@iveri/contracts 0.5.0 → 0.6.0

package/dist/cjs/api/conduit/dispatch.type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.type.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/dispatch.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEhE;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,QAAQ;IACrB,EAAE,EAAE,IAAI,CAAC;IAET,gGAAgG;IAChG,YAAY,EAAE,IAAI,CAAC;IAEnB,wFAAwF;IACxF,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IAErB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAElB;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB,MAAM,EAAE,MAAM,CAAC;IAEf;;;;;;OAMG;IACH,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEjC,MAAM,EAAE,cAAc,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IAErB,mEAAmE;IACnE,WAAW,EAAE,MAAM,CAAC;IAEpB,aAAa,EAAE,WAAW,CAAC;IAC3B,aAAa,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IAErC,sDAAsD;IACtD,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAErC,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1C,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE5B,yCAAyC;IACzC,gBAAgB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAEjC,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnC,SAAS,EAAE,WAAW,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC5B,EAAE,EAAE,IAAI,CAAC;IAET,mFAAmF;IACnF,aAAa,EAAE,MAAM,CAAC;IAEtB,4CAA4C;IAC5C,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEjC,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IAEnB,2DAA2D;IAC3D,cAAc,EAAE,OAAO,CAAC;IAExB,0FAA0F;IAC1F,qBAAqB,EAAE,OAAO,CAAC;IAE/B,SAAS,EAAE,WAAW,CAAC;CAC1B;AAED,iGAAiG;AACjG,MAAM,WAAW,oBAAoB;IACjC,KAAK,EAAE,eAAe,EAAE,CAAC;CAC5B;AAED,kGAAkG;AAClG,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;AAElD,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,2EAA2E;IAC3E,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEzB,qFAAqF;IACrF,MAAM,CAAC,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;IAElC,YAAY,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE9B,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CAChC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IAC/B,kEAAkE;IAClE,aAAa,EAAE,MAAM,CAAC;IAEtB,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;IAElB,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEjC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAE9C,wDAAwD;IACxD,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAEzC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CACrC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACnC,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,cAAc,CAAC;IAEvB,qFAAqF;IACrF,WAAW,EAAE,OAAO,CAAC;IAErB,SAAS,EAAE,WAAW,CAAC;CAC1B"}

package/dist/cjs/api/conduit/dispatch.type.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=dispatch.type.js.map

package/dist/cjs/api/conduit/dispatch.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.type.js","sourceRoot":"","sources":["../../../../src/api/conduit/dispatch.type.ts"],"names":[],"mappings":""}

package/dist/cjs/api/conduit/index.d.ts

@@ -1,7 +1,12 @@
 export * from './capture.type.js';
+export * from './connection.type.js';
+export * from './connector-auth-type.enum.js';
+export * from './connector.type.js';
 export * from './delivery-status.enum.js';
 export * from './delivery.type.js';
 export * from './destination.type.js';
+export * from './dispatch-status.enum.js';
+export * from './dispatch.type.js';
 export * from './endpoint.type.js';
 export * from './handshake-kind.enum.js';
 export * from './match-operator.enum.js';

package/dist/cjs/api/conduit/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mCAAmC,CAAC;AAClD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mCAAmC,CAAC;AAClD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC"}

package/dist/cjs/api/conduit/index.js

@@ -15,9 +15,14 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./capture.type.js"), exports);
+__exportStar(require("./connection.type.js"), exports);
+__exportStar(require("./connector-auth-type.enum.js"), exports);
+__exportStar(require("./connector.type.js"), exports);
 __exportStar(require("./delivery-status.enum.js"), exports);
 __exportStar(require("./delivery.type.js"), exports);
 __exportStar(require("./destination.type.js"), exports);
+__exportStar(require("./dispatch-status.enum.js"), exports);
+__exportStar(require("./dispatch.type.js"), exports);
 __exportStar(require("./endpoint.type.js"), exports);
 __exportStar(require("./handshake-kind.enum.js"), exports);
 __exportStar(require("./match-operator.enum.js"), exports);

package/dist/cjs/api/conduit/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/api/conduit/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAkC;AAClC,4DAA0C;AAC1C,qDAAmC;AACnC,wDAAsC;AACtC,qDAAmC;AACnC,2DAAyC;AACzC,2DAAyC;AACzC,qDAAmC;AACnC,mDAAiC;AACjC,kDAAgC;AAChC,gEAA8C;AAC9C,+DAA6C;AAC7C,oEAAkD;AAClD,8DAA4C;AAC5C,sDAAoC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/api/conduit/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAkC;AAClC,uDAAqC;AACrC,gEAA8C;AAC9C,sDAAoC;AACpC,4DAA0C;AAC1C,qDAAmC;AACnC,wDAAsC;AACtC,4DAA0C;AAC1C,qDAAmC;AACnC,qDAAmC;AACnC,2DAAyC;AACzC,2DAAyC;AACzC,qDAAmC;AACnC,mDAAiC;AACjC,kDAAgC;AAChC,gEAA8C;AAC9C,+DAA6C;AAC7C,oEAAkD;AAClD,8DAA4C;AAC5C,sDAAoC"}

package/dist/cjs/enum/user-permission.enum.d.ts

@@ -89,7 +89,46 @@ export declare enum UserPermission {
      * read: it causes an outbound request rather than returning a row, and redriving a large
      * dead-letter backlog is a way to flood a customer's own service.
      */
-    CONDUIT_DELIVERY_OPERATE = "conduit:delivery:operate"
+    CONDUIT_DELIVERY_OPERATE = "conduit:delivery:operate",
+    /** Read connector manifests. They hold no credential, so this is configuration only. */
+    CONDUIT_CONNECTOR_READ = "conduit:connector:read",
+    /**
+     * Define or amend a connector manifest — **the list of hosts and paths Conduit may be asked
+     * to call**, and the token endpoint it will send a customer's client secret to.
+     *
+     * The most powerful permission in the outbound half. A dispatch cannot name a URL; it can
+     * only name an operation somebody with this permission wrote down, which is what keeps
+     * outbound from being an authenticated open proxy. Whoever holds this decides where the
+     * proxy may point.
+     */
+    CONDUIT_CONNECTOR_MANAGE = "conduit:connector:manage",
+    /** Read connections. Never exposes their stored credential values. */
+    CONDUIT_CONNECTION_READ = "conduit:connection:read",
+    /**
+     * Create, amend or delete a connection — the customer's own third-party credentials.
+     *
+     * Single manage permission rather than create/update/delete: the dangerous act is holding
+     * the credential at all, and the three carry the same risk.
+     */
+    CONDUIT_CONNECTION_MANAGE = "conduit:connection:manage",
+    /**
+     * Read the outbound log and its dead-letter queue, including each attempt's response.
+     *
+     * A dispatch record holds the payload a vertical asked to send — a customer's message text,
+     * an order — so this is a data-read permission, not a config one.
+     */
+    CONDUIT_DISPATCH_READ = "conduit:dispatch:read",
+    /**
+     * Submit an outbound request. **This is the permission a vertical holds**, and the only one
+     * it needs: `unibox-api` sending a reply presents this and nothing else.
+     *
+     * Separate from `CONDUIT_DISPATCH_OPERATE` because sending is the routine act and operating
+     * the queue is the exceptional one — a service principal that can send should not also be
+     * able to redrive a backlog.
+     */
+    CONDUIT_DISPATCH_SEND = "conduit:dispatch:send",
+    /** Redrive a dead-lettered dispatch, or cancel one still pending. */
+    CONDUIT_DISPATCH_OPERATE = "conduit:dispatch:operate"
 }
 /**
  * Every member, for seeding the owner role and validating custom-role input.

package/dist/cjs/enum/user-permission.enum.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-permission.enum.d.ts","sourceRoot":"","sources":["../../../src/enum/user-permission.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,oBAAY,cAAc;IAItB,WAAW,gBAAgB;IAC3B,aAAa,kBAAkB;IAC/B,sFAAsF;IACtF,aAAa,kBAAkB;IAG/B,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAG3B,eAAe,oBAAoB;IACnC,6EAA6E;IAC7E,iBAAiB,sBAAsB;IACvC;;;OAGG;IACH,sBAAsB,2BAA2B;IAGjD,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAG3B,YAAY,iBAAiB;IAC7B,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;IAKjC,qEAAqE;IACrE,qBAAqB,0BAA0B;IAC/C,uBAAuB,4BAA4B;IACnD,uBAAuB,4BAA4B;IACnD,uBAAuB,4BAA4B;IAGnD;;;;OAIG;IACH,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IAGjD;;;;OAIG;IACH,sBAAsB,2BAA2B;IAGjD,qBAAqB,0BAA0B;IAC/C,yFAAyF;IACzF,uBAAuB,4BAA4B;IAGnD,mEAAmE;IACnE,wBAAwB,6BAA6B;IACrD;;;;;;;OAOG;IACH,0BAA0B,+BAA+B;IAGzD,kBAAkB,uBAAuB;IACzC,2DAA2D;IAC3D,oBAAoB,yBAAyB;IAG7C;;;;;OAKG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;;OAMG;IACH,wBAAwB,6BAA6B;CACxD;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,cAAc,EAAiD,CAAC"}
+{"version":3,"file":"user-permission.enum.d.ts","sourceRoot":"","sources":["../../../src/enum/user-permission.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,oBAAY,cAAc;IAItB,WAAW,gBAAgB;IAC3B,aAAa,kBAAkB;IAC/B,sFAAsF;IACtF,aAAa,kBAAkB;IAG/B,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAG3B,eAAe,oBAAoB;IACnC,6EAA6E;IAC7E,iBAAiB,sBAAsB;IACvC;;;OAGG;IACH,sBAAsB,2BAA2B;IAGjD,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAG3B,YAAY,iBAAiB;IAC7B,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;IAKjC,qEAAqE;IACrE,qBAAqB,0BAA0B;IAC/C,uBAAuB,4BAA4B;IACnD,uBAAuB,4BAA4B;IACnD,uBAAuB,4BAA4B;IAGnD;;;;OAIG;IACH,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IAGjD;;;;OAIG;IACH,sBAAsB,2BAA2B;IAGjD,qBAAqB,0BAA0B;IAC/C,yFAAyF;IACzF,uBAAuB,4BAA4B;IAGnD,mEAAmE;IACnE,wBAAwB,6BAA6B;IACrD;;;;;;;OAOG;IACH,0BAA0B,+BAA+B;IAGzD,kBAAkB,uBAAuB;IACzC,2DAA2D;IAC3D,oBAAoB,yBAAyB;IAG7C;;;;;OAKG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;;OAMG;IACH,wBAAwB,6BAA6B;IAGrD,wFAAwF;IACxF,sBAAsB,2BAA2B;IACjD;;;;;;;;OAQG;IACH,wBAAwB,6BAA6B;IAGrD,sEAAsE;IACtE,uBAAuB,4BAA4B;IACnD;;;;;OAKG;IACH,yBAAyB,8BAA8B;IAGvD;;;;;OAKG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;;;OAOG;IACH,qBAAqB,0BAA0B;IAC/C,qEAAqE;IACrE,wBAAwB,6BAA6B;CACxD;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,cAAc,EAAiD,CAAC"}

package/dist/cjs/enum/user-permission.enum.js

@@ -108,6 +108,48 @@ var UserPermission;
      * dead-letter backlog is a way to flood a customer's own service.
      */
     UserPermission["CONDUIT_DELIVERY_OPERATE"] = "conduit:delivery:operate";
+    // ── Connector (outbound) ────────────────────────────────────────────────
+    /** Read connector manifests. They hold no credential, so this is configuration only. */
+    UserPermission["CONDUIT_CONNECTOR_READ"] = "conduit:connector:read";
+    /**
+     * Define or amend a connector manifest — **the list of hosts and paths Conduit may be asked
+     * to call**, and the token endpoint it will send a customer's client secret to.
+     *
+     * The most powerful permission in the outbound half. A dispatch cannot name a URL; it can
+     * only name an operation somebody with this permission wrote down, which is what keeps
+     * outbound from being an authenticated open proxy. Whoever holds this decides where the
+     * proxy may point.
+     */
+    UserPermission["CONDUIT_CONNECTOR_MANAGE"] = "conduit:connector:manage";
+    // ── Connection (outbound) ───────────────────────────────────────────────
+    /** Read connections. Never exposes their stored credential values. */
+    UserPermission["CONDUIT_CONNECTION_READ"] = "conduit:connection:read";
+    /**
+     * Create, amend or delete a connection — the customer's own third-party credentials.
+     *
+     * Single manage permission rather than create/update/delete: the dangerous act is holding
+     * the credential at all, and the three carry the same risk.
+     */
+    UserPermission["CONDUIT_CONNECTION_MANAGE"] = "conduit:connection:manage";
+    // ── Dispatch (outbound) ─────────────────────────────────────────────────
+    /**
+     * Read the outbound log and its dead-letter queue, including each attempt's response.
+     *
+     * A dispatch record holds the payload a vertical asked to send — a customer's message text,
+     * an order — so this is a data-read permission, not a config one.
+     */
+    UserPermission["CONDUIT_DISPATCH_READ"] = "conduit:dispatch:read";
+    /**
+     * Submit an outbound request. **This is the permission a vertical holds**, and the only one
+     * it needs: `unibox-api` sending a reply presents this and nothing else.
+     *
+     * Separate from `CONDUIT_DISPATCH_OPERATE` because sending is the routine act and operating
+     * the queue is the exceptional one — a service principal that can send should not also be
+     * able to redrive a backlog.
+     */
+    UserPermission["CONDUIT_DISPATCH_SEND"] = "conduit:dispatch:send";
+    /** Redrive a dead-lettered dispatch, or cancel one still pending. */
+    UserPermission["CONDUIT_DISPATCH_OPERATE"] = "conduit:dispatch:operate";
 })(UserPermission || (exports.UserPermission = UserPermission = {}));
 /**
  * Every member, for seeding the owner role and validating custom-role input.

package/dist/cjs/enum/user-permission.enum.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-permission.enum.js","sourceRoot":"","sources":["../../../src/enum/user-permission.enum.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,IAAY,cAqGX;AArGD,WAAY,cAAc;IACtB,4EAA4E;IAE5E,2EAA2E;IAC3E,6CAA2B,CAAA;IAC3B,iDAA+B,CAAA;IAC/B,sFAAsF;IACtF,iDAA+B,CAAA;IAE/B,2EAA2E;IAC3E,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAE3B,2EAA2E;IAC3E,qDAAmC,CAAA;IACnC,6EAA6E;IAC7E,yDAAuC,CAAA;IACvC;;;OAGG;IACH,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAE3B,2EAA2E;IAC3E,+CAA6B,CAAA;IAC7B,iDAA+B,CAAA;IAC/B,mDAAiC,CAAA;IAEjC,4EAA4E;IAE5E,2EAA2E;IAC3E,qEAAqE;IACrE,iEAA+C,CAAA;IAC/C,qEAAmD,CAAA;IACnD,qEAAmD,CAAA;IACnD,qEAAmD,CAAA;IAEnD,2EAA2E;IAC3E;;;;OAIG;IACH,+DAA6C,CAAA;IAC7C,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E;;;;OAIG;IACH,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E,iEAA+C,CAAA;IAC/C,yFAAyF;IACzF,qEAAmD,CAAA;IAEnD,2EAA2E;IAC3E,mEAAmE;IACnE,uEAAqD,CAAA;IACrD;;;;;;;OAOG;IACH,2EAAyD,CAAA;IAEzD,2EAA2E;IAC3E,2DAAyC,CAAA;IACzC,2DAA2D;IAC3D,+DAA6C,CAAA;IAE7C,2EAA2E;IAC3E;;;;;OAKG;IACH,iEAA+C,CAAA;IAC/C;;;;;;OAMG;IACH,uEAAqD,CAAA;AACzD,CAAC,EArGW,cAAc,8BAAd,cAAc,QAqGzB;AAED;;;;;GAKG;AACU,QAAA,oBAAoB,GAA8B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC"}
+{"version":3,"file":"user-permission.enum.js","sourceRoot":"","sources":["../../../src/enum/user-permission.enum.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,IAAY,cAkJX;AAlJD,WAAY,cAAc;IACtB,4EAA4E;IAE5E,2EAA2E;IAC3E,6CAA2B,CAAA;IAC3B,iDAA+B,CAAA;IAC/B,sFAAsF;IACtF,iDAA+B,CAAA;IAE/B,2EAA2E;IAC3E,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAE3B,2EAA2E;IAC3E,qDAAmC,CAAA;IACnC,6EAA6E;IAC7E,yDAAuC,CAAA;IACvC;;;OAGG;IACH,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAE3B,2EAA2E;IAC3E,+CAA6B,CAAA;IAC7B,iDAA+B,CAAA;IAC/B,mDAAiC,CAAA;IAEjC,4EAA4E;IAE5E,2EAA2E;IAC3E,qEAAqE;IACrE,iEAA+C,CAAA;IAC/C,qEAAmD,CAAA;IACnD,qEAAmD,CAAA;IACnD,qEAAmD,CAAA;IAEnD,2EAA2E;IAC3E;;;;OAIG;IACH,+DAA6C,CAAA;IAC7C,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E;;;;OAIG;IACH,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E,iEAA+C,CAAA;IAC/C,yFAAyF;IACzF,qEAAmD,CAAA;IAEnD,2EAA2E;IAC3E,mEAAmE;IACnE,uEAAqD,CAAA;IACrD;;;;;;;OAOG;IACH,2EAAyD,CAAA;IAEzD,2EAA2E;IAC3E,2DAAyC,CAAA;IACzC,2DAA2D;IAC3D,+DAA6C,CAAA;IAE7C,2EAA2E;IAC3E;;;;;OAKG;IACH,iEAA+C,CAAA;IAC/C;;;;;;OAMG;IACH,uEAAqD,CAAA;IAErD,2EAA2E;IAC3E,wFAAwF;IACxF,mEAAiD,CAAA;IACjD;;;;;;;;OAQG;IACH,uEAAqD,CAAA;IAErD,2EAA2E;IAC3E,sEAAsE;IACtE,qEAAmD,CAAA;IACnD;;;;;OAKG;IACH,yEAAuD,CAAA;IAEvD,2EAA2E;IAC3E;;;;;OAKG;IACH,iEAA+C,CAAA;IAC/C;;;;;;;OAOG;IACH,iEAA+C,CAAA;IAC/C,qEAAqE;IACrE,uEAAqD,CAAA;AACzD,CAAC,EAlJW,cAAc,8BAAd,cAAc,QAkJzB;AAED;;;;;GAKG;AACU,QAAA,oBAAoB,GAA8B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC"}

package/dist/esm/api/conduit/connection.type.d.ts

@@ -0,0 +1,100 @@
+import type { IsoDateTime } from '../../type/iso-date-time.type.js';
+import type { Nullable } from '../../type/nil.type.js';
+import type { UUID } from '../../type/uuid.type.js';
+/**
+ * One tenant's configured instance of a connector: the credentials and the account details that
+ * turn a manifest into something that can actually send.
+ *
+ * The split is the reason a manifest can ship in the binary. A connector says "WhatsApp Cloud
+ * lives at graph.facebook.com and authenticates with a bearer token"; a connection says "and
+ * *this* is our token, for *this* phone number". One is ours and identical for everybody; the
+ * other is the customer's and is the single most sensitive thing this service holds.
+ *
+ * **No endpoint of this API returns a credential value**, in any form — not masked, not
+ * truncated, not a length. `credentialNames` answers the only question an operator has, which is
+ * whether something is configured. Same control as a destination's headers and an endpoint's
+ * signing secret, for the same reason: §11 says one leak ends the company.
+ */
+export interface Connection {
+    id: UUID;
+    /** Stable identifier a dispatch names instead of an id, so callers can be configured by name. */
+    key: string;
+    name: string;
+    description: Nullable<string>;
+    /** The manifest this connection instantiates. Built-in or tenant-defined. */
+    connectorKey: string;
+    /** Sorted. **The values are never returned by any endpoint of this API.** */
+    credentialNames: string[];
+    /**
+     * Non-secret values filling `{placeholders}` in an operation path — a phone number id, an
+     * account id, an API version.
+     *
+     * Deliberately separate from credentials rather than one map with a secrecy flag: a flag is
+     * a thing somebody sets wrong once, and the failure mode is a token in a response body.
+     * Variables are returned in full because they are the part an operator needs to check.
+     */
+    variables: Record<string, string>;
+    /**
+     * When the cached OAuth access token stops being usable, or null when there is none —
+     * either because the connector authenticates statically or because nothing has fetched one
+     * yet.
+     *
+     * The expiry is returned, the token is not. It is what makes "why is this connection
+     * failing" answerable without exposing anything.
+     */
+    accessTokenExpiresAt: Nullable<IsoDateTime>;
+    /**
+     * Why the last authentication attempt failed, or null when the last one worked.
+     *
+     * A refresh token that a provider has revoked is the most common real failure on this
+     * aggregate, and it is invisible otherwise: dispatches simply dead-letter with a 401 and
+     * nothing points at the connection.
+     */
+    lastAuthError: Nullable<string>;
+    /** Stops *new* dispatches being accepted. Does not cancel ones already queued. */
+    isActive: boolean;
+    createdAt: IsoDateTime;
+    updatedAt: IsoDateTime;
+}
+/** `GET /api/v1/connections`. Offset-paginated — a small, slow-moving collection. */
+export interface ConnectionsPage {
+    items: Connection[];
+    total: number;
+    limit: number;
+    offset: number;
+}
+/** `POST /api/v1/connections`. */
+export interface CreateConnectionBody {
+    key: string;
+    name: string;
+    description?: Nullable<string>;
+    connectorKey: string;
+    /**
+     * Secrets this connection authenticates with. **Stored encrypted and never returned.**
+     *
+     * Which names are expected depends on the connector's auth type: an `API_KEY_HEADER`
+     * manifest names its own, an OAuth one wants `clientId`/`clientSecret` and, for the refresh
+     * grant, `refreshToken`.
+     */
+    credentials: Record<string, string>;
+    variables?: Nullable<Record<string, string>>;
+}
+/**
+ * `PATCH /api/v1/connections/:id`.
+ *
+ * **`credentials` has three states, not two.** Omitting it leaves the stored map untouched,
+ * `null` clears it, an object replaces it wholesale. A form that sends `{}` meaning "unchanged"
+ * deletes the customer's token, and the symptom is every dispatch dead-lettering on a 401.
+ *
+ * Replacing credentials also discards the cached access token: a token minted from the old
+ * client secret is not evidence that the new one works, and keeping it would hide a typo until
+ * the token happened to expire.
+ */
+export interface UpdateConnectionBody {
+    name?: string;
+    description?: Nullable<string>;
+    credentials?: Nullable<Record<string, string>>;
+    variables?: Nullable<Record<string, string>>;
+    isActive?: boolean;
+}
+//# sourceMappingURL=connection.type.d.ts.map

package/dist/esm/api/conduit/connection.type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.type.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/connection.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,UAAU;IACvB,EAAE,EAAE,IAAI,CAAC;IAET,iGAAiG;IACjG,GAAG,EAAE,MAAM,CAAC;IAEZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE9B,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAC;IAErB,6EAA6E;IAC7E,eAAe,EAAE,MAAM,EAAE,CAAC;IAE1B;;;;;;;OAOG;IACH,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAElC;;;;;;;OAOG;IACH,oBAAoB,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IAE5C;;;;;;OAMG;IACH,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEhC,kFAAkF;IAClF,QAAQ,EAAE,OAAO,CAAC;IAElB,SAAS,EAAE,WAAW,CAAC;IACvB,SAAS,EAAE,WAAW,CAAC;CAC1B;AAED,qFAAqF;AACrF,MAAM,WAAW,eAAe;IAC5B,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAClB;AAED,kCAAkC;AAClC,MAAM,WAAW,oBAAoB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC;IAErB;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEpC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAChD;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,oBAAoB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7C,QAAQ,CAAC,EAAE,OAAO,CAAC;CACtB"}

package/dist/esm/api/conduit/connection.type.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=connection.type.js.map

package/dist/esm/api/conduit/connection.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.type.js","sourceRoot":"","sources":["../../../../src/api/conduit/connection.type.ts"],"names":[],"mappings":""}

package/dist/esm/api/conduit/connector-auth-type.enum.d.ts

@@ -0,0 +1,42 @@
+/**
+ * How a connector proves who we are to the third-party API it fronts.
+ *
+ * This is the field that decides whether Conduit has to hold a *renewable* credential or merely
+ * a static one, and the two are very different operationally: a static key works until someone
+ * rotates it, an OAuth token stops working on a schedule and something has to notice first.
+ *
+ * The list is deliberately short. Every member is a scheme a manifest can describe entirely as
+ * data — adding a provider that uses one of these is a manifest and a credential, never a code
+ * change, which is the whole promise of §11's connector manifest. A provider needing anything
+ * else (a request-signing scheme, mutual TLS) does not get a special case bolted on here; it
+ * gets a new member, designed once, with the same "no per-provider branches" rule applied to it.
+ */
+export declare enum ConnectorAuthType {
+    /** The API is open, or the credential travels in the payload. Nothing is added to a request. */
+    NONE = "none",
+    /**
+     * A static secret sent in a header — `X-Api-Key: …`, `Authorization: Basic …`.
+     *
+     * The header name and any literal prefix come from the manifest; only the secret comes from
+     * the connection. That split is what lets one manifest serve every tenant.
+     */
+    API_KEY_HEADER = "api-key-header",
+    /** A static bearer token. Shorthand for {@link API_KEY_HEADER} with the header and prefix fixed. */
+    BEARER_STATIC = "bearer-static",
+    /**
+     * OAuth 2.0 client credentials (RFC 6749 §4.4): exchange a client id and secret for a
+     * short-lived access token, and do it again when it expires. Machine-to-machine, no user.
+     */
+    OAUTH2_CLIENT_CREDENTIALS = "oauth2-client-credentials",
+    /**
+     * OAuth 2.0 refresh token (RFC 6749 §6): a long-lived refresh token buys short-lived access
+     * tokens.
+     *
+     * **The refresh token may be rotated by the provider on every use**, and Conduit stores
+     * whichever one came back last. That single fact is why refreshing has to be serialised
+     * across replicas rather than left to race — two simultaneous refreshes rotate twice, one
+     * of the two results is stored, and the connection is dead until a human re-authorises it.
+     */
+    OAUTH2_REFRESH_TOKEN = "oauth2-refresh-token"
+}
+//# sourceMappingURL=connector-auth-type.enum.d.ts.map

package/dist/esm/api/conduit/connector-auth-type.enum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector-auth-type.enum.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/connector-auth-type.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,oBAAY,iBAAiB;IACzB,gGAAgG;IAChG,IAAI,SAAS;IAEb;;;;;OAKG;IACH,cAAc,mBAAmB;IAEjC,oGAAoG;IACpG,aAAa,kBAAkB;IAE/B;;;OAGG;IACH,yBAAyB,8BAA8B;IAEvD;;;;;;;;OAQG;IACH,oBAAoB,yBAAyB;CAChD"}

package/dist/esm/api/conduit/connector-auth-type.enum.js

@@ -0,0 +1,43 @@
+/**
+ * How a connector proves who we are to the third-party API it fronts.
+ *
+ * This is the field that decides whether Conduit has to hold a *renewable* credential or merely
+ * a static one, and the two are very different operationally: a static key works until someone
+ * rotates it, an OAuth token stops working on a schedule and something has to notice first.
+ *
+ * The list is deliberately short. Every member is a scheme a manifest can describe entirely as
+ * data — adding a provider that uses one of these is a manifest and a credential, never a code
+ * change, which is the whole promise of §11's connector manifest. A provider needing anything
+ * else (a request-signing scheme, mutual TLS) does not get a special case bolted on here; it
+ * gets a new member, designed once, with the same "no per-provider branches" rule applied to it.
+ */
+export var ConnectorAuthType;
+(function (ConnectorAuthType) {
+    /** The API is open, or the credential travels in the payload. Nothing is added to a request. */
+    ConnectorAuthType["NONE"] = "none";
+    /**
+     * A static secret sent in a header — `X-Api-Key: …`, `Authorization: Basic …`.
+     *
+     * The header name and any literal prefix come from the manifest; only the secret comes from
+     * the connection. That split is what lets one manifest serve every tenant.
+     */
+    ConnectorAuthType["API_KEY_HEADER"] = "api-key-header";
+    /** A static bearer token. Shorthand for {@link API_KEY_HEADER} with the header and prefix fixed. */
+    ConnectorAuthType["BEARER_STATIC"] = "bearer-static";
+    /**
+     * OAuth 2.0 client credentials (RFC 6749 §4.4): exchange a client id and secret for a
+     * short-lived access token, and do it again when it expires. Machine-to-machine, no user.
+     */
+    ConnectorAuthType["OAUTH2_CLIENT_CREDENTIALS"] = "oauth2-client-credentials";
+    /**
+     * OAuth 2.0 refresh token (RFC 6749 §6): a long-lived refresh token buys short-lived access
+     * tokens.
+     *
+     * **The refresh token may be rotated by the provider on every use**, and Conduit stores
+     * whichever one came back last. That single fact is why refreshing has to be serialised
+     * across replicas rather than left to race — two simultaneous refreshes rotate twice, one
+     * of the two results is stored, and the connection is dead until a human re-authorises it.
+     */
+    ConnectorAuthType["OAUTH2_REFRESH_TOKEN"] = "oauth2-refresh-token";
+})(ConnectorAuthType || (ConnectorAuthType = {}));
+//# sourceMappingURL=connector-auth-type.enum.js.map

package/dist/esm/api/conduit/connector-auth-type.enum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector-auth-type.enum.js","sourceRoot":"","sources":["../../../../src/api/conduit/connector-auth-type.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,iBA+BX;AA/BD,WAAY,iBAAiB;IACzB,gGAAgG;IAChG,kCAAa,CAAA;IAEb;;;;;OAKG;IACH,sDAAiC,CAAA;IAEjC,oGAAoG;IACpG,oDAA+B,CAAA;IAE/B;;;OAGG;IACH,4EAAuD,CAAA;IAEvD;;;;;;;;OAQG;IACH,kEAA6C,CAAA;AACjD,CAAC,EA/BW,iBAAiB,KAAjB,iBAAiB,QA+B5B"}

package/dist/esm/api/conduit/connector.type.d.ts

@@ -0,0 +1,179 @@
+import type { IsoDateTime } from '../../type/iso-date-time.type.js';
+import type { Nullable } from '../../type/nil.type.js';
+import type { UUID } from '../../type/uuid.type.js';
+import type { ConnectorAuthType } from './connector-auth-type.enum.js';
+/**
+ * Credential names an OAuth manifest expects to find on a connection.
+ *
+ * Fixed rather than manifest-configurable: these are the field names RFC 6749 gives the token
+ * request, so letting a manifest rename them would only allow it to be wrong.
+ */
+export declare const CONNECTOR_CREDENTIAL_CLIENT_ID = "clientId";
+export declare const CONNECTOR_CREDENTIAL_CLIENT_SECRET = "clientSecret";
+export declare const CONNECTOR_CREDENTIAL_REFRESH_TOKEN = "refreshToken";
+/**
+ * How a connector authenticates, as data.
+ *
+ * Flat with a discriminating {@link ConnectorAuthType} and nullable fields, matching
+ * `SignatureManifest` — a discriminated union reads better in TypeScript and validates far worse
+ * as a request body, and this shape has to survive `class-validator` on the way in.
+ *
+ * **A manifest holds no secret.** It names *where* the credential goes; the credential itself
+ * lives on a connection, encrypted. That is what makes a manifest safe to return in full to
+ * anyone with `conduit:connector:read` and safe to ship in the binary.
+ */
+export interface ConnectorAuthManifest {
+    type: ConnectorAuthType;
+    /**
+     * Which credential on the connection holds the secret. `API_KEY_HEADER` only.
+     *
+     * OAuth manifests do not set it — they read the fixed names above, because those are defined
+     * by the grant rather than by us.
+     */
+    credentialKey: Nullable<string>;
+    /** Lowercase header the credential is sent in. `API_KEY_HEADER` only. */
+    headerName: Nullable<string>;
+    /** Literal text before the credential, e.g. `Bearer ` or `Basic `. Kept verbatim, spaces included. */
+    valuePrefix: Nullable<string>;
+    /** Token endpoint. `OAUTH2_*` only. Vetted against the SSRF blocklist like any other target. */
+    tokenUrl: Nullable<string>;
+    /** `scope` sent with the token request, when the provider wants one. */
+    scope: Nullable<string>;
+    /**
+     * Seconds shaved off a token's reported lifetime before it counts as expired.
+     *
+     * Not a nicety. A token that expires while a request is in flight fails with a 401 that looks
+     * exactly like a revoked credential, and the retry that would fix it is indistinguishable
+     * from one that never will. Refreshing slightly early makes that case rare instead of
+     * routine. Null falls back to the service default.
+     */
+    expirySkewSeconds: Nullable<number>;
+}
+/** {@link ConnectorAuthManifest} as sent on create/update: nullable fields may simply be omitted. */
+export interface ConnectorAuthManifestInput {
+    type: ConnectorAuthType;
+    credentialKey?: Nullable<string>;
+    headerName?: Nullable<string>;
+    valuePrefix?: Nullable<string>;
+    tokenUrl?: Nullable<string>;
+    scope?: Nullable<string>;
+    expirySkewSeconds?: Nullable<number>;
+}
+/**
+ * One thing a connector can be asked to do.
+ *
+ * A dispatch names an operation by {@link key} rather than supplying a URL, and that is the
+ * whole security model of the outbound side: a caller chooses from a list somebody with
+ * `conduit:connector:manage` wrote down, instead of naming a host Conduit will then post to.
+ * Outbound would otherwise be an open proxy with authentication attached.
+ */
+export interface ConnectorOperation {
+    /** Stable identifier a dispatch names. Lowercase kebab-case: `send-message`. */
+    key: string;
+    /** Human-readable label for the admin UI. */
+    name: string;
+    method: string;
+    /**
+     * Path appended to the connector's `baseUrl`.
+     *
+     * `{name}` placeholders are filled from the connection's variables first and the dispatch's
+     * `pathParams` second. Every placeholder must resolve, or the dispatch is refused at submit
+     * time rather than dead-lettering later — the caller is still on the phone at submit time.
+     */
+    path: string;
+    description: Nullable<string>;
+}
+/** Requests per minute, and how many may arrive at once. Applied per connection. */
+export interface ConnectorRateLimit {
+    perMinute: number;
+    burst: number;
+}
+/**
+ * When to try again, and when to stop.
+ *
+ * Per connector rather than global because providers genuinely differ: one returns 429 with a
+ * generous window, another treats a burst as abuse and blocks for an hour.
+ */
+export interface ConnectorRetryPolicy {
+    maxAttempts: number;
+    backoffBaseMs: number;
+    backoffMaxMs: number;
+    /**
+     * Statuses to retry **in addition** to the transient default set (5xx, 408, 425, 429).
+     *
+     * Additive, never subtractive: a manifest can say "this provider's 400 is transient", which
+     * is a fact about that provider, but it cannot claim a 502 is permanent — nothing about a
+     * gateway error is provider-specific and the ability to get it wrong buys nothing.
+     */
+    retryableStatuses: number[];
+    /**
+     * Statuses meaning the access token is stale.
+     *
+     * Handled once per attempt and unlike any other status: the token is discarded, refreshed,
+     * and the request is sent again immediately rather than after a backoff. A token that
+     * expired thirty seconds early is not a failing destination and should not be treated as one.
+     */
+    authFailureStatuses: number[];
+}
+/**
+ * A third-party API, described entirely as data. §11's "connector manifest".
+ *
+ * Conduit contains no `if (connector === 'whatsapp')` anywhere. Adding TikTok is a manifest and
+ * a credential; the code that sends the request never learns a provider's name.
+ */
+export interface Connector {
+    /** Null for a built-in — it is not a row and cannot be edited or deleted. */
+    id: Nullable<UUID>;
+    /** Stable identifier a connection references. Lowercase kebab-case. */
+    key: string;
+    name: string;
+    description: Nullable<string>;
+    /** Absolute https base every operation path is appended to. */
+    baseUrl: string;
+    auth: ConnectorAuthManifest;
+    operations: ConnectorOperation[];
+    /** Null means only the service-wide default applies. */
+    rateLimit: Nullable<ConnectorRateLimit>;
+    retry: ConnectorRetryPolicy;
+    /**
+     * Ships with Conduit, in code rather than as a seeded row. Override it by defining your own
+     * under the same key — resolution checks a tenant's rows first.
+     */
+    isBuiltIn: boolean;
+    /** Null for a built-in. */
+    createdAt: Nullable<IsoDateTime>;
+    /** Null for a built-in. */
+    updatedAt: Nullable<IsoDateTime>;
+}
+/** Built-ins plus whatever one customer has defined. `GET /api/v1/connectors`. */
+export interface ConnectorsList {
+    items: Connector[];
+}
+/** `POST /api/v1/connectors`. */
+export interface CreateConnectorBody {
+    key: string;
+    name: string;
+    description?: Nullable<string>;
+    baseUrl: string;
+    auth: ConnectorAuthManifestInput;
+    operations: ConnectorOperation[];
+    rateLimit?: Nullable<ConnectorRateLimit>;
+    retry?: Nullable<ConnectorRetryPolicy>;
+}
+/**
+ * `PATCH /api/v1/connectors/:id`.
+ *
+ * `operations` replaces the list wholesale — there is no per-operation patch. Merging would make
+ * "remove an operation" unexpressible, and an operation nobody can remove is a URL Conduit will
+ * post to forever.
+ */
+export interface UpdateConnectorBody {
+    name?: string;
+    description?: Nullable<string>;
+    baseUrl?: string;
+    auth?: ConnectorAuthManifestInput;
+    operations?: ConnectorOperation[];
+    rateLimit?: Nullable<ConnectorRateLimit>;
+    retry?: Nullable<ConnectorRetryPolicy>;
+}
+//# sourceMappingURL=connector.type.d.ts.map

package/dist/esm/api/conduit/connector.type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector.type.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/connector.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAEvE;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,aAAa,CAAC;AACzD,eAAO,MAAM,kCAAkC,iBAAiB,CAAC;AACjE,eAAO,MAAM,kCAAkC,iBAAiB,CAAC;AAEjE;;;;;;;;;;GAUG;AACH,MAAM,WAAW,qBAAqB;IAClC,IAAI,EAAE,iBAAiB,CAAC;IAExB;;;;;OAKG;IACH,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEhC,yEAAyE;IACzE,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE7B,sGAAsG;IACtG,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE9B,gGAAgG;IAChG,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE3B,wEAAwE;IACxE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAExB;;;;;;;OAOG;IACH,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CACvC;AAED,qGAAqG;AACrG,MAAM,WAAW,0BAA0B;IACvC,IAAI,EAAE,iBAAiB,CAAC;IACxB,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5B,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzB,iBAAiB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CACxC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IAC/B,gFAAgF;IAChF,GAAG,EAAE,MAAM,CAAC;IAEZ,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IAEb,MAAM,EAAE,MAAM,CAAC;IAEf;;;;;;OAMG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CACjC;AAED,oFAAoF;AACpF,MAAM,WAAW,kBAAkB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IAErB;;;;;;OAMG;IACH,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAE5B;;;;;;OAMG;IACH,mBAAmB,EAAE,MAAM,EAAE,CAAC;CACjC;AAED;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACtB,6EAA6E;IAC7E,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAEnB,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IAEZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE9B,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC;IAEhB,IAAI,EAAE,qBAAqB,CAAC;IAE5B,UAAU,EAAE,kBAAkB,EAAE,CAAC;IAEjC,wDAAwD;IACxD,SAAS,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAExC,KAAK,EAAE,oBAAoB,CAAC;IAE5B;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAC;IAEnB,2BAA2B;IAC3B,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IAEjC,2BAA2B;IAC3B,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;CACpC;AAED,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC3B,KAAK,EAAE,SAAS,EAAE,CAAC;CACtB;AAED,iCAAiC;AACjC,MAAM,WAAW,mBAAmB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,0BAA0B,CAAC;IACjC,UAAU,EAAE,kBAAkB,EAAE,CAAC;IACjC,SAAS,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACzC,KAAK,CAAC,EAAE,QAAQ,CAAC,oBAAoB,CAAC,CAAC;CAC1C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,0BAA0B,CAAC;IAClC,UAAU,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAClC,SAAS,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACzC,KAAK,CAAC,EAAE,QAAQ,CAAC,oBAAoB,CAAC,CAAC;CAC1C"}

package/dist/esm/api/conduit/connector.type.js

@@ -0,0 +1,10 @@
+/**
+ * Credential names an OAuth manifest expects to find on a connection.
+ *
+ * Fixed rather than manifest-configurable: these are the field names RFC 6749 gives the token
+ * request, so letting a manifest rename them would only allow it to be wrong.
+ */
+export const CONNECTOR_CREDENTIAL_CLIENT_ID = 'clientId';
+export const CONNECTOR_CREDENTIAL_CLIENT_SECRET = 'clientSecret';
+export const CONNECTOR_CREDENTIAL_REFRESH_TOKEN = 'refreshToken';
+//# sourceMappingURL=connector.type.js.map

package/dist/esm/api/conduit/connector.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector.type.js","sourceRoot":"","sources":["../../../../src/api/conduit/connector.type.ts"],"names":[],"mappings":"AAMA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,UAAU,CAAC;AACzD,MAAM,CAAC,MAAM,kCAAkC,GAAG,cAAc,CAAC;AACjE,MAAM,CAAC,MAAM,kCAAkC,GAAG,cAAc,CAAC"}

package/dist/esm/api/conduit/dispatch-status.enum.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Where one outbound dispatch is in its life.
+ *
+ * The members mirror `DeliveryStatus` exactly, and this is deliberately **not** the same enum.
+ * The two are separate wire contracts on separate resources, and sharing one would mean a state
+ * added for the inbound queue silently appears on the outbound one's documented API — a
+ * connector-specific state has no business showing up on a webhook delivery, and vice versa.
+ * Being identical today is not a reason to make them the same type; it is just what happens when
+ * two queues share a state machine.
+ *
+ * There is no `RATE_LIMITED` member on purpose. A dispatch held back by a connector's rate limit
+ * is simply `PENDING` with a later `nextAttemptAt`, because that is exactly what it is — waiting
+ * for its next attempt time, no differently from one waiting out a backoff. A separate state
+ * would suggest an operator has something to do about it.
+ */
+export declare enum DispatchStatus {
+    /** Waiting for its next attempt time. The only state the processor claims from. */
+    PENDING = "pending",
+    /**
+     * Claimed by a replica and being attempted right now.
+     *
+     * A row stuck here past the claim timeout is assumed abandoned and reclaimed — and on this
+     * side that reclaim is genuinely dangerous, because the request may have already reached the
+     * provider. It is why every dispatch carries an idempotency key onward and why a caller must
+     * treat outbound as at-least-once too.
+     */
+    IN_FLIGHT = "in-flight",
+    /** The provider accepted it. Terminal. */
+    DELIVERED = "delivered",
+    /**
+     * Every attempt was used and none succeeded, or the failure was permanent. Terminal until an
+     * operator redrives it.
+     *
+     * **This is the dead-letter queue** — a status, not a separate resource.
+     */
+    DEAD_LETTERED = "dead-lettered",
+    /** An operator stopped it before it was sent. Terminal, and distinct from a failure. */
+    CANCELLED = "cancelled"
+}
+//# sourceMappingURL=dispatch-status.enum.d.ts.map

package/dist/esm/api/conduit/dispatch-status.enum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch-status.enum.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/dispatch-status.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,oBAAY,cAAc;IACtB,mFAAmF;IACnF,OAAO,YAAY;IAEnB;;;;;;;OAOG;IACH,SAAS,cAAc;IAEvB,0CAA0C;IAC1C,SAAS,cAAc;IAEvB;;;;;OAKG;IACH,aAAa,kBAAkB;IAE/B,wFAAwF;IACxF,SAAS,cAAc;CAC1B"}