status : 502, `Lingxing MCP request failed: ${error.message}`, error, status === 429 ? "rate_limited" : "provider_error");
     }
     if (error instanceof SdkError && error.code === SdkErrorCode.RequestTimeout) {
         return new ProviderRequestError(504, "Lingxing MCP request timed out", error);
@@ -255,17 +281,6 @@ function mapLingxingMcpError(error) {
     }
     return new ProviderRequestError(502, error instanceof Error ? `Lingxing MCP request failed: ${error.message}` : "Lingxing MCP request failed", error);
 }
-async function runLingxingMcp(phase, run) {
-    try {
-        return await run();
-    }
-    catch (error) {
-        if (error instanceof ProviderRequestError && error.status === 401) {
-            throw new ProviderRequestError(phase === "validate" ? 400 : 401, "Lingxing MCP Server URL or X-Mcp-Key is invalid", error);
-        }
-        throw error;
-    }
-}
 function hashLingxingCredential(credential) {
     return createHash("sha256").update(credential.endpoint.toString()).digest("hex").slice(0, 16);
 }

package/src/providers/litellm/executors.d.ts

@@ -0,0 +1,4 @@
+import type { CredentialValidators, ProviderExecutors, ProviderProxyExecutor } from "../../core/types.ts";
+export declare const executors: ProviderExecutors;
+export declare const proxy: ProviderProxyExecutor;
+export declare const credentialValidators: CredentialValidators;

package/src/providers/litellm/executors.js

@@ -0,0 +1,34 @@
+import { optionalString } from "../../core/cast.js";
+import { isPrivateNetworkAccessAllowed } from "../../core/request.js";
+import { createProviderFetch, defineProviderExecutors, defineProviderProxy, ProviderRequestError, requireApiKeyCredential, } from "../provider-runtime.js";
+import { createLitellmContext, litellmActionHandlers, normalizeLitellmBaseUrl, validateLitellmCredential, } from "./runtime.js";
+const service = "litellm";
+export const executors = defineProviderExecutors({
+    service,
+    handlers: litellmActionHandlers,
+    async createContext(context, fetcher) {
+        const credential = await requireApiKeyCredential(context, service);
+        return createLitellmContext(credential.values, credential.apiKey, fetcher, context.signal);
+    },
+    allowPrivateNetwork: isPrivateNetworkAccessAllowed,
+});
+export const proxy = defineProviderProxy({
+    service,
+    baseUrl: async (context) => {
+        const credential = await requireApiKeyCredential(context, service);
+        const value = optionalString(credential.metadata.apiBaseUrl) ?? optionalString(credential.values.baseUrl);
+        if (!value)
+            throw new ProviderRequestError(500, "litellm connection is missing baseUrl metadata");
+        return normalizeLitellmBaseUrl(value);
+    },
+    auth: { type: "api_key_authorization", prefix: "Bearer " },
+    allowPrivateNetwork: isPrivateNetworkAccessAllowed,
+});
+export const credentialValidators = {
+    apiKey(input, { fetcher, signal }) {
+        // Re-guard the shared validator fetcher with the private-network opt-in so
+        // validating a proxy on a private network works when the deployment allows it.
+        const guardedFetcher = createProviderFetch({ fetch: fetcher, allowPrivateNetwork: isPrivateNetworkAccessAllowed });
+        return validateLitellmCredential(input.values, input.apiKey, guardedFetcher, signal);
+    },
+};

package/src/providers/litellm/runtime.d.ts

@@ -0,0 +1,29 @@
+import type { CredentialValidationResult } from "../../core/types.ts";
+import type { ProviderActionHandlers } from "../provider-runtime.ts";
+export interface LitellmContext {
+    apiKey: string;
+    /** Proxy root URL, without a trailing `/v1`. */
+    baseUrl: string;
+    fetcher: typeof fetch;
+    signal?: AbortSignal;
+}
+type LitellmActionHandler = (input: Record<string, unknown>, context: LitellmContext) => Promise<unknown>;
+export declare const litellmActionHandlers: ProviderActionHandlers<"litellm", LitellmActionHandler>;
+/**
+ * Build the per-request LiteLLM context from the stored connection fields.
+ */
+export declare function createLitellmContext(values: Record<string, string>, apiKey: string, fetcher: typeof fetch, signal?: AbortSignal): LitellmContext;
+/**
+ * Verify a LiteLLM key against the proxy and record the models it can call.
+ * `/v1/models` accepts both virtual keys and the master key, unlike `/key/info`.
+ */
+export declare function validateLitellmCredential(values: Record<string, string>, apiKey: string, fetcher: typeof fetch, signal?: AbortSignal): Promise<CredentialValidationResult>;
+/**
+ * Validates a LiteLLM proxy URL, rejects embedded credentials and unsafe
+ * targets, removes query/hash components, and reduces it to the proxy root.
+ * LiteLLM serves its OpenAI routes under both `/` and `/v1`, so a pasted
+ * `https://host/v1` and `https://host` resolve to the same connection, while a
+ * path prefix such as `https://host/litellm` (SERVER_ROOT_PATH) is kept.
+ */
+export declare function normalizeLitellmBaseUrl(value: unknown, allowPrivateNetwork?: boolean): string;
+export {};

package/src/providers/litellm/runtime.js

@@ -0,0 +1,227 @@
+import { compactObject, looseArray, optionalBooleanOrNull, optionalIntegerOrNull, optionalNumber, optionalRecord, optionalScalarString, optionalString, optionalStringArray, optionalStringOrNull, recordOrEmpty, } from "../../core/cast.js";
+import { assertPublicHttpUrl, isPrivateNetworkAccessAllowed } from "../../core/request.js";
+import { providerInputError, ProviderRequestError, providerUserAgent, readProviderErrorTextBody, readProviderJsonBody, requiredInputString, requiredResponseRecord, runProviderRequest, withRetryAfterSeconds, } from "../provider-runtime.js";
+const requestLabel = "LiteLLM";
+// Long completions and large embedding batches routinely exceed the shared
+// 30 second provider timeout.
+const inferenceRequestTimeoutMs = 300_000;
+const validationEndpoint = "/v1/models";
+export const litellmActionHandlers = {
+    async create_chat_completion(input, context) {
+        assertStreamingDisabled(input);
+        return litellmRequest({ path: "/v1/chat/completions", method: "POST", body: input, timeoutMs: inferenceRequestTimeoutMs }, context);
+    },
+    async create_message(input, context) {
+        assertStreamingDisabled(input);
+        return litellmRequest({ path: "/v1/messages", method: "POST", body: input, timeoutMs: inferenceRequestTimeoutMs }, context);
+    },
+    create_embedding(input, context) {
+        return litellmRequest({ path: "/v1/embeddings", method: "POST", body: input, timeoutMs: inferenceRequestTimeoutMs }, context);
+    },
+    list_models(_input, context) {
+        return litellmRequest({ path: "/v1/models" }, context);
+    },
+    async get_model_info(input, context) {
+        const model = optionalString(input.model);
+        const payload = optionalRecord(await litellmRequest({ path: "/model/info" }, context));
+        const models = looseArray(payload?.data)
+            .map(normalizeModelInfo)
+            .filter((info) => info !== undefined)
+            .filter((info) => model === undefined || info.modelName === model);
+        return { models };
+    },
+    async get_key_info(_input, context) {
+        try {
+            const payload = optionalRecord(await litellmRequest({ path: "/key/info" }, context));
+            return normalizeKeyInfo(requiredResponseRecord(payload?.info, "LiteLLM key info"));
+        }
+        catch (error) {
+            if (!(error instanceof ProviderRequestError)) {
+                throw error;
+            }
+            const details = optionalRecord(error.details);
+            if (details?.status !== 404) {
+                throw error;
+            }
+            // The proxy master key authenticates but lives in the proxy environment,
+            // not the key table, so `/key/info` answers 404 with a `not_found_error`
+            // envelope for it. Any other 404, such as FastAPI's `{"detail":"Not Found"}`,
+            // means the route itself is missing at this base URL.
+            if (details.type === "not_found_error") {
+                throw providerInputError("LiteLLM authenticated this key but has no record of it in the proxy key table, which is the case for the proxy master key. Connect a LiteLLM virtual key to read its budget.");
+            }
+            throw error;
+        }
+    },
+};
+/**
+ * Build the per-request LiteLLM context from the stored connection fields.
+ */
+export function createLitellmContext(values, apiKey, fetcher, signal) {
+    return { apiKey, baseUrl: normalizeLitellmBaseUrl(values.baseUrl), fetcher, signal };
+}
+/**
+ * Verify a LiteLLM key against the proxy and record the models it can call.
+ * `/v1/models` accepts both virtual keys and the master key, unlike `/key/info`.
+ */
+export async function validateLitellmCredential(values, apiKey, fetcher, signal) {
+    const context = createLitellmContext(values, apiKey, fetcher, signal);
+    const payload = optionalRecord(await litellmRequest({ path: validationEndpoint }, context));
+    const host = new URL(context.baseUrl).host;
+    return {
+        profile: { accountId: `litellm:${host}`, displayName: `LiteLLM ${host}` },
+        grantedScopes: [],
+        metadata: {
+            apiBaseUrl: context.baseUrl,
+            validationEndpoint,
+            availableModels: looseArray(payload?.data)
+                .map((model) => optionalString(optionalRecord(model)?.id))
+                .filter((model) => model !== undefined),
+        },
+    };
+}
+/**
+ * Validates a LiteLLM proxy URL, rejects embedded credentials and unsafe
+ * targets, removes query/hash components, and reduces it to the proxy root.
+ * LiteLLM serves its OpenAI routes under both `/` and `/v1`, so a pasted
+ * `https://host/v1` and `https://host` resolve to the same connection, while a
+ * path prefix such as `https://host/litellm` (SERVER_ROOT_PATH) is kept.
+ */
+export function normalizeLitellmBaseUrl(value, allowPrivateNetwork = isPrivateNetworkAccessAllowed()) {
+    const proxyUrl = requiredInputString(value, "baseUrl");
+    const url = assertPublicHttpUrl(proxyUrl, {
+        fieldName: "baseUrl",
+        createError: providerInputError,
+        allowPrivateNetwork,
+    });
+    if (url.username || url.password)
+        throw providerInputError("baseUrl must not include credentials");
+    url.hash = "";
+    url.search = "";
+    url.pathname = url.pathname.replace(/\/+$/u, "").replace(/\/v1$/u, "");
+    return url.toString().replace(/\/$/u, "");
+}
+/**
+ * Map a failed LiteLLM response to a provider error. LiteLLM wraps errors in
+ * an OpenAI-style `{ error: { message, type, code, param } }` envelope; an
+ * exhausted key, team, or user budget arrives with type `budget_exceeded`
+ * (HTTP 400 on older releases, 422 on newer ones, so the type is what is
+ * checked), which is reported as `insufficient_credit` so callers can tell it
+ * apart from a malformed request.
+ */
+async function readLitellmError(response, signal) {
+    const text = await readProviderErrorTextBody(response, `${requestLabel} error response`, signal);
+    const envelope = parseLitellmErrorEnvelope(text);
+    const message = envelope.message ?? (text.trim() || `${requestLabel} request failed with HTTP ${response.status}`);
+    const details = withRetryAfterSeconds(response, compactObject({ status: response.status, type: envelope.type, code: envelope.code, param: envelope.param }));
+    if (envelope.type === "budget_exceeded") {
+        return new ProviderRequestError(402, message, details, "insufficient_credit");
+    }
+    if (response.status === 429) {
+        return new ProviderRequestError(429, message, details);
+    }
+    if (response.status === 401 || response.status === 403 || response.status === 404) {
+        return new ProviderRequestError(response.status, message, details, "provider_error");
+    }
+    if (response.status >= 500) {
+        return new ProviderRequestError(response.status, message, details, "provider_error");
+    }
+    return new ProviderRequestError(400, message, details);
+}
+function litellmRequest(input, context) {
+    return runProviderRequest({ signal: context.signal, label: requestLabel, timeoutMs: input.timeoutMs }, async (signal) => {
+        const response = await context.fetcher(`${context.baseUrl}${input.path}`, {
+            method: input.method ?? "GET",
+            headers: buildLitellmHeaders(context.apiKey, input.body !== undefined),
+            body: input.body === undefined ? undefined : JSON.stringify(compactObject(input.body)),
+            signal,
+        });
+        if (!response.ok) {
+            throw await readLitellmError(response, signal);
+        }
+        return readProviderJsonBody(response, {
+            emptyBody: null,
+            invalidJsonMessage: `${requestLabel} returned malformed JSON`,
+        });
+    });
+}
+function buildLitellmHeaders(apiKey, includeJsonContentType) {
+    const headers = new Headers({
+        accept: "application/json",
+        authorization: `Bearer ${apiKey}`,
+        "user-agent": providerUserAgent,
+    });
+    if (includeJsonContentType) {
+        headers.set("content-type", "application/json");
+    }
+    return headers;
+}
+function assertStreamingDisabled(input) {
+    if (input.stream === true) {
+        throw providerInputError("stream=true is not supported by connector actions");
+    }
+}
+function parseLitellmErrorEnvelope(text) {
+    let payload;
+    try {
+        payload = optionalRecord(JSON.parse(text));
+    }
+    catch {
+        return {};
+    }
+    const nested = optionalRecord(payload?.error);
+    return {
+        message: optionalString(nested?.message) ??
+            optionalString(payload?.error) ??
+            optionalString(payload?.detail) ??
+            optionalString(optionalRecord(payload?.detail)?.error),
+        type: optionalString(nested?.type),
+        code: optionalScalarString(nested?.code),
+        param: optionalString(nested?.param),
+    };
+}
+function normalizeModelInfo(entry) {
+    const record = optionalRecord(entry);
+    const modelName = optionalString(record?.model_name);
+    if (!modelName) {
+        return undefined;
+    }
+    const info = recordOrEmpty(record?.model_info);
+    return {
+        modelName,
+        modelId: optionalStringOrNull(info.id),
+        provider: optionalStringOrNull(info.litellm_provider),
+        mode: optionalStringOrNull(info.mode),
+        maxInputTokens: optionalIntegerOrNull(info.max_input_tokens),
+        maxOutputTokens: optionalIntegerOrNull(info.max_output_tokens),
+        inputCostPerToken: optionalNumber(info.input_cost_per_token) ?? null,
+        outputCostPerToken: optionalNumber(info.output_cost_per_token) ?? null,
+        supportsFunctionCalling: optionalBooleanOrNull(info.supports_function_calling),
+        supportsVision: optionalBooleanOrNull(info.supports_vision),
+        supportsReasoning: optionalBooleanOrNull(info.supports_reasoning),
+        supportsResponseSchema: optionalBooleanOrNull(info.supports_response_schema),
+    };
+}
+// The `/key/info` envelope also echoes the looked-up key, which this keeps out
+// of action output; only the key's record is normalized.
+function normalizeKeyInfo(info) {
+    const spend = optionalNumber(info.spend) ?? 0;
+    const maxBudget = optionalNumber(info.max_budget) ?? null;
+    return {
+        keyAlias: optionalStringOrNull(info.key_alias),
+        keyName: optionalStringOrNull(info.key_name),
+        status: optionalStringOrNull(info.status),
+        spend,
+        maxBudget,
+        remainingBudget: maxBudget === null ? null : Math.max(0, maxBudget - spend),
+        budgetDuration: optionalStringOrNull(info.budget_duration),
+        budgetResetAt: optionalStringOrNull(info.budget_reset_at),
+        models: optionalStringArray(info.models) ?? [],
+        tpmLimit: optionalIntegerOrNull(info.tpm_limit),
+        rpmLimit: optionalIntegerOrNull(info.rpm_limit),
+        teamId: optionalStringOrNull(info.team_id),
+        userId: optionalStringOrNull(info.user_id),
+        expires: optionalStringOrNull(info.expires),
+        blocked: optionalBooleanOrNull(info.blocked),
+    };
+}

package/src/providers/mcp-tools.d.ts

@@ -7,6 +7,7 @@ export interface McpToolSummary {
     description?: string;
     annotations?: ToolAnnotations;
     inputSchema: Record<string, unknown>;
+    outputSchema?: Record<string, unknown>;
 }
 export interface McpToolOptions {
     endpoint: string;
@@ -24,6 +25,7 @@ export interface McpToolOptions {
     toolListTimeoutMs?: number;
 }
 interface ListMcpToolsOptions {
+    includeOutputSchema?: boolean;
     includeAnnotations?: boolean;
 }
 export declare function listMcpTools(input: McpToolOptions, options?: ListMcpToolsOptions): Promise<McpToolSummary[]>;

package/src/providers/mcp-tools.js

@@ -1,6 +1,6 @@
 import { Client, ProtocolError, ProtocolErrorCode, SdkError, SdkErrorCode, SdkHttpError, SseError, UnauthorizedError, } from "@modelcontextprotocol/client";
 import { withMcpClient } from "./mcp-client.js";
-import { createProviderTimeout, isAbortLikeError, providerFetch, providerUserAgent, ProviderRequestError, } from "./provider-runtime.js";
+import { createProviderTimeout, isAbortLikeError, providerFetch, ProviderRequestError, providerUserAgent, } from "./provider-runtime.js";
 const defaultMcpToolListMaxBytes = 16 * 1024 * 1024;
 const defaultMcpToolListMaxPages = 100;
 const defaultMcpToolListMaxTools = 10_000;
@@ -32,6 +32,7 @@ export async function listMcpTools(input, options = {}) {
             description: tool.description,
             annotations: options.includeAnnotations ? tool.annotations : undefined,
             inputSchema: tool.inputSchema,
+            outputSchema: options.includeOutputSchema ? tool.outputSchema : undefined,
         }));
     });
 }