@celigo/api-specs 0.2.77 → 0.2.79

package/dist/api.yml

@@ -7260,11 +7260,15 @@ components:
               x-celigo-ai-guidance:
                 - |-
                   Required when the GCS connection authenticates through an OAuth
-                  iClient (provider custom_oauth2) — omitting it fails the save
-                  with GCS_PROJECT_ID_MISSING. With a googleserviceaccount
-                  iClient the server fills it automatically from the iClient's
-                  projectId; any other iClient provider is rejected with
-                  GCS_ICLIENT_INVALID_PROVIDER.
+                  iClient (provider custom_oauth2). Omitting it fails the save
+                  with 422 project_id_missing on http.unencrypted.googleProjectId
+                  — "Default project ID is required on OAuth Google Cloud Storage
+                  connections (http.unencrypted.googleProjectId)." With a
+                  googleserviceaccount iClient the server fills this from the
+                  key's project_id. Any other provider fails with 422
+                  invalid_field on http._iClientId — "IClient provider must be
+                  googleserviceaccount or custom_oauth2 for Google Cloud Storage
+                  connections."
         unencryptedFields:
           type: array
           description: |

package/dist/connection.yml

@@ -701,6 +701,20 @@ paths:
                       - field: http._iClientId
                         code: invalid_field
                         message: IClient provider must be azureserviceprincipal for Azure Data Lake Storage Gen2 connections.
+                gcsIClientWrongProvider:
+                  summary: Google Cloud Storage connection referencing an iClient that is neither a service account nor OAuth
+                  value:
+                    errors:
+                      - field: http._iClientId
+                        code: invalid_field
+                        message: IClient provider must be googleserviceaccount or custom_oauth2 for Google Cloud Storage connections.
+                gcsProjectIdMissing:
+                  summary: Google Cloud Storage OAuth connection without a project id
+                  value:
+                    errors:
+                      - field: http.unencrypted.googleProjectId
+                        code: project_id_missing
+                        message: Default project ID is required on OAuth Google Cloud Storage connections (http.unencrypted.googleProjectId).
       x-celigo-ai-guidance:
         - |-
           Send exactly one adaptor config object, the one named by `type`. Credentials are accepted
@@ -5853,11 +5867,15 @@ components:
               x-celigo-ai-guidance:
                 - |-
                   Required when the GCS connection authenticates through an OAuth
-                  iClient (provider custom_oauth2) — omitting it fails the save
-                  with GCS_PROJECT_ID_MISSING. With a googleserviceaccount
-                  iClient the server fills it automatically from the iClient's
-                  projectId; any other iClient provider is rejected with
-                  GCS_ICLIENT_INVALID_PROVIDER.
+                  iClient (provider custom_oauth2). Omitting it fails the save
+                  with 422 project_id_missing on http.unencrypted.googleProjectId
+                  — "Default project ID is required on OAuth Google Cloud Storage
+                  connections (http.unencrypted.googleProjectId)." With a
+                  googleserviceaccount iClient the server fills this from the
+                  key's project_id. Any other provider fails with 422
+                  invalid_field on http._iClientId — "IClient provider must be
+                  googleserviceaccount or custom_oauth2 for Google Cloud Storage
+                  connections."
         unencryptedFields:
           type: array
           description: |

package/dist/enduser.yml

@@ -4506,11 +4506,15 @@ components:
               x-celigo-ai-guidance:
                 - |-
                   Required when the GCS connection authenticates through an OAuth
-                  iClient (provider custom_oauth2) — omitting it fails the save
-                  with GCS_PROJECT_ID_MISSING. With a googleserviceaccount
-                  iClient the server fills it automatically from the iClient's
-                  projectId; any other iClient provider is rejected with
-                  GCS_ICLIENT_INVALID_PROVIDER.
+                  iClient (provider custom_oauth2). Omitting it fails the save
+                  with 422 project_id_missing on http.unencrypted.googleProjectId
+                  — "Default project ID is required on OAuth Google Cloud Storage
+                  connections (http.unencrypted.googleProjectId)." With a
+                  googleserviceaccount iClient the server fills this from the
+                  key's project_id. Any other provider fails with 422
+                  invalid_field on http._iClientId — "IClient provider must be
+                  googleserviceaccount or custom_oauth2 for Google Cloud Storage
+                  connections."
         unencryptedFields:
           type: array
           description: |

package/dist/iclient.yml

@@ -254,6 +254,13 @@ paths:
                       - field: awsIam.roleArn
                         code: invalid_field_value
                         message: roleArn must match format arn:aws:iam::{account-id}:role/[path/]{role-name}.
+                googleServiceAccountInvalidJsonKey:
+                  summary: Google service account key is missing or not the required JSON
+                  value:
+                    errors:
+                      - field: googleserviceaccount.serviceAccountJSON
+                        code: invalid_json_key
+                        message: The service account JSON key is missing, empty, or not valid JSON with required fields (project_id, client_email, private_key).
   /v1/iclients/{_id}:
     get:
       x-internal: false
@@ -313,7 +320,8 @@ paths:
       description: |-
         Replaces an iClient. All mutable fields must be provided — omitted
         fields are reset to defaults. Secrets returned as `"******"` can be
-        sent back as-is to keep the existing value.
+        sent back as-is to keep the existing value, except a Google service
+        account: every update must include the full JSON key.
       operationId: updateIClient
       tags:
         - iClients
@@ -371,7 +379,22 @@ paths:
         '404':
           $ref: '#/components/responses/404-not-found'
         '422':
-          $ref: '#/components/responses/422-unprocessable-entity'
+          description: |-
+            Unprocessable entity. The body was well-formed but a credential
+            field failed validation. A Google service account update without
+            the full JSON key is rejected here.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+              examples:
+                googleServiceAccountKeyOmitted:
+                  summary: Google service account update without the full JSON key
+                  value:
+                    errors:
+                      - field: googleserviceaccount.serviceAccountJSON
+                        code: invalid_json_key
+                        message: The service account JSON key is missing, empty, or not valid JSON with required fields (project_id, client_email, private_key).
     patch:
       x-internal: false
       summary: Patch an iClient
@@ -3986,12 +4009,22 @@ components:
               type: string
               writeOnly: true
               description: |-
-                Full Google service-account key file as a JSON string. Must parse
-                as JSON and contain `project_id`, `client_email`, and a valid PEM
-                `private_key` — otherwise the save fails with
-                ICLIENT_GOOGLESERVICEACCOUNT_INVALID_JSON_KEY (or _INVALID_PEM
-                when only the key material is malformed). On update, omitting it
-                (or sending the mask) keeps the stored credentials.
+                Google service-account key file, sent as a JSON string. The save
+                reads `project_id`, `client_email`, and a `private_key` that
+                includes its PEM armor (`-----BEGIN PRIVATE KEY-----` through
+                `-----END PRIVATE KEY-----`). Missing, empty, or incomplete JSON
+                fails with 422 `invalid_json_key`. Send the full key on every
+                create and every update — omitting it or sending `"******"`
+                fails the same way.
+              x-celigo-ai-guidance:
+                - |-
+                  A placeholder body inside the PEM armor is accepted on create.
+                  A PUT never keeps the stored key: omitting serviceAccountJSON,
+                  sending "******", or omitting the googleserviceaccount block
+                  all return 422 invalid_json_key on
+                  googleserviceaccount.serviceAccountJSON — "The service account
+                  JSON key is missing, empty, or not valid JSON with required
+                  fields (project_id, client_email, private_key)."
             clientEmail:
               type: string
               readOnly: true
@@ -4300,9 +4333,12 @@ components:
         `salesforce`, `ebay`, `amazonmws`, `azureserviceprincipal`,
         `googleserviceaccount`, `awsIam`).
         For `custom_oauth2`, credentials go in the `oauth2` sub-object.
-        Secrets (`clientSecret`, `privateKey`, etc.) are returned masked
-        as `"******"`. On update, re-send that masked value to keep the
-        existing secret; secrets are not preserved if omitted.
+        Secrets (`clientSecret`, `privateKey`, and so on) come back masked
+        as `"******"`. Re-send that mask on update to keep the stored
+        secret; omitting it does not. A Google service account is the
+        exception: `serviceAccountJSON` is not returned, and every update
+        must send the full key — the mask or an omission fails with 422
+        `invalid_json_key`.
       required:
         - provider
       allOf:

package/dist/import.yml

@@ -8400,6 +8400,19 @@ components:
             - 100
     File:
       type: object
+      x-celigo-excludeAdaptorTypes:
+        - RDBMSImport
+        - JDBCImport
+        - SalesforceImport
+        - NetSuiteImport
+        - MongodbImport
+      x-celigo-ai-guidance:
+        - |-
+          Never author or patch `file` on an `RDBMSImport`. On a bulk load the API echoes a
+          platform-derived `file` object whose values a save cannot change: the write is accepted,
+          the change is discarded, and a read-back shows the original values. Shape the records
+          before the write (a preMap/postMap hook, the mapping, a transform) or correct the source
+          data instead.
       description: |-
         **CRITICAL: This object is REQUIRED for all file-based import adaptor types.**
 
@@ -8420,6 +8433,17 @@ components:
         - `HTTPImport` in records mode (`http.type` unset — a REST endpoint receiving records)
         - `MongodbImport`
         - `RDBMSImport`
+        - `JDBCImport`
+
+        **Read-only on database bulk loads**
+
+        An `RDBMSImport` whose `rdbms.queryType` is `bulk_load` returns a `file` object anyway: the
+        platform's description of the staging file it generates for the load (delimiter, quoting,
+        newline handling, and how the load is batched into files). It is derived on every read,
+        never stored — a save that changes it is accepted and the change discarded (the audit log
+        still records the request), and the import editor has no control for it. Change what
+        reaches the destination with a preMap/postMap hook, the mapping, or a transform, or correct
+        the source data.
 
         **Minimum required fields**
 

package/dist/mcp-server.yml

@@ -6316,11 +6316,15 @@ components:
               x-celigo-ai-guidance:
                 - |-
                   Required when the GCS connection authenticates through an OAuth
-                  iClient (provider custom_oauth2) — omitting it fails the save
-                  with GCS_PROJECT_ID_MISSING. With a googleserviceaccount
-                  iClient the server fills it automatically from the iClient's
-                  projectId; any other iClient provider is rejected with
-                  GCS_ICLIENT_INVALID_PROVIDER.
+                  iClient (provider custom_oauth2). Omitting it fails the save
+                  with 422 project_id_missing on http.unencrypted.googleProjectId
+                  — "Default project ID is required on OAuth Google Cloud Storage
+                  connections (http.unencrypted.googleProjectId)." With a
+                  googleserviceaccount iClient the server fills this from the
+                  key's project_id. Any other provider fails with 422
+                  invalid_field on http._iClientId — "IClient provider must be
+                  googleserviceaccount or custom_oauth2 for Google Cloud Storage
+                  connections."
         unencryptedFields:
           type: array
           description: |

package/dist/tool.yml

@@ -8959,11 +8959,15 @@ components:
               x-celigo-ai-guidance:
                 - |-
                   Required when the GCS connection authenticates through an OAuth
-                  iClient (provider custom_oauth2) — omitting it fails the save
-                  with GCS_PROJECT_ID_MISSING. With a googleserviceaccount
-                  iClient the server fills it automatically from the iClient's
-                  projectId; any other iClient provider is rejected with
-                  GCS_ICLIENT_INVALID_PROVIDER.
+                  iClient (provider custom_oauth2). Omitting it fails the save
+                  with 422 project_id_missing on http.unencrypted.googleProjectId
+                  — "Default project ID is required on OAuth Google Cloud Storage
+                  connections (http.unencrypted.googleProjectId)." With a
+                  googleserviceaccount iClient the server fills this from the
+                  key's project_id. Any other provider fails with 422
+                  invalid_field on http._iClientId — "IClient provider must be
+                  googleserviceaccount or custom_oauth2 for Google Cloud Storage
+                  connections."
         unencryptedFields:
           type: array
           description: |
@@ -18798,6 +18802,19 @@ components:
             - 100
     File:
       type: object
+      x-celigo-excludeAdaptorTypes:
+        - RDBMSImport
+        - JDBCImport
+        - SalesforceImport
+        - NetSuiteImport
+        - MongodbImport
+      x-celigo-ai-guidance:
+        - |-
+          Never author or patch `file` on an `RDBMSImport`. On a bulk load the API echoes a
+          platform-derived `file` object whose values a save cannot change: the write is accepted,
+          the change is discarded, and a read-back shows the original values. Shape the records
+          before the write (a preMap/postMap hook, the mapping, a transform) or correct the source
+          data instead.
       description: |-
         **CRITICAL: This object is REQUIRED for all file-based import adaptor types.**
 
@@ -18818,6 +18835,17 @@ components:
         - `HTTPImport` in records mode (`http.type` unset — a REST endpoint receiving records)
         - `MongodbImport`
         - `RDBMSImport`
+        - `JDBCImport`
+
+        **Read-only on database bulk loads**
+
+        An `RDBMSImport` whose `rdbms.queryType` is `bulk_load` returns a `file` object anyway: the
+        platform's description of the staging file it generates for the load (delimiter, quoting,
+        newline handling, and how the load is batched into files). It is derived on every read,
+        never stored — a save that changes it is accepted and the change discarded (the audit log
+        still records the request), and the import editor has no control for it. Change what
+        reaches the destination with a preMap/postMap hook, the mapping, or a transform, or correct
+        the source data.
 
         **Minimum required fields**
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celigo/api-specs",
-  "version": "0.2.77",
+  "version": "0.2.79",
   "private": false,
   "description": "Public OpenAPI bundles (dist/) and the celigo-cli lint schema pack (schemas.json).",
   "keywords": [

package/schemas.json

@@ -1,8 +1,8 @@
 {
 	"provenance": {
 		"repo": "celigo/integrator-api-specs",
-		"iasCommit": "2fa4fd0",
-		"generatedAt": "2026-10-06"
+		"iasCommit": "8b3a38c",
+		"generatedAt": "2026-10-08"
 	},
 	"roots": {
 		"aiagent": 133,