app_bridge 4.1.0-aarch64-linux → 5.0.0-aarch64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cd334ce501f49a41f2a323dcea31540dbdce65ff0a4d750b1ca3871ec491121f
-  data.tar.gz: f21ba99a8807c7894e1871321d4ff830daf37dde2fde7768d3af908618061ec5
+  metadata.gz: 7682962940ed84a4fb2094e10cd617180918e0d81b40c7582f1d60e0adda6b60
+  data.tar.gz: 2cc9bafd2f197425a7953321b3a6c0ad91a6e008b30904ca7299363fdc699fee
 SHA512:
-  metadata.gz: 8296e3014067a1a29917fd4139664cb331c77cfe419a234b4cc8f14f7f5491b80868f8272a278edcf41b5d25b7cd0459134b0eae2632b844072e00852bcd273d
-  data.tar.gz: 52eed814e20ef18341f7f6127d9a7aa1038be4f53cbc1d949107ebc91cac01d4883b8100729697ee44478d6a72f9dcb9e87692b472828b649039179dadcfec98
+  metadata.gz: 023e6c2edb75406ae15ee0a80e13773c54ec482b915cb0afa6008127d3b62dd31ba56285365560eeb338d8ddb4876a2d937da5c6449a7dee005c5cc4433ccf0c
+  data.tar.gz: 24ced7ec7713fc4c22600e12a61793b978bb76a7459f265d8c41230b286cc0b0db84d8227638afefb08cc01e5c725c8ec50986807d934dc0706893f5a60353f6

data/.tool-versions

@@ -1 +1 @@
-ruby 3.4.8
+ruby 3.4.9

data/README.md

@@ -305,6 +305,12 @@ impl v5::standout::app::new_feature::Host for AppState {
 - **Gradual migration**: Update connectors to new WIT versions at your own pace
 - **Type safety**: Each version's types are converted to the latest version internally
 
+- **Connections interface** (WIT 5.0.0+): Embeds `connection-config` JSON in WASM; platform extracts it at version upload
+
+## Connection configuration (WIT 5)
+
+Connectors embed `connection-config.json` via `include_str!` and export it through the `connections` interface. Integrationer reads it **once when the WASM version is saved**, validates against [connection-config-schema.json](ext/app_bridge/docs/connection-config-schema.json), and stores it on the version. Runtime connection flows use the stored JSON, not a live WASM call.
+
 ## Development
 
 To contribute or modify this gem, ensure you have the following dependencies installed:

data/Rakefile

@@ -1,12 +1,6 @@
 # frozen_string_literal: true
 
 require "bundler/gem_tasks"
-require "rspec/core/rake_task"
-
-require "rubocop/rake_task"
-
-RuboCop::RakeTask.new
-
 require "rb_sys/extensiontask"
 
 task build: :compile
@@ -17,12 +11,21 @@ RbSys::ExtensionTask.new("app_bridge", GEMSPEC) do |ext|
   ext.lib_dir = "lib/app_bridge"
 end
 
-# Load all project specific rake tasks
-Dir.glob(File.expand_path("tasks/**/*.rake", __dir__)).each { |file| load file }
+if ENV.key?("RUBY_TARGET")
+  task default: :compile
+else
+  require "rspec/core/rake_task"
+  require "rubocop/rake_task"
 
-# Set test mode environment variable for specs
-RSpec::Core::RakeTask.new(:spec) do |_t|
-  ENV["APP_BRIDGE_TEST_MODE"] = "1"
-end
+  RuboCop::RakeTask.new
 
-task default: %i[fixtures compile rust:test spec rubocop]
+  # Load all project specific rake tasks
+  Dir.glob(File.expand_path("tasks/**/*.rake", __dir__)).each { |file| load file }
+
+  # Set test mode environment variable for specs
+  RSpec::Core::RakeTask.new(:spec) do |_t|
+    ENV["APP_BRIDGE_TEST_MODE"] = "1"
+  end
+
+  task default: %i[fixtures compile rust:test spec rubocop]
+end

data/ext/app_bridge/docs/connection-config-schema.json

@@ -0,0 +1,500 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "urn:standout:schemas:connection-config:2",
+  "title": "Connection Config",
+  "description": "Declares how a connector authenticates and what runtime data the platform passes to actions/triggers. OAuth uses RFC 8414 authorization_server metadata and RFC 9728 protected_resource at the top level, with Standout-specific oauth_client credentials and platform hooks alongside. Generated at connector build time (see base-connector-tools). The platform does not fetch well-known metadata at runtime.",
+  "type": "object",
+  "required": ["strategies", "default_strategy", "runtime"],
+  "properties": {
+    "protected_resource": {
+      "$ref": "#/$defs/protected_resource",
+      "description": "RFC 9728 protected resource metadata for the API. runtime.base_url defaults to resource when omitted."
+    },
+    "strategies": {
+      "type": "array",
+      "minItems": 0,
+      "description": "Connection strategies. An empty array disables WASM-driven connections.",
+      "items": { "$ref": "#/$defs/strategy" }
+    },
+    "default_strategy": {
+      "type": "string",
+      "description": "ID of the strategy used when connecting"
+    },
+    "connection_schema": {
+      "type": "object",
+      "description": "JSON Schema for user input before connection (shared fallback). Field values listed in strategy storage are available as {{field}} in templates."
+    },
+    "runtime": {
+      "$ref": "#/$defs/runtime",
+      "description": "Default runtime payload merged with strategy.runtime. Headers and optional base_url override."
+    },
+    "post_connect": { "$ref": "#/$defs/post_connect_hook" }
+  },
+  "$defs": {
+    "templated_value": {
+      "description": "Literal string or template resolved by the platform. Use {{field}} for connection storage keys and {{env:NAME}} for app environment variables.",
+      "oneOf": [
+        { "type": "string" },
+        {
+          "type": "object",
+          "required": ["template"],
+          "additionalProperties": false,
+          "properties": {
+            "template": {
+              "type": "string",
+              "description": "e.g. Bearer {{access_token}}, {{username}}:{{password}}, {{env:CLIENT_ID}}"
+            },
+            "as": {
+              "enum": ["basic_authorization"],
+              "description": "Interpolate template then encode as HTTP Basic (Basic + Base64)"
+            }
+          }
+        }
+      ]
+    },
+    "templated_uri": {
+      "description": "Static URI or template that resolves to a URI at runtime",
+      "oneOf": [
+        { "type": "string", "format": "uri" },
+        {
+          "type": "object",
+          "required": ["template"],
+          "additionalProperties": false,
+          "properties": {
+            "template": {
+              "type": "string",
+              "description": "e.g. https://api.example.com/v1, https://{{subdomain}}.example.com/api, {{env:API_BASE_URL}}"
+            }
+          }
+        }
+      ]
+    },
+    "protected_resource": {
+      "type": "object",
+      "description": "RFC 9728 OAuth Protected Resource Metadata",
+      "required": ["resource", "authorization_servers"],
+      "properties": {
+        "resource": {
+          "type": "string",
+          "format": "uri",
+          "description": "API resource identifier (typically the API base URL)"
+        },
+        "authorization_servers": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "type": "string", "format": "uri" },
+          "description": "Issuer URLs of authorization servers that can issue tokens for this resource"
+        },
+        "scopes_supported": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Scopes supported when accessing this resource"
+        },
+        "bearer_methods_supported": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "e.g. header"
+        }
+      }
+    },
+    "authorization_server": {
+      "type": "object",
+      "description": "RFC 8414 OAuth Authorization Server Metadata (server capabilities and endpoints)",
+      "required": ["issuer", "token_endpoint"],
+      "properties": {
+        "issuer": {
+          "type": "string",
+          "format": "uri",
+          "description": "Authorization server issuer identifier"
+        },
+        "authorization_endpoint": {
+          "type": "string",
+          "format": "uri",
+          "description": "OAuth authorization endpoint"
+        },
+        "token_endpoint": {
+          "type": "string",
+          "format": "uri",
+          "description": "OAuth token endpoint"
+        },
+        "response_types_supported": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "e.g. code"
+        },
+        "grant_types_supported": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "e.g. authorization_code, refresh_token, client_credentials"
+        },
+        "scopes_supported": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Scopes the authorization server supports"
+        },
+        "code_challenge_methods_supported": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "PKCE methods supported, e.g. S256"
+        },
+        "token_endpoint_auth_methods_supported": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "e.g. client_secret_basic, client_secret_post"
+        },
+        "revocation_endpoint": {
+          "type": "string",
+          "format": "uri"
+        },
+        "introspection_endpoint": {
+          "type": "string",
+          "format": "uri"
+        },
+        "registration_endpoint": {
+          "type": "string",
+          "format": "uri"
+        }
+      },
+      "allOf": [
+        {
+          "if": {
+            "required": ["grant_types_supported"],
+            "properties": {
+              "grant_types_supported": {
+                "type": "array",
+                "contains": { "const": "client_credentials" },
+                "not": { "contains": { "const": "authorization_code" } }
+              }
+            }
+          },
+          "then": {},
+          "else": {
+            "required": ["authorization_endpoint"]
+          }
+        }
+      ]
+    },
+    "oauth_client": {
+      "type": "object",
+      "description": "Standout client registration and OAuth request choices (not part of RFC 8414)",
+      "required": ["client_id", "client_secret"],
+      "properties": {
+        "grant_type": {
+          "enum": ["authorization_code", "client_credentials"],
+          "default": "authorization_code",
+          "description": "OAuth grant used when connecting"
+        },
+        "response_type": {
+          "type": "string",
+          "default": "code",
+          "description": "Override response_type; defaults to code or first response_types_supported"
+        },
+        "scopes": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Fixed scope list when scopes_from_field is not used"
+        },
+        "scopes_from_field": {
+          "type": "string",
+          "description": "Connection form field containing selected scopes (array of strings)"
+        },
+        "scopes_always_include": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Scopes always appended to scopes_from_field"
+        },
+        "client_id": {
+          "$ref": "#/$defs/templated_value",
+          "description": "OAuth client_id, e.g. {{env:OAUTH_CLIENT_ID}}"
+        },
+        "client_secret": {
+          "$ref": "#/$defs/templated_value",
+          "description": "OAuth client_secret, e.g. {{env:OAUTH_CLIENT_SECRET}}"
+        },
+        "authorization_parameters": {
+          "type": "object",
+          "description": "Extra query parameters appended to the authorization request",
+          "additionalProperties": { "type": "string" }
+        },
+        "authorization_parameters_from_form": {
+          "type": "object",
+          "description": "Map connection form field values to authorization query parameters",
+          "additionalProperties": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "object",
+              "additionalProperties": { "type": "string" }
+            }
+          }
+        },
+        "token_request_method": {
+          "enum": ["POST", "GET"],
+          "default": "POST"
+        },
+        "token_request_parameters": {
+          "type": "object",
+          "description": "Extra parameters sent to the token endpoint",
+          "additionalProperties": { "type": "string" }
+        }
+      }
+    },
+    "strategy": {
+      "type": "object",
+      "required": ["id", "type"],
+      "properties": {
+        "id": { "type": "string" },
+        "title": {
+          "type": "string",
+          "description": "Label shown when the user picks authentication type before connecting"
+        },
+        "type": {
+          "enum": ["oauth2", "basic_auth", "api_key", "session", "none", "custom"]
+        },
+        "authorization_server": {
+          "$ref": "#/$defs/authorization_server",
+          "description": "RFC 8414 metadata (required when type is oauth2)"
+        },
+        "oauth_client": {
+          "$ref": "#/$defs/oauth_client",
+          "description": "Client credentials and request options (required when type is oauth2)"
+        },
+        "session": {
+          "$ref": "#/$defs/session",
+          "description": "Session login configuration (required when type is session)"
+        },
+        "token_response": {
+          "$ref": "#/$defs/token_response",
+          "description": "Maps token response fields to storage keys. Optional for oauth2 — platform defaults to standard RFC 6749 field names."
+        },
+        "refresh": {
+          "$ref": "#/$defs/refresh",
+          "description": "Token refresh policy. Optional for oauth2 — platform defaults to enabled for authorization_code."
+        },
+        "storage": {
+          "description": "Fields persisted in connection storage. Array of keys or object with optional display titles. Available as {{field}} in runtime templates.",
+          "oneOf": [
+            {
+              "type": "array",
+              "items": { "type": "string" },
+              "minItems": 1
+            },
+            {
+              "type": "object",
+              "minProperties": 1,
+              "additionalProperties": { "$ref": "#/$defs/storage_field" }
+            }
+          ]
+        },
+        "connection_schema": {
+          "type": "object",
+          "description": "Strategy-specific pre-connection form schema (JSON Schema)"
+        },
+        "form_persist": {
+          "type": "object",
+          "description": "Map pre-connection form fields to account storage keys after connect",
+          "additionalProperties": {
+            "oneOf": [
+              { "type": "string" },
+              {
+                "type": "object",
+                "required": ["as"],
+                "properties": {
+                  "as": { "type": "string" },
+                  "join": {
+                    "type": "string",
+                    "description": "Join array values before persisting, e.g. a space for OAuth scopes"
+                  }
+                }
+              }
+            ]
+          }
+        },
+        "runtime": {
+          "$ref": "#/$defs/runtime",
+          "description": "Strategy-specific runtime override"
+        }
+      },
+      "allOf": [
+        {
+          "if": {
+            "properties": { "type": { "const": "oauth2" } },
+            "required": ["type"]
+          },
+          "then": { "required": ["authorization_server", "oauth_client"] }
+        },
+        {
+          "if": {
+            "properties": { "type": { "const": "session" } },
+            "required": ["type"]
+          },
+          "then": { "required": ["session", "token_response"] }
+        }
+      ]
+    },
+    "session": {
+      "type": "object",
+      "required": ["token_endpoint"],
+      "additionalProperties": false,
+      "description": "HTTP request that creates an API session",
+      "properties": {
+        "token_endpoint": {
+          "$ref": "#/$defs/templated_uri",
+          "description": "Login URL that returns a session token"
+        },
+        "method": {
+          "enum": ["GET", "POST", "PUT", "PATCH", "DELETE"],
+          "default": "POST"
+        },
+        "headers": {
+          "type": "object",
+          "additionalProperties": { "$ref": "#/$defs/templated_value" }
+        },
+        "body": {
+          "type": "object",
+          "additionalProperties": { "$ref": "#/$defs/templated_value" }
+        },
+        "body_format": {
+          "enum": ["json", "form"],
+          "default": "json"
+        },
+        "token_source": {
+          "enum": ["body", "header"],
+          "default": "body",
+          "description": "Whether token_response reads from JSON response body or a response header"
+        },
+        "token_header": {
+          "type": "string",
+          "description": "Response header name when token_source is header"
+        },
+        "success_status": {
+          "type": "array",
+          "items": { "type": "integer" },
+          "default": [200]
+        }
+      }
+    },
+    "token_response": {
+      "type": "object",
+      "description": "Maps token or session response fields to connection storage keys",
+      "properties": {
+        "access_token": { "type": "string" },
+        "refresh_token": { "type": "string" },
+        "expires_at": {
+          "type": "object",
+          "properties": {
+            "from": { "type": "string" },
+            "type": { "enum": ["relative_seconds", "absolute_timestamp", "iso8601"] }
+          }
+        }
+      }
+    },
+    "refresh": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "grant_type": { "enum": ["refresh_token", "client_credentials"] },
+        "token_endpoint": {
+          "$ref": "#/$defs/templated_uri",
+          "description": "Override authorization_server.token_endpoint for refresh"
+        },
+        "expires_latency": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Seconds to reduce token validity by before refresh (oauth2 expires_latency)"
+        }
+      }
+    },
+    "storage_field": {
+      "type": "object",
+      "description": "Storage field metadata for account display and connect forms.",
+      "additionalProperties": false,
+      "properties": {
+        "title": {
+          "type": "string",
+          "description": "Label shown for this field"
+        },
+        "description": {
+          "type": "string",
+          "description": "Help text shown on connect forms. Not persisted."
+        }
+      }
+    },
+    "post_connect_hook": {
+      "type": "object",
+      "description": "Platform-run validation after connect. Uses resolved runtime headers and base_url for the active strategy.",
+      "required": ["request"],
+      "properties": {
+        "request": {
+          "type": "object",
+          "properties": {
+            "method": {
+              "enum": ["GET", "POST", "PUT", "PATCH", "DELETE"],
+              "default": "GET"
+            },
+            "path": {
+              "type": "string",
+              "description": "Appended to runtime base_url, e.g. /v1/me"
+            },
+            "url": {
+              "$ref": "#/$defs/templated_uri",
+              "description": "Optional full URL override instead of base_url + path"
+            },
+            "body": {
+              "type": "object",
+              "additionalProperties": { "$ref": "#/$defs/templated_value" }
+            },
+            "body_format": {
+              "enum": ["json", "form"],
+              "default": "json"
+            }
+          },
+          "anyOf": [
+            { "required": ["path"] },
+            { "required": ["url"] }
+          ]
+        },
+        "success_status": {
+          "type": "array",
+          "items": { "type": "integer" },
+          "default": [200]
+        },
+        "persist": {
+          "type": "object",
+          "description": "Map response values to connection storage keys",
+          "additionalProperties": {
+            "oneOf": [
+              {
+                "type": "string",
+                "description": "Dot path from response context, e.g. body.account.id"
+              },
+              {
+                "type": "object",
+                "required": ["from"],
+                "additionalProperties": false,
+                "properties": {
+                  "from": { "type": "string" },
+                  "as": { "enum": ["string"] }
+                }
+              }
+            ]
+          }
+        }
+      }
+    },
+    "runtime": {
+      "type": "object",
+      "description": "Runtime payload for actions/triggers. base_url defaults to protected_resource.resource when omitted.",
+      "properties": {
+        "base_url": { "$ref": "#/$defs/templated_uri" },
+        "headers": {
+          "type": "object",
+          "additionalProperties": { "$ref": "#/$defs/templated_value" }
+        },
+        "fields": {
+          "type": "object",
+          "additionalProperties": { "$ref": "#/$defs/templated_value" }
+        }
+      }
+    }
+  }
+}

data/ext/app_bridge/wit/v4_1/world.wit

@@ -243,6 +243,8 @@ interface http {
     status: u16,
     headers: headers,
     body: string,
+    /// Raw response payload for binary responses.
+    body-bytes: option<list<u8>>,
   }
 
   record request {

data/ext/app_bridge/wit/v5/world.wit

@@ -0,0 +1,363 @@
+package standout:app@5.0.0;
+
+interface types {
+  // The trigger-store is a string that is used to store data between trigger
+  // invocations. It is unique per trigger instance and is persisted between
+  // invocations.
+  //
+  // You can store any string here. We suggest that you use a serialized
+  // JSON object or similar since that will give you some flexibility if you
+  // need to add more data to the store.
+  type trigger-store = string;
+
+  record connection {
+    id: string,
+    name: string,
+    // The connection data is a JSON object serialized into a string. The JSON root
+    // will always be an object.
+    serialized-data: string,
+  }
+
+  record trigger-context {
+    // Trigger ID is a unique identifier for the trigger that is requested to be
+    // invoked.
+    trigger-id: string,
+
+    // The connection that the trigger is invoked for.
+    // Connection is required for all trigger operations.
+    connection: connection,
+
+    // The store will contain the data that was stored in the trigger store the
+    // last time the trigger was invoked.
+    store: trigger-store,
+
+    // The input data for the trigger, serialized as a JSON object string.
+    // This contains the input data from the trigger configuration form.
+    serialized-input: string,
+  }
+
+  record action-context {
+    // Action ID is a unique identifier for the action that is requested to be
+    // invoked.
+    action-id: string,
+
+    // The connection that the action is invoked for.
+    // Connection is required for all action operations.
+    connection: connection,
+
+    // The input data for the action, serialized as a JSON object string.
+    // This contains the data passed from the previous step in the workflow.
+    serialized-input: string,
+
+    // Optional reference information when the platform retries an action.
+    reference-object: option<reference-object>,
+  }
+
+  record trigger-response {
+    // The trigger events, each event will be used to spawn a new workflow
+    // execution in Standouts integration platform.
+    events: list<trigger-event>,
+
+    // The updated store will be stored and used the next time the trigger is
+    // invoked.
+    store: trigger-store,
+  }
+
+  record action-response {
+    // The output data from the action, serialized as a JSON object string.
+    // This contains the data that will be passed to the next step in the workflow.
+    // The data must be a valid JSON object (not an array or primitive).
+    serialized-output: string
+  }
+
+  record trigger-event {
+    // The ID of the trigger event
+    //
+    // If the connection used for the given instance of the trigger is the same,
+    // as seen before. Then the event will be ignored.
+    //
+    // A scheduler could therefore use a timestamp as the ID, to ensure that
+    // the event is only triggered once per given time.
+    //
+    // A trigger that acts on created orders in a e-commerce system could use
+    // the order ID as the ID, to ensure that the event is only triggered once
+    // per order.
+    //
+    // A trigger that acts on updated orders in a e-commerce system could use
+    // the order ID in combination with an updated at timestamp as the ID, to
+    // ensure that the event is only triggered once per order update.
+    id: string,
+
+    // Serialized data must be a JSON object serialized into a string
+    // Note that it is important that the root is an object, not an array,
+    // or another primitive type.
+    serialized-data: string,
+  }
+
+  /// Retry reference payload returned with error-code.retry-with-reference.
+  record reference-object {
+    /// Reference ID provided for retrying this request later.
+    reference: string,
+
+    /// Status describing the retry state.
+    status: string,
+  }
+
+  record app-error {
+    /// The error code identifying the type of failure.
+    code: error-code,
+
+    /// A human-readable message describing the error in more detail.
+    message: string,
+  }
+
+  /// An enumeration of error codes that can be returned by a trigger implementation.
+  /// These codes help the platform and plugin developers distinguish between different types of failures.
+  variant error-code {
+    /// Authentication failed. Typically due to an invalid or expired API key or token.
+    unauthenticated,
+
+    /// Authorization failed. The connection is valid but does not have the necessary permissions.
+    forbidden,
+
+    /// The trigger is misconfigured. For example, a required setting is missing or invalid.
+    misconfigured,
+
+    /// The target system does not support a required feature or endpoint.
+    unsupported,
+
+    /// The target system is rate-limiting requests. Try again later.
+    rate-limit,
+
+    /// The request timed out. The target system did not respond in time.
+    timeout,
+
+    /// The target system is currently unavailable or unreachable.
+    unavailable,
+
+    /// An unexpected internal error occurred in the plugin.
+    internal-error,
+
+    /// The response from the external system could not be parsed or was in an invalid format.
+    malformed-response,
+
+    /// A catch-all for all other types of errors. Should include a descriptive message.
+    other,
+
+    /// Retry the request using a reference identifier.
+    retry-with-reference(reference-object),
+
+    /// Complete the current workflow execution.
+    complete-workflow,
+
+    /// Complete the parent step execution.
+    complete-parent,
+  }
+}
+
+
+interface triggers {
+  use types.{trigger-context, trigger-event, trigger-response, app-error};
+
+  trigger-ids: func() -> result<list<string>, app-error>;
+
+  // Get the input schema for a specific trigger
+  // Returns a JSON Schema Draft 2020-12 schema as a string
+  // The schema may vary based on the connection in the context
+  // The trigger-id is extracted from the context
+  input-schema: func(context: trigger-context) -> result<string, app-error>;
+
+  // Get the output schema for a specific trigger
+  // Returns a JSON Schema Draft 2020-12 schema as a string
+  // The schema may vary based on the connection in the context
+  // The trigger-id is extracted from the context
+  output-schema: func(context: trigger-context) -> result<string, app-error>;
+
+  // Fetch events
+  //
+  // There are some limitations to the function:
+  // - It must return a `trigger-response` within 30 seconds
+  // - It must return less than or equal to 100 `trigger-response.events`
+  // - It must not return more than 64 kB of data in the `trigger-response.store`
+  //
+  // If you need to fetch more events, you can return up to 100 events and then
+  // store the data needed for you to remember where you left off in the store.
+  // The next time the trigger is invoked, you can use the store to continue
+  // where you left off.
+  //
+  // If you do not pass the limitations the return value will be ignored. We
+  // will not handle any events and we persist the store that was returned in
+  // the response.
+  //
+  // That also means that you should implement your fetch event function in a
+  // way that it can be called multiple times using the same context and return
+  // the same events. That will ensure that the user that is building an
+  // integration with your trigger will not miss any events if your system is
+  // down for a short period of time.
+  fetch-events: func(context: trigger-context) -> result<trigger-response, app-error>;
+}
+
+interface actions {
+  use types.{action-context, action-response, app-error};
+
+  action-ids: func() -> result<list<string>, app-error>;
+
+  // Get the input schema for a specific action
+  // Returns a JSON Schema Draft 2020-12 schema as a string
+  // The schema may vary based on the connection in the context
+  // The action-id is extracted from the context
+  input-schema: func(context: action-context) -> result<string, app-error>;
+
+  // Get the output schema for a specific action
+  // Returns a JSON Schema Draft 2020-12 schema as a string
+  // The schema may vary based on the connection in the context
+  // The action-id is extracted from the context
+  output-schema: func(context: action-context) -> result<string, app-error>;
+
+  // Execute an action
+  //
+  // There are some limitations to the function:
+  // - It must return an `action-response` within 30 seconds
+  // - The serialized-output must be a valid JSON object serialized as a string
+  //
+  // Actions can perform various operations such as:
+  // - Making HTTP requests to external APIs
+  // - Processing and transforming data
+  // - Storing data for future use
+  // - Triggering other systems or workflows
+  //
+  // The action receives input data from the previous step and can return
+  // serialized output data to be passed to the next step in the workflow.
+  execute: func(context: action-context) -> result<action-response, app-error>;
+}
+
+interface environment {
+  // Get all environment variables
+  env-vars: func() -> list<tuple<string, string>>;
+  // Get a specific environment variable by name
+  env-var: func(name: string) -> option<string>;
+}
+
+interface http {
+  record response {
+    status: u16,
+    headers: headers,
+    body: string,
+    /// Raw response payload for binary responses.
+    body-bytes: option<list<u8>>,
+  }
+
+  record request {
+    method: method,
+    url: string,
+    headers: headers,
+    body: string,
+  }
+
+  variant request-error {
+    other(string)
+  }
+
+  type headers = list<tuple<string, string>>;
+
+  resource request-builder {
+    constructor();
+
+    method: func(method: method) -> request-builder;
+    url: func(url: string) -> request-builder;
+
+    // Add a header to the request
+    header: func(key: string, value: string) -> request-builder;
+    headers: func(headers: list<tuple<string, string>>) -> request-builder;
+
+    // Add a body to the request
+    body: func(body: string) -> request-builder;
+    // Add a binary body to the request
+    body-bytes: func(body: list<u8>) -> request-builder;
+
+    object: func() -> request;
+
+    // Send the request
+    send: func() -> result<response, request-error>;
+  }
+
+  variant method {
+    get,
+    post,
+    put,
+    delete,
+    patch,
+    options,
+    head,
+  }
+}
+
+interface file {
+  // HTTP headers for file requests (same as http interface)
+  type headers = list<tuple<string, string>>;
+
+  // Normalized file data
+  record file-data {
+    // Base64-encoded file content
+    base64: string,
+    // MIME type (e.g., "application/pdf")
+    content-type: string,
+    // Filename
+    filename: string,
+  }
+
+  variant file-error {
+    // Failed to fetch file from URL
+    fetch-failed(string),
+    // Invalid input format (not a valid URL, data URI, or base64)
+    invalid-input(string),
+    // Request timed out
+    timeout(string),
+    // Any other error
+    other(string),
+  }
+
+  // Normalize any file source to FileData
+  //
+  // The source is automatically detected:
+  // - URL: "https://example.com/file.pdf" - fetched with optional headers
+  // - Data URI: "data:application/pdf;base64,JVBERi0..." - parsed and extracted
+  // - Base64: Any other string is treated as raw base64 - decoded to detect type
+  //
+  // Parameters:
+  // - source: URL, data URI, or base64-encoded content
+  // - headers: Optional HTTP headers for URL requests (e.g., Authorization)
+  // - filename: Optional filename override (auto-detected if not provided)
+  //
+  // Returns file-data which will be processed by the platform:
+  // 1. Fields with format: "file-output" in the output schema are identified
+  // 2. File data is uploaded using the configured file_uploader
+  // 3. The file-data is replaced with the blob ID in the response
+  normalize: func(source: string, headers: option<headers>, filename: option<string>) -> result<file-data, file-error>;
+}
+
+// Connection configuration for app-defined connectors.
+//
+// The connector is stateless. It declares how users connect and what runtime
+// data actions/triggers receive. The platform stores credentials and handles
+// OAuth flows, token refresh, and building serialized-data for execution.
+//
+// connection-config returns a JSON string.
+// It is not validated in WASM. app_bridge validates exported JSON against
+// connection-config-schema.json (see ext/app_bridge/docs/) using AppBridge::ConnectionConfigValidator.
+// Connector authors can run the same validator on JSON in CI without loading WASM.
+// integrationer persists connection_config_data,
+// and reads stored JSON at runtime — not a live WASM call.
+interface connections {
+  // Returns the embedded connection-config JSON document as a string.
+  connection-config: func() -> string;
+}
+
+world bridge {
+  import http;
+  import environment;
+  import file;
+  export triggers;
+  export actions;
+  export connections;
+}

data/lib/app_bridge/app.rb

@@ -39,6 +39,16 @@ module AppBridge
       30 # seconds
     end
 
+    def connections_supported?
+      _rust_connections_supported?
+    end
+
+    def connection_config
+      json = _rust_connection_config
+      ConnectionConfigValidator.validate!(json)
+      json
+    end
+
     private
 
     def validate_number_of_events!(events)

data/lib/app_bridge/connection_config_validator.rb

@@ -0,0 +1,101 @@
+# frozen_string_literal: true
+
+require "json"
+require "json_schemer"
+
+module AppBridge
+  # Validates connection-config JSON against the bundled JSON Schema.
+  class ConnectionConfigValidator
+    SCHEMA_PATH = File.expand_path(
+      "../../ext/app_bridge/docs/connection-config-schema.json",
+      __dir__
+    )
+
+    class << self
+      def validate!(data)
+        new.validate!(data)
+      end
+
+      def validate(data)
+        new.validate(data)
+      end
+
+      def schema
+        @schema ||= JSON.parse(File.read(SCHEMA_PATH))
+      end
+
+      def schemer
+        @schemer ||= JSONSchemer.schema(schema)
+      end
+    end
+
+    def validate!(data)
+      errors = validate(data)
+      return if errors.empty?
+
+      raise AppBridge::ConnectionConfigError, format_errors(errors)
+    end
+
+    def validate(data)
+      parsed = parse_data(data)
+      self.class.schemer.validate(parsed).to_a
+    end
+
+    private
+
+    def parse_data(data)
+      case data
+      when Hash
+        deep_stringify_keys(data)
+      when String
+        deep_stringify_keys(JSON.parse(data))
+      else
+        raise AppBridge::ConnectionConfigError, "connection-config must be a JSON object"
+      end
+    rescue JSON::ParserError => e
+      raise AppBridge::ConnectionConfigError, "Invalid connection-config JSON: #{e.message}"
+    end
+
+    def deep_stringify_keys(value)
+      case value
+      when Hash
+        value.each_with_object({}) do |(key, nested), result|
+          result[key.to_s] = deep_stringify_keys(nested)
+        end
+      when Array
+        value.map { |item| deep_stringify_keys(item) }
+      else
+        value
+      end
+    end
+
+    def format_errors(errors)
+      errors.map { |error| format_error(error) }.join("\n")
+    end
+
+    def format_error(error)
+      pointer = error["data_pointer"]
+      pointer = "/" if pointer.nil? || pointer.empty?
+      "#{pointer}: #{error_detail(error)}"
+    end
+
+    def error_detail(error)
+      message = error["error"]
+      return message if message.is_a?(String) && !message.empty?
+
+      details = error["details"]
+      return schemer_details_message(details) if details.is_a?(Hash)
+
+      details || error["type"] || "validation failed"
+    end
+
+    def schemer_details_message(details)
+      if details["missing_keys"]
+        missing = Array(details["missing_keys"]).join(", ")
+        return "missing required properties: #{missing}"
+      end
+
+      details.map { |key, value| "#{key}: #{value}" }.join(", ")
+    end
+  end
+end

data/lib/app_bridge/version.rb

@@ -4,5 +4,5 @@
 # ext/app_bridge/Cargo.toml file to keep them in sync.
 
 module AppBridge
-  VERSION = "4.1.0"
+  VERSION = "5.0.0"
 end

data/lib/app_bridge.rb

@@ -1,12 +1,14 @@
 # frozen_string_literal: true
 
 require_relative "app_bridge/version"
+require_relative "app_bridge/connection_config_validator"
 require_relative "app_bridge/app"
 require_relative "app_bridge/file_processor"
 
 # Communication layer for Standout integration apps using WebAssembly components.
 module AppBridge
   class Error < StandardError; end
+  class ConnectionConfigError < Error; end
   class TimeoutError < Error; end
   class TooManyEventsError < Error; end
   class StoreTooLargeError < Error; end

data/tasks/fixtures.rake

@@ -22,13 +22,16 @@ namespace :fixtures do
     desc "Compile the fixture apps"
     task :compile_rust do
       pwd = "spec/fixtures/components/rust_app"
-      compile_pid = Process.spawn("cargo clean && cargo build --release --target wasm32-wasip2",
-                                  chdir: pwd)
+      compile_pid = Process.spawn(
+        "CARGO_TARGET_DIR=target cargo clean && CARGO_TARGET_DIR=target cargo build --release --target wasm32-wasip2",
+        chdir: pwd
+      )
       Process.wait(compile_pid)
       raise "Failed to build artifacts" unless $CHILD_STATUS.success?
 
-      move_pid = Process.spawn("mv #{pwd}/target/wasm32-wasip2/release/rust_app.wasm #{pwd}/../rust_app.wasm")
+      move_pid = Process.spawn("cp #{pwd}/target/wasm32-wasip2/release/rust_app.wasm #{pwd}/../rust_app.wasm")
       Process.wait(move_pid)
+      raise "Failed to copy rust_app.wasm" unless $CHILD_STATUS.success?
     end
 
     task :compile_js do
@@ -51,8 +54,26 @@ namespace :fixtures do
       move_pid = Process.spawn("mv #{pwd}/target/wasm32-wasip2/release/rust_app_v3.wasm #{pwd}/../rust_app_v3.wasm")
       Process.wait(move_pid)
     end
+
+    desc "Compile the v5 fixture app (connections interface)"
+    task :compile_rust_v5 do
+      pwd = "spec/fixtures/components/rust_app_v5"
+      next unless File.exist?(pwd)
+
+      compile_pid = Process.spawn(
+        "CARGO_TARGET_DIR=target cargo clean && CARGO_TARGET_DIR=target cargo build --release --target wasm32-wasip2",
+        chdir: pwd
+      )
+      Process.wait(compile_pid)
+      raise "Failed to build v5 artifacts" unless $CHILD_STATUS.success?
+
+      move_pid = Process.spawn("cp #{pwd}/target/wasm32-wasip2/release/rust_app_v5.wasm #{pwd}/../rust_app_v5.wasm")
+      Process.wait(move_pid)
+      raise "Failed to copy rust_app_v5.wasm" unless $CHILD_STATUS.success?
+    end
   end
 end
 
 desc "Build all fixtures"
-task fixtures: %i[fixtures:apps:clean fixtures:apps:compile_rust fixtures:apps:compile_js fixtures:apps:compile_rust_v3]
+task fixtures: %i[fixtures:apps:clean fixtures:apps:compile_rust fixtures:apps:compile_js fixtures:apps:compile_rust_v3
+                  fixtures:apps:compile_rust_v5]

metadata

@@ -1,15 +1,29 @@
 --- !ruby/object:Gem::Specification
 name: app_bridge
 version: !ruby/object:Gem::Version
-  version: 4.1.0
+  version: 5.0.0
 platform: aarch64-linux
 authors:
 - Alexander Ross
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2026-02-10 00:00:00.000000000 Z
-dependencies: []
+date: 2026-08-28 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: json_schemer
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.3'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.3'
 description: The app_bridge gem is designed to enable seamless interaction with WebAssembly
   components that adhere to the WIT specification `standout:app`. It is developed
   for use in Standout's products.
@@ -26,13 +40,17 @@ files:
 - CHANGELOG.md
 - README.md
 - Rakefile
+- ext/app_bridge/docs/connection-config-schema.json
 - ext/app_bridge/wit/v3/world.wit
 - ext/app_bridge/wit/v4/world.wit
 - ext/app_bridge/wit/v4_1/world.wit
+- ext/app_bridge/wit/v5/world.wit
 - lib/app_bridge.rb
-- lib/app_bridge/3.2/app_bridge.so
+- lib/app_bridge/3.3/app_bridge.so
 - lib/app_bridge/3.4/app_bridge.so
+- lib/app_bridge/4.0/app_bridge.so
 - lib/app_bridge/app.rb
+- lib/app_bridge/connection_config_validator.rb
 - lib/app_bridge/file_processor.rb
 - lib/app_bridge/version.rb
 - sig/app_bridge.rbs
@@ -55,10 +73,10 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '3.2'
+      version: '3.3'
   - - "<"
     - !ruby/object:Gem::Version
-      version: 3.5.dev
+      version: 4.1.dev
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="