@oomol-lab/open-connector 1.9.2 → 1.9.3

package/src/credential-resolver.js

@@ -0,0 +1,131 @@
+import { ConnectionError } from "./connection-error.js";
+import { withProviderHttpDispatchResult } from "./providers/provider-runtime.js";
+const OAUTH_REFRESH_PERSIST_ATTEMPTS = 3;
+/**
+ * Lays a refresh result onto the connection's current credential. A refresh owns the token
+ * fields and the metadata keys it changed; everything else on `current` belongs to whoever
+ * bumped the revision and is kept.
+ */
+function mergeRefreshedOAuthCredential(current, spent, refreshed) {
+    const metadata = { ...current.metadata };
+    for (const [key, value] of Object.entries(refreshed.metadata)) {
+        if (JSON.stringify(value) !== JSON.stringify(spent.metadata[key]))
+            metadata[key] = value;
+    }
+    // A successful refresh proves the authorization is live, so a concurrent refusal's mark is stale.
+    delete metadata.oauthReauthRequired;
+    return {
+        ...current,
+        accessToken: refreshed.accessToken,
+        tokenType: refreshed.tokenType,
+        expiresAt: refreshed.expiresAt,
+        refreshToken: refreshed.refreshToken,
+        providerSecret: refreshed.providerSecret,
+        metadata,
+    };
+}
+/** Resolves stored credentials and owns refresh coalescing and revision-safe persistence. */
+export class CredentialResolver {
+    store;
+    oauthCredentials;
+    providerHttpDispatch;
+    oauthCredentialRefreshes = new Map();
+    constructor(options) {
+        this.store = options.store;
+        this.oauthCredentials = options.oauthCredentials;
+        this.providerHttpDispatch = options.providerHttpDispatch;
+    }
+    async resolve(connection) {
+        return connection.credential.authType === "oauth2"
+            ? this.resolveOAuthCredential(connection, connection.credential)
+            : connection.credential;
+    }
+    async resolveOAuthCredential(connection, credential) {
+        const service = connection.service;
+        if (credential.metadata.oauthReauthRequired === true) {
+            throw new ConnectionError("oauth_reauth_required", `OAuth authorization is no longer valid. Reconnect ${service}.`);
+        }
+        if (!isOAuthCredentialExpired(credential)) {
+            return credential;
+        }
+        if (!credential.refreshToken) {
+            throw new ConnectionError("oauth_token_expired", `${service} OAuth access token expired and no refresh token is available. Reconnect ${service}.`);
+        }
+        if (!this.oauthCredentials) {
+            throw new ConnectionError("oauth_refresh_unavailable", `${service} OAuth access token expired and this runtime cannot refresh it.`);
+        }
+        // Single-flight on the refresh token being spent, not the row revision: a single-use
+        // (rotating) refresh token must reach the provider once even when an unrelated write
+        // bumps the revision mid-refresh. A new authorization must refresh independently,
+        // even when the provider reuses the same refresh token across reconnects.
+        const refreshKey = JSON.stringify([
+            connection.id,
+            credential.refreshToken,
+            credential.metadata.oauthAuthorizationId,
+        ]);
+        const currentRefresh = this.oauthCredentialRefreshes.get(refreshKey);
+        if (currentRefresh) {
+            return currentRefresh;
+        }
+        const refresh = this.refreshOAuthCredential(connection, credential, this.oauthCredentials);
+        this.oauthCredentialRefreshes.set(refreshKey, refresh);
+        try {
+            return await refresh;
+        }
+        finally {
+            if (this.oauthCredentialRefreshes.get(refreshKey) === refresh) {
+                this.oauthCredentialRefreshes.delete(refreshKey);
+            }
+        }
+    }
+    async refreshOAuthCredential(connection, credential, refresher) {
+        const { id, revision, service, connectionName } = connection;
+        let nextCredential;
+        try {
+            nextCredential = await withProviderHttpDispatchResult({ operation: "oauth", service, connectionId: id, connectionName }, () => refresher.refresh(service, credential), this.providerHttpDispatch);
+        }
+        catch (error) {
+            if (error instanceof ConnectionError && error.code === "oauth_reauth_required") {
+                // The revision fence prevents a late refusal from marking a replacement authorization as expired.
+                await this.store.updateCredential({
+                    id,
+                    revision,
+                    service,
+                    connectionName,
+                    credential: { ...credential, metadata: { ...credential.metadata, oauthReauthRequired: true } },
+                }, true);
+            }
+            throw error;
+        }
+        // The provider has now spent the old refresh token. With rotating single-use refresh
+        // tokens, discarding `nextCredential` loses the connection for good, so a lost
+        // revision race re-reads the row and lands the refreshed token fields on the latest
+        // revision, as long as that row still holds the credential this refresh spent.
+        let target = { ...connection, source: "local", credential: nextCredential };
+        for (let attempt = 0; attempt < OAUTH_REFRESH_PERSIST_ATTEMPTS; attempt++) {
+            if (await this.store.updateCredential(target, true))
+                return target.credential;
+            const current = await this.store.get(service, connectionName);
+            if (current?.source === "saas" ||
+                current?.id !== id ||
+                current.credential.authType !== "oauth2" ||
+                current.credential.refreshToken !== credential.refreshToken ||
+                current.credential.metadata.oauthAuthorizationId !== credential.metadata.oauthAuthorizationId) {
+                // Deleted, converted, reconnected, or already rotated elsewhere: never overwrite it.
+                break;
+            }
+            target = {
+                ...current,
+                credential: mergeRefreshedOAuthCredential(current.credential, credential, nextCredential),
+            };
+        }
+        throw new ConnectionError("connection_not_found", `${service} connection changed while its OAuth credential was refreshing. Retry the action.`);
+    }
+}
+export function isOAuthCredentialExpired(credential) {
+    if (!credential.expiresAt) {
+        return false;
+    }
+    const expiresAt = Date.parse(credential.expiresAt);
+    return Number.isFinite(expiresAt) && expiresAt <= Date.now() + 60_000;
+}

package/src/mcp.js

@@ -1,6 +1,6 @@
 import { createMcpHandler, McpServer } from "@modelcontextprotocol/server";
 import * as z from "zod/v4";
-import { ConnectionError } from "./connection-service.js";
+import { ConnectionError } from "./connection-error.js";
 import { createActionSearchIndexProvider, searchActions as searchActionIndex } from "./core/action-search.js";
 import { describeSchemaType, readSchemaProperties, readSchemaRequired } from "./core/json-schema.js";
 import { renderActionMarkdown } from "./server/api/action-markdown.js";

package/src/oauth/oauth-client-config-service.d.ts

@@ -20,7 +20,7 @@ export type OAuthClientConfig = {
 };
 export interface OAuthClientConfigInput {
     clientId: string;
-    clientSecret: string;
+    clientSecret?: string;
     /** Non-empty provider-declared scope subset to request. Omit to use every provider default. */
     requestedScopes?: string[];
     /** Absolute redirect URI override, any scheme. Omit to use the runtime callback. */

package/src/oauth/oauth-client-config-service.js

@@ -34,14 +34,26 @@ export class OAuthClientConfigService {
         return normalizeStoredOAuthClientConfig(await this.store.get(service));
     }
     async upsertConfig(input) {
-        const config = this.normalizeConfig(input.service, input);
+        const previous = await this.getConfig(input.service);
+        const sameClient = previous?.clientId === input.clientId.trim();
+        const secretExtra = sameClient ? { ...previous?.secretExtra } : {};
+        for (const field of filterClientConfigFields(this.getOAuthDefinition(input.service).clientConfigFields, "secretExtra")) {
+            if (input.extra && field.key in input.extra)
+                secretExtra[field.key] = input.extra[field.key];
+        }
+        Object.assign(secretExtra, input.secretExtra);
+        const config = this.normalizeConfig(input.service, {
+            ...input,
+            clientSecret: input.clientSecret ?? (sameClient ? previous?.clientSecret : undefined),
+            secretExtra,
+        });
         await this.store.set(config);
         return this.toSummary(input.service, this.getOAuthDefinition(input.service), config);
     }
     normalizeConfig(service, input) {
         const auth = this.getOAuthDefinition(service);
         const clientId = input.clientId.trim();
-        const clientSecret = input.clientSecret.trim();
+        const clientSecret = (input.clientSecret ?? "").trim();
         if (!clientId) {
             throw new OAuthClientConfigError("invalid_input", "clientId is required.");
         }

package/src/oauth/oauth-credential-refresh-service.js

@@ -1,4 +1,4 @@
-import { ConnectionError } from "../connection-service.js";
+import { ConnectionError } from "../connection-error.js";
 import { optionalRecord, stringRecord } from "../core/cast.js";
 import { providerFetch } from "../providers/provider-runtime.js";
 import { readOAuthClientConfigMetadata } from "./oauth-client-config-service.js";

package/src/oauth/oauth-flow-service.d.ts

@@ -1,4 +1,5 @@
-import type { StoredConnection, ConnectionService } from "../connection-service.ts";
+import type { ConnectionService } from "../connection-service.ts";
+import type { StoredConnection } from "../connection-store.ts";
 import type { IProviderLoader } from "../providers/provider-loader.ts";
 import type { SaasOAuthService } from "../saas/saas-oauth-service.ts";
 import type { ISecretCodec } from "../server/secrets/secret-codec-core.ts";
@@ -81,6 +82,13 @@ export declare class OAuthFlowService {
     startConnectionRequest(input: OAuthConnectionRequestInput): Promise<OAuthConnectionRequestStart>;
     getConnectionRequest(id: string, owner: string): Promise<ConnectionRequest | undefined>;
     rejectAuthorization(state: string, denied: boolean): Promise<string | undefined>;
+    /**
+     * Ends a runtime authorization (`POST /api/oauth/authorizations`) that the
+     * provider refused, so a later callback for the same state cannot complete
+     * it. Returns false when no such authorization was pending (unknown, or
+     * already completed or refused by another callback).
+     */
+    discardAuthorization(state: string): Promise<boolean>;
     private prepareAuthorization;
     completeAuthorization(input: OAuthAuthorizationCompleteInput): Promise<{
         service: string;

package/src/oauth/oauth-flow-service.js

@@ -1,5 +1,6 @@
 import { createHash, randomBytes } from "node:crypto";
-import { ConnectionError, normalizeConnectionName } from "../connection-service.js";
+import { ConnectionError } from "../connection-error.js";
+import { normalizeConnectionName } from "../connection-service.js";
 import { providerFetch, ProviderDispatchRequestError, withProviderHttpDispatchResult, } from "../providers/provider-runtime.js";
 import { requestAuthorizationCodeToken } from "./oauth-token.js";
 /**
@@ -97,6 +98,15 @@ export class OAuthFlowService {
         await this.requests.fail(pending.connectionRequestId, denied ? "invalid_input" : "provider_error", denied ? "Authorization was denied." : "OAuth connection failed.");
         return callbackReturnUri(pending, "error", denied ? "invalid_input" : "provider_error", denied ? "Authorization was denied." : "OAuth connection failed.");
     }
+    /**
+     * Ends a runtime authorization (`POST /api/oauth/authorizations`) that the
+     * provider refused, so a later callback for the same state cannot complete
+     * it. Returns false when no such authorization was pending (unknown, or
+     * already completed or refused by another callback).
+     */
+    async discardAuthorization(state) {
+        return (await this.states.take(state)) !== undefined;
+    }
     async prepareAuthorization(input, requestConfig) {
         const { service } = input;
         const connectionName = normalizeConnectionName(input.connectionName);

package/src/providers/abuseipdb/executors.js

@@ -1,9 +1,8 @@
 import { isIP } from "node:net";
 import { nullableString, optionalBoolean, optionalInteger, optionalRecord, optionalString } from "../../core/cast.js";
-import { defineProviderExecutors, defineProviderProxy, isAbortLikeError, providerUserAgent, ProviderRequestError, requireApiKeyCredential, requiredResponseRecord, } from "../provider-runtime.js";
+import { defineProviderExecutors, defineProviderProxy, isAbortLikeError, providerUserAgent, ProviderRequestError, requireApiKeyCredential, requiredResponseRecord, defaultProviderRequestTimeoutMs, } from "../provider-runtime.js";
 const service = "abuseipdb";
 const abuseipdbApiBaseUrl = "https://api.abuseipdb.com/api/v2";
-const abuseipdbDefaultRequestTimeoutMs = 30_000;
 const abuseipdbValidationIpAddress = "8.8.8.8";
 export const abuseipdbActionHandlers = {
     check_ip(input, context) {
@@ -182,8 +181,8 @@ async function requestAbuseipdbJson(input) {
     let response;
     let payload;
     const signal = input.context.signal
-        ? AbortSignal.any([input.context.signal, AbortSignal.timeout(abuseipdbDefaultRequestTimeoutMs)])
-        : AbortSignal.timeout(abuseipdbDefaultRequestTimeoutMs);
+        ? AbortSignal.any([input.context.signal, AbortSignal.timeout(defaultProviderRequestTimeoutMs)])
+        : AbortSignal.timeout(defaultProviderRequestTimeoutMs);
     try {
         response = await input.context.fetcher(buildAbuseipdbUrl(input.path, input.query ?? {}), {
             method: "GET",

package/src/providers/action-contracts.generated.d.ts

@@ -52,6 +52,7 @@ export interface ProviderActionNames {
     aliyun_oss: "list_buckets" | "list_objects" | "head_object" | "download_object" | "put_object" | "delete_object" | "generate_presigned_url";
     aliyun_sls: "list_projects" | "list_projects_across_regions" | "list_logstores" | "query_logs" | "get_histograms";
     aliyun_sts: "assume_role";
+    allratestoday: "get_latest_rates" | "convert";
     alpaca: "get_account" | "list_assets" | "get_asset" | "list_positions" | "get_position" | "list_orders" | "get_order" | "get_market_clock" | "list_watchlists" | "get_watchlist" | "list_account_activities" | "get_account_config" | "get_account_portfolio_history" | "get_market_calendar" | "list_corporate_actions" | "get_stock_bars" | "get_crypto_bars" | "list_option_contracts" | "get_option_contract" | "get_stock_snapshots" | "get_crypto_snapshots" | "list_news";
     alpha_vantage: "search_symbols" | "get_global_quote" | "get_intraday_time_series" | "get_daily_time_series" | "get_daily_adjusted_time_series" | "get_weekly_time_series" | "get_weekly_adjusted_time_series" | "get_monthly_time_series" | "get_monthly_adjusted_time_series" | "get_realtime_bulk_quotes" | "get_top_gainers_losers" | "get_market_status" | "get_currency_exchange_rate" | "get_fx_intraday" | "get_fx_daily" | "get_fx_weekly" | "get_fx_monthly" | "get_crypto_intraday" | "get_digital_currency_daily" | "get_digital_currency_weekly" | "get_digital_currency_monthly" | "get_company_overview" | "get_etf_profile" | "get_income_statement" | "get_balance_sheet" | "get_cash_flow" | "get_earnings" | "get_earnings_estimates" | "get_listing_status" | "get_earnings_calendar" | "get_ipo_calendar" | "get_dividends" | "get_splits" | "get_insider_transactions" | "get_institutional_holdings" | "get_earnings_call_transcript" | "get_historical_options" | "get_realtime_options" | "get_news_sentiment" | "get_sector_performance" | "get_commodity_data" | "get_macro_indicator" | "get_technical_indicator" | "call_official_function";
     alt_text_ai: "get_account" | "create_image" | "list_images" | "get_image" | "search_images" | "delete_image" | "scrape_page";

package/src/providers/addressfinder/executors.js

@@ -1,8 +1,7 @@
 import { compactObject, optionalBoolean, optionalBooleanOrNull, optionalInteger, optionalRecord, optionalString, } from "../../core/cast.js";
-import { defineProviderExecutors, defineProviderProxy, isAbortLikeError, providerUserAgent, ProviderRequestError, requireApiKeyCredential, } from "../provider-runtime.js";
+import { defineProviderExecutors, defineProviderProxy, isAbortLikeError, providerUserAgent, ProviderRequestError, requireApiKeyCredential, defaultProviderRequestTimeoutMs, } from "../provider-runtime.js";
 const service = "addressfinder";
 const addressfinderApiBaseUrl = "https://api.addressfinder.io/api/";
-const addressfinderDefaultRequestTimeoutMs = 30_000;
 const addressfinderValidationEndpoint = "/nz/address/autocomplete";
 export const addressfinderActionHandlers = {
     find_au_addresses(input, context) {
@@ -182,7 +181,7 @@ async function requestAndWrapAddressfinderJson(input) {
     return input.normalize(payload);
 }
 async function requestAddressfinderJson(input) {
-    const timeoutSignal = AbortSignal.timeout(addressfinderDefaultRequestTimeoutMs);
+    const timeoutSignal = AbortSignal.timeout(defaultProviderRequestTimeoutMs);
     const signal = input.signal ? AbortSignal.any([input.signal, timeoutSignal]) : timeoutSignal;
     try {
         const response = await input.fetcher(buildAddressfinderUrl(input.path, input.apiKey, input.query), {

package/src/providers/aeroleads/executors.js

@@ -1,5 +1,5 @@
 import { optionalRecord, optionalString } from "../../core/cast.js";
-import { defineProviderExecutors, defineProviderProxy, providerUserAgent, ProviderRequestError, requireApiKeyCredential, } from "../provider-runtime.js";
+import { defineProviderExecutors, defineProviderProxy, providerUserAgent, ProviderRequestError, requireApiKeyCredential, providerInputError, providerResponseError, } from "../provider-runtime.js";
 const service = "aeroleads";
 const aeroleadsApiBaseUrl = "https://aeroleads.com";
 const linkedinDetailsPath = "/api/get_linkedin_details";
@@ -170,7 +170,7 @@ function mapAeroleadsError(status, message) {
         return new ProviderRequestError(status, message);
     }
     if (status >= 400 && status < 500) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
-    return new ProviderRequestError(502, message);
+    return providerResponseError(message);
 }

package/src/providers/affinity/runtime.js

@@ -1,8 +1,7 @@
 import { compactObject, nullableString, optionalRecord, optionalString } from "../../core/cast.js";
-import { isAbortLikeError, providerUserAgent, ProviderRequestError } from "../provider-runtime.js";
+import { isAbortLikeError, providerUserAgent, ProviderRequestError, providerInputError, providerResponseError, defaultProviderRequestTimeoutMs, } from "../provider-runtime.js";
 export const affinityApiBaseUrl = "https://api.affinity.co";
 export const affinityValidationPath = "/v2/auth/whoami";
-const affinityRequestTimeoutMs = 30_000;
 export const affinityActionHandlers = {
     get_current_user(_input, context) {
         return getCurrentUser(context);
@@ -186,7 +185,7 @@ async function affinityRequest(path, query, apiKey, fetcher, mode, signal) {
         }
         url.searchParams.set(key, value);
     }
-    const timeoutSignal = AbortSignal.timeout(affinityRequestTimeoutMs);
+    const timeoutSignal = AbortSignal.timeout(defaultProviderRequestTimeoutMs);
     const requestSignal = signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal;
     let response;
     try {
@@ -233,18 +232,18 @@ function buildAffinityError(status, payload, mode) {
         return new ProviderRequestError(429, message);
     }
     if (mode === "validation" && status === 401) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
     if (mode === "execution" && (status === 401 || status === 403)) {
         return new ProviderRequestError(status, message);
     }
     if (status === 404) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
     if (status >= 400 && status < 500) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
-    return new ProviderRequestError(502, message);
+    return providerResponseError(message);
 }
 function extractAffinityErrorMessage(payload) {
     if (typeof payload === "string" && payload.trim().length > 0) {

package/src/providers/aftership/executors.js

@@ -1,6 +1,6 @@
 import { CastError, compactObject, optionalRecord, optionalString } from "../../core/cast.js";
 import { encodePathSegment } from "../../core/request.js";
-import { createProviderFetch, defineProviderProxy, ProviderRequestError, providerUserAgent, requireApiKeyCredential, toProviderExecutionError, } from "../provider-runtime.js";
+import { createProviderFetch, defineProviderProxy, ProviderRequestError, providerUserAgent, requireApiKeyCredential, toProviderExecutionError, providerInputError, } from "../provider-runtime.js";
 const service = "aftership";
 const aftershipApiBaseUrl = "https://api.aftership.com/tracking/2026-01";
 const aftershipFetch = createProviderFetch({ skipDnsValidation: true });
@@ -172,7 +172,7 @@ function createAftershipError(response, payload, phase) {
     const message = readAftershipErrorMessage(payload) ?? `AfterShip API request failed with status ${response.status}`;
     if (response.status === 401 || response.status === 403) {
         if (phase === "validate") {
-            return new ProviderRequestError(400, message);
+            return providerInputError(message);
         }
         return new ProviderRequestError(response.status, message, payload);
     }

package/src/providers/agent_mail/runtime.js

@@ -1,5 +1,5 @@
 import { compactObject, optionalInteger, optionalRecord, optionalString } from "../../core/cast.js";
-import { mapProviderActionHandlers, providerUserAgent, ProviderRequestError } from "../provider-runtime.js";
+import { mapProviderActionHandlers, providerUserAgent, ProviderRequestError, providerInputError, } from "../provider-runtime.js";
 import { agentMailOperations } from "./actions.js";
 export const agentMailApiBaseUrl = "https://api.agentmail.to";
 export const agentMailActionHandlers = mapProviderActionHandlers("agent_mail", agentMailOperations, ({ operation }) => (input, context) => executeAgentMailOperation(input, context, operation));
@@ -147,7 +147,7 @@ function createAgentMailError(response, payload, phase, notFoundAsInvalidInput =
         return new ProviderRequestError(phase === "validate" ? 400 : 401, message);
     }
     if (response.status === 404 && notFoundAsInvalidInput) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
     if (response.status === 400 || response.status === 404 || response.status === 422) {
         return new ProviderRequestError(response.status, message);

package/src/providers/agentql/runtime.js

@@ -1,5 +1,5 @@
 import { compactObject, optionalBoolean, optionalInteger, optionalRecord, optionalString } from "../../core/cast.js";
-import { providerUserAgent, ProviderRequestError } from "../provider-runtime.js";
+import { providerUserAgent, ProviderRequestError, providerInputError } from "../provider-runtime.js";
 export const agentqlApiBaseUrl = "https://api.agentql.com";
 const usagePath = "/v1/usage";
 const queryDataPath = "/v1/query-data";
@@ -154,7 +154,7 @@ function createAgentqlError(response, payload, phase) {
         return new ProviderRequestError(429, message);
     }
     if (phase === "validate" && (response.status === 401 || response.status === 403)) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
     if (response.status >= 400 && response.status < 500) {
         return new ProviderRequestError(response.status, message);

package/src/providers/agenty/runtime.js

@@ -1,10 +1,9 @@
 import { compactObject, optionalRecord, optionalString, recordOrEmpty, requiredRecord } from "../../core/cast.js";
 import { storeResponseInTransit } from "../../core/request.js";
-import { providerFetch, ProviderRequestError, providerUserAgent } from "../provider-runtime.js";
+import { providerFetch, ProviderRequestError, providerUserAgent, defaultProviderRequestTimeoutMs, } from "../provider-runtime.js";
 export const agentyApiBaseUrl = "https://api.agenty.com/v2";
 export const agentyBrowserBaseUrl = "https://browser.agenty.com/api";
 const agentyValidationPath = "/agents";
-const agentyTimeoutMs = 30_000;
 export const agentyActionHandlers = {
     get_page_content(input, context) {
         return getPageContent(input, context);
@@ -455,7 +454,7 @@ async function downloadJobResult(input, context) {
     });
     const record = unwrapAgentyPayload(payload);
     const downloadUrl = asRequiredString(record.downloadlink ?? record.downloadLink, "downloadlink");
-    const timeoutSignal = AbortSignal.timeout(agentyTimeoutMs);
+    const timeoutSignal = AbortSignal.timeout(defaultProviderRequestTimeoutMs);
     const signal = context.signal ? AbortSignal.any([context.signal, timeoutSignal]) : timeoutSignal;
     try {
         const response = await context.fetcher(downloadUrl, {
@@ -555,7 +554,7 @@ async function requestAgentyApiJson(input) {
     });
 }
 async function requestAgentyApiResponse(input) {
-    const timeoutSignal = AbortSignal.timeout(agentyTimeoutMs);
+    const timeoutSignal = AbortSignal.timeout(defaultProviderRequestTimeoutMs);
     const signal = input.context.signal ? AbortSignal.any([input.context.signal, timeoutSignal]) : timeoutSignal;
     try {
         const response = await input.context.fetcher(buildAgentyUrl(input.baseUrl ?? agentyApiBaseUrl, input.path, input.query), {
@@ -585,7 +584,7 @@ async function requestAgentyApiResponse(input) {
     }
 }
 async function requestAgentyBrowser(input) {
-    const timeoutSignal = AbortSignal.timeout(agentyTimeoutMs);
+    const timeoutSignal = AbortSignal.timeout(defaultProviderRequestTimeoutMs);
     const signal = input.context.signal ? AbortSignal.any([input.context.signal, timeoutSignal]) : timeoutSignal;
     try {
         const response = await input.context.fetcher(buildAgentyUrl(agentyBrowserBaseUrl, input.path), {
@@ -615,7 +614,7 @@ async function requestAgentyBrowser(input) {
     }
 }
 async function requestAgentyJson(input) {
-    const timeoutSignal = AbortSignal.timeout(agentyTimeoutMs);
+    const timeoutSignal = AbortSignal.timeout(defaultProviderRequestTimeoutMs);
     const signal = input.signal ? AbortSignal.any([input.signal, timeoutSignal]) : timeoutSignal;
     try {
         const response = await input.fetcher(buildAgentyUrl(input.baseUrl, input.path, input.query), {

package/src/providers/agiled/runtime.d.ts

@@ -1,7 +1,6 @@
 import type { CredentialValidationResult } from "../../core/types.ts";
 import type { ProviderActionHandlers } from "../provider-runtime.ts";
 export declare const agiledApiBaseUrl = "https://my.agiled.app/api/v1";
-export declare const agiledDefaultRequestTimeoutMs = 30000;
 interface AgiledActionContext {
     apiKey: string;
     brand: string;

package/src/providers/agiled/runtime.js

@@ -1,7 +1,6 @@
 import { compactObject, optionalRecord, optionalString } from "../../core/cast.js";
-import { providerUserAgent, ProviderRequestError } from "../provider-runtime.js";
+import { providerUserAgent, ProviderRequestError, defaultProviderRequestTimeoutMs } from "../provider-runtime.js";
 export const agiledApiBaseUrl = "https://my.agiled.app/api/v1";
-export const agiledDefaultRequestTimeoutMs = 30_000;
 export const agiledActionHandlers = {
     list_contacts(_input, context) {
         return listAgiledItems("contacts", "/contacts", context);
@@ -143,7 +142,7 @@ function buildRequestOptions(context) {
     };
 }
 async function requestAgiledJson(path, options) {
-    const timeoutSignal = AbortSignal.timeout(agiledDefaultRequestTimeoutMs);
+    const timeoutSignal = AbortSignal.timeout(defaultProviderRequestTimeoutMs);
     const signal = options.signal ? AbortSignal.any([options.signal, timeoutSignal]) : timeoutSignal;
     try {
         const response = await options.fetcher(buildAgiledUrl(path, options.apiKey), {

package/src/providers/agility/runtime.js

@@ -1,7 +1,6 @@
 import { booleanString, compactObject, optionalInteger, optionalRecord, optionalString } from "../../core/cast.js";
-import { providerUserAgent, ProviderRequestError } from "../provider-runtime.js";
+import { providerUserAgent, ProviderRequestError, defaultProviderRequestTimeoutMs } from "../provider-runtime.js";
 export const agilityApiBaseUrl = "https://api.aglty.io";
-const agilityDefaultRequestTimeoutMs = 30_000;
 export const agilityActionHandlers = {
     async list_content_models(input, context) {
         const payload = await requestAgilityJson({
@@ -156,7 +155,7 @@ export async function validateAgilityCredential(input, fetcher, signal) {
     };
 }
 async function requestAgilityJson(input) {
-    const timeoutSignal = AbortSignal.timeout(agilityDefaultRequestTimeoutMs);
+    const timeoutSignal = AbortSignal.timeout(defaultProviderRequestTimeoutMs);
     const signal = input.signal ? AbortSignal.any([input.signal, timeoutSignal]) : timeoutSignal;
     try {
         const response = await input.fetcher(buildAgilityUrl(input.path, input.params), {

package/src/providers/ahrefs/runtime.js

@@ -1,5 +1,5 @@
 import { compactObject, optionalNumber, optionalRecord, optionalString } from "../../core/cast.js";
-import { providerUserAgent, ProviderRequestError } from "../provider-runtime.js";
+import { providerUserAgent, ProviderRequestError, providerInputError } from "../provider-runtime.js";
 export const ahrefsApiBaseUrl = "https://api.ahrefs.com/v3";
 const limitsAndUsagePath = "/subscription-info/limits-and-usage";
 export const ahrefsActionHandlers = {
@@ -140,13 +140,13 @@ function createAhrefsError(status, payload, phase) {
         return new ProviderRequestError(429, message);
     }
     if (phase === "validate" && (status === 401 || status === 403)) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
     if (phase === "execute" && (status === 401 || status === 403)) {
         return new ProviderRequestError(401, message);
     }
     if (phase === "execute" && [400, 404, 422].includes(status)) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
     return new ProviderRequestError(status || 500, message);
 }

package/src/providers/aifinmarket/runtime.js

@@ -1,8 +1,7 @@
 import { withMcpClient } from "../mcp-client.js";
-import { ProviderRequestError, providerUserAgent } from "../provider-runtime.js";
+import { ProviderRequestError, providerUserAgent, providerInputError, providerResponseError, defaultProviderRequestTimeoutMs, } from "../provider-runtime.js";
 const origin = "https://mcp.wind.com.cn";
 const actionTimeoutMs = 28_000;
-const validationTimeoutMs = 30_000;
 const maxResponseBytes = 16 * 1024 * 1024;
 const maxToolPages = 100;
 const maxTools = 10_000;
@@ -106,7 +105,7 @@ export async function callTool(actionName, input, context) {
     return { result };
 }
 export async function discoverAccessibleTools(context) {
-    const deadline = Date.now() + validationTimeoutMs;
+    const deadline = Date.now() + defaultProviderRequestTimeoutMs;
     let lastError;
     for (const serverType of serverTypes) {
         const remaining = deadline - Date.now();
@@ -300,7 +299,7 @@ function classifyWindError(message, phase) {
         "indicator_not_found",
         "market_target_not_found",
     ]))
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     const namesParameter = includesAny(normalized, ["参数", "字段", "param", "argument", "field"]);
     const invalid = includesAny(normalized, [
         "错误",
@@ -315,16 +314,16 @@ function classifyWindError(message, phase) {
         "required",
     ]);
     if (namesParameter && invalid)
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     if (includesAny(normalized, ["route_error", "unknown server_type", "未知 server_type"]))
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     return undefined;
 }
 function transformWindToolResult(result, apiKey) {
     const cloned = structuredClone(result);
     const error = readEmbeddedWindError(cloned, apiKey);
     if (error)
-        throw new ProviderRequestError(502, error);
+        throw providerResponseError(error);
     return asRecord(cloned)?.structuredContent ?? cloned;
 }
 function readEmbeddedWindError(result, apiKey) {

package/src/providers/airtable/executors.js

@@ -1,5 +1,5 @@
 import { compactObject, objectArray, optionalBoolean, optionalInteger, optionalRecord, optionalString, optionalStringArray, } from "../../core/cast.js";
-import { defineBearerProviderExecutors, defineProviderProxy, ProviderRequestError, providerResponseError, providerUserAgent, requiredResponseRecord, } from "../provider-runtime.js";
+import { defineBearerProviderExecutors, defineProviderProxy, ProviderRequestError, providerResponseError, providerUserAgent, requiredResponseRecord, providerInputError, } from "../provider-runtime.js";
 import { airtableRecordChanged } from "./trigger-on-record-changed.js";
 export const airtableApiBaseUrl = "https://api.airtable.com";
 const service = "airtable";
@@ -360,10 +360,10 @@ function createAirtableError(response, payload, mode, notFoundAsInvalidInput) {
         return new ProviderRequestError(mode === "validate" ? 400 : response.status, message);
     }
     if (notFoundAsInvalidInput && response.status === 404) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
     if (response.status === 422) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
     if (response.status === 429) {
         return new ProviderRequestError(429, message);

package/src/providers/alchemy/runtime.js

@@ -1,5 +1,5 @@
 import { compactObject, optionalBoolean } from "../../core/cast.js";
-import { providerUserAgent, ProviderRequestError } from "../provider-runtime.js";
+import { providerUserAgent, ProviderRequestError, providerInputError } from "../provider-runtime.js";
 export const alchemyRpcBaseUrl = "https://eth-mainnet.g.alchemy.com/v2";
 export const alchemyNftBaseUrl = "https://eth-mainnet.g.alchemy.com/nft/v3";
 export const alchemyActionHandlers = {
@@ -248,7 +248,7 @@ function createAlchemyHttpError(status, payload, phase) {
         return new ProviderRequestError(phase === "validate" ? 400 : status, message);
     }
     if (status === 400 || status === 404) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
     return new ProviderRequestError(status || 500, message);
 }

package/src/providers/algolia/runtime.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { compactObject, optionalBoolean, optionalNumber, optionalRecord, optionalString } from "../../core/cast.js";
-import { providerUserAgent, ProviderRequestError } from "../provider-runtime.js";
+import { providerUserAgent, ProviderRequestError, providerInputError } from "../provider-runtime.js";
 export const algoliaActionHandlers = {
     list_indices(input, context) {
         return listAlgoliaIndices(input, context);
@@ -345,7 +345,7 @@ function createAlgoliaError(response, payload, phase, notFoundAsInvalidInput) {
         readOptionalString(record.error) ??
         `algolia request failed with ${response.status}`;
     if (response.status === 400) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
     if (response.status === 401) {
         return new ProviderRequestError(phase === "validate" ? 400 : 401, message);
@@ -354,7 +354,7 @@ function createAlgoliaError(response, payload, phase, notFoundAsInvalidInput) {
         return new ProviderRequestError(phase === "validate" ? 400 : 403, message);
     }
     if (response.status === 404 && notFoundAsInvalidInput) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
     if (response.status === 429) {
         return new ProviderRequestError(429, message);