@wildo-ai/external-connectors-models 1.1.1 → 1.1.3

package/dist/esm/core/security.external-connectors-models.schemas.d.ts

@@ -146,10 +146,10 @@ export declare const ExternalProvider_AuthProfile_Schema: z.ZodDiscriminatedUnio
     extraAuthParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     extraTokenParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     tokenFormat: z.ZodDefault<z.ZodEnum<{
-        token: "token";
+        custom: "custom";
         bearer: "bearer";
+        token: "token";
         oauth: "oauth";
-        custom: "custom";
     }>>;
     customTokenPrefix: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
@@ -184,4 +184,134 @@ export declare const ExternalProvider_AuthProfile_Schema: z.ZodDiscriminatedUnio
     caRef: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>], "kind">;
 export type ExternalProvider_AuthProfile = z.infer<typeof ExternalProvider_AuthProfile_Schema>;
+/**
+ * WHOSE ACCOUNT a call spends.
+ *
+ * Distinct from the scope of the DATA the call touches, and conflating the two inverts the design.
+ * A billing provider is APPLICATION-owned — the payment account belongs to whoever ships the
+ * application — even though almost everything it produces is organization-shaped: a customer, a
+ * subscription, an invoice per tenant. Those are data in the application's own domain, produced by
+ * an application-owned account. The question here is never "does this touch organizations?", which
+ * is true of nearly everything. It is **whose account is it?**
+ *
+ * Delivery follows the owner and is not a separate decision: the APPLICATION's material is authored
+ * in the deployment environment by an operator, and an ORGANIZATION's or a USER's is authored
+ * through the application's own settings and stored, sealed, in its database.
+ *
+ * **No owner ever defaults to another.** An organization-owned call with no connection REFUSES; it
+ * never spends the application's account. A silent substitution means the vendor sees one identity
+ * while the application believes it acted as another, and every artifact the call leaves on the far
+ * side — a message, a record, a line in the vendor's own audit log — is then attributed to the wrong
+ * party, with nothing downstream able to detect it. An application that wants "the tenant's key when
+ * they have connected one, otherwise ours" expresses that in its own code by choosing which
+ * connection to call with, where the choice is visible.
+ */
+export declare enum ExternalProvider_Connection_OwnerScope {
+    /** The account belongs to the application itself. Material comes from the deployment environment. */
+    APPLICATION = "application",
+    /** The account belongs to one tenant — its own workspace, its own subscription with the vendor. */
+    ORGANIZATION = "organization",
+    /** The account belongs to one person — a personal key they authored for themselves. */
+    USER = "user"
+}
+/**
+ * WHAT A DECLARED SECRET IDENTIFIES — the integration, or the account.
+ *
+ * A provider's `secretsContract` holds two kinds of thing and, until this existed, marked neither.
+ * Slack's contract is the clearest case: `SLACK_CLIENT_ID` and `SLACK_CLIENT_SECRET` identify the
+ * APPLICATION's registration with Slack, while `SLACK_API_KEY` holds a token that identifies WHOSE
+ * Slack account is being acted as. They are stored differently, rotated for different reasons, and
+ * owned by different parties, and one undifferentiated map made all three look alike.
+ *
+ * Deliberately ORTHOGONAL to {@link ExternalProvider_Connection_OwnerScope}, which is the axis it is
+ * most likely to be confused with. This says what a secret IS; that says whose it is. A billing
+ * provider's secret key is a CREDENTIAL — it identifies an account — and is nonetheless
+ * application-owned, because the only admissible connection for it is APPLICATION. Collapsing the
+ * two would make "the deployment owns this" and "this identifies an integration" the same
+ * statement, and they are not.
+ *
+ * What the distinction buys, concretely:
+ *
+ *   - a credential row owned by a tenant or a person may hold a CREDENTIAL and never a REGISTRATION.
+ *     Without the mark, nothing stopped a tenant storing a row slugged `SLACK_CLIENT_SECRET` that no
+ *     reader would ever consult — inert, and indistinguishable from a working connection on screen;
+ *   - the connect flow can derive WHICH slug a grant is stored under by construction, rather than
+ *     by the convention that it happens to be the REST contract's `apiKey.secretRef`;
+ *   - a vendor that supports per-tenant app registrations becomes SAYABLE, which it is not today.
+ */
+export declare enum ExternalProvider_SecretScope {
+    /**
+     * Identifies the INTEGRATION — an OAuth2 client id and secret, a signing secret issued to the
+     * app's registration. Authored by the operator in the deployment environment.
+     */
+    REGISTRATION = "registration",
+    /**
+     * Identifies an ACCOUNT — a token or key standing for whoever is being acted as. May be authored
+     * in the environment (the deployment's own account) or minted into a credential row owned by a
+     * tenant or a person; which of those are permitted is the admissibility question, not this one.
+     */
+    CREDENTIAL = "credential"
+}
+/**
+ * ON WHOSE BEHALF the act is performed — orthogonal to who owns the account.
+ *
+ * These are two questions and every combination of them is real, which is why they are two enums
+ * rather than one. An application's service identity can impersonate a user (domain-wide
+ * delegation); a tenant's own registration can mint a token that acts for one of its members; a
+ * tenant's bot token acts as nobody in particular. Collapsing the pair into a single vocabulary
+ * makes most of those unsayable:
+ *
+ * | owner × delegation | the real case |
+ * |---|---|
+ * | APPLICATION × SERVICE | a platform API key |
+ * | APPLICATION × USER | the application's service identity impersonating a user |
+ * | ORGANIZATION × SERVICE | the tenant's own bot or workspace token |
+ * | ORGANIZATION × USER | the tenant's registration, acting for one of its members |
+ * | USER × SERVICE | a personal key the user authored |
+ *
+ * OAuth 2.0 carries the same split in its grant types: the client is the REGISTRATION, and the grant
+ * decides on whose behalf a token is minted.
+ */
+export declare enum ExternalProvider_Connection_DelegationMode {
+    /** The call acts as the account's owner, with no third party behind it. */
+    SERVICE = "service",
+    /** The call acts for a named user, whose authorization is what makes it permissible. */
+    USER = "user"
+}
+/**
+ * WHICH owner instance a single call spends — supplied BY THE CALL, never read from ambient context.
+ *
+ * This is the field's hardest constraint to get right and the reason it is a parameter rather than a
+ * property of the execution. `ExecutionContext.initiatorIds` answers WHO is performing the operation
+ * and `contextResourcesFieldIdentifier` answers WHICH ROWS are in scope; neither answers whose
+ * account is being spent, and a design that borrows either is wrong for a case that is entirely
+ * ordinary: one user action fanning out a message to every organization the user belongs to. One
+ * initiator, one execution, N organizations, a different account per call. An ambient answer cannot
+ * vary within one execution, so it cannot express that at all.
+ *
+ * The initiator is still decisive — as the AUTHORIZATION input. The call names the owner and the
+ * runtime asks whether this initiator may act for it. Supplying and authorizing are different jobs,
+ * and the resolver cannot verify a target it also invented.
+ */
+export declare const ExternalProvider_ConnectionShapeSchema: z.ZodObject<{
+    ownerScope: z.ZodEnum<typeof ExternalProvider_Connection_OwnerScope>;
+    delegation: z.ZodDefault<z.ZodEnum<typeof ExternalProvider_Connection_DelegationMode>>;
+}, z.core.$strip>;
+/**
+ * A connection COMBINATION, with no instance attached — what a provider ADMITS.
+ *
+ * The capability and the call are the same two axes and different objects, which is why this is a
+ * separate schema rather than the target with its identifiers made optional. A provider admitting
+ * `ORGANIZATION × USER` says nothing about which organization; a call naming an organization and no
+ * user is incomplete. Making one schema serve both would have to relax exactly the refinements that
+ * make the call safe.
+ */
+export type ExternalProvider_ConnectionShape = z.infer<typeof ExternalProvider_ConnectionShapeSchema>;
+export declare const ExternalProvider_ConnectionTargetSchema: z.ZodObject<{
+    ownerScope: z.ZodEnum<typeof ExternalProvider_Connection_OwnerScope>;
+    delegation: z.ZodDefault<z.ZodEnum<typeof ExternalProvider_Connection_DelegationMode>>;
+    ownerId: z.ZodOptional<z.ZodString>;
+    actingForUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type ExternalProvider_ConnectionTarget = z.infer<typeof ExternalProvider_ConnectionTargetSchema>;
 //# sourceMappingURL=security.external-connectors-models.schemas.d.ts.map

package/dist/esm/core/security.external-connectors-models.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../../src/core/security.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,+BAA+B,EAC/B,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AAMxB;;;GAGG;AACH,oBAAY,0BAA0B;IACpC,iCAAiC;IACjC,IAAI,SAAS;IAEb,0CAA0C;IAC1C,OAAO,YAAY;IAEnB,gDAAgD;IAChD,MAAM,WAAW;IAEjB,gCAAgC;IAChC,KAAK,UAAU;IAEf,kEAAkE;IAClE,MAAM,WAAW;IAEjB,0CAA0C;IAC1C,cAAc,mBAAmB;IAEjC,+CAA+C;IAC/C,cAAc,mBAAmB;IAEjC,uCAAuC;IACvC,UAAU,eAAe;IAEzB,qDAAqD;IACrD,eAAe,oBAAoB;CACpC;AAMD,oBAAY,qCAAqC;IAC/C,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,MAAM,WAAW;CAClB;AAED,oBAAY,8CAA8C;IACxD,MAAM,WAAW;IACjB,MAAM,WAAW;CAClB;AAED,oBAAY,mCAAmC;IAC7C,GAAG,QAAQ;IACX,OAAO,YAAY;IACnB,mBAAmB,wBAAwB;CAC5C;AAMD;;;GAGG;AACH,eAAO,MAAM,yCAAyC;;;;;iBAYpD,CAAC;AAMH,eAAO,MAAM,6CAA6C;;;;;;;iBAkBxD,CAAC;AAMH,eAAO,MAAM,uCAAuC;;;;;;iBAelD,CAAC;AAMH,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;AAC5G,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6CAA6C,CAAC,CAAC;AACpH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAMxG;;;GAGG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAmI9C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC"}
+{"version":3,"file":"security.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../../src/core/security.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,+BAA+B,EAC/B,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AAMxB;;;GAGG;AACH,oBAAY,0BAA0B;IACpC,iCAAiC;IACjC,IAAI,SAAS;IAEb,0CAA0C;IAC1C,OAAO,YAAY;IAEnB,gDAAgD;IAChD,MAAM,WAAW;IAEjB,gCAAgC;IAChC,KAAK,UAAU;IAEf,kEAAkE;IAClE,MAAM,WAAW;IAEjB,0CAA0C;IAC1C,cAAc,mBAAmB;IAEjC,+CAA+C;IAC/C,cAAc,mBAAmB;IAEjC,uCAAuC;IACvC,UAAU,eAAe;IAEzB,qDAAqD;IACrD,eAAe,oBAAoB;CACpC;AAMD,oBAAY,qCAAqC;IAC/C,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,MAAM,WAAW;CAClB;AAED,oBAAY,8CAA8C;IACxD,MAAM,WAAW;IACjB,MAAM,WAAW;CAClB;AAED,oBAAY,mCAAmC;IAC7C,GAAG,QAAQ;IACX,OAAO,YAAY;IACnB,mBAAmB,wBAAwB;CAC5C;AAMD;;;GAGG;AACH,eAAO,MAAM,yCAAyC;;;;;iBAYpD,CAAC;AAMH,eAAO,MAAM,6CAA6C;;;;;;;iBAkBxD,CAAC;AAMH,eAAO,MAAM,uCAAuC;;;;;;iBAelD,CAAC;AAMH,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;AAC5G,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6CAA6C,CAAC,CAAC;AACpH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAMxG;;;GAGG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAmI9C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAM/F;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,oBAAY,sCAAsC;IAChD,qGAAqG;IACrG,WAAW,gBAAgB;IAC3B,mGAAmG;IACnG,YAAY,iBAAiB;IAC7B,uFAAuF;IACvF,IAAI,SAAS;CACd;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,oBAAY,4BAA4B;IACtC;;;OAGG;IACH,YAAY,iBAAiB;IAC7B;;;;OAIG;IACH,UAAU,eAAe;CAC1B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,oBAAY,0CAA0C;IACpD,2EAA2E;IAC3E,OAAO,YAAY;IACnB,wFAAwF;IACxF,IAAI,SAAS;CACd;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sCAAsC;;;iBAIjD,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,eAAO,MAAM,uCAAuC;;;;;iBA2ClD,CAAC;AAEH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC"}

package/dist/esm/core/security.external-connectors-models.schemas.js

@@ -230,4 +230,168 @@ export const ExternalProvider_AuthProfile_Schema = z.discriminatedUnion("kind",
         caRef: z.string().optional(),
     }),
 ]);
+// =============================================================================
+// CONNECTION IDENTITY — whose account, on whose behalf, and which one
+// =============================================================================
+/**
+ * WHOSE ACCOUNT a call spends.
+ *
+ * Distinct from the scope of the DATA the call touches, and conflating the two inverts the design.
+ * A billing provider is APPLICATION-owned — the payment account belongs to whoever ships the
+ * application — even though almost everything it produces is organization-shaped: a customer, a
+ * subscription, an invoice per tenant. Those are data in the application's own domain, produced by
+ * an application-owned account. The question here is never "does this touch organizations?", which
+ * is true of nearly everything. It is **whose account is it?**
+ *
+ * Delivery follows the owner and is not a separate decision: the APPLICATION's material is authored
+ * in the deployment environment by an operator, and an ORGANIZATION's or a USER's is authored
+ * through the application's own settings and stored, sealed, in its database.
+ *
+ * **No owner ever defaults to another.** An organization-owned call with no connection REFUSES; it
+ * never spends the application's account. A silent substitution means the vendor sees one identity
+ * while the application believes it acted as another, and every artifact the call leaves on the far
+ * side — a message, a record, a line in the vendor's own audit log — is then attributed to the wrong
+ * party, with nothing downstream able to detect it. An application that wants "the tenant's key when
+ * they have connected one, otherwise ours" expresses that in its own code by choosing which
+ * connection to call with, where the choice is visible.
+ */
+export var ExternalProvider_Connection_OwnerScope;
+(function (ExternalProvider_Connection_OwnerScope) {
+    /** The account belongs to the application itself. Material comes from the deployment environment. */
+    ExternalProvider_Connection_OwnerScope["APPLICATION"] = "application";
+    /** The account belongs to one tenant — its own workspace, its own subscription with the vendor. */
+    ExternalProvider_Connection_OwnerScope["ORGANIZATION"] = "organization";
+    /** The account belongs to one person — a personal key they authored for themselves. */
+    ExternalProvider_Connection_OwnerScope["USER"] = "user";
+})(ExternalProvider_Connection_OwnerScope || (ExternalProvider_Connection_OwnerScope = {}));
+/**
+ * WHAT A DECLARED SECRET IDENTIFIES — the integration, or the account.
+ *
+ * A provider's `secretsContract` holds two kinds of thing and, until this existed, marked neither.
+ * Slack's contract is the clearest case: `SLACK_CLIENT_ID` and `SLACK_CLIENT_SECRET` identify the
+ * APPLICATION's registration with Slack, while `SLACK_API_KEY` holds a token that identifies WHOSE
+ * Slack account is being acted as. They are stored differently, rotated for different reasons, and
+ * owned by different parties, and one undifferentiated map made all three look alike.
+ *
+ * Deliberately ORTHOGONAL to {@link ExternalProvider_Connection_OwnerScope}, which is the axis it is
+ * most likely to be confused with. This says what a secret IS; that says whose it is. A billing
+ * provider's secret key is a CREDENTIAL — it identifies an account — and is nonetheless
+ * application-owned, because the only admissible connection for it is APPLICATION. Collapsing the
+ * two would make "the deployment owns this" and "this identifies an integration" the same
+ * statement, and they are not.
+ *
+ * What the distinction buys, concretely:
+ *
+ *   - a credential row owned by a tenant or a person may hold a CREDENTIAL and never a REGISTRATION.
+ *     Without the mark, nothing stopped a tenant storing a row slugged `SLACK_CLIENT_SECRET` that no
+ *     reader would ever consult — inert, and indistinguishable from a working connection on screen;
+ *   - the connect flow can derive WHICH slug a grant is stored under by construction, rather than
+ *     by the convention that it happens to be the REST contract's `apiKey.secretRef`;
+ *   - a vendor that supports per-tenant app registrations becomes SAYABLE, which it is not today.
+ */
+export var ExternalProvider_SecretScope;
+(function (ExternalProvider_SecretScope) {
+    /**
+     * Identifies the INTEGRATION — an OAuth2 client id and secret, a signing secret issued to the
+     * app's registration. Authored by the operator in the deployment environment.
+     */
+    ExternalProvider_SecretScope["REGISTRATION"] = "registration";
+    /**
+     * Identifies an ACCOUNT — a token or key standing for whoever is being acted as. May be authored
+     * in the environment (the deployment's own account) or minted into a credential row owned by a
+     * tenant or a person; which of those are permitted is the admissibility question, not this one.
+     */
+    ExternalProvider_SecretScope["CREDENTIAL"] = "credential";
+})(ExternalProvider_SecretScope || (ExternalProvider_SecretScope = {}));
+/**
+ * ON WHOSE BEHALF the act is performed — orthogonal to who owns the account.
+ *
+ * These are two questions and every combination of them is real, which is why they are two enums
+ * rather than one. An application's service identity can impersonate a user (domain-wide
+ * delegation); a tenant's own registration can mint a token that acts for one of its members; a
+ * tenant's bot token acts as nobody in particular. Collapsing the pair into a single vocabulary
+ * makes most of those unsayable:
+ *
+ * | owner × delegation | the real case |
+ * |---|---|
+ * | APPLICATION × SERVICE | a platform API key |
+ * | APPLICATION × USER | the application's service identity impersonating a user |
+ * | ORGANIZATION × SERVICE | the tenant's own bot or workspace token |
+ * | ORGANIZATION × USER | the tenant's registration, acting for one of its members |
+ * | USER × SERVICE | a personal key the user authored |
+ *
+ * OAuth 2.0 carries the same split in its grant types: the client is the REGISTRATION, and the grant
+ * decides on whose behalf a token is minted.
+ */
+export var ExternalProvider_Connection_DelegationMode;
+(function (ExternalProvider_Connection_DelegationMode) {
+    /** The call acts as the account's owner, with no third party behind it. */
+    ExternalProvider_Connection_DelegationMode["SERVICE"] = "service";
+    /** The call acts for a named user, whose authorization is what makes it permissible. */
+    ExternalProvider_Connection_DelegationMode["USER"] = "user";
+})(ExternalProvider_Connection_DelegationMode || (ExternalProvider_Connection_DelegationMode = {}));
+/**
+ * WHICH owner instance a single call spends — supplied BY THE CALL, never read from ambient context.
+ *
+ * This is the field's hardest constraint to get right and the reason it is a parameter rather than a
+ * property of the execution. `ExecutionContext.initiatorIds` answers WHO is performing the operation
+ * and `contextResourcesFieldIdentifier` answers WHICH ROWS are in scope; neither answers whose
+ * account is being spent, and a design that borrows either is wrong for a case that is entirely
+ * ordinary: one user action fanning out a message to every organization the user belongs to. One
+ * initiator, one execution, N organizations, a different account per call. An ambient answer cannot
+ * vary within one execution, so it cannot express that at all.
+ *
+ * The initiator is still decisive — as the AUTHORIZATION input. The call names the owner and the
+ * runtime asks whether this initiator may act for it. Supplying and authorizing are different jobs,
+ * and the resolver cannot verify a target it also invented.
+ */
+export const ExternalProvider_ConnectionShapeSchema = z.object({
+    ownerScope: z.enum(ExternalProvider_Connection_OwnerScope),
+    delegation: z.enum(ExternalProvider_Connection_DelegationMode)
+        .default(ExternalProvider_Connection_DelegationMode.SERVICE),
+});
+export const ExternalProvider_ConnectionTargetSchema = ExternalProvider_ConnectionShapeSchema.extend({
+    /**
+     * The organization or user whose account is spent. Absent for APPLICATION, which has exactly one
+     * instance by construction — an id there would be a second name for the deployment.
+     */
+    ownerId: z.string().optional(),
+    /**
+     * The user the act is performed for, when `delegation` is USER. Independent of `ownerId`: a
+     * tenant-owned connection acting for one of its members carries an organization in `ownerId` and a
+     * person here.
+     */
+    actingForUserId: z.string().optional(),
+}).superRefine((target, ctx) => {
+    const ownerIsInstance = target.ownerScope !== ExternalProvider_Connection_OwnerScope.APPLICATION;
+    if (ownerIsInstance && (target.ownerId === undefined || target.ownerId === '')) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['ownerId'],
+            message: `A ${target.ownerScope}-owned connection names WHICH ${target.ownerScope}; a call that omits it has not said whose account it spends.`,
+        });
+    }
+    if (!ownerIsInstance && target.ownerId !== undefined) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['ownerId'],
+            message: 'An application-owned connection has exactly one instance, so an ownerId here names something that does not exist.',
+        });
+    }
+    const delegated = target.delegation === ExternalProvider_Connection_DelegationMode.USER;
+    if (delegated && (target.actingForUserId === undefined || target.actingForUserId === '')) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['actingForUserId'],
+            message: 'A delegated call acts FOR someone, and the user it acts for is what makes it permissible — it cannot be left to be inferred.',
+        });
+    }
+    if (!delegated && target.actingForUserId !== undefined) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['actingForUserId'],
+            message: 'A SERVICE call acts for nobody. Naming a user here reads as delegation the runtime will not perform, which is worse than an error: the call succeeds as the wrong identity.',
+        });
+    }
+});
 //# sourceMappingURL=security.external-connectors-models.schemas.js.map

package/dist/esm/core/security.external-connectors-models.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../../src/core/security.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,+BAA+B,EAC/B,kBAAkB,EAClB,aAAa,EACb,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAExB,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAN,IAAY,0BA2BX;AA3BD,WAAY,0BAA0B;IACpC,iCAAiC;IACjC,2CAAa,CAAA;IAEb,0CAA0C;IAC1C,iDAAmB,CAAA;IAEnB,gDAAgD;IAChD,+CAAiB,CAAA;IAEjB,gCAAgC;IAChC,6CAAe,CAAA;IAEf,kEAAkE;IAClE,+CAAiB,CAAA;IAEjB,0CAA0C;IAC1C,+DAAiC,CAAA;IAEjC,+CAA+C;IAC/C,+DAAiC,CAAA;IAEjC,uCAAuC;IACvC,uDAAyB,CAAA;IAEzB,qDAAqD;IACrD,iEAAmC,CAAA;AACrC,CAAC,EA3BW,0BAA0B,KAA1B,0BAA0B,QA2BrC;AAED,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,MAAM,CAAN,IAAY,qCAIX;AAJD,WAAY,qCAAqC;IAC/C,0DAAiB,CAAA;IACjB,wDAAe,CAAA;IACf,0DAAiB,CAAA;AACnB,CAAC,EAJW,qCAAqC,KAArC,qCAAqC,QAIhD;AAED,MAAM,CAAN,IAAY,8CAGX;AAHD,WAAY,8CAA8C;IACxD,mEAAiB,CAAA;IACjB,mEAAiB,CAAA;AACnB,CAAC,EAHW,8CAA8C,KAA9C,8CAA8C,QAGzD;AAED,MAAM,CAAN,IAAY,mCAIX;AAJD,WAAY,mCAAmC;IAC7C,kDAAW,CAAA;IACX,0DAAmB,CAAA;IACnB,kFAA2C,CAAA;AAC7C,CAAC,EAJW,mCAAmC,KAAnC,mCAAmC,QAI9C;AAED,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,6BAA6B;IAC7B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAE5C,yDAAyD;IACzD,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE3C,iDAAiD;IACjD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEjC,8EAA8E;IAC9E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,CAAC,MAAM,CAAC;IACpE,kCAAkC;IAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE3D,yCAAyC;IACzC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAEzC,sCAAsC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE3C,sCAAsC;IACtC,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE1D,4CAA4C;IAC5C,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAExD,kDAAkD;IAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;CACjD,CAAC,CAAC;AAEH,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9D,6BAA6B;IAC7B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAExC,6CAA6C;IAC7C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1B,wCAAwC;IACxC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAErC,gEAAgE;IAChE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,MAAM,CAAC;IAE7G,wCAAwC;IACxC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;CACnD,CAAC,CAAC;AAUH,gFAAgF;AAChF,qCAAqC;AACrC,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC9E,iCAAiC;IACjC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,OAAO,CAAC;QACnD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;QAClD,qDAAqD;QACrD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC;IAEF,wCAAwC;IACxC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,cAAc,CAAC;QAC1D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;QAChD,qBAAqB;QACrB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC,OAAO,CAAC,8CAA8C,CAAC,MAAM,CAAC;QAChI,gDAAgD;QAChD,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;QACpE,wCAAwC;QACxC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACtC,0DAA0D;QAC1D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC;IAEF,sCAAsC;IACtC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,MAAM,CAAC;QAClD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,MAAM,CAAC;QAC7G,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;QAClD,iCAAiC;QACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACrC,mBAAmB;QACnB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC,OAAO,CAAC,mCAAmC,CAAC,GAAG,CAAC;KACrG,CAAC;IAEF,wCAAwC;IACxC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,cAAc,CAAC;QAC1D,yBAAyB;QACzB,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAChC,aAAa;QACb,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,wBAAwB;QACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,4BAA4B;QAC5B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;KACtE,CAAC;IAEF,mDAAmD;IACnD,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,MAAM,CAAC;QAElD,uDAAuD;QACvD;;;;WAIG;QACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAExC,wDAAwD;QACxD,gEAAgE;QAChE,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC3B,gBAAgB;QAChB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC5B,+CAA+C;QAC/C,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAE9B,4CAA4C;QAC5C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAEtC,2BAA2B;QAC3B,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;QAE9C,iCAAiC;QACjC,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,QAAQ,EAAE;QAE3E,mBAAmB;QACnB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC5B,kBAAkB;QAClB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;QAEjD,sBAAsB;QACtB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;QAExC,mCAAmC;QACnC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;QAEhD,qCAAqC;QACrC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAE5D,6BAA6B;QAC7B,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAE7D,uCAAuC;QACvC,sDAAsD;QACtD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC7E,+CAA+C;QAC/C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACzC,CAAC;IAEF,+BAA+B;IAC/B,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,KAAK,CAAC;QACjD,+BAA+B;QAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,+BAA+B;QAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC;IAEF,4BAA4B;IAC5B,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC;KACjD,CAAC;IAEF,0BAA0B;IAC1B,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,eAAe,CAAC;QAC3D,8CAA8C;QAC9C,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KACxC,CAAC;IAEF,qBAAqB;IACrB,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,UAAU,CAAC;QACtD,4BAA4B;QAC5B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACrC,4BAA4B;QAC5B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpC,+BAA+B;QAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC7B,CAAC;CACH,CAAC,CAAC","sourcesContent":["/**\n * Security and Authentication Schemas for External Connectors\n * \n * This module defines authentication profiles that can be used across protocols.\n * It integrates with OAuth2 to avoid duplication between API auth and OAuth2 config.\n * \n * Architecture:\n * - ExternalProvider_Auth_Kind: The type of authentication\n * - ExternalProvider_AuthProfile: How to authenticate with an API\n * - OAuth2-linked profiles: Reference OAuth2 config instead of duplicating\n * \n * @see https://swagger.io/docs/specification/v3_0/authentication/\n */\n\nimport { z } from \"zod\";\nimport {\n  OAuth2_GrantType,\n  OAuth2_TokenEndpoint_AuthMethod,\n  OAuth2_PKCE_Method,\n  OAuth2_Prompt,\n  OAuth2_AccessType,\n} from './oauth2.enums';\n\n// =============================================================================\n// AUTH KIND ENUM\n// =============================================================================\n\n/**\n * Authentication types supported by external providers\n * Follows OpenAPI 3.0 Security Schemes with extensions\n */\nexport enum ExternalProvider_Auth_Kind {\n  /** No authentication required */\n  NONE = \"none\",\n  \n  /** API Key in header, query, or cookie */\n  API_KEY = \"api_key\",\n  \n  /** Bearer token (OAuth2 access token or JWT) */\n  BEARER = \"bearer\",\n  \n  /** HTTP Basic authentication */\n  BASIC = \"basic\",\n  \n  /** OAuth2 authentication - links to OAuth2 provider definition */\n  OAUTH2 = \"oauth2\",\n  \n  /** HMAC signature-based authentication */\n  HMAC_SIGNATURE = \"hmac_signature\",\n  \n  /** OpenID Connect (OAuth2 + identity layer) */\n  OPENID_CONNECT = \"openid_connect\",\n  \n  /** Mutual TLS (client certificates) */\n  MUTUAL_TLS = \"mutual_tls\",\n  \n  /** Frontend-specific secret (not exposed to user) */\n  FRONTEND_SECRET = \"frontend_secret\",\n}\n\n// =============================================================================\n// AUTH CONFIGURATION ENUMS\n// =============================================================================\n\nexport enum ExternalProvider_Auth_ApiKey_Location {\n  HEADER = \"header\",\n  QUERY = \"query\",\n  COOKIE = \"cookie\",\n}\n\nexport enum ExternalProvider_Auth_HMAC_Signature_Algorithm {\n  SHA256 = \"sha256\",\n  SHA512 = \"sha512\",\n}\n\nexport enum ExternalProvider_Auth_Bearer_Format {\n  JWT = \"jwt\",\n  API_KEY = \"api_key\",\n  OAUTH2_ACCESS_TOKEN = \"oauth2_access_token\",\n}\n\n// =============================================================================\n// AUTH CONFIGURATION SCHEMA\n// =============================================================================\n\n/**\n * Auth Configuration - references a secret\n * This is the runtime configuration that specifies which secret to use\n */\nexport const ExternalProvider_Auth_ConfigurationSchema = z.object({\n  /** Type of authentication */\n  authKind: z.enum(ExternalProvider_Auth_Kind),\n  \n  /** References to auth profiles this config applies to */\n  profileRefs: z.array(z.string()).optional(),\n  \n  /** Is this the default auth for the provider? */\n  isDefault: z.boolean().optional(),\n  \n  /** Reference to the secret (environment variable name or secret store key) */\n  secretRef: z.string(),\n});\n\n// =============================================================================\n// RATE LIMIT CONFIGURATION\n// =============================================================================\n\nexport const ExternalProvider_RateLimitConfigurationSchema = z.object({\n  /** Maximum concurrent requests */\n  maxConcurrent: z.number().positive().optional().default(10),\n  \n  /** Minimum time (ms) between requests */\n  minTime: z.number().positive().optional(),\n  \n  /** Request reservoir (bucket size) */\n  reservoir: z.number().positive().optional(),\n  \n  /** Reservoir refresh interval (ms) */\n  reservoirRefreshInterval: z.number().positive().optional(),\n  \n  /** Amount to add to reservoir on refresh */\n  reservoirRefreshAmount: z.number().positive().optional(),\n  \n  /** Request priority (higher = higher priority) */\n  priority: z.number().int().optional().default(0),\n});\n\n// =============================================================================\n// AUTH PROFILE BASE SCHEMA\n// =============================================================================\n\nexport const ExternalProvider_AuthProfile_BaseSchema = z.object({\n  /** Type of authentication */\n  kind: z.enum(ExternalProvider_Auth_Kind),\n  \n  /** Unique reference for this auth profile */\n  ref: z.string().optional(),\n  \n  /** Is this the default auth profile? */\n  isDefault: z.boolean().default(false),\n  \n  /** Where to place the authentication (header, query, cookie) */\n  location: z.enum(ExternalProvider_Auth_ApiKey_Location).default(ExternalProvider_Auth_ApiKey_Location.HEADER),\n  \n  /** Field name for the authentication */\n  locationField: z.string().default(\"Authorization\"),\n});\n\n// =============================================================================\n// INFERRED BASE TYPES\n// =============================================================================\n\nexport type ExternalProvider_Auth_Configuration = z.infer<typeof ExternalProvider_Auth_ConfigurationSchema>;\nexport type ExternalProvider_RateLimitConfiguration = z.infer<typeof ExternalProvider_RateLimitConfigurationSchema>;\nexport type ExternalProvider_AuthProfile_Base = z.infer<typeof ExternalProvider_AuthProfile_BaseSchema>;\n\n// =============================================================================\n// DISCRIMINATED AUTH PROFILE SCHEMAS\n// =============================================================================\n\n/**\n * Complete Auth Profile Schema - discriminated union by kind\n * Each kind has specific configuration fields\n */\nexport const ExternalProvider_AuthProfile_Schema = z.discriminatedUnion(\"kind\", [\n  // ─── API Key Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.API_KEY),\n    locationField: z.string().default(\"Authorization\"),\n    /** Prefix before the key value (e.g., \"Api-Key \") */\n    prefix: z.string().optional(),\n  }),\n  \n  // ─── HMAC Signature Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.HMAC_SIGNATURE),\n    locationField: z.string().default(\"X-Signature\"),\n    /** HMAC algorithm */\n    algorithm: z.enum(ExternalProvider_Auth_HMAC_Signature_Algorithm).default(ExternalProvider_Auth_HMAC_Signature_Algorithm.SHA256),\n    /** What data to sign (body, timestamp, etc.) */\n    signaturePayload: z.enum(['body', 'timestamp', 'custom']).optional(),\n    /** Timestamp header name (if needed) */\n    timestampHeader: z.string().optional(),\n    /** Nonce header name (if needed for replay protection) */\n    nonceHeader: z.string().optional(),\n  }),\n  \n  // ─── Bearer Token Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.BEARER),\n    location: z.enum(ExternalProvider_Auth_ApiKey_Location).default(ExternalProvider_Auth_ApiKey_Location.HEADER),\n    locationField: z.string().default(\"Authorization\"),\n    /** Prefix (usually \"Bearer \") */\n    prefix: z.string().default(\"Bearer \"),\n    /** Token format */\n    format: z.enum(ExternalProvider_Auth_Bearer_Format).default(ExternalProvider_Auth_Bearer_Format.JWT),\n  }),\n  \n  // ─── OpenID Connect Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.OPENID_CONNECT),\n    /** OIDC Discovery URL */\n    discoveryUrl: z.url().optional(),\n    /** Issuer */\n    issuer: z.string().optional(),\n    /** Expected audience */\n    audience: z.string().optional(),\n    /** Token validation mode */\n    validationMode: z.enum(['jwks', 'introspection', 'local']).optional(),\n  }),\n  \n  // ─── OAuth2 Authentication (UNIFIED APPROACH) ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.OAUTH2),\n    \n    // ─── OAuth2 Provider Reference (Unified Approach) ───\n    /**\n     * Reference to OAuth2 provider definition\n     * Instead of duplicating OAuth2 config, reference the provider\n     * by its string identifier (e.g., \"google\", \"microsoft\")\n     */\n    oauth2ProviderRef: z.string().optional(),\n    \n    // ─── Inline OAuth2 Configuration (Legacy/Override) ───\n    /** Authorization URL (can be overridden or used when no ref) */\n    authUrl: z.url().optional(),\n    /** Token URL */\n    tokenUrl: z.url().optional(),\n    /** Refresh URL (if different from tokenUrl) */\n    refreshUrl: z.url().optional(),\n    \n    /** Required scopes for this auth profile */\n    scopes: z.array(z.string()).optional(),\n    \n    /** Preferred grant type */\n    grantType: z.enum(OAuth2_GrantType).optional(),\n    \n    /** Token endpoint auth method */\n    tokenEndpointAuthMethod: z.enum(OAuth2_TokenEndpoint_AuthMethod).optional(),\n    \n    /** PKCE support */\n    pkce: z.boolean().optional(),\n    /** PKCE method */\n    pkceMethod: z.enum(OAuth2_PKCE_Method).optional(),\n    \n    /** Prompt behavior */\n    prompt: z.enum(OAuth2_Prompt).optional(),\n    \n    /** Access type (online/offline) */\n    accessType: z.enum(OAuth2_AccessType).optional(),\n    \n    /** Extra authorization parameters */\n    extraAuthParams: z.record(z.string(), z.string()).optional(),\n    \n    /** Extra token parameters */\n    extraTokenParams: z.record(z.string(), z.string()).optional(),\n    \n    // ─── Token Format (for API calls) ───\n    /** How to format the token in Authorization header */\n    tokenFormat: z.enum(['bearer', 'token', 'oauth', 'custom']).default('bearer'),\n    /** Custom prefix if tokenFormat is 'custom' */\n    customTokenPrefix: z.string().optional(),\n  }),\n  \n  // ─── Basic Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.BASIC),\n    /** Username field reference */\n    usernameRef: z.string().optional(),\n    /** Password field reference */\n    passwordRef: z.string().optional(),\n  }),\n  \n  // ─── No Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.NONE),\n  }),\n  \n  // ─── Frontend Secret ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.FRONTEND_SECRET),\n    /** Secret is only used in frontend context */\n    frontendOnly: z.boolean().default(true),\n  }),\n  \n  // ─── Mutual TLS ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.MUTUAL_TLS),\n    /** Certificate reference */\n    certificateRef: z.string().optional(),\n    /** Private key reference */\n    privateKeyRef: z.string().optional(),\n    /** CA certificate reference */\n    caRef: z.string().optional(),\n  }),\n]);\nexport type ExternalProvider_AuthProfile = z.infer<typeof ExternalProvider_AuthProfile_Schema>;\n"]}
+{"version":3,"file":"security.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../../src/core/security.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,+BAA+B,EAC/B,kBAAkB,EAClB,aAAa,EACb,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAExB,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAN,IAAY,0BA2BX;AA3BD,WAAY,0BAA0B;IACpC,iCAAiC;IACjC,2CAAa,CAAA;IAEb,0CAA0C;IAC1C,iDAAmB,CAAA;IAEnB,gDAAgD;IAChD,+CAAiB,CAAA;IAEjB,gCAAgC;IAChC,6CAAe,CAAA;IAEf,kEAAkE;IAClE,+CAAiB,CAAA;IAEjB,0CAA0C;IAC1C,+DAAiC,CAAA;IAEjC,+CAA+C;IAC/C,+DAAiC,CAAA;IAEjC,uCAAuC;IACvC,uDAAyB,CAAA;IAEzB,qDAAqD;IACrD,iEAAmC,CAAA;AACrC,CAAC,EA3BW,0BAA0B,KAA1B,0BAA0B,QA2BrC;AAED,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,MAAM,CAAN,IAAY,qCAIX;AAJD,WAAY,qCAAqC;IAC/C,0DAAiB,CAAA;IACjB,wDAAe,CAAA;IACf,0DAAiB,CAAA;AACnB,CAAC,EAJW,qCAAqC,KAArC,qCAAqC,QAIhD;AAED,MAAM,CAAN,IAAY,8CAGX;AAHD,WAAY,8CAA8C;IACxD,mEAAiB,CAAA;IACjB,mEAAiB,CAAA;AACnB,CAAC,EAHW,8CAA8C,KAA9C,8CAA8C,QAGzD;AAED,MAAM,CAAN,IAAY,mCAIX;AAJD,WAAY,mCAAmC;IAC7C,kDAAW,CAAA;IACX,0DAAmB,CAAA;IACnB,kFAA2C,CAAA;AAC7C,CAAC,EAJW,mCAAmC,KAAnC,mCAAmC,QAI9C;AAED,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,6BAA6B;IAC7B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAE5C,yDAAyD;IACzD,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE3C,iDAAiD;IACjD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEjC,8EAA8E;IAC9E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,CAAC,MAAM,CAAC;IACpE,kCAAkC;IAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE3D,yCAAyC;IACzC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAEzC,sCAAsC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE3C,sCAAsC;IACtC,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE1D,4CAA4C;IAC5C,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAExD,kDAAkD;IAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;CACjD,CAAC,CAAC;AAEH,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9D,6BAA6B;IAC7B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAExC,6CAA6C;IAC7C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1B,wCAAwC;IACxC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAErC,gEAAgE;IAChE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,MAAM,CAAC;IAE7G,wCAAwC;IACxC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;CACnD,CAAC,CAAC;AAUH,gFAAgF;AAChF,qCAAqC;AACrC,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC9E,iCAAiC;IACjC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,OAAO,CAAC;QACnD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;QAClD,qDAAqD;QACrD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC;IAEF,wCAAwC;IACxC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,cAAc,CAAC;QAC1D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;QAChD,qBAAqB;QACrB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC,OAAO,CAAC,8CAA8C,CAAC,MAAM,CAAC;QAChI,gDAAgD;QAChD,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;QACpE,wCAAwC;QACxC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACtC,0DAA0D;QAC1D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC;IAEF,sCAAsC;IACtC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,MAAM,CAAC;QAClD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,MAAM,CAAC;QAC7G,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;QAClD,iCAAiC;QACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACrC,mBAAmB;QACnB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC,OAAO,CAAC,mCAAmC,CAAC,GAAG,CAAC;KACrG,CAAC;IAEF,wCAAwC;IACxC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,cAAc,CAAC;QAC1D,yBAAyB;QACzB,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAChC,aAAa;QACb,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,wBAAwB;QACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,4BAA4B;QAC5B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;KACtE,CAAC;IAEF,mDAAmD;IACnD,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,MAAM,CAAC;QAElD,uDAAuD;QACvD;;;;WAIG;QACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAExC,wDAAwD;QACxD,gEAAgE;QAChE,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC3B,gBAAgB;QAChB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC5B,+CAA+C;QAC/C,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAE9B,4CAA4C;QAC5C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAEtC,2BAA2B;QAC3B,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;QAE9C,iCAAiC;QACjC,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,QAAQ,EAAE;QAE3E,mBAAmB;QACnB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC5B,kBAAkB;QAClB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;QAEjD,sBAAsB;QACtB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;QAExC,mCAAmC;QACnC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;QAEhD,qCAAqC;QACrC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAE5D,6BAA6B;QAC7B,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAE7D,uCAAuC;QACvC,sDAAsD;QACtD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC7E,+CAA+C;QAC/C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACzC,CAAC;IAEF,+BAA+B;IAC/B,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,KAAK,CAAC;QACjD,+BAA+B;QAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,+BAA+B;QAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC;IAEF,4BAA4B;IAC5B,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC;KACjD,CAAC;IAEF,0BAA0B;IAC1B,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,eAAe,CAAC;QAC3D,8CAA8C;QAC9C,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KACxC,CAAC;IAEF,qBAAqB;IACrB,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,UAAU,CAAC;QACtD,4BAA4B;QAC5B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACrC,4BAA4B;QAC5B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpC,+BAA+B;QAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC7B,CAAC;CACH,CAAC,CAAC;AAGH,gFAAgF;AAChF,sEAAsE;AACtE,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAN,IAAY,sCAOX;AAPD,WAAY,sCAAsC;IAChD,qGAAqG;IACrG,qEAA2B,CAAA;IAC3B,mGAAmG;IACnG,uEAA6B,CAAA;IAC7B,uFAAuF;IACvF,uDAAa,CAAA;AACf,CAAC,EAPW,sCAAsC,KAAtC,sCAAsC,QAOjD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAN,IAAY,4BAYX;AAZD,WAAY,4BAA4B;IACtC;;;OAGG;IACH,6DAA6B,CAAA;IAC7B;;;;OAIG;IACH,yDAAyB,CAAA;AAC3B,CAAC,EAZW,4BAA4B,KAA5B,4BAA4B,QAYvC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAN,IAAY,0CAKX;AALD,WAAY,0CAA0C;IACpD,2EAA2E;IAC3E,iEAAmB,CAAA;IACnB,wFAAwF;IACxF,2DAAa,CAAA;AACf,CAAC,EALW,0CAA0C,KAA1C,0CAA0C,QAKrD;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC;IAC1D,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,0CAA0C,CAAC;SAC3D,OAAO,CAAC,0CAA0C,CAAC,OAAO,CAAC;CAC/D,CAAC,CAAC;AAaH,MAAM,CAAC,MAAM,uCAAuC,GAAG,sCAAsC,CAAC,MAAM,CAAC;IACnG;;;OAGG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,eAAe,GAAG,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW,CAAC;IACjG,IAAI,eAAe,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,EAAE,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,OAAO,EAAE,KAAK,MAAM,CAAC,UAAU,iCAAiC,MAAM,CAAC,UAAU,8DAA8D;SAChJ,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACrD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,OAAO,EAAE,mHAAmH;SAC7H,CAAC,CAAC;IACL,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,KAAK,0CAA0C,CAAC,IAAI,CAAC;IACxF,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,eAAe,KAAK,SAAS,IAAI,MAAM,CAAC,eAAe,KAAK,EAAE,CAAC,EAAE,CAAC;QACzF,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EAAE,8HAA8H;SACxI,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACvD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EAAE,6KAA6K;SACvL,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC","sourcesContent":["/**\n * Security and Authentication Schemas for External Connectors\n * \n * This module defines authentication profiles that can be used across protocols.\n * It integrates with OAuth2 to avoid duplication between API auth and OAuth2 config.\n * \n * Architecture:\n * - ExternalProvider_Auth_Kind: The type of authentication\n * - ExternalProvider_AuthProfile: How to authenticate with an API\n * - OAuth2-linked profiles: Reference OAuth2 config instead of duplicating\n * \n * @see https://swagger.io/docs/specification/v3_0/authentication/\n */\n\nimport { z } from \"zod\";\nimport {\n  OAuth2_GrantType,\n  OAuth2_TokenEndpoint_AuthMethod,\n  OAuth2_PKCE_Method,\n  OAuth2_Prompt,\n  OAuth2_AccessType,\n} from './oauth2.enums';\n\n// =============================================================================\n// AUTH KIND ENUM\n// =============================================================================\n\n/**\n * Authentication types supported by external providers\n * Follows OpenAPI 3.0 Security Schemes with extensions\n */\nexport enum ExternalProvider_Auth_Kind {\n  /** No authentication required */\n  NONE = \"none\",\n  \n  /** API Key in header, query, or cookie */\n  API_KEY = \"api_key\",\n  \n  /** Bearer token (OAuth2 access token or JWT) */\n  BEARER = \"bearer\",\n  \n  /** HTTP Basic authentication */\n  BASIC = \"basic\",\n  \n  /** OAuth2 authentication - links to OAuth2 provider definition */\n  OAUTH2 = \"oauth2\",\n  \n  /** HMAC signature-based authentication */\n  HMAC_SIGNATURE = \"hmac_signature\",\n  \n  /** OpenID Connect (OAuth2 + identity layer) */\n  OPENID_CONNECT = \"openid_connect\",\n  \n  /** Mutual TLS (client certificates) */\n  MUTUAL_TLS = \"mutual_tls\",\n  \n  /** Frontend-specific secret (not exposed to user) */\n  FRONTEND_SECRET = \"frontend_secret\",\n}\n\n// =============================================================================\n// AUTH CONFIGURATION ENUMS\n// =============================================================================\n\nexport enum ExternalProvider_Auth_ApiKey_Location {\n  HEADER = \"header\",\n  QUERY = \"query\",\n  COOKIE = \"cookie\",\n}\n\nexport enum ExternalProvider_Auth_HMAC_Signature_Algorithm {\n  SHA256 = \"sha256\",\n  SHA512 = \"sha512\",\n}\n\nexport enum ExternalProvider_Auth_Bearer_Format {\n  JWT = \"jwt\",\n  API_KEY = \"api_key\",\n  OAUTH2_ACCESS_TOKEN = \"oauth2_access_token\",\n}\n\n// =============================================================================\n// AUTH CONFIGURATION SCHEMA\n// =============================================================================\n\n/**\n * Auth Configuration - references a secret\n * This is the runtime configuration that specifies which secret to use\n */\nexport const ExternalProvider_Auth_ConfigurationSchema = z.object({\n  /** Type of authentication */\n  authKind: z.enum(ExternalProvider_Auth_Kind),\n  \n  /** References to auth profiles this config applies to */\n  profileRefs: z.array(z.string()).optional(),\n  \n  /** Is this the default auth for the provider? */\n  isDefault: z.boolean().optional(),\n  \n  /** Reference to the secret (environment variable name or secret store key) */\n  secretRef: z.string(),\n});\n\n// =============================================================================\n// RATE LIMIT CONFIGURATION\n// =============================================================================\n\nexport const ExternalProvider_RateLimitConfigurationSchema = z.object({\n  /** Maximum concurrent requests */\n  maxConcurrent: z.number().positive().optional().default(10),\n  \n  /** Minimum time (ms) between requests */\n  minTime: z.number().positive().optional(),\n  \n  /** Request reservoir (bucket size) */\n  reservoir: z.number().positive().optional(),\n  \n  /** Reservoir refresh interval (ms) */\n  reservoirRefreshInterval: z.number().positive().optional(),\n  \n  /** Amount to add to reservoir on refresh */\n  reservoirRefreshAmount: z.number().positive().optional(),\n  \n  /** Request priority (higher = higher priority) */\n  priority: z.number().int().optional().default(0),\n});\n\n// =============================================================================\n// AUTH PROFILE BASE SCHEMA\n// =============================================================================\n\nexport const ExternalProvider_AuthProfile_BaseSchema = z.object({\n  /** Type of authentication */\n  kind: z.enum(ExternalProvider_Auth_Kind),\n  \n  /** Unique reference for this auth profile */\n  ref: z.string().optional(),\n  \n  /** Is this the default auth profile? */\n  isDefault: z.boolean().default(false),\n  \n  /** Where to place the authentication (header, query, cookie) */\n  location: z.enum(ExternalProvider_Auth_ApiKey_Location).default(ExternalProvider_Auth_ApiKey_Location.HEADER),\n  \n  /** Field name for the authentication */\n  locationField: z.string().default(\"Authorization\"),\n});\n\n// =============================================================================\n// INFERRED BASE TYPES\n// =============================================================================\n\nexport type ExternalProvider_Auth_Configuration = z.infer<typeof ExternalProvider_Auth_ConfigurationSchema>;\nexport type ExternalProvider_RateLimitConfiguration = z.infer<typeof ExternalProvider_RateLimitConfigurationSchema>;\nexport type ExternalProvider_AuthProfile_Base = z.infer<typeof ExternalProvider_AuthProfile_BaseSchema>;\n\n// =============================================================================\n// DISCRIMINATED AUTH PROFILE SCHEMAS\n// =============================================================================\n\n/**\n * Complete Auth Profile Schema - discriminated union by kind\n * Each kind has specific configuration fields\n */\nexport const ExternalProvider_AuthProfile_Schema = z.discriminatedUnion(\"kind\", [\n  // ─── API Key Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.API_KEY),\n    locationField: z.string().default(\"Authorization\"),\n    /** Prefix before the key value (e.g., \"Api-Key \") */\n    prefix: z.string().optional(),\n  }),\n  \n  // ─── HMAC Signature Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.HMAC_SIGNATURE),\n    locationField: z.string().default(\"X-Signature\"),\n    /** HMAC algorithm */\n    algorithm: z.enum(ExternalProvider_Auth_HMAC_Signature_Algorithm).default(ExternalProvider_Auth_HMAC_Signature_Algorithm.SHA256),\n    /** What data to sign (body, timestamp, etc.) */\n    signaturePayload: z.enum(['body', 'timestamp', 'custom']).optional(),\n    /** Timestamp header name (if needed) */\n    timestampHeader: z.string().optional(),\n    /** Nonce header name (if needed for replay protection) */\n    nonceHeader: z.string().optional(),\n  }),\n  \n  // ─── Bearer Token Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.BEARER),\n    location: z.enum(ExternalProvider_Auth_ApiKey_Location).default(ExternalProvider_Auth_ApiKey_Location.HEADER),\n    locationField: z.string().default(\"Authorization\"),\n    /** Prefix (usually \"Bearer \") */\n    prefix: z.string().default(\"Bearer \"),\n    /** Token format */\n    format: z.enum(ExternalProvider_Auth_Bearer_Format).default(ExternalProvider_Auth_Bearer_Format.JWT),\n  }),\n  \n  // ─── OpenID Connect Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.OPENID_CONNECT),\n    /** OIDC Discovery URL */\n    discoveryUrl: z.url().optional(),\n    /** Issuer */\n    issuer: z.string().optional(),\n    /** Expected audience */\n    audience: z.string().optional(),\n    /** Token validation mode */\n    validationMode: z.enum(['jwks', 'introspection', 'local']).optional(),\n  }),\n  \n  // ─── OAuth2 Authentication (UNIFIED APPROACH) ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.OAUTH2),\n    \n    // ─── OAuth2 Provider Reference (Unified Approach) ───\n    /**\n     * Reference to OAuth2 provider definition\n     * Instead of duplicating OAuth2 config, reference the provider\n     * by its string identifier (e.g., \"google\", \"microsoft\")\n     */\n    oauth2ProviderRef: z.string().optional(),\n    \n    // ─── Inline OAuth2 Configuration (Legacy/Override) ───\n    /** Authorization URL (can be overridden or used when no ref) */\n    authUrl: z.url().optional(),\n    /** Token URL */\n    tokenUrl: z.url().optional(),\n    /** Refresh URL (if different from tokenUrl) */\n    refreshUrl: z.url().optional(),\n    \n    /** Required scopes for this auth profile */\n    scopes: z.array(z.string()).optional(),\n    \n    /** Preferred grant type */\n    grantType: z.enum(OAuth2_GrantType).optional(),\n    \n    /** Token endpoint auth method */\n    tokenEndpointAuthMethod: z.enum(OAuth2_TokenEndpoint_AuthMethod).optional(),\n    \n    /** PKCE support */\n    pkce: z.boolean().optional(),\n    /** PKCE method */\n    pkceMethod: z.enum(OAuth2_PKCE_Method).optional(),\n    \n    /** Prompt behavior */\n    prompt: z.enum(OAuth2_Prompt).optional(),\n    \n    /** Access type (online/offline) */\n    accessType: z.enum(OAuth2_AccessType).optional(),\n    \n    /** Extra authorization parameters */\n    extraAuthParams: z.record(z.string(), z.string()).optional(),\n    \n    /** Extra token parameters */\n    extraTokenParams: z.record(z.string(), z.string()).optional(),\n    \n    // ─── Token Format (for API calls) ───\n    /** How to format the token in Authorization header */\n    tokenFormat: z.enum(['bearer', 'token', 'oauth', 'custom']).default('bearer'),\n    /** Custom prefix if tokenFormat is 'custom' */\n    customTokenPrefix: z.string().optional(),\n  }),\n  \n  // ─── Basic Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.BASIC),\n    /** Username field reference */\n    usernameRef: z.string().optional(),\n    /** Password field reference */\n    passwordRef: z.string().optional(),\n  }),\n  \n  // ─── No Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.NONE),\n  }),\n  \n  // ─── Frontend Secret ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.FRONTEND_SECRET),\n    /** Secret is only used in frontend context */\n    frontendOnly: z.boolean().default(true),\n  }),\n  \n  // ─── Mutual TLS ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.MUTUAL_TLS),\n    /** Certificate reference */\n    certificateRef: z.string().optional(),\n    /** Private key reference */\n    privateKeyRef: z.string().optional(),\n    /** CA certificate reference */\n    caRef: z.string().optional(),\n  }),\n]);\nexport type ExternalProvider_AuthProfile = z.infer<typeof ExternalProvider_AuthProfile_Schema>;\n\n// =============================================================================\n// CONNECTION IDENTITY — whose account, on whose behalf, and which one\n// =============================================================================\n\n/**\n * WHOSE ACCOUNT a call spends.\n *\n * Distinct from the scope of the DATA the call touches, and conflating the two inverts the design.\n * A billing provider is APPLICATION-owned — the payment account belongs to whoever ships the\n * application — even though almost everything it produces is organization-shaped: a customer, a\n * subscription, an invoice per tenant. Those are data in the application's own domain, produced by\n * an application-owned account. The question here is never \"does this touch organizations?\", which\n * is true of nearly everything. It is **whose account is it?**\n *\n * Delivery follows the owner and is not a separate decision: the APPLICATION's material is authored\n * in the deployment environment by an operator, and an ORGANIZATION's or a USER's is authored\n * through the application's own settings and stored, sealed, in its database.\n *\n * **No owner ever defaults to another.** An organization-owned call with no connection REFUSES; it\n * never spends the application's account. A silent substitution means the vendor sees one identity\n * while the application believes it acted as another, and every artifact the call leaves on the far\n * side — a message, a record, a line in the vendor's own audit log — is then attributed to the wrong\n * party, with nothing downstream able to detect it. An application that wants \"the tenant's key when\n * they have connected one, otherwise ours\" expresses that in its own code by choosing which\n * connection to call with, where the choice is visible.\n */\nexport enum ExternalProvider_Connection_OwnerScope {\n  /** The account belongs to the application itself. Material comes from the deployment environment. */\n  APPLICATION = \"application\",\n  /** The account belongs to one tenant — its own workspace, its own subscription with the vendor. */\n  ORGANIZATION = \"organization\",\n  /** The account belongs to one person — a personal key they authored for themselves. */\n  USER = \"user\",\n}\n\n/**\n * WHAT A DECLARED SECRET IDENTIFIES — the integration, or the account.\n *\n * A provider's `secretsContract` holds two kinds of thing and, until this existed, marked neither.\n * Slack's contract is the clearest case: `SLACK_CLIENT_ID` and `SLACK_CLIENT_SECRET` identify the\n * APPLICATION's registration with Slack, while `SLACK_API_KEY` holds a token that identifies WHOSE\n * Slack account is being acted as. They are stored differently, rotated for different reasons, and\n * owned by different parties, and one undifferentiated map made all three look alike.\n *\n * Deliberately ORTHOGONAL to {@link ExternalProvider_Connection_OwnerScope}, which is the axis it is\n * most likely to be confused with. This says what a secret IS; that says whose it is. A billing\n * provider's secret key is a CREDENTIAL — it identifies an account — and is nonetheless\n * application-owned, because the only admissible connection for it is APPLICATION. Collapsing the\n * two would make \"the deployment owns this\" and \"this identifies an integration\" the same\n * statement, and they are not.\n *\n * What the distinction buys, concretely:\n *\n *   - a credential row owned by a tenant or a person may hold a CREDENTIAL and never a REGISTRATION.\n *     Without the mark, nothing stopped a tenant storing a row slugged `SLACK_CLIENT_SECRET` that no\n *     reader would ever consult — inert, and indistinguishable from a working connection on screen;\n *   - the connect flow can derive WHICH slug a grant is stored under by construction, rather than\n *     by the convention that it happens to be the REST contract's `apiKey.secretRef`;\n *   - a vendor that supports per-tenant app registrations becomes SAYABLE, which it is not today.\n */\nexport enum ExternalProvider_SecretScope {\n  /**\n   * Identifies the INTEGRATION — an OAuth2 client id and secret, a signing secret issued to the\n   * app's registration. Authored by the operator in the deployment environment.\n   */\n  REGISTRATION = \"registration\",\n  /**\n   * Identifies an ACCOUNT — a token or key standing for whoever is being acted as. May be authored\n   * in the environment (the deployment's own account) or minted into a credential row owned by a\n   * tenant or a person; which of those are permitted is the admissibility question, not this one.\n   */\n  CREDENTIAL = \"credential\",\n}\n\n/**\n * ON WHOSE BEHALF the act is performed — orthogonal to who owns the account.\n *\n * These are two questions and every combination of them is real, which is why they are two enums\n * rather than one. An application's service identity can impersonate a user (domain-wide\n * delegation); a tenant's own registration can mint a token that acts for one of its members; a\n * tenant's bot token acts as nobody in particular. Collapsing the pair into a single vocabulary\n * makes most of those unsayable:\n *\n * | owner × delegation | the real case |\n * |---|---|\n * | APPLICATION × SERVICE | a platform API key |\n * | APPLICATION × USER | the application's service identity impersonating a user |\n * | ORGANIZATION × SERVICE | the tenant's own bot or workspace token |\n * | ORGANIZATION × USER | the tenant's registration, acting for one of its members |\n * | USER × SERVICE | a personal key the user authored |\n *\n * OAuth 2.0 carries the same split in its grant types: the client is the REGISTRATION, and the grant\n * decides on whose behalf a token is minted.\n */\nexport enum ExternalProvider_Connection_DelegationMode {\n  /** The call acts as the account's owner, with no third party behind it. */\n  SERVICE = \"service\",\n  /** The call acts for a named user, whose authorization is what makes it permissible. */\n  USER = \"user\",\n}\n\n/**\n * WHICH owner instance a single call spends — supplied BY THE CALL, never read from ambient context.\n *\n * This is the field's hardest constraint to get right and the reason it is a parameter rather than a\n * property of the execution. `ExecutionContext.initiatorIds` answers WHO is performing the operation\n * and `contextResourcesFieldIdentifier` answers WHICH ROWS are in scope; neither answers whose\n * account is being spent, and a design that borrows either is wrong for a case that is entirely\n * ordinary: one user action fanning out a message to every organization the user belongs to. One\n * initiator, one execution, N organizations, a different account per call. An ambient answer cannot\n * vary within one execution, so it cannot express that at all.\n *\n * The initiator is still decisive — as the AUTHORIZATION input. The call names the owner and the\n * runtime asks whether this initiator may act for it. Supplying and authorizing are different jobs,\n * and the resolver cannot verify a target it also invented.\n */\nexport const ExternalProvider_ConnectionShapeSchema = z.object({\n  ownerScope: z.enum(ExternalProvider_Connection_OwnerScope),\n  delegation: z.enum(ExternalProvider_Connection_DelegationMode)\n    .default(ExternalProvider_Connection_DelegationMode.SERVICE),\n});\n\n/**\n * A connection COMBINATION, with no instance attached — what a provider ADMITS.\n *\n * The capability and the call are the same two axes and different objects, which is why this is a\n * separate schema rather than the target with its identifiers made optional. A provider admitting\n * `ORGANIZATION × USER` says nothing about which organization; a call naming an organization and no\n * user is incomplete. Making one schema serve both would have to relax exactly the refinements that\n * make the call safe.\n */\nexport type ExternalProvider_ConnectionShape = z.infer<typeof ExternalProvider_ConnectionShapeSchema>;\n\nexport const ExternalProvider_ConnectionTargetSchema = ExternalProvider_ConnectionShapeSchema.extend({\n  /**\n   * The organization or user whose account is spent. Absent for APPLICATION, which has exactly one\n   * instance by construction — an id there would be a second name for the deployment.\n   */\n  ownerId: z.string().optional(),\n  /**\n   * The user the act is performed for, when `delegation` is USER. Independent of `ownerId`: a\n   * tenant-owned connection acting for one of its members carries an organization in `ownerId` and a\n   * person here.\n   */\n  actingForUserId: z.string().optional(),\n}).superRefine((target, ctx) => {\n  const ownerIsInstance = target.ownerScope !== ExternalProvider_Connection_OwnerScope.APPLICATION;\n  if (ownerIsInstance && (target.ownerId === undefined || target.ownerId === '')) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['ownerId'],\n      message: `A ${target.ownerScope}-owned connection names WHICH ${target.ownerScope}; a call that omits it has not said whose account it spends.`,\n    });\n  }\n  if (!ownerIsInstance && target.ownerId !== undefined) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['ownerId'],\n      message: 'An application-owned connection has exactly one instance, so an ownerId here names something that does not exist.',\n    });\n  }\n  const delegated = target.delegation === ExternalProvider_Connection_DelegationMode.USER;\n  if (delegated && (target.actingForUserId === undefined || target.actingForUserId === '')) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['actingForUserId'],\n      message: 'A delegated call acts FOR someone, and the user it acts for is what makes it permissible — it cannot be left to be inferred.',\n    });\n  }\n  if (!delegated && target.actingForUserId !== undefined) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['actingForUserId'],\n      message: 'A SERVICE call acts for nobody. Naming a user here reads as delegation the runtime will not perform, which is worse than an error: the call succeeds as the wrong identity.',\n    });\n  }\n});\n\nexport type ExternalProvider_ConnectionTarget = z.infer<typeof ExternalProvider_ConnectionTargetSchema>;\n"]}

package/dist/esm/features/core.external-connectors-models.schemas.d.ts

@@ -1,63 +0,0 @@
-/**
- * External Provider Capabilities - Core Definitions
- *
- * Capabilities represent standardized behaviors that can be implemented
- * across multiple providers. Each capability has:
- * - A standard interface (request/response schemas)
- * - A transformer interface (for provider-specific ETL)
- * - Discovery through provider definitions (not protocols)
- *
- * Capabilities are defined at the PROVIDER level, not protocol level.
- * This enables provider-agnostic usage in the backend through
- * the ETL (Extract-Transform-Load) pattern.
- */
-/**
- * Standard capabilities that providers can implement.
- * Each capability maps to a standardized interface and ETL transformer.
- *
- * IMPORTANT: Each capability is fully independent - even if related
- * (like email capabilities), they have separate transformers and files.
- */
-export declare enum ExternalConnectorCapability {
-    /**
-     * Transactional email sending - password resets, receipts, notifications.
-     * Standard interface: StandardEmail_SendRequest/Response
-     * Transformer: EmailTransactional_Transformer
-     */
-    EMAIL_TRANSACTIONAL = "email_transactional",
-    /**
-     * Marketing email campaigns - newsletters, promotions.
-     * Standard interface: StandardMarketing_CampaignRequest/Response
-     * Transformer: EmailMarketing_Transformer
-     */
-    EMAIL_MARKETING = "email_marketing",
-    /**
-     * Billing provider — subscriptions, payments, invoices, metered usage.
-     * Standard interface: StandardBilling_Interface
-     * Transformer: Billing_Transformer
-     */
-    BILLING = "billing",
-    /**
-     * SMS sending - OTP codes, phone verification, notifications.
-     * Standard interface: StandardSMS_SendRequest/Response
-     * Transformer: SMS_Transformer
-     */
-    SMS = "sms"
-}
-/**
- * Metadata about each capability for discovery and documentation.
- */
-export declare const ExternalConnectorCapabilityMetadata: Record<ExternalConnectorCapability, {
-    displayName: string;
-    description: string;
-    category: "email" | "llm" | "auth" | "storage" | "billing" | "sms" | "other";
-}>;
-/**
- * Base interface for all capability transformers.
- * Each capability extends this with its specific transformation methods.
- */
-export interface CapabilityTransformer<TCapability extends ExternalConnectorCapability = ExternalConnectorCapability> {
-    /** The capability this transformer implements */
-    readonly providerCapability: TCapability;
-}
-//# sourceMappingURL=core.external-connectors-models.schemas.d.ts.map

package/dist/esm/features/core.external-connectors-models.schemas.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"core.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../../src/features/core.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH;;;;;;GAMG;AACH,oBAAY,2BAA2B;IAKrC;;;;OAIG;IACH,mBAAmB,wBAAwB;IAE3C;;;;OAIG;IACH,eAAe,oBAAoB;IAenC;;;;OAIG;IACH,OAAO,YAAY;IAMnB;;;;OAIG;IACH,GAAG,QAAQ;CASZ;AAMD;;GAEG;AACH,eAAO,MAAM,mCAAmC,EAAE,MAAM,CAAC,2BAA2B,EAAE;IACpF,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,KAAK,GAAG,OAAO,CAAC;CAC9E,CAqBA,CAAC;AAMF;;;GAGG;AACH,MAAM,WAAW,qBAAqB,CAAC,WAAW,SAAS,2BAA2B,GAAG,2BAA2B;IAClH,iDAAiD;IACjD,QAAQ,CAAC,kBAAkB,EAAE,WAAW,CAAC;CAC1C"}

package/dist/esm/features/core.external-connectors-models.schemas.js

@@ -1,101 +0,0 @@
-/**
- * External Provider Capabilities - Core Definitions
- *
- * Capabilities represent standardized behaviors that can be implemented
- * across multiple providers. Each capability has:
- * - A standard interface (request/response schemas)
- * - A transformer interface (for provider-specific ETL)
- * - Discovery through provider definitions (not protocols)
- *
- * Capabilities are defined at the PROVIDER level, not protocol level.
- * This enables provider-agnostic usage in the backend through
- * the ETL (Extract-Transform-Load) pattern.
- */
-// ===============================================================
-// Capabilities Enum
-// ===============================================================
-/**
- * Standard capabilities that providers can implement.
- * Each capability maps to a standardized interface and ETL transformer.
- *
- * IMPORTANT: Each capability is fully independent - even if related
- * (like email capabilities), they have separate transformers and files.
- */
-export var ExternalConnectorCapability;
-(function (ExternalConnectorCapability) {
-    // ============================================================
-    // Email Capabilities (fully segregated)
-    // ============================================================
-    /**
-     * Transactional email sending - password resets, receipts, notifications.
-     * Standard interface: StandardEmail_SendRequest/Response
-     * Transformer: EmailTransactional_Transformer
-     */
-    ExternalConnectorCapability["EMAIL_TRANSACTIONAL"] = "email_transactional";
-    /**
-     * Marketing email campaigns - newsletters, promotions.
-     * Standard interface: StandardMarketing_CampaignRequest/Response
-     * Transformer: EmailMarketing_Transformer
-     */
-    ExternalConnectorCapability["EMAIL_MARKETING"] = "email_marketing";
-    // ============================================================
-    // LLM Capabilities (future)
-    // ============================================================
-    // LLM_TEXT_GENERATION = "llm_text_generation",
-    // LLM_STRUCTURED_OUTPUT = "llm_structured_output",
-    // LLM_STREAMING = "llm_streaming",
-    // LLM_MULTIMODAL = "llm_multimodal",
-    // ============================================================
-    // Billing Capabilities
-    // ============================================================
-    /**
-     * Billing provider — subscriptions, payments, invoices, metered usage.
-     * Standard interface: StandardBilling_Interface
-     * Transformer: Billing_Transformer
-     */
-    ExternalConnectorCapability["BILLING"] = "billing";
-    // ============================================================
-    // SMS Capabilities (Phase G2)
-    // ============================================================
-    /**
-     * SMS sending - OTP codes, phone verification, notifications.
-     * Standard interface: StandardSMS_SendRequest/Response
-     * Transformer: SMS_Transformer
-     */
-    ExternalConnectorCapability["SMS"] = "sms";
-    // ============================================================
-    // Other Capabilities (future)
-    // ============================================================
-    // OAUTH2_SSO = "oauth2_sso",
-    // WEBHOOK_RECEIVER = "webhook_receiver",
-    // FILE_STORAGE = "file_storage",
-})(ExternalConnectorCapability || (ExternalConnectorCapability = {}));
-// ===============================================================
-// Capability Metadata
-// ===============================================================
-/**
- * Metadata about each capability for discovery and documentation.
- */
-export const ExternalConnectorCapabilityMetadata = {
-    [ExternalConnectorCapability.EMAIL_TRANSACTIONAL]: {
-        displayName: "Transactional Email",
-        description: "Send transactional emails like password resets, receipts, and notifications",
-        category: "email",
-    },
-    [ExternalConnectorCapability.EMAIL_MARKETING]: {
-        displayName: "Marketing Email",
-        description: "Send marketing campaigns, newsletters, and promotional emails",
-        category: "email",
-    },
-    [ExternalConnectorCapability.BILLING]: {
-        displayName: "Billing",
-        description: "Manage subscriptions, payments, invoices, and metered usage via a billing provider",
-        category: "billing",
-    },
-    [ExternalConnectorCapability.SMS]: {
-        displayName: "SMS",
-        description: "Send SMS messages for OTP codes, phone verification, and notifications",
-        category: "sms",
-    },
-};
-//# sourceMappingURL=core.external-connectors-models.schemas.js.map

package/dist/esm/features/core.external-connectors-models.schemas.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"core.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../../src/features/core.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,kEAAkE;AAClE,oBAAoB;AACpB,kEAAkE;AAElE;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,2BAyDX;AAzDD,WAAY,2BAA2B;IACrC,+DAA+D;IAC/D,wCAAwC;IACxC,+DAA+D;IAE/D;;;;OAIG;IACH,0EAA2C,CAAA;IAE3C;;;;OAIG;IACH,kEAAmC,CAAA;IAEnC,+DAA+D;IAC/D,4BAA4B;IAC5B,+DAA+D;IAE/D,+CAA+C;IAC/C,mDAAmD;IACnD,mCAAmC;IACnC,qCAAqC;IAErC,+DAA+D;IAC/D,uBAAuB;IACvB,+DAA+D;IAE/D;;;;OAIG;IACH,kDAAmB,CAAA;IAEnB,+DAA+D;IAC/D,8BAA8B;IAC9B,+DAA+D;IAE/D;;;;OAIG;IACH,0CAAW,CAAA;IAEX,+DAA+D;IAC/D,8BAA8B;IAC9B,+DAA+D;IAE/D,6BAA6B;IAC7B,yCAAyC;IACzC,iCAAiC;AACnC,CAAC,EAzDW,2BAA2B,KAA3B,2BAA2B,QAyDtC;AAED,kEAAkE;AAClE,sBAAsB;AACtB,kEAAkE;AAElE;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAI3C;IACH,CAAC,2BAA2B,CAAC,mBAAmB,CAAC,EAAE;QACjD,WAAW,EAAE,qBAAqB;QAClC,WAAW,EAAE,6EAA6E;QAC1F,QAAQ,EAAE,OAAO;KAClB;IACD,CAAC,2BAA2B,CAAC,eAAe,CAAC,EAAE;QAC7C,WAAW,EAAE,iBAAiB;QAC9B,WAAW,EAAE,+DAA+D;QAC5E,QAAQ,EAAE,OAAO;KAClB;IACD,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE;QACrC,WAAW,EAAE,SAAS;QACtB,WAAW,EAAE,oFAAoF;QACjG,QAAQ,EAAE,SAAS;KACpB;IACD,CAAC,2BAA2B,CAAC,GAAG,CAAC,EAAE;QACjC,WAAW,EAAE,KAAK;QAClB,WAAW,EAAE,wEAAwE;QACrF,QAAQ,EAAE,KAAK;KAChB;CACF,CAAC","sourcesContent":["/**\n * External Provider Capabilities - Core Definitions\n * \n * Capabilities represent standardized behaviors that can be implemented\n * across multiple providers. Each capability has:\n * - A standard interface (request/response schemas)\n * - A transformer interface (for provider-specific ETL)\n * - Discovery through provider definitions (not protocols)\n * \n * Capabilities are defined at the PROVIDER level, not protocol level.\n * This enables provider-agnostic usage in the backend through\n * the ETL (Extract-Transform-Load) pattern.\n */\n\n// ===============================================================\n// Capabilities Enum\n// ===============================================================\n\n/**\n * Standard capabilities that providers can implement.\n * Each capability maps to a standardized interface and ETL transformer.\n * \n * IMPORTANT: Each capability is fully independent - even if related\n * (like email capabilities), they have separate transformers and files.\n */\nexport enum ExternalConnectorCapability {\n  // ============================================================\n  // Email Capabilities (fully segregated)\n  // ============================================================\n  \n  /** \n   * Transactional email sending - password resets, receipts, notifications.\n   * Standard interface: StandardEmail_SendRequest/Response\n   * Transformer: EmailTransactional_Transformer\n   */\n  EMAIL_TRANSACTIONAL = \"email_transactional\",\n  \n  /** \n   * Marketing email campaigns - newsletters, promotions.\n   * Standard interface: StandardMarketing_CampaignRequest/Response\n   * Transformer: EmailMarketing_Transformer\n   */\n  EMAIL_MARKETING = \"email_marketing\",\n\n  // ============================================================\n  // LLM Capabilities (future)\n  // ============================================================\n  \n  // LLM_TEXT_GENERATION = \"llm_text_generation\",\n  // LLM_STRUCTURED_OUTPUT = \"llm_structured_output\",\n  // LLM_STREAMING = \"llm_streaming\",\n  // LLM_MULTIMODAL = \"llm_multimodal\",\n  \n  // ============================================================\n  // Billing Capabilities\n  // ============================================================\n\n  /**\n   * Billing provider — subscriptions, payments, invoices, metered usage.\n   * Standard interface: StandardBilling_Interface\n   * Transformer: Billing_Transformer\n   */\n  BILLING = \"billing\",\n\n  // ============================================================\n  // SMS Capabilities (Phase G2)\n  // ============================================================\n\n  /**\n   * SMS sending - OTP codes, phone verification, notifications.\n   * Standard interface: StandardSMS_SendRequest/Response\n   * Transformer: SMS_Transformer\n   */\n  SMS = \"sms\",\n\n  // ============================================================\n  // Other Capabilities (future)\n  // ============================================================\n  \n  // OAUTH2_SSO = \"oauth2_sso\",\n  // WEBHOOK_RECEIVER = \"webhook_receiver\",\n  // FILE_STORAGE = \"file_storage\",\n}\n\n// ===============================================================\n// Capability Metadata\n// ===============================================================\n\n/**\n * Metadata about each capability for discovery and documentation.\n */\nexport const ExternalConnectorCapabilityMetadata: Record<ExternalConnectorCapability, {\n  displayName: string;\n  description: string;\n  category: \"email\" | \"llm\" | \"auth\" | \"storage\" | \"billing\" | \"sms\" | \"other\";\n}> = {\n  [ExternalConnectorCapability.EMAIL_TRANSACTIONAL]: {\n    displayName: \"Transactional Email\",\n    description: \"Send transactional emails like password resets, receipts, and notifications\",\n    category: \"email\",\n  },\n  [ExternalConnectorCapability.EMAIL_MARKETING]: {\n    displayName: \"Marketing Email\",\n    description: \"Send marketing campaigns, newsletters, and promotional emails\",\n    category: \"email\",\n  },\n  [ExternalConnectorCapability.BILLING]: {\n    displayName: \"Billing\",\n    description: \"Manage subscriptions, payments, invoices, and metered usage via a billing provider\",\n    category: \"billing\",\n  },\n  [ExternalConnectorCapability.SMS]: {\n    displayName: \"SMS\",\n    description: \"Send SMS messages for OTP codes, phone verification, and notifications\",\n    category: \"sms\",\n  },\n};\n\n// ===============================================================\n// Capability Transformer Base\n// ===============================================================\n\n/**\n * Base interface for all capability transformers.\n * Each capability extends this with its specific transformation methods.\n */\nexport interface CapabilityTransformer<TCapability extends ExternalConnectorCapability = ExternalConnectorCapability> {\n  /** The capability this transformer implements */\n  readonly providerCapability: TCapability;\n}\n"]}