@wix/auto_sdk_app-components_components-catalog 1.0.110 → 1.0.111

package/build/internal/cjs/index.typings.d.ts

@@ -25680,8 +25680,8 @@ interface DispatchOrigin {
 declare enum VerificationSource {
     /**
      * One set of material covers every delivery of this connector: a single stored secret for the
-     * HMAC and callback-token methods, or the published key set at public_key_url for PUBLIC_KEY
-     * and OIDC_BEARER, where nothing is stored at all. The only legal scope for either.
+     * HMAC and callback-token methods, or the published key set at the arm's public_key_url for
+     * PUBLIC_KEY and OIDC_BEARER, where nothing is stored at all. The only legal scope for either.
      */
     CONNECTOR_WIDE = "CONNECTOR_WIDE",
     /**
@@ -25786,7 +25786,7 @@ declare enum VerificationMethod {
     HMAC_SHA1 = "HMAC_SHA1",
     /**
      * Asymmetric signature over the canonical string, verified with a key fetched from
-     * public_key_url.
+     * PublicKeyConfig.public_key_url.
      */
     PUBLIC_KEY = "PUBLIC_KEY",
     /**
@@ -25799,9 +25799,10 @@ declare enum VerificationMethod {
     NO_VERIFICATION = "NO_VERIFICATION",
     /**
      * OIDC bearer JWT in the Authorization header, verified against the key set at
-     * public_key_url with the expected audience, issuer and subject, for example Cloud Pub/Sub
-     * push authentication. Carries no payload binding, the same limitation CALLBACK_TOKEN
-     * documents for itself: it proves the sender's identity, not that the body is intact.
+     * OidcBearerConfig.public_key_url with the expected audience, issuer and subject, for
+     * example Cloud Pub/Sub push authentication. Carries no payload binding, the same
+     * limitation CALLBACK_TOKEN documents for itself: it proves the sender's identity, not that
+     * the body is intact.
      */
     OIDC_BEARER = "OIDC_BEARER"
 }
@@ -25810,8 +25811,8 @@ type VerificationMethodWithLiterals = VerificationMethod | 'HMAC_SHA256' | 'HMAC
 /** How a repeated delivery is recognized, so the same event is not processed twice. */
 declare enum ReplayProtection {
     /**
-     * The provider sends a per-delivery id, named by delivery_id_header, and a delivery already
-     * seen under that id is discarded.
+     * The provider sends a per-delivery id, named by DeliveryIdHeaderConfig.delivery_id_header,
+     * and a delivery already seen under that id is discarded.
      */
     DELIVERY_ID_HEADER = "DELIVERY_ID_HEADER",
     /**
@@ -26141,8 +26142,9 @@ interface DispatchConfig {
  *
  * No credential material is declared here. This config lives in the app component catalog and is
  * readable by app owners; signing secrets and callback tokens are stored separately and are
- * located through the selected verification arm's verification_source. public_key_url is the
- * only credential-adjacent field, and it points at material the provider publishes.
+ * located through the selected verification arm's verification_source. The public_key_url on
+ * PublicKeyConfig and OidcBearerConfig is the only credential-adjacent field, and it points at
+ * material the provider publishes.
  *
  * Fields naming something the provider owns carry a provider_ prefix, so the identifiers a
  * delivery arrives with are never confused with the ones Wix mints.
@@ -26198,39 +26200,6 @@ interface WebhookConfig extends WebhookConfigVerificationOneOf, WebhookConfigRep
      * @max 3600
      */
     timestampToleranceSeconds?: number;
-    /**
-     * Endpoint publishing the provider's public keys. Required for PUBLIC_KEY and OIDC_BEARER, and
-     * must be empty for every other method.
-     *
-     * Deliberately has no (wix.api.format), following revoke_url above: WEB_URL rejects the empty
-     * value this field carries for every other method. HTTPS and a parseable endpoint are enforced
-     * when the keys are fetched instead.
-     *
-     * Deprecated: superseded by PublicKeyConfig.public_key_url for PUBLIC_KEY, and by
-     * OidcBearerConfig.public_key_url for OIDC_BEARER.
-     * @maxLength 2000
-     * @deprecated
-     * @replacedBy verification.public_key_config.public_key_url (PUBLIC_KEY) or verification.oidc_bearer_config.public_key_url (OIDC_BEARER)
-     * @targetRemovalDate 2027-06-30
-     */
-    publicKeyUrl?: string;
-    /**
-     * Header carrying the provider's unique id for this delivery, for example "X-GitHub-Delivery".
-     * Required by, and legal only with, replay_protection = DELIVERY_ID_HEADER.
-     *
-     * The id is only as unique as the provider makes it. Google Calendar's X-Goog-Message-Number,
-     * for instance, counts per notification channel rather than globally, so a delivery is
-     * identified by the registration it arrived on together with this value, never by the value
-     * alone.
-     *
-     * Deprecated: superseded by DeliveryIdHeaderConfig.delivery_id_header (via the
-     * `replay_protection_config` oneof's delivery_id_header_config arm).
-     * @maxLength 120
-     * @deprecated
-     * @replacedBy replay_protection_config.delivery_id_header_config.delivery_id_header
-     * @targetRemovalDate 2027-06-30
-     */
-    deliveryIdHeader?: string;
     /**
      * Header carrying the event type of the delivery, for example "X-GitHub-Event". Optional: at
      * most one of event_type_header and event_type_json_pointer may be set, and a provider with no
@@ -26348,47 +26317,6 @@ interface WebhookConfig extends WebhookConfigVerificationOneOf, WebhookConfigRep
      * @immutable
      */
     deliveryTopic?: string;
-    /**
-     * Expected `aud` claim of an OIDC_BEARER token. An OIDC issuer's audience is chosen by whoever
-     * requested the token, not by the issuer, so pinning the value expected here is what stops a
-     * bearer token minted for a different audience — a different Pub/Sub push subscription, for
-     * instance — from authenticating against this one. Required for OIDC_BEARER and must be empty
-     * for every other method.
-     *
-     * Deprecated: superseded by OidcBearerConfig.oidc_expected_audience.
-     * @maxLength 2000
-     * @deprecated
-     * @replacedBy verification.oidc_bearer_config.oidc_expected_audience
-     * @targetRemovalDate 2027-06-30
-     */
-    oidcExpectedAudience?: string;
-    /**
-     * Expected `iss` claim of an OIDC_BEARER token, for example "https://accounts.google.com".
-     * Required for OIDC_BEARER and must be empty for every other method.
-     *
-     * Deprecated: superseded by OidcBearerConfig.oidc_expected_issuer.
-     * @maxLength 2000
-     * @deprecated
-     * @replacedBy verification.oidc_bearer_config.oidc_expected_issuer
-     * @targetRemovalDate 2027-06-30
-     */
-    oidcExpectedIssuer?: string;
-    /**
-     * Expected `sub` claim of an OIDC_BEARER token — the stable identifier of the specific caller
-     * trusted to send this connector's deliveries, for example a Pub/Sub push subscription's
-     * service account. iss and aud alone do not identify the sender: aud is a value the token
-     * *requester* chooses, not the issuer, so any principal able to mint a same-issuer,
-     * same-audience token — a different Google service account with permission to request an ID
-     * token for this audience, for instance — would otherwise pass. Required for OIDC_BEARER and
-     * must be empty for every other method.
-     *
-     * Deprecated: superseded by OidcBearerConfig.oidc_expected_subject.
-     * @maxLength 2000
-     * @deprecated
-     * @replacedBy verification.oidc_bearer_config.oidc_expected_subject
-     * @targetRemovalDate 2027-06-30
-     */
-    oidcExpectedSubject?: string;
     /**
      * Set when one delivery body is a batch of events, each possibly for a different provider tenant.
      * The whole request is verified once, then split into one delivery per element.

package/build/internal/cjs/meta.d.ts

@@ -25722,8 +25722,8 @@ interface DispatchOrigin {
 declare enum VerificationSource {
     /**
      * One set of material covers every delivery of this connector: a single stored secret for the
-     * HMAC and callback-token methods, or the published key set at public_key_url for PUBLIC_KEY
-     * and OIDC_BEARER, where nothing is stored at all. The only legal scope for either.
+     * HMAC and callback-token methods, or the published key set at the arm's public_key_url for
+     * PUBLIC_KEY and OIDC_BEARER, where nothing is stored at all. The only legal scope for either.
      */
     CONNECTOR_WIDE = "CONNECTOR_WIDE",
     /**
@@ -25828,7 +25828,7 @@ declare enum VerificationMethod {
     HMAC_SHA1 = "HMAC_SHA1",
     /**
      * Asymmetric signature over the canonical string, verified with a key fetched from
-     * public_key_url.
+     * PublicKeyConfig.public_key_url.
      */
     PUBLIC_KEY = "PUBLIC_KEY",
     /**
@@ -25841,9 +25841,10 @@ declare enum VerificationMethod {
     NO_VERIFICATION = "NO_VERIFICATION",
     /**
      * OIDC bearer JWT in the Authorization header, verified against the key set at
-     * public_key_url with the expected audience, issuer and subject, for example Cloud Pub/Sub
-     * push authentication. Carries no payload binding, the same limitation CALLBACK_TOKEN
-     * documents for itself: it proves the sender's identity, not that the body is intact.
+     * OidcBearerConfig.public_key_url with the expected audience, issuer and subject, for
+     * example Cloud Pub/Sub push authentication. Carries no payload binding, the same
+     * limitation CALLBACK_TOKEN documents for itself: it proves the sender's identity, not that
+     * the body is intact.
      */
     OIDC_BEARER = "OIDC_BEARER"
 }
@@ -25852,8 +25853,8 @@ type VerificationMethodWithLiterals = VerificationMethod | 'HMAC_SHA256' | 'HMAC
 /** How a repeated delivery is recognized, so the same event is not processed twice. */
 declare enum ReplayProtection {
     /**
-     * The provider sends a per-delivery id, named by delivery_id_header, and a delivery already
-     * seen under that id is discarded.
+     * The provider sends a per-delivery id, named by DeliveryIdHeaderConfig.delivery_id_header,
+     * and a delivery already seen under that id is discarded.
      */
     DELIVERY_ID_HEADER = "DELIVERY_ID_HEADER",
     /**
@@ -26183,8 +26184,9 @@ interface DispatchConfig {
  *
  * No credential material is declared here. This config lives in the app component catalog and is
  * readable by app owners; signing secrets and callback tokens are stored separately and are
- * located through the selected verification arm's verification_source. public_key_url is the
- * only credential-adjacent field, and it points at material the provider publishes.
+ * located through the selected verification arm's verification_source. The public_key_url on
+ * PublicKeyConfig and OidcBearerConfig is the only credential-adjacent field, and it points at
+ * material the provider publishes.
  *
  * Fields naming something the provider owns carry a provider_ prefix, so the identifiers a
  * delivery arrives with are never confused with the ones Wix mints.
@@ -26240,39 +26242,6 @@ interface WebhookConfig extends WebhookConfigVerificationOneOf, WebhookConfigRep
      * @max 3600
      */
     timestampToleranceSeconds?: number;
-    /**
-     * Endpoint publishing the provider's public keys. Required for PUBLIC_KEY and OIDC_BEARER, and
-     * must be empty for every other method.
-     *
-     * Deliberately has no (wix.api.format), following revoke_url above: WEB_URL rejects the empty
-     * value this field carries for every other method. HTTPS and a parseable endpoint are enforced
-     * when the keys are fetched instead.
-     *
-     * Deprecated: superseded by PublicKeyConfig.public_key_url for PUBLIC_KEY, and by
-     * OidcBearerConfig.public_key_url for OIDC_BEARER.
-     * @maxLength 2000
-     * @deprecated
-     * @replacedBy verification.public_key_config.public_key_url (PUBLIC_KEY) or verification.oidc_bearer_config.public_key_url (OIDC_BEARER)
-     * @targetRemovalDate 2027-06-30
-     */
-    publicKeyUrl?: string;
-    /**
-     * Header carrying the provider's unique id for this delivery, for example "X-GitHub-Delivery".
-     * Required by, and legal only with, replay_protection = DELIVERY_ID_HEADER.
-     *
-     * The id is only as unique as the provider makes it. Google Calendar's X-Goog-Message-Number,
-     * for instance, counts per notification channel rather than globally, so a delivery is
-     * identified by the registration it arrived on together with this value, never by the value
-     * alone.
-     *
-     * Deprecated: superseded by DeliveryIdHeaderConfig.delivery_id_header (via the
-     * `replay_protection_config` oneof's delivery_id_header_config arm).
-     * @maxLength 120
-     * @deprecated
-     * @replacedBy replay_protection_config.delivery_id_header_config.delivery_id_header
-     * @targetRemovalDate 2027-06-30
-     */
-    deliveryIdHeader?: string;
     /**
      * Header carrying the event type of the delivery, for example "X-GitHub-Event". Optional: at
      * most one of event_type_header and event_type_json_pointer may be set, and a provider with no
@@ -26390,47 +26359,6 @@ interface WebhookConfig extends WebhookConfigVerificationOneOf, WebhookConfigRep
      * @immutable
      */
     deliveryTopic?: string;
-    /**
-     * Expected `aud` claim of an OIDC_BEARER token. An OIDC issuer's audience is chosen by whoever
-     * requested the token, not by the issuer, so pinning the value expected here is what stops a
-     * bearer token minted for a different audience — a different Pub/Sub push subscription, for
-     * instance — from authenticating against this one. Required for OIDC_BEARER and must be empty
-     * for every other method.
-     *
-     * Deprecated: superseded by OidcBearerConfig.oidc_expected_audience.
-     * @maxLength 2000
-     * @deprecated
-     * @replacedBy verification.oidc_bearer_config.oidc_expected_audience
-     * @targetRemovalDate 2027-06-30
-     */
-    oidcExpectedAudience?: string;
-    /**
-     * Expected `iss` claim of an OIDC_BEARER token, for example "https://accounts.google.com".
-     * Required for OIDC_BEARER and must be empty for every other method.
-     *
-     * Deprecated: superseded by OidcBearerConfig.oidc_expected_issuer.
-     * @maxLength 2000
-     * @deprecated
-     * @replacedBy verification.oidc_bearer_config.oidc_expected_issuer
-     * @targetRemovalDate 2027-06-30
-     */
-    oidcExpectedIssuer?: string;
-    /**
-     * Expected `sub` claim of an OIDC_BEARER token — the stable identifier of the specific caller
-     * trusted to send this connector's deliveries, for example a Pub/Sub push subscription's
-     * service account. iss and aud alone do not identify the sender: aud is a value the token
-     * *requester* chooses, not the issuer, so any principal able to mint a same-issuer,
-     * same-audience token — a different Google service account with permission to request an ID
-     * token for this audience, for instance — would otherwise pass. Required for OIDC_BEARER and
-     * must be empty for every other method.
-     *
-     * Deprecated: superseded by OidcBearerConfig.oidc_expected_subject.
-     * @maxLength 2000
-     * @deprecated
-     * @replacedBy verification.oidc_bearer_config.oidc_expected_subject
-     * @targetRemovalDate 2027-06-30
-     */
-    oidcExpectedSubject?: string;
     /**
      * Set when one delivery body is a batch of events, each possibly for a different provider tenant.
      * The whole request is verified once, then split into one delivery per element.

package/build/internal/es/index.typings.d.mts

@@ -25680,8 +25680,8 @@ interface DispatchOrigin {
 declare enum VerificationSource {
     /**
      * One set of material covers every delivery of this connector: a single stored secret for the
-     * HMAC and callback-token methods, or the published key set at public_key_url for PUBLIC_KEY
-     * and OIDC_BEARER, where nothing is stored at all. The only legal scope for either.
+     * HMAC and callback-token methods, or the published key set at the arm's public_key_url for
+     * PUBLIC_KEY and OIDC_BEARER, where nothing is stored at all. The only legal scope for either.
      */
     CONNECTOR_WIDE = "CONNECTOR_WIDE",
     /**
@@ -25786,7 +25786,7 @@ declare enum VerificationMethod {
     HMAC_SHA1 = "HMAC_SHA1",
     /**
      * Asymmetric signature over the canonical string, verified with a key fetched from
-     * public_key_url.
+     * PublicKeyConfig.public_key_url.
      */
     PUBLIC_KEY = "PUBLIC_KEY",
     /**
@@ -25799,9 +25799,10 @@ declare enum VerificationMethod {
     NO_VERIFICATION = "NO_VERIFICATION",
     /**
      * OIDC bearer JWT in the Authorization header, verified against the key set at
-     * public_key_url with the expected audience, issuer and subject, for example Cloud Pub/Sub
-     * push authentication. Carries no payload binding, the same limitation CALLBACK_TOKEN
-     * documents for itself: it proves the sender's identity, not that the body is intact.
+     * OidcBearerConfig.public_key_url with the expected audience, issuer and subject, for
+     * example Cloud Pub/Sub push authentication. Carries no payload binding, the same
+     * limitation CALLBACK_TOKEN documents for itself: it proves the sender's identity, not that
+     * the body is intact.
      */
     OIDC_BEARER = "OIDC_BEARER"
 }
@@ -25810,8 +25811,8 @@ type VerificationMethodWithLiterals = VerificationMethod | 'HMAC_SHA256' | 'HMAC
 /** How a repeated delivery is recognized, so the same event is not processed twice. */
 declare enum ReplayProtection {
     /**
-     * The provider sends a per-delivery id, named by delivery_id_header, and a delivery already
-     * seen under that id is discarded.
+     * The provider sends a per-delivery id, named by DeliveryIdHeaderConfig.delivery_id_header,
+     * and a delivery already seen under that id is discarded.
      */
     DELIVERY_ID_HEADER = "DELIVERY_ID_HEADER",
     /**
@@ -26141,8 +26142,9 @@ interface DispatchConfig {
  *
  * No credential material is declared here. This config lives in the app component catalog and is
  * readable by app owners; signing secrets and callback tokens are stored separately and are
- * located through the selected verification arm's verification_source. public_key_url is the
- * only credential-adjacent field, and it points at material the provider publishes.
+ * located through the selected verification arm's verification_source. The public_key_url on
+ * PublicKeyConfig and OidcBearerConfig is the only credential-adjacent field, and it points at
+ * material the provider publishes.
  *
  * Fields naming something the provider owns carry a provider_ prefix, so the identifiers a
  * delivery arrives with are never confused with the ones Wix mints.
@@ -26198,39 +26200,6 @@ interface WebhookConfig extends WebhookConfigVerificationOneOf, WebhookConfigRep
      * @max 3600
      */
     timestampToleranceSeconds?: number;
-    /**
-     * Endpoint publishing the provider's public keys. Required for PUBLIC_KEY and OIDC_BEARER, and
-     * must be empty for every other method.
-     *
-     * Deliberately has no (wix.api.format), following revoke_url above: WEB_URL rejects the empty
-     * value this field carries for every other method. HTTPS and a parseable endpoint are enforced
-     * when the keys are fetched instead.
-     *
-     * Deprecated: superseded by PublicKeyConfig.public_key_url for PUBLIC_KEY, and by
-     * OidcBearerConfig.public_key_url for OIDC_BEARER.
-     * @maxLength 2000
-     * @deprecated
-     * @replacedBy verification.public_key_config.public_key_url (PUBLIC_KEY) or verification.oidc_bearer_config.public_key_url (OIDC_BEARER)
-     * @targetRemovalDate 2027-06-30
-     */
-    publicKeyUrl?: string;
-    /**
-     * Header carrying the provider's unique id for this delivery, for example "X-GitHub-Delivery".
-     * Required by, and legal only with, replay_protection = DELIVERY_ID_HEADER.
-     *
-     * The id is only as unique as the provider makes it. Google Calendar's X-Goog-Message-Number,
-     * for instance, counts per notification channel rather than globally, so a delivery is
-     * identified by the registration it arrived on together with this value, never by the value
-     * alone.
-     *
-     * Deprecated: superseded by DeliveryIdHeaderConfig.delivery_id_header (via the
-     * `replay_protection_config` oneof's delivery_id_header_config arm).
-     * @maxLength 120
-     * @deprecated
-     * @replacedBy replay_protection_config.delivery_id_header_config.delivery_id_header
-     * @targetRemovalDate 2027-06-30
-     */
-    deliveryIdHeader?: string;
     /**
      * Header carrying the event type of the delivery, for example "X-GitHub-Event". Optional: at
      * most one of event_type_header and event_type_json_pointer may be set, and a provider with no
@@ -26348,47 +26317,6 @@ interface WebhookConfig extends WebhookConfigVerificationOneOf, WebhookConfigRep
      * @immutable
      */
     deliveryTopic?: string;
-    /**
-     * Expected `aud` claim of an OIDC_BEARER token. An OIDC issuer's audience is chosen by whoever
-     * requested the token, not by the issuer, so pinning the value expected here is what stops a
-     * bearer token minted for a different audience — a different Pub/Sub push subscription, for
-     * instance — from authenticating against this one. Required for OIDC_BEARER and must be empty
-     * for every other method.
-     *
-     * Deprecated: superseded by OidcBearerConfig.oidc_expected_audience.
-     * @maxLength 2000
-     * @deprecated
-     * @replacedBy verification.oidc_bearer_config.oidc_expected_audience
-     * @targetRemovalDate 2027-06-30
-     */
-    oidcExpectedAudience?: string;
-    /**
-     * Expected `iss` claim of an OIDC_BEARER token, for example "https://accounts.google.com".
-     * Required for OIDC_BEARER and must be empty for every other method.
-     *
-     * Deprecated: superseded by OidcBearerConfig.oidc_expected_issuer.
-     * @maxLength 2000
-     * @deprecated
-     * @replacedBy verification.oidc_bearer_config.oidc_expected_issuer
-     * @targetRemovalDate 2027-06-30
-     */
-    oidcExpectedIssuer?: string;
-    /**
-     * Expected `sub` claim of an OIDC_BEARER token — the stable identifier of the specific caller
-     * trusted to send this connector's deliveries, for example a Pub/Sub push subscription's
-     * service account. iss and aud alone do not identify the sender: aud is a value the token
-     * *requester* chooses, not the issuer, so any principal able to mint a same-issuer,
-     * same-audience token — a different Google service account with permission to request an ID
-     * token for this audience, for instance — would otherwise pass. Required for OIDC_BEARER and
-     * must be empty for every other method.
-     *
-     * Deprecated: superseded by OidcBearerConfig.oidc_expected_subject.
-     * @maxLength 2000
-     * @deprecated
-     * @replacedBy verification.oidc_bearer_config.oidc_expected_subject
-     * @targetRemovalDate 2027-06-30
-     */
-    oidcExpectedSubject?: string;
     /**
      * Set when one delivery body is a batch of events, each possibly for a different provider tenant.
      * The whole request is verified once, then split into one delivery per element.

package/build/internal/es/meta.d.mts

@@ -25722,8 +25722,8 @@ interface DispatchOrigin {
 declare enum VerificationSource {
     /**
      * One set of material covers every delivery of this connector: a single stored secret for the
-     * HMAC and callback-token methods, or the published key set at public_key_url for PUBLIC_KEY
-     * and OIDC_BEARER, where nothing is stored at all. The only legal scope for either.
+     * HMAC and callback-token methods, or the published key set at the arm's public_key_url for
+     * PUBLIC_KEY and OIDC_BEARER, where nothing is stored at all. The only legal scope for either.
      */
     CONNECTOR_WIDE = "CONNECTOR_WIDE",
     /**
@@ -25828,7 +25828,7 @@ declare enum VerificationMethod {
     HMAC_SHA1 = "HMAC_SHA1",
     /**
      * Asymmetric signature over the canonical string, verified with a key fetched from
-     * public_key_url.
+     * PublicKeyConfig.public_key_url.
      */
     PUBLIC_KEY = "PUBLIC_KEY",
     /**
@@ -25841,9 +25841,10 @@ declare enum VerificationMethod {
     NO_VERIFICATION = "NO_VERIFICATION",
     /**
      * OIDC bearer JWT in the Authorization header, verified against the key set at
-     * public_key_url with the expected audience, issuer and subject, for example Cloud Pub/Sub
-     * push authentication. Carries no payload binding, the same limitation CALLBACK_TOKEN
-     * documents for itself: it proves the sender's identity, not that the body is intact.
+     * OidcBearerConfig.public_key_url with the expected audience, issuer and subject, for
+     * example Cloud Pub/Sub push authentication. Carries no payload binding, the same
+     * limitation CALLBACK_TOKEN documents for itself: it proves the sender's identity, not that
+     * the body is intact.
      */
     OIDC_BEARER = "OIDC_BEARER"
 }
@@ -25852,8 +25853,8 @@ type VerificationMethodWithLiterals = VerificationMethod | 'HMAC_SHA256' | 'HMAC
 /** How a repeated delivery is recognized, so the same event is not processed twice. */
 declare enum ReplayProtection {
     /**
-     * The provider sends a per-delivery id, named by delivery_id_header, and a delivery already
-     * seen under that id is discarded.
+     * The provider sends a per-delivery id, named by DeliveryIdHeaderConfig.delivery_id_header,
+     * and a delivery already seen under that id is discarded.
      */
     DELIVERY_ID_HEADER = "DELIVERY_ID_HEADER",
     /**
@@ -26183,8 +26184,9 @@ interface DispatchConfig {
  *
  * No credential material is declared here. This config lives in the app component catalog and is
  * readable by app owners; signing secrets and callback tokens are stored separately and are
- * located through the selected verification arm's verification_source. public_key_url is the
- * only credential-adjacent field, and it points at material the provider publishes.
+ * located through the selected verification arm's verification_source. The public_key_url on
+ * PublicKeyConfig and OidcBearerConfig is the only credential-adjacent field, and it points at
+ * material the provider publishes.
  *
  * Fields naming something the provider owns carry a provider_ prefix, so the identifiers a
  * delivery arrives with are never confused with the ones Wix mints.
@@ -26240,39 +26242,6 @@ interface WebhookConfig extends WebhookConfigVerificationOneOf, WebhookConfigRep
      * @max 3600
      */
     timestampToleranceSeconds?: number;
-    /**
-     * Endpoint publishing the provider's public keys. Required for PUBLIC_KEY and OIDC_BEARER, and
-     * must be empty for every other method.
-     *
-     * Deliberately has no (wix.api.format), following revoke_url above: WEB_URL rejects the empty
-     * value this field carries for every other method. HTTPS and a parseable endpoint are enforced
-     * when the keys are fetched instead.
-     *
-     * Deprecated: superseded by PublicKeyConfig.public_key_url for PUBLIC_KEY, and by
-     * OidcBearerConfig.public_key_url for OIDC_BEARER.
-     * @maxLength 2000
-     * @deprecated
-     * @replacedBy verification.public_key_config.public_key_url (PUBLIC_KEY) or verification.oidc_bearer_config.public_key_url (OIDC_BEARER)
-     * @targetRemovalDate 2027-06-30
-     */
-    publicKeyUrl?: string;
-    /**
-     * Header carrying the provider's unique id for this delivery, for example "X-GitHub-Delivery".
-     * Required by, and legal only with, replay_protection = DELIVERY_ID_HEADER.
-     *
-     * The id is only as unique as the provider makes it. Google Calendar's X-Goog-Message-Number,
-     * for instance, counts per notification channel rather than globally, so a delivery is
-     * identified by the registration it arrived on together with this value, never by the value
-     * alone.
-     *
-     * Deprecated: superseded by DeliveryIdHeaderConfig.delivery_id_header (via the
-     * `replay_protection_config` oneof's delivery_id_header_config arm).
-     * @maxLength 120
-     * @deprecated
-     * @replacedBy replay_protection_config.delivery_id_header_config.delivery_id_header
-     * @targetRemovalDate 2027-06-30
-     */
-    deliveryIdHeader?: string;
     /**
      * Header carrying the event type of the delivery, for example "X-GitHub-Event". Optional: at
      * most one of event_type_header and event_type_json_pointer may be set, and a provider with no
@@ -26390,47 +26359,6 @@ interface WebhookConfig extends WebhookConfigVerificationOneOf, WebhookConfigRep
      * @immutable
      */
     deliveryTopic?: string;
-    /**
-     * Expected `aud` claim of an OIDC_BEARER token. An OIDC issuer's audience is chosen by whoever
-     * requested the token, not by the issuer, so pinning the value expected here is what stops a
-     * bearer token minted for a different audience — a different Pub/Sub push subscription, for
-     * instance — from authenticating against this one. Required for OIDC_BEARER and must be empty
-     * for every other method.
-     *
-     * Deprecated: superseded by OidcBearerConfig.oidc_expected_audience.
-     * @maxLength 2000
-     * @deprecated
-     * @replacedBy verification.oidc_bearer_config.oidc_expected_audience
-     * @targetRemovalDate 2027-06-30
-     */
-    oidcExpectedAudience?: string;
-    /**
-     * Expected `iss` claim of an OIDC_BEARER token, for example "https://accounts.google.com".
-     * Required for OIDC_BEARER and must be empty for every other method.
-     *
-     * Deprecated: superseded by OidcBearerConfig.oidc_expected_issuer.
-     * @maxLength 2000
-     * @deprecated
-     * @replacedBy verification.oidc_bearer_config.oidc_expected_issuer
-     * @targetRemovalDate 2027-06-30
-     */
-    oidcExpectedIssuer?: string;
-    /**
-     * Expected `sub` claim of an OIDC_BEARER token — the stable identifier of the specific caller
-     * trusted to send this connector's deliveries, for example a Pub/Sub push subscription's
-     * service account. iss and aud alone do not identify the sender: aud is a value the token
-     * *requester* chooses, not the issuer, so any principal able to mint a same-issuer,
-     * same-audience token — a different Google service account with permission to request an ID
-     * token for this audience, for instance — would otherwise pass. Required for OIDC_BEARER and
-     * must be empty for every other method.
-     *
-     * Deprecated: superseded by OidcBearerConfig.oidc_expected_subject.
-     * @maxLength 2000
-     * @deprecated
-     * @replacedBy verification.oidc_bearer_config.oidc_expected_subject
-     * @targetRemovalDate 2027-06-30
-     */
-    oidcExpectedSubject?: string;
     /**
      * Set when one delivery body is a batch of events, each possibly for a different provider tenant.
      * The whole request is verified once, then split into one delivery per element.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/auto_sdk_app-components_components-catalog",
-  "version": "1.0.110",
+  "version": "1.0.111",
   "license": "MIT",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
@@ -50,5 +50,5 @@
       "fqdn": "wix.devcenter.v1.component_type_data"
     }
   },
-  "falconPackageHash": "7ced1f0cb28b86f43ac625efd4bbedeb547886636ded764f897b4fbb"
+  "falconPackageHash": "a6c57a2e13261bf9bf4192929eab5286aff6dfd4ab96143fb66c5fac"
 }