@wix/app-extensions 1.0.174 → 1.0.175

package/build/trusted/cjs/index.d.ts

@@ -27487,12 +27487,15 @@ declare enum VerificationSource {
     CONNECTOR_WIDE = "CONNECTOR_WIDE",
     /**
      * Material is issued per registration and lives on the registration the delivery was sent to.
-     * Requires registration_required.
+     * Requires registration_required. A registration is the provider-side one for a single
+     * account, which is that account's subscription; there is no separate registration entity.
      */
     PER_REGISTRATION = "PER_REGISTRATION",
     /**
      * There is no material, because nothing is verified. The only legal scope for
-     * NO_VERIFICATION, and legal for nothing else.
+     * NO_VERIFICATION, and legal for nothing else. Redundant with NO_VERIFICATION on purpose:
+     * every enum in a valid config is explicitly set, so "nothing was declared" and "the
+     * declaration is that nothing is verified" stay distinguishable.
      */
     UNSIGNED = "UNSIGNED"
 }
@@ -27546,7 +27549,7 @@ type SignedPayloadWithLiterals = SignedPayload | 'UNKNOWN_SIGNED_PAYLOAD' | 'RAW
 /**
  * Per-method payload for the `verification` oneof above. Shared by HMAC_SHA256,
  * HMAC_SHA1, and (wrapped) PUBLIC_KEY - the three methods signatureMethods already groups
- * together in the validator. timestamp_header / timestamp_tolerance_seconds stay flat on
+ * together in the validator. timestamp_header / timestamp_tolerance_seconds stay on
  * WebhookConfig rather than moving in here, since BODY_HASH_WITHIN_TIMESTAMP_WINDOW borrows
  * them independently of which verification_method is selected.
  */
@@ -27561,13 +27564,20 @@ interface HmacConfig {
     signatureHeader?: string;
     /**
      * Literal prefix the provider places in front of the encoded signature, for example
-     * "sha256=" or "v0=". Empty when the header holds the bare signature.
+     * "sha256=" or "v0=". Empty when the header holds the bare signature. A constant, never a
+     * template: compared verbatim against the start of the header, and a delivery whose header
+     * does not start with it is rejected.
      * @maxLength 20
      */
     signatureValuePrefix?: string;
     /** How the signature bytes are encoded in signature_header. */
     signatureEncoding?: SignatureEncodingWithLiterals;
-    /** Which canonical string the signature is computed over. */
+    /**
+     * Which canonical string the signature is computed over, from a closed set of recipes. There
+     * is deliberately no free-form signing template, which would make the inbound path an
+     * interpreter of app-owner input; a provider whose canonical string is not listed needs a new
+     * enum value.
+     */
     signedPayload?: SignedPayloadWithLiterals;
 }
 /** @internal */
@@ -27969,8 +27979,8 @@ interface DispatchConfig {
  *
  * No credential material is declared here. This config lives in the app component catalog and is
  * readable by app owners; signing secrets and callback tokens are stored separately and are
- * located through verification_source. public_key_url is the only credential-adjacent field, and
- * it points at material the provider publishes.
+ * located through the selected verification arm's verification_source. public_key_url is the
+ * only credential-adjacent field, and it points at material the provider publishes.
  *
  * Fields naming something the provider owns carry a provider_ prefix, so the identifiers a
  * delivery arrives with are never confused with the ones Wix mints.
@@ -28002,90 +28012,19 @@ interface WebhookConfig extends WebhookConfigVerificationOneOf, WebhookConfigRep
      * must select a concrete method — an unset method is rejected rather than treated as a default.
      */
     verificationMethod?: VerificationMethodWithLiterals;
-    /**
-     * Scope of the material used by verification_method: shared by the whole connector, or issued
-     * per registration. Names the scope rather than the kind of material, so it stays accurate for
-     * PUBLIC_KEY, where the connector-wide material is a published key URL and nothing is stored.
-     *
-     * "Per registration" is the provider-side registration for one account, which is that account's
-     * subscription - there is no separate registration entity to look for.
-     *
-     * The UNSIGNED arm is redundant with verification_method = NO_VERIFICATION, and deliberately so:
-     * every enum in a valid config is explicitly set, which keeps "nothing was declared" and "the
-     * declaration is that nothing is verified" distinguishable states rather than the same unset
-     * field. The alternative - dropping the arm and making this field conditionally required - moves
-     * the same fact into a validation rule instead of removing it.
-     *
-     * Deprecated: superseded by each `verification` arm's own verification_source field. Kept live
-     * and enforced for the flat-shape configs this migration has not yet moved off of.
-     * @deprecated
-     * @replacedBy verification (each arm's own verification_source field)
-     * @targetRemovalDate 2027-06-30
-     */
-    verificationSource?: VerificationSourceWithLiterals;
-    /**
-     * Header carrying the signature to verify. Required for HMAC_SHA256, HMAC_SHA1 and PUBLIC_KEY,
-     * and must be empty for every other method. For example: "X-Hub-Signature-256".
-     *
-     * Deprecated: superseded by HmacConfig.signature_header (via the `verification` oneof's
-     * hmac_sha256_config, hmac_sha1_config and public_key_config arms).
-     * @maxLength 120
-     * @deprecated
-     * @replacedBy HmacConfig.signature_header (via the verification oneof)
-     * @targetRemovalDate 2027-06-30
-     */
-    signatureHeader?: string;
-    /**
-     * Literal prefix the provider places in front of the encoded signature, for example "sha256="
-     * or "v0=". Empty when the header holds the bare signature.
-     *
-     * The value is a constant, never a template: it is compared verbatim against the start of the
-     * header and stripped before decoding, and a delivery whose header does not start with it is
-     * rejected. Nothing in it is interpreted or substituted.
-     *
-     * Deprecated: superseded by HmacConfig.signature_value_prefix.
-     * @maxLength 20
-     * @deprecated
-     * @replacedBy HmacConfig.signature_value_prefix (via the verification oneof)
-     * @targetRemovalDate 2027-06-30
-     */
-    signatureValuePrefix?: string;
-    /**
-     * How the signature bytes are encoded in signature_header. Required whenever signature_header
-     * is required.
-     *
-     * Deprecated: superseded by HmacConfig.signature_encoding.
-     * @deprecated
-     * @replacedBy HmacConfig.signature_encoding (via the verification oneof)
-     * @targetRemovalDate 2027-06-30
-     */
-    signatureEncoding?: SignatureEncodingWithLiterals;
-    /**
-     * Which canonical string the signature is computed over, selected from a closed set of recipes
-     * the server implements. Required whenever signature_header is required.
-     *
-     * There is deliberately no free-form signing template: a configurable template would make the
-     * inbound path an interpreter of app-owner input and an injection surface. A provider whose
-     * canonical string is not listed here needs a new enum value, not a new template.
-     *
-     * Deprecated: superseded by HmacConfig.signed_payload.
-     * @deprecated
-     * @replacedBy HmacConfig.signed_payload (via the verification oneof)
-     * @targetRemovalDate 2027-06-30
-     */
-    signedPayload?: SignedPayloadWithLiterals;
     /**
      * Header carrying the delivery timestamp, used to reject stale and replayed deliveries. For
-     * example: "X-Slack-Request-Timestamp". Required by the signed_payload recipes that include a
-     * timestamp, and must be set together with timestamp_tolerance_seconds. The header value is read
-     * as epoch seconds, except under METHOD_URI_BODY_TIMESTAMP, which reads it as epoch milliseconds.
+     * example: "X-Slack-Request-Timestamp". Required by the HmacConfig.signed_payload recipes that
+     * include a timestamp, and must be set together with timestamp_tolerance_seconds. The header
+     * value is read as epoch seconds, except under METHOD_URI_BODY_TIMESTAMP, which reads it as
+     * epoch milliseconds.
      * @maxLength 120
      */
     timestampHeader?: string;
     /**
      * How far the delivery timestamp may be from server time before the delivery is rejected. Must
      * be greater than zero when timestamp_header is set, and zero when it is not. Always in seconds,
-     * whatever unit the signed_payload recipe reads timestamp_header in.
+     * whatever unit the HmacConfig.signed_payload recipe reads timestamp_header in.
      *
      * The tolerance is a floor on replay-protection retention, not only a freshness bound: whatever
      * remembers seen deliveries has to outlive this window, or a delivery still inside its accepted
@@ -28098,19 +28037,6 @@ interface WebhookConfig extends WebhookConfigVerificationOneOf, WebhookConfigRep
      * @max 3600
      */
     timestampToleranceSeconds?: number;
-    /**
-     * Header carrying the shared token the provider echoes on every delivery. Required for
-     * CALLBACK_TOKEN and must be empty for every other method. For example:
-     * "X-Goog-Channel-Token". The token itself is never declared here — it is located through
-     * verification_source.
-     *
-     * Deprecated: superseded by CallbackTokenConfig.callback_token_header.
-     * @maxLength 120
-     * @deprecated
-     * @replacedBy verification.callback_token_config.callback_token_header
-     * @targetRemovalDate 2027-06-30
-     */
-    callbackTokenHeader?: string;
     /**
      * Endpoint publishing the provider's public keys. Required for PUBLIC_KEY and OIDC_BEARER, and
      * must be empty for every other method.