@wix/app-extensions 1.0.140 → 1.0.141

package/build/trusted/es/index.d.mts

@@ -26346,11 +26346,21 @@ declare enum VerificationMethod {
      */
     CALLBACK_TOKEN = "CALLBACK_TOKEN",
     /** Authenticity is not established at all. Requires unsigned_deliveries_accepted. */
-    NO_VERIFICATION = "NO_VERIFICATION"
+    NO_VERIFICATION = "NO_VERIFICATION",
+    /**
+     * OIDC bearer JWT in the Authorization header, verified against the key set at
+     * public_key_url with the expected audience, issuer and subject, for example Cloud Pub/Sub
+     * push authentication. Carries no payload binding, the same limitation CALLBACK_TOKEN
+     * documents for itself: it proves the sender's identity, not that the body is intact.
+     *
+     * Not yet implemented: the delivery path has no resolver for this method's key material, so
+     * no config may select it yet.
+     */
+    OIDC_BEARER = "OIDC_BEARER"
 }
 /** @enumType */
 /** @internal */
-type VerificationMethodWithLiterals = VerificationMethod | 'UNKNOWN_VERIFICATION_METHOD' | 'HMAC_SHA256' | 'HMAC_SHA1' | 'PUBLIC_KEY' | 'CALLBACK_TOKEN' | 'NO_VERIFICATION';
+type VerificationMethodWithLiterals = VerificationMethod | 'UNKNOWN_VERIFICATION_METHOD' | 'HMAC_SHA256' | 'HMAC_SHA1' | 'PUBLIC_KEY' | 'CALLBACK_TOKEN' | 'NO_VERIFICATION' | 'OIDC_BEARER';
 /** Scope of the material used by verification_method. */
 /** @internal */
 declare enum VerificationSource {
@@ -26710,8 +26720,8 @@ interface WebhookConfig {
      */
     callbackTokenHeader?: string;
     /**
-     * Endpoint publishing the provider's public keys, used to verify a PUBLIC_KEY signature.
-     * Required for PUBLIC_KEY and must be empty for every other method.
+     * Endpoint publishing the provider's public keys. Required for PUBLIC_KEY and must be empty for
+     * every other method.
      *
      * Deliberately has no (wix.api.format), following revoke_url above: WEB_URL rejects the empty
      * value this field carries for every other method. HTTPS and a parseable endpoint are enforced
@@ -26843,6 +26853,32 @@ interface WebhookConfig {
      * @immutable
      */
     deliveryTopic?: string;
+    /**
+     * Expected `aud` claim of an OIDC_BEARER token. An OIDC issuer's audience is chosen by whoever
+     * requested the token, not by the issuer, so pinning the value expected here is what stops a
+     * bearer token minted for a different audience — a different Pub/Sub push subscription, for
+     * instance — from authenticating against this one. Required for OIDC_BEARER and must be empty
+     * for every other method.
+     * @maxLength 2000
+     */
+    oidcExpectedAudience?: string;
+    /**
+     * Expected `iss` claim of an OIDC_BEARER token, for example "https://accounts.google.com".
+     * Required for OIDC_BEARER and must be empty for every other method.
+     * @maxLength 2000
+     */
+    oidcExpectedIssuer?: string;
+    /**
+     * Expected `sub` claim of an OIDC_BEARER token — the stable identifier of the specific caller
+     * trusted to send this connector's deliveries, for example a Pub/Sub push subscription's
+     * service account. iss and aud alone do not identify the sender: aud is a value the token
+     * *requester* chooses, not the issuer, so any principal able to mint a same-issuer,
+     * same-audience token — a different Google service account with permission to request an ID
+     * token for this audience, for instance — would otherwise pass. Required for OIDC_BEARER and
+     * must be empty for every other method.
+     * @maxLength 2000
+     */
+    oidcExpectedSubject?: string;
 }
 /**
  * Declares the connector's MCP (Model Context Protocol) surface: the endpoint connector dispatch

package/build/trusted/es/index.mjs

@@ -3129,6 +3129,7 @@ var VerificationMethod = /* @__PURE__ */ ((VerificationMethod2) => {
   VerificationMethod2["PUBLIC_KEY"] = "PUBLIC_KEY";
   VerificationMethod2["CALLBACK_TOKEN"] = "CALLBACK_TOKEN";
   VerificationMethod2["NO_VERIFICATION"] = "NO_VERIFICATION";
+  VerificationMethod2["OIDC_BEARER"] = "OIDC_BEARER";
   return VerificationMethod2;
 })(VerificationMethod || {});
 var VerificationSource = /* @__PURE__ */ ((VerificationSource2) => {