@salesforce/b2c-tooling-sdk 2.1.0 → 2.3.0

package/data/xsd/order.xsd

@@ -33,6 +33,9 @@
                     fields account-id and account-type are exported. Since version 22.9 details to a 
                     Salesforce Payments payment are no longer exported in a custom method element.
                     Since version 26.5 multi-level tax items can be exported for line items.
+                    Since version 26.9 custom attributes are exported for tax items.
+                    Since version 26.10 payment-details, fraud-decisions and transaction-details
+                    elements can be exported per payment.
                 </xsd:documentation>
             </xsd:annotation>
             <xsd:enumeration value="18.5" />
@@ -45,6 +48,8 @@
             <xsd:enumeration value="22.9" />
             <xsd:enumeration value="23.4" />
             <xsd:enumeration value="26.5" />
+            <xsd:enumeration value="26.9" />
+            <xsd:enumeration value="26.10" />
         </xsd:restriction>
     </xsd:simpleType>
 
@@ -230,6 +235,8 @@
                     <xsd:documentation>Tax amount in purchase currency.</xsd:documentation>
                 </xsd:annotation>
             </xsd:element>
+            <!-- Since 26.9: custom attributes on a tax item -->
+            <xsd:element name="custom-attributes" type="sharedType.CustomAttributes" minOccurs="0"/>
         </xsd:sequence>
     </xsd:complexType>
 
@@ -631,6 +638,23 @@
                 <xsd:element name="custom-method" type="complexType.CustomPaymentMethod" />
             </xsd:choice>
 
+            <xsd:element name="payment-details" type="complexType.PaymentDetails" minOccurs="0" maxOccurs="1">
+                <xsd:annotation>
+                    <xsd:documentation>
+                    Since version 26.10.
+                    The normalized payment details for the order payment instrument.
+                    </xsd:documentation>
+                </xsd:annotation>
+            </xsd:element>
+            <xsd:element name="fraud-decisions" type="complexType.FraudDecisions" minOccurs="0" maxOccurs="1">
+                <xsd:annotation>
+                    <xsd:documentation>
+                    Since version 26.10.
+                    The normalized fraud decisions for the order payment instrument.
+                    </xsd:documentation>
+                </xsd:annotation>
+            </xsd:element>
+
             <!--  payment transaction details -->
             <xsd:element name="amount" type="xsd:decimal" minOccurs="0" maxOccurs="1"/>
             <xsd:element name="processor-id" type="simpleType.Generic.NonEmptyString.256" minOccurs="0" maxOccurs="1" />
@@ -652,6 +676,14 @@
                     </xsd:documentation>
                 </xsd:annotation>
             </xsd:element>
+            <xsd:element name="transaction-details" type="complexType.TransactionDetails" minOccurs="0" maxOccurs="1">
+                <xsd:annotation>
+                    <xsd:documentation>
+                    Since version 26.10.
+                    The normalized transaction details for the order payment transaction.
+                    </xsd:documentation>
+                </xsd:annotation>
+            </xsd:element>
             <xsd:element name="custom-attributes" type="sharedType.CustomAttributes" minOccurs="0" maxOccurs="1">
                 <xsd:annotation>
                     <xsd:documentation>These are the custom attributes of the PaymentTransaction system object.</xsd:documentation>
@@ -1168,6 +1200,54 @@
         </xsd:restriction>
     </xsd:simpleType>
 
+    <xsd:simpleType name="simpleType.Generic.NonEmptyString.4">
+        <xsd:restriction base="simpleType.Generic.String">
+            <xsd:minLength value="1" />
+            <xsd:maxLength value="4" />
+            <xsd:pattern value="\S|(\S(.*)\S)" />
+        </xsd:restriction>
+    </xsd:simpleType>
+
+    <xsd:simpleType name="simpleType.Generic.NonEmptyString.8">
+        <xsd:restriction base="simpleType.Generic.String">
+            <xsd:minLength value="1" />
+            <xsd:maxLength value="8" />
+            <xsd:pattern value="\S|(\S(.*)\S)" />
+        </xsd:restriction>
+    </xsd:simpleType>
+
+    <xsd:simpleType name="simpleType.Generic.NonEmptyString.1">
+        <xsd:restriction base="simpleType.Generic.String">
+            <xsd:minLength value="1" />
+            <xsd:maxLength value="1" />
+            <xsd:pattern value="\S" />
+        </xsd:restriction>
+    </xsd:simpleType>
+
+    <xsd:simpleType name="simpleType.Generic.NonEmptyString.2">
+        <xsd:restriction base="simpleType.Generic.String">
+            <xsd:minLength value="1" />
+            <xsd:maxLength value="2" />
+            <xsd:pattern value="\S|(\S(.*)\S)" />
+        </xsd:restriction>
+    </xsd:simpleType>
+
+    <xsd:simpleType name="simpleType.Generic.NonEmptyString.3">
+        <xsd:restriction base="simpleType.Generic.String">
+            <xsd:minLength value="1" />
+            <xsd:maxLength value="3" />
+            <xsd:pattern value="\S|(\S(.*)\S)" />
+        </xsd:restriction>
+    </xsd:simpleType>
+
+    <xsd:simpleType name="simpleType.Generic.NonEmptyString.20">
+        <xsd:restriction base="simpleType.Generic.String">
+            <xsd:minLength value="1" />
+            <xsd:maxLength value="20" />
+            <xsd:pattern value="\S|(\S(.*)\S)" />
+        </xsd:restriction>
+    </xsd:simpleType>
+
     <xsd:simpleType name="simpleType.Generic.NonEmptyString.40">
         <xsd:restriction base="simpleType.Generic.String">
             <xsd:minLength value="1" />
@@ -1224,6 +1304,243 @@
         </xsd:restriction>
     </xsd:simpleType>
 
+    <xsd:complexType name="complexType.PaymentDetails">
+        <xsd:annotation>
+            <xsd:documentation>
+                Since version 26.10.
+                Normalized payment details for the order payment instrument. Specific fields are populated depending on
+                the type value.
+            </xsd:documentation>
+        </xsd:annotation>
+        <xsd:sequence>
+            <xsd:element name="brand" type="simpleType.Generic.NonEmptyString.20" minOccurs="0" maxOccurs="1">
+                <xsd:annotation>
+                    <xsd:documentation>
+                    The normalized card brand. Expected values are amex, diners, discover, jcb,
+                    mastercard, unionpay, visa, and unknown. A custom value may also be returned.
+                    </xsd:documentation>
+                </xsd:annotation>
+            </xsd:element>
+            <xsd:element name="last-4" type="simpleType.Generic.NonEmptyString.4" minOccurs="0" maxOccurs="1">
+                <xsd:annotation>
+                    <xsd:documentation>
+                    The last four digits of the payment instrument.
+                    </xsd:documentation>
+                </xsd:annotation>
+            </xsd:element>
+            <xsd:element name="wallet-type" type="simpleType.Generic.NonEmptyString.20" minOccurs="0" maxOccurs="1">
+                <xsd:annotation>
+                    <xsd:documentation>
+                    The normalized digital wallet used for the payment. Expected values are
+                    apple_pay and google_pay. A custom value may also be returned.
+                    </xsd:documentation>
+                </xsd:annotation>
+            </xsd:element>
+            <xsd:element name="expiration-month" type="simpleType.PaymentDetails.ExpirationMonth" minOccurs="0" maxOccurs="1">
+                <xsd:annotation>
+                    <xsd:documentation>
+                    The month when the payment instrument expires.
+                    </xsd:documentation>
+                </xsd:annotation>
+            </xsd:element>
+            <xsd:element name="expiration-year" type="xsd:int" minOccurs="0" maxOccurs="1">
+                <xsd:annotation>
+                    <xsd:documentation>
+                    The year when the payment instrument expires.
+                    </xsd:documentation>
+                </xsd:annotation>
+            </xsd:element>
+            <xsd:element name="token" type="simpleType.Generic.NonEmptyString.40" minOccurs="0" maxOccurs="1">
+                <xsd:annotation>
+                    <xsd:documentation>
+                    The reference token representing the payment instrument. This is an opaque
+                    identifier, not the card number (PAN).
+                    </xsd:documentation>
+                </xsd:annotation>
+            </xsd:element>
+            <xsd:element name="token-type" type="simpleType.Generic.NonEmptyString.20" minOccurs="0" maxOccurs="1">
+                <xsd:annotation>
+                    <xsd:documentation>
+                    The type of token backing the reference token. Expected values are NETWORK
+                    and GATEWAY. A custom value may also be returned.
+                    </xsd:documentation>
+                </xsd:annotation>
+            </xsd:element>
+            <xsd:element name="account-holder-name" type="simpleType.Generic.NonEmptyString.256" minOccurs="0" maxOccurs="1">
+                <xsd:annotation>
+                    <xsd:documentation>
+                    The name of the payment instrument account holder.
+                    </xsd:documentation>
+                </xsd:annotation>
+            </xsd:element>
+            <xsd:element name="bin" type="simpleType.Generic.NonEmptyString.8" minOccurs="0" maxOccurs="1">
+                <xsd:annotation>
+                    <xsd:documentation>
+                    The bank identification number (BIN) of the payment card.
+                    </xsd:documentation>
+                </xsd:annotation>
+            </xsd:element>
+            <xsd:element name="dpan-last-4" type="simpleType.Generic.NonEmptyString.4" minOccurs="0" maxOccurs="1">
+                <xsd:annotation>
+                    <xsd:documentation>
+                    The last four digits of the device primary account number for a
+                    wallet-tokenized card.
+                    </xsd:documentation>
+                </xsd:annotation>
+            </xsd:element>
+            <xsd:element name="issuing-country" type="simpleType.CountryCode" minOccurs="0" maxOccurs="1">
+                <xsd:annotation>
+                    <xsd:documentation>
+                    The ISO 3166-1 alpha-2 country code of the issuing bank.
+                    </xsd:documentation>
+                </xsd:annotation>
+            </xsd:element>
+            <xsd:element name="funding-type" type="simpleType.Generic.NonEmptyString.20" minOccurs="0" maxOccurs="1">
+                <xsd:annotation>
+                    <xsd:documentation>
+                    The normalized card funding type. Expected values are CREDIT, DEBIT, and
+                    PREPAID. A custom value may also be returned.
+                    </xsd:documentation>
+                </xsd:annotation>
+            </xsd:element>
+        </xsd:sequence>
+        <xsd:attribute name="type" type="simpleType.Generic.NonEmptyString.256" use="required">
+            <xsd:annotation>
+                <xsd:documentation>
+                The normalized payment method type. Expected values are bancontact, card,
+                eps, gift_card, ideal, klarna, sepa_debit, paypal, venmo, afterpay_clearpay,
+                amazon_pay, and twint. A custom value may also be returned.
+                </xsd:documentation>
+            </xsd:annotation>
+        </xsd:attribute>
+    </xsd:complexType>
+
+    <xsd:complexType name="complexType.TransactionDetails">
+        <xsd:annotation>
+            <xsd:documentation>
+            Since version 26.10.
+            Normalized transaction details for the order payment transaction. Specific fields
+            are populated depending on the payment-details type value.
+            </xsd:documentation>
+        </xsd:annotation>
+        <xsd:sequence>
+            <xsd:element name="cvc-result" type="simpleType.Generic.NonEmptyString.20" minOccurs="0" maxOccurs="1">
+                <xsd:annotation>
+                    <xsd:documentation>
+                    The card verification code check result. Expected values are MATCH, NO_MATCH,
+                    NOT_PROCESSED, and UNAVAILABLE. A custom value may also be returned.
+                    </xsd:documentation>
+                </xsd:annotation>
+            </xsd:element>
+            <xsd:element name="avs-result" type="simpleType.Generic.NonEmptyString.1" minOccurs="0" maxOccurs="1">
+                <xsd:annotation>
+                    <xsd:documentation>
+                    The address verification service result. Expected values are Y (full match),
+                    N (no match), A (address only), Z (postal code only), U (unavailable), S
+                    (unsupported), and R (retry). A custom value may also be returned.
+                    </xsd:documentation>
+                </xsd:annotation>
+            </xsd:element>
+            <xsd:element name="three-ds-result" type="simpleType.Generic.NonEmptyString.20" minOccurs="0" maxOccurs="1">
+                <xsd:annotation>
+                    <xsd:documentation>
+                    The 3D Secure authentication result. Expected values are AUTHENTICATED,
+                    ATTEMPTED, FAILED, REJECTED, and UNAVAILABLE. A custom value may also be returned.
+                    </xsd:documentation>
+                </xsd:annotation>
+            </xsd:element>
+            <xsd:element name="three-ds-version" type="simpleType.Generic.NonEmptyString.2" minOccurs="0" maxOccurs="1">
+                <xsd:annotation>
+                    <xsd:documentation>
+                    The 3D Secure protocol version. Expected values are V1 and V2. A custom value may also be returned.
+                    </xsd:documentation>
+                </xsd:annotation>
+            </xsd:element>
+            <xsd:element name="three-ds-transaction-id" type="simpleType.Generic.NonEmptyString.40" minOccurs="0" maxOccurs="1">
+                <xsd:annotation>
+                    <xsd:documentation>
+                    The 3D Secure transaction identifier.
+                    </xsd:documentation>
+                </xsd:annotation>
+            </xsd:element>
+            <xsd:element name="electronic-commerce-indicator" type="simpleType.Generic.NonEmptyString.3" minOccurs="0" maxOccurs="1">
+                <xsd:annotation>
+                    <xsd:documentation>
+                    The electronic commerce indicator (ECI) value returned by the processor.
+                    </xsd:documentation>
+                </xsd:annotation>
+            </xsd:element>
+            <xsd:element name="approval-code" type="simpleType.Generic.NonEmptyString.256" minOccurs="0" maxOccurs="1">
+                <xsd:annotation>
+                    <xsd:documentation>
+                    The approval code returned by the provider on a successful gift card capture.
+                    </xsd:documentation>
+                </xsd:annotation>
+            </xsd:element>
+            <xsd:element name="reason-code" type="simpleType.Generic.NonEmptyString.256" minOccurs="0" maxOccurs="1">
+                <xsd:annotation>
+                    <xsd:documentation>
+                    The reason code returned by the provider on a failed gift card capture.
+                    Expected values are DECLINED and INSUFFICIENT_FUNDS. A custom value may also
+                    be returned.
+                    </xsd:documentation>
+                </xsd:annotation>
+            </xsd:element>
+            <xsd:element name="processor-response-text" type="simpleType.Generic.NonEmptyString.256" minOccurs="0" maxOccurs="1">
+                <xsd:annotation>
+                    <xsd:documentation>
+                    The human-readable gift card processor response text. The language and localization of this
+                    text are provider-defined and may vary by provider integration.
+                    </xsd:documentation>
+                </xsd:annotation>
+            </xsd:element>
+        </xsd:sequence>
+    </xsd:complexType>
+
+    <xsd:complexType name="complexType.FraudDecisions">
+        <xsd:annotation>
+            <xsd:documentation>
+            Since version 26.10.
+            Normalized fraud decisions for the order payment instrument. The values remain
+            readable for historical orders.
+            </xsd:documentation>
+        </xsd:annotation>
+        <xsd:sequence>
+            <xsd:element name="pre-authorization" type="simpleType.Generic.NonEmptyString.256" minOccurs="0" maxOccurs="1">
+                <xsd:annotation>
+                    <xsd:documentation>
+                    The pre-authorization fraud decision used by the client to orchestrate
+                    checkout. Expected values are NOT_REVIEWED (no pre-authorization fraud
+                    decision was made), APPROVED (the payment authorization can proceed),
+                    CHALLENGE (the payment authorization should be challenged with additional
+                    verification such as a 3D Secure challenge before it can proceed), and
+                    DECLINED (the payment authorization is declined). A custom value may also be
+                    returned.
+                    </xsd:documentation>
+                </xsd:annotation>
+            </xsd:element>
+            <xsd:element name="post-authorization" type="simpleType.Generic.NonEmptyString.256" minOccurs="0" maxOccurs="1">
+                <xsd:annotation>
+                    <xsd:documentation>
+                    The post-authorization fraud decision indicating whether the transaction is
+                    covered by a fraud guarantee. Expected values are NOT_REVIEWED (no
+                    post-authorization fraud decision was made), GUARANTEED (the transaction is
+                    covered by a fraud guarantee), NOT_GUARANTEED (the transaction is not covered
+                    by a fraud guarantee), and PENDING (the post-authorization fraud decision is
+                    still pending). A custom value may also be returned.
+                    </xsd:documentation>
+                </xsd:annotation>
+            </xsd:element>
+        </xsd:sequence>
+    </xsd:complexType>
+
+    <xsd:simpleType name="simpleType.PaymentDetails.ExpirationMonth">
+        <xsd:restriction base="xsd:int">
+            <xsd:minInclusive value="1"/>
+            <xsd:maxInclusive value="12"/>
+        </xsd:restriction>
+    </xsd:simpleType>
+
     <xsd:simpleType name="simpleType.OrderBusinessType">
         <xsd:restriction base="xsd:string">
             <xsd:enumeration value="B2C" />

package/data/xsd/search2.xsd

@@ -467,7 +467,7 @@
     <xsd:simpleType name="simpleType.Generic.String.256">
         <xsd:restriction base="simpleType.Generic.String">
             <xsd:minLength value="0"/>
-            <xsd:maxLength value="10"/>
+            <xsd:maxLength value="256"/>
         </xsd:restriction>
     </xsd:simpleType>
 

package/data/xsd/sort.xsd

@@ -191,8 +191,16 @@
             <xsd:element name="description" type="LocalizedString" minOccurs="0" maxOccurs="unbounded" />
         </xsd:sequence>
         <xsd:attribute name="option-id" type="Generic.NonEmptyString.256" use="required" />
+        <xsd:attribute name="search-type" type="SearchType" use="optional" />
     </xsd:complexType>
 
+    <xsd:simpleType name="SearchType">
+        <xsd:restriction base="xsd:string">
+            <xsd:enumeration value="standard" />
+            <xsd:enumeration value="agentic" />
+        </xsd:restriction>
+    </xsd:simpleType>
+
     <xsd:simpleType name="SortingDirection">
         <xsd:restriction base="xsd:string">
             <xsd:enumeration value="ascending" />
@@ -268,9 +276,18 @@
         </xsd:restriction>
     </xsd:simpleType>
 
+    <!-- Owning system object type for a boostable attribute. -->
+    <xsd:simpleType name="BoostableObjectType">
+        <xsd:restriction base="xsd:string">
+            <xsd:enumeration value="Product" />
+            <xsd:enumeration value="ProductActiveData" />
+        </xsd:restriction>
+    </xsd:simpleType>
+
     <xsd:complexType name="BoostableAttribute">
         <xsd:attribute name="attribute-id" type="Generic.NonEmptyString.256" use="required" />
         <xsd:attribute name="system" type="xsd:boolean" use="required" />
+        <xsd:attribute name="object-type" type="BoostableObjectType" use="optional" default="Product" />
         <xsd:attribute name="mode" type="ImportMode" use="optional" />
     </xsd:complexType>
 

package/data/xsd/storefronts.xsd

@@ -24,21 +24,50 @@
     <xsd:complexType name="complexType.Storefront" mixed="false">
         <xsd:sequence>
             <xsd:element name="ecom-site" type="simpleType.Generic.String.48" minOccurs="0" maxOccurs="1"/>
-            <xsd:element name="storefront-type" type="simpleType.StorefrontType" minOccurs="1" maxOccurs="1"/>
-            <xsd:element name="storefront-status" type="simpleType.StorefrontStatus" minOccurs="1" maxOccurs="1"/>
+            <!-- Accepted values (case-insensitive on import): composable, pwa_kit. Export emits lowercase. -->
+            <xsd:element name="storefront-type" type="simpleType.Generic.String.32" minOccurs="1" maxOccurs="1"/>
+            <!--
+                Deprecated. Retained solely for backward compatibility: storefront import validates incoming
+                files against this schema (StorefrontImpexUnit.setSchema), so pre-cleanup export files that still
+                carry <storefront-status> must remain declared here to pass validation. Optional and ignored on
+                import; no longer emitted on export. Do not add new consumers.
+            -->
+            <xsd:element name="storefront-status" type="simpleType.Generic.String.32" minOccurs="0" maxOccurs="1"/>
             <xsd:element name="associated-sites" type="complexType.AssociatedSites" minOccurs="0" maxOccurs="1"/>
-            <xsd:element name="user-id" type="simpleType.Generic.String.48" minOccurs="1" maxOccurs="1"/>
+            <!--
+                Optional. For interactive Business Manager (session-based) imports the importer's authenticated
+                session identity is authoritative and this value is ignored. It supplies the acting identity only for
+                server-to-server (client-credentials) imports, which have no session; such imports are rejected if it
+                is absent or unauthorized. Retained and declared here because storefront import validates incoming
+                files against this schema (StorefrontImpexUnit.setSchema).
+            -->
+            <xsd:element name="user-id" type="simpleType.Generic.String.48" minOccurs="0" maxOccurs="1"/>
             <xsd:element name="org-slug" type="simpleType.Generic.String.64" minOccurs="1" maxOccurs="1"/>
             <xsd:element name="mrt-site" type="simpleType.Generic.String.64" minOccurs="1" maxOccurs="1"/>
             <xsd:element name="scm-repo" type="simpleType.Generic.String.512" minOccurs="0" maxOccurs="1"/>
             <xsd:element name="scm-target" type="simpleType.Generic.String.64" minOccurs="0" maxOccurs="1"/>
+            <!--
+                Deprecated (W-23546554). Retained solely for backward compatibility: storefront import validates
+                incoming files against this schema (StorefrontImpexUnit.setSchema), so pre-cleanup export files that
+                still carry <github-app-installation> must remain declared here to pass validation. Optional and
+                ignored on import; no longer emitted on export. Carrying the source realm's GitHub App installation
+                onto a target would enable a cross-realm credential-leak (spike W-23298074 3.3), so it is dropped on
+                import and the GitHub App must be reconnected manually. Do not add new consumers. This element will be
+                removed in a future schema version once all pre-cleanup export files carrying it have cycled out.
+            -->
             <xsd:element name="github-app-installation" type="complexType.GitHubAppInstallation" minOccurs="0" maxOccurs="1"/>
         </xsd:sequence>
         <xsd:attribute name="storefront-name" type="simpleType.Generic.NonEmptyString.64" use="required"/>
-        <xsd:attribute name="mode" type="simpleType.ImportMode"/>
+        <!--
+            Deprecated. Retained solely for backward compatibility: pre-cleanup delta-export files could carry
+            mode="delete". Optional and ignored on import (the import delete decision is driven by the framework
+            import mode, not this attribute); no longer emitted on export. Do not add new consumers.
+        -->
+        <xsd:attribute name="mode" type="simpleType.Generic.String.32"/>
     </xsd:complexType>
 
-    <!-- GitHub App Installation -->
+    <!-- GitHub App Installation. Deprecated (W-23546554): declared only so legacy files that still carry
+         <github-app-installation> validate on import. Ignored on import, never exported. Do not add new consumers. -->
     <xsd:complexType name="complexType.GitHubAppInstallation" mixed="false">
         <xsd:sequence>
             <xsd:element name="app-id" type="simpleType.Generic.String.64" minOccurs="1" maxOccurs="1"/>
@@ -57,49 +86,6 @@
         </xsd:sequence>
     </xsd:complexType>
 
-    <!-- Storefront Type enumeration -->
-    <xsd:simpleType name="simpleType.StorefrontType">
-        <xsd:restriction base="xsd:string">
-            <xsd:enumeration value="composable"/>
-            <xsd:enumeration value="headless"/>
-        </xsd:restriction>
-    </xsd:simpleType>
-
-    <!--
-        Storefront Status enumeration.
-
-        These values must stay in sync with StorefrontSetupStatusEnum (core/internal/storefront).
-        There is no compile-time link between this XSD and the Java enum; drift is caught by
-        comparing the JAXB-generated SimpleTypeStorefrontStatus against StorefrontSetupStatusEnum
-        in _JAXBStorefrontExportHandler (testStorefrontStatusEnumAndXsdInSync).
-
-        Export currently restricts output to SUCCESS storefronts only
-        (JAXBStorefrontExportHandler.mapStorefront). Adding a new exportable status requires:
-          1. Adding the value here
-          2. Adding the enum constant in StorefrontSetupStatusEnum
-          3. Updating the export guard in mapStorefront to allow the new status
-          4. Updating the sync unit test's expected set if needed
-    -->
-    <xsd:simpleType name="simpleType.StorefrontStatus">
-        <xsd:restriction base="xsd:string">
-            <xsd:enumeration value="in_progress"/>
-            <xsd:enumeration value="success"/>
-            <xsd:enumeration value="backfilled"/>
-            <xsd:enumeration value="failed"/>
-            <xsd:enumeration value="delete_in_progress"/>
-            <xsd:enumeration value="delete_failed"/>
-            <xsd:enumeration value="deleted"/>
-            <xsd:enumeration value="unknown"/>
-        </xsd:restriction>
-    </xsd:simpleType>
-
-    <!-- Import Mode -->
-    <xsd:simpleType name="simpleType.ImportMode">
-        <xsd:restriction base="xsd:string">
-            <xsd:enumeration value="delete"/>
-        </xsd:restriction>
-    </xsd:simpleType>
-
     <!-- simple generic types -->
     <xsd:simpleType name="simpleType.Generic.String">
         <xsd:restriction base="xsd:string"/>

package/dist/esm/auth/client-credentials.d.ts

@@ -25,3 +25,46 @@
  * @see https://datatracker.ietf.org/doc/html/rfc6749#appendix-B
  */
 export declare function encodeBasicClientCredentials(clientId: string, clientSecret: string): string;
+/**
+ * How OAuth client credentials are sent to the token endpoint.
+ *
+ * - `basic`: `Authorization: Basic` header with each component form-url-encoded
+ *   per RFC 6749 §2.3.1 (`client_secret_basic`). The default.
+ * - `basic-unencoded`: `Authorization: Basic` header over the raw `id:secret`,
+ *   without per-component encoding. For proxies and brokers that substitute a
+ *   literal value into the decoded header. A secret containing `+` or `%` is
+ *   misread by Account Manager in this mode.
+ * - `body`: `client_id` and `client_secret` in the form-url-encoded request body
+ *   (`client_secret_post`).
+ */
+export type ClientAuthMethod = 'basic' | 'basic-unencoded' | 'body';
+/** All supported client authentication methods. */
+export declare const CLIENT_AUTH_METHODS: readonly ["basic", "basic-unencoded", "body"];
+/**
+ * Returns true when a value is a sandbox credential placeholder rather than a
+ * real secret.
+ *
+ * @param value - The credential value to inspect
+ */
+export declare function isCredentialPlaceholder(value: string): boolean;
+/**
+ * Resolves the effective client authentication method. An explicit method
+ * always wins; otherwise a sandbox credential placeholder selects
+ * `basic-unencoded` (so the proxy can find it in the header) and everything
+ * else uses `basic`.
+ *
+ * @param clientSecret - The OAuth client password/secret
+ * @param method - The configured method, if any
+ */
+export declare function resolveClientAuthMethod(clientSecret: string, method?: ClientAuthMethod): ClientAuthMethod;
+/**
+ * Applies OAuth client authentication to a token request using the method
+ * chosen by {@link resolveClientAuthMethod}. Account Manager accepts all of them.
+ *
+ * @param params - The token request body; credentials are appended in the `body` case
+ * @param clientId - The OAuth client identifier
+ * @param clientSecret - The OAuth client password/secret
+ * @param method - The configured client authentication method, if any
+ * @returns Headers to add to the token request (empty in the `body` case)
+ */
+export declare function applyClientCredentials(params: URLSearchParams, clientId: string, clientSecret: string, method?: ClientAuthMethod): Record<string, string>;

package/dist/esm/auth/client-credentials.js

@@ -57,4 +57,59 @@ export function encodeBasicClientCredentials(clientId, clientSecret) {
     const userPass = `${formUrlEncodeComponent(clientId)}:${formUrlEncodeComponent(clientSecret)}`;
     return Buffer.from(userPass).toString('base64');
 }
+/** All supported client authentication methods. */
+export const CLIENT_AUTH_METHODS = ['basic', 'basic-unencoded', 'body'];
+/**
+ * Markers used by credential-brokering sandboxes (NVIDIA OpenShell) for the
+ * placeholder values they expose in place of real secrets. The sandbox proxy
+ * swaps the real secret in on the wire, but only where it recognizes the
+ * placeholder: it matches a raw placeholder inside a decoded Basic header, so
+ * the per-component form-url-encoding above (`:` -> `%3A`) hides it.
+ */
+const CREDENTIAL_PLACEHOLDER_MARKERS = ['openshell:resolve:env:', 'OPENSHELL-RESOLVE-ENV-'];
+/**
+ * Returns true when a value is a sandbox credential placeholder rather than a
+ * real secret.
+ *
+ * @param value - The credential value to inspect
+ */
+export function isCredentialPlaceholder(value) {
+    return CREDENTIAL_PLACEHOLDER_MARKERS.some((marker) => value.includes(marker));
+}
+/**
+ * Resolves the effective client authentication method. An explicit method
+ * always wins; otherwise a sandbox credential placeholder selects
+ * `basic-unencoded` (so the proxy can find it in the header) and everything
+ * else uses `basic`.
+ *
+ * @param clientSecret - The OAuth client password/secret
+ * @param method - The configured method, if any
+ */
+export function resolveClientAuthMethod(clientSecret, method) {
+    if (method)
+        return method;
+    return isCredentialPlaceholder(clientSecret) ? 'basic-unencoded' : 'basic';
+}
+/**
+ * Applies OAuth client authentication to a token request using the method
+ * chosen by {@link resolveClientAuthMethod}. Account Manager accepts all of them.
+ *
+ * @param params - The token request body; credentials are appended in the `body` case
+ * @param clientId - The OAuth client identifier
+ * @param clientSecret - The OAuth client password/secret
+ * @param method - The configured client authentication method, if any
+ * @returns Headers to add to the token request (empty in the `body` case)
+ */
+export function applyClientCredentials(params, clientId, clientSecret, method) {
+    switch (resolveClientAuthMethod(clientSecret, method)) {
+        case 'basic-unencoded':
+            return { Authorization: `Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString('base64')}` };
+        case 'body':
+            params.set('client_id', clientId);
+            params.set('client_secret', clientSecret);
+            return {};
+        default:
+            return { Authorization: `Basic ${encodeBasicClientCredentials(clientId, clientSecret)}` };
+    }
+}
 //# sourceMappingURL=client-credentials.js.map

package/dist/esm/auth/client-credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"client-credentials.js","sourceRoot":"","sources":["../../../src/auth/client-credentials.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH;;;;GAIG;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,sBAAsB,CAAC,KAAa;IAC3C,6EAA6E;IAC7E,OAAO,IAAI,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,4BAA4B,CAAC,QAAgB,EAAE,YAAoB;IACjF,MAAM,QAAQ,GAAG,GAAG,sBAAsB,CAAC,QAAQ,CAAC,IAAI,sBAAsB,CAAC,YAAY,CAAC,EAAE,CAAC;IAC/F,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAClD,CAAC"}
+{"version":3,"file":"client-credentials.js","sourceRoot":"","sources":["../../../src/auth/client-credentials.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH;;;;GAIG;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,sBAAsB,CAAC,KAAa;IAC3C,6EAA6E;IAC7E,OAAO,IAAI,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,4BAA4B,CAAC,QAAgB,EAAE,YAAoB;IACjF,MAAM,QAAQ,GAAG,GAAG,sBAAsB,CAAC,QAAQ,CAAC,IAAI,sBAAsB,CAAC,YAAY,CAAC,EAAE,CAAC;IAC/F,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAClD,CAAC;AAgBD,mDAAmD;AACnD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,iBAAiB,EAAE,MAAM,CAAgD,CAAC;AAEvH;;;;;;GAMG;AACH,MAAM,8BAA8B,GAAG,CAAC,wBAAwB,EAAE,wBAAwB,CAAC,CAAC;AAE5F;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,OAAO,8BAA8B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,YAAoB,EAAE,MAAyB;IACrF,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,OAAO,uBAAuB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC;AAC7E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAuB,EACvB,QAAgB,EAChB,YAAoB,EACpB,MAAyB;IAEzB,QAAQ,uBAAuB,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,CAAC;QACtD,KAAK,iBAAiB;YACpB,OAAO,EAAC,aAAa,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAC,CAAC;QACnG,KAAK,MAAM;YACT,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YAClC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;YAC1C,OAAO,EAAE,CAAC;QACZ;YACE,OAAO,EAAC,aAAa,EAAE,SAAS,4BAA4B,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,EAAC,CAAC;IAC5F,CAAC;AACH,CAAC"}

package/dist/esm/auth/index.d.ts

@@ -56,7 +56,8 @@
  */
 export type { AuthStrategy, UserAuthStrategy, FetchInit, AccessTokenResponse, DecodedJWT, AuthConfig, BasicAuthConfig, OAuthAuthConfig, ApiKeyAuthConfig, AuthMethod, AuthCredentials, } from './types.js';
 export { ALL_AUTH_METHODS } from './types.js';
-export { encodeBasicClientCredentials } from './client-credentials.js';
+export { applyClientCredentials, CLIENT_AUTH_METHODS, encodeBasicClientCredentials, isCredentialPlaceholder, resolveClientAuthMethod, } from './client-credentials.js';
+export type { ClientAuthMethod } from './client-credentials.js';
 export { BasicAuthStrategy } from './basic.js';
 export { OAuthStrategy, decodeJWT } from './oauth.js';
 export type { OAuthConfig } from './oauth.js';

package/dist/esm/auth/index.js

@@ -61,7 +61,7 @@
  */
 export { ALL_AUTH_METHODS } from './types.js';
 // Client credential encoding (RFC 6749 §2.3.1)
-export { encodeBasicClientCredentials } from './client-credentials.js';
+export { applyClientCredentials, CLIENT_AUTH_METHODS, encodeBasicClientCredentials, isCredentialPlaceholder, resolveClientAuthMethod, } from './client-credentials.js';
 // Strategies
 export { BasicAuthStrategy } from './basic.js';
 export { OAuthStrategy, decodeJWT } from './oauth.js';