@oomol-lab/open-connector 1.7.0 → 1.9.0

package/src/server/api/action-example.js

@@ -0,0 +1,402 @@
+import { Validator } from "@cfworker/json-schema";
+import { readSchemaProperties, readSchemaRequired } from "../../core/json-schema.js";
+import { samplePattern } from "./pattern-example.js";
+const exampleStringFormats = {
+    date: "2000-01-01",
+    "date-time": "2000-01-01T00:00:00Z",
+    email: "user@example.com",
+    hostname: "example.com",
+    ipv4: "192.0.2.1",
+    ipv6: "2001:db8::1",
+    uri: "https://example.com",
+    url: "https://example.com",
+    uuid: "00000000-0000-4000-8000-000000000000",
+};
+/** Build a small example for the schema shapes used by the action catalog. */
+export function buildExampleInput(schema) {
+    const seedSchema = mergeAllOfPropertySchemas(schema);
+    const properties = readSchemaProperties(seedSchema);
+    const input = {};
+    seedObjectRequirements(seedSchema, properties, input);
+    if (Array.isArray(schema.allOf)) {
+        for (const member of schema.allOf) {
+            if (isSchemaObject(member)) {
+                seedObjectRequirements(member, properties, input);
+            }
+        }
+    }
+    fillMinProperties(seedSchema, properties, input);
+    if (Array.isArray(schema.allOf)) {
+        for (const member of schema.allOf) {
+            if (isSchemaObject(member)) {
+                fillMinProperties(member, { ...properties, ...readSchemaProperties(member) }, input);
+            }
+        }
+    }
+    applyConditionalRequirements(seedSchema, seedSchema, input);
+    return input;
+}
+/** Apply each selected condition once; do not search for a globally satisfying assignment. */
+function applyConditionalRequirements(schema, parent, input) {
+    if (isSchemaObject(schema.if)) {
+        const matches = new Validator(schema.if, "2020-12").validate(input).valid;
+        const branch = matches ? schema.then : schema.else;
+        if (isSchemaObject(branch)) {
+            const merged = mergeExampleSchemas(parent, branch);
+            const properties = readSchemaProperties(merged);
+            for (const name of Object.keys(readSchemaProperties(branch))) {
+                if (name in input) {
+                    input[name] = exampleValue(properties[name]);
+                }
+            }
+            seedObjectRequirements({ ...branch, properties }, properties, input);
+            fillMinProperties(merged, properties, input);
+            applyConditionalRequirements(branch, merged, input);
+        }
+    }
+    if (Array.isArray(schema.allOf)) {
+        for (const member of schema.allOf) {
+            if (isSchemaObject(member)) {
+                applyConditionalRequirements(member, parent, input);
+            }
+        }
+    }
+}
+/**
+ * Same-named property schemas from `allOf` members apply together with the root
+ * schema, so merge their constraints before seeding a required property: a
+ * member that adds `minLength` must not be skipped because the root seeded the
+ * value first.
+ */
+function mergeAllOfPropertySchemas(schema) {
+    if (!Array.isArray(schema.allOf)) {
+        return schema;
+    }
+    const properties = { ...readSchemaProperties(schema) };
+    let merged = false;
+    for (const member of schema.allOf) {
+        if (!isSchemaObject(member)) {
+            continue;
+        }
+        for (const [name, memberProperty] of Object.entries(readSchemaProperties(member))) {
+            if (!isSchemaObject(memberProperty)) {
+                continue;
+            }
+            const parentProperty = properties[name];
+            properties[name] = isSchemaObject(parentProperty)
+                ? mergeExampleSchemas(parentProperty, memberProperty)
+                : memberProperty;
+            merged = true;
+        }
+    }
+    return merged ? { ...schema, properties } : schema;
+}
+/** Raise the object to its `minProperties` with named properties first, then placeholder map keys. */
+function fillMinProperties(schema, properties, input) {
+    const minProperties = typeof schema.minProperties === "number" ? schema.minProperties : 0;
+    if (minProperties === 0) {
+        return;
+    }
+    for (const name of Object.keys(properties)) {
+        if (Object.keys(input).length >= minProperties) {
+            break;
+        }
+        if (!(name in input)) {
+            input[name] = exampleValue(properties[name]);
+        }
+    }
+    if (schema.additionalProperties !== false) {
+        // A map-shaped object such as attributes or records reaches minProperties
+        // only through its additional properties; placeholder keys fill the deficit
+        // while still matching the outer schema. Bounded so a property named like a
+        // placeholder cannot loop forever.
+        for (let index = 0; Object.keys(input).length < minProperties && index < minProperties + 10; index += 1) {
+            const key = isSchemaObject(schema.propertyNames) ? stringExample(schema.propertyNames) : "key";
+            const name = index === 0 ? key : `${key}${index + 1}`;
+            if (name in input) {
+                continue;
+            }
+            input[name] = exampleValue(isSchemaObject(schema.additionalProperties) ? schema.additionalProperties : undefined);
+        }
+    }
+}
+/** Seed every property requirement an object schema (or one `allOf` member) declares. */
+function seedObjectRequirements(schema, properties, input) {
+    seedRequiredProperties(schema, properties, input);
+    seedRequirementBranches(schema, properties, input);
+}
+/**
+ * `requireAnyProperty`/`requireExactlyOneProperty` keep every property optional
+ * and add `anyOf`/`oneOf` branches that each require some property, so an example
+ * that only seeds `required` can never match. Seed the properties the first
+ * usable branch asks for, using the branch's own property schemas.
+ */
+function seedRequirementBranches(schema, properties, input) {
+    const keyword = Array.isArray(schema.anyOf) ? "anyOf" : "oneOf";
+    const branches = schema[keyword];
+    if (!Array.isArray(branches)) {
+        return;
+    }
+    const candidates = branches
+        .filter(isSchemaObject)
+        .filter((branch) => branch.type !== "null" && !conflictsWithParent(schema, branch));
+    const satisfied = keyword === "oneOf"
+        ? candidates.find((branch) => {
+            const required = readSchemaRequired(branch);
+            return required.length > 0 && required.every((name) => name in input);
+        })
+        : undefined;
+    const branch = satisfied ??
+        (keyword === "oneOf"
+            ? candidates.find((candidate) => readSchemaRequired(schema).length > 0 ||
+                readSchemaRequired(candidate).length > 0 ||
+                Array.isArray(candidate.anyOf) ||
+                Array.isArray(candidate.oneOf) ||
+                Object.keys(readSchemaProperties(candidate)).length > 0)
+            : undefined) ??
+        candidates[0];
+    if (!branch) {
+        return;
+    }
+    const merged = mergeBranch(schema, branch, keyword);
+    const mergedProperties = { ...properties, ...readSchemaProperties(merged) };
+    const required = readSchemaRequired(merged);
+    for (const name of required) {
+        input[name] = exampleValue(mergedProperties[name]);
+    }
+    // Optional properties can distinguish object shapes that would all accept {}.
+    // Nested combinators must select their own requirements before adding fields.
+    if (keyword === "oneOf" && required.length === 0 && !Array.isArray(merged.anyOf) && !Array.isArray(merged.oneOf)) {
+        for (const name of Object.keys(mergedProperties)) {
+            input[name] = exampleValue(mergedProperties[name]);
+        }
+    }
+    seedObjectRequirements(merged, mergedProperties, input);
+    fillMinProperties(merged, mergedProperties, input);
+}
+function seedRequiredProperties(schema, fallbackProperties, input) {
+    const properties = readSchemaProperties(schema);
+    for (const name of readSchemaRequired(schema)) {
+        if (!(name in input)) {
+            input[name] = exampleValue(properties[name] ?? fallbackProperties[name]);
+        }
+    }
+}
+function isSchemaObject(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+/**
+ * Unwrap one `anyOf`/`oneOf` branch while keeping the wrapper's own keywords, so
+ * a branch that only adds `required`/`properties` inherits the parent type. Same
+ * named properties are merged so the branch adds constraints instead of
+ * replacing the parent's (`format` plus `minLength`, for example). The
+ * consumed parent combinator is dropped; sibling and branch combinators remain.
+ */
+function mergeBranch(schema, branch, keyword) {
+    const parent = { ...schema };
+    delete parent[keyword];
+    return mergeExampleSchemas(parent, branch);
+}
+/** Merge the property and item refinements used by catalog branches. */
+function mergeExampleSchemas(parent, branch) {
+    const merged = { ...parent, ...branch };
+    if (parent.properties && branch.properties) {
+        const properties = { ...readSchemaProperties(parent) };
+        for (const [name, property] of Object.entries(readSchemaProperties(branch))) {
+            properties[name] = properties[name] ? mergeExampleSchemas(properties[name], property) : property;
+        }
+        merged.properties = properties;
+    }
+    if (isSchemaObject(parent.items) && isSchemaObject(branch.items)) {
+        merged.items = mergeExampleSchemas(parent.items, branch.items);
+    }
+    if (parent.required || branch.required) {
+        merged.required = [...new Set([...readSchemaRequired(parent), ...readSchemaRequired(branch)])];
+    }
+    return merged;
+}
+function exampleValue(schema) {
+    if (!schema) {
+        return "";
+    }
+    if (schema.default !== undefined && new Validator(schema, "2020-12").validate(schema.default).valid) {
+        return schema.default;
+    }
+    if (schema.const !== undefined) {
+        return schema.const;
+    }
+    if (Array.isArray(schema.enum) && schema.enum.length > 0) {
+        if (schema.minimum !== undefined || schema.maximum !== undefined) {
+            const validator = new Validator(schema, "2020-12");
+            return schema.enum.find((value) => validator.validate(value).valid) ?? schema.enum[0];
+        }
+        return schema.enum[0];
+    }
+    if (schema.type === "object") {
+        return buildExampleInput(schema);
+    }
+    const branch = firstActionableBranch(schema);
+    if (branch) {
+        return branch.type === "object" ? buildExampleInput(schema) : exampleValue(branch);
+    }
+    const type = Array.isArray(schema.type) ? schema.type.find((entry) => entry !== "null") : schema.type;
+    if (type === undefined || type === "null") {
+        return type === "null" ? null : stringExample(schema);
+    }
+    if (type === "integer" || type === "number") {
+        return numberExample(schema);
+    }
+    if (type === "boolean") {
+        return false;
+    }
+    if (type === "array") {
+        return arrayExample(schema);
+    }
+    if (type === "object") {
+        return buildExampleInput(schema);
+    }
+    return stringExample(schema);
+}
+/** Unwrap `anyOf`/`oneOf` wrappers such as nullable fields, choosing the first non-null branch. */
+function firstActionableBranch(schema) {
+    const keyword = Array.isArray(schema.anyOf) ? "anyOf" : "oneOf";
+    const branches = schema[keyword];
+    if (!Array.isArray(branches)) {
+        return undefined;
+    }
+    for (const branch of branches) {
+        if (isSchemaObject(branch) && branch.type !== "null" && !conflictsWithParent(schema, branch)) {
+            return mergeBranch(schema, branch, keyword);
+        }
+    }
+    return mergeBranch(schema, { type: "null" }, keyword);
+}
+/**
+ * A branch that pins a property the parent already pins with `const` to another
+ * value can never match; a discriminated `oneOf` relies on this.
+ */
+function conflictsWithParent(schema, branch) {
+    const parentProperties = readSchemaProperties(schema);
+    for (const [name, branchProperty] of Object.entries(readSchemaProperties(branch))) {
+        const parentProperty = parentProperties[name];
+        if (isSchemaObject(branchProperty) &&
+            isSchemaObject(parentProperty) &&
+            branchProperty.const !== undefined &&
+            parentProperty.const !== undefined &&
+            branchProperty.const !== parentProperty.const) {
+            return true;
+        }
+    }
+    return false;
+}
+function stringExample(schema) {
+    const minLength = typeof schema.minLength === "number" && schema.minLength > 0 ? schema.minLength : 0;
+    const maxLength = typeof schema.maxLength === "number" ? schema.maxLength : undefined;
+    if (typeof schema.format === "string") {
+        return formatStringExample(schema.format, minLength, maxLength);
+    }
+    if (typeof schema.pattern === "string") {
+        const sample = samplePattern(schema.pattern, { minLength });
+        if (sample !== undefined) {
+            return sample;
+        }
+    }
+    if (minLength === 0 && typeof schema.pattern !== "string") {
+        return "";
+    }
+    const length = Math.min(Math.max(1, minLength || 1), maxLength ?? Number.POSITIVE_INFINITY);
+    return length <= 0 ? "" : "a".repeat(Math.min(length, Math.max(64, minLength)));
+}
+/**
+ * A fixed format sample may be shorter than `minLength`; extend the formats that
+ * accept arbitrary length (email local part, URI path, hostname label) so the
+ * example still satisfies the schema's own bounds.
+ */
+function formatStringExample(format, minLength, maxLength) {
+    const sample = exampleStringFormats[format] ?? "string";
+    const target = Math.max(minLength, sample.length);
+    if (target === sample.length || (maxLength !== undefined && target > maxLength)) {
+        // Bounds that exclude every length the sample can take leave no better value.
+        return sample;
+    }
+    if (format === "email") {
+        const domain = "@example.com";
+        return `${"a".repeat(Math.max(1, target - domain.length))}${domain}`;
+    }
+    if (format === "uri" || format === "url") {
+        return `${sample}/${"a".repeat(target - sample.length - 1)}`;
+    }
+    if (format === "hostname") {
+        return hostnameExample(target);
+    }
+    return sample;
+}
+/** DNS labels are limited to 63 characters; spread the target length across dot-separated labels. */
+function hostnameExample(length) {
+    if (length <= 63) {
+        return "a".repeat(Math.max(1, length));
+    }
+    const labelCount = Math.ceil((length + 1) / 64);
+    let remaining = length - (labelCount - 1);
+    const labels = [];
+    for (let index = 0; index < labelCount; index += 1) {
+        const labelLength = Math.min(63, remaining - (labelCount - 1 - index));
+        labels.push("a".repeat(Math.max(1, labelLength)));
+        remaining -= labelLength;
+    }
+    return labels.join(".");
+}
+function numberExample(schema) {
+    const integer = schema.type === "integer";
+    const minimum = typeof schema.minimum === "number" ? schema.minimum : undefined;
+    const maximum = typeof schema.maximum === "number" ? schema.maximum : undefined;
+    const exclusiveMinimum = typeof schema.exclusiveMinimum === "number" ? schema.exclusiveMinimum : undefined;
+    const exclusiveMaximum = typeof schema.exclusiveMaximum === "number" ? schema.exclusiveMaximum : undefined;
+    let candidate = 1;
+    if (minimum !== undefined) {
+        candidate = Math.max(candidate, minimum);
+    }
+    if (exclusiveMinimum !== undefined) {
+        candidate = Math.max(candidate, integer ? Math.floor(exclusiveMinimum) + 1 : exclusiveMinimum + 1);
+    }
+    if (maximum !== undefined && candidate > maximum) {
+        candidate = maximum;
+    }
+    if (exclusiveMaximum !== undefined && candidate >= exclusiveMaximum) {
+        candidate = integer ? Math.ceil(exclusiveMaximum) - 1 : exclusiveMaximum - 1;
+    }
+    if (exclusiveMinimum !== undefined &&
+        exclusiveMaximum !== undefined &&
+        candidate <= exclusiveMinimum &&
+        Number.isFinite(exclusiveMinimum) &&
+        Number.isFinite(exclusiveMaximum)) {
+        // Both exclusive bounds push the candidate outside the interval; a value
+        // between them is the only one that can satisfy both.
+        candidate = (exclusiveMinimum + exclusiveMaximum) / 2;
+    }
+    return integer ? Math.floor(candidate) : candidate;
+}
+function arrayExample(schema) {
+    const minItems = typeof schema.minItems === "number" && schema.minItems > 0 ? schema.minItems : 0;
+    const itemSchema = Array.isArray(schema.items) ? undefined : schema.items;
+    const values = Array.isArray(schema.prefixItems)
+        ? schema.prefixItems.map((item) => exampleValue(item))
+        : [];
+    while (values.length < minItems) {
+        values.push(exampleValue(itemSchema));
+    }
+    const distinct = new Set(values.map((value) => JSON.stringify(value))).size === values.length;
+    if (schema.uniqueItems === true && values.length > 1 && !distinct) {
+        if (itemSchema?.type === "string") {
+            const minLength = typeof itemSchema.minLength === "number" && itemSchema.minLength > 0 ? itemSchema.minLength : 1;
+            const maxLength = typeof itemSchema.maxLength === "number" ? itemSchema.maxLength : undefined;
+            const length = Math.max(1, Math.min(minLength, maxLength ?? Number.POSITIVE_INFINITY));
+            return values.map((_, index) => String.fromCharCode(97 + index).repeat(length));
+        }
+        if (itemSchema?.type === "integer" || itemSchema?.type === "number") {
+            const first = numberExample(itemSchema);
+            return values.map((_, index) => numberExample({ ...itemSchema, minimum: first + index }));
+        }
+    }
+    return values;
+}

package/src/server/api/action-markdown.js

@@ -3,6 +3,7 @@ import { gfmFromMarkdown, gfmToMarkdown } from "mdast-util-gfm";
 import { toMarkdown } from "mdast-util-to-markdown";
 import { gfm } from "micromark-extension-gfm";
 import { describeSchemaType, readSchemaProperties, readSchemaRequired } from "../../core/json-schema.js";
+import { buildExampleInput } from "./action-example.js";
 /**
  * Render a compact action guide for coding agents and humans who want the raw
  * execution contract without browsing the full catalog JSON.
@@ -225,41 +226,6 @@ function isDocumentContent(node) {
 function isBlockContent(node) {
     return node.type !== "definition" && node.type !== "footnoteDefinition";
 }
-function buildExampleInput(schema) {
-    const properties = readSchemaProperties(schema);
-    const input = {};
-    for (const name of readSchemaRequired(schema)) {
-        input[name] = exampleValue(properties[name]);
-    }
-    return input;
-}
 function readDescription(schema) {
     return schema && typeof schema.description === "string" ? schema.description : "";
 }
-function exampleValue(schema) {
-    if (!schema) {
-        return "";
-    }
-    if (schema.default !== undefined) {
-        return schema.default;
-    }
-    if (schema.const !== undefined) {
-        return schema.const;
-    }
-    if (Array.isArray(schema.enum)) {
-        return schema.enum[0];
-    }
-    if (schema.type === "integer" || schema.type === "number") {
-        return 1;
-    }
-    if (schema.type === "boolean") {
-        return false;
-    }
-    if (schema.type === "array") {
-        return [];
-    }
-    if (schema.type === "object") {
-        return {};
-    }
-    return "";
-}

package/src/server/api/auth.d.ts

@@ -15,6 +15,7 @@ export interface LocalAuthSession {
     adminAuthConfigured: boolean;
     authenticated: boolean;
 }
+export declare function hasAdminBearer(context: Context): boolean;
 export declare function readRuntimeGrant(context: Context): RuntimeGrant | undefined;
 export declare function createLocalAuthMiddleware(options: LocalAuthOptions): MiddlewareHandler;
 export declare function readLocalAuthSession(context: Context, options: LocalAuthOptions): Promise<LocalAuthSession>;

package/src/server/api/auth.js

@@ -7,6 +7,10 @@ const authCookieName = "oomol_connect_admin_session";
 const authCookieVersion = "v1";
 const authCookieMaxAgeSeconds = 2_592_000;
 const authCookieMaxAgeMs = authCookieMaxAgeSeconds * 1000;
+const adminBearerRequests = new WeakSet();
+export function hasAdminBearer(context) {
+    return adminBearerRequests.has(context.req.raw);
+}
 const runtimeGrants = new WeakMap();
 export function readRuntimeGrant(context) {
     return runtimeGrants.get(context.req.raw);
@@ -40,6 +44,8 @@ export function createLocalAuthMiddleware(options) {
                 message: "Configure an admin token to manage connections.",
             });
         }
+        if (adminToken && matchesConfiguredToken(context, adminToken))
+            adminBearerRequests.add(context.req.raw);
         if (await hasValidToken(context, options, scope)) {
             if (scope === "admin") {
                 await installAdminCookieForBearer(context, options);
@@ -64,6 +70,13 @@ export function createLocalAuthMiddleware(options) {
                 message: "A valid administrator bearer token is required.",
             });
         }
+        if (context.req.path.startsWith("/v1/")) {
+            return writeRuntimeFailure(context, {
+                status: 401,
+                errorCode: "unauthorized",
+                message: "A valid local bearer token is required.",
+            });
+        }
         return jsonError(context, 401, "unauthorized", "A valid local bearer token is required.");
     };
 }
@@ -82,6 +95,7 @@ async function installLocalAuthCookie(context, options) {
 }
 function isPublicPath(path, method) {
     return (path === "/health" ||
+        (method === "GET" && path === "/oauth/saas/complete") ||
         path === "/oauth/callback" ||
         path.startsWith("/oauth/callback/") ||
         (method === "GET" && path === "/api/auth/session") ||
@@ -137,7 +151,9 @@ async function hasValidToken(context, options, scope) {
     return scope === "runtime" ? await hasValidRuntimeToken(context, options) : false;
 }
 async function hasRequestToken(context, token) {
-    return matchesConfiguredToken(context, token) || (await hasValidAuthCookie(context, token));
+    if (context.req.header("authorization") !== undefined)
+        return matchesConfiguredToken(context, token);
+    return await hasValidAuthCookie(context, token);
 }
 async function hasValidAuthCookie(context, token) {
     const cookie = getCookie(context, authCookieName);
@@ -239,5 +255,7 @@ function isConnectionManagementPath(path) {
     return (/^\/v1\/providers\/[^/]+\/setup$/.test(path) ||
         path === "/v1/connections" ||
         path.startsWith("/v1/connections/") ||
-        path.startsWith("/v1/connection-requests/"));
+        path.startsWith("/v1/connection-requests/") ||
+        path === "/api/oauth/connection-requests" ||
+        path.startsWith("/api/oauth/connection-requests/"));
 }

package/src/server/api/cache-policy.js

@@ -8,7 +8,10 @@ export function getResponseCachePolicy(method, path, status) {
             vary: "Authorization, Cookie, Accept-Encoding",
         };
     }
-    if (path.startsWith("/v1/connection-requests/"))
+    if (path.startsWith("/v1/connection-requests/") ||
+        path === "/api/oauth/connection-requests" ||
+        path.startsWith("/api/oauth/connection-requests/") ||
+        path === "/oauth/saas/complete")
         return { cacheControl: "private, no-store" };
     if (isRuntimeResponsePath(path)) {
         return { cacheControl: "no-store" };
@@ -19,13 +22,12 @@ function isCatalogResponse(method, path) {
     if (method !== "GET" && method !== "HEAD") {
         return false;
     }
+    // Runtime catalogs depend on mutable configuration and access policy.
+    // Only static catalogs can use the shared edge cache.
     return (path === "/api/providers" ||
         /^\/api\/providers\/[^/]+$/.test(path) ||
         path === "/api/actions" ||
-        (path !== "/api/actions/search" && /^\/api\/actions\/[^/]+$/.test(path)) ||
-        path === "/v1/providers" ||
-        path === "/v1/actions" ||
-        (path !== "/v1/actions/search" && /^\/v1\/actions\/[^/]+$/.test(path)));
+        (path !== "/api/actions/search" && /^\/api\/actions\/[^/]+$/.test(path)));
 }
 function isRuntimeResponsePath(path) {
     return (path === "/health" ||

package/src/server/api/connection-input.d.ts

@@ -1,6 +1,12 @@
 import type { OAuthConnectionRequestInput } from "../../oauth/oauth-flow-service.ts";
 import { z } from "zod";
-export declare const oauthConnectionInput: z.ZodType<Omit<OAuthConnectionRequestInput, "owner" | "service" | "target">>;
+export declare const oauthConnectionInput: z.ZodType<Omit<OAuthConnectionRequestInput, "owner" | "service" | "target" | "signal" | "connectionName">>;
+export declare const consoleOAuthConnectionInput: z.ZodType<{
+    service: string;
+    connectionName: string;
+    appId?: string;
+    authorizationOptionIds?: string[];
+}>;
 export declare const apiKeyConnectionInput: z.ZodType<{
     apiKey: string;
     extra?: Record<string, string>;

package/src/server/api/connection-input.js

@@ -1,10 +1,16 @@
 import { z } from "zod";
-export const oauthConnectionInput = z.object({
+export const oauthConnectionInput = z.strictObject({
     returnUri: z.string().optional(),
     authorizationOptionIds: z.array(z.string().trim().min(1)).optional(),
     extra: z.record(z.string(), z.unknown()).optional(),
     secretExtra: z.record(z.string(), z.string().trim().min(1)).optional(),
 });
+export const consoleOAuthConnectionInput = z.strictObject({
+    service: z.string().trim().min(1),
+    connectionName: z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/),
+    appId: z.string().min(1).optional(),
+    authorizationOptionIds: z.array(z.string().trim().min(1)).optional(),
+});
 export const apiKeyConnectionInput = z
     .object({
     apiKey: z.string(),

package/src/server/api/connection-routes.d.ts

@@ -1,10 +1,12 @@
 import type { ConnectionService } from "../../connection-service.ts";
 import type { OAuthFlowService } from "../../oauth/oauth-flow-service.ts";
+import type { SaasOAuthService } from "../../saas/saas-oauth-service.ts";
 import { Hono } from "hono";
 interface ConnectionRoutesOptions {
     connections: ConnectionService;
     oauthFlow: OAuthFlowService;
+    saasOAuth?: SaasOAuthService;
 }
 /** Personal connection management. Authentication runs in the parent app. */
-export declare function createConnectionRoutes({ connections, oauthFlow }: ConnectionRoutesOptions): Hono;
+export declare function createConnectionRoutes({ connections, oauthFlow, saasOAuth }: ConnectionRoutesOptions): Hono;
 export {};

package/src/server/api/connection-routes.js

@@ -2,14 +2,26 @@ import { Hono } from "hono";
 import { ConnectionError } from "../../connection-service.js";
 import { OAuthClientConfigError } from "../../oauth/oauth-client-config-service.js";
 import { OAuthFlowError } from "../../oauth/oauth-flow-service.js";
+import { SaasError } from "../../saas/saas-client.js";
+import { hasAdminBearer } from "./auth.js";
 import { readJsonBody, HttpRequestError } from "./http-utils.js";
 import { connectionManagementFailure, serializeManagedConnection, writeRuntimeSuccess, writeRuntimeFailure, } from "./runtime-api.js";
 /** Personal connection management. Authentication runs in the parent app. */
-export function createConnectionRoutes({ connections, oauthFlow }) {
+export function createConnectionRoutes({ connections, oauthFlow, saasOAuth }) {
     const app = new Hono();
     // The local runtime has one administrator principal, including its bearer and browser sessions.
     const owner = "local-admin";
     app.onError((error, context) => {
+        if (error instanceof SaasError) {
+            if (error.retryAfter)
+                context.header("Retry-After", error.retryAfter);
+            return writeRuntimeFailure(context, {
+                status: error.status,
+                errorCode: error.code,
+                message: error.message,
+                data: error.connectionRequestId ? { connectionRequestId: error.connectionRequestId } : undefined,
+            });
+        }
         if (error instanceof ConnectionError ||
             error instanceof OAuthFlowError ||
             error instanceof OAuthClientConfigError) {
@@ -27,7 +39,10 @@ export function createConnectionRoutes({ connections, oauthFlow }) {
         return writeRuntimeSuccess(context, serializeManagedConnection(await connections.getManagedConnection(context.req.param("appId"))));
     });
     app.get("/connection-requests/:connectionRequestId", async (context) => {
-        const request = await oauthFlow.getConnectionRequest(context.req.param("connectionRequestId"), owner);
+        const id = context.req.param("connectionRequestId");
+        const request = saasOAuth && hasAdminBearer(context)
+            ? await saasOAuth.sync(id, owner, context.req.raw.signal)
+            : await oauthFlow.getConnectionRequest(id, owner);
         if (!request)
             return writeRuntimeFailure(context, {
                 status: 404,
@@ -46,6 +61,7 @@ export function createConnectionRoutes({ connections, oauthFlow }) {
                 ...input,
                 service: target?.service ?? context.req.param("service"),
                 owner,
+                signal: context.req.raw.signal,
                 target,
             }));
         });
@@ -54,7 +70,9 @@ export function createConnectionRoutes({ connections, oauthFlow }) {
                 const { apiKeyConnectionInput, customConnectionInput } = await import("./connection-input.js");
                 const body = await readJsonBody(context);
                 const target = reconnect ? await connections.getStoredConnection(context.req.param("appId")) : undefined;
-                if (target && target.credential.authType !== (authType === "api-key" ? "api_key" : "custom_credential")) {
+                if (target &&
+                    (target.source === "saas" ||
+                        target.credential.authType !== (authType === "api-key" ? "api_key" : "custom_credential"))) {
                     throw new ConnectionError("unsupported_auth_type", "The connection uses a different credential type.");
                 }
                 const service = target?.service ?? context.req.param("service");