@wix/app-extensions 1.0.174 → 1.0.176

package/build/trusted/es/index.d.mts

@@ -27481,18 +27481,21 @@ declare enum VerificationSource {
     UNKNOWN_VERIFICATION_SOURCE = "UNKNOWN_VERIFICATION_SOURCE",
     /**
      * One set of material covers every delivery of this connector: a single stored secret for the
-     * HMAC and callback-token methods, or the published key set at public_key_url for PUBLIC_KEY
-     * and OIDC_BEARER, where nothing is stored at all. The only legal scope for either.
+     * HMAC and callback-token methods, or the published key set at the arm's public_key_url for
+     * PUBLIC_KEY and OIDC_BEARER, where nothing is stored at all. The only legal scope for either.
      */
     CONNECTOR_WIDE = "CONNECTOR_WIDE",
     /**
      * Material is issued per registration and lives on the registration the delivery was sent to.
-     * Requires registration_required.
+     * Requires registration_required. A registration is the provider-side one for a single
+     * account, which is that account's subscription; there is no separate registration entity.
      */
     PER_REGISTRATION = "PER_REGISTRATION",
     /**
      * There is no material, because nothing is verified. The only legal scope for
-     * NO_VERIFICATION, and legal for nothing else.
+     * NO_VERIFICATION, and legal for nothing else. Redundant with NO_VERIFICATION on purpose:
+     * every enum in a valid config is explicitly set, so "nothing was declared" and "the
+     * declaration is that nothing is verified" stay distinguishable.
      */
     UNSIGNED = "UNSIGNED"
 }
@@ -27546,7 +27549,7 @@ type SignedPayloadWithLiterals = SignedPayload | 'UNKNOWN_SIGNED_PAYLOAD' | 'RAW
 /**
  * Per-method payload for the `verification` oneof above. Shared by HMAC_SHA256,
  * HMAC_SHA1, and (wrapped) PUBLIC_KEY - the three methods signatureMethods already groups
- * together in the validator. timestamp_header / timestamp_tolerance_seconds stay flat on
+ * together in the validator. timestamp_header / timestamp_tolerance_seconds stay on
  * WebhookConfig rather than moving in here, since BODY_HASH_WITHIN_TIMESTAMP_WINDOW borrows
  * them independently of which verification_method is selected.
  */
@@ -27561,13 +27564,20 @@ interface HmacConfig {
     signatureHeader?: string;
     /**
      * Literal prefix the provider places in front of the encoded signature, for example
-     * "sha256=" or "v0=". Empty when the header holds the bare signature.
+     * "sha256=" or "v0=". Empty when the header holds the bare signature. A constant, never a
+     * template: compared verbatim against the start of the header, and a delivery whose header
+     * does not start with it is rejected.
      * @maxLength 20
      */
     signatureValuePrefix?: string;
     /** How the signature bytes are encoded in signature_header. */
     signatureEncoding?: SignatureEncodingWithLiterals;
-    /** Which canonical string the signature is computed over. */
+    /**
+     * Which canonical string the signature is computed over, from a closed set of recipes. There
+     * is deliberately no free-form signing template, which would make the inbound path an
+     * interpreter of app-owner input; a provider whose canonical string is not listed needs a new
+     * enum value.
+     */
     signedPayload?: SignedPayloadWithLiterals;
 }
 /** @internal */
@@ -27593,7 +27603,7 @@ declare enum VerificationMethod {
     HMAC_SHA1 = "HMAC_SHA1",
     /**
      * Asymmetric signature over the canonical string, verified with a key fetched from
-     * public_key_url.
+     * PublicKeyConfig.public_key_url.
      */
     PUBLIC_KEY = "PUBLIC_KEY",
     /**
@@ -27606,9 +27616,10 @@ declare enum VerificationMethod {
     NO_VERIFICATION = "NO_VERIFICATION",
     /**
      * OIDC bearer JWT in the Authorization header, verified against the key set at
-     * public_key_url with the expected audience, issuer and subject, for example Cloud Pub/Sub
-     * push authentication. Carries no payload binding, the same limitation CALLBACK_TOKEN
-     * documents for itself: it proves the sender's identity, not that the body is intact.
+     * OidcBearerConfig.public_key_url with the expected audience, issuer and subject, for
+     * example Cloud Pub/Sub push authentication. Carries no payload binding, the same
+     * limitation CALLBACK_TOKEN documents for itself: it proves the sender's identity, not that
+     * the body is intact.
      */
     OIDC_BEARER = "OIDC_BEARER"
 }
@@ -27624,8 +27635,8 @@ declare enum ReplayProtection {
      */
     UNKNOWN_REPLAY_PROTECTION = "UNKNOWN_REPLAY_PROTECTION",
     /**
-     * The provider sends a per-delivery id, named by delivery_id_header, and a delivery already
-     * seen under that id is discarded.
+     * The provider sends a per-delivery id, named by DeliveryIdHeaderConfig.delivery_id_header,
+     * and a delivery already seen under that id is discarded.
      */
     DELIVERY_ID_HEADER = "DELIVERY_ID_HEADER",
     /**
@@ -27969,8 +27980,9 @@ interface DispatchConfig {
  *
  * No credential material is declared here. This config lives in the app component catalog and is
  * readable by app owners; signing secrets and callback tokens are stored separately and are
- * located through verification_source. public_key_url is the only credential-adjacent field, and
- * it points at material the provider publishes.
+ * located through the selected verification arm's verification_source. The public_key_url on
+ * PublicKeyConfig and OidcBearerConfig is the only credential-adjacent field, and it points at
+ * material the provider publishes.
  *
  * Fields naming something the provider owns carry a provider_ prefix, so the identifiers a
  * delivery arrives with are never confused with the ones Wix mints.
@@ -28002,90 +28014,19 @@ interface WebhookConfig extends WebhookConfigVerificationOneOf, WebhookConfigRep
      * must select a concrete method — an unset method is rejected rather than treated as a default.
      */
     verificationMethod?: VerificationMethodWithLiterals;
-    /**
-     * Scope of the material used by verification_method: shared by the whole connector, or issued
-     * per registration. Names the scope rather than the kind of material, so it stays accurate for
-     * PUBLIC_KEY, where the connector-wide material is a published key URL and nothing is stored.
-     *
-     * "Per registration" is the provider-side registration for one account, which is that account's
-     * subscription - there is no separate registration entity to look for.
-     *
-     * The UNSIGNED arm is redundant with verification_method = NO_VERIFICATION, and deliberately so:
-     * every enum in a valid config is explicitly set, which keeps "nothing was declared" and "the
-     * declaration is that nothing is verified" distinguishable states rather than the same unset
-     * field. The alternative - dropping the arm and making this field conditionally required - moves
-     * the same fact into a validation rule instead of removing it.
-     *
-     * Deprecated: superseded by each `verification` arm's own verification_source field. Kept live
-     * and enforced for the flat-shape configs this migration has not yet moved off of.
-     * @deprecated
-     * @replacedBy verification (each arm's own verification_source field)
-     * @targetRemovalDate 2027-06-30
-     */
-    verificationSource?: VerificationSourceWithLiterals;
-    /**
-     * Header carrying the signature to verify. Required for HMAC_SHA256, HMAC_SHA1 and PUBLIC_KEY,
-     * and must be empty for every other method. For example: "X-Hub-Signature-256".
-     *
-     * Deprecated: superseded by HmacConfig.signature_header (via the `verification` oneof's
-     * hmac_sha256_config, hmac_sha1_config and public_key_config arms).
-     * @maxLength 120
-     * @deprecated
-     * @replacedBy HmacConfig.signature_header (via the verification oneof)
-     * @targetRemovalDate 2027-06-30
-     */
-    signatureHeader?: string;
-    /**
-     * Literal prefix the provider places in front of the encoded signature, for example "sha256="
-     * or "v0=". Empty when the header holds the bare signature.
-     *
-     * The value is a constant, never a template: it is compared verbatim against the start of the
-     * header and stripped before decoding, and a delivery whose header does not start with it is
-     * rejected. Nothing in it is interpreted or substituted.
-     *
-     * Deprecated: superseded by HmacConfig.signature_value_prefix.
-     * @maxLength 20
-     * @deprecated
-     * @replacedBy HmacConfig.signature_value_prefix (via the verification oneof)
-     * @targetRemovalDate 2027-06-30
-     */
-    signatureValuePrefix?: string;
-    /**
-     * How the signature bytes are encoded in signature_header. Required whenever signature_header
-     * is required.
-     *
-     * Deprecated: superseded by HmacConfig.signature_encoding.
-     * @deprecated
-     * @replacedBy HmacConfig.signature_encoding (via the verification oneof)
-     * @targetRemovalDate 2027-06-30
-     */
-    signatureEncoding?: SignatureEncodingWithLiterals;
-    /**
-     * Which canonical string the signature is computed over, selected from a closed set of recipes
-     * the server implements. Required whenever signature_header is required.
-     *
-     * There is deliberately no free-form signing template: a configurable template would make the
-     * inbound path an interpreter of app-owner input and an injection surface. A provider whose
-     * canonical string is not listed here needs a new enum value, not a new template.
-     *
-     * Deprecated: superseded by HmacConfig.signed_payload.
-     * @deprecated
-     * @replacedBy HmacConfig.signed_payload (via the verification oneof)
-     * @targetRemovalDate 2027-06-30
-     */
-    signedPayload?: SignedPayloadWithLiterals;
     /**
      * Header carrying the delivery timestamp, used to reject stale and replayed deliveries. For
-     * example: "X-Slack-Request-Timestamp". Required by the signed_payload recipes that include a
-     * timestamp, and must be set together with timestamp_tolerance_seconds. The header value is read
-     * as epoch seconds, except under METHOD_URI_BODY_TIMESTAMP, which reads it as epoch milliseconds.
+     * example: "X-Slack-Request-Timestamp". Required by the HmacConfig.signed_payload recipes that
+     * include a timestamp, and must be set together with timestamp_tolerance_seconds. The header
+     * value is read as epoch seconds, except under METHOD_URI_BODY_TIMESTAMP, which reads it as
+     * epoch milliseconds.
      * @maxLength 120
      */
     timestampHeader?: string;
     /**
      * How far the delivery timestamp may be from server time before the delivery is rejected. Must
      * be greater than zero when timestamp_header is set, and zero when it is not. Always in seconds,
-     * whatever unit the signed_payload recipe reads timestamp_header in.
+     * whatever unit the HmacConfig.signed_payload recipe reads timestamp_header in.
      *
      * The tolerance is a floor on replay-protection retention, not only a freshness bound: whatever
      * remembers seen deliveries has to outlive this window, or a delivery still inside its accepted
@@ -28098,52 +28039,6 @@ interface WebhookConfig extends WebhookConfigVerificationOneOf, WebhookConfigRep
      * @max 3600
      */
     timestampToleranceSeconds?: number;
-    /**
-     * Header carrying the shared token the provider echoes on every delivery. Required for
-     * CALLBACK_TOKEN and must be empty for every other method. For example:
-     * "X-Goog-Channel-Token". The token itself is never declared here — it is located through
-     * verification_source.
-     *
-     * Deprecated: superseded by CallbackTokenConfig.callback_token_header.
-     * @maxLength 120
-     * @deprecated
-     * @replacedBy verification.callback_token_config.callback_token_header
-     * @targetRemovalDate 2027-06-30
-     */
-    callbackTokenHeader?: string;
-    /**
-     * Endpoint publishing the provider's public keys. Required for PUBLIC_KEY and OIDC_BEARER, and
-     * must be empty for every other method.
-     *
-     * Deliberately has no (wix.api.format), following revoke_url above: WEB_URL rejects the empty
-     * value this field carries for every other method. HTTPS and a parseable endpoint are enforced
-     * when the keys are fetched instead.
-     *
-     * Deprecated: superseded by PublicKeyConfig.public_key_url for PUBLIC_KEY, and by
-     * OidcBearerConfig.public_key_url for OIDC_BEARER.
-     * @maxLength 2000
-     * @deprecated
-     * @replacedBy verification.public_key_config.public_key_url (PUBLIC_KEY) or verification.oidc_bearer_config.public_key_url (OIDC_BEARER)
-     * @targetRemovalDate 2027-06-30
-     */
-    publicKeyUrl?: string;
-    /**
-     * Header carrying the provider's unique id for this delivery, for example "X-GitHub-Delivery".
-     * Required by, and legal only with, replay_protection = DELIVERY_ID_HEADER.
-     *
-     * The id is only as unique as the provider makes it. Google Calendar's X-Goog-Message-Number,
-     * for instance, counts per notification channel rather than globally, so a delivery is
-     * identified by the registration it arrived on together with this value, never by the value
-     * alone.
-     *
-     * Deprecated: superseded by DeliveryIdHeaderConfig.delivery_id_header (via the
-     * `replay_protection_config` oneof's delivery_id_header_config arm).
-     * @maxLength 120
-     * @deprecated
-     * @replacedBy replay_protection_config.delivery_id_header_config.delivery_id_header
-     * @targetRemovalDate 2027-06-30
-     */
-    deliveryIdHeader?: string;
     /**
      * Header carrying the event type of the delivery, for example "X-GitHub-Event". Optional: at
      * most one of event_type_header and event_type_json_pointer may be set, and a provider with no
@@ -28261,47 +28156,6 @@ interface WebhookConfig extends WebhookConfigVerificationOneOf, WebhookConfigRep
      * @immutable
      */
     deliveryTopic?: string;
-    /**
-     * Expected `aud` claim of an OIDC_BEARER token. An OIDC issuer's audience is chosen by whoever
-     * requested the token, not by the issuer, so pinning the value expected here is what stops a
-     * bearer token minted for a different audience — a different Pub/Sub push subscription, for
-     * instance — from authenticating against this one. Required for OIDC_BEARER and must be empty
-     * for every other method.
-     *
-     * Deprecated: superseded by OidcBearerConfig.oidc_expected_audience.
-     * @maxLength 2000
-     * @deprecated
-     * @replacedBy verification.oidc_bearer_config.oidc_expected_audience
-     * @targetRemovalDate 2027-06-30
-     */
-    oidcExpectedAudience?: string;
-    /**
-     * Expected `iss` claim of an OIDC_BEARER token, for example "https://accounts.google.com".
-     * Required for OIDC_BEARER and must be empty for every other method.
-     *
-     * Deprecated: superseded by OidcBearerConfig.oidc_expected_issuer.
-     * @maxLength 2000
-     * @deprecated
-     * @replacedBy verification.oidc_bearer_config.oidc_expected_issuer
-     * @targetRemovalDate 2027-06-30
-     */
-    oidcExpectedIssuer?: string;
-    /**
-     * Expected `sub` claim of an OIDC_BEARER token — the stable identifier of the specific caller
-     * trusted to send this connector's deliveries, for example a Pub/Sub push subscription's
-     * service account. iss and aud alone do not identify the sender: aud is a value the token
-     * *requester* chooses, not the issuer, so any principal able to mint a same-issuer,
-     * same-audience token — a different Google service account with permission to request an ID
-     * token for this audience, for instance — would otherwise pass. Required for OIDC_BEARER and
-     * must be empty for every other method.
-     *
-     * Deprecated: superseded by OidcBearerConfig.oidc_expected_subject.
-     * @maxLength 2000
-     * @deprecated
-     * @replacedBy verification.oidc_bearer_config.oidc_expected_subject
-     * @targetRemovalDate 2027-06-30
-     */
-    oidcExpectedSubject?: string;
     /**
      * Set when one delivery body is a batch of events, each possibly for a different provider tenant.
      * The whole request is verified once, then split into one delivery per element.