@oomol-lab/open-connector 1.7.0 → 1.9.0

package/src/server/connect-app.d.ts

@@ -1,5 +1,6 @@
 import type { CatalogStore } from "../catalog-store.ts";
 import type { ActionPolicyService } from "../core/action-policy.ts";
+import type { ProviderHttpDispatchOptions } from "../core/provider-http-dispatch.ts";
 import type { RuntimeLogger, TransitFileUpload } from "../core/types.ts";
 import type { IProviderLoader } from "../providers/provider-loader.ts";
 import type { RuntimeJwtVerifier } from "./api/runtime-jwt.ts";
@@ -7,13 +8,17 @@ import type { ITransitFileService } from "./files/transit-file-store.ts";
 import type { ISecretCodec } from "./secrets/secret-codec-core.ts";
 import type { RuntimeDatabase } from "./storage/runtime-database.ts";
 import type { Hono } from "hono";
+import { SaasCleanupService } from "../saas/saas-cleanup-service.ts";
+import { TriggerMaintenance } from "../triggers/maintenance.ts";
 export interface ConnectAppOptions {
     catalog: CatalogStore;
     providerLoader: IProviderLoader;
+    providerHttpDispatch?: ProviderHttpDispatchOptions;
     runtimeDatabase: RuntimeDatabase;
     transitFiles: ITransitFileService;
     uploadTransitFile?: (request: Request) => Promise<TransitFileUpload>;
     publicOrigin: string;
+    configuredOrigin?: string;
     secretCodec: ISecretCodec;
     adminToken?: string;
     runtimeToken?: string;
@@ -25,8 +30,11 @@ export interface ConnectAppOptions {
     computeRuntimeAuthConfigured?: boolean;
     compressApiResponses?: boolean;
     serveDocumentation?: boolean;
+    oauthCloseDelaySeconds?: number;
 }
 export interface ConnectApp {
+    saasCleanup: SaasCleanupService;
+    triggerMaintenance: TriggerMaintenance;
     app: Hono;
     runtimeAuthConfigured: boolean;
 }

package/src/server/connect-app.js

@@ -1,12 +1,34 @@
 import { ConnectionService } from "../connection-service.js";
+import { ActionPolicyService as ExecutionPolicyService } from "../core/action-policy.js";
 import { MarketplaceService } from "../marketplace/marketplace-service.js";
 import { OAuthClientConfigService } from "../oauth/oauth-client-config-service.js";
 import { OAuthCredentialRefreshService } from "../oauth/oauth-credential-refresh-service.js";
 import { OAuthFlowService } from "../oauth/oauth-flow-service.js";
+import { SaasCleanupService } from "../saas/saas-cleanup-service.js";
+import { SaasClient } from "../saas/saas-client.js";
+import { SaasExecutionService } from "../saas/saas-execution-service.js";
+import { SaasOAuthService } from "../saas/saas-oauth-service.js";
+import { SaasProjectService } from "../saas/saas-project-service.js";
+import { TriggerMaintenance } from "../triggers/maintenance.js";
+import { TriggerRunner } from "../triggers/trigger-runner.js";
 import { ActionRunner } from "./actions/action-runner.js";
 import { ConnectServer } from "./connect-server.js";
 import { RuntimeTokenService } from "./storage/runtime-token-service.js";
 export async function createConnectApp(options) {
+    const saasClient = new SaasClient();
+    const saasProject = new SaasProjectService({
+        catalog: options.catalog,
+        store: options.runtimeDatabase.saasProjectStore,
+        secretCodec: options.secretCodec,
+        configuredOrigin: options.configuredOrigin,
+        client: saasClient,
+    });
+    const saasOAuth = new SaasOAuthService({
+        projects: saasProject,
+        requests: options.runtimeDatabase.connectionRequestStore,
+        client: saasClient,
+    });
+    const saas = new SaasExecutionService({ projects: saasProject, client: saasClient });
     const marketplace = new MarketplaceService({
         catalog: options.catalog,
         store: options.runtimeDatabase.marketplaceStore,
@@ -24,6 +46,7 @@ export async function createConnectApp(options) {
         isCustomClientConfigAvailable: (service) => options.secretCodec.encrypted && isCustomClientConfigAllowed(service),
     });
     const connections = new ConnectionService({
+        providerHttpDispatch: options.providerHttpDispatch,
         catalog: options.catalog,
         oauthCredentials: new OAuthCredentialRefreshService(oauthClientConfigs, options.providerLoader),
         providerLoader: options.providerLoader,
@@ -32,16 +55,41 @@ export async function createConnectApp(options) {
         marketplace,
     });
     const actions = new ActionRunner({
+        providerHttpDispatch: options.providerHttpDispatch,
         catalog: options.catalog,
         providerLoader: options.providerLoader,
         connections,
         runs: options.runtimeDatabase.runLogStore,
+        saas,
         transitFiles: options.transitFiles,
         logger: options.logger,
         marketplace,
     });
+    const triggers = new TriggerRunner({
+        providerHttpDispatch: options.providerHttpDispatch,
+        catalog: options.catalog,
+        providerLoader: options.providerLoader,
+        connections,
+        store: options.runtimeDatabase.triggerStore,
+    });
+    const triggerMaintenance = new TriggerMaintenance({
+        store: options.runtimeDatabase.triggerStore,
+        runner: triggers,
+        tokens: options.runtimeDatabase.runtimeTokenStore,
+        runtimePolicy: options.runtimeDatabase.runtimePolicyStore,
+        deploymentPolicy: options.actionPolicy ?? new ExecutionPolicyService(),
+        logger: options.logger,
+    });
     return {
+        triggerMaintenance,
+        saasCleanup: new SaasCleanupService({
+            store: options.runtimeDatabase.saasProjectStore,
+            requests: options.runtimeDatabase.connectionRequestStore,
+            client: saasClient,
+            logger: options.logger,
+        }),
         app: new ConnectServer({
+            providerHttpDispatch: options.providerHttpDispatch,
             catalog: options.catalog,
             publicOrigin: options.publicOrigin,
             providerLoader: options.providerLoader,
@@ -55,8 +103,11 @@ export async function createConnectApp(options) {
                 requests: options.runtimeDatabase.connectionRequestStore,
                 secretCodec: options.secretCodec,
                 isCustomClientConfigAllowed,
+                saasOAuth,
             }),
             actions,
+            triggers,
+            triggerMaintenance,
             idempotency: options.runtimeDatabase.idempotencyStore,
             transitFiles: options.transitFiles,
             uploadTransitFile: options.uploadTransitFile,
@@ -73,8 +124,12 @@ export async function createConnectApp(options) {
             actionPolicy: options.actionPolicy,
             logger: options.logger,
             marketplace,
+            saas,
+            saasProject,
+            saasOAuth,
             compressApiResponses: options.compressApiResponses,
             serveDocumentation: options.serveDocumentation,
+            oauthCloseDelaySeconds: options.oauthCloseDelaySeconds,
         }).createApp(),
         runtimeAuthConfigured: Boolean(options.runtimeToken) ||
             Boolean(options.verifyRuntimeJwt) ||

package/src/server/connect-server.d.ts

@@ -1,9 +1,15 @@
 import type { CatalogStore } from "../catalog-store.ts";
 import type { ConnectionService } from "../connection-service.ts";
 import type { ActionSearchIndexProvider } from "../core/action-search.ts";
+import type { ProviderHttpDispatchOptions } from "../core/provider-http-dispatch.ts";
 import type { RuntimeLogger, TransitFileUpload } from "../core/types.ts";
 import type { MarketplaceService } from "../marketplace/marketplace-service.ts";
 import type { IProviderLoader } from "../providers/provider-loader.ts";
+import type { SaasExecutionService } from "../saas/saas-execution-service.ts";
+import type { SaasOAuthService } from "../saas/saas-oauth-service.ts";
+import type { SaasProjectService } from "../saas/saas-project-service.ts";
+import type { TriggerMaintenance } from "../triggers/maintenance.ts";
+import type { TriggerRunner } from "../triggers/trigger-runner.ts";
 import type { LocalAuthOptions } from "./api/auth.ts";
 import type { ITransitFileService } from "./files/transit-file-store.ts";
 import type { IIdempotencyStore } from "./storage/idempotency-store.ts";
@@ -24,6 +30,7 @@ export declare function preloadOptionalServerModules(): Promise<void>;
  * Dependencies required to construct the local connector server.
  */
 export interface IConnectServerOptions {
+    providerHttpDispatch?: ProviderHttpDispatchOptions;
     catalog: CatalogStore;
     /** Public origin of this runtime, used for the HTTP request examples in Action guides. */
     publicOrigin: string;
@@ -33,6 +40,8 @@ export interface IConnectServerOptions {
     oauthFlow: OAuthFlowService;
     runtimeTokens: RuntimeTokenService;
     actions: ActionRunner;
+    triggers?: TriggerRunner;
+    triggerMaintenance?: TriggerMaintenance;
     idempotency: IIdempotencyStore;
     transitFiles: ITransitFileService;
     uploadTransitFile?: (request: Request) => Promise<TransitFileUpload>;
@@ -44,7 +53,12 @@ export interface IConnectServerOptions {
     logger?: RuntimeLogger;
     compressApiResponses?: boolean;
     serveDocumentation?: boolean;
+    /** Seconds the OAuth completion page waits before closing its window. `0` closes it as soon as it loads. */
+    oauthCloseDelaySeconds?: number;
     marketplace?: MarketplaceService;
+    saasProject?: SaasProjectService;
+    saas?: SaasExecutionService;
+    saasOAuth?: SaasOAuthService;
 }
 /**
  * Local single-user HTTP server for catalog browsing, credential management,
@@ -60,6 +74,8 @@ export declare class ConnectServer {
     createApp(): Hono;
     private listProviderSummaries;
     private configureMarketplace;
+    private getMarketplaceDiscovery;
+    private writeMarketplaceError;
     private deleteMarketplace;
     private updateProviderPreference;
     private getRuntimeProviderSetup;
@@ -78,6 +94,8 @@ export declare class ConnectServer {
     private searchRuntimeActions;
     private serializeSearchResults;
     private getRuntimeAction;
+    private getRuntimeTriggerPermissions;
+    private executeRuntimeTrigger;
     private createRuntimeActionRun;
     private executeRuntimeAction;
     private createRuntimeProxyRequest;

package/src/server/connect-server.js

@@ -3,11 +3,14 @@ import { compress } from "hono/compress";
 import { ConnectionError, defaultConnectionName } from "../connection-service.js";
 import { ActionPolicyService, emptyPolicyRules } from "../core/action-policy.js";
 import { DEFAULT_ACTION_SEARCH_LIMIT, createActionSearchIndexProvider, searchActions } from "../core/action-search.js";
-import { optionalRecord, optionalString, requiredRawString, requiredString, requiredStringArray, } from "../core/cast.js";
+import { optionalBoolean, optionalRecord, optionalString, requiredRawString, requiredString, requiredStringArray, } from "../core/cast.js";
 import { PromiseCache } from "../core/promise-cache.js";
+import { withProviderHttpDispatch } from "../core/provider-http-dispatch.js";
 import { MarketplaceError } from "../marketplace/marketplace-service.js";
 import { OAuthClientConfigError, OAuthClientConfigService } from "../oauth/oauth-client-config-service.js";
 import { OAuthCallbackError, OAuthFlowError, OAuthFlowService } from "../oauth/oauth-flow-service.js";
+import { ProviderDispatchRequestError, toProviderExecutionError } from "../providers/provider-runtime.js";
+import { SaasError } from "../saas/saas-client.js";
 import { ActionInputDepthError, createIdempotencyExpiry, hashActionRequest, hashIdempotencyKey, readIdempotencyKey, } from "./actions/action-idempotency.js";
 import { ActionRunner } from "./actions/action-runner.js";
 import { renderActionMarkdown } from "./api/action-markdown.js";
@@ -17,7 +20,9 @@ import { createConnectionRoutes } from "./api/connection-routes.js";
 import { HttpRequestError, internalError, jsonError, notFound, readJsonBody } from "./api/http-utils.js";
 import { renderOAuthCompletionPage } from "./api/oauth-completion-page.js";
 import { policyRequestMaxBytes, readRuntimePolicyRules, readTokenPolicy } from "./api/policy-input.js";
+import { serializeRuntimeTriggerPermissions } from "./api/runtime-api.js";
 import { mapConnectionErrorStatus, serializeRuntimeAction, serializeRuntimeActionResult, serializeRuntimeActionService, serializeRuntimeConnectedApp, serializeRuntimeFailure, serializeRuntimeProvider, serializeRuntimeProviderSetup, unknownActionFailure, unknownServiceFailure, writeRuntimeActionHttpResult, writeRuntimeFailure, writeRuntimeSuccess, } from "./api/runtime-api.js";
+import { renderSaasCompletionPage } from "./api/saas-completion-page.js";
 import { TransitFileError } from "./files/transit-file-store.js";
 import { ProxyRunner } from "./proxy/proxy-runner.js";
 import { decodeRunLogCursor } from "./storage/runtime-store.js";
@@ -74,15 +79,20 @@ export class ConnectServer {
         this.actionSearch = options.actionSearch ?? createActionSearchIndexProvider(options.catalog.actions);
         this.actionPolicy = options.actionPolicy ?? new ActionPolicyService();
         this.proxyRunner = new ProxyRunner({
+            providerHttpDispatch: options.providerHttpDispatch,
             catalog: options.catalog,
             providerLoader: options.providerLoader,
             connections: options.connections,
             logger: options.logger,
+            saas: options.saas,
         });
     }
     createApp() {
         const app = new Hono();
         const auth = this.options.auth ?? {};
+        app.use("*", async (_context, next) => {
+            await withProviderHttpDispatch({ operation: "runtime" }, next, this.options.providerHttpDispatch);
+        });
         app.use("*", async (context, next) => {
             await next();
             const cachePolicy = getResponseCachePolicy(context.req.method, context.req.path, context.res.status);
@@ -107,6 +117,7 @@ export class ConnectServer {
         app.use("*", createLocalAuthMiddleware(auth));
         if (this.options.marketplace) {
             app.get("/api/marketplace", (context) => context.json(this.options.marketplace.getState()));
+            app.get("/api/marketplace/discovery", (context) => this.getMarketplaceDiscovery(context));
             app.put("/api/marketplace", (context) => this.configureMarketplace(context));
             app.patch("/api/marketplace", (context) => this.configureMarketplace(context));
             app.delete("/api/marketplace", (context) => this.deleteMarketplace(context));
@@ -115,6 +126,21 @@ export class ConnectServer {
         }
         app.get("/v1/health", (context) => writeRuntimeSuccess(context, { ok: true, runtime: "oomol-connect" }));
         app.get("/v1/providers/:service/setup", (context) => this.getRuntimeProviderSetup(context, context.req.param("service")));
+        app.get("/v1/providers/:service/trigger-permissions", (context) => this.getRuntimeTriggerPermissions(context, context.req.param("service")));
+        app.post("/v1/providers/:service/triggers/:triggerId/execute", (context) => this.executeRuntimeTrigger(context));
+        app.get("/api/trigger-subscriptions", async (context) => context.json((await this.options.triggerMaintenance?.list()) ?? []));
+        app.post("/api/trigger-subscriptions/:id/cancel", async (context) => {
+            if (!this.options.triggerMaintenance)
+                throw new HttpRequestError("trigger_not_supported", "Trigger subscriptions are unavailable.", 501);
+            await this.options.triggerMaintenance.cancel(context.req.param("id"), context.req.raw.signal);
+            return context.json({ ok: true });
+        });
+        app.post("/api/trigger-subscriptions/:id/abandon", async (context) => {
+            if (!this.options.triggerMaintenance)
+                throw new HttpRequestError("trigger_not_supported", "Trigger subscriptions are unavailable.", 501);
+            await this.options.triggerMaintenance.abandon(context.req.param("id"), context.req.raw.signal);
+            return context.json({ ok: true });
+        });
         app.get("/v1/providers", (context) => this.listRuntimeProviders(context));
         app.get("/v1/actions", (context) => this.listRuntimeActions(context));
         app.get("/v1/actions/search", (context) => this.searchRuntimeActions(context));
@@ -166,9 +192,66 @@ export class ConnectServer {
         app.delete("/api/runtime-tokens/:id", (context) => this.revokeRuntimeToken(context, context.req.param("id")));
         app.get("/api/runtime-policy", (context) => this.getRuntimePolicy(context));
         app.put("/api/runtime-policy", (context) => this.updateRuntimePolicy(context));
+        const saas = this.options.saasProject;
+        if (saas) {
+            app.get("/api/oauth/managed-project", async (context) => context.json(await saas.getState(context.req.raw.signal)));
+            app.put("/api/oauth/managed-project", async (context) => context.json(await saas.configure(await readJsonBody(context, 16_384), context.req.raw.signal)));
+            app.delete("/api/oauth/managed-project", async (context) => {
+                await saas.remove();
+                return context.json(await saas.getState(context.req.raw.signal));
+            });
+            app.get("/api/oauth/managed-project/provider-configs", async (context) => context.json(await saas.listProviderConfigs(context.req.raw.signal)));
+            app.get("/api/oauth/sources/:service", async (context) => context.json(await saas.getSource(context.req.param("service"))));
+            app.put("/api/oauth/sources/:service", async (context) => context.json(await saas.setSource(context.req.param("service"), await readJsonBody(context, 16_384), context.req.raw.signal)));
+        }
+        if (saas && this.options.saasOAuth) {
+            app.get("/oauth/saas/complete", (context) => {
+                context.header("Content-Security-Policy", "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'");
+                context.header("Referrer-Policy", "no-referrer");
+                return context.html(renderSaasCompletionPage());
+            });
+            app.post("/api/oauth/connection-requests/:id/sync", async (context) => {
+                const expectedOrigin = saas.requireOrigin();
+                if (context.req.header("origin") !== expectedOrigin)
+                    throw new SaasError("oauth_source_origin_mismatch", `Open Console at ${expectedOrigin}, or set OOMOL_CONNECT_ORIGIN to the exact Console address in your browser and restart Connect. localhost and 127.0.0.1 are different origins.`, 403);
+                if (context.req.header("x-openconnector-request") !== "sync" ||
+                    context.req.header("content-type")?.split(";")[0].trim().toLowerCase() !== "application/json")
+                    return context.json({ error: { code: "forbidden", message: "OAuth synchronization requires a same-origin JSON request." } }, 403);
+                const result = await this.options.saasOAuth.syncForBrowser(context.req.param("id"), "local-admin", context.req.raw.signal);
+                if (!result)
+                    return jsonError(context, 404, "connection_request_not_found", "Connection request not found.");
+                context.header("Cache-Control", "private, no-store");
+                return context.json(result);
+            });
+        }
         app.get("/api/oauth/configs", (context) => this.listOAuthConfigs(context));
         app.put("/api/oauth/configs/:service", (context) => this.upsertOAuthConfig(context, context.req.param("service")));
         app.delete("/api/oauth/configs/:service", (context) => this.deleteOAuthConfig(context, context.req.param("service")));
+        app.post("/api/oauth/connection-requests", async (context) => {
+            try {
+                const { consoleOAuthConnectionInput } = await import("./api/connection-input.js");
+                const parsed = consoleOAuthConnectionInput.safeParse(await readJsonBody(context));
+                if (!parsed.success)
+                    return jsonError(context, 400, "invalid_input", "Invalid OAuth connection request.");
+                const { appId, ...input } = parsed.data;
+                const target = appId ? await this.options.connections.getStoredConnection(appId) : undefined;
+                if (target && (target.service !== input.service || target.connectionName !== input.connectionName))
+                    return jsonError(context, 400, "invalid_input", "The selected connection no longer matches.");
+                return context.json(await this.options.oauthFlow.startConnectionRequest({
+                    ...input,
+                    target,
+                    owner: "local-admin",
+                    signal: context.req.raw.signal,
+                }));
+            }
+            catch (error) {
+                if (error instanceof OAuthClientConfigError ||
+                    error instanceof OAuthFlowError ||
+                    error instanceof ConnectionError)
+                    return jsonError(context, error.code === "unknown_service" || error.code === "app_not_found" ? 404 : 400, error.code, error.message);
+                throw error;
+            }
+        });
         app.post("/api/oauth/authorizations", (context) => this.createOAuthAuthorization(context));
         app.get("/oauth/callback", (context) => this.completeOAuth(context));
         app.post("/mcp", (context) => this.handleMcp(context));
@@ -181,6 +264,33 @@ export class ConnectServer {
         else
             app.notFound(notFound);
         app.onError((error, context) => {
+            if (error instanceof ProviderDispatchRequestError) {
+                if (context.req.path.startsWith("/v1/"))
+                    return writeRuntimeFailure(context, {
+                        status: 429,
+                        errorCode: "rate_limited",
+                        message: error.message,
+                        data: toProviderExecutionError(error, error.message).error?.details,
+                    });
+                const seconds = optionalRecord(error.details)?.retryAfterSeconds;
+                if (typeof seconds === "number")
+                    context.header("Retry-After", String(seconds));
+                return jsonError(context, 429, "rate_limited", error.message);
+            }
+            if (error instanceof SaasError) {
+                this.options.logger?.warn({
+                    method: context.req.method,
+                    path: context.req.path,
+                    code: error.code,
+                    status: error.status,
+                    reason: error.message,
+                }, "SaaS request failed");
+                if (error.retryAfter)
+                    context.header("Retry-After", error.retryAfter);
+                if (context.req.path.startsWith("/v1/"))
+                    return writeRuntimeFailure(context, { status: error.status, errorCode: error.code, message: error.message });
+                return context.json({ error: { code: error.code, message: error.message, reason: error.reason } }, error.status);
+            }
             if (error instanceof HttpRequestError) {
                 if (context.req.path.startsWith("/v1/")) {
                     return writeRuntimeFailure(context, {
@@ -196,7 +306,7 @@ export class ConnectServer {
                 method: context.req.method,
                 path: context.req.path,
             }, "request failed");
-            if (context.req.path.startsWith("/v1/connections") || context.req.path.startsWith("/v1/connection-requests")) {
+            if (context.req.path.startsWith("/v1/")) {
                 return writeRuntimeFailure(context, {
                     status: 500,
                     errorCode: "internal_error",
@@ -226,12 +336,25 @@ export class ConnectServer {
             return context.json(await this.options.marketplace.configure(input));
         }
         catch (error) {
-            if (error instanceof MarketplaceError) {
-                return jsonError(context, error.status === 404 ? 404 : 400, error.code, error.message);
-            }
+            if (error instanceof MarketplaceError)
+                return this.writeMarketplaceError(context, error);
+            throw error;
+        }
+    }
+    async getMarketplaceDiscovery(context) {
+        try {
+            return context.json(await this.options.marketplace.getDefaultDiscovery(context.req.raw.signal));
+        }
+        catch (error) {
+            if (error instanceof MarketplaceError)
+                return this.writeMarketplaceError(context, error);
             throw error;
         }
     }
+    writeMarketplaceError(context, error) {
+        const status = error.status;
+        return jsonError(context, status === 401 || status === 403 || status === 404 || status === 502 || status === 504 ? status : 400, error.code, error.message);
+    }
     async deleteMarketplace(context) {
         await this.options.marketplace.remove();
         return context.json(this.options.marketplace.getState());
@@ -254,9 +377,20 @@ export class ConnectServer {
         const provider = this.options.catalog.providers.find((provider) => provider.service === service);
         if (!provider)
             return writeRuntimeFailure(context, unknownServiceFailure(service));
-        const oauth = provider.auth.some((auth) => auth.type === "oauth2")
+        let oauth = provider.auth.some((auth) => auth.type === "oauth2")
             ? await this.options.oauthClientConfigs.getSummary(service)
             : undefined;
+        const source = oauth ? await this.options.saasProject?.getSource(service) : undefined;
+        if (oauth && source?.mode === "saas") {
+            const { config } = await this.options.saasProject.resolveConfig(service, source.providerConfigId, source.managedProjectId, context.req.raw.signal);
+            oauth = {
+                ...oauth,
+                configured: true,
+                customClientAvailable: false,
+                expectedRedirectUri: config.callbackUrl,
+                missingFields: [],
+            };
+        }
         return writeRuntimeSuccess(context, serializeRuntimeProviderSetup(provider, oauth));
     }
     getProvider(context, service) {
@@ -353,11 +487,6 @@ export class ConnectServer {
         catch (error) {
             if (error instanceof ConnectionError) {
                 const status = mapConnectionErrorStatus(error);
-                // agent.md uses the admin JSON error envelope; mapConnectionErrorStatus may
-                // return 409 for OAuth refresh failures, which jsonError does not accept.
-                if (status === 409) {
-                    return context.json({ error: { code: error.code, message: error.message } }, 409);
-                }
                 return jsonError(context, status, error.code, error.message);
             }
             throw error;
@@ -428,6 +557,30 @@ export class ConnectServer {
         }
         return writeRuntimeSuccess(context, serializeRuntimeAction(action));
     }
+    async getRuntimeTriggerPermissions(context, service) {
+        const provider = this.options.catalog.providers.find((item) => item.service === service);
+        if (!provider)
+            throw new HttpRequestError("provider_not_found", "Provider not found.", 404);
+        return writeRuntimeSuccess(context, serializeRuntimeTriggerPermissions(provider));
+    }
+    async executeRuntimeTrigger(context) {
+        if (!this.options.triggers)
+            throw new HttpRequestError("trigger_not_supported", "Trigger execution is unavailable.", 501);
+        const { readTriggerRequest } = await import("../triggers/request.js");
+        const request = readTriggerRequest(await readJsonBody(context, 160 * 1024));
+        const signal = AbortSignal.any([context.req.raw.signal, AbortSignal.timeout(45_000)]);
+        const result = await this.options.triggers.run({
+            service: context.req.param("service"),
+            triggerId: context.req.param("triggerId"),
+            request,
+            connectionName: readConnectionName(context),
+            connectionId: optionalString(context.req.header("x-oo-connector-app-id")),
+            policy: await this.getPolicySnapshot(context),
+            grant: readRuntimeGrant(context),
+            signal,
+        });
+        return writeRuntimeSuccess(context, result);
+    }
     async createRuntimeActionRun(context, actionId) {
         const action = this.options.catalog.actionsById.get(actionId);
         if (!action) {
@@ -436,6 +589,7 @@ export class ConnectServer {
         const body = await readJsonBody(context);
         const input = body.input ?? {};
         const connectionName = readConnectionName(context, body);
+        const connectionId = optionalString(context.req.header("x-oo-connector-app-id"));
         const runtimeGrant = readRuntimeGrant(context);
         let policy;
         try {
@@ -450,7 +604,7 @@ export class ConnectServer {
             });
         }
         if (!policy.evaluate(action).allowed) {
-            return writeRuntimeActionHttpResult(context, await this.executeRuntimeAction(actionId, input, connectionName, policy, runtimeGrant, context.req.raw.signal));
+            return writeRuntimeActionHttpResult(context, await this.executeRuntimeAction(actionId, input, connectionName, policy, runtimeGrant, context.req.raw.signal, connectionId));
         }
         const idempotencyKey = readIdempotencyKey(context.req.header("idempotency-key"));
         if (!idempotencyKey.ok) {
@@ -462,7 +616,7 @@ export class ConnectServer {
             });
         }
         if (!idempotencyKey.key) {
-            return writeRuntimeActionHttpResult(context, await this.executeRuntimeAction(actionId, input, connectionName, policy, runtimeGrant, context.req.raw.signal));
+            return writeRuntimeActionHttpResult(context, await this.executeRuntimeAction(actionId, input, connectionName, policy, runtimeGrant, context.req.raw.signal, connectionId));
         }
         const now = new Date();
         const keyHash = hashIdempotencyKey(idempotencyKey.key);
@@ -471,6 +625,7 @@ export class ConnectServer {
             requestHash = hashActionRequest({
                 actionId,
                 connectionName: connectionName ?? defaultConnectionName,
+                connectionId,
                 input,
                 runtimeTokenId: runtimeGrant?.tokenId,
             });
@@ -513,7 +668,7 @@ export class ConnectServer {
         if (claim.kind === "completed") {
             return writeRuntimeActionHttpResult(context, claim.response);
         }
-        const result = await this.executeRuntimeAction(actionId, input, connectionName, policy, runtimeGrant, context.req.raw.signal);
+        const result = await this.executeRuntimeAction(actionId, input, connectionName, policy, runtimeGrant, context.req.raw.signal, connectionId);
         const completed = await this.options.idempotency.complete({
             keyHash,
             requestHash,
@@ -526,13 +681,14 @@ export class ConnectServer {
         }
         return writeRuntimeActionHttpResult(context, result);
     }
-    async executeRuntimeAction(actionId, input, connectionName, policy, runtimeGrant, signal) {
+    async executeRuntimeAction(actionId, input, connectionName, policy, runtimeGrant, signal, connectionId) {
         try {
             const run = await this.options.actions.run({
                 actionId,
                 input,
                 caller: "http",
                 connectionName,
+                connectionId,
                 policy,
                 runtimeTokenId: runtimeGrant?.tokenId,
                 signal,
@@ -543,6 +699,9 @@ export class ConnectServer {
             return serializeRuntimeActionResult({
                 actionId,
                 executionId: run.executionId,
+                remoteExecutionId: run.remoteExecutionId,
+                failureStatus: run.failureStatus,
+                retryAfter: run.retryAfter,
                 auditPersisted: run.auditPersisted,
                 result: run.result,
             });
@@ -591,11 +750,12 @@ export class ConnectServer {
             service,
             input: body,
             connectionName: readConnectionName(context, body),
+            connectionId: optionalString(context.req.header("x-oo-connector-app-id")),
             policy,
             signal: context.req.raw.signal,
         });
         if (result.ok) {
-            return writeRuntimeSuccess(context, result.response);
+            return writeRuntimeSuccess(context, result.response, result.meta);
         }
         return writeRuntimeFailure(context, {
             status: result.status,
@@ -749,7 +909,7 @@ export class ConnectServer {
             connectionName,
         };
         this.options.logger?.info(logContext, "connection disconnect started");
-        return this.writeConnectionResult(context, this.options.connections.disconnect(service, connectionName), logContext);
+        return this.writeConnectionResult(context, this.options.connections.disconnect(service, connectionName, { revoke: optionalBoolean(body.revoke) }), logContext);
     }
     async createOAuthAuthorization(context) {
         const body = await readJsonBody(context);
@@ -836,7 +996,13 @@ export class ConnectServer {
         });
     }
     async listOAuthConfigs(context) {
-        return context.json(await this.options.oauthClientConfigs.listConfigs());
+        const configs = await this.options.oauthClientConfigs.listConfigs();
+        const sources = await this.options.saasProject?.listSources();
+        return context.json(configs.map((config) => ({
+            ...config,
+            oauthSource: sources?.get(config.service) ?? { mode: "local" },
+            customClientAvailable: sources?.has(config.service) ? false : config.customClientAvailable,
+        })));
     }
     async upsertOAuthConfig(context, service) {
         const body = await readJsonBody(context);
@@ -889,10 +1055,12 @@ export class ConnectServer {
         }
         let service;
         try {
+            const callbackUrl = new URL(context.req.url);
             const completed = await this.options.oauthFlow.completeAuthorization({
                 state,
                 code,
-                callbackParameters: Object.fromEntries(new URL(context.req.url).searchParams),
+                callbackParameters: Object.fromEntries(callbackUrl.searchParams),
+                callbackQuery: callbackUrl.search,
                 signal: context.req.raw.signal,
             });
             service = completed.service;
@@ -916,7 +1084,7 @@ export class ConnectServer {
             }
             throw error;
         }
-        return context.html(renderOAuthCompletionPage(service));
+        return context.html(renderOAuthCompletionPage(service, this.options.oauthCloseDelaySeconds));
     }
     async writeConnectionResult(context, operation, logContext) {
         try {

package/src/server/connector-runtime.d.ts

@@ -1,4 +1,5 @@
 import type { ActionPolicyConfig } from "../core/action-policy.ts";
+import type { ProviderHttpDispatchOptions } from "../core/provider-http-dispatch.ts";
 import type { RuntimeLogger } from "../core/types.ts";
 import type { RuntimeJwtConfig } from "./api/runtime-jwt.ts";
 import type { S3TransitClientOptions } from "./files/s3-transit-files.ts";
@@ -44,6 +45,8 @@ export interface ConnectorRuntimeOptions {
     dataDir: string;
     /** External HTTP(S) URL, optionally including a mount path such as /connector. */
     publicOrigin: string;
+    /** False when the host supplied a development fallback instead of an explicit public origin. */
+    publicOriginConfigured?: boolean;
     /** Encrypts stored credentials, OAuth client configuration, pending OAuth state and replayed action responses. Omit to store them in plain text. */
     encryptionKey?: string;
     /** Bearer token required for management requests such as connections, OAuth clients and policies. Omit to leave them open. */
@@ -54,7 +57,9 @@ export interface ConnectorRuntimeOptions {
     jwt?: RuntimeJwtConfig;
     postgres?: ConnectorPostgresOptions;
     network?: ConnectorNetworkOptions;
-    /** Allow or block actions and proxies by name. */
+    /** Opt-in admission and result feedback for every provider HTTP transport attempt. */
+    providerHttpDispatch?: ProviderHttpDispatchOptions;
+    /** Allow or block actions, proxies and Triggers by name. */
     actionPolicy?: ActionPolicyConfig;
     /** Services, or `*`, whose connections may carry their own OAuth client instead of the configured one. */
     allowedCustomOAuth?: string[];
@@ -71,6 +76,8 @@ export interface ConnectorRuntimeOptions {
     logger?: RuntimeLogger;
     /** The standalone host opts into API-reference HTML. Authorization completion pages are always available. */
     apiReference?: boolean;
+    /** Seconds the OAuth completion page waits before closing its window. Defaults to 5; `0` closes it as soon as it loads. */
+    oauthCloseDelaySeconds?: number;
 }
 /** Standard web requests are the host boundary; credentials, databases and framework objects stay private. */
 export interface ConnectorRuntime {