@iveri/contracts 0.37.0 → 0.39.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iveri/contracts",
-  "version": "0.37.0",
+  "version": "0.39.0",
   "description": "Wire contracts shared by every Iveri backend and frontend. Zero runtime dependencies.",
   "license": "MIT",
   "repository": {
@@ -10,116 +10,73 @@
   "publishConfig": {
     "access": "public"
   },
+  "type": "module",
   "engines": {
-    "node": ">=22"
+    "node": ">=26"
   },
-  "packageManager": "pnpm@9.12.0",
-  "type": "commonjs",
-  "main": "./dist/cjs/index.js",
-  "module": "./dist/esm/index.js",
-  "types": "./dist/cjs/index.d.ts",
+  "packageManager": "pnpm@12.18.0",
   "exports": {
     ".": {
-      "types": "./dist/cjs/index.d.ts",
-      "import": "./dist/esm/index.js",
-      "require": "./dist/cjs/index.js"
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
     },
     "./conduit": {
-      "types": "./dist/cjs/api/conduit/index.d.ts",
-      "import": "./dist/esm/api/conduit/index.js",
-      "require": "./dist/cjs/api/conduit/index.js"
+      "types": "./dist/api/conduit/index.d.ts",
+      "default": "./dist/api/conduit/index.js"
     },
     "./identity": {
-      "types": "./dist/cjs/api/identity/index.d.ts",
-      "import": "./dist/esm/api/identity/index.js",
-      "require": "./dist/cjs/api/identity/index.js"
+      "types": "./dist/api/identity/index.d.ts",
+      "default": "./dist/api/identity/index.js"
     },
     "./unibox": {
-      "types": "./dist/cjs/api/unibox/index.d.ts",
-      "import": "./dist/esm/api/unibox/index.js",
-      "require": "./dist/cjs/api/unibox/index.js"
+      "types": "./dist/api/unibox/index.d.ts",
+      "default": "./dist/api/unibox/index.js"
     },
     "./unibox-ai": {
-      "types": "./dist/cjs/api/unibox-ai/index.d.ts",
-      "import": "./dist/esm/api/unibox-ai/index.js",
-      "require": "./dist/cjs/api/unibox-ai/index.js"
+      "types": "./dist/api/unibox-ai/index.d.ts",
+      "default": "./dist/api/unibox-ai/index.js"
     },
     "./localization": {
-      "types": "./dist/cjs/api/localization/index.d.ts",
-      "import": "./dist/esm/api/localization/index.js",
-      "require": "./dist/cjs/api/localization/index.js"
+      "types": "./dist/api/localization/index.d.ts",
+      "default": "./dist/api/localization/index.js"
     },
     "./notification": {
-      "types": "./dist/cjs/api/notification/index.d.ts",
-      "import": "./dist/esm/api/notification/index.js",
-      "require": "./dist/cjs/api/notification/index.js"
+      "types": "./dist/api/notification/index.d.ts",
+      "default": "./dist/api/notification/index.js"
     },
     "./realtime": {
-      "types": "./dist/cjs/api/realtime/index.d.ts",
-      "import": "./dist/esm/api/realtime/index.js",
-      "require": "./dist/cjs/api/realtime/index.js"
+      "types": "./dist/api/realtime/index.d.ts",
+      "default": "./dist/api/realtime/index.js"
     },
     "./mobility": {
-      "types": "./dist/cjs/api/mobility/index.d.ts",
-      "import": "./dist/esm/api/mobility/index.js",
-      "require": "./dist/cjs/api/mobility/index.js"
+      "types": "./dist/api/mobility/index.d.ts",
+      "default": "./dist/api/mobility/index.js"
     },
     "./package.json": "./package.json"
   },
-  "typesVersions": {
-    "*": {
-      "conduit": [
-        "./dist/cjs/api/conduit/index.d.ts"
-      ],
-      "identity": [
-        "./dist/cjs/api/identity/index.d.ts"
-      ],
-      "localization": [
-        "./dist/cjs/api/localization/index.d.ts"
-      ],
-      "notification": [
-        "./dist/cjs/api/notification/index.d.ts"
-      ],
-      "realtime": [
-        "./dist/cjs/api/realtime/index.d.ts"
-      ],
-      "mobility": [
-        "./dist/cjs/api/mobility/index.d.ts"
-      ],
-      "unibox": [
-        "./dist/cjs/api/unibox/index.d.ts"
-      ],
-      "unibox-ai": [
-        "./dist/cjs/api/unibox-ai/index.d.ts"
-      ]
-    }
-  },
   "sideEffects": false,
   "files": [
     "dist",
     "README.md"
   ],
   "scripts": {
-    "clean": "rimraf dist tsconfig.*.tsbuildinfo",
-    "build": "pnpm clean && tsc -p tsconfig.cjs.json && tsc -p tsconfig.esm.json && node ./scripts/write-dist-package-json.mjs && node ./scripts/verify-zero-runtime-deps.mjs && node ./scripts/verify-entry-points.mjs",
+    "clean": "rimraf dist",
+    "build": "pnpm clean && tsc -p tsconfig.build.json && node ./scripts/verify-zero-runtime-deps.mjs && node ./scripts/verify-entry-points.mjs",
     "typecheck": "tsc -p tsconfig.json --noEmit",
-    "test": "jest",
+    "test": "vitest run",
     "lint": "eslint .",
     "format": "prettier --write .",
     "format:check": "prettier --check ."
   },
   "prettier": "@iveri/prettier-config",
   "devDependencies": {
-    "@iveri/eslint-config": "^0.1.0",
+    "@iveri/eslint-config": "^0.2.3",
     "@iveri/prettier-config": "^0.1.0",
-    "@iveri/tsconfig": "^0.1.0",
-    "@types/jest": "^29.5.14",
-    "@types/node": "^22.10.7",
-    "eslint": "^9.18.0",
-    "jest": "^29.7.0",
-    "prettier": "^3.4.2",
-    "rimraf": "^6.0.1",
-    "ts-jest": "^29.2.5",
-    "typescript": "^5.7.3"
+    "@iveri/tsconfig": "^0.2.1",
+    "eslint": "^10.14.0",
+    "prettier": "^3.9.10",
+    "rimraf": "^6.1.4",
+    "typescript": "~6.0.3",
+    "vitest": "^5.1.0"
   }
 }

package/dist/cjs/api/conduit/capture.type.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"capture.type.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/capture.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,wDAAwD;AACxD,MAAM,WAAW,cAAc;IAC3B,EAAE,EAAE,IAAI,CAAC;IACT,UAAU,EAAE,IAAI,CAAC;IAEjB,MAAM,EAAE,MAAM,CAAC;IAEf,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IAEb,yCAAyC;IACzC,WAAW,EAAE,MAAM,CAAC;IAEpB,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE9B,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC;IAEjB,oFAAoF;IACpF,UAAU,EAAE,MAAM,CAAC;IAEnB,+DAA+D;IAC/D,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE3B;;;OAGG;IACH,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAE7C,wEAAwE;IACxE,WAAW,EAAE,OAAO,CAAC;IAErB,UAAU,EAAE,WAAW,CAAC;CAC3B;AAED,sEAAsE;AACtE,MAAM,WAAW,aAAc,SAAQ,cAAc;IACjD,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAE3C;;;;;;;OAOG;IACH,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEvB;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB,4EAA4E;IAC5E,SAAS,EAAE,OAAO,CAAC;CACtB;AAED,6BAA6B;AAC7B,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;AAEtD;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,2EAA2E;IAC3E,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEzB,UAAU,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1B,gBAAgB,CAAC,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;CACjD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IACzB,qFAAqF;IACrF,WAAW,EAAE,MAAM,CAAC;IAEpB,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;;;;;;;;;;;OAaG;IACH,iBAAiB,EAAE,MAAM,CAAC;CAC7B"}

package/dist/cjs/api/conduit/capture.type.js

@@ -1,3 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=capture.type.js.map

package/dist/cjs/api/conduit/capture.type.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"capture.type.js","sourceRoot":"","sources":["../../../../src/api/conduit/capture.type.ts"],"names":[],"mappings":""}

package/dist/cjs/api/conduit/connection-verification-verdict.enum.d.ts

@@ -1,74 +0,0 @@
-/**
- * The outcome of checking whether a connection's credentials still work.
- *
- * **Not a boolean, for the same reason {@link SignatureVerdict} is not.** The question an
- * operator asks after replacing a client secret is "did that work", and for three of the five
- * {@link ConnectorAuthType} members the honest answer is *we cannot tell from here* — each for a
- * different and separately fixable reason. Collapsing those into `false` would report a correctly
- * configured connection as broken; collapsing them into `true` would report an untested one as
- * proven.
- *
- * A UI must not colour all of these red. Only {@link ConnectionVerificationVerdict.INVALID_CREDENTIALS}
- * and {@link ConnectionVerificationVerdict.MISCONFIGURED} mean something is wrong;
- * {@link ConnectionVerificationVerdict.PROVIDER_UNREACHABLE} is somebody else's outage, and the
- * remaining three are "nothing to check" or "checked as far as this auth type allows".
- */
-export declare enum ConnectionVerificationVerdict {
-    /**
-     * A token was minted just now, so the credentials are good as of this moment.
-     *
-     * Only an OAuth grant can reach this: it is the one case where the provider itself tells us
-     * whether the secret is right, without us having to send a message somebody would receive.
-     */
-    VERIFIED = "verified",
-    /**
-     * A cached access token is still usable, so nothing was asked of the provider.
-     *
-     * This is a weaker statement than {@link VERIFIED} and deliberately distinguished from it: it
-     * says the credentials worked when the token was minted, not that they work now. A secret
-     * revoked at the provider five minutes ago still reports this until the token expires.
-     *
-     * It exists so that clicking verify repeatedly does not spend a refresh token each time —
-     * see the note on {@link ConnectorAuthType.OAUTH2_REFRESH_TOKEN} about rotation. Replacing a
-     * connection's credentials discards the cached token, so the first verify after a credential
-     * edit is never this.
-     */
-    VERIFIED_CACHED = "verified-cached",
-    /**
-     * The credential the manifest asks for is present, and its correctness is unknowable from
-     * here.
-     *
-     * A static secret is only ever checked by the provider when a real request carries it, so
-     * this is as far as verification can go for {@link ConnectorAuthType.API_KEY_HEADER} and
-     * {@link ConnectorAuthType.BEARER_STATIC}. That is not a cop-out: *presence* is exactly what
-     * breaks after a credential edit — a cleared map, or a key renamed to something the manifest
-     * does not ask for — and this catches it.
-     */
-    CREDENTIAL_PRESENT = "credential-present",
-    /** The connector adds no credential to a request, so there is nothing to check. */
-    NOTHING_TO_VERIFY = "nothing-to-verify",
-    /**
-     * The provider refused the credentials.
-     *
-     * The one verdict that means the secret itself is wrong. Everything needed was present and
-     * the token endpoint said no.
-     */
-    INVALID_CREDENTIALS = "invalid-credentials",
-    /**
-     * The credential, or the manifest field naming it, is missing.
-     *
-     * Distinct from {@link INVALID_CREDENTIALS} because the remedy is different and the provider
-     * was never contacted: a connection with no `clientSecret`, or a manifest with an
-     * `api-key-header` auth type and no `headerName`. The most common state immediately after a
-     * credential map is cleared.
-     */
-    MISCONFIGURED = "misconfigured",
-    /**
-     * The token endpoint could not be reached, or did not answer in time.
-     *
-     * Says nothing about the credentials. Worth its own verdict so an operator who has just
-     * replaced a secret is not told it is wrong when the provider is simply down.
-     */
-    PROVIDER_UNREACHABLE = "provider-unreachable"
-}
-//# sourceMappingURL=connection-verification-verdict.enum.d.ts.map

package/dist/cjs/api/conduit/connection-verification-verdict.enum.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"connection-verification-verdict.enum.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/connection-verification-verdict.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,oBAAY,6BAA6B;IACrC;;;;;OAKG;IACH,QAAQ,aAAa;IAErB;;;;;;;;;;;OAWG;IACH,eAAe,oBAAoB;IAEnC;;;;;;;;;OASG;IACH,kBAAkB,uBAAuB;IAEzC,mFAAmF;IACnF,iBAAiB,sBAAsB;IAEvC;;;;;OAKG;IACH,mBAAmB,wBAAwB;IAE3C;;;;;;;OAOG;IACH,aAAa,kBAAkB;IAE/B;;;;;OAKG;IACH,oBAAoB,yBAAyB;CAChD"}

package/dist/cjs/api/conduit/connection-verification-verdict.enum.js

@@ -1,78 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ConnectionVerificationVerdict = void 0;
-/**
- * The outcome of checking whether a connection's credentials still work.
- *
- * **Not a boolean, for the same reason {@link SignatureVerdict} is not.** The question an
- * operator asks after replacing a client secret is "did that work", and for three of the five
- * {@link ConnectorAuthType} members the honest answer is *we cannot tell from here* — each for a
- * different and separately fixable reason. Collapsing those into `false` would report a correctly
- * configured connection as broken; collapsing them into `true` would report an untested one as
- * proven.
- *
- * A UI must not colour all of these red. Only {@link ConnectionVerificationVerdict.INVALID_CREDENTIALS}
- * and {@link ConnectionVerificationVerdict.MISCONFIGURED} mean something is wrong;
- * {@link ConnectionVerificationVerdict.PROVIDER_UNREACHABLE} is somebody else's outage, and the
- * remaining three are "nothing to check" or "checked as far as this auth type allows".
- */
-var ConnectionVerificationVerdict;
-(function (ConnectionVerificationVerdict) {
-    /**
-     * A token was minted just now, so the credentials are good as of this moment.
-     *
-     * Only an OAuth grant can reach this: it is the one case where the provider itself tells us
-     * whether the secret is right, without us having to send a message somebody would receive.
-     */
-    ConnectionVerificationVerdict["VERIFIED"] = "verified";
-    /**
-     * A cached access token is still usable, so nothing was asked of the provider.
-     *
-     * This is a weaker statement than {@link VERIFIED} and deliberately distinguished from it: it
-     * says the credentials worked when the token was minted, not that they work now. A secret
-     * revoked at the provider five minutes ago still reports this until the token expires.
-     *
-     * It exists so that clicking verify repeatedly does not spend a refresh token each time —
-     * see the note on {@link ConnectorAuthType.OAUTH2_REFRESH_TOKEN} about rotation. Replacing a
-     * connection's credentials discards the cached token, so the first verify after a credential
-     * edit is never this.
-     */
-    ConnectionVerificationVerdict["VERIFIED_CACHED"] = "verified-cached";
-    /**
-     * The credential the manifest asks for is present, and its correctness is unknowable from
-     * here.
-     *
-     * A static secret is only ever checked by the provider when a real request carries it, so
-     * this is as far as verification can go for {@link ConnectorAuthType.API_KEY_HEADER} and
-     * {@link ConnectorAuthType.BEARER_STATIC}. That is not a cop-out: *presence* is exactly what
-     * breaks after a credential edit — a cleared map, or a key renamed to something the manifest
-     * does not ask for — and this catches it.
-     */
-    ConnectionVerificationVerdict["CREDENTIAL_PRESENT"] = "credential-present";
-    /** The connector adds no credential to a request, so there is nothing to check. */
-    ConnectionVerificationVerdict["NOTHING_TO_VERIFY"] = "nothing-to-verify";
-    /**
-     * The provider refused the credentials.
-     *
-     * The one verdict that means the secret itself is wrong. Everything needed was present and
-     * the token endpoint said no.
-     */
-    ConnectionVerificationVerdict["INVALID_CREDENTIALS"] = "invalid-credentials";
-    /**
-     * The credential, or the manifest field naming it, is missing.
-     *
-     * Distinct from {@link INVALID_CREDENTIALS} because the remedy is different and the provider
-     * was never contacted: a connection with no `clientSecret`, or a manifest with an
-     * `api-key-header` auth type and no `headerName`. The most common state immediately after a
-     * credential map is cleared.
-     */
-    ConnectionVerificationVerdict["MISCONFIGURED"] = "misconfigured";
-    /**
-     * The token endpoint could not be reached, or did not answer in time.
-     *
-     * Says nothing about the credentials. Worth its own verdict so an operator who has just
-     * replaced a secret is not told it is wrong when the provider is simply down.
-     */
-    ConnectionVerificationVerdict["PROVIDER_UNREACHABLE"] = "provider-unreachable";
-})(ConnectionVerificationVerdict || (exports.ConnectionVerificationVerdict = ConnectionVerificationVerdict = {}));
-//# sourceMappingURL=connection-verification-verdict.enum.js.map

package/dist/cjs/api/conduit/connection-verification-verdict.enum.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"connection-verification-verdict.enum.js","sourceRoot":"","sources":["../../../../src/api/conduit/connection-verification-verdict.enum.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;GAcG;AACH,IAAY,6BA+DX;AA/DD,WAAY,6BAA6B;IACrC;;;;;OAKG;IACH,sDAAqB,CAAA;IAErB;;;;;;;;;;;OAWG;IACH,oEAAmC,CAAA;IAEnC;;;;;;;;;OASG;IACH,0EAAyC,CAAA;IAEzC,mFAAmF;IACnF,wEAAuC,CAAA;IAEvC;;;;;OAKG;IACH,4EAA2C,CAAA;IAE3C;;;;;;;OAOG;IACH,gEAA+B,CAAA;IAE/B;;;;;OAKG;IACH,8EAA6C,CAAA;AACjD,CAAC,EA/DW,6BAA6B,6CAA7B,6BAA6B,QA+DxC"}

package/dist/cjs/api/conduit/connection.type.d.ts

@@ -1,132 +0,0 @@
-import type { IsoDateTime } from '../../type/iso-date-time.type.js';
-import type { Nullable } from '../../type/nil.type.js';
-import type { UUID } from '../../type/uuid.type.js';
-import type { ConnectionVerificationVerdict } from './connection-verification-verdict.enum.js';
-import type { ConnectorAuthType } from './connector-auth-type.enum.js';
-/**
- * One tenant's configured instance of a connector: the credentials and the account details that
- * turn a manifest into something that can actually send.
- *
- * The split is the reason a manifest can ship in the binary. A connector says "WhatsApp Cloud
- * lives at graph.facebook.com and authenticates with a bearer token"; a connection says "and
- * *this* is our token, for *this* phone number". One is ours and identical for everybody; the
- * other is the customer's and is the single most sensitive thing this service holds.
- *
- * **No endpoint of this API returns a credential value**, in any form — not masked, not
- * truncated, not a length. `credentialNames` answers the only question an operator has, which is
- * whether something is configured. Same control as a destination's headers and an endpoint's
- * signing secret, for the same reason: §11 says one leak ends the company.
- */
-export interface Connection {
-    id: UUID;
-    /** Stable identifier a dispatch names instead of an id, so callers can be configured by name. */
-    key: string;
-    name: string;
-    description: Nullable<string>;
-    /** The manifest this connection instantiates. Built-in or tenant-defined. */
-    connectorKey: string;
-    /** Sorted. **The values are never returned by any endpoint of this API.** */
-    credentialNames: string[];
-    /**
-     * Non-secret values filling `{placeholders}` in an operation path — a phone number id, an
-     * account id, an API version.
-     *
-     * Deliberately separate from credentials rather than one map with a secrecy flag: a flag is
-     * a thing somebody sets wrong once, and the failure mode is a token in a response body.
-     * Variables are returned in full because they are the part an operator needs to check.
-     */
-    variables: Record<string, string>;
-    /**
-     * When the cached OAuth access token stops being usable, or null when there is none —
-     * either because the connector authenticates statically or because nothing has fetched one
-     * yet.
-     *
-     * The expiry is returned, the token is not. It is what makes "why is this connection
-     * failing" answerable without exposing anything.
-     */
-    accessTokenExpiresAt: Nullable<IsoDateTime>;
-    /**
-     * Why the last authentication attempt failed, or null when the last one worked.
-     *
-     * A refresh token that a provider has revoked is the most common real failure on this
-     * aggregate, and it is invisible otherwise: dispatches simply dead-letter with a 401 and
-     * nothing points at the connection.
-     */
-    lastAuthError: Nullable<string>;
-    /** Stops *new* dispatches being accepted. Does not cancel ones already queued. */
-    isActive: boolean;
-    createdAt: IsoDateTime;
-    updatedAt: IsoDateTime;
-}
-/** `GET /api/v1/connections`. Offset-paginated — a small, slow-moving collection. */
-export interface ConnectionsPage {
-    items: Connection[];
-    total: number;
-    limit: number;
-    offset: number;
-}
-/** `POST /api/v1/connections`. */
-export interface CreateConnectionBody {
-    key: string;
-    name: string;
-    description?: Nullable<string>;
-    connectorKey: string;
-    /**
-     * Secrets this connection authenticates with. **Stored encrypted and never returned.**
-     *
-     * Which names are expected depends on the connector's auth type: an `API_KEY_HEADER`
-     * manifest names its own, an OAuth one wants `clientId`/`clientSecret` and, for the refresh
-     * grant, `refreshToken`.
-     */
-    credentials: Record<string, string>;
-    variables?: Nullable<Record<string, string>>;
-}
-/**
- * `PATCH /api/v1/connections/:id`.
- *
- * **`credentials` has three states, not two.** Omitting it leaves the stored map untouched,
- * `null` clears it, an object replaces it wholesale. A form that sends `{}` meaning "unchanged"
- * deletes the customer's token, and the symptom is every dispatch dead-lettering on a 401.
- *
- * Replacing credentials also discards the cached access token: a token minted from the old
- * client secret is not evidence that the new one works, and keeping it would hide a typo until
- * the token happened to expire.
- */
-export interface UpdateConnectionBody {
-    name?: string;
-    description?: Nullable<string>;
-    credentials?: Nullable<Record<string, string>>;
-    variables?: Nullable<Record<string, string>>;
-    isActive?: boolean;
-}
-/**
- * `POST /api/v1/connections/:id/verify`.
- *
- * Takes no body. Everything the check needs is already on the connection and its connector's
- * manifest, and a field a caller could send would be a field that changes what is verified —
- * which is the opposite of the point.
- */
-export interface ConnectionVerification {
-    verdict: ConnectionVerificationVerdict;
-    /**
-     * The auth type the verdict was reached under, so a client can explain it without fetching
-     * the connector.
-     *
-     * A reader needs this to say *why* a verdict is as weak as it is — "nothing to check" and
-     * "cannot be checked without sending something real" are different sentences, and which one
-     * applies is a property of the connector rather than of the connection.
-     */
-    authType: ConnectorAuthType;
-    /**
-     * What the provider or the configuration said, when there is something to pass on.
-     *
-     * **Never a credential, in whole or in part.** It carries a token endpoint's error code, a
-     * missing credential's name, or a timeout — the same things `lastAuthError` holds, and the
-     * same rule applies: no endpoint returns a credential value in any form, not masked, not
-     * truncated, not a length.
-     */
-    detail: Nullable<string>;
-    /** When the check ran. A client showing a stale verdict should say how stale. */
-    checkedAt: IsoDateTime;
-}
-//# sourceMappingURL=connection.type.d.ts.map

package/dist/cjs/api/conduit/connection.type.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"connection.type.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/connection.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAC/F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAEvE;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,UAAU;IACvB,EAAE,EAAE,IAAI,CAAC;IAET,iGAAiG;IACjG,GAAG,EAAE,MAAM,CAAC;IAEZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE9B,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAC;IAErB,6EAA6E;IAC7E,eAAe,EAAE,MAAM,EAAE,CAAC;IAE1B;;;;;;;OAOG;IACH,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAElC;;;;;;;OAOG;IACH,oBAAoB,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IAE5C;;;;;;OAMG;IACH,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEhC,kFAAkF;IAClF,QAAQ,EAAE,OAAO,CAAC;IAElB,SAAS,EAAE,WAAW,CAAC;IACvB,SAAS,EAAE,WAAW,CAAC;CAC1B;AAED,qFAAqF;AACrF,MAAM,WAAW,eAAe;IAC5B,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAClB;AAED,kCAAkC;AAClC,MAAM,WAAW,oBAAoB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC;IAErB;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEpC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAChD;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,oBAAoB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7C,QAAQ,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACnC,OAAO,EAAE,6BAA6B,CAAC;IAEvC;;;;;;;OAOG;IACH,QAAQ,EAAE,iBAAiB,CAAC;IAE5B;;;;;;;OAOG;IACH,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEzB,iFAAiF;IACjF,SAAS,EAAE,WAAW,CAAC;CAC1B"}

package/dist/cjs/api/conduit/connection.type.js

@@ -1,3 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=connection.type.js.map

package/dist/cjs/api/conduit/connection.type.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"connection.type.js","sourceRoot":"","sources":["../../../../src/api/conduit/connection.type.ts"],"names":[],"mappings":""}

package/dist/cjs/api/conduit/connector-auth-type.enum.d.ts

@@ -1,42 +0,0 @@
-/**
- * How a connector proves who we are to the third-party API it fronts.
- *
- * This is the field that decides whether Conduit has to hold a *renewable* credential or merely
- * a static one, and the two are very different operationally: a static key works until someone
- * rotates it, an OAuth token stops working on a schedule and something has to notice first.
- *
- * The list is deliberately short. Every member is a scheme a manifest can describe entirely as
- * data — adding a provider that uses one of these is a manifest and a credential, never a code
- * change, which is the whole promise of §11's connector manifest. A provider needing anything
- * else (a request-signing scheme, mutual TLS) does not get a special case bolted on here; it
- * gets a new member, designed once, with the same "no per-provider branches" rule applied to it.
- */
-export declare enum ConnectorAuthType {
-    /** The API is open, or the credential travels in the payload. Nothing is added to a request. */
-    NONE = "none",
-    /**
-     * A static secret sent in a header — `X-Api-Key: …`, `Authorization: Basic …`.
-     *
-     * The header name and any literal prefix come from the manifest; only the secret comes from
-     * the connection. That split is what lets one manifest serve every tenant.
-     */
-    API_KEY_HEADER = "api-key-header",
-    /** A static bearer token. Shorthand for {@link API_KEY_HEADER} with the header and prefix fixed. */
-    BEARER_STATIC = "bearer-static",
-    /**
-     * OAuth 2.0 client credentials (RFC 6749 §4.4): exchange a client id and secret for a
-     * short-lived access token, and do it again when it expires. Machine-to-machine, no user.
-     */
-    OAUTH2_CLIENT_CREDENTIALS = "oauth2-client-credentials",
-    /**
-     * OAuth 2.0 refresh token (RFC 6749 §6): a long-lived refresh token buys short-lived access
-     * tokens.
-     *
-     * **The refresh token may be rotated by the provider on every use**, and Conduit stores
-     * whichever one came back last. That single fact is why refreshing has to be serialised
-     * across replicas rather than left to race — two simultaneous refreshes rotate twice, one
-     * of the two results is stored, and the connection is dead until a human re-authorises it.
-     */
-    OAUTH2_REFRESH_TOKEN = "oauth2-refresh-token"
-}
-//# sourceMappingURL=connector-auth-type.enum.d.ts.map

package/dist/cjs/api/conduit/connector-auth-type.enum.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"connector-auth-type.enum.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/connector-auth-type.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,oBAAY,iBAAiB;IACzB,gGAAgG;IAChG,IAAI,SAAS;IAEb;;;;;OAKG;IACH,cAAc,mBAAmB;IAEjC,oGAAoG;IACpG,aAAa,kBAAkB;IAE/B;;;OAGG;IACH,yBAAyB,8BAA8B;IAEvD;;;;;;;;OAQG;IACH,oBAAoB,yBAAyB;CAChD"}

package/dist/cjs/api/conduit/connector-auth-type.enum.js

@@ -1,46 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ConnectorAuthType = void 0;
-/**
- * How a connector proves who we are to the third-party API it fronts.
- *
- * This is the field that decides whether Conduit has to hold a *renewable* credential or merely
- * a static one, and the two are very different operationally: a static key works until someone
- * rotates it, an OAuth token stops working on a schedule and something has to notice first.
- *
- * The list is deliberately short. Every member is a scheme a manifest can describe entirely as
- * data — adding a provider that uses one of these is a manifest and a credential, never a code
- * change, which is the whole promise of §11's connector manifest. A provider needing anything
- * else (a request-signing scheme, mutual TLS) does not get a special case bolted on here; it
- * gets a new member, designed once, with the same "no per-provider branches" rule applied to it.
- */
-var ConnectorAuthType;
-(function (ConnectorAuthType) {
-    /** The API is open, or the credential travels in the payload. Nothing is added to a request. */
-    ConnectorAuthType["NONE"] = "none";
-    /**
-     * A static secret sent in a header — `X-Api-Key: …`, `Authorization: Basic …`.
-     *
-     * The header name and any literal prefix come from the manifest; only the secret comes from
-     * the connection. That split is what lets one manifest serve every tenant.
-     */
-    ConnectorAuthType["API_KEY_HEADER"] = "api-key-header";
-    /** A static bearer token. Shorthand for {@link API_KEY_HEADER} with the header and prefix fixed. */
-    ConnectorAuthType["BEARER_STATIC"] = "bearer-static";
-    /**
-     * OAuth 2.0 client credentials (RFC 6749 §4.4): exchange a client id and secret for a
-     * short-lived access token, and do it again when it expires. Machine-to-machine, no user.
-     */
-    ConnectorAuthType["OAUTH2_CLIENT_CREDENTIALS"] = "oauth2-client-credentials";
-    /**
-     * OAuth 2.0 refresh token (RFC 6749 §6): a long-lived refresh token buys short-lived access
-     * tokens.
-     *
-     * **The refresh token may be rotated by the provider on every use**, and Conduit stores
-     * whichever one came back last. That single fact is why refreshing has to be serialised
-     * across replicas rather than left to race — two simultaneous refreshes rotate twice, one
-     * of the two results is stored, and the connection is dead until a human re-authorises it.
-     */
-    ConnectorAuthType["OAUTH2_REFRESH_TOKEN"] = "oauth2-refresh-token";
-})(ConnectorAuthType || (exports.ConnectorAuthType = ConnectorAuthType = {}));
-//# sourceMappingURL=connector-auth-type.enum.js.map

package/dist/cjs/api/conduit/connector-auth-type.enum.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"connector-auth-type.enum.js","sourceRoot":"","sources":["../../../../src/api/conduit/connector-auth-type.enum.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;GAYG;AACH,IAAY,iBA+BX;AA/BD,WAAY,iBAAiB;IACzB,gGAAgG;IAChG,kCAAa,CAAA;IAEb;;;;;OAKG;IACH,sDAAiC,CAAA;IAEjC,oGAAoG;IACpG,oDAA+B,CAAA;IAE/B;;;OAGG;IACH,4EAAuD,CAAA;IAEvD;;;;;;;;OAQG;IACH,kEAA6C,CAAA;AACjD,CAAC,EA/BW,iBAAiB,iCAAjB,iBAAiB,QA+B5B"}