@wildo-ai/external-connectors-models 1.1.4 → 1.1.6

package/dist/esm/companion-exports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"companion-exports.d.ts","sourceRoot":"","sources":["../../src/companion-exports.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,cAAc,SAAS,CAAC"}
+{"version":3,"file":"companion-exports.d.ts","sourceRoot":"","sources":["../../../src/companion-exports.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,cAAc,SAAS,CAAC"}

package/dist/esm/core/commons.external-connectors-models.schemas.d.ts

@@ -1,5 +1,4 @@
 import { z } from "zod";
-import { ExternalProvider_Auth_Kind } from "./security.external-connectors-models.schemas";
 /**
  * The ONE protocol vocabulary a provider can speak. Every other list is derived from or pinned
  * to this enum: the backend runtime-contract discriminants (`ProviderProtocolRuntimeKind`, a
@@ -71,6 +70,15 @@ export declare enum ExternalProvider_ExchangeProtocol_Kind {
     /** Reserved — video generation. Serves the VIDEO modality. Not yet implemented. */
     VIDEO_PROVIDER = "video_provider",
     EMAIL_PROVIDER = "email_provider",
+    /**
+     * RECEIVING email (#1630): the provider hosts a receiving domain, announces each message through a
+     * `WEBHOOK_ORIGINATOR` endpoint whose `capability` is `EMAIL_INBOUND`, and serves the message on
+     * request through `StandardInboundEmail_Interface`. Its own kind rather than a mode of
+     * `EMAIL_PROVIDER` because sending and receiving are separate procurement decisions and share no
+     * operation: a sending contract composes a request, a receiving one parses a notification and
+     * fetches a message.
+     */
+    EMAIL_INBOUND_PROVIDER = "email_inbound_provider",
     SSO_OAUTH2 = "sso_oauth2",
     BILLING_PROVIDER = "billing_provider",
     SMS_PROVIDER = "sms_provider",
@@ -96,6 +104,7 @@ export declare const ProviderProtocolRuntimeKind: Readonly<{
     readonly DOCUMENT_EXTRACTION: ExternalProvider_ExchangeProtocol_Kind.DOCUMENT_EXTRACTION_PROVIDER;
     readonly AGENT_CLIENT_PROTOCOL: ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL;
     readonly EMAIL: ExternalProvider_ExchangeProtocol_Kind.EMAIL_PROVIDER;
+    readonly EMAIL_INBOUND: ExternalProvider_ExchangeProtocol_Kind.EMAIL_INBOUND_PROVIDER;
     readonly OAUTH2_SSO: ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2;
     readonly BILLING: ExternalProvider_ExchangeProtocol_Kind.BILLING_PROVIDER;
     readonly WEBHOOK_ORIGINATOR: ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR;
@@ -108,13 +117,6 @@ export declare enum APPLICATION_ENVIRONMENT {
     STAGING = "staging",
     PRODUCTION = "production"
 }
-export declare enum ExternalProvider_Status {
-    ACTIVE = "active",
-    INACTIVE = "inactive",
-    BUZY = "busy",
-    OFFLINE = "offline",
-    DEPRECATED = "deprecated"
-}
 export declare enum API_HttpMethod {
     GET = "GET",
     POST = "POST",
@@ -125,128 +127,25 @@ export declare enum API_HttpMethod {
     OPTIONS = "OPTIONS"
 }
 /**
- * Shared protocol profile fields.
+ * Shared protocol configuration fields — the ONE survivor of the per-protocol profile /
+ * configuration / status triple (#965), and the reason it stays is a reader, not a legacy.
  *
- * These fields are transport-oriented hints that many protocols use, but they
- * are not universally meaningful. Execution-oriented protocols such as a local
- * CLI runtime should not need to invent fake HTTP endpoints or auth profiles
- * just to satisfy the shared contract.
- */
-export declare const ExternalProvider_ExchangeProtocol_Profile_BaseSchema: z.ZodObject<{
-    endpoints: z.ZodOptional<z.ZodRecord<z.ZodEnum<typeof APPLICATION_ENVIRONMENT>, z.ZodString>>;
-    availableAuthMethods: z.ZodOptional<z.ZodArray<z.ZodEnum<typeof ExternalProvider_Auth_Kind>>>;
-    authProfiles: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
-        ref: z.ZodOptional<z.ZodString>;
-        isDefault: z.ZodDefault<z.ZodBoolean>;
-        location: z.ZodDefault<z.ZodEnum<typeof import("./security.external-connectors-models.schemas").ExternalProvider_Auth_ApiKey_Location>>;
-        kind: z.ZodLiteral<ExternalProvider_Auth_Kind.API_KEY>;
-        locationField: z.ZodDefault<z.ZodString>;
-        prefix: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>, z.ZodObject<{
-        ref: z.ZodOptional<z.ZodString>;
-        isDefault: z.ZodDefault<z.ZodBoolean>;
-        location: z.ZodDefault<z.ZodEnum<typeof import("./security.external-connectors-models.schemas").ExternalProvider_Auth_ApiKey_Location>>;
-        kind: z.ZodLiteral<ExternalProvider_Auth_Kind.HMAC_SIGNATURE>;
-        locationField: z.ZodDefault<z.ZodString>;
-        algorithm: z.ZodDefault<z.ZodEnum<typeof import("./security.external-connectors-models.schemas").ExternalProvider_Auth_HMAC_Signature_Algorithm>>;
-        signaturePayload: z.ZodOptional<z.ZodEnum<{
-            custom: "custom";
-            body: "body";
-            timestamp: "timestamp";
-        }>>;
-        timestampHeader: z.ZodOptional<z.ZodString>;
-        nonceHeader: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>, z.ZodObject<{
-        ref: z.ZodOptional<z.ZodString>;
-        isDefault: z.ZodDefault<z.ZodBoolean>;
-        kind: z.ZodLiteral<ExternalProvider_Auth_Kind.BEARER>;
-        location: z.ZodDefault<z.ZodEnum<typeof import("./security.external-connectors-models.schemas").ExternalProvider_Auth_ApiKey_Location>>;
-        locationField: z.ZodDefault<z.ZodString>;
-        prefix: z.ZodDefault<z.ZodString>;
-        format: z.ZodDefault<z.ZodEnum<typeof import("./security.external-connectors-models.schemas").ExternalProvider_Auth_Bearer_Format>>;
-    }, z.core.$strip>, z.ZodObject<{
-        ref: z.ZodOptional<z.ZodString>;
-        isDefault: z.ZodDefault<z.ZodBoolean>;
-        location: z.ZodDefault<z.ZodEnum<typeof import("./security.external-connectors-models.schemas").ExternalProvider_Auth_ApiKey_Location>>;
-        locationField: z.ZodDefault<z.ZodString>;
-        kind: z.ZodLiteral<ExternalProvider_Auth_Kind.OPENID_CONNECT>;
-        discoveryUrl: z.ZodOptional<z.ZodURL>;
-        issuer: z.ZodOptional<z.ZodString>;
-        audience: z.ZodOptional<z.ZodString>;
-        validationMode: z.ZodOptional<z.ZodEnum<{
-            jwks: "jwks";
-            introspection: "introspection";
-            local: "local";
-        }>>;
-    }, z.core.$strip>, z.ZodObject<{
-        ref: z.ZodOptional<z.ZodString>;
-        isDefault: z.ZodDefault<z.ZodBoolean>;
-        location: z.ZodDefault<z.ZodEnum<typeof import("./security.external-connectors-models.schemas").ExternalProvider_Auth_ApiKey_Location>>;
-        locationField: z.ZodDefault<z.ZodString>;
-        kind: z.ZodLiteral<ExternalProvider_Auth_Kind.OAUTH2>;
-        oauth2ProviderRef: z.ZodOptional<z.ZodString>;
-        authUrl: z.ZodOptional<z.ZodURL>;
-        tokenUrl: z.ZodOptional<z.ZodURL>;
-        refreshUrl: z.ZodOptional<z.ZodURL>;
-        scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        grantType: z.ZodOptional<z.ZodEnum<typeof import("./oauth2.enums").OAuth2_GrantType>>;
-        tokenEndpointAuthMethod: z.ZodOptional<z.ZodEnum<typeof import("./oauth2.enums").OAuth2_TokenEndpoint_AuthMethod>>;
-        pkce: z.ZodOptional<z.ZodBoolean>;
-        pkceMethod: z.ZodOptional<z.ZodEnum<typeof import("./oauth2.enums").OAuth2_PKCE_Method>>;
-        prompt: z.ZodOptional<z.ZodEnum<typeof import("./oauth2.enums").OAuth2_Prompt>>;
-        accessType: z.ZodOptional<z.ZodEnum<typeof import("./oauth2.enums").OAuth2_AccessType>>;
-        extraAuthParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-        extraTokenParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-        tokenFormat: z.ZodDefault<z.ZodEnum<{
-            custom: "custom";
-            bearer: "bearer";
-            token: "token";
-            oauth: "oauth";
-        }>>;
-        customTokenPrefix: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>, z.ZodObject<{
-        ref: z.ZodOptional<z.ZodString>;
-        isDefault: z.ZodDefault<z.ZodBoolean>;
-        location: z.ZodDefault<z.ZodEnum<typeof import("./security.external-connectors-models.schemas").ExternalProvider_Auth_ApiKey_Location>>;
-        locationField: z.ZodDefault<z.ZodString>;
-        kind: z.ZodLiteral<ExternalProvider_Auth_Kind.BASIC>;
-        usernameRef: z.ZodOptional<z.ZodString>;
-        passwordRef: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>, z.ZodObject<{
-        ref: z.ZodOptional<z.ZodString>;
-        isDefault: z.ZodDefault<z.ZodBoolean>;
-        location: z.ZodDefault<z.ZodEnum<typeof import("./security.external-connectors-models.schemas").ExternalProvider_Auth_ApiKey_Location>>;
-        locationField: z.ZodDefault<z.ZodString>;
-        kind: z.ZodLiteral<ExternalProvider_Auth_Kind.NONE>;
-    }, z.core.$strip>, z.ZodObject<{
-        ref: z.ZodOptional<z.ZodString>;
-        isDefault: z.ZodDefault<z.ZodBoolean>;
-        location: z.ZodDefault<z.ZodEnum<typeof import("./security.external-connectors-models.schemas").ExternalProvider_Auth_ApiKey_Location>>;
-        locationField: z.ZodDefault<z.ZodString>;
-        kind: z.ZodLiteral<ExternalProvider_Auth_Kind.FRONTEND_SECRET>;
-        frontendOnly: z.ZodDefault<z.ZodBoolean>;
-    }, z.core.$strip>, z.ZodObject<{
-        ref: z.ZodOptional<z.ZodString>;
-        isDefault: z.ZodDefault<z.ZodBoolean>;
-        location: z.ZodDefault<z.ZodEnum<typeof import("./security.external-connectors-models.schemas").ExternalProvider_Auth_ApiKey_Location>>;
-        locationField: z.ZodDefault<z.ZodString>;
-        kind: z.ZodLiteral<ExternalProvider_Auth_Kind.MUTUAL_TLS>;
-        certificateRef: z.ZodOptional<z.ZodString>;
-        privateKeyRef: z.ZodOptional<z.ZodString>;
-        caRef: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>], "kind">>>;
-}, z.core.$strip>;
-/**
- * Shared protocol configuration fields.
+ * `authConfig` is read on a resolved provider configuration by the OAuth2 connection resolver
+ * (`clientId`, `secretRef`) and by the registry's default-over-custom merge, and `enabled` is what
+ * a provider configuration parses at the boundary (`AgentClientProtocol_ConfigurationSchema`,
+ * `OAuth2Provider_ConfigurationSchema` extend this; the LLM and webhook configurations intersect
+ * with the inferred type). It is optional because execution-oriented protocols can own their own
+ * auth/runtime policy contract.
  *
- * `authConfig` remains available for protocols that resolve secrets through the
- * generic provider auth model, but it is optional because execution-oriented
- * protocols can own their own auth/runtime policy contract.
+ * What is gone: the profile base (a provider's transport facts now live on its runtime contract,
+ * `ProviderProtocolRuntimeContract`, which the registry projects) and the status base (nothing
+ * ever recorded a per-protocol status). Both had no reader outside the declarations that extended
+ * them.
  */
 export declare const ExternalProvider_ExchangeProtocol_Configuration_BaseSchema: z.ZodObject<{
     enabled: z.ZodBoolean;
     authConfig: z.ZodOptional<z.ZodObject<{
-        authKind: z.ZodEnum<typeof ExternalProvider_Auth_Kind>;
+        authKind: z.ZodEnum<typeof import("./security.external-connectors-models.schemas").ExternalProvider_Auth_Kind>;
         profileRefs: z.ZodOptional<z.ZodArray<z.ZodString>>;
         isDefault: z.ZodOptional<z.ZodBoolean>;
         secretRef: z.ZodString;
@@ -260,15 +159,7 @@ export declare const ExternalProvider_ExchangeProtocol_Configuration_BaseSchema:
         priority: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
-export declare const ExternalProvider_ExchangeProtocol_Status_BaseSchema: z.ZodObject<{
-    protocolKind: z.ZodEnum<typeof ExternalProvider_ExchangeProtocol_Kind>;
-    status: z.ZodEnum<typeof ExternalProvider_Status>;
-    lastCheckedAt: z.ZodString;
-    errorReason: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-export type ExternalProvider_ExchangeProtocol_Profile_Base = z.infer<typeof ExternalProvider_ExchangeProtocol_Profile_BaseSchema>;
 export type ExternalProvider_ExchangeProtocol_Configuration_Base = z.infer<typeof ExternalProvider_ExchangeProtocol_Configuration_BaseSchema>;
-export type ExternalProvider_ExchangeProtocol_Status_Base = z.infer<typeof ExternalProvider_ExchangeProtocol_Status_BaseSchema>;
 export declare enum ExternalProvider_IO_Direction {
     INBOUND = "inbound",
     OUTBOUND = "outbound",

package/dist/esm/core/commons.external-connectors-models.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commons.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../src/core/commons.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAA6C,0BAA0B,EAAsF,MAAM,+CAA+C,CAAC;AAG1N;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,sCAAsC;IAEhD,QAAQ,aAAa;IACrB,kBAAkB,uBAAuB;IAIzC,YAAY,iBAAiB;IAC7B;;;;;;;;;;;;;;;OAeG;IACH,qBAAqB,0BAA0B;IAE/C,8EAA8E;IAC9E,cAAc,mBAAmB;IACjC;;;;;;;;;;OAUG;IACH,mBAAmB,wBAAwB;IAC3C;;;;;;;;;;;;;OAaG;IACH,4BAA4B,iCAAiC;IAC7D,iGAAiG;IACjG,cAAc,mBAAmB;IACjC,mFAAmF;IACnF,cAAc,mBAAmB;IAGjC,cAAc,mBAAmB;IAGjC,UAAU,eAAe;IAIzB,gBAAgB,qBAAqB;IAGrC,YAAY,iBAAiB;IAG7B,YAAY,iBAAiB;CAC9B;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;EAY7B,CAAC;AACZ,MAAM,MAAM,2BAA2B,GACrC,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,OAAO,2BAA2B,CAAC,CAAC;AAEjF,oBAAY,uBAAuB;IACjC,WAAW,gBAAgB;IAC3B,OAAO,YAAY;IACnB,UAAU,eAAe;CAC1B;AAED,oBAAY,uBAAuB;IACjC,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,UAAU,eAAe;CAC1B;AAGD,oBAAY,cAAc;IACxB,GAAG,QAAQ;IACX,IAAI,SAAS;IACb,GAAG,QAAQ;IACX,KAAK,UAAU;IACf,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,OAAO,YAAY;CACpB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oDAAoD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAI/D,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,0DAA0D;;;;;;;;;;;;;;;;iBAIrE,CAAC;AAEH,eAAO,MAAM,mDAAmD;;;;;iBAK9D,CAAC;AAEH,MAAM,MAAM,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oDAAoD,CAAC,CAAC;AAClI,MAAM,MAAM,oDAAoD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0DAA0D,CAAC,CAAC;AAC9I,MAAM,MAAM,6CAA6C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mDAAmD,CAAC,CAAC;AAEhI,oBAAY,6BAA6B;IACvC,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,aAAa,kBAAkB;CAChC;AAED,oBAAY,sCAAsC;IAChD,gBAAgB,qBAAqB;IACrC,WAAW,gBAAgB;IAC3B,SAAS,WAAW;CACrB"}
+{"version":3,"file":"commons.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../../src/core/commons.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,sCAAsC;IAEhD,QAAQ,aAAa;IACrB,kBAAkB,uBAAuB;IAIzC,YAAY,iBAAiB;IAC7B;;;;;;;;;;;;;;;OAeG;IACH,qBAAqB,0BAA0B;IAE/C,8EAA8E;IAC9E,cAAc,mBAAmB;IACjC;;;;;;;;;;OAUG;IACH,mBAAmB,wBAAwB;IAC3C;;;;;;;;;;;;;OAaG;IACH,4BAA4B,iCAAiC;IAC7D,iGAAiG;IACjG,cAAc,mBAAmB;IACjC,mFAAmF;IACnF,cAAc,mBAAmB;IAGjC,cAAc,mBAAmB;IACjC;;;;;;;OAOG;IACH,sBAAsB,2BAA2B;IAGjD,UAAU,eAAe;IAIzB,gBAAgB,qBAAqB;IAGrC,YAAY,iBAAiB;IAG7B,YAAY,iBAAiB;CAC9B;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;EAa7B,CAAC;AACZ,MAAM,MAAM,2BAA2B,GACrC,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,OAAO,2BAA2B,CAAC,CAAC;AAEjF,oBAAY,uBAAuB;IACjC,WAAW,gBAAgB;IAC3B,OAAO,YAAY;IACnB,UAAU,eAAe;CAC1B;AAGD,oBAAY,cAAc;IACxB,GAAG,QAAQ;IACX,IAAI,SAAS;IACb,GAAG,QAAQ;IACX,KAAK,UAAU;IACf,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,0DAA0D;;;;;;;;;;;;;;;;iBAIrE,CAAC;AAEH,MAAM,MAAM,oDAAoD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0DAA0D,CAAC,CAAC;AAE9I,oBAAY,6BAA6B;IACvC,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,aAAa,kBAAkB;CAChC;AAED,oBAAY,sCAAsC;IAChD,gBAAgB,qBAAqB;IACrC,WAAW,gBAAgB;IAC3B,SAAS,WAAW;CACrB"}

package/dist/esm/core/commons.external-connectors-models.schemas.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { ExternalProvider_Auth_ConfigurationSchema, ExternalProvider_Auth_Kind, ExternalProvider_AuthProfile_Schema, ExternalProvider_RateLimitConfigurationSchema } from "./security.external-connectors-models.schemas.js";
+import { ExternalProvider_Auth_ConfigurationSchema, ExternalProvider_RateLimitConfigurationSchema } from "./security.external-connectors-models.schemas.js";
 /**
  * The ONE protocol vocabulary a provider can speak. Every other list is derived from or pinned
  * to this enum: the backend runtime-contract discriminants (`ProviderProtocolRuntimeKind`, a
@@ -77,6 +77,15 @@ export var ExternalProvider_ExchangeProtocol_Kind;
     ExternalProvider_ExchangeProtocol_Kind["VIDEO_PROVIDER"] = "video_provider";
     // INFRA
     ExternalProvider_ExchangeProtocol_Kind["EMAIL_PROVIDER"] = "email_provider";
+    /**
+     * RECEIVING email (#1630): the provider hosts a receiving domain, announces each message through a
+     * `WEBHOOK_ORIGINATOR` endpoint whose `capability` is `EMAIL_INBOUND`, and serves the message on
+     * request through `StandardInboundEmail_Interface`. Its own kind rather than a mode of
+     * `EMAIL_PROVIDER` because sending and receiving are separate procurement decisions and share no
+     * operation: a sending contract composes a request, a receiving one parses a notification and
+     * fetches a message.
+     */
+    ExternalProvider_ExchangeProtocol_Kind["EMAIL_INBOUND_PROVIDER"] = "email_inbound_provider";
     // AUTH
     ExternalProvider_ExchangeProtocol_Kind["SSO_OAUTH2"] = "sso_oauth2";
     // OPENID_CONNECT ?
@@ -107,6 +116,7 @@ export const ProviderProtocolRuntimeKind = Object.freeze({
     DOCUMENT_EXTRACTION: ExternalProvider_ExchangeProtocol_Kind.DOCUMENT_EXTRACTION_PROVIDER,
     AGENT_CLIENT_PROTOCOL: ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL,
     EMAIL: ExternalProvider_ExchangeProtocol_Kind.EMAIL_PROVIDER,
+    EMAIL_INBOUND: ExternalProvider_ExchangeProtocol_Kind.EMAIL_INBOUND_PROVIDER,
     OAUTH2_SSO: ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2,
     BILLING: ExternalProvider_ExchangeProtocol_Kind.BILLING_PROVIDER,
     WEBHOOK_ORIGINATOR: ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR,
@@ -119,14 +129,6 @@ export var APPLICATION_ENVIRONMENT;
     APPLICATION_ENVIRONMENT["STAGING"] = "staging";
     APPLICATION_ENVIRONMENT["PRODUCTION"] = "production";
 })(APPLICATION_ENVIRONMENT || (APPLICATION_ENVIRONMENT = {}));
-export var ExternalProvider_Status;
-(function (ExternalProvider_Status) {
-    ExternalProvider_Status["ACTIVE"] = "active";
-    ExternalProvider_Status["INACTIVE"] = "inactive";
-    ExternalProvider_Status["BUZY"] = "busy";
-    ExternalProvider_Status["OFFLINE"] = "offline";
-    ExternalProvider_Status["DEPRECATED"] = "deprecated";
-})(ExternalProvider_Status || (ExternalProvider_Status = {}));
 export var API_HttpMethod;
 (function (API_HttpMethod) {
     API_HttpMethod["GET"] = "GET";
@@ -138,36 +140,26 @@ export var API_HttpMethod;
     API_HttpMethod["OPTIONS"] = "OPTIONS";
 })(API_HttpMethod || (API_HttpMethod = {}));
 /**
- * Shared protocol profile fields.
+ * Shared protocol configuration fields — the ONE survivor of the per-protocol profile /
+ * configuration / status triple (#965), and the reason it stays is a reader, not a legacy.
  *
- * These fields are transport-oriented hints that many protocols use, but they
- * are not universally meaningful. Execution-oriented protocols such as a local
- * CLI runtime should not need to invent fake HTTP endpoints or auth profiles
- * just to satisfy the shared contract.
- */
-export const ExternalProvider_ExchangeProtocol_Profile_BaseSchema = z.object({
-    endpoints: z.record(z.enum(APPLICATION_ENVIRONMENT), z.string()).optional(),
-    availableAuthMethods: z.array(z.enum(ExternalProvider_Auth_Kind)).optional(),
-    authProfiles: z.array(ExternalProvider_AuthProfile_Schema).optional(),
-});
-/**
- * Shared protocol configuration fields.
+ * `authConfig` is read on a resolved provider configuration by the OAuth2 connection resolver
+ * (`clientId`, `secretRef`) and by the registry's default-over-custom merge, and `enabled` is what
+ * a provider configuration parses at the boundary (`AgentClientProtocol_ConfigurationSchema`,
+ * `OAuth2Provider_ConfigurationSchema` extend this; the LLM and webhook configurations intersect
+ * with the inferred type). It is optional because execution-oriented protocols can own their own
+ * auth/runtime policy contract.
  *
- * `authConfig` remains available for protocols that resolve secrets through the
- * generic provider auth model, but it is optional because execution-oriented
- * protocols can own their own auth/runtime policy contract.
+ * What is gone: the profile base (a provider's transport facts now live on its runtime contract,
+ * `ProviderProtocolRuntimeContract`, which the registry projects) and the status base (nothing
+ * ever recorded a per-protocol status). Both had no reader outside the declarations that extended
+ * them.
  */
 export const ExternalProvider_ExchangeProtocol_Configuration_BaseSchema = z.object({
     enabled: z.boolean(),
     authConfig: ExternalProvider_Auth_ConfigurationSchema.optional(),
     rateLimitConfig: ExternalProvider_RateLimitConfigurationSchema.optional(),
 });
-export const ExternalProvider_ExchangeProtocol_Status_BaseSchema = z.object({
-    protocolKind: z.enum(ExternalProvider_ExchangeProtocol_Kind),
-    status: z.enum(ExternalProvider_Status),
-    lastCheckedAt: z.string(),
-    errorReason: z.string().optional(),
-});
 export var ExternalProvider_IO_Direction;
 (function (ExternalProvider_IO_Direction) {
     ExternalProvider_IO_Direction["INBOUND"] = "inbound";

package/dist/esm/core/commons.external-connectors-models.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"commons.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../src/core/commons.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yCAAyC,EAAE,0BAA0B,EAAE,mCAAmC,EAAE,6CAA6C,EAAE,MAAM,+CAA+C,CAAC;AAG1N;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,sCA2EX;AA3ED,WAAY,sCAAsC;IAChD,MAAM;IACN,+DAAqB,CAAA;IACrB,mFAAyC,CAAA;IACzC,SAAS;IAET,KAAK;IACL,uEAA6B,CAAA;IAC7B;;;;;;;;;;;;;;;OAeG;IACH,yFAA+C,CAAA;IAC/C,sDAAsD;IACtD,8EAA8E;IAC9E,2EAAiC,CAAA;IACjC;;;;;;;;;;OAUG;IACH,qFAA2C,CAAA;IAC3C;;;;;;;;;;;;;OAaG;IACH,uGAA6D,CAAA;IAC7D,iGAAiG;IACjG,2EAAiC,CAAA;IACjC,mFAAmF;IACnF,2EAAiC,CAAA;IAEjC,QAAQ;IACR,2EAAiC,CAAA;IAEjC,OAAO;IACP,mEAAyB,CAAA;IACzB,mBAAmB;IAEnB,UAAU;IACV,+EAAqC,CAAA;IAErC,iBAAiB;IACjB,uEAA6B,CAAA;IAE7B,WAAW;IACX,uEAA6B,CAAA;AAC/B,CAAC,EA3EW,sCAAsC,KAAtC,sCAAsC,QA2EjD;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC,MAAM,CAAC;IACvD,GAAG,EAAE,sCAAsC,CAAC,YAAY;IACxD,KAAK,EAAE,sCAAsC,CAAC,cAAc;IAC5D,UAAU,EAAE,sCAAsC,CAAC,mBAAmB;IACtE,mBAAmB,EAAE,sCAAsC,CAAC,4BAA4B;IACxF,qBAAqB,EAAE,sCAAsC,CAAC,qBAAqB;IACnF,KAAK,EAAE,sCAAsC,CAAC,cAAc;IAC5D,UAAU,EAAE,sCAAsC,CAAC,UAAU;IAC7D,OAAO,EAAE,sCAAsC,CAAC,gBAAgB;IAChE,kBAAkB,EAAE,sCAAsC,CAAC,kBAAkB;IAC7E,GAAG,EAAE,sCAAsC,CAAC,YAAY;IACxD,IAAI,EAAE,sCAAsC,CAAC,QAAQ;CAC7C,CAAC,CAAC;AAIZ,MAAM,CAAN,IAAY,uBAIX;AAJD,WAAY,uBAAuB;IACjC,sDAA2B,CAAA;IAC3B,8CAAmB,CAAA;IACnB,oDAAyB,CAAA;AAC3B,CAAC,EAJW,uBAAuB,KAAvB,uBAAuB,QAIlC;AAED,MAAM,CAAN,IAAY,uBAMX;AAND,WAAY,uBAAuB;IACjC,4CAAiB,CAAA;IACjB,gDAAqB,CAAA;IACrB,wCAAa,CAAA;IACb,8CAAmB,CAAA;IACnB,oDAAyB,CAAA;AAC3B,CAAC,EANW,uBAAuB,KAAvB,uBAAuB,QAMlC;AAGD,MAAM,CAAN,IAAY,cAQX;AARD,WAAY,cAAc;IACxB,6BAAW,CAAA;IACX,+BAAa,CAAA;IACb,6BAAW,CAAA;IACX,iCAAe,CAAA;IACf,mCAAiB,CAAA;IACjB,+BAAa,CAAA;IACb,qCAAmB,CAAA;AACrB,CAAC,EARW,cAAc,KAAd,cAAc,QAQzB;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3E,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5E,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC,QAAQ,EAAE;CACtE,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0DAA0D,GAAG,CAAC,CAAC,MAAM,CAAC;IACjF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,UAAU,EAAE,yCAAyC,CAAC,QAAQ,EAAE;IAChE,eAAe,EAAE,6CAA6C,CAAC,QAAQ,EAAE;CAC1E,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1E,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC;IAC5D,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;IACvC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAMH,MAAM,CAAN,IAAY,6BAIX;AAJD,WAAY,6BAA6B;IACvC,oDAAmB,CAAA;IACnB,sDAAqB,CAAA;IACrB,gEAA+B,CAAA;AACjC,CAAC,EAJW,6BAA6B,KAA7B,6BAA6B,QAIxC;AAED,MAAM,CAAN,IAAY,sCAIX;AAJD,WAAY,sCAAsC;IAChD,+EAAqC,CAAA;IACrC,qEAA2B,CAAA;IAC3B,8DAAoB,CAAA;AACtB,CAAC,EAJW,sCAAsC,KAAtC,sCAAsC,QAIjD","sourcesContent":["import { z } from \"zod\";\nimport { ExternalProvider_Auth_ConfigurationSchema, ExternalProvider_Auth_Kind, ExternalProvider_AuthProfile_Schema, ExternalProvider_RateLimitConfigurationSchema } from \"./security.external-connectors-models.schemas\";\n\n\n/**\n * The ONE protocol vocabulary a provider can speak. Every other list is derived from or pinned\n * to this enum: the backend runtime-contract discriminants (`ProviderProtocolRuntimeKind`, a\n * subset of these members) and the application-authoring keys (`BUILTIN_PROVIDER_PROTOCOL` in\n * `@wildo-ai/saas-models`, its key set pinned by a drift test because that package must not\n * import this one into browser bundles).\n *\n * RETIRED 2026-09-05 (#327): `MCP_CONNECTOR`, `A2A_CONNECTOR`, `GIT_PROVIDER`, `GRPC`,\n * `SSO_SAML`. Each had an authored profile/configuration module in this package and NOTHING\n * that read it — no runtime-contract arm, no provider module declaring it, no consumer of any\n * export outside the module itself (measured with a positive control). Wildo's own MCP server,\n * A2A plane and SAML SSO are engine-implemented surfaces, not provider-declared protocols, and\n * none of them referenced these members. A retired member is refused at CONFIG time by\n * `ProviderProtocolSelectorSchema`, naming the value. Re-admit one only together with a\n * runtime-contract arm and a provider module that declares it.\n */\nexport enum ExternalProvider_ExchangeProtocol_Kind {\n  // WEB\n  REST_API = \"rest_api\",\n  WEBHOOK_ORIGINATOR = \"webhook_originator\",\n  // SOAP ?\n  \n  // AI\n  LLM_PROVIDER = \"llm_provider\",\n  /**\n   * Zed's Agent Client Protocol — a JSON-RPC session between Wildo (the client)\n   * and a CODING AGENT subprocess that reads and writes a workspace, runs\n   * commands, and calls back for permission.\n   *\n   * Its own protocol kind rather than a mode of `CLI_RUNTIME`, for the reason\n   * `EMBEDDINGS_PROVIDER` records above and one more that is specific to it: a\n   * coding agent is not a one-shot text call wearing a subprocess. Every\n   * capability the previous CLI transport lacked — token and cost accounting, a\n   * permission channel, cancellation, resumption, live progress — was missing\n   * because the one-shot shape has nowhere to put it, not because nobody had\n   * implemented it yet.\n   *\n   * NOT to be confused with the IBM/BeeAI \"Agent Communication Protocol\", which\n   * shares the acronym and is agent-to-agent — that space is `A2A_CONNECTOR`.\n   */\n  AGENT_CLIENT_PROTOCOL = \"agent_client_protocol\",\n  // AI — multimodal generation (artifact-modality axis)\n  /** Text-to-image generation (wired: gpt-image). Serves the IMAGE modality. */\n  IMAGE_PROVIDER = \"image_provider\",\n  /**\n   * Text → vector embeddings (wired: OpenAI `text-embedding-3-*`). Serves the RAG derived-data\n   * tier (corpus embedding via the `rag:embedding-drain` worker; query-time embedding in\n   * retrieval). Deliberately its OWN protocol kind rather than a sixth `LLMProvider_OperationKey`\n   * (RAG plan DL2): an unmapped LLM operation key fails SILENTLY across six consumer surfaces\n   * (registry semantic-operation map, output normalization, executor dispatch, capability slot,\n   * usage completeness, observability sink), whereas a new protocol kind fails COMPILATION at\n   * every `runtimeContract.kind` switch — the `IMAGE_PROVIDER` precedent. It also gets its own\n   * `EngineCapability.AI_EMBEDDINGS` slot so an application can select its embeddings provider\n   * independently of its chat provider.\n   */\n  EMBEDDINGS_PROVIDER = \"embeddings_provider\",\n  /**\n   * Document bytes → text (wired: Mistral `mistral-ocr-latest`). Serves the file-side text\n   * provider that `FileTextExtractionBackendService` owns, whose largest consumer is\n   * `.ragSource()` corpus ingestion.\n   *\n   * Its own kind for the reason `EMBEDDINGS_PROVIDER` records above, and it fills its own\n   * `EngineCapability.AI_DOCUMENT_EXTRACTION` slot so an application selects its OCR provider\n   * independently of chat and embeddings — three unrelated procurement decisions.\n   *\n   * NOT to be confused with PDF *generation* (templates → bytes), which is the `pdfTemplates`\n   * surface and is semantically the opposite direction. It has no provider slot: the\n   * `EngineCapability.DOCUMENT_GENERATION` this paragraph used to name was withdrawn because no\n   * provider capability token could ever fill it.\n   */\n  DOCUMENT_EXTRACTION_PROVIDER = \"document_extraction_provider\",\n  /** Reserved — audio generation (TTS / music). Serves the AUDIO modality. Not yet implemented. */\n  AUDIO_PROVIDER = \"audio_provider\",\n  /** Reserved — video generation. Serves the VIDEO modality. Not yet implemented. */\n  VIDEO_PROVIDER = \"video_provider\",\n  \n  // INFRA\n  EMAIL_PROVIDER = \"email_provider\",\n  \n  // AUTH\n  SSO_OAUTH2 = \"sso_oauth2\",\n  // OPENID_CONNECT ?\n\n  // BILLING\n  BILLING_PROVIDER = \"billing_provider\",\n\n  // SMS (Phase G2)\n  SMS_PROVIDER = \"sms_provider\",\n\n  // FRONTEND\n  FRONTEND_SDK = \"frontend_sdk\",\n}\n\n/**\n * The BACKEND runtime-contract discriminants — the subset of `ExternalProvider_ExchangeProtocol_Kind`\n * a `BackendProviderModule` can execute. Its VALUES are the enum members themselves (one spelling per\n * member since 2026-09-05, #327), so a runtime contract's `kind` IS the exchange kind and no\n * protocol→kind map exists anywhere; `BackendProtocolBinding.protocol` (the authoring KEY) and\n * `runtimeContract.kind` are checked for agreement at composition. A member absent here has no\n * backend arm: `FRONTEND_SDK` is declared by browser-side modules only, `AUDIO_PROVIDER` /\n * `VIDEO_PROVIDER` are reserved.\n *\n * A frozen const rather than a second enum because provider modules are an extension boundary and\n * the union discriminant must stay the enum member type. Import from\n * `@wildo-ai/external-connectors-models`; the private backend package consumes it, never defines it.\n */\nexport const ProviderProtocolRuntimeKind = Object.freeze({\n  LLM: ExternalProvider_ExchangeProtocol_Kind.LLM_PROVIDER,\n  IMAGE: ExternalProvider_ExchangeProtocol_Kind.IMAGE_PROVIDER,\n  EMBEDDINGS: ExternalProvider_ExchangeProtocol_Kind.EMBEDDINGS_PROVIDER,\n  DOCUMENT_EXTRACTION: ExternalProvider_ExchangeProtocol_Kind.DOCUMENT_EXTRACTION_PROVIDER,\n  AGENT_CLIENT_PROTOCOL: ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL,\n  EMAIL: ExternalProvider_ExchangeProtocol_Kind.EMAIL_PROVIDER,\n  OAUTH2_SSO: ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2,\n  BILLING: ExternalProvider_ExchangeProtocol_Kind.BILLING_PROVIDER,\n  WEBHOOK_ORIGINATOR: ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR,\n  SMS: ExternalProvider_ExchangeProtocol_Kind.SMS_PROVIDER,\n  REST: ExternalProvider_ExchangeProtocol_Kind.REST_API,\n} as const);\nexport type ProviderProtocolRuntimeKind =\n  (typeof ProviderProtocolRuntimeKind)[keyof typeof ProviderProtocolRuntimeKind];\n\nexport enum APPLICATION_ENVIRONMENT {\n  DEVELOPMENT = \"development\",\n  STAGING = \"staging\",\n  PRODUCTION = \"production\",\n}\n\nexport enum ExternalProvider_Status {\n  ACTIVE = \"active\",\n  INACTIVE = \"inactive\",\n  BUZY = \"busy\",\n  OFFLINE = \"offline\",\n  DEPRECATED = \"deprecated\",\n}\n\n\nexport enum API_HttpMethod {\n  GET = \"GET\",\n  POST = \"POST\",\n  PUT = \"PUT\",\n  PATCH = \"PATCH\",\n  DELETE = \"DELETE\",\n  HEAD = \"HEAD\",\n  OPTIONS = \"OPTIONS\",\n}\n\n/**\n * Shared protocol profile fields.\n *\n * These fields are transport-oriented hints that many protocols use, but they\n * are not universally meaningful. Execution-oriented protocols such as a local\n * CLI runtime should not need to invent fake HTTP endpoints or auth profiles\n * just to satisfy the shared contract.\n */\nexport const ExternalProvider_ExchangeProtocol_Profile_BaseSchema = z.object({\n  endpoints: z.record(z.enum(APPLICATION_ENVIRONMENT), z.string()).optional(),\n  availableAuthMethods: z.array(z.enum(ExternalProvider_Auth_Kind)).optional(),\n  authProfiles: z.array(ExternalProvider_AuthProfile_Schema).optional(),\n});\n\n/**\n * Shared protocol configuration fields.\n *\n * `authConfig` remains available for protocols that resolve secrets through the\n * generic provider auth model, but it is optional because execution-oriented\n * protocols can own their own auth/runtime policy contract.\n */\nexport const ExternalProvider_ExchangeProtocol_Configuration_BaseSchema = z.object({\n  enabled: z.boolean(),\n  authConfig: ExternalProvider_Auth_ConfigurationSchema.optional(),\n  rateLimitConfig: ExternalProvider_RateLimitConfigurationSchema.optional(),\n});\n\nexport const ExternalProvider_ExchangeProtocol_Status_BaseSchema = z.object({\n  protocolKind: z.enum(ExternalProvider_ExchangeProtocol_Kind),\n  status: z.enum(ExternalProvider_Status),\n  lastCheckedAt: z.string(),\n  errorReason: z.string().optional(),\n});\n\nexport type ExternalProvider_ExchangeProtocol_Profile_Base = z.infer<typeof ExternalProvider_ExchangeProtocol_Profile_BaseSchema>;\nexport type ExternalProvider_ExchangeProtocol_Configuration_Base = z.infer<typeof ExternalProvider_ExchangeProtocol_Configuration_BaseSchema>;\nexport type ExternalProvider_ExchangeProtocol_Status_Base = z.infer<typeof ExternalProvider_ExchangeProtocol_Status_BaseSchema>;\n\nexport enum ExternalProvider_IO_Direction {\n  INBOUND = \"inbound\",\n  OUTBOUND = \"outbound\",\n  BIDIRECTIONAL = \"bidirectional\",\n}\n\nexport enum ExternalProvider_IO_InteractionPattern {\n  REQUEST_RESPONSE = \"request_response\",\n  EVENT_BASED = \"event_based\",\n  STREAMING = \"stream\",\n}\n\n"]}
+{"version":3,"file":"commons.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../../src/core/commons.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yCAAyC,EAAE,6CAA6C,EAAE,MAAM,+CAA+C,CAAC;AAGzJ;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,sCAoFX;AApFD,WAAY,sCAAsC;IAChD,MAAM;IACN,+DAAqB,CAAA;IACrB,mFAAyC,CAAA;IACzC,SAAS;IAET,KAAK;IACL,uEAA6B,CAAA;IAC7B;;;;;;;;;;;;;;;OAeG;IACH,yFAA+C,CAAA;IAC/C,sDAAsD;IACtD,8EAA8E;IAC9E,2EAAiC,CAAA;IACjC;;;;;;;;;;OAUG;IACH,qFAA2C,CAAA;IAC3C;;;;;;;;;;;;;OAaG;IACH,uGAA6D,CAAA;IAC7D,iGAAiG;IACjG,2EAAiC,CAAA;IACjC,mFAAmF;IACnF,2EAAiC,CAAA;IAEjC,QAAQ;IACR,2EAAiC,CAAA;IACjC;;;;;;;OAOG;IACH,2FAAiD,CAAA;IAEjD,OAAO;IACP,mEAAyB,CAAA;IACzB,mBAAmB;IAEnB,UAAU;IACV,+EAAqC,CAAA;IAErC,iBAAiB;IACjB,uEAA6B,CAAA;IAE7B,WAAW;IACX,uEAA6B,CAAA;AAC/B,CAAC,EApFW,sCAAsC,KAAtC,sCAAsC,QAoFjD;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC,MAAM,CAAC;IACvD,GAAG,EAAE,sCAAsC,CAAC,YAAY;IACxD,KAAK,EAAE,sCAAsC,CAAC,cAAc;IAC5D,UAAU,EAAE,sCAAsC,CAAC,mBAAmB;IACtE,mBAAmB,EAAE,sCAAsC,CAAC,4BAA4B;IACxF,qBAAqB,EAAE,sCAAsC,CAAC,qBAAqB;IACnF,KAAK,EAAE,sCAAsC,CAAC,cAAc;IAC5D,aAAa,EAAE,sCAAsC,CAAC,sBAAsB;IAC5E,UAAU,EAAE,sCAAsC,CAAC,UAAU;IAC7D,OAAO,EAAE,sCAAsC,CAAC,gBAAgB;IAChE,kBAAkB,EAAE,sCAAsC,CAAC,kBAAkB;IAC7E,GAAG,EAAE,sCAAsC,CAAC,YAAY;IACxD,IAAI,EAAE,sCAAsC,CAAC,QAAQ;CAC7C,CAAC,CAAC;AAIZ,MAAM,CAAN,IAAY,uBAIX;AAJD,WAAY,uBAAuB;IACjC,sDAA2B,CAAA;IAC3B,8CAAmB,CAAA;IACnB,oDAAyB,CAAA;AAC3B,CAAC,EAJW,uBAAuB,KAAvB,uBAAuB,QAIlC;AAGD,MAAM,CAAN,IAAY,cAQX;AARD,WAAY,cAAc;IACxB,6BAAW,CAAA;IACX,+BAAa,CAAA;IACb,6BAAW,CAAA;IACX,iCAAe,CAAA;IACf,mCAAiB,CAAA;IACjB,+BAAa,CAAA;IACb,qCAAmB,CAAA;AACrB,CAAC,EARW,cAAc,KAAd,cAAc,QAQzB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,0DAA0D,GAAG,CAAC,CAAC,MAAM,CAAC;IACjF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,UAAU,EAAE,yCAAyC,CAAC,QAAQ,EAAE;IAChE,eAAe,EAAE,6CAA6C,CAAC,QAAQ,EAAE;CAC1E,CAAC,CAAC;AAIH,MAAM,CAAN,IAAY,6BAIX;AAJD,WAAY,6BAA6B;IACvC,oDAAmB,CAAA;IACnB,sDAAqB,CAAA;IACrB,gEAA+B,CAAA;AACjC,CAAC,EAJW,6BAA6B,KAA7B,6BAA6B,QAIxC;AAED,MAAM,CAAN,IAAY,sCAIX;AAJD,WAAY,sCAAsC;IAChD,+EAAqC,CAAA;IACrC,qEAA2B,CAAA;IAC3B,8DAAoB,CAAA;AACtB,CAAC,EAJW,sCAAsC,KAAtC,sCAAsC,QAIjD","sourcesContent":["import { z } from \"zod\";\nimport { ExternalProvider_Auth_ConfigurationSchema, ExternalProvider_RateLimitConfigurationSchema } from \"./security.external-connectors-models.schemas\";\n\n\n/**\n * The ONE protocol vocabulary a provider can speak. Every other list is derived from or pinned\n * to this enum: the backend runtime-contract discriminants (`ProviderProtocolRuntimeKind`, a\n * subset of these members) and the application-authoring keys (`BUILTIN_PROVIDER_PROTOCOL` in\n * `@wildo-ai/saas-models`, its key set pinned by a drift test because that package must not\n * import this one into browser bundles).\n *\n * RETIRED 2026-09-05 (#327): `MCP_CONNECTOR`, `A2A_CONNECTOR`, `GIT_PROVIDER`, `GRPC`,\n * `SSO_SAML`. Each had an authored profile/configuration module in this package and NOTHING\n * that read it — no runtime-contract arm, no provider module declaring it, no consumer of any\n * export outside the module itself (measured with a positive control). Wildo's own MCP server,\n * A2A plane and SAML SSO are engine-implemented surfaces, not provider-declared protocols, and\n * none of them referenced these members. A retired member is refused at CONFIG time by\n * `ProviderProtocolSelectorSchema`, naming the value. Re-admit one only together with a\n * runtime-contract arm and a provider module that declares it.\n */\nexport enum ExternalProvider_ExchangeProtocol_Kind {\n  // WEB\n  REST_API = \"rest_api\",\n  WEBHOOK_ORIGINATOR = \"webhook_originator\",\n  // SOAP ?\n  \n  // AI\n  LLM_PROVIDER = \"llm_provider\",\n  /**\n   * Zed's Agent Client Protocol — a JSON-RPC session between Wildo (the client)\n   * and a CODING AGENT subprocess that reads and writes a workspace, runs\n   * commands, and calls back for permission.\n   *\n   * Its own protocol kind rather than a mode of `CLI_RUNTIME`, for the reason\n   * `EMBEDDINGS_PROVIDER` records above and one more that is specific to it: a\n   * coding agent is not a one-shot text call wearing a subprocess. Every\n   * capability the previous CLI transport lacked — token and cost accounting, a\n   * permission channel, cancellation, resumption, live progress — was missing\n   * because the one-shot shape has nowhere to put it, not because nobody had\n   * implemented it yet.\n   *\n   * NOT to be confused with the IBM/BeeAI \"Agent Communication Protocol\", which\n   * shares the acronym and is agent-to-agent — that space is `A2A_CONNECTOR`.\n   */\n  AGENT_CLIENT_PROTOCOL = \"agent_client_protocol\",\n  // AI — multimodal generation (artifact-modality axis)\n  /** Text-to-image generation (wired: gpt-image). Serves the IMAGE modality. */\n  IMAGE_PROVIDER = \"image_provider\",\n  /**\n   * Text → vector embeddings (wired: OpenAI `text-embedding-3-*`). Serves the RAG derived-data\n   * tier (corpus embedding via the `rag:embedding-drain` worker; query-time embedding in\n   * retrieval). Deliberately its OWN protocol kind rather than a sixth `LLMProvider_OperationKey`\n   * (RAG plan DL2): an unmapped LLM operation key fails SILENTLY across six consumer surfaces\n   * (registry semantic-operation map, output normalization, executor dispatch, capability slot,\n   * usage completeness, observability sink), whereas a new protocol kind fails COMPILATION at\n   * every `runtimeContract.kind` switch — the `IMAGE_PROVIDER` precedent. It also gets its own\n   * `EngineCapability.AI_EMBEDDINGS` slot so an application can select its embeddings provider\n   * independently of its chat provider.\n   */\n  EMBEDDINGS_PROVIDER = \"embeddings_provider\",\n  /**\n   * Document bytes → text (wired: Mistral `mistral-ocr-latest`). Serves the file-side text\n   * provider that `FileTextExtractionBackendService` owns, whose largest consumer is\n   * `.ragSource()` corpus ingestion.\n   *\n   * Its own kind for the reason `EMBEDDINGS_PROVIDER` records above, and it fills its own\n   * `EngineCapability.AI_DOCUMENT_EXTRACTION` slot so an application selects its OCR provider\n   * independently of chat and embeddings — three unrelated procurement decisions.\n   *\n   * NOT to be confused with PDF *generation* (templates → bytes), which is the `pdfTemplates`\n   * surface and is semantically the opposite direction. It has no provider slot: the\n   * `EngineCapability.DOCUMENT_GENERATION` this paragraph used to name was withdrawn because no\n   * provider capability token could ever fill it.\n   */\n  DOCUMENT_EXTRACTION_PROVIDER = \"document_extraction_provider\",\n  /** Reserved — audio generation (TTS / music). Serves the AUDIO modality. Not yet implemented. */\n  AUDIO_PROVIDER = \"audio_provider\",\n  /** Reserved — video generation. Serves the VIDEO modality. Not yet implemented. */\n  VIDEO_PROVIDER = \"video_provider\",\n  \n  // INFRA\n  EMAIL_PROVIDER = \"email_provider\",\n  /**\n   * RECEIVING email (#1630): the provider hosts a receiving domain, announces each message through a\n   * `WEBHOOK_ORIGINATOR` endpoint whose `capability` is `EMAIL_INBOUND`, and serves the message on\n   * request through `StandardInboundEmail_Interface`. Its own kind rather than a mode of\n   * `EMAIL_PROVIDER` because sending and receiving are separate procurement decisions and share no\n   * operation: a sending contract composes a request, a receiving one parses a notification and\n   * fetches a message.\n   */\n  EMAIL_INBOUND_PROVIDER = \"email_inbound_provider\",\n  \n  // AUTH\n  SSO_OAUTH2 = \"sso_oauth2\",\n  // OPENID_CONNECT ?\n\n  // BILLING\n  BILLING_PROVIDER = \"billing_provider\",\n\n  // SMS (Phase G2)\n  SMS_PROVIDER = \"sms_provider\",\n\n  // FRONTEND\n  FRONTEND_SDK = \"frontend_sdk\",\n}\n\n/**\n * The BACKEND runtime-contract discriminants — the subset of `ExternalProvider_ExchangeProtocol_Kind`\n * a `BackendProviderModule` can execute. Its VALUES are the enum members themselves (one spelling per\n * member since 2026-09-05, #327), so a runtime contract's `kind` IS the exchange kind and no\n * protocol→kind map exists anywhere; `BackendProtocolBinding.protocol` (the authoring KEY) and\n * `runtimeContract.kind` are checked for agreement at composition. A member absent here has no\n * backend arm: `FRONTEND_SDK` is declared by browser-side modules only, `AUDIO_PROVIDER` /\n * `VIDEO_PROVIDER` are reserved.\n *\n * A frozen const rather than a second enum because provider modules are an extension boundary and\n * the union discriminant must stay the enum member type. Import from\n * `@wildo-ai/external-connectors-models`; the private backend package consumes it, never defines it.\n */\nexport const ProviderProtocolRuntimeKind = Object.freeze({\n  LLM: ExternalProvider_ExchangeProtocol_Kind.LLM_PROVIDER,\n  IMAGE: ExternalProvider_ExchangeProtocol_Kind.IMAGE_PROVIDER,\n  EMBEDDINGS: ExternalProvider_ExchangeProtocol_Kind.EMBEDDINGS_PROVIDER,\n  DOCUMENT_EXTRACTION: ExternalProvider_ExchangeProtocol_Kind.DOCUMENT_EXTRACTION_PROVIDER,\n  AGENT_CLIENT_PROTOCOL: ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL,\n  EMAIL: ExternalProvider_ExchangeProtocol_Kind.EMAIL_PROVIDER,\n  EMAIL_INBOUND: ExternalProvider_ExchangeProtocol_Kind.EMAIL_INBOUND_PROVIDER,\n  OAUTH2_SSO: ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2,\n  BILLING: ExternalProvider_ExchangeProtocol_Kind.BILLING_PROVIDER,\n  WEBHOOK_ORIGINATOR: ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR,\n  SMS: ExternalProvider_ExchangeProtocol_Kind.SMS_PROVIDER,\n  REST: ExternalProvider_ExchangeProtocol_Kind.REST_API,\n} as const);\nexport type ProviderProtocolRuntimeKind =\n  (typeof ProviderProtocolRuntimeKind)[keyof typeof ProviderProtocolRuntimeKind];\n\nexport enum APPLICATION_ENVIRONMENT {\n  DEVELOPMENT = \"development\",\n  STAGING = \"staging\",\n  PRODUCTION = \"production\",\n}\n\n\nexport enum API_HttpMethod {\n  GET = \"GET\",\n  POST = \"POST\",\n  PUT = \"PUT\",\n  PATCH = \"PATCH\",\n  DELETE = \"DELETE\",\n  HEAD = \"HEAD\",\n  OPTIONS = \"OPTIONS\",\n}\n\n/**\n * Shared protocol configuration fields — the ONE survivor of the per-protocol profile /\n * configuration / status triple (#965), and the reason it stays is a reader, not a legacy.\n *\n * `authConfig` is read on a resolved provider configuration by the OAuth2 connection resolver\n * (`clientId`, `secretRef`) and by the registry's default-over-custom merge, and `enabled` is what\n * a provider configuration parses at the boundary (`AgentClientProtocol_ConfigurationSchema`,\n * `OAuth2Provider_ConfigurationSchema` extend this; the LLM and webhook configurations intersect\n * with the inferred type). It is optional because execution-oriented protocols can own their own\n * auth/runtime policy contract.\n *\n * What is gone: the profile base (a provider's transport facts now live on its runtime contract,\n * `ProviderProtocolRuntimeContract`, which the registry projects) and the status base (nothing\n * ever recorded a per-protocol status). Both had no reader outside the declarations that extended\n * them.\n */\nexport const ExternalProvider_ExchangeProtocol_Configuration_BaseSchema = z.object({\n  enabled: z.boolean(),\n  authConfig: ExternalProvider_Auth_ConfigurationSchema.optional(),\n  rateLimitConfig: ExternalProvider_RateLimitConfigurationSchema.optional(),\n});\n\nexport type ExternalProvider_ExchangeProtocol_Configuration_Base = z.infer<typeof ExternalProvider_ExchangeProtocol_Configuration_BaseSchema>;\n\nexport enum ExternalProvider_IO_Direction {\n  INBOUND = \"inbound\",\n  OUTBOUND = \"outbound\",\n  BIDIRECTIONAL = \"bidirectional\",\n}\n\nexport enum ExternalProvider_IO_InteractionPattern {\n  REQUEST_RESPONSE = \"request_response\",\n  EVENT_BASED = \"event_based\",\n  STREAMING = \"stream\",\n}\n\n"]}

package/dist/esm/core/operation-classification.external-connectors-models.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operation-classification.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../src/core/operation-classification.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,oBAAY,gCAAgC;IAC1C,IAAI,SAAS;IACb,KAAK,UAAU;CAChB"}
+{"version":3,"file":"operation-classification.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../../src/core/operation-classification.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,oBAAY,gCAAgC;IAC1C,IAAI,SAAS;IACb,KAAK,UAAU;CAChB"}

package/dist/esm/core/operation-classification.external-connectors-models.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"operation-classification.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../src/core/operation-classification.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,gCAGX;AAHD,WAAY,gCAAgC;IAC1C,iDAAa,CAAA;IACb,mDAAe,CAAA;AACjB,CAAC,EAHW,gCAAgC,KAAhC,gCAAgC,QAG3C","sourcesContent":["/**\n * Whether an external operation READS from or WRITES to the third-party system.\n *\n * Kept as its own tiny vocabulary because every operation catalogue needs it regardless of where\n * the catalogue came from: a caller decides retry-safety, an audit decides severity, and a UI\n * decides whether to confirm. Neutral by construction — it names the operation's effect, never a\n * source catalogue's spelling of it.\n */\nexport enum ExternalOperation_Classification {\n  READ = \"READ\",\n  WRITE = \"WRITE\",\n}\n"]}
+{"version":3,"file":"operation-classification.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../../src/core/operation-classification.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,gCAGX;AAHD,WAAY,gCAAgC;IAC1C,iDAAa,CAAA;IACb,mDAAe,CAAA;AACjB,CAAC,EAHW,gCAAgC,KAAhC,gCAAgC,QAG3C","sourcesContent":["/**\n * Whether an external operation READS from or WRITES to the third-party system.\n *\n * Kept as its own tiny vocabulary because every operation catalogue needs it regardless of where\n * the catalogue came from: a caller decides retry-safety, an audit decides severity, and a UI\n * decides whether to confirm. Neutral by construction — it names the operation's effect, never a\n * source catalogue's spelling of it.\n */\nexport enum ExternalOperation_Classification {\n  READ = \"READ\",\n  WRITE = \"WRITE\",\n}\n"]}

package/dist/esm/core/security.external-connectors-models.schemas.d.ts

@@ -76,7 +76,6 @@ export declare const ExternalProvider_AuthProfile_BaseSchema: z.ZodObject<{
     location: z.ZodDefault<z.ZodEnum<typeof ExternalProvider_Auth_ApiKey_Location>>;
     locationField: z.ZodDefault<z.ZodString>;
 }, z.core.$strip>;
-export type ExternalProvider_Auth_Configuration = z.infer<typeof ExternalProvider_Auth_ConfigurationSchema>;
 export type ExternalProvider_RateLimitConfiguration = z.infer<typeof ExternalProvider_RateLimitConfigurationSchema>;
 export type ExternalProvider_AuthProfile_Base = z.infer<typeof ExternalProvider_AuthProfile_BaseSchema>;
 /**
@@ -146,10 +145,10 @@ export declare const ExternalProvider_AuthProfile_Schema: z.ZodDiscriminatedUnio
     extraAuthParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     extraTokenParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     tokenFormat: z.ZodDefault<z.ZodEnum<{
-        custom: "custom";
-        bearer: "bearer";
         token: "token";
+        bearer: "bearer";
         oauth: "oauth";
+        custom: "custom";
     }>>;
     customTokenPrefix: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
@@ -266,8 +265,23 @@ export declare enum ExternalProvider_SecretScope {
  * | APPLICATION × SERVICE | a platform API key |
  * | APPLICATION × USER | the application's service identity impersonating a user |
  * | ORGANIZATION × SERVICE | the tenant's own bot or workspace token |
- * | ORGANIZATION × USER | the tenant's registration, acting for one of its members |
- * | USER × SERVICE | a personal key the user authored |
+ * | ORGANIZATION × USER | ONE member's own account, linked for the whole organization |
+ * | USER × SERVICE | a person's own account, for that person |
+ *
+ * ## `ORGANIZATION × USER`, decided 2026-09-12 (Paul, recorded on wildo-ai/wildo-ai#18)
+ *
+ * A member connects THEIR OWN vendor account on the organization's behalf — the common pattern that
+ * lets a tenant integrate without a service account. There is ONE grant per organization, and every
+ * member's call spends it transparently. The member who links it carries the responsibility for
+ * that: they are trusting their colleagues' activity with their account, they ACKNOWLEDGE it when
+ * they link, and that acknowledgement is the whole control — no per-call gate. What the audit trail
+ * must then say, on every call, is WHOSE account was spent: the member who linked it.
+ *
+ * So the person behind this shape is fixed by the GRANT, not by the call, which is why a call never
+ * names `actingForUserId` for it. The rejected readings are worth keeping: per-member grants keyed
+ * `(organization, member)` is a real model and not what this shape means here; and requiring the
+ * call to name the linking member would stop every other member using a grant that exists to be
+ * shared. A person's connection for themselves is the USER-owned row.
  *
  * OAuth 2.0 carries the same split in its grant types: the client is the REGISTRATION, and the grant
  * decides on whose behalf a token is minted.
@@ -302,9 +316,9 @@ export declare const ExternalProvider_ConnectionShapeSchema: z.ZodObject<{
  *
  * The capability and the call are the same two axes and different objects, which is why this is a
  * separate schema rather than the target with its identifiers made optional. A provider admitting
- * `ORGANIZATION × USER` says nothing about which organization; a call naming an organization and no
- * user is incomplete. Making one schema serve both would have to relax exactly the refinements that
- * make the call safe.
+ * `ORGANIZATION × USER` says nothing about which organization; a call naming no organization is
+ * incomplete. Making one schema serve both would have to relax exactly the refinements that make the
+ * call safe.
  */
 export type ExternalProvider_ConnectionShape = z.infer<typeof ExternalProvider_ConnectionShapeSchema>;
 export declare const ExternalProvider_ConnectionTargetSchema: z.ZodObject<{
@@ -313,5 +327,23 @@ export declare const ExternalProvider_ConnectionTargetSchema: z.ZodObject<{
     ownerId: z.ZodOptional<z.ZodString>;
     actingForUserId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
+/**
+ * Whether a connection target must NAME the user it acts for — true only for APPLICATION × USER.
+ *
+ * One predicate rather than a condition restated at each builder: the target schema, the HTTP-API
+ * binding's target builder and the connect panel all ask this question, and three spellings of it
+ * are how a target comes to carry a person the refinement then refuses.
+ */
+export declare function connectionTargetNamesActingUser(shape: ExternalProvider_ConnectionShape): boolean;
+/**
+ * Whether linking this connection lends ONE member's own account to their whole organization —
+ * true only for ORGANIZATION × USER.
+ *
+ * The member who links such a connection is trusting every colleague's activity with their account,
+ * so the connect surface asks them to ACKNOWLEDGE it and the connect leg refuses a link that did not
+ * (decision on wildo-ai/wildo-ai#18). One predicate for the panel that shows the acknowledgement and
+ * the controller that requires it, so the two cannot come to disagree about which links owe one.
+ */
+export declare function connectionLendsMemberAccountToOrganization(shape: ExternalProvider_ConnectionShape): boolean;
 export type ExternalProvider_ConnectionTarget = z.infer<typeof ExternalProvider_ConnectionTargetSchema>;
 //# sourceMappingURL=security.external-connectors-models.schemas.d.ts.map

package/dist/esm/core/security.external-connectors-models.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../src/core/security.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,+BAA+B,EAC/B,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AAMxB;;;GAGG;AACH,oBAAY,0BAA0B;IACpC,iCAAiC;IACjC,IAAI,SAAS;IAEb,0CAA0C;IAC1C,OAAO,YAAY;IAEnB,gDAAgD;IAChD,MAAM,WAAW;IAEjB,gCAAgC;IAChC,KAAK,UAAU;IAEf,kEAAkE;IAClE,MAAM,WAAW;IAEjB,0CAA0C;IAC1C,cAAc,mBAAmB;IAEjC,+CAA+C;IAC/C,cAAc,mBAAmB;IAEjC,uCAAuC;IACvC,UAAU,eAAe;IAEzB,qDAAqD;IACrD,eAAe,oBAAoB;CACpC;AAMD,oBAAY,qCAAqC;IAC/C,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,MAAM,WAAW;CAClB;AAED,oBAAY,8CAA8C;IACxD,MAAM,WAAW;IACjB,MAAM,WAAW;CAClB;AAED,oBAAY,mCAAmC;IAC7C,GAAG,QAAQ;IACX,OAAO,YAAY;IACnB,mBAAmB,wBAAwB;CAC5C;AAMD;;;GAGG;AACH,eAAO,MAAM,yCAAyC;;;;;iBAYpD,CAAC;AAMH,eAAO,MAAM,6CAA6C;;;;;;;iBAkBxD,CAAC;AAMH,eAAO,MAAM,uCAAuC;;;;;;iBAelD,CAAC;AAMH,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;AAC5G,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6CAA6C,CAAC,CAAC;AACpH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAMxG;;;GAGG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAmI9C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAM/F;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,oBAAY,sCAAsC;IAChD,qGAAqG;IACrG,WAAW,gBAAgB;IAC3B,mGAAmG;IACnG,YAAY,iBAAiB;IAC7B,uFAAuF;IACvF,IAAI,SAAS;CACd;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,oBAAY,4BAA4B;IACtC;;;OAGG;IACH,YAAY,iBAAiB;IAC7B;;;;OAIG;IACH,UAAU,eAAe;CAC1B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,oBAAY,0CAA0C;IACpD,2EAA2E;IAC3E,OAAO,YAAY;IACnB,wFAAwF;IACxF,IAAI,SAAS;CACd;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sCAAsC;;;iBAIjD,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,eAAO,MAAM,uCAAuC;;;;;iBA2ClD,CAAC;AAEH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC"}
+{"version":3,"file":"security.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../../src/core/security.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,+BAA+B,EAC/B,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AAMxB;;;GAGG;AACH,oBAAY,0BAA0B;IACpC,iCAAiC;IACjC,IAAI,SAAS;IAEb,0CAA0C;IAC1C,OAAO,YAAY;IAEnB,gDAAgD;IAChD,MAAM,WAAW;IAEjB,gCAAgC;IAChC,KAAK,UAAU;IAEf,kEAAkE;IAClE,MAAM,WAAW;IAEjB,0CAA0C;IAC1C,cAAc,mBAAmB;IAEjC,+CAA+C;IAC/C,cAAc,mBAAmB;IAEjC,uCAAuC;IACvC,UAAU,eAAe;IAEzB,qDAAqD;IACrD,eAAe,oBAAoB;CACpC;AAMD,oBAAY,qCAAqC;IAC/C,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,MAAM,WAAW;CAClB;AAED,oBAAY,8CAA8C;IACxD,MAAM,WAAW;IACjB,MAAM,WAAW;CAClB;AAED,oBAAY,mCAAmC;IAC7C,GAAG,QAAQ;IACX,OAAO,YAAY;IACnB,mBAAmB,wBAAwB;CAC5C;AAMD;;;GAGG;AACH,eAAO,MAAM,yCAAyC;;;;;iBAYpD,CAAC;AAMH,eAAO,MAAM,6CAA6C;;;;;;;iBAkBxD,CAAC;AAMH,eAAO,MAAM,uCAAuC;;;;;;iBAelD,CAAC;AAMH,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6CAA6C,CAAC,CAAC;AACpH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAMxG;;;GAGG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAmI9C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAM/F;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,oBAAY,sCAAsC;IAChD,qGAAqG;IACrG,WAAW,gBAAgB;IAC3B,mGAAmG;IACnG,YAAY,iBAAiB;IAC7B,uFAAuF;IACvF,IAAI,SAAS;CACd;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,oBAAY,4BAA4B;IACtC;;;OAGG;IACH,YAAY,iBAAiB;IAC7B;;;;OAIG;IACH,UAAU,eAAe;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,oBAAY,0CAA0C;IACpD,2EAA2E;IAC3E,OAAO,YAAY;IACnB,wFAAwF;IACxF,IAAI,SAAS;CACd;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sCAAsC;;;iBAIjD,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,eAAO,MAAM,uCAAuC;;;;;iBAkDlD,CAAC;AAEH;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,gCAAgC,GAAG,OAAO,CAGhG;AAED;;;;;;;;GAQG;AACH,wBAAgB,0CAA0C,CAAC,KAAK,EAAE,gCAAgC,GAAG,OAAO,CAG3G;AAED,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC"}

package/dist/esm/core/security.external-connectors-models.schemas.js

@@ -317,8 +317,23 @@ export var ExternalProvider_SecretScope;
  * | APPLICATION × SERVICE | a platform API key |
  * | APPLICATION × USER | the application's service identity impersonating a user |
  * | ORGANIZATION × SERVICE | the tenant's own bot or workspace token |
- * | ORGANIZATION × USER | the tenant's registration, acting for one of its members |
- * | USER × SERVICE | a personal key the user authored |
+ * | ORGANIZATION × USER | ONE member's own account, linked for the whole organization |
+ * | USER × SERVICE | a person's own account, for that person |
+ *
+ * ## `ORGANIZATION × USER`, decided 2026-09-12 (Paul, recorded on wildo-ai/wildo-ai#18)
+ *
+ * A member connects THEIR OWN vendor account on the organization's behalf — the common pattern that
+ * lets a tenant integrate without a service account. There is ONE grant per organization, and every
+ * member's call spends it transparently. The member who links it carries the responsibility for
+ * that: they are trusting their colleagues' activity with their account, they ACKNOWLEDGE it when
+ * they link, and that acknowledgement is the whole control — no per-call gate. What the audit trail
+ * must then say, on every call, is WHOSE account was spent: the member who linked it.
+ *
+ * So the person behind this shape is fixed by the GRANT, not by the call, which is why a call never
+ * names `actingForUserId` for it. The rejected readings are worth keeping: per-member grants keyed
+ * `(organization, member)` is a real model and not what this shape means here; and requiring the
+ * call to name the linking member would stop every other member using a grant that exists to be
+ * shared. A person's connection for themselves is the USER-owned row.
  *
  * OAuth 2.0 carries the same split in its grant types: the client is the REGISTRATION, and the grant
  * decides on whose behalf a token is minted.
@@ -357,9 +372,13 @@ export const ExternalProvider_ConnectionTargetSchema = ExternalProvider_Connecti
      */
     ownerId: z.string().optional(),
     /**
-     * The user the act is performed for, when `delegation` is USER. Independent of `ownerId`: a
-     * tenant-owned connection acting for one of its members carries an organization in `ownerId` and a
-     * person here.
+     * The user an APPLICATION-owned, USER-delegated call impersonates — the ONLY shape where the call
+     * itself must say who, because the application's identity could impersonate anyone.
+     *
+     * Refused everywhere else. An ORGANIZATION-owned USER-delegated connection spends the account of
+     * the member who LINKED it, whoever triggers the call (see the decision above), so a person named
+     * here would describe an identity the runtime will not act as. A USER-owned connection already
+     * names its person in `ownerId`.
      */
     actingForUserId: z.string().optional(),
 }).superRefine((target, ctx) => {
@@ -378,20 +397,48 @@ export const ExternalProvider_ConnectionTargetSchema = ExternalProvider_Connecti
             message: 'An application-owned connection has exactly one instance, so an ownerId here names something that does not exist.',
         });
     }
-    const delegated = target.delegation === ExternalProvider_Connection_DelegationMode.USER;
-    if (delegated && (target.actingForUserId === undefined || target.actingForUserId === '')) {
-        ctx.addIssue({
-            code: 'custom',
-            path: ['actingForUserId'],
-            message: 'A delegated call acts FOR someone, and the user it acts for is what makes it permissible — it cannot be left to be inferred.',
-        });
+    if (connectionTargetNamesActingUser(target)) {
+        if (target.actingForUserId === undefined || target.actingForUserId === '') {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['actingForUserId'],
+                message: 'An application-owned delegated call impersonates someone, and who is what makes it permissible — it cannot be left to be inferred.',
+            });
+        }
     }
-    if (!delegated && target.actingForUserId !== undefined) {
+    else if (target.actingForUserId !== undefined) {
         ctx.addIssue({
             code: 'custom',
             path: ['actingForUserId'],
-            message: 'A SERVICE call acts for nobody. Naming a user here reads as delegation the runtime will not perform, which is worse than an error: the call succeeds as the wrong identity.',
+            message: target.delegation === ExternalProvider_Connection_DelegationMode.USER
+                ? `A ${target.ownerScope}-owned connection's person is fixed by the account itself — the member who linked it, or the owner. `
+                    + 'Naming a user here describes an identity the runtime will not act as.'
+                : 'A SERVICE call acts for nobody. Naming a user here reads as delegation the runtime will not perform, which is worse than an error: the call succeeds as the wrong identity.',
         });
     }
 });
+/**
+ * Whether a connection target must NAME the user it acts for — true only for APPLICATION × USER.
+ *
+ * One predicate rather than a condition restated at each builder: the target schema, the HTTP-API
+ * binding's target builder and the connect panel all ask this question, and three spellings of it
+ * are how a target comes to carry a person the refinement then refuses.
+ */
+export function connectionTargetNamesActingUser(shape) {
+    return shape.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION
+        && shape.delegation === ExternalProvider_Connection_DelegationMode.USER;
+}
+/**
+ * Whether linking this connection lends ONE member's own account to their whole organization —
+ * true only for ORGANIZATION × USER.
+ *
+ * The member who links such a connection is trusting every colleague's activity with their account,
+ * so the connect surface asks them to ACKNOWLEDGE it and the connect leg refuses a link that did not
+ * (decision on wildo-ai/wildo-ai#18). One predicate for the panel that shows the acknowledgement and
+ * the controller that requires it, so the two cannot come to disagree about which links owe one.
+ */
+export function connectionLendsMemberAccountToOrganization(shape) {
+    return shape.ownerScope === ExternalProvider_Connection_OwnerScope.ORGANIZATION
+        && shape.delegation === ExternalProvider_Connection_DelegationMode.USER;
+}
 //# sourceMappingURL=security.external-connectors-models.schemas.js.map