@atlasauth/pca-connectors 0.0.0-stage → 0.1.0

package/dist/manifest.d.ts

@@ -0,0 +1,93 @@
+/**
+ * The declarative unit of the connector catalog: a {@link ProviderManifest}.
+ *
+ * A manifest is PURE DATA (no secrets): it names a SaaS provider's OAuth 2.0 authorize/token endpoints,
+ * the scopes it offers, how its access token is presented to the API, and how (if at all) it refreshes.
+ * Wiring a new outbound tool is therefore a data edit, not code. Every connection minted from a manifest
+ * is stored in the `@atlasauth/pca-connect` vault bound to a PCA capability, so each outbound token is a
+ * proof-carrying, least-privilege capability — the property Composio / Descope / Auth0 Token Vault lack.
+ */
+/** How a provider's ACCESS token is presented to its API on an outbound call. */
+export type TokenPlacement = 'bearer' | 'header' | 'query';
+/** Whether (and how) a provider's access token can be refreshed. */
+export type RefreshMode = 'refresh_token' | 'none';
+/** How client credentials are presented at the token endpoint (RFC 6749 §2.3.1). */
+export type ClientAuthMethod = 'post' | 'basic';
+/** The refresh contract for a provider: how a stale access token is renewed. */
+export interface RefreshSpec {
+    /** `refresh_token` = standard OAuth refresh-token grant; `none` = tokens do not refresh (static/long-lived). */
+    mode: RefreshMode;
+    /** Token endpoint used for refresh. Defaults to the manifest's `tokenUrl`. */
+    tokenEndpoint?: string;
+    /** When true, a narrowed `scope` is sent on refresh so the minted token is no wider than requested. */
+    supportsScopeNarrowing?: boolean;
+    /** Extra static form parameters merged into every refresh request. */
+    extraParams?: Record<string, string>;
+}
+/** A declarative outbound-provider definition. See the module doc. */
+export interface ProviderManifest {
+    /** Stable, lowercase, globally-unique registry id (e.g. `google`, `microsoft`). */
+    id: string;
+    /** Human label for consent / directory UIs. */
+    displayName: string;
+    /** OAuth 2.0 authorization endpoint (RFC 6749 §3.1). May carry `{var}` placeholders (see `requiredVars`). */
+    authorizeUrl: string;
+    /** OAuth 2.0 token endpoint (RFC 6749 §3.2). May carry `{var}` placeholders. */
+    tokenUrl: string;
+    /** The full set of scopes this connector knows about (catalog/consent UI surface). */
+    scopesAvailable: string[];
+    /** The least-privilege default requested when a caller names no scopes. Must be ⊆ `scopesAvailable`. */
+    defaultScopes: string[];
+    /** The refresh contract. */
+    refresh: RefreshSpec;
+    /** How the access token is presented to the provider API. */
+    tokenPlacement: TokenPlacement;
+    /** Whether this provider supports / requires PKCE (RFC 7636). */
+    pkce?: boolean;
+    /** Scope delimiter in the authorize request. Default `' '`; some providers use `','` (Slack, Shopify, Linear). */
+    scopeSeparator?: string;
+    /** Static extra parameters added to the authorize URL (e.g. Google `access_type=offline`). */
+    authParams?: Record<string, string>;
+    /** How client credentials are sent at the token endpoint. Default `'post'`; `'basic'` for Notion / Zoom. */
+    clientAuth?: ClientAuthMethod;
+    /** Header name to carry the token when `tokenPlacement === 'header'`. */
+    headerName?: string;
+    /** Query-parameter name to carry the token when `tokenPlacement === 'query'`. */
+    queryParam?: string;
+    /** `{var}` placeholder names that must be substituted in `authorizeUrl` / `tokenUrl` (e.g. `['shop']`). */
+    requiredVars?: string[];
+    /** Optional human documentation link. */
+    docsUrl?: string;
+}
+/** Base class for every runtime refusal this package raises. */
+export declare class ConnectorError extends Error {
+    constructor(message: string);
+}
+/** A manifest failed structural validation. `issues` lists every problem found. */
+export declare class ManifestValidationError extends ConnectorError {
+    readonly issues: readonly string[];
+    constructor(issues: readonly string[]);
+}
+/** No manifest is registered for the requested provider id. */
+export declare class UnknownProviderError extends ConnectorError {
+    readonly providerId: string;
+    constructor(providerId: string);
+}
+/** The result of validating an untrusted manifest. */
+export type ManifestValidation = {
+    ok: true;
+    manifest: ProviderManifest;
+} | {
+    ok: false;
+    issues: string[];
+};
+/**
+ * Structurally validate an untrusted value as a {@link ProviderManifest}. Pure (no I/O); collects every
+ * issue rather than failing on the first, so a custom-manifest author sees all problems at once. Enforces
+ * the catalog invariants: a well-formed id, HTTPS endpoints, string scope lists, `defaultScopes ⊆
+ * scopesAvailable`, a known `tokenPlacement` / `refresh.mode` / `clientAuth`, a `headerName`/`queryParam`
+ * present for the matching placement, and that every `{var}` in the URLs is declared in `requiredVars`.
+ */
+export declare function validateManifest(input: unknown): ManifestValidation;
+/** Validate `input`, returning the manifest or throwing {@link ManifestValidationError}. */
+export declare function assertManifest(input: unknown): ProviderManifest;

package/dist/manifest.js

@@ -0,0 +1,256 @@
+"use strict";
+/**
+ * The declarative unit of the connector catalog: a {@link ProviderManifest}.
+ *
+ * A manifest is PURE DATA (no secrets): it names a SaaS provider's OAuth 2.0 authorize/token endpoints,
+ * the scopes it offers, how its access token is presented to the API, and how (if at all) it refreshes.
+ * Wiring a new outbound tool is therefore a data edit, not code. Every connection minted from a manifest
+ * is stored in the `@atlasauth/pca-connect` vault bound to a PCA capability, so each outbound token is a
+ * proof-carrying, least-privilege capability — the property Composio / Descope / Auth0 Token Vault lack.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UnknownProviderError = exports.ManifestValidationError = exports.ConnectorError = void 0;
+exports.validateManifest = validateManifest;
+exports.assertManifest = assertManifest;
+// ---- errors -----------------------------------------------------------------------------------
+/** Base class for every runtime refusal this package raises. */
+class ConnectorError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ConnectorError';
+    }
+}
+exports.ConnectorError = ConnectorError;
+/** A manifest failed structural validation. `issues` lists every problem found. */
+class ManifestValidationError extends ConnectorError {
+    issues;
+    constructor(issues) {
+        super(`invalid provider manifest: ${issues.join('; ')}`);
+        this.name = 'ManifestValidationError';
+        this.issues = issues;
+    }
+}
+exports.ManifestValidationError = ManifestValidationError;
+/** No manifest is registered for the requested provider id. */
+class UnknownProviderError extends ConnectorError {
+    providerId;
+    constructor(providerId) {
+        super(`no connector registered for provider '${providerId}'`);
+        this.name = 'UnknownProviderError';
+        this.providerId = providerId;
+    }
+}
+exports.UnknownProviderError = UnknownProviderError;
+// ---- validation -------------------------------------------------------------------------------
+/** Read own property `k` off `o` as `unknown`, without a cast. Absent => `undefined`. */
+function prop(o, k) {
+    return Object.prototype.hasOwnProperty.call(o, k) ? Reflect.get(o, k) : undefined;
+}
+function isRecord(v) {
+    return v !== null && typeof v === 'object' && !Array.isArray(v);
+}
+function isNonEmptyString(v) {
+    return typeof v === 'string' && v.length > 0;
+}
+function isStringArray(v) {
+    return Array.isArray(v) && v.every((x) => typeof x === 'string');
+}
+function isStringRecord(v) {
+    return isRecord(v) && Object.values(v).every((x) => typeof x === 'string');
+}
+const ID_PATTERN = /^[a-z0-9][a-z0-9._-]*$/;
+const TOKEN_PLACEMENTS = new Set(['bearer', 'header', 'query']);
+const REFRESH_MODES = new Set(['refresh_token', 'none']);
+const CLIENT_AUTHS = new Set(['post', 'basic']);
+const oneOf = (s) => [...s].join(' | ');
+function isHttpsUrl(v) {
+    return typeof v === 'string' && v.startsWith('https://');
+}
+/**
+ * Structurally validate an untrusted value as a {@link ProviderManifest}. Pure (no I/O); collects every
+ * issue rather than failing on the first, so a custom-manifest author sees all problems at once. Enforces
+ * the catalog invariants: a well-formed id, HTTPS endpoints, string scope lists, `defaultScopes ⊆
+ * scopesAvailable`, a known `tokenPlacement` / `refresh.mode` / `clientAuth`, a `headerName`/`queryParam`
+ * present for the matching placement, and that every `{var}` in the URLs is declared in `requiredVars`.
+ */
+function validateManifest(input) {
+    const issues = [];
+    if (!isRecord(input)) {
+        return { ok: false, issues: ['manifest must be an object'] };
+    }
+    const id = prop(input, 'id');
+    if (!isNonEmptyString(id))
+        issues.push('id must be a non-empty string');
+    else if (!ID_PATTERN.test(id))
+        issues.push(`id '${id}' must be lowercase and match ${ID_PATTERN.source}`);
+    if (!isNonEmptyString(prop(input, 'displayName')))
+        issues.push('displayName must be a non-empty string');
+    const authorizeUrl = prop(input, 'authorizeUrl');
+    if (!isHttpsUrl(authorizeUrl))
+        issues.push('authorizeUrl must be an https:// URL');
+    const tokenUrl = prop(input, 'tokenUrl');
+    if (!isHttpsUrl(tokenUrl))
+        issues.push('tokenUrl must be an https:// URL');
+    const scopesAvailable = prop(input, 'scopesAvailable');
+    if (!isStringArray(scopesAvailable))
+        issues.push('scopesAvailable must be an array of strings');
+    const defaultScopes = prop(input, 'defaultScopes');
+    if (!isStringArray(defaultScopes))
+        issues.push('defaultScopes must be an array of strings');
+    if (isStringArray(scopesAvailable) && isStringArray(defaultScopes) && scopesAvailable.length > 0) {
+        const available = new Set(scopesAvailable);
+        const missing = defaultScopes.filter((s) => !available.has(s));
+        if (missing.length > 0)
+            issues.push(`defaultScopes must be a subset of scopesAvailable (unknown: ${missing.join(', ')})`);
+    }
+    const refresh = prop(input, 'refresh');
+    if (!isRecord(refresh)) {
+        issues.push('refresh must be an object');
+    }
+    else {
+        const mode = prop(refresh, 'mode');
+        if (typeof mode !== 'string' || !REFRESH_MODES.has(mode)) {
+            issues.push(`refresh.mode must be one of ${oneOf(REFRESH_MODES)}`);
+        }
+        const te = prop(refresh, 'tokenEndpoint');
+        if (te !== undefined && !isHttpsUrl(te))
+            issues.push('refresh.tokenEndpoint, when present, must be an https:// URL');
+        const sn = prop(refresh, 'supportsScopeNarrowing');
+        if (sn !== undefined && typeof sn !== 'boolean')
+            issues.push('refresh.supportsScopeNarrowing must be a boolean');
+        const ep = prop(refresh, 'extraParams');
+        if (ep !== undefined && !isStringRecord(ep))
+            issues.push('refresh.extraParams must be a string→string map');
+    }
+    const tokenPlacement = prop(input, 'tokenPlacement');
+    if (typeof tokenPlacement !== 'string' || !TOKEN_PLACEMENTS.has(tokenPlacement)) {
+        issues.push(`tokenPlacement must be one of ${oneOf(TOKEN_PLACEMENTS)}`);
+    }
+    else if (tokenPlacement === 'header' && !isNonEmptyString(prop(input, 'headerName'))) {
+        issues.push("tokenPlacement 'header' requires a non-empty headerName");
+    }
+    else if (tokenPlacement === 'query' && !isNonEmptyString(prop(input, 'queryParam'))) {
+        issues.push("tokenPlacement 'query' requires a non-empty queryParam");
+    }
+    const pkce = prop(input, 'pkce');
+    if (pkce !== undefined && typeof pkce !== 'boolean')
+        issues.push('pkce must be a boolean');
+    const scopeSeparator = prop(input, 'scopeSeparator');
+    if (scopeSeparator !== undefined && typeof scopeSeparator !== 'string')
+        issues.push('scopeSeparator must be a string');
+    const authParams = prop(input, 'authParams');
+    if (authParams !== undefined && !isStringRecord(authParams))
+        issues.push('authParams must be a string→string map');
+    const clientAuth = prop(input, 'clientAuth');
+    if (clientAuth !== undefined && (typeof clientAuth !== 'string' || !CLIENT_AUTHS.has(clientAuth))) {
+        issues.push(`clientAuth must be one of ${oneOf(CLIENT_AUTHS)}`);
+    }
+    const requiredVars = prop(input, 'requiredVars');
+    if (requiredVars !== undefined && !isStringArray(requiredVars))
+        issues.push('requiredVars must be an array of strings');
+    // Every `{var}` that appears in a URL must be declared, and vice-versa, so substitution can never silently
+    // leave a placeholder in a live request.
+    if (isHttpsUrl(authorizeUrl) && isHttpsUrl(tokenUrl)) {
+        const declared = new Set(isStringArray(requiredVars) ? requiredVars : []);
+        const used = new Set([...urlVars(authorizeUrl), ...urlVars(tokenUrl)]);
+        for (const v of used)
+            if (!declared.has(v))
+                issues.push(`url uses '{${v}}' but requiredVars does not declare it`);
+        for (const v of declared)
+            if (!used.has(v))
+                issues.push(`requiredVars declares '${v}' but no URL uses '{${v}}'`);
+    }
+    const docsUrl = prop(input, 'docsUrl');
+    if (docsUrl !== undefined && typeof docsUrl !== 'string')
+        issues.push('docsUrl must be a string');
+    if (issues.length > 0)
+        return { ok: false, issues };
+    // Every branch above has narrowed the fields; rebuild a clean manifest from the validated values so the
+    // returned object carries only known keys.
+    return { ok: true, manifest: freezeManifest(input) };
+}
+/** Collect the `{var}` placeholder names used in a URL. */
+function urlVars(url) {
+    const out = [];
+    const re = /\{(\w+)\}/g;
+    let m = re.exec(url);
+    while (m !== null) {
+        const name = m[1];
+        if (name !== undefined)
+            out.push(name);
+        m = re.exec(url);
+    }
+    return out;
+}
+/** Build a {@link ProviderManifest} from an already-validated record, copying only known fields. */
+function freezeManifest(input) {
+    // Each read is guarded by validateManifest having passed; the casts here are to the ALREADY-CHECKED
+    // shapes, expressed as narrowing helpers rather than `as` on raw unknown.
+    const refreshRaw = prop(input, 'refresh');
+    const refreshRec = isRecord(refreshRaw) ? refreshRaw : {};
+    const refresh = { mode: readRefreshMode(prop(refreshRec, 'mode')) };
+    const te = prop(refreshRec, 'tokenEndpoint');
+    if (typeof te === 'string')
+        refresh.tokenEndpoint = te;
+    const sn = prop(refreshRec, 'supportsScopeNarrowing');
+    if (typeof sn === 'boolean')
+        refresh.supportsScopeNarrowing = sn;
+    const ep = prop(refreshRec, 'extraParams');
+    if (isStringRecord(ep))
+        refresh.extraParams = { ...ep };
+    const manifest = {
+        id: readString(prop(input, 'id')),
+        displayName: readString(prop(input, 'displayName')),
+        authorizeUrl: readString(prop(input, 'authorizeUrl')),
+        tokenUrl: readString(prop(input, 'tokenUrl')),
+        scopesAvailable: readStringArray(prop(input, 'scopesAvailable')),
+        defaultScopes: readStringArray(prop(input, 'defaultScopes')),
+        refresh,
+        tokenPlacement: readTokenPlacement(prop(input, 'tokenPlacement')),
+    };
+    const pkce = prop(input, 'pkce');
+    if (typeof pkce === 'boolean')
+        manifest.pkce = pkce;
+    const sep = prop(input, 'scopeSeparator');
+    if (typeof sep === 'string')
+        manifest.scopeSeparator = sep;
+    const authParams = prop(input, 'authParams');
+    if (isStringRecord(authParams))
+        manifest.authParams = { ...authParams };
+    const clientAuth = prop(input, 'clientAuth');
+    if (clientAuth === 'post' || clientAuth === 'basic')
+        manifest.clientAuth = clientAuth;
+    const headerName = prop(input, 'headerName');
+    if (typeof headerName === 'string')
+        manifest.headerName = headerName;
+    const queryParam = prop(input, 'queryParam');
+    if (typeof queryParam === 'string')
+        manifest.queryParam = queryParam;
+    const requiredVars = prop(input, 'requiredVars');
+    if (isStringArray(requiredVars))
+        manifest.requiredVars = [...requiredVars];
+    const docsUrl = prop(input, 'docsUrl');
+    if (typeof docsUrl === 'string')
+        manifest.docsUrl = docsUrl;
+    return manifest;
+}
+function readString(v) {
+    return typeof v === 'string' ? v : '';
+}
+function readStringArray(v) {
+    return isStringArray(v) ? [...v] : [];
+}
+function readRefreshMode(v) {
+    return v === 'none' ? 'none' : 'refresh_token';
+}
+function readTokenPlacement(v) {
+    return v === 'header' ? 'header' : v === 'query' ? 'query' : 'bearer';
+}
+/** Validate `input`, returning the manifest or throwing {@link ManifestValidationError}. */
+function assertManifest(input) {
+    const result = validateManifest(input);
+    if (!result.ok)
+        throw new ManifestValidationError(result.issues);
+    return result.manifest;
+}
+//# sourceMappingURL=manifest.js.map

package/dist/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAsIH,4CAiFC;AAwED,wCAIC;AAxOD,kGAAkG;AAElG,gEAAgE;AAChE,MAAa,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AALD,wCAKC;AAED,mFAAmF;AACnF,MAAa,uBAAwB,SAAQ,cAAc;IAChD,MAAM,CAAoB;IACnC,YAAY,MAAyB;QACnC,KAAK,CAAC,8BAA8B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAPD,0DAOC;AAED,+DAA+D;AAC/D,MAAa,oBAAqB,SAAQ,cAAc;IAC7C,UAAU,CAAS;IAC5B,YAAY,UAAkB;QAC5B,KAAK,CAAC,yCAAyC,UAAU,GAAG,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAPD,oDAOC;AAED,kGAAkG;AAElG,yFAAyF;AACzF,SAAS,IAAI,CAAC,CAAS,EAAE,CAAS;IAChC,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACpF,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAU;IAClC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,cAAc,CAAC,CAAU;IAChC,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAC5C,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AACxE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;AACjE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AACxD,MAAM,KAAK,GAAG,CAAC,CAAc,EAAU,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAE7D,SAAS,UAAU,CAAC,CAAU;IAC5B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AAC3D,CAAC;AAOD;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAAC,KAAc;IAC7C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,4BAA4B,CAAC,EAAE,CAAC;IAC/D,CAAC;IAED,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;SACnE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,iCAAiC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAE1G,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IAEzG,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACjD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACzC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IAE3E,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IACvD,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAChG,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IACnD,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;IAC5F,IAAI,aAAa,CAAC,eAAe,CAAC,IAAI,aAAa,CAAC,aAAa,CAAC,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjG,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,+DAA+D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5H,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACvC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,MAAM,CAAC,IAAI,CAAC,+BAA+B,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC1C,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;QACrH,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;QACnD,IAAI,EAAE,KAAK,SAAS,IAAI,OAAO,EAAE,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;QACjH,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACxC,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;IAC9G,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACrD,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QAChF,MAAM,CAAC,IAAI,CAAC,iCAAiC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;SAAM,IAAI,cAAc,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;QACvF,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;IACzE,CAAC;SAAM,IAAI,cAAc,KAAK,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;QACtF,MAAM,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC3F,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACrD,IAAI,cAAc,KAAK,SAAS,IAAI,OAAO,cAAc,KAAK,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACvH,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAC7C,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACnH,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAC7C,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAClG,MAAM,CAAC,IAAI,CAAC,6BAA6B,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACjD,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IACxH,2GAA2G;IAC3G,yCAAyC;IACzC,IAAI,UAAU,CAAC,YAAY,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1E,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC/E,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,yCAAyC,CAAC,CAAC;QAClH,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACnH,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAElG,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACpD,wGAAwG;IACxG,2CAA2C;IAC3C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,2DAA2D;AAC3D,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,EAAE,GAAG,YAAY,CAAC;IACxB,IAAI,CAAC,GAA2B,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7C,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,IAAI,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oGAAoG;AACpG,SAAS,cAAc,CAAC,KAA8B;IACpD,oGAAoG;IACpG,0EAA0E;IAC1E,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,MAAM,OAAO,GAAgB,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;IACjF,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAC7C,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,CAAC,aAAa,GAAG,EAAE,CAAC;IACvD,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,wBAAwB,CAAC,CAAC;IACtD,IAAI,OAAO,EAAE,KAAK,SAAS;QAAE,OAAO,CAAC,sBAAsB,GAAG,EAAE,CAAC;IACjE,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAC3C,IAAI,cAAc,CAAC,EAAE,CAAC;QAAE,OAAO,CAAC,WAAW,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;IAExD,MAAM,QAAQ,GAAqB;QACjC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACjC,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACnD,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QACrD,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC7C,eAAe,EAAE,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAChE,aAAa,EAAE,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAC5D,OAAO;QACP,cAAc,EAAE,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;KAClE,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,OAAO,IAAI,KAAK,SAAS;QAAE,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,QAAQ,CAAC,cAAc,GAAG,GAAG,CAAC;IAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAC7C,IAAI,cAAc,CAAC,UAAU,CAAC;QAAE,QAAQ,CAAC,UAAU,GAAG,EAAE,GAAG,UAAU,EAAE,CAAC;IACxE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAC7C,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,OAAO;QAAE,QAAQ,CAAC,UAAU,GAAG,UAAU,CAAC;IACtF,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,QAAQ,CAAC,UAAU,GAAG,UAAU,CAAC;IACrE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,QAAQ,CAAC,UAAU,GAAG,UAAU,CAAC;IACrE,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACjD,IAAI,aAAa,CAAC,YAAY,CAAC;QAAE,QAAQ,CAAC,YAAY,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACvC,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,QAAQ,CAAC,OAAO,GAAG,OAAO,CAAC;IAC5D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,UAAU,CAAC,CAAU;IAC5B,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxC,CAAC;AACD,SAAS,eAAe,CAAC,CAAU;IACjC,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxC,CAAC;AACD,SAAS,eAAe,CAAC,CAAU;IACjC,OAAO,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC;AACjD,CAAC;AACD,SAAS,kBAAkB,CAAC,CAAU;IACpC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;AACxE,CAAC;AAED,4FAA4F;AAC5F,SAAgB,cAAc,CAAC,KAAc;IAC3C,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjE,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC"}

package/dist/providers/index.d.ts

@@ -0,0 +1,41 @@
+/**
+ * The seeded connector catalog: declarative {@link ProviderManifest}s for the top outbound SaaS tools.
+ *
+ * These carry NO secrets — only public OAuth 2.0 endpoints, the scopes a provider offers, how its token is
+ * presented, and its refresh contract. A consumer supplies the `clientId` / `clientSecret` at call time.
+ * Endpoints and scope strings are the providers' documented production values; `defaultScopes` is a
+ * least-privilege starting set, always a subset of `scopesAvailable`.
+ */
+import type { ProviderManifest } from '../manifest';
+/** Google Workspace / Gmail / Drive / Calendar. PKCE-capable; `access_type=offline` is required for a refresh token. */
+export declare const google: ProviderManifest;
+/** GitHub OAuth (classic app). Tokens are long-lived and do not refresh. Authorize scopes are space-delimited. */
+export declare const github: ProviderManifest;
+/** Slack (OAuth v2). Bot tokens are long-lived; scopes are COMMA-delimited. */
+export declare const slack: ProviderManifest;
+/** Notion. Scopes are integration-level (none in the request); client credentials go via HTTP Basic. */
+export declare const notion: ProviderManifest;
+/** HubSpot CRM. Supports the refresh-token grant. */
+export declare const hubspot: ProviderManifest;
+/** Atlassian (Jira / Confluence). PKCE + `offline_access` for refresh; `audience` names the API. */
+export declare const atlassian: ProviderManifest;
+/** Salesforce. Refresh-token grant; `refresh_token`/`offline_access` scopes enable it. */
+export declare const salesforce: ProviderManifest;
+/** Microsoft Graph (identity platform v2). `offline_access` yields a refresh token. */
+export declare const microsoft: ProviderManifest;
+/** Shopify Admin. Per-shop host via the `{shop}` placeholder; scopes are COMMA-delimited. */
+export declare const shopify: ProviderManifest;
+/** Snowflake (OAuth). Per-account host via the `{account}` placeholder; refresh-token grant. */
+export declare const snowflake: ProviderManifest;
+/** Linear. Long-lived tokens (no refresh); scopes are COMMA-delimited. */
+export declare const linear: ProviderManifest;
+/** Zoom. Access tokens expire hourly; refresh-token grant with HTTP Basic client auth. */
+export declare const zoom: ProviderManifest;
+/** Stripe Connect (OAuth). Refresh-token grant; `read_only` is least-privilege. */
+export declare const stripe: ProviderManifest;
+/** Dropbox. `token_access_type=offline` yields a refresh token; PKCE-capable. */
+export declare const dropbox: ProviderManifest;
+/** Airtable. PKCE is REQUIRED; refresh-token grant. */
+export declare const airtable: ProviderManifest;
+/** The full seeded catalog, in a stable order. */
+export declare const BUILTIN_MANIFESTS: readonly ProviderManifest[];