@wildo-ai/external-connectors-models 1.1.7 → 1.1.9

package/dist/esm/companion-exports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"companion-exports.d.ts","sourceRoot":"","sources":["../../src/companion-exports.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,cAAc,SAAS,CAAC"}
+{"version":3,"file":"companion-exports.d.ts","sourceRoot":"","sources":["../../../src/companion-exports.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,cAAc,SAAS,CAAC"}

package/dist/esm/companion-exports.js.map

@@ -1 +1 @@
-{"version":3,"file":"companion-exports.js","sourceRoot":"","sources":["../../src/companion-exports.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,cAAc,SAAS,CAAC","sourcesContent":["/**\n * Dedicated companion entrypoint for external-connector model contracts.\n *\n * The explicit subpath keeps companion/tooling imports consistent across the\n * engine package family.\n */\nexport * from './index';\n"]}
+{"version":3,"file":"companion-exports.js","sourceRoot":"","sources":["../../../src/companion-exports.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,cAAc,SAAS,CAAC","sourcesContent":["/**\n * Dedicated companion entrypoint for external-connector model contracts.\n *\n * The explicit subpath keeps companion/tooling imports consistent across the\n * engine package family.\n */\nexport * from './index';\n"]}

package/dist/esm/core/commons.external-connectors-models.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commons.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../src/core/commons.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,sCAAsC;IAEhD,QAAQ,aAAa;IACrB,kBAAkB,uBAAuB;IAIzC,YAAY,iBAAiB;IAC7B;;;;;;;;;;;;;;;OAeG;IACH,qBAAqB,0BAA0B;IAE/C,8EAA8E;IAC9E,cAAc,mBAAmB;IACjC;;;;;;;;;;OAUG;IACH,mBAAmB,wBAAwB;IAC3C;;;;;;;;;;;;;OAaG;IACH,4BAA4B,iCAAiC;IAC7D,iGAAiG;IACjG,cAAc,mBAAmB;IACjC,mFAAmF;IACnF,cAAc,mBAAmB;IAGjC,cAAc,mBAAmB;IACjC;;;;;;;OAOG;IACH,sBAAsB,2BAA2B;IAGjD,UAAU,eAAe;IAIzB,gBAAgB,qBAAqB;IAGrC,YAAY,iBAAiB;IAG7B,YAAY,iBAAiB;CAC9B;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;EAa7B,CAAC;AACZ,MAAM,MAAM,2BAA2B,GACrC,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,OAAO,2BAA2B,CAAC,CAAC;AAEjF,oBAAY,uBAAuB;IACjC,WAAW,gBAAgB;IAC3B,OAAO,YAAY;IACnB,UAAU,eAAe;CAC1B;AAGD,oBAAY,cAAc;IACxB,GAAG,QAAQ;IACX,IAAI,SAAS;IACb,GAAG,QAAQ;IACX,KAAK,UAAU;IACf,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,0DAA0D;;;;;;;;;;;;;;;;iBAIrE,CAAC;AAEH,MAAM,MAAM,oDAAoD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0DAA0D,CAAC,CAAC;AAE9I,oBAAY,6BAA6B;IACvC,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,aAAa,kBAAkB;CAChC;AAED,oBAAY,sCAAsC;IAChD,gBAAgB,qBAAqB;IACrC,WAAW,gBAAgB;IAC3B,SAAS,WAAW;CACrB"}
+{"version":3,"file":"commons.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../../src/core/commons.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,sCAAsC;IAEhD,QAAQ,aAAa;IACrB,kBAAkB,uBAAuB;IAIzC,YAAY,iBAAiB;IAC7B;;;;;;;;;;;;;;;OAeG;IACH,qBAAqB,0BAA0B;IAE/C,8EAA8E;IAC9E,cAAc,mBAAmB;IACjC;;;;;;;;;;OAUG;IACH,mBAAmB,wBAAwB;IAC3C;;;;;;;;;;;;;OAaG;IACH,4BAA4B,iCAAiC;IAC7D,iGAAiG;IACjG,cAAc,mBAAmB;IACjC,mFAAmF;IACnF,cAAc,mBAAmB;IAGjC,cAAc,mBAAmB;IACjC;;;;;;;OAOG;IACH,sBAAsB,2BAA2B;IAGjD,UAAU,eAAe;IAIzB,gBAAgB,qBAAqB;IAGrC,YAAY,iBAAiB;IAG7B,YAAY,iBAAiB;CAC9B;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;EAa7B,CAAC;AACZ,MAAM,MAAM,2BAA2B,GACrC,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,OAAO,2BAA2B,CAAC,CAAC;AAEjF,oBAAY,uBAAuB;IACjC,WAAW,gBAAgB;IAC3B,OAAO,YAAY;IACnB,UAAU,eAAe;CAC1B;AAGD,oBAAY,cAAc;IACxB,GAAG,QAAQ;IACX,IAAI,SAAS;IACb,GAAG,QAAQ;IACX,KAAK,UAAU;IACf,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,0DAA0D;;;;;;;;;;;;;;;;iBAIrE,CAAC;AAEH,MAAM,MAAM,oDAAoD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0DAA0D,CAAC,CAAC;AAE9I,oBAAY,6BAA6B;IACvC,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,aAAa,kBAAkB;CAChC;AAED,oBAAY,sCAAsC;IAChD,gBAAgB,qBAAqB;IACrC,WAAW,gBAAgB;IAC3B,SAAS,WAAW;CACrB"}

package/dist/esm/core/commons.external-connectors-models.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"commons.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../src/core/commons.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yCAAyC,EAAE,6CAA6C,EAAE,MAAM,+CAA+C,CAAC;AAGzJ;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,sCAoFX;AApFD,WAAY,sCAAsC;IAChD,MAAM;IACN,+DAAqB,CAAA;IACrB,mFAAyC,CAAA;IACzC,SAAS;IAET,KAAK;IACL,uEAA6B,CAAA;IAC7B;;;;;;;;;;;;;;;OAeG;IACH,yFAA+C,CAAA;IAC/C,sDAAsD;IACtD,8EAA8E;IAC9E,2EAAiC,CAAA;IACjC;;;;;;;;;;OAUG;IACH,qFAA2C,CAAA;IAC3C;;;;;;;;;;;;;OAaG;IACH,uGAA6D,CAAA;IAC7D,iGAAiG;IACjG,2EAAiC,CAAA;IACjC,mFAAmF;IACnF,2EAAiC,CAAA;IAEjC,QAAQ;IACR,2EAAiC,CAAA;IACjC;;;;;;;OAOG;IACH,2FAAiD,CAAA;IAEjD,OAAO;IACP,mEAAyB,CAAA;IACzB,mBAAmB;IAEnB,UAAU;IACV,+EAAqC,CAAA;IAErC,iBAAiB;IACjB,uEAA6B,CAAA;IAE7B,WAAW;IACX,uEAA6B,CAAA;AAC/B,CAAC,EApFW,sCAAsC,KAAtC,sCAAsC,QAoFjD;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC,MAAM,CAAC;IACvD,GAAG,EAAE,sCAAsC,CAAC,YAAY;IACxD,KAAK,EAAE,sCAAsC,CAAC,cAAc;IAC5D,UAAU,EAAE,sCAAsC,CAAC,mBAAmB;IACtE,mBAAmB,EAAE,sCAAsC,CAAC,4BAA4B;IACxF,qBAAqB,EAAE,sCAAsC,CAAC,qBAAqB;IACnF,KAAK,EAAE,sCAAsC,CAAC,cAAc;IAC5D,aAAa,EAAE,sCAAsC,CAAC,sBAAsB;IAC5E,UAAU,EAAE,sCAAsC,CAAC,UAAU;IAC7D,OAAO,EAAE,sCAAsC,CAAC,gBAAgB;IAChE,kBAAkB,EAAE,sCAAsC,CAAC,kBAAkB;IAC7E,GAAG,EAAE,sCAAsC,CAAC,YAAY;IACxD,IAAI,EAAE,sCAAsC,CAAC,QAAQ;CAC7C,CAAC,CAAC;AAIZ,MAAM,CAAN,IAAY,uBAIX;AAJD,WAAY,uBAAuB;IACjC,sDAA2B,CAAA;IAC3B,8CAAmB,CAAA;IACnB,oDAAyB,CAAA;AAC3B,CAAC,EAJW,uBAAuB,KAAvB,uBAAuB,QAIlC;AAGD,MAAM,CAAN,IAAY,cAQX;AARD,WAAY,cAAc;IACxB,6BAAW,CAAA;IACX,+BAAa,CAAA;IACb,6BAAW,CAAA;IACX,iCAAe,CAAA;IACf,mCAAiB,CAAA;IACjB,+BAAa,CAAA;IACb,qCAAmB,CAAA;AACrB,CAAC,EARW,cAAc,KAAd,cAAc,QAQzB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,0DAA0D,GAAG,CAAC,CAAC,MAAM,CAAC;IACjF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,UAAU,EAAE,yCAAyC,CAAC,QAAQ,EAAE;IAChE,eAAe,EAAE,6CAA6C,CAAC,QAAQ,EAAE;CAC1E,CAAC,CAAC;AAIH,MAAM,CAAN,IAAY,6BAIX;AAJD,WAAY,6BAA6B;IACvC,oDAAmB,CAAA;IACnB,sDAAqB,CAAA;IACrB,gEAA+B,CAAA;AACjC,CAAC,EAJW,6BAA6B,KAA7B,6BAA6B,QAIxC;AAED,MAAM,CAAN,IAAY,sCAIX;AAJD,WAAY,sCAAsC;IAChD,+EAAqC,CAAA;IACrC,qEAA2B,CAAA;IAC3B,8DAAoB,CAAA;AACtB,CAAC,EAJW,sCAAsC,KAAtC,sCAAsC,QAIjD","sourcesContent":["import { z } from \"zod\";\nimport { ExternalProvider_Auth_ConfigurationSchema, ExternalProvider_RateLimitConfigurationSchema } from \"./security.external-connectors-models.schemas\";\n\n\n/**\n * The ONE protocol vocabulary a provider can speak. Every other list is derived from or pinned\n * to this enum: the backend runtime-contract discriminants (`ProviderProtocolRuntimeKind`, a\n * subset of these members) and the application-authoring keys (`BUILTIN_PROVIDER_PROTOCOL` in\n * `@wildo-ai/saas-models`, its key set pinned by a drift test because that package must not\n * import this one into browser bundles).\n *\n * RETIRED 2026-09-05 (#327): `MCP_CONNECTOR`, `A2A_CONNECTOR`, `GIT_PROVIDER`, `GRPC`,\n * `SSO_SAML`. Each had an authored profile/configuration module in this package and NOTHING\n * that read it — no runtime-contract arm, no provider module declaring it, no consumer of any\n * export outside the module itself (measured with a positive control). Wildo's own MCP server,\n * A2A plane and SAML SSO are engine-implemented surfaces, not provider-declared protocols, and\n * none of them referenced these members. A retired member is refused at CONFIG time by\n * `ProviderProtocolSelectorSchema`, naming the value. Re-admit one only together with a\n * runtime-contract arm and a provider module that declares it.\n */\nexport enum ExternalProvider_ExchangeProtocol_Kind {\n  // WEB\n  REST_API = \"rest_api\",\n  WEBHOOK_ORIGINATOR = \"webhook_originator\",\n  // SOAP ?\n  \n  // AI\n  LLM_PROVIDER = \"llm_provider\",\n  /**\n   * Zed's Agent Client Protocol — a JSON-RPC session between Wildo (the client)\n   * and a CODING AGENT subprocess that reads and writes a workspace, runs\n   * commands, and calls back for permission.\n   *\n   * Its own protocol kind rather than a mode of `CLI_RUNTIME`, for the reason\n   * `EMBEDDINGS_PROVIDER` records above and one more that is specific to it: a\n   * coding agent is not a one-shot text call wearing a subprocess. Every\n   * capability the previous CLI transport lacked — token and cost accounting, a\n   * permission channel, cancellation, resumption, live progress — was missing\n   * because the one-shot shape has nowhere to put it, not because nobody had\n   * implemented it yet.\n   *\n   * NOT to be confused with the IBM/BeeAI \"Agent Communication Protocol\", which\n   * shares the acronym and is agent-to-agent — that space is `A2A_CONNECTOR`.\n   */\n  AGENT_CLIENT_PROTOCOL = \"agent_client_protocol\",\n  // AI — multimodal generation (artifact-modality axis)\n  /** Text-to-image generation (wired: gpt-image). Serves the IMAGE modality. */\n  IMAGE_PROVIDER = \"image_provider\",\n  /**\n   * Text → vector embeddings (wired: OpenAI `text-embedding-3-*`). Serves the RAG derived-data\n   * tier (corpus embedding via the `rag:embedding-drain` worker; query-time embedding in\n   * retrieval). Deliberately its OWN protocol kind rather than a sixth `LLMProvider_OperationKey`\n   * (RAG plan DL2): an unmapped LLM operation key fails SILENTLY across six consumer surfaces\n   * (registry semantic-operation map, output normalization, executor dispatch, capability slot,\n   * usage completeness, observability sink), whereas a new protocol kind fails COMPILATION at\n   * every `runtimeContract.kind` switch — the `IMAGE_PROVIDER` precedent. It also gets its own\n   * `EngineCapability.AI_EMBEDDINGS` slot so an application can select its embeddings provider\n   * independently of its chat provider.\n   */\n  EMBEDDINGS_PROVIDER = \"embeddings_provider\",\n  /**\n   * Document bytes → text (wired: Mistral `mistral-ocr-latest`). Serves the file-side text\n   * provider that `FileTextExtractionBackendService` owns, whose largest consumer is\n   * `.ragSource()` corpus ingestion.\n   *\n   * Its own kind for the reason `EMBEDDINGS_PROVIDER` records above, and it fills its own\n   * `EngineCapability.AI_DOCUMENT_EXTRACTION` slot so an application selects its OCR provider\n   * independently of chat and embeddings — three unrelated procurement decisions.\n   *\n   * NOT to be confused with PDF *generation* (templates → bytes), which is the `pdfTemplates`\n   * surface and is semantically the opposite direction. It has no provider slot: the\n   * `EngineCapability.DOCUMENT_GENERATION` this paragraph used to name was withdrawn because no\n   * provider capability token could ever fill it.\n   */\n  DOCUMENT_EXTRACTION_PROVIDER = \"document_extraction_provider\",\n  /** Reserved — audio generation (TTS / music). Serves the AUDIO modality. Not yet implemented. */\n  AUDIO_PROVIDER = \"audio_provider\",\n  /** Reserved — video generation. Serves the VIDEO modality. Not yet implemented. */\n  VIDEO_PROVIDER = \"video_provider\",\n  \n  // INFRA\n  EMAIL_PROVIDER = \"email_provider\",\n  /**\n   * RECEIVING email (#1630): the provider hosts a receiving domain, announces each message through a\n   * `WEBHOOK_ORIGINATOR` endpoint whose `capability` is `EMAIL_INBOUND`, and serves the message on\n   * request through `StandardInboundEmail_Interface`. Its own kind rather than a mode of\n   * `EMAIL_PROVIDER` because sending and receiving are separate procurement decisions and share no\n   * operation: a sending contract composes a request, a receiving one parses a notification and\n   * fetches a message.\n   */\n  EMAIL_INBOUND_PROVIDER = \"email_inbound_provider\",\n  \n  // AUTH\n  SSO_OAUTH2 = \"sso_oauth2\",\n  // OPENID_CONNECT ?\n\n  // BILLING\n  BILLING_PROVIDER = \"billing_provider\",\n\n  // SMS (Phase G2)\n  SMS_PROVIDER = \"sms_provider\",\n\n  // FRONTEND\n  FRONTEND_SDK = \"frontend_sdk\",\n}\n\n/**\n * The BACKEND runtime-contract discriminants — the subset of `ExternalProvider_ExchangeProtocol_Kind`\n * a `BackendProviderModule` can execute. Its VALUES are the enum members themselves (one spelling per\n * member since 2026-09-05, #327), so a runtime contract's `kind` IS the exchange kind and no\n * protocol→kind map exists anywhere; `BackendProtocolBinding.protocol` (the authoring KEY) and\n * `runtimeContract.kind` are checked for agreement at composition. A member absent here has no\n * backend arm: `FRONTEND_SDK` is declared by browser-side modules only, `AUDIO_PROVIDER` /\n * `VIDEO_PROVIDER` are reserved.\n *\n * A frozen const rather than a second enum because provider modules are an extension boundary and\n * the union discriminant must stay the enum member type. Import from\n * `@wildo-ai/external-connectors-models`; the private backend package consumes it, never defines it.\n */\nexport const ProviderProtocolRuntimeKind = Object.freeze({\n  LLM: ExternalProvider_ExchangeProtocol_Kind.LLM_PROVIDER,\n  IMAGE: ExternalProvider_ExchangeProtocol_Kind.IMAGE_PROVIDER,\n  EMBEDDINGS: ExternalProvider_ExchangeProtocol_Kind.EMBEDDINGS_PROVIDER,\n  DOCUMENT_EXTRACTION: ExternalProvider_ExchangeProtocol_Kind.DOCUMENT_EXTRACTION_PROVIDER,\n  AGENT_CLIENT_PROTOCOL: ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL,\n  EMAIL: ExternalProvider_ExchangeProtocol_Kind.EMAIL_PROVIDER,\n  EMAIL_INBOUND: ExternalProvider_ExchangeProtocol_Kind.EMAIL_INBOUND_PROVIDER,\n  OAUTH2_SSO: ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2,\n  BILLING: ExternalProvider_ExchangeProtocol_Kind.BILLING_PROVIDER,\n  WEBHOOK_ORIGINATOR: ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR,\n  SMS: ExternalProvider_ExchangeProtocol_Kind.SMS_PROVIDER,\n  REST: ExternalProvider_ExchangeProtocol_Kind.REST_API,\n} as const);\nexport type ProviderProtocolRuntimeKind =\n  (typeof ProviderProtocolRuntimeKind)[keyof typeof ProviderProtocolRuntimeKind];\n\nexport enum APPLICATION_ENVIRONMENT {\n  DEVELOPMENT = \"development\",\n  STAGING = \"staging\",\n  PRODUCTION = \"production\",\n}\n\n\nexport enum API_HttpMethod {\n  GET = \"GET\",\n  POST = \"POST\",\n  PUT = \"PUT\",\n  PATCH = \"PATCH\",\n  DELETE = \"DELETE\",\n  HEAD = \"HEAD\",\n  OPTIONS = \"OPTIONS\",\n}\n\n/**\n * Shared protocol configuration fields — the ONE survivor of the per-protocol profile /\n * configuration / status triple (#965), and the reason it stays is a reader, not a legacy.\n *\n * `authConfig` is read on a resolved provider configuration by the OAuth2 connection resolver\n * (`clientId`, `secretRef`) and by the registry's default-over-custom merge, and `enabled` is what\n * a provider configuration parses at the boundary (`AgentClientProtocol_ConfigurationSchema`,\n * `OAuth2Provider_ConfigurationSchema` extend this; the LLM and webhook configurations intersect\n * with the inferred type). It is optional because execution-oriented protocols can own their own\n * auth/runtime policy contract.\n *\n * What is gone: the profile base (a provider's transport facts now live on its runtime contract,\n * `ProviderProtocolRuntimeContract`, which the registry projects) and the status base (nothing\n * ever recorded a per-protocol status). Both had no reader outside the declarations that extended\n * them.\n */\nexport const ExternalProvider_ExchangeProtocol_Configuration_BaseSchema = z.object({\n  enabled: z.boolean(),\n  authConfig: ExternalProvider_Auth_ConfigurationSchema.optional(),\n  rateLimitConfig: ExternalProvider_RateLimitConfigurationSchema.optional(),\n});\n\nexport type ExternalProvider_ExchangeProtocol_Configuration_Base = z.infer<typeof ExternalProvider_ExchangeProtocol_Configuration_BaseSchema>;\n\nexport enum ExternalProvider_IO_Direction {\n  INBOUND = \"inbound\",\n  OUTBOUND = \"outbound\",\n  BIDIRECTIONAL = \"bidirectional\",\n}\n\nexport enum ExternalProvider_IO_InteractionPattern {\n  REQUEST_RESPONSE = \"request_response\",\n  EVENT_BASED = \"event_based\",\n  STREAMING = \"stream\",\n}\n\n"]}
+{"version":3,"file":"commons.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../../src/core/commons.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yCAAyC,EAAE,6CAA6C,EAAE,MAAM,+CAA+C,CAAC;AAGzJ;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,sCAoFX;AApFD,WAAY,sCAAsC;IAChD,MAAM;IACN,+DAAqB,CAAA;IACrB,mFAAyC,CAAA;IACzC,SAAS;IAET,KAAK;IACL,uEAA6B,CAAA;IAC7B;;;;;;;;;;;;;;;OAeG;IACH,yFAA+C,CAAA;IAC/C,sDAAsD;IACtD,8EAA8E;IAC9E,2EAAiC,CAAA;IACjC;;;;;;;;;;OAUG;IACH,qFAA2C,CAAA;IAC3C;;;;;;;;;;;;;OAaG;IACH,uGAA6D,CAAA;IAC7D,iGAAiG;IACjG,2EAAiC,CAAA;IACjC,mFAAmF;IACnF,2EAAiC,CAAA;IAEjC,QAAQ;IACR,2EAAiC,CAAA;IACjC;;;;;;;OAOG;IACH,2FAAiD,CAAA;IAEjD,OAAO;IACP,mEAAyB,CAAA;IACzB,mBAAmB;IAEnB,UAAU;IACV,+EAAqC,CAAA;IAErC,iBAAiB;IACjB,uEAA6B,CAAA;IAE7B,WAAW;IACX,uEAA6B,CAAA;AAC/B,CAAC,EApFW,sCAAsC,KAAtC,sCAAsC,QAoFjD;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC,MAAM,CAAC;IACvD,GAAG,EAAE,sCAAsC,CAAC,YAAY;IACxD,KAAK,EAAE,sCAAsC,CAAC,cAAc;IAC5D,UAAU,EAAE,sCAAsC,CAAC,mBAAmB;IACtE,mBAAmB,EAAE,sCAAsC,CAAC,4BAA4B;IACxF,qBAAqB,EAAE,sCAAsC,CAAC,qBAAqB;IACnF,KAAK,EAAE,sCAAsC,CAAC,cAAc;IAC5D,aAAa,EAAE,sCAAsC,CAAC,sBAAsB;IAC5E,UAAU,EAAE,sCAAsC,CAAC,UAAU;IAC7D,OAAO,EAAE,sCAAsC,CAAC,gBAAgB;IAChE,kBAAkB,EAAE,sCAAsC,CAAC,kBAAkB;IAC7E,GAAG,EAAE,sCAAsC,CAAC,YAAY;IACxD,IAAI,EAAE,sCAAsC,CAAC,QAAQ;CAC7C,CAAC,CAAC;AAIZ,MAAM,CAAN,IAAY,uBAIX;AAJD,WAAY,uBAAuB;IACjC,sDAA2B,CAAA;IAC3B,8CAAmB,CAAA;IACnB,oDAAyB,CAAA;AAC3B,CAAC,EAJW,uBAAuB,KAAvB,uBAAuB,QAIlC;AAGD,MAAM,CAAN,IAAY,cAQX;AARD,WAAY,cAAc;IACxB,6BAAW,CAAA;IACX,+BAAa,CAAA;IACb,6BAAW,CAAA;IACX,iCAAe,CAAA;IACf,mCAAiB,CAAA;IACjB,+BAAa,CAAA;IACb,qCAAmB,CAAA;AACrB,CAAC,EARW,cAAc,KAAd,cAAc,QAQzB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,0DAA0D,GAAG,CAAC,CAAC,MAAM,CAAC;IACjF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,UAAU,EAAE,yCAAyC,CAAC,QAAQ,EAAE;IAChE,eAAe,EAAE,6CAA6C,CAAC,QAAQ,EAAE;CAC1E,CAAC,CAAC;AAIH,MAAM,CAAN,IAAY,6BAIX;AAJD,WAAY,6BAA6B;IACvC,oDAAmB,CAAA;IACnB,sDAAqB,CAAA;IACrB,gEAA+B,CAAA;AACjC,CAAC,EAJW,6BAA6B,KAA7B,6BAA6B,QAIxC;AAED,MAAM,CAAN,IAAY,sCAIX;AAJD,WAAY,sCAAsC;IAChD,+EAAqC,CAAA;IACrC,qEAA2B,CAAA;IAC3B,8DAAoB,CAAA;AACtB,CAAC,EAJW,sCAAsC,KAAtC,sCAAsC,QAIjD","sourcesContent":["import { z } from \"zod\";\nimport { ExternalProvider_Auth_ConfigurationSchema, ExternalProvider_RateLimitConfigurationSchema } from \"./security.external-connectors-models.schemas\";\n\n\n/**\n * The ONE protocol vocabulary a provider can speak. Every other list is derived from or pinned\n * to this enum: the backend runtime-contract discriminants (`ProviderProtocolRuntimeKind`, a\n * subset of these members) and the application-authoring keys (`BUILTIN_PROVIDER_PROTOCOL` in\n * `@wildo-ai/saas-models`, its key set pinned by a drift test because that package must not\n * import this one into browser bundles).\n *\n * RETIRED 2026-09-05 (#327): `MCP_CONNECTOR`, `A2A_CONNECTOR`, `GIT_PROVIDER`, `GRPC`,\n * `SSO_SAML`. Each had an authored profile/configuration module in this package and NOTHING\n * that read it — no runtime-contract arm, no provider module declaring it, no consumer of any\n * export outside the module itself (measured with a positive control). Wildo's own MCP server,\n * A2A plane and SAML SSO are engine-implemented surfaces, not provider-declared protocols, and\n * none of them referenced these members. A retired member is refused at CONFIG time by\n * `ProviderProtocolSelectorSchema`, naming the value. Re-admit one only together with a\n * runtime-contract arm and a provider module that declares it.\n */\nexport enum ExternalProvider_ExchangeProtocol_Kind {\n  // WEB\n  REST_API = \"rest_api\",\n  WEBHOOK_ORIGINATOR = \"webhook_originator\",\n  // SOAP ?\n  \n  // AI\n  LLM_PROVIDER = \"llm_provider\",\n  /**\n   * Zed's Agent Client Protocol — a JSON-RPC session between Wildo (the client)\n   * and a CODING AGENT subprocess that reads and writes a workspace, runs\n   * commands, and calls back for permission.\n   *\n   * Its own protocol kind rather than a mode of `CLI_RUNTIME`, for the reason\n   * `EMBEDDINGS_PROVIDER` records above and one more that is specific to it: a\n   * coding agent is not a one-shot text call wearing a subprocess. Every\n   * capability the previous CLI transport lacked — token and cost accounting, a\n   * permission channel, cancellation, resumption, live progress — was missing\n   * because the one-shot shape has nowhere to put it, not because nobody had\n   * implemented it yet.\n   *\n   * NOT to be confused with the IBM/BeeAI \"Agent Communication Protocol\", which\n   * shares the acronym and is agent-to-agent — that space is `A2A_CONNECTOR`.\n   */\n  AGENT_CLIENT_PROTOCOL = \"agent_client_protocol\",\n  // AI — multimodal generation (artifact-modality axis)\n  /** Text-to-image generation (wired: gpt-image). Serves the IMAGE modality. */\n  IMAGE_PROVIDER = \"image_provider\",\n  /**\n   * Text → vector embeddings (wired: OpenAI `text-embedding-3-*`). Serves the RAG derived-data\n   * tier (corpus embedding via the `rag:embedding-drain` worker; query-time embedding in\n   * retrieval). Deliberately its OWN protocol kind rather than a sixth `LLMProvider_OperationKey`\n   * (RAG plan DL2): an unmapped LLM operation key fails SILENTLY across six consumer surfaces\n   * (registry semantic-operation map, output normalization, executor dispatch, capability slot,\n   * usage completeness, observability sink), whereas a new protocol kind fails COMPILATION at\n   * every `runtimeContract.kind` switch — the `IMAGE_PROVIDER` precedent. It also gets its own\n   * `EngineCapability.AI_EMBEDDINGS` slot so an application can select its embeddings provider\n   * independently of its chat provider.\n   */\n  EMBEDDINGS_PROVIDER = \"embeddings_provider\",\n  /**\n   * Document bytes → text (wired: Mistral `mistral-ocr-latest`). Serves the file-side text\n   * provider that `FileTextExtractionBackendService` owns, whose largest consumer is\n   * `.ragSource()` corpus ingestion.\n   *\n   * Its own kind for the reason `EMBEDDINGS_PROVIDER` records above, and it fills its own\n   * `EngineCapability.AI_DOCUMENT_EXTRACTION` slot so an application selects its OCR provider\n   * independently of chat and embeddings — three unrelated procurement decisions.\n   *\n   * NOT to be confused with PDF *generation* (templates → bytes), which is the `pdfTemplates`\n   * surface and is semantically the opposite direction. It has no provider slot: the\n   * `EngineCapability.DOCUMENT_GENERATION` this paragraph used to name was withdrawn because no\n   * provider capability token could ever fill it.\n   */\n  DOCUMENT_EXTRACTION_PROVIDER = \"document_extraction_provider\",\n  /** Reserved — audio generation (TTS / music). Serves the AUDIO modality. Not yet implemented. */\n  AUDIO_PROVIDER = \"audio_provider\",\n  /** Reserved — video generation. Serves the VIDEO modality. Not yet implemented. */\n  VIDEO_PROVIDER = \"video_provider\",\n  \n  // INFRA\n  EMAIL_PROVIDER = \"email_provider\",\n  /**\n   * RECEIVING email (#1630): the provider hosts a receiving domain, announces each message through a\n   * `WEBHOOK_ORIGINATOR` endpoint whose `capability` is `EMAIL_INBOUND`, and serves the message on\n   * request through `StandardInboundEmail_Interface`. Its own kind rather than a mode of\n   * `EMAIL_PROVIDER` because sending and receiving are separate procurement decisions and share no\n   * operation: a sending contract composes a request, a receiving one parses a notification and\n   * fetches a message.\n   */\n  EMAIL_INBOUND_PROVIDER = \"email_inbound_provider\",\n  \n  // AUTH\n  SSO_OAUTH2 = \"sso_oauth2\",\n  // OPENID_CONNECT ?\n\n  // BILLING\n  BILLING_PROVIDER = \"billing_provider\",\n\n  // SMS (Phase G2)\n  SMS_PROVIDER = \"sms_provider\",\n\n  // FRONTEND\n  FRONTEND_SDK = \"frontend_sdk\",\n}\n\n/**\n * The BACKEND runtime-contract discriminants — the subset of `ExternalProvider_ExchangeProtocol_Kind`\n * a `BackendProviderModule` can execute. Its VALUES are the enum members themselves (one spelling per\n * member since 2026-09-05, #327), so a runtime contract's `kind` IS the exchange kind and no\n * protocol→kind map exists anywhere; `BackendProtocolBinding.protocol` (the authoring KEY) and\n * `runtimeContract.kind` are checked for agreement at composition. A member absent here has no\n * backend arm: `FRONTEND_SDK` is declared by browser-side modules only, `AUDIO_PROVIDER` /\n * `VIDEO_PROVIDER` are reserved.\n *\n * A frozen const rather than a second enum because provider modules are an extension boundary and\n * the union discriminant must stay the enum member type. Import from\n * `@wildo-ai/external-connectors-models`; the private backend package consumes it, never defines it.\n */\nexport const ProviderProtocolRuntimeKind = Object.freeze({\n  LLM: ExternalProvider_ExchangeProtocol_Kind.LLM_PROVIDER,\n  IMAGE: ExternalProvider_ExchangeProtocol_Kind.IMAGE_PROVIDER,\n  EMBEDDINGS: ExternalProvider_ExchangeProtocol_Kind.EMBEDDINGS_PROVIDER,\n  DOCUMENT_EXTRACTION: ExternalProvider_ExchangeProtocol_Kind.DOCUMENT_EXTRACTION_PROVIDER,\n  AGENT_CLIENT_PROTOCOL: ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL,\n  EMAIL: ExternalProvider_ExchangeProtocol_Kind.EMAIL_PROVIDER,\n  EMAIL_INBOUND: ExternalProvider_ExchangeProtocol_Kind.EMAIL_INBOUND_PROVIDER,\n  OAUTH2_SSO: ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2,\n  BILLING: ExternalProvider_ExchangeProtocol_Kind.BILLING_PROVIDER,\n  WEBHOOK_ORIGINATOR: ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR,\n  SMS: ExternalProvider_ExchangeProtocol_Kind.SMS_PROVIDER,\n  REST: ExternalProvider_ExchangeProtocol_Kind.REST_API,\n} as const);\nexport type ProviderProtocolRuntimeKind =\n  (typeof ProviderProtocolRuntimeKind)[keyof typeof ProviderProtocolRuntimeKind];\n\nexport enum APPLICATION_ENVIRONMENT {\n  DEVELOPMENT = \"development\",\n  STAGING = \"staging\",\n  PRODUCTION = \"production\",\n}\n\n\nexport enum API_HttpMethod {\n  GET = \"GET\",\n  POST = \"POST\",\n  PUT = \"PUT\",\n  PATCH = \"PATCH\",\n  DELETE = \"DELETE\",\n  HEAD = \"HEAD\",\n  OPTIONS = \"OPTIONS\",\n}\n\n/**\n * Shared protocol configuration fields — the ONE survivor of the per-protocol profile /\n * configuration / status triple (#965), and the reason it stays is a reader, not a legacy.\n *\n * `authConfig` is read on a resolved provider configuration by the OAuth2 connection resolver\n * (`clientId`, `secretRef`) and by the registry's default-over-custom merge, and `enabled` is what\n * a provider configuration parses at the boundary (`AgentClientProtocol_ConfigurationSchema`,\n * `OAuth2Provider_ConfigurationSchema` extend this; the LLM and webhook configurations intersect\n * with the inferred type). It is optional because execution-oriented protocols can own their own\n * auth/runtime policy contract.\n *\n * What is gone: the profile base (a provider's transport facts now live on its runtime contract,\n * `ProviderProtocolRuntimeContract`, which the registry projects) and the status base (nothing\n * ever recorded a per-protocol status). Both had no reader outside the declarations that extended\n * them.\n */\nexport const ExternalProvider_ExchangeProtocol_Configuration_BaseSchema = z.object({\n  enabled: z.boolean(),\n  authConfig: ExternalProvider_Auth_ConfigurationSchema.optional(),\n  rateLimitConfig: ExternalProvider_RateLimitConfigurationSchema.optional(),\n});\n\nexport type ExternalProvider_ExchangeProtocol_Configuration_Base = z.infer<typeof ExternalProvider_ExchangeProtocol_Configuration_BaseSchema>;\n\nexport enum ExternalProvider_IO_Direction {\n  INBOUND = \"inbound\",\n  OUTBOUND = \"outbound\",\n  BIDIRECTIONAL = \"bidirectional\",\n}\n\nexport enum ExternalProvider_IO_InteractionPattern {\n  REQUEST_RESPONSE = \"request_response\",\n  EVENT_BASED = \"event_based\",\n  STREAMING = \"stream\",\n}\n\n"]}

package/dist/esm/core/oauth2.enums.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth2.enums.d.ts","sourceRoot":"","sources":["../../../src/core/oauth2.enums.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;GAGG;AACH,oBAAY,gBAAgB;IAC1B,iGAAiG;IACjG,kBAAkB,uBAAuB;IAEzC,6FAA6F;IAC7F,kBAAkB,uBAAuB;IAEzC,0EAA0E;IAC1E,aAAa,kBAAkB;IAE/B,oEAAoE;IACpE,QAAQ,aAAa;IAErB,uEAAuE;IACvE,QAAQ,aAAa;IAErB,4EAA4E;IAC5E,WAAW,iDAAiD;IAE5D,6DAA6D;IAC7D,UAAU,gDAAgD;CAC3D;AAED;;GAEG;AACH,oBAAY,mBAAmB;IAC7B,IAAI,SAAS;IACb,KAAK,UAAU;IACf,QAAQ,aAAa;IACrB,aAAa,kBAAkB;IAC/B,UAAU,eAAe;IACzB,cAAc,mBAAmB;IACjC,mBAAmB,wBAAwB;CAC5C;AAED;;GAEG;AACH,oBAAY,kBAAkB;IAC5B,KAAK,UAAU;IACf,IAAI,SAAS;CACd;AAED;;;GAGG;AACH,oBAAY,+BAA+B;IACzC,wDAAwD;IACxD,mBAAmB,wBAAwB;IAE3C,kCAAkC;IAClC,kBAAkB,uBAAuB;IAEzC,qDAAqD;IACrD,iBAAiB,sBAAsB;IAEvC,qDAAqD;IACrD,eAAe,oBAAoB;IAEnC,yCAAyC;IACzC,IAAI,SAAS;CACd;AAED;;;GAGG;AACH,oBAAY,aAAa;IACvB,mCAAmC;IACnC,IAAI,SAAS;IAEb,yCAAyC;IACzC,KAAK,UAAU;IAEf,sDAAsD;IACtD,OAAO,YAAY;IAEnB,mCAAmC;IACnC,cAAc,mBAAmB;CAClC;AAED;;GAEG;AACH,oBAAY,iBAAiB;IAC3B,+CAA+C;IAC/C,MAAM,WAAW;IAEjB,+CAA+C;IAC/C,OAAO,YAAY;CACpB;AAED;;GAEG;AACH,oBAAY,cAAc;IACxB,6DAA6D;IAC7D,UAAU,eAAe;IAEzB,+DAA+D;IAC/D,QAAQ,aAAa;IAErB,mCAAmC;IACnC,MAAM,WAAW;CAClB;AAED;;GAEG;AACH,oBAAY,kBAAkB;IAC5B,oCAAoC;IACpC,MAAM,WAAW;IACjB,mCAAmC;IACnC,KAAK,UAAU;IACf,mCAAmC;IACnC,KAAK,UAAU;IACf,yCAAyC;IACzC,aAAa,kBAAkB;IAC/B,+BAA+B;IAC/B,WAAW,gBAAgB;CAC5B;AAED;;GAEG;AACH,oBAAY,oBAAoB;IAC9B,8BAA8B;IAC9B,MAAM,WAAW;IACjB,yBAAyB;IACzB,KAAK,UAAU;CAChB"}
+{"version":3,"file":"oauth2.enums.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2.enums.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;GAGG;AACH,oBAAY,gBAAgB;IAC1B,iGAAiG;IACjG,kBAAkB,uBAAuB;IAEzC,6FAA6F;IAC7F,kBAAkB,uBAAuB;IAEzC,0EAA0E;IAC1E,aAAa,kBAAkB;IAE/B,oEAAoE;IACpE,QAAQ,aAAa;IAErB,uEAAuE;IACvE,QAAQ,aAAa;IAErB,4EAA4E;IAC5E,WAAW,iDAAiD;IAE5D,6DAA6D;IAC7D,UAAU,gDAAgD;CAC3D;AAED;;GAEG;AACH,oBAAY,mBAAmB;IAC7B,IAAI,SAAS;IACb,KAAK,UAAU;IACf,QAAQ,aAAa;IACrB,aAAa,kBAAkB;IAC/B,UAAU,eAAe;IACzB,cAAc,mBAAmB;IACjC,mBAAmB,wBAAwB;CAC5C;AAED;;GAEG;AACH,oBAAY,kBAAkB;IAC5B,KAAK,UAAU;IACf,IAAI,SAAS;CACd;AAED;;;GAGG;AACH,oBAAY,+BAA+B;IACzC,wDAAwD;IACxD,mBAAmB,wBAAwB;IAE3C,kCAAkC;IAClC,kBAAkB,uBAAuB;IAEzC,qDAAqD;IACrD,iBAAiB,sBAAsB;IAEvC,qDAAqD;IACrD,eAAe,oBAAoB;IAEnC,yCAAyC;IACzC,IAAI,SAAS;CACd;AAED;;;GAGG;AACH,oBAAY,aAAa;IACvB,mCAAmC;IACnC,IAAI,SAAS;IAEb,yCAAyC;IACzC,KAAK,UAAU;IAEf,sDAAsD;IACtD,OAAO,YAAY;IAEnB,mCAAmC;IACnC,cAAc,mBAAmB;CAClC;AAED;;GAEG;AACH,oBAAY,iBAAiB;IAC3B,+CAA+C;IAC/C,MAAM,WAAW;IAEjB,+CAA+C;IAC/C,OAAO,YAAY;CACpB;AAED;;GAEG;AACH,oBAAY,cAAc;IACxB,6DAA6D;IAC7D,UAAU,eAAe;IAEzB,+DAA+D;IAC/D,QAAQ,aAAa;IAErB,mCAAmC;IACnC,MAAM,WAAW;CAClB;AAED;;GAEG;AACH,oBAAY,kBAAkB;IAC5B,oCAAoC;IACpC,MAAM,WAAW;IACjB,mCAAmC;IACnC,KAAK,UAAU;IACf,mCAAmC;IACnC,KAAK,UAAU;IACf,yCAAyC;IACzC,aAAa,kBAAkB;IAC/B,+BAA+B;IAC/B,WAAW,gBAAgB;CAC5B;AAED;;GAEG;AACH,oBAAY,oBAAoB;IAC9B,8BAA8B;IAC9B,MAAM,WAAW;IACjB,yBAAyB;IACzB,KAAK,UAAU;CAChB"}

package/dist/esm/core/oauth2.enums.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth2.enums.js","sourceRoot":"","sources":["../../../src/core/oauth2.enums.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;GAGG;AACH,MAAM,CAAN,IAAY,gBAqBX;AArBD,WAAY,gBAAgB;IAC1B,iGAAiG;IACjG,6DAAyC,CAAA;IAEzC,6FAA6F;IAC7F,6DAAyC,CAAA;IAEzC,0EAA0E;IAC1E,mDAA+B,CAAA;IAE/B,oEAAoE;IACpE,yCAAqB,CAAA;IAErB,uEAAuE;IACvE,yCAAqB,CAAA;IAErB,4EAA4E;IAC5E,gFAA4D,CAAA;IAE5D,6DAA6D;IAC7D,8EAA0D,CAAA;AAC5D,CAAC,EArBW,gBAAgB,KAAhB,gBAAgB,QAqB3B;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,mBAQX;AARD,WAAY,mBAAmB;IAC7B,oCAAa,CAAA;IACb,sCAAe,CAAA;IACf,4CAAqB,CAAA;IACrB,sDAA+B,CAAA;IAC/B,gDAAyB,CAAA;IACzB,wDAAiC,CAAA;IACjC,kEAA2C,CAAA;AAC7C,CAAC,EARW,mBAAmB,KAAnB,mBAAmB,QAQ9B;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,kBAGX;AAHD,WAAY,kBAAkB;IAC5B,qCAAe,CAAA;IACf,mCAAa,CAAA;AACf,CAAC,EAHW,kBAAkB,KAAlB,kBAAkB,QAG7B;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,+BAeX;AAfD,WAAY,+BAA+B;IACzC,wDAAwD;IACxD,8EAA2C,CAAA;IAE3C,kCAAkC;IAClC,4EAAyC,CAAA;IAEzC,qDAAqD;IACrD,0EAAuC,CAAA;IAEvC,qDAAqD;IACrD,sEAAmC,CAAA;IAEnC,yCAAyC;IACzC,gDAAa,CAAA;AACf,CAAC,EAfW,+BAA+B,KAA/B,+BAA+B,QAe1C;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,aAYX;AAZD,WAAY,aAAa;IACvB,mCAAmC;IACnC,8BAAa,CAAA;IAEb,yCAAyC;IACzC,gCAAe,CAAA;IAEf,sDAAsD;IACtD,oCAAmB,CAAA;IAEnB,mCAAmC;IACnC,kDAAiC,CAAA;AACnC,CAAC,EAZW,aAAa,KAAb,aAAa,QAYxB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,iBAMX;AAND,WAAY,iBAAiB;IAC3B,+CAA+C;IAC/C,sCAAiB,CAAA;IAEjB,+CAA+C;IAC/C,wCAAmB,CAAA;AACrB,CAAC,EANW,iBAAiB,KAAjB,iBAAiB,QAM5B;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,cASX;AATD,WAAY,cAAc;IACxB,6DAA6D;IAC7D,2CAAyB,CAAA;IAEzB,+DAA+D;IAC/D,uCAAqB,CAAA;IAErB,mCAAmC;IACnC,mCAAiB,CAAA;AACnB,CAAC,EATW,cAAc,KAAd,cAAc,QASzB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,kBAWX;AAXD,WAAY,kBAAkB;IAC5B,oCAAoC;IACpC,uCAAiB,CAAA;IACjB,mCAAmC;IACnC,qCAAe,CAAA;IACf,mCAAmC;IACnC,qCAAe,CAAA;IACf,yCAAyC;IACzC,qDAA+B,CAAA;IAC/B,+BAA+B;IAC/B,iDAA2B,CAAA;AAC7B,CAAC,EAXW,kBAAkB,KAAlB,kBAAkB,QAW7B;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,oBAKX;AALD,WAAY,oBAAoB;IAC9B,8BAA8B;IAC9B,yCAAiB,CAAA;IACjB,yBAAyB;IACzB,uCAAe,CAAA;AACjB,CAAC,EALW,oBAAoB,KAApB,oBAAoB,QAK/B","sourcesContent":["/**\n * OAuth2 Enums - Shared OAuth2 type definitions\n * \n * These enums are extracted to avoid circular dependencies between\n * security schemas and oauth2 protocol schemas.\n * \n * Based on:\n * - RFC 6749: The OAuth 2.0 Authorization Framework\n * - RFC 7636: Proof Key for Code Exchange (PKCE)\n * - OpenID Connect Core 1.0\n */\n\n/**\n * OAuth2 Grant Types as defined in RFC 6749\n * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4\n */\nexport enum OAuth2_GrantType {\n  /** Authorization Code Grant (RFC 6749 §4.1) - For server-side apps with secure client secrets */\n  AUTHORIZATION_CODE = 'authorization_code',\n  \n  /** Client Credentials Grant (RFC 6749 §4.4) - For machine-to-machine / S2S authentication */\n  CLIENT_CREDENTIALS = 'client_credentials',\n  \n  /** Refresh Token Grant (RFC 6749 §6) - For obtaining new access tokens */\n  REFRESH_TOKEN = 'refresh_token',\n  \n  /** Implicit Grant (RFC 6749 §4.2) - DEPRECATED, use PKCE instead */\n  IMPLICIT = 'implicit',\n  \n  /** Resource Owner Password Credentials (RFC 6749 §4.3) - DEPRECATED */\n  PASSWORD = 'password',\n  \n  /** Device Authorization Grant (RFC 8628) - For input-constrained devices */\n  DEVICE_CODE = 'urn:ietf:params:oauth:grant-type:device_code',\n  \n  /** JWT Bearer Assertion (RFC 7523) - For service accounts */\n  JWT_BEARER = 'urn:ietf:params:oauth:grant-type:jwt-bearer',\n}\n\n/**\n * OAuth2 Response Types for Authorization Endpoint\n */\nexport enum OAuth2_ResponseType {\n  CODE = 'code',\n  TOKEN = 'token',\n  ID_TOKEN = 'id_token',\n  CODE_ID_TOKEN = 'code id_token',\n  CODE_TOKEN = 'code token',\n  ID_TOKEN_TOKEN = 'id_token token',\n  CODE_ID_TOKEN_TOKEN = 'code id_token token',\n}\n\n/**\n * PKCE Code Challenge Methods (RFC 7636)\n */\nexport enum OAuth2_PKCE_Method {\n  PLAIN = 'plain',\n  S256 = 'S256',\n}\n\n/**\n * Token Endpoint Authentication Methods\n * How credentials are sent to the token endpoint\n */\nexport enum OAuth2_TokenEndpoint_AuthMethod {\n  /** Credentials in Authorization header as Basic auth */\n  CLIENT_SECRET_BASIC = 'client_secret_basic',\n  \n  /** Credentials in request body */\n  CLIENT_SECRET_POST = 'client_secret_post',\n  \n  /** JWT assertion signed with client secret (HMAC) */\n  CLIENT_SECRET_JWT = 'client_secret_jwt',\n  \n  /** JWT assertion signed with private key (RSA/EC) */\n  PRIVATE_KEY_JWT = 'private_key_jwt',\n  \n  /** No authentication (public clients) */\n  NONE = 'none',\n}\n\n/**\n * OpenID Connect Prompt Values\n * Controls how the authorization server prompts the user\n */\nexport enum OAuth2_Prompt {\n  /** No prompt - silent auth only */\n  NONE = 'none',\n  \n  /** Force login even if session exists */\n  LOGIN = 'login',\n  \n  /** Require user consent even if previously granted */\n  CONSENT = 'consent',\n  \n  /** Prompt for account selection */\n  SELECT_ACCOUNT = 'select_account',\n}\n\n/**\n * Access Type - whether to request refresh tokens\n */\nexport enum OAuth2_AccessType {\n  /** Only access token, no refresh capability */\n  ONLINE = 'online',\n  \n  /** Request refresh token for offline access */\n  OFFLINE = 'offline',\n}\n\n/**\n * OAuth2 Provider Purpose - what the OAuth2 is used for\n */\nexport enum OAuth2_Purpose {\n  /** API access only - for making API calls to the provider */\n  API_ACCESS = 'api_access',\n  \n  /** User SSO - for authenticating users into our application */\n  USER_SSO = 'user_sso',\n  \n  /** Both API access and user SSO */\n  HYBRID = 'hybrid',\n}\n\n/**\n * OAuth2 Token Format - How to format the token for API calls\n */\nexport enum OAuth2_TokenFormat {\n  /** Authorization: Bearer <token> */\n  BEARER = 'bearer',\n  /** Authorization: token <token> */\n  TOKEN = 'token',\n  /** Authorization: OAuth <token> */\n  OAUTH = 'oauth',\n  /** Custom header specified separately */\n  CUSTOM_HEADER = 'custom_header',\n  /** Token in query parameter */\n  QUERY_PARAM = 'query_param',\n}\n\n/**\n * OAuth2 Token Location - Where to send the access token\n */\nexport enum OAuth2_TokenLocation {\n  /** In Authorization header */\n  HEADER = 'header',\n  /** As query parameter */\n  QUERY = 'query',\n}\n\n"]}
+{"version":3,"file":"oauth2.enums.js","sourceRoot":"","sources":["../../../../src/core/oauth2.enums.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;GAGG;AACH,MAAM,CAAN,IAAY,gBAqBX;AArBD,WAAY,gBAAgB;IAC1B,iGAAiG;IACjG,6DAAyC,CAAA;IAEzC,6FAA6F;IAC7F,6DAAyC,CAAA;IAEzC,0EAA0E;IAC1E,mDAA+B,CAAA;IAE/B,oEAAoE;IACpE,yCAAqB,CAAA;IAErB,uEAAuE;IACvE,yCAAqB,CAAA;IAErB,4EAA4E;IAC5E,gFAA4D,CAAA;IAE5D,6DAA6D;IAC7D,8EAA0D,CAAA;AAC5D,CAAC,EArBW,gBAAgB,KAAhB,gBAAgB,QAqB3B;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,mBAQX;AARD,WAAY,mBAAmB;IAC7B,oCAAa,CAAA;IACb,sCAAe,CAAA;IACf,4CAAqB,CAAA;IACrB,sDAA+B,CAAA;IAC/B,gDAAyB,CAAA;IACzB,wDAAiC,CAAA;IACjC,kEAA2C,CAAA;AAC7C,CAAC,EARW,mBAAmB,KAAnB,mBAAmB,QAQ9B;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,kBAGX;AAHD,WAAY,kBAAkB;IAC5B,qCAAe,CAAA;IACf,mCAAa,CAAA;AACf,CAAC,EAHW,kBAAkB,KAAlB,kBAAkB,QAG7B;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,+BAeX;AAfD,WAAY,+BAA+B;IACzC,wDAAwD;IACxD,8EAA2C,CAAA;IAE3C,kCAAkC;IAClC,4EAAyC,CAAA;IAEzC,qDAAqD;IACrD,0EAAuC,CAAA;IAEvC,qDAAqD;IACrD,sEAAmC,CAAA;IAEnC,yCAAyC;IACzC,gDAAa,CAAA;AACf,CAAC,EAfW,+BAA+B,KAA/B,+BAA+B,QAe1C;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,aAYX;AAZD,WAAY,aAAa;IACvB,mCAAmC;IACnC,8BAAa,CAAA;IAEb,yCAAyC;IACzC,gCAAe,CAAA;IAEf,sDAAsD;IACtD,oCAAmB,CAAA;IAEnB,mCAAmC;IACnC,kDAAiC,CAAA;AACnC,CAAC,EAZW,aAAa,KAAb,aAAa,QAYxB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,iBAMX;AAND,WAAY,iBAAiB;IAC3B,+CAA+C;IAC/C,sCAAiB,CAAA;IAEjB,+CAA+C;IAC/C,wCAAmB,CAAA;AACrB,CAAC,EANW,iBAAiB,KAAjB,iBAAiB,QAM5B;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,cASX;AATD,WAAY,cAAc;IACxB,6DAA6D;IAC7D,2CAAyB,CAAA;IAEzB,+DAA+D;IAC/D,uCAAqB,CAAA;IAErB,mCAAmC;IACnC,mCAAiB,CAAA;AACnB,CAAC,EATW,cAAc,KAAd,cAAc,QASzB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,kBAWX;AAXD,WAAY,kBAAkB;IAC5B,oCAAoC;IACpC,uCAAiB,CAAA;IACjB,mCAAmC;IACnC,qCAAe,CAAA;IACf,mCAAmC;IACnC,qCAAe,CAAA;IACf,yCAAyC;IACzC,qDAA+B,CAAA;IAC/B,+BAA+B;IAC/B,iDAA2B,CAAA;AAC7B,CAAC,EAXW,kBAAkB,KAAlB,kBAAkB,QAW7B;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,oBAKX;AALD,WAAY,oBAAoB;IAC9B,8BAA8B;IAC9B,yCAAiB,CAAA;IACjB,yBAAyB;IACzB,uCAAe,CAAA;AACjB,CAAC,EALW,oBAAoB,KAApB,oBAAoB,QAK/B","sourcesContent":["/**\n * OAuth2 Enums - Shared OAuth2 type definitions\n * \n * These enums are extracted to avoid circular dependencies between\n * security schemas and oauth2 protocol schemas.\n * \n * Based on:\n * - RFC 6749: The OAuth 2.0 Authorization Framework\n * - RFC 7636: Proof Key for Code Exchange (PKCE)\n * - OpenID Connect Core 1.0\n */\n\n/**\n * OAuth2 Grant Types as defined in RFC 6749\n * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4\n */\nexport enum OAuth2_GrantType {\n  /** Authorization Code Grant (RFC 6749 §4.1) - For server-side apps with secure client secrets */\n  AUTHORIZATION_CODE = 'authorization_code',\n  \n  /** Client Credentials Grant (RFC 6749 §4.4) - For machine-to-machine / S2S authentication */\n  CLIENT_CREDENTIALS = 'client_credentials',\n  \n  /** Refresh Token Grant (RFC 6749 §6) - For obtaining new access tokens */\n  REFRESH_TOKEN = 'refresh_token',\n  \n  /** Implicit Grant (RFC 6749 §4.2) - DEPRECATED, use PKCE instead */\n  IMPLICIT = 'implicit',\n  \n  /** Resource Owner Password Credentials (RFC 6749 §4.3) - DEPRECATED */\n  PASSWORD = 'password',\n  \n  /** Device Authorization Grant (RFC 8628) - For input-constrained devices */\n  DEVICE_CODE = 'urn:ietf:params:oauth:grant-type:device_code',\n  \n  /** JWT Bearer Assertion (RFC 7523) - For service accounts */\n  JWT_BEARER = 'urn:ietf:params:oauth:grant-type:jwt-bearer',\n}\n\n/**\n * OAuth2 Response Types for Authorization Endpoint\n */\nexport enum OAuth2_ResponseType {\n  CODE = 'code',\n  TOKEN = 'token',\n  ID_TOKEN = 'id_token',\n  CODE_ID_TOKEN = 'code id_token',\n  CODE_TOKEN = 'code token',\n  ID_TOKEN_TOKEN = 'id_token token',\n  CODE_ID_TOKEN_TOKEN = 'code id_token token',\n}\n\n/**\n * PKCE Code Challenge Methods (RFC 7636)\n */\nexport enum OAuth2_PKCE_Method {\n  PLAIN = 'plain',\n  S256 = 'S256',\n}\n\n/**\n * Token Endpoint Authentication Methods\n * How credentials are sent to the token endpoint\n */\nexport enum OAuth2_TokenEndpoint_AuthMethod {\n  /** Credentials in Authorization header as Basic auth */\n  CLIENT_SECRET_BASIC = 'client_secret_basic',\n  \n  /** Credentials in request body */\n  CLIENT_SECRET_POST = 'client_secret_post',\n  \n  /** JWT assertion signed with client secret (HMAC) */\n  CLIENT_SECRET_JWT = 'client_secret_jwt',\n  \n  /** JWT assertion signed with private key (RSA/EC) */\n  PRIVATE_KEY_JWT = 'private_key_jwt',\n  \n  /** No authentication (public clients) */\n  NONE = 'none',\n}\n\n/**\n * OpenID Connect Prompt Values\n * Controls how the authorization server prompts the user\n */\nexport enum OAuth2_Prompt {\n  /** No prompt - silent auth only */\n  NONE = 'none',\n  \n  /** Force login even if session exists */\n  LOGIN = 'login',\n  \n  /** Require user consent even if previously granted */\n  CONSENT = 'consent',\n  \n  /** Prompt for account selection */\n  SELECT_ACCOUNT = 'select_account',\n}\n\n/**\n * Access Type - whether to request refresh tokens\n */\nexport enum OAuth2_AccessType {\n  /** Only access token, no refresh capability */\n  ONLINE = 'online',\n  \n  /** Request refresh token for offline access */\n  OFFLINE = 'offline',\n}\n\n/**\n * OAuth2 Provider Purpose - what the OAuth2 is used for\n */\nexport enum OAuth2_Purpose {\n  /** API access only - for making API calls to the provider */\n  API_ACCESS = 'api_access',\n  \n  /** User SSO - for authenticating users into our application */\n  USER_SSO = 'user_sso',\n  \n  /** Both API access and user SSO */\n  HYBRID = 'hybrid',\n}\n\n/**\n * OAuth2 Token Format - How to format the token for API calls\n */\nexport enum OAuth2_TokenFormat {\n  /** Authorization: Bearer <token> */\n  BEARER = 'bearer',\n  /** Authorization: token <token> */\n  TOKEN = 'token',\n  /** Authorization: OAuth <token> */\n  OAUTH = 'oauth',\n  /** Custom header specified separately */\n  CUSTOM_HEADER = 'custom_header',\n  /** Token in query parameter */\n  QUERY_PARAM = 'query_param',\n}\n\n/**\n * OAuth2 Token Location - Where to send the access token\n */\nexport enum OAuth2_TokenLocation {\n  /** In Authorization header */\n  HEADER = 'header',\n  /** As query parameter */\n  QUERY = 'query',\n}\n\n"]}

package/dist/esm/core/operation-classification.external-connectors-models.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operation-classification.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../src/core/operation-classification.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,oBAAY,gCAAgC;IAC1C,IAAI,SAAS;IACb,KAAK,UAAU;CAChB"}
+{"version":3,"file":"operation-classification.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../../src/core/operation-classification.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,oBAAY,gCAAgC;IAC1C,IAAI,SAAS;IACb,KAAK,UAAU;CAChB"}

package/dist/esm/core/operation-classification.external-connectors-models.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"operation-classification.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../src/core/operation-classification.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,gCAGX;AAHD,WAAY,gCAAgC;IAC1C,iDAAa,CAAA;IACb,mDAAe,CAAA;AACjB,CAAC,EAHW,gCAAgC,KAAhC,gCAAgC,QAG3C","sourcesContent":["/**\n * Whether an external operation READS from or WRITES to the third-party system.\n *\n * Kept as its own tiny vocabulary because every operation catalogue needs it regardless of where\n * the catalogue came from: a caller decides retry-safety, an audit decides severity, and a UI\n * decides whether to confirm. Neutral by construction — it names the operation's effect, never a\n * source catalogue's spelling of it.\n */\nexport enum ExternalOperation_Classification {\n  READ = \"READ\",\n  WRITE = \"WRITE\",\n}\n"]}
+{"version":3,"file":"operation-classification.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../../src/core/operation-classification.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,gCAGX;AAHD,WAAY,gCAAgC;IAC1C,iDAAa,CAAA;IACb,mDAAe,CAAA;AACjB,CAAC,EAHW,gCAAgC,KAAhC,gCAAgC,QAG3C","sourcesContent":["/**\n * Whether an external operation READS from or WRITES to the third-party system.\n *\n * Kept as its own tiny vocabulary because every operation catalogue needs it regardless of where\n * the catalogue came from: a caller decides retry-safety, an audit decides severity, and a UI\n * decides whether to confirm. Neutral by construction — it names the operation's effect, never a\n * source catalogue's spelling of it.\n */\nexport enum ExternalOperation_Classification {\n  READ = \"READ\",\n  WRITE = \"WRITE\",\n}\n"]}

package/dist/esm/core/operations.external-connectors-models.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operations.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../src/core/operations.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;oEAEoE;AAEpE,eAAO,MAAM,uCAAuC;;;;iBAIlD,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG,MAAM,MAAM,yCAAyC,GAAG;IACtD;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IAEpB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAEnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IAEpB,0BAA0B;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,4BAA4B;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,yBAAyB;IACzB,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAE9B,0BAA0B;IAC1B,YAAY,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAE/B,kCAAkC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAE/B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B,CAAA"}
+{"version":3,"file":"operations.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../../src/core/operations.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;oEAEoE;AAEpE,eAAO,MAAM,uCAAuC;;;;iBAIlD,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG,MAAM,MAAM,yCAAyC,GAAG;IACtD;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IAEpB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAEnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IAEpB,0BAA0B;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,4BAA4B;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,yBAAyB;IACzB,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAE9B,0BAA0B;IAC1B,YAAY,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAE/B,kCAAkC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAE/B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B,CAAA"}

package/dist/esm/core/operations.external-connectors-models.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"operations.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../src/core/operations.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;oEAEoE;AAEpE,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9D,aAAa,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\n\n/** ──────────────────────────────────────────────────────────────\n * Internal Schemas (concrete, for method access)\n * ────────────────────────────────────────────────────────────── */\n\nexport const ExternalProvider_OperationContextSchema = z.object({\n  callTimestamp: z.iso.datetime(),\n  callDuration: z.number().optional(),\n  errorReason: z.string().optional(),\n});\nexport type ExternalProvider_OperationContext = z.infer<typeof ExternalProvider_OperationContextSchema>;\n\nexport type ExternalProvider_OperationDefinition_Base = {\n  /** \n   * Unique operation identifier\n   * Format: {provider}-{domain}-{action} e.g., \"stripe-customers-create\"\n   */\n  operationKey: string,\n  \n  /** Provider reference (e.g., \"google\", \"slack\", \"stripe\") */\n  providerRef: string,\n  \n  /** \n   * Domains this operation belongs to (can span multiple domains)\n   * e.g., [\"customers\"] or [\"sheets\", \"drive\"] for cross-domain operations\n   * Empty/undefined for providers without explicit domains\n   */\n  domains?: string[],\n  \n  /** \n   * Capabilities/features this operation uses\n   * e.g., [\"storage\", \"file-upload\"] for a file creation operation\n   */\n  features?: string[],\n  \n  /** Human-readable name */\n  displayName?: string,\n  \n  /** Operation description */\n  description?: string,\n  \n  /** Input schema (Zod) */\n  inputSchema: z.ZodSchema<any>,\n  \n  /** Output schema (Zod) */\n  outputSchema: z.ZodSchema<any>,\n  \n  /** Operation-specific metadata */\n  metadata?: Record<string, any>,\n  \n  /** \n   * OAuth2 scopes required specifically for this operation\n   * System unions all required scopes from selected operations at auth time\n   */\n  requiredScopes?: string[],\n}\n"]}
+{"version":3,"file":"operations.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../../src/core/operations.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;oEAEoE;AAEpE,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9D,aAAa,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\n\n/** ──────────────────────────────────────────────────────────────\n * Internal Schemas (concrete, for method access)\n * ────────────────────────────────────────────────────────────── */\n\nexport const ExternalProvider_OperationContextSchema = z.object({\n  callTimestamp: z.iso.datetime(),\n  callDuration: z.number().optional(),\n  errorReason: z.string().optional(),\n});\nexport type ExternalProvider_OperationContext = z.infer<typeof ExternalProvider_OperationContextSchema>;\n\nexport type ExternalProvider_OperationDefinition_Base = {\n  /** \n   * Unique operation identifier\n   * Format: {provider}-{domain}-{action} e.g., \"stripe-customers-create\"\n   */\n  operationKey: string,\n  \n  /** Provider reference (e.g., \"google\", \"slack\", \"stripe\") */\n  providerRef: string,\n  \n  /** \n   * Domains this operation belongs to (can span multiple domains)\n   * e.g., [\"customers\"] or [\"sheets\", \"drive\"] for cross-domain operations\n   * Empty/undefined for providers without explicit domains\n   */\n  domains?: string[],\n  \n  /** \n   * Capabilities/features this operation uses\n   * e.g., [\"storage\", \"file-upload\"] for a file creation operation\n   */\n  features?: string[],\n  \n  /** Human-readable name */\n  displayName?: string,\n  \n  /** Operation description */\n  description?: string,\n  \n  /** Input schema (Zod) */\n  inputSchema: z.ZodSchema<any>,\n  \n  /** Output schema (Zod) */\n  outputSchema: z.ZodSchema<any>,\n  \n  /** Operation-specific metadata */\n  metadata?: Record<string, any>,\n  \n  /** \n   * OAuth2 scopes required specifically for this operation\n   * System unions all required scopes from selected operations at auth time\n   */\n  requiredScopes?: string[],\n}\n"]}

package/dist/esm/core/security.external-connectors-models.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../src/core/security.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,+BAA+B,EAC/B,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AAMxB;;;GAGG;AACH,oBAAY,0BAA0B;IACpC,iCAAiC;IACjC,IAAI,SAAS;IAEb,0CAA0C;IAC1C,OAAO,YAAY;IAEnB,gDAAgD;IAChD,MAAM,WAAW;IAEjB,gCAAgC;IAChC,KAAK,UAAU;IAEf,kEAAkE;IAClE,MAAM,WAAW;IAEjB,0CAA0C;IAC1C,cAAc,mBAAmB;IAEjC,+CAA+C;IAC/C,cAAc,mBAAmB;IAEjC,uCAAuC;IACvC,UAAU,eAAe;IAEzB,qDAAqD;IACrD,eAAe,oBAAoB;CACpC;AAMD,oBAAY,qCAAqC;IAC/C,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,MAAM,WAAW;CAClB;AAED,oBAAY,8CAA8C;IACxD,MAAM,WAAW;IACjB,MAAM,WAAW;CAClB;AAED,oBAAY,mCAAmC;IAC7C,GAAG,QAAQ;IACX,OAAO,YAAY;IACnB,mBAAmB,wBAAwB;CAC5C;AAMD;;;GAGG;AACH,eAAO,MAAM,yCAAyC;;;;;iBAYpD,CAAC;AAMH,eAAO,MAAM,6CAA6C;;;;;;;iBAkBxD,CAAC;AAMH,eAAO,MAAM,uCAAuC;;;;;;iBAelD,CAAC;AAMH,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6CAA6C,CAAC,CAAC;AACpH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAMxG;;;GAGG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAmI9C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAM/F;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,oBAAY,sCAAsC;IAChD,qGAAqG;IACrG,WAAW,gBAAgB;IAC3B,mGAAmG;IACnG,YAAY,iBAAiB;IAC7B,uFAAuF;IACvF,IAAI,SAAS;CACd;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,oBAAY,4BAA4B;IACtC;;;OAGG;IACH,YAAY,iBAAiB;IAC7B;;;;OAIG;IACH,UAAU,eAAe;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,oBAAY,0CAA0C;IACpD,2EAA2E;IAC3E,OAAO,YAAY;IACnB,wFAAwF;IACxF,IAAI,SAAS;CACd;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sCAAsC;;;iBAIjD,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,eAAO,MAAM,uCAAuC;;;;;iBAkDlD,CAAC;AAEH;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,gCAAgC,GAAG,OAAO,CAGhG;AAED;;;;;;;;GAQG;AACH,wBAAgB,0CAA0C,CAAC,KAAK,EAAE,gCAAgC,GAAG,OAAO,CAG3G;AAED,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC"}
+{"version":3,"file":"security.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../../src/core/security.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,+BAA+B,EAC/B,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AAMxB;;;GAGG;AACH,oBAAY,0BAA0B;IACpC,iCAAiC;IACjC,IAAI,SAAS;IAEb,0CAA0C;IAC1C,OAAO,YAAY;IAEnB,gDAAgD;IAChD,MAAM,WAAW;IAEjB,gCAAgC;IAChC,KAAK,UAAU;IAEf,kEAAkE;IAClE,MAAM,WAAW;IAEjB,0CAA0C;IAC1C,cAAc,mBAAmB;IAEjC,+CAA+C;IAC/C,cAAc,mBAAmB;IAEjC,uCAAuC;IACvC,UAAU,eAAe;IAEzB,qDAAqD;IACrD,eAAe,oBAAoB;CACpC;AAMD,oBAAY,qCAAqC;IAC/C,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,MAAM,WAAW;CAClB;AAED,oBAAY,8CAA8C;IACxD,MAAM,WAAW;IACjB,MAAM,WAAW;CAClB;AAED,oBAAY,mCAAmC;IAC7C,GAAG,QAAQ;IACX,OAAO,YAAY;IACnB,mBAAmB,wBAAwB;CAC5C;AAMD;;;GAGG;AACH,eAAO,MAAM,yCAAyC;;;;;iBAYpD,CAAC;AAMH,eAAO,MAAM,6CAA6C;;;;;;;iBAkBxD,CAAC;AAMH,eAAO,MAAM,uCAAuC;;;;;;iBAelD,CAAC;AAMH,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6CAA6C,CAAC,CAAC;AACpH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAMxG;;;GAGG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAmI9C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAM/F;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,oBAAY,sCAAsC;IAChD,qGAAqG;IACrG,WAAW,gBAAgB;IAC3B,mGAAmG;IACnG,YAAY,iBAAiB;IAC7B,uFAAuF;IACvF,IAAI,SAAS;CACd;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,oBAAY,4BAA4B;IACtC;;;OAGG;IACH,YAAY,iBAAiB;IAC7B;;;;OAIG;IACH,UAAU,eAAe;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,oBAAY,0CAA0C;IACpD,2EAA2E;IAC3E,OAAO,YAAY;IACnB,wFAAwF;IACxF,IAAI,SAAS;CACd;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sCAAsC;;;iBAIjD,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,eAAO,MAAM,uCAAuC;;;;;iBAkDlD,CAAC;AAEH;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,gCAAgC,GAAG,OAAO,CAGhG;AAED;;;;;;;;GAQG;AACH,wBAAgB,0CAA0C,CAAC,KAAK,EAAE,gCAAgC,GAAG,OAAO,CAG3G;AAED,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC"}

package/dist/esm/core/security.external-connectors-models.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../src/core/security.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,+BAA+B,EAC/B,kBAAkB,EAClB,aAAa,EACb,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAExB,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAN,IAAY,0BA2BX;AA3BD,WAAY,0BAA0B;IACpC,iCAAiC;IACjC,2CAAa,CAAA;IAEb,0CAA0C;IAC1C,iDAAmB,CAAA;IAEnB,gDAAgD;IAChD,+CAAiB,CAAA;IAEjB,gCAAgC;IAChC,6CAAe,CAAA;IAEf,kEAAkE;IAClE,+CAAiB,CAAA;IAEjB,0CAA0C;IAC1C,+DAAiC,CAAA;IAEjC,+CAA+C;IAC/C,+DAAiC,CAAA;IAEjC,uCAAuC;IACvC,uDAAyB,CAAA;IAEzB,qDAAqD;IACrD,iEAAmC,CAAA;AACrC,CAAC,EA3BW,0BAA0B,KAA1B,0BAA0B,QA2BrC;AAED,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,MAAM,CAAN,IAAY,qCAIX;AAJD,WAAY,qCAAqC;IAC/C,0DAAiB,CAAA;IACjB,wDAAe,CAAA;IACf,0DAAiB,CAAA;AACnB,CAAC,EAJW,qCAAqC,KAArC,qCAAqC,QAIhD;AAED,MAAM,CAAN,IAAY,8CAGX;AAHD,WAAY,8CAA8C;IACxD,mEAAiB,CAAA;IACjB,mEAAiB,CAAA;AACnB,CAAC,EAHW,8CAA8C,KAA9C,8CAA8C,QAGzD;AAED,MAAM,CAAN,IAAY,mCAIX;AAJD,WAAY,mCAAmC;IAC7C,kDAAW,CAAA;IACX,0DAAmB,CAAA;IACnB,kFAA2C,CAAA;AAC7C,CAAC,EAJW,mCAAmC,KAAnC,mCAAmC,QAI9C;AAED,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,6BAA6B;IAC7B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAE5C,yDAAyD;IACzD,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE3C,iDAAiD;IACjD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEjC,8EAA8E;IAC9E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,CAAC,MAAM,CAAC;IACpE,kCAAkC;IAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE3D,yCAAyC;IACzC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAEzC,sCAAsC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE3C,sCAAsC;IACtC,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE1D,4CAA4C;IAC5C,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAExD,kDAAkD;IAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;CACjD,CAAC,CAAC;AAEH,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9D,6BAA6B;IAC7B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAExC,6CAA6C;IAC7C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1B,wCAAwC;IACxC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAErC,gEAAgE;IAChE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,MAAM,CAAC;IAE7G,wCAAwC;IACxC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;CACnD,CAAC,CAAC;AASH,gFAAgF;AAChF,qCAAqC;AACrC,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC9E,iCAAiC;IACjC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,OAAO,CAAC;QACnD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;QAClD,qDAAqD;QACrD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC;IAEF,wCAAwC;IACxC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,cAAc,CAAC;QAC1D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;QAChD,qBAAqB;QACrB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC,OAAO,CAAC,8CAA8C,CAAC,MAAM,CAAC;QAChI,gDAAgD;QAChD,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;QACpE,wCAAwC;QACxC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACtC,0DAA0D;QAC1D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC;IAEF,sCAAsC;IACtC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,MAAM,CAAC;QAClD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,MAAM,CAAC;QAC7G,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;QAClD,iCAAiC;QACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACrC,mBAAmB;QACnB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC,OAAO,CAAC,mCAAmC,CAAC,GAAG,CAAC;KACrG,CAAC;IAEF,wCAAwC;IACxC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,cAAc,CAAC;QAC1D,yBAAyB;QACzB,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAChC,aAAa;QACb,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,wBAAwB;QACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,4BAA4B;QAC5B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;KACtE,CAAC;IAEF,mDAAmD;IACnD,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,MAAM,CAAC;QAElD,uDAAuD;QACvD;;;;WAIG;QACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAExC,wDAAwD;QACxD,gEAAgE;QAChE,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC3B,gBAAgB;QAChB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC5B,+CAA+C;QAC/C,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAE9B,4CAA4C;QAC5C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAEtC,2BAA2B;QAC3B,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;QAE9C,iCAAiC;QACjC,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,QAAQ,EAAE;QAE3E,mBAAmB;QACnB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC5B,kBAAkB;QAClB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;QAEjD,sBAAsB;QACtB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;QAExC,mCAAmC;QACnC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;QAEhD,qCAAqC;QACrC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAE5D,6BAA6B;QAC7B,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAE7D,uCAAuC;QACvC,sDAAsD;QACtD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC7E,+CAA+C;QAC/C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACzC,CAAC;IAEF,+BAA+B;IAC/B,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,KAAK,CAAC;QACjD,+BAA+B;QAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,+BAA+B;QAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC;IAEF,4BAA4B;IAC5B,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC;KACjD,CAAC;IAEF,0BAA0B;IAC1B,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,eAAe,CAAC;QAC3D,8CAA8C;QAC9C,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KACxC,CAAC;IAEF,qBAAqB;IACrB,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,UAAU,CAAC;QACtD,4BAA4B;QAC5B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACrC,4BAA4B;QAC5B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpC,+BAA+B;QAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC7B,CAAC;CACH,CAAC,CAAC;AAGH,gFAAgF;AAChF,sEAAsE;AACtE,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAN,IAAY,sCAOX;AAPD,WAAY,sCAAsC;IAChD,qGAAqG;IACrG,qEAA2B,CAAA;IAC3B,mGAAmG;IACnG,uEAA6B,CAAA;IAC7B,uFAAuF;IACvF,uDAAa,CAAA;AACf,CAAC,EAPW,sCAAsC,KAAtC,sCAAsC,QAOjD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAN,IAAY,4BAYX;AAZD,WAAY,4BAA4B;IACtC;;;OAGG;IACH,6DAA6B,CAAA;IAC7B;;;;OAIG;IACH,yDAAyB,CAAA;AAC3B,CAAC,EAZW,4BAA4B,KAA5B,4BAA4B,QAYvC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,CAAN,IAAY,0CAKX;AALD,WAAY,0CAA0C;IACpD,2EAA2E;IAC3E,iEAAmB,CAAA;IACnB,wFAAwF;IACxF,2DAAa,CAAA;AACf,CAAC,EALW,0CAA0C,KAA1C,0CAA0C,QAKrD;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC;IAC1D,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,0CAA0C,CAAC;SAC3D,OAAO,CAAC,0CAA0C,CAAC,OAAO,CAAC;CAC/D,CAAC,CAAC;AAaH,MAAM,CAAC,MAAM,uCAAuC,GAAG,sCAAsC,CAAC,MAAM,CAAC;IACnG;;;OAGG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B;;;;;;;;OAQG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,eAAe,GAAG,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW,CAAC;IACjG,IAAI,eAAe,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,EAAE,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,OAAO,EAAE,KAAK,MAAM,CAAC,UAAU,iCAAiC,MAAM,CAAC,UAAU,8DAA8D;SAChJ,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACrD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,OAAO,EAAE,mHAAmH;SAC7H,CAAC,CAAC;IACL,CAAC;IACD,IAAI,+BAA+B,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,IAAI,MAAM,CAAC,eAAe,KAAK,EAAE,EAAE,CAAC;YAC1E,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;gBACzB,OAAO,EAAE,oIAAoI;aAC9I,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAChD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EAAE,MAAM,CAAC,UAAU,KAAK,0CAA0C,CAAC,IAAI;gBAC5E,CAAC,CAAC,KAAK,MAAM,CAAC,UAAU,sGAAsG;sBAC1H,uEAAuE;gBAC3E,CAAC,CAAC,6KAA6K;SAClL,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAAuC;IACrF,OAAO,KAAK,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW;WACzE,KAAK,CAAC,UAAU,KAAK,0CAA0C,CAAC,IAAI,CAAC;AAC5E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0CAA0C,CAAC,KAAuC;IAChG,OAAO,KAAK,CAAC,UAAU,KAAK,sCAAsC,CAAC,YAAY;WAC1E,KAAK,CAAC,UAAU,KAAK,0CAA0C,CAAC,IAAI,CAAC;AAC5E,CAAC","sourcesContent":["/**\n * Security and Authentication Schemas for External Connectors\n * \n * This module defines authentication profiles that can be used across protocols.\n * It integrates with OAuth2 to avoid duplication between API auth and OAuth2 config.\n * \n * Architecture:\n * - ExternalProvider_Auth_Kind: The type of authentication\n * - ExternalProvider_AuthProfile: How to authenticate with an API\n * - OAuth2-linked profiles: Reference OAuth2 config instead of duplicating\n * \n * @see https://swagger.io/docs/specification/v3_0/authentication/\n */\n\nimport { z } from \"zod\";\nimport {\n  OAuth2_GrantType,\n  OAuth2_TokenEndpoint_AuthMethod,\n  OAuth2_PKCE_Method,\n  OAuth2_Prompt,\n  OAuth2_AccessType,\n} from './oauth2.enums';\n\n// =============================================================================\n// AUTH KIND ENUM\n// =============================================================================\n\n/**\n * Authentication types supported by external providers\n * Follows OpenAPI 3.0 Security Schemes with extensions\n */\nexport enum ExternalProvider_Auth_Kind {\n  /** No authentication required */\n  NONE = \"none\",\n  \n  /** API Key in header, query, or cookie */\n  API_KEY = \"api_key\",\n  \n  /** Bearer token (OAuth2 access token or JWT) */\n  BEARER = \"bearer\",\n  \n  /** HTTP Basic authentication */\n  BASIC = \"basic\",\n  \n  /** OAuth2 authentication - links to OAuth2 provider definition */\n  OAUTH2 = \"oauth2\",\n  \n  /** HMAC signature-based authentication */\n  HMAC_SIGNATURE = \"hmac_signature\",\n  \n  /** OpenID Connect (OAuth2 + identity layer) */\n  OPENID_CONNECT = \"openid_connect\",\n  \n  /** Mutual TLS (client certificates) */\n  MUTUAL_TLS = \"mutual_tls\",\n  \n  /** Frontend-specific secret (not exposed to user) */\n  FRONTEND_SECRET = \"frontend_secret\",\n}\n\n// =============================================================================\n// AUTH CONFIGURATION ENUMS\n// =============================================================================\n\nexport enum ExternalProvider_Auth_ApiKey_Location {\n  HEADER = \"header\",\n  QUERY = \"query\",\n  COOKIE = \"cookie\",\n}\n\nexport enum ExternalProvider_Auth_HMAC_Signature_Algorithm {\n  SHA256 = \"sha256\",\n  SHA512 = \"sha512\",\n}\n\nexport enum ExternalProvider_Auth_Bearer_Format {\n  JWT = \"jwt\",\n  API_KEY = \"api_key\",\n  OAUTH2_ACCESS_TOKEN = \"oauth2_access_token\",\n}\n\n// =============================================================================\n// AUTH CONFIGURATION SCHEMA\n// =============================================================================\n\n/**\n * Auth Configuration - references a secret\n * This is the runtime configuration that specifies which secret to use\n */\nexport const ExternalProvider_Auth_ConfigurationSchema = z.object({\n  /** Type of authentication */\n  authKind: z.enum(ExternalProvider_Auth_Kind),\n  \n  /** References to auth profiles this config applies to */\n  profileRefs: z.array(z.string()).optional(),\n  \n  /** Is this the default auth for the provider? */\n  isDefault: z.boolean().optional(),\n  \n  /** Reference to the secret (environment variable name or secret store key) */\n  secretRef: z.string(),\n});\n\n// =============================================================================\n// RATE LIMIT CONFIGURATION\n// =============================================================================\n\nexport const ExternalProvider_RateLimitConfigurationSchema = z.object({\n  /** Maximum concurrent requests */\n  maxConcurrent: z.number().positive().optional().default(10),\n  \n  /** Minimum time (ms) between requests */\n  minTime: z.number().positive().optional(),\n  \n  /** Request reservoir (bucket size) */\n  reservoir: z.number().positive().optional(),\n  \n  /** Reservoir refresh interval (ms) */\n  reservoirRefreshInterval: z.number().positive().optional(),\n  \n  /** Amount to add to reservoir on refresh */\n  reservoirRefreshAmount: z.number().positive().optional(),\n  \n  /** Request priority (higher = higher priority) */\n  priority: z.number().int().optional().default(0),\n});\n\n// =============================================================================\n// AUTH PROFILE BASE SCHEMA\n// =============================================================================\n\nexport const ExternalProvider_AuthProfile_BaseSchema = z.object({\n  /** Type of authentication */\n  kind: z.enum(ExternalProvider_Auth_Kind),\n  \n  /** Unique reference for this auth profile */\n  ref: z.string().optional(),\n  \n  /** Is this the default auth profile? */\n  isDefault: z.boolean().default(false),\n  \n  /** Where to place the authentication (header, query, cookie) */\n  location: z.enum(ExternalProvider_Auth_ApiKey_Location).default(ExternalProvider_Auth_ApiKey_Location.HEADER),\n  \n  /** Field name for the authentication */\n  locationField: z.string().default(\"Authorization\"),\n});\n\n// =============================================================================\n// INFERRED BASE TYPES\n// =============================================================================\n\nexport type ExternalProvider_RateLimitConfiguration = z.infer<typeof ExternalProvider_RateLimitConfigurationSchema>;\nexport type ExternalProvider_AuthProfile_Base = z.infer<typeof ExternalProvider_AuthProfile_BaseSchema>;\n\n// =============================================================================\n// DISCRIMINATED AUTH PROFILE SCHEMAS\n// =============================================================================\n\n/**\n * Complete Auth Profile Schema - discriminated union by kind\n * Each kind has specific configuration fields\n */\nexport const ExternalProvider_AuthProfile_Schema = z.discriminatedUnion(\"kind\", [\n  // ─── API Key Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.API_KEY),\n    locationField: z.string().default(\"Authorization\"),\n    /** Prefix before the key value (e.g., \"Api-Key \") */\n    prefix: z.string().optional(),\n  }),\n  \n  // ─── HMAC Signature Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.HMAC_SIGNATURE),\n    locationField: z.string().default(\"X-Signature\"),\n    /** HMAC algorithm */\n    algorithm: z.enum(ExternalProvider_Auth_HMAC_Signature_Algorithm).default(ExternalProvider_Auth_HMAC_Signature_Algorithm.SHA256),\n    /** What data to sign (body, timestamp, etc.) */\n    signaturePayload: z.enum(['body', 'timestamp', 'custom']).optional(),\n    /** Timestamp header name (if needed) */\n    timestampHeader: z.string().optional(),\n    /** Nonce header name (if needed for replay protection) */\n    nonceHeader: z.string().optional(),\n  }),\n  \n  // ─── Bearer Token Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.BEARER),\n    location: z.enum(ExternalProvider_Auth_ApiKey_Location).default(ExternalProvider_Auth_ApiKey_Location.HEADER),\n    locationField: z.string().default(\"Authorization\"),\n    /** Prefix (usually \"Bearer \") */\n    prefix: z.string().default(\"Bearer \"),\n    /** Token format */\n    format: z.enum(ExternalProvider_Auth_Bearer_Format).default(ExternalProvider_Auth_Bearer_Format.JWT),\n  }),\n  \n  // ─── OpenID Connect Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.OPENID_CONNECT),\n    /** OIDC Discovery URL */\n    discoveryUrl: z.url().optional(),\n    /** Issuer */\n    issuer: z.string().optional(),\n    /** Expected audience */\n    audience: z.string().optional(),\n    /** Token validation mode */\n    validationMode: z.enum(['jwks', 'introspection', 'local']).optional(),\n  }),\n  \n  // ─── OAuth2 Authentication (UNIFIED APPROACH) ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.OAUTH2),\n    \n    // ─── OAuth2 Provider Reference (Unified Approach) ───\n    /**\n     * Reference to OAuth2 provider definition\n     * Instead of duplicating OAuth2 config, reference the provider\n     * by its string identifier (e.g., \"google\", \"microsoft\")\n     */\n    oauth2ProviderRef: z.string().optional(),\n    \n    // ─── Inline OAuth2 Configuration (Legacy/Override) ───\n    /** Authorization URL (can be overridden or used when no ref) */\n    authUrl: z.url().optional(),\n    /** Token URL */\n    tokenUrl: z.url().optional(),\n    /** Refresh URL (if different from tokenUrl) */\n    refreshUrl: z.url().optional(),\n    \n    /** Required scopes for this auth profile */\n    scopes: z.array(z.string()).optional(),\n    \n    /** Preferred grant type */\n    grantType: z.enum(OAuth2_GrantType).optional(),\n    \n    /** Token endpoint auth method */\n    tokenEndpointAuthMethod: z.enum(OAuth2_TokenEndpoint_AuthMethod).optional(),\n    \n    /** PKCE support */\n    pkce: z.boolean().optional(),\n    /** PKCE method */\n    pkceMethod: z.enum(OAuth2_PKCE_Method).optional(),\n    \n    /** Prompt behavior */\n    prompt: z.enum(OAuth2_Prompt).optional(),\n    \n    /** Access type (online/offline) */\n    accessType: z.enum(OAuth2_AccessType).optional(),\n    \n    /** Extra authorization parameters */\n    extraAuthParams: z.record(z.string(), z.string()).optional(),\n    \n    /** Extra token parameters */\n    extraTokenParams: z.record(z.string(), z.string()).optional(),\n    \n    // ─── Token Format (for API calls) ───\n    /** How to format the token in Authorization header */\n    tokenFormat: z.enum(['bearer', 'token', 'oauth', 'custom']).default('bearer'),\n    /** Custom prefix if tokenFormat is 'custom' */\n    customTokenPrefix: z.string().optional(),\n  }),\n  \n  // ─── Basic Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.BASIC),\n    /** Username field reference */\n    usernameRef: z.string().optional(),\n    /** Password field reference */\n    passwordRef: z.string().optional(),\n  }),\n  \n  // ─── No Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.NONE),\n  }),\n  \n  // ─── Frontend Secret ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.FRONTEND_SECRET),\n    /** Secret is only used in frontend context */\n    frontendOnly: z.boolean().default(true),\n  }),\n  \n  // ─── Mutual TLS ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.MUTUAL_TLS),\n    /** Certificate reference */\n    certificateRef: z.string().optional(),\n    /** Private key reference */\n    privateKeyRef: z.string().optional(),\n    /** CA certificate reference */\n    caRef: z.string().optional(),\n  }),\n]);\nexport type ExternalProvider_AuthProfile = z.infer<typeof ExternalProvider_AuthProfile_Schema>;\n\n// =============================================================================\n// CONNECTION IDENTITY — whose account, on whose behalf, and which one\n// =============================================================================\n\n/**\n * WHOSE ACCOUNT a call spends.\n *\n * Distinct from the scope of the DATA the call touches, and conflating the two inverts the design.\n * A billing provider is APPLICATION-owned — the payment account belongs to whoever ships the\n * application — even though almost everything it produces is organization-shaped: a customer, a\n * subscription, an invoice per tenant. Those are data in the application's own domain, produced by\n * an application-owned account. The question here is never \"does this touch organizations?\", which\n * is true of nearly everything. It is **whose account is it?**\n *\n * Delivery follows the owner and is not a separate decision: the APPLICATION's material is authored\n * in the deployment environment by an operator, and an ORGANIZATION's or a USER's is authored\n * through the application's own settings and stored, sealed, in its database.\n *\n * **No owner ever defaults to another.** An organization-owned call with no connection REFUSES; it\n * never spends the application's account. A silent substitution means the vendor sees one identity\n * while the application believes it acted as another, and every artifact the call leaves on the far\n * side — a message, a record, a line in the vendor's own audit log — is then attributed to the wrong\n * party, with nothing downstream able to detect it. An application that wants \"the tenant's key when\n * they have connected one, otherwise ours\" expresses that in its own code by choosing which\n * connection to call with, where the choice is visible.\n */\nexport enum ExternalProvider_Connection_OwnerScope {\n  /** The account belongs to the application itself. Material comes from the deployment environment. */\n  APPLICATION = \"application\",\n  /** The account belongs to one tenant — its own workspace, its own subscription with the vendor. */\n  ORGANIZATION = \"organization\",\n  /** The account belongs to one person — a personal key they authored for themselves. */\n  USER = \"user\",\n}\n\n/**\n * WHAT A DECLARED SECRET IDENTIFIES — the integration, or the account.\n *\n * A provider's `secretsContract` holds two kinds of thing and, until this existed, marked neither.\n * Slack's contract is the clearest case: `SLACK_CLIENT_ID` and `SLACK_CLIENT_SECRET` identify the\n * APPLICATION's registration with Slack, while `SLACK_API_KEY` holds a token that identifies WHOSE\n * Slack account is being acted as. They are stored differently, rotated for different reasons, and\n * owned by different parties, and one undifferentiated map made all three look alike.\n *\n * Deliberately ORTHOGONAL to {@link ExternalProvider_Connection_OwnerScope}, which is the axis it is\n * most likely to be confused with. This says what a secret IS; that says whose it is. A billing\n * provider's secret key is a CREDENTIAL — it identifies an account — and is nonetheless\n * application-owned, because the only admissible connection for it is APPLICATION. Collapsing the\n * two would make \"the deployment owns this\" and \"this identifies an integration\" the same\n * statement, and they are not.\n *\n * What the distinction buys, concretely:\n *\n *   - a credential row owned by a tenant or a person may hold a CREDENTIAL and never a REGISTRATION.\n *     Without the mark, nothing stopped a tenant storing a row slugged `SLACK_CLIENT_SECRET` that no\n *     reader would ever consult — inert, and indistinguishable from a working connection on screen;\n *   - the connect flow can derive WHICH slug a grant is stored under by construction, rather than\n *     by the convention that it happens to be the REST contract's `apiKey.secretRef`;\n *   - a vendor that supports per-tenant app registrations becomes SAYABLE, which it is not today.\n */\nexport enum ExternalProvider_SecretScope {\n  /**\n   * Identifies the INTEGRATION — an OAuth2 client id and secret, a signing secret issued to the\n   * app's registration. Authored by the operator in the deployment environment.\n   */\n  REGISTRATION = \"registration\",\n  /**\n   * Identifies an ACCOUNT — a token or key standing for whoever is being acted as. May be authored\n   * in the environment (the deployment's own account) or minted into a credential row owned by a\n   * tenant or a person; which of those are permitted is the admissibility question, not this one.\n   */\n  CREDENTIAL = \"credential\",\n}\n\n/**\n * ON WHOSE BEHALF the act is performed — orthogonal to who owns the account.\n *\n * These are two questions and every combination of them is real, which is why they are two enums\n * rather than one. An application's service identity can impersonate a user (domain-wide\n * delegation); a tenant's own registration can mint a token that acts for one of its members; a\n * tenant's bot token acts as nobody in particular. Collapsing the pair into a single vocabulary\n * makes most of those unsayable:\n *\n * | owner × delegation | the real case |\n * |---|---|\n * | APPLICATION × SERVICE | a platform API key |\n * | APPLICATION × USER | the application's service identity impersonating a user |\n * | ORGANIZATION × SERVICE | the tenant's own bot or workspace token |\n * | ORGANIZATION × USER | ONE member's own account, linked for the whole organization |\n * | USER × SERVICE | a person's own account, for that person |\n *\n * ## `ORGANIZATION × USER`, decided 2026-09-12 (Paul, recorded on wildo-ai/wildo-ai#18)\n *\n * A member connects THEIR OWN vendor account on the organization's behalf — the common pattern that\n * lets a tenant integrate without a service account. There is ONE grant per organization, and every\n * member's call spends it transparently. The member who links it carries the responsibility for\n * that: they are trusting their colleagues' activity with their account, they ACKNOWLEDGE it when\n * they link, and that acknowledgement is the whole control — no per-call gate. What the audit trail\n * must then say, on every call, is WHOSE account was spent: the member who linked it.\n *\n * So the person behind this shape is fixed by the GRANT, not by the call, which is why a call never\n * names `actingForUserId` for it. The rejected readings are worth keeping: per-member grants keyed\n * `(organization, member)` is a real model and not what this shape means here; and requiring the\n * call to name the linking member would stop every other member using a grant that exists to be\n * shared. A person's connection for themselves is the USER-owned row.\n *\n * OAuth 2.0 carries the same split in its grant types: the client is the REGISTRATION, and the grant\n * decides on whose behalf a token is minted.\n */\nexport enum ExternalProvider_Connection_DelegationMode {\n  /** The call acts as the account's owner, with no third party behind it. */\n  SERVICE = \"service\",\n  /** The call acts for a named user, whose authorization is what makes it permissible. */\n  USER = \"user\",\n}\n\n/**\n * WHICH owner instance a single call spends — supplied BY THE CALL, never read from ambient context.\n *\n * This is the field's hardest constraint to get right and the reason it is a parameter rather than a\n * property of the execution. `ExecutionContext.initiatorIds` answers WHO is performing the operation\n * and `contextResourcesFieldIdentifier` answers WHICH ROWS are in scope; neither answers whose\n * account is being spent, and a design that borrows either is wrong for a case that is entirely\n * ordinary: one user action fanning out a message to every organization the user belongs to. One\n * initiator, one execution, N organizations, a different account per call. An ambient answer cannot\n * vary within one execution, so it cannot express that at all.\n *\n * The initiator is still decisive — as the AUTHORIZATION input. The call names the owner and the\n * runtime asks whether this initiator may act for it. Supplying and authorizing are different jobs,\n * and the resolver cannot verify a target it also invented.\n */\nexport const ExternalProvider_ConnectionShapeSchema = z.object({\n  ownerScope: z.enum(ExternalProvider_Connection_OwnerScope),\n  delegation: z.enum(ExternalProvider_Connection_DelegationMode)\n    .default(ExternalProvider_Connection_DelegationMode.SERVICE),\n});\n\n/**\n * A connection COMBINATION, with no instance attached — what a provider ADMITS.\n *\n * The capability and the call are the same two axes and different objects, which is why this is a\n * separate schema rather than the target with its identifiers made optional. A provider admitting\n * `ORGANIZATION × USER` says nothing about which organization; a call naming no organization is\n * incomplete. Making one schema serve both would have to relax exactly the refinements that make the\n * call safe.\n */\nexport type ExternalProvider_ConnectionShape = z.infer<typeof ExternalProvider_ConnectionShapeSchema>;\n\nexport const ExternalProvider_ConnectionTargetSchema = ExternalProvider_ConnectionShapeSchema.extend({\n  /**\n   * The organization or user whose account is spent. Absent for APPLICATION, which has exactly one\n   * instance by construction — an id there would be a second name for the deployment.\n   */\n  ownerId: z.string().optional(),\n  /**\n   * The user an APPLICATION-owned, USER-delegated call impersonates — the ONLY shape where the call\n   * itself must say who, because the application's identity could impersonate anyone.\n   *\n   * Refused everywhere else. An ORGANIZATION-owned USER-delegated connection spends the account of\n   * the member who LINKED it, whoever triggers the call (see the decision above), so a person named\n   * here would describe an identity the runtime will not act as. A USER-owned connection already\n   * names its person in `ownerId`.\n   */\n  actingForUserId: z.string().optional(),\n}).superRefine((target, ctx) => {\n  const ownerIsInstance = target.ownerScope !== ExternalProvider_Connection_OwnerScope.APPLICATION;\n  if (ownerIsInstance && (target.ownerId === undefined || target.ownerId === '')) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['ownerId'],\n      message: `A ${target.ownerScope}-owned connection names WHICH ${target.ownerScope}; a call that omits it has not said whose account it spends.`,\n    });\n  }\n  if (!ownerIsInstance && target.ownerId !== undefined) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['ownerId'],\n      message: 'An application-owned connection has exactly one instance, so an ownerId here names something that does not exist.',\n    });\n  }\n  if (connectionTargetNamesActingUser(target)) {\n    if (target.actingForUserId === undefined || target.actingForUserId === '') {\n      ctx.addIssue({\n        code: 'custom',\n        path: ['actingForUserId'],\n        message: 'An application-owned delegated call impersonates someone, and who is what makes it permissible — it cannot be left to be inferred.',\n      });\n    }\n  } else if (target.actingForUserId !== undefined) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['actingForUserId'],\n      message: target.delegation === ExternalProvider_Connection_DelegationMode.USER\n        ? `A ${target.ownerScope}-owned connection's person is fixed by the account itself — the member who linked it, or the owner. `\n          + 'Naming a user here describes an identity the runtime will not act as.'\n        : 'A SERVICE call acts for nobody. Naming a user here reads as delegation the runtime will not perform, which is worse than an error: the call succeeds as the wrong identity.',\n    });\n  }\n});\n\n/**\n * Whether a connection target must NAME the user it acts for — true only for APPLICATION × USER.\n *\n * One predicate rather than a condition restated at each builder: the target schema, the HTTP-API\n * binding's target builder and the connect panel all ask this question, and three spellings of it\n * are how a target comes to carry a person the refinement then refuses.\n */\nexport function connectionTargetNamesActingUser(shape: ExternalProvider_ConnectionShape): boolean {\n  return shape.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION\n    && shape.delegation === ExternalProvider_Connection_DelegationMode.USER;\n}\n\n/**\n * Whether linking this connection lends ONE member's own account to their whole organization —\n * true only for ORGANIZATION × USER.\n *\n * The member who links such a connection is trusting every colleague's activity with their account,\n * so the connect surface asks them to ACKNOWLEDGE it and the connect leg refuses a link that did not\n * (decision on wildo-ai/wildo-ai#18). One predicate for the panel that shows the acknowledgement and\n * the controller that requires it, so the two cannot come to disagree about which links owe one.\n */\nexport function connectionLendsMemberAccountToOrganization(shape: ExternalProvider_ConnectionShape): boolean {\n  return shape.ownerScope === ExternalProvider_Connection_OwnerScope.ORGANIZATION\n    && shape.delegation === ExternalProvider_Connection_DelegationMode.USER;\n}\n\nexport type ExternalProvider_ConnectionTarget = z.infer<typeof ExternalProvider_ConnectionTargetSchema>;\n"]}
+{"version":3,"file":"security.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../../src/core/security.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,+BAA+B,EAC/B,kBAAkB,EAClB,aAAa,EACb,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAExB,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAN,IAAY,0BA2BX;AA3BD,WAAY,0BAA0B;IACpC,iCAAiC;IACjC,2CAAa,CAAA;IAEb,0CAA0C;IAC1C,iDAAmB,CAAA;IAEnB,gDAAgD;IAChD,+CAAiB,CAAA;IAEjB,gCAAgC;IAChC,6CAAe,CAAA;IAEf,kEAAkE;IAClE,+CAAiB,CAAA;IAEjB,0CAA0C;IAC1C,+DAAiC,CAAA;IAEjC,+CAA+C;IAC/C,+DAAiC,CAAA;IAEjC,uCAAuC;IACvC,uDAAyB,CAAA;IAEzB,qDAAqD;IACrD,iEAAmC,CAAA;AACrC,CAAC,EA3BW,0BAA0B,KAA1B,0BAA0B,QA2BrC;AAED,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,MAAM,CAAN,IAAY,qCAIX;AAJD,WAAY,qCAAqC;IAC/C,0DAAiB,CAAA;IACjB,wDAAe,CAAA;IACf,0DAAiB,CAAA;AACnB,CAAC,EAJW,qCAAqC,KAArC,qCAAqC,QAIhD;AAED,MAAM,CAAN,IAAY,8CAGX;AAHD,WAAY,8CAA8C;IACxD,mEAAiB,CAAA;IACjB,mEAAiB,CAAA;AACnB,CAAC,EAHW,8CAA8C,KAA9C,8CAA8C,QAGzD;AAED,MAAM,CAAN,IAAY,mCAIX;AAJD,WAAY,mCAAmC;IAC7C,kDAAW,CAAA;IACX,0DAAmB,CAAA;IACnB,kFAA2C,CAAA;AAC7C,CAAC,EAJW,mCAAmC,KAAnC,mCAAmC,QAI9C;AAED,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,6BAA6B;IAC7B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAE5C,yDAAyD;IACzD,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE3C,iDAAiD;IACjD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEjC,8EAA8E;IAC9E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,CAAC,MAAM,CAAC;IACpE,kCAAkC;IAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE3D,yCAAyC;IACzC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAEzC,sCAAsC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE3C,sCAAsC;IACtC,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE1D,4CAA4C;IAC5C,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAExD,kDAAkD;IAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;CACjD,CAAC,CAAC;AAEH,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9D,6BAA6B;IAC7B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAExC,6CAA6C;IAC7C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1B,wCAAwC;IACxC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAErC,gEAAgE;IAChE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,MAAM,CAAC;IAE7G,wCAAwC;IACxC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;CACnD,CAAC,CAAC;AASH,gFAAgF;AAChF,qCAAqC;AACrC,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC9E,iCAAiC;IACjC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,OAAO,CAAC;QACnD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;QAClD,qDAAqD;QACrD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC;IAEF,wCAAwC;IACxC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,cAAc,CAAC;QAC1D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;QAChD,qBAAqB;QACrB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC,OAAO,CAAC,8CAA8C,CAAC,MAAM,CAAC;QAChI,gDAAgD;QAChD,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;QACpE,wCAAwC;QACxC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACtC,0DAA0D;QAC1D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC;IAEF,sCAAsC;IACtC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,MAAM,CAAC;QAClD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,MAAM,CAAC;QAC7G,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;QAClD,iCAAiC;QACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACrC,mBAAmB;QACnB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC,OAAO,CAAC,mCAAmC,CAAC,GAAG,CAAC;KACrG,CAAC;IAEF,wCAAwC;IACxC,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,cAAc,CAAC;QAC1D,yBAAyB;QACzB,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAChC,aAAa;QACb,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,wBAAwB;QACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,4BAA4B;QAC5B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;KACtE,CAAC;IAEF,mDAAmD;IACnD,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,MAAM,CAAC;QAElD,uDAAuD;QACvD;;;;WAIG;QACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAExC,wDAAwD;QACxD,gEAAgE;QAChE,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC3B,gBAAgB;QAChB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC5B,+CAA+C;QAC/C,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAE9B,4CAA4C;QAC5C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAEtC,2BAA2B;QAC3B,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;QAE9C,iCAAiC;QACjC,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,QAAQ,EAAE;QAE3E,mBAAmB;QACnB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC5B,kBAAkB;QAClB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;QAEjD,sBAAsB;QACtB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;QAExC,mCAAmC;QACnC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;QAEhD,qCAAqC;QACrC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAE5D,6BAA6B;QAC7B,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAE7D,uCAAuC;QACvC,sDAAsD;QACtD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC7E,+CAA+C;QAC/C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACzC,CAAC;IAEF,+BAA+B;IAC/B,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,KAAK,CAAC;QACjD,+BAA+B;QAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,+BAA+B;QAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC;IAEF,4BAA4B;IAC5B,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC;KACjD,CAAC;IAEF,0BAA0B;IAC1B,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,eAAe,CAAC;QAC3D,8CAA8C;QAC9C,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KACxC,CAAC;IAEF,qBAAqB;IACrB,uCAAuC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,UAAU,CAAC;QACtD,4BAA4B;QAC5B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACrC,4BAA4B;QAC5B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpC,+BAA+B;QAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC7B,CAAC;CACH,CAAC,CAAC;AAGH,gFAAgF;AAChF,sEAAsE;AACtE,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAN,IAAY,sCAOX;AAPD,WAAY,sCAAsC;IAChD,qGAAqG;IACrG,qEAA2B,CAAA;IAC3B,mGAAmG;IACnG,uEAA6B,CAAA;IAC7B,uFAAuF;IACvF,uDAAa,CAAA;AACf,CAAC,EAPW,sCAAsC,KAAtC,sCAAsC,QAOjD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAN,IAAY,4BAYX;AAZD,WAAY,4BAA4B;IACtC;;;OAGG;IACH,6DAA6B,CAAA;IAC7B;;;;OAIG;IACH,yDAAyB,CAAA;AAC3B,CAAC,EAZW,4BAA4B,KAA5B,4BAA4B,QAYvC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,CAAN,IAAY,0CAKX;AALD,WAAY,0CAA0C;IACpD,2EAA2E;IAC3E,iEAAmB,CAAA;IACnB,wFAAwF;IACxF,2DAAa,CAAA;AACf,CAAC,EALW,0CAA0C,KAA1C,0CAA0C,QAKrD;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC;IAC1D,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,0CAA0C,CAAC;SAC3D,OAAO,CAAC,0CAA0C,CAAC,OAAO,CAAC;CAC/D,CAAC,CAAC;AAaH,MAAM,CAAC,MAAM,uCAAuC,GAAG,sCAAsC,CAAC,MAAM,CAAC;IACnG;;;OAGG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B;;;;;;;;OAQG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,eAAe,GAAG,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW,CAAC;IACjG,IAAI,eAAe,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,EAAE,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,OAAO,EAAE,KAAK,MAAM,CAAC,UAAU,iCAAiC,MAAM,CAAC,UAAU,8DAA8D;SAChJ,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACrD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,OAAO,EAAE,mHAAmH;SAC7H,CAAC,CAAC;IACL,CAAC;IACD,IAAI,+BAA+B,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,IAAI,MAAM,CAAC,eAAe,KAAK,EAAE,EAAE,CAAC;YAC1E,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;gBACzB,OAAO,EAAE,oIAAoI;aAC9I,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAChD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EAAE,MAAM,CAAC,UAAU,KAAK,0CAA0C,CAAC,IAAI;gBAC5E,CAAC,CAAC,KAAK,MAAM,CAAC,UAAU,sGAAsG;sBAC1H,uEAAuE;gBAC3E,CAAC,CAAC,6KAA6K;SAClL,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAAuC;IACrF,OAAO,KAAK,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW;WACzE,KAAK,CAAC,UAAU,KAAK,0CAA0C,CAAC,IAAI,CAAC;AAC5E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0CAA0C,CAAC,KAAuC;IAChG,OAAO,KAAK,CAAC,UAAU,KAAK,sCAAsC,CAAC,YAAY;WAC1E,KAAK,CAAC,UAAU,KAAK,0CAA0C,CAAC,IAAI,CAAC;AAC5E,CAAC","sourcesContent":["/**\n * Security and Authentication Schemas for External Connectors\n * \n * This module defines authentication profiles that can be used across protocols.\n * It integrates with OAuth2 to avoid duplication between API auth and OAuth2 config.\n * \n * Architecture:\n * - ExternalProvider_Auth_Kind: The type of authentication\n * - ExternalProvider_AuthProfile: How to authenticate with an API\n * - OAuth2-linked profiles: Reference OAuth2 config instead of duplicating\n * \n * @see https://swagger.io/docs/specification/v3_0/authentication/\n */\n\nimport { z } from \"zod\";\nimport {\n  OAuth2_GrantType,\n  OAuth2_TokenEndpoint_AuthMethod,\n  OAuth2_PKCE_Method,\n  OAuth2_Prompt,\n  OAuth2_AccessType,\n} from './oauth2.enums';\n\n// =============================================================================\n// AUTH KIND ENUM\n// =============================================================================\n\n/**\n * Authentication types supported by external providers\n * Follows OpenAPI 3.0 Security Schemes with extensions\n */\nexport enum ExternalProvider_Auth_Kind {\n  /** No authentication required */\n  NONE = \"none\",\n  \n  /** API Key in header, query, or cookie */\n  API_KEY = \"api_key\",\n  \n  /** Bearer token (OAuth2 access token or JWT) */\n  BEARER = \"bearer\",\n  \n  /** HTTP Basic authentication */\n  BASIC = \"basic\",\n  \n  /** OAuth2 authentication - links to OAuth2 provider definition */\n  OAUTH2 = \"oauth2\",\n  \n  /** HMAC signature-based authentication */\n  HMAC_SIGNATURE = \"hmac_signature\",\n  \n  /** OpenID Connect (OAuth2 + identity layer) */\n  OPENID_CONNECT = \"openid_connect\",\n  \n  /** Mutual TLS (client certificates) */\n  MUTUAL_TLS = \"mutual_tls\",\n  \n  /** Frontend-specific secret (not exposed to user) */\n  FRONTEND_SECRET = \"frontend_secret\",\n}\n\n// =============================================================================\n// AUTH CONFIGURATION ENUMS\n// =============================================================================\n\nexport enum ExternalProvider_Auth_ApiKey_Location {\n  HEADER = \"header\",\n  QUERY = \"query\",\n  COOKIE = \"cookie\",\n}\n\nexport enum ExternalProvider_Auth_HMAC_Signature_Algorithm {\n  SHA256 = \"sha256\",\n  SHA512 = \"sha512\",\n}\n\nexport enum ExternalProvider_Auth_Bearer_Format {\n  JWT = \"jwt\",\n  API_KEY = \"api_key\",\n  OAUTH2_ACCESS_TOKEN = \"oauth2_access_token\",\n}\n\n// =============================================================================\n// AUTH CONFIGURATION SCHEMA\n// =============================================================================\n\n/**\n * Auth Configuration - references a secret\n * This is the runtime configuration that specifies which secret to use\n */\nexport const ExternalProvider_Auth_ConfigurationSchema = z.object({\n  /** Type of authentication */\n  authKind: z.enum(ExternalProvider_Auth_Kind),\n  \n  /** References to auth profiles this config applies to */\n  profileRefs: z.array(z.string()).optional(),\n  \n  /** Is this the default auth for the provider? */\n  isDefault: z.boolean().optional(),\n  \n  /** Reference to the secret (environment variable name or secret store key) */\n  secretRef: z.string(),\n});\n\n// =============================================================================\n// RATE LIMIT CONFIGURATION\n// =============================================================================\n\nexport const ExternalProvider_RateLimitConfigurationSchema = z.object({\n  /** Maximum concurrent requests */\n  maxConcurrent: z.number().positive().optional().default(10),\n  \n  /** Minimum time (ms) between requests */\n  minTime: z.number().positive().optional(),\n  \n  /** Request reservoir (bucket size) */\n  reservoir: z.number().positive().optional(),\n  \n  /** Reservoir refresh interval (ms) */\n  reservoirRefreshInterval: z.number().positive().optional(),\n  \n  /** Amount to add to reservoir on refresh */\n  reservoirRefreshAmount: z.number().positive().optional(),\n  \n  /** Request priority (higher = higher priority) */\n  priority: z.number().int().optional().default(0),\n});\n\n// =============================================================================\n// AUTH PROFILE BASE SCHEMA\n// =============================================================================\n\nexport const ExternalProvider_AuthProfile_BaseSchema = z.object({\n  /** Type of authentication */\n  kind: z.enum(ExternalProvider_Auth_Kind),\n  \n  /** Unique reference for this auth profile */\n  ref: z.string().optional(),\n  \n  /** Is this the default auth profile? */\n  isDefault: z.boolean().default(false),\n  \n  /** Where to place the authentication (header, query, cookie) */\n  location: z.enum(ExternalProvider_Auth_ApiKey_Location).default(ExternalProvider_Auth_ApiKey_Location.HEADER),\n  \n  /** Field name for the authentication */\n  locationField: z.string().default(\"Authorization\"),\n});\n\n// =============================================================================\n// INFERRED BASE TYPES\n// =============================================================================\n\nexport type ExternalProvider_RateLimitConfiguration = z.infer<typeof ExternalProvider_RateLimitConfigurationSchema>;\nexport type ExternalProvider_AuthProfile_Base = z.infer<typeof ExternalProvider_AuthProfile_BaseSchema>;\n\n// =============================================================================\n// DISCRIMINATED AUTH PROFILE SCHEMAS\n// =============================================================================\n\n/**\n * Complete Auth Profile Schema - discriminated union by kind\n * Each kind has specific configuration fields\n */\nexport const ExternalProvider_AuthProfile_Schema = z.discriminatedUnion(\"kind\", [\n  // ─── API Key Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.API_KEY),\n    locationField: z.string().default(\"Authorization\"),\n    /** Prefix before the key value (e.g., \"Api-Key \") */\n    prefix: z.string().optional(),\n  }),\n  \n  // ─── HMAC Signature Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.HMAC_SIGNATURE),\n    locationField: z.string().default(\"X-Signature\"),\n    /** HMAC algorithm */\n    algorithm: z.enum(ExternalProvider_Auth_HMAC_Signature_Algorithm).default(ExternalProvider_Auth_HMAC_Signature_Algorithm.SHA256),\n    /** What data to sign (body, timestamp, etc.) */\n    signaturePayload: z.enum(['body', 'timestamp', 'custom']).optional(),\n    /** Timestamp header name (if needed) */\n    timestampHeader: z.string().optional(),\n    /** Nonce header name (if needed for replay protection) */\n    nonceHeader: z.string().optional(),\n  }),\n  \n  // ─── Bearer Token Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.BEARER),\n    location: z.enum(ExternalProvider_Auth_ApiKey_Location).default(ExternalProvider_Auth_ApiKey_Location.HEADER),\n    locationField: z.string().default(\"Authorization\"),\n    /** Prefix (usually \"Bearer \") */\n    prefix: z.string().default(\"Bearer \"),\n    /** Token format */\n    format: z.enum(ExternalProvider_Auth_Bearer_Format).default(ExternalProvider_Auth_Bearer_Format.JWT),\n  }),\n  \n  // ─── OpenID Connect Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.OPENID_CONNECT),\n    /** OIDC Discovery URL */\n    discoveryUrl: z.url().optional(),\n    /** Issuer */\n    issuer: z.string().optional(),\n    /** Expected audience */\n    audience: z.string().optional(),\n    /** Token validation mode */\n    validationMode: z.enum(['jwks', 'introspection', 'local']).optional(),\n  }),\n  \n  // ─── OAuth2 Authentication (UNIFIED APPROACH) ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.OAUTH2),\n    \n    // ─── OAuth2 Provider Reference (Unified Approach) ───\n    /**\n     * Reference to OAuth2 provider definition\n     * Instead of duplicating OAuth2 config, reference the provider\n     * by its string identifier (e.g., \"google\", \"microsoft\")\n     */\n    oauth2ProviderRef: z.string().optional(),\n    \n    // ─── Inline OAuth2 Configuration (Legacy/Override) ───\n    /** Authorization URL (can be overridden or used when no ref) */\n    authUrl: z.url().optional(),\n    /** Token URL */\n    tokenUrl: z.url().optional(),\n    /** Refresh URL (if different from tokenUrl) */\n    refreshUrl: z.url().optional(),\n    \n    /** Required scopes for this auth profile */\n    scopes: z.array(z.string()).optional(),\n    \n    /** Preferred grant type */\n    grantType: z.enum(OAuth2_GrantType).optional(),\n    \n    /** Token endpoint auth method */\n    tokenEndpointAuthMethod: z.enum(OAuth2_TokenEndpoint_AuthMethod).optional(),\n    \n    /** PKCE support */\n    pkce: z.boolean().optional(),\n    /** PKCE method */\n    pkceMethod: z.enum(OAuth2_PKCE_Method).optional(),\n    \n    /** Prompt behavior */\n    prompt: z.enum(OAuth2_Prompt).optional(),\n    \n    /** Access type (online/offline) */\n    accessType: z.enum(OAuth2_AccessType).optional(),\n    \n    /** Extra authorization parameters */\n    extraAuthParams: z.record(z.string(), z.string()).optional(),\n    \n    /** Extra token parameters */\n    extraTokenParams: z.record(z.string(), z.string()).optional(),\n    \n    // ─── Token Format (for API calls) ───\n    /** How to format the token in Authorization header */\n    tokenFormat: z.enum(['bearer', 'token', 'oauth', 'custom']).default('bearer'),\n    /** Custom prefix if tokenFormat is 'custom' */\n    customTokenPrefix: z.string().optional(),\n  }),\n  \n  // ─── Basic Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.BASIC),\n    /** Username field reference */\n    usernameRef: z.string().optional(),\n    /** Password field reference */\n    passwordRef: z.string().optional(),\n  }),\n  \n  // ─── No Authentication ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.NONE),\n  }),\n  \n  // ─── Frontend Secret ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.FRONTEND_SECRET),\n    /** Secret is only used in frontend context */\n    frontendOnly: z.boolean().default(true),\n  }),\n  \n  // ─── Mutual TLS ───\n  ExternalProvider_AuthProfile_BaseSchema.extend({\n    kind: z.literal(ExternalProvider_Auth_Kind.MUTUAL_TLS),\n    /** Certificate reference */\n    certificateRef: z.string().optional(),\n    /** Private key reference */\n    privateKeyRef: z.string().optional(),\n    /** CA certificate reference */\n    caRef: z.string().optional(),\n  }),\n]);\nexport type ExternalProvider_AuthProfile = z.infer<typeof ExternalProvider_AuthProfile_Schema>;\n\n// =============================================================================\n// CONNECTION IDENTITY — whose account, on whose behalf, and which one\n// =============================================================================\n\n/**\n * WHOSE ACCOUNT a call spends.\n *\n * Distinct from the scope of the DATA the call touches, and conflating the two inverts the design.\n * A billing provider is APPLICATION-owned — the payment account belongs to whoever ships the\n * application — even though almost everything it produces is organization-shaped: a customer, a\n * subscription, an invoice per tenant. Those are data in the application's own domain, produced by\n * an application-owned account. The question here is never \"does this touch organizations?\", which\n * is true of nearly everything. It is **whose account is it?**\n *\n * Delivery follows the owner and is not a separate decision: the APPLICATION's material is authored\n * in the deployment environment by an operator, and an ORGANIZATION's or a USER's is authored\n * through the application's own settings and stored, sealed, in its database.\n *\n * **No owner ever defaults to another.** An organization-owned call with no connection REFUSES; it\n * never spends the application's account. A silent substitution means the vendor sees one identity\n * while the application believes it acted as another, and every artifact the call leaves on the far\n * side — a message, a record, a line in the vendor's own audit log — is then attributed to the wrong\n * party, with nothing downstream able to detect it. An application that wants \"the tenant's key when\n * they have connected one, otherwise ours\" expresses that in its own code by choosing which\n * connection to call with, where the choice is visible.\n */\nexport enum ExternalProvider_Connection_OwnerScope {\n  /** The account belongs to the application itself. Material comes from the deployment environment. */\n  APPLICATION = \"application\",\n  /** The account belongs to one tenant — its own workspace, its own subscription with the vendor. */\n  ORGANIZATION = \"organization\",\n  /** The account belongs to one person — a personal key they authored for themselves. */\n  USER = \"user\",\n}\n\n/**\n * WHAT A DECLARED SECRET IDENTIFIES — the integration, or the account.\n *\n * A provider's `secretsContract` holds two kinds of thing and, until this existed, marked neither.\n * Slack's contract is the clearest case: `SLACK_CLIENT_ID` and `SLACK_CLIENT_SECRET` identify the\n * APPLICATION's registration with Slack, while `SLACK_API_KEY` holds a token that identifies WHOSE\n * Slack account is being acted as. They are stored differently, rotated for different reasons, and\n * owned by different parties, and one undifferentiated map made all three look alike.\n *\n * Deliberately ORTHOGONAL to {@link ExternalProvider_Connection_OwnerScope}, which is the axis it is\n * most likely to be confused with. This says what a secret IS; that says whose it is. A billing\n * provider's secret key is a CREDENTIAL — it identifies an account — and is nonetheless\n * application-owned, because the only admissible connection for it is APPLICATION. Collapsing the\n * two would make \"the deployment owns this\" and \"this identifies an integration\" the same\n * statement, and they are not.\n *\n * What the distinction buys, concretely:\n *\n *   - a credential row owned by a tenant or a person may hold a CREDENTIAL and never a REGISTRATION.\n *     Without the mark, nothing stopped a tenant storing a row slugged `SLACK_CLIENT_SECRET` that no\n *     reader would ever consult — inert, and indistinguishable from a working connection on screen;\n *   - the connect flow can derive WHICH slug a grant is stored under by construction, rather than\n *     by the convention that it happens to be the REST contract's `apiKey.secretRef`;\n *   - a vendor that supports per-tenant app registrations becomes SAYABLE, which it is not today.\n */\nexport enum ExternalProvider_SecretScope {\n  /**\n   * Identifies the INTEGRATION — an OAuth2 client id and secret, a signing secret issued to the\n   * app's registration. Authored by the operator in the deployment environment.\n   */\n  REGISTRATION = \"registration\",\n  /**\n   * Identifies an ACCOUNT — a token or key standing for whoever is being acted as. May be authored\n   * in the environment (the deployment's own account) or minted into a credential row owned by a\n   * tenant or a person; which of those are permitted is the admissibility question, not this one.\n   */\n  CREDENTIAL = \"credential\",\n}\n\n/**\n * ON WHOSE BEHALF the act is performed — orthogonal to who owns the account.\n *\n * These are two questions and every combination of them is real, which is why they are two enums\n * rather than one. An application's service identity can impersonate a user (domain-wide\n * delegation); a tenant's own registration can mint a token that acts for one of its members; a\n * tenant's bot token acts as nobody in particular. Collapsing the pair into a single vocabulary\n * makes most of those unsayable:\n *\n * | owner × delegation | the real case |\n * |---|---|\n * | APPLICATION × SERVICE | a platform API key |\n * | APPLICATION × USER | the application's service identity impersonating a user |\n * | ORGANIZATION × SERVICE | the tenant's own bot or workspace token |\n * | ORGANIZATION × USER | ONE member's own account, linked for the whole organization |\n * | USER × SERVICE | a person's own account, for that person |\n *\n * ## `ORGANIZATION × USER`, decided 2026-09-12 (Paul, recorded on wildo-ai/wildo-ai#18)\n *\n * A member connects THEIR OWN vendor account on the organization's behalf — the common pattern that\n * lets a tenant integrate without a service account. There is ONE grant per organization, and every\n * member's call spends it transparently. The member who links it carries the responsibility for\n * that: they are trusting their colleagues' activity with their account, they ACKNOWLEDGE it when\n * they link, and that acknowledgement is the whole control — no per-call gate. What the audit trail\n * must then say, on every call, is WHOSE account was spent: the member who linked it.\n *\n * So the person behind this shape is fixed by the GRANT, not by the call, which is why a call never\n * names `actingForUserId` for it. The rejected readings are worth keeping: per-member grants keyed\n * `(organization, member)` is a real model and not what this shape means here; and requiring the\n * call to name the linking member would stop every other member using a grant that exists to be\n * shared. A person's connection for themselves is the USER-owned row.\n *\n * OAuth 2.0 carries the same split in its grant types: the client is the REGISTRATION, and the grant\n * decides on whose behalf a token is minted.\n */\nexport enum ExternalProvider_Connection_DelegationMode {\n  /** The call acts as the account's owner, with no third party behind it. */\n  SERVICE = \"service\",\n  /** The call acts for a named user, whose authorization is what makes it permissible. */\n  USER = \"user\",\n}\n\n/**\n * WHICH owner instance a single call spends — supplied BY THE CALL, never read from ambient context.\n *\n * This is the field's hardest constraint to get right and the reason it is a parameter rather than a\n * property of the execution. `ExecutionContext.initiatorIds` answers WHO is performing the operation\n * and `contextResourcesFieldIdentifier` answers WHICH ROWS are in scope; neither answers whose\n * account is being spent, and a design that borrows either is wrong for a case that is entirely\n * ordinary: one user action fanning out a message to every organization the user belongs to. One\n * initiator, one execution, N organizations, a different account per call. An ambient answer cannot\n * vary within one execution, so it cannot express that at all.\n *\n * The initiator is still decisive — as the AUTHORIZATION input. The call names the owner and the\n * runtime asks whether this initiator may act for it. Supplying and authorizing are different jobs,\n * and the resolver cannot verify a target it also invented.\n */\nexport const ExternalProvider_ConnectionShapeSchema = z.object({\n  ownerScope: z.enum(ExternalProvider_Connection_OwnerScope),\n  delegation: z.enum(ExternalProvider_Connection_DelegationMode)\n    .default(ExternalProvider_Connection_DelegationMode.SERVICE),\n});\n\n/**\n * A connection COMBINATION, with no instance attached — what a provider ADMITS.\n *\n * The capability and the call are the same two axes and different objects, which is why this is a\n * separate schema rather than the target with its identifiers made optional. A provider admitting\n * `ORGANIZATION × USER` says nothing about which organization; a call naming no organization is\n * incomplete. Making one schema serve both would have to relax exactly the refinements that make the\n * call safe.\n */\nexport type ExternalProvider_ConnectionShape = z.infer<typeof ExternalProvider_ConnectionShapeSchema>;\n\nexport const ExternalProvider_ConnectionTargetSchema = ExternalProvider_ConnectionShapeSchema.extend({\n  /**\n   * The organization or user whose account is spent. Absent for APPLICATION, which has exactly one\n   * instance by construction — an id there would be a second name for the deployment.\n   */\n  ownerId: z.string().optional(),\n  /**\n   * The user an APPLICATION-owned, USER-delegated call impersonates — the ONLY shape where the call\n   * itself must say who, because the application's identity could impersonate anyone.\n   *\n   * Refused everywhere else. An ORGANIZATION-owned USER-delegated connection spends the account of\n   * the member who LINKED it, whoever triggers the call (see the decision above), so a person named\n   * here would describe an identity the runtime will not act as. A USER-owned connection already\n   * names its person in `ownerId`.\n   */\n  actingForUserId: z.string().optional(),\n}).superRefine((target, ctx) => {\n  const ownerIsInstance = target.ownerScope !== ExternalProvider_Connection_OwnerScope.APPLICATION;\n  if (ownerIsInstance && (target.ownerId === undefined || target.ownerId === '')) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['ownerId'],\n      message: `A ${target.ownerScope}-owned connection names WHICH ${target.ownerScope}; a call that omits it has not said whose account it spends.`,\n    });\n  }\n  if (!ownerIsInstance && target.ownerId !== undefined) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['ownerId'],\n      message: 'An application-owned connection has exactly one instance, so an ownerId here names something that does not exist.',\n    });\n  }\n  if (connectionTargetNamesActingUser(target)) {\n    if (target.actingForUserId === undefined || target.actingForUserId === '') {\n      ctx.addIssue({\n        code: 'custom',\n        path: ['actingForUserId'],\n        message: 'An application-owned delegated call impersonates someone, and who is what makes it permissible — it cannot be left to be inferred.',\n      });\n    }\n  } else if (target.actingForUserId !== undefined) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['actingForUserId'],\n      message: target.delegation === ExternalProvider_Connection_DelegationMode.USER\n        ? `A ${target.ownerScope}-owned connection's person is fixed by the account itself — the member who linked it, or the owner. `\n          + 'Naming a user here describes an identity the runtime will not act as.'\n        : 'A SERVICE call acts for nobody. Naming a user here reads as delegation the runtime will not perform, which is worse than an error: the call succeeds as the wrong identity.',\n    });\n  }\n});\n\n/**\n * Whether a connection target must NAME the user it acts for — true only for APPLICATION × USER.\n *\n * One predicate rather than a condition restated at each builder: the target schema, the HTTP-API\n * binding's target builder and the connect panel all ask this question, and three spellings of it\n * are how a target comes to carry a person the refinement then refuses.\n */\nexport function connectionTargetNamesActingUser(shape: ExternalProvider_ConnectionShape): boolean {\n  return shape.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION\n    && shape.delegation === ExternalProvider_Connection_DelegationMode.USER;\n}\n\n/**\n * Whether linking this connection lends ONE member's own account to their whole organization —\n * true only for ORGANIZATION × USER.\n *\n * The member who links such a connection is trusting every colleague's activity with their account,\n * so the connect surface asks them to ACKNOWLEDGE it and the connect leg refuses a link that did not\n * (decision on wildo-ai/wildo-ai#18). One predicate for the panel that shows the acknowledgement and\n * the controller that requires it, so the two cannot come to disagree about which links owe one.\n */\nexport function connectionLendsMemberAccountToOrganization(shape: ExternalProvider_ConnectionShape): boolean {\n  return shape.ownerScope === ExternalProvider_Connection_OwnerScope.ORGANIZATION\n    && shape.delegation === ExternalProvider_Connection_DelegationMode.USER;\n}\n\nexport type ExternalProvider_ConnectionTarget = z.infer<typeof ExternalProvider_ConnectionTargetSchema>;\n"]}

package/dist/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mDAAmD,CAAC;AAClE,cAAc,oDAAoD,CAAC;AACnE,cAAc,sDAAsD,CAAC;AAKrE,cAAc,iEAAiE,CAAC;AAChF,cAAc,oEAAoE,CAAC;AAGnF,cAAc,sEAAsE,CAAC;AACrF,cAAc,oEAAoE,CAAC;AACnF,cAAc,sDAAsD,CAAC;AACrE,cAAc,8CAA8C,CAAC;AAC7D,cAAc,sDAAsD,CAAC;AACrE,cAAc,2DAA2D,CAAC;AAC1E,cAAc,sDAAsD,CAAC;AACrE,cAAc,yDAAyD,CAAC;AACxE,cAAc,sDAAsD,CAAC;AACrE,cAAc,oDAAoD,CAAC;AACnE,cAAc,uDAAuD,CAAC;AACtE,cAAc,gEAAgE,CAAC;AAC/E,cAAc,6EAA6E,CAAC;AAC5F,cAAc,gDAAgD,CAAC;AAC/D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,oDAAoD,CAAC;AACnE,cAAc,4CAA4C,CAAC;AAI3D,cAAc,mDAAmD,CAAC;AAClE,cAAc,+CAA+C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mDAAmD,CAAC;AAClE,cAAc,oDAAoD,CAAC;AACnE,cAAc,sDAAsD,CAAC;AAKrE,cAAc,iEAAiE,CAAC;AAChF,cAAc,oEAAoE,CAAC;AAGnF,cAAc,sEAAsE,CAAC;AACrF,cAAc,oEAAoE,CAAC;AACnF,cAAc,sDAAsD,CAAC;AACrE,cAAc,8CAA8C,CAAC;AAC7D,cAAc,sDAAsD,CAAC;AACrE,cAAc,2DAA2D,CAAC;AAC1E,cAAc,sDAAsD,CAAC;AACrE,cAAc,yDAAyD,CAAC;AACxE,cAAc,sDAAsD,CAAC;AACrE,cAAc,oDAAoD,CAAC;AACnE,cAAc,uDAAuD,CAAC;AACtE,cAAc,gEAAgE,CAAC;AAC/E,cAAc,6EAA6E,CAAC;AAC5F,cAAc,gDAAgD,CAAC;AAC/D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,oDAAoD,CAAC;AACnE,cAAc,4CAA4C,CAAC;AAI3D,cAAc,mDAAmD,CAAC;AAClE,cAAc,+CAA+C,CAAC"}

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mDAAmD,CAAC;AAClE,cAAc,oDAAoD,CAAC;AACnE,cAAc,sDAAsD,CAAC;AAErE,+FAA+F;AAC/F,+FAA+F;AAC/F,2FAA2F;AAC3F,cAAc,iEAAiE,CAAC;AAChF,cAAc,oEAAoE,CAAC;AAEnF,YAAY;AACZ,cAAc,sEAAsE,CAAC;AACrF,cAAc,oEAAoE,CAAC;AACnF,cAAc,sDAAsD,CAAC;AACrE,cAAc,8CAA8C,CAAC;AAC7D,cAAc,sDAAsD,CAAC;AACrE,cAAc,2DAA2D,CAAC;AAC1E,cAAc,sDAAsD,CAAC;AACrE,cAAc,yDAAyD,CAAC;AACxE,cAAc,sDAAsD,CAAC;AACrE,cAAc,oDAAoD,CAAC;AACnE,cAAc,uDAAuD,CAAC;AACtE,cAAc,gEAAgE,CAAC;AAC/E,cAAc,6EAA6E,CAAC;AAC5F,cAAc,gDAAgD,CAAC;AAC/D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,oDAAoD,CAAC;AACnE,cAAc,4CAA4C,CAAC;AAI3D,cAAc,mDAAmD,CAAC;AAClE,cAAc,+CAA+C,CAAC","sourcesContent":["export * from './core/commons.external-connectors-models.schemas';\nexport * from './core/security.external-connectors-models.schemas';\nexport * from './core/operations.external-connectors-models.schemas';\n\n// Webhook capability contracts (adapter / handler / scope resolver) — consumed by the engine's\n// webhook pipeline. The former `features/` layer (capability enum, transformer interfaces) was\n// retired 2026-09-05 (#327): it re-stated `BUILTIN_PROVIDER_CAPABILITY` and had no reader.\nexport * from './protocols/hooks-capability.external-connectors-models.schemas';\nexport * from './core/operation-classification.external-connectors-models.schemas';\n\n// Protocols\nexport * from './protocols/agent-client-protocol.external-connectors-models.schemas';\nexport * from './protocols/document-extraction.external-connectors-models.schemas';\nexport * from './protocols/email.external-connectors-models.schemas';\nexport * from './protocols/email.standard-interface.schemas';\nexport * from './protocols/email-inbound.standard-interface.schemas';\nexport * from './protocols/embeddings.external-connectors-models.schemas';\nexport * from './protocols/image.external-connectors-models.schemas';\nexport * from './protocols/frontend.external-connectors-models.schemas';\nexport * from './protocols/hooks.external-connectors-models.schemas';\nexport * from './protocols/llm.external-connectors-models.schemas';\nexport * from './protocols/oauth2.external-connectors-models.schemas';\nexport * from './protocols/rest-operations.external-connectors-models.schemas';\nexport * from './protocols/provider-oauth2-token-endpoint-hosts.external-connectors-models';\nexport * from './protocols/billing.standard-interface.schemas';\nexport * from './protocols/file-storage.standard-interface';\nexport * from './protocols/sms.external-connectors-models.schemas';\nexport * from './protocols/sms.standard-interface.schemas';\n\n\n\nexport * from './protocols/oauth2-provider-assurance.definitions';\nexport * from './protocols/oauth2-provider-assurance.schemas';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mDAAmD,CAAC;AAClE,cAAc,oDAAoD,CAAC;AACnE,cAAc,sDAAsD,CAAC;AAErE,+FAA+F;AAC/F,+FAA+F;AAC/F,2FAA2F;AAC3F,cAAc,iEAAiE,CAAC;AAChF,cAAc,oEAAoE,CAAC;AAEnF,YAAY;AACZ,cAAc,sEAAsE,CAAC;AACrF,cAAc,oEAAoE,CAAC;AACnF,cAAc,sDAAsD,CAAC;AACrE,cAAc,8CAA8C,CAAC;AAC7D,cAAc,sDAAsD,CAAC;AACrE,cAAc,2DAA2D,CAAC;AAC1E,cAAc,sDAAsD,CAAC;AACrE,cAAc,yDAAyD,CAAC;AACxE,cAAc,sDAAsD,CAAC;AACrE,cAAc,oDAAoD,CAAC;AACnE,cAAc,uDAAuD,CAAC;AACtE,cAAc,gEAAgE,CAAC;AAC/E,cAAc,6EAA6E,CAAC;AAC5F,cAAc,gDAAgD,CAAC;AAC/D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,oDAAoD,CAAC;AACnE,cAAc,4CAA4C,CAAC;AAI3D,cAAc,mDAAmD,CAAC;AAClE,cAAc,+CAA+C,CAAC","sourcesContent":["export * from './core/commons.external-connectors-models.schemas';\nexport * from './core/security.external-connectors-models.schemas';\nexport * from './core/operations.external-connectors-models.schemas';\n\n// Webhook capability contracts (adapter / handler / scope resolver) — consumed by the engine's\n// webhook pipeline. The former `features/` layer (capability enum, transformer interfaces) was\n// retired 2026-09-05 (#327): it re-stated `BUILTIN_PROVIDER_CAPABILITY` and had no reader.\nexport * from './protocols/hooks-capability.external-connectors-models.schemas';\nexport * from './core/operation-classification.external-connectors-models.schemas';\n\n// Protocols\nexport * from './protocols/agent-client-protocol.external-connectors-models.schemas';\nexport * from './protocols/document-extraction.external-connectors-models.schemas';\nexport * from './protocols/email.external-connectors-models.schemas';\nexport * from './protocols/email.standard-interface.schemas';\nexport * from './protocols/email-inbound.standard-interface.schemas';\nexport * from './protocols/embeddings.external-connectors-models.schemas';\nexport * from './protocols/image.external-connectors-models.schemas';\nexport * from './protocols/frontend.external-connectors-models.schemas';\nexport * from './protocols/hooks.external-connectors-models.schemas';\nexport * from './protocols/llm.external-connectors-models.schemas';\nexport * from './protocols/oauth2.external-connectors-models.schemas';\nexport * from './protocols/rest-operations.external-connectors-models.schemas';\nexport * from './protocols/provider-oauth2-token-endpoint-hosts.external-connectors-models';\nexport * from './protocols/billing.standard-interface.schemas';\nexport * from './protocols/file-storage.standard-interface';\nexport * from './protocols/sms.external-connectors-models.schemas';\nexport * from './protocols/sms.standard-interface.schemas';\n\n\n\nexport * from './protocols/oauth2-provider-assurance.definitions';\nexport * from './protocols/oauth2-provider-assurance.schemas';\n"]}

package/dist/esm/protocols/agent-client-protocol.external-connectors-models.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-client-protocol.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../src/protocols/agent-client-protocol.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,yCAAyC,EAC1C,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EACL,uBAAuB,EACvB,oDAAoD,EAEpD,sCAAsC,EACrC,MAAM,oDAAoD,CAAC;AAoC9D;;;;;;;;GAQG;AACH,oBAAY,8BAA8B;IACxC,kBAAkB,uBAAuB;CAC1C;AAED;;;;;;;;GAQG;AACH,oBAAY,4BAA4B;IACtC,oFAAoF;IACpF,IAAI,SAAS;IACb;;;;;OAKG;IACH,YAAY,iBAAiB;IAC7B,gFAAgF;IAChF,wBAAwB,6BAA6B;CACtD;AAED;;;;;;;GAOG;AACH,oBAAY,0CAA0C;IACpD,cAAc,mBAAmB;IACjC,uBAAuB,4BAA4B;CACpD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,sGAAsG;AACtG,oBAAY,qCAAqC;IAC/C;;;;;;;;;;OAUG;IACH,aAAa,kBAAkB;IAC/B;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,sBAAsB;IACvC;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,sBAAsB;IACvC;;;;;;;;;;;;;;;;OAgBG;IACH,2BAA2B,gCAAgC;IAC3D;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,YAAY,iBAAiB;CAC9B;AACD,oDAAoD;AAEpD;;;;;;GAMG;AACH,wBAAgB,wCAAwC,CACtD,OAAO,EAAE,qCAAqC,GAC7C,MAAM,CAaR;AAED;;;;;;;;GAQG;AACH,oBAAY,mCAAmC;IAC7C,yDAAyD;IACzD,cAAc,mBAAmB;IACjC,0EAA0E;IAC1E,kBAAkB,uBAAuB;IACzC,yGAAyG;IACzG,eAAe,oBAAoB;CACpC;AAED;;;;;;;GAOG;AACH,oBAAY,yBAAyB;IACnC,SAAS,cAAc;IACvB,UAAU,eAAe;IACzB,aAAa,kBAAkB;IAC/B,OAAO,YAAY;CACpB;AAED;;;;GAIG;AACH,eAAO,MAAM,yCAAyC,mDAAmD,CAAC;AAE1G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,yGAAyG;AACzG,oBAAY,iDAAiD;IAC3D;;;;OAIG;IACH,sBAAsB,2BAA2B;IACjD;;;;;;;;OAQG;IACH,oCAAoC,yCAAyC;IAC7E;;;;;OAKG;IACH,YAAY,iBAAiB;CAC9B;AACD,uDAAuD;AAEvD;;;;;;;;;;;;GAYG;AACH,wBAAgB,wCAAwC,CACtD,SAAS,EAAE,iDAAiD,EAC5D,+BAA+B,EAAE,OAAO,GACvC,OAAO,CAST;AAED;;;;;;;;;;;;;;;GAeG;AACH,kHAAkH;AAClH,oBAAY,gDAAgD;IAC1D,sFAAsF;IACtF,QAAQ,aAAa;IACrB;;;;OAIG;IACH,kBAAkB,uBAAuB;IACzC;;;;;OAKG;IACH,cAAc,mBAAmB;CAClC;AACD,gEAAgE;AAEhE,qGAAqG;AACrG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,0CAA0C;;;;;;;kBAgC5C,CAAC;AACZ,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAC9G,mDAAmD;AAEnD;;;;;GAKG;AACH,qGAAqG;AACrG,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAuLrD,CAAC;AACH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAC9G,mDAAmD;AAEnD,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAWlD,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,oDAAoD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAc/J,oBAAY,wBAAwB;IAClC,iFAAiF;IACjF,eAAe,yBAAyB;CACzC;AAED;;;;;;;;;GASG;AACH,oBAAY,sBAAsB;IAChC,4CAA4C;IAC5C,QAAQ,aAAa;IACrB,qDAAqD;IACrD,UAAU,eAAe;IACzB,6DAA6D;IAC7D,iBAAiB,sBAAsB;IACvC,mCAAmC;IACnC,OAAO,YAAY;IACnB,oEAAoE;IACpE,SAAS,cAAc;IACvB;;;;;;;;;OASG;IACH,YAAY,uBAAuB;CACpC;AAED;;;;;;;;;GASG;AACH,oBAAY,mCAAmC;IAC7C,+DAA+D;IAC/D,aAAa,kBAAkB;IAC/B;;;;;OAKG;IACH,UAAU,eAAe;IACzB;;;;OAIG;IACH,WAAW,gBAAgB;IAC3B;;;;;OAKG;IACH,sBAAsB,2BAA2B;CAClD;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oCAAoC;IAC/C,6DAA6D;;;IAG7D;;;OAGG;;kBAEH,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC;IAC9C,iDAAiD;;IAEjD,gEAAgE;;IAEhE,6CAA6C;;IAE7C;;;;;OAKG;;IAEH;;;;;;OAMG;;kBAEH,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;iBAwBlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;;;;;GAQG;AACH,eAAO,MAAM,oDAAoD;;;;;;;;;;;;iBA+C/D,CAAC;AACH,MAAM,MAAM,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oDAAoD,CAAC,CAAC;AAElI,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAKlD,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG,MAAM,MAAM,mCAAmC,GAAG,yCAAyC,GAAG;IAC5F,sBAAsB,EAAE,OAAO,uCAAuC,CAAC;IACvE,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B,CAAC;AAMF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,8CAA8C;;;iBAGzD,CAAC;AACH,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8CAA8C,CAAC,CAAC;AAErH,eAAO,MAAM,8BAA8B;;;;iBA4BzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;QAvN1C,6DAA6D;;;QAG7D;;;WAGG;;;;QAgBH,iDAAiD;;QAEjD,gEAAgE;;QAEhE,6CAA6C;;QAE7C;;;;;WAKG;;QAEH;;;;;;WAMG;;;iBAiPH,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;GAMG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,oCAAoC,CAAC;CAC5D;AAED,uFAAuF;AACvF,MAAM,WAAW,6BAA6B;IAC5C,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAC9D;;;;;OAKG;IACH,QAAQ,CAAC,2BAA2B,EAAE,SAAS;QAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACzH;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,2BAA2B,CAQzC,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxD,6BAA6B,CAiC/B;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAAuC,CAAC;AAE/F,iGAAiG;AACjG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEtE"}
+{"version":3,"file":"agent-client-protocol.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../../src/protocols/agent-client-protocol.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,yCAAyC,EAC1C,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EACL,uBAAuB,EACvB,oDAAoD,EAEpD,sCAAsC,EACrC,MAAM,oDAAoD,CAAC;AAoC9D;;;;;;;;GAQG;AACH,oBAAY,8BAA8B;IACxC,kBAAkB,uBAAuB;CAC1C;AAED;;;;;;;;GAQG;AACH,oBAAY,4BAA4B;IACtC,oFAAoF;IACpF,IAAI,SAAS;IACb;;;;;OAKG;IACH,YAAY,iBAAiB;IAC7B,gFAAgF;IAChF,wBAAwB,6BAA6B;CACtD;AAED;;;;;;;GAOG;AACH,oBAAY,0CAA0C;IACpD,cAAc,mBAAmB;IACjC,uBAAuB,4BAA4B;CACpD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,sGAAsG;AACtG,oBAAY,qCAAqC;IAC/C;;;;;;;;;;OAUG;IACH,aAAa,kBAAkB;IAC/B;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,sBAAsB;IACvC;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,sBAAsB;IACvC;;;;;;;;;;;;;;;;OAgBG;IACH,2BAA2B,gCAAgC;IAC3D;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,YAAY,iBAAiB;CAC9B;AACD,oDAAoD;AAEpD;;;;;;GAMG;AACH,wBAAgB,wCAAwC,CACtD,OAAO,EAAE,qCAAqC,GAC7C,MAAM,CAaR;AAED;;;;;;;;GAQG;AACH,oBAAY,mCAAmC;IAC7C,yDAAyD;IACzD,cAAc,mBAAmB;IACjC,0EAA0E;IAC1E,kBAAkB,uBAAuB;IACzC,yGAAyG;IACzG,eAAe,oBAAoB;CACpC;AAED;;;;;;;GAOG;AACH,oBAAY,yBAAyB;IACnC,SAAS,cAAc;IACvB,UAAU,eAAe;IACzB,aAAa,kBAAkB;IAC/B,OAAO,YAAY;CACpB;AAED;;;;GAIG;AACH,eAAO,MAAM,yCAAyC,mDAAmD,CAAC;AAE1G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,yGAAyG;AACzG,oBAAY,iDAAiD;IAC3D;;;;OAIG;IACH,sBAAsB,2BAA2B;IACjD;;;;;;;;OAQG;IACH,oCAAoC,yCAAyC;IAC7E;;;;;OAKG;IACH,YAAY,iBAAiB;CAC9B;AACD,uDAAuD;AAEvD;;;;;;;;;;;;GAYG;AACH,wBAAgB,wCAAwC,CACtD,SAAS,EAAE,iDAAiD,EAC5D,+BAA+B,EAAE,OAAO,GACvC,OAAO,CAST;AAED;;;;;;;;;;;;;;;GAeG;AACH,kHAAkH;AAClH,oBAAY,gDAAgD;IAC1D,sFAAsF;IACtF,QAAQ,aAAa;IACrB;;;;OAIG;IACH,kBAAkB,uBAAuB;IACzC;;;;;OAKG;IACH,cAAc,mBAAmB;CAClC;AACD,gEAAgE;AAEhE,qGAAqG;AACrG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,0CAA0C;;;;;;;kBAgC5C,CAAC;AACZ,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAC9G,mDAAmD;AAEnD;;;;;GAKG;AACH,qGAAqG;AACrG,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAuLrD,CAAC;AACH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAC9G,mDAAmD;AAEnD,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAWlD,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,oDAAoD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAc/J,oBAAY,wBAAwB;IAClC,iFAAiF;IACjF,eAAe,yBAAyB;CACzC;AAED;;;;;;;;;GASG;AACH,oBAAY,sBAAsB;IAChC,4CAA4C;IAC5C,QAAQ,aAAa;IACrB,qDAAqD;IACrD,UAAU,eAAe;IACzB,6DAA6D;IAC7D,iBAAiB,sBAAsB;IACvC,mCAAmC;IACnC,OAAO,YAAY;IACnB,oEAAoE;IACpE,SAAS,cAAc;IACvB;;;;;;;;;OASG;IACH,YAAY,uBAAuB;CACpC;AAED;;;;;;;;;GASG;AACH,oBAAY,mCAAmC;IAC7C,+DAA+D;IAC/D,aAAa,kBAAkB;IAC/B;;;;;OAKG;IACH,UAAU,eAAe;IACzB;;;;OAIG;IACH,WAAW,gBAAgB;IAC3B;;;;;OAKG;IACH,sBAAsB,2BAA2B;CAClD;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oCAAoC;IAC/C,6DAA6D;;;IAG7D;;;OAGG;;kBAEH,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC;IAC9C,iDAAiD;;IAEjD,gEAAgE;;IAEhE,6CAA6C;;IAE7C;;;;;OAKG;;IAEH;;;;;;OAMG;;kBAEH,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;iBAwBlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;;;;;GAQG;AACH,eAAO,MAAM,oDAAoD;;;;;;;;;;;;iBA+C/D,CAAC;AACH,MAAM,MAAM,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oDAAoD,CAAC,CAAC;AAElI,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAKlD,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG,MAAM,MAAM,mCAAmC,GAAG,yCAAyC,GAAG;IAC5F,sBAAsB,EAAE,OAAO,uCAAuC,CAAC;IACvE,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B,CAAC;AAMF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,8CAA8C;;;iBAGzD,CAAC;AACH,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8CAA8C,CAAC,CAAC;AAErH,eAAO,MAAM,8BAA8B;;;;iBA4BzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;QAvN1C,6DAA6D;;;QAG7D;;;WAGG;;;;QAgBH,iDAAiD;;QAEjD,gEAAgE;;QAEhE,6CAA6C;;QAE7C;;;;;WAKG;;QAEH;;;;;;WAMG;;;iBAiPH,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;GAMG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,oCAAoC,CAAC;CAC5D;AAED,uFAAuF;AACvF,MAAM,WAAW,6BAA6B;IAC5C,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAC9D;;;;;OAKG;IACH,QAAQ,CAAC,2BAA2B,EAAE,SAAS;QAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACzH;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,2BAA2B,CAQzC,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxD,6BAA6B,CAiC/B;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAAuC,CAAC;AAE/F,iGAAiG;AACjG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEtE"}