npm - @wildo-ai/external-connectors-models - Versions diffs - 1.1.11 → 1.1.13 - Mend

@wildo-ai/external-connectors-models 1.1.11 → 1.1.13

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (109) hide show

package/dist/esm/companion-exports.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"companion-exports.d.ts","sourceRoot":"","sources":["~~../../../~~src/companion-exports.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,cAAc,SAAS,CAAC"}
1	+ {"version":3,"file":"companion-exports.d.ts","sourceRoot":"","sources":["../../src/companion-exports.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,cAAc,SAAS,CAAC"}

package/dist/esm/companion-exports.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"companion-exports.js","sourceRoot":"","sources":["~~../../../~~src/companion-exports.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,cAAc,SAAS,CAAC","sourcesContent":["/*\n Dedicated companion entrypoint for external-connector model contracts.\n \n The explicit subpath keeps companion/tooling imports consistent across the\n * engine package family.\n /\nexport from './index';\n"]}
1	+ {"version":3,"file":"companion-exports.js","sourceRoot":"","sources":["../../src/companion-exports.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,cAAc,SAAS,CAAC","sourcesContent":["/*\n Dedicated companion entrypoint for external-connector model contracts.\n \n The explicit subpath keeps companion/tooling imports consistent across the\n * engine package family.\n /\nexport from './index';\n"]}

package/dist/esm/core/commons.external-connectors-models.schemas.d.ts CHANGED Viewed

@@ -74,6 +74,15 @@ export declare enum ExternalProvider_ExchangeProtocol_Kind {
      * independently of the vendor that answers it.
      */
     CONTENT_SAFETY_PROVIDER = "content_safety_provider",
+    /**
+     * A deliverable → its signers' own electronic signatures, applied by a trust-service vendor (#2293). The provider
+     * declares pure functions over a conversation of requests; the engine owns transport, keys and deadlines, and never
+     * trusts the vendor's word that a request is signed.
+     *
+     * Its own kind and its own `EngineCapability.ELECTRONIC_SIGNATURE` slot: which vendor signs a client's engagement
+     * letter is a legal and procurement decision unrelated to every other provider's.
+     */
+    ELECTRONIC_SIGNATURE_PROVIDER = "electronic_signature_provider",
     /** Reserved — audio generation (TTS / music). Serves the AUDIO modality. Not yet implemented. */
     AUDIO_PROVIDER = "audio_provider",
     /** Reserved — video generation. Serves the VIDEO modality. Not yet implemented. */
@@ -112,6 +121,7 @@ export declare const ProviderProtocolRuntimeKind: Readonly<{
     readonly EMBEDDINGS: ExternalProvider_ExchangeProtocol_Kind.EMBEDDINGS_PROVIDER;
     readonly DOCUMENT_EXTRACTION: ExternalProvider_ExchangeProtocol_Kind.DOCUMENT_EXTRACTION_PROVIDER;
     readonly CONTENT_SAFETY: ExternalProvider_ExchangeProtocol_Kind.CONTENT_SAFETY_PROVIDER;
+    readonly ELECTRONIC_SIGNATURE: ExternalProvider_ExchangeProtocol_Kind.ELECTRONIC_SIGNATURE_PROVIDER;
     readonly AGENT_CLIENT_PROTOCOL: ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL;
     readonly EMAIL: ExternalProvider_ExchangeProtocol_Kind.EMAIL_PROVIDER;
     readonly EMAIL_INBOUND: ExternalProvider_ExchangeProtocol_Kind.EMAIL_INBOUND_PROVIDER;

package/dist/esm/core/commons.external-connectors-models.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"commons.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/core/commons.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,sCAAsC;IAEhD,QAAQ,aAAa;IACrB,kBAAkB,uBAAuB;IAIzC,YAAY,iBAAiB;IAC7B;;;;;;;;;;;;;;;OAeG;IACH,qBAAqB,0BAA0B;IAE/C,8EAA8E;IAC9E,cAAc,mBAAmB;IACjC;;;;;;;;;;OAUG;IACH,mBAAmB,wBAAwB;IAC3C;;;;;;;;;;;;;OAaG;IACH,4BAA4B,iCAAiC;IAC7D;;;;;;;OAOG;IACH,uBAAuB,4BAA4B;IACnD,iGAAiG;IACjG,cAAc,mBAAmB;IACjC,mFAAmF;IACnF,cAAc,mBAAmB;IAGjC,cAAc,mBAAmB;IACjC;;;;;;;OAOG;IACH,sBAAsB,2BAA2B;IAGjD,UAAU,eAAe;IAIzB,gBAAgB,qBAAqB;IAGrC,YAAY,iBAAiB;IAG7B,YAAY,iBAAiB;CAC9B;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,2BAA2B~~;;;;;;;;;;;;;;EAc7B~~,CAAC;AACZ,MAAM,MAAM,2BAA2B,GACrC,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,OAAO,2BAA2B,CAAC,CAAC;AAEjF,oBAAY,uBAAuB;IACjC,WAAW,gBAAgB;IAC3B,OAAO,YAAY;IACnB,UAAU,eAAe;CAC1B;AAGD,oBAAY,cAAc;IACxB,GAAG,QAAQ;IACX,IAAI,SAAS;IACb,GAAG,QAAQ;IACX,KAAK,UAAU;IACf,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,0DAA0D;;;;;;;;;;;;;;;;iBAIrE,CAAC;AAEH,MAAM,MAAM,oDAAoD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0DAA0D,CAAC,CAAC;AAE9I;;;;;;;;;;;;;;;;;;;GAmBG;AACH,oBAAY,4CAA4C;IACtD,gBAAgB,oBAAoB;IACpC,SAAS,cAAc;CACxB;AAED,iGAAiG;AACjG,MAAM,WAAW,mDAAmD;IAClE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,2GAA2G;IAC3G,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,4CAA4C,CAAC;CAC5D;AAID;;;;;GAKG;AACH,wBAAgB,wCAAwC,CAAC,sBAAsB,EAAE,OAAO,GAAG,mDAAmD,EAAE,CAa/I;AAED,qGAAqG;AACrG,wBAAgB,2CAA2C,CAAC,OAAO,EAAE,mDAAmD,GAAG,MAAM,CAIhI;AAED;;;;;GAKG;AACH,wBAAgB,0CAA0C,CAAC,sBAAsB,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,aAAa,GAAG,IAAI,CAQtH;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,oBAAY,oCAAoC;IAC9C,+GAA+G;IAC/G,eAAe,oBAAoB;IACnC;;;OAGG;IACH,qCAAqC,0CAA0C;IAC/E;;;OAGG;IACH,uCAAuC,4CAA4C;CACpF;AAED,iHAAiH;AACjH,MAAM,WAAW,2CAA2C;IAC1D,QAAQ,CAAC,KAAK,EAAE,oCAAoC,CAAC;IACrD,wIAAwI;IACxI,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,4FAA4F;IAC5F,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAKD;;;;;GAKG;AACH,wBAAgB,qCAAqC,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAElF;AAuCD;;;GAGG;AACH,wBAAgB,yCAAyC,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,2CAA2C,EAAE,CAG1I;AAWD,oBAAY,6BAA6B;IACvC,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,aAAa,kBAAkB;CAChC;AAED,oBAAY,sCAAsC;IAChD,gBAAgB,qBAAqB;IACrC,WAAW,gBAAgB;IAC3B,SAAS,WAAW;CACrB;AAGD;;;;;;;GAOG;AACH,oBAAY,qCAAqC;IAC/C;;;OAGG;IACH,kBAAkB,uBAAuB;CAC1C"}
1	+ {"version":3,"file":"commons.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../src/core/commons.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,sCAAsC;IAEhD,QAAQ,aAAa;IACrB,kBAAkB,uBAAuB;IAIzC,YAAY,iBAAiB;IAC7B;;;;;;;;;;;;;;;OAeG;IACH,qBAAqB,0BAA0B;IAE/C,8EAA8E;IAC9E,cAAc,mBAAmB;IACjC;;;;;;;;;;OAUG;IACH,mBAAmB,wBAAwB;IAC3C;;;;;;;;;;;;;OAaG;IACH,4BAA4B,iCAAiC;IAC7D;;;;;;;OAOG;IACH,uBAAuB,4BAA4B;IACnD;;;;;;;OAOG;IACH,6BAA6B,kCAAkC;IAC/D,iGAAiG;IACjG,cAAc,mBAAmB;IACjC,mFAAmF;IACnF,cAAc,mBAAmB;IAGjC,cAAc,mBAAmB;IACjC;;;;;;;OAOG;IACH,sBAAsB,2BAA2B;IAGjD,UAAU,eAAe;IAIzB,gBAAgB,qBAAqB;IAGrC,YAAY,iBAAiB;IAG7B,YAAY,iBAAiB;CAC9B;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;EAe7B,CAAC;AACZ,MAAM,MAAM,2BAA2B,GACrC,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,OAAO,2BAA2B,CAAC,CAAC;AAEjF,oBAAY,uBAAuB;IACjC,WAAW,gBAAgB;IAC3B,OAAO,YAAY;IACnB,UAAU,eAAe;CAC1B;AAGD,oBAAY,cAAc;IACxB,GAAG,QAAQ;IACX,IAAI,SAAS;IACb,GAAG,QAAQ;IACX,KAAK,UAAU;IACf,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,0DAA0D;;;;;;;;;;;;;;;;iBAIrE,CAAC;AAEH,MAAM,MAAM,oDAAoD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0DAA0D,CAAC,CAAC;AAE9I;;;;;;;;;;;;;;;;;;;GAmBG;AACH,oBAAY,4CAA4C;IACtD,gBAAgB,oBAAoB;IACpC,SAAS,cAAc;CACxB;AAED,iGAAiG;AACjG,MAAM,WAAW,mDAAmD;IAClE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,2GAA2G;IAC3G,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,4CAA4C,CAAC;CAC5D;AAID;;;;;GAKG;AACH,wBAAgB,wCAAwC,CAAC,sBAAsB,EAAE,OAAO,GAAG,mDAAmD,EAAE,CAa/I;AAED,qGAAqG;AACrG,wBAAgB,2CAA2C,CAAC,OAAO,EAAE,mDAAmD,GAAG,MAAM,CAIhI;AAED;;;;;GAKG;AACH,wBAAgB,0CAA0C,CAAC,sBAAsB,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,aAAa,GAAG,IAAI,CAQtH;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,oBAAY,oCAAoC;IAC9C,+GAA+G;IAC/G,eAAe,oBAAoB;IACnC;;;OAGG;IACH,qCAAqC,0CAA0C;IAC/E;;;OAGG;IACH,uCAAuC,4CAA4C;CACpF;AAED,iHAAiH;AACjH,MAAM,WAAW,2CAA2C;IAC1D,QAAQ,CAAC,KAAK,EAAE,oCAAoC,CAAC;IACrD,wIAAwI;IACxI,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,4FAA4F;IAC5F,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAKD;;;;;GAKG;AACH,wBAAgB,qCAAqC,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAElF;AAuCD;;;GAGG;AACH,wBAAgB,yCAAyC,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,2CAA2C,EAAE,CAG1I;AAWD,oBAAY,6BAA6B;IACvC,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,aAAa,kBAAkB;CAChC;AAED,oBAAY,sCAAsC;IAChD,gBAAgB,qBAAqB;IACrC,WAAW,gBAAgB;IAC3B,SAAS,WAAW;CACrB;AAGD;;;;;;;GAOG;AACH,oBAAY,qCAAqC;IAC/C;;;OAGG;IACH,kBAAkB,uBAAuB;CAC1C"}

package/dist/esm/core/commons.external-connectors-models.schemas.js CHANGED Viewed

@@ -80,6 +80,15 @@ export var ExternalProvider_ExchangeProtocol_Kind;
      * independently of the vendor that answers it.
      */
     ExternalProvider_ExchangeProtocol_Kind["CONTENT_SAFETY_PROVIDER"] = "content_safety_provider";
+    /**
+     * A deliverable → its signers' own electronic signatures, applied by a trust-service vendor (#2293). The provider
+     * declares pure functions over a conversation of requests; the engine owns transport, keys and deadlines, and never
+     * trusts the vendor's word that a request is signed.
+     *
+     * Its own kind and its own `EngineCapability.ELECTRONIC_SIGNATURE` slot: which vendor signs a client's engagement
+     * letter is a legal and procurement decision unrelated to every other provider's.
+     */
+    ExternalProvider_ExchangeProtocol_Kind["ELECTRONIC_SIGNATURE_PROVIDER"] = "electronic_signature_provider";
     /** Reserved — audio generation (TTS / music). Serves the AUDIO modality. Not yet implemented. */
     ExternalProvider_ExchangeProtocol_Kind["AUDIO_PROVIDER"] = "audio_provider";
     /** Reserved — video generation. Serves the VIDEO modality. Not yet implemented. */
@@ -124,6 +133,7 @@ export const ProviderProtocolRuntimeKind = Object.freeze({
     EMBEDDINGS: ExternalProvider_ExchangeProtocol_Kind.EMBEDDINGS_PROVIDER,
     DOCUMENT_EXTRACTION: ExternalProvider_ExchangeProtocol_Kind.DOCUMENT_EXTRACTION_PROVIDER,
     CONTENT_SAFETY: ExternalProvider_ExchangeProtocol_Kind.CONTENT_SAFETY_PROVIDER,
+    ELECTRONIC_SIGNATURE: ExternalProvider_ExchangeProtocol_Kind.ELECTRONIC_SIGNATURE_PROVIDER,
     AGENT_CLIENT_PROTOCOL: ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL,
     EMAIL: ExternalProvider_ExchangeProtocol_Kind.EMAIL_PROVIDER,
     EMAIL_INBOUND: ExternalProvider_ExchangeProtocol_Kind.EMAIL_INBOUND_PROVIDER,

package/dist/esm/core/commons.external-connectors-models.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"commons.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../../src/core/commons.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yCAAyC,EAAE,6CAA6C,EAAE,MAAM,+CAA+C,CAAC;AAGzJ;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,sCA6FX;AA7FD,WAAY,sCAAsC;IAChD,MAAM;IACN,+DAAqB,CAAA;IACrB,mFAAyC,CAAA;IACzC,SAAS;IAET,KAAK;IACL,uEAA6B,CAAA;IAC7B;;;;;;;;;;;;;;;OAeG;IACH,yFAA+C,CAAA;IAC/C,sDAAsD;IACtD,8EAA8E;IAC9E,2EAAiC,CAAA;IACjC;;;;;;;;;;OAUG;IACH,qFAA2C,CAAA;IAC3C;;;;;;;;;;;;;OAaG;IACH,uGAA6D,CAAA;IAC7D;;;;;;;OAOG;IACH,6FAAmD,CAAA;IACnD,iGAAiG;IACjG,2EAAiC,CAAA;IACjC,mFAAmF;IACnF,2EAAiC,CAAA;IAEjC,QAAQ;IACR,2EAAiC,CAAA;IACjC;;;;;;;OAOG;IACH,2FAAiD,CAAA;IAEjD,OAAO;IACP,mEAAyB,CAAA;IACzB,mBAAmB;IAEnB,UAAU;IACV,+EAAqC,CAAA;IAErC,iBAAiB;IACjB,uEAA6B,CAAA;IAE7B,WAAW;IACX,uEAA6B,CAAA;AAC/B,CAAC,EA7FW,sCAAsC,KAAtC,sCAAsC,QA6FjD;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC,MAAM,CAAC;IACvD,GAAG,EAAE,sCAAsC,CAAC,YAAY;IACxD,KAAK,EAAE,sCAAsC,CAAC,cAAc;IAC5D,UAAU,EAAE,sCAAsC,CAAC,mBAAmB;IACtE,mBAAmB,EAAE,sCAAsC,CAAC,4BAA4B;IACxF,cAAc,EAAE,sCAAsC,CAAC,uBAAuB;IAC9E,qBAAqB,EAAE,sCAAsC,CAAC,qBAAqB;IACnF,KAAK,EAAE,sCAAsC,CAAC,cAAc;IAC5D,aAAa,EAAE,sCAAsC,CAAC,sBAAsB;IAC5E,UAAU,EAAE,sCAAsC,CAAC,UAAU;IAC7D,OAAO,EAAE,sCAAsC,CAAC,gBAAgB;IAChE,kBAAkB,EAAE,sCAAsC,CAAC,kBAAkB;IAC7E,GAAG,EAAE,sCAAsC,CAAC,YAAY;IACxD,IAAI,EAAE,sCAAsC,CAAC,QAAQ;CAC7C,CAAC,CAAC;AAIZ,MAAM,CAAN,IAAY,uBAIX;AAJD,WAAY,uBAAuB;IACjC,sDAA2B,CAAA;IAC3B,8CAAmB,CAAA;IACnB,oDAAyB,CAAA;AAC3B,CAAC,EAJW,uBAAuB,KAAvB,uBAAuB,QAIlC;AAGD,MAAM,CAAN,IAAY,cAQX;AARD,WAAY,cAAc;IACxB,6BAAW,CAAA;IACX,+BAAa,CAAA;IACb,6BAAW,CAAA;IACX,iCAAe,CAAA;IACf,mCAAiB,CAAA;IACjB,+BAAa,CAAA;IACb,qCAAmB,CAAA;AACrB,CAAC,EARW,cAAc,KAAd,cAAc,QAQzB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,0DAA0D,GAAG,CAAC,CAAC,MAAM,CAAC;IACjF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,UAAU,EAAE,yCAAyC,CAAC,QAAQ,EAAE;IAChE,eAAe,EAAE,6CAA6C,CAAC,QAAQ,EAAE;CAC1E,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAN,IAAY,4CAGX;AAHD,WAAY,4CAA4C;IACtD,oFAAoC,CAAA;IACpC,uEAAuB,CAAA;AACzB,CAAC,EAHW,4CAA4C,KAA5C,4CAA4C,QAGvD;AAUD,MAAM,+BAA+B,GAA4D,MAAM,CAAC,MAAM,CAAC,4CAA4C,CAAC,CAAC;AAE7J;;;;;GAKG;AACH,MAAM,UAAU,wCAAwC,CAAC,sBAA+B;IACtF,MAAM,QAAQ,GAA0D,EAAE,CAAC;IAC3E,IAAI,CAAC,aAAa,CAAC,sBAAsB,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC5D,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC9E,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;YAAE,SAAS;QACxC,KAAK,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;gBAAE,SAAS;YAClC,KAAK,MAAM,GAAG,IAAI,+BAA+B,EAAE,CAAC;gBAClD,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC;oBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;YACvG,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,2CAA2C,CAAC,OAA4D;IACtH,OAAO,0BAA0B,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,wCAAwC;UAC9H,IAAI,OAAO,CAAC,GAAG,mHAAmH;UAClI,oIAAoI,CAAC;AAC3I,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0CAA0C,CAAC,sBAA+B,EAAE,GAAoB;IAC9G,KAAK,MAAM,OAAO,IAAI,wCAAwC,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACvF,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC;YAC7D,OAAO,EAAE,2CAA2C,CAAC,OAAO,CAAC;SAC9D,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAN,IAAY,oCAaX;AAbD,WAAY,oCAAoC;IAC9C,+GAA+G;IAC/G,2EAAmC,CAAA;IACnC;;;OAGG;IACH,uHAA+E,CAAA;IAC/E;;;OAGG;IACH,2HAAmF,CAAA;AACrF,CAAC,EAbW,oCAAoC,KAApC,oCAAoC,QAa/C;AAaD,MAAM,iCAAiC,GAAI,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAgE;KAC1J,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,sCAAsC,CAAC,MAAM,CAAC,KAAK,sCAAsC,CAAC,qBAAqB,CAAC,CAAC;AAErI;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CAAC,WAAmB;IACvE,OAAO,WAAW,KAAK,sCAAsC,CAAC,qBAAqB,IAAI,WAAW,KAAK,iCAAiC,CAAC;AAC3I,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,yBAAyB,CAAC,WAAmB,EAAE,GAA4B;IAClF,IAAI,CAAC,qCAAqC,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAAE,OAAO,EAAE,CAAC;IACvG,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAA8C,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjI,CAAC;AAED,gGAAgG;AAChG,MAAM,+CAA+C,GAEjD;IACF,CAAC,oCAAoC,CAAC,eAAe,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE,EAAE;QAC5E,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,UAAsC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3G,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,oCAAoC,CAAC,eAAe,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3I,CAAC;IACD,CAAC,oCAAoC,CAAC,qCAAqC,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE,CACjG,yBAAyB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACrI,KAAK,EAAE,oCAAoC,CAAC,qCAAqC;YACjF,IAAI,EAAE,qBAAqB,mBAAmB,mBAAmB;YACjE,mBAAmB;YACnB,KAAK,EAAE,OAAO,CAAC,gBAAgB;SAChC,CAAC,CAAC;IACL,CAAC,oCAAoC,CAAC,uCAAuC,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE,CACnG,yBAAyB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,6BAA6B,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAClJ,KAAK,EAAE,oCAAoC,CAAC,uCAAuC;YACnF,IAAI,EAAE,qBAAqB,mBAAmB,gCAAgC;YAC9E,mBAAmB;YACnB,KAAK,EAAE,OAAO,CAAC,6BAA6B;SAC7C,CAAC,CAAC;CACN,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,yCAAyC,CAAC,WAAmB,EAAE,GAAY;IACzF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC,oCAAoC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,+CAA+C,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;AAC1J,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,yHAAyH;AACzH,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED,MAAM,CAAN,IAAY,6BAIX;AAJD,WAAY,6BAA6B;IACvC,oDAAmB,CAAA;IACnB,sDAAqB,CAAA;IACrB,gEAA+B,CAAA;AACjC,CAAC,EAJW,6BAA6B,KAA7B,6BAA6B,QAIxC;AAED,MAAM,CAAN,IAAY,sCAIX;AAJD,WAAY,sCAAsC;IAChD,+EAAqC,CAAA;IACrC,qEAA2B,CAAA;IAC3B,8DAAoB,CAAA;AACtB,CAAC,EAJW,sCAAsC,KAAtC,sCAAsC,QAIjD;AAGD;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,qCAMX;AAND,WAAY,qCAAqC;IAC/C;;;OAGG;IACH,kFAAyC,CAAA;AAC3C,CAAC,EANW,qCAAqC,KAArC,qCAAqC,QAMhD","sourcesContent":["import { z } from \"zod\";\nimport { ExternalProvider_Auth_ConfigurationSchema, ExternalProvider_RateLimitConfigurationSchema } from \"./security.external-connectors-models.schemas\";\n\n\n/*\n The ONE protocol vocabulary a provider can speak. Every other list is derived from or pinned\n * to this enum: the backend runtime-contract discriminants (`ProviderProtocolRuntimeKind`, a\n * subset of these members) and the application-authoring keys (`BUILTIN_PROVIDER_PROTOCOL` in\n * `@wildo-ai/saas-models`, its key set pinned by a drift test because that package must not\n * import this one into browser bundles).\n \n RETIRED 2026-09-05 (#327): `MCP_CONNECTOR`, `A2A_CONNECTOR`, `GIT_PROVIDER`, `GRPC`,\n * `SSO_SAML`. Each had an authored profile/configuration module in this package and NOTHING\n * that read it — no runtime-contract arm, no provider module declaring it, no consumer of any\n * export outside the module itself (measured with a positive control). Wildo's own MCP server,\n * A2A plane and SAML SSO are engine-implemented surfaces, not provider-declared protocols, and\n * none of them referenced these members. A retired member is refused at CONFIG time by\n * `ProviderProtocolSelectorSchema`, naming the value. Re-admit one only together with a\n * runtime-contract arm and a provider module that declares it.\n /\nexport enum ExternalProvider_ExchangeProtocol_Kind {\n // WEB\n REST_API = \"rest_api\",\n WEBHOOK_ORIGINATOR = \"webhook_originator\",\n // SOAP ?\n \n // AI\n LLM_PROVIDER = \"llm_provider\",\n /\n Zed's Agent Client Protocol — a JSON-RPC session between Wildo (the client)\n * and a CODING AGENT subprocess that reads and writes a workspace, runs\n * commands, and calls back for permission.\n \n Its own protocol kind rather than a mode of `CLI_RUNTIME`, for the reason\n * `EMBEDDINGS_PROVIDER` records above and one more that is specific to it: a\n * coding agent is not a one-shot text call wearing a subprocess. Every\n * capability the previous CLI transport lacked — token and cost accounting, a\n * permission channel, cancellation, resumption, live progress — was missing\n * because the one-shot shape has nowhere to put it, not because nobody had\n * implemented it yet.\n \n NOT to be confused with the IBM/BeeAI \"Agent Communication Protocol\", which\n * shares the acronym and is agent-to-agent — that space is `A2A_CONNECTOR`.\n /\n AGENT_CLIENT_PROTOCOL = \"agent_client_protocol\",\n // AI — multimodal generation (artifact-modality axis)\n /* Text-to-image generation (wired: gpt-image). Serves the IMAGE modality. /\n IMAGE_PROVIDER = \"image_provider\",\n /\n Text → vector embeddings (wired: OpenAI `text-embedding-3-`). Serves the RAG derived-data\n tier (corpus embedding via the `rag:embedding-drain` worker; query-time embedding in\n * retrieval). Deliberately its OWN protocol kind rather than a sixth `LLMProvider_OperationKey`\n * (RAG plan DL2): an unmapped LLM operation key fails SILENTLY across six consumer surfaces\n * (registry semantic-operation map, output normalization, executor dispatch, capability slot,\n * usage completeness, observability sink), whereas a new protocol kind fails COMPILATION at\n * every `runtimeContract.kind` switch — the `IMAGE_PROVIDER` precedent. It also gets its own\n * `EngineCapability.AI_EMBEDDINGS` slot so an application can select its embeddings provider\n * independently of its chat provider.\n /\n EMBEDDINGS_PROVIDER = \"embeddings_provider\",\n /\n Document bytes → text (wired: Mistral `mistral-ocr-latest`). Serves the file-side text\n * provider that `FileTextExtractionBackendService` owns, whose largest consumer is\n * `.ragSource()` corpus ingestion.\n \n Its own kind for the reason `EMBEDDINGS_PROVIDER` records above, and it fills its own\n * `EngineCapability.AI_DOCUMENT_EXTRACTION` slot so an application selects its OCR provider\n * independently of chat and embeddings — three unrelated procurement decisions.\n \n NOT to be confused with PDF generation (templates → bytes), which is the `pdfTemplates`\n * surface and is semantically the opposite direction. It has no provider slot: the\n * `EngineCapability.DOCUMENT_GENERATION` this paragraph used to name was withdrawn because no\n * provider capability token could ever fill it.\n /\n DOCUMENT_EXTRACTION_PROVIDER = \"document_extraction_provider\",\n /\n Text → a classifier's verdict about it (#2292): first, whether third-party content entering an agent's prompt\n * carries a prompt-injection attack. Serves an agent's declared content guardrails.\n \n Its own kind for the reason `EMBEDDINGS_PROVIDER` records above, and it fills its own\n * `EngineCapability.AI_CONTENT_SAFETY` slot so an application chooses the vendor that screens its model's input\n * independently of the vendor that answers it.\n /\n CONTENT_SAFETY_PROVIDER = \"content_safety_provider\",\n /* Reserved — audio generation (TTS / music). Serves the AUDIO modality. Not yet implemented. /\n AUDIO_PROVIDER = \"audio_provider\",\n /* Reserved — video generation. Serves the VIDEO modality. Not yet implemented. /\n VIDEO_PROVIDER = \"video_provider\",\n \n // INFRA\n EMAIL_PROVIDER = \"email_provider\",\n /\n RECEIVING email (#1630): the provider hosts a receiving domain, announces each message through a\n * `WEBHOOK_ORIGINATOR` endpoint whose `capability` is `EMAIL_INBOUND`, and serves the message on\n * request through `StandardInboundEmail_Interface`. Its own kind rather than a mode of\n * `EMAIL_PROVIDER` because sending and receiving are separate procurement decisions and share no\n * operation: a sending contract composes a request, a receiving one parses a notification and\n * fetches a message.\n /\n EMAIL_INBOUND_PROVIDER = \"email_inbound_provider\",\n \n // AUTH\n SSO_OAUTH2 = \"sso_oauth2\",\n // OPENID_CONNECT ?\n\n // BILLING\n BILLING_PROVIDER = \"billing_provider\",\n\n // SMS (Phase G2)\n SMS_PROVIDER = \"sms_provider\",\n\n // FRONTEND\n FRONTEND_SDK = \"frontend_sdk\",\n}\n\n/\n The BACKEND runtime-contract discriminants — the subset of `ExternalProvider_ExchangeProtocol_Kind`\n * a `BackendProviderModule` can execute. Its VALUES are the enum members themselves (one spelling per\n * member since 2026-09-05, #327), so a runtime contract's `kind` IS the exchange kind and no\n * protocol→kind map exists anywhere; `BackendProtocolBinding.protocol` (the authoring KEY) and\n * `runtimeContract.kind` are checked for agreement at composition. A member absent here has no\n * backend arm: `FRONTEND_SDK` is declared by browser-side modules only, `AUDIO_PROVIDER` /\n * `VIDEO_PROVIDER` are reserved.\n \n A frozen const rather than a second enum because provider modules are an extension boundary and\n * the union discriminant must stay the enum member type. Import from\n * `@wildo-ai/external-connectors-models`; the private backend package consumes it, never defines it.\n /\nexport const ProviderProtocolRuntimeKind = Object.freeze({\n LLM: ExternalProvider_ExchangeProtocol_Kind.LLM_PROVIDER,\n IMAGE: ExternalProvider_ExchangeProtocol_Kind.IMAGE_PROVIDER,\n EMBEDDINGS: ExternalProvider_ExchangeProtocol_Kind.EMBEDDINGS_PROVIDER,\n DOCUMENT_EXTRACTION: ExternalProvider_ExchangeProtocol_Kind.DOCUMENT_EXTRACTION_PROVIDER,\n CONTENT_SAFETY: ExternalProvider_ExchangeProtocol_Kind.CONTENT_SAFETY_PROVIDER,\n AGENT_CLIENT_PROTOCOL: ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL,\n EMAIL: ExternalProvider_ExchangeProtocol_Kind.EMAIL_PROVIDER,\n EMAIL_INBOUND: ExternalProvider_ExchangeProtocol_Kind.EMAIL_INBOUND_PROVIDER,\n OAUTH2_SSO: ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2,\n BILLING: ExternalProvider_ExchangeProtocol_Kind.BILLING_PROVIDER,\n WEBHOOK_ORIGINATOR: ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR,\n SMS: ExternalProvider_ExchangeProtocol_Kind.SMS_PROVIDER,\n REST: ExternalProvider_ExchangeProtocol_Kind.REST_API,\n} as const);\nexport type ProviderProtocolRuntimeKind =\n (typeof ProviderProtocolRuntimeKind)[keyof typeof ProviderProtocolRuntimeKind];\n\nexport enum APPLICATION_ENVIRONMENT {\n DEVELOPMENT = \"development\",\n STAGING = \"staging\",\n PRODUCTION = \"production\",\n}\n\n\nexport enum API_HttpMethod {\n GET = \"GET\",\n POST = \"POST\",\n PUT = \"PUT\",\n PATCH = \"PATCH\",\n DELETE = \"DELETE\",\n HEAD = \"HEAD\",\n OPTIONS = \"OPTIONS\",\n}\n\n/\n Shared protocol configuration fields — the ONE survivor of the per-protocol profile /\n * configuration / status triple (#965), and the reason it stays is a reader, not a legacy.\n \n `authConfig` is read on a resolved provider configuration by the OAuth2 connection resolver\n * (`clientId`, `secretRef`) and by the registry's default-over-custom merge, and `enabled` is what\n * a provider configuration parses at the boundary (`AgentClientProtocol_ConfigurationSchema`,\n * `OAuth2Provider_ConfigurationSchema` extend this; the LLM and webhook configurations intersect\n * with the inferred type). It is optional because execution-oriented protocols can own their own\n * auth/runtime policy contract.\n \n What is gone: the profile base (a provider's transport facts now live on its runtime contract,\n * `ProviderProtocolRuntimeContract`, which the registry projects) and the status base (nothing\n * ever recorded a per-protocol status). Both had no reader outside the declarations that extended\n * them.\n /\nexport const ExternalProvider_ExchangeProtocol_Configuration_BaseSchema = z.object({\n enabled: z.boolean(),\n authConfig: ExternalProvider_Auth_ConfigurationSchema.optional(),\n rateLimitConfig: ExternalProvider_RateLimitConfigurationSchema.optional(),\n});\n\nexport type ExternalProvider_ExchangeProtocol_Configuration_Base = z.infer<typeof ExternalProvider_ExchangeProtocol_Configuration_BaseSchema>;\n\n/\n The keys of a `providerConfigurations.<providerRef>.<protocol>` bag that belong to the PROVIDER MODULE, never to the\n * application (#2995). Each is projected by the backend registry from the module's own runtime contract, and each\n * decides where a request goes and how its credential travels:\n \n - `runtimeContract` — the contract itself: the base URL or host slot, the API-key header, the operations.\n * - `endpoints` — the webhook endpoints a `WEBHOOK_ORIGINATOR` contract declares (route keys, signature handling).\n \n An application cannot author either. The registry used to deep-merge an authored `runtimeContract` over the module's,\n * so one configuration line (`runtimeContract: { baseUrl: 'http://anywhere' }`) sent the provider's key to any URL, over\n * plain http, in any environment, around the host-held slot and its bare-DNS rule (#992 F3). The comments said the module\n * owned the contract; nothing held it. Now three schemas refuse these keys when the configuration is parsed\n * (`defineSaaSConfig`, the per-environment overlay, the backend's application configuration), and the registry refuses\n * them again before it merges, so a configuration hydrated from anywhere else is refused too.\n \n The way to point a provider at a local double is the environment-gated loopback host of a host-held slot (#2991),\n * which a deployment outside development and test refuses.\n \n Import path: `@wildo-ai/external-connectors-models`.\n /\nexport enum ExternalProvider_ModuleOwnedConfigurationKey {\n RUNTIME_CONTRACT = \"runtimeContract\",\n ENDPOINTS = \"endpoints\",\n}\n\n/* One authored key a provider module owns: where it was written, so the refusal can name it. /\nexport interface ExternalProvider_ModuleOwnedConfigurationKeyFinding {\n readonly providerRef: string;\n /* The second-level key of the bag: a protocol kind, or a key the module reads itself (`registration`). /\n readonly protocolKey: string;\n readonly key: ExternalProvider_ModuleOwnedConfigurationKey;\n}\n\nconst MODULE_OWNED_CONFIGURATION_KEYS: readonly ExternalProvider_ModuleOwnedConfigurationKey[] = Object.values(ExternalProvider_ModuleOwnedConfigurationKey);\n\n/\n Every module-owned key written anywhere in a `providerConfigurations` value. Total over the\n * {@link ExternalProvider_ModuleOwnedConfigurationKey} vocabulary, and over every bag, a protocol bag or not: no bag can\n * legitimately carry these names, and a bag the registry does not merge today is one a later reader might.\n * Anything that is not a record of records (a malformed value) yields nothing here; the schema reports that itself.\n /\nexport function findModuleOwnedProviderConfigurationKeys(providerConfigurations: unknown): ExternalProvider_ModuleOwnedConfigurationKeyFinding[] {\n const findings: ExternalProvider_ModuleOwnedConfigurationKeyFinding[] = [];\n if (!isPlainRecord(providerConfigurations)) return findings;\n for (const [providerRef, protocols] of Object.entries(providerConfigurations)) {\n if (!isPlainRecord(protocols)) continue;\n for (const [protocolKey, bag] of Object.entries(protocols)) {\n if (!isPlainRecord(bag)) continue;\n for (const key of MODULE_OWNED_CONFIGURATION_KEYS) {\n if (Object.prototype.hasOwnProperty.call(bag, key)) findings.push({ providerRef, protocolKey, key });\n }\n }\n }\n return findings;\n}\n\n/* The one sentence every door refuses a module-owned key with, so an operator greps one wording. /\nexport function describeModuleOwnedProviderConfigurationKey(finding: ExternalProvider_ModuleOwnedConfigurationKeyFinding): string {\n return `providerConfigurations.${finding.providerRef}.${finding.protocolKey}.${finding.key} is refused: the provider module owns `\n + `'${finding.key}' (where its requests go and how its credential travels), and a configuration cannot rewrite it. Remove the key. `\n + 'To reach a local double of the vendor, set the provider\\'s host slot to a loopback host:port in a development or test environment.';\n}\n\n/\n Report every module-owned key as an issue on `ctx`, at its path. The refinement each `providerConfigurations` schema\n * applies, so the three refuse the same keys with the same words.\n \n assurance-control: WILDO.SECRETS.CREDENTIAL_SCOPING — a configuration cannot author where a provider's credential is sent (#2995).\n /\nexport function refuseModuleOwnedProviderConfigurationKeys(providerConfigurations: unknown, ctx: z.RefinementCtx): void {\n for (const finding of findModuleOwnedProviderConfigurationKeys(providerConfigurations)) {\n ctx.addIssue({\n code: \"custom\",\n path: [finding.providerRef, finding.protocolKey, finding.key],\n message: describeModuleOwnedProviderConfigurationKey(finding),\n });\n }\n}\n\n/\n The fields of a `providerConfigurations.<providerRef>.<protocol>` bag that NAME a credential (#3022). Each decides\n * which secret a vendor or a coding agent receives, so each is held to a rule that leaves that choice to the provider\n * module and the framework rather than to the configuration:\n \n \| field \| the rule \| closed by \|\n * \|---\|---\|---\|\n * \| `authConfig.secretRef` \| names only a slot the module's `secretsContract` declares, by its variable or its slug \| #3002 \|\n * \| an execution profile's `secretEnvVarName` \| names only a variable the module declares (never a slug: it is the variable the agent reads) \| #3002 \|\n * \| an execution profile's `inheritedEnvironmentVariables` \| names anything EXCEPT a secret the framework declares \| #3018 \|\n \n The vocabulary is the one named source for the doors that check these fields: the backend registry, on every read and\n * in its startup walk, and the CLI's environment door. Each reads the fields through\n * {@link readProviderConfigurationCredentialFields} and branches on the member, so a field added here gets a reader (a\n * compile error until it does) and then reaches every door's exhaustive switch, where it is a compile error again until\n * the door decides its rule. Before this vocabulary the three fields were string paths written out at each door.\n \n Where the credential then GOES is the other half of the property, and it is not a configuration field at all: the\n * module owns its destination ({@link ExternalProvider_ModuleOwnedConfigurationKey}, #2995).\n \n Import path: `@wildo-ai/external-connectors-models`.\n /\nexport enum ProviderConfigurationCredentialField {\n /* `authConfig.secretRef`: the slot a protocol's key or client secret is read from, and sent to the vendor. /\n AUTH_SECRET_REF = \"auth_secret_ref\",\n /\n `executionProfiles.<profile>.secretEnvVarName`, on the agent-client-protocol bag only: the one variable read from the\n * spawning process and set in the coding agent's environment.\n /\n EXECUTION_PROFILE_SECRET_ENV_VAR_NAME = \"execution_profile_secret_env_var_name\",\n /\n `executionProfiles.<profile>.inheritedEnvironmentVariables`, on the agent-client-protocol bag only: the host's own\n * variables (the agent's login, its tool paths) copied into the coding agent's environment.\n /\n EXECUTION_PROFILE_INHERITED_ENVIRONMENT = \"execution_profile_inherited_environment\",\n}\n\n/* One credential-naming field as authored, unchecked: the door that reads it decides whether it is admitted. /\nexport interface ProviderConfigurationCredentialFieldReading {\n readonly field: ProviderConfigurationCredentialField;\n /* Where it sits inside the protocol bag (`authConfig.secretRef`, `executionProfiles.mine.secretEnvVarName`), for a refusal to name. /\n readonly path: string;\n /* The execution profile it was read from, for the two profile fields. /\n readonly executionProfileRef?: string;\n /* The authored value. Never `undefined`: a field that is not written yields no reading. /\n readonly value: unknown;\n}\n\nconst AGENT_CLIENT_PROTOCOL_MEMBER_NAME = (Object.keys(ExternalProvider_ExchangeProtocol_Kind) as Array<keyof typeof ExternalProvider_ExchangeProtocol_Kind>)\n .find((member) => ExternalProvider_ExchangeProtocol_Kind[member] === ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL);\n\n/\n Whether a protocol key of a `providerConfigurations.<providerRef>` value holds the agent-client-protocol bag: the\n * protocol's wire value, or its member name. The backend reads the configuration under the wire value only, but a\n * credential-naming field is checked under either key, so a bag authored under the member name is refused by every door\n * rather than by the CLI alone.\n /\nexport function isAgentClientProtocolConfigurationKey(protocolKey: string): boolean {\n return protocolKey === ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL \|\| protocolKey === AGENT_CLIENT_PROTOCOL_MEMBER_NAME;\n}\n\n/\n The authored execution profiles of an agent-client-protocol bag; nothing for any other bag.\n \n Read from ANY object, an array included, and each profile that is any object, never only from plain records: the doors\n * iterated `Object.entries` before this vocabulary, and the registry's merge turns an array into `{ '0': profile }`, which\n * an agent or a default profile can select. Reading plain records only would leave such a profile's `secretEnvVarName`\n * unchecked while dispatch still injects it (#3022 review F1). What is not an object carries no field to read.\n /\nfunction authoredExecutionProfiles(protocolKey: string, bag: Record<string, unknown>): Array<[string, Record<string, unknown>]> {\n if (!isAgentClientProtocolConfigurationKey(protocolKey) \|\| !isObject(bag.executionProfiles)) return [];\n return Object.entries(bag.executionProfiles).filter((entry): entry is [string, Record<string, unknown>] => isObject(entry[1]));\n}\n\n/* One reader per field, so a member added to the vocabulary without one is a compile error. /\nconst PROVIDER_CONFIGURATION_CREDENTIAL_FIELD_READERS: {\n readonly [Field in ProviderConfigurationCredentialField]: (protocolKey: string, bag: Record<string, unknown>) => ProviderConfigurationCredentialFieldReading[];\n} = {\n [ProviderConfigurationCredentialField.AUTH_SECRET_REF]: (_protocolKey, bag) => {\n const value = isObject(bag.authConfig) ? (bag.authConfig as Record<string, unknown>).secretRef : undefined;\n return value === undefined ? [] : [{ field: ProviderConfigurationCredentialField.AUTH_SECRET_REF, path: \"authConfig.secretRef\", value }];\n },\n [ProviderConfigurationCredentialField.EXECUTION_PROFILE_SECRET_ENV_VAR_NAME]: (protocolKey, bag) =>\n authoredExecutionProfiles(protocolKey, bag).flatMap(([executionProfileRef, profile]) => profile.secretEnvVarName === undefined ? [] : [{\n field: ProviderConfigurationCredentialField.EXECUTION_PROFILE_SECRET_ENV_VAR_NAME,\n path: `executionProfiles.${executionProfileRef}.secretEnvVarName`,\n executionProfileRef,\n value: profile.secretEnvVarName,\n }]),\n [ProviderConfigurationCredentialField.EXECUTION_PROFILE_INHERITED_ENVIRONMENT]: (protocolKey, bag) =>\n authoredExecutionProfiles(protocolKey, bag).flatMap(([executionProfileRef, profile]) => profile.inheritedEnvironmentVariables === undefined ? [] : [{\n field: ProviderConfigurationCredentialField.EXECUTION_PROFILE_INHERITED_ENVIRONMENT,\n path: `executionProfiles.${executionProfileRef}.inheritedEnvironmentVariables`,\n executionProfileRef,\n value: profile.inheritedEnvironmentVariables,\n }]),\n};\n\n/\n Every credential-naming field written in one protocol bag of a provider configuration, in vocabulary order. Total over\n * {@link ProviderConfigurationCredentialField}. A bag that is not a record yields nothing; its schema reports that itself.\n /\nexport function readProviderConfigurationCredentialFields(protocolKey: string, bag: unknown): ProviderConfigurationCredentialFieldReading[] {\n if (!isPlainRecord(bag)) return [];\n return Object.values(ProviderConfigurationCredentialField).flatMap((field) => PROVIDER_CONFIGURATION_CREDENTIAL_FIELD_READERS[field](protocolKey, bag));\n}\n\nfunction isPlainRecord(value: unknown): value is Record<string, unknown> {\n return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/* Any object, an array included: the shape a credential-naming field is read from, so no authored object escapes it. /\nfunction isObject(value: unknown): value is Record<string, unknown> {\n return typeof value === \"object\" && value !== null;\n}\n\nexport enum ExternalProvider_IO_Direction {\n INBOUND = \"inbound\",\n OUTBOUND = \"outbound\",\n BIDIRECTIONAL = \"bidirectional\",\n}\n\nexport enum ExternalProvider_IO_InteractionPattern {\n REQUEST_RESPONSE = \"request_response\",\n EVENT_BASED = \"event_based\",\n STREAMING = \"stream\",\n}\n\n\n/\n An address a vendor registration asks a person to TYPE at the vendor, as opposed to one the registration file already\n * carries (#2713). A provider module's `vendorRegistration` names each one it needs beside its steps, so a screen can\n * show it as a value to copy, labelled from its own words, rather than leave it inside a sentence.\n \n Add a member when a provider's registration names another such address. A Slack app's request URLs are not one: the\n * manifest file carries them, and nobody types them.\n /\nexport enum ProviderVendorRegistrationAddressKind {\n /\n Where the vendor delivers a bot's messages: the Azure Bot's \"Messaging endpoint\", the route the engine mounts for the\n * provider's inbound endpoint. Every bot of one application, its own or an organization's, is registered with the same one.\n */\n MESSAGING_ENDPOINT = \"messaging_endpoint\",\n}\n"]}
1	+ {"version":3,"file":"commons.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../src/core/commons.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yCAAyC,EAAE,6CAA6C,EAAE,MAAM,+CAA+C,CAAC;AAGzJ;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,sCAsGX;AAtGD,WAAY,sCAAsC;IAChD,MAAM;IACN,+DAAqB,CAAA;IACrB,mFAAyC,CAAA;IACzC,SAAS;IAET,KAAK;IACL,uEAA6B,CAAA;IAC7B;;;;;;;;;;;;;;;OAeG;IACH,yFAA+C,CAAA;IAC/C,sDAAsD;IACtD,8EAA8E;IAC9E,2EAAiC,CAAA;IACjC;;;;;;;;;;OAUG;IACH,qFAA2C,CAAA;IAC3C;;;;;;;;;;;;;OAaG;IACH,uGAA6D,CAAA;IAC7D;;;;;;;OAOG;IACH,6FAAmD,CAAA;IACnD;;;;;;;OAOG;IACH,yGAA+D,CAAA;IAC/D,iGAAiG;IACjG,2EAAiC,CAAA;IACjC,mFAAmF;IACnF,2EAAiC,CAAA;IAEjC,QAAQ;IACR,2EAAiC,CAAA;IACjC;;;;;;;OAOG;IACH,2FAAiD,CAAA;IAEjD,OAAO;IACP,mEAAyB,CAAA;IACzB,mBAAmB;IAEnB,UAAU;IACV,+EAAqC,CAAA;IAErC,iBAAiB;IACjB,uEAA6B,CAAA;IAE7B,WAAW;IACX,uEAA6B,CAAA;AAC/B,CAAC,EAtGW,sCAAsC,KAAtC,sCAAsC,QAsGjD;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC,MAAM,CAAC;IACvD,GAAG,EAAE,sCAAsC,CAAC,YAAY;IACxD,KAAK,EAAE,sCAAsC,CAAC,cAAc;IAC5D,UAAU,EAAE,sCAAsC,CAAC,mBAAmB;IACtE,mBAAmB,EAAE,sCAAsC,CAAC,4BAA4B;IACxF,cAAc,EAAE,sCAAsC,CAAC,uBAAuB;IAC9E,oBAAoB,EAAE,sCAAsC,CAAC,6BAA6B;IAC1F,qBAAqB,EAAE,sCAAsC,CAAC,qBAAqB;IACnF,KAAK,EAAE,sCAAsC,CAAC,cAAc;IAC5D,aAAa,EAAE,sCAAsC,CAAC,sBAAsB;IAC5E,UAAU,EAAE,sCAAsC,CAAC,UAAU;IAC7D,OAAO,EAAE,sCAAsC,CAAC,gBAAgB;IAChE,kBAAkB,EAAE,sCAAsC,CAAC,kBAAkB;IAC7E,GAAG,EAAE,sCAAsC,CAAC,YAAY;IACxD,IAAI,EAAE,sCAAsC,CAAC,QAAQ;CAC7C,CAAC,CAAC;AAIZ,MAAM,CAAN,IAAY,uBAIX;AAJD,WAAY,uBAAuB;IACjC,sDAA2B,CAAA;IAC3B,8CAAmB,CAAA;IACnB,oDAAyB,CAAA;AAC3B,CAAC,EAJW,uBAAuB,KAAvB,uBAAuB,QAIlC;AAGD,MAAM,CAAN,IAAY,cAQX;AARD,WAAY,cAAc;IACxB,6BAAW,CAAA;IACX,+BAAa,CAAA;IACb,6BAAW,CAAA;IACX,iCAAe,CAAA;IACf,mCAAiB,CAAA;IACjB,+BAAa,CAAA;IACb,qCAAmB,CAAA;AACrB,CAAC,EARW,cAAc,KAAd,cAAc,QAQzB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,0DAA0D,GAAG,CAAC,CAAC,MAAM,CAAC;IACjF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,UAAU,EAAE,yCAAyC,CAAC,QAAQ,EAAE;IAChE,eAAe,EAAE,6CAA6C,CAAC,QAAQ,EAAE;CAC1E,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAN,IAAY,4CAGX;AAHD,WAAY,4CAA4C;IACtD,oFAAoC,CAAA;IACpC,uEAAuB,CAAA;AACzB,CAAC,EAHW,4CAA4C,KAA5C,4CAA4C,QAGvD;AAUD,MAAM,+BAA+B,GAA4D,MAAM,CAAC,MAAM,CAAC,4CAA4C,CAAC,CAAC;AAE7J;;;;;GAKG;AACH,MAAM,UAAU,wCAAwC,CAAC,sBAA+B;IACtF,MAAM,QAAQ,GAA0D,EAAE,CAAC;IAC3E,IAAI,CAAC,aAAa,CAAC,sBAAsB,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC5D,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC9E,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;YAAE,SAAS;QACxC,KAAK,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;gBAAE,SAAS;YAClC,KAAK,MAAM,GAAG,IAAI,+BAA+B,EAAE,CAAC;gBAClD,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC;oBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;YACvG,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,2CAA2C,CAAC,OAA4D;IACtH,OAAO,0BAA0B,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,wCAAwC;UAC9H,IAAI,OAAO,CAAC,GAAG,mHAAmH;UAClI,oIAAoI,CAAC;AAC3I,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0CAA0C,CAAC,sBAA+B,EAAE,GAAoB;IAC9G,KAAK,MAAM,OAAO,IAAI,wCAAwC,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACvF,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC;YAC7D,OAAO,EAAE,2CAA2C,CAAC,OAAO,CAAC;SAC9D,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAN,IAAY,oCAaX;AAbD,WAAY,oCAAoC;IAC9C,+GAA+G;IAC/G,2EAAmC,CAAA;IACnC;;;OAGG;IACH,uHAA+E,CAAA;IAC/E;;;OAGG;IACH,2HAAmF,CAAA;AACrF,CAAC,EAbW,oCAAoC,KAApC,oCAAoC,QAa/C;AAaD,MAAM,iCAAiC,GAAI,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAgE;KAC1J,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,sCAAsC,CAAC,MAAM,CAAC,KAAK,sCAAsC,CAAC,qBAAqB,CAAC,CAAC;AAErI;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CAAC,WAAmB;IACvE,OAAO,WAAW,KAAK,sCAAsC,CAAC,qBAAqB,IAAI,WAAW,KAAK,iCAAiC,CAAC;AAC3I,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,yBAAyB,CAAC,WAAmB,EAAE,GAA4B;IAClF,IAAI,CAAC,qCAAqC,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAAE,OAAO,EAAE,CAAC;IACvG,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAA8C,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjI,CAAC;AAED,gGAAgG;AAChG,MAAM,+CAA+C,GAEjD;IACF,CAAC,oCAAoC,CAAC,eAAe,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE,EAAE;QAC5E,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,UAAsC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3G,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,oCAAoC,CAAC,eAAe,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3I,CAAC;IACD,CAAC,oCAAoC,CAAC,qCAAqC,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE,CACjG,yBAAyB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACrI,KAAK,EAAE,oCAAoC,CAAC,qCAAqC;YACjF,IAAI,EAAE,qBAAqB,mBAAmB,mBAAmB;YACjE,mBAAmB;YACnB,KAAK,EAAE,OAAO,CAAC,gBAAgB;SAChC,CAAC,CAAC;IACL,CAAC,oCAAoC,CAAC,uCAAuC,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE,CACnG,yBAAyB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,6BAA6B,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAClJ,KAAK,EAAE,oCAAoC,CAAC,uCAAuC;YACnF,IAAI,EAAE,qBAAqB,mBAAmB,gCAAgC;YAC9E,mBAAmB;YACnB,KAAK,EAAE,OAAO,CAAC,6BAA6B;SAC7C,CAAC,CAAC;CACN,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,yCAAyC,CAAC,WAAmB,EAAE,GAAY;IACzF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC,oCAAoC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,+CAA+C,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;AAC1J,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,yHAAyH;AACzH,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED,MAAM,CAAN,IAAY,6BAIX;AAJD,WAAY,6BAA6B;IACvC,oDAAmB,CAAA;IACnB,sDAAqB,CAAA;IACrB,gEAA+B,CAAA;AACjC,CAAC,EAJW,6BAA6B,KAA7B,6BAA6B,QAIxC;AAED,MAAM,CAAN,IAAY,sCAIX;AAJD,WAAY,sCAAsC;IAChD,+EAAqC,CAAA;IACrC,qEAA2B,CAAA;IAC3B,8DAAoB,CAAA;AACtB,CAAC,EAJW,sCAAsC,KAAtC,sCAAsC,QAIjD;AAGD;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,qCAMX;AAND,WAAY,qCAAqC;IAC/C;;;OAGG;IACH,kFAAyC,CAAA;AAC3C,CAAC,EANW,qCAAqC,KAArC,qCAAqC,QAMhD","sourcesContent":["import { z } from \"zod\";\nimport { ExternalProvider_Auth_ConfigurationSchema, ExternalProvider_RateLimitConfigurationSchema } from \"./security.external-connectors-models.schemas\";\n\n\n/*\n The ONE protocol vocabulary a provider can speak. Every other list is derived from or pinned\n * to this enum: the backend runtime-contract discriminants (`ProviderProtocolRuntimeKind`, a\n * subset of these members) and the application-authoring keys (`BUILTIN_PROVIDER_PROTOCOL` in\n * `@wildo-ai/saas-models`, its key set pinned by a drift test because that package must not\n * import this one into browser bundles).\n \n RETIRED 2026-09-05 (#327): `MCP_CONNECTOR`, `A2A_CONNECTOR`, `GIT_PROVIDER`, `GRPC`,\n * `SSO_SAML`. Each had an authored profile/configuration module in this package and NOTHING\n * that read it — no runtime-contract arm, no provider module declaring it, no consumer of any\n * export outside the module itself (measured with a positive control). Wildo's own MCP server,\n * A2A plane and SAML SSO are engine-implemented surfaces, not provider-declared protocols, and\n * none of them referenced these members. A retired member is refused at CONFIG time by\n * `ProviderProtocolSelectorSchema`, naming the value. Re-admit one only together with a\n * runtime-contract arm and a provider module that declares it.\n /\nexport enum ExternalProvider_ExchangeProtocol_Kind {\n // WEB\n REST_API = \"rest_api\",\n WEBHOOK_ORIGINATOR = \"webhook_originator\",\n // SOAP ?\n \n // AI\n LLM_PROVIDER = \"llm_provider\",\n /\n Zed's Agent Client Protocol — a JSON-RPC session between Wildo (the client)\n * and a CODING AGENT subprocess that reads and writes a workspace, runs\n * commands, and calls back for permission.\n \n Its own protocol kind rather than a mode of `CLI_RUNTIME`, for the reason\n * `EMBEDDINGS_PROVIDER` records above and one more that is specific to it: a\n * coding agent is not a one-shot text call wearing a subprocess. Every\n * capability the previous CLI transport lacked — token and cost accounting, a\n * permission channel, cancellation, resumption, live progress — was missing\n * because the one-shot shape has nowhere to put it, not because nobody had\n * implemented it yet.\n \n NOT to be confused with the IBM/BeeAI \"Agent Communication Protocol\", which\n * shares the acronym and is agent-to-agent — that space is `A2A_CONNECTOR`.\n /\n AGENT_CLIENT_PROTOCOL = \"agent_client_protocol\",\n // AI — multimodal generation (artifact-modality axis)\n /* Text-to-image generation (wired: gpt-image). Serves the IMAGE modality. /\n IMAGE_PROVIDER = \"image_provider\",\n /\n Text → vector embeddings (wired: OpenAI `text-embedding-3-`). Serves the RAG derived-data\n tier (corpus embedding via the `rag:embedding-drain` worker; query-time embedding in\n * retrieval). Deliberately its OWN protocol kind rather than a sixth `LLMProvider_OperationKey`\n * (RAG plan DL2): an unmapped LLM operation key fails SILENTLY across six consumer surfaces\n * (registry semantic-operation map, output normalization, executor dispatch, capability slot,\n * usage completeness, observability sink), whereas a new protocol kind fails COMPILATION at\n * every `runtimeContract.kind` switch — the `IMAGE_PROVIDER` precedent. It also gets its own\n * `EngineCapability.AI_EMBEDDINGS` slot so an application can select its embeddings provider\n * independently of its chat provider.\n /\n EMBEDDINGS_PROVIDER = \"embeddings_provider\",\n /\n Document bytes → text (wired: Mistral `mistral-ocr-latest`). Serves the file-side text\n * provider that `FileTextExtractionBackendService` owns, whose largest consumer is\n * `.ragSource()` corpus ingestion.\n \n Its own kind for the reason `EMBEDDINGS_PROVIDER` records above, and it fills its own\n * `EngineCapability.AI_DOCUMENT_EXTRACTION` slot so an application selects its OCR provider\n * independently of chat and embeddings — three unrelated procurement decisions.\n \n NOT to be confused with PDF generation (templates → bytes), which is the `pdfTemplates`\n * surface and is semantically the opposite direction. It has no provider slot: the\n * `EngineCapability.DOCUMENT_GENERATION` this paragraph used to name was withdrawn because no\n * provider capability token could ever fill it.\n /\n DOCUMENT_EXTRACTION_PROVIDER = \"document_extraction_provider\",\n /\n Text → a classifier's verdict about it (#2292): first, whether third-party content entering an agent's prompt\n * carries a prompt-injection attack. Serves an agent's declared content guardrails.\n \n Its own kind for the reason `EMBEDDINGS_PROVIDER` records above, and it fills its own\n * `EngineCapability.AI_CONTENT_SAFETY` slot so an application chooses the vendor that screens its model's input\n * independently of the vendor that answers it.\n /\n CONTENT_SAFETY_PROVIDER = \"content_safety_provider\",\n /\n A deliverable → its signers' own electronic signatures, applied by a trust-service vendor (#2293). The provider\n * declares pure functions over a conversation of requests; the engine owns transport, keys and deadlines, and never\n * trusts the vendor's word that a request is signed.\n \n Its own kind and its own `EngineCapability.ELECTRONIC_SIGNATURE` slot: which vendor signs a client's engagement\n * letter is a legal and procurement decision unrelated to every other provider's.\n /\n ELECTRONIC_SIGNATURE_PROVIDER = \"electronic_signature_provider\",\n /* Reserved — audio generation (TTS / music). Serves the AUDIO modality. Not yet implemented. /\n AUDIO_PROVIDER = \"audio_provider\",\n /* Reserved — video generation. Serves the VIDEO modality. Not yet implemented. /\n VIDEO_PROVIDER = \"video_provider\",\n \n // INFRA\n EMAIL_PROVIDER = \"email_provider\",\n /\n RECEIVING email (#1630): the provider hosts a receiving domain, announces each message through a\n * `WEBHOOK_ORIGINATOR` endpoint whose `capability` is `EMAIL_INBOUND`, and serves the message on\n * request through `StandardInboundEmail_Interface`. Its own kind rather than a mode of\n * `EMAIL_PROVIDER` because sending and receiving are separate procurement decisions and share no\n * operation: a sending contract composes a request, a receiving one parses a notification and\n * fetches a message.\n /\n EMAIL_INBOUND_PROVIDER = \"email_inbound_provider\",\n \n // AUTH\n SSO_OAUTH2 = \"sso_oauth2\",\n // OPENID_CONNECT ?\n\n // BILLING\n BILLING_PROVIDER = \"billing_provider\",\n\n // SMS (Phase G2)\n SMS_PROVIDER = \"sms_provider\",\n\n // FRONTEND\n FRONTEND_SDK = \"frontend_sdk\",\n}\n\n/\n The BACKEND runtime-contract discriminants — the subset of `ExternalProvider_ExchangeProtocol_Kind`\n * a `BackendProviderModule` can execute. Its VALUES are the enum members themselves (one spelling per\n * member since 2026-09-05, #327), so a runtime contract's `kind` IS the exchange kind and no\n * protocol→kind map exists anywhere; `BackendProtocolBinding.protocol` (the authoring KEY) and\n * `runtimeContract.kind` are checked for agreement at composition. A member absent here has no\n * backend arm: `FRONTEND_SDK` is declared by browser-side modules only, `AUDIO_PROVIDER` /\n * `VIDEO_PROVIDER` are reserved.\n \n A frozen const rather than a second enum because provider modules are an extension boundary and\n * the union discriminant must stay the enum member type. Import from\n * `@wildo-ai/external-connectors-models`; the private backend package consumes it, never defines it.\n /\nexport const ProviderProtocolRuntimeKind = Object.freeze({\n LLM: ExternalProvider_ExchangeProtocol_Kind.LLM_PROVIDER,\n IMAGE: ExternalProvider_ExchangeProtocol_Kind.IMAGE_PROVIDER,\n EMBEDDINGS: ExternalProvider_ExchangeProtocol_Kind.EMBEDDINGS_PROVIDER,\n DOCUMENT_EXTRACTION: ExternalProvider_ExchangeProtocol_Kind.DOCUMENT_EXTRACTION_PROVIDER,\n CONTENT_SAFETY: ExternalProvider_ExchangeProtocol_Kind.CONTENT_SAFETY_PROVIDER,\n ELECTRONIC_SIGNATURE: ExternalProvider_ExchangeProtocol_Kind.ELECTRONIC_SIGNATURE_PROVIDER,\n AGENT_CLIENT_PROTOCOL: ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL,\n EMAIL: ExternalProvider_ExchangeProtocol_Kind.EMAIL_PROVIDER,\n EMAIL_INBOUND: ExternalProvider_ExchangeProtocol_Kind.EMAIL_INBOUND_PROVIDER,\n OAUTH2_SSO: ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2,\n BILLING: ExternalProvider_ExchangeProtocol_Kind.BILLING_PROVIDER,\n WEBHOOK_ORIGINATOR: ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR,\n SMS: ExternalProvider_ExchangeProtocol_Kind.SMS_PROVIDER,\n REST: ExternalProvider_ExchangeProtocol_Kind.REST_API,\n} as const);\nexport type ProviderProtocolRuntimeKind =\n (typeof ProviderProtocolRuntimeKind)[keyof typeof ProviderProtocolRuntimeKind];\n\nexport enum APPLICATION_ENVIRONMENT {\n DEVELOPMENT = \"development\",\n STAGING = \"staging\",\n PRODUCTION = \"production\",\n}\n\n\nexport enum API_HttpMethod {\n GET = \"GET\",\n POST = \"POST\",\n PUT = \"PUT\",\n PATCH = \"PATCH\",\n DELETE = \"DELETE\",\n HEAD = \"HEAD\",\n OPTIONS = \"OPTIONS\",\n}\n\n/\n Shared protocol configuration fields — the ONE survivor of the per-protocol profile /\n * configuration / status triple (#965), and the reason it stays is a reader, not a legacy.\n \n `authConfig` is read on a resolved provider configuration by the OAuth2 connection resolver\n * (`clientId`, `secretRef`) and by the registry's default-over-custom merge, and `enabled` is what\n * a provider configuration parses at the boundary (`AgentClientProtocol_ConfigurationSchema`,\n * `OAuth2Provider_ConfigurationSchema` extend this; the LLM and webhook configurations intersect\n * with the inferred type). It is optional because execution-oriented protocols can own their own\n * auth/runtime policy contract.\n \n What is gone: the profile base (a provider's transport facts now live on its runtime contract,\n * `ProviderProtocolRuntimeContract`, which the registry projects) and the status base (nothing\n * ever recorded a per-protocol status). Both had no reader outside the declarations that extended\n * them.\n /\nexport const ExternalProvider_ExchangeProtocol_Configuration_BaseSchema = z.object({\n enabled: z.boolean(),\n authConfig: ExternalProvider_Auth_ConfigurationSchema.optional(),\n rateLimitConfig: ExternalProvider_RateLimitConfigurationSchema.optional(),\n});\n\nexport type ExternalProvider_ExchangeProtocol_Configuration_Base = z.infer<typeof ExternalProvider_ExchangeProtocol_Configuration_BaseSchema>;\n\n/\n The keys of a `providerConfigurations.<providerRef>.<protocol>` bag that belong to the PROVIDER MODULE, never to the\n * application (#2995). Each is projected by the backend registry from the module's own runtime contract, and each\n * decides where a request goes and how its credential travels:\n \n - `runtimeContract` — the contract itself: the base URL or host slot, the API-key header, the operations.\n * - `endpoints` — the webhook endpoints a `WEBHOOK_ORIGINATOR` contract declares (route keys, signature handling).\n \n An application cannot author either. The registry used to deep-merge an authored `runtimeContract` over the module's,\n * so one configuration line (`runtimeContract: { baseUrl: 'http://anywhere' }`) sent the provider's key to any URL, over\n * plain http, in any environment, around the host-held slot and its bare-DNS rule (#992 F3). The comments said the module\n * owned the contract; nothing held it. Now three schemas refuse these keys when the configuration is parsed\n * (`defineSaaSConfig`, the per-environment overlay, the backend's application configuration), and the registry refuses\n * them again before it merges, so a configuration hydrated from anywhere else is refused too.\n \n The way to point a provider at a local double is the environment-gated loopback host of a host-held slot (#2991),\n * which a deployment outside development and test refuses.\n \n Import path: `@wildo-ai/external-connectors-models`.\n /\nexport enum ExternalProvider_ModuleOwnedConfigurationKey {\n RUNTIME_CONTRACT = \"runtimeContract\",\n ENDPOINTS = \"endpoints\",\n}\n\n/* One authored key a provider module owns: where it was written, so the refusal can name it. /\nexport interface ExternalProvider_ModuleOwnedConfigurationKeyFinding {\n readonly providerRef: string;\n /* The second-level key of the bag: a protocol kind, or a key the module reads itself (`registration`). /\n readonly protocolKey: string;\n readonly key: ExternalProvider_ModuleOwnedConfigurationKey;\n}\n\nconst MODULE_OWNED_CONFIGURATION_KEYS: readonly ExternalProvider_ModuleOwnedConfigurationKey[] = Object.values(ExternalProvider_ModuleOwnedConfigurationKey);\n\n/\n Every module-owned key written anywhere in a `providerConfigurations` value. Total over the\n * {@link ExternalProvider_ModuleOwnedConfigurationKey} vocabulary, and over every bag, a protocol bag or not: no bag can\n * legitimately carry these names, and a bag the registry does not merge today is one a later reader might.\n * Anything that is not a record of records (a malformed value) yields nothing here; the schema reports that itself.\n /\nexport function findModuleOwnedProviderConfigurationKeys(providerConfigurations: unknown): ExternalProvider_ModuleOwnedConfigurationKeyFinding[] {\n const findings: ExternalProvider_ModuleOwnedConfigurationKeyFinding[] = [];\n if (!isPlainRecord(providerConfigurations)) return findings;\n for (const [providerRef, protocols] of Object.entries(providerConfigurations)) {\n if (!isPlainRecord(protocols)) continue;\n for (const [protocolKey, bag] of Object.entries(protocols)) {\n if (!isPlainRecord(bag)) continue;\n for (const key of MODULE_OWNED_CONFIGURATION_KEYS) {\n if (Object.prototype.hasOwnProperty.call(bag, key)) findings.push({ providerRef, protocolKey, key });\n }\n }\n }\n return findings;\n}\n\n/* The one sentence every door refuses a module-owned key with, so an operator greps one wording. /\nexport function describeModuleOwnedProviderConfigurationKey(finding: ExternalProvider_ModuleOwnedConfigurationKeyFinding): string {\n return `providerConfigurations.${finding.providerRef}.${finding.protocolKey}.${finding.key} is refused: the provider module owns `\n + `'${finding.key}' (where its requests go and how its credential travels), and a configuration cannot rewrite it. Remove the key. `\n + 'To reach a local double of the vendor, set the provider\\'s host slot to a loopback host:port in a development or test environment.';\n}\n\n/\n Report every module-owned key as an issue on `ctx`, at its path. The refinement each `providerConfigurations` schema\n * applies, so the three refuse the same keys with the same words.\n \n assurance-control: WILDO.SECRETS.CREDENTIAL_SCOPING — a configuration cannot author where a provider's credential is sent (#2995).\n /\nexport function refuseModuleOwnedProviderConfigurationKeys(providerConfigurations: unknown, ctx: z.RefinementCtx): void {\n for (const finding of findModuleOwnedProviderConfigurationKeys(providerConfigurations)) {\n ctx.addIssue({\n code: \"custom\",\n path: [finding.providerRef, finding.protocolKey, finding.key],\n message: describeModuleOwnedProviderConfigurationKey(finding),\n });\n }\n}\n\n/\n The fields of a `providerConfigurations.<providerRef>.<protocol>` bag that NAME a credential (#3022). Each decides\n * which secret a vendor or a coding agent receives, so each is held to a rule that leaves that choice to the provider\n * module and the framework rather than to the configuration:\n \n \| field \| the rule \| closed by \|\n * \|---\|---\|---\|\n * \| `authConfig.secretRef` \| names only a slot the module's `secretsContract` declares, by its variable or its slug \| #3002 \|\n * \| an execution profile's `secretEnvVarName` \| names only a variable the module declares (never a slug: it is the variable the agent reads) \| #3002 \|\n * \| an execution profile's `inheritedEnvironmentVariables` \| names anything EXCEPT a secret the framework declares \| #3018 \|\n \n The vocabulary is the one named source for the doors that check these fields: the backend registry, on every read and\n * in its startup walk, and the CLI's environment door. Each reads the fields through\n * {@link readProviderConfigurationCredentialFields} and branches on the member, so a field added here gets a reader (a\n * compile error until it does) and then reaches every door's exhaustive switch, where it is a compile error again until\n * the door decides its rule. Before this vocabulary the three fields were string paths written out at each door.\n \n Where the credential then GOES is the other half of the property, and it is not a configuration field at all: the\n * module owns its destination ({@link ExternalProvider_ModuleOwnedConfigurationKey}, #2995).\n \n Import path: `@wildo-ai/external-connectors-models`.\n /\nexport enum ProviderConfigurationCredentialField {\n /* `authConfig.secretRef`: the slot a protocol's key or client secret is read from, and sent to the vendor. /\n AUTH_SECRET_REF = \"auth_secret_ref\",\n /\n `executionProfiles.<profile>.secretEnvVarName`, on the agent-client-protocol bag only: the one variable read from the\n * spawning process and set in the coding agent's environment.\n /\n EXECUTION_PROFILE_SECRET_ENV_VAR_NAME = \"execution_profile_secret_env_var_name\",\n /\n `executionProfiles.<profile>.inheritedEnvironmentVariables`, on the agent-client-protocol bag only: the host's own\n * variables (the agent's login, its tool paths) copied into the coding agent's environment.\n /\n EXECUTION_PROFILE_INHERITED_ENVIRONMENT = \"execution_profile_inherited_environment\",\n}\n\n/* One credential-naming field as authored, unchecked: the door that reads it decides whether it is admitted. /\nexport interface ProviderConfigurationCredentialFieldReading {\n readonly field: ProviderConfigurationCredentialField;\n /* Where it sits inside the protocol bag (`authConfig.secretRef`, `executionProfiles.mine.secretEnvVarName`), for a refusal to name. /\n readonly path: string;\n /* The execution profile it was read from, for the two profile fields. /\n readonly executionProfileRef?: string;\n /* The authored value. Never `undefined`: a field that is not written yields no reading. /\n readonly value: unknown;\n}\n\nconst AGENT_CLIENT_PROTOCOL_MEMBER_NAME = (Object.keys(ExternalProvider_ExchangeProtocol_Kind) as Array<keyof typeof ExternalProvider_ExchangeProtocol_Kind>)\n .find((member) => ExternalProvider_ExchangeProtocol_Kind[member] === ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL);\n\n/\n Whether a protocol key of a `providerConfigurations.<providerRef>` value holds the agent-client-protocol bag: the\n * protocol's wire value, or its member name. The backend reads the configuration under the wire value only, but a\n * credential-naming field is checked under either key, so a bag authored under the member name is refused by every door\n * rather than by the CLI alone.\n /\nexport function isAgentClientProtocolConfigurationKey(protocolKey: string): boolean {\n return protocolKey === ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL \|\| protocolKey === AGENT_CLIENT_PROTOCOL_MEMBER_NAME;\n}\n\n/\n The authored execution profiles of an agent-client-protocol bag; nothing for any other bag.\n \n Read from ANY object, an array included, and each profile that is any object, never only from plain records: the doors\n * iterated `Object.entries` before this vocabulary, and the registry's merge turns an array into `{ '0': profile }`, which\n * an agent or a default profile can select. Reading plain records only would leave such a profile's `secretEnvVarName`\n * unchecked while dispatch still injects it (#3022 review F1). What is not an object carries no field to read.\n /\nfunction authoredExecutionProfiles(protocolKey: string, bag: Record<string, unknown>): Array<[string, Record<string, unknown>]> {\n if (!isAgentClientProtocolConfigurationKey(protocolKey) \|\| !isObject(bag.executionProfiles)) return [];\n return Object.entries(bag.executionProfiles).filter((entry): entry is [string, Record<string, unknown>] => isObject(entry[1]));\n}\n\n/* One reader per field, so a member added to the vocabulary without one is a compile error. /\nconst PROVIDER_CONFIGURATION_CREDENTIAL_FIELD_READERS: {\n readonly [Field in ProviderConfigurationCredentialField]: (protocolKey: string, bag: Record<string, unknown>) => ProviderConfigurationCredentialFieldReading[];\n} = {\n [ProviderConfigurationCredentialField.AUTH_SECRET_REF]: (_protocolKey, bag) => {\n const value = isObject(bag.authConfig) ? (bag.authConfig as Record<string, unknown>).secretRef : undefined;\n return value === undefined ? [] : [{ field: ProviderConfigurationCredentialField.AUTH_SECRET_REF, path: \"authConfig.secretRef\", value }];\n },\n [ProviderConfigurationCredentialField.EXECUTION_PROFILE_SECRET_ENV_VAR_NAME]: (protocolKey, bag) =>\n authoredExecutionProfiles(protocolKey, bag).flatMap(([executionProfileRef, profile]) => profile.secretEnvVarName === undefined ? [] : [{\n field: ProviderConfigurationCredentialField.EXECUTION_PROFILE_SECRET_ENV_VAR_NAME,\n path: `executionProfiles.${executionProfileRef}.secretEnvVarName`,\n executionProfileRef,\n value: profile.secretEnvVarName,\n }]),\n [ProviderConfigurationCredentialField.EXECUTION_PROFILE_INHERITED_ENVIRONMENT]: (protocolKey, bag) =>\n authoredExecutionProfiles(protocolKey, bag).flatMap(([executionProfileRef, profile]) => profile.inheritedEnvironmentVariables === undefined ? [] : [{\n field: ProviderConfigurationCredentialField.EXECUTION_PROFILE_INHERITED_ENVIRONMENT,\n path: `executionProfiles.${executionProfileRef}.inheritedEnvironmentVariables`,\n executionProfileRef,\n value: profile.inheritedEnvironmentVariables,\n }]),\n};\n\n/\n Every credential-naming field written in one protocol bag of a provider configuration, in vocabulary order. Total over\n * {@link ProviderConfigurationCredentialField}. A bag that is not a record yields nothing; its schema reports that itself.\n /\nexport function readProviderConfigurationCredentialFields(protocolKey: string, bag: unknown): ProviderConfigurationCredentialFieldReading[] {\n if (!isPlainRecord(bag)) return [];\n return Object.values(ProviderConfigurationCredentialField).flatMap((field) => PROVIDER_CONFIGURATION_CREDENTIAL_FIELD_READERS[field](protocolKey, bag));\n}\n\nfunction isPlainRecord(value: unknown): value is Record<string, unknown> {\n return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/* Any object, an array included: the shape a credential-naming field is read from, so no authored object escapes it. /\nfunction isObject(value: unknown): value is Record<string, unknown> {\n return typeof value === \"object\" && value !== null;\n}\n\nexport enum ExternalProvider_IO_Direction {\n INBOUND = \"inbound\",\n OUTBOUND = \"outbound\",\n BIDIRECTIONAL = \"bidirectional\",\n}\n\nexport enum ExternalProvider_IO_InteractionPattern {\n REQUEST_RESPONSE = \"request_response\",\n EVENT_BASED = \"event_based\",\n STREAMING = \"stream\",\n}\n\n\n/\n An address a vendor registration asks a person to TYPE at the vendor, as opposed to one the registration file already\n * carries (#2713). A provider module's `vendorRegistration` names each one it needs beside its steps, so a screen can\n * show it as a value to copy, labelled from its own words, rather than leave it inside a sentence.\n \n Add a member when a provider's registration names another such address. A Slack app's request URLs are not one: the\n * manifest file carries them, and nobody types them.\n /\nexport enum ProviderVendorRegistrationAddressKind {\n /\n Where the vendor delivers a bot's messages: the Azure Bot's \"Messaging endpoint\", the route the engine mounts for the\n * provider's inbound endpoint. Every bot of one application, its own or an organization's, is registered with the same one.\n */\n MESSAGING_ENDPOINT = \"messaging_endpoint\",\n}\n"]}

package/dist/esm/core/oauth2.enums.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth2.enums.d.ts","sourceRoot":"","sources":["~~../../../../~~src/core/oauth2.enums.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;GAGG;AACH,oBAAY,gBAAgB;IAC1B,iGAAiG;IACjG,kBAAkB,uBAAuB;IAEzC,6FAA6F;IAC7F,kBAAkB,uBAAuB;IAEzC,0EAA0E;IAC1E,aAAa,kBAAkB;IAE/B,oEAAoE;IACpE,QAAQ,aAAa;IAErB,uEAAuE;IACvE,QAAQ,aAAa;IAErB,4EAA4E;IAC5E,WAAW,iDAAiD;IAE5D,6DAA6D;IAC7D,UAAU,gDAAgD;CAC3D;AAED;;GAEG;AACH,oBAAY,mBAAmB;IAC7B,IAAI,SAAS;IACb,KAAK,UAAU;IACf,QAAQ,aAAa;IACrB,aAAa,kBAAkB;IAC/B,UAAU,eAAe;IACzB,cAAc,mBAAmB;IACjC,mBAAmB,wBAAwB;CAC5C;AAED;;GAEG;AACH,oBAAY,kBAAkB;IAC5B,KAAK,UAAU;IACf,IAAI,SAAS;CACd;AAED;;;GAGG;AACH,oBAAY,+BAA+B;IACzC,wDAAwD;IACxD,mBAAmB,wBAAwB;IAE3C,kCAAkC;IAClC,kBAAkB,uBAAuB;IAEzC,qDAAqD;IACrD,iBAAiB,sBAAsB;IAEvC,qDAAqD;IACrD,eAAe,oBAAoB;IAEnC,yCAAyC;IACzC,IAAI,SAAS;CACd;AAED;;;GAGG;AACH,oBAAY,aAAa;IACvB,mCAAmC;IACnC,IAAI,SAAS;IAEb,yCAAyC;IACzC,KAAK,UAAU;IAEf,sDAAsD;IACtD,OAAO,YAAY;IAEnB,mCAAmC;IACnC,cAAc,mBAAmB;CAClC;AAED;;GAEG;AACH,oBAAY,iBAAiB;IAC3B,+CAA+C;IAC/C,MAAM,WAAW;IAEjB,+CAA+C;IAC/C,OAAO,YAAY;CACpB;AAED;;GAEG;AACH,oBAAY,cAAc;IACxB,6DAA6D;IAC7D,UAAU,eAAe;IAEzB,+DAA+D;IAC/D,QAAQ,aAAa;IAErB,mCAAmC;IACnC,MAAM,WAAW;CAClB;AAED;;GAEG;AACH,oBAAY,kBAAkB;IAC5B,oCAAoC;IACpC,MAAM,WAAW;IACjB,mCAAmC;IACnC,KAAK,UAAU;IACf,mCAAmC;IACnC,KAAK,UAAU;IACf,yCAAyC;IACzC,aAAa,kBAAkB;IAC/B,+BAA+B;IAC/B,WAAW,gBAAgB;CAC5B;AAED;;GAEG;AACH,oBAAY,oBAAoB;IAC9B,8BAA8B;IAC9B,MAAM,WAAW;IACjB,yBAAyB;IACzB,KAAK,UAAU;CAChB"}
1	+ {"version":3,"file":"oauth2.enums.d.ts","sourceRoot":"","sources":["../../../src/core/oauth2.enums.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;GAGG;AACH,oBAAY,gBAAgB;IAC1B,iGAAiG;IACjG,kBAAkB,uBAAuB;IAEzC,6FAA6F;IAC7F,kBAAkB,uBAAuB;IAEzC,0EAA0E;IAC1E,aAAa,kBAAkB;IAE/B,oEAAoE;IACpE,QAAQ,aAAa;IAErB,uEAAuE;IACvE,QAAQ,aAAa;IAErB,4EAA4E;IAC5E,WAAW,iDAAiD;IAE5D,6DAA6D;IAC7D,UAAU,gDAAgD;CAC3D;AAED;;GAEG;AACH,oBAAY,mBAAmB;IAC7B,IAAI,SAAS;IACb,KAAK,UAAU;IACf,QAAQ,aAAa;IACrB,aAAa,kBAAkB;IAC/B,UAAU,eAAe;IACzB,cAAc,mBAAmB;IACjC,mBAAmB,wBAAwB;CAC5C;AAED;;GAEG;AACH,oBAAY,kBAAkB;IAC5B,KAAK,UAAU;IACf,IAAI,SAAS;CACd;AAED;;;GAGG;AACH,oBAAY,+BAA+B;IACzC,wDAAwD;IACxD,mBAAmB,wBAAwB;IAE3C,kCAAkC;IAClC,kBAAkB,uBAAuB;IAEzC,qDAAqD;IACrD,iBAAiB,sBAAsB;IAEvC,qDAAqD;IACrD,eAAe,oBAAoB;IAEnC,yCAAyC;IACzC,IAAI,SAAS;CACd;AAED;;;GAGG;AACH,oBAAY,aAAa;IACvB,mCAAmC;IACnC,IAAI,SAAS;IAEb,yCAAyC;IACzC,KAAK,UAAU;IAEf,sDAAsD;IACtD,OAAO,YAAY;IAEnB,mCAAmC;IACnC,cAAc,mBAAmB;CAClC;AAED;;GAEG;AACH,oBAAY,iBAAiB;IAC3B,+CAA+C;IAC/C,MAAM,WAAW;IAEjB,+CAA+C;IAC/C,OAAO,YAAY;CACpB;AAED;;GAEG;AACH,oBAAY,cAAc;IACxB,6DAA6D;IAC7D,UAAU,eAAe;IAEzB,+DAA+D;IAC/D,QAAQ,aAAa;IAErB,mCAAmC;IACnC,MAAM,WAAW;CAClB;AAED;;GAEG;AACH,oBAAY,kBAAkB;IAC5B,oCAAoC;IACpC,MAAM,WAAW;IACjB,mCAAmC;IACnC,KAAK,UAAU;IACf,mCAAmC;IACnC,KAAK,UAAU;IACf,yCAAyC;IACzC,aAAa,kBAAkB;IAC/B,+BAA+B;IAC/B,WAAW,gBAAgB;CAC5B;AAED;;GAEG;AACH,oBAAY,oBAAoB;IAC9B,8BAA8B;IAC9B,MAAM,WAAW;IACjB,yBAAyB;IACzB,KAAK,UAAU;CAChB"}

package/dist/esm/core/oauth2.enums.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth2.enums.js","sourceRoot":"","sources":["~~../../../../~~src/core/oauth2.enums.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;GAGG;AACH,MAAM,CAAN,IAAY,gBAqBX;AArBD,WAAY,gBAAgB;IAC1B,iGAAiG;IACjG,6DAAyC,CAAA;IAEzC,6FAA6F;IAC7F,6DAAyC,CAAA;IAEzC,0EAA0E;IAC1E,mDAA+B,CAAA;IAE/B,oEAAoE;IACpE,yCAAqB,CAAA;IAErB,uEAAuE;IACvE,yCAAqB,CAAA;IAErB,4EAA4E;IAC5E,gFAA4D,CAAA;IAE5D,6DAA6D;IAC7D,8EAA0D,CAAA;AAC5D,CAAC,EArBW,gBAAgB,KAAhB,gBAAgB,QAqB3B;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,mBAQX;AARD,WAAY,mBAAmB;IAC7B,oCAAa,CAAA;IACb,sCAAe,CAAA;IACf,4CAAqB,CAAA;IACrB,sDAA+B,CAAA;IAC/B,gDAAyB,CAAA;IACzB,wDAAiC,CAAA;IACjC,kEAA2C,CAAA;AAC7C,CAAC,EARW,mBAAmB,KAAnB,mBAAmB,QAQ9B;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,kBAGX;AAHD,WAAY,kBAAkB;IAC5B,qCAAe,CAAA;IACf,mCAAa,CAAA;AACf,CAAC,EAHW,kBAAkB,KAAlB,kBAAkB,QAG7B;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,+BAeX;AAfD,WAAY,+BAA+B;IACzC,wDAAwD;IACxD,8EAA2C,CAAA;IAE3C,kCAAkC;IAClC,4EAAyC,CAAA;IAEzC,qDAAqD;IACrD,0EAAuC,CAAA;IAEvC,qDAAqD;IACrD,sEAAmC,CAAA;IAEnC,yCAAyC;IACzC,gDAAa,CAAA;AACf,CAAC,EAfW,+BAA+B,KAA/B,+BAA+B,QAe1C;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,aAYX;AAZD,WAAY,aAAa;IACvB,mCAAmC;IACnC,8BAAa,CAAA;IAEb,yCAAyC;IACzC,gCAAe,CAAA;IAEf,sDAAsD;IACtD,oCAAmB,CAAA;IAEnB,mCAAmC;IACnC,kDAAiC,CAAA;AACnC,CAAC,EAZW,aAAa,KAAb,aAAa,QAYxB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,iBAMX;AAND,WAAY,iBAAiB;IAC3B,+CAA+C;IAC/C,sCAAiB,CAAA;IAEjB,+CAA+C;IAC/C,wCAAmB,CAAA;AACrB,CAAC,EANW,iBAAiB,KAAjB,iBAAiB,QAM5B;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,cASX;AATD,WAAY,cAAc;IACxB,6DAA6D;IAC7D,2CAAyB,CAAA;IAEzB,+DAA+D;IAC/D,uCAAqB,CAAA;IAErB,mCAAmC;IACnC,mCAAiB,CAAA;AACnB,CAAC,EATW,cAAc,KAAd,cAAc,QASzB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,kBAWX;AAXD,WAAY,kBAAkB;IAC5B,oCAAoC;IACpC,uCAAiB,CAAA;IACjB,mCAAmC;IACnC,qCAAe,CAAA;IACf,mCAAmC;IACnC,qCAAe,CAAA;IACf,yCAAyC;IACzC,qDAA+B,CAAA;IAC/B,+BAA+B;IAC/B,iDAA2B,CAAA;AAC7B,CAAC,EAXW,kBAAkB,KAAlB,kBAAkB,QAW7B;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,oBAKX;AALD,WAAY,oBAAoB;IAC9B,8BAA8B;IAC9B,yCAAiB,CAAA;IACjB,yBAAyB;IACzB,uCAAe,CAAA;AACjB,CAAC,EALW,oBAAoB,KAApB,oBAAoB,QAK/B","sourcesContent":["/*\n OAuth2 Enums - Shared OAuth2 type definitions\n * \n * These enums are extracted to avoid circular dependencies between\n * security schemas and oauth2 protocol schemas.\n * \n * Based on:\n * - RFC 6749: The OAuth 2.0 Authorization Framework\n * - RFC 7636: Proof Key for Code Exchange (PKCE)\n * - OpenID Connect Core 1.0\n /\n\n/\n OAuth2 Grant Types as defined in RFC 6749\n * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4\n /\nexport enum OAuth2_GrantType {\n /* Authorization Code Grant (RFC 6749 §4.1) - For server-side apps with secure client secrets /\n AUTHORIZATION_CODE = 'authorization_code',\n \n /* Client Credentials Grant (RFC 6749 §4.4) - For machine-to-machine / S2S authentication /\n CLIENT_CREDENTIALS = 'client_credentials',\n \n /* Refresh Token Grant (RFC 6749 §6) - For obtaining new access tokens /\n REFRESH_TOKEN = 'refresh_token',\n \n /* Implicit Grant (RFC 6749 §4.2) - DEPRECATED, use PKCE instead /\n IMPLICIT = 'implicit',\n \n /* Resource Owner Password Credentials (RFC 6749 §4.3) - DEPRECATED /\n PASSWORD = 'password',\n \n /* Device Authorization Grant (RFC 8628) - For input-constrained devices /\n DEVICE_CODE = 'urn:ietf:params:oauth:grant-type:device_code',\n \n /* JWT Bearer Assertion (RFC 7523) - For service accounts /\n JWT_BEARER = 'urn:ietf:params:oauth:grant-type:jwt-bearer',\n}\n\n/\n OAuth2 Response Types for Authorization Endpoint\n /\nexport enum OAuth2_ResponseType {\n CODE = 'code',\n TOKEN = 'token',\n ID_TOKEN = 'id_token',\n CODE_ID_TOKEN = 'code id_token',\n CODE_TOKEN = 'code token',\n ID_TOKEN_TOKEN = 'id_token token',\n CODE_ID_TOKEN_TOKEN = 'code id_token token',\n}\n\n/\n PKCE Code Challenge Methods (RFC 7636)\n /\nexport enum OAuth2_PKCE_Method {\n PLAIN = 'plain',\n S256 = 'S256',\n}\n\n/\n Token Endpoint Authentication Methods\n * How credentials are sent to the token endpoint\n /\nexport enum OAuth2_TokenEndpoint_AuthMethod {\n /* Credentials in Authorization header as Basic auth /\n CLIENT_SECRET_BASIC = 'client_secret_basic',\n \n /* Credentials in request body /\n CLIENT_SECRET_POST = 'client_secret_post',\n \n /* JWT assertion signed with client secret (HMAC) /\n CLIENT_SECRET_JWT = 'client_secret_jwt',\n \n /* JWT assertion signed with private key (RSA/EC) /\n PRIVATE_KEY_JWT = 'private_key_jwt',\n \n /* No authentication (public clients) /\n NONE = 'none',\n}\n\n/\n OpenID Connect Prompt Values\n * Controls how the authorization server prompts the user\n /\nexport enum OAuth2_Prompt {\n /* No prompt - silent auth only /\n NONE = 'none',\n \n /* Force login even if session exists /\n LOGIN = 'login',\n \n /* Require user consent even if previously granted /\n CONSENT = 'consent',\n \n /* Prompt for account selection /\n SELECT_ACCOUNT = 'select_account',\n}\n\n/\n Access Type - whether to request refresh tokens\n /\nexport enum OAuth2_AccessType {\n /* Only access token, no refresh capability /\n ONLINE = 'online',\n \n /* Request refresh token for offline access /\n OFFLINE = 'offline',\n}\n\n/\n OAuth2 Provider Purpose - what the OAuth2 is used for\n /\nexport enum OAuth2_Purpose {\n /* API access only - for making API calls to the provider /\n API_ACCESS = 'api_access',\n \n /* User SSO - for authenticating users into our application /\n USER_SSO = 'user_sso',\n \n /* Both API access and user SSO /\n HYBRID = 'hybrid',\n}\n\n/\n OAuth2 Token Format - How to format the token for API calls\n /\nexport enum OAuth2_TokenFormat {\n /* Authorization: Bearer <token> /\n BEARER = 'bearer',\n /* Authorization: token <token> /\n TOKEN = 'token',\n /* Authorization: OAuth <token> /\n OAUTH = 'oauth',\n /* Custom header specified separately /\n CUSTOM_HEADER = 'custom_header',\n /* Token in query parameter /\n QUERY_PARAM = 'query_param',\n}\n\n/\n OAuth2 Token Location - Where to send the access token\n /\nexport enum OAuth2_TokenLocation {\n /* In Authorization header /\n HEADER = 'header',\n /* As query parameter */\n QUERY = 'query',\n}\n\n"]}
1	+ {"version":3,"file":"oauth2.enums.js","sourceRoot":"","sources":["../../../src/core/oauth2.enums.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;GAGG;AACH,MAAM,CAAN,IAAY,gBAqBX;AArBD,WAAY,gBAAgB;IAC1B,iGAAiG;IACjG,6DAAyC,CAAA;IAEzC,6FAA6F;IAC7F,6DAAyC,CAAA;IAEzC,0EAA0E;IAC1E,mDAA+B,CAAA;IAE/B,oEAAoE;IACpE,yCAAqB,CAAA;IAErB,uEAAuE;IACvE,yCAAqB,CAAA;IAErB,4EAA4E;IAC5E,gFAA4D,CAAA;IAE5D,6DAA6D;IAC7D,8EAA0D,CAAA;AAC5D,CAAC,EArBW,gBAAgB,KAAhB,gBAAgB,QAqB3B;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,mBAQX;AARD,WAAY,mBAAmB;IAC7B,oCAAa,CAAA;IACb,sCAAe,CAAA;IACf,4CAAqB,CAAA;IACrB,sDAA+B,CAAA;IAC/B,gDAAyB,CAAA;IACzB,wDAAiC,CAAA;IACjC,kEAA2C,CAAA;AAC7C,CAAC,EARW,mBAAmB,KAAnB,mBAAmB,QAQ9B;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,kBAGX;AAHD,WAAY,kBAAkB;IAC5B,qCAAe,CAAA;IACf,mCAAa,CAAA;AACf,CAAC,EAHW,kBAAkB,KAAlB,kBAAkB,QAG7B;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,+BAeX;AAfD,WAAY,+BAA+B;IACzC,wDAAwD;IACxD,8EAA2C,CAAA;IAE3C,kCAAkC;IAClC,4EAAyC,CAAA;IAEzC,qDAAqD;IACrD,0EAAuC,CAAA;IAEvC,qDAAqD;IACrD,sEAAmC,CAAA;IAEnC,yCAAyC;IACzC,gDAAa,CAAA;AACf,CAAC,EAfW,+BAA+B,KAA/B,+BAA+B,QAe1C;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,aAYX;AAZD,WAAY,aAAa;IACvB,mCAAmC;IACnC,8BAAa,CAAA;IAEb,yCAAyC;IACzC,gCAAe,CAAA;IAEf,sDAAsD;IACtD,oCAAmB,CAAA;IAEnB,mCAAmC;IACnC,kDAAiC,CAAA;AACnC,CAAC,EAZW,aAAa,KAAb,aAAa,QAYxB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,iBAMX;AAND,WAAY,iBAAiB;IAC3B,+CAA+C;IAC/C,sCAAiB,CAAA;IAEjB,+CAA+C;IAC/C,wCAAmB,CAAA;AACrB,CAAC,EANW,iBAAiB,KAAjB,iBAAiB,QAM5B;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,cASX;AATD,WAAY,cAAc;IACxB,6DAA6D;IAC7D,2CAAyB,CAAA;IAEzB,+DAA+D;IAC/D,uCAAqB,CAAA;IAErB,mCAAmC;IACnC,mCAAiB,CAAA;AACnB,CAAC,EATW,cAAc,KAAd,cAAc,QASzB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,kBAWX;AAXD,WAAY,kBAAkB;IAC5B,oCAAoC;IACpC,uCAAiB,CAAA;IACjB,mCAAmC;IACnC,qCAAe,CAAA;IACf,mCAAmC;IACnC,qCAAe,CAAA;IACf,yCAAyC;IACzC,qDAA+B,CAAA;IAC/B,+BAA+B;IAC/B,iDAA2B,CAAA;AAC7B,CAAC,EAXW,kBAAkB,KAAlB,kBAAkB,QAW7B;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,oBAKX;AALD,WAAY,oBAAoB;IAC9B,8BAA8B;IAC9B,yCAAiB,CAAA;IACjB,yBAAyB;IACzB,uCAAe,CAAA;AACjB,CAAC,EALW,oBAAoB,KAApB,oBAAoB,QAK/B","sourcesContent":["/*\n OAuth2 Enums - Shared OAuth2 type definitions\n * \n * These enums are extracted to avoid circular dependencies between\n * security schemas and oauth2 protocol schemas.\n * \n * Based on:\n * - RFC 6749: The OAuth 2.0 Authorization Framework\n * - RFC 7636: Proof Key for Code Exchange (PKCE)\n * - OpenID Connect Core 1.0\n /\n\n/\n OAuth2 Grant Types as defined in RFC 6749\n * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4\n /\nexport enum OAuth2_GrantType {\n /* Authorization Code Grant (RFC 6749 §4.1) - For server-side apps with secure client secrets /\n AUTHORIZATION_CODE = 'authorization_code',\n \n /* Client Credentials Grant (RFC 6749 §4.4) - For machine-to-machine / S2S authentication /\n CLIENT_CREDENTIALS = 'client_credentials',\n \n /* Refresh Token Grant (RFC 6749 §6) - For obtaining new access tokens /\n REFRESH_TOKEN = 'refresh_token',\n \n /* Implicit Grant (RFC 6749 §4.2) - DEPRECATED, use PKCE instead /\n IMPLICIT = 'implicit',\n \n /* Resource Owner Password Credentials (RFC 6749 §4.3) - DEPRECATED /\n PASSWORD = 'password',\n \n /* Device Authorization Grant (RFC 8628) - For input-constrained devices /\n DEVICE_CODE = 'urn:ietf:params:oauth:grant-type:device_code',\n \n /* JWT Bearer Assertion (RFC 7523) - For service accounts /\n JWT_BEARER = 'urn:ietf:params:oauth:grant-type:jwt-bearer',\n}\n\n/\n OAuth2 Response Types for Authorization Endpoint\n /\nexport enum OAuth2_ResponseType {\n CODE = 'code',\n TOKEN = 'token',\n ID_TOKEN = 'id_token',\n CODE_ID_TOKEN = 'code id_token',\n CODE_TOKEN = 'code token',\n ID_TOKEN_TOKEN = 'id_token token',\n CODE_ID_TOKEN_TOKEN = 'code id_token token',\n}\n\n/\n PKCE Code Challenge Methods (RFC 7636)\n /\nexport enum OAuth2_PKCE_Method {\n PLAIN = 'plain',\n S256 = 'S256',\n}\n\n/\n Token Endpoint Authentication Methods\n * How credentials are sent to the token endpoint\n /\nexport enum OAuth2_TokenEndpoint_AuthMethod {\n /* Credentials in Authorization header as Basic auth /\n CLIENT_SECRET_BASIC = 'client_secret_basic',\n \n /* Credentials in request body /\n CLIENT_SECRET_POST = 'client_secret_post',\n \n /* JWT assertion signed with client secret (HMAC) /\n CLIENT_SECRET_JWT = 'client_secret_jwt',\n \n /* JWT assertion signed with private key (RSA/EC) /\n PRIVATE_KEY_JWT = 'private_key_jwt',\n \n /* No authentication (public clients) /\n NONE = 'none',\n}\n\n/\n OpenID Connect Prompt Values\n * Controls how the authorization server prompts the user\n /\nexport enum OAuth2_Prompt {\n /* No prompt - silent auth only /\n NONE = 'none',\n \n /* Force login even if session exists /\n LOGIN = 'login',\n \n /* Require user consent even if previously granted /\n CONSENT = 'consent',\n \n /* Prompt for account selection /\n SELECT_ACCOUNT = 'select_account',\n}\n\n/\n Access Type - whether to request refresh tokens\n /\nexport enum OAuth2_AccessType {\n /* Only access token, no refresh capability /\n ONLINE = 'online',\n \n /* Request refresh token for offline access /\n OFFLINE = 'offline',\n}\n\n/\n OAuth2 Provider Purpose - what the OAuth2 is used for\n /\nexport enum OAuth2_Purpose {\n /* API access only - for making API calls to the provider /\n API_ACCESS = 'api_access',\n \n /* User SSO - for authenticating users into our application /\n USER_SSO = 'user_sso',\n \n /* Both API access and user SSO /\n HYBRID = 'hybrid',\n}\n\n/\n OAuth2 Token Format - How to format the token for API calls\n /\nexport enum OAuth2_TokenFormat {\n /* Authorization: Bearer <token> /\n BEARER = 'bearer',\n /* Authorization: token <token> /\n TOKEN = 'token',\n /* Authorization: OAuth <token> /\n OAUTH = 'oauth',\n /* Custom header specified separately /\n CUSTOM_HEADER = 'custom_header',\n /* Token in query parameter /\n QUERY_PARAM = 'query_param',\n}\n\n/\n OAuth2 Token Location - Where to send the access token\n /\nexport enum OAuth2_TokenLocation {\n /* In Authorization header /\n HEADER = 'header',\n /* As query parameter */\n QUERY = 'query',\n}\n\n"]}

package/dist/esm/core/operation-classification.external-connectors-models.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"operation-classification.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/core/operation-classification.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,oBAAY,gCAAgC;IAC1C,IAAI,SAAS;IACb,KAAK,UAAU;CAChB"}
1	+ {"version":3,"file":"operation-classification.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../src/core/operation-classification.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,oBAAY,gCAAgC;IAC1C,IAAI,SAAS;IACb,KAAK,UAAU;CAChB"}

package/dist/esm/core/operation-classification.external-connectors-models.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"operation-classification.external-connectors-models.schemas.js","sourceRoot":"","sources":["~~../../../../~~src/core/operation-classification.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,gCAGX;AAHD,WAAY,gCAAgC;IAC1C,iDAAa,CAAA;IACb,mDAAe,CAAA;AACjB,CAAC,EAHW,gCAAgC,KAAhC,gCAAgC,QAG3C","sourcesContent":["/*\n Whether an external operation READS from or WRITES to the third-party system.\n \n Kept as its own tiny vocabulary because every operation catalogue needs it regardless of where\n * the catalogue came from: a caller decides retry-safety, an audit decides severity, and a UI\n * decides whether to confirm. Neutral by construction — it names the operation's effect, never a\n * source catalogue's spelling of it.\n */\nexport enum ExternalOperation_Classification {\n READ = \"READ\",\n WRITE = \"WRITE\",\n}\n"]}
1	+ {"version":3,"file":"operation-classification.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../src/core/operation-classification.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,gCAGX;AAHD,WAAY,gCAAgC;IAC1C,iDAAa,CAAA;IACb,mDAAe,CAAA;AACjB,CAAC,EAHW,gCAAgC,KAAhC,gCAAgC,QAG3C","sourcesContent":["/*\n Whether an external operation READS from or WRITES to the third-party system.\n \n Kept as its own tiny vocabulary because every operation catalogue needs it regardless of where\n * the catalogue came from: a caller decides retry-safety, an audit decides severity, and a UI\n * decides whether to confirm. Neutral by construction — it names the operation's effect, never a\n * source catalogue's spelling of it.\n */\nexport enum ExternalOperation_Classification {\n READ = \"READ\",\n WRITE = \"WRITE\",\n}\n"]}

package/dist/esm/core/operations.external-connectors-models.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"operations.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/core/operations.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;oEAEoE;AAEpE,eAAO,MAAM,uCAAuC;;;;iBAIlD,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG,MAAM,MAAM,yCAAyC,GAAG;IACtD;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IAEpB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAEnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IAEpB,0BAA0B;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,4BAA4B;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,yBAAyB;IACzB,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAE9B,0BAA0B;IAC1B,YAAY,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAE/B,kCAAkC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAE/B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B,CAAA"}
1	+ {"version":3,"file":"operations.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../src/core/operations.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;oEAEoE;AAEpE,eAAO,MAAM,uCAAuC;;;;iBAIlD,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG,MAAM,MAAM,yCAAyC,GAAG;IACtD;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IAEpB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAEnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IAEpB,0BAA0B;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,4BAA4B;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,yBAAyB;IACzB,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAE9B,0BAA0B;IAC1B,YAAY,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAE/B,kCAAkC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAE/B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B,CAAA"}

package/dist/esm/core/operations.external-connectors-models.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"operations.external-connectors-models.schemas.js","sourceRoot":"","sources":["~~../../../../~~src/core/operations.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;oEAEoE;AAEpE,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9D,aAAa,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\n\n/** ──────────────────────────────────────────────────────────────\n * Internal Schemas (concrete, for method access)\n * ────────────────────────────────────────────────────────────── /\n\nexport const ExternalProvider_OperationContextSchema = z.object({\n callTimestamp: z.iso.datetime(),\n callDuration: z.number().optional(),\n errorReason: z.string().optional(),\n});\nexport type ExternalProvider_OperationContext = z.infer<typeof ExternalProvider_OperationContextSchema>;\n\nexport type ExternalProvider_OperationDefinition_Base = {\n /* \n * Unique operation identifier\n * Format: {provider}-{domain}-{action} e.g., \"stripe-customers-create\"\n /\n operationKey: string,\n \n /* Provider reference (e.g., \"google\", \"slack\", \"stripe\") /\n providerRef: string,\n \n /* \n * Domains this operation belongs to (can span multiple domains)\n * e.g., [\"customers\"] or [\"sheets\", \"drive\"] for cross-domain operations\n * Empty/undefined for providers without explicit domains\n /\n domains?: string[],\n \n /* \n * Capabilities/features this operation uses\n * e.g., [\"storage\", \"file-upload\"] for a file creation operation\n /\n features?: string[],\n \n /* Human-readable name /\n displayName?: string,\n \n /* Operation description /\n description?: string,\n \n /* Input schema (Zod) /\n inputSchema: z.ZodSchema<any>,\n \n /* Output schema (Zod) /\n outputSchema: z.ZodSchema<any>,\n \n /* Operation-specific metadata /\n metadata?: Record<string, any>,\n \n /* \n * OAuth2 scopes required specifically for this operation\n * System unions all required scopes from selected operations at auth time\n */\n requiredScopes?: string[],\n}\n"]}
1	+ {"version":3,"file":"operations.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../src/core/operations.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;oEAEoE;AAEpE,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9D,aAAa,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\n\n/** ──────────────────────────────────────────────────────────────\n * Internal Schemas (concrete, for method access)\n * ────────────────────────────────────────────────────────────── /\n\nexport const ExternalProvider_OperationContextSchema = z.object({\n callTimestamp: z.iso.datetime(),\n callDuration: z.number().optional(),\n errorReason: z.string().optional(),\n});\nexport type ExternalProvider_OperationContext = z.infer<typeof ExternalProvider_OperationContextSchema>;\n\nexport type ExternalProvider_OperationDefinition_Base = {\n /* \n * Unique operation identifier\n * Format: {provider}-{domain}-{action} e.g., \"stripe-customers-create\"\n /\n operationKey: string,\n \n /* Provider reference (e.g., \"google\", \"slack\", \"stripe\") /\n providerRef: string,\n \n /* \n * Domains this operation belongs to (can span multiple domains)\n * e.g., [\"customers\"] or [\"sheets\", \"drive\"] for cross-domain operations\n * Empty/undefined for providers without explicit domains\n /\n domains?: string[],\n \n /* \n * Capabilities/features this operation uses\n * e.g., [\"storage\", \"file-upload\"] for a file creation operation\n /\n features?: string[],\n \n /* Human-readable name /\n displayName?: string,\n \n /* Operation description /\n description?: string,\n \n /* Input schema (Zod) /\n inputSchema: z.ZodSchema<any>,\n \n /* Output schema (Zod) /\n outputSchema: z.ZodSchema<any>,\n \n /* Operation-specific metadata /\n metadata?: Record<string, any>,\n \n /* \n * OAuth2 scopes required specifically for this operation\n * System unions all required scopes from selected operations at auth time\n */\n requiredScopes?: string[],\n}\n"]}

package/dist/esm/core/security.external-connectors-models.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"security.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/core/security.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,+BAA+B,EAC/B,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AAMxB;;;GAGG;AACH,oBAAY,0BAA0B;IACpC,iCAAiC;IACjC,IAAI,SAAS;IAEb,0CAA0C;IAC1C,OAAO,YAAY;IAEnB,gDAAgD;IAChD,MAAM,WAAW;IAEjB,gCAAgC;IAChC,KAAK,UAAU;IAEf,kEAAkE;IAClE,MAAM,WAAW;IAEjB,0CAA0C;IAC1C,cAAc,mBAAmB;IAEjC,+CAA+C;IAC/C,cAAc,mBAAmB;IAEjC,uCAAuC;IACvC,UAAU,eAAe;IAEzB,qDAAqD;IACrD,eAAe,oBAAoB;CACpC;AAMD,oBAAY,qCAAqC;IAC/C,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,MAAM,WAAW;CAClB;AAED,oBAAY,8CAA8C;IACxD,MAAM,WAAW;IACjB,MAAM,WAAW;CAClB;AAED,oBAAY,mCAAmC;IAC7C,GAAG,QAAQ;IACX,OAAO,YAAY;IACnB,mBAAmB,wBAAwB;CAC5C;AAMD;;;GAGG;AACH,eAAO,MAAM,yCAAyC;;;;;iBAYpD,CAAC;AAMH,eAAO,MAAM,6CAA6C;;;;;;;iBAkBxD,CAAC;AAMH,eAAO,MAAM,uCAAuC;;;;;;iBAelD,CAAC;AAMH,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6CAA6C,CAAC,CAAC;AACpH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAMxG;;;GAGG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAmI9C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAM/F;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,oBAAY,sCAAsC;IAChD,qGAAqG;IACrG,WAAW,gBAAgB;IAC3B,mGAAmG;IACnG,YAAY,iBAAiB;IAC7B,uFAAuF;IACvF,IAAI,SAAS;CACd;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,oBAAY,4BAA4B;IACtC;;;OAGG;IACH,YAAY,iBAAiB;IAC7B;;;;OAIG;IACH,UAAU,eAAe;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,oBAAY,0CAA0C;IACpD,2EAA2E;IAC3E,OAAO,YAAY;IACnB,wFAAwF;IACxF,IAAI,SAAS;CACd;AAED,4HAA4H;AAC5H;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sCAAsC;;;iBAMjD,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,eAAO,MAAM,uCAAuC;;;;;iBAoDlD,CAAC;AACH,0EAA0E;AAE1E;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,gCAAgC,GAAG,OAAO,CAGhG;AAED;;;;;;;;GAQG;AACH,wBAAgB,0CAA0C,CAAC,KAAK,EAAE,gCAAgC,GAAG,OAAO,CAG3G;AAED,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC"}
1	+ {"version":3,"file":"security.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../src/core/security.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,+BAA+B,EAC/B,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AAMxB;;;GAGG;AACH,oBAAY,0BAA0B;IACpC,iCAAiC;IACjC,IAAI,SAAS;IAEb,0CAA0C;IAC1C,OAAO,YAAY;IAEnB,gDAAgD;IAChD,MAAM,WAAW;IAEjB,gCAAgC;IAChC,KAAK,UAAU;IAEf,kEAAkE;IAClE,MAAM,WAAW;IAEjB,0CAA0C;IAC1C,cAAc,mBAAmB;IAEjC,+CAA+C;IAC/C,cAAc,mBAAmB;IAEjC,uCAAuC;IACvC,UAAU,eAAe;IAEzB,qDAAqD;IACrD,eAAe,oBAAoB;CACpC;AAMD,oBAAY,qCAAqC;IAC/C,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,MAAM,WAAW;CAClB;AAED,oBAAY,8CAA8C;IACxD,MAAM,WAAW;IACjB,MAAM,WAAW;CAClB;AAED,oBAAY,mCAAmC;IAC7C,GAAG,QAAQ;IACX,OAAO,YAAY;IACnB,mBAAmB,wBAAwB;CAC5C;AAMD;;;GAGG;AACH,eAAO,MAAM,yCAAyC;;;;;iBAYpD,CAAC;AAMH,eAAO,MAAM,6CAA6C;;;;;;;iBAkBxD,CAAC;AAMH,eAAO,MAAM,uCAAuC;;;;;;iBAelD,CAAC;AAMH,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6CAA6C,CAAC,CAAC;AACpH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAMxG;;;GAGG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAmI9C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAM/F;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,oBAAY,sCAAsC;IAChD,qGAAqG;IACrG,WAAW,gBAAgB;IAC3B,mGAAmG;IACnG,YAAY,iBAAiB;IAC7B,uFAAuF;IACvF,IAAI,SAAS;CACd;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,oBAAY,4BAA4B;IACtC;;;OAGG;IACH,YAAY,iBAAiB;IAC7B;;;;OAIG;IACH,UAAU,eAAe;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,oBAAY,0CAA0C;IACpD,2EAA2E;IAC3E,OAAO,YAAY;IACnB,wFAAwF;IACxF,IAAI,SAAS;CACd;AAED,4HAA4H;AAC5H;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sCAAsC;;;iBAMjD,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,eAAO,MAAM,uCAAuC;;;;;iBAoDlD,CAAC;AACH,0EAA0E;AAE1E;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,gCAAgC,GAAG,OAAO,CAGhG;AAED;;;;;;;;GAQG;AACH,wBAAgB,0CAA0C,CAAC,KAAK,EAAE,gCAAgC,GAAG,OAAO,CAG3G;AAED,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC"}

package/dist/esm/core/security.external-connectors-models.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"security.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../../src/core/security.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,+BAA+B,EAC/B,kBAAkB,EAClB,aAAa,EACb,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAExB,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAN,IAAY,0BA2BX;AA3BD,WAAY,0BAA0B;IACpC,iCAAiC;IACjC,2CAAa,CAAA;IAEb,0CAA0C;IAC1C,iDAAmB,CAAA;IAEnB,gDAAgD;IAChD,+CAAiB,CAAA;IAEjB,gCAAgC;IAChC,6CAAe,CAAA;IAEf,kEAAkE;IAClE,+CAAiB,CAAA;IAEjB,0CAA0C;IAC1C,+DAAiC,CAAA;IAEjC,+CAA+C;IAC/C,+DAAiC,CAAA;IAEjC,uCAAuC;IACvC,uDAAyB,CAAA;IAEzB,qDAAqD;IACrD,iEAAmC,CAAA;AACrC,CAAC,EA3BW,0BAA0B,KAA1B,0BAA0B,QA2BrC;AAED,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,MAAM,CAAN,IAAY,qCAIX;AAJD,WAAY,qCAAqC;IAC/C,0DAAiB,CAAA;IACjB,wDAAe,CAAA;IACf,0DAAiB,CAAA;AACnB,CAAC,EAJW,qCAAqC,KAArC,qCAAqC,QAIhD;AAED,MAAM,CAAN,IAAY,8CAGX;AAHD,WAAY,8CAA8C;IACxD,mEAAiB,CAAA;IACjB,mEAAiB,CAAA;AACnB,CAAC,EAHW,8CAA8C,KAA9C,8CAA8C,QAGzD;AAED,MAAM,CAAN,IAAY,mCAIX;AAJD,WAAY,mCAAmC;IAC7C,kDAAW,CAAA;IACX,0DAAmB,CAAA;IACnB,kFAA2C,CAAA;AAC7C,CAAC,EAJW,mCAAmC,KAAnC,mCAAmC,QAI9C;AAED,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,6BAA6B;IAC7B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAE5C,yDAAyD;IACzD,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE3C,iDAAiD;IACjD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEjC,8EAA8E;IAC9E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,CAAC,MAAM,CAAC;IACpE,kCAAkC;IAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE3D,yCAAyC;IACzC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAEzC,sCAAsC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE3C,sCAAsC;IACtC,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE1D,4CAA4C;IAC5C,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAExD,kDAAkD;IAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;CACjD,CAAC,CAAC;AAEH,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9D,6BAA6B;IAC7B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAExC,6CAA6C;IAC7C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1B,wCAAwC;IACxC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAErC,gEAAgE;IAChE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,MAAM,CAAC;IAE7G,wCAAwC;IACxC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;CACnD,CAAC,CAAC;AASH,gFAAgF;AAChF,qCAAqC;AACrC,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC9E,iCAAiC;IACjC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,OAAO,CAAC;QACnD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;QAClD,qDAAqD;QACrD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC;IAEF,wCAAwC;IACxC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,cAAc,CAAC;QAC1D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;QAChD,qBAAqB;QACrB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC,OAAO,CAAC,8CAA8C,CAAC,MAAM,CAAC;QAChI,gDAAgD;QAChD,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;QACpE,wCAAwC;QACxC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACtC,0DAA0D;QAC1D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC;IAEF,sCAAsC;IACtC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,MAAM,CAAC;QAClD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,MAAM,CAAC;QAC7G,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;QAClD,iCAAiC;QACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACrC,mBAAmB;QACnB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC,OAAO,CAAC,mCAAmC,CAAC,GAAG,CAAC;KACrG,CAAC;IAEF,wCAAwC;IACxC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,cAAc,CAAC;QAC1D,yBAAyB;QACzB,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAChC,aAAa;QACb,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,wBAAwB;QACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,4BAA4B;QAC5B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;KACtE,CAAC;IAEF,mDAAmD;IACnD,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,MAAM,CAAC;QAElD,uDAAuD;QACvD;;;;WAIG;QACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAExC,wDAAwD;QACxD,gEAAgE;QAChE,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC3B,gBAAgB;QAChB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC5B,+CAA+C;QAC/C,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAE9B,4CAA4C;QAC5C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAEtC,2BAA2B;QAC3B,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;QAE9C,iCAAiC;QACjC,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,QAAQ,EAAE;QAE3E,mBAAmB;QACnB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC5B,kBAAkB;QAClB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;QAEjD,sBAAsB;QACtB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;QAExC,mCAAmC;QACnC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;QAEhD,qCAAqC;QACrC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAE5D,6BAA6B;QAC7B,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAE7D,uCAAuC;QACvC,sDAAsD;QACtD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC7E,+CAA+C;QAC/C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACzC,CAAC;IAEF,+BAA+B;IAC/B,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,KAAK,CAAC;QACjD,+BAA+B;QAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,+BAA+B;QAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC;IAEF,4BAA4B;IAC5B,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC;KACjD,CAAC;IAEF,0BAA0B;IAC1B,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,eAAe,CAAC;QAC3D,8CAA8C;QAC9C,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KACxC,CAAC;IAEF,qBAAqB;IACrB,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,UAAU,CAAC;QACtD,4BAA4B;QAC5B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACrC,4BAA4B;QAC5B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpC,+BAA+B;QAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC7B,CAAC;CACH,CAAC,CAAC;AAGH,gFAAgF;AAChF,sEAAsE;AACtE,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAN,IAAY,sCAOX;AAPD,WAAY,sCAAsC;IAChD,qGAAqG;IACrG,qEAA2B,CAAA;IAC3B,mGAAmG;IACnG,uEAA6B,CAAA;IAC7B,uFAAuF;IACvF,uDAAa,CAAA;AACf,CAAC,EAPW,sCAAsC,KAAtC,sCAAsC,QAOjD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAN,IAAY,4BAYX;AAZD,WAAY,4BAA4B;IACtC;;;OAGG;IACH,6DAA6B,CAAA;IAC7B;;;;OAIG;IACH,yDAAyB,CAAA;AAC3B,CAAC,EAZW,4BAA4B,KAA5B,4BAA4B,QAYvC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,CAAN,IAAY,0CAKX;AALD,WAAY,0CAA0C;IACpD,2EAA2E;IAC3E,iEAAmB,CAAA;IACnB,wFAAwF;IACxF,2DAAa,CAAA;AACf,CAAC,EALW,0CAA0C,KAA1C,0CAA0C,QAKrD;AAED,4HAA4H;AAC5H;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC;SACvD,QAAQ,CAAC,uFAAuF,CAAC;IACpG,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,0CAA0C,CAAC;SAC3D,OAAO,CAAC,0CAA0C,CAAC,OAAO,CAAC;SAC3D,QAAQ,CAAC,yHAAyH,CAAC;CACvI,CAAC,CAAC;AAaH,MAAM,CAAC,MAAM,uCAAuC,GAAG,sCAAsC,CAAC,MAAM,CAAC;IACnG;;;OAGG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC3B,QAAQ,CAAC,oIAAoI,CAAC;IACjJ;;;;;;;;OAQG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACnC,QAAQ,CAAC,4IAA4I,CAAC;CAC1J,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,eAAe,GAAG,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW,CAAC;IACjG,IAAI,eAAe,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,EAAE,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,OAAO,EAAE,KAAK,MAAM,CAAC,UAAU,iCAAiC,MAAM,CAAC,UAAU,8DAA8D;SAChJ,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACrD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,OAAO,EAAE,mHAAmH;SAC7H,CAAC,CAAC;IACL,CAAC;IACD,IAAI,+BAA+B,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,IAAI,MAAM,CAAC,eAAe,KAAK,EAAE,EAAE,CAAC;YAC1E,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;gBACzB,OAAO,EAAE,oIAAoI;aAC9I,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAChD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EAAE,MAAM,CAAC,UAAU,KAAK,0CAA0C,CAAC,IAAI;gBAC5E,CAAC,CAAC,KAAK,MAAM,CAAC,UAAU,sGAAsG;sBAC1H,uEAAuE;gBAC3E,CAAC,CAAC,6KAA6K;SAClL,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AACH,0EAA0E;AAE1E;;;;;;GAMG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAAuC;IACrF,OAAO,KAAK,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW;WACzE,KAAK,CAAC,UAAU,KAAK,0CAA0C,CAAC,IAAI,CAAC;AAC5E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0CAA0C,CAAC,KAAuC;IAChG,OAAO,KAAK,CAAC,UAAU,KAAK,sCAAsC,CAAC,YAAY;WAC1E,KAAK,CAAC,UAAU,KAAK,0CAA0C,CAAC,IAAI,CAAC;AAC5E,CAAC","sourcesContent":["/*\n Security and Authentication Schemas for External Connectors\n * \n * This module defines authentication profiles that can be used across protocols.\n * It integrates with OAuth2 to avoid duplication between API auth and OAuth2 config.\n * \n * Architecture:\n * - ExternalProvider_Auth_Kind: The type of authentication\n * - ExternalProvider_AuthProfile: How to authenticate with an API\n * - OAuth2-linked profiles: Reference OAuth2 config instead of duplicating\n * \n * @see https://swagger.io/docs/specification/v3_0/authentication/\n /\n\nimport { z } from \"zod\";\nimport {\n OAuth2_GrantType,\n OAuth2_TokenEndpoint_AuthMethod,\n OAuth2_PKCE_Method,\n OAuth2_Prompt,\n OAuth2_AccessType,\n} from './oauth2.enums';\n\n// =============================================================================\n// AUTH KIND ENUM\n// =============================================================================\n\n/\n Authentication types supported by external providers\n * Follows OpenAPI 3.0 Security Schemes with extensions\n /\nexport enum ExternalProvider_Auth_Kind {\n /* No authentication required /\n NONE = \"none\",\n \n /* API Key in header, query, or cookie /\n API_KEY = \"api_key\",\n \n /* Bearer token (OAuth2 access token or JWT) /\n BEARER = \"bearer\",\n \n /* HTTP Basic authentication /\n BASIC = \"basic\",\n \n /* OAuth2 authentication - links to OAuth2 provider definition /\n OAUTH2 = \"oauth2\",\n \n /* HMAC signature-based authentication /\n HMAC_SIGNATURE = \"hmac_signature\",\n \n /* OpenID Connect (OAuth2 + identity layer) /\n OPENID_CONNECT = \"openid_connect\",\n \n /* Mutual TLS (client certificates) /\n MUTUAL_TLS = \"mutual_tls\",\n \n /* Frontend-specific secret (not exposed to user) /\n FRONTEND_SECRET = \"frontend_secret\",\n}\n\n// =============================================================================\n// AUTH CONFIGURATION ENUMS\n// =============================================================================\n\nexport enum ExternalProvider_Auth_ApiKey_Location {\n HEADER = \"header\",\n QUERY = \"query\",\n COOKIE = \"cookie\",\n}\n\nexport enum ExternalProvider_Auth_HMAC_Signature_Algorithm {\n SHA256 = \"sha256\",\n SHA512 = \"sha512\",\n}\n\nexport enum ExternalProvider_Auth_Bearer_Format {\n JWT = \"jwt\",\n API_KEY = \"api_key\",\n OAUTH2_ACCESS_TOKEN = \"oauth2_access_token\",\n}\n\n// =============================================================================\n// AUTH CONFIGURATION SCHEMA\n// =============================================================================\n\n/\n Auth Configuration - references a secret\n * This is the runtime configuration that specifies which secret to use\n /\nexport const ExternalProvider_Auth_ConfigurationSchema = z.object({\n /* Type of authentication /\n authKind: z.enum(ExternalProvider_Auth_Kind),\n \n /* References to auth profiles this config applies to /\n profileRefs: z.array(z.string()).optional(),\n \n /* Is this the default auth for the provider? /\n isDefault: z.boolean().optional(),\n \n /* Reference to the secret (environment variable name or secret store key) /\n secretRef: z.string(),\n});\n\n// =============================================================================\n// RATE LIMIT CONFIGURATION\n// =============================================================================\n\nexport const ExternalProvider_RateLimitConfigurationSchema = z.object({\n /* Maximum concurrent requests /\n maxConcurrent: z.number().positive().optional().default(10),\n \n /* Minimum time (ms) between requests /\n minTime: z.number().positive().optional(),\n \n /* Request reservoir (bucket size) /\n reservoir: z.number().positive().optional(),\n \n /* Reservoir refresh interval (ms) /\n reservoirRefreshInterval: z.number().positive().optional(),\n \n /* Amount to add to reservoir on refresh /\n reservoirRefreshAmount: z.number().positive().optional(),\n \n /* Request priority (higher = higher priority) /\n priority: z.number().int().optional().default(0),\n});\n\n// =============================================================================\n// AUTH PROFILE BASE SCHEMA\n// =============================================================================\n\nexport const ExternalProvider_AuthProfile_BaseSchema = z.object({\n /* Type of authentication /\n kind: z.enum(ExternalProvider_Auth_Kind),\n \n /* Unique reference for this auth profile /\n ref: z.string().optional(),\n \n /* Is this the default auth profile? /\n isDefault: z.boolean().default(false),\n \n /* Where to place the authentication (header, query, cookie) /\n location: z.enum(ExternalProvider_Auth_ApiKey_Location).default(ExternalProvider_Auth_ApiKey_Location.HEADER),\n \n /* Field name for the authentication /\n locationField: z.string().default(\"Authorization\"),\n});\n\n// =============================================================================\n// INFERRED BASE TYPES\n// =============================================================================\n\nexport type ExternalProvider_RateLimitConfiguration = z.infer<typeof ExternalProvider_RateLimitConfigurationSchema>;\nexport type ExternalProvider_AuthProfile_Base = z.infer<typeof ExternalProvider_AuthProfile_BaseSchema>;\n\n// =============================================================================\n// DISCRIMINATED AUTH PROFILE SCHEMAS\n// =============================================================================\n\n/\n Complete Auth Profile Schema - discriminated union by kind\n * Each kind has specific configuration fields\n /\nexport const ExternalProvider_AuthProfile_Schema = z.discriminatedUnion(\"kind\", [\n // ─── API Key Authentication ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.API_KEY),\n locationField: z.string().default(\"Authorization\"),\n /* Prefix before the key value (e.g., \"Api-Key \") /\n prefix: z.string().optional(),\n }),\n \n // ─── HMAC Signature Authentication ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.HMAC_SIGNATURE),\n locationField: z.string().default(\"X-Signature\"),\n /* HMAC algorithm /\n algorithm: z.enum(ExternalProvider_Auth_HMAC_Signature_Algorithm).default(ExternalProvider_Auth_HMAC_Signature_Algorithm.SHA256),\n /* What data to sign (body, timestamp, etc.) /\n signaturePayload: z.enum(['body', 'timestamp', 'custom']).optional(),\n /* Timestamp header name (if needed) /\n timestampHeader: z.string().optional(),\n /* Nonce header name (if needed for replay protection) /\n nonceHeader: z.string().optional(),\n }),\n \n // ─── Bearer Token Authentication ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.BEARER),\n location: z.enum(ExternalProvider_Auth_ApiKey_Location).default(ExternalProvider_Auth_ApiKey_Location.HEADER),\n locationField: z.string().default(\"Authorization\"),\n /* Prefix (usually \"Bearer \") /\n prefix: z.string().default(\"Bearer \"),\n /* Token format /\n format: z.enum(ExternalProvider_Auth_Bearer_Format).default(ExternalProvider_Auth_Bearer_Format.JWT),\n }),\n \n // ─── OpenID Connect Authentication ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.OPENID_CONNECT),\n /* OIDC Discovery URL /\n discoveryUrl: z.url().optional(),\n /* Issuer /\n issuer: z.string().optional(),\n /* Expected audience /\n audience: z.string().optional(),\n /* Token validation mode /\n validationMode: z.enum(['jwks', 'introspection', 'local']).optional(),\n }),\n \n // ─── OAuth2 Authentication (UNIFIED APPROACH) ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.OAUTH2),\n \n // ─── OAuth2 Provider Reference (Unified Approach) ───\n /\n Reference to OAuth2 provider definition\n * Instead of duplicating OAuth2 config, reference the provider\n * by its string identifier (e.g., \"google\", \"microsoft\")\n /\n oauth2ProviderRef: z.string().optional(),\n \n // ─── Inline OAuth2 Configuration (Legacy/Override) ───\n /* Authorization URL (can be overridden or used when no ref) /\n authUrl: z.url().optional(),\n /* Token URL /\n tokenUrl: z.url().optional(),\n /* Refresh URL (if different from tokenUrl) /\n refreshUrl: z.url().optional(),\n \n /* Required scopes for this auth profile /\n scopes: z.array(z.string()).optional(),\n \n /* Preferred grant type /\n grantType: z.enum(OAuth2_GrantType).optional(),\n \n /* Token endpoint auth method /\n tokenEndpointAuthMethod: z.enum(OAuth2_TokenEndpoint_AuthMethod).optional(),\n \n /* PKCE support /\n pkce: z.boolean().optional(),\n /* PKCE method /\n pkceMethod: z.enum(OAuth2_PKCE_Method).optional(),\n \n /* Prompt behavior /\n prompt: z.enum(OAuth2_Prompt).optional(),\n \n /* Access type (online/offline) /\n accessType: z.enum(OAuth2_AccessType).optional(),\n \n /* Extra authorization parameters /\n extraAuthParams: z.record(z.string(), z.string()).optional(),\n \n /* Extra token parameters /\n extraTokenParams: z.record(z.string(), z.string()).optional(),\n \n // ─── Token Format (for API calls) ───\n /* How to format the token in Authorization header /\n tokenFormat: z.enum(['bearer', 'token', 'oauth', 'custom']).default('bearer'),\n /* Custom prefix if tokenFormat is 'custom' /\n customTokenPrefix: z.string().optional(),\n }),\n \n // ─── Basic Authentication ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.BASIC),\n /* Username field reference /\n usernameRef: z.string().optional(),\n /* Password field reference /\n passwordRef: z.string().optional(),\n }),\n \n // ─── No Authentication ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.NONE),\n }),\n \n // ─── Frontend Secret ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.FRONTEND_SECRET),\n /* Secret is only used in frontend context /\n frontendOnly: z.boolean().default(true),\n }),\n \n // ─── Mutual TLS ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.MUTUAL_TLS),\n /* Certificate reference /\n certificateRef: z.string().optional(),\n /* Private key reference /\n privateKeyRef: z.string().optional(),\n /* CA certificate reference /\n caRef: z.string().optional(),\n }),\n]);\nexport type ExternalProvider_AuthProfile = z.infer<typeof ExternalProvider_AuthProfile_Schema>;\n\n// =============================================================================\n// CONNECTION IDENTITY — whose account, on whose behalf, and which one\n// =============================================================================\n\n/\n WHOSE ACCOUNT a call spends.\n \n Distinct from the scope of the DATA the call touches, and conflating the two inverts the design.\n * A billing provider is APPLICATION-owned — the payment account belongs to whoever ships the\n * application — even though almost everything it produces is organization-shaped: a customer, a\n * subscription, an invoice per tenant. Those are data in the application's own domain, produced by\n * an application-owned account. The question here is never \"does this touch organizations?\", which\n * is true of nearly everything. It is whose account is it?\n \n Delivery follows the owner and is not a separate decision: the APPLICATION's material is authored\n * in the deployment environment by an operator, and an ORGANIZATION's or a USER's is authored\n * through the application's own settings and stored, sealed, in its database.\n \n No owner ever defaults to another. An organization-owned call with no connection REFUSES; it\n * never spends the application's account. A silent substitution means the vendor sees one identity\n * while the application believes it acted as another, and every artifact the call leaves on the far\n * side — a message, a record, a line in the vendor's own audit log — is then attributed to the wrong\n * party, with nothing downstream able to detect it. An application that wants \"the tenant's key when\n * they have connected one, otherwise ours\" expresses that in its own code by choosing which\n * connection to call with, where the choice is visible.\n /\nexport enum ExternalProvider_Connection_OwnerScope {\n /* The account belongs to the application itself. Material comes from the deployment environment. /\n APPLICATION = \"application\",\n /* The account belongs to one tenant — its own workspace, its own subscription with the vendor. /\n ORGANIZATION = \"organization\",\n /* The account belongs to one person — a personal key they authored for themselves. /\n USER = \"user\",\n}\n\n/\n WHAT A DECLARED SECRET IDENTIFIES — the integration, or the account.\n \n A provider's `secretsContract` holds two kinds of thing and, until this existed, marked neither.\n * Slack's contract is the clearest case: `SLACK_CLIENT_ID` and `SLACK_CLIENT_SECRET` identify the\n * APPLICATION's registration with Slack, while `SLACK_API_KEY` holds a token that identifies WHOSE\n * Slack account is being acted as. They are stored differently, rotated for different reasons, and\n * owned by different parties, and one undifferentiated map made all three look alike.\n \n Deliberately ORTHOGONAL to {@link ExternalProvider_Connection_OwnerScope}, which is the axis it is\n * most likely to be confused with. This says what a secret IS; that says whose it is. A billing\n * provider's secret key is a CREDENTIAL — it identifies an account — and is nonetheless\n * application-owned, because the only admissible connection for it is APPLICATION. Collapsing the\n * two would make \"the deployment owns this\" and \"this identifies an integration\" the same\n * statement, and they are not.\n \n What the distinction buys, concretely:\n \n - a credential row owned by a tenant or a person may hold a CREDENTIAL and never a REGISTRATION.\n * Without the mark, nothing stopped a tenant storing a row slugged `SLACK_CLIENT_SECRET` that no\n * reader would ever consult — inert, and indistinguishable from a working connection on screen;\n * - the connect flow can derive WHICH slug a grant is stored under by construction, rather than\n * by the convention that it happens to be the REST contract's `apiKey.secretRef`;\n * - a vendor that supports per-tenant app registrations becomes SAYABLE, which it is not today.\n /\nexport enum ExternalProvider_SecretScope {\n /\n Identifies the INTEGRATION — an OAuth2 client id and secret, a signing secret issued to the\n * app's registration. Authored by the operator in the deployment environment.\n /\n REGISTRATION = \"registration\",\n /\n Identifies an ACCOUNT — a token or key standing for whoever is being acted as. May be authored\n * in the environment (the deployment's own account) or minted into a credential row owned by a\n * tenant or a person; which of those are permitted is the admissibility question, not this one.\n /\n CREDENTIAL = \"credential\",\n}\n\n/\n ON WHOSE BEHALF the act is performed — orthogonal to who owns the account.\n \n These are two questions and every combination of them is real, which is why they are two enums\n * rather than one. An application's service identity can impersonate a user (domain-wide\n * delegation); a tenant's own registration can mint a token that acts for one of its members; a\n * tenant's bot token acts as nobody in particular. Collapsing the pair into a single vocabulary\n * makes most of those unsayable:\n \n \| owner × delegation \| the real case \|\n * \|---\|---\|\n * \| APPLICATION × SERVICE \| a platform API key \|\n * \| APPLICATION × USER \| the application's service identity impersonating a user \|\n * \| ORGANIZATION × SERVICE \| the tenant's own bot or workspace token \|\n * \| ORGANIZATION × USER \| ONE member's own account, linked for the whole organization \|\n * \| USER × SERVICE \| a person's own account, for that person \|\n \n ## `ORGANIZATION × USER`, decided 2026-09-12 (Paul, recorded on wildo-ai/wildo-ai#18)\n \n A member connects THEIR OWN vendor account on the organization's behalf — the common pattern that\n * lets a tenant integrate without a service account. There is ONE grant per organization, and every\n * member's call spends it transparently. The member who links it carries the responsibility for\n * that: they are trusting their colleagues' activity with their account, they ACKNOWLEDGE it when\n * they link, and that acknowledgement is the whole control — no per-call gate. What the audit trail\n * must then say, on every call, is WHOSE account was spent: the member who linked it.\n \n So the person behind this shape is fixed by the GRANT, not by the call, which is why a call never\n * names `actingForUserId` for it. The rejected readings are worth keeping: per-member grants keyed\n * `(organization, member)` is a real model and not what this shape means here; and requiring the\n * call to name the linking member would stop every other member using a grant that exists to be\n * shared. A person's connection for themselves is the USER-owned row.\n \n OAuth 2.0 carries the same split in its grant types: the client is the REGISTRATION, and the grant\n * decides on whose behalf a token is minted.\n /\nexport enum ExternalProvider_Connection_DelegationMode {\n /* The call acts as the account's owner, with no third party behind it. /\n SERVICE = \"service\",\n /* The call acts for a named user, whose authorization is what makes it permissible. /\n USER = \"user\",\n}\n\n/* @wildo_source:part:start external-connectors.models.connection-target facet:layer:shared facet:audience:app-developer /\n/\n WHICH owner instance a single call spends — supplied BY THE CALL, never read from ambient context.\n \n This is the field's hardest constraint to get right and the reason it is a parameter rather than a\n * property of the execution. `ExecutionContext.initiatorIds` answers WHO is performing the operation\n * and `contextResourcesFieldIdentifier` answers WHICH ROWS are in scope; neither answers whose\n * account is being spent, and a design that borrows either is wrong for a case that is entirely\n * ordinary: one user action fanning out a message to every organization the user belongs to. One\n * initiator, one execution, N organizations, a different account per call. An ambient answer cannot\n * vary within one execution, so it cannot express that at all.\n \n The initiator is still decisive — as the AUTHORIZATION input. The call names the owner and the\n * runtime asks whether this initiator may act for it. Supplying and authorizing are different jobs,\n * and the resolver cannot verify a target it also invented.\n /\nexport const ExternalProvider_ConnectionShapeSchema = z.object({\n ownerScope: z.enum(ExternalProvider_Connection_OwnerScope)\n .describe('Who owns the provider account: the application itself, one organization, or one user.'),\n delegation: z.enum(ExternalProvider_Connection_DelegationMode)\n .default(ExternalProvider_Connection_DelegationMode.SERVICE)\n .describe('On whose behalf calls act: `service` acts as the account owner itself, `user` acts for a person. Defaults to `service`.'),\n});\n\n/\n A connection COMBINATION, with no instance attached — what a provider ADMITS.\n \n The capability and the call are the same two axes and different objects, which is why this is a\n * separate schema rather than the target with its identifiers made optional. A provider admitting\n * `ORGANIZATION × USER` says nothing about which organization; a call naming no organization is\n * incomplete. Making one schema serve both would have to relax exactly the refinements that make the\n * call safe.\n /\nexport type ExternalProvider_ConnectionShape = z.infer<typeof ExternalProvider_ConnectionShapeSchema>;\n\nexport const ExternalProvider_ConnectionTargetSchema = ExternalProvider_ConnectionShapeSchema.extend({\n /\n The organization or user whose account is spent. Absent for APPLICATION, which has exactly one\n * instance by construction — an id there would be a second name for the deployment.\n /\n ownerId: z.string().optional()\n .describe('The id of the organization or user that owns the account. Required for an organization or user owner; omit it for the application.'),\n /\n The user an APPLICATION-owned, USER-delegated call impersonates — the ONLY shape where the call\n * itself must say who, because the application's identity could impersonate anyone.\n \n Refused everywhere else. An ORGANIZATION-owned USER-delegated connection spends the account of\n * the member who LINKED it, whoever triggers the call (see the decision above), so a person named\n * here would describe an identity the runtime will not act as. A USER-owned connection already\n * names its person in `ownerId`.\n /\n actingForUserId: z.string().optional()\n .describe('The user an application-owned account acts for: required when `ownerScope` is `application` and `delegation` is `user`, refused otherwise.'),\n}).superRefine((target, ctx) => {\n const ownerIsInstance = target.ownerScope !== ExternalProvider_Connection_OwnerScope.APPLICATION;\n if (ownerIsInstance && (target.ownerId === undefined \|\| target.ownerId === '')) {\n ctx.addIssue({\n code: 'custom',\n path: ['ownerId'],\n message: `A ${target.ownerScope}-owned connection names WHICH ${target.ownerScope}; a call that omits it has not said whose account it spends.`,\n });\n }\n if (!ownerIsInstance && target.ownerId !== undefined) {\n ctx.addIssue({\n code: 'custom',\n path: ['ownerId'],\n message: 'An application-owned connection has exactly one instance, so an ownerId here names something that does not exist.',\n });\n }\n if (connectionTargetNamesActingUser(target)) {\n if (target.actingForUserId === undefined \|\| target.actingForUserId === '') {\n ctx.addIssue({\n code: 'custom',\n path: ['actingForUserId'],\n message: 'An application-owned delegated call impersonates someone, and who is what makes it permissible — it cannot be left to be inferred.',\n });\n }\n } else if (target.actingForUserId !== undefined) {\n ctx.addIssue({\n code: 'custom',\n path: ['actingForUserId'],\n message: target.delegation === ExternalProvider_Connection_DelegationMode.USER\n ? `A ${target.ownerScope}-owned connection's person is fixed by the account itself — the member who linked it, or the owner. `\n + 'Naming a user here describes an identity the runtime will not act as.'\n : 'A SERVICE call acts for nobody. Naming a user here reads as delegation the runtime will not perform, which is worse than an error: the call succeeds as the wrong identity.',\n });\n }\n});\n/* @wildo_source:part:end external-connectors.models.connection-target /\n\n/\n Whether a connection target must NAME the user it acts for — true only for APPLICATION × USER.\n \n One predicate rather than a condition restated at each builder: the target schema, the HTTP-API\n * binding's target builder and the connect panel all ask this question, and three spellings of it\n * are how a target comes to carry a person the refinement then refuses.\n /\nexport function connectionTargetNamesActingUser(shape: ExternalProvider_ConnectionShape): boolean {\n return shape.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION\n && shape.delegation === ExternalProvider_Connection_DelegationMode.USER;\n}\n\n/\n Whether linking this connection lends ONE member's own account to their whole organization —\n * true only for ORGANIZATION × USER.\n \n The member who links such a connection is trusting every colleague's activity with their account,\n * so the connect surface asks them to ACKNOWLEDGE it and the connect leg refuses a link that did not\n * (decision on wildo-ai/wildo-ai#18). One predicate for the panel that shows the acknowledgement and\n * the controller that requires it, so the two cannot come to disagree about which links owe one.\n */\nexport function connectionLendsMemberAccountToOrganization(shape: ExternalProvider_ConnectionShape): boolean {\n return shape.ownerScope === ExternalProvider_Connection_OwnerScope.ORGANIZATION\n && shape.delegation === ExternalProvider_Connection_DelegationMode.USER;\n}\n\nexport type ExternalProvider_ConnectionTarget = z.infer<typeof ExternalProvider_ConnectionTargetSchema>;\n"]}
1	+ {"version":3,"file":"security.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../src/core/security.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,+BAA+B,EAC/B,kBAAkB,EAClB,aAAa,EACb,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAExB,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAN,IAAY,0BA2BX;AA3BD,WAAY,0BAA0B;IACpC,iCAAiC;IACjC,2CAAa,CAAA;IAEb,0CAA0C;IAC1C,iDAAmB,CAAA;IAEnB,gDAAgD;IAChD,+CAAiB,CAAA;IAEjB,gCAAgC;IAChC,6CAAe,CAAA;IAEf,kEAAkE;IAClE,+CAAiB,CAAA;IAEjB,0CAA0C;IAC1C,+DAAiC,CAAA;IAEjC,+CAA+C;IAC/C,+DAAiC,CAAA;IAEjC,uCAAuC;IACvC,uDAAyB,CAAA;IAEzB,qDAAqD;IACrD,iEAAmC,CAAA;AACrC,CAAC,EA3BW,0BAA0B,KAA1B,0BAA0B,QA2BrC;AAED,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,MAAM,CAAN,IAAY,qCAIX;AAJD,WAAY,qCAAqC;IAC/C,0DAAiB,CAAA;IACjB,wDAAe,CAAA;IACf,0DAAiB,CAAA;AACnB,CAAC,EAJW,qCAAqC,KAArC,qCAAqC,QAIhD;AAED,MAAM,CAAN,IAAY,8CAGX;AAHD,WAAY,8CAA8C;IACxD,mEAAiB,CAAA;IACjB,mEAAiB,CAAA;AACnB,CAAC,EAHW,8CAA8C,KAA9C,8CAA8C,QAGzD;AAED,MAAM,CAAN,IAAY,mCAIX;AAJD,WAAY,mCAAmC;IAC7C,kDAAW,CAAA;IACX,0DAAmB,CAAA;IACnB,kFAA2C,CAAA;AAC7C,CAAC,EAJW,mCAAmC,KAAnC,mCAAmC,QAI9C;AAED,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,6BAA6B;IAC7B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAE5C,yDAAyD;IACzD,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE3C,iDAAiD;IACjD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEjC,8EAA8E;IAC9E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,CAAC,MAAM,CAAC;IACpE,kCAAkC;IAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE3D,yCAAyC;IACzC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAEzC,sCAAsC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE3C,sCAAsC;IACtC,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE1D,4CAA4C;IAC5C,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAExD,kDAAkD;IAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;CACjD,CAAC,CAAC;AAEH,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9D,6BAA6B;IAC7B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAExC,6CAA6C;IAC7C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1B,wCAAwC;IACxC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAErC,gEAAgE;IAChE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,MAAM,CAAC;IAE7G,wCAAwC;IACxC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;CACnD,CAAC,CAAC;AASH,gFAAgF;AAChF,qCAAqC;AACrC,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC9E,iCAAiC;IACjC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,OAAO,CAAC;QACnD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;QAClD,qDAAqD;QACrD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC;IAEF,wCAAwC;IACxC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,cAAc,CAAC;QAC1D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;QAChD,qBAAqB;QACrB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC,OAAO,CAAC,8CAA8C,CAAC,MAAM,CAAC;QAChI,gDAAgD;QAChD,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;QACpE,wCAAwC;QACxC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACtC,0DAA0D;QAC1D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC;IAEF,sCAAsC;IACtC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,MAAM,CAAC;QAClD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,MAAM,CAAC;QAC7G,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;QAClD,iCAAiC;QACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACrC,mBAAmB;QACnB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC,OAAO,CAAC,mCAAmC,CAAC,GAAG,CAAC;KACrG,CAAC;IAEF,wCAAwC;IACxC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,cAAc,CAAC;QAC1D,yBAAyB;QACzB,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAChC,aAAa;QACb,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,wBAAwB;QACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,4BAA4B;QAC5B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;KACtE,CAAC;IAEF,mDAAmD;IACnD,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,MAAM,CAAC;QAElD,uDAAuD;QACvD;;;;WAIG;QACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAExC,wDAAwD;QACxD,gEAAgE;QAChE,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC3B,gBAAgB;QAChB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC5B,+CAA+C;QAC/C,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAE9B,4CAA4C;QAC5C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAEtC,2BAA2B;QAC3B,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;QAE9C,iCAAiC;QACjC,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,QAAQ,EAAE;QAE3E,mBAAmB;QACnB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC5B,kBAAkB;QAClB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;QAEjD,sBAAsB;QACtB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;QAExC,mCAAmC;QACnC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;QAEhD,qCAAqC;QACrC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAE5D,6BAA6B;QAC7B,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAE7D,uCAAuC;QACvC,sDAAsD;QACtD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC7E,+CAA+C;QAC/C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACzC,CAAC;IAEF,+BAA+B;IAC/B,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,KAAK,CAAC;QACjD,+BAA+B;QAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,+BAA+B;QAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC;IAEF,4BAA4B;IAC5B,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC;KACjD,CAAC;IAEF,0BAA0B;IAC1B,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,eAAe,CAAC;QAC3D,8CAA8C;QAC9C,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KACxC,CAAC;IAEF,qBAAqB;IACrB,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,UAAU,CAAC;QACtD,4BAA4B;QAC5B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACrC,4BAA4B;QAC5B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpC,+BAA+B;QAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC7B,CAAC;CACH,CAAC,CAAC;AAGH,gFAAgF;AAChF,sEAAsE;AACtE,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAN,IAAY,sCAOX;AAPD,WAAY,sCAAsC;IAChD,qGAAqG;IACrG,qEAA2B,CAAA;IAC3B,mGAAmG;IACnG,uEAA6B,CAAA;IAC7B,uFAAuF;IACvF,uDAAa,CAAA;AACf,CAAC,EAPW,sCAAsC,KAAtC,sCAAsC,QAOjD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAN,IAAY,4BAYX;AAZD,WAAY,4BAA4B;IACtC;;;OAGG;IACH,6DAA6B,CAAA;IAC7B;;;;OAIG;IACH,yDAAyB,CAAA;AAC3B,CAAC,EAZW,4BAA4B,KAA5B,4BAA4B,QAYvC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,CAAN,IAAY,0CAKX;AALD,WAAY,0CAA0C;IACpD,2EAA2E;IAC3E,iEAAmB,CAAA;IACnB,wFAAwF;IACxF,2DAAa,CAAA;AACf,CAAC,EALW,0CAA0C,KAA1C,0CAA0C,QAKrD;AAED,4HAA4H;AAC5H;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC;SACvD,QAAQ,CAAC,uFAAuF,CAAC;IACpG,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,0CAA0C,CAAC;SAC3D,OAAO,CAAC,0CAA0C,CAAC,OAAO,CAAC;SAC3D,QAAQ,CAAC,yHAAyH,CAAC;CACvI,CAAC,CAAC;AAaH,MAAM,CAAC,MAAM,uCAAuC,GAAG,sCAAsC,CAAC,MAAM,CAAC;IACnG;;;OAGG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC3B,QAAQ,CAAC,oIAAoI,CAAC;IACjJ;;;;;;;;OAQG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACnC,QAAQ,CAAC,4IAA4I,CAAC;CAC1J,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,eAAe,GAAG,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW,CAAC;IACjG,IAAI,eAAe,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,EAAE,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,OAAO,EAAE,KAAK,MAAM,CAAC,UAAU,iCAAiC,MAAM,CAAC,UAAU,8DAA8D;SAChJ,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACrD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,OAAO,EAAE,mHAAmH;SAC7H,CAAC,CAAC;IACL,CAAC;IACD,IAAI,+BAA+B,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,IAAI,MAAM,CAAC,eAAe,KAAK,EAAE,EAAE,CAAC;YAC1E,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;gBACzB,OAAO,EAAE,oIAAoI;aAC9I,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAChD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EAAE,MAAM,CAAC,UAAU,KAAK,0CAA0C,CAAC,IAAI;gBAC5E,CAAC,CAAC,KAAK,MAAM,CAAC,UAAU,sGAAsG;sBAC1H,uEAAuE;gBAC3E,CAAC,CAAC,6KAA6K;SAClL,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AACH,0EAA0E;AAE1E;;;;;;GAMG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAAuC;IACrF,OAAO,KAAK,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW;WACzE,KAAK,CAAC,UAAU,KAAK,0CAA0C,CAAC,IAAI,CAAC;AAC5E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0CAA0C,CAAC,KAAuC;IAChG,OAAO,KAAK,CAAC,UAAU,KAAK,sCAAsC,CAAC,YAAY;WAC1E,KAAK,CAAC,UAAU,KAAK,0CAA0C,CAAC,IAAI,CAAC;AAC5E,CAAC","sourcesContent":["/*\n Security and Authentication Schemas for External Connectors\n * \n * This module defines authentication profiles that can be used across protocols.\n * It integrates with OAuth2 to avoid duplication between API auth and OAuth2 config.\n * \n * Architecture:\n * - ExternalProvider_Auth_Kind: The type of authentication\n * - ExternalProvider_AuthProfile: How to authenticate with an API\n * - OAuth2-linked profiles: Reference OAuth2 config instead of duplicating\n * \n * @see https://swagger.io/docs/specification/v3_0/authentication/\n /\n\nimport { z } from \"zod\";\nimport {\n OAuth2_GrantType,\n OAuth2_TokenEndpoint_AuthMethod,\n OAuth2_PKCE_Method,\n OAuth2_Prompt,\n OAuth2_AccessType,\n} from './oauth2.enums';\n\n// =============================================================================\n// AUTH KIND ENUM\n// =============================================================================\n\n/\n Authentication types supported by external providers\n * Follows OpenAPI 3.0 Security Schemes with extensions\n /\nexport enum ExternalProvider_Auth_Kind {\n /* No authentication required /\n NONE = \"none\",\n \n /* API Key in header, query, or cookie /\n API_KEY = \"api_key\",\n \n /* Bearer token (OAuth2 access token or JWT) /\n BEARER = \"bearer\",\n \n /* HTTP Basic authentication /\n BASIC = \"basic\",\n \n /* OAuth2 authentication - links to OAuth2 provider definition /\n OAUTH2 = \"oauth2\",\n \n /* HMAC signature-based authentication /\n HMAC_SIGNATURE = \"hmac_signature\",\n \n /* OpenID Connect (OAuth2 + identity layer) /\n OPENID_CONNECT = \"openid_connect\",\n \n /* Mutual TLS (client certificates) /\n MUTUAL_TLS = \"mutual_tls\",\n \n /* Frontend-specific secret (not exposed to user) /\n FRONTEND_SECRET = \"frontend_secret\",\n}\n\n// =============================================================================\n// AUTH CONFIGURATION ENUMS\n// =============================================================================\n\nexport enum ExternalProvider_Auth_ApiKey_Location {\n HEADER = \"header\",\n QUERY = \"query\",\n COOKIE = \"cookie\",\n}\n\nexport enum ExternalProvider_Auth_HMAC_Signature_Algorithm {\n SHA256 = \"sha256\",\n SHA512 = \"sha512\",\n}\n\nexport enum ExternalProvider_Auth_Bearer_Format {\n JWT = \"jwt\",\n API_KEY = \"api_key\",\n OAUTH2_ACCESS_TOKEN = \"oauth2_access_token\",\n}\n\n// =============================================================================\n// AUTH CONFIGURATION SCHEMA\n// =============================================================================\n\n/\n Auth Configuration - references a secret\n * This is the runtime configuration that specifies which secret to use\n /\nexport const ExternalProvider_Auth_ConfigurationSchema = z.object({\n /* Type of authentication /\n authKind: z.enum(ExternalProvider_Auth_Kind),\n \n /* References to auth profiles this config applies to /\n profileRefs: z.array(z.string()).optional(),\n \n /* Is this the default auth for the provider? /\n isDefault: z.boolean().optional(),\n \n /* Reference to the secret (environment variable name or secret store key) /\n secretRef: z.string(),\n});\n\n// =============================================================================\n// RATE LIMIT CONFIGURATION\n// =============================================================================\n\nexport const ExternalProvider_RateLimitConfigurationSchema = z.object({\n /* Maximum concurrent requests /\n maxConcurrent: z.number().positive().optional().default(10),\n \n /* Minimum time (ms) between requests /\n minTime: z.number().positive().optional(),\n \n /* Request reservoir (bucket size) /\n reservoir: z.number().positive().optional(),\n \n /* Reservoir refresh interval (ms) /\n reservoirRefreshInterval: z.number().positive().optional(),\n \n /* Amount to add to reservoir on refresh /\n reservoirRefreshAmount: z.number().positive().optional(),\n \n /* Request priority (higher = higher priority) /\n priority: z.number().int().optional().default(0),\n});\n\n// =============================================================================\n// AUTH PROFILE BASE SCHEMA\n// =============================================================================\n\nexport const ExternalProvider_AuthProfile_BaseSchema = z.object({\n /* Type of authentication /\n kind: z.enum(ExternalProvider_Auth_Kind),\n \n /* Unique reference for this auth profile /\n ref: z.string().optional(),\n \n /* Is this the default auth profile? /\n isDefault: z.boolean().default(false),\n \n /* Where to place the authentication (header, query, cookie) /\n location: z.enum(ExternalProvider_Auth_ApiKey_Location).default(ExternalProvider_Auth_ApiKey_Location.HEADER),\n \n /* Field name for the authentication /\n locationField: z.string().default(\"Authorization\"),\n});\n\n// =============================================================================\n// INFERRED BASE TYPES\n// =============================================================================\n\nexport type ExternalProvider_RateLimitConfiguration = z.infer<typeof ExternalProvider_RateLimitConfigurationSchema>;\nexport type ExternalProvider_AuthProfile_Base = z.infer<typeof ExternalProvider_AuthProfile_BaseSchema>;\n\n// =============================================================================\n// DISCRIMINATED AUTH PROFILE SCHEMAS\n// =============================================================================\n\n/\n Complete Auth Profile Schema - discriminated union by kind\n * Each kind has specific configuration fields\n /\nexport const ExternalProvider_AuthProfile_Schema = z.discriminatedUnion(\"kind\", [\n // ─── API Key Authentication ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.API_KEY),\n locationField: z.string().default(\"Authorization\"),\n /* Prefix before the key value (e.g., \"Api-Key \") /\n prefix: z.string().optional(),\n }),\n \n // ─── HMAC Signature Authentication ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.HMAC_SIGNATURE),\n locationField: z.string().default(\"X-Signature\"),\n /* HMAC algorithm /\n algorithm: z.enum(ExternalProvider_Auth_HMAC_Signature_Algorithm).default(ExternalProvider_Auth_HMAC_Signature_Algorithm.SHA256),\n /* What data to sign (body, timestamp, etc.) /\n signaturePayload: z.enum(['body', 'timestamp', 'custom']).optional(),\n /* Timestamp header name (if needed) /\n timestampHeader: z.string().optional(),\n /* Nonce header name (if needed for replay protection) /\n nonceHeader: z.string().optional(),\n }),\n \n // ─── Bearer Token Authentication ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.BEARER),\n location: z.enum(ExternalProvider_Auth_ApiKey_Location).default(ExternalProvider_Auth_ApiKey_Location.HEADER),\n locationField: z.string().default(\"Authorization\"),\n /* Prefix (usually \"Bearer \") /\n prefix: z.string().default(\"Bearer \"),\n /* Token format /\n format: z.enum(ExternalProvider_Auth_Bearer_Format).default(ExternalProvider_Auth_Bearer_Format.JWT),\n }),\n \n // ─── OpenID Connect Authentication ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.OPENID_CONNECT),\n /* OIDC Discovery URL /\n discoveryUrl: z.url().optional(),\n /* Issuer /\n issuer: z.string().optional(),\n /* Expected audience /\n audience: z.string().optional(),\n /* Token validation mode /\n validationMode: z.enum(['jwks', 'introspection', 'local']).optional(),\n }),\n \n // ─── OAuth2 Authentication (UNIFIED APPROACH) ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.OAUTH2),\n \n // ─── OAuth2 Provider Reference (Unified Approach) ───\n /\n Reference to OAuth2 provider definition\n * Instead of duplicating OAuth2 config, reference the provider\n * by its string identifier (e.g., \"google\", \"microsoft\")\n /\n oauth2ProviderRef: z.string().optional(),\n \n // ─── Inline OAuth2 Configuration (Legacy/Override) ───\n /* Authorization URL (can be overridden or used when no ref) /\n authUrl: z.url().optional(),\n /* Token URL /\n tokenUrl: z.url().optional(),\n /* Refresh URL (if different from tokenUrl) /\n refreshUrl: z.url().optional(),\n \n /* Required scopes for this auth profile /\n scopes: z.array(z.string()).optional(),\n \n /* Preferred grant type /\n grantType: z.enum(OAuth2_GrantType).optional(),\n \n /* Token endpoint auth method /\n tokenEndpointAuthMethod: z.enum(OAuth2_TokenEndpoint_AuthMethod).optional(),\n \n /* PKCE support /\n pkce: z.boolean().optional(),\n /* PKCE method /\n pkceMethod: z.enum(OAuth2_PKCE_Method).optional(),\n \n /* Prompt behavior /\n prompt: z.enum(OAuth2_Prompt).optional(),\n \n /* Access type (online/offline) /\n accessType: z.enum(OAuth2_AccessType).optional(),\n \n /* Extra authorization parameters /\n extraAuthParams: z.record(z.string(), z.string()).optional(),\n \n /* Extra token parameters /\n extraTokenParams: z.record(z.string(), z.string()).optional(),\n \n // ─── Token Format (for API calls) ───\n /* How to format the token in Authorization header /\n tokenFormat: z.enum(['bearer', 'token', 'oauth', 'custom']).default('bearer'),\n /* Custom prefix if tokenFormat is 'custom' /\n customTokenPrefix: z.string().optional(),\n }),\n \n // ─── Basic Authentication ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.BASIC),\n /* Username field reference /\n usernameRef: z.string().optional(),\n /* Password field reference /\n passwordRef: z.string().optional(),\n }),\n \n // ─── No Authentication ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.NONE),\n }),\n \n // ─── Frontend Secret ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.FRONTEND_SECRET),\n /* Secret is only used in frontend context /\n frontendOnly: z.boolean().default(true),\n }),\n \n // ─── Mutual TLS ───\n ExternalProvider_AuthProfile_BaseSchema.extend({\n kind: z.literal(ExternalProvider_Auth_Kind.MUTUAL_TLS),\n /* Certificate reference /\n certificateRef: z.string().optional(),\n /* Private key reference /\n privateKeyRef: z.string().optional(),\n /* CA certificate reference /\n caRef: z.string().optional(),\n }),\n]);\nexport type ExternalProvider_AuthProfile = z.infer<typeof ExternalProvider_AuthProfile_Schema>;\n\n// =============================================================================\n// CONNECTION IDENTITY — whose account, on whose behalf, and which one\n// =============================================================================\n\n/\n WHOSE ACCOUNT a call spends.\n \n Distinct from the scope of the DATA the call touches, and conflating the two inverts the design.\n * A billing provider is APPLICATION-owned — the payment account belongs to whoever ships the\n * application — even though almost everything it produces is organization-shaped: a customer, a\n * subscription, an invoice per tenant. Those are data in the application's own domain, produced by\n * an application-owned account. The question here is never \"does this touch organizations?\", which\n * is true of nearly everything. It is whose account is it?\n \n Delivery follows the owner and is not a separate decision: the APPLICATION's material is authored\n * in the deployment environment by an operator, and an ORGANIZATION's or a USER's is authored\n * through the application's own settings and stored, sealed, in its database.\n \n No owner ever defaults to another. An organization-owned call with no connection REFUSES; it\n * never spends the application's account. A silent substitution means the vendor sees one identity\n * while the application believes it acted as another, and every artifact the call leaves on the far\n * side — a message, a record, a line in the vendor's own audit log — is then attributed to the wrong\n * party, with nothing downstream able to detect it. An application that wants \"the tenant's key when\n * they have connected one, otherwise ours\" expresses that in its own code by choosing which\n * connection to call with, where the choice is visible.\n /\nexport enum ExternalProvider_Connection_OwnerScope {\n /* The account belongs to the application itself. Material comes from the deployment environment. /\n APPLICATION = \"application\",\n /* The account belongs to one tenant — its own workspace, its own subscription with the vendor. /\n ORGANIZATION = \"organization\",\n /* The account belongs to one person — a personal key they authored for themselves. /\n USER = \"user\",\n}\n\n/\n WHAT A DECLARED SECRET IDENTIFIES — the integration, or the account.\n \n A provider's `secretsContract` holds two kinds of thing and, until this existed, marked neither.\n * Slack's contract is the clearest case: `SLACK_CLIENT_ID` and `SLACK_CLIENT_SECRET` identify the\n * APPLICATION's registration with Slack, while `SLACK_API_KEY` holds a token that identifies WHOSE\n * Slack account is being acted as. They are stored differently, rotated for different reasons, and\n * owned by different parties, and one undifferentiated map made all three look alike.\n \n Deliberately ORTHOGONAL to {@link ExternalProvider_Connection_OwnerScope}, which is the axis it is\n * most likely to be confused with. This says what a secret IS; that says whose it is. A billing\n * provider's secret key is a CREDENTIAL — it identifies an account — and is nonetheless\n * application-owned, because the only admissible connection for it is APPLICATION. Collapsing the\n * two would make \"the deployment owns this\" and \"this identifies an integration\" the same\n * statement, and they are not.\n \n What the distinction buys, concretely:\n \n - a credential row owned by a tenant or a person may hold a CREDENTIAL and never a REGISTRATION.\n * Without the mark, nothing stopped a tenant storing a row slugged `SLACK_CLIENT_SECRET` that no\n * reader would ever consult — inert, and indistinguishable from a working connection on screen;\n * - the connect flow can derive WHICH slug a grant is stored under by construction, rather than\n * by the convention that it happens to be the REST contract's `apiKey.secretRef`;\n * - a vendor that supports per-tenant app registrations becomes SAYABLE, which it is not today.\n /\nexport enum ExternalProvider_SecretScope {\n /\n Identifies the INTEGRATION — an OAuth2 client id and secret, a signing secret issued to the\n * app's registration. Authored by the operator in the deployment environment.\n /\n REGISTRATION = \"registration\",\n /\n Identifies an ACCOUNT — a token or key standing for whoever is being acted as. May be authored\n * in the environment (the deployment's own account) or minted into a credential row owned by a\n * tenant or a person; which of those are permitted is the admissibility question, not this one.\n /\n CREDENTIAL = \"credential\",\n}\n\n/\n ON WHOSE BEHALF the act is performed — orthogonal to who owns the account.\n \n These are two questions and every combination of them is real, which is why they are two enums\n * rather than one. An application's service identity can impersonate a user (domain-wide\n * delegation); a tenant's own registration can mint a token that acts for one of its members; a\n * tenant's bot token acts as nobody in particular. Collapsing the pair into a single vocabulary\n * makes most of those unsayable:\n \n \| owner × delegation \| the real case \|\n * \|---\|---\|\n * \| APPLICATION × SERVICE \| a platform API key \|\n * \| APPLICATION × USER \| the application's service identity impersonating a user \|\n * \| ORGANIZATION × SERVICE \| the tenant's own bot or workspace token \|\n * \| ORGANIZATION × USER \| ONE member's own account, linked for the whole organization \|\n * \| USER × SERVICE \| a person's own account, for that person \|\n \n ## `ORGANIZATION × USER`, decided 2026-09-12 (Paul, recorded on wildo-ai/wildo-ai#18)\n \n A member connects THEIR OWN vendor account on the organization's behalf — the common pattern that\n * lets a tenant integrate without a service account. There is ONE grant per organization, and every\n * member's call spends it transparently. The member who links it carries the responsibility for\n * that: they are trusting their colleagues' activity with their account, they ACKNOWLEDGE it when\n * they link, and that acknowledgement is the whole control — no per-call gate. What the audit trail\n * must then say, on every call, is WHOSE account was spent: the member who linked it.\n \n So the person behind this shape is fixed by the GRANT, not by the call, which is why a call never\n * names `actingForUserId` for it. The rejected readings are worth keeping: per-member grants keyed\n * `(organization, member)` is a real model and not what this shape means here; and requiring the\n * call to name the linking member would stop every other member using a grant that exists to be\n * shared. A person's connection for themselves is the USER-owned row.\n \n OAuth 2.0 carries the same split in its grant types: the client is the REGISTRATION, and the grant\n * decides on whose behalf a token is minted.\n /\nexport enum ExternalProvider_Connection_DelegationMode {\n /* The call acts as the account's owner, with no third party behind it. /\n SERVICE = \"service\",\n /* The call acts for a named user, whose authorization is what makes it permissible. /\n USER = \"user\",\n}\n\n/* @wildo_source:part:start external-connectors.models.connection-target facet:layer:shared facet:audience:app-developer /\n/\n WHICH owner instance a single call spends — supplied BY THE CALL, never read from ambient context.\n \n This is the field's hardest constraint to get right and the reason it is a parameter rather than a\n * property of the execution. `ExecutionContext.initiatorIds` answers WHO is performing the operation\n * and `contextResourcesFieldIdentifier` answers WHICH ROWS are in scope; neither answers whose\n * account is being spent, and a design that borrows either is wrong for a case that is entirely\n * ordinary: one user action fanning out a message to every organization the user belongs to. One\n * initiator, one execution, N organizations, a different account per call. An ambient answer cannot\n * vary within one execution, so it cannot express that at all.\n \n The initiator is still decisive — as the AUTHORIZATION input. The call names the owner and the\n * runtime asks whether this initiator may act for it. Supplying and authorizing are different jobs,\n * and the resolver cannot verify a target it also invented.\n /\nexport const ExternalProvider_ConnectionShapeSchema = z.object({\n ownerScope: z.enum(ExternalProvider_Connection_OwnerScope)\n .describe('Who owns the provider account: the application itself, one organization, or one user.'),\n delegation: z.enum(ExternalProvider_Connection_DelegationMode)\n .default(ExternalProvider_Connection_DelegationMode.SERVICE)\n .describe('On whose behalf calls act: `service` acts as the account owner itself, `user` acts for a person. Defaults to `service`.'),\n});\n\n/\n A connection COMBINATION, with no instance attached — what a provider ADMITS.\n \n The capability and the call are the same two axes and different objects, which is why this is a\n * separate schema rather than the target with its identifiers made optional. A provider admitting\n * `ORGANIZATION × USER` says nothing about which organization; a call naming no organization is\n * incomplete. Making one schema serve both would have to relax exactly the refinements that make the\n * call safe.\n /\nexport type ExternalProvider_ConnectionShape = z.infer<typeof ExternalProvider_ConnectionShapeSchema>;\n\nexport const ExternalProvider_ConnectionTargetSchema = ExternalProvider_ConnectionShapeSchema.extend({\n /\n The organization or user whose account is spent. Absent for APPLICATION, which has exactly one\n * instance by construction — an id there would be a second name for the deployment.\n /\n ownerId: z.string().optional()\n .describe('The id of the organization or user that owns the account. Required for an organization or user owner; omit it for the application.'),\n /\n The user an APPLICATION-owned, USER-delegated call impersonates — the ONLY shape where the call\n * itself must say who, because the application's identity could impersonate anyone.\n \n Refused everywhere else. An ORGANIZATION-owned USER-delegated connection spends the account of\n * the member who LINKED it, whoever triggers the call (see the decision above), so a person named\n * here would describe an identity the runtime will not act as. A USER-owned connection already\n * names its person in `ownerId`.\n /\n actingForUserId: z.string().optional()\n .describe('The user an application-owned account acts for: required when `ownerScope` is `application` and `delegation` is `user`, refused otherwise.'),\n}).superRefine((target, ctx) => {\n const ownerIsInstance = target.ownerScope !== ExternalProvider_Connection_OwnerScope.APPLICATION;\n if (ownerIsInstance && (target.ownerId === undefined \|\| target.ownerId === '')) {\n ctx.addIssue({\n code: 'custom',\n path: ['ownerId'],\n message: `A ${target.ownerScope}-owned connection names WHICH ${target.ownerScope}; a call that omits it has not said whose account it spends.`,\n });\n }\n if (!ownerIsInstance && target.ownerId !== undefined) {\n ctx.addIssue({\n code: 'custom',\n path: ['ownerId'],\n message: 'An application-owned connection has exactly one instance, so an ownerId here names something that does not exist.',\n });\n }\n if (connectionTargetNamesActingUser(target)) {\n if (target.actingForUserId === undefined \|\| target.actingForUserId === '') {\n ctx.addIssue({\n code: 'custom',\n path: ['actingForUserId'],\n message: 'An application-owned delegated call impersonates someone, and who is what makes it permissible — it cannot be left to be inferred.',\n });\n }\n } else if (target.actingForUserId !== undefined) {\n ctx.addIssue({\n code: 'custom',\n path: ['actingForUserId'],\n message: target.delegation === ExternalProvider_Connection_DelegationMode.USER\n ? `A ${target.ownerScope}-owned connection's person is fixed by the account itself — the member who linked it, or the owner. `\n + 'Naming a user here describes an identity the runtime will not act as.'\n : 'A SERVICE call acts for nobody. Naming a user here reads as delegation the runtime will not perform, which is worse than an error: the call succeeds as the wrong identity.',\n });\n }\n});\n/* @wildo_source:part:end external-connectors.models.connection-target /\n\n/\n Whether a connection target must NAME the user it acts for — true only for APPLICATION × USER.\n \n One predicate rather than a condition restated at each builder: the target schema, the HTTP-API\n * binding's target builder and the connect panel all ask this question, and three spellings of it\n * are how a target comes to carry a person the refinement then refuses.\n /\nexport function connectionTargetNamesActingUser(shape: ExternalProvider_ConnectionShape): boolean {\n return shape.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION\n && shape.delegation === ExternalProvider_Connection_DelegationMode.USER;\n}\n\n/\n Whether linking this connection lends ONE member's own account to their whole organization —\n * true only for ORGANIZATION × USER.\n \n The member who links such a connection is trusting every colleague's activity with their account,\n * so the connect surface asks them to ACKNOWLEDGE it and the connect leg refuses a link that did not\n * (decision on wildo-ai/wildo-ai#18). One predicate for the panel that shows the acknowledgement and\n * the controller that requires it, so the two cannot come to disagree about which links owe one.\n */\nexport function connectionLendsMemberAccountToOrganization(shape: ExternalProvider_ConnectionShape): boolean {\n return shape.ownerScope === ExternalProvider_Connection_OwnerScope.ORGANIZATION\n && shape.delegation === ExternalProvider_Connection_DelegationMode.USER;\n}\n\nexport type ExternalProvider_ConnectionTarget = z.infer<typeof ExternalProvider_ConnectionTargetSchema>;\n"]}

package/dist/esm/index.d.ts CHANGED Viewed

@@ -5,6 +5,7 @@ export * from './protocols/hooks-capability.external-connectors-models.schemas';
 export * from './core/operation-classification.external-connectors-models.schemas';
 export * from './protocols/agent-client-protocol.external-connectors-models.schemas';
 export * from './protocols/content-safety.external-connectors-models.schemas';
+export * from './protocols/electronic-signature.external-connectors-models.schemas';
 export * from './protocols/document-extraction.external-connectors-models.schemas';
 export * from './protocols/email.external-connectors-models.schemas';
 export * from './protocols/email.standard-interface.schemas';
@@ -16,12 +17,17 @@ export * from './protocols/hooks.external-connectors-models.schemas';
 export * from './protocols/llm.external-connectors-models.schemas';
 export * from './protocols/oauth2.external-connectors-models.schemas';
 export * from './protocols/rest-operations.external-connectors-models.schemas';
+export * from './protocols/graphql-operations.external-connectors-models.schemas';
+export * from './protocols/service-account-token.external-connectors-models.schemas';
 export * from './protocols/provider-oauth2-token-endpoint-hosts.external-connectors-models';
+export * from './protocols/provider-connection-parameters.external-connectors-models';
+export * from './protocols/provider-vendor-registration.external-connectors-models';
 export * from './protocols/billing.standard-interface.schemas';
 export * from './protocols/file-storage.standard-interface';
 export * from './protocols/subject-erasure-effect.standard-interface';
 export * from './protocols/sms.external-connectors-models.schemas';
 export * from './protocols/sms.standard-interface.schemas';
+export * from './protocols/provider-configuration-authoring.external-connectors-models.schemas';
 export * from './protocols/oauth2-provider-assurance.definitions';
 export * from './protocols/oauth2-provider-assurance.schemas';
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["~~../../../~~src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mDAAmD,CAAC;AAClE,cAAc,oDAAoD,CAAC;AACnE,cAAc,sDAAsD,CAAC;AAKrE,cAAc,iEAAiE,CAAC;AAChF,cAAc,oEAAoE,CAAC;AAGnF,cAAc,sEAAsE,CAAC;AACrF,cAAc,+DAA+D,CAAC;AAC9E,cAAc,oEAAoE,CAAC;AACnF,cAAc,sDAAsD,CAAC;AACrE,cAAc,8CAA8C,CAAC;AAC7D,cAAc,sDAAsD,CAAC;AACrE,cAAc,2DAA2D,CAAC;AAC1E,cAAc,sDAAsD,CAAC;AACrE,cAAc,yDAAyD,CAAC;AACxE,cAAc,sDAAsD,CAAC;AACrE,cAAc,oDAAoD,CAAC;AACnE,cAAc,uDAAuD,CAAC;AACtE,cAAc,gEAAgE,CAAC;AAC/E,cAAc,6EAA6E,CAAC;AAC5F,cAAc,gDAAgD,CAAC;AAC/D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,uDAAuD,CAAC;AACtE,cAAc,oDAAoD,CAAC;AACnE,cAAc,4CAA4C,CAAC;~~AAI3D~~,cAAc,mDAAmD,CAAC;AAClE,cAAc,+CAA+C,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mDAAmD,CAAC;AAClE,cAAc,oDAAoD,CAAC;AACnE,cAAc,sDAAsD,CAAC;AAKrE,cAAc,iEAAiE,CAAC;AAChF,cAAc,oEAAoE,CAAC;AAGnF,cAAc,sEAAsE,CAAC;AACrF,cAAc,+DAA+D,CAAC;AAC9E,cAAc,qEAAqE,CAAC;AACpF,cAAc,oEAAoE,CAAC;AACnF,cAAc,sDAAsD,CAAC;AACrE,cAAc,8CAA8C,CAAC;AAC7D,cAAc,sDAAsD,CAAC;AACrE,cAAc,2DAA2D,CAAC;AAC1E,cAAc,sDAAsD,CAAC;AACrE,cAAc,yDAAyD,CAAC;AACxE,cAAc,sDAAsD,CAAC;AACrE,cAAc,oDAAoD,CAAC;AACnE,cAAc,uDAAuD,CAAC;AACtE,cAAc,gEAAgE,CAAC;AAC/E,cAAc,mEAAmE,CAAC;AAClF,cAAc,sEAAsE,CAAC;AACrF,cAAc,6EAA6E,CAAC;AAC5F,cAAc,uEAAuE,CAAC;AACtF,cAAc,qEAAqE,CAAC;AACpF,cAAc,gDAAgD,CAAC;AAC/D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,uDAAuD,CAAC;AACtE,cAAc,oDAAoD,CAAC;AACnE,cAAc,4CAA4C,CAAC;AAC3D,cAAc,iFAAiF,CAAC;AAIhG,cAAc,mDAAmD,CAAC;AAClE,cAAc,+CAA+C,CAAC"}

package/dist/esm/index.js CHANGED Viewed

@@ -9,6 +9,7 @@ export * from './core/operation-classification.external-connectors-models.schema
 // Protocols
 export * from './protocols/agent-client-protocol.external-connectors-models.schemas.js';
 export * from './protocols/content-safety.external-connectors-models.schemas.js';
+export * from './protocols/electronic-signature.external-connectors-models.schemas.js';
 export * from './protocols/document-extraction.external-connectors-models.schemas.js';
 export * from './protocols/email.external-connectors-models.schemas.js';
 export * from './protocols/email.standard-interface.schemas.js';
@@ -20,12 +21,17 @@ export * from './protocols/hooks.external-connectors-models.schemas.js';
 export * from './protocols/llm.external-connectors-models.schemas.js';
 export * from './protocols/oauth2.external-connectors-models.schemas.js';
 export * from './protocols/rest-operations.external-connectors-models.schemas.js';
+export * from './protocols/graphql-operations.external-connectors-models.schemas.js';
+export * from './protocols/service-account-token.external-connectors-models.schemas.js';
 export * from './protocols/provider-oauth2-token-endpoint-hosts.external-connectors-models.js';
+export * from './protocols/provider-connection-parameters.external-connectors-models.js';
+export * from './protocols/provider-vendor-registration.external-connectors-models.js';
 export * from './protocols/billing.standard-interface.schemas.js';
 export * from './protocols/file-storage.standard-interface.js';
 export * from './protocols/subject-erasure-effect.standard-interface.js';
 export * from './protocols/sms.external-connectors-models.schemas.js';
 export * from './protocols/sms.standard-interface.schemas.js';
+export * from './protocols/provider-configuration-authoring.external-connectors-models.schemas.js';
 export * from './protocols/oauth2-provider-assurance.definitions.js';
 export * from './protocols/oauth2-provider-assurance.schemas.js';
 //# sourceMappingURL=index.js.map

package/dist/esm/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["~~../../../~~src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mDAAmD,CAAC;AAClE,cAAc,oDAAoD,CAAC;AACnE,cAAc,sDAAsD,CAAC;AAErE,+FAA+F;AAC/F,+FAA+F;AAC/F,2FAA2F;AAC3F,cAAc,iEAAiE,CAAC;AAChF,cAAc,oEAAoE,CAAC;AAEnF,YAAY;AACZ,cAAc,sEAAsE,CAAC;AACrF,cAAc,+DAA+D,CAAC;AAC9E,cAAc,oEAAoE,CAAC;AACnF,cAAc,sDAAsD,CAAC;AACrE,cAAc,8CAA8C,CAAC;AAC7D,cAAc,sDAAsD,CAAC;AACrE,cAAc,2DAA2D,CAAC;AAC1E,cAAc,sDAAsD,CAAC;AACrE,cAAc,yDAAyD,CAAC;AACxE,cAAc,sDAAsD,CAAC;AACrE,cAAc,oDAAoD,CAAC;AACnE,cAAc,uDAAuD,CAAC;AACtE,cAAc,gEAAgE,CAAC;AAC/E,cAAc,6EAA6E,CAAC;AAC5F,cAAc,gDAAgD,CAAC;AAC/D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,uDAAuD,CAAC;AACtE,cAAc,oDAAoD,CAAC;AACnE,cAAc,4CAA4C,CAAC;~~AAI3D~~,cAAc,mDAAmD,CAAC;AAClE,cAAc,+CAA+C,CAAC","sourcesContent":["export * from './core/commons.external-connectors-models.schemas';\nexport * from './core/security.external-connectors-models.schemas';\nexport * from './core/operations.external-connectors-models.schemas';\n\n// Webhook capability contracts (adapter / handler / scope resolver) — consumed by the engine's\n// webhook pipeline. The former `features/` layer (capability enum, transformer interfaces) was\n// retired 2026-09-05 (#327): it re-stated `BUILTIN_PROVIDER_CAPABILITY` and had no reader.\nexport * from './protocols/hooks-capability.external-connectors-models.schemas';\nexport * from './core/operation-classification.external-connectors-models.schemas';\n\n// Protocols\nexport * from './protocols/agent-client-protocol.external-connectors-models.schemas';\nexport * from './protocols/content-safety.external-connectors-models.schemas';\nexport * from './protocols/document-extraction.external-connectors-models.schemas';\nexport * from './protocols/email.external-connectors-models.schemas';\nexport * from './protocols/email.standard-interface.schemas';\nexport * from './protocols/email-inbound.standard-interface.schemas';\nexport * from './protocols/embeddings.external-connectors-models.schemas';\nexport * from './protocols/image.external-connectors-models.schemas';\nexport * from './protocols/frontend.external-connectors-models.schemas';\nexport * from './protocols/hooks.external-connectors-models.schemas';\nexport * from './protocols/llm.external-connectors-models.schemas';\nexport * from './protocols/oauth2.external-connectors-models.schemas';\nexport * from './protocols/rest-operations.external-connectors-models.schemas';\nexport * from './protocols/provider-oauth2-token-endpoint-hosts.external-connectors-models';\nexport * from './protocols/billing.standard-interface.schemas';\nexport * from './protocols/file-storage.standard-interface';\nexport * from './protocols/subject-erasure-effect.standard-interface';\nexport * from './protocols/sms.external-connectors-models.schemas';\nexport * from './protocols/sms.standard-interface.schemas';\n\n\n\nexport * from './protocols/oauth2-provider-assurance.definitions';\nexport * from './protocols/oauth2-provider-assurance.schemas';\n"]}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mDAAmD,CAAC;AAClE,cAAc,oDAAoD,CAAC;AACnE,cAAc,sDAAsD,CAAC;AAErE,+FAA+F;AAC/F,+FAA+F;AAC/F,2FAA2F;AAC3F,cAAc,iEAAiE,CAAC;AAChF,cAAc,oEAAoE,CAAC;AAEnF,YAAY;AACZ,cAAc,sEAAsE,CAAC;AACrF,cAAc,+DAA+D,CAAC;AAC9E,cAAc,qEAAqE,CAAC;AACpF,cAAc,oEAAoE,CAAC;AACnF,cAAc,sDAAsD,CAAC;AACrE,cAAc,8CAA8C,CAAC;AAC7D,cAAc,sDAAsD,CAAC;AACrE,cAAc,2DAA2D,CAAC;AAC1E,cAAc,sDAAsD,CAAC;AACrE,cAAc,yDAAyD,CAAC;AACxE,cAAc,sDAAsD,CAAC;AACrE,cAAc,oDAAoD,CAAC;AACnE,cAAc,uDAAuD,CAAC;AACtE,cAAc,gEAAgE,CAAC;AAC/E,cAAc,mEAAmE,CAAC;AAClF,cAAc,sEAAsE,CAAC;AACrF,cAAc,6EAA6E,CAAC;AAC5F,cAAc,uEAAuE,CAAC;AACtF,cAAc,qEAAqE,CAAC;AACpF,cAAc,gDAAgD,CAAC;AAC/D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,uDAAuD,CAAC;AACtE,cAAc,oDAAoD,CAAC;AACnE,cAAc,4CAA4C,CAAC;AAC3D,cAAc,iFAAiF,CAAC;AAIhG,cAAc,mDAAmD,CAAC;AAClE,cAAc,+CAA+C,CAAC","sourcesContent":["export * from './core/commons.external-connectors-models.schemas';\nexport * from './core/security.external-connectors-models.schemas';\nexport * from './core/operations.external-connectors-models.schemas';\n\n// Webhook capability contracts (adapter / handler / scope resolver) — consumed by the engine's\n// webhook pipeline. The former `features/` layer (capability enum, transformer interfaces) was\n// retired 2026-09-05 (#327): it re-stated `BUILTIN_PROVIDER_CAPABILITY` and had no reader.\nexport * from './protocols/hooks-capability.external-connectors-models.schemas';\nexport * from './core/operation-classification.external-connectors-models.schemas';\n\n// Protocols\nexport * from './protocols/agent-client-protocol.external-connectors-models.schemas';\nexport * from './protocols/content-safety.external-connectors-models.schemas';\nexport * from './protocols/electronic-signature.external-connectors-models.schemas';\nexport * from './protocols/document-extraction.external-connectors-models.schemas';\nexport * from './protocols/email.external-connectors-models.schemas';\nexport * from './protocols/email.standard-interface.schemas';\nexport * from './protocols/email-inbound.standard-interface.schemas';\nexport * from './protocols/embeddings.external-connectors-models.schemas';\nexport * from './protocols/image.external-connectors-models.schemas';\nexport * from './protocols/frontend.external-connectors-models.schemas';\nexport * from './protocols/hooks.external-connectors-models.schemas';\nexport * from './protocols/llm.external-connectors-models.schemas';\nexport * from './protocols/oauth2.external-connectors-models.schemas';\nexport * from './protocols/rest-operations.external-connectors-models.schemas';\nexport * from './protocols/graphql-operations.external-connectors-models.schemas';\nexport * from './protocols/service-account-token.external-connectors-models.schemas';\nexport * from './protocols/provider-oauth2-token-endpoint-hosts.external-connectors-models';\nexport * from './protocols/provider-connection-parameters.external-connectors-models';\nexport * from './protocols/provider-vendor-registration.external-connectors-models';\nexport * from './protocols/billing.standard-interface.schemas';\nexport * from './protocols/file-storage.standard-interface';\nexport * from './protocols/subject-erasure-effect.standard-interface';\nexport * from './protocols/sms.external-connectors-models.schemas';\nexport * from './protocols/sms.standard-interface.schemas';\nexport * from './protocols/provider-configuration-authoring.external-connectors-models.schemas';\n\n\n\nexport * from './protocols/oauth2-provider-assurance.definitions';\nexport * from './protocols/oauth2-provider-assurance.schemas';\n"]}