runline 0.29.0 → 0.30.1

package/dist/plugins/microsoftFiles/src/index.js

@@ -1,4 +1,4 @@
-import { graphRequest, microsoftAccessToken, microsoftSetupHelp, userBase, } from "../../_shared/microsoftAuth.js";
+import { graphRequest, graphResponse, microsoftDownload, microsoftDriveBase, microsoftSetupHelp, } from "../../_shared/microsoftAuth.js";
 const NAME = "microsoftFiles";
 const SCOPES = [
     "https://graph.microsoft.com/Files.ReadWrite.All",
@@ -6,30 +6,16 @@ const SCOPES = [
 ];
 /** Resolve the drive root path: explicit drive/site, else the user's default drive. */
 function driveBase(ctx) {
-    const cfg = ctx.connection.config;
-    if (cfg.driveId)
-        return `/drives/${cfg.driveId}`;
-    if (cfg.siteId)
-        return `/sites/${cfg.siteId}/drive`;
-    return `${userBase(ctx)}/drive`;
+    return microsoftDriveBase(ctx.connection.config);
 }
 async function binaryFetch(ctx, method, path, body) {
-    const token = await microsoftAccessToken(ctx, NAME, SCOPES);
-    const init = {
-        method,
-        headers: {
-            Authorization: `Bearer ${token}`,
-            ...(body ? { "Content-Type": "application/octet-stream" } : {}),
-        },
-    };
-    if (body)
-        init.body = body;
-    return fetch(`https://graph.microsoft.com/v1.0${path}`, init);
+    return graphResponse(ctx, NAME, SCOPES, method, path, body, body ? "application/octet-stream" : undefined);
 }
 export default function microsoftFiles(rl) {
     rl.setName(NAME);
     rl.setVersion("1.0.0");
     rl.setConnectionSchema({
+        authMethod: { type: "string", required: false, description: "delegated or appOnly; legacy configs infer the method from existing credentials" },
         tenantId: { type: "string", required: false, env: "MS_GRAPH_TENANT_ID", description: "Entra tenant id (app-only) or omit for OAuth /common" },
         clientId: { type: "string", required: false, env: "MS_GRAPH_CLIENT_ID", description: "App (client) id" },
         clientSecret: { type: "string", required: false, env: "MS_GRAPH_CLIENT_SECRET", description: "Client secret VALUE" },
@@ -69,7 +55,7 @@ export default function microsoftFiles(rl) {
             top: { type: "number", required: false, default: 100 },
         },
         async execute(input, ctx) {
-            const where = input.folderId ? `/items/${input.folderId}/children` : "/root/children";
+            const where = input.folderId ? `/items/${encodeURIComponent(input.folderId)}/children` : "/root/children";
             const qs = new URLSearchParams({
                 $top: String(input.top ?? 100),
                 $select: "id,name,size,lastModifiedDateTime,webUrl,folder,file",
@@ -83,10 +69,10 @@ export default function microsoftFiles(rl) {
         description: "Download a file by id. Returns {id,name,size,contentType,base64}. base64 is the file bytes.",
         inputSchema: { id: { type: "string", required: true } },
         async execute(input, ctx) {
-            const meta = await graphRequest(ctx, NAME, SCOPES, "GET", `${driveBase(ctx)}/items/${input.id}`);
-            const res = await binaryFetch(ctx, "GET", `${driveBase(ctx)}/items/${input.id}/content`);
+            const meta = await graphRequest(ctx, NAME, SCOPES, "GET", `${driveBase(ctx)}/items/${encodeURIComponent(input.id)}`);
+            const res = await microsoftDownload(meta["@microsoft.graph.downloadUrl"]);
             if (!res.ok)
-                throw new Error(`${NAME}: download ${input.id} → ${res.status} ${await res.text()}`);
+                throw new Error(`${NAME}: download failed (HTTP ${res.status})`);
             const buf = Buffer.from(await res.arrayBuffer());
             return {
                 id: meta.id,
@@ -109,7 +95,7 @@ export default function microsoftFiles(rl) {
             const p = input.path.split("/").map(encodeURIComponent).join("/");
             const res = await binaryFetch(ctx, "PUT", `${driveBase(ctx)}/root:/${p}:/content`, bytes);
             if (!res.ok)
-                throw new Error(`${NAME}: upload ${input.path} → ${res.status} ${await res.text()}`);
+                throw new Error(`${NAME}: upload failed (HTTP ${res.status})`);
             return JSON.parse(await res.text());
         },
     });
@@ -121,7 +107,7 @@ export default function microsoftFiles(rl) {
             parentId: { type: "string", required: false, description: "Parent folder id; omit for root" },
         },
         async execute(input, ctx) {
-            const where = input.parentId ? `/items/${input.parentId}/children` : "/root/children";
+            const where = input.parentId ? `/items/${encodeURIComponent(input.parentId)}/children` : "/root/children";
             return graphRequest(ctx, NAME, SCOPES, "POST", `${driveBase(ctx)}${where}`, {
                 name: input.name,
                 folder: {},

package/dist/plugins/microsoftMail/src/index.js

@@ -20,6 +20,7 @@ export default function microsoftMail(rl) {
     rl.setName(NAME);
     rl.setVersion("1.0.0");
     rl.setConnectionSchema({
+        authMethod: { type: "string", required: false, description: "delegated or appOnly; legacy configs infer the method from existing credentials" },
         tenantId: { type: "string", required: false, env: "MS_GRAPH_TENANT_ID", description: "Entra tenant id (app-only) or omit for OAuth /common" },
         clientId: { type: "string", required: false, env: "MS_GRAPH_CLIENT_ID", description: "App (client) id" },
         clientSecret: { type: "string", required: false, env: "MS_GRAPH_CLIENT_SECRET", description: "Client secret VALUE" },
@@ -89,7 +90,7 @@ export default function microsoftMail(rl) {
         description: "Get one message with full body by id.",
         inputSchema: { id: { type: "string", required: true } },
         async execute(input, ctx) {
-            return graphRequest(ctx, NAME, SCOPES, "GET", `${userBase(ctx)}/messages/${input.id}`);
+            return graphRequest(ctx, NAME, SCOPES, "GET", `${userBase(ctx)}/messages/${encodeURIComponent(input.id)}`);
         },
     });
 }

package/dist/plugins/paypal/src/index.js

@@ -1,35 +1,20 @@
-let cachedToken = null;
-function getConn(ctx) {
-    const c = ctx.connection.config;
+import { coordinatedAccessToken, requestToken, } from "../../_shared/tokenRefresh.js";
+function getConn(c) {
     const env = c.env ?? "sandbox";
     const base = env === "live"
         ? "https://api-m.paypal.com"
         : "https://api-m.sandbox.paypal.com";
     return { base, clientId: c.clientId, secret: c.secret };
 }
-async function getAccessToken(conn) {
-    if (cachedToken && Date.now() < cachedToken.expiresAt)
-        return cachedToken.token;
-    const res = await fetch(`${conn.base}/v1/oauth2/token`, {
-        method: "POST",
-        headers: {
-            Authorization: "Basic " + btoa(`${conn.clientId}:${conn.secret}`),
-            "Content-Type": "application/x-www-form-urlencoded",
-        },
-        body: "grant_type=client_credentials",
+async function apiRequest(ctx, method, endpoint, body, qs) {
+    const token = await coordinatedAccessToken(ctx, (current) => {
+        const conn = getConn(current);
+        return requestToken({
+            url: `${conn.base}/v1/oauth2/token`,
+            clientAuthentication: "client_secret_basic",
+        }, { grant_type: "client_credentials" }, { clientId: conn.clientId, clientSecret: conn.secret });
     });
-    if (!res.ok)
-        throw new Error(`PayPal auth error ${res.status}: ${await res.text()}`);
-    const data = (await res.json());
-    cachedToken = {
-        token: data.access_token,
-        expiresAt: Date.now() + (data.expires_in - 60) * 1000,
-    };
-    return cachedToken.token;
-}
-async function apiRequest(conn, method, endpoint, body, qs) {
-    const token = await getAccessToken(conn);
-    const url = new URL(`${conn.base}/v1${endpoint}`);
+    const url = new URL(`${getConn(ctx.connection.config).base}/v1${endpoint}`);
     if (qs) {
         for (const [k, v] of Object.entries(qs)) {
             if (v !== undefined && v !== null)
@@ -103,7 +88,7 @@ export default function paypal(rl) {
                 header.email_message = p.emailMessage;
             if (p.note)
                 header.note = p.note;
-            return apiRequest(getConn(ctx), "POST", "/payments/payouts", {
+            return apiRequest(ctx, "POST", "/payments/payouts", {
                 sender_batch_header: header,
                 items: p.items,
             });
@@ -125,7 +110,7 @@ export default function paypal(rl) {
             const qs = {};
             if (p.limit)
                 qs.page_size = p.limit;
-            const data = (await apiRequest(getConn(ctx), "GET", `/payments/payouts/${p.payoutBatchId}`, undefined, qs));
+            const data = (await apiRequest(ctx, "GET", `/payments/payouts/${p.payoutBatchId}`, undefined, qs));
             return data.items;
         },
     });
@@ -135,7 +120,7 @@ export default function paypal(rl) {
         inputSchema: { payoutItemId: { type: "string", required: true } },
         async execute(input, ctx) {
             const { payoutItemId } = input;
-            return apiRequest(getConn(ctx), "GET", `/payments/payouts-item/${payoutItemId}`);
+            return apiRequest(ctx, "GET", `/payments/payouts-item/${payoutItemId}`);
         },
     });
     rl.registerAction("payoutItem.cancel", {
@@ -144,7 +129,7 @@ export default function paypal(rl) {
         inputSchema: { payoutItemId: { type: "string", required: true } },
         async execute(input, ctx) {
             const { payoutItemId } = input;
-            return apiRequest(getConn(ctx), "POST", `/payments/payouts-item/${payoutItemId}/cancel`);
+            return apiRequest(ctx, "POST", `/payments/payouts-item/${payoutItemId}/cancel`);
         },
     });
 }

package/dist/plugins/plaud/src/index.js

@@ -0,0 +1,210 @@
+import * as t from "typebox";
+import { blockContent, blocks, dateBoundary, list, PLAUD_OAUTH, PLAUD_PUBLIC_CLIENT_ID, PLAUD_REDIRECT_URI, recording, request, scan, } from "./shared.js";
+const strict = { additionalProperties: false };
+const Id = t.String({ minLength: 1, maxLength: 512 });
+const RecordingInput = t.Object({ id: Id }, strict);
+const ScanFields = {
+    limit: t.Optional(t.Integer({
+        minimum: 1,
+        maximum: 1000,
+        description: "Maximum matching recordings (default 50)",
+    })),
+    maxPages: t.Optional(t.Integer({
+        minimum: 1,
+        maximum: 10,
+        description: "Bounded scan of 100 recordings per page (default 5)",
+    })),
+};
+const Day = t.String({
+    pattern: "^\\d{4}-\\d{2}-\\d{2}$",
+    description: "UTC date, YYYY-MM-DD",
+});
+const ListInput = t.Object({
+    page: t.Optional(t.Integer({ minimum: 1, maximum: 1000 })),
+    pageSize: t.Optional(t.Integer({ minimum: 10, maximum: 100 })),
+}, strict);
+const SearchInput = t.Object({
+    query: t.String({ minLength: 1, pattern: "\\S" }),
+    from: t.Optional(Day),
+    to: t.Optional(Day),
+    ...ScanFields,
+}, strict);
+const RecentInput = t.Object({ days: t.Optional(t.Integer({ minimum: 1, maximum: 365 })), ...ScanFields }, strict);
+const TranscriptInput = t.Object({
+    id: Id,
+    block: t.Optional(t.Union([
+        t.Literal("transaction"),
+        t.Literal("transaction_polish"),
+        t.Literal("outline"),
+        t.Literal("mark_memo"),
+    ])),
+}, strict);
+const SummaryInput = t.Object({ id: Id, index: t.Optional(t.Integer({ minimum: 0, maximum: 999 })) }, strict);
+export default function plaud(rl) {
+    rl.setName("plaud");
+    rl.setVersion("0.1.0");
+    rl.setOAuth({
+        protocol: PLAUD_OAUTH,
+        scopes: [],
+        redirectUri: PLAUD_REDIRECT_URI,
+        publicClient: true,
+        defaultClientId: PLAUD_PUBLIC_CLIENT_ID,
+        setupHelp: [
+            "Plaud publishes a public OAuth client (PKCE, no secret) with the fixed callback {{redirectUri}}; the same flow as the official CLI.",
+            "Set PLAUD_CLIENT_ID to use a different client registered for that callback.",
+            "Plaud Embedded partner credentials are for a different API and are not interchangeable.",
+        ],
+    });
+    rl.setConnectionSchema({
+        clientId: {
+            type: "string",
+            required: false,
+            env: "PLAUD_CLIENT_ID",
+            description: "Public third-party OAuth client ID used at login; defaults to Plaud's published client",
+        },
+        refreshToken: {
+            type: "string",
+            required: false,
+            env: "PLAUD_REFRESH_TOKEN",
+            description: "Third-party OAuth refresh token",
+        },
+        accessToken: {
+            type: "string",
+            required: false,
+            env: "PLAUD_ACCESS_TOKEN",
+            description: "Cached third-party OAuth access token",
+        },
+        accessTokenExpiresAt: {
+            type: "number",
+            required: false,
+            description: "Access-token expiry in epoch milliseconds; omit if unknown",
+        },
+        contentOrigins: {
+            type: "array",
+            required: false,
+            description: "Host-approved exact HTTPS origins for signed transcript/summary data_link downloads. Empty by default; never accepts action-supplied origins.",
+        },
+    });
+    rl.registerAction("user.get", {
+        access: "read",
+        description: "Get the authenticated Plaud user.",
+        inputSchema: t.Object({}, strict),
+        execute: (_input, ctx) => request(ctx, "users/current"),
+    });
+    rl.registerAction("recording.list", {
+        access: "read",
+        description: "List one page of recordings; preserves Plaud's data and pagination fields. Durations are milliseconds.",
+        inputSchema: ListInput,
+        execute: (input, ctx) => {
+            const p = input;
+            return list(ctx, p.page ?? 1, p.pageSize ?? 20);
+        },
+    });
+    rl.registerAction("recording.get", {
+        access: "read",
+        description: "Get recording metadata, source_list, note_list and any signed audio URL. Returned content is private application data.",
+        inputSchema: RecordingInput,
+        execute: (input, ctx) => recording(ctx, input.id),
+    });
+    rl.registerAction("recording.search", {
+        access: "read",
+        description: "Case-insensitive name search over a bounded number of pages, not transcript/full-text search. Returns scan counts and truncated; dates are inclusive UTC.",
+        inputSchema: SearchInput,
+        execute: (input, ctx) => {
+            const p = input;
+            return scan(ctx, {
+                query: p.query,
+                from: dateBoundary(p.from, false),
+                to: dateBoundary(p.to, true),
+                limit: p.limit ?? 50,
+                maxPages: p.maxPages ?? 5,
+            });
+        },
+    });
+    rl.registerAction("recording.recent", {
+        access: "read",
+        description: "Recordings created within the last N days (default 7). Scans bounded pages; truncated means the result may be incomplete.",
+        inputSchema: RecentInput,
+        execute: (input, ctx) => {
+            const p = input;
+            const now = Date.now();
+            return scan(ctx, {
+                from: now - (p.days ?? 7) * 86_400_000,
+                to: now,
+                limit: p.limit ?? 50,
+                maxPages: p.maxPages ?? 5,
+            });
+        },
+    });
+    rl.registerAction("recording.audioUrl", {
+        access: "read",
+        description: "Return Plaud's temporary signed audio URL without downloading audio. Treat the URL as a secret; missing URLs may be transient.",
+        inputSchema: RecordingInput,
+        async execute(input, ctx) {
+            const { id } = input;
+            const file = await recording(ctx, id);
+            return {
+                recordingId: id,
+                url: typeof file.presigned_url === "string" && file.presigned_url
+                    ? file.presigned_url
+                    : null,
+            };
+        },
+    });
+    rl.registerAction("transcript.get", {
+        access: "read",
+        description: "Get an original/polished transcript, outline, or highlights. Uses inline content first; signed links require host-approved contentOrigins. JSON content is decoded; segment times remain milliseconds.",
+        inputSchema: TranscriptInput,
+        async execute(input, ctx) {
+            const { id, block = "transaction" } = input;
+            const file = await recording(ctx, id);
+            const sources = blocks(file, "source_list");
+            const content = await blockContent(ctx, sources.find((source) => source.data_type === block));
+            let parsed = content.content;
+            if (content.content) {
+                try {
+                    parsed = JSON.parse(content.content);
+                }
+                catch {
+                    /* Plain-text transcripts are valid. */
+                }
+            }
+            return {
+                recordingId: id,
+                block,
+                ...content,
+                content: parsed,
+                availableBlocks: sources
+                    .map((source) => source.data_type)
+                    .filter((type) => typeof type === "string"),
+            };
+        },
+    });
+    rl.registerAction("summary.get", {
+        access: "read",
+        description: "Get an auto_sum_note summary (Markdown). index selects among multiple summaries, starting at 0. Linked content requires host-approved contentOrigins.",
+        inputSchema: SummaryInput,
+        async execute(input, ctx) {
+            const { id, index = 0 } = input;
+            const notes = blocks(await recording(ctx, id), "note_list").filter((note) => note.data_type === "auto_sum_note");
+            return {
+                recordingId: id,
+                index,
+                count: notes.length,
+                ...(await blockContent(ctx, notes[index])),
+            };
+        },
+    });
+    rl.registerAction("note.list", {
+        access: "read",
+        description: "List every note block verbatim, including data_type, titles, inline data_content, and signed data_link. Does not download links.",
+        inputSchema: RecordingInput,
+        async execute(input, ctx) {
+            const { id } = input;
+            return {
+                recordingId: id,
+                notes: blocks(await recording(ctx, id), "note_list"),
+            };
+        },
+    });
+}

package/dist/plugins/plaud/src/shared.js

@@ -0,0 +1,221 @@
+import { AuthError, downloadResource, OAuthGrantSchema, } from "runline";
+import * as t from "typebox";
+import { credentialRuntime } from "../../_shared/credentialAdapter.js";
+const BASE = "https://platform.plaud.ai/developer/api";
+/** Public client identifier and fixed callback published in Plaud's official CLI. */
+export const PLAUD_PUBLIC_CLIENT_ID = "client_f9e0b214-c11f-434b-8b95-c4497d1feb81";
+export const PLAUD_REDIRECT_URI = "http://localhost:8199/auth/callback";
+/** Third-party personal-recording API, NOT Plaud Embedded's partner-token API. */
+export const PLAUD_OAUTH = {
+    id: "plaud.oauth2",
+    provider: "plaud",
+    authorization: { url: "https://web.plaud.ai/platform/oauth" },
+    exchange: {
+        url: `${BASE}/oauth/third-party/access-token`,
+        clientAuthentication: "client_id_basic",
+        grantType: null,
+        sendState: true,
+        requirePkce: true,
+    },
+    refresh: {
+        url: `${BASE}/oauth/third-party/access-token/refresh`,
+        clientAuthentication: "none",
+        grantType: null,
+    },
+};
+export const PLAUD_CREDENTIAL = {
+    id: "plaud",
+    methods: {
+        oauth2: {
+            schema: t.Object({ grant: t.Optional(OAuthGrantSchema) }, { additionalProperties: false }),
+            authentication: {
+                kind: "oauth2",
+                grantField: "grant",
+                definition: PLAUD_OAUTH,
+                renewal: "refresh",
+            },
+            targets: {
+                api: { baseUrl: `${BASE}/open/third-party/`, methods: ["GET"] },
+            },
+            probe: {
+                target: "api",
+                path: "users/current",
+                method: "GET",
+                acceptedStatuses: [200],
+            },
+        },
+    },
+};
+export function plaudRuntime(ctx) {
+    return credentialRuntime(ctx, PLAUD_CREDENTIAL, "oauth2", (config) => [
+        config.clientId,
+    ]);
+}
+function object(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new AuthError("invalid_response");
+    return value;
+}
+export async function request(ctx, path) {
+    const { binding, transport } = plaudRuntime(ctx);
+    const response = await transport.request(binding, { target: "api", path });
+    if (!response.ok)
+        throw new Error(`plaud: request failed (HTTP ${response.status})`);
+    try {
+        return object(await response.json());
+    }
+    catch {
+        throw new AuthError("invalid_response");
+    }
+}
+export async function recording(ctx, id) {
+    // Encoding protects separators/query injection; the transport also rejects traversal.
+    return request(ctx, `files/${encodeURIComponent(id)}`);
+}
+export async function list(ctx, page, pageSize) {
+    const result = await request(ctx, `files/?${new URLSearchParams({ page: String(page), page_size: String(pageSize) })}`);
+    if (!Array.isArray(result.data) || result.data.length > pageSize)
+        throw new AuthError("invalid_response");
+    const data = result.data.map(object);
+    return { ...result, data };
+}
+export function blocks(file, field) {
+    const value = file[field];
+    if (value === undefined || value === null)
+        return [];
+    if (!Array.isArray(value))
+        throw new AuthError("invalid_response");
+    return value.map(object);
+}
+/** Linked content is a separate, unauthenticated capability approved by host config. */
+export async function blockContent(ctx, block) {
+    if (!block)
+        return { status: "unavailable", content: null };
+    if (typeof block.data_content === "string" && block.data_content.length)
+        return { status: "available", content: block.data_content };
+    const link = block.data_link;
+    if (typeof link !== "string" || !link)
+        return { status: "unavailable", content: null };
+    const origins = ctx.connection.config.contentOrigins ?? [];
+    if (!Array.isArray(origins) ||
+        origins.some((origin) => {
+            if (typeof origin !== "string")
+                return true;
+            try {
+                const url = new URL(origin);
+                return url.protocol !== "https:" || url.origin !== origin;
+            }
+            catch {
+                return true;
+            }
+        }))
+        throw new AuthError("invalid_credentials");
+    let origin;
+    try {
+        const url = new URL(link);
+        if (url.protocol !== "https:" || url.username || url.password || url.hash)
+            throw new Error();
+        origin = url.origin;
+    }
+    catch {
+        throw new AuthError("request_not_allowed");
+    }
+    if (!origins.includes(origin))
+        return {
+            status: "link_requires_approval",
+            content: null,
+            contentUrl: link,
+        };
+    const response = await downloadResource(link, {
+        allowedOrigins: [...origins],
+        fetch: globalThis.fetch,
+        maxResponseBytes: 8 * 1024 * 1024,
+    });
+    if (!response.ok)
+        throw new Error(`plaud: content download failed (HTTP ${response.status})`);
+    const content = await response.text();
+    return {
+        status: content ? "available" : "unavailable",
+        content: content || null,
+    };
+}
+function utcDay(value) {
+    if (!/^\d{4}-\d{2}-\d{2}$/.test(value))
+        return undefined;
+    const ms = Date.parse(`${value}T00:00:00.000Z`);
+    return Number.isFinite(ms) &&
+        new Date(ms).toISOString().slice(0, 10) === value
+        ? ms
+        : undefined;
+}
+/** Timezone-less timestamps are UTC; invalid calendar days/times are not normalized. */
+function timestamp(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const match = /^(\d{4}-\d{2}-\d{2})(?:[T ](\d{2}):(\d{2})(?::(\d{2})(\.\d+)?)?(Z|[+-]\d{2}:?\d{2})?)?$/i.exec(value.trim());
+    if (!match)
+        return undefined;
+    const [, day, hour, minute, second = "00", fraction = "", zone = "Z"] = match;
+    const midnight = utcDay(day);
+    if (midnight === undefined || hour === undefined)
+        return midnight;
+    if (Number(hour) > 23 || Number(minute) > 59 || Number(second) > 59)
+        return undefined;
+    const result = Date.parse(`${day}T${hour}:${minute}:${second}${fraction}${zone}`);
+    return Number.isFinite(result) ? result : undefined;
+}
+export function dateBoundary(value, end) {
+    if (value === undefined)
+        return undefined;
+    const ms = utcDay(value);
+    if (ms === undefined)
+        throw new Error("plaud: invalid date; use YYYY-MM-DD");
+    return ms + (end ? 86_400_000 - 1 : 0);
+}
+export async function scan(ctx, options) {
+    if (options.from !== undefined &&
+        options.to !== undefined &&
+        options.from > options.to)
+        throw new Error("plaud: from must not be after to");
+    const recordings = [];
+    const seen = new Set();
+    const query = options.query?.toLowerCase();
+    let scanned = 0;
+    let pagesScanned = 0;
+    for (let page = 1; page <= options.maxPages; page++) {
+        const result = await list(ctx, page, 100);
+        pagesScanned++;
+        for (let index = 0; index < result.data.length; index++) {
+            const file = result.data[index];
+            scanned++;
+            if (typeof file.id !== "string" || !file.id)
+                throw new AuthError("invalid_response");
+            if (seen.has(file.id))
+                continue;
+            seen.add(file.id);
+            if (query &&
+                !(typeof file.name === "string" &&
+                    file.name.toLowerCase().includes(query)))
+                continue;
+            if (options.from !== undefined || options.to !== undefined) {
+                const created = timestamp(file.created_at);
+                if (created === undefined ||
+                    (options.from !== undefined && created < options.from) ||
+                    (options.to !== undefined && created > options.to))
+                    continue;
+            }
+            recordings.push(file);
+            if (recordings.length >= options.limit)
+                return {
+                    recordings,
+                    scanned,
+                    pagesScanned,
+                    truncated: index < result.data.length - 1 || result.data.length === 100,
+                };
+        }
+        if (result.data.length < 100)
+            return { recordings, scanned, pagesScanned, truncated: false };
+    }
+    // Do not claim exhaustive results or assume provider ordering beyond the scanned pages.
+    return { recordings, scanned, pagesScanned, truncated: true };
+}

package/dist/plugins/salesforce/src/shared.js

@@ -1,3 +1,4 @@
+import { requestOAuth2Token } from "runline";
 export const DEFAULT_API_VERSION = "v59.0";
 export function config(ctx) {
     return ctx.connection.config;
@@ -37,40 +38,24 @@ export async function getSession(ctx) {
     const loginUrl = validateInstanceUrl(requireString(c.loginUrl ?? c.instanceUrl, "loginUrl or instanceUrl"));
     const clientId = requireString(c.clientId, "clientId");
     const clientSecret = requireString(c.clientSecret, "clientSecret");
-    const body = new URLSearchParams();
-    body.set("grant_type", "client_credentials");
-    body.set("client_id", clientId);
-    body.set("client_secret", clientSecret);
-    const res = await fetch(`${loginUrl}/services/oauth2/token`, {
-        method: "POST",
-        headers: {
-            Accept: "application/json",
-            "Content-Type": "application/x-www-form-urlencoded",
+    const tokens = await requestOAuth2Token({
+        url: `${loginUrl}/services/oauth2/token`,
+        clientAuthentication: "client_secret_post",
+        response: {
+            metadata: {
+                instanceUrl: "instance_url",
+                id: "id",
+                issuedAt: "issued_at",
+            },
         },
-        body,
-    });
-    const text = await res.text();
-    let data;
-    try {
-        data = text ? JSON.parse(text) : {};
-    }
-    catch {
-        data = { raw: text };
-    }
-    if (!res.ok) {
-        const err = typeof data.error === "string" ? data.error : res.status;
-        const description = typeof data.error_description === "string"
-            ? `: ${data.error_description}`
-            : "";
-        throw new Error(`Salesforce token error ${err}${description}`);
-    }
+    }, { grant_type: "client_credentials" }, { clientId, clientSecret });
     return {
-        instanceUrl: validateInstanceUrl(requireString(data.instance_url, "token response instance_url")),
-        accessToken: requireString(data.access_token, "token response access_token"),
-        tokenType: typeof data.token_type === "string" ? data.token_type : "Bearer",
-        scope: typeof data.scope === "string" ? data.scope : undefined,
-        id: typeof data.id === "string" ? data.id : undefined,
-        issuedAt: typeof data.issued_at === "string" ? data.issued_at : undefined,
+        instanceUrl: validateInstanceUrl(requireString(tokens.metadata?.instanceUrl, "token response instance_url")),
+        accessToken: tokens.accessToken,
+        tokenType: tokens.tokenType ?? "Bearer",
+        scope: tokens.scope,
+        id: tokens.metadata?.id,
+        issuedAt: tokens.metadata?.issuedAt,
     };
 }
 export async function api(ctx, method, endpoint, body, qs, session = getSession(ctx)) {