@oomol-lab/open-connector 1.8.0 → 1.9.0

package/src/server/connect-server.js

@@ -3,11 +3,13 @@ import { compress } from "hono/compress";
 import { ConnectionError, defaultConnectionName } from "../connection-service.js";
 import { ActionPolicyService, emptyPolicyRules } from "../core/action-policy.js";
 import { DEFAULT_ACTION_SEARCH_LIMIT, createActionSearchIndexProvider, searchActions } from "../core/action-search.js";
-import { optionalRecord, optionalString, requiredRawString, requiredString, requiredStringArray, } from "../core/cast.js";
+import { optionalBoolean, optionalRecord, optionalString, requiredRawString, requiredString, requiredStringArray, } from "../core/cast.js";
 import { PromiseCache } from "../core/promise-cache.js";
+import { withProviderHttpDispatch } from "../core/provider-http-dispatch.js";
 import { MarketplaceError } from "../marketplace/marketplace-service.js";
 import { OAuthClientConfigError, OAuthClientConfigService } from "../oauth/oauth-client-config-service.js";
 import { OAuthCallbackError, OAuthFlowError, OAuthFlowService } from "../oauth/oauth-flow-service.js";
+import { ProviderDispatchRequestError, toProviderExecutionError } from "../providers/provider-runtime.js";
 import { SaasError } from "../saas/saas-client.js";
 import { ActionInputDepthError, createIdempotencyExpiry, hashActionRequest, hashIdempotencyKey, readIdempotencyKey, } from "./actions/action-idempotency.js";
 import { ActionRunner } from "./actions/action-runner.js";
@@ -77,6 +79,7 @@ export class ConnectServer {
         this.actionSearch = options.actionSearch ?? createActionSearchIndexProvider(options.catalog.actions);
         this.actionPolicy = options.actionPolicy ?? new ActionPolicyService();
         this.proxyRunner = new ProxyRunner({
+            providerHttpDispatch: options.providerHttpDispatch,
             catalog: options.catalog,
             providerLoader: options.providerLoader,
             connections: options.connections,
@@ -87,6 +90,9 @@ export class ConnectServer {
     createApp() {
         const app = new Hono();
         const auth = this.options.auth ?? {};
+        app.use("*", async (_context, next) => {
+            await withProviderHttpDispatch({ operation: "runtime" }, next, this.options.providerHttpDispatch);
+        });
         app.use("*", async (context, next) => {
             await next();
             const cachePolicy = getResponseCachePolicy(context.req.method, context.req.path, context.res.status);
@@ -111,6 +117,7 @@ export class ConnectServer {
         app.use("*", createLocalAuthMiddleware(auth));
         if (this.options.marketplace) {
             app.get("/api/marketplace", (context) => context.json(this.options.marketplace.getState()));
+            app.get("/api/marketplace/discovery", (context) => this.getMarketplaceDiscovery(context));
             app.put("/api/marketplace", (context) => this.configureMarketplace(context));
             app.patch("/api/marketplace", (context) => this.configureMarketplace(context));
             app.delete("/api/marketplace", (context) => this.deleteMarketplace(context));
@@ -257,6 +264,19 @@ export class ConnectServer {
         else
             app.notFound(notFound);
         app.onError((error, context) => {
+            if (error instanceof ProviderDispatchRequestError) {
+                if (context.req.path.startsWith("/v1/"))
+                    return writeRuntimeFailure(context, {
+                        status: 429,
+                        errorCode: "rate_limited",
+                        message: error.message,
+                        data: toProviderExecutionError(error, error.message).error?.details,
+                    });
+                const seconds = optionalRecord(error.details)?.retryAfterSeconds;
+                if (typeof seconds === "number")
+                    context.header("Retry-After", String(seconds));
+                return jsonError(context, 429, "rate_limited", error.message);
+            }
             if (error instanceof SaasError) {
                 this.options.logger?.warn({
                     method: context.req.method,
@@ -286,7 +306,7 @@ export class ConnectServer {
                 method: context.req.method,
                 path: context.req.path,
             }, "request failed");
-            if (context.req.path.startsWith("/v1/connections") || context.req.path.startsWith("/v1/connection-requests")) {
+            if (context.req.path.startsWith("/v1/")) {
                 return writeRuntimeFailure(context, {
                     status: 500,
                     errorCode: "internal_error",
@@ -316,13 +336,25 @@ export class ConnectServer {
             return context.json(await this.options.marketplace.configure(input));
         }
         catch (error) {
-            if (error instanceof MarketplaceError) {
-                const status = error.status;
-                return jsonError(context, status === 401 || status === 403 || status === 404 || status === 502 || status === 504 ? status : 400, error.code, error.message);
-            }
+            if (error instanceof MarketplaceError)
+                return this.writeMarketplaceError(context, error);
             throw error;
         }
     }
+    async getMarketplaceDiscovery(context) {
+        try {
+            return context.json(await this.options.marketplace.getDefaultDiscovery(context.req.raw.signal));
+        }
+        catch (error) {
+            if (error instanceof MarketplaceError)
+                return this.writeMarketplaceError(context, error);
+            throw error;
+        }
+    }
+    writeMarketplaceError(context, error) {
+        const status = error.status;
+        return jsonError(context, status === 401 || status === 403 || status === 404 || status === 502 || status === 504 ? status : 400, error.code, error.message);
+    }
     async deleteMarketplace(context) {
         await this.options.marketplace.remove();
         return context.json(this.options.marketplace.getState());
@@ -877,7 +909,7 @@ export class ConnectServer {
             connectionName,
         };
         this.options.logger?.info(logContext, "connection disconnect started");
-        return this.writeConnectionResult(context, this.options.connections.disconnect(service, connectionName), logContext);
+        return this.writeConnectionResult(context, this.options.connections.disconnect(service, connectionName, { revoke: optionalBoolean(body.revoke) }), logContext);
     }
     async createOAuthAuthorization(context) {
         const body = await readJsonBody(context);
@@ -1023,10 +1055,12 @@ export class ConnectServer {
         }
         let service;
         try {
+            const callbackUrl = new URL(context.req.url);
             const completed = await this.options.oauthFlow.completeAuthorization({
                 state,
                 code,
-                callbackParameters: Object.fromEntries(new URL(context.req.url).searchParams),
+                callbackParameters: Object.fromEntries(callbackUrl.searchParams),
+                callbackQuery: callbackUrl.search,
                 signal: context.req.raw.signal,
             });
             service = completed.service;
@@ -1050,7 +1084,7 @@ export class ConnectServer {
             }
             throw error;
         }
-        return context.html(renderOAuthCompletionPage(service));
+        return context.html(renderOAuthCompletionPage(service, this.options.oauthCloseDelaySeconds));
     }
     async writeConnectionResult(context, operation, logContext) {
         try {

package/src/server/connector-runtime.d.ts

@@ -1,4 +1,5 @@
 import type { ActionPolicyConfig } from "../core/action-policy.ts";
+import type { ProviderHttpDispatchOptions } from "../core/provider-http-dispatch.ts";
 import type { RuntimeLogger } from "../core/types.ts";
 import type { RuntimeJwtConfig } from "./api/runtime-jwt.ts";
 import type { S3TransitClientOptions } from "./files/s3-transit-files.ts";
@@ -56,6 +57,8 @@ export interface ConnectorRuntimeOptions {
     jwt?: RuntimeJwtConfig;
     postgres?: ConnectorPostgresOptions;
     network?: ConnectorNetworkOptions;
+    /** Opt-in admission and result feedback for every provider HTTP transport attempt. */
+    providerHttpDispatch?: ProviderHttpDispatchOptions;
     /** Allow or block actions, proxies and Triggers by name. */
     actionPolicy?: ActionPolicyConfig;
     /** Services, or `*`, whose connections may carry their own OAuth client instead of the configured one. */
@@ -73,6 +76,8 @@ export interface ConnectorRuntimeOptions {
     logger?: RuntimeLogger;
     /** The standalone host opts into API-reference HTML. Authorization completion pages are always available. */
     apiReference?: boolean;
+    /** Seconds the OAuth completion page waits before closing its window. Defaults to 5; `0` closes it as soon as it loads. */
+    oauthCloseDelaySeconds?: number;
 }
 /** Standard web requests are the host boundary; credentials, databases and framework objects stay private. */
 export interface ConnectorRuntime {

package/src/server/connector-runtime.js

@@ -5,6 +5,7 @@ import { ActionPolicyService } from "../core/action-policy.js";
 import { setEgressTrustedHosts, setPrivateNetworkAccessAllowed } from "../core/request.js";
 import { ProviderLoader } from "../providers/provider-loader.js";
 import { executorModules } from "../providers/registry.generated.js";
+import { DEFAULT_OAUTH_CLOSE_DELAY_SECONDS } from "./api/oauth-completion-page.js";
 import { createRuntimeJwtVerifier } from "./api/runtime-jwt.js";
 import { createConnectApp } from "./connect-app.js";
 import { getConnectorAssetDirectory } from "./connector-assets.js";
@@ -48,6 +49,9 @@ async function openRuntime(options) {
         throw new Error("transitFiles.ttlSeconds must be a positive number of seconds.");
     if (!Number.isFinite(maxBytes) || maxBytes <= 0)
         throw new Error("transitFiles.maxBytes must be a positive number.");
+    const oauthCloseDelaySeconds = options.oauthCloseDelaySeconds ?? DEFAULT_OAUTH_CLOSE_DELAY_SECONDS;
+    if (!Number.isInteger(oauthCloseDelaySeconds) || oauthCloseDelaySeconds < 0)
+        throw new Error("oauthCloseDelaySeconds must be a non-negative integer of seconds.");
     const assetDirectory = getConnectorAssetDirectory();
     const assets = options.assets ?? {
         catalogDir: join(assetDirectory, "catalog/apps"),
@@ -107,6 +111,7 @@ async function openRuntime(options) {
         const { app, runtimeAuthConfigured, saasCleanup, triggerMaintenance } = await createConnectApp({
             catalog,
             providerLoader: new ProviderLoader(executorModules),
+            providerHttpDispatch: options.providerHttpDispatch,
             runtimeDatabase: database,
             transitFiles,
             uploadTransitFile: createNodeTransitFileUpload({ transitFiles, tempDir }),
@@ -120,6 +125,7 @@ async function openRuntime(options) {
             allowedCustomOAuth: options.allowedCustomOAuth,
             logger: options.logger,
             serveDocumentation: options.apiReference ?? false,
+            oauthCloseDelaySeconds,
         });
         saasCleanup.start();
         triggerMaintenance.start();

package/src/server/files/node-transit-file-upload.js

@@ -41,7 +41,11 @@ async function stageMultipartFile(request, path, maxBytes) {
         parser = Busboy({
             headers: { "content-type": contentType },
             defParamCharset: "utf8",
-            limits: { fields: 0, files: 1, parts: 2, fileSize: maxBytes },
+            // Busboy flags truncation when its counter *reaches* its limit, so give it
+            // one byte of headroom and judge the bytes actually written below. This
+            // also rejects an over-limit file under a fractional limit, where the
+            // counter never equals the limit and `truncated` would stay false.
+            limits: { fields: 0, files: 1, parts: 2, fileSize: maxBytes + 1 },
         });
     }
     catch {
@@ -62,13 +66,13 @@ async function stageMultipartFile(request, path, maxBytes) {
         }
         const writer = createWriteStream(path, { flags: "wx" });
         staged = pipeline(stream, writer).then(() => {
-            if (stream.truncated) {
+            if (writer.bytesWritten > maxBytes) {
                 throw new TransitFileError(413, "file_too_large", `Transit file must be ${maxBytes} bytes or smaller.`);
             }
             return {
                 path,
                 sizeBytes: writer.bytesWritten,
-                name: info.filename,
+                name: info.filename ?? "",
                 mimeType: info.mimeType,
             };
         });

package/src/server/files/transit-file-store.js

@@ -52,11 +52,15 @@ export function uploadResult(publicOrigin, fileId, info) {
  * ASCII-only form for clients that do not read `filename*`.
  */
 export function contentDispositionForFileName(name) {
-    const asciiName = name.replace(/[^\u0020-\u007e]/gu, "_").replace(/["\\]/g, "_");
-    if (!/[\u0080-\u{10ffff}]/u.test(name)) {
+    // Metadata written before the write-time repair (or supplied by a caller)
+    // can still hold an unpaired surrogate. `encodeURIComponent` throws on it,
+    // which would fail every download for the whole lifetime of the file.
+    const repaired = name.toWellFormed();
+    const asciiName = repaired.replace(/[^\u0020-\u007e]/gu, "_").replace(/["\\]/g, "_");
+    if (!/[\u0080-\u{10ffff}]/u.test(repaired)) {
         return `attachment; filename="${asciiName}"`;
     }
-    return `attachment; filename="${asciiName}"; filename*=UTF-8''${encodeExtendedValue(name)}`;
+    return `attachment; filename="${asciiName}"; filename*=UTF-8''${encodeExtendedValue(repaired)}`;
 }
 /** Percent-encode a file name as an RFC 8187 `ext-value`, which allows fewer literals than a URI component. */
 function encodeExtendedValue(name) {
@@ -144,7 +148,9 @@ export function metadataKey(fileId) {
 /** Trim a stored name and MIME type, substituting the matching fallback for a missing or blank value. */
 export function normalizeDescriptor(input, fallback = { name: "file", mimeType: "application/octet-stream" }) {
     return {
-        name: typeof input.name === "string" && input.name.trim() ? input.name.trim() : fallback.name,
+        // Repair unpaired UTF-16 surrogates at the storage boundary so every
+        // backend and every later reader sees a well-formed name.
+        name: typeof input.name === "string" && input.name.trim() ? input.name.trim().toWellFormed() : fallback.name,
         mimeType: typeof input.mimeType === "string" && input.mimeType.trim() ? input.mimeType.trim() : fallback.mimeType,
     };
 }

package/src/server/files/transit-files.d.ts

@@ -11,6 +11,9 @@ export declare class TransitFileService implements IStagedTransitFileService {
     private readonly publicOrigin;
     private readonly ttlMs;
     readonly maxBytes: number;
+    private sweeping;
+    private followUp;
+    private lastSweepAt;
     constructor(options: TransitFileOptions);
     create(file: File): Promise<TransitFileUpload>;
     createFromStream(file: TransitFileStream): Promise<TransitFileUpload>;
@@ -18,7 +21,22 @@ export declare class TransitFileService implements IStagedTransitFileService {
     read(fileId: string): Promise<TransitFileRead>;
     response(fileId: string): Promise<Response>;
     delete(fileId: string): Promise<boolean>;
+    /**
+     * Remove expired files and their side-cars. One sweep runs at a time (a
+     * caller arriving mid-sweep shares it), and the directory is walked in
+     * bounded batches, so its size never turns into that many concurrent
+     * filesystem requests on the heap.
+     */
     cleanupExpired(): Promise<void>;
+    private startSweep;
+    /**
+     * The write path's sweep: at most one every {@link sweepIntervalMs}, never
+     * awaited. Sweeping on every write made each upload walk the whole
+     * directory, so concurrent downloads into a store holding a day of files
+     * queued hundreds of thousands of `stat` calls and exhausted the heap.
+     */
+    private sweepIfDue;
+    private sweep;
     /** Resolve a live, unexpired file on disk together with its side-car metadata, or report it as missing. */
     private locate;
     private readMetadata;

package/src/server/files/transit-files.js

@@ -1,14 +1,21 @@
 import { createReadStream, createWriteStream } from "node:fs";
-import { mkdir, readFile, readdir, rename, stat, unlink, writeFile } from "node:fs/promises";
+import { mkdir, opendir, readFile, rename, stat, unlink, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { assertFileSize, assertSafeFileId, contentTypeFromFileId, isSafeFileId, normalizeDescriptor, randomHex, safeExtension, TransitFileError, transitFileRead, transitFileResponse, uploadResult, } from "./transit-file-store.js";
+/** How often the write path may start a sweep of expired transit files. */
+const sweepIntervalMs = 60_000;
+/** How many directory entries a sweep stats at once. */
+const sweepConcurrency = 64;
 export class TransitFileService {
     rootDir;
     publicOrigin;
     ttlMs;
     maxBytes;
+    sweeping;
+    followUp;
+    lastSweepAt = Number.NEGATIVE_INFINITY;
     constructor(options) {
         this.rootDir = options.rootDir;
         this.publicOrigin = options.publicOrigin;
@@ -29,7 +36,8 @@ export class TransitFileService {
         });
         try {
             file.signal?.throwIfAborted();
-            await this.cleanupExpired();
+            this.sweepIfDue();
+            await mkdir(this.rootDir, { recursive: true });
             const sizeBytes = await this.writeStream(file, tempPath);
             file.signal?.throwIfAborted();
             await writeFile(metadataPath(path), JSON.stringify(metadata), { flag: "wx", signal: file.signal });
@@ -47,7 +55,7 @@ export class TransitFileService {
     }
     async createFromPath(file) {
         assertFileSize(file.sizeBytes, this.maxBytes);
-        await this.cleanupExpired();
+        this.sweepIfDue();
         await mkdir(this.rootDir, { recursive: true });
         const fileId = `${randomHex(16)}${safeExtension(file.name)}`;
         const path = join(this.rootDir, fileId);
@@ -82,21 +90,74 @@ export class TransitFileService {
             return false;
         }
     }
-    async cleanupExpired() {
+    /**
+     * Remove expired files and their side-cars. One sweep runs at a time (a
+     * caller arriving mid-sweep shares it), and the directory is walked in
+     * bounded batches, so its size never turns into that many concurrent
+     * filesystem requests on the heap.
+     */
+    cleanupExpired() {
+        if (this.sweeping) {
+            // The running sweep may have read the directory before this call:
+            // run one more after it, shared by every caller that arrives meanwhile.
+            if (!this.followUp) {
+                const next = () => {
+                    this.followUp = undefined;
+                    return this.startSweep();
+                };
+                this.followUp = this.sweeping.then(next, next);
+            }
+            return this.followUp;
+        }
+        return this.startSweep();
+    }
+    startSweep() {
+        if (this.sweeping) {
+            return this.sweeping;
+        }
+        this.lastSweepAt = Date.now();
+        this.sweeping = this.sweep().finally(() => {
+            this.sweeping = undefined;
+        });
+        return this.sweeping;
+    }
+    /**
+     * The write path's sweep: at most one every {@link sweepIntervalMs}, never
+     * awaited. Sweeping on every write made each upload walk the whole
+     * directory, so concurrent downloads into a store holding a day of files
+     * queued hundreds of thousands of `stat` calls and exhausted the heap.
+     */
+    sweepIfDue() {
+        if (this.sweeping || Date.now() - this.lastSweepAt < sweepIntervalMs) {
+            return;
+        }
+        void this.cleanupExpired().catch(() => undefined);
+    }
+    async sweep() {
         await mkdir(this.rootDir, { recursive: true });
         const cutoff = Date.now() - this.ttlMs;
-        const entries = await readdir(this.rootDir, { withFileTypes: true });
-        await Promise.all(entries.map(async (entry) => {
+        let batch = [];
+        const flush = async () => {
+            await Promise.all(batch.map(async (name) => {
+                const path = join(this.rootDir, name);
+                const stats = await stat(path).catch(() => undefined);
+                if (stats && stats.mtimeMs < cutoff) {
+                    await unlink(path).catch(() => undefined);
+                    await unlink(metadataPath(path)).catch(() => undefined);
+                }
+            }));
+            batch = [];
+        };
+        for await (const entry of await opendir(this.rootDir)) {
             if (!entry.isFile() || !isManagedFileName(entry.name)) {
-                return;
+                continue;
             }
-            const path = join(this.rootDir, entry.name);
-            const stats = await stat(path).catch(() => undefined);
-            if (stats && stats.mtimeMs < cutoff) {
-                await unlink(path).catch(() => undefined);
-                await unlink(metadataPath(path)).catch(() => undefined);
+            batch.push(entry.name);
+            if (batch.length >= sweepConcurrency) {
+                await flush();
             }
-        }));
+        }
+        await flush();
     }
     /** Resolve a live, unexpired file on disk together with its side-car metadata, or report it as missing. */
     async locate(fileId) {

package/src/server/proxy/proxy-runner.d.ts

@@ -1,11 +1,13 @@
 import type { CatalogStore } from "../../catalog-store.ts";
 import type { ConnectionService } from "../../connection-service.ts";
 import type { ActionPolicySnapshot } from "../../core/action-policy.ts";
+import type { ProviderHttpDispatchOptions } from "../../core/provider-http-dispatch.ts";
 import type { RuntimeLogger, ProxyResponse } from "../../core/types.ts";
 import type { IProviderLoader } from "../../providers/provider-loader.ts";
 import type { SaasExecutionService } from "../../saas/saas-execution-service.ts";
 export type ProxyFailureStatus = 400 | 402 | 403 | 404 | 409 | 413 | 429 | 500 | 501 | 502 | 503 | 504;
 export interface ProxyRunnerOptions {
+    providerHttpDispatch?: ProviderHttpDispatchOptions;
     catalog: CatalogStore;
     providerLoader: IProviderLoader;
     connections: ConnectionService;
@@ -38,6 +40,7 @@ export declare class ProxyRunner {
     private readonly options;
     constructor(options: ProxyRunnerOptions);
     run(input: RunProxyInput): Promise<ProxyRunResult>;
+    private runProxy;
     private readProxyRequestInput;
     private assertRelativeEndpoint;
     private hasPathTraversalSegment;

package/src/server/proxy/proxy-runner.js

@@ -1,5 +1,7 @@
 import { ConnectionError } from "../../connection-service.js";
 import { optionalInteger, optionalRecord, requiredRecord, requiredString } from "../../core/cast.js";
+import { withProviderHttpDispatch } from "../../core/provider-http-dispatch.js";
+import { ProviderDispatchRequestError, toProviderExecutionError, withProviderHttpDispatchResult, } from "../../providers/provider-runtime.js";
 import { SaasError } from "../../saas/saas-client.js";
 import { mapConnectionErrorStatus } from "../api/runtime-api.js";
 class ProxyInputError extends Error {
@@ -11,6 +13,10 @@ export class ProxyRunner {
         this.options = options;
     }
     async run(input) {
+        const provider = this.options.catalog.providers.find((candidate) => candidate.service === input.service);
+        return withProviderHttpDispatch({ operation: "proxy", service: provider?.service }, () => this.runProxy(input), this.options.providerHttpDispatch);
+    }
+    async runProxy(input) {
         const provider = this.options.catalog.providers.find((candidate) => candidate.service === input.service);
         if (!provider) {
             return {
@@ -105,10 +111,15 @@ export class ProxyRunner {
                     message: `Proxy execution is not supported for ${provider.service}.`,
                     meta: { service: provider.service },
                 };
-            const result = await executor(request.input, {
+            const result = await withProviderHttpDispatchResult({
+                operation: "proxy",
+                service: provider.service,
+                connectionId: target.summary?.id,
+                connectionName: target.summary?.connectionName,
+            }, () => executor(request.input, {
                 getCredential: target.getCredential,
                 signal: input.signal,
-            });
+            }), this.options.providerHttpDispatch);
             const durationMs = Date.now() - startedAtMs;
             if (result.ok) {
                 this.options.logger?.info({ ...logContext, durationMs, status: result.response.status }, "proxy request completed");
@@ -149,6 +160,16 @@ export class ProxyRunner {
                     meta: { service: provider.service, executionId, remoteExecutionId: error.remoteExecutionId },
                 };
             }
+            if (error instanceof ProviderDispatchRequestError) {
+                return {
+                    ok: false,
+                    status: 429,
+                    errorCode: "rate_limited",
+                    message: error.message,
+                    data: toProviderExecutionError(error, error.message).error?.details,
+                    meta: { service: provider.service },
+                };
+            }
             if (error instanceof ConnectionError) {
                 const missingConnectionDecision = error.code === "connection_not_found" ? input.policy.evaluateConnection() : undefined;
                 if (missingConnectionDecision && !missingConnectionDecision.allowed) {

package/src/server/storage/connection-request-store.js

@@ -1,3 +1,4 @@
+import { initializeRetirement, lockRetirement, retirementMatches } from "./connection-retirement.js";
 import { queueSaasConnections, queueSaasRequests } from "./saas-project-store.js";
 /** Shared SQL lifecycle for SQLite, PostgreSQL and D1. Secrets use the runtime's codec. */
 export class ConnectionRequestStore {
@@ -10,11 +11,14 @@ export class ConnectionRequestStore {
     async create(pending) {
         const now = Date.parse(pending.createdAt);
         const value = await this.secretCodec.encode(JSON.stringify(pending));
+        const fence = retirementMatches(pending.service, pending.connectionName, pending.retirementGeneration);
         await this.transaction([
-            ...this.retireRequests(pending.owner, pending.service, now),
+            initializeRetirement(pending.service, pending.connectionName, pending.retirementGeneration),
+            lockRetirement(pending.service, pending.connectionName, pending.retirementGeneration),
+            ...this.retireRequests(pending.owner, pending.service, now, fence),
             {
-                sql: `insert into connection_requests (id, owner, service, state, phase, status, value, expires_at, created_at, updated_at)
-          values (?, ?, ?, ?, 'pending', 'initiated', ?, ?, ?, ?)`,
+                sql: `insert into connection_requests (id, owner, service, state, phase, status, value, expires_at, created_at, updated_at, connection_name)
+          select ?, ?, ?, ?, 'pending', 'initiated', ?, ?, ?, ?, ? where ${fence.sql}`,
                 values: [
                     pending.connectionRequestId,
                     pending.owner,
@@ -24,6 +28,8 @@ export class ConnectionRequestStore {
                     pending.expiresAt,
                     now,
                     now,
+                    pending.connectionName,
+                    ...fence.values,
                 ],
             },
         ]);
@@ -81,7 +87,8 @@ export class ConnectionRequestStore {
             : null;
         signal?.throwIfAborted();
         const now = new Date();
-        const active = "exists (select 1 from connection_requests where kind = 'local' and id = ? and phase = 'processing')";
+        const fence = retirementMatches(pending.service, pending.connectionName, pending.retirementGeneration);
+        const active = `exists (select 1 from connection_requests where kind = 'local' and id = ? and phase = 'processing') and ${fence.sql}`;
         const write = pending.target
             ? {
                 sql: `update connections set value = ?, revision = ?, updated_at = ?, source = 'local',
@@ -96,6 +103,7 @@ export class ConnectionRequestStore {
                     id,
                     pending.target.revision,
                     pending.connectionRequestId,
+                    ...fence.values,
                     accountId,
                 ],
             }
@@ -111,14 +119,17 @@ export class ConnectionRequestStore {
                     now.toISOString(),
                     accountId,
                     pending.connectionRequestId,
+                    ...fence.values,
                 ],
             };
         const results = await this.transaction([
+            lockRetirement(pending.service, pending.connectionName, pending.retirementGeneration),
             { sql: "update connections set revision = revision where id = ?", values: [id] },
             queueSaasConnections(`id = ? and revision = ? and ${active}`, [
                 id,
                 pending.target?.revision ?? "",
                 pending.connectionRequestId,
+                ...fence.values,
             ]),
             write,
             {
@@ -127,29 +138,31 @@ export class ConnectionRequestStore {
                 values: [id, now.getTime(), pending.connectionRequestId, id, revision],
             },
         ]);
-        return results[2].length ? id : undefined;
+        return results[3].length ? id : undefined;
     }
-    retireRequests(owner, service, now) {
-        const expired = "expires_at <= ?";
-        const superseded = "owner = ? and service = ? and phase = 'pending'";
+    retireRequests(owner, service, now, fence = { sql: "1 = 1", values: [] }) {
+        const expired = `expires_at <= ? and ${fence.sql}`;
+        const superseded = `owner = ? and service = ? and phase = 'pending' and ${fence.sql}`;
+        const expiredValues = [new Date(now - 86_400_000).toISOString(), ...fence.values];
+        const supersededValues = [owner, service, ...fence.values];
         return [
-            queueSaasRequests(expired, [new Date(now - 86_400_000).toISOString()]),
-            queueSaasRequests(superseded, [owner, service]),
+            queueSaasRequests(expired, expiredValues),
+            queueSaasRequests(superseded, supersededValues),
             {
                 sql: `update connection_requests set phase = 'completed', status = 'failed', error_code = 'request_expired',
           value = null, candidate_value = null, lease_id = null, lease_until = null, updated_at = ?
           where kind = 'saas' and phase <> 'completed' and ${expired}`,
-                values: [now, new Date(now - 86_400_000).toISOString()],
+                values: [now, ...expiredValues],
             },
             {
-                sql: "delete from connection_requests where expires_at <= ?",
-                values: [new Date(now - 86_400_000).toISOString()],
+                sql: `delete from connection_requests where ${expired}`,
+                values: expiredValues,
             },
             {
                 sql: `update connection_requests set phase = 'completed', status = 'failed', error_code = 'request_superseded',
           error_message = 'A newer authorization request replaced this request.', value = null, candidate_value = null,
           lease_id = null, lease_until = null, updated_at = ? where ${superseded} and (kind = 'saas' or expires_at > ?)`,
-                values: [now, owner, service, new Date(now).toISOString()],
+                values: [now, ...supersededValues, new Date(now).toISOString()],
             },
         ];
     }

package/src/server/storage/connection-retirement.d.ts

@@ -0,0 +1,7 @@
+import type { RequestStatement } from "./connection-request-store.ts";
+/** SQL predicate for the one durable retirement fence shared by OAuth publication paths. */
+export declare function retirementMatches(service: string, connectionName: string, generation: string): RequestStatement;
+/** Keeps retirement and publication in the same lock order, including on PostgreSQL. */
+export declare function lockRetirement(service: string, connectionName: string, generation: string): RequestStatement;
+/** A retired name's row is never removed, including when no credential was ever published. */
+export declare function initializeRetirement(service: string, connectionName: string, generation: string): RequestStatement;

package/src/server/storage/connection-retirement.js

@@ -0,0 +1,21 @@
+/** SQL predicate for the one durable retirement fence shared by OAuth publication paths. */
+export function retirementMatches(service, connectionName, generation) {
+    return {
+        sql: "exists (select 1 from connection_retirements where service = ? and connection_name = ? and generation = ?)",
+        values: [service, connectionName, generation],
+    };
+}
+/** Keeps retirement and publication in the same lock order, including on PostgreSQL. */
+export function lockRetirement(service, connectionName, generation) {
+    return {
+        sql: "update connection_retirements set generation = generation where service = ? and connection_name = ? and generation = ? returning generation",
+        values: [service, connectionName, generation],
+    };
+}
+/** A retired name's row is never removed, including when no credential was ever published. */
+export function initializeRetirement(service, connectionName, generation) {
+    return {
+        sql: "insert into connection_retirements (service, connection_name, generation) values (?, ?, ?) on conflict do nothing",
+        values: [service, connectionName, generation],
+    };
+}

package/src/server/storage/connection-store.d.ts

@@ -10,7 +10,10 @@ export declare class SqlConnectionStore implements IConnectionStore {
     private read;
     get(service: string, connectionName: string): Promise<StoredConnection | undefined>;
     list(): Promise<StoredConnection[]>;
+    getRetirementGeneration(service: string, connectionName: string): Promise<string>;
     set(service: string, connectionName: string, credential: ResolvedCredential): Promise<StoredLocalConnection>;
+    setIfCurrentGeneration(service: string, connectionName: string, credential: ResolvedCredential, retirementGeneration: string): Promise<StoredLocalConnection | undefined>;
+    private writeCredential;
     updateCredential(input: StoredLocalConnection, refresh?: boolean): Promise<boolean>;
     delete(service: string, connectionName: string): Promise<void>;
 }