npm - @wildo-ai/external-connectors-models - Versions diffs - 1.1.10 → 1.1.12 - Mend

@wildo-ai/external-connectors-models 1.1.10 → 1.1.12

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (110) hide show

package/dist/esm/core/security.external-connectors-models.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"security.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../src/core/security.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,+BAA+B,EAC/B,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AAMxB;;;GAGG;AACH,oBAAY,0BAA0B;IACpC,iCAAiC;IACjC,IAAI,SAAS;IAEb,0CAA0C;IAC1C,OAAO,YAAY;IAEnB,gDAAgD;IAChD,MAAM,WAAW;IAEjB,gCAAgC;IAChC,KAAK,UAAU;IAEf,kEAAkE;IAClE,MAAM,WAAW;IAEjB,0CAA0C;IAC1C,cAAc,mBAAmB;IAEjC,+CAA+C;IAC/C,cAAc,mBAAmB;IAEjC,uCAAuC;IACvC,UAAU,eAAe;IAEzB,qDAAqD;IACrD,eAAe,oBAAoB;CACpC;AAMD,oBAAY,qCAAqC;IAC/C,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,MAAM,WAAW;CAClB;AAED,oBAAY,8CAA8C;IACxD,MAAM,WAAW;IACjB,MAAM,WAAW;CAClB;AAED,oBAAY,mCAAmC;IAC7C,GAAG,QAAQ;IACX,OAAO,YAAY;IACnB,mBAAmB,wBAAwB;CAC5C;AAMD;;;GAGG;AACH,eAAO,MAAM,yCAAyC;;;;;iBAYpD,CAAC;AAMH,eAAO,MAAM,6CAA6C;;;;;;;iBAkBxD,CAAC;AAMH,eAAO,MAAM,uCAAuC;;;;;;iBAelD,CAAC;AAMH,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6CAA6C,CAAC,CAAC;AACpH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAMxG;;;GAGG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAmI9C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAM/F;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,oBAAY,sCAAsC;IAChD,qGAAqG;IACrG,WAAW,gBAAgB;IAC3B,mGAAmG;IACnG,YAAY,iBAAiB;IAC7B,uFAAuF;IACvF,IAAI,SAAS;CACd;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,oBAAY,4BAA4B;IACtC;;;OAGG;IACH,YAAY,iBAAiB;IAC7B;;;;OAIG;IACH,UAAU,eAAe;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,oBAAY,0CAA0C;IACpD,2EAA2E;IAC3E,OAAO,YAAY;IACnB,wFAAwF;IACxF,IAAI,SAAS;CACd;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sCAAsC;;;~~iBAIjD~~,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,eAAO,MAAM,uCAAuC;;;;;~~iBAkDlD~~,CAAC;~~AAEH~~;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,gCAAgC,GAAG,OAAO,CAGhG;AAED;;;;;;;;GAQG;AACH,wBAAgB,0CAA0C,CAAC,KAAK,EAAE,gCAAgC,GAAG,OAAO,CAG3G;AAED,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC"}
1	+ {"version":3,"file":"security.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../src/core/security.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,+BAA+B,EAC/B,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AAMxB;;;GAGG;AACH,oBAAY,0BAA0B;IACpC,iCAAiC;IACjC,IAAI,SAAS;IAEb,0CAA0C;IAC1C,OAAO,YAAY;IAEnB,gDAAgD;IAChD,MAAM,WAAW;IAEjB,gCAAgC;IAChC,KAAK,UAAU;IAEf,kEAAkE;IAClE,MAAM,WAAW;IAEjB,0CAA0C;IAC1C,cAAc,mBAAmB;IAEjC,+CAA+C;IAC/C,cAAc,mBAAmB;IAEjC,uCAAuC;IACvC,UAAU,eAAe;IAEzB,qDAAqD;IACrD,eAAe,oBAAoB;CACpC;AAMD,oBAAY,qCAAqC;IAC/C,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,MAAM,WAAW;CAClB;AAED,oBAAY,8CAA8C;IACxD,MAAM,WAAW;IACjB,MAAM,WAAW;CAClB;AAED,oBAAY,mCAAmC;IAC7C,GAAG,QAAQ;IACX,OAAO,YAAY;IACnB,mBAAmB,wBAAwB;CAC5C;AAMD;;;GAGG;AACH,eAAO,MAAM,yCAAyC;;;;;iBAYpD,CAAC;AAMH,eAAO,MAAM,6CAA6C;;;;;;;iBAkBxD,CAAC;AAMH,eAAO,MAAM,uCAAuC;;;;;;iBAelD,CAAC;AAMH,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6CAA6C,CAAC,CAAC;AACpH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAMxG;;;GAGG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAmI9C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAM/F;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,oBAAY,sCAAsC;IAChD,qGAAqG;IACrG,WAAW,gBAAgB;IAC3B,mGAAmG;IACnG,YAAY,iBAAiB;IAC7B,uFAAuF;IACvF,IAAI,SAAS;CACd;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,oBAAY,4BAA4B;IACtC;;;OAGG;IACH,YAAY,iBAAiB;IAC7B;;;;OAIG;IACH,UAAU,eAAe;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,oBAAY,0CAA0C;IACpD,2EAA2E;IAC3E,OAAO,YAAY;IACnB,wFAAwF;IACxF,IAAI,SAAS;CACd;AAED,4HAA4H;AAC5H;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sCAAsC;;;iBAMjD,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,eAAO,MAAM,uCAAuC;;;;;iBAoDlD,CAAC;AACH,0EAA0E;AAE1E;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,gCAAgC,GAAG,OAAO,CAGhG;AAED;;;;;;;;GAQG;AACH,wBAAgB,0CAA0C,CAAC,KAAK,EAAE,gCAAgC,GAAG,OAAO,CAG3G;AAED,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC"}

package/dist/esm/core/security.external-connectors-models.schemas.js CHANGED Viewed

@@ -345,6 +345,7 @@ export var ExternalProvider_Connection_DelegationMode;
     /** The call acts for a named user, whose authorization is what makes it permissible. */
     ExternalProvider_Connection_DelegationMode["USER"] = "user";
 })(ExternalProvider_Connection_DelegationMode || (ExternalProvider_Connection_DelegationMode = {}));
+/** @wildo_source:part:start external-connectors.models.connection-target facet:layer:shared facet:audience:app-developer */
 /**
  * WHICH owner instance a single call spends — supplied BY THE CALL, never read from ambient context.
  *
@@ -361,16 +362,19 @@ export var ExternalProvider_Connection_DelegationMode;
  * and the resolver cannot verify a target it also invented.
  */
 export const ExternalProvider_ConnectionShapeSchema = z.object({
-    ownerScope: z.enum(ExternalProvider_Connection_OwnerScope),
+    ownerScope: z.enum(ExternalProvider_Connection_OwnerScope)
+        .describe('Who owns the provider account: the application itself, one organization, or one user.'),
     delegation: z.enum(ExternalProvider_Connection_DelegationMode)
-        .default(ExternalProvider_Connection_DelegationMode.SERVICE),
+        .default(ExternalProvider_Connection_DelegationMode.SERVICE)
+        .describe('On whose behalf calls act: `service` acts as the account owner itself, `user` acts for a person. Defaults to `service`.'),
 });
 export const ExternalProvider_ConnectionTargetSchema = ExternalProvider_ConnectionShapeSchema.extend({
     /**
      * The organization or user whose account is spent. Absent for APPLICATION, which has exactly one
      * instance by construction — an id there would be a second name for the deployment.
      */
-    ownerId: z.string().optional(),
+    ownerId: z.string().optional()
+        .describe('The id of the organization or user that owns the account. Required for an organization or user owner; omit it for the application.'),
     /**
      * The user an APPLICATION-owned, USER-delegated call impersonates — the ONLY shape where the call
      * itself must say who, because the application's identity could impersonate anyone.
@@ -380,7 +384,8 @@ export const ExternalProvider_ConnectionTargetSchema = ExternalProvider_Connecti
      * here would describe an identity the runtime will not act as. A USER-owned connection already
      * names its person in `ownerId`.
      */
-    actingForUserId: z.string().optional(),
+    actingForUserId: z.string().optional()
+        .describe('The user an application-owned account acts for: required when `ownerScope` is `application` and `delegation` is `user`, refused otherwise.'),
 }).superRefine((target, ctx) => {
     const ownerIsInstance = target.ownerScope !== ExternalProvider_Connection_OwnerScope.APPLICATION;
     if (ownerIsInstance && (target.ownerId === undefined || target.ownerId === '')) {
@@ -417,6 +422,7 @@ export const ExternalProvider_ConnectionTargetSchema = ExternalProvider_Connecti
         });
     }
 });
+/** @wildo_source:part:end external-connectors.models.connection-target */
 /**
  * Whether a connection target must NAME the user it acts for — true only for APPLICATION × USER.
  *

package/dist/esm/core/security.external-connectors-models.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"security.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../../src/core/security.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,+BAA+B,EAC/B,kBAAkB,EAClB,aAAa,EACb,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAExB,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAN,IAAY,0BA2BX;AA3BD,WAAY,0BAA0B;IACpC,iCAAiC;IACjC,2CAAa,CAAA;IAEb,0CAA0C;IAC1C,iDAAmB,CAAA;IAEnB,gDAAgD;IAChD,+CAAiB,CAAA;IAEjB,gCAAgC;IAChC,6CAAe,CAAA;IAEf,kEAAkE;IAClE,+CAAiB,CAAA;IAEjB,0CAA0C;IAC1C,+DAAiC,CAAA;IAEjC,+CAA+C;IAC/C,+DAAiC,CAAA;IAEjC,uCAAuC;IACvC,uDAAyB,CAAA;IAEzB,qDAAqD;IACrD,iEAAmC,CAAA;AACrC,CAAC,EA3BW,0BAA0B,KAA1B,0BAA0B,QA2BrC;AAED,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,MAAM,CAAN,IAAY,qCAIX;AAJD,WAAY,qCAAqC;IAC/C,0DAAiB,CAAA;IACjB,wDAAe,CAAA;IACf,0DAAiB,CAAA;AACnB,CAAC,EAJW,qCAAqC,KAArC,qCAAqC,QAIhD;AAED,MAAM,CAAN,IAAY,8CAGX;AAHD,WAAY,8CAA8C;IACxD,mEAAiB,CAAA;IACjB,mEAAiB,CAAA;AACnB,CAAC,EAHW,8CAA8C,KAA9C,8CAA8C,QAGzD;AAED,MAAM,CAAN,IAAY,mCAIX;AAJD,WAAY,mCAAmC;IAC7C,kDAAW,CAAA;IACX,0DAAmB,CAAA;IACnB,kFAA2C,CAAA;AAC7C,CAAC,EAJW,mCAAmC,KAAnC,mCAAmC,QAI9C;AAED,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,6BAA6B;IAC7B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAE5C,yDAAyD;IACzD,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE3C,iDAAiD;IACjD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEjC,8EAA8E;IAC9E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,CAAC,MAAM,CAAC;IACpE,kCAAkC;IAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE3D,yCAAyC;IACzC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAEzC,sCAAsC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE3C,sCAAsC;IACtC,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE1D,4CAA4C;IAC5C,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAExD,kDAAkD;IAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;CACjD,CAAC,CAAC;AAEH,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9D,6BAA6B;IAC7B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAExC,6CAA6C;IAC7C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1B,wCAAwC;IACxC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAErC,gEAAgE;IAChE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,MAAM,CAAC;IAE7G,wCAAwC;IACxC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;CACnD,CAAC,CAAC;AASH,gFAAgF;AAChF,qCAAqC;AACrC,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC9E,iCAAiC;IACjC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,OAAO,CAAC;QACnD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;QAClD,qDAAqD;QACrD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC;IAEF,wCAAwC;IACxC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,cAAc,CAAC;QAC1D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;QAChD,qBAAqB;QACrB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC,OAAO,CAAC,8CAA8C,CAAC,MAAM,CAAC;QAChI,gDAAgD;QAChD,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;QACpE,wCAAwC;QACxC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACtC,0DAA0D;QAC1D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC;IAEF,sCAAsC;IACtC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,MAAM,CAAC;QAClD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,MAAM,CAAC;QAC7G,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;QAClD,iCAAiC;QACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACrC,mBAAmB;QACnB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC,OAAO,CAAC,mCAAmC,CAAC,GAAG,CAAC;KACrG,CAAC;IAEF,wCAAwC;IACxC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,cAAc,CAAC;QAC1D,yBAAyB;QACzB,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAChC,aAAa;QACb,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,wBAAwB;QACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,4BAA4B;QAC5B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;KACtE,CAAC;IAEF,mDAAmD;IACnD,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,MAAM,CAAC;QAElD,uDAAuD;QACvD;;;;WAIG;QACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAExC,wDAAwD;QACxD,gEAAgE;QAChE,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC3B,gBAAgB;QAChB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC5B,+CAA+C;QAC/C,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAE9B,4CAA4C;QAC5C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAEtC,2BAA2B;QAC3B,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;QAE9C,iCAAiC;QACjC,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,QAAQ,EAAE;QAE3E,mBAAmB;QACnB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC5B,kBAAkB;QAClB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;QAEjD,sBAAsB;QACtB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;QAExC,mCAAmC;QACnC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;QAEhD,qCAAqC;QACrC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAE5D,6BAA6B;QAC7B,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAE7D,uCAAuC;QACvC,sDAAsD;QACtD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC7E,+CAA+C;QAC/C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACzC,CAAC;IAEF,+BAA+B;IAC/B,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,KAAK,CAAC;QACjD,+BAA+B;QAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,+BAA+B;QAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC;IAEF,4BAA4B;IAC5B,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC;KACjD,CAAC;IAEF,0BAA0B;IAC1B,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,eAAe,CAAC;QAC3D,8CAA8C;QAC9C,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KACxC,CAAC;IAEF,qBAAqB;IACrB,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,UAAU,CAAC;QACtD,4BAA4B;QAC5B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACrC,4BAA4B;QAC5B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpC,+BAA+B;QAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC7B,CAAC;CACH,CAAC,CAAC;AAGH,gFAAgF;AAChF,sEAAsE;AACtE,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAN,IAAY,sCAOX;AAPD,WAAY,sCAAsC;IAChD,qGAAqG;IACrG,qEAA2B,CAAA;IAC3B,mGAAmG;IACnG,uEAA6B,CAAA;IAC7B,uFAAuF;IACvF,uDAAa,CAAA;AACf,CAAC,EAPW,sCAAsC,KAAtC,sCAAsC,QAOjD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAN,IAAY,4BAYX;AAZD,WAAY,4BAA4B;IACtC;;;OAGG;IACH,6DAA6B,CAAA;IAC7B;;;;OAIG;IACH,yDAAyB,CAAA;AAC3B,CAAC,EAZW,4BAA4B,KAA5B,4BAA4B,QAYvC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,CAAN,IAAY,0CAKX;AALD,WAAY,0CAA0C;IACpD,2EAA2E;IAC3E,iEAAmB,CAAA;IACnB,wFAAwF;IACxF,2DAAa,CAAA;AACf,CAAC,EALW,0CAA0C,KAA1C,0CAA0C,QAKrD;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC;IAC1D,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,0CAA0C,CAAC;SAC3D,OAAO,CAAC,0CAA0C,CAAC,OAAO,CAAC;CAC/D,CAAC,CAAC;AAaH,MAAM,CAAC,MAAM,uCAAuC,GAAG,sCAAsC,CAAC,MAAM,CAAC;IACnG;;;OAGG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B;;;;;;;;OAQG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,eAAe,GAAG,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW,CAAC;IACjG,IAAI,eAAe,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,EAAE,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,OAAO,EAAE,KAAK,MAAM,CAAC,UAAU,iCAAiC,MAAM,CAAC,UAAU,8DAA8D;SAChJ,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACrD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,OAAO,EAAE,mHAAmH;SAC7H,CAAC,CAAC;IACL,CAAC;IACD,IAAI,+BAA+B,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,IAAI,MAAM,CAAC,eAAe,KAAK,EAAE,EAAE,CAAC;YAC1E,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;gBACzB,OAAO,EAAE,oIAAoI;aAC9I,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAChD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EAAE,MAAM,CAAC,UAAU,KAAK,0CAA0C,CAAC,IAAI;gBAC5E,CAAC,CAAC,KAAK,MAAM,CAAC,UAAU,sGAAsG;sBAC1H,uEAAuE;gBAC3E,CAAC,CAAC,6KAA6K;SAClL,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAAuC;IACrF,OAAO,KAAK,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW;WACzE,KAAK,CAAC,UAAU,KAAK,0CAA0C,CAAC,IAAI,CAAC;AAC5E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0CAA0C,CAAC,KAAuC;IAChG,OAAO,KAAK,CAAC,UAAU,KAAK,sCAAsC,CAAC,YAAY;WAC1E,KAAK,CAAC,UAAU,KAAK,0CAA0C,CAAC,IAAI,CAAC;AAC5E,CAAC","sourcesContent":["/*\n Security and Authentication Schemas for External Connectors\n * \n * This module defines authentication profiles that can be used across protocols.\n * It integrates with OAuth2 to avoid duplication between API auth and OAuth2 config.\n * \n * Architecture:\n * - ExternalProvider_Auth_Kind: The type of authentication\n * - ExternalProvider_AuthProfile: How to authenticate with an API\n * - OAuth2-linked profiles: Reference OAuth2 config instead of duplicating\n * \n * @see https://swagger.io/docs/specification/v3_0/authentication/\n /\n\nimport { z } from \"zod\";\nimport {\n OAuth2_GrantType,\n OAuth2_TokenEndpoint_AuthMethod,\n OAuth2_PKCE_Method,\n OAuth2_Prompt,\n OAuth2_AccessType,\n} from './oauth2.enums';\n\n// =============================================================================\n// AUTH KIND ENUM\n// =============================================================================\n\n/\n Authentication types supported by external providers\n * Follows OpenAPI 3.0 Security Schemes with extensions\n /\nexport enum ExternalProvider_Auth_Kind {\n /* No authentication required /\n NONE = \"none\",\n \n /* API Key in header, query, or cookie /\n API_KEY = \"api_key\",\n \n /* Bearer token (OAuth2 access token or JWT) /\n BEARER = \"bearer\",\n \n /* HTTP Basic authentication /\n BASIC = \"basic\",\n \n /* OAuth2 authentication - links to OAuth2 provider definition /\n OAUTH2 = \"oauth2\",\n \n /* HMAC signature-based authentication /\n HMAC_SIGNATURE = \"hmac_signature\",\n \n /* OpenID Connect (OAuth2 + identity layer) /\n OPENID_CONNECT = \"openid_connect\",\n \n /* Mutual TLS (client certificates) /\n MUTUAL_TLS = \"mutual_tls\",\n \n /* Frontend-specific secret (not exposed to user) /\n FRONTEND_SECRET = \"frontend_secret\",\n}\n\n// =============================================================================\n// AUTH CONFIGURATION ENUMS\n// =============================================================================\n\nexport enum ExternalProvider_Auth_ApiKey_Location {\n HEADER = \"header\",\n QUERY = \"query\",\n COOKIE = \"cookie\",\n}\n\nexport enum ExternalProvider_Auth_HMAC_Signature_Algorithm {\n SHA256 = \"sha256\",\n SHA512 = \"sha512\",\n}\n\nexport enum ExternalProvider_Auth_Bearer_Format {\n JWT = \"jwt\",\n API_KEY = \"api_key\",\n OAUTH2_ACCESS_TOKEN = \"oauth2_access_token\",\n}\n\n// =============================================================================\n// AUTH CONFIGURATION SCHEMA\n// =============================================================================\n\n/\n Auth Configuration - references a secret\n * This is the runtime configuration that specifies which secret to use\n /\nexport const ExternalProvider_Auth_ConfigurationSchema = z.object({\n /* Type of authentication /\n authKind: z.enum(ExternalProvider_Auth_Kind),\n \n /* References to auth profiles this config applies to /\n profileRefs: z.array(z.string()).optional(),\n \n /* Is this the default auth for the provider? /\n isDefault: z.boolean().optional(),\n \n /* Reference to the secret (environment variable name or secret store key) /\n secretRef: z.string(),\n});\n\n// =============================================================================\n// RATE LIMIT CONFIGURATION\n// =============================================================================\n\nexport const ExternalProvider_RateLimitConfigurationSchema = z.object({\n /* Maximum concurrent requests /\n maxConcurrent: z.number().positive().optional().default(10),\n \n /* Minimum time (ms) between requests /\n minTime: z.number().positive().optional(),\n \n /* Request reservoir (bucket size) /\n reservoir: z.number().positive().optional(),\n \n /* Reservoir refresh interval (ms) /\n reservoirRefreshInterval: z.number().positive().optional(),\n \n /* Amount to add to reservoir on refresh /\n reservoirRefreshAmount: z.number().positive().optional(),\n \n /* Request priority (higher = higher priority) /\n priority: z.number().int().optional().default(0),\n});\n\n// =============================================================================\n// AUTH PROFILE BASE SCHEMA\n// =============================================================================\n\nexport const ExternalProvider_AuthProfile_BaseSchema = z.object({\n /* Type of authentication /\n kind: z.enum(ExternalProvider_Auth_Kind),\n \n /* Unique reference for this auth profile /\n ref: z.string().optional(),\n \n /* Is this the default auth profile? /\n isDefault: z.boolean().default(false),\n \n /* Where to place the authentication (header, query, cookie) /\n location: z.enum(ExternalProvider_Auth_ApiKey_Location).default(ExternalProvider_Auth_ApiKey_Location.HEADER),\n \n /* Field name for the authentication /\n locationField: z.string().default(\"Authorization\"),\n});\n\n// =============================================================================\n// INFERRED BASE TYPES\n// =============================================================================\n\nexport type ExternalProvider_RateLimitConfiguration = z.infer<typeof ExternalProvider_RateLimitConfigurationSchema>;\nexport type ExternalProvider_AuthProfile_Base = z.infer<typeof ExternalProvider_AuthProfile_BaseSchema>;\n\n// =============================================================================\n// DISCRIMINATED AUTH PROFILE SCHEMAS\n// =============================================================================\n\n/\n Complete Auth Profile Schema - discriminated union by kind\n * Each kind has specific configuration fields\n /\nexport const ExternalProvider_AuthProfile_Schema = z.discriminatedUnion(\"kind\", [\n // ─── API Key Authentication ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.API_KEY),\n locationField: z.string().default(\"Authorization\"),\n /* Prefix before the key value (e.g., \"Api-Key \") /\n prefix: z.string().optional(),\n }),\n \n // ─── HMAC Signature Authentication ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.HMAC_SIGNATURE),\n locationField: z.string().default(\"X-Signature\"),\n /* HMAC algorithm /\n algorithm: z.enum(ExternalProvider_Auth_HMAC_Signature_Algorithm).default(ExternalProvider_Auth_HMAC_Signature_Algorithm.SHA256),\n /* What data to sign (body, timestamp, etc.) /\n signaturePayload: z.enum(['body', 'timestamp', 'custom']).optional(),\n /* Timestamp header name (if needed) /\n timestampHeader: z.string().optional(),\n /* Nonce header name (if needed for replay protection) /\n nonceHeader: z.string().optional(),\n }),\n \n // ─── Bearer Token Authentication ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.BEARER),\n location: z.enum(ExternalProvider_Auth_ApiKey_Location).default(ExternalProvider_Auth_ApiKey_Location.HEADER),\n locationField: z.string().default(\"Authorization\"),\n /* Prefix (usually \"Bearer \") /\n prefix: z.string().default(\"Bearer \"),\n /* Token format /\n format: z.enum(ExternalProvider_Auth_Bearer_Format).default(ExternalProvider_Auth_Bearer_Format.JWT),\n }),\n \n // ─── OpenID Connect Authentication ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.OPENID_CONNECT),\n /* OIDC Discovery URL /\n discoveryUrl: z.url().optional(),\n /* Issuer /\n issuer: z.string().optional(),\n /* Expected audience /\n audience: z.string().optional(),\n /* Token validation mode /\n validationMode: z.enum(['jwks', 'introspection', 'local']).optional(),\n }),\n \n // ─── OAuth2 Authentication (UNIFIED APPROACH) ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.OAUTH2),\n \n // ─── OAuth2 Provider Reference (Unified Approach) ───\n /\n Reference to OAuth2 provider definition\n * Instead of duplicating OAuth2 config, reference the provider\n * by its string identifier (e.g., \"google\", \"microsoft\")\n /\n oauth2ProviderRef: z.string().optional(),\n \n // ─── Inline OAuth2 Configuration (Legacy/Override) ───\n /* Authorization URL (can be overridden or used when no ref) /\n authUrl: z.url().optional(),\n /* Token URL /\n tokenUrl: z.url().optional(),\n /* Refresh URL (if different from tokenUrl) /\n refreshUrl: z.url().optional(),\n \n /* Required scopes for this auth profile /\n scopes: z.array(z.string()).optional(),\n \n /* Preferred grant type /\n grantType: z.enum(OAuth2_GrantType).optional(),\n \n /* Token endpoint auth method /\n tokenEndpointAuthMethod: z.enum(OAuth2_TokenEndpoint_AuthMethod).optional(),\n \n /* PKCE support /\n pkce: z.boolean().optional(),\n /* PKCE method /\n pkceMethod: z.enum(OAuth2_PKCE_Method).optional(),\n \n /* Prompt behavior /\n prompt: z.enum(OAuth2_Prompt).optional(),\n \n /* Access type (online/offline) /\n accessType: z.enum(OAuth2_AccessType).optional(),\n \n /* Extra authorization parameters /\n extraAuthParams: z.record(z.string(), z.string()).optional(),\n \n /* Extra token parameters /\n extraTokenParams: z.record(z.string(), z.string()).optional(),\n \n // ─── Token Format (for API calls) ───\n /* How to format the token in Authorization header /\n tokenFormat: z.enum(['bearer', 'token', 'oauth', 'custom']).default('bearer'),\n /* Custom prefix if tokenFormat is 'custom' /\n customTokenPrefix: z.string().optional(),\n }),\n \n // ─── Basic Authentication ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.BASIC),\n /* Username field reference /\n usernameRef: z.string().optional(),\n /* Password field reference /\n passwordRef: z.string().optional(),\n }),\n \n // ─── No Authentication ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.NONE),\n }),\n \n // ─── Frontend Secret ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.FRONTEND_SECRET),\n /* Secret is only used in frontend context /\n frontendOnly: z.boolean().default(true),\n }),\n \n // ─── Mutual TLS ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.MUTUAL_TLS),\n /* Certificate reference /\n certificateRef: z.string().optional(),\n /* Private key reference /\n privateKeyRef: z.string().optional(),\n /* CA certificate reference /\n caRef: z.string().optional(),\n }),\n]);\nexport type ExternalProvider_AuthProfile = z.infer<typeof ExternalProvider_AuthProfile_Schema>;\n\n// =============================================================================\n// CONNECTION IDENTITY — whose account, on whose behalf, and which one\n// =============================================================================\n\n/\n WHOSE ACCOUNT a call spends.\n \n Distinct from the scope of the DATA the call touches, and conflating the two inverts the design.\n * A billing provider is APPLICATION-owned — the payment account belongs to whoever ships the\n * application — even though almost everything it produces is organization-shaped: a customer, a\n * subscription, an invoice per tenant. Those are data in the application's own domain, produced by\n * an application-owned account. The question here is never \"does this touch organizations?\", which\n * is true of nearly everything. It is whose account is it?\n \n Delivery follows the owner and is not a separate decision: the APPLICATION's material is authored\n * in the deployment environment by an operator, and an ORGANIZATION's or a USER's is authored\n * through the application's own settings and stored, sealed, in its database.\n \n No owner ever defaults to another. An organization-owned call with no connection REFUSES; it\n * never spends the application's account. A silent substitution means the vendor sees one identity\n * while the application believes it acted as another, and every artifact the call leaves on the far\n * side — a message, a record, a line in the vendor's own audit log — is then attributed to the wrong\n * party, with nothing downstream able to detect it. An application that wants \"the tenant's key when\n * they have connected one, otherwise ours\" expresses that in its own code by choosing which\n * connection to call with, where the choice is visible.\n /\nexport enum ExternalProvider_Connection_OwnerScope {\n /* The account belongs to the application itself. Material comes from the deployment environment. /\n APPLICATION = \"application\",\n /* The account belongs to one tenant — its own workspace, its own subscription with the vendor. /\n ORGANIZATION = \"organization\",\n /* The account belongs to one person — a personal key they authored for themselves. /\n USER = \"user\",\n}\n\n/\n WHAT A DECLARED SECRET IDENTIFIES — the integration, or the account.\n \n A provider's `secretsContract` holds two kinds of thing and, until this existed, marked neither.\n * Slack's contract is the clearest case: `SLACK_CLIENT_ID` and `SLACK_CLIENT_SECRET` identify the\n * APPLICATION's registration with Slack, while `SLACK_API_KEY` holds a token that identifies WHOSE\n * Slack account is being acted as. They are stored differently, rotated for different reasons, and\n * owned by different parties, and one undifferentiated map made all three look alike.\n \n Deliberately ORTHOGONAL to {@link ExternalProvider_Connection_OwnerScope}, which is the axis it is\n * most likely to be confused with. This says what a secret IS; that says whose it is. A billing\n * provider's secret key is a CREDENTIAL — it identifies an account — and is nonetheless\n * application-owned, because the only admissible connection for it is APPLICATION. Collapsing the\n * two would make \"the deployment owns this\" and \"this identifies an integration\" the same\n * statement, and they are not.\n \n What the distinction buys, concretely:\n \n - a credential row owned by a tenant or a person may hold a CREDENTIAL and never a REGISTRATION.\n * Without the mark, nothing stopped a tenant storing a row slugged `SLACK_CLIENT_SECRET` that no\n * reader would ever consult — inert, and indistinguishable from a working connection on screen;\n * - the connect flow can derive WHICH slug a grant is stored under by construction, rather than\n * by the convention that it happens to be the REST contract's `apiKey.secretRef`;\n * - a vendor that supports per-tenant app registrations becomes SAYABLE, which it is not today.\n /\nexport enum ExternalProvider_SecretScope {\n /\n Identifies the INTEGRATION — an OAuth2 client id and secret, a signing secret issued to the\n * app's registration. Authored by the operator in the deployment environment.\n /\n REGISTRATION = \"registration\",\n /\n Identifies an ACCOUNT — a token or key standing for whoever is being acted as. May be authored\n * in the environment (the deployment's own account) or minted into a credential row owned by a\n * tenant or a person; which of those are permitted is the admissibility question, not this one.\n /\n CREDENTIAL = \"credential\",\n}\n\n/\n ON WHOSE BEHALF the act is performed — orthogonal to who owns the account.\n \n These are two questions and every combination of them is real, which is why they are two enums\n * rather than one. An application's service identity can impersonate a user (domain-wide\n * delegation); a tenant's own registration can mint a token that acts for one of its members; a\n * tenant's bot token acts as nobody in particular. Collapsing the pair into a single vocabulary\n * makes most of those unsayable:\n \n \| owner × delegation \| the real case \|\n * \|---\|---\|\n * \| APPLICATION × SERVICE \| a platform API key \|\n * \| APPLICATION × USER \| the application's service identity impersonating a user \|\n * \| ORGANIZATION × SERVICE \| the tenant's own bot or workspace token \|\n * \| ORGANIZATION × USER \| ONE member's own account, linked for the whole organization \|\n * \| USER × SERVICE \| a person's own account, for that person \|\n \n ## `ORGANIZATION × USER`, decided 2026-09-12 (Paul, recorded on wildo-ai/wildo-ai#18)\n \n A member connects THEIR OWN vendor account on the organization's behalf — the common pattern that\n * lets a tenant integrate without a service account. There is ONE grant per organization, and every\n * member's call spends it transparently. The member who links it carries the responsibility for\n * that: they are trusting their colleagues' activity with their account, they ACKNOWLEDGE it when\n * they link, and that acknowledgement is the whole control — no per-call gate. What the audit trail\n * must then say, on every call, is WHOSE account was spent: the member who linked it.\n \n So the person behind this shape is fixed by the GRANT, not by the call, which is why a call never\n * names `actingForUserId` for it. The rejected readings are worth keeping: per-member grants keyed\n * `(organization, member)` is a real model and not what this shape means here; and requiring the\n * call to name the linking member would stop every other member using a grant that exists to be\n * shared. A person's connection for themselves is the USER-owned row.\n \n OAuth 2.0 carries the same split in its grant types: the client is the REGISTRATION, and the grant\n * decides on whose behalf a token is minted.\n /\nexport enum ExternalProvider_Connection_DelegationMode {\n /* The call acts as the account's owner, with no third party behind it. /\n SERVICE = \"service\",\n /* The call acts for a named user, whose authorization is what makes it permissible. /\n USER = \"user\",\n}\n\n/\n WHICH owner instance a single call spends — supplied BY THE CALL, never read from ambient context.\n \n This is the field's hardest constraint to get right and the reason it is a parameter rather than a\n * property of the execution. `ExecutionContext.initiatorIds` answers WHO is performing the operation\n * and `contextResourcesFieldIdentifier` answers WHICH ROWS are in scope; neither answers whose\n * account is being spent, and a design that borrows either is wrong for a case that is entirely\n * ordinary: one user action fanning out a message to every organization the user belongs to. One\n * initiator, one execution, N organizations, a different account per call. An ambient answer cannot\n * vary within one execution, so it cannot express that at all.\n \n The initiator is still decisive — as the AUTHORIZATION input. The call names the owner and the\n * runtime asks whether this initiator may act for it. Supplying and authorizing are different jobs,\n * and the resolver cannot verify a target it also invented.\n /\nexport const ExternalProvider_ConnectionShapeSchema = z.object({\n ownerScope: z.enum(ExternalProvider_Connection_OwnerScope),\n delegation: z.enum(ExternalProvider_Connection_DelegationMode)\n .default(ExternalProvider_Connection_DelegationMode.SERVICE),\n});\n\n/\n A connection COMBINATION, with no instance attached — what a provider ADMITS.\n \n The capability and the call are the same two axes and different objects, which is why this is a\n * separate schema rather than the target with its identifiers made optional. A provider admitting\n * `ORGANIZATION × USER` says nothing about which organization; a call naming no organization is\n * incomplete. Making one schema serve both would have to relax exactly the refinements that make the\n * call safe.\n /\nexport type ExternalProvider_ConnectionShape = z.infer<typeof ExternalProvider_ConnectionShapeSchema>;\n\nexport const ExternalProvider_ConnectionTargetSchema = ExternalProvider_ConnectionShapeSchema.extend({\n /\n The organization or user whose account is spent. Absent for APPLICATION, which has exactly one\n * instance by construction — an id there would be a second name for the deployment.\n /\n ownerId: z.string().optional(),\n /\n The user an APPLICATION-owned, USER-delegated call impersonates — the ONLY shape where the call\n * itself must say who, because the application's identity could impersonate anyone.\n \n Refused everywhere else. An ORGANIZATION-owned USER-delegated connection spends the account of\n * the member who LINKED it, whoever triggers the call (see the decision above), so a person named\n * here would describe an identity the runtime will not act as. A USER-owned connection already\n * names its person in `ownerId`.\n /\n actingForUserId: z.string().optional(),\n}).superRefine((target, ctx) => {\n const ownerIsInstance = target.ownerScope !== ExternalProvider_Connection_OwnerScope.APPLICATION;\n if (ownerIsInstance && (target.ownerId === undefined \|\| target.ownerId === '')) {\n ctx.addIssue({\n code: 'custom',\n path: ['ownerId'],\n message: `A ${target.ownerScope}-owned connection names WHICH ${target.ownerScope}; a call that omits it has not said whose account it spends.`,\n });\n }\n if (!ownerIsInstance && target.ownerId !== undefined) {\n ctx.addIssue({\n code: 'custom',\n path: ['ownerId'],\n message: 'An application-owned connection has exactly one instance, so an ownerId here names something that does not exist.',\n });\n }\n if (connectionTargetNamesActingUser(target)) {\n if (target.actingForUserId === undefined \|\| target.actingForUserId === '') {\n ctx.addIssue({\n code: 'custom',\n path: ['actingForUserId'],\n message: 'An application-owned delegated call impersonates someone, and who is what makes it permissible — it cannot be left to be inferred.',\n });\n }\n } else if (target.actingForUserId !== undefined) {\n ctx.addIssue({\n code: 'custom',\n path: ['actingForUserId'],\n message: target.delegation === ExternalProvider_Connection_DelegationMode.USER\n ? `A ${target.ownerScope}-owned connection's person is fixed by the account itself — the member who linked it, or the owner. `\n + 'Naming a user here describes an identity the runtime will not act as.'\n : 'A SERVICE call acts for nobody. Naming a user here reads as delegation the runtime will not perform, which is worse than an error: the call succeeds as the wrong identity.',\n });\n }\n});\n\n/\n Whether a connection target must NAME the user it acts for — true only for APPLICATION × USER.\n \n One predicate rather than a condition restated at each builder: the target schema, the HTTP-API\n * binding's target builder and the connect panel all ask this question, and three spellings of it\n * are how a target comes to carry a person the refinement then refuses.\n /\nexport function connectionTargetNamesActingUser(shape: ExternalProvider_ConnectionShape): boolean {\n return shape.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION\n && shape.delegation === ExternalProvider_Connection_DelegationMode.USER;\n}\n\n/\n Whether linking this connection lends ONE member's own account to their whole organization —\n * true only for ORGANIZATION × USER.\n \n The member who links such a connection is trusting every colleague's activity with their account,\n * so the connect surface asks them to ACKNOWLEDGE it and the connect leg refuses a link that did not\n * (decision on wildo-ai/wildo-ai#18). One predicate for the panel that shows the acknowledgement and\n * the controller that requires it, so the two cannot come to disagree about which links owe one.\n */\nexport function connectionLendsMemberAccountToOrganization(shape: ExternalProvider_ConnectionShape): boolean {\n return shape.ownerScope === ExternalProvider_Connection_OwnerScope.ORGANIZATION\n && shape.delegation === ExternalProvider_Connection_DelegationMode.USER;\n}\n\nexport type ExternalProvider_ConnectionTarget = z.infer<typeof ExternalProvider_ConnectionTargetSchema>;\n"]}
1	+ {"version":3,"file":"security.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../src/core/security.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,+BAA+B,EAC/B,kBAAkB,EAClB,aAAa,EACb,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAExB,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAN,IAAY,0BA2BX;AA3BD,WAAY,0BAA0B;IACpC,iCAAiC;IACjC,2CAAa,CAAA;IAEb,0CAA0C;IAC1C,iDAAmB,CAAA;IAEnB,gDAAgD;IAChD,+CAAiB,CAAA;IAEjB,gCAAgC;IAChC,6CAAe,CAAA;IAEf,kEAAkE;IAClE,+CAAiB,CAAA;IAEjB,0CAA0C;IAC1C,+DAAiC,CAAA;IAEjC,+CAA+C;IAC/C,+DAAiC,CAAA;IAEjC,uCAAuC;IACvC,uDAAyB,CAAA;IAEzB,qDAAqD;IACrD,iEAAmC,CAAA;AACrC,CAAC,EA3BW,0BAA0B,KAA1B,0BAA0B,QA2BrC;AAED,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,MAAM,CAAN,IAAY,qCAIX;AAJD,WAAY,qCAAqC;IAC/C,0DAAiB,CAAA;IACjB,wDAAe,CAAA;IACf,0DAAiB,CAAA;AACnB,CAAC,EAJW,qCAAqC,KAArC,qCAAqC,QAIhD;AAED,MAAM,CAAN,IAAY,8CAGX;AAHD,WAAY,8CAA8C;IACxD,mEAAiB,CAAA;IACjB,mEAAiB,CAAA;AACnB,CAAC,EAHW,8CAA8C,KAA9C,8CAA8C,QAGzD;AAED,MAAM,CAAN,IAAY,mCAIX;AAJD,WAAY,mCAAmC;IAC7C,kDAAW,CAAA;IACX,0DAAmB,CAAA;IACnB,kFAA2C,CAAA;AAC7C,CAAC,EAJW,mCAAmC,KAAnC,mCAAmC,QAI9C;AAED,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,6BAA6B;IAC7B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAE5C,yDAAyD;IACzD,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE3C,iDAAiD;IACjD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEjC,8EAA8E;IAC9E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,CAAC,MAAM,CAAC;IACpE,kCAAkC;IAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE3D,yCAAyC;IACzC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAEzC,sCAAsC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE3C,sCAAsC;IACtC,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE1D,4CAA4C;IAC5C,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAExD,kDAAkD;IAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;CACjD,CAAC,CAAC;AAEH,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9D,6BAA6B;IAC7B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAExC,6CAA6C;IAC7C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1B,wCAAwC;IACxC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAErC,gEAAgE;IAChE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,MAAM,CAAC;IAE7G,wCAAwC;IACxC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;CACnD,CAAC,CAAC;AASH,gFAAgF;AAChF,qCAAqC;AACrC,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC9E,iCAAiC;IACjC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,OAAO,CAAC;QACnD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;QAClD,qDAAqD;QACrD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC;IAEF,wCAAwC;IACxC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,cAAc,CAAC;QAC1D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;QAChD,qBAAqB;QACrB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC,OAAO,CAAC,8CAA8C,CAAC,MAAM,CAAC;QAChI,gDAAgD;QAChD,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;QACpE,wCAAwC;QACxC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACtC,0DAA0D;QAC1D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC;IAEF,sCAAsC;IACtC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,MAAM,CAAC;QAClD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,MAAM,CAAC;QAC7G,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;QAClD,iCAAiC;QACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACrC,mBAAmB;QACnB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC,OAAO,CAAC,mCAAmC,CAAC,GAAG,CAAC;KACrG,CAAC;IAEF,wCAAwC;IACxC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,cAAc,CAAC;QAC1D,yBAAyB;QACzB,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAChC,aAAa;QACb,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,wBAAwB;QACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,4BAA4B;QAC5B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;KACtE,CAAC;IAEF,mDAAmD;IACnD,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,MAAM,CAAC;QAElD,uDAAuD;QACvD;;;;WAIG;QACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAExC,wDAAwD;QACxD,gEAAgE;QAChE,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC3B,gBAAgB;QAChB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC5B,+CAA+C;QAC/C,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAE9B,4CAA4C;QAC5C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAEtC,2BAA2B;QAC3B,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;QAE9C,iCAAiC;QACjC,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,QAAQ,EAAE;QAE3E,mBAAmB;QACnB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC5B,kBAAkB;QAClB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;QAEjD,sBAAsB;QACtB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;QAExC,mCAAmC;QACnC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;QAEhD,qCAAqC;QACrC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAE5D,6BAA6B;QAC7B,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAE7D,uCAAuC;QACvC,sDAAsD;QACtD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC7E,+CAA+C;QAC/C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACzC,CAAC;IAEF,+BAA+B;IAC/B,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,KAAK,CAAC;QACjD,+BAA+B;QAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,+BAA+B;QAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC;IAEF,4BAA4B;IAC5B,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC;KACjD,CAAC;IAEF,0BAA0B;IAC1B,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,eAAe,CAAC;QAC3D,8CAA8C;QAC9C,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KACxC,CAAC;IAEF,qBAAqB;IACrB,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,UAAU,CAAC;QACtD,4BAA4B;QAC5B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACrC,4BAA4B;QAC5B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpC,+BAA+B;QAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC7B,CAAC;CACH,CAAC,CAAC;AAGH,gFAAgF;AAChF,sEAAsE;AACtE,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAN,IAAY,sCAOX;AAPD,WAAY,sCAAsC;IAChD,qGAAqG;IACrG,qEAA2B,CAAA;IAC3B,mGAAmG;IACnG,uEAA6B,CAAA;IAC7B,uFAAuF;IACvF,uDAAa,CAAA;AACf,CAAC,EAPW,sCAAsC,KAAtC,sCAAsC,QAOjD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAN,IAAY,4BAYX;AAZD,WAAY,4BAA4B;IACtC;;;OAGG;IACH,6DAA6B,CAAA;IAC7B;;;;OAIG;IACH,yDAAyB,CAAA;AAC3B,CAAC,EAZW,4BAA4B,KAA5B,4BAA4B,QAYvC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,CAAN,IAAY,0CAKX;AALD,WAAY,0CAA0C;IACpD,2EAA2E;IAC3E,iEAAmB,CAAA;IACnB,wFAAwF;IACxF,2DAAa,CAAA;AACf,CAAC,EALW,0CAA0C,KAA1C,0CAA0C,QAKrD;AAED,4HAA4H;AAC5H;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC;SACvD,QAAQ,CAAC,uFAAuF,CAAC;IACpG,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,0CAA0C,CAAC;SAC3D,OAAO,CAAC,0CAA0C,CAAC,OAAO,CAAC;SAC3D,QAAQ,CAAC,yHAAyH,CAAC;CACvI,CAAC,CAAC;AAaH,MAAM,CAAC,MAAM,uCAAuC,GAAG,sCAAsC,CAAC,MAAM,CAAC;IACnG;;;OAGG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC3B,QAAQ,CAAC,oIAAoI,CAAC;IACjJ;;;;;;;;OAQG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACnC,QAAQ,CAAC,4IAA4I,CAAC;CAC1J,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,eAAe,GAAG,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW,CAAC;IACjG,IAAI,eAAe,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,EAAE,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,OAAO,EAAE,KAAK,MAAM,CAAC,UAAU,iCAAiC,MAAM,CAAC,UAAU,8DAA8D;SAChJ,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACrD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,OAAO,EAAE,mHAAmH;SAC7H,CAAC,CAAC;IACL,CAAC;IACD,IAAI,+BAA+B,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,IAAI,MAAM,CAAC,eAAe,KAAK,EAAE,EAAE,CAAC;YAC1E,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;gBACzB,OAAO,EAAE,oIAAoI;aAC9I,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAChD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EAAE,MAAM,CAAC,UAAU,KAAK,0CAA0C,CAAC,IAAI;gBAC5E,CAAC,CAAC,KAAK,MAAM,CAAC,UAAU,sGAAsG;sBAC1H,uEAAuE;gBAC3E,CAAC,CAAC,6KAA6K;SAClL,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AACH,0EAA0E;AAE1E;;;;;;GAMG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAAuC;IACrF,OAAO,KAAK,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW;WACzE,KAAK,CAAC,UAAU,KAAK,0CAA0C,CAAC,IAAI,CAAC;AAC5E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0CAA0C,CAAC,KAAuC;IAChG,OAAO,KAAK,CAAC,UAAU,KAAK,sCAAsC,CAAC,YAAY;WAC1E,KAAK,CAAC,UAAU,KAAK,0CAA0C,CAAC,IAAI,CAAC;AAC5E,CAAC","sourcesContent":["/*\n Security and Authentication Schemas for External Connectors\n * \n * This module defines authentication profiles that can be used across protocols.\n * It integrates with OAuth2 to avoid duplication between API auth and OAuth2 config.\n * \n * Architecture:\n * - ExternalProvider_Auth_Kind: The type of authentication\n * - ExternalProvider_AuthProfile: How to authenticate with an API\n * - OAuth2-linked profiles: Reference OAuth2 config instead of duplicating\n * \n * @see https://swagger.io/docs/specification/v3_0/authentication/\n /\n\nimport { z } from \"zod\";\nimport {\n OAuth2_GrantType,\n OAuth2_TokenEndpoint_AuthMethod,\n OAuth2_PKCE_Method,\n OAuth2_Prompt,\n OAuth2_AccessType,\n} from './oauth2.enums';\n\n// =============================================================================\n// AUTH KIND ENUM\n// =============================================================================\n\n/\n Authentication types supported by external providers\n * Follows OpenAPI 3.0 Security Schemes with extensions\n /\nexport enum ExternalProvider_Auth_Kind {\n /* No authentication required /\n NONE = \"none\",\n \n /* API Key in header, query, or cookie /\n API_KEY = \"api_key\",\n \n /* Bearer token (OAuth2 access token or JWT) /\n BEARER = \"bearer\",\n \n /* HTTP Basic authentication /\n BASIC = \"basic\",\n \n /* OAuth2 authentication - links to OAuth2 provider definition /\n OAUTH2 = \"oauth2\",\n \n /* HMAC signature-based authentication /\n HMAC_SIGNATURE = \"hmac_signature\",\n \n /* OpenID Connect (OAuth2 + identity layer) /\n OPENID_CONNECT = \"openid_connect\",\n \n /* Mutual TLS (client certificates) /\n MUTUAL_TLS = \"mutual_tls\",\n \n /* Frontend-specific secret (not exposed to user) /\n FRONTEND_SECRET = \"frontend_secret\",\n}\n\n// =============================================================================\n// AUTH CONFIGURATION ENUMS\n// =============================================================================\n\nexport enum ExternalProvider_Auth_ApiKey_Location {\n HEADER = \"header\",\n QUERY = \"query\",\n COOKIE = \"cookie\",\n}\n\nexport enum ExternalProvider_Auth_HMAC_Signature_Algorithm {\n SHA256 = \"sha256\",\n SHA512 = \"sha512\",\n}\n\nexport enum ExternalProvider_Auth_Bearer_Format {\n JWT = \"jwt\",\n API_KEY = \"api_key\",\n OAUTH2_ACCESS_TOKEN = \"oauth2_access_token\",\n}\n\n// =============================================================================\n// AUTH CONFIGURATION SCHEMA\n// =============================================================================\n\n/\n Auth Configuration - references a secret\n * This is the runtime configuration that specifies which secret to use\n /\nexport const ExternalProvider_Auth_ConfigurationSchema = z.object({\n /* Type of authentication /\n authKind: z.enum(ExternalProvider_Auth_Kind),\n \n /* References to auth profiles this config applies to /\n profileRefs: z.array(z.string()).optional(),\n \n /* Is this the default auth for the provider? /\n isDefault: z.boolean().optional(),\n \n /* Reference to the secret (environment variable name or secret store key) /\n secretRef: z.string(),\n});\n\n// =============================================================================\n// RATE LIMIT CONFIGURATION\n// =============================================================================\n\nexport const ExternalProvider_RateLimitConfigurationSchema = z.object({\n /* Maximum concurrent requests /\n maxConcurrent: z.number().positive().optional().default(10),\n \n /* Minimum time (ms) between requests /\n minTime: z.number().positive().optional(),\n \n /* Request reservoir (bucket size) /\n reservoir: z.number().positive().optional(),\n \n /* Reservoir refresh interval (ms) /\n reservoirRefreshInterval: z.number().positive().optional(),\n \n /* Amount to add to reservoir on refresh /\n reservoirRefreshAmount: z.number().positive().optional(),\n \n /* Request priority (higher = higher priority) /\n priority: z.number().int().optional().default(0),\n});\n\n// =============================================================================\n// AUTH PROFILE BASE SCHEMA\n// =============================================================================\n\nexport const ExternalProvider_AuthProfile_BaseSchema = z.object({\n /* Type of authentication /\n kind: z.enum(ExternalProvider_Auth_Kind),\n \n /* Unique reference for this auth profile /\n ref: z.string().optional(),\n \n /* Is this the default auth profile? /\n isDefault: z.boolean().default(false),\n \n /* Where to place the authentication (header, query, cookie) /\n location: z.enum(ExternalProvider_Auth_ApiKey_Location).default(ExternalProvider_Auth_ApiKey_Location.HEADER),\n \n /* Field name for the authentication /\n locationField: z.string().default(\"Authorization\"),\n});\n\n// =============================================================================\n// INFERRED BASE TYPES\n// =============================================================================\n\nexport type ExternalProvider_RateLimitConfiguration = z.infer<typeof ExternalProvider_RateLimitConfigurationSchema>;\nexport type ExternalProvider_AuthProfile_Base = z.infer<typeof ExternalProvider_AuthProfile_BaseSchema>;\n\n// =============================================================================\n// DISCRIMINATED AUTH PROFILE SCHEMAS\n// =============================================================================\n\n/\n Complete Auth Profile Schema - discriminated union by kind\n * Each kind has specific configuration fields\n /\nexport const ExternalProvider_AuthProfile_Schema = z.discriminatedUnion(\"kind\", [\n // ─── API Key Authentication ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.API_KEY),\n locationField: z.string().default(\"Authorization\"),\n /* Prefix before the key value (e.g., \"Api-Key \") /\n prefix: z.string().optional(),\n }),\n \n // ─── HMAC Signature Authentication ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.HMAC_SIGNATURE),\n locationField: z.string().default(\"X-Signature\"),\n /* HMAC algorithm /\n algorithm: z.enum(ExternalProvider_Auth_HMAC_Signature_Algorithm).default(ExternalProvider_Auth_HMAC_Signature_Algorithm.SHA256),\n /* What data to sign (body, timestamp, etc.) /\n signaturePayload: z.enum(['body', 'timestamp', 'custom']).optional(),\n /* Timestamp header name (if needed) /\n timestampHeader: z.string().optional(),\n /* Nonce header name (if needed for replay protection) /\n nonceHeader: z.string().optional(),\n }),\n \n // ─── Bearer Token Authentication ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.BEARER),\n location: z.enum(ExternalProvider_Auth_ApiKey_Location).default(ExternalProvider_Auth_ApiKey_Location.HEADER),\n locationField: z.string().default(\"Authorization\"),\n /* Prefix (usually \"Bearer \") /\n prefix: z.string().default(\"Bearer \"),\n /* Token format /\n format: z.enum(ExternalProvider_Auth_Bearer_Format).default(ExternalProvider_Auth_Bearer_Format.JWT),\n }),\n \n // ─── OpenID Connect Authentication ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.OPENID_CONNECT),\n /* OIDC Discovery URL /\n discoveryUrl: z.url().optional(),\n /* Issuer /\n issuer: z.string().optional(),\n /* Expected audience /\n audience: z.string().optional(),\n /* Token validation mode /\n validationMode: z.enum(['jwks', 'introspection', 'local']).optional(),\n }),\n \n // ─── OAuth2 Authentication (UNIFIED APPROACH) ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.OAUTH2),\n \n // ─── OAuth2 Provider Reference (Unified Approach) ───\n /\n Reference to OAuth2 provider definition\n * Instead of duplicating OAuth2 config, reference the provider\n * by its string identifier (e.g., \"google\", \"microsoft\")\n /\n oauth2ProviderRef: z.string().optional(),\n \n // ─── Inline OAuth2 Configuration (Legacy/Override) ───\n /* Authorization URL (can be overridden or used when no ref) /\n authUrl: z.url().optional(),\n /* Token URL /\n tokenUrl: z.url().optional(),\n /* Refresh URL (if different from tokenUrl) /\n refreshUrl: z.url().optional(),\n \n /* Required scopes for this auth profile /\n scopes: z.array(z.string()).optional(),\n \n /* Preferred grant type /\n grantType: z.enum(OAuth2_GrantType).optional(),\n \n /* Token endpoint auth method /\n tokenEndpointAuthMethod: z.enum(OAuth2_TokenEndpoint_AuthMethod).optional(),\n \n /* PKCE support /\n pkce: z.boolean().optional(),\n /* PKCE method /\n pkceMethod: z.enum(OAuth2_PKCE_Method).optional(),\n \n /* Prompt behavior /\n prompt: z.enum(OAuth2_Prompt).optional(),\n \n /* Access type (online/offline) /\n accessType: z.enum(OAuth2_AccessType).optional(),\n \n /* Extra authorization parameters /\n extraAuthParams: z.record(z.string(), z.string()).optional(),\n \n /* Extra token parameters /\n extraTokenParams: z.record(z.string(), z.string()).optional(),\n \n // ─── Token Format (for API calls) ───\n /* How to format the token in Authorization header /\n tokenFormat: z.enum(['bearer', 'token', 'oauth', 'custom']).default('bearer'),\n /* Custom prefix if tokenFormat is 'custom' /\n customTokenPrefix: z.string().optional(),\n }),\n \n // ─── Basic Authentication ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.BASIC),\n /* Username field reference /\n usernameRef: z.string().optional(),\n /* Password field reference /\n passwordRef: z.string().optional(),\n }),\n \n // ─── No Authentication ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.NONE),\n }),\n \n // ─── Frontend Secret ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.FRONTEND_SECRET),\n /* Secret is only used in frontend context /\n frontendOnly: z.boolean().default(true),\n }),\n \n // ─── Mutual TLS ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.MUTUAL_TLS),\n /* Certificate reference /\n certificateRef: z.string().optional(),\n /* Private key reference /\n privateKeyRef: z.string().optional(),\n /* CA certificate reference /\n caRef: z.string().optional(),\n }),\n]);\nexport type ExternalProvider_AuthProfile = z.infer<typeof ExternalProvider_AuthProfile_Schema>;\n\n// =============================================================================\n// CONNECTION IDENTITY — whose account, on whose behalf, and which one\n// =============================================================================\n\n/\n WHOSE ACCOUNT a call spends.\n \n Distinct from the scope of the DATA the call touches, and conflating the two inverts the design.\n * A billing provider is APPLICATION-owned — the payment account belongs to whoever ships the\n * application — even though almost everything it produces is organization-shaped: a customer, a\n * subscription, an invoice per tenant. Those are data in the application's own domain, produced by\n * an application-owned account. The question here is never \"does this touch organizations?\", which\n * is true of nearly everything. It is whose account is it?\n \n Delivery follows the owner and is not a separate decision: the APPLICATION's material is authored\n * in the deployment environment by an operator, and an ORGANIZATION's or a USER's is authored\n * through the application's own settings and stored, sealed, in its database.\n \n No owner ever defaults to another. An organization-owned call with no connection REFUSES; it\n * never spends the application's account. A silent substitution means the vendor sees one identity\n * while the application believes it acted as another, and every artifact the call leaves on the far\n * side — a message, a record, a line in the vendor's own audit log — is then attributed to the wrong\n * party, with nothing downstream able to detect it. An application that wants \"the tenant's key when\n * they have connected one, otherwise ours\" expresses that in its own code by choosing which\n * connection to call with, where the choice is visible.\n /\nexport enum ExternalProvider_Connection_OwnerScope {\n /* The account belongs to the application itself. Material comes from the deployment environment. /\n APPLICATION = \"application\",\n /* The account belongs to one tenant — its own workspace, its own subscription with the vendor. /\n ORGANIZATION = \"organization\",\n /* The account belongs to one person — a personal key they authored for themselves. /\n USER = \"user\",\n}\n\n/\n WHAT A DECLARED SECRET IDENTIFIES — the integration, or the account.\n \n A provider's `secretsContract` holds two kinds of thing and, until this existed, marked neither.\n * Slack's contract is the clearest case: `SLACK_CLIENT_ID` and `SLACK_CLIENT_SECRET` identify the\n * APPLICATION's registration with Slack, while `SLACK_API_KEY` holds a token that identifies WHOSE\n * Slack account is being acted as. They are stored differently, rotated for different reasons, and\n * owned by different parties, and one undifferentiated map made all three look alike.\n \n Deliberately ORTHOGONAL to {@link ExternalProvider_Connection_OwnerScope}, which is the axis it is\n * most likely to be confused with. This says what a secret IS; that says whose it is. A billing\n * provider's secret key is a CREDENTIAL — it identifies an account — and is nonetheless\n * application-owned, because the only admissible connection for it is APPLICATION. Collapsing the\n * two would make \"the deployment owns this\" and \"this identifies an integration\" the same\n * statement, and they are not.\n \n What the distinction buys, concretely:\n \n - a credential row owned by a tenant or a person may hold a CREDENTIAL and never a REGISTRATION.\n * Without the mark, nothing stopped a tenant storing a row slugged `SLACK_CLIENT_SECRET` that no\n * reader would ever consult — inert, and indistinguishable from a working connection on screen;\n * - the connect flow can derive WHICH slug a grant is stored under by construction, rather than\n * by the convention that it happens to be the REST contract's `apiKey.secretRef`;\n * - a vendor that supports per-tenant app registrations becomes SAYABLE, which it is not today.\n /\nexport enum ExternalProvider_SecretScope {\n /\n Identifies the INTEGRATION — an OAuth2 client id and secret, a signing secret issued to the\n * app's registration. Authored by the operator in the deployment environment.\n /\n REGISTRATION = \"registration\",\n /\n Identifies an ACCOUNT — a token or key standing for whoever is being acted as. May be authored\n * in the environment (the deployment's own account) or minted into a credential row owned by a\n * tenant or a person; which of those are permitted is the admissibility question, not this one.\n /\n CREDENTIAL = \"credential\",\n}\n\n/\n ON WHOSE BEHALF the act is performed — orthogonal to who owns the account.\n \n These are two questions and every combination of them is real, which is why they are two enums\n * rather than one. An application's service identity can impersonate a user (domain-wide\n * delegation); a tenant's own registration can mint a token that acts for one of its members; a\n * tenant's bot token acts as nobody in particular. Collapsing the pair into a single vocabulary\n * makes most of those unsayable:\n \n \| owner × delegation \| the real case \|\n * \|---\|---\|\n * \| APPLICATION × SERVICE \| a platform API key \|\n * \| APPLICATION × USER \| the application's service identity impersonating a user \|\n * \| ORGANIZATION × SERVICE \| the tenant's own bot or workspace token \|\n * \| ORGANIZATION × USER \| ONE member's own account, linked for the whole organization \|\n * \| USER × SERVICE \| a person's own account, for that person \|\n \n ## `ORGANIZATION × USER`, decided 2026-09-12 (Paul, recorded on wildo-ai/wildo-ai#18)\n \n A member connects THEIR OWN vendor account on the organization's behalf — the common pattern that\n * lets a tenant integrate without a service account. There is ONE grant per organization, and every\n * member's call spends it transparently. The member who links it carries the responsibility for\n * that: they are trusting their colleagues' activity with their account, they ACKNOWLEDGE it when\n * they link, and that acknowledgement is the whole control — no per-call gate. What the audit trail\n * must then say, on every call, is WHOSE account was spent: the member who linked it.\n \n So the person behind this shape is fixed by the GRANT, not by the call, which is why a call never\n * names `actingForUserId` for it. The rejected readings are worth keeping: per-member grants keyed\n * `(organization, member)` is a real model and not what this shape means here; and requiring the\n * call to name the linking member would stop every other member using a grant that exists to be\n * shared. A person's connection for themselves is the USER-owned row.\n \n OAuth 2.0 carries the same split in its grant types: the client is the REGISTRATION, and the grant\n * decides on whose behalf a token is minted.\n /\nexport enum ExternalProvider_Connection_DelegationMode {\n /* The call acts as the account's owner, with no third party behind it. /\n SERVICE = \"service\",\n /* The call acts for a named user, whose authorization is what makes it permissible. /\n USER = \"user\",\n}\n\n/* @wildo_source:part:start external-connectors.models.connection-target facet:layer:shared facet:audience:app-developer /\n/\n WHICH owner instance a single call spends — supplied BY THE CALL, never read from ambient context.\n \n This is the field's hardest constraint to get right and the reason it is a parameter rather than a\n * property of the execution. `ExecutionContext.initiatorIds` answers WHO is performing the operation\n * and `contextResourcesFieldIdentifier` answers WHICH ROWS are in scope; neither answers whose\n * account is being spent, and a design that borrows either is wrong for a case that is entirely\n * ordinary: one user action fanning out a message to every organization the user belongs to. One\n * initiator, one execution, N organizations, a different account per call. An ambient answer cannot\n * vary within one execution, so it cannot express that at all.\n \n The initiator is still decisive — as the AUTHORIZATION input. The call names the owner and the\n * runtime asks whether this initiator may act for it. Supplying and authorizing are different jobs,\n * and the resolver cannot verify a target it also invented.\n /\nexport const ExternalProvider_ConnectionShapeSchema = z.object({\n ownerScope: z.enum(ExternalProvider_Connection_OwnerScope)\n .describe('Who owns the provider account: the application itself, one organization, or one user.'),\n delegation: z.enum(ExternalProvider_Connection_DelegationMode)\n .default(ExternalProvider_Connection_DelegationMode.SERVICE)\n .describe('On whose behalf calls act: `service` acts as the account owner itself, `user` acts for a person. Defaults to `service`.'),\n});\n\n/\n A connection COMBINATION, with no instance attached — what a provider ADMITS.\n \n The capability and the call are the same two axes and different objects, which is why this is a\n * separate schema rather than the target with its identifiers made optional. A provider admitting\n * `ORGANIZATION × USER` says nothing about which organization; a call naming no organization is\n * incomplete. Making one schema serve both would have to relax exactly the refinements that make the\n * call safe.\n /\nexport type ExternalProvider_ConnectionShape = z.infer<typeof ExternalProvider_ConnectionShapeSchema>;\n\nexport const ExternalProvider_ConnectionTargetSchema = ExternalProvider_ConnectionShapeSchema.extend({\n /\n The organization or user whose account is spent. Absent for APPLICATION, which has exactly one\n * instance by construction — an id there would be a second name for the deployment.\n /\n ownerId: z.string().optional()\n .describe('The id of the organization or user that owns the account. Required for an organization or user owner; omit it for the application.'),\n /\n The user an APPLICATION-owned, USER-delegated call impersonates — the ONLY shape where the call\n * itself must say who, because the application's identity could impersonate anyone.\n \n Refused everywhere else. An ORGANIZATION-owned USER-delegated connection spends the account of\n * the member who LINKED it, whoever triggers the call (see the decision above), so a person named\n * here would describe an identity the runtime will not act as. A USER-owned connection already\n * names its person in `ownerId`.\n /\n actingForUserId: z.string().optional()\n .describe('The user an application-owned account acts for: required when `ownerScope` is `application` and `delegation` is `user`, refused otherwise.'),\n}).superRefine((target, ctx) => {\n const ownerIsInstance = target.ownerScope !== ExternalProvider_Connection_OwnerScope.APPLICATION;\n if (ownerIsInstance && (target.ownerId === undefined \|\| target.ownerId === '')) {\n ctx.addIssue({\n code: 'custom',\n path: ['ownerId'],\n message: `A ${target.ownerScope}-owned connection names WHICH ${target.ownerScope}; a call that omits it has not said whose account it spends.`,\n });\n }\n if (!ownerIsInstance && target.ownerId !== undefined) {\n ctx.addIssue({\n code: 'custom',\n path: ['ownerId'],\n message: 'An application-owned connection has exactly one instance, so an ownerId here names something that does not exist.',\n });\n }\n if (connectionTargetNamesActingUser(target)) {\n if (target.actingForUserId === undefined \|\| target.actingForUserId === '') {\n ctx.addIssue({\n code: 'custom',\n path: ['actingForUserId'],\n message: 'An application-owned delegated call impersonates someone, and who is what makes it permissible — it cannot be left to be inferred.',\n });\n }\n } else if (target.actingForUserId !== undefined) {\n ctx.addIssue({\n code: 'custom',\n path: ['actingForUserId'],\n message: target.delegation === ExternalProvider_Connection_DelegationMode.USER\n ? `A ${target.ownerScope}-owned connection's person is fixed by the account itself — the member who linked it, or the owner. `\n + 'Naming a user here describes an identity the runtime will not act as.'\n : 'A SERVICE call acts for nobody. Naming a user here reads as delegation the runtime will not perform, which is worse than an error: the call succeeds as the wrong identity.',\n });\n }\n});\n/* @wildo_source:part:end external-connectors.models.connection-target /\n\n/\n Whether a connection target must NAME the user it acts for — true only for APPLICATION × USER.\n \n One predicate rather than a condition restated at each builder: the target schema, the HTTP-API\n * binding's target builder and the connect panel all ask this question, and three spellings of it\n * are how a target comes to carry a person the refinement then refuses.\n /\nexport function connectionTargetNamesActingUser(shape: ExternalProvider_ConnectionShape): boolean {\n return shape.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION\n && shape.delegation === ExternalProvider_Connection_DelegationMode.USER;\n}\n\n/\n Whether linking this connection lends ONE member's own account to their whole organization —\n * true only for ORGANIZATION × USER.\n \n The member who links such a connection is trusting every colleague's activity with their account,\n * so the connect surface asks them to ACKNOWLEDGE it and the connect leg refuses a link that did not\n * (decision on wildo-ai/wildo-ai#18). One predicate for the panel that shows the acknowledgement and\n * the controller that requires it, so the two cannot come to disagree about which links owe one.\n */\nexport function connectionLendsMemberAccountToOrganization(shape: ExternalProvider_ConnectionShape): boolean {\n return shape.ownerScope === ExternalProvider_Connection_OwnerScope.ORGANIZATION\n && shape.delegation === ExternalProvider_Connection_DelegationMode.USER;\n}\n\nexport type ExternalProvider_ConnectionTarget = z.infer<typeof ExternalProvider_ConnectionTargetSchema>;\n"]}

package/dist/esm/index.d.ts CHANGED Viewed

@@ -4,6 +4,8 @@ export * from './core/operations.external-connectors-models.schemas';
 export * from './protocols/hooks-capability.external-connectors-models.schemas';
 export * from './core/operation-classification.external-connectors-models.schemas';
 export * from './protocols/agent-client-protocol.external-connectors-models.schemas';
+export * from './protocols/content-safety.external-connectors-models.schemas';
+export * from './protocols/electronic-signature.external-connectors-models.schemas';
 export * from './protocols/document-extraction.external-connectors-models.schemas';
 export * from './protocols/email.external-connectors-models.schemas';
 export * from './protocols/email.standard-interface.schemas';
@@ -15,11 +17,17 @@ export * from './protocols/hooks.external-connectors-models.schemas';
 export * from './protocols/llm.external-connectors-models.schemas';
 export * from './protocols/oauth2.external-connectors-models.schemas';
 export * from './protocols/rest-operations.external-connectors-models.schemas';
+export * from './protocols/graphql-operations.external-connectors-models.schemas';
+export * from './protocols/service-account-token.external-connectors-models.schemas';
 export * from './protocols/provider-oauth2-token-endpoint-hosts.external-connectors-models';
+export * from './protocols/provider-connection-parameters.external-connectors-models';
+export * from './protocols/provider-vendor-registration.external-connectors-models';
 export * from './protocols/billing.standard-interface.schemas';
 export * from './protocols/file-storage.standard-interface';
+export * from './protocols/subject-erasure-effect.standard-interface';
 export * from './protocols/sms.external-connectors-models.schemas';
 export * from './protocols/sms.standard-interface.schemas';
+export * from './protocols/provider-configuration-authoring.external-connectors-models.schemas';
 export * from './protocols/oauth2-provider-assurance.definitions';
 export * from './protocols/oauth2-provider-assurance.schemas';
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mDAAmD,CAAC;AAClE,cAAc,oDAAoD,CAAC;AACnE,cAAc,sDAAsD,CAAC;AAKrE,cAAc,iEAAiE,CAAC;AAChF,cAAc,oEAAoE,CAAC;AAGnF,cAAc,sEAAsE,CAAC;AACrF,cAAc,oEAAoE,CAAC;AACnF,cAAc,sDAAsD,CAAC;AACrE,cAAc,8CAA8C,CAAC;AAC7D,cAAc,sDAAsD,CAAC;AACrE,cAAc,2DAA2D,CAAC;AAC1E,cAAc,sDAAsD,CAAC;AACrE,cAAc,yDAAyD,CAAC;AACxE,cAAc,sDAAsD,CAAC;AACrE,cAAc,oDAAoD,CAAC;AACnE,cAAc,uDAAuD,CAAC;AACtE,cAAc,gEAAgE,CAAC;AAC/E,cAAc,6EAA6E,CAAC;AAC5F,cAAc,gDAAgD,CAAC;AAC/D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,oDAAoD,CAAC;AACnE,cAAc,4CAA4C,CAAC;~~AAI3D~~,cAAc,mDAAmD,CAAC;AAClE,cAAc,+CAA+C,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mDAAmD,CAAC;AAClE,cAAc,oDAAoD,CAAC;AACnE,cAAc,sDAAsD,CAAC;AAKrE,cAAc,iEAAiE,CAAC;AAChF,cAAc,oEAAoE,CAAC;AAGnF,cAAc,sEAAsE,CAAC;AACrF,cAAc,+DAA+D,CAAC;AAC9E,cAAc,qEAAqE,CAAC;AACpF,cAAc,oEAAoE,CAAC;AACnF,cAAc,sDAAsD,CAAC;AACrE,cAAc,8CAA8C,CAAC;AAC7D,cAAc,sDAAsD,CAAC;AACrE,cAAc,2DAA2D,CAAC;AAC1E,cAAc,sDAAsD,CAAC;AACrE,cAAc,yDAAyD,CAAC;AACxE,cAAc,sDAAsD,CAAC;AACrE,cAAc,oDAAoD,CAAC;AACnE,cAAc,uDAAuD,CAAC;AACtE,cAAc,gEAAgE,CAAC;AAC/E,cAAc,mEAAmE,CAAC;AAClF,cAAc,sEAAsE,CAAC;AACrF,cAAc,6EAA6E,CAAC;AAC5F,cAAc,uEAAuE,CAAC;AACtF,cAAc,qEAAqE,CAAC;AACpF,cAAc,gDAAgD,CAAC;AAC/D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,uDAAuD,CAAC;AACtE,cAAc,oDAAoD,CAAC;AACnE,cAAc,4CAA4C,CAAC;AAC3D,cAAc,iFAAiF,CAAC;AAIhG,cAAc,mDAAmD,CAAC;AAClE,cAAc,+CAA+C,CAAC"}

package/dist/esm/index.js CHANGED Viewed

@@ -8,6 +8,8 @@ export * from './protocols/hooks-capability.external-connectors-models.schemas.j
 export * from './core/operation-classification.external-connectors-models.schemas.js';
 // Protocols
 export * from './protocols/agent-client-protocol.external-connectors-models.schemas.js';
+export * from './protocols/content-safety.external-connectors-models.schemas.js';
+export * from './protocols/electronic-signature.external-connectors-models.schemas.js';
 export * from './protocols/document-extraction.external-connectors-models.schemas.js';
 export * from './protocols/email.external-connectors-models.schemas.js';
 export * from './protocols/email.standard-interface.schemas.js';
@@ -19,11 +21,17 @@ export * from './protocols/hooks.external-connectors-models.schemas.js';
 export * from './protocols/llm.external-connectors-models.schemas.js';
 export * from './protocols/oauth2.external-connectors-models.schemas.js';
 export * from './protocols/rest-operations.external-connectors-models.schemas.js';
+export * from './protocols/graphql-operations.external-connectors-models.schemas.js';
+export * from './protocols/service-account-token.external-connectors-models.schemas.js';
 export * from './protocols/provider-oauth2-token-endpoint-hosts.external-connectors-models.js';
+export * from './protocols/provider-connection-parameters.external-connectors-models.js';
+export * from './protocols/provider-vendor-registration.external-connectors-models.js';
 export * from './protocols/billing.standard-interface.schemas.js';
 export * from './protocols/file-storage.standard-interface.js';
+export * from './protocols/subject-erasure-effect.standard-interface.js';
 export * from './protocols/sms.external-connectors-models.schemas.js';
 export * from './protocols/sms.standard-interface.schemas.js';
+export * from './protocols/provider-configuration-authoring.external-connectors-models.schemas.js';
 export * from './protocols/oauth2-provider-assurance.definitions.js';
 export * from './protocols/oauth2-provider-assurance.schemas.js';
 //# sourceMappingURL=index.js.map

package/dist/esm/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["~~../../../~~src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mDAAmD,CAAC;AAClE,cAAc,oDAAoD,CAAC;AACnE,cAAc,sDAAsD,CAAC;AAErE,+FAA+F;AAC/F,+FAA+F;AAC/F,2FAA2F;AAC3F,cAAc,iEAAiE,CAAC;AAChF,cAAc,oEAAoE,CAAC;AAEnF,YAAY;AACZ,cAAc,sEAAsE,CAAC;AACrF,cAAc,oEAAoE,CAAC;AACnF,cAAc,sDAAsD,CAAC;AACrE,cAAc,8CAA8C,CAAC;AAC7D,cAAc,sDAAsD,CAAC;AACrE,cAAc,2DAA2D,CAAC;AAC1E,cAAc,sDAAsD,CAAC;AACrE,cAAc,yDAAyD,CAAC;AACxE,cAAc,sDAAsD,CAAC;AACrE,cAAc,oDAAoD,CAAC;AACnE,cAAc,uDAAuD,CAAC;AACtE,cAAc,gEAAgE,CAAC;AAC/E,cAAc,6EAA6E,CAAC;AAC5F,cAAc,gDAAgD,CAAC;AAC/D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,oDAAoD,CAAC;AACnE,cAAc,4CAA4C,CAAC;~~AAI3D~~,cAAc,mDAAmD,CAAC;AAClE,cAAc,+CAA+C,CAAC","sourcesContent":["export * from './core/commons.external-connectors-models.schemas';\nexport * from './core/security.external-connectors-models.schemas';\nexport * from './core/operations.external-connectors-models.schemas';\n\n// Webhook capability contracts (adapter / handler / scope resolver) — consumed by the engine's\n// webhook pipeline. The former `features/` layer (capability enum, transformer interfaces) was\n// retired 2026-09-05 (#327): it re-stated `BUILTIN_PROVIDER_CAPABILITY` and had no reader.\nexport * from './protocols/hooks-capability.external-connectors-models.schemas';\nexport * from './core/operation-classification.external-connectors-models.schemas';\n\n// Protocols\nexport * from './protocols/agent-client-protocol.external-connectors-models.schemas';\nexport * from './protocols/document-extraction.external-connectors-models.schemas';\nexport * from './protocols/email.external-connectors-models.schemas';\nexport * from './protocols/email.standard-interface.schemas';\nexport * from './protocols/email-inbound.standard-interface.schemas';\nexport * from './protocols/embeddings.external-connectors-models.schemas';\nexport * from './protocols/image.external-connectors-models.schemas';\nexport * from './protocols/frontend.external-connectors-models.schemas';\nexport * from './protocols/hooks.external-connectors-models.schemas';\nexport * from './protocols/llm.external-connectors-models.schemas';\nexport * from './protocols/oauth2.external-connectors-models.schemas';\nexport * from './protocols/rest-operations.external-connectors-models.schemas';\nexport * from './protocols/provider-oauth2-token-endpoint-hosts.external-connectors-models';\nexport * from './protocols/billing.standard-interface.schemas';\nexport * from './protocols/file-storage.standard-interface';\nexport * from './protocols/sms.external-connectors-models.schemas';\nexport * from './protocols/sms.standard-interface.schemas';\n\n\n\nexport * from './protocols/oauth2-provider-assurance.definitions';\nexport * from './protocols/oauth2-provider-assurance.schemas';\n"]}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mDAAmD,CAAC;AAClE,cAAc,oDAAoD,CAAC;AACnE,cAAc,sDAAsD,CAAC;AAErE,+FAA+F;AAC/F,+FAA+F;AAC/F,2FAA2F;AAC3F,cAAc,iEAAiE,CAAC;AAChF,cAAc,oEAAoE,CAAC;AAEnF,YAAY;AACZ,cAAc,sEAAsE,CAAC;AACrF,cAAc,+DAA+D,CAAC;AAC9E,cAAc,qEAAqE,CAAC;AACpF,cAAc,oEAAoE,CAAC;AACnF,cAAc,sDAAsD,CAAC;AACrE,cAAc,8CAA8C,CAAC;AAC7D,cAAc,sDAAsD,CAAC;AACrE,cAAc,2DAA2D,CAAC;AAC1E,cAAc,sDAAsD,CAAC;AACrE,cAAc,yDAAyD,CAAC;AACxE,cAAc,sDAAsD,CAAC;AACrE,cAAc,oDAAoD,CAAC;AACnE,cAAc,uDAAuD,CAAC;AACtE,cAAc,gEAAgE,CAAC;AAC/E,cAAc,mEAAmE,CAAC;AAClF,cAAc,sEAAsE,CAAC;AACrF,cAAc,6EAA6E,CAAC;AAC5F,cAAc,uEAAuE,CAAC;AACtF,cAAc,qEAAqE,CAAC;AACpF,cAAc,gDAAgD,CAAC;AAC/D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,uDAAuD,CAAC;AACtE,cAAc,oDAAoD,CAAC;AACnE,cAAc,4CAA4C,CAAC;AAC3D,cAAc,iFAAiF,CAAC;AAIhG,cAAc,mDAAmD,CAAC;AAClE,cAAc,+CAA+C,CAAC","sourcesContent":["export * from './core/commons.external-connectors-models.schemas';\nexport * from './core/security.external-connectors-models.schemas';\nexport * from './core/operations.external-connectors-models.schemas';\n\n// Webhook capability contracts (adapter / handler / scope resolver) — consumed by the engine's\n// webhook pipeline. The former `features/` layer (capability enum, transformer interfaces) was\n// retired 2026-09-05 (#327): it re-stated `BUILTIN_PROVIDER_CAPABILITY` and had no reader.\nexport * from './protocols/hooks-capability.external-connectors-models.schemas';\nexport * from './core/operation-classification.external-connectors-models.schemas';\n\n// Protocols\nexport * from './protocols/agent-client-protocol.external-connectors-models.schemas';\nexport * from './protocols/content-safety.external-connectors-models.schemas';\nexport * from './protocols/electronic-signature.external-connectors-models.schemas';\nexport * from './protocols/document-extraction.external-connectors-models.schemas';\nexport * from './protocols/email.external-connectors-models.schemas';\nexport * from './protocols/email.standard-interface.schemas';\nexport * from './protocols/email-inbound.standard-interface.schemas';\nexport * from './protocols/embeddings.external-connectors-models.schemas';\nexport * from './protocols/image.external-connectors-models.schemas';\nexport * from './protocols/frontend.external-connectors-models.schemas';\nexport * from './protocols/hooks.external-connectors-models.schemas';\nexport * from './protocols/llm.external-connectors-models.schemas';\nexport * from './protocols/oauth2.external-connectors-models.schemas';\nexport * from './protocols/rest-operations.external-connectors-models.schemas';\nexport * from './protocols/graphql-operations.external-connectors-models.schemas';\nexport * from './protocols/service-account-token.external-connectors-models.schemas';\nexport * from './protocols/provider-oauth2-token-endpoint-hosts.external-connectors-models';\nexport * from './protocols/provider-connection-parameters.external-connectors-models';\nexport * from './protocols/provider-vendor-registration.external-connectors-models';\nexport * from './protocols/billing.standard-interface.schemas';\nexport * from './protocols/file-storage.standard-interface';\nexport * from './protocols/subject-erasure-effect.standard-interface';\nexport * from './protocols/sms.external-connectors-models.schemas';\nexport * from './protocols/sms.standard-interface.schemas';\nexport * from './protocols/provider-configuration-authoring.external-connectors-models.schemas';\n\n\n\nexport * from './protocols/oauth2-provider-assurance.definitions';\nexport * from './protocols/oauth2-provider-assurance.schemas';\n"]}

package/dist/esm/protocols/agent-client-protocol.external-connectors-models.schemas.d.ts CHANGED Viewed

@@ -295,6 +295,7 @@ export declare enum AgentClientProtocol_PermissionEscalationBehaviour {
  * contract names. Deliberately a parameter rather than something this function
  * reads, because the environment is composed by the dispatch and a predicate
  * that guessed at it would be a second, quieter answer.
+ * assurance-control: WILDO.SOFTWARE.AI_PRODUCED_CHANGE_CONTROL — the one answer to whether the ceiling and write scope can fire for an agent: always, never, or only when its configuration pointer reaches it.
  */
 export declare function agentClientProtocolInFlightGuardsCanFire(behaviour: AgentClientProtocol_PermissionEscalationBehaviour, escalationConfigurationSupplied: boolean): boolean;
 /**
@@ -537,13 +538,8 @@ export declare enum CodingAgent_EndOfTurnClassification {
  * what was classified and what was sent back.
  */
 export declare const CodingAgent_ContinuationRecordSchema: z.ZodObject<{
-    /** 1-based index of the turn that ENDED at this boundary. */
     turnIndex: z.ZodNumber;
     classification: z.ZodEnum<typeof CodingAgent_EndOfTurnClassification>;
-    /**
-     * The tail of the agent's end-of-turn message the classification was made
-     * from. A bounded excerpt, not the transcript — enough to audit the judgment.
-     */
     agentMessageTail: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export type CodingAgent_ContinuationRecord = z.infer<typeof CodingAgent_ContinuationRecordSchema>;
@@ -558,26 +554,10 @@ export type CodingAgent_ContinuationRecord = z.infer<typeof CodingAgent_Continua
  * survives the child process and even a host restart.
  */
 export declare const CodingAgent_SessionSuspensionSchema: z.ZodObject<{
-    /** The ACP session to resume with the answer. */
     sessionId: z.ZodString;
-    /** The agent's question, verbatim — its end-of-turn message. */
     question: z.ZodString;
-    /** 1-based turn the session parked after. */
     turnIndex: z.ZodNumber;
-    /**
-     * Whether the session can be re-entered after the agent process is gone.
-     * False when the agent does not advertise `loadSession`: the question is
-     * still real, but answering it starts a NEW session that must restate task
-     * context — a degradation the caller should surface, not hide.
-     */
     resumable: z.ZodBoolean;
-    /**
-     * An INFORMATIONAL freshness bound for the question (ISO timestamp), surfaced to the operator —
-     * never a reaping deadline. No child process is held open while a run is parked (see
-     * `awaitingInputTtlMs`), so there is nothing that closes at this instant. It said "when the parked
-     * child process will be closed" until 2026-09-24, contradicting the contract above it, and a host
-     * read it that way and aborted answerable questions at boot (#1533).
-     */
     parkedUntil: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export type CodingAgent_SessionSuspension = z.infer<typeof CodingAgent_SessionSuspensionSchema>;
@@ -711,36 +691,15 @@ export declare const CodingAgent_RunTaskOutputSchema: z.ZodObject<{
     rawStopReason: z.ZodOptional<z.ZodString>;
     turnCount: z.ZodOptional<z.ZodNumber>;
     continuations: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        /** 1-based index of the turn that ENDED at this boundary. */
         turnIndex: z.ZodNumber;
         classification: z.ZodEnum<typeof CodingAgent_EndOfTurnClassification>;
-        /**
-         * The tail of the agent's end-of-turn message the classification was made
-         * from. A bounded excerpt, not the transcript — enough to audit the judgment.
-         */
         agentMessageTail: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>>;
     suspension: z.ZodOptional<z.ZodObject<{
-        /** The ACP session to resume with the answer. */
         sessionId: z.ZodString;
-        /** The agent's question, verbatim — its end-of-turn message. */
         question: z.ZodString;
-        /** 1-based turn the session parked after. */
         turnIndex: z.ZodNumber;
-        /**
-         * Whether the session can be re-entered after the agent process is gone.
-         * False when the agent does not advertise `loadSession`: the question is
-         * still real, but answering it starts a NEW session that must restate task
-         * context — a degradation the caller should surface, not hide.
-         */
         resumable: z.ZodBoolean;
-        /**
-         * An INFORMATIONAL freshness bound for the question (ISO timestamp), surfaced to the operator —
-         * never a reaping deadline. No child process is held open while a run is parked (see
-         * `awaitingInputTtlMs`), so there is nothing that closes at this instant. It said "when the parked
-         * child process will be closed" until 2026-09-24, contradicting the contract above it, and a host
-         * read it that way and aborted answerable questions at boot (#1533).
-         */
         parkedUntil: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
 }, z.core.$strip>;
@@ -817,4 +776,12 @@ export declare function readCodingModelDestinations(providerConfigurations: Read
 export declare const ACP_WRITING_TOOL_KINDS: ReadonlySet<string>;
 /** Whether an ACP tool kind writes the workspace; an absent kind is no evidence that it does. */
 export declare function isWritingAcpToolKind(kind: string | undefined): boolean;
+/**
+ * The file locations ONE ACP `session/update` claims as WRITTEN: the `locations` of a `tool_call` or
+ * `tool_call_update` whose kind writes ({@link isWritingAcpToolKind}). An update may omit its kind, so the kind of
+ * each call is remembered by its `toolCallId` in `toolCallKinds`, which the caller keeps per session. The ONE rule:
+ * the session runner gathers a run's `reportedFileLocations` with it, and the companion keeps a live run's claims on
+ * disk with it (#3205), so the two cannot disagree about what a run claimed. Pure apart from that memo.
+ */
+export declare function writtenLocationsOfAcpSessionUpdate(sessionUpdateKind: string, update: unknown, toolCallKinds: Map<string, string>): string[];
 //# sourceMappingURL=agent-client-protocol.external-connectors-models.schemas.d.ts.map

package/dist/esm/protocols/agent-client-protocol.external-connectors-models.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"agent-client-protocol.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../src/protocols/agent-client-protocol.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,yCAAyC,EAC1C,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EACL,uBAAuB,EACvB,oDAAoD,EAEpD,sCAAsC,EACrC,MAAM,oDAAoD,CAAC;AAoC9D;;;;;;;;GAQG;AACH,oBAAY,8BAA8B;IACxC,kBAAkB,uBAAuB;CAC1C;AAED;;;;;;;;GAQG;AACH,oBAAY,4BAA4B;IACtC,oFAAoF;IACpF,IAAI,SAAS;IACb;;;;;OAKG;IACH,YAAY,iBAAiB;IAC7B,gFAAgF;IAChF,wBAAwB,6BAA6B;CACtD;AAED;;;;;;;GAOG;AACH,oBAAY,0CAA0C;IACpD,cAAc,mBAAmB;IACjC,uBAAuB,4BAA4B;CACpD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,sGAAsG;AACtG,oBAAY,qCAAqC;IAC/C;;;;;;;;;;OAUG;IACH,aAAa,kBAAkB;IAC/B;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,sBAAsB;IACvC;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,sBAAsB;IACvC;;;;;;;;;;;;;;;;OAgBG;IACH,2BAA2B,gCAAgC;IAC3D;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,YAAY,iBAAiB;CAC9B;AACD,oDAAoD;AAEpD;;;;;;GAMG;AACH,wBAAgB,wCAAwC,CACtD,OAAO,EAAE,qCAAqC,GAC7C,MAAM,CAaR;AAED;;;;;;;;GAQG;AACH,oBAAY,mCAAmC;IAC7C,yDAAyD;IACzD,cAAc,mBAAmB;IACjC,0EAA0E;IAC1E,kBAAkB,uBAAuB;IACzC,yGAAyG;IACzG,eAAe,oBAAoB;CACpC;AAED;;;;;;;GAOG;AACH,oBAAY,yBAAyB;IACnC,SAAS,cAAc;IACvB,UAAU,eAAe;IACzB,aAAa,kBAAkB;IAC/B,OAAO,YAAY;CACpB;AAED;;;;GAIG;AACH,eAAO,MAAM,yCAAyC,mDAAmD,CAAC;AAE1G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,yGAAyG;AACzG,oBAAY,iDAAiD;IAC3D;;;;OAIG;IACH,sBAAsB,2BAA2B;IACjD;;;;;;;;OAQG;IACH,oCAAoC,yCAAyC;IAC7E;;;;;OAKG;IACH,YAAY,iBAAiB;CAC9B;AACD,uDAAuD;AAEvD~~;;;;;;;;;;;;GAYG~~;AACH,wBAAgB,wCAAwC,CACtD,SAAS,EAAE,iDAAiD,EAC5D,+BAA+B,EAAE,OAAO,GACvC,OAAO,CAST;AAED;;;;;;;;;;;;;;;GAeG;AACH,kHAAkH;AAClH,oBAAY,gDAAgD;IAC1D,sFAAsF;IACtF,QAAQ,aAAa;IACrB;;;;OAIG;IACH,kBAAkB,uBAAuB;IACzC;;;;;OAKG;IACH,cAAc,mBAAmB;CAClC;AACD,gEAAgE;AAEhE,qGAAqG;AACrG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,0CAA0C;;;;;;;kBAgC5C,CAAC;AACZ,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAC9G,mDAAmD;AAEnD;;;;;GAKG;AACH,qGAAqG;AACrG,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;;;;;;;;;;;;;;;~~kBAuLrD~~,CAAC;AACH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAC9G,mDAAmD;AAEnD,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAWlD,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,oDAAoD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAc/J,oBAAY,wBAAwB;IAClC,iFAAiF;IACjF,eAAe,yBAAyB;CACzC;AAED;;;;;;;;;GASG;AACH,oBAAY,sBAAsB;IAChC,4CAA4C;IAC5C,QAAQ,aAAa;IACrB,qDAAqD;IACrD,UAAU,eAAe;IACzB,6DAA6D;IAC7D,iBAAiB,sBAAsB;IACvC,mCAAmC;IACnC,OAAO,YAAY;IACnB,oEAAoE;IACpE,SAAS,cAAc;IACvB;;;;;;;;;OASG;IACH,YAAY,uBAAuB;CACpC;AAED;;;;;;;;;GASG;AACH,oBAAY,mCAAmC;IAC7C,+DAA+D;IAC/D,aAAa,kBAAkB;IAC/B;;;;;OAKG;IACH,UAAU,eAAe;IACzB;;;;OAIG;IACH,WAAW,gBAAgB;IAC3B;;;;;OAKG;IACH,sBAAsB,2BAA2B;CAClD;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oCAAoC~~;IAC~~/C,~~6DAA6D;;;IAG7D;;;OAGG;;kBAEH,~~CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC~~;IAC9C,iDAAiD;;IAEjD,gEAAgE;;IAEhE,6CAA6C;;IAE7C;;;;;OAKG;;IAEH~~;;;;;;~~OAMG;;kBAEH~~,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;iBAwBlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;;;;;GAQG;AACH,eAAO,MAAM,oDAAoD;;;;;;;;;;;;iBA+C/D,CAAC;AACH,MAAM,MAAM,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oDAAoD,CAAC,CAAC;AAElI,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAKlD,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG,MAAM,MAAM,mCAAmC,GAAG,yCAAyC,GAAG;IAC5F,sBAAsB,EAAE,OAAO,uCAAuC,CAAC;IACvE,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B,CAAC;AAMF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,8CAA8C;;;iBAGzD,CAAC;AACH,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8CAA8C,CAAC,CAAC;AAErH,eAAO,MAAM,8BAA8B;;;;iBA4BzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,+BAA+B~~;;;;;;;;;;;;;;;QAvN1C~~,~~6DAA6D;;;QAG7D;;;WAGG;;;;QAgBH,iDAAiD;;QAEjD,gEAAgE;;QAEhE,6CAA6C;;QAE7C;;;;;WAKG;;QAEH;;;;;;WAMG;;;iBAiPH,~~CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;GAMG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,oCAAoC,CAAC;CAC5D;AAED,uFAAuF;AACvF,MAAM,WAAW,6BAA6B;IAC5C,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAC9D;;;;;OAKG;IACH,QAAQ,CAAC,2BAA2B,EAAE,SAAS;QAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACzH;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,2BAA2B,CAQzC,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxD,6BAA6B,CAiC/B;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAAuC,CAAC;AAE/F,iGAAiG;AACjG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEtE"}
1	+ {"version":3,"file":"agent-client-protocol.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../src/protocols/agent-client-protocol.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,yCAAyC,EAC1C,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EACL,uBAAuB,EACvB,oDAAoD,EAEpD,sCAAsC,EACrC,MAAM,oDAAoD,CAAC;AAoC9D;;;;;;;;GAQG;AACH,oBAAY,8BAA8B;IACxC,kBAAkB,uBAAuB;CAC1C;AAED;;;;;;;;GAQG;AACH,oBAAY,4BAA4B;IACtC,oFAAoF;IACpF,IAAI,SAAS;IACb;;;;;OAKG;IACH,YAAY,iBAAiB;IAC7B,gFAAgF;IAChF,wBAAwB,6BAA6B;CACtD;AAED;;;;;;;GAOG;AACH,oBAAY,0CAA0C;IACpD,cAAc,mBAAmB;IACjC,uBAAuB,4BAA4B;CACpD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,sGAAsG;AACtG,oBAAY,qCAAqC;IAC/C;;;;;;;;;;OAUG;IACH,aAAa,kBAAkB;IAC/B;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,sBAAsB;IACvC;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,sBAAsB;IACvC;;;;;;;;;;;;;;;;OAgBG;IACH,2BAA2B,gCAAgC;IAC3D;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,YAAY,iBAAiB;CAC9B;AACD,oDAAoD;AAEpD;;;;;;GAMG;AACH,wBAAgB,wCAAwC,CACtD,OAAO,EAAE,qCAAqC,GAC7C,MAAM,CAaR;AAED;;;;;;;;GAQG;AACH,oBAAY,mCAAmC;IAC7C,yDAAyD;IACzD,cAAc,mBAAmB;IACjC,0EAA0E;IAC1E,kBAAkB,uBAAuB;IACzC,yGAAyG;IACzG,eAAe,oBAAoB;CACpC;AAED;;;;;;;GAOG;AACH,oBAAY,yBAAyB;IACnC,SAAS,cAAc;IACvB,UAAU,eAAe;IACzB,aAAa,kBAAkB;IAC/B,OAAO,YAAY;CACpB;AAED;;;;GAIG;AACH,eAAO,MAAM,yCAAyC,mDAAmD,CAAC;AAE1G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,yGAAyG;AACzG,oBAAY,iDAAiD;IAC3D;;;;OAIG;IACH,sBAAsB,2BAA2B;IACjD;;;;;;;;OAQG;IACH,oCAAoC,yCAAyC;IAC7E;;;;;OAKG;IACH,YAAY,iBAAiB;CAC9B;AACD,uDAAuD;AAEvD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wCAAwC,CACtD,SAAS,EAAE,iDAAiD,EAC5D,+BAA+B,EAAE,OAAO,GACvC,OAAO,CAST;AAED;;;;;;;;;;;;;;;GAeG;AACH,kHAAkH;AAClH,oBAAY,gDAAgD;IAC1D,sFAAsF;IACtF,QAAQ,aAAa;IACrB;;;;OAIG;IACH,kBAAkB,uBAAuB;IACzC;;;;;OAKG;IACH,cAAc,mBAAmB;CAClC;AACD,gEAAgE;AAEhE,qGAAqG;AACrG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,0CAA0C;;;;;;;kBAgC5C,CAAC;AACZ,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAC9G,mDAAmD;AAEnD;;;;;GAKG;AACH,qGAAqG;AACrG,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA+LrD,CAAC;AACH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAC9G,mDAAmD;AAEnD,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAWlD,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,oDAAoD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAc/J,oBAAY,wBAAwB;IAClC,iFAAiF;IACjF,eAAe,yBAAyB;CACzC;AAED;;;;;;;;;GASG;AACH,oBAAY,sBAAsB;IAChC,4CAA4C;IAC5C,QAAQ,aAAa;IACrB,qDAAqD;IACrD,UAAU,eAAe;IACzB,6DAA6D;IAC7D,iBAAiB,sBAAsB;IACvC,mCAAmC;IACnC,OAAO,YAAY;IACnB,oEAAoE;IACpE,SAAS,cAAc;IACvB;;;;;;;;;OASG;IACH,YAAY,uBAAuB;CACpC;AAED;;;;;;;;;GASG;AACH,oBAAY,mCAAmC;IAC7C,+DAA+D;IAC/D,aAAa,kBAAkB;IAC/B;;;;;OAKG;IACH,UAAU,eAAe;IACzB;;;;OAIG;IACH,WAAW,gBAAgB;IAC3B;;;;;OAKG;IACH,sBAAsB,2BAA2B;CAClD;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oCAAoC;;;;kBAS/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC;;;;;;kBAsB9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;iBAwBlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;;;;;GAQG;AACH,eAAO,MAAM,oDAAoD;;;;;;;;;;;;iBA+C/D,CAAC;AACH,MAAM,MAAM,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oDAAoD,CAAC,CAAC;AAElI,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAKlD,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG,MAAM,MAAM,mCAAmC,GAAG,yCAAyC,GAAG;IAC5F,sBAAsB,EAAE,OAAO,uCAAuC,CAAC;IACvE,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B,CAAC;AAMF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,8CAA8C;;;iBAGzD,CAAC;AACH,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8CAA8C,CAAC,CAAC;AAErH,eAAO,MAAM,8BAA8B;;;;iBA4BzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;iBAmE1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;GAMG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,oCAAoC,CAAC;CAC5D;AAED,uFAAuF;AACvF,MAAM,WAAW,6BAA6B;IAC5C,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAC9D;;;;;OAKG;IACH,QAAQ,CAAC,2BAA2B,EAAE,SAAS;QAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACzH;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,2BAA2B,CAQzC,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxD,6BAA6B,CAiC/B;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAAuC,CAAC;AAE/F,iGAAiG;AACjG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEtE;AAED;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAAC,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,CAU3I"}

package/dist/esm/protocols/agent-client-protocol.external-connectors-models.schemas.js CHANGED Viewed

@@ -348,6 +348,7 @@ export var AgentClientProtocol_PermissionEscalationBehaviour;
  * contract names. Deliberately a parameter rather than something this function
  * reads, because the environment is composed by the dispatch and a predicate
  * that guessed at it would be a second, quieter answer.
+ * assurance-control: WILDO.SOFTWARE.AI_PRODUCED_CHANGE_CONTROL — the one answer to whether the ceiling and write scope can fire for an agent: always, never, or only when its configuration pointer reaches it.
  */
 export function agentClientProtocolInFlightGuardsCanFire(behaviour, escalationConfigurationSupplied) {
     switch (behaviour) {
@@ -486,7 +487,15 @@ export const AgentClientProtocol_ExecutionProfileSchema = z.object({
      *
      * The runner starts from a minimal identity allowlist and adds only what is
      * named here. Full inheritance is never available: the process that spawns
-     * the agent holds platform secrets that must not reach it.
+     * the agent holds platform secrets that must not reach it. Naming one does
+     * not get past that: a variable the framework declares secret (a platform or
+     * application runtime secret, an inbound endpoint or system-of-record
+     * secret, or any provider's declared secret) is refused by `wildo config
+     * sync`, on every read and at startup, and at dispatch. A provider credential
+     * the agent needs is handed to it through `secretEnvVarName` instead. The
+     * refusal covers what the framework declares; a secret in the developer's
+     * own shell environment is not the framework's to know, so name only what
+     * the agent needs.
      */
     inheritedEnvironmentVariables: z.array(z.string().min(1)).optional(),
     authMode: z.enum(AgentClientProtocol_AuthMode),
@@ -1079,4 +1088,25 @@ export const ACP_WRITING_TOOL_KINDS = new Set(['edit', 'delete', 'move']);
 export function isWritingAcpToolKind(kind) {
     return kind !== undefined && ACP_WRITING_TOOL_KINDS.has(kind);
 }
+/**
+ * The file locations ONE ACP `session/update` claims as WRITTEN: the `locations` of a `tool_call` or
+ * `tool_call_update` whose kind writes ({@link isWritingAcpToolKind}). An update may omit its kind, so the kind of
+ * each call is remembered by its `toolCallId` in `toolCallKinds`, which the caller keeps per session. The ONE rule:
+ * the session runner gathers a run's `reportedFileLocations` with it, and the companion keeps a live run's claims on
+ * disk with it (#3205), so the two cannot disagree about what a run claimed. Pure apart from that memo.
+ */
+export function writtenLocationsOfAcpSessionUpdate(sessionUpdateKind, update, toolCallKinds) {
+    if (sessionUpdateKind !== 'tool_call' && sessionUpdateKind !== 'tool_call_update')
+        return [];
+    const fields = typeof update === 'object' && update !== null ? update : {};
+    const toolCallId = typeof fields.toolCallId === 'string' ? fields.toolCallId : undefined;
+    if (toolCallId !== undefined && typeof fields.kind === 'string')
+        toolCallKinds.set(toolCallId, fields.kind);
+    const toolKind = typeof fields.kind === 'string' ? fields.kind : (toolCallId !== undefined ? toolCallKinds.get(toolCallId) : undefined);
+    if (!Array.isArray(fields.locations) || !isWritingAcpToolKind(toolKind))
+        return [];
+    return fields.locations
+        .filter((entry) => typeof entry === 'object' && entry !== null && typeof entry.path === 'string')
+        .map((entry) => entry.path);
+}
 //# sourceMappingURL=agent-client-protocol.external-connectors-models.schemas.js.map