@cleocode/contracts 2026.6.13 → 2026.6.15

package/src/operations/llm.ts

@@ -255,6 +255,7 @@ export type ResolutionSource =
   | 'default'
   | 'default-profile'
   | 'registered-default'
+  | 'cross-provider'
   | 'implicit-fallback';
 
 /**
@@ -349,6 +350,21 @@ export interface ResolveLLMForRoleOptions {
    * @task T11748
    */
   systemKey?: string;
+  /**
+   * Optional named profile (a key of `llm.profiles`) that pins this resolution
+   * to a specific provider/model/credential, winning over the role tier
+   * (T11759 · M4).
+   *
+   * When set and the profile resolves, it is the HIGHEST-priority tier of
+   * {@link selectProviderModel} — above `roles[role]` and the `systems[key]`
+   * override — so an explicit caller pin (e.g. a `.cantbook` stage's
+   * `profile:`) cannot be silently overridden by background role config. When
+   * the named profile is absent or structurally incomplete, resolution falls
+   * through to the normal chain unchanged. Direct role callers leave it unset.
+   *
+   * @task T11759
+   */
+  profileOverride?: string;
 }
 
 // ============================================================================

package/src/operations/output-contracts-data.ts

@@ -24,10 +24,30 @@
  * @task T11692 — DHQ-057: per-operation output schema SSoT
  */
 
+import {
+  accountAddOutputContract,
+  accountListOutputContract,
+  accountRemoveOutputContract,
+  modelQueryOutputContract,
+  modelShowOutputContract,
+  profileCreateOutputContract,
+  profileListOutputContract,
+  profilePinOutputContract,
+  profileUseOutputContract,
+  providerConnectOutputContract,
+  providerListOutputContract,
+  providerShowOutputContract,
+} from './entities.js';
 import type {
   OperationOutputContract,
   OperationOutputContractRegistry,
 } from './output-contract.js';
+import {
+  serviceConnectOutputContract,
+  serviceListOutputContract,
+  serviceRevokeOutputContract,
+  serviceStatusOutputContract,
+} from './service.js';
 
 // ---------------------------------------------------------------------------
 // tasks.show — the operation that bit us (DHQ-057 reproduction)
@@ -334,6 +354,224 @@ const tasksCompleteOutputContract: OperationOutputContract = {
   fieldPointers: ['/data/updated/0', '/data/status', '/data/count'],
 };
 
+// ---------------------------------------------------------------------------
+// tasks.reorder-rank / tasks.bulk-move / tasks.assignee — bulk Kanban mutate
+// ops (T11786 · epic T11556). These ops have NO MUTATE_PROJECTION_PLANS entry,
+// so their raw core result is returned under `envelope.data` unchanged.
+// ---------------------------------------------------------------------------
+
+/**
+ * OUTPUT contract for `tasks.reorder-rank`.
+ *
+ * Grounded in `TasksReorderRankResult`: `{ ranked, skipped, count }`. `ranked`
+ * is the new top-to-bottom order; `skipped` lists request IDs that did not
+ * resolve to a task.
+ */
+const tasksReorderRankOutputContract: OperationOutputContract = {
+  operation: 'tasks.reorder-rank',
+  shapeNote:
+    'Re-ranked IDs (new order) at /data/ranked; unresolved request IDs at /data/skipped; count at /data/count.',
+  dataSchema: {
+    type: 'object',
+    required: ['ranked', 'skipped', 'count'],
+    additionalProperties: true,
+    properties: {
+      ranked: {
+        type: 'array',
+        description: 'Task IDs whose position was written, in the new top-to-bottom order.',
+        items: { type: 'string' },
+      },
+      skipped: {
+        type: 'array',
+        description: 'Request IDs that did not resolve to a task (no-op for these).',
+        items: { type: 'string' },
+      },
+      count: { type: 'number', description: 'Number of tasks re-ranked.' },
+    },
+  },
+  fieldPointers: ['/data/ranked/0', '/data/skipped/0', '/data/count'],
+};
+
+/**
+ * OUTPUT contract for `tasks.bulk-move`.
+ *
+ * Grounded in `TasksBulkMoveResult`: `{ moved, status?, pipelineStage?, count }`.
+ */
+const tasksBulkMoveOutputContract: OperationOutputContract = {
+  operation: 'tasks.bulk-move',
+  shapeNote:
+    'Moved task IDs at /data/moved (all-or-nothing); applied status/stage at /data/status and /data/pipelineStage; count at /data/count.',
+  dataSchema: {
+    type: 'object',
+    required: ['moved', 'count'],
+    additionalProperties: true,
+    properties: {
+      moved: {
+        type: 'array',
+        description: 'Task IDs successfully moved (atomic — empty only when count is 0).',
+        items: { type: 'string' },
+      },
+      status: { type: 'string', description: 'The status applied, when supplied.' },
+      pipelineStage: { type: 'string', description: 'The pipeline stage applied, when supplied.' },
+      count: { type: 'number', description: 'Number of tasks moved.' },
+    },
+  },
+  fieldPointers: ['/data/moved/0', '/data/status', '/data/pipelineStage', '/data/count'],
+};
+
+/**
+ * OUTPUT contract for `tasks.assignee`.
+ *
+ * Grounded in `TasksAssigneeResult`: `{ taskId, assignee, assigned }`. `assignee`
+ * is null when cleared; `assigned` is the boolean verb result.
+ */
+const tasksAssigneeOutputContract: OperationOutputContract = {
+  operation: 'tasks.assignee',
+  shapeNote:
+    'The new assignee is at /data/assignee (null when cleared); /data/assigned is true on set, false on clear.',
+  dataSchema: {
+    type: 'object',
+    required: ['taskId', 'assignee', 'assigned'],
+    additionalProperties: true,
+    properties: {
+      taskId: { type: 'string', description: 'The task ID whose assignee changed.' },
+      assignee: {
+        type: ['string', 'null'],
+        description: 'The new assignee value (null when cleared).',
+      },
+      assigned: { type: 'boolean', description: 'True when an assignee was set; false on clear.' },
+    },
+  },
+  fieldPointers: ['/data/taskId', '/data/assignee', '/data/assigned'],
+};
+
+// ---------------------------------------------------------------------------
+// admin.config.* — config-as-domain (T11917 · M5/AC3 · ConfigManifest cascade)
+// ---------------------------------------------------------------------------
+
+/**
+ * OUTPUT contract for `admin.config.get`.
+ *
+ * Grounded in `AdminConfigGetResult`: `{ key, scope, value, found }`. The
+ * resolved value lives at `/data/value`; `found` disambiguates a present `null`
+ * value from an absent key.
+ */
+const adminConfigGetOutputContract: OperationOutputContract = {
+  operation: 'admin.config.get',
+  shapeNote:
+    'The resolved value is at /data/value (may be null). /data/found is false when the key is absent.',
+  dataSchema: {
+    type: 'object',
+    required: ['key', 'scope', 'value', 'found'],
+    additionalProperties: true,
+    properties: {
+      key: { type: 'string', description: 'The dot-notation key that was resolved.' },
+      scope: {
+        type: 'string',
+        description: 'Cascade slice the value was resolved against.',
+        enum: ['global', 'project', 'merged'],
+      },
+      value: { description: 'Resolved value, or null when the key is absent.' },
+      found: { type: 'boolean', description: 'True IFF the key resolved to a defined value.' },
+    },
+  },
+  fieldPointers: ['/data/key', '/data/scope', '/data/value', '/data/found'],
+};
+
+/**
+ * OUTPUT contract for `admin.config.list`.
+ *
+ * Grounded in `AdminConfigListResult`: `{ scope, config, keys }`. The full
+ * resolved config object is at `/data/config`; flattened keys are at
+ * `/data/keys`.
+ */
+const adminConfigListOutputContract: OperationOutputContract = {
+  operation: 'admin.config.list',
+  shapeNote:
+    'The full resolved config is at /data/config (an object); flattened dot-notation keys are at /data/keys (an array).',
+  dataSchema: {
+    type: 'object',
+    required: ['scope', 'config', 'keys'],
+    additionalProperties: true,
+    properties: {
+      scope: {
+        type: 'string',
+        description: 'Cascade slice the config was resolved against.',
+        enum: ['global', 'project', 'merged'],
+      },
+      config: {
+        type: 'object',
+        description: 'Full resolved config object for the slice.',
+        additionalProperties: true,
+      },
+      keys: {
+        type: 'array',
+        description: 'Flattened dot-notation keys present in the resolved config.',
+        items: { type: 'string' },
+      },
+    },
+  },
+  fieldPointers: ['/data/scope', '/data/keys/0', '/data/keys'],
+};
+
+/**
+ * OUTPUT contract for `admin.config.validate`.
+ *
+ * Grounded in `AdminConfigValidateResult`: `{ scope, ok, issues }`. `ok` is the
+ * pass/fail verdict; `issues` carries human-readable rejection reasons.
+ */
+const adminConfigValidateOutputContract: OperationOutputContract = {
+  operation: 'admin.config.validate',
+  shapeNote:
+    'The pass/fail verdict is at /data/ok; rejection reasons are at /data/issues (empty when ok=true).',
+  dataSchema: {
+    type: 'object',
+    required: ['scope', 'ok', 'issues'],
+    additionalProperties: true,
+    properties: {
+      scope: {
+        type: 'string',
+        description: 'Scope that was validated.',
+        enum: ['global', 'project'],
+      },
+      ok: { type: 'boolean', description: 'True IFF every gate passed.' },
+      issues: {
+        type: 'array',
+        description: 'Human-readable schema issues. Empty when ok=true.',
+        items: { type: 'string' },
+      },
+    },
+  },
+  fieldPointers: ['/data/scope', '/data/ok', '/data/issues/0', '/data/issues'],
+};
+
+/**
+ * OUTPUT contract for `admin.config.unset`.
+ *
+ * Grounded in `AdminConfigUnsetResult`: `{ key, scope, removed }`. `removed` is
+ * `true` IFF the key existed and was deleted (idempotent: `false` when absent).
+ */
+const adminConfigUnsetOutputContract: OperationOutputContract = {
+  operation: 'admin.config.unset',
+  shapeNote:
+    '/data/removed is true IFF a value was deleted; false when the key was already absent (idempotent).',
+  dataSchema: {
+    type: 'object',
+    required: ['key', 'scope', 'removed'],
+    additionalProperties: true,
+    properties: {
+      key: { type: 'string', description: 'The dot-notation key that was targeted.' },
+      scope: {
+        type: 'string',
+        description: 'Scope the key was removed from.',
+        enum: ['project', 'global'],
+      },
+      removed: { type: 'boolean', description: 'True IFF a value was actually deleted.' },
+    },
+  },
+  fieldPointers: ['/data/key', '/data/scope', '/data/removed'],
+};
+
 // ---------------------------------------------------------------------------
 // Registry
 // ---------------------------------------------------------------------------
@@ -353,4 +591,30 @@ export const OUTPUT_CONTRACTS: OperationOutputContractRegistry = {
   'tasks.add-batch': tasksAddBatchOutputContract,
   'tasks.update': tasksUpdateOutputContract,
   'tasks.complete': tasksCompleteOutputContract,
+  // T11786 (epic T11556) — bulk Kanban mutate ops.
+  'tasks.reorder-rank': tasksReorderRankOutputContract,
+  'tasks.bulk-move': tasksBulkMoveOutputContract,
+  'tasks.assignee': tasksAssigneeOutputContract,
+  'admin.config.get': adminConfigGetOutputContract,
+  'admin.config.list': adminConfigListOutputContract,
+  'admin.config.validate': adminConfigValidateOutputContract,
+  'admin.config.unset': adminConfigUnsetOutputContract,
+  // service-vault CLI verbs (T11941 · epic T11765 · M2-W4)
+  'service.connect': serviceConnectOutputContract,
+  'service.list': serviceListOutputContract,
+  'service.revoke': serviceRevokeOutputContract,
+  'service.status': serviceStatusOutputContract,
+  // 5-entity provider-experience ops (T11700 · epic T11666)
+  'account.add': accountAddOutputContract,
+  'account.list': accountListOutputContract,
+  'account.remove': accountRemoveOutputContract,
+  'provider.list': providerListOutputContract,
+  'provider.show': providerShowOutputContract,
+  'provider.connect': providerConnectOutputContract,
+  'model.query': modelQueryOutputContract,
+  'model.show': modelShowOutputContract,
+  'profile.create': profileCreateOutputContract,
+  'profile.list': profileListOutputContract,
+  'profile.pin': profilePinOutputContract,
+  'profile.use': profileUseOutputContract,
 };

package/src/operations/service.ts

@@ -0,0 +1,360 @@
+/**
+ * Service-vault CLI operation contracts — INPUT + OUTPUT schemas (T11941).
+ *
+ * The schema-first I/O contracts for the four user-facing service-vault CLI
+ * verbs (`cleo service connect|list|revoke|status`). They live HERE in the
+ * `contracts` leaf package — alongside `tasks.ts` and the OUTPUT-contracts
+ * registry — so every consumer (CLI `--describe`, the SDK `describeOperation`,
+ * REST clients) resolves the I/O shape against ONE source of truth.
+ *
+ * AC4 (T11941): each new op carries an INPUT and an OUTPUT schema and appears in
+ * the output-contract data. `connect`/`list`/`revoke`/`status` are registered in
+ * `INPUT_CONTRACTS` (core) and `OUTPUT_CONTRACTS` (this package) so
+ * `cleo service <verb> --describe` resolves a non-null contract pair.
+ *
+ * ## Secrets never surfaced
+ *
+ * Every OUTPUT schema describes a NON-SECRET view: `list`/`status` carry
+ * `provider`/`label`/`status`/`scopes`/`expiresAt`/`hasCredentials` only —
+ * NEVER the decrypted token. `connect` returns the non-secret connection
+ * identity. `revoke` returns the `{count, deleted, grantsRemoved}` cascade
+ * report. There is no `--field` pointer that resolves to a token, by design.
+ *
+ * @packageDocumentation
+ * @module @cleocode/contracts/operations/service
+ *
+ * @epic T11765
+ * @saga T10409
+ * @task T11941 — M2-W4 service CLI verbs
+ */
+
+import type { JsonSchema, OperationInputContract } from './input-contract.js';
+import type { OperationOutputContract } from './output-contract.js';
+
+// ---------------------------------------------------------------------------
+// service.connect — store a service credential (token-direct or paste-code)
+// ---------------------------------------------------------------------------
+
+/**
+ * Accepted input shape for `service.connect`.
+ *
+ * Two non-interactive modes (v1, browser-free + testable):
+ *   - token-direct: `provider` + `token` (+ optional `refreshToken`, `expiresAt`,
+ *     `scopes`) — stores the token blob `encryptGlobal`-encrypted.
+ *   - paste-code: `provider` + `code` + `codeVerifier` + `redirectUri` — runs the
+ *     OAuth `exchangeCode` dance (the interactive flow is a thin wrapper over it).
+ *
+ * `additionalProperties: false` so a typo'd flag is rejected loudly (DHQ-033).
+ *
+ * @task T11941
+ */
+export const SERVICE_CONNECT_INPUT_SCHEMA: JsonSchema = {
+  type: 'object',
+  required: ['provider'],
+  additionalProperties: false,
+  properties: {
+    provider: {
+      type: 'string',
+      minLength: 1,
+      description: 'Service provider key (e.g. github, google, notion).',
+    },
+    label: {
+      type: 'string',
+      description: "Connection label, unique within the provider (default: 'default').",
+    },
+    token: {
+      type: 'string',
+      description:
+        'Direct access token to store (token-direct mode). SECRET — never logged/echoed.',
+    },
+    refreshToken: {
+      type: 'string',
+      description: 'Optional refresh token paired with --token. SECRET.',
+    },
+    expiresAt: {
+      type: 'string',
+      description: 'ISO-8601 access-token expiry (token-direct mode).',
+    },
+    scopes: {
+      type: 'array',
+      items: { type: 'string' },
+      description: 'Granted scope list (non-secret).',
+    },
+    code: {
+      type: 'string',
+      description: 'OAuth authorization code from the redirect callback (paste-code mode).',
+    },
+    codeVerifier: {
+      type: 'string',
+      description: 'PKCE code verifier from service.auth-url, round-tripped (paste-code mode).',
+    },
+    redirectUri: {
+      type: 'string',
+      description: 'Redirect URI used in service.auth-url; must match (paste-code mode).',
+    },
+  },
+};
+
+/** Schema-first INPUT contract for `service.connect`. */
+export const serviceConnectInputContract: OperationInputContract<Record<string, unknown>> = {
+  operation: 'service.connect',
+  schema: SERVICE_CONNECT_INPUT_SCHEMA,
+  examples: [
+    {
+      name: 'token-direct',
+      value: { provider: 'github', token: 'gho_xxx', label: 'personal' },
+      description: 'Store an already-obtained access token (browser-free v1).',
+    },
+    {
+      name: 'paste-code',
+      value: {
+        provider: 'github',
+        code: 'auth-code',
+        codeVerifier: 'pkce-verifier',
+        redirectUri: 'http://127.0.0.1:0/callback',
+      },
+      description: 'Exchange an OAuth code + PKCE verifier for tokens.',
+    },
+  ],
+};
+
+/** OUTPUT contract for `service.connect` — the non-secret mutate envelope. */
+export const serviceConnectOutputContract: OperationOutputContract = {
+  operation: 'service.connect',
+  shapeNote:
+    'Mutate envelope: count=1, created=[connectionId]. `connection` carries the NON-SECRET identity (provider/label/expiresAt). No token is ever returned.',
+  dataSchema: {
+    type: 'object',
+    required: ['count', 'created'],
+    additionalProperties: true,
+    properties: {
+      count: { type: 'number', description: 'Number of connections created/updated (1).' },
+      created: {
+        type: 'array',
+        items: { type: 'string' },
+        description: 'The connection id(s) created/updated, as strings.',
+      },
+      connection: {
+        type: 'object',
+        description: 'Non-secret connection identity.',
+        properties: {
+          connectionId: { type: 'number' },
+          provider: { type: 'string' },
+          label: { type: 'string' },
+          expiresAt: { type: ['string', 'null'] },
+        },
+      },
+    },
+  },
+  fieldPointers: [
+    '/data/count',
+    '/data/created/0',
+    '/data/connection/provider',
+    '/data/connection/label',
+    '/data/connection/expiresAt',
+  ],
+};
+
+// ---------------------------------------------------------------------------
+// service.list — redacted connection views
+// ---------------------------------------------------------------------------
+
+/** Accepted input shape for `service.list`. */
+export const SERVICE_LIST_INPUT_SCHEMA: JsonSchema = {
+  type: 'object',
+  required: [],
+  additionalProperties: false,
+  properties: {
+    provider: {
+      type: 'string',
+      description: 'Optional provider filter; lists all providers when omitted.',
+    },
+  },
+};
+
+/** Schema-first INPUT contract for `service.list`. */
+export const serviceListInputContract: OperationInputContract<Record<string, unknown>> = {
+  operation: 'service.list',
+  schema: SERVICE_LIST_INPUT_SCHEMA,
+  examples: [
+    { name: 'all', value: {}, description: 'List every service connection (redacted).' },
+    { name: 'one-provider', value: { provider: 'github' }, description: 'Filter to one provider.' },
+  ],
+};
+
+/** The redacted per-connection view schema (shared by list + status). */
+const SERVICE_CONNECTION_VIEW_SCHEMA: JsonSchema = {
+  type: 'object',
+  required: ['provider', 'label', 'status', 'scopes', 'hasCredentials'],
+  additionalProperties: true,
+  properties: {
+    id: { type: 'number' },
+    provider: { type: 'string' },
+    label: { type: 'string' },
+    status: { type: 'string', enum: ['active', 'expired', 'revoked'] },
+    scopes: { type: 'array', items: { type: 'string' } },
+    expiresAt: { type: ['string', 'null'] },
+    connectedAt: { type: 'string' },
+    updatedAt: { type: 'string' },
+    hasCredentials: {
+      type: 'boolean',
+      description: 'Whether a credential blob is present — NEVER the token itself.',
+    },
+  },
+};
+
+/** OUTPUT contract for `service.list` — redacted connection views. */
+export const serviceListOutputContract: OperationOutputContract = {
+  operation: 'service.list',
+  shapeNote:
+    'connections[] are NON-SECRET views — provider/label/status/scopes/expiresAt/hasCredentials only. The decrypted token is NEVER present in any field.',
+  dataSchema: {
+    type: 'object',
+    required: ['connections'],
+    additionalProperties: true,
+    properties: {
+      connections: {
+        type: 'array',
+        items: SERVICE_CONNECTION_VIEW_SCHEMA,
+        description: 'Redacted connection views.',
+      },
+    },
+  },
+  fieldPointers: [
+    '/data/connections',
+    '/data/connections/0/provider',
+    '/data/connections/0/label',
+    '/data/connections/0/status',
+    '/data/connections/0/expiresAt',
+    '/data/connections/0/hasCredentials',
+  ],
+};
+
+// ---------------------------------------------------------------------------
+// service.revoke — hard delete + cascade grants
+// ---------------------------------------------------------------------------
+
+/** Accepted input shape for `service.revoke`. */
+export const SERVICE_REVOKE_INPUT_SCHEMA: JsonSchema = {
+  type: 'object',
+  required: ['provider', 'label'],
+  additionalProperties: false,
+  properties: {
+    provider: { type: 'string', minLength: 1, description: 'Service provider key.' },
+    label: { type: 'string', minLength: 1, description: 'Connection label to revoke.' },
+  },
+};
+
+/** Schema-first INPUT contract for `service.revoke`. */
+export const serviceRevokeInputContract: OperationInputContract<Record<string, unknown>> = {
+  operation: 'service.revoke',
+  schema: SERVICE_REVOKE_INPUT_SCHEMA,
+  examples: [
+    {
+      name: 'revoke',
+      value: { provider: 'github', label: 'personal' },
+      description: 'Delete the connection and cascade its agent grants.',
+    },
+  ],
+};
+
+/** OUTPUT contract for `service.revoke` — the cascade-delete report. */
+export const serviceRevokeOutputContract: OperationOutputContract = {
+  operation: 'service.revoke',
+  shapeNote:
+    'Mutate envelope: count=1 + deleted=[provider:label] on success (0 + [] when no such connection). `grantsRemoved` counts the cascaded agent_service_grants rows.',
+  dataSchema: {
+    type: 'object',
+    required: ['count', 'deleted'],
+    additionalProperties: true,
+    properties: {
+      count: { type: 'number', description: '1 when a connection was deleted, else 0.' },
+      deleted: {
+        type: 'array',
+        items: { type: 'string' },
+        description: 'The `provider:label` identifier(s) deleted.',
+      },
+      grantsRemoved: {
+        type: 'number',
+        description: 'How many agent_service_grants rows were cascaded-deleted.',
+      },
+    },
+  },
+  fieldPointers: ['/data/count', '/data/deleted/0', '/data/grantsRemoved'],
+};
+
+// ---------------------------------------------------------------------------
+// service.status — connection health (expired? needs refresh?)
+// ---------------------------------------------------------------------------
+
+/** Accepted input shape for `service.status`. */
+export const SERVICE_STATUS_INPUT_SCHEMA: JsonSchema = {
+  type: 'object',
+  required: [],
+  additionalProperties: false,
+  properties: {
+    provider: {
+      type: 'string',
+      description: 'Optional provider filter; reports all connections when omitted.',
+    },
+  },
+};
+
+/** Schema-first INPUT contract for `service.status`. */
+export const serviceStatusInputContract: OperationInputContract<Record<string, unknown>> = {
+  operation: 'service.status',
+  schema: SERVICE_STATUS_INPUT_SCHEMA,
+  examples: [
+    { name: 'all', value: {}, description: 'Health of every connection.' },
+    {
+      name: 'one-provider',
+      value: { provider: 'github' },
+      description: 'Health for one provider.',
+    },
+  ],
+};
+
+/** OUTPUT contract for `service.status` — per-connection health. */
+export const serviceStatusOutputContract: OperationOutputContract = {
+  operation: 'service.status',
+  shapeNote:
+    'connections[] are NON-SECRET health views: each adds `expired` + `needsRefresh` booleans computed from expiresAt. No token is ever present.',
+  dataSchema: {
+    type: 'object',
+    required: ['connections'],
+    additionalProperties: true,
+    properties: {
+      connections: {
+        type: 'array',
+        items: {
+          type: 'object',
+          required: ['provider', 'label', 'status', 'expired', 'needsRefresh'],
+          additionalProperties: true,
+          properties: {
+            provider: { type: 'string' },
+            label: { type: 'string' },
+            status: { type: 'string', enum: ['active', 'expired', 'revoked'] },
+            expiresAt: { type: ['string', 'null'] },
+            expired: {
+              type: 'boolean',
+              description: 'True when expiresAt is in the past (or status=expired).',
+            },
+            needsRefresh: {
+              type: 'boolean',
+              description: 'True when the connection is expired and has stored credentials.',
+            },
+            hasCredentials: { type: 'boolean' },
+          },
+        },
+      },
+    },
+  },
+  fieldPointers: [
+    '/data/connections',
+    '/data/connections/0/provider',
+    '/data/connections/0/label',
+    '/data/connections/0/status',
+    '/data/connections/0/expired',
+    '/data/connections/0/needsRefresh',
+  ],
+};