@iveri/contracts 0.5.0 → 0.7.0

package/dist/cjs/api/conduit/dispatch.type.d.ts

@@ -0,0 +1,143 @@
+import type { CursorPage } from '../../type/cursor-page.type.js';
+import type { IsoDateTime } from '../../type/iso-date-time.type.js';
+import type { Nullable } from '../../type/nil.type.js';
+import type { UUID } from '../../type/uuid.type.js';
+import type { DispatchStatus } from './dispatch-status.enum.js';
+/**
+ * One outbound request Conduit has accepted responsibility for.
+ *
+ * The inbound pipeline reversed: a vertical POSTs here, Conduit persists and answers `202`, and
+ * the provider is called afterwards with retries and a dead-letter queue. The caller is released
+ * from the third party's availability entirely — which is the point, because a CRM that awaits
+ * the Graph API inline is a CRM that is down whenever Meta is.
+ *
+ * **The payload is stored as sent.** Conduit does not reshape it into a provider's format; §14
+ * rules out transforms beyond header templating, and a gateway that rewrites bodies is a gateway
+ * that has opinions about domains it must not know exist.
+ */
+export interface Dispatch {
+    id: UUID;
+    /** The connection this went out through. A loose reference — it may since have been deleted. */
+    connectionId: UUID;
+    /** Snapshotted, so the record still reads correctly after the connection is renamed. */
+    connectionKey: string;
+    connectorKey: string;
+    /** The operation named at submit time. */
+    operation: string;
+    /**
+     * Resolved when the dispatch was accepted, not read from the manifest now.
+     *
+     * Same rule as a delivery's target: editing an operation's path must not retroactively
+     * change where Conduit says it sent something.
+     */
+    targetUrl: string;
+    method: string;
+    /**
+     * The caller's own key, echoed back.
+     *
+     * Submitting twice with the same key returns the **first** dispatch rather than creating a
+     * second — which is what makes a vertical's own retry safe. Null when the caller supplied
+     * none, in which case a resubmit is a second send and that is the caller's choice.
+     */
+    idempotencyKey: Nullable<string>;
+    status: DispatchStatus;
+    attemptCount: number;
+    /** Snapshotted from the connector's retry policy when accepted. */
+    maxAttempts: number;
+    nextAttemptAt: IsoDateTime;
+    lastAttemptAt: Nullable<IsoDateTime>;
+    /** Null when no response arrived. See `lastError`. */
+    lastResponseStatus: Nullable<number>;
+    lastResponseBodyPreview: Nullable<string>;
+    lastError: Nullable<string>;
+    /** Set when an operator redrove this. */
+    redrivenByUserId: Nullable<UUID>;
+    completedAt: Nullable<IsoDateTime>;
+    createdAt: IsoDateTime;
+}
+/**
+ * One attempt at one dispatch.
+ *
+ * `wasRateLimited` is the field that stops an operator misreading the history. A dispatch held
+ * back by the connector's own limit did not fail, cost no attempt, and needs nothing done about
+ * it — but without a record it looks like a gap in the timeline, and the obvious conclusion is
+ * that the queue stalled.
+ */
+export interface DispatchAttempt {
+    id: UUID;
+    /** 1-based. Equal for two rows only when one of them was a rate-limit deferral. */
+    attemptNumber: number;
+    /** Null when no response arrived at all. */
+    responseStatus: Nullable<number>;
+    responseBodyPreview: Nullable<string>;
+    errorMessage: Nullable<string>;
+    durationMs: number;
+    isSuccess: boolean;
+    /** Recorded but not charged against the attempt budget. */
+    wasRateLimited: boolean;
+    /** Whether the access token was refreshed and the request re-sent within this attempt. */
+    didRefreshCredentials: boolean;
+    createdAt: IsoDateTime;
+}
+/** `GET /api/v1/dispatches/:id/attempts`. Oldest first — an attempt history reads as a story. */
+export interface DispatchAttemptsList {
+    items: DispatchAttempt[];
+}
+/** `GET /api/v1/dispatches`. Cursor-paginated: the collection is appended to while it is read. */
+export type DispatchesPage = CursorPage<Dispatch>;
+/** Query for `GET /api/v1/dispatches`. */
+export interface GetDispatchesQuery {
+    limit?: number;
+    /** Opaque cursor from the previous page's `nextCursor`. Never parse it. */
+    after?: Nullable<string>;
+    /** `dead-lettered` is the DLQ view. The DLQ is a filter, not a separate resource. */
+    status?: Nullable<DispatchStatus>;
+    connectionId?: Nullable<UUID>;
+    operation?: Nullable<string>;
+}
+/**
+ * `POST /api/v1/dispatches` — the request a vertical makes to send something.
+ *
+ * Note what is **not** here: no URL, no host, no arbitrary headers. The caller picks a connection
+ * and an operation, both of which someone configured deliberately, and Conduit derives the
+ * target. Accepting a URL would make this an authenticated open proxy sitting inside our network.
+ */
+export interface SubmitDispatchBody {
+    /** Which connection to send through, by its tenant-scoped key. */
+    connectionKey: string;
+    /** Which of the connector's operations to invoke, by key. */
+    operation: string;
+    /** The request body, sent to the provider as-is. */
+    payload: Record<string, unknown>;
+    /**
+     * Values for `{placeholders}` in the operation's path that the connection does not supply.
+     *
+     * Percent-encoded into the path, so a value cannot introduce a path segment or a query
+     * string and steer the request at a different endpoint of the same host.
+     */
+    pathParams?: Nullable<Record<string, string>>;
+    /** Appended to the resolved URL. Values are encoded. */
+    query?: Nullable<Record<string, string>>;
+    /**
+     * The caller's idempotency key, scoped to the tenant.
+     *
+     * **Strongly recommended.** Without one, a vertical that times out submitting and retries
+     * sends the customer two messages. With one, the second submit returns the first dispatch.
+     */
+    idempotencyKey?: Nullable<string>;
+}
+/**
+ * `202 Accepted` from `POST /api/v1/dispatches`.
+ *
+ * Deliberately not the full {@link Dispatch}: at this moment the only true facts are that it was
+ * accepted and where to look next. Returning a status the caller might treat as an outcome
+ * invites exactly the synchronous coupling this endpoint exists to remove.
+ */
+export interface SubmitDispatchResponse {
+    id: UUID;
+    status: DispatchStatus;
+    /** True when this submit matched an existing idempotency key and created nothing. */
+    isDuplicate: boolean;
+    createdAt: IsoDateTime;
+}
+//# sourceMappingURL=dispatch.type.d.ts.map

package/dist/cjs/api/conduit/dispatch.type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.type.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/dispatch.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEhE;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,QAAQ;IACrB,EAAE,EAAE,IAAI,CAAC;IAET,gGAAgG;IAChG,YAAY,EAAE,IAAI,CAAC;IAEnB,wFAAwF;IACxF,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IAErB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAElB;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB,MAAM,EAAE,MAAM,CAAC;IAEf;;;;;;OAMG;IACH,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEjC,MAAM,EAAE,cAAc,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IAErB,mEAAmE;IACnE,WAAW,EAAE,MAAM,CAAC;IAEpB,aAAa,EAAE,WAAW,CAAC;IAC3B,aAAa,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IAErC,sDAAsD;IACtD,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAErC,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1C,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE5B,yCAAyC;IACzC,gBAAgB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAEjC,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnC,SAAS,EAAE,WAAW,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC5B,EAAE,EAAE,IAAI,CAAC;IAET,mFAAmF;IACnF,aAAa,EAAE,MAAM,CAAC;IAEtB,4CAA4C;IAC5C,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEjC,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IAEnB,2DAA2D;IAC3D,cAAc,EAAE,OAAO,CAAC;IAExB,0FAA0F;IAC1F,qBAAqB,EAAE,OAAO,CAAC;IAE/B,SAAS,EAAE,WAAW,CAAC;CAC1B;AAED,iGAAiG;AACjG,MAAM,WAAW,oBAAoB;IACjC,KAAK,EAAE,eAAe,EAAE,CAAC;CAC5B;AAED,kGAAkG;AAClG,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;AAElD,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,2EAA2E;IAC3E,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEzB,qFAAqF;IACrF,MAAM,CAAC,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;IAElC,YAAY,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE9B,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CAChC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IAC/B,kEAAkE;IAClE,aAAa,EAAE,MAAM,CAAC;IAEtB,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;IAElB,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEjC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAE9C,wDAAwD;IACxD,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAEzC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CACrC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACnC,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,cAAc,CAAC;IAEvB,qFAAqF;IACrF,WAAW,EAAE,OAAO,CAAC;IAErB,SAAS,EAAE,WAAW,CAAC;CAC1B"}

package/dist/cjs/api/conduit/dispatch.type.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=dispatch.type.js.map

package/dist/cjs/api/conduit/dispatch.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.type.js","sourceRoot":"","sources":["../../../../src/api/conduit/dispatch.type.ts"],"names":[],"mappings":""}

package/dist/cjs/api/conduit/index.d.ts

@@ -1,7 +1,12 @@
 export * from './capture.type.js';
+export * from './connection.type.js';
+export * from './connector-auth-type.enum.js';
+export * from './connector.type.js';
 export * from './delivery-status.enum.js';
 export * from './delivery.type.js';
 export * from './destination.type.js';
+export * from './dispatch-status.enum.js';
+export * from './dispatch.type.js';
 export * from './endpoint.type.js';
 export * from './handshake-kind.enum.js';
 export * from './match-operator.enum.js';

package/dist/cjs/api/conduit/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mCAAmC,CAAC;AAClD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mCAAmC,CAAC;AAClD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC"}

package/dist/cjs/api/conduit/index.js

@@ -15,9 +15,14 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./capture.type.js"), exports);
+__exportStar(require("./connection.type.js"), exports);
+__exportStar(require("./connector-auth-type.enum.js"), exports);
+__exportStar(require("./connector.type.js"), exports);
 __exportStar(require("./delivery-status.enum.js"), exports);
 __exportStar(require("./delivery.type.js"), exports);
 __exportStar(require("./destination.type.js"), exports);
+__exportStar(require("./dispatch-status.enum.js"), exports);
+__exportStar(require("./dispatch.type.js"), exports);
 __exportStar(require("./endpoint.type.js"), exports);
 __exportStar(require("./handshake-kind.enum.js"), exports);
 __exportStar(require("./match-operator.enum.js"), exports);

package/dist/cjs/api/conduit/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/api/conduit/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAkC;AAClC,4DAA0C;AAC1C,qDAAmC;AACnC,wDAAsC;AACtC,qDAAmC;AACnC,2DAAyC;AACzC,2DAAyC;AACzC,qDAAmC;AACnC,mDAAiC;AACjC,kDAAgC;AAChC,gEAA8C;AAC9C,+DAA6C;AAC7C,oEAAkD;AAClD,8DAA4C;AAC5C,sDAAoC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/api/conduit/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAkC;AAClC,uDAAqC;AACrC,gEAA8C;AAC9C,sDAAoC;AACpC,4DAA0C;AAC1C,qDAAmC;AACnC,wDAAsC;AACtC,4DAA0C;AAC1C,qDAAmC;AACnC,qDAAmC;AACnC,2DAAyC;AACzC,2DAAyC;AACzC,qDAAmC;AACnC,mDAAiC;AACjC,kDAAgC;AAChC,gEAA8C;AAC9C,+DAA6C;AAC7C,oEAAkD;AAClD,8DAA4C;AAC5C,sDAAoC"}

package/dist/cjs/api/identity/access-token-payload.interface.d.ts

@@ -0,0 +1,53 @@
+import type { UserPermission } from '../../enum/user-permission.enum.js';
+import type { UUID } from '../../type/uuid.type.js';
+import type { PrincipalType } from './principal-type.enum.js';
+/**
+ * Claims carried by an access token.
+ *
+ * **`iveri-identity-api` issues these; every other service only verifies them.** The shape is
+ * therefore a contract owned by identity, and it lives here rather than in either repo because
+ * both sides have to agree byte for byte — a service whose idea of these claims has drifted
+ * does not fail loudly, it rejects every request or, worse, reads the wrong field and keeps
+ * going. `conduit-api` carried a hand-copied duplicate of this interface until the `pt` claim
+ * had to be added to both at once, which is exactly the drift the copy invited.
+ *
+ * Names are short and non-obvious (`tid`, `perms`) because this is JWT convention and because
+ * the token travels on every request — the registered claims are three characters for the same
+ * reason.
+ *
+ * **Permissions are embedded rather than resolved per request.** That is the whole point of a
+ * JWT here: any Iveri service verifies a token with the shared secret and never calls identity
+ * on the hot path. The cost is staleness — revoking a role does not invalidate access tokens
+ * already issued, so a removed permission survives up to identity's `JWT_ACCESS_TOKEN_TTL`
+ * (15 minutes by default), or `JWT_SERVICE_TOKEN_TTL` for a service token. Anything needing
+ * immediate revocation must check state at the point of use, not rely on the token.
+ */
+export interface AccessTokenPayload {
+    /**
+     * Subject — **the principal**, which is a user id or an API key id depending on {@link pt}.
+     *
+     * Read it together with `pt` or not at all. Treating it as a user id unconditionally is the
+     * one mistake this shape is arranged to prevent.
+     */
+    sub: UUID;
+    /**
+     * Which kind of principal `sub` names.
+     *
+     * Required, so adding the service-token path could not silently leave a consumer reading a
+     * machine's `sub` as a person's id.
+     */
+    pt: PrincipalType;
+    /** Tenant the token is scoped to. Becomes `RequestContext.tenantId`; never trusted from a header. */
+    tid: UUID;
+    /** Permissions resolved from the principal's roles — or from the API key's grant — at issue time. */
+    perms: UserPermission[];
+    /** Issued-at, seconds since epoch. Set by the signer. */
+    iat?: number;
+    /** Expiry, seconds since epoch. Set by the signer. */
+    exp?: number;
+    /** Issuer, verified on every decode so a token from another Iveri environment is rejected. */
+    iss?: string;
+    /** Audience, verified alongside `iss`. */
+    aud?: string;
+}
+//# sourceMappingURL=access-token-payload.interface.d.ts.map

package/dist/cjs/api/identity/access-token-payload.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-token-payload.interface.d.ts","sourceRoot":"","sources":["../../../../src/api/identity/access-token-payload.interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,kBAAkB;IAC/B;;;;;OAKG;IACH,GAAG,EAAE,IAAI,CAAC;IAEV;;;;;OAKG;IACH,EAAE,EAAE,aAAa,CAAC;IAElB,qGAAqG;IACrG,GAAG,EAAE,IAAI,CAAC;IAEV,qGAAqG;IACrG,KAAK,EAAE,cAAc,EAAE,CAAC;IAExB,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,sDAAsD;IACtD,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,8FAA8F;IAC9F,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,0CAA0C;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;CAChB"}

package/dist/cjs/api/identity/access-token-payload.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=access-token-payload.interface.js.map

package/dist/cjs/api/identity/access-token-payload.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-token-payload.interface.js","sourceRoot":"","sources":["../../../../src/api/identity/access-token-payload.interface.ts"],"names":[],"mappings":""}

package/dist/cjs/api/identity/auth.type.d.ts

@@ -51,6 +51,27 @@ export interface AuthTokens {
     /** Lifetime of `accessToken` in seconds, not of `refreshToken`. */
     expiresInSeconds: number;
 }
+/**
+ * Returned by `POST /auth/token` — the API-key-for-JWT exchange a service makes so that other
+ * Iveri services can authorize it **without calling identity**.
+ *
+ * **There is deliberately no refresh token.** The API key already is the long-lived credential,
+ * and it is revocable by a row. A refresh token here would be a second long-lived credential
+ * with its own independent lifetime, rotation rule and leak story, obtained from the first —
+ * so revoking the key would no longer be enough to stop the caller. A service re-exchanges
+ * instead, which costs one call per {@link expiresInSeconds}.
+ *
+ * The key travels as `x-api-key`, so this call has no request body.
+ */
+export interface ServiceToken {
+    /** Send as `Authorization: Bearer <accessToken>`. Carries `pt: 'service'`. */
+    accessToken: string;
+    /**
+     * Lifetime in seconds. Shorter than a human session's: a service re-exchanges with nobody
+     * waiting, so the revocation window is cheap to shrink.
+     */
+    expiresInSeconds: number;
+}
 /**
  * Who the caller is. Returned by `GET /auth/me` and nested inside {@link AuthSession}.
  *

package/dist/cjs/api/identity/auth.type.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.type.d.ts","sourceRoot":"","sources":["../../../../src/api/identity/auth.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE5D,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACvB,UAAU,EAAE,MAAM,CAAC;IAEnB,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAC;IAEnB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,0BAA0B;AAC1B,MAAM,WAAW,SAAS;IACtB;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,oDAAoD;AACpD,MAAM,WAAW,gBAAgB;IAC7B,YAAY,EAAE,MAAM,CAAC;CACxB;AAED,iGAAiG;AACjG,MAAM,WAAW,oBAAoB;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,+EAA+E;AAC/E,MAAM,WAAW,UAAU;IACvB,qDAAqD;IACrD,WAAW,EAAE,MAAM,CAAC;IAEpB;;;;;;;;OAQG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB,mEAAmE;IACnE,gBAAgB,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,SAAS;IACtB,qCAAqC;IACrC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAEvB,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxB,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5B,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE3B,QAAQ,EAAE,IAAI,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,YAAY,CAAC;IAE3B,qCAAqC;IACrC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAE7C,SAAS,EAAE,MAAM,EAAE,CAAC;IAEpB,gEAAgE;IAChE,WAAW,EAAE,cAAc,EAAE,CAAC;CACjC;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IACxB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,UAAU,CAAC;CACtB"}
+{"version":3,"file":"auth.type.d.ts","sourceRoot":"","sources":["../../../../src/api/identity/auth.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE5D,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACvB,UAAU,EAAE,MAAM,CAAC;IAEnB,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAC;IAEnB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,0BAA0B;AAC1B,MAAM,WAAW,SAAS;IACtB;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,oDAAoD;AACpD,MAAM,WAAW,gBAAgB;IAC7B,YAAY,EAAE,MAAM,CAAC;CACxB;AAED,iGAAiG;AACjG,MAAM,WAAW,oBAAoB;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,+EAA+E;AAC/E,MAAM,WAAW,UAAU;IACvB,qDAAqD;IACrD,WAAW,EAAE,MAAM,CAAC;IAEpB;;;;;;;;OAQG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB,mEAAmE;IACnE,gBAAgB,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IACzB,8EAA8E;IAC9E,WAAW,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,gBAAgB,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,SAAS;IACtB,qCAAqC;IACrC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAEvB,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxB,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5B,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE3B,QAAQ,EAAE,IAAI,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,YAAY,CAAC;IAE3B,qCAAqC;IACrC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAE7C,SAAS,EAAE,MAAM,EAAE,CAAC;IAEpB,gEAAgE;IAChE,WAAW,EAAE,cAAc,EAAE,CAAC;CACjC;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IACxB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,UAAU,CAAC;CACtB"}

package/dist/cjs/api/identity/index.d.ts

@@ -1,4 +1,6 @@
+export * from './access-token-payload.interface.js';
 export * from './auth.type.js';
 export * from './membership-status.enum.js';
+export * from './principal-type.enum.js';
 export * from './tenant-status.enum.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/cjs/api/identity/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/api/identity/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/api/identity/index.ts"],"names":[],"mappings":"AAAA,cAAc,qCAAqC,CAAC;AACpD,cAAc,gBAAgB,CAAC;AAC/B,cAAc,6BAA6B,CAAC;AAC5C,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC"}

package/dist/cjs/api/identity/index.js

@@ -14,7 +14,9 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./access-token-payload.interface.js"), exports);
 __exportStar(require("./auth.type.js"), exports);
 __exportStar(require("./membership-status.enum.js"), exports);
+__exportStar(require("./principal-type.enum.js"), exports);
 __exportStar(require("./tenant-status.enum.js"), exports);
 //# sourceMappingURL=index.js.map

package/dist/cjs/api/identity/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/api/identity/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,8DAA4C;AAC5C,0DAAwC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/api/identity/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sEAAoD;AACpD,iDAA+B;AAC/B,8DAA4C;AAC5C,2DAAyC;AACzC,0DAAwC"}

package/dist/cjs/api/identity/principal-type.enum.d.ts

@@ -0,0 +1,19 @@
+/**
+ * What kind of principal an access token was minted for.
+ *
+ * It exists because `sub` alone cannot answer the question. A JWT's subject is *the principal*,
+ * and identity issues tokens for two kinds of them: a person who logged in, and a service that
+ * exchanged an API key. Both put a UUID in `sub`, and the two UUIDs mean entirely different
+ * things — one names a row in `user`, the other a row in `api_key`.
+ *
+ * A consumer that reads `sub` as a user id without checking this claim attributes a machine's
+ * actions to a user who does not exist. That is why every guard branches on it, and why it is
+ * required rather than optional: `tsc` then makes the branch impossible to forget.
+ */
+export declare enum PrincipalType {
+    /** A person, authenticated by password. `sub` is their `user.id`. */
+    USER = "user",
+    /** A service, authenticated by API key. `sub` is the `api_key.id`, and there is no user. */
+    SERVICE = "service"
+}
+//# sourceMappingURL=principal-type.enum.d.ts.map

package/dist/cjs/api/identity/principal-type.enum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal-type.enum.d.ts","sourceRoot":"","sources":["../../../../src/api/identity/principal-type.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,oBAAY,aAAa;IACrB,qEAAqE;IACrE,IAAI,SAAS;IAEb,4FAA4F;IAC5F,OAAO,YAAY;CACtB"}

package/dist/cjs/api/identity/principal-type.enum.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PrincipalType = void 0;
+/**
+ * What kind of principal an access token was minted for.
+ *
+ * It exists because `sub` alone cannot answer the question. A JWT's subject is *the principal*,
+ * and identity issues tokens for two kinds of them: a person who logged in, and a service that
+ * exchanged an API key. Both put a UUID in `sub`, and the two UUIDs mean entirely different
+ * things — one names a row in `user`, the other a row in `api_key`.
+ *
+ * A consumer that reads `sub` as a user id without checking this claim attributes a machine's
+ * actions to a user who does not exist. That is why every guard branches on it, and why it is
+ * required rather than optional: `tsc` then makes the branch impossible to forget.
+ */
+var PrincipalType;
+(function (PrincipalType) {
+    /** A person, authenticated by password. `sub` is their `user.id`. */
+    PrincipalType["USER"] = "user";
+    /** A service, authenticated by API key. `sub` is the `api_key.id`, and there is no user. */
+    PrincipalType["SERVICE"] = "service";
+})(PrincipalType || (exports.PrincipalType = PrincipalType = {}));
+//# sourceMappingURL=principal-type.enum.js.map

package/dist/cjs/api/identity/principal-type.enum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal-type.enum.js","sourceRoot":"","sources":["../../../../src/api/identity/principal-type.enum.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;GAWG;AACH,IAAY,aAMX;AAND,WAAY,aAAa;IACrB,qEAAqE;IACrE,8BAAa,CAAA;IAEb,4FAA4F;IAC5F,oCAAmB,CAAA;AACvB,CAAC,EANW,aAAa,6BAAb,aAAa,QAMxB"}

package/dist/cjs/enum/user-permission.enum.d.ts

@@ -89,7 +89,46 @@ export declare enum UserPermission {
      * read: it causes an outbound request rather than returning a row, and redriving a large
      * dead-letter backlog is a way to flood a customer's own service.
      */
-    CONDUIT_DELIVERY_OPERATE = "conduit:delivery:operate"
+    CONDUIT_DELIVERY_OPERATE = "conduit:delivery:operate",
+    /** Read connector manifests. They hold no credential, so this is configuration only. */
+    CONDUIT_CONNECTOR_READ = "conduit:connector:read",
+    /**
+     * Define or amend a connector manifest — **the list of hosts and paths Conduit may be asked
+     * to call**, and the token endpoint it will send a customer's client secret to.
+     *
+     * The most powerful permission in the outbound half. A dispatch cannot name a URL; it can
+     * only name an operation somebody with this permission wrote down, which is what keeps
+     * outbound from being an authenticated open proxy. Whoever holds this decides where the
+     * proxy may point.
+     */
+    CONDUIT_CONNECTOR_MANAGE = "conduit:connector:manage",
+    /** Read connections. Never exposes their stored credential values. */
+    CONDUIT_CONNECTION_READ = "conduit:connection:read",
+    /**
+     * Create, amend or delete a connection — the customer's own third-party credentials.
+     *
+     * Single manage permission rather than create/update/delete: the dangerous act is holding
+     * the credential at all, and the three carry the same risk.
+     */
+    CONDUIT_CONNECTION_MANAGE = "conduit:connection:manage",
+    /**
+     * Read the outbound log and its dead-letter queue, including each attempt's response.
+     *
+     * A dispatch record holds the payload a vertical asked to send — a customer's message text,
+     * an order — so this is a data-read permission, not a config one.
+     */
+    CONDUIT_DISPATCH_READ = "conduit:dispatch:read",
+    /**
+     * Submit an outbound request. **This is the permission a vertical holds**, and the only one
+     * it needs: `unibox-api` sending a reply presents this and nothing else.
+     *
+     * Separate from `CONDUIT_DISPATCH_OPERATE` because sending is the routine act and operating
+     * the queue is the exceptional one — a service principal that can send should not also be
+     * able to redrive a backlog.
+     */
+    CONDUIT_DISPATCH_SEND = "conduit:dispatch:send",
+    /** Redrive a dead-lettered dispatch, or cancel one still pending. */
+    CONDUIT_DISPATCH_OPERATE = "conduit:dispatch:operate"
 }
 /**
  * Every member, for seeding the owner role and validating custom-role input.

package/dist/cjs/enum/user-permission.enum.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-permission.enum.d.ts","sourceRoot":"","sources":["../../../src/enum/user-permission.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,oBAAY,cAAc;IAItB,WAAW,gBAAgB;IAC3B,aAAa,kBAAkB;IAC/B,sFAAsF;IACtF,aAAa,kBAAkB;IAG/B,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAG3B,eAAe,oBAAoB;IACnC,6EAA6E;IAC7E,iBAAiB,sBAAsB;IACvC;;;OAGG;IACH,sBAAsB,2BAA2B;IAGjD,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAG3B,YAAY,iBAAiB;IAC7B,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;IAKjC,qEAAqE;IACrE,qBAAqB,0BAA0B;IAC/C,uBAAuB,4BAA4B;IACnD,uBAAuB,4BAA4B;IACnD,uBAAuB,4BAA4B;IAGnD;;;;OAIG;IACH,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IAGjD;;;;OAIG;IACH,sBAAsB,2BAA2B;IAGjD,qBAAqB,0BAA0B;IAC/C,yFAAyF;IACzF,uBAAuB,4BAA4B;IAGnD,mEAAmE;IACnE,wBAAwB,6BAA6B;IACrD;;;;;;;OAOG;IACH,0BAA0B,+BAA+B;IAGzD,kBAAkB,uBAAuB;IACzC,2DAA2D;IAC3D,oBAAoB,yBAAyB;IAG7C;;;;;OAKG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;;OAMG;IACH,wBAAwB,6BAA6B;CACxD;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,cAAc,EAAiD,CAAC"}
+{"version":3,"file":"user-permission.enum.d.ts","sourceRoot":"","sources":["../../../src/enum/user-permission.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,oBAAY,cAAc;IAItB,WAAW,gBAAgB;IAC3B,aAAa,kBAAkB;IAC/B,sFAAsF;IACtF,aAAa,kBAAkB;IAG/B,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAG3B,eAAe,oBAAoB;IACnC,6EAA6E;IAC7E,iBAAiB,sBAAsB;IACvC;;;OAGG;IACH,sBAAsB,2BAA2B;IAGjD,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAG3B,YAAY,iBAAiB;IAC7B,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;IAKjC,qEAAqE;IACrE,qBAAqB,0BAA0B;IAC/C,uBAAuB,4BAA4B;IACnD,uBAAuB,4BAA4B;IACnD,uBAAuB,4BAA4B;IAGnD;;;;OAIG;IACH,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IAGjD;;;;OAIG;IACH,sBAAsB,2BAA2B;IAGjD,qBAAqB,0BAA0B;IAC/C,yFAAyF;IACzF,uBAAuB,4BAA4B;IAGnD,mEAAmE;IACnE,wBAAwB,6BAA6B;IACrD;;;;;;;OAOG;IACH,0BAA0B,+BAA+B;IAGzD,kBAAkB,uBAAuB;IACzC,2DAA2D;IAC3D,oBAAoB,yBAAyB;IAG7C;;;;;OAKG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;;OAMG;IACH,wBAAwB,6BAA6B;IAGrD,wFAAwF;IACxF,sBAAsB,2BAA2B;IACjD;;;;;;;;OAQG;IACH,wBAAwB,6BAA6B;IAGrD,sEAAsE;IACtE,uBAAuB,4BAA4B;IACnD;;;;;OAKG;IACH,yBAAyB,8BAA8B;IAGvD;;;;;OAKG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;;;OAOG;IACH,qBAAqB,0BAA0B;IAC/C,qEAAqE;IACrE,wBAAwB,6BAA6B;CACxD;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,cAAc,EAAiD,CAAC"}

package/dist/cjs/enum/user-permission.enum.js

@@ -108,6 +108,48 @@ var UserPermission;
      * dead-letter backlog is a way to flood a customer's own service.
      */
     UserPermission["CONDUIT_DELIVERY_OPERATE"] = "conduit:delivery:operate";
+    // ── Connector (outbound) ────────────────────────────────────────────────
+    /** Read connector manifests. They hold no credential, so this is configuration only. */
+    UserPermission["CONDUIT_CONNECTOR_READ"] = "conduit:connector:read";
+    /**
+     * Define or amend a connector manifest — **the list of hosts and paths Conduit may be asked
+     * to call**, and the token endpoint it will send a customer's client secret to.
+     *
+     * The most powerful permission in the outbound half. A dispatch cannot name a URL; it can
+     * only name an operation somebody with this permission wrote down, which is what keeps
+     * outbound from being an authenticated open proxy. Whoever holds this decides where the
+     * proxy may point.
+     */
+    UserPermission["CONDUIT_CONNECTOR_MANAGE"] = "conduit:connector:manage";
+    // ── Connection (outbound) ───────────────────────────────────────────────
+    /** Read connections. Never exposes their stored credential values. */
+    UserPermission["CONDUIT_CONNECTION_READ"] = "conduit:connection:read";
+    /**
+     * Create, amend or delete a connection — the customer's own third-party credentials.
+     *
+     * Single manage permission rather than create/update/delete: the dangerous act is holding
+     * the credential at all, and the three carry the same risk.
+     */
+    UserPermission["CONDUIT_CONNECTION_MANAGE"] = "conduit:connection:manage";
+    // ── Dispatch (outbound) ─────────────────────────────────────────────────
+    /**
+     * Read the outbound log and its dead-letter queue, including each attempt's response.
+     *
+     * A dispatch record holds the payload a vertical asked to send — a customer's message text,
+     * an order — so this is a data-read permission, not a config one.
+     */
+    UserPermission["CONDUIT_DISPATCH_READ"] = "conduit:dispatch:read";
+    /**
+     * Submit an outbound request. **This is the permission a vertical holds**, and the only one
+     * it needs: `unibox-api` sending a reply presents this and nothing else.
+     *
+     * Separate from `CONDUIT_DISPATCH_OPERATE` because sending is the routine act and operating
+     * the queue is the exceptional one — a service principal that can send should not also be
+     * able to redrive a backlog.
+     */
+    UserPermission["CONDUIT_DISPATCH_SEND"] = "conduit:dispatch:send";
+    /** Redrive a dead-lettered dispatch, or cancel one still pending. */
+    UserPermission["CONDUIT_DISPATCH_OPERATE"] = "conduit:dispatch:operate";
 })(UserPermission || (exports.UserPermission = UserPermission = {}));
 /**
  * Every member, for seeding the owner role and validating custom-role input.

package/dist/cjs/enum/user-permission.enum.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-permission.enum.js","sourceRoot":"","sources":["../../../src/enum/user-permission.enum.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,IAAY,cAqGX;AArGD,WAAY,cAAc;IACtB,4EAA4E;IAE5E,2EAA2E;IAC3E,6CAA2B,CAAA;IAC3B,iDAA+B,CAAA;IAC/B,sFAAsF;IACtF,iDAA+B,CAAA;IAE/B,2EAA2E;IAC3E,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAE3B,2EAA2E;IAC3E,qDAAmC,CAAA;IACnC,6EAA6E;IAC7E,yDAAuC,CAAA;IACvC;;;OAGG;IACH,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAE3B,2EAA2E;IAC3E,+CAA6B,CAAA;IAC7B,iDAA+B,CAAA;IAC/B,mDAAiC,CAAA;IAEjC,4EAA4E;IAE5E,2EAA2E;IAC3E,qEAAqE;IACrE,iEAA+C,CAAA;IAC/C,qEAAmD,CAAA;IACnD,qEAAmD,CAAA;IACnD,qEAAmD,CAAA;IAEnD,2EAA2E;IAC3E;;;;OAIG;IACH,+DAA6C,CAAA;IAC7C,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E;;;;OAIG;IACH,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E,iEAA+C,CAAA;IAC/C,yFAAyF;IACzF,qEAAmD,CAAA;IAEnD,2EAA2E;IAC3E,mEAAmE;IACnE,uEAAqD,CAAA;IACrD;;;;;;;OAOG;IACH,2EAAyD,CAAA;IAEzD,2EAA2E;IAC3E,2DAAyC,CAAA;IACzC,2DAA2D;IAC3D,+DAA6C,CAAA;IAE7C,2EAA2E;IAC3E;;;;;OAKG;IACH,iEAA+C,CAAA;IAC/C;;;;;;OAMG;IACH,uEAAqD,CAAA;AACzD,CAAC,EArGW,cAAc,8BAAd,cAAc,QAqGzB;AAED;;;;;GAKG;AACU,QAAA,oBAAoB,GAA8B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC"}
+{"version":3,"file":"user-permission.enum.js","sourceRoot":"","sources":["../../../src/enum/user-permission.enum.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,IAAY,cAkJX;AAlJD,WAAY,cAAc;IACtB,4EAA4E;IAE5E,2EAA2E;IAC3E,6CAA2B,CAAA;IAC3B,iDAA+B,CAAA;IAC/B,sFAAsF;IACtF,iDAA+B,CAAA;IAE/B,2EAA2E;IAC3E,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAE3B,2EAA2E;IAC3E,qDAAmC,CAAA;IACnC,6EAA6E;IAC7E,yDAAuC,CAAA;IACvC;;;OAGG;IACH,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAE3B,2EAA2E;IAC3E,+CAA6B,CAAA;IAC7B,iDAA+B,CAAA;IAC/B,mDAAiC,CAAA;IAEjC,4EAA4E;IAE5E,2EAA2E;IAC3E,qEAAqE;IACrE,iEAA+C,CAAA;IAC/C,qEAAmD,CAAA;IACnD,qEAAmD,CAAA;IACnD,qEAAmD,CAAA;IAEnD,2EAA2E;IAC3E;;;;OAIG;IACH,+DAA6C,CAAA;IAC7C,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E;;;;OAIG;IACH,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E,iEAA+C,CAAA;IAC/C,yFAAyF;IACzF,qEAAmD,CAAA;IAEnD,2EAA2E;IAC3E,mEAAmE;IACnE,uEAAqD,CAAA;IACrD;;;;;;;OAOG;IACH,2EAAyD,CAAA;IAEzD,2EAA2E;IAC3E,2DAAyC,CAAA;IACzC,2DAA2D;IAC3D,+DAA6C,CAAA;IAE7C,2EAA2E;IAC3E;;;;;OAKG;IACH,iEAA+C,CAAA;IAC/C;;;;;;OAMG;IACH,uEAAqD,CAAA;IAErD,2EAA2E;IAC3E,wFAAwF;IACxF,mEAAiD,CAAA;IACjD;;;;;;;;OAQG;IACH,uEAAqD,CAAA;IAErD,2EAA2E;IAC3E,sEAAsE;IACtE,qEAAmD,CAAA;IACnD;;;;;OAKG;IACH,yEAAuD,CAAA;IAEvD,2EAA2E;IAC3E;;;;;OAKG;IACH,iEAA+C,CAAA;IAC/C;;;;;;;OAOG;IACH,iEAA+C,CAAA;IAC/C,qEAAqE;IACrE,uEAAqD,CAAA;AACzD,CAAC,EAlJW,cAAc,8BAAd,cAAc,QAkJzB;AAED;;;;;GAKG;AACU,QAAA,oBAAoB,GAA8B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC"}

package/dist/esm/api/conduit/connection.type.d.ts

@@ -0,0 +1,100 @@
+import type { IsoDateTime } from '../../type/iso-date-time.type.js';
+import type { Nullable } from '../../type/nil.type.js';
+import type { UUID } from '../../type/uuid.type.js';
+/**
+ * One tenant's configured instance of a connector: the credentials and the account details that
+ * turn a manifest into something that can actually send.
+ *
+ * The split is the reason a manifest can ship in the binary. A connector says "WhatsApp Cloud
+ * lives at graph.facebook.com and authenticates with a bearer token"; a connection says "and
+ * *this* is our token, for *this* phone number". One is ours and identical for everybody; the
+ * other is the customer's and is the single most sensitive thing this service holds.
+ *
+ * **No endpoint of this API returns a credential value**, in any form — not masked, not
+ * truncated, not a length. `credentialNames` answers the only question an operator has, which is
+ * whether something is configured. Same control as a destination's headers and an endpoint's
+ * signing secret, for the same reason: §11 says one leak ends the company.
+ */
+export interface Connection {
+    id: UUID;
+    /** Stable identifier a dispatch names instead of an id, so callers can be configured by name. */
+    key: string;
+    name: string;
+    description: Nullable<string>;
+    /** The manifest this connection instantiates. Built-in or tenant-defined. */
+    connectorKey: string;
+    /** Sorted. **The values are never returned by any endpoint of this API.** */
+    credentialNames: string[];
+    /**
+     * Non-secret values filling `{placeholders}` in an operation path — a phone number id, an
+     * account id, an API version.
+     *
+     * Deliberately separate from credentials rather than one map with a secrecy flag: a flag is
+     * a thing somebody sets wrong once, and the failure mode is a token in a response body.
+     * Variables are returned in full because they are the part an operator needs to check.
+     */
+    variables: Record<string, string>;
+    /**
+     * When the cached OAuth access token stops being usable, or null when there is none —
+     * either because the connector authenticates statically or because nothing has fetched one
+     * yet.
+     *
+     * The expiry is returned, the token is not. It is what makes "why is this connection
+     * failing" answerable without exposing anything.
+     */
+    accessTokenExpiresAt: Nullable<IsoDateTime>;
+    /**
+     * Why the last authentication attempt failed, or null when the last one worked.
+     *
+     * A refresh token that a provider has revoked is the most common real failure on this
+     * aggregate, and it is invisible otherwise: dispatches simply dead-letter with a 401 and
+     * nothing points at the connection.
+     */
+    lastAuthError: Nullable<string>;
+    /** Stops *new* dispatches being accepted. Does not cancel ones already queued. */
+    isActive: boolean;
+    createdAt: IsoDateTime;
+    updatedAt: IsoDateTime;
+}
+/** `GET /api/v1/connections`. Offset-paginated — a small, slow-moving collection. */
+export interface ConnectionsPage {
+    items: Connection[];
+    total: number;
+    limit: number;
+    offset: number;
+}
+/** `POST /api/v1/connections`. */
+export interface CreateConnectionBody {
+    key: string;
+    name: string;
+    description?: Nullable<string>;
+    connectorKey: string;
+    /**
+     * Secrets this connection authenticates with. **Stored encrypted and never returned.**
+     *
+     * Which names are expected depends on the connector's auth type: an `API_KEY_HEADER`
+     * manifest names its own, an OAuth one wants `clientId`/`clientSecret` and, for the refresh
+     * grant, `refreshToken`.
+     */
+    credentials: Record<string, string>;
+    variables?: Nullable<Record<string, string>>;
+}
+/**
+ * `PATCH /api/v1/connections/:id`.
+ *
+ * **`credentials` has three states, not two.** Omitting it leaves the stored map untouched,
+ * `null` clears it, an object replaces it wholesale. A form that sends `{}` meaning "unchanged"
+ * deletes the customer's token, and the symptom is every dispatch dead-lettering on a 401.
+ *
+ * Replacing credentials also discards the cached access token: a token minted from the old
+ * client secret is not evidence that the new one works, and keeping it would hide a typo until
+ * the token happened to expire.
+ */
+export interface UpdateConnectionBody {
+    name?: string;
+    description?: Nullable<string>;
+    credentials?: Nullable<Record<string, string>>;
+    variables?: Nullable<Record<string, string>>;
+    isActive?: boolean;
+}
+//# sourceMappingURL=connection.type.d.ts.map

package/dist/esm/api/conduit/connection.type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.type.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/connection.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,UAAU;IACvB,EAAE,EAAE,IAAI,CAAC;IAET,iGAAiG;IACjG,GAAG,EAAE,MAAM,CAAC;IAEZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE9B,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAC;IAErB,6EAA6E;IAC7E,eAAe,EAAE,MAAM,EAAE,CAAC;IAE1B;;;;;;;OAOG;IACH,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAElC;;;;;;;OAOG;IACH,oBAAoB,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IAE5C;;;;;;OAMG;IACH,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEhC,kFAAkF;IAClF,QAAQ,EAAE,OAAO,CAAC;IAElB,SAAS,EAAE,WAAW,CAAC;IACvB,SAAS,EAAE,WAAW,CAAC;CAC1B;AAED,qFAAqF;AACrF,MAAM,WAAW,eAAe;IAC5B,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAClB;AAED,kCAAkC;AAClC,MAAM,WAAW,oBAAoB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC;IAErB;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEpC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAChD;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,oBAAoB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7C,QAAQ,CAAC,EAAE,OAAO,CAAC;CACtB"}

package/dist/esm/api/conduit/connection.type.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=connection.type.js.map

package/dist/esm/api/conduit/connection.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.type.js","sourceRoot":"","sources":["../../../../src/api/conduit/connection.type.ts"],"names":[],"mappings":""}