@wix/app-extensions 1.0.175 → 1.0.176

package/build/trusted/cjs/index.d.ts

@@ -27481,8 +27481,8 @@ declare enum VerificationSource {
     UNKNOWN_VERIFICATION_SOURCE = "UNKNOWN_VERIFICATION_SOURCE",
     /**
      * One set of material covers every delivery of this connector: a single stored secret for the
-     * HMAC and callback-token methods, or the published key set at public_key_url for PUBLIC_KEY
-     * and OIDC_BEARER, where nothing is stored at all. The only legal scope for either.
+     * HMAC and callback-token methods, or the published key set at the arm's public_key_url for
+     * PUBLIC_KEY and OIDC_BEARER, where nothing is stored at all. The only legal scope for either.
      */
     CONNECTOR_WIDE = "CONNECTOR_WIDE",
     /**
@@ -27603,7 +27603,7 @@ declare enum VerificationMethod {
     HMAC_SHA1 = "HMAC_SHA1",
     /**
      * Asymmetric signature over the canonical string, verified with a key fetched from
-     * public_key_url.
+     * PublicKeyConfig.public_key_url.
      */
     PUBLIC_KEY = "PUBLIC_KEY",
     /**
@@ -27616,9 +27616,10 @@ declare enum VerificationMethod {
     NO_VERIFICATION = "NO_VERIFICATION",
     /**
      * OIDC bearer JWT in the Authorization header, verified against the key set at
-     * public_key_url with the expected audience, issuer and subject, for example Cloud Pub/Sub
-     * push authentication. Carries no payload binding, the same limitation CALLBACK_TOKEN
-     * documents for itself: it proves the sender's identity, not that the body is intact.
+     * OidcBearerConfig.public_key_url with the expected audience, issuer and subject, for
+     * example Cloud Pub/Sub push authentication. Carries no payload binding, the same
+     * limitation CALLBACK_TOKEN documents for itself: it proves the sender's identity, not that
+     * the body is intact.
      */
     OIDC_BEARER = "OIDC_BEARER"
 }
@@ -27634,8 +27635,8 @@ declare enum ReplayProtection {
      */
     UNKNOWN_REPLAY_PROTECTION = "UNKNOWN_REPLAY_PROTECTION",
     /**
-     * The provider sends a per-delivery id, named by delivery_id_header, and a delivery already
-     * seen under that id is discarded.
+     * The provider sends a per-delivery id, named by DeliveryIdHeaderConfig.delivery_id_header,
+     * and a delivery already seen under that id is discarded.
      */
     DELIVERY_ID_HEADER = "DELIVERY_ID_HEADER",
     /**
@@ -27979,8 +27980,9 @@ interface DispatchConfig {
  *
  * No credential material is declared here. This config lives in the app component catalog and is
  * readable by app owners; signing secrets and callback tokens are stored separately and are
- * located through the selected verification arm's verification_source. public_key_url is the
- * only credential-adjacent field, and it points at material the provider publishes.
+ * located through the selected verification arm's verification_source. The public_key_url on
+ * PublicKeyConfig and OidcBearerConfig is the only credential-adjacent field, and it points at
+ * material the provider publishes.
  *
  * Fields naming something the provider owns carry a provider_ prefix, so the identifiers a
  * delivery arrives with are never confused with the ones Wix mints.
@@ -28037,39 +28039,6 @@ interface WebhookConfig extends WebhookConfigVerificationOneOf, WebhookConfigRep
      * @max 3600
      */
     timestampToleranceSeconds?: number;
-    /**
-     * Endpoint publishing the provider's public keys. Required for PUBLIC_KEY and OIDC_BEARER, and
-     * must be empty for every other method.
-     *
-     * Deliberately has no (wix.api.format), following revoke_url above: WEB_URL rejects the empty
-     * value this field carries for every other method. HTTPS and a parseable endpoint are enforced
-     * when the keys are fetched instead.
-     *
-     * Deprecated: superseded by PublicKeyConfig.public_key_url for PUBLIC_KEY, and by
-     * OidcBearerConfig.public_key_url for OIDC_BEARER.
-     * @maxLength 2000
-     * @deprecated
-     * @replacedBy verification.public_key_config.public_key_url (PUBLIC_KEY) or verification.oidc_bearer_config.public_key_url (OIDC_BEARER)
-     * @targetRemovalDate 2027-06-30
-     */
-    publicKeyUrl?: string;
-    /**
-     * Header carrying the provider's unique id for this delivery, for example "X-GitHub-Delivery".
-     * Required by, and legal only with, replay_protection = DELIVERY_ID_HEADER.
-     *
-     * The id is only as unique as the provider makes it. Google Calendar's X-Goog-Message-Number,
-     * for instance, counts per notification channel rather than globally, so a delivery is
-     * identified by the registration it arrived on together with this value, never by the value
-     * alone.
-     *
-     * Deprecated: superseded by DeliveryIdHeaderConfig.delivery_id_header (via the
-     * `replay_protection_config` oneof's delivery_id_header_config arm).
-     * @maxLength 120
-     * @deprecated
-     * @replacedBy replay_protection_config.delivery_id_header_config.delivery_id_header
-     * @targetRemovalDate 2027-06-30
-     */
-    deliveryIdHeader?: string;
     /**
      * Header carrying the event type of the delivery, for example "X-GitHub-Event". Optional: at
      * most one of event_type_header and event_type_json_pointer may be set, and a provider with no
@@ -28187,47 +28156,6 @@ interface WebhookConfig extends WebhookConfigVerificationOneOf, WebhookConfigRep
      * @immutable
      */
     deliveryTopic?: string;
-    /**
-     * Expected `aud` claim of an OIDC_BEARER token. An OIDC issuer's audience is chosen by whoever
-     * requested the token, not by the issuer, so pinning the value expected here is what stops a
-     * bearer token minted for a different audience — a different Pub/Sub push subscription, for
-     * instance — from authenticating against this one. Required for OIDC_BEARER and must be empty
-     * for every other method.
-     *
-     * Deprecated: superseded by OidcBearerConfig.oidc_expected_audience.
-     * @maxLength 2000
-     * @deprecated
-     * @replacedBy verification.oidc_bearer_config.oidc_expected_audience
-     * @targetRemovalDate 2027-06-30
-     */
-    oidcExpectedAudience?: string;
-    /**
-     * Expected `iss` claim of an OIDC_BEARER token, for example "https://accounts.google.com".
-     * Required for OIDC_BEARER and must be empty for every other method.
-     *
-     * Deprecated: superseded by OidcBearerConfig.oidc_expected_issuer.
-     * @maxLength 2000
-     * @deprecated
-     * @replacedBy verification.oidc_bearer_config.oidc_expected_issuer
-     * @targetRemovalDate 2027-06-30
-     */
-    oidcExpectedIssuer?: string;
-    /**
-     * Expected `sub` claim of an OIDC_BEARER token — the stable identifier of the specific caller
-     * trusted to send this connector's deliveries, for example a Pub/Sub push subscription's
-     * service account. iss and aud alone do not identify the sender: aud is a value the token
-     * *requester* chooses, not the issuer, so any principal able to mint a same-issuer,
-     * same-audience token — a different Google service account with permission to request an ID
-     * token for this audience, for instance — would otherwise pass. Required for OIDC_BEARER and
-     * must be empty for every other method.
-     *
-     * Deprecated: superseded by OidcBearerConfig.oidc_expected_subject.
-     * @maxLength 2000
-     * @deprecated
-     * @replacedBy verification.oidc_bearer_config.oidc_expected_subject
-     * @targetRemovalDate 2027-06-30
-     */
-    oidcExpectedSubject?: string;
     /**
      * Set when one delivery body is a batch of events, each possibly for a different provider tenant.
      * The whole request is verified once, then split into one delivery per element.