npm - @wildo-ai/external-connectors-models - Versions diffs - 1.1.11 → 1.1.13 - Mend

@wildo-ai/external-connectors-models 1.1.11 → 1.1.13

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (109) hide show

package/dist/esm/protocols/oauth2-provider-assurance.definitions.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth2-provider-assurance.definitions.d.ts","sourceRoot":"","sources":["~~../../../../~~src/protocols/oauth2-provider-assurance.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiC,KAAK,+BAA+B,EAAE,MAAM,qCAAqC,CAAC;AAE1H,yGAAyG;AACzG,eAAO,MAAM,6BAA6B,EAAE,+BAO3C,CAAC;AACF,eAAO,MAAM,6BAA6B,EAAE,+BAM3C,CAAC;AACF,eAAO,MAAM,4BAA4B,EAAE,+BAM1C,CAAC;AACF,eAAO,MAAM,gCAAgC,EAAE,+BAU9C,CAAC"}
1	+ {"version":3,"file":"oauth2-provider-assurance.definitions.d.ts","sourceRoot":"","sources":["../../../src/protocols/oauth2-provider-assurance.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiC,KAAK,+BAA+B,EAAE,MAAM,qCAAqC,CAAC;AAE1H,yGAAyG;AACzG,eAAO,MAAM,6BAA6B,EAAE,+BAO3C,CAAC;AACF,eAAO,MAAM,6BAA6B,EAAE,+BAM3C,CAAC;AACF,eAAO,MAAM,4BAA4B,EAAE,+BAM1C,CAAC;AACF,eAAO,MAAM,gCAAgC,EAAE,+BAU9C,CAAC"}

package/dist/esm/protocols/oauth2-provider-assurance.definitions.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth2-provider-assurance.definitions.js","sourceRoot":"","sources":["~~../../../../~~src/protocols/oauth2-provider-assurance.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAwC,MAAM,qCAAqC,CAAC;AAE1H,yGAAyG;AACzG,MAAM,CAAC,MAAM,6BAA6B,GAAoC;IAC5E,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,EAAE,iBAAiB;IAC3F,YAAY,EAAE,6BAA6B,CAAC,WAAW,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC;IAChG,aAAa,EAAE,CAAC,wFAAwF,CAAC;IACzG,WAAW,EAAE,CAAC,4FAA4F,EAAE,wEAAwE,CAAC;IACrL,iBAAiB,EAAE,EAAE,MAAM,EAAE,yCAAyC,EAAE;IACxE,iBAAiB,EAAE,CAAC,sEAAsE,CAAC,EAAE,UAAU,EAAE,YAAY;CACtH,CAAC;AACF,MAAM,CAAC,MAAM,6BAA6B,GAAoC;IAC5E,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,+CAA+C;IAClH,YAAY,EAAE,6BAA6B,CAAC,kBAAkB,EAAE,SAAS,EAAE,EAAE;IAC7E,aAAa,EAAE,CAAC,sFAAsF,CAAC;IACvG,WAAW,EAAE,CAAC,oIAAoI,CAAC;IACnJ,iBAAiB,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAC,wEAAwE,CAAC,EAAE,UAAU,EAAE,YAAY;CAC/I,CAAC;AACF,MAAM,CAAC,MAAM,4BAA4B,GAAoC;IAC3E,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,EAAE,sBAAsB;IAC/F,YAAY,EAAE,6BAA6B,CAAC,kBAAkB,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;IAClG,aAAa,EAAE,CAAC,8EAA8E,CAAC;IAC/F,WAAW,EAAE,CAAC,+HAA+H,CAAC;IAC9I,iBAAiB,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAC,4EAA4E,EAAE,wGAAwG,CAAC,EAAE,UAAU,EAAE,YAAY;CAC7P,CAAC;AACF,MAAM,CAAC,MAAM,gCAAgC,GAAoC;IAC/E,OAAO,EAAE,2FAA2F,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,EAAE,eAAe;IAC/J,YAAY,EAAE,6BAA6B,CAAC,WAAW,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC;IAChG,aAAa,EAAE;QACb,4GAA4G;QAC5G,gHAAgH;QAChH,wXAAwX;KACzX;IACD,WAAW,EAAE,CAAC,8FAA8F,EAAE,+FAA+F,EAAE,sGAAsG,CAAC;IACtT,iBAAiB,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAC,qFAAqF,EAAE,qFAAqF,CAAC,EAAE,UAAU,EAAE,YAAY;CACnP,CAAC","sourcesContent":["import { ProviderAssuranceEvidenceKind, type ProviderAuthenticationAssurance } from './oauth2-provider-assurance.schemas';\n\n/** Shared by executable modules and provider specifications; reviewed against linked primary sources. */\nexport const GoogleAuthenticationAssurance: ProviderAuthenticationAssurance = {\n product: 'Sign in with Google', protocol: 'OpenID Connect', tokenVersion: 'Google ID token',\n evidenceKind: ProviderAssuranceEvidenceKind.SESSION_AMR, subjectClaim: 'sub', mfaValues: ['mfa'],\n prerequisites: ['Request the amr ID-token claim and enable its return in Google Auth Platform settings.'],\n limitations: ['Optional claim availability depends on provider settings; missing amr is not MFA evidence.', 'Generic mfa does not identify a particular local second-factor method.'],\n requestParameters: { claims: '{\"id_token\":{\"amr\":{\"essential\":true}}}' },\n documentationUrls: ['https://developers.google.com/identity/openid-connect/openid-connect'], verifiedOn: '2026-09-12',\n};\nexport const GitHubAuthenticationAssurance: ProviderAuthenticationAssurance = {\n product: 'GitHub OAuth Apps', protocol: 'OAuth 2.0', tokenVersion: 'OAuth access token and authenticated-user API',\n evidenceKind: ProviderAssuranceEvidenceKind.ACCOUNT_ENROLLMENT, mfaValues: [],\n prerequisites: ['read:user or user scope exposes the private two_factor_authentication account field.'],\n limitations: ['Account 2FA configuration does not establish MFA in this login; do not translate two_factor_authentication into session assurance.'],\n requestParameters: {}, documentationUrls: ['https://docs.github.com/en/rest/users/users#get-the-authenticated-user'], verifiedOn: '2026-09-12',\n};\nexport const AppleAuthenticationAssurance: ProviderAuthenticationAssurance = {\n product: 'Sign in with Apple', protocol: 'OpenID Connect', tokenVersion: 'Apple identity token',\n evidenceKind: ProviderAssuranceEvidenceKind.ACCOUNT_ENROLLMENT, subjectClaim: 'sub', mfaValues: [],\n prerequisites: ['Sign in with Apple requires an Apple Account with two-factor authentication.'],\n limitations: ['The account requirement does not identify which factors were performed in this login. No session AMR equivalence is declared.'],\n requestParameters: {}, documentationUrls: ['https://support.apple.com/guide/iphone/sign-in-with-apple-iph238921d37/ios', 'https://developer.apple.com/documentation/signinwithapple/authenticating-users-with-sign-in-with-apple'], verifiedOn: '2026-09-12',\n};\nexport const MicrosoftAuthenticationAssurance: ProviderAuthenticationAssurance = {\n product: 'Microsoft identity platform; common endpoint accepts personal and organizational accounts', protocol: 'OpenID Connect', tokenVersion: 'v2.0 ID token',\n evidenceKind: ProviderAssuranceEvidenceKind.SESSION_AMR, subjectClaim: 'oid', mfaValues: ['mfa'],\n prerequisites: [\n 'Configure the optional amr ID-token claim on the app registration; v2 tokens do not include it by default.',\n // #1228 — the verified-email prerequisite, stated where an operator configuring this provider reads the others.\n 'Configure the optional email and xms_edov ID-token claims on the app registration. xms_edov is the only verified-email signal Microsoft emits — there is no email_verified claim, and Microsoft Graph reports no verification field — and it is returned only when the email claim is also present. Without both, every social sign-in through this provider is refused as unverified.',\n ],\n limitations: ['Entra method documentation does not guarantee MFA evidence for every personal-account login.', 'An organizational Microsoft account using social login is not an enterprise Wildo connection.', 'Generic mfa may include email OTP and does not satisfy a stronger or named local-method requirement.'],\n requestParameters: {}, documentationUrls: ['https://learn.microsoft.com/en-us/entra/identity-platform/optional-claims-reference', 'https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference'], verifiedOn: '2026-09-12',\n};\n"]}
1	+ {"version":3,"file":"oauth2-provider-assurance.definitions.js","sourceRoot":"","sources":["../../../src/protocols/oauth2-provider-assurance.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAwC,MAAM,qCAAqC,CAAC;AAE1H,yGAAyG;AACzG,MAAM,CAAC,MAAM,6BAA6B,GAAoC;IAC5E,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,EAAE,iBAAiB;IAC3F,YAAY,EAAE,6BAA6B,CAAC,WAAW,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC;IAChG,aAAa,EAAE,CAAC,wFAAwF,CAAC;IACzG,WAAW,EAAE,CAAC,4FAA4F,EAAE,wEAAwE,CAAC;IACrL,iBAAiB,EAAE,EAAE,MAAM,EAAE,yCAAyC,EAAE;IACxE,iBAAiB,EAAE,CAAC,sEAAsE,CAAC,EAAE,UAAU,EAAE,YAAY;CACtH,CAAC;AACF,MAAM,CAAC,MAAM,6BAA6B,GAAoC;IAC5E,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,+CAA+C;IAClH,YAAY,EAAE,6BAA6B,CAAC,kBAAkB,EAAE,SAAS,EAAE,EAAE;IAC7E,aAAa,EAAE,CAAC,sFAAsF,CAAC;IACvG,WAAW,EAAE,CAAC,oIAAoI,CAAC;IACnJ,iBAAiB,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAC,wEAAwE,CAAC,EAAE,UAAU,EAAE,YAAY;CAC/I,CAAC;AACF,MAAM,CAAC,MAAM,4BAA4B,GAAoC;IAC3E,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,EAAE,sBAAsB;IAC/F,YAAY,EAAE,6BAA6B,CAAC,kBAAkB,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;IAClG,aAAa,EAAE,CAAC,8EAA8E,CAAC;IAC/F,WAAW,EAAE,CAAC,+HAA+H,CAAC;IAC9I,iBAAiB,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAC,4EAA4E,EAAE,wGAAwG,CAAC,EAAE,UAAU,EAAE,YAAY;CAC7P,CAAC;AACF,MAAM,CAAC,MAAM,gCAAgC,GAAoC;IAC/E,OAAO,EAAE,2FAA2F,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,EAAE,eAAe;IAC/J,YAAY,EAAE,6BAA6B,CAAC,WAAW,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC;IAChG,aAAa,EAAE;QACb,4GAA4G;QAC5G,gHAAgH;QAChH,wXAAwX;KACzX;IACD,WAAW,EAAE,CAAC,8FAA8F,EAAE,+FAA+F,EAAE,sGAAsG,CAAC;IACtT,iBAAiB,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAC,qFAAqF,EAAE,qFAAqF,CAAC,EAAE,UAAU,EAAE,YAAY;CACnP,CAAC","sourcesContent":["import { ProviderAssuranceEvidenceKind, type ProviderAuthenticationAssurance } from './oauth2-provider-assurance.schemas';\n\n/** Shared by executable modules and provider specifications; reviewed against linked primary sources. */\nexport const GoogleAuthenticationAssurance: ProviderAuthenticationAssurance = {\n product: 'Sign in with Google', protocol: 'OpenID Connect', tokenVersion: 'Google ID token',\n evidenceKind: ProviderAssuranceEvidenceKind.SESSION_AMR, subjectClaim: 'sub', mfaValues: ['mfa'],\n prerequisites: ['Request the amr ID-token claim and enable its return in Google Auth Platform settings.'],\n limitations: ['Optional claim availability depends on provider settings; missing amr is not MFA evidence.', 'Generic mfa does not identify a particular local second-factor method.'],\n requestParameters: { claims: '{\"id_token\":{\"amr\":{\"essential\":true}}}' },\n documentationUrls: ['https://developers.google.com/identity/openid-connect/openid-connect'], verifiedOn: '2026-09-12',\n};\nexport const GitHubAuthenticationAssurance: ProviderAuthenticationAssurance = {\n product: 'GitHub OAuth Apps', protocol: 'OAuth 2.0', tokenVersion: 'OAuth access token and authenticated-user API',\n evidenceKind: ProviderAssuranceEvidenceKind.ACCOUNT_ENROLLMENT, mfaValues: [],\n prerequisites: ['read:user or user scope exposes the private two_factor_authentication account field.'],\n limitations: ['Account 2FA configuration does not establish MFA in this login; do not translate two_factor_authentication into session assurance.'],\n requestParameters: {}, documentationUrls: ['https://docs.github.com/en/rest/users/users#get-the-authenticated-user'], verifiedOn: '2026-09-12',\n};\nexport const AppleAuthenticationAssurance: ProviderAuthenticationAssurance = {\n product: 'Sign in with Apple', protocol: 'OpenID Connect', tokenVersion: 'Apple identity token',\n evidenceKind: ProviderAssuranceEvidenceKind.ACCOUNT_ENROLLMENT, subjectClaim: 'sub', mfaValues: [],\n prerequisites: ['Sign in with Apple requires an Apple Account with two-factor authentication.'],\n limitations: ['The account requirement does not identify which factors were performed in this login. No session AMR equivalence is declared.'],\n requestParameters: {}, documentationUrls: ['https://support.apple.com/guide/iphone/sign-in-with-apple-iph238921d37/ios', 'https://developer.apple.com/documentation/signinwithapple/authenticating-users-with-sign-in-with-apple'], verifiedOn: '2026-09-12',\n};\nexport const MicrosoftAuthenticationAssurance: ProviderAuthenticationAssurance = {\n product: 'Microsoft identity platform; common endpoint accepts personal and organizational accounts', protocol: 'OpenID Connect', tokenVersion: 'v2.0 ID token',\n evidenceKind: ProviderAssuranceEvidenceKind.SESSION_AMR, subjectClaim: 'oid', mfaValues: ['mfa'],\n prerequisites: [\n 'Configure the optional amr ID-token claim on the app registration; v2 tokens do not include it by default.',\n // #1228 — the verified-email prerequisite, stated where an operator configuring this provider reads the others.\n 'Configure the optional email and xms_edov ID-token claims on the app registration. xms_edov is the only verified-email signal Microsoft emits — there is no email_verified claim, and Microsoft Graph reports no verification field — and it is returned only when the email claim is also present. Without both, every social sign-in through this provider is refused as unverified.',\n ],\n limitations: ['Entra method documentation does not guarantee MFA evidence for every personal-account login.', 'An organizational Microsoft account using social login is not an enterprise Wildo connection.', 'Generic mfa may include email OTP and does not satisfy a stronger or named local-method requirement.'],\n requestParameters: {}, documentationUrls: ['https://learn.microsoft.com/en-us/entra/identity-platform/optional-claims-reference', 'https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference'], verifiedOn: '2026-09-12',\n};\n"]}

package/dist/esm/protocols/oauth2-provider-assurance.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth2-provider-assurance.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/protocols/oauth2-provider-assurance.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+FAA+F;AAC/F,oBAAY,6BAA6B;IACvC,WAAW,gBAAgB;IAC3B,kBAAkB,uBAAuB;IACzC,YAAY,iBAAiB;CAC9B;AAED,kGAAkG;AAClG,eAAO,MAAM,qCAAqC;;;;;;;;;;;;iBAchD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC"}
1	+ {"version":3,"file":"oauth2-provider-assurance.schemas.d.ts","sourceRoot":"","sources":["../../../src/protocols/oauth2-provider-assurance.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+FAA+F;AAC/F,oBAAY,6BAA6B;IACvC,WAAW,gBAAgB;IAC3B,kBAAkB,uBAAuB;IACzC,YAAY,iBAAiB;CAC9B;AAED,kGAAkG;AAClG,eAAO,MAAM,qCAAqC;;;;;;;;;;;;iBAchD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC"}

package/dist/esm/protocols/oauth2-provider-assurance.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth2-provider-assurance.schemas.js","sourceRoot":"","sources":["~~../../../../~~src/protocols/oauth2-provider-assurance.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+FAA+F;AAC/F,MAAM,CAAN,IAAY,6BAIX;AAJD,WAAY,6BAA6B;IACvC,4DAA2B,CAAA;IAC3B,0EAAyC,CAAA;IACzC,8DAA6B,CAAA;AAC/B,CAAC,EAJW,6BAA6B,KAA7B,6BAA6B,QAIxC;AAED,kGAAkG;AAClG,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC;IACnD,wFAAwF;IACxF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,iFAAiF;IACjF,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACjD,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACzC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACvC,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE;CACzB,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\n\n/** Provider enrollment requirements are not evidence about this authentication transaction. /\nexport enum ProviderAssuranceEvidenceKind {\n SESSION_AMR = 'session_amr',\n ACCOUNT_ENROLLMENT = 'account_enrollment',\n UNDOCUMENTED = 'undocumented',\n}\n\n/* A researched provider contract. Documentation is evidence of meaning, not proof of a login. /\nexport const ProviderAuthenticationAssuranceSchema = z.object({\n product: z.string().min(1),\n protocol: z.string().min(1),\n tokenVersion: z.string().min(1),\n evidenceKind: z.enum(ProviderAssuranceEvidenceKind),\n /* ID-token claim matching the identifier returned by the provider profile endpoint. /\n subjectClaim: z.string().min(1).optional(),\n /* Values in a verified ID token's amr array that establish generic MFA only. */\n mfaValues: z.array(z.string().min(1)).default([]),\n prerequisites: z.array(z.string().min(1)),\n limitations: z.array(z.string().min(1)),\n requestParameters: z.record(z.string(), z.string()).default({}),\n documentationUrls: z.array(z.url()).min(1),\n verifiedOn: z.iso.date(),\n});\nexport type ProviderAuthenticationAssurance = z.infer<typeof ProviderAuthenticationAssuranceSchema>;\n\n"]}
1	+ {"version":3,"file":"oauth2-provider-assurance.schemas.js","sourceRoot":"","sources":["../../../src/protocols/oauth2-provider-assurance.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+FAA+F;AAC/F,MAAM,CAAN,IAAY,6BAIX;AAJD,WAAY,6BAA6B;IACvC,4DAA2B,CAAA;IAC3B,0EAAyC,CAAA;IACzC,8DAA6B,CAAA;AAC/B,CAAC,EAJW,6BAA6B,KAA7B,6BAA6B,QAIxC;AAED,kGAAkG;AAClG,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC;IACnD,wFAAwF;IACxF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,iFAAiF;IACjF,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACjD,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACzC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACvC,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE;CACzB,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\n\n/** Provider enrollment requirements are not evidence about this authentication transaction. /\nexport enum ProviderAssuranceEvidenceKind {\n SESSION_AMR = 'session_amr',\n ACCOUNT_ENROLLMENT = 'account_enrollment',\n UNDOCUMENTED = 'undocumented',\n}\n\n/* A researched provider contract. Documentation is evidence of meaning, not proof of a login. /\nexport const ProviderAuthenticationAssuranceSchema = z.object({\n product: z.string().min(1),\n protocol: z.string().min(1),\n tokenVersion: z.string().min(1),\n evidenceKind: z.enum(ProviderAssuranceEvidenceKind),\n /* ID-token claim matching the identifier returned by the provider profile endpoint. /\n subjectClaim: z.string().min(1).optional(),\n /* Values in a verified ID token's amr array that establish generic MFA only. */\n mfaValues: z.array(z.string().min(1)).default([]),\n prerequisites: z.array(z.string().min(1)),\n limitations: z.array(z.string().min(1)),\n requestParameters: z.record(z.string(), z.string()).default({}),\n documentationUrls: z.array(z.url()).min(1),\n verifiedOn: z.iso.date(),\n});\nexport type ProviderAuthenticationAssurance = z.infer<typeof ProviderAuthenticationAssuranceSchema>;\n\n"]}

package/dist/esm/protocols/oauth2.external-connectors-models.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth2.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/protocols/oauth2.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,+BAA+B,EAC/B,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,+BAA+B,EAC/B,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,EACrB,MAAM,sBAAsB,CAAC;AAG9B;;;;;;;;;;;;;;GAcG;AAMH;;;GAGG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;iBA8D5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAM5F;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;iBAqCjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAMtE;;GAEG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;iBAqBvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;GAEG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;iBAevC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAMlF;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;iBAqBnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM1E;;;GAGG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqF1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAmBxF;;;GAGG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;iBAiClC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAIxE;;;GAGG;AACH,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+B7C,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,8BAA8B,gCAAe,CAAC;AAM3D,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAMtF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;iBAqBnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAQ1E;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,kBAAkB,CAAC;IACzC,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,gBAAgB,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC"}
1	+ {"version":3,"file":"oauth2.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../src/protocols/oauth2.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,+BAA+B,EAC/B,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,+BAA+B,EAC/B,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,EACrB,MAAM,sBAAsB,CAAC;AAG9B;;;;;;;;;;;;;;GAcG;AAMH;;;GAGG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;iBA8D5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAM5F;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;iBAqCjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAMtE;;GAEG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;iBAqBvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;GAEG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;iBAevC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAMlF;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;iBAqBnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM1E;;;GAGG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqF1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAmBxF;;;GAGG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;iBAiClC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAIxE;;;GAGG;AACH,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+B7C,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,8BAA8B,gCAAe,CAAC;AAM3D,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAMtF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;iBAqBnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAQ1E;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,kBAAkB,CAAC;IACzC,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,gBAAgB,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC"}

package/dist/esm/protocols/oauth2.external-connectors-models.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth2.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../../src/protocols/oauth2.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,0DAA0D,EAE3D,MAAM,oDAAoD,CAAC;AAE5D,iFAAiF;AACjF,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,+BAA+B,EAC/B,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,+BAA+B,EAC/B,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAG9B;;;;;;;;;;;;;;GAcG;AAEH,gFAAgF;AAChF,uDAAuD;AACvD,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,6BAA6B;IAC7B,gEAAgE;IAChE,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEjD,iEAAiE;IACjE,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEjD,6DAA6D;IAC7D,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE1C,qCAAqC;IACrC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEzC,yBAAyB;IACzB,8BAA8B;IAC9B,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE5C,kDAAkD;IAClD,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE3C,2CAA2C;IAC3C,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE/C,8CAA8C;IAC9C,0BAA0B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAElD,4BAA4B;IAC5B,6DAA6D;IAC7D,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEpC,sCAAsC;IACtC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEpC,4BAA4B;IAC5B,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAE1D,kCAAkC;IAClC,8BAA8B;IAC9B,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEpC,iEAAiE;IACjE,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE7C,iCAAiC;IACjC,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAExC,yBAAyB;IACzB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEvC,4BAA4B;IAC5B,yDAAyD;IACzD,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE/C,gDAAgD;IAChD,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE9C,2CAA2C;IAC3C,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE7C,6BAA6B;IAC7B,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAGH,gFAAgF;AAChF,sCAAsC;AACtC,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,2CAA2C;IAC3C,wDAAwD;IACxD,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IAEzB,kDAAkD;IAClD,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;IAEjB,6BAA6B;IAC7B,sEAAsE;IACtE,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAE9B,qCAAqC;IACrC,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEjC,wCAAwC;IACxC,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEpC,+CAA+C;IAC/C,sBAAsB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAE1C,mCAAmC;IACnC,oDAAoD;IACpD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAE/B,2CAA2C;IAC3C,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAE3B,8BAA8B;IAC9B,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEhC,oCAAoC;IACpC,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEjC,4BAA4B;IAC5B,+DAA+D;IAC/D,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAGH,gFAAgF;AAChF,2CAA2C;AAC3C,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,kDAAkD;IAClD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IAEjB,iCAAiC;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAElC,0CAA0C;IAC1C,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEhC,oEAAoE;IACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE/B,sCAAsC;IACtC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE9B,6DAA6D;IAC7D,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE3C,8DAA8D;IAC9D,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAGH;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,2BAA2B;IAC3B,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,QAAQ,EAAE;IAE3D,iDAAiD;IACjD,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE7C,oCAAoC;IACpC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE7C,8BAA8B;IAC9B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEvC,wEAAwE;IACxE,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAGH,gFAAgF;AAChF,iDAAiD;AACjD,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,oCAAoC;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEhC,+CAA+C;IAC/C,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAErD,gDAAgD;IAChD,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAEtD,0CAA0C;IAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAEjD,gDAAgD;IAChD,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,QAAQ,EAAE;IAE3E,qDAAqD;IACrD,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEhE,6DAA6D;IAC7D,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC;AAGH,gFAAgF;AAChF,kCAAkC;AAClC,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,mBAAmB;IACnB,iCAAiC;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE7B,0BAA0B;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE9B,wBAAwB;IACxB,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAE3B,gCAAgC;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEjC,kBAAkB;IAClB,0CAA0C;IAC1C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC;IAElE,gCAAgC;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAElC,oBAAoB;IACpB,qCAAqC;IACrC,SAAS,EAAE,sBAAsB;IAEjC,uBAAuB;IACvB,4DAA4D;IAC5D,YAAY,EAAE,iCAAiC,CAAC,QAAQ,EAAE;IAE1D,iBAAiB;IACjB,gEAAgE;IAChE,MAAM,EAAE,4BAA4B,CAAC,QAAQ,EAAE;IAE/C,8BAA8B;IAC9B,8DAA8D;IAC9D,WAAW,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAEhD,sCAAsC;IACtC,2BAA2B;IAC3B,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;IAEzF,+CAA+C;IAC/C,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC;IAE3E,sBAAsB;IACtB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAExC,mCAAmC;IACnC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC;IAExE,gCAAgC;IAChC;;;OAGG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;QAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;QACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAChC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;YACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;SAClB,CAAC,CAAC,CAAC,QAAQ,EAAE;KACf,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEd,4DAA4D;IAC5D,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE5D,oDAAoD;IACpD,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE7D,0CAA0C;IAC1C,6DAA6D;IAC7D,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;QAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;QAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACpC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC;KACpD,CAAC,CAAC,QAAQ,EAAE;IAEb,uCAAuC;IACvC,iDAAiD;IACjD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACzD,CAAC,CAAC;AAGH,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,GAAG;AACH,2EAA2E;AAC3E,+EAA+E;AAC/E,EAAE;AAEF,gFAAgF;AAChF,gDAAgD;AAChD,gFAAgF;AAGhF,gFAAgF;AAChF,iDAAiD;AACjD,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,sCAAsC;IACtC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IAEtB,mBAAmB;IACnB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IAEvB,oCAAoC;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IAEvC,qDAAqD;IACrD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEhC,mCAAmC;IACnC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEnC,sDAAsD;IACtD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE5C,sBAAsB;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE9B,iDAAiD;IACjD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE5B,wCAAwC;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IAErB,8CAA8C;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAElD,oDAAoD;IACpD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAKH;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,0DAA0D,CAAC,MAAM,CAAC;IAClH,oCAAoC;IACpC,uEAAuE;IACvE,gBAAgB,EAAE,+BAA+B,CAAC,QAAQ,EAAE;IAE5D,mDAAmD;IACnD,iCAAiC;IACjC,qBAAqB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEzC,uBAAuB;IACvB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEvC,sEAAsE;IACtE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC1B,qEAAqE;QACrE,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAE9C,uEAAuE;QACvE,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAEtD,qCAAqC;QACrC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAEpD,sDAAsD;QACtD,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KAC9C,CAAC,CAAC,OAAO,CAAC;QACT,kBAAkB,EAAE,KAAK;QACzB,qBAAqB,EAAE,EAAE;QACzB,mBAAmB,EAAE,EAAE;QACvB,kBAAkB,EAAE,IAAI;KACzB,CAAC;CACH,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAS3D,gFAAgF;AAChF,gDAAgD;AAChD,gFAAgF;AAEhF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,kDAAkD;IAClD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAEpC,kDAAkD;IAClD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE/C,4CAA4C;IAC5C,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC;IAE1E,qCAAqC;IACrC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,MAAM,CAAC;IAEhF,+DAA+D;IAC/D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEvC,2DAA2D;IAC3D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAErC,qDAAqD;IACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC","sourcesContent":["/*\n OAuth2 Protocol Schemas for External Connectors\n * \n * This module integrates the comprehensive OAuth2 definitions with the\n * external connectors protocol engine. It provides:\n * \n * 1. SSO_OAuth2 Protocol - For user authentication (OpenID Connect)\n * 2. OAuth2 API Auth Profile - For linking OAuth2 to REST API authentication\n /\n\nimport { z } from 'zod';\nimport { \n ExternalProvider_ExchangeProtocol_Configuration_BaseSchema, \n ExternalProvider_ExchangeProtocol_Kind \n} from '../core/commons.external-connectors-models.schemas';\n\n// Re-export OAuth2 enums from the shared enums file (avoids circular dependency)\nexport {\n OAuth2_GrantType,\n OAuth2_ResponseType,\n OAuth2_PKCE_Method,\n OAuth2_TokenEndpoint_AuthMethod,\n OAuth2_Prompt,\n OAuth2_AccessType,\n OAuth2_Purpose,\n OAuth2_TokenFormat,\n OAuth2_TokenLocation,\n} from '../core/oauth2.enums';\n\nimport {\n OAuth2_GrantType,\n OAuth2_ResponseType,\n OAuth2_PKCE_Method,\n OAuth2_TokenEndpoint_AuthMethod,\n OAuth2_Prompt,\n OAuth2_AccessType,\n OAuth2_Purpose,\n OAuth2_TokenFormat,\n OAuth2_TokenLocation,\n} from '../core/oauth2.enums';\n\n\n/\n OAuth2 and OpenID Connect Protocol Definitions\n * \n * Based on:\n * - RFC 6749: The OAuth 2.0 Authorization Framework\n * - RFC 7636: Proof Key for Code Exchange (PKCE)\n * - OpenID Connect Core 1.0\n * - RFC 7662: OAuth 2.0 Token Introspection\n * - RFC 7009: OAuth 2.0 Token Revocation\n * \n * This module provides standardized OAuth2 definitions that unify:\n * 1. API Authentication (for REST/GraphQL/Webhook calls)\n * 2. User SSO Authentication (OpenID Connect overlay)\n * 3. Service-to-Service (S2S) authentication\n /\n\n// =============================================================================\n// CAPABILITY FLAGS - Provider Features and Limitations\n// =============================================================================\n\n/\n OAuth2 Provider Capabilities - what the provider supports\n * These flags help determine what flows and features are available\n /\nexport const OAuth2_ProviderCapabilitiesSchema = z.object({\n // ─── Grant Type Support ───\n /* Supports authorization_code grant (user-interactive flow) /\n supportsAuthorizationCode: z.boolean().optional(),\n \n /* Supports client_credentials grant (S2S/machine-to-machine) /\n supportsClientCredentials: z.boolean().optional(),\n \n /* Supports device_code grant (input-constrained devices) /\n supportsDeviceCode: z.boolean().optional(),\n \n /* Supports JWT bearer assertions /\n supportsJwtBearer: z.boolean().optional(),\n \n // ─── Token Features ───\n /* Supports refresh tokens /\n supportsRefreshToken: z.boolean().optional(),\n \n /* Provider rotates refresh tokens on each use /\n rotatesRefreshToken: z.boolean().optional(),\n \n /* Supports token revocation (RFC 7009) /\n supportsTokenRevocation: z.boolean().optional(),\n \n /* Supports token introspection (RFC 7662) /\n supportsTokenIntrospection: z.boolean().optional(),\n \n // ─── Security Features ───\n /* Supports PKCE (RFC 7636) - required for public clients /\n supportsPKCE: z.boolean().optional(),\n \n /* PKCE is required (not optional) /\n requiresPKCE: z.boolean().optional(),\n \n /* Preferred PKCE method /\n preferredPKCEMethod: z.enum(OAuth2_PKCE_Method).optional(),\n \n // ─── OpenID Connect Features ───\n /* Supports OpenID Connect /\n supportsOIDC: z.boolean().optional(),\n \n /* Supports OIDC Discovery (.well-known/openid-configuration) /\n supportsOIDCDiscovery: z.boolean().optional(),\n \n /* Supports userinfo endpoint /\n supportsUserInfo: z.boolean().optional(),\n \n /* Supports ID tokens /\n supportsIdToken: z.boolean().optional(),\n \n // ─── Advanced Features ───\n /* Supports incremental authorization (adding scopes) /\n supportsIncrementalAuth: z.boolean().optional(),\n \n /* Supports scope reduction on token refresh /\n supportsScopeReduction: z.boolean().optional(),\n \n /* Supports custom domains/environments /\n supportsCustomDomains: z.boolean().optional(),\n \n /* Supports multi-tenancy /\n supportsMultiTenancy: z.boolean().optional(),\n});\nexport type OAuth2_ProviderCapabilities = z.infer<typeof OAuth2_ProviderCapabilitiesSchema>;\n\n// =============================================================================\n// ENDPOINTS - OAuth2 Server Endpoints\n// =============================================================================\n\n/\n OAuth2 Endpoints Configuration\n * Standard endpoints as defined in RFC 6749 and OIDC Discovery\n /\nexport const OAuth2_EndpointsSchema = z.object({\n // ─── Core OAuth2 Endpoints (RFC 6749) ───\n /* Authorization endpoint - where user grants access /\n authorizationUrl: z.url(),\n \n /* Token endpoint - where tokens are exchanged /\n tokenUrl: z.url(),\n \n // ─── Optional Endpoints ───\n /* Refresh URL - often same as tokenUrl, but some providers differ /\n refreshUrl: z.url().optional(),\n \n /* Revocation endpoint (RFC 7009) /\n revocationUrl: z.url().optional(),\n \n /* Introspection endpoint (RFC 7662) /\n introspectionUrl: z.url().optional(),\n \n /* Device authorization endpoint (RFC 8628) /\n deviceAuthorizationUrl: z.url().optional(),\n \n // ─── OpenID Connect Endpoints ───\n /* UserInfo endpoint - for fetching user profile /\n userInfoUrl: z.url().optional(),\n \n /* JWKS endpoint - for verifying tokens /\n jwksUrl: z.url().optional(),\n \n /* OIDC Discovery endpoint /\n discoveryUrl: z.url().optional(),\n \n /* End session / logout endpoint /\n endSessionUrl: z.url().optional(),\n \n // ─── Provider-Specific ───\n /* Custom API base URL (for making authenticated API calls) /\n apiBaseUrl: z.url().optional(),\n});\nexport type OAuth2_Endpoints = z.infer<typeof OAuth2_EndpointsSchema>;\n\n// =============================================================================\n// SCOPE DEFINITIONS - Granular Permissions\n// =============================================================================\n\n/\n OAuth2 Scope Definition - describes what a scope grants\n /\nexport const OAuth2_ScopeDefinitionSchema = z.object({\n /* The scope string as used in OAuth2 requests /\n scope: z.string(),\n \n /* Human-readable description /\n description: z.string().optional(),\n \n /* Is this scope required or optional? /\n required: z.boolean().optional(),\n \n /* Category for grouping scopes (e.g., 'read', 'write', 'admin') /\n category: z.string().optional(),\n \n /* Is this an OIDC standard scope? /\n isOIDC: z.boolean().optional(),\n \n /* Does this scope grant offline access (refresh tokens)? /\n grantsOfflineAccess: z.boolean().optional(),\n \n /* Related resources or APIs this scope provides access to /\n resources: z.array(z.string()).optional(),\n});\nexport type OAuth2_ScopeDefinition = z.infer<typeof OAuth2_ScopeDefinitionSchema>;\n\n/\n Scope Collection - organized scopes for a provider\n /\nexport const OAuth2_ScopeCollectionSchema = z.object({\n /* All available scopes /\n available: z.array(OAuth2_ScopeDefinitionSchema).optional(),\n \n /* Default scopes for user SSO authentication /\n defaultForSSO: z.array(z.string()).optional(),\n \n /* Default scopes for API access /\n defaultForAPI: z.array(z.string()).optional(),\n \n /* Minimum required scopes /\n minimum: z.array(z.string()).optional(),\n \n /* Scope that grants offline/refresh access (e.g., 'offline_access') /\n offlineAccessScope: z.string().optional(),\n});\nexport type OAuth2_ScopeCollection = z.infer<typeof OAuth2_ScopeCollectionSchema>;\n\n// =============================================================================\n// TOKEN CONFIGURATION - Token handling specifics\n// =============================================================================\n\n/\n Token Configuration - how tokens behave\n /\nexport const OAuth2_TokenConfigSchema = z.object({\n /* Token type (usually 'Bearer') /\n tokenType: z.string().optional(),\n \n /* Default access token lifetime in seconds /\n accessTokenLifetime: z.number().positive().optional(),\n \n /* Default refresh token lifetime in seconds /\n refreshTokenLifetime: z.number().positive().optional(),\n \n /* ID token lifetime in seconds (OIDC) /\n idTokenLifetime: z.number().positive().optional(),\n \n /* How to authenticate at the token endpoint /\n tokenEndpointAuthMethod: z.enum(OAuth2_TokenEndpoint_AuthMethod).optional(),\n \n /* Additional headers required for token requests /\n tokenRequestHeaders: z.record(z.string(), z.string()).optional(),\n \n /* How early (in seconds) to refresh tokens before expiry /\n refreshBufferSeconds: z.number().nonnegative().optional(),\n});\nexport type OAuth2_TokenConfig = z.infer<typeof OAuth2_TokenConfigSchema>;\n\n// =============================================================================\n// MAIN OAUTH2 PROVIDER DEFINITION\n// =============================================================================\n\n/\n Complete OAuth2 Provider Definition\n * This is the main schema that captures all OAuth2 configuration for a provider\n /\nexport const OAuth2_ProviderDefinitionSchema = z.object({\n // ─── Identity ───\n /* Unique provider identifier /\n providerId: z.string().min(1),\n \n /* Display name for UI /\n displayName: z.string().min(1),\n \n /* Provider icon URL /\n iconUrl: z.url().optional(),\n \n /* Primary brand color (hex) /\n brandColor: z.string().optional(),\n \n // ─── Purpose ───\n /* What this OAuth2 config is used for /\n purpose: z.enum(OAuth2_Purpose).default(OAuth2_Purpose.API_ACCESS),\n \n /* Is this provider enabled? /\n enabled: z.boolean().default(true),\n \n // ─── Endpoints ───\n /* OAuth2 endpoints configuration /\n endpoints: OAuth2_EndpointsSchema,\n \n // ─── Capabilities ───\n /* What the provider supports (all fields have defaults) /\n capabilities: OAuth2_ProviderCapabilitiesSchema.optional(),\n \n // ─── Scopes ───\n /* Scope definitions and defaults (all fields have defaults) /\n scopes: OAuth2_ScopeCollectionSchema.optional(),\n \n // ─── Token Configuration ───\n /* Token handling configuration (all fields have defaults) /\n tokenConfig: OAuth2_TokenConfigSchema.optional(),\n \n // ─── Authorization Configuration ───\n /* Preferred grant type /\n preferredGrantType: z.enum(OAuth2_GrantType).default(OAuth2_GrantType.AUTHORIZATION_CODE),\n \n /* Response type for authorization requests /\n responseType: z.enum(OAuth2_ResponseType).default(OAuth2_ResponseType.CODE),\n \n /* Prompt behavior /\n prompt: z.enum(OAuth2_Prompt).optional(),\n \n /* Access type (online/offline) /\n accessType: z.enum(OAuth2_AccessType).default(OAuth2_AccessType.OFFLINE),\n \n // ─── Dynamic Configuration ───\n /* \n * Template variables that can be substituted in URLs\n * e.g., { location: 'us' } for 'https://accounts.{location}.zoho.com'\n /\n templateVariables: z.record(z.string(), z.object({\n displayName: z.string(),\n description: z.string().optional(),\n required: z.boolean().optional(),\n defaultValue: z.string().optional(),\n options: z.array(z.object({\n value: z.string(),\n label: z.string(),\n })).optional(),\n })).optional(),\n \n /* Extra parameters to include in authorization requests /\n extraAuthParams: z.record(z.string(), z.string()).optional(),\n \n /* Extra parameters to include in token requests /\n extraTokenParams: z.record(z.string(), z.string()).optional(),\n \n // ─── User Profile Mapping (OIDC/SSO) ───\n /* Mapping for extracting user info from profile response /\n userProfileMapping: z.object({\n id: z.string().default('sub'),\n email: z.string().default('email'),\n name: z.string().default('name'),\n image: z.string().default('picture'),\n emailVerified: z.string().default('email_verified'),\n }).optional(),\n \n // ─── Provider-Specific Extensions ───\n /* Provider-specific configuration extensions /\n extensions: z.record(z.string(), z.unknown()).optional(),\n});\nexport type OAuth2_ProviderDefinition = z.infer<typeof OAuth2_ProviderDefinitionSchema>;\n\n// =============================================================================\n// NOTE: OAuth2 configurations are defined per-provider in external-connectors\n// =============================================================================\n// \n// Each provider folder (e.g., google/, microsoft/) contains its own OAuth2\n// protocol definition. Use provider string identifiers to reference providers.\n//\n\n// =============================================================================\n// SSO OAUTH2 PROTOCOL - For User Authentication\n// =============================================================================\n\n\n// =============================================================================\n// RUNTIME CREDENTIAL - Active OAuth2 credentials\n// =============================================================================\n\n/\n OAuth2 Credential - Active tokens for a provider connection\n * This is what gets stored after successful OAuth2 authentication\n /\nexport const OAuth2_CredentialSchema = z.object({\n /* Provider this credential is for /\n providerId: z.string(),\n \n /* Access token /\n accessToken: z.string(),\n \n /* Token type (usually 'Bearer') /\n tokenType: z.string().default('Bearer'),\n \n /* When the access token expires (Unix timestamp) /\n expiresAt: z.number().optional(),\n \n /* Refresh token (if available) /\n refreshToken: z.string().optional(),\n \n /* When the refresh token expires (Unix timestamp) /\n refreshTokenExpiresAt: z.number().optional(),\n \n /* ID token (OIDC) /\n idToken: z.string().optional(),\n \n /* Granted scopes (may differ from requested) /\n scope: z.string().optional(),\n \n /* When this credential was obtained /\n claimedAt: z.number(),\n \n /* Additional data from the token response /\n data: z.record(z.string(), z.unknown()).optional(),\n \n /* Provider-specific properties used during auth /\n props: z.record(z.string(), z.unknown()).optional(),\n});\nexport type OAuth2_Credential = z.infer<typeof OAuth2_CredentialSchema>;\n\n\n\n/\n OAuth2 Provider Configuration - Runtime configuration\n * Contains the OAuth2 endpoints and configuration\n /\nexport const OAuth2Provider_ConfigurationSchema = ExternalProvider_ExchangeProtocol_Configuration_BaseSchema.extend({\n // ─── OAuth2 Core Configuration ───\n /* Complete OAuth2 provider definition (new comprehensive approach) /\n oauth2Definition: OAuth2_ProviderDefinitionSchema.optional(),\n \n // ─── Legacy fields for backward compatibility ───\n /* Authorization endpoint URL /\n authorizationEndpoint: z.url().optional(),\n \n /* Requested scopes /\n scopes: z.array(z.string()).default([]),\n\n // ─── Integration Access (for providers that offer multiple APIs) ───\n integrationAccess: z.object({\n /* Enable third-party integrations through this OAuth2 connection /\n enableIntegrations: z.boolean().default(false),\n \n /* Available integrations (e.g., ['drive', 'calendar', 'contacts']) /\n availableIntegrations: z.array(z.string()).default([]),\n \n /* Default integrations to enable /\n defaultIntegrations: z.array(z.string()).default([]),\n \n /* User must grant permission for each integration /\n requiresPermission: z.boolean().default(true),\n }).default({\n enableIntegrations: false,\n availableIntegrations: [],\n defaultIntegrations: [],\n requiresPermission: true,\n }),\n});\n\n/\n OAuth2 Provider Operation - Operations that require OAuth2\n * Currently empty, reserved for future use\n /\nexport const OAuth2Provider_OperationSchema = z.object({});\n\n// =============================================================================\n// INFERRED TYPES\n// =============================================================================\n\nexport type OAuth2Provider_Configuration = z.infer<typeof OAuth2Provider_ConfigurationSchema>;\nexport type OAuth2Provider_Operation = z.infer<typeof OAuth2Provider_OperationSchema>;\n\n// =============================================================================\n// OAUTH2 API AUTHENTICATION LINK (Consolidated)\n// =============================================================================\n\n/\n OAuth2 API Auth Link\n * \n * Unified schema for linking OAuth2 credentials to REST API / Hook authentication.\n * This prevents duplication between auth profile and OAuth2 config.\n * \n * When a REST API uses OAuth2 for authentication:\n * 1. Define the OAuth2 provider once (endpoints, scopes, capabilities)\n * 2. Link it to the API auth profile using this schema\n * 3. The system will automatically:\n * - Manage token refresh\n * - Format Authorization headers\n * - Track required scopes per operation\n /\nexport const OAuth2_APIAuthLinkSchema = z.object({\n /* Reference to the OAuth2 provider definition /\n oauth2ProviderRef: z.string().min(1),\n \n /* Which scopes are needed for this API access /\n requiredScopes: z.array(z.string()).default([]),\n \n /* How to format the token for API calls /\n tokenFormat: z.enum(OAuth2_TokenFormat).default(OAuth2_TokenFormat.BEARER),\n \n /* Where to send the access token /\n tokenLocation: z.enum(OAuth2_TokenLocation).default(OAuth2_TokenLocation.HEADER),\n \n /* Custom header name (when tokenFormat is 'custom_header') /\n customHeaderName: z.string().optional(),\n \n /* Query parameter name (when tokenLocation is 'query') /\n queryParamName: z.string().optional(),\n \n /* Prefix for the token value (optional override) /\n tokenPrefix: z.string().optional(),\n});\nexport type OAuth2_APIAuthLink = z.infer<typeof OAuth2_APIAuthLinkSchema>;\n\n// Note: OAuth2_APIAuthLinkSchema is now defined in the consolidated section above\n\n// =============================================================================\n// HELPER TYPES\n// =============================================================================\n\n/\n OAuth2 Authorization Request - parameters for the authorization URL\n /\nexport interface OAuth2_AuthorizationRequest {\n clientId: string;\n redirectUri: string;\n scope: string[];\n state: string;\n responseType?: OAuth2_ResponseType;\n codeChallenge?: string;\n codeChallengeMethod?: OAuth2_PKCE_Method;\n prompt?: OAuth2_Prompt;\n accessType?: OAuth2_AccessType;\n extraParams?: Record<string, string>;\n}\n\n/\n OAuth2 Token Request - parameters for the token endpoint\n /\nexport interface OAuth2_TokenRequest {\n grantType: OAuth2_GrantType;\n clientId: string;\n clientSecret?: string;\n code?: string;\n redirectUri?: string;\n codeVerifier?: string;\n refreshToken?: string;\n scope?: string[];\n extraParams?: Record<string, string>;\n}\n\n/\n OAuth2 Token Response - response from the token endpoint\n */\nexport interface OAuth2_TokenResponse {\n accessToken: string;\n tokenType: string;\n expiresIn?: number;\n refreshToken?: string;\n scope?: string;\n idToken?: string;\n data?: Record<string, unknown>;\n}\n\n"]}
1	+ {"version":3,"file":"oauth2.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../src/protocols/oauth2.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,0DAA0D,EAE3D,MAAM,oDAAoD,CAAC;AAE5D,iFAAiF;AACjF,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,+BAA+B,EAC/B,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,+BAA+B,EAC/B,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAG9B;;;;;;;;;;;;;;GAcG;AAEH,gFAAgF;AAChF,uDAAuD;AACvD,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,6BAA6B;IAC7B,gEAAgE;IAChE,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEjD,iEAAiE;IACjE,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEjD,6DAA6D;IAC7D,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE1C,qCAAqC;IACrC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEzC,yBAAyB;IACzB,8BAA8B;IAC9B,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE5C,kDAAkD;IAClD,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE3C,2CAA2C;IAC3C,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE/C,8CAA8C;IAC9C,0BAA0B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAElD,4BAA4B;IAC5B,6DAA6D;IAC7D,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEpC,sCAAsC;IACtC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEpC,4BAA4B;IAC5B,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAE1D,kCAAkC;IAClC,8BAA8B;IAC9B,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEpC,iEAAiE;IACjE,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE7C,iCAAiC;IACjC,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAExC,yBAAyB;IACzB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEvC,4BAA4B;IAC5B,yDAAyD;IACzD,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE/C,gDAAgD;IAChD,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE9C,2CAA2C;IAC3C,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE7C,6BAA6B;IAC7B,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAGH,gFAAgF;AAChF,sCAAsC;AACtC,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,2CAA2C;IAC3C,wDAAwD;IACxD,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IAEzB,kDAAkD;IAClD,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;IAEjB,6BAA6B;IAC7B,sEAAsE;IACtE,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAE9B,qCAAqC;IACrC,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEjC,wCAAwC;IACxC,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEpC,+CAA+C;IAC/C,sBAAsB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAE1C,mCAAmC;IACnC,oDAAoD;IACpD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAE/B,2CAA2C;IAC3C,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAE3B,8BAA8B;IAC9B,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEhC,oCAAoC;IACpC,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEjC,4BAA4B;IAC5B,+DAA+D;IAC/D,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAGH,gFAAgF;AAChF,2CAA2C;AAC3C,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,kDAAkD;IAClD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IAEjB,iCAAiC;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAElC,0CAA0C;IAC1C,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEhC,oEAAoE;IACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE/B,sCAAsC;IACtC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE9B,6DAA6D;IAC7D,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE3C,8DAA8D;IAC9D,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAGH;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,2BAA2B;IAC3B,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,QAAQ,EAAE;IAE3D,iDAAiD;IACjD,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE7C,oCAAoC;IACpC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE7C,8BAA8B;IAC9B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEvC,wEAAwE;IACxE,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAGH,gFAAgF;AAChF,iDAAiD;AACjD,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,oCAAoC;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEhC,+CAA+C;IAC/C,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAErD,gDAAgD;IAChD,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAEtD,0CAA0C;IAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAEjD,gDAAgD;IAChD,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,QAAQ,EAAE;IAE3E,qDAAqD;IACrD,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEhE,6DAA6D;IAC7D,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC;AAGH,gFAAgF;AAChF,kCAAkC;AAClC,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,mBAAmB;IACnB,iCAAiC;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE7B,0BAA0B;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE9B,wBAAwB;IACxB,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAE3B,gCAAgC;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEjC,kBAAkB;IAClB,0CAA0C;IAC1C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC;IAElE,gCAAgC;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAElC,oBAAoB;IACpB,qCAAqC;IACrC,SAAS,EAAE,sBAAsB;IAEjC,uBAAuB;IACvB,4DAA4D;IAC5D,YAAY,EAAE,iCAAiC,CAAC,QAAQ,EAAE;IAE1D,iBAAiB;IACjB,gEAAgE;IAChE,MAAM,EAAE,4BAA4B,CAAC,QAAQ,EAAE;IAE/C,8BAA8B;IAC9B,8DAA8D;IAC9D,WAAW,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAEhD,sCAAsC;IACtC,2BAA2B;IAC3B,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;IAEzF,+CAA+C;IAC/C,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC;IAE3E,sBAAsB;IACtB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAExC,mCAAmC;IACnC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC;IAExE,gCAAgC;IAChC;;;OAGG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;QAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;QACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAChC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;YACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;SAClB,CAAC,CAAC,CAAC,QAAQ,EAAE;KACf,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEd,4DAA4D;IAC5D,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE5D,oDAAoD;IACpD,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE7D,0CAA0C;IAC1C,6DAA6D;IAC7D,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;QAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;QAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACpC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC;KACpD,CAAC,CAAC,QAAQ,EAAE;IAEb,uCAAuC;IACvC,iDAAiD;IACjD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACzD,CAAC,CAAC;AAGH,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,GAAG;AACH,2EAA2E;AAC3E,+EAA+E;AAC/E,EAAE;AAEF,gFAAgF;AAChF,gDAAgD;AAChD,gFAAgF;AAGhF,gFAAgF;AAChF,iDAAiD;AACjD,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,sCAAsC;IACtC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IAEtB,mBAAmB;IACnB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IAEvB,oCAAoC;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IAEvC,qDAAqD;IACrD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEhC,mCAAmC;IACnC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEnC,sDAAsD;IACtD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE5C,sBAAsB;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE9B,iDAAiD;IACjD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE5B,wCAAwC;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IAErB,8CAA8C;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAElD,oDAAoD;IACpD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAKH;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,0DAA0D,CAAC,MAAM,CAAC;IAClH,oCAAoC;IACpC,uEAAuE;IACvE,gBAAgB,EAAE,+BAA+B,CAAC,QAAQ,EAAE;IAE5D,mDAAmD;IACnD,iCAAiC;IACjC,qBAAqB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEzC,uBAAuB;IACvB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEvC,sEAAsE;IACtE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC1B,qEAAqE;QACrE,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAE9C,uEAAuE;QACvE,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAEtD,qCAAqC;QACrC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAEpD,sDAAsD;QACtD,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KAC9C,CAAC,CAAC,OAAO,CAAC;QACT,kBAAkB,EAAE,KAAK;QACzB,qBAAqB,EAAE,EAAE;QACzB,mBAAmB,EAAE,EAAE;QACvB,kBAAkB,EAAE,IAAI;KACzB,CAAC;CACH,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAS3D,gFAAgF;AAChF,gDAAgD;AAChD,gFAAgF;AAEhF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,kDAAkD;IAClD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAEpC,kDAAkD;IAClD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE/C,4CAA4C;IAC5C,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC;IAE1E,qCAAqC;IACrC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,MAAM,CAAC;IAEhF,+DAA+D;IAC/D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEvC,2DAA2D;IAC3D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAErC,qDAAqD;IACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC","sourcesContent":["/*\n OAuth2 Protocol Schemas for External Connectors\n * \n * This module integrates the comprehensive OAuth2 definitions with the\n * external connectors protocol engine. It provides:\n * \n * 1. SSO_OAuth2 Protocol - For user authentication (OpenID Connect)\n * 2. OAuth2 API Auth Profile - For linking OAuth2 to REST API authentication\n /\n\nimport { z } from 'zod';\nimport { \n ExternalProvider_ExchangeProtocol_Configuration_BaseSchema, \n ExternalProvider_ExchangeProtocol_Kind \n} from '../core/commons.external-connectors-models.schemas';\n\n// Re-export OAuth2 enums from the shared enums file (avoids circular dependency)\nexport {\n OAuth2_GrantType,\n OAuth2_ResponseType,\n OAuth2_PKCE_Method,\n OAuth2_TokenEndpoint_AuthMethod,\n OAuth2_Prompt,\n OAuth2_AccessType,\n OAuth2_Purpose,\n OAuth2_TokenFormat,\n OAuth2_TokenLocation,\n} from '../core/oauth2.enums';\n\nimport {\n OAuth2_GrantType,\n OAuth2_ResponseType,\n OAuth2_PKCE_Method,\n OAuth2_TokenEndpoint_AuthMethod,\n OAuth2_Prompt,\n OAuth2_AccessType,\n OAuth2_Purpose,\n OAuth2_TokenFormat,\n OAuth2_TokenLocation,\n} from '../core/oauth2.enums';\n\n\n/\n OAuth2 and OpenID Connect Protocol Definitions\n * \n * Based on:\n * - RFC 6749: The OAuth 2.0 Authorization Framework\n * - RFC 7636: Proof Key for Code Exchange (PKCE)\n * - OpenID Connect Core 1.0\n * - RFC 7662: OAuth 2.0 Token Introspection\n * - RFC 7009: OAuth 2.0 Token Revocation\n * \n * This module provides standardized OAuth2 definitions that unify:\n * 1. API Authentication (for REST/GraphQL/Webhook calls)\n * 2. User SSO Authentication (OpenID Connect overlay)\n * 3. Service-to-Service (S2S) authentication\n /\n\n// =============================================================================\n// CAPABILITY FLAGS - Provider Features and Limitations\n// =============================================================================\n\n/\n OAuth2 Provider Capabilities - what the provider supports\n * These flags help determine what flows and features are available\n /\nexport const OAuth2_ProviderCapabilitiesSchema = z.object({\n // ─── Grant Type Support ───\n /* Supports authorization_code grant (user-interactive flow) /\n supportsAuthorizationCode: z.boolean().optional(),\n \n /* Supports client_credentials grant (S2S/machine-to-machine) /\n supportsClientCredentials: z.boolean().optional(),\n \n /* Supports device_code grant (input-constrained devices) /\n supportsDeviceCode: z.boolean().optional(),\n \n /* Supports JWT bearer assertions /\n supportsJwtBearer: z.boolean().optional(),\n \n // ─── Token Features ───\n /* Supports refresh tokens /\n supportsRefreshToken: z.boolean().optional(),\n \n /* Provider rotates refresh tokens on each use /\n rotatesRefreshToken: z.boolean().optional(),\n \n /* Supports token revocation (RFC 7009) /\n supportsTokenRevocation: z.boolean().optional(),\n \n /* Supports token introspection (RFC 7662) /\n supportsTokenIntrospection: z.boolean().optional(),\n \n // ─── Security Features ───\n /* Supports PKCE (RFC 7636) - required for public clients /\n supportsPKCE: z.boolean().optional(),\n \n /* PKCE is required (not optional) /\n requiresPKCE: z.boolean().optional(),\n \n /* Preferred PKCE method /\n preferredPKCEMethod: z.enum(OAuth2_PKCE_Method).optional(),\n \n // ─── OpenID Connect Features ───\n /* Supports OpenID Connect /\n supportsOIDC: z.boolean().optional(),\n \n /* Supports OIDC Discovery (.well-known/openid-configuration) /\n supportsOIDCDiscovery: z.boolean().optional(),\n \n /* Supports userinfo endpoint /\n supportsUserInfo: z.boolean().optional(),\n \n /* Supports ID tokens /\n supportsIdToken: z.boolean().optional(),\n \n // ─── Advanced Features ───\n /* Supports incremental authorization (adding scopes) /\n supportsIncrementalAuth: z.boolean().optional(),\n \n /* Supports scope reduction on token refresh /\n supportsScopeReduction: z.boolean().optional(),\n \n /* Supports custom domains/environments /\n supportsCustomDomains: z.boolean().optional(),\n \n /* Supports multi-tenancy /\n supportsMultiTenancy: z.boolean().optional(),\n});\nexport type OAuth2_ProviderCapabilities = z.infer<typeof OAuth2_ProviderCapabilitiesSchema>;\n\n// =============================================================================\n// ENDPOINTS - OAuth2 Server Endpoints\n// =============================================================================\n\n/\n OAuth2 Endpoints Configuration\n * Standard endpoints as defined in RFC 6749 and OIDC Discovery\n /\nexport const OAuth2_EndpointsSchema = z.object({\n // ─── Core OAuth2 Endpoints (RFC 6749) ───\n /* Authorization endpoint - where user grants access /\n authorizationUrl: z.url(),\n \n /* Token endpoint - where tokens are exchanged /\n tokenUrl: z.url(),\n \n // ─── Optional Endpoints ───\n /* Refresh URL - often same as tokenUrl, but some providers differ /\n refreshUrl: z.url().optional(),\n \n /* Revocation endpoint (RFC 7009) /\n revocationUrl: z.url().optional(),\n \n /* Introspection endpoint (RFC 7662) /\n introspectionUrl: z.url().optional(),\n \n /* Device authorization endpoint (RFC 8628) /\n deviceAuthorizationUrl: z.url().optional(),\n \n // ─── OpenID Connect Endpoints ───\n /* UserInfo endpoint - for fetching user profile /\n userInfoUrl: z.url().optional(),\n \n /* JWKS endpoint - for verifying tokens /\n jwksUrl: z.url().optional(),\n \n /* OIDC Discovery endpoint /\n discoveryUrl: z.url().optional(),\n \n /* End session / logout endpoint /\n endSessionUrl: z.url().optional(),\n \n // ─── Provider-Specific ───\n /* Custom API base URL (for making authenticated API calls) /\n apiBaseUrl: z.url().optional(),\n});\nexport type OAuth2_Endpoints = z.infer<typeof OAuth2_EndpointsSchema>;\n\n// =============================================================================\n// SCOPE DEFINITIONS - Granular Permissions\n// =============================================================================\n\n/\n OAuth2 Scope Definition - describes what a scope grants\n /\nexport const OAuth2_ScopeDefinitionSchema = z.object({\n /* The scope string as used in OAuth2 requests /\n scope: z.string(),\n \n /* Human-readable description /\n description: z.string().optional(),\n \n /* Is this scope required or optional? /\n required: z.boolean().optional(),\n \n /* Category for grouping scopes (e.g., 'read', 'write', 'admin') /\n category: z.string().optional(),\n \n /* Is this an OIDC standard scope? /\n isOIDC: z.boolean().optional(),\n \n /* Does this scope grant offline access (refresh tokens)? /\n grantsOfflineAccess: z.boolean().optional(),\n \n /* Related resources or APIs this scope provides access to /\n resources: z.array(z.string()).optional(),\n});\nexport type OAuth2_ScopeDefinition = z.infer<typeof OAuth2_ScopeDefinitionSchema>;\n\n/\n Scope Collection - organized scopes for a provider\n /\nexport const OAuth2_ScopeCollectionSchema = z.object({\n /* All available scopes /\n available: z.array(OAuth2_ScopeDefinitionSchema).optional(),\n \n /* Default scopes for user SSO authentication /\n defaultForSSO: z.array(z.string()).optional(),\n \n /* Default scopes for API access /\n defaultForAPI: z.array(z.string()).optional(),\n \n /* Minimum required scopes /\n minimum: z.array(z.string()).optional(),\n \n /* Scope that grants offline/refresh access (e.g., 'offline_access') /\n offlineAccessScope: z.string().optional(),\n});\nexport type OAuth2_ScopeCollection = z.infer<typeof OAuth2_ScopeCollectionSchema>;\n\n// =============================================================================\n// TOKEN CONFIGURATION - Token handling specifics\n// =============================================================================\n\n/\n Token Configuration - how tokens behave\n /\nexport const OAuth2_TokenConfigSchema = z.object({\n /* Token type (usually 'Bearer') /\n tokenType: z.string().optional(),\n \n /* Default access token lifetime in seconds /\n accessTokenLifetime: z.number().positive().optional(),\n \n /* Default refresh token lifetime in seconds /\n refreshTokenLifetime: z.number().positive().optional(),\n \n /* ID token lifetime in seconds (OIDC) /\n idTokenLifetime: z.number().positive().optional(),\n \n /* How to authenticate at the token endpoint /\n tokenEndpointAuthMethod: z.enum(OAuth2_TokenEndpoint_AuthMethod).optional(),\n \n /* Additional headers required for token requests /\n tokenRequestHeaders: z.record(z.string(), z.string()).optional(),\n \n /* How early (in seconds) to refresh tokens before expiry /\n refreshBufferSeconds: z.number().nonnegative().optional(),\n});\nexport type OAuth2_TokenConfig = z.infer<typeof OAuth2_TokenConfigSchema>;\n\n// =============================================================================\n// MAIN OAUTH2 PROVIDER DEFINITION\n// =============================================================================\n\n/\n Complete OAuth2 Provider Definition\n * This is the main schema that captures all OAuth2 configuration for a provider\n /\nexport const OAuth2_ProviderDefinitionSchema = z.object({\n // ─── Identity ───\n /* Unique provider identifier /\n providerId: z.string().min(1),\n \n /* Display name for UI /\n displayName: z.string().min(1),\n \n /* Provider icon URL /\n iconUrl: z.url().optional(),\n \n /* Primary brand color (hex) /\n brandColor: z.string().optional(),\n \n // ─── Purpose ───\n /* What this OAuth2 config is used for /\n purpose: z.enum(OAuth2_Purpose).default(OAuth2_Purpose.API_ACCESS),\n \n /* Is this provider enabled? /\n enabled: z.boolean().default(true),\n \n // ─── Endpoints ───\n /* OAuth2 endpoints configuration /\n endpoints: OAuth2_EndpointsSchema,\n \n // ─── Capabilities ───\n /* What the provider supports (all fields have defaults) /\n capabilities: OAuth2_ProviderCapabilitiesSchema.optional(),\n \n // ─── Scopes ───\n /* Scope definitions and defaults (all fields have defaults) /\n scopes: OAuth2_ScopeCollectionSchema.optional(),\n \n // ─── Token Configuration ───\n /* Token handling configuration (all fields have defaults) /\n tokenConfig: OAuth2_TokenConfigSchema.optional(),\n \n // ─── Authorization Configuration ───\n /* Preferred grant type /\n preferredGrantType: z.enum(OAuth2_GrantType).default(OAuth2_GrantType.AUTHORIZATION_CODE),\n \n /* Response type for authorization requests /\n responseType: z.enum(OAuth2_ResponseType).default(OAuth2_ResponseType.CODE),\n \n /* Prompt behavior /\n prompt: z.enum(OAuth2_Prompt).optional(),\n \n /* Access type (online/offline) /\n accessType: z.enum(OAuth2_AccessType).default(OAuth2_AccessType.OFFLINE),\n \n // ─── Dynamic Configuration ───\n /* \n * Template variables that can be substituted in URLs\n * e.g., { location: 'us' } for 'https://accounts.{location}.zoho.com'\n /\n templateVariables: z.record(z.string(), z.object({\n displayName: z.string(),\n description: z.string().optional(),\n required: z.boolean().optional(),\n defaultValue: z.string().optional(),\n options: z.array(z.object({\n value: z.string(),\n label: z.string(),\n })).optional(),\n })).optional(),\n \n /* Extra parameters to include in authorization requests /\n extraAuthParams: z.record(z.string(), z.string()).optional(),\n \n /* Extra parameters to include in token requests /\n extraTokenParams: z.record(z.string(), z.string()).optional(),\n \n // ─── User Profile Mapping (OIDC/SSO) ───\n /* Mapping for extracting user info from profile response /\n userProfileMapping: z.object({\n id: z.string().default('sub'),\n email: z.string().default('email'),\n name: z.string().default('name'),\n image: z.string().default('picture'),\n emailVerified: z.string().default('email_verified'),\n }).optional(),\n \n // ─── Provider-Specific Extensions ───\n /* Provider-specific configuration extensions /\n extensions: z.record(z.string(), z.unknown()).optional(),\n});\nexport type OAuth2_ProviderDefinition = z.infer<typeof OAuth2_ProviderDefinitionSchema>;\n\n// =============================================================================\n// NOTE: OAuth2 configurations are defined per-provider in external-connectors\n// =============================================================================\n// \n// Each provider folder (e.g., google/, microsoft/) contains its own OAuth2\n// protocol definition. Use provider string identifiers to reference providers.\n//\n\n// =============================================================================\n// SSO OAUTH2 PROTOCOL - For User Authentication\n// =============================================================================\n\n\n// =============================================================================\n// RUNTIME CREDENTIAL - Active OAuth2 credentials\n// =============================================================================\n\n/\n OAuth2 Credential - Active tokens for a provider connection\n * This is what gets stored after successful OAuth2 authentication\n /\nexport const OAuth2_CredentialSchema = z.object({\n /* Provider this credential is for /\n providerId: z.string(),\n \n /* Access token /\n accessToken: z.string(),\n \n /* Token type (usually 'Bearer') /\n tokenType: z.string().default('Bearer'),\n \n /* When the access token expires (Unix timestamp) /\n expiresAt: z.number().optional(),\n \n /* Refresh token (if available) /\n refreshToken: z.string().optional(),\n \n /* When the refresh token expires (Unix timestamp) /\n refreshTokenExpiresAt: z.number().optional(),\n \n /* ID token (OIDC) /\n idToken: z.string().optional(),\n \n /* Granted scopes (may differ from requested) /\n scope: z.string().optional(),\n \n /* When this credential was obtained /\n claimedAt: z.number(),\n \n /* Additional data from the token response /\n data: z.record(z.string(), z.unknown()).optional(),\n \n /* Provider-specific properties used during auth /\n props: z.record(z.string(), z.unknown()).optional(),\n});\nexport type OAuth2_Credential = z.infer<typeof OAuth2_CredentialSchema>;\n\n\n\n/\n OAuth2 Provider Configuration - Runtime configuration\n * Contains the OAuth2 endpoints and configuration\n /\nexport const OAuth2Provider_ConfigurationSchema = ExternalProvider_ExchangeProtocol_Configuration_BaseSchema.extend({\n // ─── OAuth2 Core Configuration ───\n /* Complete OAuth2 provider definition (new comprehensive approach) /\n oauth2Definition: OAuth2_ProviderDefinitionSchema.optional(),\n \n // ─── Legacy fields for backward compatibility ───\n /* Authorization endpoint URL /\n authorizationEndpoint: z.url().optional(),\n \n /* Requested scopes /\n scopes: z.array(z.string()).default([]),\n\n // ─── Integration Access (for providers that offer multiple APIs) ───\n integrationAccess: z.object({\n /* Enable third-party integrations through this OAuth2 connection /\n enableIntegrations: z.boolean().default(false),\n \n /* Available integrations (e.g., ['drive', 'calendar', 'contacts']) /\n availableIntegrations: z.array(z.string()).default([]),\n \n /* Default integrations to enable /\n defaultIntegrations: z.array(z.string()).default([]),\n \n /* User must grant permission for each integration /\n requiresPermission: z.boolean().default(true),\n }).default({\n enableIntegrations: false,\n availableIntegrations: [],\n defaultIntegrations: [],\n requiresPermission: true,\n }),\n});\n\n/\n OAuth2 Provider Operation - Operations that require OAuth2\n * Currently empty, reserved for future use\n /\nexport const OAuth2Provider_OperationSchema = z.object({});\n\n// =============================================================================\n// INFERRED TYPES\n// =============================================================================\n\nexport type OAuth2Provider_Configuration = z.infer<typeof OAuth2Provider_ConfigurationSchema>;\nexport type OAuth2Provider_Operation = z.infer<typeof OAuth2Provider_OperationSchema>;\n\n// =============================================================================\n// OAUTH2 API AUTHENTICATION LINK (Consolidated)\n// =============================================================================\n\n/\n OAuth2 API Auth Link\n * \n * Unified schema for linking OAuth2 credentials to REST API / Hook authentication.\n * This prevents duplication between auth profile and OAuth2 config.\n * \n * When a REST API uses OAuth2 for authentication:\n * 1. Define the OAuth2 provider once (endpoints, scopes, capabilities)\n * 2. Link it to the API auth profile using this schema\n * 3. The system will automatically:\n * - Manage token refresh\n * - Format Authorization headers\n * - Track required scopes per operation\n /\nexport const OAuth2_APIAuthLinkSchema = z.object({\n /* Reference to the OAuth2 provider definition /\n oauth2ProviderRef: z.string().min(1),\n \n /* Which scopes are needed for this API access /\n requiredScopes: z.array(z.string()).default([]),\n \n /* How to format the token for API calls /\n tokenFormat: z.enum(OAuth2_TokenFormat).default(OAuth2_TokenFormat.BEARER),\n \n /* Where to send the access token /\n tokenLocation: z.enum(OAuth2_TokenLocation).default(OAuth2_TokenLocation.HEADER),\n \n /* Custom header name (when tokenFormat is 'custom_header') /\n customHeaderName: z.string().optional(),\n \n /* Query parameter name (when tokenLocation is 'query') /\n queryParamName: z.string().optional(),\n \n /* Prefix for the token value (optional override) /\n tokenPrefix: z.string().optional(),\n});\nexport type OAuth2_APIAuthLink = z.infer<typeof OAuth2_APIAuthLinkSchema>;\n\n// Note: OAuth2_APIAuthLinkSchema is now defined in the consolidated section above\n\n// =============================================================================\n// HELPER TYPES\n// =============================================================================\n\n/\n OAuth2 Authorization Request - parameters for the authorization URL\n /\nexport interface OAuth2_AuthorizationRequest {\n clientId: string;\n redirectUri: string;\n scope: string[];\n state: string;\n responseType?: OAuth2_ResponseType;\n codeChallenge?: string;\n codeChallengeMethod?: OAuth2_PKCE_Method;\n prompt?: OAuth2_Prompt;\n accessType?: OAuth2_AccessType;\n extraParams?: Record<string, string>;\n}\n\n/\n OAuth2 Token Request - parameters for the token endpoint\n /\nexport interface OAuth2_TokenRequest {\n grantType: OAuth2_GrantType;\n clientId: string;\n clientSecret?: string;\n code?: string;\n redirectUri?: string;\n codeVerifier?: string;\n refreshToken?: string;\n scope?: string[];\n extraParams?: Record<string, string>;\n}\n\n/\n OAuth2 Token Response - response from the token endpoint\n */\nexport interface OAuth2_TokenResponse {\n accessToken: string;\n tokenType: string;\n expiresIn?: number;\n refreshToken?: string;\n scope?: string;\n idToken?: string;\n data?: Record<string, unknown>;\n}\n\n"]}

package/dist/esm/protocols/provider-configuration-authoring.external-connectors-models.schemas.d.ts ADDED Viewed

@@ -0,0 +1,52 @@
+import { z } from "zod";
+import { ExternalProvider_ExchangeProtocol_Kind } from "../core/commons.external-connectors-models.schemas";
+/**
+ * What an application may author in a `providerConfigurations.<providerRef>.<protocol>` bag, for the protocols the ENGINE
+ * reads (#3003): every key a reader looks at, and nothing else. A key outside it is refused, naming the provider, the
+ * protocol and the key, because no reader would ever see it: a misspelt `fromAdress`, a key from a retired protocol, or a
+ * setting the author believed was a control. The configuration would look set and do nothing.
+ *
+ * | protocol | its reader | the keys it reads |
+ * |---|---|---|
+ * | `email_provider` | the email service's sender (`EmailBackendService`) | `fromAddress`, `fromName`, `domain` |
+ * | `sms_provider` | the SMS service's sender (`SmsBackendService`) | `fromNumber` |
+ * | `agent_client_protocol` | the registry's ACP resolution | `defaultExecutionProfileRef`, `executionProfiles`, each profile parsed by `AgentClientProtocol_ExecutionProfileSchema` |
+ *
+ * plus the shared keys above, on each.
+ *
+ * PARTIAL over the protocol vocabulary, deliberately. A protocol absent here is not checked yet, because its keys are not
+ * the engine's to list:
+ * - `sso_oauth2` reads its client id under a key the provider MODULE names (`clientIdPublicConfigKey`, e.g.
+ *   `GOOGLE_OAUTH2_CLIENT_ID`), so its allowed keys depend on the module;
+ * - `frontend_sdk` is the module's public configuration, which the provider's own schema already validates when it is
+ *   served (`/application-config`);
+ * - a second-level key a module reads itself (`registration`, read by `wildo providers register`) is not a protocol bag;
+ * - the remaining protocols read no authored key beyond the shared ones today, and are listed here when a reader is
+ *   measured rather than assumed.
+ * Those are the module-declared half of #3003, still owed: a provider module declaring the schema of its own keys.
+ *
+ * Import path: `@wildo-ai/external-connectors-models`.
+ */
+export declare const ENGINE_READ_PROVIDER_PROTOCOL_CONFIGURATION_SCHEMAS: Readonly<Partial<Record<ExternalProvider_ExchangeProtocol_Kind, z.ZodType>>>;
+/**
+ * Report, as issues on `ctx`, every authored provider-configuration value a reader would not use (#3003), after the keys
+ * the provider MODULE owns (#2995, the first rule): a key the protocol's reader does not read, and a value of the wrong
+ * shape (an ACP execution profile the runner would refuse). Each issue's path is
+ * `<providerRef>.<protocol>.<key…>`, and its message names the provider, the protocol and the key.
+ *
+ * The refinement every `providerConfigurations` schema applies (`defineSaaSConfig`, the per-environment overlay, the
+ * backend's application configuration and its configuration loader), so all four refuse the same values in the same
+ * words. A protocol with no engine authoring schema ({@link ENGINE_READ_PROVIDER_PROTOCOL_CONFIGURATION_SCHEMAS}) is not
+ * checked beyond the module-owned keys.
+ *
+ * assurance-control: WILDO.SECRETS.CREDENTIAL_SCOPING — a configuration cannot author where a provider's credential is sent (#2995).
+ */
+export declare function refuseUnreadProviderConfigurationValues(providerConfigurations: unknown, ctx: z.RefinementCtx): void;
+/** The one sentence an unread key is refused with, so an operator greps one wording (#3003). */
+export declare function describeUnreadProviderConfigurationKey(finding: {
+    readonly providerRef: string;
+    readonly protocolKey: string;
+    readonly path: readonly string[];
+    readonly admitted: readonly string[];
+}): string;
+//# sourceMappingURL=provider-configuration-authoring.external-connectors-models.schemas.d.ts.map

package/dist/esm/protocols/provider-configuration-authoring.external-connectors-models.schemas.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"provider-configuration-authoring.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../src/protocols/provider-configuration-authoring.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,sCAAsC,EAGvC,MAAM,oDAAoD,CAAC;AAiB5D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,mDAAmD,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,sCAAsC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAgB5I,CAAC;AAWF;;;;;;;;;;;;GAYG;AACH,wBAAgB,uCAAuC,CAAC,sBAAsB,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,aAAa,GAAG,IAAI,CAuCnH;AAED,gGAAgG;AAChG,wBAAgB,sCAAsC,CAAC,OAAO,EAAE;IAC9D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,GAAG,MAAM,CAKT"}

package/dist/esm/protocols/provider-configuration-authoring.external-connectors-models.schemas.js ADDED Viewed

@@ -0,0 +1,132 @@
+import { z } from "zod";
+import { ExternalProvider_ExchangeProtocol_Kind, findModuleOwnedProviderConfigurationKeys, describeModuleOwnedProviderConfigurationKey, } from "../core/commons.external-connectors-models.schemas.js";
+import { AgentClientProtocol_ExecutionProfileSchema } from "./agent-client-protocol.external-connectors-models.schemas.js";
+/**
+ * The keys the protocol readers share, read on every protocol bag the registry resolves: `enabled`
+ * (`isProviderEnabled`), `authConfig` (its credential fields are held by their own doors, #3002 / #3018) and
+ * `rateLimitConfig`. Derived from the base configuration schema, so a field added there is admitted here with it.
+ *
+ * Their VALUES are checked for shape only (a boolean, an object): `authConfig` is deep-merged over the module's own, so an
+ * authored one is legitimately partial (`{ secretRef }` alone), and parsing it whole would refuse that.
+ */
+const SHARED_PROTOCOL_CONFIGURATION_SHAPE = {
+    enabled: z.boolean().optional(),
+    authConfig: z.record(z.string(), z.unknown()).optional(),
+    rateLimitConfig: z.record(z.string(), z.unknown()).optional(),
+};
+/**
+ * What an application may author in a `providerConfigurations.<providerRef>.<protocol>` bag, for the protocols the ENGINE
+ * reads (#3003): every key a reader looks at, and nothing else. A key outside it is refused, naming the provider, the
+ * protocol and the key, because no reader would ever see it: a misspelt `fromAdress`, a key from a retired protocol, or a
+ * setting the author believed was a control. The configuration would look set and do nothing.
+ *
+ * | protocol | its reader | the keys it reads |
+ * |---|---|---|
+ * | `email_provider` | the email service's sender (`EmailBackendService`) | `fromAddress`, `fromName`, `domain` |
+ * | `sms_provider` | the SMS service's sender (`SmsBackendService`) | `fromNumber` |
+ * | `agent_client_protocol` | the registry's ACP resolution | `defaultExecutionProfileRef`, `executionProfiles`, each profile parsed by `AgentClientProtocol_ExecutionProfileSchema` |
+ *
+ * plus the shared keys above, on each.
+ *
+ * PARTIAL over the protocol vocabulary, deliberately. A protocol absent here is not checked yet, because its keys are not
+ * the engine's to list:
+ * - `sso_oauth2` reads its client id under a key the provider MODULE names (`clientIdPublicConfigKey`, e.g.
+ *   `GOOGLE_OAUTH2_CLIENT_ID`), so its allowed keys depend on the module;
+ * - `frontend_sdk` is the module's public configuration, which the provider's own schema already validates when it is
+ *   served (`/application-config`);
+ * - a second-level key a module reads itself (`registration`, read by `wildo providers register`) is not a protocol bag;
+ * - the remaining protocols read no authored key beyond the shared ones today, and are listed here when a reader is
+ *   measured rather than assumed.
+ * Those are the module-declared half of #3003, still owed: a provider module declaring the schema of its own keys.
+ *
+ * Import path: `@wildo-ai/external-connectors-models`.
+ */
+export const ENGINE_READ_PROVIDER_PROTOCOL_CONFIGURATION_SCHEMAS = {
+    [ExternalProvider_ExchangeProtocol_Kind.EMAIL_PROVIDER]: z.strictObject({
+        ...SHARED_PROTOCOL_CONFIGURATION_SHAPE,
+        fromAddress: z.string().optional(),
+        fromName: z.string().optional(),
+        domain: z.string().optional(),
+    }),
+    [ExternalProvider_ExchangeProtocol_Kind.SMS_PROVIDER]: z.strictObject({
+        ...SHARED_PROTOCOL_CONFIGURATION_SHAPE,
+        fromNumber: z.string().optional(),
+    }),
+    [ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL]: z.strictObject({
+        ...SHARED_PROTOCOL_CONFIGURATION_SHAPE,
+        defaultExecutionProfileRef: z.string().optional(),
+        executionProfiles: z.record(z.string(), AgentClientProtocol_ExecutionProfileSchema).optional(),
+    }),
+};
+/** The keys a checked protocol bag admits, for a refusal to name: the authoring schema's own, read from it. */
+function admittedKeysOf(schema) {
+    return schema instanceof z.ZodObject ? Object.keys(schema.shape) : [];
+}
+function isPlainRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+ * Report, as issues on `ctx`, every authored provider-configuration value a reader would not use (#3003), after the keys
+ * the provider MODULE owns (#2995, the first rule): a key the protocol's reader does not read, and a value of the wrong
+ * shape (an ACP execution profile the runner would refuse). Each issue's path is
+ * `<providerRef>.<protocol>.<key…>`, and its message names the provider, the protocol and the key.
+ *
+ * The refinement every `providerConfigurations` schema applies (`defineSaaSConfig`, the per-environment overlay, the
+ * backend's application configuration and its configuration loader), so all four refuse the same values in the same
+ * words. A protocol with no engine authoring schema ({@link ENGINE_READ_PROVIDER_PROTOCOL_CONFIGURATION_SCHEMAS}) is not
+ * checked beyond the module-owned keys.
+ *
+ * assurance-control: WILDO.SECRETS.CREDENTIAL_SCOPING — a configuration cannot author where a provider's credential is sent (#2995).
+ */
+export function refuseUnreadProviderConfigurationValues(providerConfigurations, ctx) {
+    const moduleOwned = findModuleOwnedProviderConfigurationKeys(providerConfigurations);
+    for (const finding of moduleOwned) {
+        ctx.addIssue({
+            code: "custom",
+            path: [finding.providerRef, finding.protocolKey, finding.key],
+            message: describeModuleOwnedProviderConfigurationKey(finding),
+        });
+    }
+    if (!isPlainRecord(providerConfigurations))
+        return;
+    for (const [providerRef, protocols] of Object.entries(providerConfigurations)) {
+        if (!isPlainRecord(protocols))
+            continue;
+        for (const [protocolKey, bag] of Object.entries(protocols)) {
+            const schema = ENGINE_READ_PROVIDER_PROTOCOL_CONFIGURATION_SCHEMAS[protocolKey];
+            if (schema === undefined || bag === undefined)
+                continue;
+            // A module-owned key is already reported, in its own words; do not report it a second time as unread.
+            const moduleOwnedHere = new Set(moduleOwned.filter((f) => f.providerRef === providerRef && f.protocolKey === protocolKey).map((f) => f.key));
+            const checked = isPlainRecord(bag) ? Object.fromEntries(Object.entries(bag).filter(([key]) => !moduleOwnedHere.has(key))) : bag;
+            const parsed = schema.safeParse(checked);
+            if (parsed.success)
+                continue;
+            for (const issue of parsed.error.issues) {
+                if (issue.code === "unrecognized_keys") {
+                    for (const key of issue.keys) {
+                        ctx.addIssue({
+                            code: "custom",
+                            path: [providerRef, protocolKey, ...issue.path, key],
+                            message: describeUnreadProviderConfigurationKey({ providerRef, protocolKey, path: [...issue.path.map(String), key], admitted: admittedKeysOf(schema) }),
+                        });
+                    }
+                    continue;
+                }
+                ctx.addIssue({
+                    code: "custom",
+                    path: [providerRef, protocolKey, ...issue.path],
+                    message: `providerConfigurations.${[providerRef, protocolKey, ...issue.path.map(String)].join(".")} is refused: ${issue.message}`,
+                });
+            }
+        }
+    }
+}
+/** The one sentence an unread key is refused with, so an operator greps one wording (#3003). */
+export function describeUnreadProviderConfigurationKey(finding) {
+    const where = `providerConfigurations.${[finding.providerRef, finding.protocolKey, ...finding.path].join(".")}`;
+    const admitted = finding.path.length === 1 && finding.admitted.length > 0 ? ` It reads: ${finding.admitted.join(", ")}.` : "";
+    return `${where} is refused: no reader of the '${finding.protocolKey}' protocol reads '${finding.path[finding.path.length - 1]}', `
+        + `so it would be ignored. Remove it, or correct its spelling.${admitted}`;
+}
+//# sourceMappingURL=provider-configuration-authoring.external-connectors-models.schemas.js.map

package/dist/esm/protocols/provider-configuration-authoring.external-connectors-models.schemas.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"provider-configuration-authoring.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../src/protocols/provider-configuration-authoring.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,sCAAsC,EACtC,wCAAwC,EACxC,2CAA2C,GAC5C,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,0CAA0C,EAAE,MAAM,4DAA4D,CAAC;AAExH;;;;;;;GAOG;AACH,MAAM,mCAAmC,GAAG;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxD,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC6C,CAAC;AAE7G;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,mDAAmD,GAAiF;IAC/I,CAAC,sCAAsC,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC;QACtE,GAAG,mCAAmC;QACtC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC;IACF,CAAC,sCAAsC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC;QACpE,GAAG,mCAAmC;QACtC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAClC,CAAC;IACF,CAAC,sCAAsC,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC;QAC7E,GAAG,mCAAmC;QACtC,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,0CAA0C,CAAC,CAAC,QAAQ,EAAE;KAC/F,CAAC;CACH,CAAC;AAEF,+GAA+G;AAC/G,SAAS,cAAc,CAAC,MAAiB;IACvC,OAAO,MAAM,YAAY,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,uCAAuC,CAAC,sBAA+B,EAAE,GAAoB;IAC3G,MAAM,WAAW,GAAG,wCAAwC,CAAC,sBAAsB,CAAC,CAAC;IACrF,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;QAClC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC;YAC7D,OAAO,EAAE,2CAA2C,CAAC,OAAO,CAAC;SAC9D,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,sBAAsB,CAAC;QAAE,OAAO;IACnD,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC9E,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;YAAE,SAAS;QACxC,KAAK,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,MAAM,MAAM,GAAG,mDAAmD,CAAC,WAAqD,CAAC,CAAC;YAC1H,IAAI,MAAM,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS;gBAAE,SAAS;YACxD,sGAAsG;YACtG,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAa,CAAC,CAAC,CAAC;YACvJ,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAChI,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,MAAM,CAAC,OAAO;gBAAE,SAAS;YAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBACxC,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;oBACvC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;wBAC7B,GAAG,CAAC,QAAQ,CAAC;4BACX,IAAI,EAAE,QAAQ;4BACd,IAAI,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC;4BACpD,OAAO,EAAE,sCAAsC,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;yBACxJ,CAAC,CAAC;oBACL,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC;oBAC/C,OAAO,EAAE,0BAA0B,CAAC,WAAW,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,OAAO,EAAE;iBAClI,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,sCAAsC,CAAC,OAKtD;IACC,MAAM,KAAK,GAAG,0BAA0B,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAChH,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9H,OAAO,GAAG,KAAK,kCAAkC,OAAO,CAAC,WAAW,qBAAqB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK;UAC/H,8DAA8D,QAAQ,EAAE,CAAC;AAC/E,CAAC","sourcesContent":["import { z } from \"zod\";\nimport {\n ExternalProvider_ExchangeProtocol_Configuration_BaseSchema,\n ExternalProvider_ExchangeProtocol_Kind,\n findModuleOwnedProviderConfigurationKeys,\n describeModuleOwnedProviderConfigurationKey,\n} from \"../core/commons.external-connectors-models.schemas\";\nimport { AgentClientProtocol_ExecutionProfileSchema } from \"./agent-client-protocol.external-connectors-models.schemas\";\n\n/**\n * The keys the protocol readers share, read on every protocol bag the registry resolves: `enabled`\n * (`isProviderEnabled`), `authConfig` (its credential fields are held by their own doors, #3002 / #3018) and\n * `rateLimitConfig`. Derived from the base configuration schema, so a field added there is admitted here with it.\n *\n * Their VALUES are checked for shape only (a boolean, an object): `authConfig` is deep-merged over the module's own, so an\n * authored one is legitimately partial (`{ secretRef }` alone), and parsing it whole would refuse that.\n */\nconst SHARED_PROTOCOL_CONFIGURATION_SHAPE = {\n enabled: z.boolean().optional(),\n authConfig: z.record(z.string(), z.unknown()).optional(),\n rateLimitConfig: z.record(z.string(), z.unknown()).optional(),\n} satisfies Record<keyof typeof ExternalProvider_ExchangeProtocol_Configuration_BaseSchema.shape, z.ZodType>;\n\n/**\n * What an application may author in a `providerConfigurations.<providerRef>.<protocol>` bag, for the protocols the ENGINE\n * reads (#3003): every key a reader looks at, and nothing else. A key outside it is refused, naming the provider, the\n * protocol and the key, because no reader would ever see it: a misspelt `fromAdress`, a key from a retired protocol, or a\n * setting the author believed was a control. The configuration would look set and do nothing.\n *\n * | protocol | its reader | the keys it reads |\n * |---|---|---|\n * | `email_provider` | the email service's sender (`EmailBackendService`) | `fromAddress`, `fromName`, `domain` |\n * | `sms_provider` | the SMS service's sender (`SmsBackendService`) | `fromNumber` |\n * | `agent_client_protocol` | the registry's ACP resolution | `defaultExecutionProfileRef`, `executionProfiles`, each profile parsed by `AgentClientProtocol_ExecutionProfileSchema` |\n *\n * plus the shared keys above, on each.\n *\n * PARTIAL over the protocol vocabulary, deliberately. A protocol absent here is not checked yet, because its keys are not\n * the engine's to list:\n * - `sso_oauth2` reads its client id under a key the provider MODULE names (`clientIdPublicConfigKey`, e.g.\n * `GOOGLE_OAUTH2_CLIENT_ID`), so its allowed keys depend on the module;\n * - `frontend_sdk` is the module's public configuration, which the provider's own schema already validates when it is\n * served (`/application-config`);\n * - a second-level key a module reads itself (`registration`, read by `wildo providers register`) is not a protocol bag;\n * - the remaining protocols read no authored key beyond the shared ones today, and are listed here when a reader is\n * measured rather than assumed.\n * Those are the module-declared half of #3003, still owed: a provider module declaring the schema of its own keys.\n *\n * Import path: `@wildo-ai/external-connectors-models`.\n */\nexport const ENGINE_READ_PROVIDER_PROTOCOL_CONFIGURATION_SCHEMAS: Readonly<Partial<Record<ExternalProvider_ExchangeProtocol_Kind, z.ZodType>>> = {\n [ExternalProvider_ExchangeProtocol_Kind.EMAIL_PROVIDER]: z.strictObject({\n ...SHARED_PROTOCOL_CONFIGURATION_SHAPE,\n fromAddress: z.string().optional(),\n fromName: z.string().optional(),\n domain: z.string().optional(),\n }),\n [ExternalProvider_ExchangeProtocol_Kind.SMS_PROVIDER]: z.strictObject({\n ...SHARED_PROTOCOL_CONFIGURATION_SHAPE,\n fromNumber: z.string().optional(),\n }),\n [ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL]: z.strictObject({\n ...SHARED_PROTOCOL_CONFIGURATION_SHAPE,\n defaultExecutionProfileRef: z.string().optional(),\n executionProfiles: z.record(z.string(), AgentClientProtocol_ExecutionProfileSchema).optional(),\n }),\n};\n\n/** The keys a checked protocol bag admits, for a refusal to name: the authoring schema's own, read from it. */\nfunction admittedKeysOf(schema: z.ZodType): readonly string[] {\n return schema instanceof z.ZodObject ? Object.keys(schema.shape) : [];\n}\n\nfunction isPlainRecord(value: unknown): value is Record<string, unknown> {\n return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/**\n * Report, as issues on `ctx`, every authored provider-configuration value a reader would not use (#3003), after the keys\n * the provider MODULE owns (#2995, the first rule): a key the protocol's reader does not read, and a value of the wrong\n * shape (an ACP execution profile the runner would refuse). Each issue's path is\n * `<providerRef>.<protocol>.<key…>`, and its message names the provider, the protocol and the key.\n *\n * The refinement every `providerConfigurations` schema applies (`defineSaaSConfig`, the per-environment overlay, the\n * backend's application configuration and its configuration loader), so all four refuse the same values in the same\n * words. A protocol with no engine authoring schema ({@link ENGINE_READ_PROVIDER_PROTOCOL_CONFIGURATION_SCHEMAS}) is not\n * checked beyond the module-owned keys.\n *\n * assurance-control: WILDO.SECRETS.CREDENTIAL_SCOPING — a configuration cannot author where a provider's credential is sent (#2995).\n */\nexport function refuseUnreadProviderConfigurationValues(providerConfigurations: unknown, ctx: z.RefinementCtx): void {\n const moduleOwned = findModuleOwnedProviderConfigurationKeys(providerConfigurations);\n for (const finding of moduleOwned) {\n ctx.addIssue({\n code: \"custom\",\n path: [finding.providerRef, finding.protocolKey, finding.key],\n message: describeModuleOwnedProviderConfigurationKey(finding),\n });\n }\n if (!isPlainRecord(providerConfigurations)) return;\n for (const [providerRef, protocols] of Object.entries(providerConfigurations)) {\n if (!isPlainRecord(protocols)) continue;\n for (const [protocolKey, bag] of Object.entries(protocols)) {\n const schema = ENGINE_READ_PROVIDER_PROTOCOL_CONFIGURATION_SCHEMAS[protocolKey as ExternalProvider_ExchangeProtocol_Kind];\n if (schema === undefined || bag === undefined) continue;\n // A module-owned key is already reported, in its own words; do not report it a second time as unread.\n const moduleOwnedHere = new Set(moduleOwned.filter((f) => f.providerRef === providerRef && f.protocolKey === protocolKey).map((f) => f.key as string));\n const checked = isPlainRecord(bag) ? Object.fromEntries(Object.entries(bag).filter(([key]) => !moduleOwnedHere.has(key))) : bag;\n const parsed = schema.safeParse(checked);\n if (parsed.success) continue;\n for (const issue of parsed.error.issues) {\n if (issue.code === \"unrecognized_keys\") {\n for (const key of issue.keys) {\n ctx.addIssue({\n code: \"custom\",\n path: [providerRef, protocolKey, ...issue.path, key],\n message: describeUnreadProviderConfigurationKey({ providerRef, protocolKey, path: [...issue.path.map(String), key], admitted: admittedKeysOf(schema) }),\n });\n }\n continue;\n }\n ctx.addIssue({\n code: \"custom\",\n path: [providerRef, protocolKey, ...issue.path],\n message: `providerConfigurations.${[providerRef, protocolKey, ...issue.path.map(String)].join(\".\")} is refused: ${issue.message}`,\n });\n }\n }\n }\n}\n\n/** The one sentence an unread key is refused with, so an operator greps one wording (#3003). */\nexport function describeUnreadProviderConfigurationKey(finding: {\n readonly providerRef: string;\n readonly protocolKey: string;\n readonly path: readonly string[];\n readonly admitted: readonly string[];\n}): string {\n const where = `providerConfigurations.${[finding.providerRef, finding.protocolKey, ...finding.path].join(\".\")}`;\n const admitted = finding.path.length === 1 && finding.admitted.length > 0 ? ` It reads: ${finding.admitted.join(\", \")}.` : \"\";\n return `${where} is refused: no reader of the '${finding.protocolKey}' protocol reads '${finding.path[finding.path.length - 1]}', `\n + `so it would be ignored. Remove it, or correct its spelling.${admitted}`;\n}\n"]}

package/dist/esm/protocols/provider-connection-parameters.external-connectors-models.d.ts ADDED Viewed

@@ -0,0 +1,111 @@
+import { ProviderOAuth2EndpointPlaceholderPosition, type ProviderRestOAuth2 } from './rest-operations.external-connectors-models.schemas';
+/**
+ * Which `{placeholders}` a person connecting an account is ASKED for: "which tenant", "which cloud", "which subdomain".
+ *
+ * ## Why these functions live here, values-free
+ *
+ * The connect screen asks for them, and since #3251 the labelling pipeline plans a word for each one
+ * (`providers.<ref>.connectionParameters.<name>.{label,description}`). The catalogue computes the asked set from the
+ * provider's runtime contract inside the application backend; the labelling planner runs in the development companion
+ * and must not load a provider module, so it reads the same set from the provider's discovery contribution
+ * (`connectionParameterNames`). Both read ONE function, {@link describeProviderAskedConnectionParameters}, so the names
+ * the screen asks for and the names that get words cannot disagree. Until #3251 the catalogue's rules lived privately in
+ * the connected-accounts controller, and a second copy of them for the contribution would have been the enumeration that
+ * drifts.
+ *
+ * Every function here is pure and reads the declaration only: no deployment value, no secret.
+ */
+/**
+ * Every placeholder a provider's OAuth2 declaration carries, with each position it takes: across both
+ * endpoints (HOST / ORIGIN / PATH_OR_QUERY) and the scopes (a `{name}/…` scope makes `name` an ORIGIN).
+ * Whole-scope placeholders are returned separately — they form no URL component at all.
+ *
+ * One reader of "where does this name sit", shared by the connectability probe, the catalogue (which must neither
+ * ask for a placeholder no answer can satisfy nor render a host as a scope choice) and the discovery contribution.
+ * A scope with a template defect contributes nothing here; resolution refuses it. Throws when an endpoint template
+ * cannot be classified at all; every caller contains that per provider.
+ */
+export declare function collectProviderOAuth2PlaceholderPositions(oauth2: ProviderRestOAuth2): {
+    readonly positionsByName: ReadonlyMap<string, ReadonlySet<ProviderOAuth2EndpointPlaceholderPosition>>;
+    readonly wholeScopeNames: ReadonlySet<string>;
+};
+/**
+ * The placeholders a person connecting an account through the OAuth2 flow is ASKED for.
+ *
+ * Every declared one EXCEPT those the start route would refuse whatever was typed: a host/origin
+ * placeholder the deployment fills (from its base URL, or from a dedicated deployment-configured host,
+ * #992), a host/origin placeholder the provider declares no allowance for (#623), and a whole-scope
+ * placeholder with no declared scope values (#991). Asking for any of them would build a form field that
+ * can only fail — the catalogue's `notConnectableBecause` says why instead. Absent when nothing is left
+ * to ask, keeping "no placeholder" distinguishable.
+ */
+export declare function describeProviderOAuth2AskedConnectionParameters(oauth2: ProviderRestOAuth2 | undefined): readonly string[] | undefined;
+/**
+ * The REST-contract slice the TYPED-CREDENTIAL door reads (#1097): a literal base URL that may carry
+ * `{placeholder}`s, and the allowances governing the ones that form its host or origin. The same two fields
+ * `http-api-provider-access.resolveBaseUrlTemplate` reads at every call.
+ */
+export interface ProviderCredentialBaseUrlContract {
+    readonly baseUrl?: string;
+    readonly baseUrlHostAllowances?: ProviderRestOAuth2['endpointHostAllowances'];
+}
+/** What a pasted-credential vendor's base URL asks of the person connecting. See {@link describeProviderCredentialBaseUrlAnswers}. */
+export interface ProviderCredentialBaseUrlAnswers {
+    /** The placeholders the person is ASKED for, in template order; `undefined` when the base URL carries none to ask. */
+    readonly asked: readonly string[] | undefined;
+    /** Every name the contract declares — the base URL's placeholders and every allowance key — the names an answer is kept for. */
+    readonly declared: ReadonlySet<string>;
+    /** Host or origin placeholders NO allowance admits: every call would refuse, and nobody connecting can fix it. */
+    readonly hostsNotDeclared: readonly string[];
+    /** The template cannot be resolved safely whatever is answered — two placeholders in one authority, or unreadable. */
+    readonly templateDefective: boolean;
+    readonly positionsByName: ReadonlyMap<string, ReadonlySet<ProviderOAuth2EndpointPlaceholderPosition>>;
+}
+/** Whether a provider URL template carries a `{placeholder}` the resolver fills (the test `resolveBaseUrlTemplate` applies). */
+export declare function providerTemplateCarriesPlaceholder(template: string): boolean;
+/**
+ * What a PASTED-credential vendor's base URL asks of the person connecting (#1097).
+ *
+ * The OAuth2 start asks for the placeholders its endpoints and scopes carry. A vendor with no authorization
+ * flow has no such endpoints, and its base URL is the one template every operation dials
+ * (`https://{subdomain}.zendesk.com`) — so before this door existed, a recorded and sound host allowance
+ * still left every call refused: nothing collected the answer. DERIVED from the contract rather than
+ * declared beside it, because the placeholders ARE the base URL's and the allowances are the ones
+ * `resolveBaseUrlTemplate` admits them against at every call; this door and that resolver read one
+ * declaration and cannot disagree about which names exist.
+ *
+ * The rules are {@link describeProviderOAuth2AskedConnectionParameters}'s: a path placeholder is asked freely and
+ * percent-encoded; a host or origin one is asked only under an allowance a person can answer (`DECLARED_VALUES`) — one
+ * the deployment fills is never asked, and one with NO allowance is a BLOCKER rather than a field, because the resolver
+ * refuses it whatever is typed. A template the classifier cannot read is contained per provider, as the
+ * OAuth2 case is (N4): the blocker reports it and nothing is asked.
+ */
+export declare function describeProviderCredentialBaseUrlAnswers(contract: ProviderCredentialBaseUrlContract | undefined): ProviderCredentialBaseUrlAnswers;
+/** The REST contract slice {@link describeProviderAskedConnectionParameters} reads: the base URL, its allowances, the OAuth2 block. */
+export interface ProviderConnectFormRestContract extends ProviderCredentialBaseUrlContract {
+    readonly oauth2?: ProviderRestOAuth2;
+}
+/**
+ * The connection parameters the connect screen ASKS for, for the connection whose REST contract this is: the OAuth2
+ * flow's asked placeholders when the contract declares an OAuth2 block, else the placeholders a pasted credential's base
+ * URL asks for (#1097). The catalogue answers `connectionParameters` with it, and the discovery contribution carries it
+ * as `connectionParameterNames` so the labelling pipeline plans a word for each (#3251).
+ *
+ * Pass the CONNECTION's contract: for a member of a declared shared connection, the base's, whose client connects.
+ */
+export declare function describeProviderAskedConnectionParameters(contract: ProviderConnectFormRestContract | undefined): readonly string[] | undefined;
+/** What {@link describeProviderConnectionParameterNames} reads of one protocol binding of a provider module. */
+export interface ProviderConnectionParameterBindingFacts {
+    readonly runtimeContract: unknown;
+}
+/**
+ * The discovery contribution's `connectionParameterNames` (#3251): what the connect screen asks of a person connecting
+ * the provider's OWN connection, sorted, or `undefined` when it asks nothing. Read from the module's REST binding (the
+ * runtime contract of kind `ProviderProtocolRuntimeKind.REST`), the one the catalogue reads through
+ * `getProviderRuntimeContract(ref, REST_API)`. Pure; never throws.
+ *
+ * Every provider producer derives it with this function rather than restating the names, so the words planned for the
+ * screen are planned for the names it asks.
+ */
+export declare function describeProviderConnectionParameterNames(protocols: ReadonlyArray<ProviderConnectionParameterBindingFacts>): string[] | undefined;
+//# sourceMappingURL=provider-connection-parameters.external-connectors-models.d.ts.map

package/dist/esm/protocols/provider-connection-parameters.external-connectors-models.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"provider-connection-parameters.external-connectors-models.d.ts","sourceRoot":"","sources":["../../../src/protocols/provider-connection-parameters.external-connectors-models.ts"],"names":[],"mappings":"AACA,OAAO,EAML,yCAAyC,EAEzC,KAAK,kBAAkB,EACxB,MAAM,sDAAsD,CAAC;AAE9D;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;;;GASG;AACH,wBAAgB,yCAAyC,CAAC,MAAM,EAAE,kBAAkB,GAAG;IACrF,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,yCAAyC,CAAC,CAAC,CAAC;IACtG,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC/C,CAmBA;AAED;;;;;;;;;GASG;AACH,wBAAgB,+CAA+C,CAAC,MAAM,EAAE,kBAAkB,GAAG,SAAS,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CA0BrI;AAED;;;;GAIG;AACH,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,qBAAqB,CAAC,EAAE,kBAAkB,CAAC,wBAAwB,CAAC,CAAC;CAC/E;AAED,sIAAsI;AACtI,MAAM,WAAW,gCAAgC;IAC/C,sHAAsH;IACtH,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC9C,gIAAgI;IAChI,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACvC,kHAAkH;IAClH,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,sHAAsH;IACtH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,yCAAyC,CAAC,CAAC,CAAC;CACvG;AASD,gIAAgI;AAChI,wBAAgB,kCAAkC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE5E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wCAAwC,CAAC,QAAQ,EAAE,iCAAiC,GAAG,SAAS,GAAG,gCAAgC,CA0ClJ;AAED,uIAAuI;AACvI,MAAM,WAAW,+BAAgC,SAAQ,iCAAiC;IACxF,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;CACtC;AAED;;;;;;;GAOG;AACH,wBAAgB,yCAAyC,CAAC,QAAQ,EAAE,+BAA+B,GAAG,SAAS,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAK9I;AAED,gHAAgH;AAChH,MAAM,WAAW,uCAAuC;IACtD,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,wBAAgB,wCAAwC,CAAC,SAAS,EAAE,aAAa,CAAC,uCAAuC,CAAC,GAAG,MAAM,EAAE,GAAG,SAAS,CAOhJ"}