@xemahq/contracts 0.1.0

package/dist/connector/lib/credential-auth-type.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CredentialAuthType = void 0;
+var CredentialAuthType;
+(function (CredentialAuthType) {
+    CredentialAuthType["None"] = "none";
+    CredentialAuthType["Bearer"] = "bearer";
+    CredentialAuthType["ApiKey"] = "api_key";
+    CredentialAuthType["Basic"] = "basic";
+    CredentialAuthType["OAuth2"] = "oauth2";
+    CredentialAuthType["AppInstall"] = "app_install";
+    CredentialAuthType["IamRole"] = "iam_role";
+})(CredentialAuthType || (exports.CredentialAuthType = CredentialAuthType = {}));
+//# sourceMappingURL=credential-auth-type.js.map

package/dist/connector/lib/credential-auth-type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-auth-type.js","sourceRoot":"","sources":["../../../src/connector/lib/credential-auth-type.ts"],"names":[],"mappings":";;;AAOA,IAAY,kBAQX;AARD,WAAY,kBAAkB;IAC5B,mCAAa,CAAA;IACb,uCAAiB,CAAA;IACjB,wCAAkB,CAAA;IAClB,qCAAe,CAAA;IACf,uCAAiB,CAAA;IACjB,gDAA0B,CAAA;IAC1B,0CAAoB,CAAA;AACtB,CAAC,EARW,kBAAkB,kCAAlB,kBAAkB,QAQ7B"}

package/dist/connector/lib/credential-kind-fields.d.ts

@@ -0,0 +1,31 @@
+import { CredentialKind } from './credential-kind';
+import { type ProviderOnboardingManifest } from './onboarding-manifest';
+import { ProviderAppAuthKind } from './provider-descriptor';
+export declare enum CredentialField {
+    AccessToken = "accessToken",
+    Username = "username",
+    Password = "password",
+    Secret = "secret",
+    Host = "host",
+    Port = "port",
+    RoleArn = "roleArn"
+}
+export declare enum CredentialBlobOrigin {
+    OnboardingForm = "onboarding-form",
+    OAuthCallback = "oauth-callback",
+    PlatformMint = "platform-mint"
+}
+export declare const CURATED_CREDENTIAL_KIND_REQUIRED_FIELDS: Readonly<Record<CredentialKind, readonly CredentialField[]>>;
+export declare function credentialBlobOrigin(appAuthKind: ProviderAppAuthKind): CredentialBlobOrigin;
+export declare const OAUTH_CALLBACK_CREDENTIAL_FIELDS: readonly CredentialField[];
+export declare class CredentialFieldContractError extends Error {
+    constructor(message: string);
+}
+export declare function assertCredentialBlobFieldsSatisfyKind(kind: CredentialKind, blobFieldNames: readonly string[], subject: string): void;
+export declare function assertConnectorCredentialDeclaration(input: {
+    readonly subject: string;
+    readonly credentialKind: CredentialKind;
+    readonly appAuthKind: ProviderAppAuthKind;
+    readonly onboarding: Pick<ProviderOnboardingManifest, 'kind' | 'fields'>;
+}): void;
+//# sourceMappingURL=credential-kind-fields.d.ts.map

package/dist/connector/lib/credential-kind-fields.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-kind-fields.d.ts","sourceRoot":"","sources":["../../../src/connector/lib/credential-kind-fields.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAGL,KAAK,0BAA0B,EAChC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAc5D,oBAAY,eAAe;IAEzB,WAAW,gBAAgB;IAE3B,QAAQ,aAAa;IAErB,QAAQ,aAAa;IAErB,MAAM,WAAW;IAEjB,IAAI,SAAS;IAEb,IAAI,SAAS;IAEb,OAAO,YAAY;CACpB;AAiBD,oBAAY,oBAAoB;IAC9B,cAAc,oBAAoB;IAClC,aAAa,mBAAmB;IAChC,YAAY,kBAAkB;CAC/B;AAYD,eAAO,MAAM,uCAAuC,EAAE,QAAQ,CAC5D,MAAM,CAAC,cAAc,EAAE,SAAS,eAAe,EAAE,CAAC,CA2BW,CAAC;AAMhE,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,mBAAmB,GAC/B,oBAAoB,CAetB;AASD,eAAO,MAAM,gCAAgC,EAAE,SAAS,eAAe,EACzB,CAAC;AAG/C,qBAAa,4BAA6B,SAAQ,KAAK;gBACzC,OAAO,EAAE,MAAM;CAI5B;AASD,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,cAAc,EACpB,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,OAAO,EAAE,MAAM,GACd,IAAI,CAYN;AAqBD,wBAAgB,oCAAoC,CAAC,KAAK,EAAE;IAE1D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,0BAA0B,EAAE,MAAM,GAAG,QAAQ,CAAC,CAAC;CAC1E,GAAG,IAAI,CAgEP"}

package/dist/connector/lib/credential-kind-fields.js

@@ -0,0 +1,132 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CredentialFieldContractError = exports.OAUTH_CALLBACK_CREDENTIAL_FIELDS = exports.CURATED_CREDENTIAL_KIND_REQUIRED_FIELDS = exports.CredentialBlobOrigin = exports.CredentialField = void 0;
+exports.credentialBlobOrigin = credentialBlobOrigin;
+exports.assertCredentialBlobFieldsSatisfyKind = assertCredentialBlobFieldsSatisfyKind;
+exports.assertConnectorCredentialDeclaration = assertConnectorCredentialDeclaration;
+const credential_kind_1 = require("./credential-kind");
+const onboarding_manifest_1 = require("./onboarding-manifest");
+const provider_descriptor_1 = require("./provider-descriptor");
+var CredentialField;
+(function (CredentialField) {
+    CredentialField["AccessToken"] = "accessToken";
+    CredentialField["Username"] = "username";
+    CredentialField["Password"] = "password";
+    CredentialField["Secret"] = "secret";
+    CredentialField["Host"] = "host";
+    CredentialField["Port"] = "port";
+    CredentialField["RoleArn"] = "roleArn";
+})(CredentialField || (exports.CredentialField = CredentialField = {}));
+var CredentialBlobOrigin;
+(function (CredentialBlobOrigin) {
+    CredentialBlobOrigin["OnboardingForm"] = "onboarding-form";
+    CredentialBlobOrigin["OAuthCallback"] = "oauth-callback";
+    CredentialBlobOrigin["PlatformMint"] = "platform-mint";
+})(CredentialBlobOrigin || (exports.CredentialBlobOrigin = CredentialBlobOrigin = {}));
+exports.CURATED_CREDENTIAL_KIND_REQUIRED_FIELDS = Object.freeze({
+    [credential_kind_1.CredentialKind.AppInstall]: Object.freeze([]),
+    [credential_kind_1.CredentialKind.OAuthUser]: Object.freeze([CredentialField.AccessToken]),
+    [credential_kind_1.CredentialKind.OAuthClient]: Object.freeze([CredentialField.AccessToken]),
+    [credential_kind_1.CredentialKind.Pat]: Object.freeze([CredentialField.AccessToken]),
+    [credential_kind_1.CredentialKind.ApiKey]: Object.freeze([CredentialField.AccessToken]),
+    [credential_kind_1.CredentialKind.BotToken]: Object.freeze([CredentialField.AccessToken]),
+    [credential_kind_1.CredentialKind.Basic]: Object.freeze([
+        CredentialField.Username,
+        CredentialField.Password,
+    ]),
+    [credential_kind_1.CredentialKind.RestrictedKey]: Object.freeze([CredentialField.AccessToken]),
+    [credential_kind_1.CredentialKind.IamRole]: Object.freeze([CredentialField.RoleArn]),
+    [credential_kind_1.CredentialKind.SignatureOnly]: Object.freeze([CredentialField.Secret]),
+    [credential_kind_1.CredentialKind.SmtpAuth]: Object.freeze([
+        CredentialField.Host,
+        CredentialField.Port,
+        CredentialField.Username,
+        CredentialField.Password,
+    ]),
+    [credential_kind_1.CredentialKind.ImapAuth]: Object.freeze([
+        CredentialField.Host,
+        CredentialField.Port,
+        CredentialField.Username,
+        CredentialField.Password,
+    ]),
+});
+function credentialBlobOrigin(appAuthKind) {
+    switch (appAuthKind) {
+        case provider_descriptor_1.ProviderAppAuthKind.OAuth2:
+            return CredentialBlobOrigin.OAuthCallback;
+        case provider_descriptor_1.ProviderAppAuthKind.AppInstall:
+            return CredentialBlobOrigin.PlatformMint;
+        case provider_descriptor_1.ProviderAppAuthKind.None:
+            return CredentialBlobOrigin.OnboardingForm;
+        default: {
+            const unhandled = appAuthKind;
+            throw new Error(`Unmapped ProviderAppAuthKind "${String(unhandled)}" — extend credentialBlobOrigin.`);
+        }
+    }
+}
+exports.OAUTH_CALLBACK_CREDENTIAL_FIELDS = Object.freeze([CredentialField.AccessToken]);
+class CredentialFieldContractError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'CredentialFieldContractError';
+    }
+}
+exports.CredentialFieldContractError = CredentialFieldContractError;
+function assertCredentialBlobFieldsSatisfyKind(kind, blobFieldNames, subject) {
+    const required = exports.CURATED_CREDENTIAL_KIND_REQUIRED_FIELDS[kind];
+    const present = new Set(blobFieldNames);
+    const missing = required.filter((field) => !present.has(field));
+    if (missing.length > 0) {
+        throw new CredentialFieldContractError(`${subject} declares credentialKind="${kind}", whose mint reads ` +
+            `[${required.join(', ')}], but the credential blob supplies ` +
+            `[${blobFieldNames.join(', ') || '<nothing>'}] — missing ` +
+            `[${missing.join(', ')}]. The credential could never be minted.`);
+    }
+}
+function assertConnectorCredentialDeclaration(input) {
+    const { subject, credentialKind, appAuthKind, onboarding } = input;
+    const required = exports.CURATED_CREDENTIAL_KIND_REQUIRED_FIELDS[credentialKind];
+    const fields = onboarding.fields ?? [];
+    const origin = credentialBlobOrigin(appAuthKind);
+    switch (origin) {
+        case CredentialBlobOrigin.OnboardingForm: {
+            if (onboarding.kind !== onboarding_manifest_1.ConnectorOnboardingKind.CREDENTIALS) {
+                throw new CredentialFieldContractError(`${subject} has appAuthKind="${appAuthKind}", so its credential comes from the ` +
+                    `onboarding form, but the manifest declares kind="${onboarding.kind}". ` +
+                    'There is no other producer that could write its credential.');
+            }
+            assertCredentialBlobFieldsSatisfyKind(credentialKind, fields.map((f) => f.key), `${subject} onboarding form`);
+            const optionalMintFields = fields
+                .filter((f) => !f.required && required.includes(f.key))
+                .map((f) => f.key);
+            if (optionalMintFields.length > 0) {
+                throw new CredentialFieldContractError(`${subject} declares mint field(s) [${optionalMintFields.join(', ')}] as OPTIONAL. ` +
+                    'Every field the mint reads must be required — an optional one lets a ' +
+                    'connection be created that the mint then rejects at first use.');
+            }
+            return;
+        }
+        case CredentialBlobOrigin.OAuthCallback: {
+            assertCredentialBlobFieldsSatisfyKind(credentialKind, exports.OAUTH_CALLBACK_CREDENTIAL_FIELDS, `${subject} OAuth connect driver`);
+            const collided = fields
+                .map((f) => f.key)
+                .filter((key) => required.includes(key));
+            if (collided.length > 0) {
+                throw new CredentialFieldContractError(`${subject} has appAuthKind="oauth2", so the OAuth connect driver writes its ` +
+                    `credential, but its onboarding form ALSO collects mint field(s) ` +
+                    `[${collided.join(', ')}]. Only one producer ever runs; a form field here is ` +
+                    'either dead or silently overwritten. Collect supplementary configuration only.');
+            }
+            return;
+        }
+        case CredentialBlobOrigin.PlatformMint: {
+            if (onboarding.kind === onboarding_manifest_1.ConnectorOnboardingKind.CREDENTIALS) {
+                throw new CredentialFieldContractError(`${subject} has appAuthKind="app_install": its token is minted from the ` +
+                    'installation, not from a stored blob. A CREDENTIALS onboarding form has ' +
+                    'nothing to write.');
+            }
+            return;
+        }
+    }
+}
+//# sourceMappingURL=credential-kind-fields.js.map

package/dist/connector/lib/credential-kind-fields.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-kind-fields.js","sourceRoot":"","sources":["../../../src/connector/lib/credential-kind-fields.ts"],"names":[],"mappings":";;;AAiIA,oDAiBC;AA2BD,sFAgBC;AAqBD,oFAsEC;AA7PD,uDAAmD;AACnD,+DAI+B;AAC/B,+DAA4D;AAc5D,IAAY,eAeX;AAfD,WAAY,eAAe;IAEzB,8CAA2B,CAAA;IAE3B,wCAAqB,CAAA;IAErB,wCAAqB,CAAA;IAErB,oCAAiB,CAAA;IAEjB,gCAAa,CAAA;IAEb,gCAAa,CAAA;IAEb,sCAAmB,CAAA;AACrB,CAAC,EAfW,eAAe,+BAAf,eAAe,QAe1B;AAiBD,IAAY,oBAIX;AAJD,WAAY,oBAAoB;IAC9B,0DAAkC,CAAA;IAClC,wDAAgC,CAAA;IAChC,sDAA8B,CAAA;AAChC,CAAC,EAJW,oBAAoB,oCAApB,oBAAoB,QAI/B;AAYY,QAAA,uCAAuC,GAEhD,MAAM,CAAC,MAAM,CAAC;IAChB,CAAC,gCAAc,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IAC9C,CAAC,gCAAc,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;IACxE,CAAC,gCAAc,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;IAC1E,CAAC,gCAAc,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;IAClE,CAAC,gCAAc,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;IACrE,CAAC,gCAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;IACvE,CAAC,gCAAc,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QACpC,eAAe,CAAC,QAAQ;QACxB,eAAe,CAAC,QAAQ;KACzB,CAAC;IACF,CAAC,gCAAc,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;IAC5E,CAAC,gCAAc,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IAClE,CAAC,gCAAc,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IACvE,CAAC,gCAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QACvC,eAAe,CAAC,IAAI;QACpB,eAAe,CAAC,IAAI;QACpB,eAAe,CAAC,QAAQ;QACxB,eAAe,CAAC,QAAQ;KACzB,CAAC;IACF,CAAC,gCAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QACvC,eAAe,CAAC,IAAI;QACpB,eAAe,CAAC,IAAI;QACpB,eAAe,CAAC,QAAQ;QACxB,eAAe,CAAC,QAAQ;KACzB,CAAC;CAC0D,CAAC,CAAC;AAMhE,SAAgB,oBAAoB,CAClC,WAAgC;IAEhC,QAAQ,WAAW,EAAE,CAAC;QACpB,KAAK,yCAAmB,CAAC,MAAM;YAC7B,OAAO,oBAAoB,CAAC,aAAa,CAAC;QAC5C,KAAK,yCAAmB,CAAC,UAAU;YACjC,OAAO,oBAAoB,CAAC,YAAY,CAAC;QAC3C,KAAK,yCAAmB,CAAC,IAAI;YAC3B,OAAO,oBAAoB,CAAC,cAAc,CAAC;QAC7C,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,SAAS,GAAU,WAAW,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,iCAAiC,MAAM,CAAC,SAAS,CAAC,kCAAkC,CACrF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AASY,QAAA,gCAAgC,GAC3C,MAAM,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC;AAG/C,MAAa,4BAA6B,SAAQ,KAAK;IACrD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AALD,oEAKC;AASD,SAAgB,qCAAqC,CACnD,IAAoB,EACpB,cAAiC,EACjC,OAAe;IAEf,MAAM,QAAQ,GAAG,+CAAuC,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,4BAA4B,CACpC,GAAG,OAAO,6BAA6B,IAAI,sBAAsB;YAC/D,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,sCAAsC;YAC7D,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,cAAc;YAC1D,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,0CAA0C,CACnE,CAAC;IACJ,CAAC;AACH,CAAC;AAqBD,SAAgB,oCAAoC,CAAC,KAMpD;IACC,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IACnE,MAAM,QAAQ,GAAG,+CAAuC,CAAC,cAAc,CAAC,CAAC;IACzE,MAAM,MAAM,GAAmC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC;IACvE,MAAM,MAAM,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAEjD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,oBAAoB,CAAC,cAAc,CAAC,CAAC,CAAC;YACzC,IAAI,UAAU,CAAC,IAAI,KAAK,6CAAuB,CAAC,WAAW,EAAE,CAAC;gBAC5D,MAAM,IAAI,4BAA4B,CACpC,GAAG,OAAO,qBAAqB,WAAW,sCAAsC;oBAC9E,oDAAoD,UAAU,CAAC,IAAI,KAAK;oBACxE,6DAA6D,CAChE,CAAC;YACJ,CAAC;YACD,qCAAqC,CACnC,cAAc,EACd,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EACxB,GAAG,OAAO,kBAAkB,CAC7B,CAAC;YACF,MAAM,kBAAkB,GAAG,MAAM;iBAC9B,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAK,QAA8B,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CACtE;iBACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACrB,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,4BAA4B,CACpC,GAAG,OAAO,4BAA4B,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB;oBAClF,uEAAuE;oBACvE,gEAAgE,CACnE,CAAC;YACJ,CAAC;YACD,OAAO;QACT,CAAC;QACD,KAAK,oBAAoB,CAAC,aAAa,CAAC,CAAC,CAAC;YACxC,qCAAqC,CACnC,cAAc,EACd,wCAAgC,EAChC,GAAG,OAAO,uBAAuB,CAClC,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM;iBACpB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;iBACjB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAE,QAA8B,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAClE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,4BAA4B,CACpC,GAAG,OAAO,oEAAoE;oBAC5E,kEAAkE;oBAClE,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,uDAAuD;oBAC9E,gFAAgF,CACnF,CAAC;YACJ,CAAC;YACD,OAAO;QACT,CAAC;QACD,KAAK,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC;YACvC,IAAI,UAAU,CAAC,IAAI,KAAK,6CAAuB,CAAC,WAAW,EAAE,CAAC;gBAC5D,MAAM,IAAI,4BAA4B,CACpC,GAAG,OAAO,+DAA+D;oBACvE,0EAA0E;oBAC1E,mBAAmB,CACtB,CAAC;YACJ,CAAC;YACD,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/connector/lib/credential-kind.d.ts

@@ -0,0 +1,47 @@
+import { z } from 'zod';
+export declare enum CredentialKind {
+    AppInstall = "app_install",
+    OAuthUser = "oauth_user",
+    OAuthClient = "oauth_client",
+    Pat = "pat",
+    ApiKey = "api_key",
+    BotToken = "bot_token",
+    Basic = "basic",
+    RestrictedKey = "restricted_key",
+    IamRole = "iam_role",
+    SignatureOnly = "signature_only",
+    SmtpAuth = "smtp_auth",
+    ImapAuth = "imap_auth"
+}
+export declare const CURATED_CREDENTIAL_KINDS: readonly CredentialKind[];
+export type CredentialKindRef = string;
+export declare const CredentialKindRefSchema: z.ZodString;
+export declare function isCuratedCredentialKind(value: string): value is CredentialKind;
+export declare enum EmailTlsMode {
+    Auto = "auto",
+    Tls = "tls",
+    Starttls = "starttls",
+    Plain = "plain"
+}
+export interface EmailCredentialHints {
+    host: string;
+    port: string;
+    username: string;
+    password: string;
+    tlsMode: EmailTlsMode;
+    fromAddress?: string;
+    fromName?: string;
+}
+export type MintedTokenType = 'bearer' | 'basic' | 'aws-sigv4' | 'header' | 'signature-only';
+export interface MintedToken {
+    tokenType: MintedTokenType;
+    accessToken: string;
+    expiresAt: string | null;
+    expiresInSec: number | null;
+    providerHints: Readonly<Record<string, string>>;
+}
+export interface ResourceRef {
+    type: string;
+    id: string;
+}
+//# sourceMappingURL=credential-kind.d.ts.map

package/dist/connector/lib/credential-kind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-kind.d.ts","sourceRoot":"","sources":["../../../src/connector/lib/credential-kind.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAmBxB,oBAAY,cAAc;IAExB,UAAU,gBAAgB;IAE1B,SAAS,eAAe;IAExB,WAAW,iBAAiB;IAE5B,GAAG,QAAQ;IAEX,MAAM,YAAY;IAElB,QAAQ,cAAc;IAEtB,KAAK,UAAU;IAEf,aAAa,mBAAmB;IAEhC,OAAO,aAAa;IAKpB,aAAa,mBAAmB;IAQhC,QAAQ,cAAc;IAMtB,QAAQ,cAAc;CACvB;AAOD,eAAO,MAAM,wBAAwB,EAAE,SAAS,cAAc,EAChB,CAAC;AAgB/C,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAQvC,eAAO,MAAM,uBAAuB,aAOjC,CAAC;AAGJ,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,GACZ,KAAK,IAAI,cAAc,CAEzB;AAUD,oBAAY,YAAY;IACtB,IAAI,SAAS;IACb,GAAG,QAAQ;IACX,QAAQ,aAAa;IACrB,KAAK,UAAU;CAChB;AAYD,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,YAAY,CAAC;IAEtB,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAOD,MAAM,MAAM,eAAe,GACvB,QAAQ,GACR,OAAO,GACP,WAAW,GACX,QAAQ,GAMR,gBAAgB,CAAC;AAErB,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,eAAe,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACjD;AAOD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ"}

package/dist/connector/lib/credential-kind.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EmailTlsMode = exports.CredentialKindRefSchema = exports.CURATED_CREDENTIAL_KINDS = exports.CredentialKind = void 0;
+exports.isCuratedCredentialKind = isCuratedCredentialKind;
+const zod_1 = require("zod");
+var CredentialKind;
+(function (CredentialKind) {
+    CredentialKind["AppInstall"] = "app_install";
+    CredentialKind["OAuthUser"] = "oauth_user";
+    CredentialKind["OAuthClient"] = "oauth_client";
+    CredentialKind["Pat"] = "pat";
+    CredentialKind["ApiKey"] = "api_key";
+    CredentialKind["BotToken"] = "bot_token";
+    CredentialKind["Basic"] = "basic";
+    CredentialKind["RestrictedKey"] = "restricted_key";
+    CredentialKind["IamRole"] = "iam_role";
+    CredentialKind["SignatureOnly"] = "signature_only";
+    CredentialKind["SmtpAuth"] = "smtp_auth";
+    CredentialKind["ImapAuth"] = "imap_auth";
+})(CredentialKind || (exports.CredentialKind = CredentialKind = {}));
+exports.CURATED_CREDENTIAL_KINDS = Object.freeze(Object.values(CredentialKind));
+const CURATED_CREDENTIAL_KIND_VALUES = new Set(exports.CURATED_CREDENTIAL_KINDS);
+exports.CredentialKindRefSchema = zod_1.z
+    .string()
+    .min(1)
+    .max(64)
+    .regex(/^[A-Za-z][A-Za-z0-9_-]*$/, 'credential-kind ref must be a slug: an initial letter then letters/digits/_/-');
+function isCuratedCredentialKind(value) {
+    return CURATED_CREDENTIAL_KIND_VALUES.has(value);
+}
+var EmailTlsMode;
+(function (EmailTlsMode) {
+    EmailTlsMode["Auto"] = "auto";
+    EmailTlsMode["Tls"] = "tls";
+    EmailTlsMode["Starttls"] = "starttls";
+    EmailTlsMode["Plain"] = "plain";
+})(EmailTlsMode || (exports.EmailTlsMode = EmailTlsMode = {}));
+//# sourceMappingURL=credential-kind.js.map

package/dist/connector/lib/credential-kind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-kind.js","sourceRoot":"","sources":["../../../src/connector/lib/credential-kind.ts"],"names":[],"mappings":";;;AAmGA,0DAIC;AAvGD,6BAAwB;AAmBxB,IAAY,cAsCX;AAtCD,WAAY,cAAc;IAExB,4CAA0B,CAAA;IAE1B,0CAAwB,CAAA;IAExB,8CAA4B,CAAA;IAE5B,6BAAW,CAAA;IAEX,oCAAkB,CAAA;IAElB,wCAAsB,CAAA;IAEtB,iCAAe,CAAA;IAEf,kDAAgC,CAAA;IAEhC,sCAAoB,CAAA;IAKpB,kDAAgC,CAAA;IAQhC,wCAAsB,CAAA;IAMtB,wCAAsB,CAAA;AACxB,CAAC,EAtCW,cAAc,8BAAd,cAAc,QAsCzB;AAOY,QAAA,wBAAwB,GACnC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;AAE/C,MAAM,8BAA8B,GAAwB,IAAI,GAAG,CACjE,gCAA6C,CAC9C,CAAC;AAoBW,QAAA,uBAAuB,GAAG,OAAC;KACrC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CACJ,0BAA0B,EAC1B,+EAA+E,CAChF,CAAC;AAGJ,SAAgB,uBAAuB,CACrC,KAAa;IAEb,OAAO,8BAA8B,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACnD,CAAC;AAUD,IAAY,YAKX;AALD,WAAY,YAAY;IACtB,6BAAa,CAAA;IACb,2BAAW,CAAA;IACX,qCAAqB,CAAA;IACrB,+BAAe,CAAA;AACjB,CAAC,EALW,YAAY,4BAAZ,YAAY,QAKvB"}

package/dist/connector/lib/credential-owner-scope.d.ts

@@ -0,0 +1,37 @@
+import { z } from 'zod';
+import { SpaceKind, type SpaceKindSubset } from '../../space';
+export declare const CREDENTIAL_OWNER_SPACE_KINDS: SpaceKindSubset;
+export type CredentialOwnerSpaceKind = SpaceKind.System | SpaceKind.Org | SpaceKind.Project | SpaceKind.User;
+export declare const CredentialOwnerSpaceKindSchema: z.ZodEnum<typeof SpaceKind>;
+export declare function assertCredentialOwnerSpaceKind(kind: SpaceKind): asserts kind is CredentialOwnerSpaceKind;
+export declare const CREDENTIAL_OWNER_SCOPE_ORDER: readonly CredentialOwnerSpaceKind[];
+export declare function toCredentialOwnerSpaceKind(raw: string): CredentialOwnerSpaceKind;
+export declare function isNarrowerOwnerScope(a: CredentialOwnerSpaceKind, b: CredentialOwnerSpaceKind): boolean;
+export interface OwnerScopeIdentityShape {
+    readonly orgId: boolean;
+    readonly projectId: boolean;
+    readonly userId: boolean;
+}
+export declare const OWNER_SCOPE_IDENTITY: Readonly<Record<CredentialOwnerSpaceKind, OwnerScopeIdentityShape>>;
+export interface OwnerScopeIdentity {
+    readonly scope: CredentialOwnerSpaceKind;
+    readonly orgId: string | null;
+    readonly projectId: string | null;
+    readonly userId: string | null;
+}
+export declare enum OwnerScopeIdentityError {
+    MissingSegment = "owner-scope-missing-segment",
+    UnexpectedSegment = "owner-scope-unexpected-segment"
+}
+export interface OwnerScopeIdentityViolation {
+    readonly error: OwnerScopeIdentityError;
+    readonly segment: keyof OwnerScopeIdentityShape;
+}
+export declare function validateOwnerScopeIdentity(identity: OwnerScopeIdentity): readonly OwnerScopeIdentityViolation[];
+export declare function ownerScopeWalk(context: {
+    readonly userId?: string | null;
+    readonly projectId?: string | null;
+    readonly orgId?: string | null;
+}): readonly CredentialOwnerSpaceKind[];
+export declare function ownerScopeForSubjectKind(kind: string): CredentialOwnerSpaceKind | undefined;
+//# sourceMappingURL=credential-owner-scope.d.ts.map

package/dist/connector/lib/credential-owner-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-owner-scope.d.ts","sourceRoot":"","sources":["../../../src/connector/lib/credential-owner-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,SAAS,EAIT,KAAK,eAAe,EACrB,MAAM,aAAa,CAAC;AA+DrB,eAAO,MAAM,4BAA4B,EAAE,eAK1C,CAAC;AAGF,MAAM,MAAM,wBAAwB,GAChC,SAAS,CAAC,MAAM,GAChB,SAAS,CAAC,GAAG,GACb,SAAS,CAAC,OAAO,GACjB,SAAS,CAAC,IAAI,CAAC;AAOnB,eAAO,MAAM,8BAA8B,6BAIvC,CAAC;AAGL,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,SAAS,GACd,OAAO,CAAC,IAAI,IAAI,wBAAwB,CAM1C;AAiBD,eAAO,MAAM,4BAA4B,EAAE,SAAS,wBAAwB,EAKzE,CAAC;AAgFJ,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,MAAM,GACV,wBAAwB,CAc1B;AAGD,wBAAgB,oBAAoB,CAClC,CAAC,EAAE,wBAAwB,EAC3B,CAAC,EAAE,wBAAwB,GAC1B,OAAO,CAET;AAiBD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CACzC,MAAM,CAAC,wBAAwB,EAAE,uBAAuB,CAAC,CAsBzD,CAAC;AAGH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAUD,oBAAY,uBAAuB;IACjC,cAAc,gCAAgC;IAC9C,iBAAiB,mCAAmC;CACrD;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,uBAAuB,CAAC;CACjD;AAYD,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,kBAAkB,GAC3B,SAAS,2BAA2B,EAAE,CAwBxC;AAiBD,wBAAgB,cAAc,CAAC,OAAO,EAAE;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,GAAG,SAAS,wBAAwB,EAAE,CAetC;AAoCD,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,GACX,wBAAwB,GAAG,SAAS,CAEtC"}

package/dist/connector/lib/credential-owner-scope.js

@@ -0,0 +1,106 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OwnerScopeIdentityError = exports.OWNER_SCOPE_IDENTITY = exports.CREDENTIAL_OWNER_SCOPE_ORDER = exports.CredentialOwnerSpaceKindSchema = exports.CREDENTIAL_OWNER_SPACE_KINDS = void 0;
+exports.assertCredentialOwnerSpaceKind = assertCredentialOwnerSpaceKind;
+exports.toCredentialOwnerSpaceKind = toCredentialOwnerSpaceKind;
+exports.isNarrowerOwnerScope = isNarrowerOwnerScope;
+exports.validateOwnerScopeIdentity = validateOwnerScopeIdentity;
+exports.ownerScopeWalk = ownerScopeWalk;
+exports.ownerScopeForSubjectKind = ownerScopeForSubjectKind;
+const zod_1 = require("zod");
+const space_1 = require("../../space");
+exports.CREDENTIAL_OWNER_SPACE_KINDS = (0, space_1.spaceKindSubset)(space_1.SpaceKind.System, space_1.SpaceKind.Org, space_1.SpaceKind.Project, space_1.SpaceKind.User);
+exports.CredentialOwnerSpaceKindSchema = zod_1.z
+    .nativeEnum(space_1.SpaceKind)
+    .refine((value) => exports.CREDENTIAL_OWNER_SPACE_KINDS.has(value), {
+    message: `A credential is owned at one of: ${[...exports.CREDENTIAL_OWNER_SPACE_KINDS].join(', ')}.`,
+});
+function assertCredentialOwnerSpaceKind(kind) {
+    (0, space_1.assertSpaceKindAdmissible)('credential-broker-api', kind, exports.CREDENTIAL_OWNER_SPACE_KINDS);
+}
+exports.CREDENTIAL_OWNER_SCOPE_ORDER = Object.freeze([...exports.CREDENTIAL_OWNER_SPACE_KINDS].sort((a, b) => (0, space_1.spaceKindRank)(a) - (0, space_1.spaceKindRank)(b)));
+function toCredentialOwnerSpaceKind(raw) {
+    const spaceKinds = Object.values(space_1.SpaceKind);
+    if (!spaceKinds.includes(raw)) {
+        throw new Error(`Unknown credential owner tier "${raw}" — refusing to interpret it. ` +
+            `Known tiers: ${[...exports.CREDENTIAL_OWNER_SPACE_KINDS].join(', ')}.`);
+    }
+    const kind = raw;
+    assertCredentialOwnerSpaceKind(kind);
+    return kind;
+}
+function isNarrowerOwnerScope(a, b) {
+    return (0, space_1.spaceKindRank)(a) < (0, space_1.spaceKindRank)(b);
+}
+exports.OWNER_SCOPE_IDENTITY = Object.freeze({
+    [space_1.SpaceKind.System]: Object.freeze({
+        orgId: false,
+        projectId: false,
+        userId: false,
+    }),
+    [space_1.SpaceKind.Org]: Object.freeze({
+        orgId: true,
+        projectId: false,
+        userId: false,
+    }),
+    [space_1.SpaceKind.Project]: Object.freeze({
+        orgId: true,
+        projectId: true,
+        userId: false,
+    }),
+    [space_1.SpaceKind.User]: Object.freeze({
+        orgId: true,
+        projectId: false,
+        userId: true,
+    }),
+});
+var OwnerScopeIdentityError;
+(function (OwnerScopeIdentityError) {
+    OwnerScopeIdentityError["MissingSegment"] = "owner-scope-missing-segment";
+    OwnerScopeIdentityError["UnexpectedSegment"] = "owner-scope-unexpected-segment";
+})(OwnerScopeIdentityError || (exports.OwnerScopeIdentityError = OwnerScopeIdentityError = {}));
+function validateOwnerScopeIdentity(identity) {
+    const shape = exports.OWNER_SCOPE_IDENTITY[identity.scope];
+    const violations = [];
+    const segments = [
+        'orgId',
+        'projectId',
+        'userId',
+    ];
+    for (const segment of segments) {
+        const present = identity[segment] !== null && identity[segment] !== '';
+        if (shape[segment] && !present) {
+            violations.push({
+                error: OwnerScopeIdentityError.MissingSegment,
+                segment,
+            });
+        }
+        if (!shape[segment] && present) {
+            violations.push({
+                error: OwnerScopeIdentityError.UnexpectedSegment,
+                segment,
+            });
+        }
+    }
+    return violations;
+}
+function ownerScopeWalk(context) {
+    return exports.CREDENTIAL_OWNER_SCOPE_ORDER.filter((scope) => {
+        switch (scope) {
+            case space_1.SpaceKind.User:
+                return Boolean(context.userId) && Boolean(context.orgId);
+            case space_1.SpaceKind.Project:
+                return Boolean(context.projectId) && Boolean(context.orgId);
+            case space_1.SpaceKind.Org:
+                return Boolean(context.orgId);
+            case space_1.SpaceKind.System:
+                return true;
+            default:
+                return false;
+        }
+    });
+}
+function ownerScopeForSubjectKind(kind) {
+    return exports.CREDENTIAL_OWNER_SCOPE_ORDER.find((scope) => scope === kind);
+}
+//# sourceMappingURL=credential-owner-scope.js.map

package/dist/connector/lib/credential-owner-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-owner-scope.js","sourceRoot":"","sources":["../../../src/connector/lib/credential-owner-scope.ts"],"names":[],"mappings":";;;AAiGA,wEAQC;AAsGD,gEAgBC;AAGD,oDAKC;AAoFD,gEA0BC;AAiBD,wCAmBC;AAoCD,4DAIC;AAjaD,6BAAwB;AAExB,uCAMqB;AA+DR,QAAA,4BAA4B,GAAoB,IAAA,uBAAe,EAC1E,iBAAS,CAAC,MAAM,EAChB,iBAAS,CAAC,GAAG,EACb,iBAAS,CAAC,OAAO,EACjB,iBAAS,CAAC,IAAI,CACf,CAAC;AAcW,QAAA,8BAA8B,GAAG,OAAC;KAC5C,UAAU,CAAC,iBAAS,CAAC;KACrB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,oCAA4B,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;IAC1D,OAAO,EAAE,oCAAoC,CAAC,GAAG,oCAA4B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;CAC7F,CAAC,CAAC;AAGL,SAAgB,8BAA8B,CAC5C,IAAe;IAEf,IAAA,iCAAyB,EACvB,uBAAuB,EACvB,IAAI,EACJ,oCAA4B,CAC7B,CAAC;AACJ,CAAC;AAiBY,QAAA,4BAA4B,GACvC,MAAM,CAAC,MAAM,CACV,CAAC,GAAG,oCAA4B,CAAgC,CAAC,IAAI,CACpE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,qBAAa,EAAC,CAAC,CAAC,GAAG,IAAA,qBAAa,EAAC,CAAC,CAAC,CAC9C,CACF,CAAC;AAgFJ,SAAgB,0BAA0B,CACxC,GAAW;IAEX,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,iBAAS,CAAsB,CAAC;IACjE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,kCAAkC,GAAG,gCAAgC;YACnE,gBAAgB,CAAC,GAAG,oCAA4B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,GAAgB,CAAC;IAI9B,8BAA8B,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC;AACd,CAAC;AAGD,SAAgB,oBAAoB,CAClC,CAA2B,EAC3B,CAA2B;IAE3B,OAAO,IAAA,qBAAa,EAAC,CAAC,CAAC,GAAG,IAAA,qBAAa,EAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAuBY,QAAA,oBAAoB,GAE7B,MAAM,CAAC,MAAM,CAAC;IAChB,CAAC,iBAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QAChC,KAAK,EAAE,KAAK;QACZ,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,KAAK;KACd,CAAC;IACF,CAAC,iBAAS,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QAC7B,KAAK,EAAE,IAAI;QACX,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,KAAK;KACd,CAAC;IACF,CAAC,iBAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QACjC,KAAK,EAAE,IAAI;QACX,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,KAAK;KACd,CAAC;IACF,CAAC,iBAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QAC9B,KAAK,EAAE,IAAI;QACX,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,IAAI;KACb,CAAC;CACH,CAAC,CAAC;AAkBH,IAAY,uBAGX;AAHD,WAAY,uBAAuB;IACjC,yEAA8C,CAAA;IAC9C,+EAAoD,CAAA;AACtD,CAAC,EAHW,uBAAuB,uCAAvB,uBAAuB,QAGlC;AAiBD,SAAgB,0BAA0B,CACxC,QAA4B;IAE5B,MAAM,KAAK,GAAG,4BAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,UAAU,GAAkC,EAAE,CAAC;IACrD,MAAM,QAAQ,GAA+C;QAC3D,OAAO;QACP,WAAW;QACX,QAAQ;KACT,CAAC;IACF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACvE,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAC/B,UAAU,CAAC,IAAI,CAAC;gBACd,KAAK,EAAE,uBAAuB,CAAC,cAAc;gBAC7C,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,EAAE,CAAC;YAC/B,UAAU,CAAC,IAAI,CAAC;gBACd,KAAK,EAAE,uBAAuB,CAAC,iBAAiB;gBAChD,OAAO;aACR,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAiBD,SAAgB,cAAc,CAAC,OAI9B;IACC,OAAO,oCAA4B,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACnD,QAAQ,KAAK,EAAE,CAAC;YACd,KAAK,iBAAS,CAAC,IAAI;gBACjB,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC3D,KAAK,iBAAS,CAAC,OAAO;gBACpB,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC9D,KAAK,iBAAS,CAAC,GAAG;gBAChB,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAChC,KAAK,iBAAS,CAAC,MAAM;gBACnB,OAAO,IAAI,CAAC;YACd;gBACE,OAAO,KAAK,CAAC;QACjB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAoCD,SAAgB,wBAAwB,CACtC,IAAY;IAEZ,OAAO,oCAA4B,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;AACtE,CAAC"}

package/dist/connector/lib/credential-strategy-contribution.d.ts

@@ -0,0 +1,28 @@
+import { z } from 'zod';
+import { type CredentialKindRef } from './credential-kind';
+export declare enum CredentialProjectionScheme {
+    Bearer = "bearer",
+    Basic = "basic",
+    Header = "header"
+}
+export declare enum CredentialMintStrategyKind {
+    Declarative = "declarative",
+    Capability = "capability"
+}
+export declare const CredentialMintStrategyKindSchema: z.ZodEnum<typeof CredentialMintStrategyKind>;
+export declare const CredentialProjectionSchemeSchema: z.ZodEnum<typeof CredentialProjectionScheme>;
+export interface CredentialStrategyContributionManifest {
+    readonly mintStrategy?: CredentialMintStrategyKind | undefined;
+    readonly key: CredentialKindRef;
+    readonly displayName: string;
+    readonly scheme: CredentialProjectionScheme;
+    readonly tokenField?: string | undefined;
+    readonly usernameField?: string | undefined;
+    readonly passwordField?: string | undefined;
+    readonly valuePrefix?: string | undefined;
+    readonly valueTemplate?: string | undefined;
+    readonly staticParams?: Readonly<Record<string, string>> | undefined;
+}
+export declare const CredentialStrategyContributionManifestSchema: z.ZodType<CredentialStrategyContributionManifest>;
+export declare function templateFieldNames(valueTemplate: string): readonly string[];
+//# sourceMappingURL=credential-strategy-contribution.d.ts.map

package/dist/connector/lib/credential-strategy-contribution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-strategy-contribution.d.ts","sourceRoot":"","sources":["../../../src/connector/lib/credential-strategy-contribution.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,mBAAmB,CAAC;AAkB3B,oBAAY,0BAA0B;IACpC,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,MAAM,WAAW;CAClB;AA4CD,oBAAY,0BAA0B;IAEpC,WAAW,gBAAgB;IAQ3B,UAAU,eAAe;CAC1B;AAED,eAAO,MAAM,gCAAgC,8CAE5C,CAAC;AAEF,eAAO,MAAM,gCAAgC,8CAE5C,CAAC;AA6BF,MAAM,WAAW,sCAAsC;IAYrD,QAAQ,CAAC,YAAY,CAAC,EAAE,0BAA0B,GAAG,SAAS,CAAC;IAO/D,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC;IAEhC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAE5C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEzC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE5C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAc5C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE1C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAM5C,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;CACtE;AAED,eAAO,MAAM,4CAA4C,EAAE,CAAC,CAAC,OAAO,CAAC,sCAAsC,CAkGrG,CAAC;AAOP,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAW3E"}

package/dist/connector/lib/credential-strategy-contribution.js

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CredentialStrategyContributionManifestSchema = exports.CredentialProjectionSchemeSchema = exports.CredentialMintStrategyKindSchema = exports.CredentialMintStrategyKind = exports.CredentialProjectionScheme = void 0;
+exports.templateFieldNames = templateFieldNames;
+const zod_1 = require("zod");
+const credential_kind_1 = require("./credential-kind");
+const CREDENTIAL_STRATEGY_STRING_MAX = 200;
+const CREDENTIAL_STRATEGY_STATIC_PARAMS_MAX = 20;
+var CredentialProjectionScheme;
+(function (CredentialProjectionScheme) {
+    CredentialProjectionScheme["Bearer"] = "bearer";
+    CredentialProjectionScheme["Basic"] = "basic";
+    CredentialProjectionScheme["Header"] = "header";
+})(CredentialProjectionScheme || (exports.CredentialProjectionScheme = CredentialProjectionScheme = {}));
+var CredentialMintStrategyKind;
+(function (CredentialMintStrategyKind) {
+    CredentialMintStrategyKind["Declarative"] = "declarative";
+    CredentialMintStrategyKind["Capability"] = "capability";
+})(CredentialMintStrategyKind || (exports.CredentialMintStrategyKind = CredentialMintStrategyKind = {}));
+exports.CredentialMintStrategyKindSchema = zod_1.z.nativeEnum(CredentialMintStrategyKind);
+exports.CredentialProjectionSchemeSchema = zod_1.z.nativeEnum(CredentialProjectionScheme);
+const VALUE_TEMPLATE_MAX = 500;
+const FieldNameSchema = zod_1.z
+    .string()
+    .min(1)
+    .max(CREDENTIAL_STRATEGY_STRING_MAX)
+    .regex(/^[A-Za-z][A-Za-z0-9_]*$/, 'field name must be an identifier-like key of the resolved credential');
+exports.CredentialStrategyContributionManifestSchema = zod_1.z
+    .object({
+    mintStrategy: exports.CredentialMintStrategyKindSchema.optional(),
+    key: credential_kind_1.CredentialKindRefSchema.regex(/^[A-Z][A-Z0-9_]*$/, 'a contributed credential-strategy key must be UPPER_SNAKE (e.g. ACME_HMAC)').refine((k) => !(0, credential_kind_1.isCuratedCredentialKind)(k), {
+        message: 'a contributed credential-strategy key must not collide with a curated CredentialKind (curated always wins)',
+    }),
+    displayName: zod_1.z.string().min(1).max(CREDENTIAL_STRATEGY_STRING_MAX),
+    scheme: exports.CredentialProjectionSchemeSchema,
+    tokenField: FieldNameSchema.optional(),
+    usernameField: FieldNameSchema.optional(),
+    passwordField: FieldNameSchema.optional(),
+    valuePrefix: zod_1.z.string().max(CREDENTIAL_STRATEGY_STRING_MAX).optional(),
+    valueTemplate: zod_1.z.string().min(1).max(VALUE_TEMPLATE_MAX).optional(),
+    staticParams: zod_1.z
+        .record(zod_1.z.string().min(1).max(CREDENTIAL_STRATEGY_STRING_MAX), zod_1.z.string().max(CREDENTIAL_STRATEGY_STRING_MAX))
+        .refine((r) => Object.keys(r).length <= CREDENTIAL_STRATEGY_STATIC_PARAMS_MAX, `at most ${CREDENTIAL_STRATEGY_STATIC_PARAMS_MAX} static params`)
+        .optional(),
+})
+    .strict()
+    .superRefine((m, ctx) => {
+    const requireField = (present, field, why) => {
+        if (present === undefined) {
+            ctx.addIssue({ code: 'custom', path: [field], message: why });
+        }
+    };
+    const forbidField = (present, field) => {
+        if (present !== undefined) {
+            ctx.addIssue({
+                code: 'custom',
+                path: [field],
+                message: `"${String(field)}" is not valid for scheme "${m.scheme}"`,
+            });
+        }
+    };
+    switch (m.scheme) {
+        case CredentialProjectionScheme.Bearer:
+            requireField(m.tokenField, 'tokenField', 'bearer scheme requires tokenField');
+            forbidField(m.usernameField, 'usernameField');
+            forbidField(m.passwordField, 'passwordField');
+            forbidField(m.valuePrefix, 'valuePrefix');
+            forbidField(m.valueTemplate, 'valueTemplate');
+            break;
+        case CredentialProjectionScheme.Basic:
+            requireField(m.usernameField, 'usernameField', 'basic scheme requires usernameField');
+            requireField(m.passwordField, 'passwordField', 'basic scheme requires passwordField');
+            forbidField(m.tokenField, 'tokenField');
+            forbidField(m.valuePrefix, 'valuePrefix');
+            forbidField(m.valueTemplate, 'valueTemplate');
+            break;
+        case CredentialProjectionScheme.Header:
+            requireField(m.valueTemplate, 'valueTemplate', 'header scheme requires valueTemplate');
+            forbidField(m.tokenField, 'tokenField');
+            forbidField(m.usernameField, 'usernameField');
+            forbidField(m.passwordField, 'passwordField');
+            break;
+    }
+});
+function templateFieldNames(valueTemplate) {
+    const out = [];
+    const re = /\{([A-Za-z][A-Za-z0-9_]*)\}/g;
+    let match;
+    while ((match = re.exec(valueTemplate)) !== null) {
+        const fieldName = match[1];
+        if (fieldName !== undefined && !out.includes(fieldName)) {
+            out.push(fieldName);
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=credential-strategy-contribution.js.map

package/dist/connector/lib/credential-strategy-contribution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-strategy-contribution.js","sourceRoot":"","sources":["../../../src/connector/lib/credential-strategy-contribution.ts"],"names":[],"mappings":";;;AAgTA,gDAWC;AAlSD,6BAAwB;AAExB,uDAI2B;AAG3B,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAG3C,MAAM,qCAAqC,GAAG,EAAE,CAAC;AAYjD,IAAY,0BAIX;AAJD,WAAY,0BAA0B;IACpC,+CAAiB,CAAA;IACjB,6CAAe,CAAA;IACf,+CAAiB,CAAA;AACnB,CAAC,EAJW,0BAA0B,0CAA1B,0BAA0B,QAIrC;AA4CD,IAAY,0BAWX;AAXD,WAAY,0BAA0B;IAEpC,yDAA2B,CAAA;IAQ3B,uDAAyB,CAAA;AAC3B,CAAC,EAXW,0BAA0B,0CAA1B,0BAA0B,QAWrC;AAEY,QAAA,gCAAgC,GAAG,OAAC,CAAC,UAAU,CAC1D,0BAA0B,CAC3B,CAAC;AAEW,QAAA,gCAAgC,GAAG,OAAC,CAAC,UAAU,CAC1D,0BAA0B,CAC3B,CAAC;AAOF,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAG/B,MAAM,eAAe,GAAG,OAAC;KACtB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,8BAA8B,CAAC;KACnC,KAAK,CACJ,yBAAyB,EACzB,sEAAsE,CACvE,CAAC;AAkES,QAAA,4CAA4C,GACvD,OAAC;KACE,MAAM,CAAC;IACN,YAAY,EAAE,wCAAgC,CAAC,QAAQ,EAAE;IACzD,GAAG,EAAE,yCAAuB,CAAC,KAAK,CAChC,mBAAmB,EACnB,4EAA4E,CAC7E,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,yCAAuB,EAAC,CAAC,CAAC,EAAE;QAC3C,OAAO,EACL,4GAA4G;KAC/G,CAAC;IACF,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,8BAA8B,CAAC;IAClE,MAAM,EAAE,wCAAgC;IACxC,UAAU,EAAE,eAAe,CAAC,QAAQ,EAAE;IACtC,aAAa,EAAE,eAAe,CAAC,QAAQ,EAAE;IACzC,aAAa,EAAE,eAAe,CAAC,QAAQ,EAAE;IACzC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC,QAAQ,EAAE;IACtE,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACnE,YAAY,EAAE,OAAC;SACZ,MAAM,CACL,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,8BAA8B,CAAC,EACrD,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAC/C;SACA,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,qCAAqC,EACrE,WAAW,qCAAqC,gBAAgB,CACjE;SACA,QAAQ,EAAE;CACd,CAAC;KASD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;IACtB,MAAM,YAAY,GAAG,CACnB,OAAgB,EAChB,KAAmD,EACnD,GAAW,EACL,EAAE;QACR,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC,CAAC;IACF,MAAM,WAAW,GAAG,CAClB,OAAgB,EAChB,KAAmD,EAC7C,EAAE;QACR,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,KAAK,CAAC;gBACb,OAAO,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC,MAAM,GAAG;aACpE,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IACF,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;QACjB,KAAK,0BAA0B,CAAC,MAAM;YACpC,YAAY,CACV,CAAC,CAAC,UAAU,EACZ,YAAY,EACZ,mCAAmC,CACpC,CAAC;YACF,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;YAC9C,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;YAC9C,WAAW,CAAC,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YAC1C,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;YAC9C,MAAM;QACR,KAAK,0BAA0B,CAAC,KAAK;YACnC,YAAY,CACV,CAAC,CAAC,aAAa,EACf,eAAe,EACf,qCAAqC,CACtC,CAAC;YACF,YAAY,CACV,CAAC,CAAC,aAAa,EACf,eAAe,EACf,qCAAqC,CACtC,CAAC;YACF,WAAW,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YACxC,WAAW,CAAC,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YAC1C,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;YAC9C,MAAM;QACR,KAAK,0BAA0B,CAAC,MAAM;YACpC,YAAY,CACV,CAAC,CAAC,aAAa,EACf,eAAe,EACf,sCAAsC,CACvC,CAAC;YACF,WAAW,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YACxC,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;YAC9C,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;YAC9C,MAAM;IACV,CAAC;AACH,CAAC,CAAC,CAAC;AAOP,SAAgB,kBAAkB,CAAC,aAAqB;IACtD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,EAAE,GAAG,8BAA8B,CAAC;IAC1C,IAAI,KAA6B,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACjD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/connector/lib/envelope-schema.d.ts

@@ -0,0 +1,6 @@
+import { type AdapterKindRef } from './adapter-kind';
+export declare const UNION_ENTITY_KIND = "*";
+export declare function registerEnvelopeSchema(adapterKind: AdapterKindRef, perEntityKind: Readonly<Record<string, readonly string[]>>): void;
+export declare function getEnvelopeSchema(adapterKind: AdapterKindRef, entityKind?: string): ReadonlySet<string> | undefined;
+export declare function isAllowedEnvelopePath(adapterKind: AdapterKindRef, path: string, entityKind?: string): boolean;
+//# sourceMappingURL=envelope-schema.d.ts.map

package/dist/connector/lib/envelope-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope-schema.d.ts","sourceRoot":"","sources":["../../../src/connector/lib/envelope-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AA+BzE,eAAO,MAAM,iBAAiB,MAAM,CAAC;AAmJrC,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,cAAc,EAC3B,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,GACzD,IAAI,CAUN;AAWD,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,cAAc,EAC3B,UAAU,CAAC,EAAE,MAAM,GAClB,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,CAIjC;AAiBD,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,cAAc,EAC3B,IAAI,EAAE,MAAM,EACZ,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAaT"}