@atlasauth/pca-connectors 0.0.0-stage → 0.2.0

package/dist/providers/index.js

@@ -0,0 +1,260 @@
+"use strict";
+/**
+ * The seeded connector catalog: declarative {@link ProviderManifest}s for the top outbound SaaS tools.
+ *
+ * These carry NO secrets — only public OAuth 2.0 endpoints, the scopes a provider offers, how its token is
+ * presented, and its refresh contract. A consumer supplies the `clientId` / `clientSecret` at call time.
+ * Endpoints and scope strings are the providers' documented production values; `defaultScopes` is a
+ * least-privilege starting set, always a subset of `scopesAvailable`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BUILTIN_MANIFESTS = exports.airtable = exports.dropbox = exports.stripe = exports.zoom = exports.linear = exports.snowflake = exports.shopify = exports.microsoft = exports.salesforce = exports.atlassian = exports.hubspot = exports.notion = exports.slack = exports.github = exports.google = void 0;
+/** Google Workspace / Gmail / Drive / Calendar. PKCE-capable; `access_type=offline` is required for a refresh token. */
+exports.google = {
+    id: 'google',
+    displayName: 'Google Workspace',
+    authorizeUrl: 'https://accounts.google.com/o/oauth2/v2/auth',
+    tokenUrl: 'https://oauth2.googleapis.com/token',
+    scopesAvailable: [
+        'openid',
+        'email',
+        'profile',
+        'https://www.googleapis.com/auth/gmail.readonly',
+        'https://www.googleapis.com/auth/gmail.send',
+        'https://www.googleapis.com/auth/drive.readonly',
+        'https://www.googleapis.com/auth/calendar',
+    ],
+    defaultScopes: ['openid', 'email', 'profile'],
+    refresh: { mode: 'refresh_token', supportsScopeNarrowing: false },
+    tokenPlacement: 'bearer',
+    pkce: true,
+    authParams: { access_type: 'offline', prompt: 'consent' },
+    docsUrl: 'https://developers.google.com/identity/protocols/oauth2',
+};
+/** GitHub OAuth (classic app). Tokens are long-lived and do not refresh. Authorize scopes are space-delimited. */
+exports.github = {
+    id: 'github',
+    displayName: 'GitHub',
+    authorizeUrl: 'https://github.com/login/oauth/authorize',
+    tokenUrl: 'https://github.com/login/oauth/access_token',
+    scopesAvailable: ['repo', 'read:user', 'user:email', 'read:org', 'gist', 'workflow'],
+    defaultScopes: ['read:user', 'user:email'],
+    refresh: { mode: 'none' },
+    tokenPlacement: 'bearer',
+    pkce: false,
+    docsUrl: 'https://docs.github.com/apps/oauth-apps',
+};
+/** Slack (OAuth v2). Bot tokens are long-lived; scopes are COMMA-delimited. */
+exports.slack = {
+    id: 'slack',
+    displayName: 'Slack',
+    authorizeUrl: 'https://slack.com/oauth/v2/authorize',
+    tokenUrl: 'https://slack.com/api/oauth.v2.access',
+    scopesAvailable: ['chat:write', 'channels:read', 'channels:history', 'users:read', 'files:read'],
+    defaultScopes: ['chat:write', 'channels:read'],
+    refresh: { mode: 'none' },
+    tokenPlacement: 'bearer',
+    pkce: false,
+    scopeSeparator: ',',
+    docsUrl: 'https://api.slack.com/authentication/oauth-v2',
+};
+/** Notion. Scopes are integration-level (none in the request); client credentials go via HTTP Basic. */
+exports.notion = {
+    id: 'notion',
+    displayName: 'Notion',
+    authorizeUrl: 'https://api.notion.com/v1/oauth/authorize',
+    tokenUrl: 'https://api.notion.com/v1/oauth/token',
+    scopesAvailable: [],
+    defaultScopes: [],
+    refresh: { mode: 'none' },
+    tokenPlacement: 'bearer',
+    pkce: false,
+    clientAuth: 'basic',
+    authParams: { owner: 'user' },
+    docsUrl: 'https://developers.notion.com/docs/authorization',
+};
+/** HubSpot CRM. Supports the refresh-token grant. */
+exports.hubspot = {
+    id: 'hubspot',
+    displayName: 'HubSpot',
+    authorizeUrl: 'https://app.hubspot.com/oauth/authorize',
+    tokenUrl: 'https://api.hubapi.com/oauth/v1/token',
+    scopesAvailable: [
+        'oauth',
+        'crm.objects.contacts.read',
+        'crm.objects.contacts.write',
+        'crm.objects.deals.read',
+        'crm.objects.deals.write',
+    ],
+    defaultScopes: ['oauth', 'crm.objects.contacts.read'],
+    refresh: { mode: 'refresh_token' },
+    tokenPlacement: 'bearer',
+    pkce: false,
+    docsUrl: 'https://developers.hubspot.com/docs/api/oauth-quickstart-guide',
+};
+/** Atlassian (Jira / Confluence). PKCE + `offline_access` for refresh; `audience` names the API. */
+exports.atlassian = {
+    id: 'atlassian',
+    displayName: 'Atlassian (Jira)',
+    authorizeUrl: 'https://auth.atlassian.com/authorize',
+    tokenUrl: 'https://auth.atlassian.com/oauth/token',
+    scopesAvailable: ['read:jira-work', 'write:jira-work', 'read:jira-user', 'manage:jira-project', 'offline_access'],
+    defaultScopes: ['read:jira-work', 'offline_access'],
+    refresh: { mode: 'refresh_token' },
+    tokenPlacement: 'bearer',
+    pkce: true,
+    authParams: { audience: 'api.atlassian.com', prompt: 'consent' },
+    docsUrl: 'https://developer.atlassian.com/cloud/jira/platform/oauth-2-3lo-apps/',
+};
+/** Salesforce. Refresh-token grant; `refresh_token`/`offline_access` scopes enable it. */
+exports.salesforce = {
+    id: 'salesforce',
+    displayName: 'Salesforce',
+    authorizeUrl: 'https://login.salesforce.com/services/oauth2/authorize',
+    tokenUrl: 'https://login.salesforce.com/services/oauth2/token',
+    scopesAvailable: ['api', 'refresh_token', 'offline_access', 'full', 'chatter_api', 'openid'],
+    defaultScopes: ['api', 'refresh_token'],
+    refresh: { mode: 'refresh_token' },
+    tokenPlacement: 'bearer',
+    pkce: true,
+    docsUrl: 'https://help.salesforce.com/s/articleView?id=sf.remoteaccess_oauth_web_server_flow.htm',
+};
+/** Microsoft Graph (identity platform v2). `offline_access` yields a refresh token. */
+exports.microsoft = {
+    id: 'microsoft',
+    displayName: 'Microsoft Graph',
+    authorizeUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize',
+    tokenUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/token',
+    scopesAvailable: [
+        'openid',
+        'profile',
+        'offline_access',
+        'User.Read',
+        'Mail.Read',
+        'Mail.Send',
+        'Files.Read',
+        'Calendars.Read',
+    ],
+    defaultScopes: ['openid', 'profile', 'offline_access', 'User.Read'],
+    refresh: { mode: 'refresh_token' },
+    tokenPlacement: 'bearer',
+    pkce: true,
+    docsUrl: 'https://learn.microsoft.com/azure/active-directory/develop/v2-oauth2-auth-code-flow',
+};
+/** Shopify Admin. Per-shop host via the `{shop}` placeholder; scopes are COMMA-delimited. */
+exports.shopify = {
+    id: 'shopify',
+    displayName: 'Shopify',
+    authorizeUrl: 'https://{shop}.myshopify.com/admin/oauth/authorize',
+    tokenUrl: 'https://{shop}.myshopify.com/admin/oauth/access_token',
+    scopesAvailable: ['read_products', 'write_products', 'read_orders', 'write_orders', 'read_customers'],
+    defaultScopes: ['read_products', 'read_orders'],
+    refresh: { mode: 'none' },
+    tokenPlacement: 'header',
+    headerName: 'X-Shopify-Access-Token',
+    pkce: false,
+    scopeSeparator: ',',
+    requiredVars: ['shop'],
+    docsUrl: 'https://shopify.dev/docs/apps/auth/oauth',
+};
+/** Snowflake (OAuth). Per-account host via the `{account}` placeholder; refresh-token grant. */
+exports.snowflake = {
+    id: 'snowflake',
+    displayName: 'Snowflake',
+    authorizeUrl: 'https://{account}.snowflakecomputing.com/oauth/authorize',
+    tokenUrl: 'https://{account}.snowflakecomputing.com/oauth/token-request',
+    scopesAvailable: ['refresh_token', 'session:role-any'],
+    defaultScopes: ['refresh_token'],
+    refresh: { mode: 'refresh_token' },
+    tokenPlacement: 'bearer',
+    pkce: true,
+    requiredVars: ['account'],
+    docsUrl: 'https://docs.snowflake.com/en/user-guide/oauth-custom',
+};
+/** Linear. Long-lived tokens (no refresh); scopes are COMMA-delimited. */
+exports.linear = {
+    id: 'linear',
+    displayName: 'Linear',
+    authorizeUrl: 'https://linear.app/oauth/authorize',
+    tokenUrl: 'https://api.linear.app/oauth/token',
+    scopesAvailable: ['read', 'write', 'issues:create', 'admin'],
+    defaultScopes: ['read'],
+    refresh: { mode: 'none' },
+    tokenPlacement: 'bearer',
+    pkce: false,
+    scopeSeparator: ',',
+    docsUrl: 'https://developers.linear.app/docs/oauth/authentication',
+};
+/** Zoom. Access tokens expire hourly; refresh-token grant with HTTP Basic client auth. */
+exports.zoom = {
+    id: 'zoom',
+    displayName: 'Zoom',
+    authorizeUrl: 'https://zoom.us/oauth/authorize',
+    tokenUrl: 'https://zoom.us/oauth/token',
+    scopesAvailable: ['meeting:read', 'meeting:write', 'user:read', 'recording:read'],
+    defaultScopes: ['user:read'],
+    refresh: { mode: 'refresh_token' },
+    tokenPlacement: 'bearer',
+    pkce: true,
+    clientAuth: 'basic',
+    docsUrl: 'https://developers.zoom.us/docs/integrations/oauth/',
+};
+/** Stripe Connect (OAuth). Refresh-token grant; `read_only` is least-privilege. */
+exports.stripe = {
+    id: 'stripe',
+    displayName: 'Stripe',
+    authorizeUrl: 'https://connect.stripe.com/oauth/authorize',
+    tokenUrl: 'https://connect.stripe.com/oauth/token',
+    scopesAvailable: ['read_only', 'read_write'],
+    defaultScopes: ['read_only'],
+    refresh: { mode: 'refresh_token' },
+    tokenPlacement: 'bearer',
+    pkce: false,
+    docsUrl: 'https://stripe.com/docs/connect/oauth-reference',
+};
+/** Dropbox. `token_access_type=offline` yields a refresh token; PKCE-capable. */
+exports.dropbox = {
+    id: 'dropbox',
+    displayName: 'Dropbox',
+    authorizeUrl: 'https://www.dropbox.com/oauth2/authorize',
+    tokenUrl: 'https://api.dropboxapi.com/oauth2/token',
+    scopesAvailable: ['files.content.read', 'files.content.write', 'files.metadata.read', 'sharing.read'],
+    defaultScopes: ['files.metadata.read'],
+    refresh: { mode: 'refresh_token' },
+    tokenPlacement: 'bearer',
+    pkce: true,
+    authParams: { token_access_type: 'offline' },
+    docsUrl: 'https://developers.dropbox.com/oauth-guide',
+};
+/** Airtable. PKCE is REQUIRED; refresh-token grant. */
+exports.airtable = {
+    id: 'airtable',
+    displayName: 'Airtable',
+    authorizeUrl: 'https://airtable.com/oauth2/v1/authorize',
+    tokenUrl: 'https://airtable.com/oauth2/v1/token',
+    scopesAvailable: ['data.records:read', 'data.records:write', 'schema.bases:read', 'schema.bases:write'],
+    defaultScopes: ['data.records:read'],
+    refresh: { mode: 'refresh_token', supportsScopeNarrowing: false },
+    tokenPlacement: 'bearer',
+    pkce: true,
+    docsUrl: 'https://airtable.com/developers/web/guides/oauth-integrations',
+};
+/** The full seeded catalog, in a stable order. */
+exports.BUILTIN_MANIFESTS = [
+    exports.google,
+    exports.github,
+    exports.slack,
+    exports.notion,
+    exports.hubspot,
+    exports.atlassian,
+    exports.salesforce,
+    exports.microsoft,
+    exports.shopify,
+    exports.snowflake,
+    exports.linear,
+    exports.zoom,
+    exports.stripe,
+    exports.dropbox,
+    exports.airtable,
+];
+//# sourceMappingURL=index.js.map

package/dist/providers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/providers/index.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAIH,wHAAwH;AAC3G,QAAA,MAAM,GAAqB;IACtC,EAAE,EAAE,QAAQ;IACZ,WAAW,EAAE,kBAAkB;IAC/B,YAAY,EAAE,8CAA8C;IAC5D,QAAQ,EAAE,qCAAqC;IAC/C,eAAe,EAAE;QACf,QAAQ;QACR,OAAO;QACP,SAAS;QACT,gDAAgD;QAChD,4CAA4C;QAC5C,gDAAgD;QAChD,0CAA0C;KAC3C;IACD,aAAa,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;IAC7C,OAAO,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,sBAAsB,EAAE,KAAK,EAAE;IACjE,cAAc,EAAE,QAAQ;IACxB,IAAI,EAAE,IAAI;IACV,UAAU,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE;IACzD,OAAO,EAAE,yDAAyD;CACnE,CAAC;AAEF,kHAAkH;AACrG,QAAA,MAAM,GAAqB;IACtC,EAAE,EAAE,QAAQ;IACZ,WAAW,EAAE,QAAQ;IACrB,YAAY,EAAE,0CAA0C;IACxD,QAAQ,EAAE,6CAA6C;IACvD,eAAe,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC;IACpF,aAAa,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC;IAC1C,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;IACzB,cAAc,EAAE,QAAQ;IACxB,IAAI,EAAE,KAAK;IACX,OAAO,EAAE,yCAAyC;CACnD,CAAC;AAEF,+EAA+E;AAClE,QAAA,KAAK,GAAqB;IACrC,EAAE,EAAE,OAAO;IACX,WAAW,EAAE,OAAO;IACpB,YAAY,EAAE,sCAAsC;IACpD,QAAQ,EAAE,uCAAuC;IACjD,eAAe,EAAE,CAAC,YAAY,EAAE,eAAe,EAAE,kBAAkB,EAAE,YAAY,EAAE,YAAY,CAAC;IAChG,aAAa,EAAE,CAAC,YAAY,EAAE,eAAe,CAAC;IAC9C,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;IACzB,cAAc,EAAE,QAAQ;IACxB,IAAI,EAAE,KAAK;IACX,cAAc,EAAE,GAAG;IACnB,OAAO,EAAE,+CAA+C;CACzD,CAAC;AAEF,wGAAwG;AAC3F,QAAA,MAAM,GAAqB;IACtC,EAAE,EAAE,QAAQ;IACZ,WAAW,EAAE,QAAQ;IACrB,YAAY,EAAE,2CAA2C;IACzD,QAAQ,EAAE,uCAAuC;IACjD,eAAe,EAAE,EAAE;IACnB,aAAa,EAAE,EAAE;IACjB,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;IACzB,cAAc,EAAE,QAAQ;IACxB,IAAI,EAAE,KAAK;IACX,UAAU,EAAE,OAAO;IACnB,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;IAC7B,OAAO,EAAE,kDAAkD;CAC5D,CAAC;AAEF,qDAAqD;AACxC,QAAA,OAAO,GAAqB;IACvC,EAAE,EAAE,SAAS;IACb,WAAW,EAAE,SAAS;IACtB,YAAY,EAAE,yCAAyC;IACvD,QAAQ,EAAE,uCAAuC;IACjD,eAAe,EAAE;QACf,OAAO;QACP,2BAA2B;QAC3B,4BAA4B;QAC5B,wBAAwB;QACxB,yBAAyB;KAC1B;IACD,aAAa,EAAE,CAAC,OAAO,EAAE,2BAA2B,CAAC;IACrD,OAAO,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE;IAClC,cAAc,EAAE,QAAQ;IACxB,IAAI,EAAE,KAAK;IACX,OAAO,EAAE,gEAAgE;CAC1E,CAAC;AAEF,oGAAoG;AACvF,QAAA,SAAS,GAAqB;IACzC,EAAE,EAAE,WAAW;IACf,WAAW,EAAE,kBAAkB;IAC/B,YAAY,EAAE,sCAAsC;IACpD,QAAQ,EAAE,wCAAwC;IAClD,eAAe,EAAE,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,gBAAgB,CAAC;IACjH,aAAa,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IACnD,OAAO,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE;IAClC,cAAc,EAAE,QAAQ;IACxB,IAAI,EAAE,IAAI;IACV,UAAU,EAAE,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,EAAE,SAAS,EAAE;IAChE,OAAO,EAAE,uEAAuE;CACjF,CAAC;AAEF,0FAA0F;AAC7E,QAAA,UAAU,GAAqB;IAC1C,EAAE,EAAE,YAAY;IAChB,WAAW,EAAE,YAAY;IACzB,YAAY,EAAE,wDAAwD;IACtE,QAAQ,EAAE,oDAAoD;IAC9D,eAAe,EAAE,CAAC,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,CAAC;IAC5F,aAAa,EAAE,CAAC,KAAK,EAAE,eAAe,CAAC;IACvC,OAAO,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE;IAClC,cAAc,EAAE,QAAQ;IACxB,IAAI,EAAE,IAAI;IACV,OAAO,EAAE,wFAAwF;CAClG,CAAC;AAEF,uFAAuF;AAC1E,QAAA,SAAS,GAAqB;IACzC,EAAE,EAAE,WAAW;IACf,WAAW,EAAE,iBAAiB;IAC9B,YAAY,EAAE,gEAAgE;IAC9E,QAAQ,EAAE,4DAA4D;IACtE,eAAe,EAAE;QACf,QAAQ;QACR,SAAS;QACT,gBAAgB;QAChB,WAAW;QACX,WAAW;QACX,WAAW;QACX,YAAY;QACZ,gBAAgB;KACjB;IACD,aAAa,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAE,WAAW,CAAC;IACnE,OAAO,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE;IAClC,cAAc,EAAE,QAAQ;IACxB,IAAI,EAAE,IAAI;IACV,OAAO,EAAE,qFAAqF;CAC/F,CAAC;AAEF,6FAA6F;AAChF,QAAA,OAAO,GAAqB;IACvC,EAAE,EAAE,SAAS;IACb,WAAW,EAAE,SAAS;IACtB,YAAY,EAAE,oDAAoD;IAClE,QAAQ,EAAE,uDAAuD;IACjE,eAAe,EAAE,CAAC,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,CAAC;IACrG,aAAa,EAAE,CAAC,eAAe,EAAE,aAAa,CAAC;IAC/C,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;IACzB,cAAc,EAAE,QAAQ;IACxB,UAAU,EAAE,wBAAwB;IACpC,IAAI,EAAE,KAAK;IACX,cAAc,EAAE,GAAG;IACnB,YAAY,EAAE,CAAC,MAAM,CAAC;IACtB,OAAO,EAAE,0CAA0C;CACpD,CAAC;AAEF,gGAAgG;AACnF,QAAA,SAAS,GAAqB;IACzC,EAAE,EAAE,WAAW;IACf,WAAW,EAAE,WAAW;IACxB,YAAY,EAAE,0DAA0D;IACxE,QAAQ,EAAE,8DAA8D;IACxE,eAAe,EAAE,CAAC,eAAe,EAAE,kBAAkB,CAAC;IACtD,aAAa,EAAE,CAAC,eAAe,CAAC;IAChC,OAAO,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE;IAClC,cAAc,EAAE,QAAQ;IACxB,IAAI,EAAE,IAAI;IACV,YAAY,EAAE,CAAC,SAAS,CAAC;IACzB,OAAO,EAAE,uDAAuD;CACjE,CAAC;AAEF,0EAA0E;AAC7D,QAAA,MAAM,GAAqB;IACtC,EAAE,EAAE,QAAQ;IACZ,WAAW,EAAE,QAAQ;IACrB,YAAY,EAAE,oCAAoC;IAClD,QAAQ,EAAE,oCAAoC;IAC9C,eAAe,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC;IAC5D,aAAa,EAAE,CAAC,MAAM,CAAC;IACvB,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;IACzB,cAAc,EAAE,QAAQ;IACxB,IAAI,EAAE,KAAK;IACX,cAAc,EAAE,GAAG;IACnB,OAAO,EAAE,yDAAyD;CACnE,CAAC;AAEF,0FAA0F;AAC7E,QAAA,IAAI,GAAqB;IACpC,EAAE,EAAE,MAAM;IACV,WAAW,EAAE,MAAM;IACnB,YAAY,EAAE,iCAAiC;IAC/C,QAAQ,EAAE,6BAA6B;IACvC,eAAe,EAAE,CAAC,cAAc,EAAE,eAAe,EAAE,WAAW,EAAE,gBAAgB,CAAC;IACjF,aAAa,EAAE,CAAC,WAAW,CAAC;IAC5B,OAAO,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE;IAClC,cAAc,EAAE,QAAQ;IACxB,IAAI,EAAE,IAAI;IACV,UAAU,EAAE,OAAO;IACnB,OAAO,EAAE,qDAAqD;CAC/D,CAAC;AAEF,mFAAmF;AACtE,QAAA,MAAM,GAAqB;IACtC,EAAE,EAAE,QAAQ;IACZ,WAAW,EAAE,QAAQ;IACrB,YAAY,EAAE,4CAA4C;IAC1D,QAAQ,EAAE,wCAAwC;IAClD,eAAe,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC;IAC5C,aAAa,EAAE,CAAC,WAAW,CAAC;IAC5B,OAAO,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE;IAClC,cAAc,EAAE,QAAQ;IACxB,IAAI,EAAE,KAAK;IACX,OAAO,EAAE,iDAAiD;CAC3D,CAAC;AAEF,iFAAiF;AACpE,QAAA,OAAO,GAAqB;IACvC,EAAE,EAAE,SAAS;IACb,WAAW,EAAE,SAAS;IACtB,YAAY,EAAE,0CAA0C;IACxD,QAAQ,EAAE,yCAAyC;IACnD,eAAe,EAAE,CAAC,oBAAoB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,cAAc,CAAC;IACrG,aAAa,EAAE,CAAC,qBAAqB,CAAC;IACtC,OAAO,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE;IAClC,cAAc,EAAE,QAAQ;IACxB,IAAI,EAAE,IAAI;IACV,UAAU,EAAE,EAAE,iBAAiB,EAAE,SAAS,EAAE;IAC5C,OAAO,EAAE,4CAA4C;CACtD,CAAC;AAEF,uDAAuD;AAC1C,QAAA,QAAQ,GAAqB;IACxC,EAAE,EAAE,UAAU;IACd,WAAW,EAAE,UAAU;IACvB,YAAY,EAAE,0CAA0C;IACxD,QAAQ,EAAE,sCAAsC;IAChD,eAAe,EAAE,CAAC,mBAAmB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,oBAAoB,CAAC;IACvG,aAAa,EAAE,CAAC,mBAAmB,CAAC;IACpC,OAAO,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,sBAAsB,EAAE,KAAK,EAAE;IACjE,cAAc,EAAE,QAAQ;IACxB,IAAI,EAAE,IAAI;IACV,OAAO,EAAE,+DAA+D;CACzE,CAAC;AAEF,kDAAkD;AACrC,QAAA,iBAAiB,GAAgC;IAC5D,cAAM;IACN,cAAM;IACN,aAAK;IACL,cAAM;IACN,eAAO;IACP,iBAAS;IACT,kBAAU;IACV,iBAAS;IACT,eAAO;IACP,iBAAS;IACT,cAAM;IACN,YAAI;IACJ,cAAM;IACN,eAAO;IACP,gBAAQ;CACT,CAAC"}

package/dist/registry.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The connector registry: an in-memory map of provider id → {@link ProviderManifest}. A manifest is
+ * validated on the way in, so nothing malformed can ever be looked up. A process-wide {@link defaultRegistry}
+ * is seeded with the built-in catalog; callers who want isolation build their own with {@link createDefaultRegistry}.
+ */
+import { type ProviderManifest } from './manifest';
+/** A mutable collection of provider manifests, keyed by id. */
+export declare class ProviderRegistry {
+    private readonly byId;
+    /** Validate and register (or replace) a manifest. Throws `ManifestValidationError` on a malformed input. */
+    register(manifest: ProviderManifest | unknown): ProviderManifest;
+    /** The manifest for `id`, or `undefined` when none is registered. */
+    get(id: string): ProviderManifest | undefined;
+    /** The manifest for `id`, or throw {@link UnknownProviderError}. */
+    require(id: string): ProviderManifest;
+    /** Whether a manifest is registered for `id`. */
+    has(id: string): boolean;
+    /** Every registered manifest, in ascending id order. */
+    list(): ProviderManifest[];
+    /** The registered provider ids, in ascending order. */
+    ids(): string[];
+}
+/** A fresh registry seeded with the full built-in connector catalog. */
+export declare function createDefaultRegistry(): ProviderRegistry;
+/** The process-wide registry the top-level `registerProvider` / `getProvider` / `listProviders` operate on. */
+export declare const defaultRegistry: ProviderRegistry;
+/** Validate and register a custom manifest onto the {@link defaultRegistry}. */
+export declare function registerProvider(manifest: ProviderManifest | unknown): ProviderManifest;
+/** The manifest for `id` in the {@link defaultRegistry}, or `undefined`. */
+export declare function getProvider(id: string): ProviderManifest | undefined;
+/** Every manifest in the {@link defaultRegistry}, in ascending id order. */
+export declare function listProviders(): ProviderManifest[];

package/dist/registry.js

@@ -0,0 +1,70 @@
+"use strict";
+/**
+ * The connector registry: an in-memory map of provider id → {@link ProviderManifest}. A manifest is
+ * validated on the way in, so nothing malformed can ever be looked up. A process-wide {@link defaultRegistry}
+ * is seeded with the built-in catalog; callers who want isolation build their own with {@link createDefaultRegistry}.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultRegistry = exports.ProviderRegistry = void 0;
+exports.createDefaultRegistry = createDefaultRegistry;
+exports.registerProvider = registerProvider;
+exports.getProvider = getProvider;
+exports.listProviders = listProviders;
+const manifest_1 = require("./manifest");
+const providers_1 = require("./providers");
+/** A mutable collection of provider manifests, keyed by id. */
+class ProviderRegistry {
+    byId = new Map();
+    /** Validate and register (or replace) a manifest. Throws `ManifestValidationError` on a malformed input. */
+    register(manifest) {
+        const valid = (0, manifest_1.assertManifest)(manifest);
+        this.byId.set(valid.id, valid);
+        return valid;
+    }
+    /** The manifest for `id`, or `undefined` when none is registered. */
+    get(id) {
+        return this.byId.get(id);
+    }
+    /** The manifest for `id`, or throw {@link UnknownProviderError}. */
+    require(id) {
+        const m = this.byId.get(id);
+        if (m === undefined)
+            throw new manifest_1.UnknownProviderError(id);
+        return m;
+    }
+    /** Whether a manifest is registered for `id`. */
+    has(id) {
+        return this.byId.has(id);
+    }
+    /** Every registered manifest, in ascending id order. */
+    list() {
+        return [...this.byId.values()].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+    }
+    /** The registered provider ids, in ascending order. */
+    ids() {
+        return this.list().map((m) => m.id);
+    }
+}
+exports.ProviderRegistry = ProviderRegistry;
+/** A fresh registry seeded with the full built-in connector catalog. */
+function createDefaultRegistry() {
+    const r = new ProviderRegistry();
+    for (const m of providers_1.BUILTIN_MANIFESTS)
+        r.register(m);
+    return r;
+}
+/** The process-wide registry the top-level `registerProvider` / `getProvider` / `listProviders` operate on. */
+exports.defaultRegistry = createDefaultRegistry();
+/** Validate and register a custom manifest onto the {@link defaultRegistry}. */
+function registerProvider(manifest) {
+    return exports.defaultRegistry.register(manifest);
+}
+/** The manifest for `id` in the {@link defaultRegistry}, or `undefined`. */
+function getProvider(id) {
+    return exports.defaultRegistry.get(id);
+}
+/** Every manifest in the {@link defaultRegistry}, in ascending id order. */
+function listProviders() {
+    return exports.defaultRegistry.list();
+}
+//# sourceMappingURL=registry.js.map

package/dist/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AA6CH,sDAIC;AAMD,4CAEC;AAGD,kCAEC;AAGD,sCAEC;AAjED,yCAAyF;AACzF,2CAAgD;AAEhD,+DAA+D;AAC/D,MAAa,gBAAgB;IACV,IAAI,GAAG,IAAI,GAAG,EAA4B,CAAC;IAE5D,4GAA4G;IAC5G,QAAQ,CAAC,QAAoC;QAC3C,MAAM,KAAK,GAAG,IAAA,yBAAc,EAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,qEAAqE;IACrE,GAAG,CAAC,EAAU;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,oEAAoE;IACpE,OAAO,CAAC,EAAU;QAChB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,+BAAoB,CAAC,EAAE,CAAC,CAAC;QACxD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,iDAAiD;IACjD,GAAG,CAAC,EAAU;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,wDAAwD;IACxD,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1F,CAAC;IAED,uDAAuD;IACvD,GAAG;QACD,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;CACF;AApCD,4CAoCC;AAED,wEAAwE;AACxE,SAAgB,qBAAqB;IACnC,MAAM,CAAC,GAAG,IAAI,gBAAgB,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,6BAAiB;QAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,+GAA+G;AAClG,QAAA,eAAe,GAAqB,qBAAqB,EAAE,CAAC;AAEzE,gFAAgF;AAChF,SAAgB,gBAAgB,CAAC,QAAoC;IACnE,OAAO,uBAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC5C,CAAC;AAED,4EAA4E;AAC5E,SAAgB,WAAW,CAAC,EAAU;IACpC,OAAO,uBAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,4EAA4E;AAC5E,SAAgB,aAAa;IAC3B,OAAO,uBAAe,CAAC,IAAI,EAAE,CAAC;AAChC,CAAC"}

package/package.json

@@ -1,6 +1,58 @@
 {
   "name": "@atlasauth/pca-connectors",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.2.0",
+  "description": "Declarative outbound connector registry for PCA: provider manifests (auth URLs, scopes, refresh, token placement) for the top SaaS tools + an auto-refresh helper, so every vault connector call is a proof-carrying capability.",
+  "keywords": [
+    "connectors",
+    "oauth",
+    "saas",
+    "manifest",
+    "agent authorization",
+    "proof-carrying authority",
+    "pca",
+    "ai agents"
+  ],
+  "license": "MIT",
+  "homepage": "https://github.com/Atlas-Authorization/pca#readme",
+  "bugs": {
+    "url": "https://github.com/Atlas-Authorization/pca/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Atlas-Authorization/pca.git",
+    "directory": "packages/pca-connectors"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "dependencies": {
+    "@atlasauth/pca": "0.2.0",
+    "@atlasauth/pca-connect": "0.2.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.6.3",
+    "vitest": "^2.1.4"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  }
 }