@oomol-lab/open-connector 1.9.1 → 1.9.3

package/src/providers/zeplin/runtime.js

@@ -1,6 +1,6 @@
 import { compactObject, objectArray, optionalInteger, optionalNumber, optionalRecord, optionalString, requiredRecord, requiredString, } from "../../core/cast.js";
 import { encodePathSegment, queryParams } from "../../core/request.js";
-import { providerResponseError, providerUserAgent, ProviderRequestError } from "../provider-runtime.js";
+import { providerResponseError, providerUserAgent, ProviderRequestError, providerInputError, } from "../provider-runtime.js";
 import { zeplinReadScope } from "./scopes.js";
 export const zeplinApiBaseUrl = "https://api.zeplin.dev/v1";
 export const zeplinActionHandlers = {
@@ -186,7 +186,7 @@ function mapZeplinError(status, text, phase) {
         return new ProviderRequestError(429, message);
     }
     if (status >= 400 && status < 500) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
     return new ProviderRequestError(status || 502, message);
 }

package/src/providers/zhihu/executors.js

@@ -5,7 +5,7 @@ import { basename, extname, join } from "node:path";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { compactObject, optionalRecord } from "../../core/cast.js";
-import { createProviderFetch, createProviderTimeout, defineApiKeyProviderExecutors, defineProviderProxy, ProviderRequestError, providerUserAgent, } from "../provider-runtime.js";
+import { createProviderFetch, createProviderTimeout, defineApiKeyProviderExecutors, defineProviderProxy, ProviderRequestError, providerUserAgent, providerInputError, providerResponseError, } from "../provider-runtime.js";
 const zhihuApiBaseUrl = "https://developer.zhihu.com";
 const zhihuUserAgent = providerUserAgent;
 const maximumZhihuUploadBytes = 100 * 1024 * 1024;
@@ -245,13 +245,13 @@ async function buildZhihuError(response, mode) {
         return new ProviderRequestError(429, message);
     }
     if (mode === "validate" && (response.status === 400 || response.status === 401 || response.status === 403)) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
     if (mode === "execute" && (response.status === 401 || response.status === 403)) {
         return new ProviderRequestError(401, message);
     }
     if (mode === "execute" && (response.status === 400 || response.status === 404)) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
     return new ProviderRequestError(response.status || 500, message);
 }
@@ -263,15 +263,15 @@ function buildZhihuPayloadError(payload, mode) {
         return new ProviderRequestError(429, message);
     }
     if (mode === "validate" && (code === 10001 || code === 20001)) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
     if (mode === "execute" && code === 20001) {
         return new ProviderRequestError(401, message);
     }
     if (mode === "execute" && code === 10001) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
-    return new ProviderRequestError(502, message);
+    return providerResponseError(message);
 }
 async function readZhihuPayload(response) {
     const text = await response.text();

package/src/providers/zoom/executors.d.ts

@@ -1,4 +1,6 @@
 import type { CredentialValidators, ProviderExecutors, ProviderProxyExecutor } from "../../core/types.ts";
+import type { IntegrationDefinition } from "../../triggers/common/integration.ts";
 export declare const executors: ProviderExecutors;
 export declare const proxy: ProviderProxyExecutor;
 export declare const credentialValidators: CredentialValidators;
+export declare const triggers: readonly IntegrationDefinition[];

package/src/providers/zoom/executors.js

@@ -1,5 +1,6 @@
 import { defineOAuthProviderExecutors, defineProviderProxy } from "../provider-runtime.js";
 import { fetchZoomCurrentAccount, zoomActionHandlers, zoomApiBaseUrl } from "./runtime.js";
+import { zoomRecordingReady } from "./trigger-on-recording-ready.js";
 const service = "zoom";
 export const executors = defineOAuthProviderExecutors(service, zoomActionHandlers);
 export const proxy = defineProviderProxy({
@@ -13,3 +14,4 @@ export const credentialValidators = {
         return fetchZoomCurrentAccount(input.accessToken, input.metadata, fetcher, signal);
     },
 };
+export const triggers = [zoomRecordingReady];

package/src/providers/zoom/trigger-on-recording-ready.d.ts

@@ -0,0 +1,2 @@
+import type { IntegrationDefinition } from "../../triggers/common/integration.ts";
+export declare const zoomRecordingReady: IntegrationDefinition;

package/src/providers/zoom/trigger-on-recording-ready.definition.d.ts

@@ -0,0 +1,4 @@
+import type { TriggerKeySnapshot } from "../../triggers/common/types.ts";
+export declare const snapshot: TriggerKeySnapshot & {
+    readonly type: "integration";
+};

package/src/providers/zoom/trigger-on-recording-ready.definition.js

@@ -0,0 +1,44 @@
+export const snapshot = {
+    key: "zoom.on_recording_ready",
+    provider: "zoom",
+    name: "on_recording_ready",
+    displayName: "Cloud Recording Ready",
+    description: "Receives completed cloud recordings hosted by the connected Zoom user through a verified application event source.",
+    definitionVersion: 2,
+    type: "integration",
+    endpoint: {
+        methods: ["POST"],
+        body: { formats: ["json"], allowArray: false, allowEmpty: false },
+        successStatus: 200,
+    },
+    configInputs: [
+        {
+            handle: "sourceId",
+            jsonSchema: { type: "string", pattern: "^source_[0-9a-f]{32}$", title: "Event source" },
+            nullable: false,
+        },
+        {
+            handle: "eventTypes",
+            jsonSchema: {
+                type: "array",
+                items: {
+                    type: "string",
+                    enum: ["recording.completed"],
+                },
+                minItems: 1,
+                maxItems: 1,
+                uniqueItems: true,
+                title: "Events",
+            },
+            nullable: false,
+            value: ["recording.completed"],
+        },
+    ],
+    outputs: [
+        { handle: "event", jsonSchema: { type: "string" }, nullable: false },
+        { handle: "deliveryId", jsonSchema: { type: "string" }, nullable: false },
+        { handle: "accountId", jsonSchema: { type: "string" }, nullable: false },
+        { handle: "meetingUuid", jsonSchema: { type: "string" }, nullable: false },
+        { handle: "body", jsonSchema: { type: "object" }, nullable: false },
+    ],
+};

package/src/providers/zoom/trigger-on-recording-ready.js

@@ -0,0 +1,39 @@
+import { PermanentIntegrationError } from "../../triggers/common/integration.js";
+import { isJsonObject } from "../../triggers/common/json.js";
+import { webhookRequest } from "../../triggers/managed-webhook.js";
+import { zoomApplication } from "../../triggers/sources/zoom.js";
+import { snapshot } from "./trigger-on-recording-ready.definition.js";
+export const zoomRecordingReady = {
+    snapshot,
+    eventSource: "zoom",
+    source: zoomApplication,
+    async sourceIdentity(context) {
+        const result = await webhookRequest(context, { method: "GET", endpoint: "/users/me" });
+        if (!context.connector.providerAccountId ||
+            !isJsonObject(result.data) ||
+            typeof result.data.id !== "string" ||
+            !result.data.id ||
+            typeof result.data.account_id !== "string" ||
+            !result.data.account_id)
+            throw new PermanentIntegrationError("Zoom did not return a verified user and account identity.");
+        return {
+            accountId: context.connector.providerAccountId,
+            userId: result.data.id,
+            zoomAccountId: result.data.account_id,
+        };
+    },
+    receive(context) {
+        if (context.eventSourceId !== context.config.sourceId)
+            return { outcome: "respond", status: 404, body: "", contentType: "text/plain" };
+        const payload = context.payload;
+        if (!isJsonObject(payload) ||
+            typeof payload.deliveryId !== "string" ||
+            !payload.deliveryId ||
+            !isJsonObject(payload.body))
+            throw new PermanentIntegrationError("Invalid shared Zoom event.");
+        return { outcome: "event", dedupeKey: payload.deliveryId, outputs: payload };
+    },
+    async reconcile() {
+        throw new PermanentIntegrationError("This deployment does not support shared Zoom event sources.");
+    },
+};

package/src/providers/zylvie/runtime.js

@@ -1,5 +1,5 @@
 import { optionalRecord, optionalString, requiredString } from "../../core/cast.js";
-import { createProviderTimeout, getProviderActionHandler, ProviderRequestError, providerUserAgent, requiredResponseRecord, } from "../provider-runtime.js";
+import { createProviderTimeout, getProviderActionHandler, ProviderRequestError, providerUserAgent, requiredResponseRecord, providerInputError, } from "../provider-runtime.js";
 export const zylvieApiBaseUrl = "https://api.zylvie.com";
 const productFieldMap = {
     title: "title",
@@ -144,7 +144,7 @@ const actionHandlers = {
 };
 export async function validateZylvieCredential(input, fetcher) {
     const payload = await requestZylvieJson({
-        apiKey: requiredString(input.apiKey, "apiKey", (message) => new ProviderRequestError(400, message)),
+        apiKey: requiredString(input.apiKey, "apiKey", providerInputError),
         path: "/me",
         method: "GET",
         fetcher,
@@ -240,13 +240,13 @@ function createRequestError(response, payload, phase) {
         return new ProviderRequestError(429, message);
     }
     if (phase === "validate" && response.status >= 400 && response.status < 500) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
     if (phase === "execute" && (response.status === 401 || response.status === 403)) {
         return new ProviderRequestError(401, message);
     }
     if ([400, 404, 409, 422].includes(response.status)) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
     return new ProviderRequestError(response.status || 500, message);
 }

package/src/saas/saas-cleanup-service.d.ts

@@ -1,8 +1,10 @@
+import type { ProviderNetworkPolicy } from "../core/provider-network-policy.ts";
 import type { RuntimeLogger } from "../core/types.ts";
 import type { ConnectionRequestStore } from "../server/storage/connection-request-store.ts";
 import type { SaasProjectStore } from "../server/storage/saas-project-store.ts";
 import { SaasClient } from "./saas-client.ts";
 export interface SaasCleanupServiceOptions {
+    network?: ProviderNetworkPolicy;
     store: SaasProjectStore;
     requests: ConnectionRequestStore;
     client?: SaasClient;

package/src/saas/saas-cleanup-service.js

@@ -1,3 +1,4 @@
+import { withProviderNetworkPolicy } from "../core/provider-network-policy.js";
 import { SaasClient, SaasError } from "./saas-client.js";
 /** Resumable deletion of ordinary SaaS accounts; never creates or reconnects an account. */
 export class SaasCleanupService {
@@ -14,7 +15,7 @@ export class SaasCleanupService {
     run() {
         if (this.shutdown.signal.aborted)
             return Promise.resolve();
-        this.pending ??= this.runBatch()
+        this.pending ??= withProviderNetworkPolicy(this.options.network ?? {}, () => this.runBatch())
             .catch(() => {
             this.options.logger?.warn({ errorCode: "saas_cleanup_failed" }, "SaaS cleanup batch failed; pending work is retained");
         })

package/src/saas/saas-execution-service.d.ts

@@ -1,4 +1,4 @@
-import type { SaasConnectionReference } from "../connection-service.ts";
+import type { SaasConnectionReference } from "../connection-store.ts";
 import type { SaasActionResult, SaasProxyResult } from "./saas-client.ts";
 import type { SaasProjectService } from "./saas-project-service.ts";
 import { SaasClient } from "./saas-client.ts";

package/src/server/actions/action-runner.js

@@ -1,4 +1,4 @@
-import { ConnectionError } from "../../connection-service.js";
+import { ConnectionError } from "../../connection-error.js";
 import { executeAction as executeProviderAction } from "../../core/execution.js";
 import { withProviderHttpDispatch } from "../../core/provider-http-dispatch.js";
 import { ProviderDispatchRequestError, toProviderExecutionError, withProviderHttpDispatchResult, } from "../../providers/provider-runtime.js";

package/src/server/api/action-example.js

@@ -33,6 +33,14 @@ export function buildExampleInput(schema) {
             }
         }
     }
+    // De Morgan's law exposes positive choices encoded as not(allOf(not(...))).
+    if (isSchemaObject(seedSchema.not) && Array.isArray(seedSchema.not.allOf)) {
+        const members = seedSchema.not.allOf;
+        if (members.length > 0 && members.every((member) => isSchemaObject(member) && isSchemaObject(member.not))) {
+            const choices = members.map((member) => member.not);
+            seedRequirementBranches({ ...seedSchema, not: undefined, anyOf: choices }, properties, input);
+        }
+    }
     applyConditionalRequirements(seedSchema, seedSchema, input);
     return input;
 }
@@ -293,7 +301,10 @@ function stringExample(schema) {
     const minLength = typeof schema.minLength === "number" && schema.minLength > 0 ? schema.minLength : 0;
     const maxLength = typeof schema.maxLength === "number" ? schema.maxLength : undefined;
     if (typeof schema.format === "string") {
-        return formatStringExample(schema.format, minLength, maxLength);
+        const formatted = formatStringExample(schema.format, minLength, maxLength);
+        if (new Validator(schema, "2020-12").validate(formatted).valid) {
+            return formatted;
+        }
     }
     if (typeof schema.pattern === "string") {
         const sample = samplePattern(schema.pattern, { minLength });

package/src/server/api/auth.js

@@ -102,6 +102,9 @@ function isPublicPath(path, method) {
         (method === "GET" && path === "/api/auth/session") ||
         (method === "POST" && path === "/api/auth/logout") ||
         (method === "GET" && path.startsWith("/api/files/")) ||
+        // This route performs its own dedicated bearer check; the global admin/runtime
+        // middleware must not require a different token.
+        (method === "POST" && path === "/v1/providers/slackbot/events/verify") ||
         isConsoleShellRequest(path, method));
 }
 export async function readLocalAuthSession(context, options) {

package/src/server/api/connection-routes.js

@@ -1,5 +1,5 @@
 import { Hono } from "hono";
-import { ConnectionError } from "../../connection-service.js";
+import { ConnectionError } from "../../connection-error.js";
 import { OAuthClientConfigError } from "../../oauth/oauth-client-config-service.js";
 import { OAuthFlowError } from "../../oauth/oauth-flow-service.js";
 import { SaasError } from "../../saas/saas-client.js";

package/src/server/api/console-catalog-routes.js

@@ -1,5 +1,5 @@
 import { Hono } from "hono";
-import { ConnectionError } from "../../connection-service.js";
+import { ConnectionError } from "../../connection-error.js";
 import { searchActions } from "../../core/action-search.js";
 import { renderActionMarkdown } from "./action-markdown.js";
 import { jsonError, notFound, readConnectionName as defaultReadConnectionName } from "./http-utils.js";

package/src/server/api/console-oauth-routes.d.ts

@@ -12,7 +12,9 @@ export interface ConsoleOAuthRoutesOptions {
     saasProject?: SaasProjectService;
     logger?: RuntimeLogger;
     oauthCloseDelaySeconds?: number;
+    /** Origins a provider-refusal page may post its result to (`OOMOL_CONNECT_OAUTH_RESULT_ORIGINS`). */
+    oauthResultOrigins?: readonly string[];
     readConnectionName?: (context: Context, body?: Record<string, unknown>) => string | undefined;
 }
 /** Console connection management and OAuth client configuration / authorization routes. */
-export declare function createConsoleOAuthRoutes({ connections, oauthFlow, oauthClientConfigs, saasProject, logger, oauthCloseDelaySeconds, readConnectionName, }: ConsoleOAuthRoutesOptions): Hono;
+export declare function createConsoleOAuthRoutes({ connections, oauthFlow, oauthClientConfigs, saasProject, logger, oauthCloseDelaySeconds, oauthResultOrigins, readConnectionName, }: ConsoleOAuthRoutesOptions): Hono;

package/src/server/api/console-oauth-routes.js

@@ -1,10 +1,10 @@
 import { Hono } from "hono";
-import { ConnectionError } from "../../connection-service.js";
+import { ConnectionError } from "../../connection-error.js";
 import { optionalBoolean, optionalRecord, optionalString, requiredRawString, requiredString, requiredStringArray, } from "../../core/cast.js";
 import { OAuthClientConfigError } from "../../oauth/oauth-client-config-service.js";
 import { OAuthCallbackError, OAuthFlowError } from "../../oauth/oauth-flow-service.js";
 import { HttpRequestError, jsonError, readConnectionName as defaultReadConnectionName, readJsonBody, } from "./http-utils.js";
-import { renderOAuthCompletionPage } from "./oauth-completion-page.js";
+import { oauthProviderErrorCode, renderOAuthCompletionPage, renderOAuthRefusedPage } from "./oauth-completion-page.js";
 function readOAuthClientConfigInput(body) {
     const keys = ["clientId", "clientSecret", "requestedScopes", "redirectUri", "extra", "secretExtra"];
     if (!keys.some((key) => key in body)) {
@@ -31,7 +31,7 @@ function readOptionalStringArray(body, fieldName) {
     return requiredStringArray(body[fieldName], fieldName, (message) => new HttpRequestError("invalid_input", `${message}.`));
 }
 /** Console connection management and OAuth client configuration / authorization routes. */
-export function createConsoleOAuthRoutes({ connections, oauthFlow, oauthClientConfigs, saasProject, logger, oauthCloseDelaySeconds, readConnectionName = defaultReadConnectionName, }) {
+export function createConsoleOAuthRoutes({ connections, oauthFlow, oauthClientConfigs, saasProject, logger, oauthCloseDelaySeconds, oauthResultOrigins = [], readConnectionName = defaultReadConnectionName, }) {
     const app = new Hono();
     const writeConnectionResult = async (context, operation, logContext) => {
         try {
@@ -149,7 +149,7 @@ export function createConsoleOAuthRoutes({ connections, oauthFlow, oauthClientCo
         return writeOAuthResult(context, oauthClientConfigs.upsertConfig({
             service,
             clientId: optionalString(body.clientId) ?? "",
-            clientSecret: optionalString(body.clientSecret) ?? "",
+            clientSecret: readOptionalRawString(body, "clientSecret"),
             requestedScopes: readOptionalStringArray(body, "requestedScopes"),
             redirectUri: readOptionalRawString(body, "redirectUri"),
             extra: optionalRecord(body.extra),
@@ -243,14 +243,27 @@ export function createConsoleOAuthRoutes({ connections, oauthFlow, oauthClientCo
                 : undefined;
             if (returnUri)
                 return context.redirect(returnUri);
-            const providerErrorDescription = context.req.query("error_description");
+            // A runtime authorization (`POST /api/oauth/authorizations`) has no
+            // return address: it was opened in a popup. End the authorization so it
+            // cannot complete later, and give the popup a page that tells the person
+            // what happened and, for an allowed opener, posts the result.
+            const errorCode = oauthProviderErrorCode(providerError);
+            // Only a refusal that ended a pending authorization names its state, so
+            // a late duplicate callback for a state another callback already
+            // completed cannot tell the opener that the authorization failed.
+            const discarded = state ? await oauthFlow.discardAuthorization(state) : false;
             logger?.warn({
                 ...logContext,
                 errorCode: "oauth_provider_error",
-                providerError,
-                providerErrorDescription,
-            }, "oauth callback failed");
-            return jsonError(context, 400, "oauth_provider_error", `OAuth provider returned error "${providerError}"${providerErrorDescription ? `: ${providerErrorDescription}` : "."}`);
+                providerError: errorCode,
+                providerErrorDescription: context.req.query("error_description"),
+            }, "oauth callback refused by provider");
+            return context.html(renderOAuthRefusedPage({
+                code: errorCode,
+                state: discarded ? state : undefined,
+                resultOrigins: oauthResultOrigins,
+                closeDelaySeconds: oauthCloseDelaySeconds,
+            }));
         }
         if (!state || !code) {
             if (state)

package/src/server/api/oauth-completion-page.d.ts

@@ -18,6 +18,10 @@ export declare const oauthCompletionStrings: {
         network: string;
         notFound: string;
         forbidden: string;
+        refusedBadge: string;
+        cancelledTitle: string;
+        refusedTitle: string;
+        refusedBody: string;
     };
     "zh-CN": {
         badge: string;
@@ -38,6 +42,10 @@ export declare const oauthCompletionStrings: {
         network: string;
         notFound: string;
         forbidden: string;
+        refusedBadge: string;
+        cancelledTitle: string;
+        refusedTitle: string;
+        refusedBody: string;
     };
     "zh-TW": {
         badge: string;
@@ -58,6 +66,10 @@ export declare const oauthCompletionStrings: {
         network: string;
         notFound: string;
         forbidden: string;
+        refusedBadge: string;
+        cancelledTitle: string;
+        refusedTitle: string;
+        refusedBody: string;
     };
     ja: {
         badge: string;
@@ -78,6 +90,10 @@ export declare const oauthCompletionStrings: {
         network: string;
         notFound: string;
         forbidden: string;
+        refusedBadge: string;
+        cancelledTitle: string;
+        refusedTitle: string;
+        refusedBody: string;
     };
     fr: {
         badge: string;
@@ -98,6 +114,10 @@ export declare const oauthCompletionStrings: {
         network: string;
         notFound: string;
         forbidden: string;
+        refusedBadge: string;
+        cancelledTitle: string;
+        refusedTitle: string;
+        refusedBody: string;
     };
     ru: {
         badge: string;
@@ -118,6 +138,10 @@ export declare const oauthCompletionStrings: {
         network: string;
         notFound: string;
         forbidden: string;
+        refusedBadge: string;
+        cancelledTitle: string;
+        refusedTitle: string;
+        refusedBody: string;
     };
 };
 export declare const oauthCompletionStyles = "\n:root {\n  --background: hsl(0 0% 100%);\n  --foreground: hsl(222.2 84% 4.9%);\n  --card: hsl(0 0% 100%);\n  --card-foreground: hsl(222.2 84% 4.9%);\n  --muted: hsl(210 40% 96.1%);\n  --muted-foreground: hsl(215.4 16.3% 46.9%);\n  --border: hsl(214.3 31.8% 91.4%);\n  --primary: hsl(222.2 47.4% 11.2%);\n  --primary-foreground: hsl(210 40% 98%);\n  --ring: hsl(222.2 84% 4.9%);\n}\n* {\n  box-sizing: border-box;\n}\nbody {\n  min-height: 100vh;\n  margin: 0;\n  display: grid;\n  place-items: center;\n  padding: 24px;\n  background: var(--background);\n  color: var(--foreground);\n  font-family: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif;\n}\n.card {\n  width: min(100%, 420px);\n  padding: 24px;\n  border: 1px solid var(--border);\n  border-radius: 12px;\n  background: var(--card);\n  color: var(--card-foreground);\n  box-shadow: 0 1px 2px hsl(222.2 84% 4.9% / 0.04), 0 12px 32px hsl(222.2 84% 4.9% / 0.08);\n}\n.header {\n  display: flex;\n  flex-direction: column;\n  gap: 8px;\n}\n.badge {\n  width: fit-content;\n  display: inline-flex;\n  align-items: center;\n  border: 1px solid transparent;\n  border-radius: 999px;\n  padding: 2px 10px;\n  background: var(--primary);\n  color: var(--primary-foreground);\n  font-size: 12px;\n  font-weight: 600;\n  line-height: 20px;\n}\nh1 {\n  margin: 0;\n  font-size: 20px;\n  line-height: 28px;\n  font-weight: 600;\n}\np {\n  margin: 0;\n  color: var(--muted-foreground);\n  font-size: 14px;\n  line-height: 22px;\n}\ncode {\n  border-radius: 6px;\n  background: var(--muted);\n  padding: 2px 6px;\n  color: var(--foreground);\n  font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, \"Liberation Mono\", monospace;\n  font-size: 13px;\n}\n.actions {\n  display: flex;\n  align-items: center;\n  justify-content: space-between;\n  gap: 12px;\n  flex-wrap: wrap;\n  margin-top: 24px;\n}\n.button {\n  appearance: none;\n  border: 1px solid var(--border);\n  border-radius: 8px;\n  background: var(--card);\n  color: var(--foreground);\n  padding: 8px 14px;\n  font: inherit;\n  font-size: 14px;\n  font-weight: 500;\n  line-height: 20px;\n  cursor: pointer;\n}\n.button:focus-visible {\n  outline: 2px solid var(--ring);\n  outline-offset: 2px;\n}\n.button:hover {\n  background: var(--muted);\n}\n.close-note {\n  font-size: 12px;\n  line-height: 18px;\n}\n\n[hidden]{display:none!important}\n.button:disabled{opacity:.5;cursor:wait}\na.button{text-decoration:none}\n.actions{justify-content:flex-start}\n";
@@ -125,3 +149,36 @@ export declare const oauthCompletionLocaleScript = "const pick=()=>{try{const st
 /** Seconds the OAuth completion page counts down before it tries to close its window. */
 export declare const DEFAULT_OAUTH_CLOSE_DELAY_SECONDS = 5;
 export declare function renderOAuthCompletionPage(service: string, closeDelaySeconds?: number): string;
+/** The `type` of the message a refusal page posts to the window that opened it. */
+export declare const oauthRefusedType = "oauth.refused";
+/**
+ * Reads the origins a refusal page may post its result to: a comma-separated
+ * list of exact HTTP(S) origins. `*` and anything that is not an origin are
+ * rejected, so the result can never be broadcast to an arbitrary opener.
+ */
+export declare function parseOAuthResultOrigins(value: string | undefined): string[];
+/**
+ * The same rules for origins given as a list, such as the `oauthResultOrigins`
+ * runtime option: blank entries are skipped and duplicates dropped; anything
+ * that is not an exact http(s) origin, `*` included, throws.
+ */
+export declare function normalizeOAuthResultOrigins(entries: readonly string[]): string[];
+/** A provider error code that is safe to echo: short and code-shaped, else `provider_error`. */
+export declare function oauthProviderErrorCode(providerError: string): string;
+export interface OAuthRefusedPageInput {
+    /** The provider's error code, already passed through `oauthProviderErrorCode`. */
+    code: string;
+    /** The state of the refused authorization; set only when this callback ended a pending one. */
+    state?: string;
+    /** Origins allowed to receive the result; empty means the page posts nothing. */
+    resultOrigins: readonly string[];
+    closeDelaySeconds?: number;
+}
+/**
+ * The page a provider's refusal lands on when the authorization has no return
+ * address. When this window was opened by a page on an allowed origin, it
+ * posts `{ type: "oauth.refused", status, code, state }` to that origin only;
+ * either way the shared countdown closes it after `closeDelaySeconds`. Success is never
+ * reported this way: the opener learns it from its own server.
+ */
+export declare function renderOAuthRefusedPage(input: OAuthRefusedPageInput): string;