@celigo/api-specs 0.2.193 → 0.2.194

package/dist/api.yml

@@ -7960,23 +7960,51 @@ components:
             googleProjectId:
               type: string
               description: |-
-                Google Cloud project id for Google Cloud Storage connections
-                (assistant `googlecloudstorage`, or a `baseURI` pointing at
-                `storage.googleapis.com`).
+                Default project ID of a Google Cloud Storage connection (assistant
+                `googlecloudstorage`, or a `baseURI` pointing at
+                `storage.googleapis.com`): the Google Cloud project whose buckets the
+                export and import forms list. It does not limit access — the
+                connection reaches any bucket the authorized Google account or
+                service account may use. Set by the caller on the OAuth 2.0 auth type
+                (Celigo's published Google Cloud Storage iClient or an account-owned
+                `custom_oauth2` iClient). On the Google service account auth type the
+                server stores the key's `project_id` on create and on any save that
+                changes or omits `http.unencrypted`; a save that re-sends the stored
+                `http.unencrypted` unchanged keeps the stored value, even though the
+                response body can echo the key's — read the connection back. Trimmed
+                on save; no format is enforced (the connection form warns on a value
+                outside Google's project-id format and still saves it).
               examples:
                 - my-gcs-project
               x-celigo-ai-guidance:
                 - |-
                   Required when the GCS connection authenticates through an OAuth
-                  iClient (provider custom_oauth2). Omitting it fails the save
-                  with 422 project_id_missing on http.unencrypted.googleProjectId
-                  — "Default project ID is required on OAuth Google Cloud Storage
-                  connections (http.unencrypted.googleProjectId)." With a
-                  googleserviceaccount iClient the server fills this from the
-                  key's project_id. Any other provider fails with 422
-                  invalid_field on http._iClientId — "IClient provider must be
+                  iClient — Celigo's published Google Cloud Storage iClient (the id
+                  the connector pre-configures on `http._iClientId` when
+                  `http.auth.type` is `oauth`) or an account-owned iClient with
+                  provider custom_oauth2. Omitting it, or sending only whitespace,
+                  fails the save with 422 project_id_missing on
+                  http.unencrypted.googleProjectId — "Default project ID is
+                  required on OAuth Google Cloud Storage connections
+                  (http.unencrypted.googleProjectId)." — on create and on every
+                  later PUT. With a googleserviceaccount iClient the server stores
+                  the key's project_id on create (a value sent on create is
+                  replaced by it) and on any later save that changes or omits
+                  `http.unencrypted` — the next bullet has the PUT that does not
+                  re-fill it. Any other provider fails with 422 invalid_field
+                  on http._iClientId — "IClient provider must be
                   googleserviceaccount or custom_oauth2 for Google Cloud Storage
                   connections."
+                - |-
+                  When a PUT moves the connection from an OAuth iClient to a
+                  googleserviceaccount iClient, drop `http.unencrypted` (or change
+                  it) in the same PUT: the server's fill from the key is written
+                  only when `http.unencrypted` is absent or changed, so a PUT that
+                  re-sends the stored object unchanged keeps the OAuth-era project
+                  id beside the service account (the 200 body still echoes the
+                  key's — only a GET shows what persisted). Moving the other way
+                  (service account → OAuth) needs the project id in the PUT, or it
+                  is the 422 above.
         unencryptedFields:
           type: array
           description: |
@@ -8021,13 +8049,20 @@ components:
           description: |-
             iClient that holds the credentials this connection signs with: the OAuth 2.0 client for
             `auth.type` `oauth` (including the `azureserviceprincipal` service principal an Azure
-            Data Lake Storage Gen2 connection authenticates with and the `googleserviceaccount` key
-            a Google Cloud Storage connection uses), or the `awsIam` role for `auth.type` `awsiam`.
+            Data Lake Storage Gen2 connection authenticates with and, on a Google Cloud Storage
+            connection, either the `googleserviceaccount` key of its Google service account auth
+            type or — its OAuth 2.0 auth type — Celigo's published Google Cloud Storage iClient,
+            which the connector pre-configures, or an account-owned `custom_oauth2` iClient), or
+            the `awsIam` role for `auth.type` `awsiam`.
             Must belong to the same account as the connection — or be the iClient Celigo publishes
             with a pre-built OAuth HTTP connector (pre-configured by the connector; from the
-            connecting account `GET /v1/iclients/{_id}` on it is 404 resource_not_found and
-            `GET /v1/iclients` does not list it, yet the connection saves with it). Omit for every
-            other auth type. On a Shopify connection `settings.appType` says which of the two it
+            connecting account `GET /v1/iclients/{_id}` on it is 404 — resource_not_found or
+            invalid_ref "IClient not found." — and `GET /v1/iclients` does not list it, yet the
+            connection saves with it). Omit for every other auth type. A Google Cloud Storage
+            connection stores `auth.type` `oauth` under both of its auth types; the referenced
+            iClient's provider tells them apart, and switching is a PUT that changes `_iClientId`
+            (see `unencrypted.googleProjectId` for what travels with it). On a Shopify connection
+            `settings.appType` says which of the two it
             is: `public` rides Celigo's published Shopify app (installed from the Shopify App
             Store), `custom` rides the account's own iClient — the Shopify app the customer created
             in the Shopify dev dashboard — with `auth.oauth.scope` chosen on the connection. A
@@ -8042,7 +8077,7 @@ components:
             published app and carry no `settings.appType`.
           examples:
             - 6203a7e4f321d800129a1b8e
-          x-celigo-ui-override: 'Required by the connection form for oauth (subForms/httpOAuth.js: required true, iClient filter provider custom_oauth2, or googleserviceaccount / azureserviceprincipal for the GCS and ADLS Gen2 variants) and for awsIam (subForms/httpAwsIam.js: required true, filter provider awsIam). For oauth the API creates the connection without it and the authorization is completed afterward; for awsiam the API also rejects its absence (see the if/then rule on this schema).'
+          x-celigo-ui-override: 'Required by the connection form for oauth (subForms/httpOAuth.js: required true, iClient filter provider custom_oauth2 — on a Google Cloud Storage connection''s OAuth 2.0 auth type too, where Simple view pre-selects Celigo''s published iClient and hides the picker — or googleserviceaccount / azureserviceprincipal for the GCS Google service account and ADLS Gen2 variants) and for awsIam (subForms/httpAwsIam.js: required true, filter provider awsIam). For oauth the API creates the connection without it and the authorization is completed afterward; for awsiam the API also rejects its absence (see the if/then rule on this schema).'
           x-celigo-ai-guidance:
             - |-
               For auth.type "awsiam" the referenced iClient must have provider "awsIam" (any other
@@ -8061,10 +8096,30 @@ components:
               The iClient must belong to the same account as the connection — an iClient id from
               another account fails with 422 invalid_ref "The referenced IClient must belong to the
               same user." The one exception is the iClient a pre-built OAuth HTTP connector
-              pre-configures (Celigo's published app — the Shopify Public App's, for one): the
-              connection saves with that id from the connecting account even though
-              `GET /v1/iclients/{_id}` on it is 404 there, so do not refuse a `public` Shopify
-              connection on this rule.
+              pre-configures (Celigo's published app — the Shopify Public App's and the Google Cloud
+              Storage OAuth 2.0 iClient, for two): the connection saves with that id from the
+              connecting account even though `GET /v1/iclients/{_id}` on it is 404 there, so do not
+              refuse a `public` Shopify connection or an OAuth 2.0 Google Cloud Storage connection on
+              this rule. Read the id from the connector's metadata
+              (`GET /v1/httpconnectors/{_id}?returnEverything=true`,
+              `supportedBy.connection.preConfiguredFields` entry for `http._iClientId`), never from
+              a hard-coded value.
+            - |-
+              A Google Cloud Storage connection (assistant "googlecloudstorage", or any http.baseURI
+              containing "storage.googleapis.com") references either a googleserviceaccount iClient
+              of the same account (its Google service account auth type — no authorization step; the
+              server stores the key's project_id in `unencrypted.googleProjectId` on create and
+              whenever `http.unencrypted` changes or is omitted — see that field) or an OAuth iClient
+              with `unencrypted.googleProjectId` set (its OAuth 2.0 auth type — Celigo's published
+              iClient, or an account-owned custom_oauth2 one — authorized afterwards in a browser;
+              until then `POST /v1/connections/{_id}/ping` answers `missing_token`). The server
+              checks the provider only — a custom_oauth2 iClient registered for a different HTTP
+              connector (`_httpConnectorId`) also saves on a GCS connection — so bind an iClient
+              with no connector or the Google Cloud Storage connector's. The connection document
+              keeps `auth.oauth.scope` as sent (a GCS connection saved without it stores none), so
+              send the Cloud Storage scopes on the OAuth 2.0 auth type
+              (https://www.googleapis.com/auth/devstorage.read_write, …read_only or
+              …full_control); a service account connection carries none.
             - |-
               On a Shopify connection keep `settings.appType` and `_iClientId` in step the way the
               form does — `public` with the connector's published iClient, `custom` with an

package/dist/connection.yml

@@ -709,7 +709,7 @@ paths:
                         code: invalid_field
                         message: IClient provider must be googleserviceaccount or custom_oauth2 for Google Cloud Storage connections.
                 gcsProjectIdMissing:
-                  summary: Google Cloud Storage OAuth connection without a project id
+                  summary: Google Cloud Storage OAuth 2.0 connection whose project id is absent or only whitespace
                   value:
                     errors:
                       - field: http.unencrypted.googleProjectId
@@ -6594,23 +6594,51 @@ components:
             googleProjectId:
               type: string
               description: |-
-                Google Cloud project id for Google Cloud Storage connections
-                (assistant `googlecloudstorage`, or a `baseURI` pointing at
-                `storage.googleapis.com`).
+                Default project ID of a Google Cloud Storage connection (assistant
+                `googlecloudstorage`, or a `baseURI` pointing at
+                `storage.googleapis.com`): the Google Cloud project whose buckets the
+                export and import forms list. It does not limit access — the
+                connection reaches any bucket the authorized Google account or
+                service account may use. Set by the caller on the OAuth 2.0 auth type
+                (Celigo's published Google Cloud Storage iClient or an account-owned
+                `custom_oauth2` iClient). On the Google service account auth type the
+                server stores the key's `project_id` on create and on any save that
+                changes or omits `http.unencrypted`; a save that re-sends the stored
+                `http.unencrypted` unchanged keeps the stored value, even though the
+                response body can echo the key's — read the connection back. Trimmed
+                on save; no format is enforced (the connection form warns on a value
+                outside Google's project-id format and still saves it).
               examples:
                 - my-gcs-project
               x-celigo-ai-guidance:
                 - |-
                   Required when the GCS connection authenticates through an OAuth
-                  iClient (provider custom_oauth2). Omitting it fails the save
-                  with 422 project_id_missing on http.unencrypted.googleProjectId
-                  — "Default project ID is required on OAuth Google Cloud Storage
-                  connections (http.unencrypted.googleProjectId)." With a
-                  googleserviceaccount iClient the server fills this from the
-                  key's project_id. Any other provider fails with 422
-                  invalid_field on http._iClientId — "IClient provider must be
+                  iClient — Celigo's published Google Cloud Storage iClient (the id
+                  the connector pre-configures on `http._iClientId` when
+                  `http.auth.type` is `oauth`) or an account-owned iClient with
+                  provider custom_oauth2. Omitting it, or sending only whitespace,
+                  fails the save with 422 project_id_missing on
+                  http.unencrypted.googleProjectId — "Default project ID is
+                  required on OAuth Google Cloud Storage connections
+                  (http.unencrypted.googleProjectId)." — on create and on every
+                  later PUT. With a googleserviceaccount iClient the server stores
+                  the key's project_id on create (a value sent on create is
+                  replaced by it) and on any later save that changes or omits
+                  `http.unencrypted` — the next bullet has the PUT that does not
+                  re-fill it. Any other provider fails with 422 invalid_field
+                  on http._iClientId — "IClient provider must be
                   googleserviceaccount or custom_oauth2 for Google Cloud Storage
                   connections."
+                - |-
+                  When a PUT moves the connection from an OAuth iClient to a
+                  googleserviceaccount iClient, drop `http.unencrypted` (or change
+                  it) in the same PUT: the server's fill from the key is written
+                  only when `http.unencrypted` is absent or changed, so a PUT that
+                  re-sends the stored object unchanged keeps the OAuth-era project
+                  id beside the service account (the 200 body still echoes the
+                  key's — only a GET shows what persisted). Moving the other way
+                  (service account → OAuth) needs the project id in the PUT, or it
+                  is the 422 above.
         unencryptedFields:
           type: array
           description: |
@@ -6655,13 +6683,20 @@ components:
           description: |-
             iClient that holds the credentials this connection signs with: the OAuth 2.0 client for
             `auth.type` `oauth` (including the `azureserviceprincipal` service principal an Azure
-            Data Lake Storage Gen2 connection authenticates with and the `googleserviceaccount` key
-            a Google Cloud Storage connection uses), or the `awsIam` role for `auth.type` `awsiam`.
+            Data Lake Storage Gen2 connection authenticates with and, on a Google Cloud Storage
+            connection, either the `googleserviceaccount` key of its Google service account auth
+            type or — its OAuth 2.0 auth type — Celigo's published Google Cloud Storage iClient,
+            which the connector pre-configures, or an account-owned `custom_oauth2` iClient), or
+            the `awsIam` role for `auth.type` `awsiam`.
             Must belong to the same account as the connection — or be the iClient Celigo publishes
             with a pre-built OAuth HTTP connector (pre-configured by the connector; from the
-            connecting account `GET /v1/iclients/{_id}` on it is 404 resource_not_found and
-            `GET /v1/iclients` does not list it, yet the connection saves with it). Omit for every
-            other auth type. On a Shopify connection `settings.appType` says which of the two it
+            connecting account `GET /v1/iclients/{_id}` on it is 404 — resource_not_found or
+            invalid_ref "IClient not found." — and `GET /v1/iclients` does not list it, yet the
+            connection saves with it). Omit for every other auth type. A Google Cloud Storage
+            connection stores `auth.type` `oauth` under both of its auth types; the referenced
+            iClient's provider tells them apart, and switching is a PUT that changes `_iClientId`
+            (see `unencrypted.googleProjectId` for what travels with it). On a Shopify connection
+            `settings.appType` says which of the two it
             is: `public` rides Celigo's published Shopify app (installed from the Shopify App
             Store), `custom` rides the account's own iClient — the Shopify app the customer created
             in the Shopify dev dashboard — with `auth.oauth.scope` chosen on the connection. A
@@ -6676,7 +6711,7 @@ components:
             published app and carry no `settings.appType`.
           examples:
             - 6203a7e4f321d800129a1b8e
-          x-celigo-ui-override: 'Required by the connection form for oauth (subForms/httpOAuth.js: required true, iClient filter provider custom_oauth2, or googleserviceaccount / azureserviceprincipal for the GCS and ADLS Gen2 variants) and for awsIam (subForms/httpAwsIam.js: required true, filter provider awsIam). For oauth the API creates the connection without it and the authorization is completed afterward; for awsiam the API also rejects its absence (see the if/then rule on this schema).'
+          x-celigo-ui-override: 'Required by the connection form for oauth (subForms/httpOAuth.js: required true, iClient filter provider custom_oauth2 — on a Google Cloud Storage connection''s OAuth 2.0 auth type too, where Simple view pre-selects Celigo''s published iClient and hides the picker — or googleserviceaccount / azureserviceprincipal for the GCS Google service account and ADLS Gen2 variants) and for awsIam (subForms/httpAwsIam.js: required true, filter provider awsIam). For oauth the API creates the connection without it and the authorization is completed afterward; for awsiam the API also rejects its absence (see the if/then rule on this schema).'
           x-celigo-ai-guidance:
             - |-
               For auth.type "awsiam" the referenced iClient must have provider "awsIam" (any other
@@ -6695,10 +6730,30 @@ components:
               The iClient must belong to the same account as the connection — an iClient id from
               another account fails with 422 invalid_ref "The referenced IClient must belong to the
               same user." The one exception is the iClient a pre-built OAuth HTTP connector
-              pre-configures (Celigo's published app — the Shopify Public App's, for one): the
-              connection saves with that id from the connecting account even though
-              `GET /v1/iclients/{_id}` on it is 404 there, so do not refuse a `public` Shopify
-              connection on this rule.
+              pre-configures (Celigo's published app — the Shopify Public App's and the Google Cloud
+              Storage OAuth 2.0 iClient, for two): the connection saves with that id from the
+              connecting account even though `GET /v1/iclients/{_id}` on it is 404 there, so do not
+              refuse a `public` Shopify connection or an OAuth 2.0 Google Cloud Storage connection on
+              this rule. Read the id from the connector's metadata
+              (`GET /v1/httpconnectors/{_id}?returnEverything=true`,
+              `supportedBy.connection.preConfiguredFields` entry for `http._iClientId`), never from
+              a hard-coded value.
+            - |-
+              A Google Cloud Storage connection (assistant "googlecloudstorage", or any http.baseURI
+              containing "storage.googleapis.com") references either a googleserviceaccount iClient
+              of the same account (its Google service account auth type — no authorization step; the
+              server stores the key's project_id in `unencrypted.googleProjectId` on create and
+              whenever `http.unencrypted` changes or is omitted — see that field) or an OAuth iClient
+              with `unencrypted.googleProjectId` set (its OAuth 2.0 auth type — Celigo's published
+              iClient, or an account-owned custom_oauth2 one — authorized afterwards in a browser;
+              until then `POST /v1/connections/{_id}/ping` answers `missing_token`). The server
+              checks the provider only — a custom_oauth2 iClient registered for a different HTTP
+              connector (`_httpConnectorId`) also saves on a GCS connection — so bind an iClient
+              with no connector or the Google Cloud Storage connector's. The connection document
+              keeps `auth.oauth.scope` as sent (a GCS connection saved without it stores none), so
+              send the Cloud Storage scopes on the OAuth 2.0 auth type
+              (https://www.googleapis.com/auth/devstorage.read_write, …read_only or
+              …full_control); a service account connection carries none.
             - |-
               On a Shopify connection keep `settings.appType` and `_iClientId` in step the way the
               form does — `public` with the connector's published iClient, `custom` with an

package/dist/enduser.yml

@@ -4630,23 +4630,51 @@ components:
             googleProjectId:
               type: string
               description: |-
-                Google Cloud project id for Google Cloud Storage connections
-                (assistant `googlecloudstorage`, or a `baseURI` pointing at
-                `storage.googleapis.com`).
+                Default project ID of a Google Cloud Storage connection (assistant
+                `googlecloudstorage`, or a `baseURI` pointing at
+                `storage.googleapis.com`): the Google Cloud project whose buckets the
+                export and import forms list. It does not limit access — the
+                connection reaches any bucket the authorized Google account or
+                service account may use. Set by the caller on the OAuth 2.0 auth type
+                (Celigo's published Google Cloud Storage iClient or an account-owned
+                `custom_oauth2` iClient). On the Google service account auth type the
+                server stores the key's `project_id` on create and on any save that
+                changes or omits `http.unencrypted`; a save that re-sends the stored
+                `http.unencrypted` unchanged keeps the stored value, even though the
+                response body can echo the key's — read the connection back. Trimmed
+                on save; no format is enforced (the connection form warns on a value
+                outside Google's project-id format and still saves it).
               examples:
                 - my-gcs-project
               x-celigo-ai-guidance:
                 - |-
                   Required when the GCS connection authenticates through an OAuth
-                  iClient (provider custom_oauth2). Omitting it fails the save
-                  with 422 project_id_missing on http.unencrypted.googleProjectId
-                  — "Default project ID is required on OAuth Google Cloud Storage
-                  connections (http.unencrypted.googleProjectId)." With a
-                  googleserviceaccount iClient the server fills this from the
-                  key's project_id. Any other provider fails with 422
-                  invalid_field on http._iClientId — "IClient provider must be
+                  iClient — Celigo's published Google Cloud Storage iClient (the id
+                  the connector pre-configures on `http._iClientId` when
+                  `http.auth.type` is `oauth`) or an account-owned iClient with
+                  provider custom_oauth2. Omitting it, or sending only whitespace,
+                  fails the save with 422 project_id_missing on
+                  http.unencrypted.googleProjectId — "Default project ID is
+                  required on OAuth Google Cloud Storage connections
+                  (http.unencrypted.googleProjectId)." — on create and on every
+                  later PUT. With a googleserviceaccount iClient the server stores
+                  the key's project_id on create (a value sent on create is
+                  replaced by it) and on any later save that changes or omits
+                  `http.unencrypted` — the next bullet has the PUT that does not
+                  re-fill it. Any other provider fails with 422 invalid_field
+                  on http._iClientId — "IClient provider must be
                   googleserviceaccount or custom_oauth2 for Google Cloud Storage
                   connections."
+                - |-
+                  When a PUT moves the connection from an OAuth iClient to a
+                  googleserviceaccount iClient, drop `http.unencrypted` (or change
+                  it) in the same PUT: the server's fill from the key is written
+                  only when `http.unencrypted` is absent or changed, so a PUT that
+                  re-sends the stored object unchanged keeps the OAuth-era project
+                  id beside the service account (the 200 body still echoes the
+                  key's — only a GET shows what persisted). Moving the other way
+                  (service account → OAuth) needs the project id in the PUT, or it
+                  is the 422 above.
         unencryptedFields:
           type: array
           description: |
@@ -4691,13 +4719,20 @@ components:
           description: |-
             iClient that holds the credentials this connection signs with: the OAuth 2.0 client for
             `auth.type` `oauth` (including the `azureserviceprincipal` service principal an Azure
-            Data Lake Storage Gen2 connection authenticates with and the `googleserviceaccount` key
-            a Google Cloud Storage connection uses), or the `awsIam` role for `auth.type` `awsiam`.
+            Data Lake Storage Gen2 connection authenticates with and, on a Google Cloud Storage
+            connection, either the `googleserviceaccount` key of its Google service account auth
+            type or — its OAuth 2.0 auth type — Celigo's published Google Cloud Storage iClient,
+            which the connector pre-configures, or an account-owned `custom_oauth2` iClient), or
+            the `awsIam` role for `auth.type` `awsiam`.
             Must belong to the same account as the connection — or be the iClient Celigo publishes
             with a pre-built OAuth HTTP connector (pre-configured by the connector; from the
-            connecting account `GET /v1/iclients/{_id}` on it is 404 resource_not_found and
-            `GET /v1/iclients` does not list it, yet the connection saves with it). Omit for every
-            other auth type. On a Shopify connection `settings.appType` says which of the two it
+            connecting account `GET /v1/iclients/{_id}` on it is 404 — resource_not_found or
+            invalid_ref "IClient not found." — and `GET /v1/iclients` does not list it, yet the
+            connection saves with it). Omit for every other auth type. A Google Cloud Storage
+            connection stores `auth.type` `oauth` under both of its auth types; the referenced
+            iClient's provider tells them apart, and switching is a PUT that changes `_iClientId`
+            (see `unencrypted.googleProjectId` for what travels with it). On a Shopify connection
+            `settings.appType` says which of the two it
             is: `public` rides Celigo's published Shopify app (installed from the Shopify App
             Store), `custom` rides the account's own iClient — the Shopify app the customer created
             in the Shopify dev dashboard — with `auth.oauth.scope` chosen on the connection. A
@@ -4712,7 +4747,7 @@ components:
             published app and carry no `settings.appType`.
           examples:
             - 6203a7e4f321d800129a1b8e
-          x-celigo-ui-override: 'Required by the connection form for oauth (subForms/httpOAuth.js: required true, iClient filter provider custom_oauth2, or googleserviceaccount / azureserviceprincipal for the GCS and ADLS Gen2 variants) and for awsIam (subForms/httpAwsIam.js: required true, filter provider awsIam). For oauth the API creates the connection without it and the authorization is completed afterward; for awsiam the API also rejects its absence (see the if/then rule on this schema).'
+          x-celigo-ui-override: 'Required by the connection form for oauth (subForms/httpOAuth.js: required true, iClient filter provider custom_oauth2 — on a Google Cloud Storage connection''s OAuth 2.0 auth type too, where Simple view pre-selects Celigo''s published iClient and hides the picker — or googleserviceaccount / azureserviceprincipal for the GCS Google service account and ADLS Gen2 variants) and for awsIam (subForms/httpAwsIam.js: required true, filter provider awsIam). For oauth the API creates the connection without it and the authorization is completed afterward; for awsiam the API also rejects its absence (see the if/then rule on this schema).'
           x-celigo-ai-guidance:
             - |-
               For auth.type "awsiam" the referenced iClient must have provider "awsIam" (any other
@@ -4731,10 +4766,30 @@ components:
               The iClient must belong to the same account as the connection — an iClient id from
               another account fails with 422 invalid_ref "The referenced IClient must belong to the
               same user." The one exception is the iClient a pre-built OAuth HTTP connector
-              pre-configures (Celigo's published app — the Shopify Public App's, for one): the
-              connection saves with that id from the connecting account even though
-              `GET /v1/iclients/{_id}` on it is 404 there, so do not refuse a `public` Shopify
-              connection on this rule.
+              pre-configures (Celigo's published app — the Shopify Public App's and the Google Cloud
+              Storage OAuth 2.0 iClient, for two): the connection saves with that id from the
+              connecting account even though `GET /v1/iclients/{_id}` on it is 404 there, so do not
+              refuse a `public` Shopify connection or an OAuth 2.0 Google Cloud Storage connection on
+              this rule. Read the id from the connector's metadata
+              (`GET /v1/httpconnectors/{_id}?returnEverything=true`,
+              `supportedBy.connection.preConfiguredFields` entry for `http._iClientId`), never from
+              a hard-coded value.
+            - |-
+              A Google Cloud Storage connection (assistant "googlecloudstorage", or any http.baseURI
+              containing "storage.googleapis.com") references either a googleserviceaccount iClient
+              of the same account (its Google service account auth type — no authorization step; the
+              server stores the key's project_id in `unencrypted.googleProjectId` on create and
+              whenever `http.unencrypted` changes or is omitted — see that field) or an OAuth iClient
+              with `unencrypted.googleProjectId` set (its OAuth 2.0 auth type — Celigo's published
+              iClient, or an account-owned custom_oauth2 one — authorized afterwards in a browser;
+              until then `POST /v1/connections/{_id}/ping` answers `missing_token`). The server
+              checks the provider only — a custom_oauth2 iClient registered for a different HTTP
+              connector (`_httpConnectorId`) also saves on a GCS connection — so bind an iClient
+              with no connector or the Google Cloud Storage connector's. The connection document
+              keeps `auth.oauth.scope` as sent (a GCS connection saved without it stores none), so
+              send the Cloud Storage scopes on the OAuth 2.0 auth type
+              (https://www.googleapis.com/auth/devstorage.read_write, …read_only or
+              …full_control); a service account connection carries none.
             - |-
               On a Shopify connection keep `settings.appType` and `_iClientId` in step the way the
               form does — `public` with the connector's published iClient, `custom` with an

package/dist/mcp-server.yml

@@ -7072,23 +7072,51 @@ components:
             googleProjectId:
               type: string
               description: |-
-                Google Cloud project id for Google Cloud Storage connections
-                (assistant `googlecloudstorage`, or a `baseURI` pointing at
-                `storage.googleapis.com`).
+                Default project ID of a Google Cloud Storage connection (assistant
+                `googlecloudstorage`, or a `baseURI` pointing at
+                `storage.googleapis.com`): the Google Cloud project whose buckets the
+                export and import forms list. It does not limit access — the
+                connection reaches any bucket the authorized Google account or
+                service account may use. Set by the caller on the OAuth 2.0 auth type
+                (Celigo's published Google Cloud Storage iClient or an account-owned
+                `custom_oauth2` iClient). On the Google service account auth type the
+                server stores the key's `project_id` on create and on any save that
+                changes or omits `http.unencrypted`; a save that re-sends the stored
+                `http.unencrypted` unchanged keeps the stored value, even though the
+                response body can echo the key's — read the connection back. Trimmed
+                on save; no format is enforced (the connection form warns on a value
+                outside Google's project-id format and still saves it).
               examples:
                 - my-gcs-project
               x-celigo-ai-guidance:
                 - |-
                   Required when the GCS connection authenticates through an OAuth
-                  iClient (provider custom_oauth2). Omitting it fails the save
-                  with 422 project_id_missing on http.unencrypted.googleProjectId
-                  — "Default project ID is required on OAuth Google Cloud Storage
-                  connections (http.unencrypted.googleProjectId)." With a
-                  googleserviceaccount iClient the server fills this from the
-                  key's project_id. Any other provider fails with 422
-                  invalid_field on http._iClientId — "IClient provider must be
+                  iClient — Celigo's published Google Cloud Storage iClient (the id
+                  the connector pre-configures on `http._iClientId` when
+                  `http.auth.type` is `oauth`) or an account-owned iClient with
+                  provider custom_oauth2. Omitting it, or sending only whitespace,
+                  fails the save with 422 project_id_missing on
+                  http.unencrypted.googleProjectId — "Default project ID is
+                  required on OAuth Google Cloud Storage connections
+                  (http.unencrypted.googleProjectId)." — on create and on every
+                  later PUT. With a googleserviceaccount iClient the server stores
+                  the key's project_id on create (a value sent on create is
+                  replaced by it) and on any later save that changes or omits
+                  `http.unencrypted` — the next bullet has the PUT that does not
+                  re-fill it. Any other provider fails with 422 invalid_field
+                  on http._iClientId — "IClient provider must be
                   googleserviceaccount or custom_oauth2 for Google Cloud Storage
                   connections."
+                - |-
+                  When a PUT moves the connection from an OAuth iClient to a
+                  googleserviceaccount iClient, drop `http.unencrypted` (or change
+                  it) in the same PUT: the server's fill from the key is written
+                  only when `http.unencrypted` is absent or changed, so a PUT that
+                  re-sends the stored object unchanged keeps the OAuth-era project
+                  id beside the service account (the 200 body still echoes the
+                  key's — only a GET shows what persisted). Moving the other way
+                  (service account → OAuth) needs the project id in the PUT, or it
+                  is the 422 above.
         unencryptedFields:
           type: array
           description: |
@@ -7133,13 +7161,20 @@ components:
           description: |-
             iClient that holds the credentials this connection signs with: the OAuth 2.0 client for
             `auth.type` `oauth` (including the `azureserviceprincipal` service principal an Azure
-            Data Lake Storage Gen2 connection authenticates with and the `googleserviceaccount` key
-            a Google Cloud Storage connection uses), or the `awsIam` role for `auth.type` `awsiam`.
+            Data Lake Storage Gen2 connection authenticates with and, on a Google Cloud Storage
+            connection, either the `googleserviceaccount` key of its Google service account auth
+            type or — its OAuth 2.0 auth type — Celigo's published Google Cloud Storage iClient,
+            which the connector pre-configures, or an account-owned `custom_oauth2` iClient), or
+            the `awsIam` role for `auth.type` `awsiam`.
             Must belong to the same account as the connection — or be the iClient Celigo publishes
             with a pre-built OAuth HTTP connector (pre-configured by the connector; from the
-            connecting account `GET /v1/iclients/{_id}` on it is 404 resource_not_found and
-            `GET /v1/iclients` does not list it, yet the connection saves with it). Omit for every
-            other auth type. On a Shopify connection `settings.appType` says which of the two it
+            connecting account `GET /v1/iclients/{_id}` on it is 404 — resource_not_found or
+            invalid_ref "IClient not found." — and `GET /v1/iclients` does not list it, yet the
+            connection saves with it). Omit for every other auth type. A Google Cloud Storage
+            connection stores `auth.type` `oauth` under both of its auth types; the referenced
+            iClient's provider tells them apart, and switching is a PUT that changes `_iClientId`
+            (see `unencrypted.googleProjectId` for what travels with it). On a Shopify connection
+            `settings.appType` says which of the two it
             is: `public` rides Celigo's published Shopify app (installed from the Shopify App
             Store), `custom` rides the account's own iClient — the Shopify app the customer created
             in the Shopify dev dashboard — with `auth.oauth.scope` chosen on the connection. A
@@ -7154,7 +7189,7 @@ components:
             published app and carry no `settings.appType`.
           examples:
             - 6203a7e4f321d800129a1b8e
-          x-celigo-ui-override: 'Required by the connection form for oauth (subForms/httpOAuth.js: required true, iClient filter provider custom_oauth2, or googleserviceaccount / azureserviceprincipal for the GCS and ADLS Gen2 variants) and for awsIam (subForms/httpAwsIam.js: required true, filter provider awsIam). For oauth the API creates the connection without it and the authorization is completed afterward; for awsiam the API also rejects its absence (see the if/then rule on this schema).'
+          x-celigo-ui-override: 'Required by the connection form for oauth (subForms/httpOAuth.js: required true, iClient filter provider custom_oauth2 — on a Google Cloud Storage connection''s OAuth 2.0 auth type too, where Simple view pre-selects Celigo''s published iClient and hides the picker — or googleserviceaccount / azureserviceprincipal for the GCS Google service account and ADLS Gen2 variants) and for awsIam (subForms/httpAwsIam.js: required true, filter provider awsIam). For oauth the API creates the connection without it and the authorization is completed afterward; for awsiam the API also rejects its absence (see the if/then rule on this schema).'
           x-celigo-ai-guidance:
             - |-
               For auth.type "awsiam" the referenced iClient must have provider "awsIam" (any other
@@ -7173,10 +7208,30 @@ components:
               The iClient must belong to the same account as the connection — an iClient id from
               another account fails with 422 invalid_ref "The referenced IClient must belong to the
               same user." The one exception is the iClient a pre-built OAuth HTTP connector
-              pre-configures (Celigo's published app — the Shopify Public App's, for one): the
-              connection saves with that id from the connecting account even though
-              `GET /v1/iclients/{_id}` on it is 404 there, so do not refuse a `public` Shopify
-              connection on this rule.
+              pre-configures (Celigo's published app — the Shopify Public App's and the Google Cloud
+              Storage OAuth 2.0 iClient, for two): the connection saves with that id from the
+              connecting account even though `GET /v1/iclients/{_id}` on it is 404 there, so do not
+              refuse a `public` Shopify connection or an OAuth 2.0 Google Cloud Storage connection on
+              this rule. Read the id from the connector's metadata
+              (`GET /v1/httpconnectors/{_id}?returnEverything=true`,
+              `supportedBy.connection.preConfiguredFields` entry for `http._iClientId`), never from
+              a hard-coded value.
+            - |-
+              A Google Cloud Storage connection (assistant "googlecloudstorage", or any http.baseURI
+              containing "storage.googleapis.com") references either a googleserviceaccount iClient
+              of the same account (its Google service account auth type — no authorization step; the
+              server stores the key's project_id in `unencrypted.googleProjectId` on create and
+              whenever `http.unencrypted` changes or is omitted — see that field) or an OAuth iClient
+              with `unencrypted.googleProjectId` set (its OAuth 2.0 auth type — Celigo's published
+              iClient, or an account-owned custom_oauth2 one — authorized afterwards in a browser;
+              until then `POST /v1/connections/{_id}/ping` answers `missing_token`). The server
+              checks the provider only — a custom_oauth2 iClient registered for a different HTTP
+              connector (`_httpConnectorId`) also saves on a GCS connection — so bind an iClient
+              with no connector or the Google Cloud Storage connector's. The connection document
+              keeps `auth.oauth.scope` as sent (a GCS connection saved without it stores none), so
+              send the Cloud Storage scopes on the OAuth 2.0 auth type
+              (https://www.googleapis.com/auth/devstorage.read_write, …read_only or
+              …full_control); a service account connection carries none.
             - |-
               On a Shopify connection keep `settings.appType` and `_iClientId` in step the way the
               form does — `public` with the connector's published iClient, `custom` with an

package/dist/tool.yml

@@ -10000,23 +10000,51 @@ components:
             googleProjectId:
               type: string
               description: |-
-                Google Cloud project id for Google Cloud Storage connections
-                (assistant `googlecloudstorage`, or a `baseURI` pointing at
-                `storage.googleapis.com`).
+                Default project ID of a Google Cloud Storage connection (assistant
+                `googlecloudstorage`, or a `baseURI` pointing at
+                `storage.googleapis.com`): the Google Cloud project whose buckets the
+                export and import forms list. It does not limit access — the
+                connection reaches any bucket the authorized Google account or
+                service account may use. Set by the caller on the OAuth 2.0 auth type
+                (Celigo's published Google Cloud Storage iClient or an account-owned
+                `custom_oauth2` iClient). On the Google service account auth type the
+                server stores the key's `project_id` on create and on any save that
+                changes or omits `http.unencrypted`; a save that re-sends the stored
+                `http.unencrypted` unchanged keeps the stored value, even though the
+                response body can echo the key's — read the connection back. Trimmed
+                on save; no format is enforced (the connection form warns on a value
+                outside Google's project-id format and still saves it).
               examples:
                 - my-gcs-project
               x-celigo-ai-guidance:
                 - |-
                   Required when the GCS connection authenticates through an OAuth
-                  iClient (provider custom_oauth2). Omitting it fails the save
-                  with 422 project_id_missing on http.unencrypted.googleProjectId
-                  — "Default project ID is required on OAuth Google Cloud Storage
-                  connections (http.unencrypted.googleProjectId)." With a
-                  googleserviceaccount iClient the server fills this from the
-                  key's project_id. Any other provider fails with 422
-                  invalid_field on http._iClientId — "IClient provider must be
+                  iClient — Celigo's published Google Cloud Storage iClient (the id
+                  the connector pre-configures on `http._iClientId` when
+                  `http.auth.type` is `oauth`) or an account-owned iClient with
+                  provider custom_oauth2. Omitting it, or sending only whitespace,
+                  fails the save with 422 project_id_missing on
+                  http.unencrypted.googleProjectId — "Default project ID is
+                  required on OAuth Google Cloud Storage connections
+                  (http.unencrypted.googleProjectId)." — on create and on every
+                  later PUT. With a googleserviceaccount iClient the server stores
+                  the key's project_id on create (a value sent on create is
+                  replaced by it) and on any later save that changes or omits
+                  `http.unencrypted` — the next bullet has the PUT that does not
+                  re-fill it. Any other provider fails with 422 invalid_field
+                  on http._iClientId — "IClient provider must be
                   googleserviceaccount or custom_oauth2 for Google Cloud Storage
                   connections."
+                - |-
+                  When a PUT moves the connection from an OAuth iClient to a
+                  googleserviceaccount iClient, drop `http.unencrypted` (or change
+                  it) in the same PUT: the server's fill from the key is written
+                  only when `http.unencrypted` is absent or changed, so a PUT that
+                  re-sends the stored object unchanged keeps the OAuth-era project
+                  id beside the service account (the 200 body still echoes the
+                  key's — only a GET shows what persisted). Moving the other way
+                  (service account → OAuth) needs the project id in the PUT, or it
+                  is the 422 above.
         unencryptedFields:
           type: array
           description: |
@@ -10061,13 +10089,20 @@ components:
           description: |-
             iClient that holds the credentials this connection signs with: the OAuth 2.0 client for
             `auth.type` `oauth` (including the `azureserviceprincipal` service principal an Azure
-            Data Lake Storage Gen2 connection authenticates with and the `googleserviceaccount` key
-            a Google Cloud Storage connection uses), or the `awsIam` role for `auth.type` `awsiam`.
+            Data Lake Storage Gen2 connection authenticates with and, on a Google Cloud Storage
+            connection, either the `googleserviceaccount` key of its Google service account auth
+            type or — its OAuth 2.0 auth type — Celigo's published Google Cloud Storage iClient,
+            which the connector pre-configures, or an account-owned `custom_oauth2` iClient), or
+            the `awsIam` role for `auth.type` `awsiam`.
             Must belong to the same account as the connection — or be the iClient Celigo publishes
             with a pre-built OAuth HTTP connector (pre-configured by the connector; from the
-            connecting account `GET /v1/iclients/{_id}` on it is 404 resource_not_found and
-            `GET /v1/iclients` does not list it, yet the connection saves with it). Omit for every
-            other auth type. On a Shopify connection `settings.appType` says which of the two it
+            connecting account `GET /v1/iclients/{_id}` on it is 404 — resource_not_found or
+            invalid_ref "IClient not found." — and `GET /v1/iclients` does not list it, yet the
+            connection saves with it). Omit for every other auth type. A Google Cloud Storage
+            connection stores `auth.type` `oauth` under both of its auth types; the referenced
+            iClient's provider tells them apart, and switching is a PUT that changes `_iClientId`
+            (see `unencrypted.googleProjectId` for what travels with it). On a Shopify connection
+            `settings.appType` says which of the two it
             is: `public` rides Celigo's published Shopify app (installed from the Shopify App
             Store), `custom` rides the account's own iClient — the Shopify app the customer created
             in the Shopify dev dashboard — with `auth.oauth.scope` chosen on the connection. A
@@ -10082,7 +10117,7 @@ components:
             published app and carry no `settings.appType`.
           examples:
             - 6203a7e4f321d800129a1b8e
-          x-celigo-ui-override: 'Required by the connection form for oauth (subForms/httpOAuth.js: required true, iClient filter provider custom_oauth2, or googleserviceaccount / azureserviceprincipal for the GCS and ADLS Gen2 variants) and for awsIam (subForms/httpAwsIam.js: required true, filter provider awsIam). For oauth the API creates the connection without it and the authorization is completed afterward; for awsiam the API also rejects its absence (see the if/then rule on this schema).'
+          x-celigo-ui-override: 'Required by the connection form for oauth (subForms/httpOAuth.js: required true, iClient filter provider custom_oauth2 — on a Google Cloud Storage connection''s OAuth 2.0 auth type too, where Simple view pre-selects Celigo''s published iClient and hides the picker — or googleserviceaccount / azureserviceprincipal for the GCS Google service account and ADLS Gen2 variants) and for awsIam (subForms/httpAwsIam.js: required true, filter provider awsIam). For oauth the API creates the connection without it and the authorization is completed afterward; for awsiam the API also rejects its absence (see the if/then rule on this schema).'
           x-celigo-ai-guidance:
             - |-
               For auth.type "awsiam" the referenced iClient must have provider "awsIam" (any other
@@ -10101,10 +10136,30 @@ components:
               The iClient must belong to the same account as the connection — an iClient id from
               another account fails with 422 invalid_ref "The referenced IClient must belong to the
               same user." The one exception is the iClient a pre-built OAuth HTTP connector
-              pre-configures (Celigo's published app — the Shopify Public App's, for one): the
-              connection saves with that id from the connecting account even though
-              `GET /v1/iclients/{_id}` on it is 404 there, so do not refuse a `public` Shopify
-              connection on this rule.
+              pre-configures (Celigo's published app — the Shopify Public App's and the Google Cloud
+              Storage OAuth 2.0 iClient, for two): the connection saves with that id from the
+              connecting account even though `GET /v1/iclients/{_id}` on it is 404 there, so do not
+              refuse a `public` Shopify connection or an OAuth 2.0 Google Cloud Storage connection on
+              this rule. Read the id from the connector's metadata
+              (`GET /v1/httpconnectors/{_id}?returnEverything=true`,
+              `supportedBy.connection.preConfiguredFields` entry for `http._iClientId`), never from
+              a hard-coded value.
+            - |-
+              A Google Cloud Storage connection (assistant "googlecloudstorage", or any http.baseURI
+              containing "storage.googleapis.com") references either a googleserviceaccount iClient
+              of the same account (its Google service account auth type — no authorization step; the
+              server stores the key's project_id in `unencrypted.googleProjectId` on create and
+              whenever `http.unencrypted` changes or is omitted — see that field) or an OAuth iClient
+              with `unencrypted.googleProjectId` set (its OAuth 2.0 auth type — Celigo's published
+              iClient, or an account-owned custom_oauth2 one — authorized afterwards in a browser;
+              until then `POST /v1/connections/{_id}/ping` answers `missing_token`). The server
+              checks the provider only — a custom_oauth2 iClient registered for a different HTTP
+              connector (`_httpConnectorId`) also saves on a GCS connection — so bind an iClient
+              with no connector or the Google Cloud Storage connector's. The connection document
+              keeps `auth.oauth.scope` as sent (a GCS connection saved without it stores none), so
+              send the Cloud Storage scopes on the OAuth 2.0 auth type
+              (https://www.googleapis.com/auth/devstorage.read_write, …read_only or
+              …full_control); a service account connection carries none.
             - |-
               On a Shopify connection keep `settings.appType` and `_iClientId` in step the way the
               form does — `public` with the connector's published iClient, `custom` with an

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celigo/api-specs",
-  "version": "0.2.193",
+  "version": "0.2.194",
   "private": false,
   "description": "Public OpenAPI bundles (dist/) and the celigo-cli lint schema pack (schemas.json).",
   "keywords": [

package/schemas.json

@@ -1,7 +1,7 @@
 {
 	"provenance": {
 		"repo": "celigo/integrator-api-specs",
-		"iasCommit": "9ea51d4f",
+		"iasCommit": "15622d32",
 		"generatedAt": "2026-10-26"
 	},
 	"roots": {