@adminide-stack/form-builder-core 5.1.8-alpha.98 → 5.1.9-alpha.14

package/lib/utils/authMetaDataSchema.js

@@ -1,4 +1,4 @@
-import {CONTRIBUTION_POINTS,ContributeDefaultValueSourceType}from'common';import {resolveConnectorFieldTokensInValue}from'./connectorFieldTokenResolver.js';import {parseSampleNodes,flattenSchemas}from'./schemaHelpers.js';const parseScopes = raw => raw.split(',').map(s => s.trim()).filter(Boolean);
+import {CONTRIBUTION_POINTS,ContributeDefaultValueSourceType}from'common';import {CONNECTOR_REDIRECT_URI_TEMPLATE}from'./connectorRedirectUri.js';import {connectorDefaultAuthMethod}from'./connectorDefaultAuthMethod.js';import {resolveConnectorFieldTokensInValue}from'./connectorFieldTokenResolver.js';import {pickConnectorOAuthRequestKnobs,connectorOAuthRequestKnobSettings}from'./connectorOAuthRequestKnobs.js';import {parseSampleNodes,flattenSchemas}from'./schemaHelpers.js';const parseScopes = raw => raw.split(',').map(s => s.trim()).filter(Boolean);
 const parseEnumValues = raw => {
   if (Array.isArray(raw)) return raw;
   if (raw === null || raw === undefined) return [];
@@ -92,13 +92,19 @@ const buildAppSeed = p => {
     useCustomOAuthEndpoints: p.useCustomOAuthEndpoints,
     usePKCE: p.usePKCE,
     clientAuthMethod: p.clientAuthMethod,
+    clientIdParamName: p.clientIdParamName,
+    useCommaSeparatedScopes: p.useCommaSeparatedScopes,
+    tokenEndpointHeaders: p.tokenEndpointHeaders,
+    ...pickConnectorOAuthRequestKnobs(p),
     authorizationUrl: p.authorizationUrl,
     tokenUrl: p.tokenUrl,
     revocationUrl: p.revocationUrl,
     useBasicAuth: p.useBasicAuth,
+    requiresDeveloperToken: p.requiresDeveloperToken,
     mcpUrl: p.mcpUrl || '',
     connectorType: 'app',
     authMethods,
+    defaultAuthMethod: p.defaultAuthMethod,
     fields: p.fields || [],
     resources: p.resources || [],
     customButtons: p.customButtons || [],
@@ -232,8 +238,129 @@ const seedCategory = seed => seed.categories[0];
  * 'app' but a `${id}:llm` key; everything else is an app connector.
  */
 const seedCredentialNamespace = seed => seed.connectorType === 'mcp' ? 'mcp' : seed.key.endsWith(':llm') ? 'llm' : 'app';
+/**
+ * Normalize a provider id or form namespace into a vault secret key prefix.
+ * e.g. `gmail-app-hk7zf7w9` → `GMAIL_APP_HK7ZF7W9`
+ */
 const toVaultPrefix = value => value.replace(/[^a-zA-Z0-9]/g, '_').toUpperCase();
-const seedAuthMethodDefault = seed => seed.authMethods.includes('oauth2') ? 'oauth' : seed.connectorType === 'mcp' ? 'mcp' : 'api_key';
+/**
+ * Per-form-instance vault keys for non-account-specific secrets (e.g. API key fields).
+ *
+ * Do NOT use these for OAuth access/refresh tokens when multiple accounts can share
+ * one published form — connecting account B would overwrite account A's vault entry.
+ * Access/refresh live under per-credential `configKey.accounts.{id}.*` and durable
+ * `CRED_<id>_*` vault keys via syncOAuthTokensToCredentialVault.
+ *
+ * Client id/secret stay provider-scoped (shared OAuth app credentials).
+ */
+const buildOAuthInstanceTokenVaultKeys = namespace => {
+  const prefix = toVaultPrefix(namespace);
+  return {
+    /** @deprecated Do not wire access tokens to this shared key — use CRED_* instead. */
+    accessToken: `${prefix}_ACCESS_TOKEN`,
+    /** @deprecated Do not wire refresh tokens to this shared key — use CRED_* instead. */
+    refreshToken: `${prefix}_REFRESH_TOKEN`,
+    apiKey: `${prefix}_API_KEY`
+  };
+};
+/** `_{24-hex}` suffix appended to a base vault key to scope it to one credential. */
+const CREDENTIAL_SCOPED_SECRET_KEY_RE = /_([a-fA-F0-9]{24})$/;
+/**
+ * Credential-scoped vault key: `{BASE_KEY}_{credentialId}`.
+ *
+ * This is the platform's own convention — `preferences-service` resolves a
+ * `format: 'secret'` config key to `${defaultValueSource.secretKey}_${credentialId}`
+ * on both read and write whenever the node context carries a `credentialId`.
+ * API-key connectors reuse the exact same shape so several credentials for one
+ * provider can coexist in a project/env instead of overwriting each other's
+ * shared `PROVIDER_API_KEY` entry (the same isolation OAuth gets from its
+ * per-account configKey).
+ *
+ * Idempotent when `baseSecretKey` is already scoped to the same credential.
+ */
+const buildCredentialScopedSecretKey = (baseSecretKey, credentialId) => {
+  const base = stripCredentialScopedSecretKey(baseSecretKey || '');
+  if (!base || !credentialId) {
+    return base || '';
+  }
+  return `${base}_${credentialId}`;
+};
+/** True when a vault key already carries a `_{credentialId}` suffix. */
+const isCredentialScopedSecretKey = secretKey => CREDENTIAL_SCOPED_SECRET_KEY_RE.test(secretKey || '');
+/** Strip `_{credentialId}` to recover the catalog/base vault key. */
+const stripCredentialScopedSecretKey = secretKey => (secretKey || '').replace(CREDENTIAL_SCOPED_SECRET_KEY_RE, '');
+/** credentialId embedded in a scoped vault key, if any. */
+const credentialIdFromScopedSecretKey = secretKey => CREDENTIAL_SCOPED_SECRET_KEY_RE.exec(secretKey || '')?.[1] || null;
+/**
+ * Durable per-credential token vault keys. Used after OAuth connect so each
+ * FormBuilderCredential keeps its own token pair even when several credentials
+ * share the same published template/configKey staging path.
+ */
+const buildCredentialOAuthTokenVaultKeys = credentialId => {
+  const prefix = toVaultPrefix(`cred_${credentialId}`);
+  return {
+    accessToken: `${prefix}_ACCESS_TOKEN`,
+    refreshToken: `${prefix}_REFRESH_TOKEN`
+  };
+};
+/**
+ * Provider-scoped per-credential OAuth vault keys (e.g. OAuth callback writes
+ * `GOOGLE_GMAIL_ACCESS_TOKEN_{credentialId}` to Personal Vault).
+ */
+const buildProviderCredentialOAuthTokenVaultKeys = (providerId, credentialId) => {
+  const prefix = toVaultPrefix(providerId);
+  return {
+    accessToken: `${prefix}_ACCESS_TOKEN_${credentialId}`,
+    refreshToken: `${prefix}_REFRESH_TOKEN_${credentialId}`
+  };
+};
+/**
+ * Namespace-scoped per-credential OAuth vault keys (`google_gmail-app` → `GOOGLE_GMAIL_APP_*_{id}`).
+ */
+const buildNamespaceCredentialOAuthTokenVaultKeys = (namespace, credentialId) => {
+  const prefix = toVaultPrefix(namespace);
+  return {
+    accessToken: `${prefix}_ACCESS_TOKEN_${credentialId}`,
+    refreshToken: `${prefix}_REFRESH_TOKEN_${credentialId}`
+  };
+};
+/**
+ * Per-connected-account OAuth preferences path.
+ * Template: `….{namespace}.oauthConnector`
+ * Account:  `….{namespace}.oauthConnector.accounts.{credentialId}`
+ *
+ * OAuth app settings (client id/secret, scopes, endpoints) are seeded from the
+ * template path onto each account path so ApplicationConnectorOAuthService can
+ * use a single configKey without a shared token staging slot.
+ */
+const CREDENTIAL_ACCOUNT_CONFIG_KEY_RE = /\.accounts\.([a-fA-F0-9]{24})$/;
+/** True when configKey is already scoped to a FormBuilder credential account. */
+const isCredentialAccountConfigKey = configKey => CREDENTIAL_ACCOUNT_CONFIG_KEY_RE.test(configKey || '');
+/** Strip `.accounts.{credentialId}` to recover the published template configKey. */
+const stripCredentialAccountConfigKey = configKey => (configKey || '').replace(CREDENTIAL_ACCOUNT_CONFIG_KEY_RE, '');
+/** credentialId embedded in an account-scoped configKey, if any. */
+const credentialIdFromOAuthConfigKey = configKey => {
+  const match = CREDENTIAL_ACCOUNT_CONFIG_KEY_RE.exec(configKey || '');
+  return match?.[1] || null;
+};
+/**
+ * Build the per-credential OAuth configKey used for connect / refresh / disconnect.
+ * Idempotent when `baseConfigKey` is already account-scoped for the same id.
+ */
+const buildCredentialOAuthConfigKey = (baseConfigKey, credentialId) => {
+  const base = stripCredentialAccountConfigKey(baseConfigKey || '').replace(/\.+$/, '');
+  if (!base || !credentialId) {
+    return base || '';
+  }
+  return `${base}.accounts.${credentialId}`;
+};
+/** Extract the form namespace from an oauthConnector configKey path. */
+const namespaceFromOAuthConfigKey = configKey => {
+  const normalized = stripCredentialAccountConfigKey(configKey || '');
+  const match = /integrationSettings\.settings\.[^.]+\.([^.]+)\.oauthConnector(?:\.|$)/.exec(normalized);
+  return match?.[1] || null;
+};
+const seedAuthMethodDefault = seed => connectorDefaultAuthMethod(seed) ?? (seed.authMethods.includes('oauth2') ? 'oauth' : seed.connectorType === 'mcp' ? 'mcp' : 'api_key');
 /**
  * Build a `genericType -> count` map for the given fields. Used by
  * {@link resolveFieldKey} to detect colliding `genericType` values so that
@@ -270,7 +397,10 @@ const resolveFieldKey = (field, genericTypeCounts) => {
   return field.name;
 };
 function buildPreGeneratedFormSteps(seed, namespace) {
-  const vaultPrefix = toVaultPrefix(seed.providerId);
+  // Shared OAuth app credentials (one client id/secret per provider).
+  const providerVaultPrefix = toVaultPrefix(seed.providerId);
+  // Per-form-instance tokens — unique namespace prevents multi-account overwrite.
+  const instanceTokenKeys = buildOAuthInstanceTokenVaultKeys(namespace);
   const isApp = seed.connectorType === 'app';
   const isApiKeyOnly = seedIsApiKeyOnly(seed);
   const templateType = seedTemplateType(seed);
@@ -365,14 +495,15 @@ function buildPreGeneratedFormSteps(seed, namespace) {
       connectorTokenUrl: seed.tokenUrl || '',
       connectorRevocationUrl: seed.revocationUrl || '',
       useBasicAuth: seed.useBasicAuth ?? false,
-      connectorRedirectUri: '{{CLIENT_URL}}/{{CONNECTOR_ENDPOINT}}',
+      connectorRedirectUri: CONNECTOR_REDIRECT_URI_TEMPLATE,
       // connectorAuthMethod — present only for non-oauth connectors (matches reference forms)
-      ...(!seed.authMethods.includes('oauth2') ? {
+      ...(seedAuthMethodDefault(seed) !== 'oauth' ? {
         connectorAuthMethod: seedAuthMethodDefault(seed)
       } : {}),
-      ...(seed.fields.length > 0 ? {
-        connectorProviderFields: seed.fields
-      } : {}),
+      // Always emitted, even empty: a template entry is self-describing only when a reader can
+      // tell "no extra provider fields" from "unknown", and the credential picker synthesizes
+      // the form from this entry instead of fetching the published form document.
+      connectorProviderFields: seed.fields,
       ...(seed.resources.length > 0 ? {
         connectorProviderResources: seed.resources
       } : {}),
@@ -407,7 +538,7 @@ function buildPreGeneratedFormSteps(seed, namespace) {
       defaultValueSource: {
         type: ContributeDefaultValueSourceType.Vault,
         secretType: 'OAUTH_CLIENT',
-        secretKey: `${vaultPrefix}_CLIENT_ID`,
+        secretKey: `${providerVaultPrefix}_CLIENT_ID`,
         ...(isApp ? {
           requiredReference: true
         } : {})
@@ -426,13 +557,30 @@ function buildPreGeneratedFormSteps(seed, namespace) {
       defaultValueSource: {
         type: ContributeDefaultValueSourceType.Vault,
         secretType: 'OAUTH_CLIENT',
-        secretKey: `${vaultPrefix}_CLIENT_SECRET`,
+        secretKey: `${providerVaultPrefix}_CLIENT_SECRET`,
         ...(isApp ? {
           requiredReference: true
         } : {})
       }
     }
-  }, {
+  }, ...(seed.requiresDeveloperToken ? [{
+    id: 'developerToken',
+    type: 'string',
+    label: 'Developer Token',
+    description: 'Provider-issued developer token, sent with every API request alongside the OAuth access token',
+    format: 'secret',
+    readOnly: true,
+    default: '',
+    scope: isApp ? 6 /* ConfigurationScope.MACHINE_OVERRIDABLE */ : 1 /* ConfigurationScope.APPLICATION */,
+    schemaExtensions: {
+      defaultValueSource: {
+        type: ContributeDefaultValueSourceType.Vault,
+        secretType: 'OAUTH_CLIENT',
+        secretKey: `${providerVaultPrefix}_DEVELOPER_TOKEN`,
+        requiredReference: true
+      }
+    }
+  }] : []), {
     id: 'apiKey',
     type: 'string',
     label: 'API Key',
@@ -445,7 +593,7 @@ function buildPreGeneratedFormSteps(seed, namespace) {
       defaultValueSource: {
         type: ContributeDefaultValueSourceType.Vault,
         secretType: 'API_KEY',
-        secretKey: `${vaultPrefix}_API_KEY`
+        secretKey: instanceTokenKeys.apiKey
       }
     }
   }, {
@@ -457,11 +605,16 @@ function buildPreGeneratedFormSteps(seed, namespace) {
     default: '',
     readOnly: true,
     scope: 1 /* ConfigurationScope.APPLICATION */,
+
+    // No shared vault secretKey by default — multi-account connects would overwrite.
+    // Staging still needs a vault route: writeSettings discards format:secret when
+    // defaultValueSource is missing. Instance keys are the temporary staging slot;
+    // completeOAuth / sync(force) copies them into CRED_<credentialId>_*.
     schemaExtensions: {
       defaultValueSource: {
         type: ContributeDefaultValueSourceType.Vault,
         secretType: 'OAUTH_CLIENT',
-        secretKey: `${vaultPrefix}_ACCESS_TOKEN`
+        secretKey: instanceTokenKeys.accessToken
       }
     }
   }, {
@@ -477,7 +630,7 @@ function buildPreGeneratedFormSteps(seed, namespace) {
       defaultValueSource: {
         type: ContributeDefaultValueSourceType.Vault,
         secretType: 'OAUTH_CLIENT',
-        secretKey: `${vaultPrefix}_REFRESH_TOKEN`
+        secretKey: instanceTokenKeys.refreshToken
       }
     }
   }, {
@@ -565,7 +718,7 @@ function buildPreGeneratedFormSteps(seed, namespace) {
     type: 'string',
     label: 'Redirect URI',
     scope: 2 /* ConfigurationScope.MACHINE */,
-    default: '{{CLIENT_URL}}/{{CONNECTOR_ENDPOINT}}',
+    default: CONNECTOR_REDIRECT_URI_TEMPLATE,
     readOnly: true,
     defaultValueSource: {
       type: ContributeDefaultValueSourceType.Environment
@@ -660,6 +813,12 @@ function buildPreGeneratedFormSteps(seed, namespace) {
       'ui:widget': 'hidden',
       'ui:placeholder': 'Enter OAuth Client Secret'
     },
+    ...(seed.requiresDeveloperToken ? {
+      developerToken: {
+        'ui:widget': 'hidden',
+        'ui:placeholder': 'Enter Developer Token'
+      }
+    } : {}),
     apiKey: {
       'ui:widget': seed.connectorType === 'mcp' || !seed.authMethods.includes('oauth2') ? 'password' : 'hidden',
       'ui:placeholder': 'Enter API Key'
@@ -758,14 +917,15 @@ function buildPreGeneratedFormSteps(seed, namespace) {
       connectorTokenUrl: seed.tokenUrl || '',
       connectorRevocationUrl: seed.revocationUrl || '',
       useBasicAuth: seed.useBasicAuth ?? false,
-      connectorRedirectUri: '{{CLIENT_URL}}/{{CONNECTOR_ENDPOINT}}',
+      connectorRedirectUri: CONNECTOR_REDIRECT_URI_TEMPLATE,
       // connectorAuthMethod — present only for non-oauth connectors (matches reference forms)
-      ...(!seed.authMethods.includes('oauth2') ? {
+      ...(seedAuthMethodDefault(seed) !== 'oauth' ? {
         connectorAuthMethod: seedAuthMethodDefault(seed)
       } : {}),
-      ...(seed.fields.length > 0 ? {
-        connectorProviderFields: seed.fields
-      } : {}),
+      // Always emitted, even empty: a template entry is self-describing only when a reader can
+      // tell "no extra provider fields" from "unknown", and the credential picker synthesizes
+      // the form from this entry instead of fetching the published form document.
+      connectorProviderFields: seed.fields,
       ...(seed.resources.length > 0 ? {
         connectorProviderResources: seed.resources
       } : {}),
@@ -792,7 +952,8 @@ function buildOAuthConfigurationContribution(seedsWithNamespaces) {
     seed,
     namespace
   } of seedsWithNamespaces) {
-    const vaultPrefix = toVaultPrefix(seed.providerId);
+    const providerVaultPrefix = toVaultPrefix(seed.providerId);
+    const instanceTokenKeys = buildOAuthInstanceTokenVaultKeys(namespace);
     const isApp = seed.connectorType === 'app';
     const isApiKeyOnly = seedIsApiKeyOnly(seed);
     const templateType = seedTemplateType(seed);
@@ -854,7 +1015,7 @@ function buildOAuthConfigurationContribution(seedsWithNamespaces) {
         defaultValueSource: {
           type: ContributeDefaultValueSourceType.Vault,
           secretType: 'OAUTH_CLIENT',
-          secretKey: `${vaultPrefix}_CLIENT_ID`,
+          secretKey: `${providerVaultPrefix}_CLIENT_ID`,
           ...(isApp ? {
             requiredReference: true
           } : {})
@@ -875,7 +1036,7 @@ function buildOAuthConfigurationContribution(seedsWithNamespaces) {
         defaultValueSource: {
           type: ContributeDefaultValueSourceType.Vault,
           secretType: 'OAUTH_CLIENT',
-          secretKey: `${vaultPrefix}_CLIENT_SECRET`,
+          secretKey: `${providerVaultPrefix}_CLIENT_SECRET`,
           ...(isApp ? {
             requiredReference: true
           } : {})
@@ -885,6 +1046,29 @@ function buildOAuthConfigurationContribution(seedsWithNamespaces) {
         'ui:description': 'OAuth application client secret',
         'ui:placeholder': 'Enter OAuth Client Secret'
       });
+      // ── Developer token — an extra provider credential a few APIs (Google Ads)
+      // require on every call. Provisioned exactly like clientId/clientSecret.
+      if (seed.requiresDeveloperToken) {
+        addField('developerToken', {
+          type: 'string',
+          title: 'Developer Token',
+          description: 'Provider-issued developer token, sent with every API request alongside the OAuth access token',
+          format: 'secret',
+          default: '',
+          readOnly: true,
+          scope: isApp ? 6 /* ConfigurationScope.MACHINE_OVERRIDABLE */ : 1 /* ConfigurationScope.APPLICATION */,
+          defaultValueSource: {
+            type: ContributeDefaultValueSourceType.Vault,
+            secretType: 'OAUTH_CLIENT',
+            secretKey: `${providerVaultPrefix}_DEVELOPER_TOKEN`,
+            requiredReference: true
+          }
+        }, {
+          'ui:widget': 'hidden',
+          'ui:description': 'Provider-issued developer token, sent with every API request alongside the OAuth access token',
+          'ui:placeholder': 'Enter Developer Token'
+        });
+      }
       addField('apiKey', {
         type: 'string',
         title: 'API Key',
@@ -896,7 +1080,7 @@ function buildOAuthConfigurationContribution(seedsWithNamespaces) {
         defaultValueSource: {
           type: ContributeDefaultValueSourceType.Vault,
           secretType: 'API_KEY',
-          secretKey: `${vaultPrefix}_API_KEY`
+          secretKey: instanceTokenKeys.apiKey
         }
       }, {
         'ui:widget': !seed.authMethods.includes('oauth2') ? 'password' : 'hidden',
@@ -912,10 +1096,13 @@ function buildOAuthConfigurationContribution(seedsWithNamespaces) {
         readOnly: true,
         writeOnly: true,
         scope: 1 /* ConfigurationScope.APPLICATION */,
+
+        // Staging vault route required — writeSettings drops format:secret
+        // without defaultValueSource. Durable isolation is CRED_* via sync.
         defaultValueSource: {
           type: ContributeDefaultValueSourceType.Vault,
           secretType: 'OAUTH_CLIENT',
-          secretKey: `${vaultPrefix}_ACCESS_TOKEN`
+          secretKey: instanceTokenKeys.accessToken
         }
       }, {
         'ui:widget': 'hidden'
@@ -932,7 +1119,7 @@ function buildOAuthConfigurationContribution(seedsWithNamespaces) {
         defaultValueSource: {
           type: ContributeDefaultValueSourceType.Vault,
           secretType: 'OAUTH_CLIENT',
-          secretKey: `${vaultPrefix}_REFRESH_TOKEN`
+          secretKey: instanceTokenKeys.refreshToken
         }
       }, {
         'ui:widget': 'hidden'
@@ -1039,6 +1226,18 @@ function buildOAuthConfigurationContribution(seedsWithNamespaces) {
       }, {
         'ui:widget': 'hidden'
       });
+      // Without this key in the registry the connect flow cannot see the catalog's
+      // usePKCE, and both the widget and readOAuthConfigFromRegistry fall back to
+      // PKCE-on — silently ignoring every `usePKCE: false` in the catalog.
+      addField('usePKCE', {
+        type: 'boolean',
+        title: 'Use PKCE',
+        default: seed.usePKCE !== false,
+        readOnly: true,
+        scope: 2 /* ConfigurationScope.MACHINE */
+      }, {
+        'ui:widget': 'hidden'
+      });
       if (seed.clientAuthMethod) {
         addField('clientAuthMethod', {
           type: 'string',
@@ -1050,10 +1249,59 @@ function buildOAuthConfigurationContribution(seedsWithNamespaces) {
           'ui:widget': 'hidden'
         });
       }
+      if (seed.clientIdParamName) {
+        addField('clientIdParamName', {
+          type: 'string',
+          title: 'Client ID Parameter Name',
+          default: seed.clientIdParamName,
+          readOnly: true,
+          scope: 2 /* ConfigurationScope.MACHINE */
+        }, {
+          'ui:widget': 'hidden'
+        });
+      }
+      if (seed.useCommaSeparatedScopes) {
+        addField('useCommaSeparatedScopes', {
+          type: 'boolean',
+          title: 'Use Comma-Separated Scopes',
+          default: true,
+          readOnly: true,
+          scope: 2 /* ConfigurationScope.MACHINE */
+        }, {
+          'ui:widget': 'hidden'
+        });
+      }
+      if (seed.tokenEndpointHeaders && Object.keys(seed.tokenEndpointHeaders).length > 0) {
+        // Stored as a JSON string: the OAuth service reads it with one prefix read and
+        // resolves its `{{KEY}}` templates the same way it does the OAuth URLs.
+        addField('tokenEndpointHeaders', {
+          type: 'string',
+          title: 'Token Endpoint Headers',
+          default: JSON.stringify(seed.tokenEndpointHeaders),
+          readOnly: true,
+          scope: 2 /* ConfigurationScope.MACHINE */
+        }, {
+          'ui:widget': 'hidden'
+        });
+      }
+      // Generic OAuth request/response knobs (TikTok Business). Only the ones a connector
+      // sets are declared, as strings (lists and objects as JSON), so every other
+      // connector's settings stay byte-identical.
+      for (const knob of connectorOAuthRequestKnobSettings(seed)) {
+        addField(knob.name, {
+          type: 'string',
+          title: knob.title,
+          default: knob.value,
+          readOnly: true,
+          scope: 2 /* ConfigurationScope.MACHINE */
+        }, {
+          'ui:widget': 'hidden'
+        });
+      }
       addField('redirectUri', {
         type: 'string',
         title: 'Redirect URI',
-        default: '{{CLIENT_URL}}/{{CONNECTOR_ENDPOINT}}',
+        default: CONNECTOR_REDIRECT_URI_TEMPLATE,
         readOnly: true,
         scope: 2 /* ConfigurationScope.MACHINE */,
         defaultValueSource: {
@@ -1286,15 +1534,24 @@ function buildOAuthConfigurationContribution(seedsWithNamespaces) {
     properties: formUIProperties
   }];
 }
-function generateFromSeeds(seeds, title, formIcon, formExtensionId) {
+function generateFromSeeds(seeds, title, formIcon, formExtensionId, options = {}) {
   const allNodes = [];
   const mergedUiLayoutTemplates = {};
   const mergedUiLayoutUi = {};
   let uiLayoutFormMetadataNode = null;
   const seedsWithNamespaces = [];
   seeds.forEach((seed, idx) => {
-    const generatedFormId = `${sanitizeFieldKey(seed.providerId)}-${seed.connectorType}-${Math.random().toString(36).substring(2, 10)}`;
-    const providerTitle = `${seed.title} (${seed.connectorType.toUpperCase()})`;
+    // The namespace doubles as the formId AND flows into every configuration key
+    // (`integrationSettings.settings.<type>.<ns>.oauthConnector…`). An explicit
+    // namespace lets a caller regenerate the form for an ALREADY-PUBLISHED template
+    // so the output is identity-compatible with it (same formId, same config keys);
+    // the random default is only safe for brand-new forms.
+    const generatedFormId = options.namespaces?.[idx] || `${sanitizeFieldKey(seed.providerId)}-${seed.connectorType}-${Math.random().toString(36).substring(2, 10)}`;
+    // The connector's own title, with no `(APP)` marker appended. `connectorType` is
+    // `app` for every one of the 1166 catalog connectors, so the suffix carried no
+    // information - it just made every row in the credential picker read "… (APP)".
+    // The type is still contributed as `connectorType` for anything that needs it.
+    const providerTitle = seed.title;
     const namespace = generatedFormId;
     seedsWithNamespaces.push({
       seed,
@@ -1574,8 +1831,8 @@ function generateFromSeeds(seeds, title, formIcon, formExtensionId) {
   if (!uiLayoutFormMetadataNode) return allNodes;
   return [...allNodes, uiLayoutFormMetadataNode, uiLayoutFormNode, uiLayoutFormUINode];
 }
-function createOAuthSeedGenerator(seeds) {
-  return (title = '', formIcon = '', formExtensionId = '') => generateFromSeeds(seeds, title, formIcon, formExtensionId);
+function createOAuthSeedGenerator(seeds, options = {}) {
+  return (title = '', formIcon = '', formExtensionId = '') => generateFromSeeds(seeds, title, formIcon, formExtensionId, options);
 }
 // create provider refs
 const findRefPath = node => {
@@ -1633,4 +1890,4 @@ const buildMetadataSchema = sampleNodes => {
     configurationNodes: entry.configurationNodes,
     contributes: {}
   }))];
-};export{buildMetadataSchema,buildProviderConfig,buildProviderSeedFromConfig,buildProviderWithRefs,createOAuthSeedGenerator};//# sourceMappingURL=authMetaDataSchema.js.map
+};export{buildCredentialOAuthConfigKey,buildCredentialOAuthTokenVaultKeys,buildCredentialScopedSecretKey,buildMetadataSchema,buildNamespaceCredentialOAuthTokenVaultKeys,buildOAuthInstanceTokenVaultKeys,buildProviderConfig,buildProviderCredentialOAuthTokenVaultKeys,buildProviderSeedFromConfig,buildProviderWithRefs,createOAuthSeedGenerator,credentialIdFromOAuthConfigKey,credentialIdFromScopedSecretKey,isCredentialAccountConfigKey,isCredentialScopedSecretKey,namespaceFromOAuthConfigKey,stripCredentialAccountConfigKey,stripCredentialScopedSecretKey,toVaultPrefix};//# sourceMappingURL=authMetaDataSchema.js.map

package/lib/utils/authMetaDataSchema.js.map

@@ -1 +1 @@
-{"version":3,"file":"authMetaDataSchema.js","sources":["../../src/utils/authMetaDataSchema.ts"],"sourcesContent":[null],"names":[],"mappings":"6NAeA,MAAA,WAAU,GAAA,GAAA,IAAA,GAAoB,CAAA,KAAA,CAAA,GAAA,CAAA,CAAA,GAAA,CAAA,CAAA,IAAA,CAAA,CAAA,IAAA,EAAA,CAAA,CAAA,MAAA,CAAA,OAAA,CAAA;MAC1B,eAAY,GAAA,GAAA,IAAA;MACZ,KAAA,CAAA,WAAmB,CAAA,EAAA,OAAA,GAAA;MACnB,GAAK,SAAS,IAAA,GAAA,KAAA,SAAA,EAAA,OAAA,EAAA;MACd,OAAA,GAAW,aAAS,EAAA,OAAA,EAAA;MACpB,CAAA,GAAM,CAAA,IAAE,EAAA,EAAM,OAAG,EAAA;MACjB;IACA,MAAA,MAAA,GAAA,IAAA,CAAA,KAAwB,CAAE,GAAA,CAAA;IAC1B,OAAO,KAAG,CAAA,OAAQ,CAAA,MAAA,CAAA,GAAA,MAAA,GAAA,EAAA;AAClB,EAAA,CAAA,CAAA,OAAA,CAAA,EAAA;IACA,OAAA,GAAA,CAAA,KAAgB,CAAC,IAAE,CAAA,CAAA,GAAO,CAAA,IAAA,IAAA,IAAA,CAAA,IAAA,EAAA,CAAA,CAAA,MAAA,CAAA,OAAA,CAAA,CAAA,GAAA,CAAA,IAAA,IAAA;MAC1B,MAAQ,CAAC,KAAE,EAAA,KAAO,CAAA,GAAA,IAAA,CAAA,KAAA,CAAA,GAAA,CAAA;MAClB,OAAA;QACA,KAAA,EAAA,CAAY,KAAG,IAAA,EAAQ,EAAA,IAAA,EAAA;QACvB,KAAS,EAAA,CAAA,KAAO,IAAA,KAAA,IAAA,EAAA,EAAA,IAAA;OAChB;IACA,CAAA,CAAA;;;MAGA,QAAA,GAAa,KAAE,IAAA,CAAA,KAAA,IAAA,EAAkB,EAAG,OAAA,CAAA,oBAAA,EAAA,OAAA,CAAA,CAAA,OAAA,CAAA,uBAAA,EAAA,OAAA,CAAA,CAAA,OAAA,CAAA,gBAAA,EAAA,GAAA,CAAA,CAAA,OAAA,CAAA,UAAA,EAAA,EAAA,CAAA,CAAA,WAAA,EAAA;MACpC,iBAAiB,GAAA,CAAA,MAAA,EAAA,UAAA,KAAA,MAAA,CAAA,GAAA,CAAA,KAAA,KAAA;MACjB,EAAA,KAAA,CAAA,IAAA;OACA,EAAA,KAAU,CAAA;AACb,EAAA,IAAA,EAAA,KAAA,CAAA,IAAA;AAED,EAAA,kBAAiB,CAAA,WAAA;oBACA,CAAA,WAAA;UACR,OAAQ,CAAC,QAAA;gBACF,KAAC,CAAA,YAAA,IAAA,EAAA;eACF,EAAE,MAAM,aAAC;UACpB,EAAA,KAAa,SAAO;cACV,OAAO,CAAC,QAAA,GAAA,KAAA,CAAA,YAAA,IAAA;IAClB,IAAA,EAAA,OAAY;IACZ,UAAA,EAAA,gBAAuB;AACvB,IAAA,SAAA,EAAA,KAAe,CAAA,SAAA,KAAA,UAAA,GAAA,CAAA,EAAA,QAAA,CAAA,UAAA,CAAA,CAAA,CAAA,EAAA,QAAA,CAAA,KAAA,CAAA,IAAA,CAAA,CAAA,CAAA,GAAA,QAAA,CAAA,KAAA,CAAA,IAAA,CAAA;AACX,GAAA,GAAA,IAAA;AACA,EAAA,QAAA,EAAA,KAAA,CAAU,QAAE;YACZ,EAAA,eAAkB,CAAA,KAAA,CAAA,UAAA,CAAA;UACpB,EAAA,KAAA,CAAA,QAAA;UACF,EAAQ,cAAU;aACT,EAAE,MAAM,WAAC,IAAA,SAAA;AAClB,EAAA,SAAA,EAAA,KAAY,CAAA,SAAY,IAAA,SAAA;cACd,OAAO,CAAA,YAAA,IAAA,SAAA;OACjB,EAAA,KAAU,CAAA,SAAS;;AAEX,MAAA,mBAAS,GAAA,CAAA,cAAA,EAAA,aAAA,KAAA;QACjB,IAAA,GAAW;IACX,EAAA,EAAA,cAAc,CAAA,EAAA;IACd,KAAA,EAAA,cAAkB,CAAA,KAAA;IAClB,WAAA,EAAY,cAAS,CAAA,WAAA;AACxB,IAAA,IAAA,EAAA,cAAA,CAAA,IAAA,IAAA;AAED,MAAM,oBAAW,CAAA,QAAA;MACX,qBAAS,CAAA,YAAA,GAAA;QACX,UAAc,cAAA,CAAA;OACd,GAAA;KACA;IACA,IAAA,EAAM,cAAS,CAAA,IAAA,IAAA,SAAA;IACf,KAAA,EAAA,cAAiB,CAAA,KAAA,IAAA,SAAA;IACjB,OAAA,EAAA,cAAqB,CAAA,OAAA;IACrB,MAAM,OAAO,CAAA,OAAA,CAAA,cAAA,CAAA,MAAA,CAAA,GAAA,cAAA,CAAA,MAAA,GAAA,WAAA,CAAA,cAAA,CAAA,MAAA,CAAA;IACb,aAAa,cAAC,CAAA,WAAA,CAAA,MAAA,GAAA,CAAA,GAAA,cAAA,CAAA,WAAA,GAAA,CAAA,SAAA,CAAA;IACd,0BAAiB,CAAA,UAAA,IAAA,CAAA,cAAA,CAAA,QAAA,CAAA;IACjB,MAAM,EAAE,iBAAO,CAAA,cAAA,CAAA,MAAA,EAAA,cAAA,CAAA,EAAA;AACf,GAAA;wBAAsB,KAAA,EAAA;AAAC,IAAA,OAAA;aAAU;iBAAkB,EAAA,cAAA,CAAA,WAAA,IAAA,SAAA;MAAG,MAAA,EAAA,cAAA,CAAA;AACtD,KAAA;AACA,EAAA;SACA;IACA,GAAA,IAAO;AACP,IAAA,WAAA,EAAA,cAAkB,CAAA,WAAqB;IACvC,yBAAyB,cAAA,CAAA,uBAAA;IACzB,OAAA,EAAQ,cAAS,CAAA,OAAA;IACjB,gCAAsB,CAAA,gBAAA;IACtB,gCAAsB,CAAA,gBAAA;IACtB,QAAQ,EAAE,cAAO,CAAA,QAAA;IACjB,aAAQ,EAAA,cAAqB,CAAC,aAAA;AACjC,IAAA,YAAA,EAAA,cAAA,CAAA;AAkED,GAAA;;;;;;;kBA9EmB;AAAgB,IAAA,WAAA,EAAA,CAAA,CAAA,WAAA,IAAA,EAAA;YAAE,CAAA,CAAA,MAAQ;AAAU,IAAA,WAAA,EAAA,CAAA,CAAA,WAAA,IAAA,EAAA;;;;;;;;;;;cAoD3B,MAAG,IAAA,EAAA;;;;;;;;AAjFjB,EAAA,GAAA,EAAA,CAAA,EAAA,CAAA,CAAA,EAAA,CAAA,IAAA,CAAA;;;;kBAiGsB,IAAG,EAAA;;sBAhDgB,EAAA;sBAAe;;;;;;;;;;;;;;;;;;;;;;6BApB7C,IAAA,IAAA,CAAA,SAAA,EAAA;AAAU,IAAA,MAAA,QAAA,GAAA,kCAAA,CAAA,gBAAA,EAAA;YAAE,EAAA,IAAA,CAAA;AAAkB,MAAA,QAAA,EAAA,CAAA,EAAA,QAAA,CAAA,eAAA,CAAA;;;;;;;;;;;gBAoD3B,CAAG,IAAA,KAAA,UAAA,IAAA,QAAA,CAAA,MAAA,CAAA,OAAA,EAAA;;;;;;;;AAjFjB,QAAA,UAAA,CAAA,CAAA,EAAA,EAAA,CAAO,SAAG,EAAA,CAAA,CAAA,MAAa,CAAA,CAAA,GAAA,CAAA,CAAA,KAAA;;uBAElB,YAAM,CAAA,CAAA,GAAA,CAAA,CAAA,IAAA,CAAA,MAAA;;kBA+FW,EAAA,EAAG,CAAA,aAAA,CAAA,CAAA,GAAA,CAAA,CAAA,IAAA,CAAA,OAAA;;oBAhDgB,EAAA,CAAA,YAAM,CAAA,CAAA,GAAA,CAAA,CAAA,WAAA;oBAAS,EAAA,CAAA,iBAAM,CAAA,CAAA,GAAA,CAAA,CAAA,gBAAA;;;;;;;;;MA+F1E,MAAA,CAAA,GAAA,QAAA,CAAA,MAAA,CAAA,OAAA;AA+CF,MAAA,MAAA,EAAA,GAAA,CAAA,EAAA,MAAgB,CAAA,eAAA,CAAA;AAo8ChB,MAAA,UAAA,CAAA,CAAA,EAAA,EAAA,CAAA,MAAgB,CAAA,CAAA,GAAA,CAAA,CAAA,KAAA;AAwBhB,MAAA,UAAO,CAAA,CAAA,EAAA,EAAM,CAAA,gBAAA,CAAA,CAAA,GAAqB,CAAI,CAAA,eAAe;AAwBrD,MAAA,UAAO,CAAA,CAAA,EAAA,EAAM,CAAA,iBAAmB,CAAA,CAAA,GAAI,CAAA,CAAA,gBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"authMetaDataSchema.js","sources":["../../src/utils/authMetaDataSchema.ts"],"sourcesContent":[null],"names":[],"mappings":"meAwBI,iBAAmB,IAAA,GAAA,CAAA,KAAA,CAAA,GAAA,CAAA,CAAA,GAAA,CAAA,CAAA,IAAA,CAAA,CAAA,IAAA,EAAA,CAAA,CAAA,MAAA,CAAA,OAAA,CAAA;MACnB,eAAc,GAAA,GAAA,IAAA;MACd,KAAA,CAAA,WAAmB,CAAC,EAAA,OAAA,GAAA;MACpB,GAAA,KAAQ,IAAM,IAAG,GAAA,KAAA,SAAA,EAAA,OAAA,EAAA;MACjB,OAAA,GAAW,aAAS,EAAA,OAAA,EAAA;MACpB,CAAA,GAAA,CAAA,IAAA,EAAA,EAAA,OAAA,EAAwB;MACxB;AACA,IAAA,MAAA,MAAA,GAAA,IAAmB,CAAA,KAAA,CAAA,GAAA,CAAA;IACnB,OAAA,KAAA,CAAA,OAAoB,CAAA,MAAO,CAAA,GAAA,MAAA,GAAA,EAAA;IAC3B,OAAA,CAAA,EAAA;IACA,OAAA,GAAA,CAAA,KAAA,CAAA,IAAqB,EAAE,GAAA,CAAA,YAAe,CAAA,IAAM,EAAE,CAAA,CAAA,MAAA,CAAA,OAAA,CAAA,CAAA,GAAA,CAAA,IAAA,IAAA;MAC9C,MAAA,CAAA,KAAA,EAAgB,KAAG,CAAA,GAAM,IAAC,CAAA,KAAA,CAAA,GAAA,CAAA;MAC1B,OAAS;QACT,KAAA,EAAA,CAAA,KAAgB,IAAA,EAAO,EAAA,IAAA,EAAA;QACvB,KAAA,EAAA,CAAY,KAAG,IAAA,KAAQ,IAAA,EAAA,EAAA,IAAA;OACvB;IACA,CAAA,CAAA;;;MAGA,QAAA,GAAa,KAAA,IAAS,CAAA,KAAA,IAAA,EAAA,EAAA,OAAA,CAAA,oBAAA,EAAA,OAAA,CAAA,CAAA,OAAA,CAAA,uBAAA,EAAA,OAAA,CAAA,CAAA,OAAA,CAAA,gBAAA,EAAA,GAAA,CAAA,CAAA,OAAA,CAAA,UAAA,EAAA,EAAA,CAAA,CAAA,WAAA,EAAA;MACtB,iBAAA,GAAA,CAAA,MAAA,EAAA,UAAA,KAAA,MAAA,CAAA,GAAA,CAAA,KAAA,KAAA;AACA,EAAA,IAAA,EAAA,KAAA,CAAA,IAAA;OACA,EAAA,KAAQ,CAAA,KAAA;MACR,EAAA,KAAS,CAAA,IAAE;aACX,EAAA,KAAe,CAAA,WAAA;aACP,OAAQ,CAAC,WAAA;UACjB,EAAA,KAAA,CAAA,QAAA;cACU,EAAE,sBAAsB,EAAC;AACtC,EAAA,aAAA,EAAA,KAAA,CAAA,aAAA;AAED,EAAA,eAAiB,CAAA,QAAA;gBACD,KAAC,CAAA,QAAA,GAAA,KAAA,CAAA,YAAA,IAAA;IACb,IAAA,EAAK,OAAQ;IACb,YAAY,KAAC,CAAA,UAAA;IACb,SAAA,EAAW,eAAS,KAAA,UAAA,GAAA,CAAA,EAAA,QAAA,CAAA,UAAA,CAAA,CAAA,CAAA,EAAA,QAAA,CAAA,KAAA,CAAA,IAAA,CAAA,CAAA,CAAA,GAAA,QAAA,CAAA,KAAA,CAAA,IAAA,CAAA;MACpB,IAAA;UACA,EAAQ,cAAU;YAClB,EAAA,eAAqB,CAAA,KAAA,CAAA,UAAA,CAAA;UACrB,EAAA,KAAa,CAAA,QAAS;AACtB,EAAA,QAAA,EAAA,KAAa,CAAA,QAAE;AACX,EAAA,WAAI,EAAE,KAAA,CAAO,WAAG,IAAA,SAAc;AAC9B,EAAA,SAAA,EAAA,KAAU,UAAE,IAAY,SAAA;cACxB,EAAA,kBAAkB,IAAA,SAAA;OACpB,EAAA,KAAA,CAAA,KAAA,IAAA;;AAEF,MAAS,mBAAS,GAAA,CAAA,cAAA,EAAA,aAAA,KAAA;AAClB,EAAA,MAAA,IAAA;IACA,EAAA,EAAA,cAAiB,CAAA,EAAA;IACjB,KAAA,EAAA,cAAmB,CAAA,KAAA;IACnB,2BAAkB,CAAA,WAAA;IAClB,IAAA,EAAA,cAAiB,CAAA,IAAA,IAAA;MACjB,IAAA,EAAA,cAAoB,CAAA,QAAA;MACpB,KAAO,gBAAO,CAAA,YAAA,GAAA;QACd,wBAAkB,CAAA;OAClB,GAAA;AACH,KAAA;AAED,IAAA,oBAAiB,CAAA,IAAA,IAAA,SAAyB;IACtC,qBAAW,CAAA,KAAA,IAAA,SAAA;IACX,OAAO,gBAAO,CAAA,OAAA;IACd,MAAA,EAAA,KAAa,QAAO,CAAA,cAAA,CAAA,MAAA,CAAA,GAAA,cAAA,CAAA,MAAA,GAAA,WAAA,CAAA,cAAA,CAAA,MAAA,CAAA;IACpB,WAAW,EAAE,cAAO,CAAA,WAAA,CAAA,MAAA,GAAA,CAAA,GAAA,cAAA,CAAA,WAAA,GAAA,CAAA,SAAA,CAAA;IACpB,0BAAe,CAAA,UAAA,IAAA,CAAA,cAAA,CAAA,QAAA,CAAA;IACf,MAAA,EAAQ,iBAAS,CAAA,cAAA,CAAA,MAAA,EAAA,cAAA,CAAA,EAAA;;MAEjB,aAAa,KAAA,KAAA,EAAA;IACb,OAAO;MACP,GAAA,IAAS;MACT,aAAe,cAAA,CAAA,WAAA,IAAA,SAAA;AACf,MAAA,MAAO,EAAA,cAAA,CAAA;;AAAgB,EAAA;;WAA4B;eAAG,EAAA,cAAA,CAAA,WAAA;AACtD,IAAA,uBAAsB,EAAA,cAAA,CAAA,uBAAA;AACtB,IAAA,OAAA,EAAA,sBAA8B;IAC9B,gBAAA,EAAA,cAAgC,CAAC,gBAAA;IACjC,gBAAgB,EAAC,cAAA,CAAA,gBAAA;AACjB,IAAA,QAAA,EAAA,cAAkB,CAAA,QAAA;IAClB,aAAA,EAAA,cAAyB,CAAA,aAAA;IACzB,4BAAiB,CAAA;;;MAGjB,eAAiB,CAAA,IAAA;QACjB,WAAQ,GAAA,CAAA,CAAA,WAAsB,GAAA,CAAA,GAAA,CAAA,CAAA,WAAA,CAAA,GAAA,CAAA,QAAA,CAAA;AACjC,EAAA,OAAA;AAkED,IAAA,GAAA,EAAA,CAAA,EAAA,CAAA,CAAA,EAAO,CAAA,IAAM;;;;;;;cA9EM,CAAA,OAAM;AAAU,IAAA,gBAAA,EAAA,CAAA,CAAA,gBAAA;qBAAU,qBAAQ;AAAE,IAAA,uBAAA,EAAA,CAAA,CAAA,uBAAA;;;;;;;;;;;qBAoDxB,EAAA,CAAA,CAAA,iBAAA;;;;;;;;AAjFjB,MAAA,YAAA,GAAA,CAAA;;;;4BAiGyB,IAAA,EAAA;;uBAhDgB,IAAM,EAAA;sBAAS,EAAA;;;;;;;;;;;;;;;;;;;;;;kBApBnD,GAAM,EAAA;AAAU,EAAA,KAAA,MAAA,gBAAA,IAAA,IAAA,CAAA,SAAA,EAAA;kBAAE,GAAQ,kCAAQ,CAAA,gBAAA,EAAA;AAAE,MAAA,MAAA,EAAA,IAAA,CAAA,MAAA;;;;;;;;;;;cAoD3B,CAAA,CAAA,EAAG,MAAA,CAAA,IAAA,CAAA,CAAA,GAAA,QAAA,CAAA,IAAA;;;;;;;;AAjFjB,QAAA,UAAA,CAAA,CAAA,EAAA,EAAA,CAAO,SAAG,EAAA,CAAA,CAAA,IAAa,CAAA,CAAA,GAAA,CAAA,CAAA,GAAA;wBACjB,CAAA,SAAS,EAAG,CAAA,CAAA,MAAA,CAAA,CAAA,GAAA,CAAc,CAAA,KAAG;;;kBAgGb,EAAA,EAAG,CAAA,UAAA,CAAA,CAAA,GAAA,CAAA,CAAA,IAAA,CAAA,IAAA;;oBAhDgB,EAAA,CAAA,QAAM,CAAA,CAAA,GAAA,CAAA,CAAA,OAAA;oBAAS,EAAA,CAAA,YAAM,CAAA,CAAA,GAAA,CAAA,CAAA,WAAA;;;;;;;;;IA+F1E,IAAA,QAAA,CAAA,IAAA,KAAA,SAAA,IAAA,QAAA,CAAA,MAAA,CAAA,OAAA,EAAA;AAqDF,MAAA,MAAA,CAAA,GAAA,QAAgB,CAAA,MAAA,CAAA,OAAA;AAmIhB,MAAA,MAAA,EAAA,GAAA,CAAA,EAAA,MAAA,CAAA,eAAA,CAAA;;;AAGG,MAAA,UAAA,CAAA,CAAA,EAAA,EAAA,CAAA,iBAAA,CAAA,CAAA,GAAA,CAAA,CAAA,gBAAA;AACH,MAAA,gBAAa,CAAA,UAAA,CAAa,CAAA,cAAW;AAErC,IAAA;;;;;;;;;AASG,EAAA,MAAA,IAAA,GAAA;AACH,IAAA,IAAA,EAAA;;;IAKQ,MAAA,IAAA,GAAA,CAAA,WAAA,EAAA,QAAA,CAAA,CAAA,EAAA,GAAA,CAAA,CAAA;;;IAIN,IAAA,CAAA,CAAA,EAAA,IAAA,CAAA,OAAA,CAAA,CAAA,GAAA,GAAA,CAAA,MAAA;AAKF,IAAA,IAAA,GAAA,CAAA,UAAA,EAAA,IAAA,CAAA,CAAA,EAAA,IAAA,CAAA,WAAA,CAAA,CAAA,GAAA,GAAA,CAAA,UAAA;;;;;;;;;;;;AAYG,IAAA,+BAAA,EAAA,KAAA;AACH,IAAA,2CAAa,EAAA,KAAkC;AAQ/C,IAAA,gCAAA,EAAA,WAAA;AACA,IAAA,wCAAa,EAAA;AAGb,IAAA,oCAAA,EAAA,IAAA;AACA,IAAA,iCAAa,EAAA,QAAA;AAGb,IAAA,4CAAA,EAAA,SAA2D;AAC3D,IAAA,iDAA4C,EAAI;AAGhD,IAAA,8CAAA,EAAA,CAAA;;;;AAIG,IAAA,kDAAA,EAAA,QAAA;AACH,IAAA,+BAAa,EAAA;;;MAMX,YAAA,GAAA,IAAA,IAAA,IAAA,CAAA,UAAA,CAAA,CAAA,CAAA;AAEF;;;AAGG;AACH;;;;AAQA;;AAEG,MAAA,aAAA,GAAA,KAAA,IAAA,KAAA,CAAA,OAAA,CAAA,eAAA,EAAA,GAAA,CAAA,CAAA,WAAA;AACH;;;;AAmBA;AACA;AAGA;AACA;AAGA;AACA;AAKA,MAAA,gCAAA,GAAA,SAAA,IAAA;;;AAGG;AACH,IAAA,WAAO,EAAA,CAAA,EAAA,MAAM,CAAA,aAAA,CAAA;AAQb;AACA,IAAA,YAAO,EAAA,CAAA,EAAM;AAi+Cb,IAAA,iBAAiB,CAAA,QAAA;AACb,GAAA;;;;;;AAMG;;AAEN;AAED;AA2BA;AAwBA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/lib/utils/connectorDefaultAuthMethod.d.ts

@@ -0,0 +1,14 @@
+import type { ConnectorConfig } from '../config/configTypes';
+/** What a seed needs for the catalog's declared default auth method. */
+export interface ConnectorDefaultAuthMethodSeed {
+    authMethods: string[];
+    defaultAuthMethod?: ConnectorConfig['defaultAuthMethod'];
+}
+/**
+ * The auth method a catalog connector declares its credential form opens on
+ * (`ConnectorConfig.defaultAuthMethod`), as the form's `authMethod` value - or undefined when it
+ * declares none, or declares one it does not offer, so the generators keep their own rule and
+ * every connector without the knob gets exactly the default it got before.
+ */
+export declare function connectorDefaultAuthMethod(seed: ConnectorDefaultAuthMethodSeed): 'oauth' | 'api_key' | undefined;
+//# sourceMappingURL=connectorDefaultAuthMethod.d.ts.map

package/lib/utils/connectorDefaultAuthMethod.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connectorDefaultAuthMethod.d.ts","sourceRoot":"","sources":["../../src/utils/connectorDefaultAuthMethod.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,wEAAwE;AACxE,MAAM,WAAW,8BAA8B;IAC3C,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,iBAAiB,CAAC,EAAE,eAAe,CAAC,mBAAmB,CAAC,CAAC;CAC5D;AAQD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,8BAA8B,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAIhH"}

package/lib/utils/connectorDefaultAuthMethod.js

@@ -0,0 +1,16 @@
+/** The credential-form value (`authMethod`) for each catalog auth method. */
+const FORM_AUTH_METHOD = {
+  oauth2: 'oauth',
+  api_key: 'api_key'
+};
+/**
+ * The auth method a catalog connector declares its credential form opens on
+ * (`ConnectorConfig.defaultAuthMethod`), as the form's `authMethod` value - or undefined when it
+ * declares none, or declares one it does not offer, so the generators keep their own rule and
+ * every connector without the knob gets exactly the default it got before.
+ */
+function connectorDefaultAuthMethod(seed) {
+  const declared = seed.defaultAuthMethod;
+  if (!declared || !Object.prototype.hasOwnProperty.call(FORM_AUTH_METHOD, declared)) return undefined;
+  return seed.authMethods.includes(declared) ? FORM_AUTH_METHOD[declared] : undefined;
+}export{connectorDefaultAuthMethod};//# sourceMappingURL=connectorDefaultAuthMethod.js.map

package/lib/utils/connectorDefaultAuthMethod.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connectorDefaultAuthMethod.js","sources":["../../src/utils/connectorDefaultAuthMethod.ts"],"sourcesContent":[null],"names":[],"mappings":"AAAA;AAEA,MAAA,gBAAA,GAAA;AACA,EAAA,eAAiB;SACb,EAAA;AACA,CAAA;AACH;AAQD;;;;;AAKG,SAAA,0BAAA,CAAA,IAAA,EAAA;AACH,EAAA,MAAA,QAAA,GAAA,IAAA,CAAgB,iBAAA;;;"}

package/lib/utils/connectorOAuthRequestKnobs.d.ts

@@ -0,0 +1,24 @@
+import type { ConnectorConfig } from '../config/configTypes';
+/**
+ * Generic OAuth request/response knobs for a provider whose OAuth departs from the standard
+ * (TikTok Business: `app_id`/`secret`/`auth_code`, a JSON token request, no scope, and a token
+ * response wrapped in `{ code, message, data }`).
+ *
+ * Every knob a catalog connector sets is published as a read-only machine setting under the
+ * connector's `oauthConnector` path, next to `clientIdParamName` and `tokenEndpointHeaders`,
+ * where the adminIde OAuth service reads it with the rest of the prefix. A knob that is not set
+ * publishes nothing, so the settings of every other connector stay byte-identical.
+ */
+export type ConnectorOAuthRequestKnobs = Pick<ConnectorConfig, 'clientSecretParamName' | 'authorizationCodeParamName' | 'tokenRequestEncoding' | 'tokenRequestOmitParams' | 'authorizationOmitParams' | 'tokenResponseEnvelope' | 'tokenResponseMetadataFields'>;
+/** One knob as published: the leaf name under `oauthConnector`, its title, and the stored string. */
+export interface ConnectorOAuthRequestKnobSetting {
+    name: keyof ConnectorOAuthRequestKnobs;
+    title: string;
+    /** Scalars as they are; lists and objects as JSON, the way `tokenEndpointHeaders` is stored. */
+    value: string;
+}
+/** The knobs a connector config sets, and none of the ones it leaves out. */
+export declare function pickConnectorOAuthRequestKnobs(config: ConnectorOAuthRequestKnobs): ConnectorOAuthRequestKnobs;
+/** The settings to publish for a connector's knobs, in publish order; empty when it sets none. */
+export declare function connectorOAuthRequestKnobSettings(knobs: ConnectorOAuthRequestKnobs): ConnectorOAuthRequestKnobSetting[];
+//# sourceMappingURL=connectorOAuthRequestKnobs.d.ts.map

package/lib/utils/connectorOAuthRequestKnobs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connectorOAuthRequestKnobs.d.ts","sourceRoot":"","sources":["../../src/utils/connectorOAuthRequestKnobs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D;;;;;;;;;GASG;AACH,MAAM,MAAM,0BAA0B,GAAG,IAAI,CACzC,eAAe,EACb,uBAAuB,GACvB,4BAA4B,GAC5B,sBAAsB,GACtB,wBAAwB,GACxB,yBAAyB,GACzB,uBAAuB,GACvB,6BAA6B,CAClC,CAAC;AAEF,qGAAqG;AACrG,MAAM,WAAW,gCAAgC;IAC7C,IAAI,EAAE,MAAM,0BAA0B,CAAC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,KAAK,EAAE,MAAM,CAAC;CACjB;AAaD,6EAA6E;AAC7E,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,0BAA0B,GAAG,0BAA0B,CAM7G;AAUD,kGAAkG;AAClG,wBAAgB,iCAAiC,CAC7C,KAAK,EAAE,0BAA0B,GAClC,gCAAgC,EAAE,CAOpC"}