@oomol-lab/open-connector 1.9.0 → 1.9.1

package/src/server/connect-server.js

@@ -1,61 +1,33 @@
 import { Hono } from "hono";
 import { compress } from "hono/compress";
-import { ConnectionError, defaultConnectionName } from "../connection-service.js";
-import { ActionPolicyService, emptyPolicyRules } from "../core/action-policy.js";
-import { DEFAULT_ACTION_SEARCH_LIMIT, createActionSearchIndexProvider, searchActions } from "../core/action-search.js";
-import { optionalBoolean, optionalRecord, optionalString, requiredRawString, requiredString, requiredStringArray, } from "../core/cast.js";
-import { PromiseCache } from "../core/promise-cache.js";
+import { ActionPolicyService } from "../core/action-policy.js";
+import { createActionSearchIndexProvider } from "../core/action-search.js";
+import { optionalRecord } from "../core/cast.js";
 import { withProviderHttpDispatch } from "../core/provider-http-dispatch.js";
-import { MarketplaceError } from "../marketplace/marketplace-service.js";
-import { OAuthClientConfigError, OAuthClientConfigService } from "../oauth/oauth-client-config-service.js";
-import { OAuthCallbackError, OAuthFlowError, OAuthFlowService } from "../oauth/oauth-flow-service.js";
 import { ProviderDispatchRequestError, toProviderExecutionError } from "../providers/provider-runtime.js";
 import { SaasError } from "../saas/saas-client.js";
-import { ActionInputDepthError, createIdempotencyExpiry, hashActionRequest, hashIdempotencyKey, readIdempotencyKey, } from "./actions/action-idempotency.js";
 import { ActionRunner } from "./actions/action-runner.js";
-import { renderActionMarkdown } from "./api/action-markdown.js";
-import { clearLocalAuthCookie, createLocalAuthMiddleware, readLocalAuthSession, readRuntimeGrant } from "./api/auth.js";
+import { clearLocalAuthCookie, createLocalAuthMiddleware, readLocalAuthSession } from "./api/auth.js";
 import { getResponseCachePolicy } from "./api/cache-policy.js";
 import { createConnectionRoutes } from "./api/connection-routes.js";
-import { HttpRequestError, internalError, jsonError, notFound, readJsonBody } from "./api/http-utils.js";
-import { renderOAuthCompletionPage } from "./api/oauth-completion-page.js";
-import { policyRequestMaxBytes, readRuntimePolicyRules, readTokenPolicy } from "./api/policy-input.js";
-import { serializeRuntimeTriggerPermissions } from "./api/runtime-api.js";
-import { mapConnectionErrorStatus, serializeRuntimeAction, serializeRuntimeActionResult, serializeRuntimeActionService, serializeRuntimeConnectedApp, serializeRuntimeFailure, serializeRuntimeProvider, serializeRuntimeProviderSetup, unknownActionFailure, unknownServiceFailure, writeRuntimeActionHttpResult, writeRuntimeFailure, writeRuntimeSuccess, } from "./api/runtime-api.js";
-import { renderSaasCompletionPage } from "./api/saas-completion-page.js";
-import { TransitFileError } from "./files/transit-file-store.js";
+import { createConsoleCatalogRoutes } from "./api/console-catalog-routes.js";
+import { createConsoleOAuthRoutes } from "./api/console-oauth-routes.js";
+import { createDocsRoutes, loadDocsHandler } from "./api/docs-routes.js";
+import { HttpRequestError, internalError, jsonError, notFound } from "./api/http-utils.js";
+import { createMarketplaceRoutes } from "./api/marketplace-routes.js";
+import { createMcpRoutes, loadMcpModule } from "./api/mcp-routes.js";
+import { createPolicyRoutes } from "./api/policy-routes.js";
+import { createPolicySnapshotProvider } from "./api/policy-snapshot.js";
+import { createRunLogRoutes } from "./api/run-log-routes.js";
+import { writeRuntimeFailure, writeRuntimeSuccess } from "./api/runtime-api.js";
+import { createRuntimeAppRoutes } from "./api/runtime-app-routes.js";
+import { createRuntimeCatalogRoutes } from "./api/runtime-catalog-routes.js";
+import { createRuntimeExecutionRoutes } from "./api/runtime-execution-routes.js";
+import { createSaasOAuthRoutes } from "./api/saas-oauth-routes.js";
+import { createSaasProjectRoutes } from "./api/saas-project-routes.js";
+import { createTransitFileRoutes } from "./api/transit-file-routes.js";
+import { createTriggerRoutes } from "./api/trigger-routes.js";
 import { ProxyRunner } from "./proxy/proxy-runner.js";
-import { decodeRunLogCursor } from "./storage/runtime-store.js";
-import { summarizeRuntimeToken } from "./storage/runtime-token-service.js";
-/**
- * The MCP module pulls in @modelcontextprotocol/server and zod, which no other startup path needs, so it is
- * loaded on the first /mcp request. The cache shares one in-flight import; a rejected import is evicted so
- * transient resolution failures retry, while evaluation errors rethrow identically.
- */
-const mcpModule = new PromiseCache();
-function loadMcpModule() {
-    return mcpModule.get("", () => import("../mcp.js"));
-}
-/** The Scalar API reference is only rendered for /docs, so its package is loaded on the first request. */
-const docsHandler = new PromiseCache();
-function loadDocsHandler(openapiUrl = "/openapi.json") {
-    return docsHandler.get(openapiUrl, async () => {
-        const { Scalar } = await import("@scalar/hono-api-reference");
-        return Scalar({
-            pageTitle: "OOMOL Connect API Reference",
-            url: openapiUrl,
-            theme: "default",
-            darkMode: false,
-            forceDarkModeState: "light",
-            customCss: `
-          :root {
-            --scalar-color-accent: rgb(59, 99, 251);
-            --scalar-background-accent: rgba(59, 99, 251, 0.12);
-          }
-        `,
-        });
-    });
-}
 /**
  * Import and evaluate the modules the /mcp and /docs routes defer to their first request. The Node server never
  * calls this, so its startup graph stays small; Cloudflare Workers call it at app creation so an isolate keeps
@@ -73,7 +45,7 @@ export class ConnectServer {
     actionSearch;
     actionPolicy;
     proxyRunner;
-    policySnapshots = new WeakMap();
+    getPolicySnapshot;
     constructor(options) {
         this.options = options;
         this.actionSearch = options.actionSearch ?? createActionSearchIndexProvider(options.catalog.actions);
@@ -86,6 +58,11 @@ export class ConnectServer {
             logger: options.logger,
             saas: options.saas,
         });
+        this.getPolicySnapshot = createPolicySnapshotProvider({
+            actionPolicy: this.actionPolicy,
+            runtimePolicyStore: options.runtimePolicyStore,
+            logger: options.logger,
+        });
     }
     createApp() {
         const app = new Hono();
@@ -115,149 +92,86 @@ export class ConnectServer {
             app.use("/api/*", compress());
         }
         app.use("*", createLocalAuthMiddleware(auth));
-        if (this.options.marketplace) {
-            app.get("/api/marketplace", (context) => context.json(this.options.marketplace.getState()));
-            app.get("/api/marketplace/discovery", (context) => this.getMarketplaceDiscovery(context));
-            app.put("/api/marketplace", (context) => this.configureMarketplace(context));
-            app.patch("/api/marketplace", (context) => this.configureMarketplace(context));
-            app.delete("/api/marketplace", (context) => this.deleteMarketplace(context));
-            app.get("/api/provider-preferences", async (context) => context.json(await this.options.marketplace.listProviderPreferences()));
-            app.patch("/api/provider-preferences/:service", (context) => this.updateProviderPreference(context, context.req.param("service")));
-        }
+        // Health and runtime discovery / execution endpoints
         app.get("/v1/health", (context) => writeRuntimeSuccess(context, { ok: true, runtime: "oomol-connect" }));
-        app.get("/v1/providers/:service/setup", (context) => this.getRuntimeProviderSetup(context, context.req.param("service")));
-        app.get("/v1/providers/:service/trigger-permissions", (context) => this.getRuntimeTriggerPermissions(context, context.req.param("service")));
-        app.post("/v1/providers/:service/triggers/:triggerId/execute", (context) => this.executeRuntimeTrigger(context));
-        app.get("/api/trigger-subscriptions", async (context) => context.json((await this.options.triggerMaintenance?.list()) ?? []));
-        app.post("/api/trigger-subscriptions/:id/cancel", async (context) => {
-            if (!this.options.triggerMaintenance)
-                throw new HttpRequestError("trigger_not_supported", "Trigger subscriptions are unavailable.", 501);
-            await this.options.triggerMaintenance.cancel(context.req.param("id"), context.req.raw.signal);
-            return context.json({ ok: true });
-        });
-        app.post("/api/trigger-subscriptions/:id/abandon", async (context) => {
-            if (!this.options.triggerMaintenance)
-                throw new HttpRequestError("trigger_not_supported", "Trigger subscriptions are unavailable.", 501);
-            await this.options.triggerMaintenance.abandon(context.req.param("id"), context.req.raw.signal);
-            return context.json({ ok: true });
-        });
-        app.get("/v1/providers", (context) => this.listRuntimeProviders(context));
-        app.get("/v1/actions", (context) => this.listRuntimeActions(context));
-        app.get("/v1/actions/search", (context) => this.searchRuntimeActions(context));
-        app.get("/v1/actions/:actionId", (context) => this.getRuntimeAction(context, context.req.param("actionId")));
-        app.post("/v1/actions/:actionId", (context) => this.createRuntimeActionRun(context, context.req.param("actionId")));
+        app.route("/v1", createRuntimeCatalogRoutes({
+            catalog: this.options.catalog,
+            connections: this.options.connections,
+            actionSearch: this.actionSearch,
+            oauthClientConfigs: this.options.oauthClientConfigs,
+            saasProject: this.options.saasProject,
+        }));
+        app.route("/v1", createRuntimeAppRoutes({
+            connections: this.options.connections,
+            getPolicySnapshot: this.getPolicySnapshot,
+        }));
+        app.route("/v1", createRuntimeExecutionRoutes({
+            catalog: this.options.catalog,
+            actions: this.options.actions,
+            idempotency: this.options.idempotency,
+            proxyRunner: this.proxyRunner,
+            getPolicySnapshot: this.getPolicySnapshot,
+        }));
         app.route("/v1", createConnectionRoutes(this.options));
-        app.get("/v1/apps", (context) => this.listRuntimeApps(context));
-        app.get("/v1/apps/authenticated", (context) => this.listAuthenticatedRuntimeApps(context));
-        app.get("/v1/apps/services/:service", (context) => this.listRuntimeAppsByService(context, context.req.param("service")));
-        app.post("/v1/proxy/:service", (context) => this.createRuntimeProxyRequest(context, context.req.param("service")));
-        app.get("/openapi.json", async (context) => {
-            const { createOpenApiDocument } = await import("./api/openapi.js");
-            return context.json(createOpenApiDocument(this.options.catalog.providers, {
-                actionId: optionalString(context.req.query("actionId")),
-            }));
-        });
-        if (this.options.serveDocumentation !== false) {
-            // Path-only so the browser resolves it against whichever host it reached the server through: the public
-            // origin may name a different host (a default localhost origin, a reverse proxy) and /openapi.json sends no CORS.
-            const openapiUrl = `${new URL(this.options.publicOrigin).pathname.replace(/\/+$/, "")}/openapi.json`;
-            app.get("/docs", async (context, next) => (await loadDocsHandler(openapiUrl))(context, next));
-        }
-        // Schema-free listing. The action detail view loads full schemas on demand
-        // from /api/actions/:actionId. The catalog is immutable at runtime, so the
-        // body and its ETag are precomputed and reused, and unchanged reloads get a
-        // 304 instead of re-downloading the payload.
-        app.get("/api/providers", (context) => this.listProviderSummaries(context));
-        app.get("/api/providers/:service", (context) => this.getProvider(context, context.req.param("service")));
-        app.get("/api/actions", (context) => context.json(this.options.catalog.actions));
-        app.get("/api/actions/search", (context) => this.searchApiActions(context));
-        app.get("/api/actions/:actionId/agent.md", (context) => this.getActionMarkdown(context, context.req.param("actionId")));
-        app.get("/api/actions/:actionId", (context) => this.getAction(context, context.req.param("actionId")));
+        // Triggers and protocols
+        app.route("/", createTriggerRoutes({
+            catalog: this.options.catalog,
+            triggers: this.options.triggers,
+            triggerMaintenance: this.options.triggerMaintenance,
+            getPolicySnapshot: this.getPolicySnapshot,
+        }));
+        app.route("/", createMcpRoutes({
+            catalog: this.options.catalog,
+            connections: this.options.connections,
+            actions: this.options.actions,
+            actionSearch: this.actionSearch,
+            getPolicySnapshot: this.getPolicySnapshot,
+        }));
+        // API documentation (OpenAPI and Scalar reference)
+        app.route("/", createDocsRoutes({
+            providers: this.options.catalog.providers,
+            publicOrigin: this.options.publicOrigin,
+            serveDocumentation: this.options.serveDocumentation,
+        }));
+        // Console API routes
+        app.route("/api", createConsoleCatalogRoutes({
+            catalog: this.options.catalog,
+            connections: this.options.connections,
+            actionSearch: this.actionSearch,
+            publicOrigin: this.options.publicOrigin,
+            getPolicySnapshot: this.getPolicySnapshot,
+        }));
         app.get("/api/auth/session", async (context) => context.json(await readLocalAuthSession(context, auth)));
         app.post("/api/auth/logout", (context) => {
             clearLocalAuthCookie(context);
             return context.json({ ok: true });
         });
-        app.get("/api/connections", (context) => this.listConnections(context));
-        app.put("/api/connections/:service", (context) => this.upsertConnection(context, context.req.param("service")));
-        app.delete("/api/connections/:service", (context) => this.disconnect(context, context.req.param("service")));
-        app.get("/api/runs", (context) => this.listRuns(context));
-        app.get("/api/runs/:id", (context) => this.getRun(context, context.req.param("id")));
-        app.post("/api/files", (context) => this.createTransitFile(context));
-        app.get("/api/files/:fileId", (context) => this.getTransitFile(context, context.req.param("fileId")));
-        app.delete("/api/files/:fileId", (context) => this.deleteTransitFile(context, context.req.param("fileId")));
-        app.get("/api/runtime-tokens", (context) => this.listRuntimeTokens(context));
-        app.post("/api/runtime-tokens", (context) => this.createRuntimeToken(context));
-        app.put("/api/runtime-tokens/:id", (context) => this.updateRuntimeToken(context, context.req.param("id")));
-        app.delete("/api/runtime-tokens/:id", (context) => this.revokeRuntimeToken(context, context.req.param("id")));
-        app.get("/api/runtime-policy", (context) => this.getRuntimePolicy(context));
-        app.put("/api/runtime-policy", (context) => this.updateRuntimePolicy(context));
+        if (this.options.marketplace) {
+            app.route("/api", createMarketplaceRoutes({ marketplace: this.options.marketplace }));
+        }
+        app.route("/api", createRunLogRoutes({ actions: this.options.actions }));
+        app.route("/api", createTransitFileRoutes(this.options));
+        app.route("/api", createPolicyRoutes({
+            runtimeTokens: this.options.runtimeTokens,
+            runtimePolicyStore: this.options.runtimePolicyStore,
+            deploymentPolicyRules: this.actionPolicy.rules,
+            getPolicySnapshot: this.getPolicySnapshot,
+        }));
         const saas = this.options.saasProject;
         if (saas) {
-            app.get("/api/oauth/managed-project", async (context) => context.json(await saas.getState(context.req.raw.signal)));
-            app.put("/api/oauth/managed-project", async (context) => context.json(await saas.configure(await readJsonBody(context, 16_384), context.req.raw.signal)));
-            app.delete("/api/oauth/managed-project", async (context) => {
-                await saas.remove();
-                return context.json(await saas.getState(context.req.raw.signal));
-            });
-            app.get("/api/oauth/managed-project/provider-configs", async (context) => context.json(await saas.listProviderConfigs(context.req.raw.signal)));
-            app.get("/api/oauth/sources/:service", async (context) => context.json(await saas.getSource(context.req.param("service"))));
-            app.put("/api/oauth/sources/:service", async (context) => context.json(await saas.setSource(context.req.param("service"), await readJsonBody(context, 16_384), context.req.raw.signal)));
+            app.route("/api", createSaasProjectRoutes({ saasProject: saas }));
         }
         if (saas && this.options.saasOAuth) {
-            app.get("/oauth/saas/complete", (context) => {
-                context.header("Content-Security-Policy", "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'");
-                context.header("Referrer-Policy", "no-referrer");
-                return context.html(renderSaasCompletionPage());
-            });
-            app.post("/api/oauth/connection-requests/:id/sync", async (context) => {
-                const expectedOrigin = saas.requireOrigin();
-                if (context.req.header("origin") !== expectedOrigin)
-                    throw new SaasError("oauth_source_origin_mismatch", `Open Console at ${expectedOrigin}, or set OOMOL_CONNECT_ORIGIN to the exact Console address in your browser and restart Connect. localhost and 127.0.0.1 are different origins.`, 403);
-                if (context.req.header("x-openconnector-request") !== "sync" ||
-                    context.req.header("content-type")?.split(";")[0].trim().toLowerCase() !== "application/json")
-                    return context.json({ error: { code: "forbidden", message: "OAuth synchronization requires a same-origin JSON request." } }, 403);
-                const result = await this.options.saasOAuth.syncForBrowser(context.req.param("id"), "local-admin", context.req.raw.signal);
-                if (!result)
-                    return jsonError(context, 404, "connection_request_not_found", "Connection request not found.");
-                context.header("Cache-Control", "private, no-store");
-                return context.json(result);
-            });
+            app.route("/", createSaasOAuthRoutes({ saasProject: saas, saasOAuth: this.options.saasOAuth }));
         }
-        app.get("/api/oauth/configs", (context) => this.listOAuthConfigs(context));
-        app.put("/api/oauth/configs/:service", (context) => this.upsertOAuthConfig(context, context.req.param("service")));
-        app.delete("/api/oauth/configs/:service", (context) => this.deleteOAuthConfig(context, context.req.param("service")));
-        app.post("/api/oauth/connection-requests", async (context) => {
-            try {
-                const { consoleOAuthConnectionInput } = await import("./api/connection-input.js");
-                const parsed = consoleOAuthConnectionInput.safeParse(await readJsonBody(context));
-                if (!parsed.success)
-                    return jsonError(context, 400, "invalid_input", "Invalid OAuth connection request.");
-                const { appId, ...input } = parsed.data;
-                const target = appId ? await this.options.connections.getStoredConnection(appId) : undefined;
-                if (target && (target.service !== input.service || target.connectionName !== input.connectionName))
-                    return jsonError(context, 400, "invalid_input", "The selected connection no longer matches.");
-                return context.json(await this.options.oauthFlow.startConnectionRequest({
-                    ...input,
-                    target,
-                    owner: "local-admin",
-                    signal: context.req.raw.signal,
-                }));
-            }
-            catch (error) {
-                if (error instanceof OAuthClientConfigError ||
-                    error instanceof OAuthFlowError ||
-                    error instanceof ConnectionError)
-                    return jsonError(context, error.code === "unknown_service" || error.code === "app_not_found" ? 404 : 400, error.code, error.message);
-                throw error;
-            }
-        });
-        app.post("/api/oauth/authorizations", (context) => this.createOAuthAuthorization(context));
-        app.get("/oauth/callback", (context) => this.completeOAuth(context));
-        app.post("/mcp", (context) => this.handleMcp(context));
-        app.get("/mcp", (context) => this.rejectMcpMethod(context));
-        app.delete("/mcp", (context) => this.rejectMcpMethod(context));
-        app.get("/mcp/tools", async (context) => context.json({ tools: (await loadMcpModule()).listMcpToolSummaries() }));
+        app.route("/", createConsoleOAuthRoutes({
+            connections: this.options.connections,
+            oauthFlow: this.options.oauthFlow,
+            oauthClientConfigs: this.options.oauthClientConfigs,
+            saasProject: this.options.saasProject,
+            logger: this.options.logger,
+            oauthCloseDelaySeconds: this.options.oauthCloseDelaySeconds,
+        }));
         // Without a console the API owns every unknown path; a console host layers its fallback over these 404s.
         if (this.options.registerStaticRoutes)
             this.options.registerStaticRoutes(app);
@@ -317,971 +231,4 @@ export class ConnectServer {
         });
         return app;
     }
-    listProviderSummaries(context) {
-        const { providerSummariesJson, providerSummariesEtag } = this.options.catalog;
-        context.header("ETag", providerSummariesEtag);
-        if (requestMatchesEtag(context.req.header("If-None-Match"), providerSummariesEtag)) {
-            return context.body(null, 304);
-        }
-        return context.body(providerSummariesJson, 200, { "Content-Type": "application/json" });
-    }
-    async configureMarketplace(context) {
-        const body = await readJsonBody(context);
-        const input = {
-            discoveryUrl: optionalString(body.discoveryUrl),
-            apiKey: optionalString(body.apiKey),
-            enabled: typeof body.enabled === "boolean" ? body.enabled : undefined,
-        };
-        try {
-            return context.json(await this.options.marketplace.configure(input));
-        }
-        catch (error) {
-            if (error instanceof MarketplaceError)
-                return this.writeMarketplaceError(context, error);
-            throw error;
-        }
-    }
-    async getMarketplaceDiscovery(context) {
-        try {
-            return context.json(await this.options.marketplace.getDefaultDiscovery(context.req.raw.signal));
-        }
-        catch (error) {
-            if (error instanceof MarketplaceError)
-                return this.writeMarketplaceError(context, error);
-            throw error;
-        }
-    }
-    writeMarketplaceError(context, error) {
-        const status = error.status;
-        return jsonError(context, status === 401 || status === 403 || status === 404 || status === 502 || status === 504 ? status : 400, error.code, error.message);
-    }
-    async deleteMarketplace(context) {
-        await this.options.marketplace.remove();
-        return context.json(this.options.marketplace.getState());
-    }
-    async updateProviderPreference(context, service) {
-        const body = await readJsonBody(context);
-        if (typeof body.enabled !== "boolean") {
-            return jsonError(context, 400, "invalid_input", "enabled must be a boolean.");
-        }
-        try {
-            return context.json(await this.options.marketplace.setProviderEnabled(service, body.enabled));
-        }
-        catch (error) {
-            if (error instanceof MarketplaceError)
-                return jsonError(context, 404, error.code, error.message);
-            throw error;
-        }
-    }
-    async getRuntimeProviderSetup(context, service) {
-        const provider = this.options.catalog.providers.find((provider) => provider.service === service);
-        if (!provider)
-            return writeRuntimeFailure(context, unknownServiceFailure(service));
-        let oauth = provider.auth.some((auth) => auth.type === "oauth2")
-            ? await this.options.oauthClientConfigs.getSummary(service)
-            : undefined;
-        const source = oauth ? await this.options.saasProject?.getSource(service) : undefined;
-        if (oauth && source?.mode === "saas") {
-            const { config } = await this.options.saasProject.resolveConfig(service, source.providerConfigId, source.managedProjectId, context.req.raw.signal);
-            oauth = {
-                ...oauth,
-                configured: true,
-                customClientAvailable: false,
-                expectedRedirectUri: config.callbackUrl,
-                missingFields: [],
-            };
-        }
-        return writeRuntimeSuccess(context, serializeRuntimeProviderSetup(provider, oauth));
-    }
-    getProvider(context, service) {
-        const provider = this.options.catalog.providers.find((provider) => provider.service === service);
-        if (!provider) {
-            return notFound(context);
-        }
-        return context.json(provider);
-    }
-    async createTransitFile(context) {
-        try {
-            if (this.options.uploadTransitFile) {
-                return context.json(await this.options.uploadTransitFile(context.req.raw));
-            }
-            const form = await context.req.raw.formData();
-            const file = form.get("file");
-            if (!(file instanceof File)) {
-                return jsonError(context, 400, "invalid_input", "file is required.");
-            }
-            const upload = await this.options.transitFiles.create(file);
-            return context.json(upload);
-        }
-        catch (error) {
-            return this.handleTransitFileError(context, error);
-        }
-    }
-    async getTransitFile(context, fileId) {
-        try {
-            return await this.options.transitFiles.response(fileId);
-        }
-        catch (error) {
-            return this.handleTransitFileError(context, error);
-        }
-    }
-    async deleteTransitFile(context, fileId) {
-        try {
-            const deleted = await this.options.transitFiles.delete(fileId);
-            return context.json({ fileId, deleted });
-        }
-        catch (error) {
-            return this.handleTransitFileError(context, error);
-        }
-    }
-    handleTransitFileError(context, error) {
-        if (error instanceof TransitFileError) {
-            return jsonError(context, error.status, error.code, error.message);
-        }
-        throw error;
-    }
-    getAction(context, actionId) {
-        const action = this.options.catalog.actionsById.get(actionId);
-        if (!action) {
-            return notFound(context);
-        }
-        return context.json(action);
-    }
-    async listRuns(context) {
-        const query = readRunLogListInput(context);
-        if (!query.ok) {
-            return jsonError(context, 400, "invalid_input", query.message);
-        }
-        return context.json(await this.options.actions.listRuns(query.input));
-    }
-    async getRun(context, id) {
-        const run = await this.options.actions.getRun(id);
-        return run ? context.json(run) : jsonError(context, 404, "run_not_found", `Run not found: ${id}.`);
-    }
-    async searchApiActions(context) {
-        const query = readSearchQuery(context);
-        if (!query.ok) {
-            return jsonError(context, 400, "invalid_input", query.message);
-        }
-        const index = await this.actionSearch.get();
-        return context.json(await this.serializeSearchResults(searchActions(index, query.q, {
-            service: query.service,
-            limit: query.limit,
-        })));
-    }
-    async getActionMarkdown(context, actionId) {
-        const action = this.options.catalog.actionsById.get(actionId);
-        if (!action) {
-            return notFound(context);
-        }
-        try {
-            const policy = (await this.getPolicySnapshot(context)).evaluate(action);
-            return context.text(renderActionMarkdown(action, {
-                transport: { kind: "http", origin: this.options.publicOrigin },
-                connection: await this.options.connections.getConnectionSummary(action.service, readConnectionName(context)),
-                policy,
-            }), 200, {
-                "content-type": "text/markdown; charset=utf-8",
-            });
-        }
-        catch (error) {
-            if (error instanceof ConnectionError) {
-                const status = mapConnectionErrorStatus(error);
-                return jsonError(context, status, error.code, error.message);
-            }
-            throw error;
-        }
-    }
-    listRuntimeProviders(context) {
-        const services = context.req.queries("service") ?? [];
-        const query = optionalString(context.req.query("q"))?.toLowerCase();
-        const providers = this.options.catalog.providers.filter((provider) => {
-            if (services.length > 0 && !services.includes(provider.service)) {
-                return false;
-            }
-            if (!query) {
-                return true;
-            }
-            return [
-                provider.service,
-                provider.displayName,
-                provider.categories.join(" "),
-                provider.scenario,
-                provider.authTypes.join(" "),
-            ]
-                .join(" ")
-                .toLowerCase()
-                .includes(query);
-        });
-        return writeRuntimeSuccess(context, providers.map(serializeRuntimeProvider));
-    }
-    listRuntimeActions(context) {
-        const service = optionalString(context.req.query("service"));
-        if (!service) {
-            const services = [...new Set(this.options.catalog.actions.map((action) => action.service))];
-            return writeRuntimeSuccess(context, services.map(serializeRuntimeActionService));
-        }
-        const actions = this.options.catalog.actions.filter((action) => action.service === service);
-        return writeRuntimeSuccess(context, actions.map(serializeRuntimeAction));
-    }
-    async searchRuntimeActions(context) {
-        const query = readSearchQuery(context, 10);
-        if (!query.ok) {
-            return writeRuntimeFailure(context, {
-                status: 400,
-                errorCode: "invalid_input",
-                message: query.message,
-            });
-        }
-        const index = await this.actionSearch.get();
-        const results = searchActions(index, query.q, {
-            service: query.service,
-            limit: query.limit,
-        });
-        return writeRuntimeSuccess(context, await this.serializeSearchResults(results));
-    }
-    async serializeSearchResults(results) {
-        const authenticated = new Set(await this.options.connections.listAuthenticatedServices([...new Set(results.map((result) => result.service))]));
-        return results.flatMap((result) => {
-            const action = this.options.catalog.actionsById.get(result.id);
-            if (!action) {
-                return [];
-            }
-            return [serializeActionSearchResult(result, action, authenticated.has(action.service))];
-        });
-    }
-    getRuntimeAction(context, actionId) {
-        const action = this.options.catalog.actionsById.get(actionId);
-        if (!action) {
-            return writeRuntimeFailure(context, unknownActionFailure(actionId));
-        }
-        return writeRuntimeSuccess(context, serializeRuntimeAction(action));
-    }
-    async getRuntimeTriggerPermissions(context, service) {
-        const provider = this.options.catalog.providers.find((item) => item.service === service);
-        if (!provider)
-            throw new HttpRequestError("provider_not_found", "Provider not found.", 404);
-        return writeRuntimeSuccess(context, serializeRuntimeTriggerPermissions(provider));
-    }
-    async executeRuntimeTrigger(context) {
-        if (!this.options.triggers)
-            throw new HttpRequestError("trigger_not_supported", "Trigger execution is unavailable.", 501);
-        const { readTriggerRequest } = await import("../triggers/request.js");
-        const request = readTriggerRequest(await readJsonBody(context, 160 * 1024));
-        const signal = AbortSignal.any([context.req.raw.signal, AbortSignal.timeout(45_000)]);
-        const result = await this.options.triggers.run({
-            service: context.req.param("service"),
-            triggerId: context.req.param("triggerId"),
-            request,
-            connectionName: readConnectionName(context),
-            connectionId: optionalString(context.req.header("x-oo-connector-app-id")),
-            policy: await this.getPolicySnapshot(context),
-            grant: readRuntimeGrant(context),
-            signal,
-        });
-        return writeRuntimeSuccess(context, result);
-    }
-    async createRuntimeActionRun(context, actionId) {
-        const action = this.options.catalog.actionsById.get(actionId);
-        if (!action) {
-            return writeRuntimeFailure(context, unknownActionFailure(actionId));
-        }
-        const body = await readJsonBody(context);
-        const input = body.input ?? {};
-        const connectionName = readConnectionName(context, body);
-        const connectionId = optionalString(context.req.header("x-oo-connector-app-id"));
-        const runtimeGrant = readRuntimeGrant(context);
-        let policy;
-        try {
-            policy = await this.getPolicySnapshot(context);
-        }
-        catch {
-            return writeRuntimeFailure(context, {
-                status: 500,
-                errorCode: "internal_error",
-                message: "Runtime policy is unavailable.",
-                meta: { actionId },
-            });
-        }
-        if (!policy.evaluate(action).allowed) {
-            return writeRuntimeActionHttpResult(context, await this.executeRuntimeAction(actionId, input, connectionName, policy, runtimeGrant, context.req.raw.signal, connectionId));
-        }
-        const idempotencyKey = readIdempotencyKey(context.req.header("idempotency-key"));
-        if (!idempotencyKey.ok) {
-            return writeRuntimeFailure(context, {
-                status: 400,
-                errorCode: "invalid_input",
-                message: idempotencyKey.message,
-                meta: { actionId },
-            });
-        }
-        if (!idempotencyKey.key) {
-            return writeRuntimeActionHttpResult(context, await this.executeRuntimeAction(actionId, input, connectionName, policy, runtimeGrant, context.req.raw.signal, connectionId));
-        }
-        const now = new Date();
-        const keyHash = hashIdempotencyKey(idempotencyKey.key);
-        let requestHash;
-        try {
-            requestHash = hashActionRequest({
-                actionId,
-                connectionName: connectionName ?? defaultConnectionName,
-                connectionId,
-                input,
-                runtimeTokenId: runtimeGrant?.tokenId,
-            });
-        }
-        catch (error) {
-            if (!(error instanceof ActionInputDepthError)) {
-                throw error;
-            }
-            return writeRuntimeFailure(context, {
-                status: 400,
-                errorCode: "invalid_input",
-                message: error.message,
-                meta: { actionId },
-            });
-        }
-        const claimId = crypto.randomUUID();
-        const claim = await this.options.idempotency.claim({
-            keyHash,
-            requestHash,
-            claimId,
-            now: now.toISOString(),
-            expiresAt: createIdempotencyExpiry(now),
-        });
-        if (claim.kind === "conflict") {
-            return writeRuntimeFailure(context, {
-                status: 409,
-                errorCode: "idempotency_key_conflict",
-                message: "Idempotency-Key has already been used with a different request.",
-                meta: { actionId },
-            });
-        }
-        if (claim.kind === "in_progress") {
-            return writeRuntimeFailure(context, {
-                status: 409,
-                errorCode: "idempotency_request_in_progress",
-                message: "A request with this Idempotency-Key is still in progress.",
-                meta: { actionId },
-            });
-        }
-        if (claim.kind === "completed") {
-            return writeRuntimeActionHttpResult(context, claim.response);
-        }
-        const result = await this.executeRuntimeAction(actionId, input, connectionName, policy, runtimeGrant, context.req.raw.signal, connectionId);
-        const completed = await this.options.idempotency.complete({
-            keyHash,
-            requestHash,
-            claimId,
-            response: result,
-            expiresAt: createIdempotencyExpiry(new Date()),
-        });
-        if (!completed) {
-            throw new Error("Idempotency claim was replaced before completion.");
-        }
-        return writeRuntimeActionHttpResult(context, result);
-    }
-    async executeRuntimeAction(actionId, input, connectionName, policy, runtimeGrant, signal, connectionId) {
-        try {
-            const run = await this.options.actions.run({
-                actionId,
-                input,
-                caller: "http",
-                connectionName,
-                connectionId,
-                policy,
-                runtimeTokenId: runtimeGrant?.tokenId,
-                signal,
-            });
-            if (!run) {
-                return serializeRuntimeFailure(unknownActionFailure(actionId));
-            }
-            return serializeRuntimeActionResult({
-                actionId,
-                executionId: run.executionId,
-                remoteExecutionId: run.remoteExecutionId,
-                failureStatus: run.failureStatus,
-                retryAfter: run.retryAfter,
-                auditPersisted: run.auditPersisted,
-                result: run.result,
-            });
-        }
-        catch (error) {
-            if (error instanceof ConnectionError) {
-                return serializeRuntimeFailure({
-                    status: mapConnectionErrorStatus(error),
-                    errorCode: error.code,
-                    message: error.message,
-                    meta: { actionId },
-                });
-            }
-            throw error;
-        }
-    }
-    async createRuntimeProxyRequest(context, service) {
-        let body;
-        try {
-            body = await readJsonBody(context);
-        }
-        catch (error) {
-            if (error instanceof HttpRequestError) {
-                return writeRuntimeFailure(context, {
-                    status: error.status,
-                    errorCode: error.code,
-                    message: error.message,
-                    meta: { service },
-                });
-            }
-            throw error;
-        }
-        let policy;
-        try {
-            policy = await this.getPolicySnapshot(context);
-        }
-        catch {
-            return writeRuntimeFailure(context, {
-                status: 500,
-                errorCode: "internal_error",
-                message: "Runtime policy is unavailable.",
-                meta: { service },
-            });
-        }
-        const result = await this.proxyRunner.run({
-            service,
-            input: body,
-            connectionName: readConnectionName(context, body),
-            connectionId: optionalString(context.req.header("x-oo-connector-app-id")),
-            policy,
-            signal: context.req.raw.signal,
-        });
-        if (result.ok) {
-            return writeRuntimeSuccess(context, result.response, result.meta);
-        }
-        return writeRuntimeFailure(context, {
-            status: result.status,
-            errorCode: result.errorCode,
-            message: result.message,
-            data: result.data,
-            meta: result.meta,
-        });
-    }
-    async listRuntimeApps(context) {
-        let policy;
-        try {
-            policy = await this.getPolicySnapshot(context);
-        }
-        catch {
-            return writeRuntimeFailure(context, {
-                status: 500,
-                errorCode: "internal_error",
-                message: "Runtime policy is unavailable.",
-            });
-        }
-        return writeRuntimeSuccess(context, this.filterAllowedConnections(policy, await this.options.connections.listConnections()).map(serializeRuntimeConnectedApp));
-    }
-    async listRuntimeAppsByService(context, service) {
-        let policy;
-        try {
-            policy = await this.getPolicySnapshot(context);
-        }
-        catch {
-            return writeRuntimeFailure(context, {
-                status: 500,
-                errorCode: "internal_error",
-                message: "Runtime policy is unavailable.",
-                meta: { service },
-            });
-        }
-        try {
-            return writeRuntimeSuccess(context, this.filterAllowedConnections(policy, await this.options.connections.listConnectionsByService(service)).map(serializeRuntimeConnectedApp));
-        }
-        catch (error) {
-            if (error instanceof ConnectionError) {
-                return writeRuntimeFailure(context, {
-                    status: mapConnectionErrorStatus(error),
-                    errorCode: error.code,
-                    message: error.message,
-                    meta: { service },
-                });
-            }
-            throw error;
-        }
-    }
-    async listAuthenticatedRuntimeApps(context) {
-        const services = context.req.queries("service") ?? [];
-        let policy;
-        try {
-            policy = await this.getPolicySnapshot(context);
-        }
-        catch {
-            return writeRuntimeFailure(context, {
-                status: 500,
-                errorCode: "internal_error",
-                message: "Runtime policy is unavailable.",
-            });
-        }
-        const authenticated = new Set(this.filterAllowedConnections(policy, await this.options.connections.listConnections())
-            .filter((connection) => connection.configured && connection.authType !== "no_auth")
-            .map((connection) => connection.service));
-        return writeRuntimeSuccess(context, services.filter((service) => authenticated.has(service)));
-    }
-    filterAllowedConnections(policy, connections) {
-        return connections.filter((connection) => connection.authType === "no_auth" || policy.evaluateConnection(connection.id).allowed);
-    }
-    async handleMcp(context) {
-        const { handleMcpRequest } = await loadMcpModule();
-        return await handleMcpRequest(context.req.raw, {
-            catalog: this.options.catalog,
-            connections: this.options.connections,
-            actions: this.options.actions,
-            actionSearch: this.actionSearch,
-            getPolicySnapshot: () => this.getPolicySnapshot(context),
-            runtimeGrant: readRuntimeGrant(context),
-            signal: context.req.raw.signal,
-        });
-    }
-    rejectMcpMethod(context) {
-        return context.json({
-            jsonrpc: "2.0",
-            error: {
-                code: -32000,
-                message: "Method not allowed.",
-            },
-            id: null,
-        }, 405);
-    }
-    async listConnections(context) {
-        return context.json(await this.options.connections.listConnections());
-    }
-    async upsertConnection(context, service) {
-        const body = await readJsonBody(context);
-        const authType = optionalString(body.authType);
-        if (!authType) {
-            this.options.logger?.warn({
-                errorCode: "invalid_input",
-                path: context.req.path,
-                service,
-            }, "connection rejected");
-            return jsonError(context, 400, "invalid_input", "authType is required.");
-        }
-        const values = body.values ?? body;
-        const connectionName = readConnectionName(context, body);
-        const logContext = {
-            operation: "connect",
-            path: context.req.path,
-            service,
-            authType,
-            connectionName,
-        };
-        if (authType === "no_auth") {
-            this.options.logger?.info(logContext, "connection started");
-            return this.writeConnectionResult(context, this.options.connections.connectWithoutAuth(service, { connectionName }), logContext);
-        }
-        if (authType === "api_key") {
-            this.options.logger?.info(logContext, "connection started");
-            return this.writeConnectionResult(context, this.options.connections.connectWithApiKey(service, {
-                values,
-                connectionName,
-                signal: context.req.raw.signal,
-            }), logContext);
-        }
-        if (authType === "custom_credential") {
-            this.options.logger?.info(logContext, "connection started");
-            return this.writeConnectionResult(context, this.options.connections.connectWithCustomCredential(service, {
-                values,
-                connectionName,
-                signal: context.req.raw.signal,
-            }), logContext);
-        }
-        this.options.logger?.warn({
-            ...logContext,
-            errorCode: "unsupported_auth_type",
-        }, "connection rejected");
-        return jsonError(context, 400, "unsupported_auth_type", `${service} does not support ${authType}.`);
-    }
-    async disconnect(context, service) {
-        const body = await readJsonBody(context);
-        const connectionName = readConnectionName(context, body);
-        const logContext = {
-            operation: "disconnect",
-            path: context.req.path,
-            service,
-            connectionName,
-        };
-        this.options.logger?.info(logContext, "connection disconnect started");
-        return this.writeConnectionResult(context, this.options.connections.disconnect(service, connectionName, { revoke: optionalBoolean(body.revoke) }), logContext);
-    }
-    async createOAuthAuthorization(context) {
-        const body = await readJsonBody(context);
-        const requestedService = optionalString(body.service);
-        const connectionName = readConnectionName(context, body);
-        try {
-            const service = requiredString(body.service, "service", (message) => new OAuthFlowError("invalid_input", message));
-            const logContext = {
-                path: context.req.path,
-                service,
-                connectionName,
-            };
-            this.options.logger?.info(logContext, "oauth authorization started");
-            const authorization = await this.options.oauthFlow.startAuthorization({
-                service,
-                connectionName,
-                clientConfig: readOAuthClientConfigInput(body),
-                authorizationOptionIds: readOptionalStringArray(body, "authorizationOptionIds"),
-            });
-            const authorizationUrl = new URL(authorization.authorizationUrl);
-            this.options.logger?.info({
-                ...logContext,
-                authorizationHost: authorizationUrl.host,
-                redirectUri: authorizationUrl.searchParams.get("redirect_uri") ?? undefined,
-            }, "oauth authorization created");
-            return context.json(authorization);
-        }
-        catch (error) {
-            if (error instanceof OAuthClientConfigError ||
-                error instanceof OAuthFlowError ||
-                error instanceof ConnectionError) {
-                this.options.logger?.warn({
-                    errorCode: error.code,
-                    path: context.req.path,
-                    service: requestedService,
-                    connectionName,
-                }, "oauth authorization failed");
-                const status = error.code === "unknown_service" ? 404 : 400;
-                return jsonError(context, status, error.code, error.message);
-            }
-            throw error;
-        }
-    }
-    async listRuntimeTokens(context) {
-        return context.json(await this.options.runtimeTokens.listTokens());
-    }
-    async createRuntimeToken(context) {
-        const body = await readJsonBody(context, policyRequestMaxBytes);
-        const name = optionalString(body.name);
-        if (!name) {
-            return jsonError(context, 400, "invalid_input", "name is required.");
-        }
-        const created = await this.options.runtimeTokens.createToken(name, readTokenPolicy(body, true));
-        return context.json({
-            token: created.token,
-            record: summarizeRuntimeToken(created.record),
-        });
-    }
-    async updateRuntimeToken(context, id) {
-        const body = await readJsonBody(context, policyRequestMaxBytes);
-        const token = await this.options.runtimeTokens.updateTokenPolicy(id, readTokenPolicy(body));
-        return token
-            ? context.json(token)
-            : jsonError(context, 404, "runtime_token_not_found", `Runtime token not found: ${id}.`);
-    }
-    async revokeRuntimeToken(context, id) {
-        if (!(await this.options.runtimeTokens.revokeToken(id))) {
-            return jsonError(context, 404, "runtime_token_not_found", `Runtime token not found: ${id}.`);
-        }
-        return context.json({ id, revoked: true });
-    }
-    async getRuntimePolicy(context) {
-        return context.json((await this.getPolicySnapshot(context)).state);
-    }
-    async updateRuntimePolicy(context) {
-        const body = await readJsonBody(context, policyRequestMaxBytes);
-        const rules = readRuntimePolicyRules(body);
-        const updatedAt = new Date().toISOString();
-        await this.options.runtimePolicyStore.set({ rules, updatedAt });
-        return context.json({
-            deployment: this.actionPolicy.rules,
-            runtime: rules,
-            updatedAt,
-        });
-    }
-    async listOAuthConfigs(context) {
-        const configs = await this.options.oauthClientConfigs.listConfigs();
-        const sources = await this.options.saasProject?.listSources();
-        return context.json(configs.map((config) => ({
-            ...config,
-            oauthSource: sources?.get(config.service) ?? { mode: "local" },
-            customClientAvailable: sources?.has(config.service) ? false : config.customClientAvailable,
-        })));
-    }
-    async upsertOAuthConfig(context, service) {
-        const body = await readJsonBody(context);
-        return this.writeOAuthResult(context, this.options.oauthClientConfigs.upsertConfig({
-            service,
-            clientId: optionalString(body.clientId) ?? "",
-            clientSecret: optionalString(body.clientSecret) ?? "",
-            requestedScopes: readOptionalStringArray(body, "requestedScopes"),
-            redirectUri: readOptionalRawString(body, "redirectUri"),
-            extra: optionalRecord(body.extra),
-            secretExtra: optionalRecord(body.secretExtra),
-        }));
-    }
-    async deleteOAuthConfig(context, service) {
-        return this.writeOAuthResult(context, this.options.oauthClientConfigs.deleteConfig(service));
-    }
-    async completeOAuth(context) {
-        const state = context.req.query("state");
-        const code = context.req.query("code");
-        const logContext = {
-            path: context.req.path,
-            hasState: Boolean(state),
-            hasCode: Boolean(code),
-        };
-        this.options.logger?.info(logContext, "oauth callback received");
-        const providerError = context.req.query("error");
-        if (providerError) {
-            const returnUri = state
-                ? await this.options.oauthFlow.rejectAuthorization(state, providerError === "access_denied")
-                : undefined;
-            if (returnUri)
-                return context.redirect(returnUri);
-            const providerErrorDescription = context.req.query("error_description");
-            this.options.logger?.warn({
-                ...logContext,
-                errorCode: "oauth_provider_error",
-                providerError,
-                providerErrorDescription,
-            }, "oauth callback failed");
-            return jsonError(context, 400, "oauth_provider_error", `OAuth provider returned error "${providerError}"${providerErrorDescription ? `: ${providerErrorDescription}` : "."}`);
-        }
-        if (!state || !code) {
-            if (state)
-                await this.options.oauthFlow.rejectAuthorization(state, false);
-            this.options.logger?.warn({
-                ...logContext,
-                errorCode: "invalid_oauth_callback",
-            }, "oauth callback failed");
-            return jsonError(context, 400, "invalid_oauth_callback", "OAuth callback requires state and code.");
-        }
-        let service;
-        try {
-            const callbackUrl = new URL(context.req.url);
-            const completed = await this.options.oauthFlow.completeAuthorization({
-                state,
-                code,
-                callbackParameters: Object.fromEntries(callbackUrl.searchParams),
-                callbackQuery: callbackUrl.search,
-                signal: context.req.raw.signal,
-            });
-            service = completed.service;
-            if (completed.returnUri)
-                return context.redirect(completed.returnUri);
-            this.options.logger?.info({
-                ...logContext,
-                service,
-            }, "oauth callback completed");
-        }
-        catch (error) {
-            if (error instanceof OAuthCallbackError && error.returnUri)
-                return context.redirect(error.returnUri);
-            if (error instanceof OAuthFlowError || error instanceof ConnectionError) {
-                const cancelled = error instanceof ConnectionError && error.code === "connection_cancelled";
-                this.options.logger?.[cancelled ? "info" : "warn"]({
-                    ...logContext,
-                    errorCode: error.code,
-                }, cancelled ? "oauth callback cancelled" : "oauth callback failed");
-                return jsonError(context, error.code === "unknown_service" ? 404 : 400, error.code, error.message);
-            }
-            throw error;
-        }
-        return context.html(renderOAuthCompletionPage(service, this.options.oauthCloseDelaySeconds));
-    }
-    async writeConnectionResult(context, operation, logContext) {
-        try {
-            const result = await operation;
-            if (logContext) {
-                this.options.logger?.info(logContext, logContext.operation === "disconnect" ? "connection disconnect completed" : "connection completed");
-            }
-            return context.json(result);
-        }
-        catch (error) {
-            if (error instanceof ConnectionError) {
-                if (logContext) {
-                    const cancelled = error.code === "connection_cancelled";
-                    this.options.logger?.[cancelled ? "info" : "warn"]({
-                        ...logContext,
-                        errorCode: error.code,
-                    }, cancelled
-                        ? "connection cancelled"
-                        : logContext.operation === "disconnect"
-                            ? "connection disconnect failed"
-                            : "connection failed");
-                }
-                return jsonError(context, error.code === "unknown_service" ? 404 : 400, error.code, error.message);
-            }
-            throw error;
-        }
-    }
-    async writeOAuthResult(context, operation) {
-        try {
-            return context.json(await operation);
-        }
-        catch (error) {
-            if (error instanceof OAuthClientConfigError || error instanceof OAuthFlowError) {
-                return jsonError(context, error.code === "unknown_service" ? 404 : 400, error.code, error.message);
-            }
-            if (error instanceof HttpRequestError) {
-                return jsonError(context, 400, error.code, error.message);
-            }
-            throw error;
-        }
-    }
-    getPolicySnapshot(context) {
-        const request = context.req.raw;
-        let snapshot = this.policySnapshots.get(request);
-        if (!snapshot) {
-            snapshot = this.loadPolicySnapshot(context);
-            this.policySnapshots.set(request, snapshot);
-        }
-        return snapshot;
-    }
-    async loadPolicySnapshot(context) {
-        try {
-            const record = await this.options.runtimePolicyStore.get();
-            return this.actionPolicy.createSnapshot(record?.rules ?? emptyPolicyRules(), readRuntimeGrant(context), record?.updatedAt);
-        }
-        catch {
-            this.options.logger?.error({
-                method: context.req.method,
-                path: context.req.path,
-            }, "runtime policy load failed");
-            throw new Error("Runtime policy is unavailable.");
-        }
-    }
-}
-function readOAuthClientConfigInput(body) {
-    const keys = ["clientId", "clientSecret", "requestedScopes", "redirectUri", "extra", "secretExtra"];
-    if (!keys.some((key) => key in body)) {
-        return undefined;
-    }
-    return {
-        clientId: optionalString(body.clientId) ?? "",
-        clientSecret: optionalString(body.clientSecret) ?? "",
-        requestedScopes: readOptionalStringArray(body, "requestedScopes"),
-        redirectUri: readOptionalRawString(body, "redirectUri"),
-        extra: optionalRecord(body.extra),
-        secretExtra: optionalRecord(body.secretExtra),
-    };
-}
-/** An absent field is undefined; a present one, null included, must be a string (blank is kept for the caller to read as unset). */
-function readOptionalRawString(body, fieldName) {
-    if (!(fieldName in body))
-        return undefined;
-    return requiredRawString(body[fieldName], fieldName, (message) => new HttpRequestError("invalid_input", `${message}.`));
-}
-function readOptionalStringArray(body, fieldName) {
-    if (!(fieldName in body))
-        return undefined;
-    return requiredStringArray(body[fieldName], fieldName, (message) => new HttpRequestError("invalid_input", `${message}.`));
-}
-/**
- * RFC 7232 `If-None-Match` check. Handles `*`, comma-separated lists, and the
- * weak-comparison prefix (`W/`) so a validator round-tripped through gzip (which
- * downgrades strong to weak) still matches.
- */
-function requestMatchesEtag(ifNoneMatch, etag) {
-    if (!ifNoneMatch) {
-        return false;
-    }
-    if (ifNoneMatch.trim() === "*") {
-        return true;
-    }
-    const target = stripWeakPrefix(etag);
-    return ifNoneMatch.split(",").some((candidate) => stripWeakPrefix(candidate.trim()) === target);
-}
-function stripWeakPrefix(etag) {
-    return etag.startsWith("W/") ? etag.slice(2) : etag;
-}
-function readConnectionName(context, body) {
-    return (optionalString(body?.connectionName) ??
-        optionalString(body?.alias) ??
-        optionalString(context.req.header("x-oo-connector-alias")) ??
-        optionalString(context.req.query("connectionName")) ??
-        optionalString(context.req.query("alias")));
-}
-function serializeActionSearchResult(result, action, authenticated) {
-    return {
-        id: result.id,
-        service: result.service,
-        name: result.name,
-        description: result.description,
-        operationType: action.operationType,
-        authenticated,
-        inputSchema: action.inputSchema,
-        outputSchema: action.outputSchema,
-    };
-}
-function readRunLogListInput(context) {
-    const rawLimit = optionalString(context.req.query("limit"));
-    const limit = rawLimit === undefined ? 50 : Number(rawLimit);
-    if (!Number.isInteger(limit) || limit < 1 || limit > 100) {
-        return { ok: false, message: "limit must be an integer between 1 and 100." };
-    }
-    const cursor = optionalString(context.req.query("cursor"));
-    if (cursor !== undefined) {
-        try {
-            decodeRunLogCursor(cursor);
-        }
-        catch {
-            return { ok: false, message: "cursor is invalid." };
-        }
-    }
-    const input = { limit };
-    if (cursor !== undefined) {
-        input.cursor = cursor;
-    }
-    const service = optionalString(context.req.query("service"));
-    if (service !== undefined) {
-        input.service = service;
-    }
-    const actionId = optionalString(context.req.query("actionId"));
-    if (actionId !== undefined) {
-        if (actionId.length > 256) {
-            return { ok: false, message: "actionId must be at most 256 characters." };
-        }
-        input.actionId = actionId;
-    }
-    const caller = optionalString(context.req.query("caller"));
-    if (caller !== undefined) {
-        if (!isRunLogCaller(caller)) {
-            return { ok: false, message: "caller must be one of http, mcp, or web." };
-        }
-        input.caller = caller;
-    }
-    const ok = optionalString(context.req.query("ok"));
-    if (ok !== undefined) {
-        if (ok !== "true" && ok !== "false") {
-            return { ok: false, message: "ok must be true or false." };
-        }
-        input.ok = ok === "true";
-    }
-    return { ok: true, input };
-}
-function isRunLogCaller(value) {
-    return value === "http" || value === "mcp" || value === "web";
-}
-function readSearchQuery(context, defaultLimit = DEFAULT_ACTION_SEARCH_LIMIT) {
-    const q = optionalString(context.req.query("q") ?? context.req.query("query"));
-    if (!q || q.length > 256) {
-        return { ok: false, message: "q must be a non-empty string of at most 256 characters." };
-    }
-    const rawLimit = optionalString(context.req.query("limit"));
-    if (!rawLimit) {
-        return {
-            ok: true,
-            q,
-            service: optionalString(context.req.query("service")),
-            limit: defaultLimit,
-        };
-    }
-    const limit = Number(rawLimit);
-    if (!Number.isInteger(limit) || limit < 1 || limit > 50) {
-        return { ok: false, message: "limit must be an integer between 1 and 50." };
-    }
-    return {
-        ok: true,
-        q,
-        service: optionalString(context.req.query("service")),
-        limit,
-    };
 }