@wildo-ai/external-connectors-models 1.1.3 → 1.1.5

package/dist/esm/core/security.external-connectors-models.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../../src/core/security.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,+BAA+B,EAC/B,kBAAkB,EAClB,aAAa,EACb,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAExB,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAN,IAAY,0BA2BX;AA3BD,WAAY,0BAA0B;IACpC,iCAAiC;IACjC,2CAAa,CAAA;IAEb,0CAA0C;IAC1C,iDAAmB,CAAA;IAEnB,gDAAgD;IAChD,+CAAiB,CAAA;IAEjB,gCAAgC;IAChC,6CAAe,CAAA;IAEf,kEAAkE;IAClE,+CAAiB,CAAA;IAEjB,0CAA0C;IAC1C,+DAAiC,CAAA;IAEjC,+CAA+C;IAC/C,+DAAiC,CAAA;IAEjC,uCAAuC;IACvC,uDAAyB,CAAA;IAEzB,qDAAqD;IACrD,iEAAmC,CAAA;AACrC,CAAC,EA3BW,0BAA0B,KAA1B,0BAA0B,QA2BrC;AAED,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,MAAM,CAAN,IAAY,qCAIX;AAJD,WAAY,qCAAqC;IAC/C,0DAAiB,CAAA;IACjB,wDAAe,CAAA;IACf,0DAAiB,CAAA;AACnB,CAAC,EAJW,qCAAqC,KAArC,qCAAqC,QAIhD;AAED,MAAM,CAAN,IAAY,8CAGX;AAHD,WAAY,8CAA8C;IACxD,mEAAiB,CAAA;IACjB,mEAAiB,CAAA;AACnB,CAAC,EAHW,8CAA8C,KAA9C,8CAA8C,QAGzD;AAED,MAAM,CAAN,IAAY,mCAIX;AAJD,WAAY,mCAAmC;IAC7C,kDAAW,CAAA;IACX,0DAAmB,CAAA;IACnB,kFAA2C,CAAA;AAC7C,CAAC,EAJW,mCAAmC,KAAnC,mCAAmC,QAI9C;AAED,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,6BAA6B;IAC7B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAE5C,yDAAyD;IACzD,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE3C,iDAAiD;IACjD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEjC,8EAA8E;IAC9E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,CAAC,MAAM,CAAC;IACpE,kCAAkC;IAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE3D,yCAAyC;IACzC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAEzC,sCAAsC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE3C,sCAAsC;IACtC,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE1D,4CAA4C;IAC5C,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAExD,kDAAkD;IAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;CACjD,CAAC,CAAC;AAEH,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9D,6BAA6B;IAC7B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAExC,6CAA6C;IAC7C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1B,wCAAwC;IACxC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAErC,gEAAgE;IAChE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,MAAM,CAAC;IAE7G,wCAAwC;IACxC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;CACnD,CAAC,CAAC;AAUH,gFAAgF;AAChF,qCAAqC;AACrC,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC9E,iCAAiC;IACjC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,OAAO,CAAC;QACnD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;QAClD,qDAAqD;QACrD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC;IAEF,wCAAwC;IACxC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,cAAc,CAAC;QAC1D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;QAChD,qBAAqB;QACrB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC,OAAO,CAAC,8CAA8C,CAAC,MAAM,CAAC;QAChI,gDAAgD;QAChD,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;QACpE,wCAAwC;QACxC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACtC,0DAA0D;QAC1D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC;IAEF,sCAAsC;IACtC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,MAAM,CAAC;QAClD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,MAAM,CAAC;QAC7G,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;QAClD,iCAAiC;QACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACrC,mBAAmB;QACnB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC,OAAO,CAAC,mCAAmC,CAAC,GAAG,CAAC;KACrG,CAAC;IAEF,wCAAwC;IACxC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,cAAc,CAAC;QAC1D,yBAAyB;QACzB,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAChC,aAAa;QACb,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,wBAAwB;QACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,4BAA4B;QAC5B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;KACtE,CAAC;IAEF,mDAAmD;IACnD,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,MAAM,CAAC;QAElD,uDAAuD;QACvD;;;;WAIG;QACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAExC,wDAAwD;QACxD,gEAAgE;QAChE,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC3B,gBAAgB;QAChB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC5B,+CAA+C;QAC/C,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAE9B,4CAA4C;QAC5C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAEtC,2BAA2B;QAC3B,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;QAE9C,iCAAiC;QACjC,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,QAAQ,EAAE;QAE3E,mBAAmB;QACnB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC5B,kBAAkB;QAClB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;QAEjD,sBAAsB;QACtB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;QAExC,mCAAmC;QACnC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;QAEhD,qCAAqC;QACrC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAE5D,6BAA6B;QAC7B,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAE7D,uCAAuC;QACvC,sDAAsD;QACtD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC7E,+CAA+C;QAC/C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACzC,CAAC;IAEF,+BAA+B;IAC/B,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,KAAK,CAAC;QACjD,+BAA+B;QAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,+BAA+B;QAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC;IAEF,4BAA4B;IAC5B,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC;KACjD,CAAC;IAEF,0BAA0B;IAC1B,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,eAAe,CAAC;QAC3D,8CAA8C;QAC9C,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KACxC,CAAC;IAEF,qBAAqB;IACrB,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,UAAU,CAAC;QACtD,4BAA4B;QAC5B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACrC,4BAA4B;QAC5B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpC,+BAA+B;QAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC7B,CAAC;CACH,CAAC,CAAC;AAGH,gFAAgF;AAChF,sEAAsE;AACtE,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAN,IAAY,sCAOX;AAPD,WAAY,sCAAsC;IAChD,qGAAqG;IACrG,qEAA2B,CAAA;IAC3B,mGAAmG;IACnG,uEAA6B,CAAA;IAC7B,uFAAuF;IACvF,uDAAa,CAAA;AACf,CAAC,EAPW,sCAAsC,KAAtC,sCAAsC,QAOjD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAN,IAAY,4BAYX;AAZD,WAAY,4BAA4B;IACtC;;;OAGG;IACH,6DAA6B,CAAA;IAC7B;;;;OAIG;IACH,yDAAyB,CAAA;AAC3B,CAAC,EAZW,4BAA4B,KAA5B,4BAA4B,QAYvC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAN,IAAY,0CAKX;AALD,WAAY,0CAA0C;IACpD,2EAA2E;IAC3E,iEAAmB,CAAA;IACnB,wFAAwF;IACxF,2DAAa,CAAA;AACf,CAAC,EALW,0CAA0C,KAA1C,0CAA0C,QAKrD;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC;IAC1D,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,0CAA0C,CAAC;SAC3D,OAAO,CAAC,0CAA0C,CAAC,OAAO,CAAC;CAC/D,CAAC,CAAC;AAaH,MAAM,CAAC,MAAM,uCAAuC,GAAG,sCAAsC,CAAC,MAAM,CAAC;IACnG;;;OAGG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,eAAe,GAAG,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW,CAAC;IACjG,IAAI,eAAe,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,EAAE,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,OAAO,EAAE,KAAK,MAAM,CAAC,UAAU,iCAAiC,MAAM,CAAC,UAAU,8DAA8D;SAChJ,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACrD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,OAAO,EAAE,mHAAmH;SAC7H,CAAC,CAAC;IACL,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,KAAK,0CAA0C,CAAC,IAAI,CAAC;IACxF,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,eAAe,KAAK,SAAS,IAAI,MAAM,CAAC,eAAe,KAAK,EAAE,CAAC,EAAE,CAAC;QACzF,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EAAE,8HAA8H;SACxI,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACvD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EAAE,6KAA6K;SACvL,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC","sourcesContent":["/**\n * Security and Authentication Schemas for External Connectors\n * \n * This module defines authentication profiles that can be used across protocols.\n * It integrates with OAuth2 to avoid duplication between API auth and OAuth2 config.\n * \n * Architecture:\n * - ExternalProvider_Auth_Kind: The type of authentication\n * - ExternalProvider_AuthProfile: How to authenticate with an API\n * - OAuth2-linked profiles: Reference OAuth2 config instead of duplicating\n * \n * @see https://swagger.io/docs/specification/v3_0/authentication/\n */\n\nimport { z } from \"zod\";\nimport {\n  OAuth2_GrantType,\n  OAuth2_TokenEndpoint_AuthMethod,\n  OAuth2_PKCE_Method,\n  OAuth2_Prompt,\n  OAuth2_AccessType,\n} from './oauth2.enums';\n\n// =============================================================================\n// AUTH KIND ENUM\n// =============================================================================\n\n/**\n * Authentication types supported by external providers\n * Follows OpenAPI 3.0 Security Schemes with extensions\n */\nexport enum ExternalProvider_Auth_Kind {\n  /** No authentication required */\n  NONE = \"none\",\n  \n  /** API Key in header, query, or cookie */\n  API_KEY = \"api_key\",\n  \n  /** Bearer token (OAuth2 access token or JWT) */\n  BEARER = \"bearer\",\n  \n  /** HTTP Basic authentication */\n  BASIC = \"basic\",\n  \n  /** OAuth2 authentication - links to OAuth2 provider definition */\n  OAUTH2 = \"oauth2\",\n  \n  /** HMAC signature-based authentication */\n  HMAC_SIGNATURE = \"hmac_signature\",\n  \n  /** OpenID Connect (OAuth2 + identity layer) */\n  OPENID_CONNECT = \"openid_connect\",\n  \n  /** Mutual TLS (client certificates) */\n  MUTUAL_TLS = \"mutual_tls\",\n  \n  /** Frontend-specific secret (not exposed to user) */\n  FRONTEND_SECRET = \"frontend_secret\",\n}\n\n// =============================================================================\n// AUTH CONFIGURATION ENUMS\n// =============================================================================\n\nexport enum ExternalProvider_Auth_ApiKey_Location {\n  HEADER = \"header\",\n  QUERY = \"query\",\n  COOKIE = \"cookie\",\n}\n\nexport enum ExternalProvider_Auth_HMAC_Signature_Algorithm {\n  SHA256 = \"sha256\",\n  SHA512 = \"sha512\",\n}\n\nexport enum ExternalProvider_Auth_Bearer_Format {\n  JWT = \"jwt\",\n  API_KEY = \"api_key\",\n  OAUTH2_ACCESS_TOKEN = \"oauth2_access_token\",\n}\n\n// =============================================================================\n// AUTH CONFIGURATION SCHEMA\n// =============================================================================\n\n/**\n * Auth Configuration - references a secret\n * This is the runtime configuration that specifies which secret to use\n */\nexport const ExternalProvider_Auth_ConfigurationSchema = z.object({\n  /** Type of authentication */\n  authKind: z.enum(ExternalProvider_Auth_Kind),\n  \n  /** References to auth profiles this config applies to */\n  profileRefs: z.array(z.string()).optional(),\n  \n  /** Is this the default auth for the provider? */\n  isDefault: z.boolean().optional(),\n  \n  /** Reference to the secret (environment variable name or secret store key) */\n  secretRef: z.string(),\n});\n\n// =============================================================================\n// RATE LIMIT CONFIGURATION\n// =============================================================================\n\nexport const ExternalProvider_RateLimitConfigurationSchema = z.object({\n  /** Maximum concurrent requests */\n  maxConcurrent: z.number().positive().optional().default(10),\n  \n  /** Minimum time (ms) between requests */\n  minTime: z.number().positive().optional(),\n  \n  /** Request reservoir (bucket size) */\n  reservoir: z.number().positive().optional(),\n  \n  /** Reservoir refresh interval (ms) */\n  reservoirRefreshInterval: z.number().positive().optional(),\n  \n  /** Amount to add to reservoir on refresh */\n  reservoirRefreshAmount: z.number().positive().optional(),\n  \n  /** Request priority (higher = higher priority) */\n  priority: z.number().int().optional().default(0),\n});\n\n// =============================================================================\n// AUTH PROFILE BASE SCHEMA\n// =============================================================================\n\nexport const ExternalProvider_AuthProfile_BaseSchema = z.object({\n  /** Type of authentication */\n  kind: z.enum(ExternalProvider_Auth_Kind),\n  \n  /** Unique reference for this auth profile */\n  ref: z.string().optional(),\n  \n  /** Is this the default auth profile? */\n  isDefault: z.boolean().default(false),\n  \n  /** Where to place the authentication (header, query, cookie) */\n  location: z.enum(ExternalProvider_Auth_ApiKey_Location).default(ExternalProvider_Auth_ApiKey_Location.HEADER),\n  \n  /** Field name for the authentication */\n  locationField: z.string().default(\"Authorization\"),\n});\n\n// =============================================================================\n// INFERRED BASE TYPES\n// =============================================================================\n\nexport type ExternalProvider_Auth_Configuration = z.infer<typeof ExternalProvider_Auth_ConfigurationSchema>;\nexport type ExternalProvider_RateLimitConfiguration = z.infer<typeof ExternalProvider_RateLimitConfigurationSchema>;\nexport type ExternalProvider_AuthProfile_Base = z.infer<typeof ExternalProvider_AuthProfile_BaseSchema>;\n\n// =============================================================================\n// DISCRIMINATED AUTH PROFILE SCHEMAS\n// =============================================================================\n\n/**\n * Complete Auth Profile Schema - discriminated union by kind\n * Each kind has specific configuration fields\n */\nexport const ExternalProvider_AuthProfile_Schema = z.discriminatedUnion(\"kind\", [\n  // ─── API Key Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.API_KEY),\n    locationField: z.string().default(\"Authorization\"),\n    /** Prefix before the key value (e.g., \"Api-Key \") */\n    prefix: z.string().optional(),\n  }),\n  \n  // ─── HMAC Signature Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.HMAC_SIGNATURE),\n    locationField: z.string().default(\"X-Signature\"),\n    /** HMAC algorithm */\n    algorithm: z.enum(ExternalProvider_Auth_HMAC_Signature_Algorithm).default(ExternalProvider_Auth_HMAC_Signature_Algorithm.SHA256),\n    /** What data to sign (body, timestamp, etc.) */\n    signaturePayload: z.enum(['body', 'timestamp', 'custom']).optional(),\n    /** Timestamp header name (if needed) */\n    timestampHeader: z.string().optional(),\n    /** Nonce header name (if needed for replay protection) */\n    nonceHeader: z.string().optional(),\n  }),\n  \n  // ─── Bearer Token Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.BEARER),\n    location: z.enum(ExternalProvider_Auth_ApiKey_Location).default(ExternalProvider_Auth_ApiKey_Location.HEADER),\n    locationField: z.string().default(\"Authorization\"),\n    /** Prefix (usually \"Bearer \") */\n    prefix: z.string().default(\"Bearer \"),\n    /** Token format */\n    format: z.enum(ExternalProvider_Auth_Bearer_Format).default(ExternalProvider_Auth_Bearer_Format.JWT),\n  }),\n  \n  // ─── OpenID Connect Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.OPENID_CONNECT),\n    /** OIDC Discovery URL */\n    discoveryUrl: z.url().optional(),\n    /** Issuer */\n    issuer: z.string().optional(),\n    /** Expected audience */\n    audience: z.string().optional(),\n    /** Token validation mode */\n    validationMode: z.enum(['jwks', 'introspection', 'local']).optional(),\n  }),\n  \n  // ─── OAuth2 Authentication (UNIFIED APPROACH) ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.OAUTH2),\n    \n    // ─── OAuth2 Provider Reference (Unified Approach) ───\n    /**\n     * Reference to OAuth2 provider definition\n     * Instead of duplicating OAuth2 config, reference the provider\n     * by its string identifier (e.g., \"google\", \"microsoft\")\n     */\n    oauth2ProviderRef: z.string().optional(),\n    \n    // ─── Inline OAuth2 Configuration (Legacy/Override) ───\n    /** Authorization URL (can be overridden or used when no ref) */\n    authUrl: z.url().optional(),\n    /** Token URL */\n    tokenUrl: z.url().optional(),\n    /** Refresh URL (if different from tokenUrl) */\n    refreshUrl: z.url().optional(),\n    \n    /** Required scopes for this auth profile */\n    scopes: z.array(z.string()).optional(),\n    \n    /** Preferred grant type */\n    grantType: z.enum(OAuth2_GrantType).optional(),\n    \n    /** Token endpoint auth method */\n    tokenEndpointAuthMethod: z.enum(OAuth2_TokenEndpoint_AuthMethod).optional(),\n    \n    /** PKCE support */\n    pkce: z.boolean().optional(),\n    /** PKCE method */\n    pkceMethod: z.enum(OAuth2_PKCE_Method).optional(),\n    \n    /** Prompt behavior */\n    prompt: z.enum(OAuth2_Prompt).optional(),\n    \n    /** Access type (online/offline) */\n    accessType: z.enum(OAuth2_AccessType).optional(),\n    \n    /** Extra authorization parameters */\n    extraAuthParams: z.record(z.string(), z.string()).optional(),\n    \n    /** Extra token parameters */\n    extraTokenParams: z.record(z.string(), z.string()).optional(),\n    \n    // ─── Token Format (for API calls) ───\n    /** How to format the token in Authorization header */\n    tokenFormat: z.enum(['bearer', 'token', 'oauth', 'custom']).default('bearer'),\n    /** Custom prefix if tokenFormat is 'custom' */\n    customTokenPrefix: z.string().optional(),\n  }),\n  \n  // ─── Basic Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.BASIC),\n    /** Username field reference */\n    usernameRef: z.string().optional(),\n    /** Password field reference */\n    passwordRef: z.string().optional(),\n  }),\n  \n  // ─── No Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.NONE),\n  }),\n  \n  // ─── Frontend Secret ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.FRONTEND_SECRET),\n    /** Secret is only used in frontend context */\n    frontendOnly: z.boolean().default(true),\n  }),\n  \n  // ─── Mutual TLS ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.MUTUAL_TLS),\n    /** Certificate reference */\n    certificateRef: z.string().optional(),\n    /** Private key reference */\n    privateKeyRef: z.string().optional(),\n    /** CA certificate reference */\n    caRef: z.string().optional(),\n  }),\n]);\nexport type ExternalProvider_AuthProfile = z.infer<typeof ExternalProvider_AuthProfile_Schema>;\n\n// =============================================================================\n// CONNECTION IDENTITY — whose account, on whose behalf, and which one\n// =============================================================================\n\n/**\n * WHOSE ACCOUNT a call spends.\n *\n * Distinct from the scope of the DATA the call touches, and conflating the two inverts the design.\n * A billing provider is APPLICATION-owned — the payment account belongs to whoever ships the\n * application — even though almost everything it produces is organization-shaped: a customer, a\n * subscription, an invoice per tenant. Those are data in the application's own domain, produced by\n * an application-owned account. The question here is never \"does this touch organizations?\", which\n * is true of nearly everything. It is **whose account is it?**\n *\n * Delivery follows the owner and is not a separate decision: the APPLICATION's material is authored\n * in the deployment environment by an operator, and an ORGANIZATION's or a USER's is authored\n * through the application's own settings and stored, sealed, in its database.\n *\n * **No owner ever defaults to another.** An organization-owned call with no connection REFUSES; it\n * never spends the application's account. A silent substitution means the vendor sees one identity\n * while the application believes it acted as another, and every artifact the call leaves on the far\n * side — a message, a record, a line in the vendor's own audit log — is then attributed to the wrong\n * party, with nothing downstream able to detect it. An application that wants \"the tenant's key when\n * they have connected one, otherwise ours\" expresses that in its own code by choosing which\n * connection to call with, where the choice is visible.\n */\nexport enum ExternalProvider_Connection_OwnerScope {\n  /** The account belongs to the application itself. Material comes from the deployment environment. */\n  APPLICATION = \"application\",\n  /** The account belongs to one tenant — its own workspace, its own subscription with the vendor. */\n  ORGANIZATION = \"organization\",\n  /** The account belongs to one person — a personal key they authored for themselves. */\n  USER = \"user\",\n}\n\n/**\n * WHAT A DECLARED SECRET IDENTIFIES — the integration, or the account.\n *\n * A provider's `secretsContract` holds two kinds of thing and, until this existed, marked neither.\n * Slack's contract is the clearest case: `SLACK_CLIENT_ID` and `SLACK_CLIENT_SECRET` identify the\n * APPLICATION's registration with Slack, while `SLACK_API_KEY` holds a token that identifies WHOSE\n * Slack account is being acted as. They are stored differently, rotated for different reasons, and\n * owned by different parties, and one undifferentiated map made all three look alike.\n *\n * Deliberately ORTHOGONAL to {@link ExternalProvider_Connection_OwnerScope}, which is the axis it is\n * most likely to be confused with. This says what a secret IS; that says whose it is. A billing\n * provider's secret key is a CREDENTIAL — it identifies an account — and is nonetheless\n * application-owned, because the only admissible connection for it is APPLICATION. Collapsing the\n * two would make \"the deployment owns this\" and \"this identifies an integration\" the same\n * statement, and they are not.\n *\n * What the distinction buys, concretely:\n *\n *   - a credential row owned by a tenant or a person may hold a CREDENTIAL and never a REGISTRATION.\n *     Without the mark, nothing stopped a tenant storing a row slugged `SLACK_CLIENT_SECRET` that no\n *     reader would ever consult — inert, and indistinguishable from a working connection on screen;\n *   - the connect flow can derive WHICH slug a grant is stored under by construction, rather than\n *     by the convention that it happens to be the REST contract's `apiKey.secretRef`;\n *   - a vendor that supports per-tenant app registrations becomes SAYABLE, which it is not today.\n */\nexport enum ExternalProvider_SecretScope {\n  /**\n   * Identifies the INTEGRATION — an OAuth2 client id and secret, a signing secret issued to the\n   * app's registration. Authored by the operator in the deployment environment.\n   */\n  REGISTRATION = \"registration\",\n  /**\n   * Identifies an ACCOUNT — a token or key standing for whoever is being acted as. May be authored\n   * in the environment (the deployment's own account) or minted into a credential row owned by a\n   * tenant or a person; which of those are permitted is the admissibility question, not this one.\n   */\n  CREDENTIAL = \"credential\",\n}\n\n/**\n * ON WHOSE BEHALF the act is performed — orthogonal to who owns the account.\n *\n * These are two questions and every combination of them is real, which is why they are two enums\n * rather than one. An application's service identity can impersonate a user (domain-wide\n * delegation); a tenant's own registration can mint a token that acts for one of its members; a\n * tenant's bot token acts as nobody in particular. Collapsing the pair into a single vocabulary\n * makes most of those unsayable:\n *\n * | owner × delegation | the real case |\n * |---|---|\n * | APPLICATION × SERVICE | a platform API key |\n * | APPLICATION × USER | the application's service identity impersonating a user |\n * | ORGANIZATION × SERVICE | the tenant's own bot or workspace token |\n * | ORGANIZATION × USER | the tenant's registration, acting for one of its members |\n * | USER × SERVICE | a personal key the user authored |\n *\n * OAuth 2.0 carries the same split in its grant types: the client is the REGISTRATION, and the grant\n * decides on whose behalf a token is minted.\n */\nexport enum ExternalProvider_Connection_DelegationMode {\n  /** The call acts as the account's owner, with no third party behind it. */\n  SERVICE = \"service\",\n  /** The call acts for a named user, whose authorization is what makes it permissible. */\n  USER = \"user\",\n}\n\n/**\n * WHICH owner instance a single call spends — supplied BY THE CALL, never read from ambient context.\n *\n * This is the field's hardest constraint to get right and the reason it is a parameter rather than a\n * property of the execution. `ExecutionContext.initiatorIds` answers WHO is performing the operation\n * and `contextResourcesFieldIdentifier` answers WHICH ROWS are in scope; neither answers whose\n * account is being spent, and a design that borrows either is wrong for a case that is entirely\n * ordinary: one user action fanning out a message to every organization the user belongs to. One\n * initiator, one execution, N organizations, a different account per call. An ambient answer cannot\n * vary within one execution, so it cannot express that at all.\n *\n * The initiator is still decisive — as the AUTHORIZATION input. The call names the owner and the\n * runtime asks whether this initiator may act for it. Supplying and authorizing are different jobs,\n * and the resolver cannot verify a target it also invented.\n */\nexport const ExternalProvider_ConnectionShapeSchema = z.object({\n  ownerScope: z.enum(ExternalProvider_Connection_OwnerScope),\n  delegation: z.enum(ExternalProvider_Connection_DelegationMode)\n    .default(ExternalProvider_Connection_DelegationMode.SERVICE),\n});\n\n/**\n * A connection COMBINATION, with no instance attached — what a provider ADMITS.\n *\n * The capability and the call are the same two axes and different objects, which is why this is a\n * separate schema rather than the target with its identifiers made optional. A provider admitting\n * `ORGANIZATION × USER` says nothing about which organization; a call naming an organization and no\n * user is incomplete. Making one schema serve both would have to relax exactly the refinements that\n * make the call safe.\n */\nexport type ExternalProvider_ConnectionShape = z.infer<typeof ExternalProvider_ConnectionShapeSchema>;\n\nexport const ExternalProvider_ConnectionTargetSchema = ExternalProvider_ConnectionShapeSchema.extend({\n  /**\n   * The organization or user whose account is spent. Absent for APPLICATION, which has exactly one\n   * instance by construction — an id there would be a second name for the deployment.\n   */\n  ownerId: z.string().optional(),\n  /**\n   * The user the act is performed for, when `delegation` is USER. Independent of `ownerId`: a\n   * tenant-owned connection acting for one of its members carries an organization in `ownerId` and a\n   * person here.\n   */\n  actingForUserId: z.string().optional(),\n}).superRefine((target, ctx) => {\n  const ownerIsInstance = target.ownerScope !== ExternalProvider_Connection_OwnerScope.APPLICATION;\n  if (ownerIsInstance && (target.ownerId === undefined || target.ownerId === '')) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['ownerId'],\n      message: `A ${target.ownerScope}-owned connection names WHICH ${target.ownerScope}; a call that omits it has not said whose account it spends.`,\n    });\n  }\n  if (!ownerIsInstance && target.ownerId !== undefined) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['ownerId'],\n      message: 'An application-owned connection has exactly one instance, so an ownerId here names something that does not exist.',\n    });\n  }\n  const delegated = target.delegation === ExternalProvider_Connection_DelegationMode.USER;\n  if (delegated && (target.actingForUserId === undefined || target.actingForUserId === '')) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['actingForUserId'],\n      message: 'A delegated call acts FOR someone, and the user it acts for is what makes it permissible — it cannot be left to be inferred.',\n    });\n  }\n  if (!delegated && target.actingForUserId !== undefined) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['actingForUserId'],\n      message: 'A SERVICE call acts for nobody. Naming a user here reads as delegation the runtime will not perform, which is worse than an error: the call succeeds as the wrong identity.',\n    });\n  }\n});\n\nexport type ExternalProvider_ConnectionTarget = z.infer<typeof ExternalProvider_ConnectionTargetSchema>;\n"]}
+{"version":3,"file":"security.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../../src/core/security.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,+BAA+B,EAC/B,kBAAkB,EAClB,aAAa,EACb,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAExB,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAN,IAAY,0BA2BX;AA3BD,WAAY,0BAA0B;IACpC,iCAAiC;IACjC,2CAAa,CAAA;IAEb,0CAA0C;IAC1C,iDAAmB,CAAA;IAEnB,gDAAgD;IAChD,+CAAiB,CAAA;IAEjB,gCAAgC;IAChC,6CAAe,CAAA;IAEf,kEAAkE;IAClE,+CAAiB,CAAA;IAEjB,0CAA0C;IAC1C,+DAAiC,CAAA;IAEjC,+CAA+C;IAC/C,+DAAiC,CAAA;IAEjC,uCAAuC;IACvC,uDAAyB,CAAA;IAEzB,qDAAqD;IACrD,iEAAmC,CAAA;AACrC,CAAC,EA3BW,0BAA0B,KAA1B,0BAA0B,QA2BrC;AAED,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,MAAM,CAAN,IAAY,qCAIX;AAJD,WAAY,qCAAqC;IAC/C,0DAAiB,CAAA;IACjB,wDAAe,CAAA;IACf,0DAAiB,CAAA;AACnB,CAAC,EAJW,qCAAqC,KAArC,qCAAqC,QAIhD;AAED,MAAM,CAAN,IAAY,8CAGX;AAHD,WAAY,8CAA8C;IACxD,mEAAiB,CAAA;IACjB,mEAAiB,CAAA;AACnB,CAAC,EAHW,8CAA8C,KAA9C,8CAA8C,QAGzD;AAED,MAAM,CAAN,IAAY,mCAIX;AAJD,WAAY,mCAAmC;IAC7C,kDAAW,CAAA;IACX,0DAAmB,CAAA;IACnB,kFAA2C,CAAA;AAC7C,CAAC,EAJW,mCAAmC,KAAnC,mCAAmC,QAI9C;AAED,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,6BAA6B;IAC7B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAE5C,yDAAyD;IACzD,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE3C,iDAAiD;IACjD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEjC,8EAA8E;IAC9E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,CAAC,MAAM,CAAC;IACpE,kCAAkC;IAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE3D,yCAAyC;IACzC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAEzC,sCAAsC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE3C,sCAAsC;IACtC,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE1D,4CAA4C;IAC5C,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAExD,kDAAkD;IAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;CACjD,CAAC,CAAC;AAEH,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9D,6BAA6B;IAC7B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAExC,6CAA6C;IAC7C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1B,wCAAwC;IACxC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAErC,gEAAgE;IAChE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,MAAM,CAAC;IAE7G,wCAAwC;IACxC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;CACnD,CAAC,CAAC;AASH,gFAAgF;AAChF,qCAAqC;AACrC,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC9E,iCAAiC;IACjC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,OAAO,CAAC;QACnD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;QAClD,qDAAqD;QACrD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC;IAEF,wCAAwC;IACxC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,cAAc,CAAC;QAC1D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;QAChD,qBAAqB;QACrB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC,OAAO,CAAC,8CAA8C,CAAC,MAAM,CAAC;QAChI,gDAAgD;QAChD,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;QACpE,wCAAwC;QACxC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACtC,0DAA0D;QAC1D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC;IAEF,sCAAsC;IACtC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,MAAM,CAAC;QAClD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,MAAM,CAAC;QAC7G,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;QAClD,iCAAiC;QACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACrC,mBAAmB;QACnB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC,OAAO,CAAC,mCAAmC,CAAC,GAAG,CAAC;KACrG,CAAC;IAEF,wCAAwC;IACxC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,cAAc,CAAC;QAC1D,yBAAyB;QACzB,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAChC,aAAa;QACb,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,wBAAwB;QACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,4BAA4B;QAC5B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;KACtE,CAAC;IAEF,mDAAmD;IACnD,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,MAAM,CAAC;QAElD,uDAAuD;QACvD;;;;WAIG;QACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAExC,wDAAwD;QACxD,gEAAgE;QAChE,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC3B,gBAAgB;QAChB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC5B,+CAA+C;QAC/C,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAE9B,4CAA4C;QAC5C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAEtC,2BAA2B;QAC3B,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;QAE9C,iCAAiC;QACjC,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,QAAQ,EAAE;QAE3E,mBAAmB;QACnB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC5B,kBAAkB;QAClB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;QAEjD,sBAAsB;QACtB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;QAExC,mCAAmC;QACnC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;QAEhD,qCAAqC;QACrC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAE5D,6BAA6B;QAC7B,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAE7D,uCAAuC;QACvC,sDAAsD;QACtD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC7E,+CAA+C;QAC/C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACzC,CAAC;IAEF,+BAA+B;IAC/B,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,KAAK,CAAC;QACjD,+BAA+B;QAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,+BAA+B;QAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC;IAEF,4BAA4B;IAC5B,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC;KACjD,CAAC;IAEF,0BAA0B;IAC1B,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,eAAe,CAAC;QAC3D,8CAA8C;QAC9C,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KACxC,CAAC;IAEF,qBAAqB;IACrB,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,UAAU,CAAC;QACtD,4BAA4B;QAC5B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACrC,4BAA4B;QAC5B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpC,+BAA+B;QAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC7B,CAAC;CACH,CAAC,CAAC;AAGH,gFAAgF;AAChF,sEAAsE;AACtE,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAN,IAAY,sCAOX;AAPD,WAAY,sCAAsC;IAChD,qGAAqG;IACrG,qEAA2B,CAAA;IAC3B,mGAAmG;IACnG,uEAA6B,CAAA;IAC7B,uFAAuF;IACvF,uDAAa,CAAA;AACf,CAAC,EAPW,sCAAsC,KAAtC,sCAAsC,QAOjD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAN,IAAY,4BAYX;AAZD,WAAY,4BAA4B;IACtC;;;OAGG;IACH,6DAA6B,CAAA;IAC7B;;;;OAIG;IACH,yDAAyB,CAAA;AAC3B,CAAC,EAZW,4BAA4B,KAA5B,4BAA4B,QAYvC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,CAAN,IAAY,0CAKX;AALD,WAAY,0CAA0C;IACpD,2EAA2E;IAC3E,iEAAmB,CAAA;IACnB,wFAAwF;IACxF,2DAAa,CAAA;AACf,CAAC,EALW,0CAA0C,KAA1C,0CAA0C,QAKrD;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC;IAC1D,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,0CAA0C,CAAC;SAC3D,OAAO,CAAC,0CAA0C,CAAC,OAAO,CAAC;CAC/D,CAAC,CAAC;AAaH,MAAM,CAAC,MAAM,uCAAuC,GAAG,sCAAsC,CAAC,MAAM,CAAC;IACnG;;;OAGG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B;;;;;;;;OAQG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,eAAe,GAAG,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW,CAAC;IACjG,IAAI,eAAe,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,EAAE,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,OAAO,EAAE,KAAK,MAAM,CAAC,UAAU,iCAAiC,MAAM,CAAC,UAAU,8DAA8D;SAChJ,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACrD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,OAAO,EAAE,mHAAmH;SAC7H,CAAC,CAAC;IACL,CAAC;IACD,IAAI,+BAA+B,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,IAAI,MAAM,CAAC,eAAe,KAAK,EAAE,EAAE,CAAC;YAC1E,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;gBACzB,OAAO,EAAE,oIAAoI;aAC9I,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAChD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EAAE,MAAM,CAAC,UAAU,KAAK,0CAA0C,CAAC,IAAI;gBAC5E,CAAC,CAAC,KAAK,MAAM,CAAC,UAAU,sGAAsG;sBAC1H,uEAAuE;gBAC3E,CAAC,CAAC,6KAA6K;SAClL,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAAuC;IACrF,OAAO,KAAK,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW;WACzE,KAAK,CAAC,UAAU,KAAK,0CAA0C,CAAC,IAAI,CAAC;AAC5E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0CAA0C,CAAC,KAAuC;IAChG,OAAO,KAAK,CAAC,UAAU,KAAK,sCAAsC,CAAC,YAAY;WAC1E,KAAK,CAAC,UAAU,KAAK,0CAA0C,CAAC,IAAI,CAAC;AAC5E,CAAC","sourcesContent":["/**\n * Security and Authentication Schemas for External Connectors\n * \n * This module defines authentication profiles that can be used across protocols.\n * It integrates with OAuth2 to avoid duplication between API auth and OAuth2 config.\n * \n * Architecture:\n * - ExternalProvider_Auth_Kind: The type of authentication\n * - ExternalProvider_AuthProfile: How to authenticate with an API\n * - OAuth2-linked profiles: Reference OAuth2 config instead of duplicating\n * \n * @see https://swagger.io/docs/specification/v3_0/authentication/\n */\n\nimport { z } from \"zod\";\nimport {\n  OAuth2_GrantType,\n  OAuth2_TokenEndpoint_AuthMethod,\n  OAuth2_PKCE_Method,\n  OAuth2_Prompt,\n  OAuth2_AccessType,\n} from './oauth2.enums';\n\n// =============================================================================\n// AUTH KIND ENUM\n// =============================================================================\n\n/**\n * Authentication types supported by external providers\n * Follows OpenAPI 3.0 Security Schemes with extensions\n */\nexport enum ExternalProvider_Auth_Kind {\n  /** No authentication required */\n  NONE = \"none\",\n  \n  /** API Key in header, query, or cookie */\n  API_KEY = \"api_key\",\n  \n  /** Bearer token (OAuth2 access token or JWT) */\n  BEARER = \"bearer\",\n  \n  /** HTTP Basic authentication */\n  BASIC = \"basic\",\n  \n  /** OAuth2 authentication - links to OAuth2 provider definition */\n  OAUTH2 = \"oauth2\",\n  \n  /** HMAC signature-based authentication */\n  HMAC_SIGNATURE = \"hmac_signature\",\n  \n  /** OpenID Connect (OAuth2 + identity layer) */\n  OPENID_CONNECT = \"openid_connect\",\n  \n  /** Mutual TLS (client certificates) */\n  MUTUAL_TLS = \"mutual_tls\",\n  \n  /** Frontend-specific secret (not exposed to user) */\n  FRONTEND_SECRET = \"frontend_secret\",\n}\n\n// =============================================================================\n// AUTH CONFIGURATION ENUMS\n// =============================================================================\n\nexport enum ExternalProvider_Auth_ApiKey_Location {\n  HEADER = \"header\",\n  QUERY = \"query\",\n  COOKIE = \"cookie\",\n}\n\nexport enum ExternalProvider_Auth_HMAC_Signature_Algorithm {\n  SHA256 = \"sha256\",\n  SHA512 = \"sha512\",\n}\n\nexport enum ExternalProvider_Auth_Bearer_Format {\n  JWT = \"jwt\",\n  API_KEY = \"api_key\",\n  OAUTH2_ACCESS_TOKEN = \"oauth2_access_token\",\n}\n\n// =============================================================================\n// AUTH CONFIGURATION SCHEMA\n// =============================================================================\n\n/**\n * Auth Configuration - references a secret\n * This is the runtime configuration that specifies which secret to use\n */\nexport const ExternalProvider_Auth_ConfigurationSchema = z.object({\n  /** Type of authentication */\n  authKind: z.enum(ExternalProvider_Auth_Kind),\n  \n  /** References to auth profiles this config applies to */\n  profileRefs: z.array(z.string()).optional(),\n  \n  /** Is this the default auth for the provider? */\n  isDefault: z.boolean().optional(),\n  \n  /** Reference to the secret (environment variable name or secret store key) */\n  secretRef: z.string(),\n});\n\n// =============================================================================\n// RATE LIMIT CONFIGURATION\n// =============================================================================\n\nexport const ExternalProvider_RateLimitConfigurationSchema = z.object({\n  /** Maximum concurrent requests */\n  maxConcurrent: z.number().positive().optional().default(10),\n  \n  /** Minimum time (ms) between requests */\n  minTime: z.number().positive().optional(),\n  \n  /** Request reservoir (bucket size) */\n  reservoir: z.number().positive().optional(),\n  \n  /** Reservoir refresh interval (ms) */\n  reservoirRefreshInterval: z.number().positive().optional(),\n  \n  /** Amount to add to reservoir on refresh */\n  reservoirRefreshAmount: z.number().positive().optional(),\n  \n  /** Request priority (higher = higher priority) */\n  priority: z.number().int().optional().default(0),\n});\n\n// =============================================================================\n// AUTH PROFILE BASE SCHEMA\n// =============================================================================\n\nexport const ExternalProvider_AuthProfile_BaseSchema = z.object({\n  /** Type of authentication */\n  kind: z.enum(ExternalProvider_Auth_Kind),\n  \n  /** Unique reference for this auth profile */\n  ref: z.string().optional(),\n  \n  /** Is this the default auth profile? */\n  isDefault: z.boolean().default(false),\n  \n  /** Where to place the authentication (header, query, cookie) */\n  location: z.enum(ExternalProvider_Auth_ApiKey_Location).default(ExternalProvider_Auth_ApiKey_Location.HEADER),\n  \n  /** Field name for the authentication */\n  locationField: z.string().default(\"Authorization\"),\n});\n\n// =============================================================================\n// INFERRED BASE TYPES\n// =============================================================================\n\nexport type ExternalProvider_RateLimitConfiguration = z.infer<typeof ExternalProvider_RateLimitConfigurationSchema>;\nexport type ExternalProvider_AuthProfile_Base = z.infer<typeof ExternalProvider_AuthProfile_BaseSchema>;\n\n// =============================================================================\n// DISCRIMINATED AUTH PROFILE SCHEMAS\n// =============================================================================\n\n/**\n * Complete Auth Profile Schema - discriminated union by kind\n * Each kind has specific configuration fields\n */\nexport const ExternalProvider_AuthProfile_Schema = z.discriminatedUnion(\"kind\", [\n  // ─── API Key Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.API_KEY),\n    locationField: z.string().default(\"Authorization\"),\n    /** Prefix before the key value (e.g., \"Api-Key \") */\n    prefix: z.string().optional(),\n  }),\n  \n  // ─── HMAC Signature Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.HMAC_SIGNATURE),\n    locationField: z.string().default(\"X-Signature\"),\n    /** HMAC algorithm */\n    algorithm: z.enum(ExternalProvider_Auth_HMAC_Signature_Algorithm).default(ExternalProvider_Auth_HMAC_Signature_Algorithm.SHA256),\n    /** What data to sign (body, timestamp, etc.) */\n    signaturePayload: z.enum(['body', 'timestamp', 'custom']).optional(),\n    /** Timestamp header name (if needed) */\n    timestampHeader: z.string().optional(),\n    /** Nonce header name (if needed for replay protection) */\n    nonceHeader: z.string().optional(),\n  }),\n  \n  // ─── Bearer Token Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.BEARER),\n    location: z.enum(ExternalProvider_Auth_ApiKey_Location).default(ExternalProvider_Auth_ApiKey_Location.HEADER),\n    locationField: z.string().default(\"Authorization\"),\n    /** Prefix (usually \"Bearer \") */\n    prefix: z.string().default(\"Bearer \"),\n    /** Token format */\n    format: z.enum(ExternalProvider_Auth_Bearer_Format).default(ExternalProvider_Auth_Bearer_Format.JWT),\n  }),\n  \n  // ─── OpenID Connect Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.OPENID_CONNECT),\n    /** OIDC Discovery URL */\n    discoveryUrl: z.url().optional(),\n    /** Issuer */\n    issuer: z.string().optional(),\n    /** Expected audience */\n    audience: z.string().optional(),\n    /** Token validation mode */\n    validationMode: z.enum(['jwks', 'introspection', 'local']).optional(),\n  }),\n  \n  // ─── OAuth2 Authentication (UNIFIED APPROACH) ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.OAUTH2),\n    \n    // ─── OAuth2 Provider Reference (Unified Approach) ───\n    /**\n     * Reference to OAuth2 provider definition\n     * Instead of duplicating OAuth2 config, reference the provider\n     * by its string identifier (e.g., \"google\", \"microsoft\")\n     */\n    oauth2ProviderRef: z.string().optional(),\n    \n    // ─── Inline OAuth2 Configuration (Legacy/Override) ───\n    /** Authorization URL (can be overridden or used when no ref) */\n    authUrl: z.url().optional(),\n    /** Token URL */\n    tokenUrl: z.url().optional(),\n    /** Refresh URL (if different from tokenUrl) */\n    refreshUrl: z.url().optional(),\n    \n    /** Required scopes for this auth profile */\n    scopes: z.array(z.string()).optional(),\n    \n    /** Preferred grant type */\n    grantType: z.enum(OAuth2_GrantType).optional(),\n    \n    /** Token endpoint auth method */\n    tokenEndpointAuthMethod: z.enum(OAuth2_TokenEndpoint_AuthMethod).optional(),\n    \n    /** PKCE support */\n    pkce: z.boolean().optional(),\n    /** PKCE method */\n    pkceMethod: z.enum(OAuth2_PKCE_Method).optional(),\n    \n    /** Prompt behavior */\n    prompt: z.enum(OAuth2_Prompt).optional(),\n    \n    /** Access type (online/offline) */\n    accessType: z.enum(OAuth2_AccessType).optional(),\n    \n    /** Extra authorization parameters */\n    extraAuthParams: z.record(z.string(), z.string()).optional(),\n    \n    /** Extra token parameters */\n    extraTokenParams: z.record(z.string(), z.string()).optional(),\n    \n    // ─── Token Format (for API calls) ───\n    /** How to format the token in Authorization header */\n    tokenFormat: z.enum(['bearer', 'token', 'oauth', 'custom']).default('bearer'),\n    /** Custom prefix if tokenFormat is 'custom' */\n    customTokenPrefix: z.string().optional(),\n  }),\n  \n  // ─── Basic Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.BASIC),\n    /** Username field reference */\n    usernameRef: z.string().optional(),\n    /** Password field reference */\n    passwordRef: z.string().optional(),\n  }),\n  \n  // ─── No Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.NONE),\n  }),\n  \n  // ─── Frontend Secret ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.FRONTEND_SECRET),\n    /** Secret is only used in frontend context */\n    frontendOnly: z.boolean().default(true),\n  }),\n  \n  // ─── Mutual TLS ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.MUTUAL_TLS),\n    /** Certificate reference */\n    certificateRef: z.string().optional(),\n    /** Private key reference */\n    privateKeyRef: z.string().optional(),\n    /** CA certificate reference */\n    caRef: z.string().optional(),\n  }),\n]);\nexport type ExternalProvider_AuthProfile = z.infer<typeof ExternalProvider_AuthProfile_Schema>;\n\n// =============================================================================\n// CONNECTION IDENTITY — whose account, on whose behalf, and which one\n// =============================================================================\n\n/**\n * WHOSE ACCOUNT a call spends.\n *\n * Distinct from the scope of the DATA the call touches, and conflating the two inverts the design.\n * A billing provider is APPLICATION-owned — the payment account belongs to whoever ships the\n * application — even though almost everything it produces is organization-shaped: a customer, a\n * subscription, an invoice per tenant. Those are data in the application's own domain, produced by\n * an application-owned account. The question here is never \"does this touch organizations?\", which\n * is true of nearly everything. It is **whose account is it?**\n *\n * Delivery follows the owner and is not a separate decision: the APPLICATION's material is authored\n * in the deployment environment by an operator, and an ORGANIZATION's or a USER's is authored\n * through the application's own settings and stored, sealed, in its database.\n *\n * **No owner ever defaults to another.** An organization-owned call with no connection REFUSES; it\n * never spends the application's account. A silent substitution means the vendor sees one identity\n * while the application believes it acted as another, and every artifact the call leaves on the far\n * side — a message, a record, a line in the vendor's own audit log — is then attributed to the wrong\n * party, with nothing downstream able to detect it. An application that wants \"the tenant's key when\n * they have connected one, otherwise ours\" expresses that in its own code by choosing which\n * connection to call with, where the choice is visible.\n */\nexport enum ExternalProvider_Connection_OwnerScope {\n  /** The account belongs to the application itself. Material comes from the deployment environment. */\n  APPLICATION = \"application\",\n  /** The account belongs to one tenant — its own workspace, its own subscription with the vendor. */\n  ORGANIZATION = \"organization\",\n  /** The account belongs to one person — a personal key they authored for themselves. */\n  USER = \"user\",\n}\n\n/**\n * WHAT A DECLARED SECRET IDENTIFIES — the integration, or the account.\n *\n * A provider's `secretsContract` holds two kinds of thing and, until this existed, marked neither.\n * Slack's contract is the clearest case: `SLACK_CLIENT_ID` and `SLACK_CLIENT_SECRET` identify the\n * APPLICATION's registration with Slack, while `SLACK_API_KEY` holds a token that identifies WHOSE\n * Slack account is being acted as. They are stored differently, rotated for different reasons, and\n * owned by different parties, and one undifferentiated map made all three look alike.\n *\n * Deliberately ORTHOGONAL to {@link ExternalProvider_Connection_OwnerScope}, which is the axis it is\n * most likely to be confused with. This says what a secret IS; that says whose it is. A billing\n * provider's secret key is a CREDENTIAL — it identifies an account — and is nonetheless\n * application-owned, because the only admissible connection for it is APPLICATION. Collapsing the\n * two would make \"the deployment owns this\" and \"this identifies an integration\" the same\n * statement, and they are not.\n *\n * What the distinction buys, concretely:\n *\n *   - a credential row owned by a tenant or a person may hold a CREDENTIAL and never a REGISTRATION.\n *     Without the mark, nothing stopped a tenant storing a row slugged `SLACK_CLIENT_SECRET` that no\n *     reader would ever consult — inert, and indistinguishable from a working connection on screen;\n *   - the connect flow can derive WHICH slug a grant is stored under by construction, rather than\n *     by the convention that it happens to be the REST contract's `apiKey.secretRef`;\n *   - a vendor that supports per-tenant app registrations becomes SAYABLE, which it is not today.\n */\nexport enum ExternalProvider_SecretScope {\n  /**\n   * Identifies the INTEGRATION — an OAuth2 client id and secret, a signing secret issued to the\n   * app's registration. Authored by the operator in the deployment environment.\n   */\n  REGISTRATION = \"registration\",\n  /**\n   * Identifies an ACCOUNT — a token or key standing for whoever is being acted as. May be authored\n   * in the environment (the deployment's own account) or minted into a credential row owned by a\n   * tenant or a person; which of those are permitted is the admissibility question, not this one.\n   */\n  CREDENTIAL = \"credential\",\n}\n\n/**\n * ON WHOSE BEHALF the act is performed — orthogonal to who owns the account.\n *\n * These are two questions and every combination of them is real, which is why they are two enums\n * rather than one. An application's service identity can impersonate a user (domain-wide\n * delegation); a tenant's own registration can mint a token that acts for one of its members; a\n * tenant's bot token acts as nobody in particular. Collapsing the pair into a single vocabulary\n * makes most of those unsayable:\n *\n * | owner × delegation | the real case |\n * |---|---|\n * | APPLICATION × SERVICE | a platform API key |\n * | APPLICATION × USER | the application's service identity impersonating a user |\n * | ORGANIZATION × SERVICE | the tenant's own bot or workspace token |\n * | ORGANIZATION × USER | ONE member's own account, linked for the whole organization |\n * | USER × SERVICE | a person's own account, for that person |\n *\n * ## `ORGANIZATION × USER`, decided 2026-09-12 (Paul, recorded on wildo-ai/wildo-ai#18)\n *\n * A member connects THEIR OWN vendor account on the organization's behalf — the common pattern that\n * lets a tenant integrate without a service account. There is ONE grant per organization, and every\n * member's call spends it transparently. The member who links it carries the responsibility for\n * that: they are trusting their colleagues' activity with their account, they ACKNOWLEDGE it when\n * they link, and that acknowledgement is the whole control — no per-call gate. What the audit trail\n * must then say, on every call, is WHOSE account was spent: the member who linked it.\n *\n * So the person behind this shape is fixed by the GRANT, not by the call, which is why a call never\n * names `actingForUserId` for it. The rejected readings are worth keeping: per-member grants keyed\n * `(organization, member)` is a real model and not what this shape means here; and requiring the\n * call to name the linking member would stop every other member using a grant that exists to be\n * shared. A person's connection for themselves is the USER-owned row.\n *\n * OAuth 2.0 carries the same split in its grant types: the client is the REGISTRATION, and the grant\n * decides on whose behalf a token is minted.\n */\nexport enum ExternalProvider_Connection_DelegationMode {\n  /** The call acts as the account's owner, with no third party behind it. */\n  SERVICE = \"service\",\n  /** The call acts for a named user, whose authorization is what makes it permissible. */\n  USER = \"user\",\n}\n\n/**\n * WHICH owner instance a single call spends — supplied BY THE CALL, never read from ambient context.\n *\n * This is the field's hardest constraint to get right and the reason it is a parameter rather than a\n * property of the execution. `ExecutionContext.initiatorIds` answers WHO is performing the operation\n * and `contextResourcesFieldIdentifier` answers WHICH ROWS are in scope; neither answers whose\n * account is being spent, and a design that borrows either is wrong for a case that is entirely\n * ordinary: one user action fanning out a message to every organization the user belongs to. One\n * initiator, one execution, N organizations, a different account per call. An ambient answer cannot\n * vary within one execution, so it cannot express that at all.\n *\n * The initiator is still decisive — as the AUTHORIZATION input. The call names the owner and the\n * runtime asks whether this initiator may act for it. Supplying and authorizing are different jobs,\n * and the resolver cannot verify a target it also invented.\n */\nexport const ExternalProvider_ConnectionShapeSchema = z.object({\n  ownerScope: z.enum(ExternalProvider_Connection_OwnerScope),\n  delegation: z.enum(ExternalProvider_Connection_DelegationMode)\n    .default(ExternalProvider_Connection_DelegationMode.SERVICE),\n});\n\n/**\n * A connection COMBINATION, with no instance attached — what a provider ADMITS.\n *\n * The capability and the call are the same two axes and different objects, which is why this is a\n * separate schema rather than the target with its identifiers made optional. A provider admitting\n * `ORGANIZATION × USER` says nothing about which organization; a call naming no organization is\n * incomplete. Making one schema serve both would have to relax exactly the refinements that make the\n * call safe.\n */\nexport type ExternalProvider_ConnectionShape = z.infer<typeof ExternalProvider_ConnectionShapeSchema>;\n\nexport const ExternalProvider_ConnectionTargetSchema = ExternalProvider_ConnectionShapeSchema.extend({\n  /**\n   * The organization or user whose account is spent. Absent for APPLICATION, which has exactly one\n   * instance by construction — an id there would be a second name for the deployment.\n   */\n  ownerId: z.string().optional(),\n  /**\n   * The user an APPLICATION-owned, USER-delegated call impersonates — the ONLY shape where the call\n   * itself must say who, because the application's identity could impersonate anyone.\n   *\n   * Refused everywhere else. An ORGANIZATION-owned USER-delegated connection spends the account of\n   * the member who LINKED it, whoever triggers the call (see the decision above), so a person named\n   * here would describe an identity the runtime will not act as. A USER-owned connection already\n   * names its person in `ownerId`.\n   */\n  actingForUserId: z.string().optional(),\n}).superRefine((target, ctx) => {\n  const ownerIsInstance = target.ownerScope !== ExternalProvider_Connection_OwnerScope.APPLICATION;\n  if (ownerIsInstance && (target.ownerId === undefined || target.ownerId === '')) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['ownerId'],\n      message: `A ${target.ownerScope}-owned connection names WHICH ${target.ownerScope}; a call that omits it has not said whose account it spends.`,\n    });\n  }\n  if (!ownerIsInstance && target.ownerId !== undefined) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['ownerId'],\n      message: 'An application-owned connection has exactly one instance, so an ownerId here names something that does not exist.',\n    });\n  }\n  if (connectionTargetNamesActingUser(target)) {\n    if (target.actingForUserId === undefined || target.actingForUserId === '') {\n      ctx.addIssue({\n        code: 'custom',\n        path: ['actingForUserId'],\n        message: 'An application-owned delegated call impersonates someone, and who is what makes it permissible — it cannot be left to be inferred.',\n      });\n    }\n  } else if (target.actingForUserId !== undefined) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['actingForUserId'],\n      message: target.delegation === ExternalProvider_Connection_DelegationMode.USER\n        ? `A ${target.ownerScope}-owned connection's person is fixed by the account itself — the member who linked it, or the owner. `\n          + 'Naming a user here describes an identity the runtime will not act as.'\n        : 'A SERVICE call acts for nobody. Naming a user here reads as delegation the runtime will not perform, which is worse than an error: the call succeeds as the wrong identity.',\n    });\n  }\n});\n\n/**\n * Whether a connection target must NAME the user it acts for — true only for APPLICATION × USER.\n *\n * One predicate rather than a condition restated at each builder: the target schema, the HTTP-API\n * binding's target builder and the connect panel all ask this question, and three spellings of it\n * are how a target comes to carry a person the refinement then refuses.\n */\nexport function connectionTargetNamesActingUser(shape: ExternalProvider_ConnectionShape): boolean {\n  return shape.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION\n    && shape.delegation === ExternalProvider_Connection_DelegationMode.USER;\n}\n\n/**\n * Whether linking this connection lends ONE member's own account to their whole organization —\n * true only for ORGANIZATION × USER.\n *\n * The member who links such a connection is trusting every colleague's activity with their account,\n * so the connect surface asks them to ACKNOWLEDGE it and the connect leg refuses a link that did not\n * (decision on wildo-ai/wildo-ai#18). One predicate for the panel that shows the acknowledgement and\n * the controller that requires it, so the two cannot come to disagree about which links owe one.\n */\nexport function connectionLendsMemberAccountToOrganization(shape: ExternalProvider_ConnectionShape): boolean {\n  return shape.ownerScope === ExternalProvider_Connection_OwnerScope.ORGANIZATION\n    && shape.delegation === ExternalProvider_Connection_DelegationMode.USER;\n}\n\nexport type ExternalProvider_ConnectionTarget = z.infer<typeof ExternalProvider_ConnectionTargetSchema>;\n"]}

package/dist/esm/index.d.ts

@@ -1,7 +1,6 @@
 export * from './core/commons.external-connectors-models.schemas';
 export * from './core/security.external-connectors-models.schemas';
 export * from './core/operations.external-connectors-models.schemas';
-export * from './core/protocols.external-connectors-models.schemas';
 export * from './protocols/hooks-capability.external-connectors-models.schemas';
 export * from './core/operation-classification.external-connectors-models.schemas';
 export * from './protocols/agent-client-protocol.external-connectors-models.schemas';
@@ -14,9 +13,10 @@ export * from './protocols/frontend.external-connectors-models.schemas';
 export * from './protocols/hooks.external-connectors-models.schemas';
 export * from './protocols/llm.external-connectors-models.schemas';
 export * from './protocols/oauth2.external-connectors-models.schemas';
-export * from './protocols/rest-api.external-connectors-models.schemas';
 export * from './protocols/rest-operations.external-connectors-models.schemas';
 export * from './protocols/billing.standard-interface.schemas';
 export * from './protocols/sms.external-connectors-models.schemas';
 export * from './protocols/sms.standard-interface.schemas';
+export * from './protocols/oauth2-provider-assurance.definitions';
+export * from './protocols/oauth2-provider-assurance.schemas';
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mDAAmD,CAAC;AAClE,cAAc,oDAAoD,CAAC;AACnE,cAAc,sDAAsD,CAAC;AACrE,cAAc,qDAAqD,CAAC;AAKpE,cAAc,iEAAiE,CAAC;AAChF,cAAc,oEAAoE,CAAC;AAGnF,cAAc,sEAAsE,CAAC;AACrF,cAAc,oEAAoE,CAAC;AACnF,cAAc,sDAAsD,CAAC;AACrE,cAAc,8CAA8C,CAAC;AAC7D,cAAc,2DAA2D,CAAC;AAC1E,cAAc,sDAAsD,CAAC;AACrE,cAAc,yDAAyD,CAAC;AACxE,cAAc,sDAAsD,CAAC;AACrE,cAAc,oDAAoD,CAAC;AACnE,cAAc,uDAAuD,CAAC;AACtE,cAAc,yDAAyD,CAAC;AACxE,cAAc,gEAAgE,CAAC;AAC/E,cAAc,gDAAgD,CAAC;AAC/D,cAAc,oDAAoD,CAAC;AACnE,cAAc,4CAA4C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mDAAmD,CAAC;AAClE,cAAc,oDAAoD,CAAC;AACnE,cAAc,sDAAsD,CAAC;AAKrE,cAAc,iEAAiE,CAAC;AAChF,cAAc,oEAAoE,CAAC;AAGnF,cAAc,sEAAsE,CAAC;AACrF,cAAc,oEAAoE,CAAC;AACnF,cAAc,sDAAsD,CAAC;AACrE,cAAc,8CAA8C,CAAC;AAC7D,cAAc,2DAA2D,CAAC;AAC1E,cAAc,sDAAsD,CAAC;AACrE,cAAc,yDAAyD,CAAC;AACxE,cAAc,sDAAsD,CAAC;AACrE,cAAc,oDAAoD,CAAC;AACnE,cAAc,uDAAuD,CAAC;AACtE,cAAc,gEAAgE,CAAC;AAC/E,cAAc,gDAAgD,CAAC;AAC/D,cAAc,oDAAoD,CAAC;AACnE,cAAc,4CAA4C,CAAC;AAI3D,cAAc,mDAAmD,CAAC;AAClE,cAAc,+CAA+C,CAAC"}

package/dist/esm/index.js

@@ -1,7 +1,6 @@
 export * from './core/commons.external-connectors-models.schemas.js';
 export * from './core/security.external-connectors-models.schemas.js';
 export * from './core/operations.external-connectors-models.schemas.js';
-export * from './core/protocols.external-connectors-models.schemas.js';
 // Webhook capability contracts (adapter / handler / scope resolver) — consumed by the engine's
 // webhook pipeline. The former `features/` layer (capability enum, transformer interfaces) was
 // retired 2026-09-05 (#327): it re-stated `BUILTIN_PROVIDER_CAPABILITY` and had no reader.
@@ -18,9 +17,10 @@ export * from './protocols/frontend.external-connectors-models.schemas.js';
 export * from './protocols/hooks.external-connectors-models.schemas.js';
 export * from './protocols/llm.external-connectors-models.schemas.js';
 export * from './protocols/oauth2.external-connectors-models.schemas.js';
-export * from './protocols/rest-api.external-connectors-models.schemas.js';
 export * from './protocols/rest-operations.external-connectors-models.schemas.js';
 export * from './protocols/billing.standard-interface.schemas.js';
 export * from './protocols/sms.external-connectors-models.schemas.js';
 export * from './protocols/sms.standard-interface.schemas.js';
+export * from './protocols/oauth2-provider-assurance.definitions.js';
+export * from './protocols/oauth2-provider-assurance.schemas.js';
 //# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mDAAmD,CAAC;AAClE,cAAc,oDAAoD,CAAC;AACnE,cAAc,sDAAsD,CAAC;AACrE,cAAc,qDAAqD,CAAC;AAEpE,+FAA+F;AAC/F,+FAA+F;AAC/F,2FAA2F;AAC3F,cAAc,iEAAiE,CAAC;AAChF,cAAc,oEAAoE,CAAC;AAEnF,YAAY;AACZ,cAAc,sEAAsE,CAAC;AACrF,cAAc,oEAAoE,CAAC;AACnF,cAAc,sDAAsD,CAAC;AACrE,cAAc,8CAA8C,CAAC;AAC7D,cAAc,2DAA2D,CAAC;AAC1E,cAAc,sDAAsD,CAAC;AACrE,cAAc,yDAAyD,CAAC;AACxE,cAAc,sDAAsD,CAAC;AACrE,cAAc,oDAAoD,CAAC;AACnE,cAAc,uDAAuD,CAAC;AACtE,cAAc,yDAAyD,CAAC;AACxE,cAAc,gEAAgE,CAAC;AAC/E,cAAc,gDAAgD,CAAC;AAC/D,cAAc,oDAAoD,CAAC;AACnE,cAAc,4CAA4C,CAAC","sourcesContent":["export * from './core/commons.external-connectors-models.schemas';\nexport * from './core/security.external-connectors-models.schemas';\nexport * from './core/operations.external-connectors-models.schemas';\nexport * from './core/protocols.external-connectors-models.schemas';\n\n// Webhook capability contracts (adapter / handler / scope resolver) — consumed by the engine's\n// webhook pipeline. The former `features/` layer (capability enum, transformer interfaces) was\n// retired 2026-09-05 (#327): it re-stated `BUILTIN_PROVIDER_CAPABILITY` and had no reader.\nexport * from './protocols/hooks-capability.external-connectors-models.schemas';\nexport * from './core/operation-classification.external-connectors-models.schemas';\n\n// Protocols\nexport * from './protocols/agent-client-protocol.external-connectors-models.schemas';\nexport * from './protocols/document-extraction.external-connectors-models.schemas';\nexport * from './protocols/email.external-connectors-models.schemas';\nexport * from './protocols/email.standard-interface.schemas';\nexport * from './protocols/embeddings.external-connectors-models.schemas';\nexport * from './protocols/image.external-connectors-models.schemas';\nexport * from './protocols/frontend.external-connectors-models.schemas';\nexport * from './protocols/hooks.external-connectors-models.schemas';\nexport * from './protocols/llm.external-connectors-models.schemas';\nexport * from './protocols/oauth2.external-connectors-models.schemas';\nexport * from './protocols/rest-api.external-connectors-models.schemas';\nexport * from './protocols/rest-operations.external-connectors-models.schemas';\nexport * from './protocols/billing.standard-interface.schemas';\nexport * from './protocols/sms.external-connectors-models.schemas';\nexport * from './protocols/sms.standard-interface.schemas';\n\n\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mDAAmD,CAAC;AAClE,cAAc,oDAAoD,CAAC;AACnE,cAAc,sDAAsD,CAAC;AAErE,+FAA+F;AAC/F,+FAA+F;AAC/F,2FAA2F;AAC3F,cAAc,iEAAiE,CAAC;AAChF,cAAc,oEAAoE,CAAC;AAEnF,YAAY;AACZ,cAAc,sEAAsE,CAAC;AACrF,cAAc,oEAAoE,CAAC;AACnF,cAAc,sDAAsD,CAAC;AACrE,cAAc,8CAA8C,CAAC;AAC7D,cAAc,2DAA2D,CAAC;AAC1E,cAAc,sDAAsD,CAAC;AACrE,cAAc,yDAAyD,CAAC;AACxE,cAAc,sDAAsD,CAAC;AACrE,cAAc,oDAAoD,CAAC;AACnE,cAAc,uDAAuD,CAAC;AACtE,cAAc,gEAAgE,CAAC;AAC/E,cAAc,gDAAgD,CAAC;AAC/D,cAAc,oDAAoD,CAAC;AACnE,cAAc,4CAA4C,CAAC;AAI3D,cAAc,mDAAmD,CAAC;AAClE,cAAc,+CAA+C,CAAC","sourcesContent":["export * from './core/commons.external-connectors-models.schemas';\nexport * from './core/security.external-connectors-models.schemas';\nexport * from './core/operations.external-connectors-models.schemas';\n\n// Webhook capability contracts (adapter / handler / scope resolver) — consumed by the engine's\n// webhook pipeline. The former `features/` layer (capability enum, transformer interfaces) was\n// retired 2026-09-05 (#327): it re-stated `BUILTIN_PROVIDER_CAPABILITY` and had no reader.\nexport * from './protocols/hooks-capability.external-connectors-models.schemas';\nexport * from './core/operation-classification.external-connectors-models.schemas';\n\n// Protocols\nexport * from './protocols/agent-client-protocol.external-connectors-models.schemas';\nexport * from './protocols/document-extraction.external-connectors-models.schemas';\nexport * from './protocols/email.external-connectors-models.schemas';\nexport * from './protocols/email.standard-interface.schemas';\nexport * from './protocols/embeddings.external-connectors-models.schemas';\nexport * from './protocols/image.external-connectors-models.schemas';\nexport * from './protocols/frontend.external-connectors-models.schemas';\nexport * from './protocols/hooks.external-connectors-models.schemas';\nexport * from './protocols/llm.external-connectors-models.schemas';\nexport * from './protocols/oauth2.external-connectors-models.schemas';\nexport * from './protocols/rest-operations.external-connectors-models.schemas';\nexport * from './protocols/billing.standard-interface.schemas';\nexport * from './protocols/sms.external-connectors-models.schemas';\nexport * from './protocols/sms.standard-interface.schemas';\n\n\n\nexport * from './protocols/oauth2-provider-assurance.definitions';\nexport * from './protocols/oauth2-provider-assurance.schemas';\n"]}