@wix/auto_sdk_app-components_components-catalog 1.0.76 → 1.0.77

package/build/internal/cjs/index.typings.d.ts

@@ -24949,8 +24949,8 @@ interface WebhookConfig {
      */
     callbackTokenHeader?: string;
     /**
-     * Endpoint publishing the provider's public keys, used to verify a PUBLIC_KEY signature.
-     * Required for PUBLIC_KEY and must be empty for every other method.
+     * Endpoint publishing the provider's public keys. Required for PUBLIC_KEY and must be empty for
+     * every other method.
      *
      * Deliberately has no (wix.api.format), following revoke_url above: WEB_URL rejects the empty
      * value this field carries for every other method. HTTPS and a parseable endpoint are enforced
@@ -25082,6 +25082,32 @@ interface WebhookConfig {
      * @immutable
      */
     deliveryTopic?: string;
+    /**
+     * Expected `aud` claim of an OIDC_BEARER token. An OIDC issuer's audience is chosen by whoever
+     * requested the token, not by the issuer, so pinning the value expected here is what stops a
+     * bearer token minted for a different audience — a different Pub/Sub push subscription, for
+     * instance — from authenticating against this one. Required for OIDC_BEARER and must be empty
+     * for every other method.
+     * @maxLength 2000
+     */
+    oidcExpectedAudience?: string;
+    /**
+     * Expected `iss` claim of an OIDC_BEARER token, for example "https://accounts.google.com".
+     * Required for OIDC_BEARER and must be empty for every other method.
+     * @maxLength 2000
+     */
+    oidcExpectedIssuer?: string;
+    /**
+     * Expected `sub` claim of an OIDC_BEARER token — the stable identifier of the specific caller
+     * trusted to send this connector's deliveries, for example a Pub/Sub push subscription's
+     * service account. iss and aud alone do not identify the sender: aud is a value the token
+     * *requester* chooses, not the issuer, so any principal able to mint a same-issuer,
+     * same-audience token — a different Google service account with permission to request an ID
+     * token for this audience, for instance — would otherwise pass. Required for OIDC_BEARER and
+     * must be empty for every other method.
+     * @maxLength 2000
+     */
+    oidcExpectedSubject?: string;
 }
 /**
  * Declares the connector's MCP (Model Context Protocol) surface: the endpoint connector dispatch

package/build/internal/cjs/meta.d.ts

@@ -24991,8 +24991,8 @@ interface WebhookConfig {
      */
     callbackTokenHeader?: string;
     /**
-     * Endpoint publishing the provider's public keys, used to verify a PUBLIC_KEY signature.
-     * Required for PUBLIC_KEY and must be empty for every other method.
+     * Endpoint publishing the provider's public keys. Required for PUBLIC_KEY and must be empty for
+     * every other method.
      *
      * Deliberately has no (wix.api.format), following revoke_url above: WEB_URL rejects the empty
      * value this field carries for every other method. HTTPS and a parseable endpoint are enforced
@@ -25124,6 +25124,32 @@ interface WebhookConfig {
      * @immutable
      */
     deliveryTopic?: string;
+    /**
+     * Expected `aud` claim of an OIDC_BEARER token. An OIDC issuer's audience is chosen by whoever
+     * requested the token, not by the issuer, so pinning the value expected here is what stops a
+     * bearer token minted for a different audience — a different Pub/Sub push subscription, for
+     * instance — from authenticating against this one. Required for OIDC_BEARER and must be empty
+     * for every other method.
+     * @maxLength 2000
+     */
+    oidcExpectedAudience?: string;
+    /**
+     * Expected `iss` claim of an OIDC_BEARER token, for example "https://accounts.google.com".
+     * Required for OIDC_BEARER and must be empty for every other method.
+     * @maxLength 2000
+     */
+    oidcExpectedIssuer?: string;
+    /**
+     * Expected `sub` claim of an OIDC_BEARER token — the stable identifier of the specific caller
+     * trusted to send this connector's deliveries, for example a Pub/Sub push subscription's
+     * service account. iss and aud alone do not identify the sender: aud is a value the token
+     * *requester* chooses, not the issuer, so any principal able to mint a same-issuer,
+     * same-audience token — a different Google service account with permission to request an ID
+     * token for this audience, for instance — would otherwise pass. Required for OIDC_BEARER and
+     * must be empty for every other method.
+     * @maxLength 2000
+     */
+    oidcExpectedSubject?: string;
 }
 /**
  * Declares the connector's MCP (Model Context Protocol) surface: the endpoint connector dispatch

package/build/internal/es/index.typings.d.mts

@@ -24949,8 +24949,8 @@ interface WebhookConfig {
      */
     callbackTokenHeader?: string;
     /**
-     * Endpoint publishing the provider's public keys, used to verify a PUBLIC_KEY signature.
-     * Required for PUBLIC_KEY and must be empty for every other method.
+     * Endpoint publishing the provider's public keys. Required for PUBLIC_KEY and must be empty for
+     * every other method.
      *
      * Deliberately has no (wix.api.format), following revoke_url above: WEB_URL rejects the empty
      * value this field carries for every other method. HTTPS and a parseable endpoint are enforced
@@ -25082,6 +25082,32 @@ interface WebhookConfig {
      * @immutable
      */
     deliveryTopic?: string;
+    /**
+     * Expected `aud` claim of an OIDC_BEARER token. An OIDC issuer's audience is chosen by whoever
+     * requested the token, not by the issuer, so pinning the value expected here is what stops a
+     * bearer token minted for a different audience — a different Pub/Sub push subscription, for
+     * instance — from authenticating against this one. Required for OIDC_BEARER and must be empty
+     * for every other method.
+     * @maxLength 2000
+     */
+    oidcExpectedAudience?: string;
+    /**
+     * Expected `iss` claim of an OIDC_BEARER token, for example "https://accounts.google.com".
+     * Required for OIDC_BEARER and must be empty for every other method.
+     * @maxLength 2000
+     */
+    oidcExpectedIssuer?: string;
+    /**
+     * Expected `sub` claim of an OIDC_BEARER token — the stable identifier of the specific caller
+     * trusted to send this connector's deliveries, for example a Pub/Sub push subscription's
+     * service account. iss and aud alone do not identify the sender: aud is a value the token
+     * *requester* chooses, not the issuer, so any principal able to mint a same-issuer,
+     * same-audience token — a different Google service account with permission to request an ID
+     * token for this audience, for instance — would otherwise pass. Required for OIDC_BEARER and
+     * must be empty for every other method.
+     * @maxLength 2000
+     */
+    oidcExpectedSubject?: string;
 }
 /**
  * Declares the connector's MCP (Model Context Protocol) surface: the endpoint connector dispatch

package/build/internal/es/meta.d.mts

@@ -24991,8 +24991,8 @@ interface WebhookConfig {
      */
     callbackTokenHeader?: string;
     /**
-     * Endpoint publishing the provider's public keys, used to verify a PUBLIC_KEY signature.
-     * Required for PUBLIC_KEY and must be empty for every other method.
+     * Endpoint publishing the provider's public keys. Required for PUBLIC_KEY and must be empty for
+     * every other method.
      *
      * Deliberately has no (wix.api.format), following revoke_url above: WEB_URL rejects the empty
      * value this field carries for every other method. HTTPS and a parseable endpoint are enforced
@@ -25124,6 +25124,32 @@ interface WebhookConfig {
      * @immutable
      */
     deliveryTopic?: string;
+    /**
+     * Expected `aud` claim of an OIDC_BEARER token. An OIDC issuer's audience is chosen by whoever
+     * requested the token, not by the issuer, so pinning the value expected here is what stops a
+     * bearer token minted for a different audience — a different Pub/Sub push subscription, for
+     * instance — from authenticating against this one. Required for OIDC_BEARER and must be empty
+     * for every other method.
+     * @maxLength 2000
+     */
+    oidcExpectedAudience?: string;
+    /**
+     * Expected `iss` claim of an OIDC_BEARER token, for example "https://accounts.google.com".
+     * Required for OIDC_BEARER and must be empty for every other method.
+     * @maxLength 2000
+     */
+    oidcExpectedIssuer?: string;
+    /**
+     * Expected `sub` claim of an OIDC_BEARER token — the stable identifier of the specific caller
+     * trusted to send this connector's deliveries, for example a Pub/Sub push subscription's
+     * service account. iss and aud alone do not identify the sender: aud is a value the token
+     * *requester* chooses, not the issuer, so any principal able to mint a same-issuer,
+     * same-audience token — a different Google service account with permission to request an ID
+     * token for this audience, for instance — would otherwise pass. Required for OIDC_BEARER and
+     * must be empty for every other method.
+     * @maxLength 2000
+     */
+    oidcExpectedSubject?: string;
 }
 /**
  * Declares the connector's MCP (Model Context Protocol) surface: the endpoint connector dispatch

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/auto_sdk_app-components_components-catalog",
-  "version": "1.0.76",
+  "version": "1.0.77",
   "license": "MIT",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
@@ -50,5 +50,5 @@
       "fqdn": "wix.devcenter.v1.component_type_data"
     }
   },
-  "falconPackageHash": "a51222ee36384a82631f062a58fc0fb14c77d8f9e62fd18e1d336a28"
+  "falconPackageHash": "4e8ae9ecf1e5d3a95db059538f49b3cc590ae604264e71372ab71ffd"
 }