@xemahq/contracts 0.1.0

package/dist/connector/lib/inbound-endpoint-contribution.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InboundEndpointContributionManifestSchema = exports.InboundIdempotencySchema = exports.InboundTenantResolutionSchema = exports.InboundVerificationSchema = exports.InboundIdempotencyKeySource = exports.InboundTenantResolutionKind = exports.InboundVerificationKind = void 0;
+const zod_1 = require("zod");
+var InboundVerificationKind;
+(function (InboundVerificationKind) {
+    InboundVerificationKind["HmacSha256"] = "hmac-sha256";
+    InboundVerificationKind["Bearer"] = "bearer";
+    InboundVerificationKind["MutualTls"] = "mtls";
+})(InboundVerificationKind || (exports.InboundVerificationKind = InboundVerificationKind = {}));
+var InboundTenantResolutionKind;
+(function (InboundTenantResolutionKind) {
+    InboundTenantResolutionKind["Header"] = "header";
+    InboundTenantResolutionKind["BodyPath"] = "body-path";
+    InboundTenantResolutionKind["Binding"] = "binding";
+})(InboundTenantResolutionKind || (exports.InboundTenantResolutionKind = InboundTenantResolutionKind = {}));
+var InboundIdempotencyKeySource;
+(function (InboundIdempotencyKeySource) {
+    InboundIdempotencyKeySource["Header"] = "header";
+    InboundIdempotencyKeySource["BodyPath"] = "body-path";
+})(InboundIdempotencyKeySource || (exports.InboundIdempotencyKeySource = InboundIdempotencyKeySource = {}));
+const SLUG = /^[a-z][a-z0-9-]{1,62}[a-z0-9]$/;
+exports.InboundVerificationSchema = zod_1.z.discriminatedUnion('kind', [
+    zod_1.z.object({
+        kind: zod_1.z.literal(InboundVerificationKind.HmacSha256),
+        signatureHeader: zod_1.z.string().min(1),
+        secretEnv: zod_1.z.string().min(1),
+        signaturePrefix: zod_1.z.string().optional(),
+    }),
+    zod_1.z.object({
+        kind: zod_1.z.literal(InboundVerificationKind.Bearer),
+        secretEnv: zod_1.z.string().min(1),
+    }),
+    zod_1.z.object({
+        kind: zod_1.z.literal(InboundVerificationKind.MutualTls),
+        expectedSubject: zod_1.z.string().min(1),
+    }),
+]);
+exports.InboundTenantResolutionSchema = zod_1.z.discriminatedUnion('kind', [
+    zod_1.z.object({
+        kind: zod_1.z.literal(InboundTenantResolutionKind.Header),
+        header: zod_1.z.string().min(1),
+    }),
+    zod_1.z.object({
+        kind: zod_1.z.literal(InboundTenantResolutionKind.BodyPath),
+        path: zod_1.z.string().min(1),
+    }),
+    zod_1.z.object({
+        kind: zod_1.z.literal(InboundTenantResolutionKind.Binding),
+        externalKey: zod_1.z.discriminatedUnion('kind', [
+            zod_1.z.object({ kind: zod_1.z.literal('header'), header: zod_1.z.string().min(1) }),
+            zod_1.z.object({ kind: zod_1.z.literal('body-path'), path: zod_1.z.string().min(1) }),
+        ]),
+    }),
+]);
+exports.InboundIdempotencySchema = zod_1.z.discriminatedUnion('source', [
+    zod_1.z.object({
+        source: zod_1.z.literal(InboundIdempotencyKeySource.Header),
+        header: zod_1.z.string().min(1),
+    }),
+    zod_1.z.object({
+        source: zod_1.z.literal(InboundIdempotencyKeySource.BodyPath),
+        path: zod_1.z.string().min(1),
+    }),
+]);
+exports.InboundEndpointContributionManifestSchema = zod_1.z
+    .object({
+    slug: zod_1.z.string().regex(SLUG),
+    displayName: zod_1.z.string().min(1),
+    description: zod_1.z.string().min(1),
+    verification: exports.InboundVerificationSchema,
+    tenantResolution: exports.InboundTenantResolutionSchema,
+    idempotency: exports.InboundIdempotencySchema,
+    forwardTo: zod_1.z.object({
+        serviceName: zod_1.z.string().min(1),
+        path: zod_1.z.string().startsWith('/'),
+    }),
+    dataClassification: zod_1.z.string().min(1),
+})
+    .strict();
+//# sourceMappingURL=inbound-endpoint-contribution.js.map

package/dist/connector/lib/inbound-endpoint-contribution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbound-endpoint-contribution.js","sourceRoot":"","sources":["../../../src/connector/lib/inbound-endpoint-contribution.ts"],"names":[],"mappings":";;;AAwCA,6BAAwB;AAaxB,IAAY,uBAoBX;AApBD,WAAY,uBAAuB;IAKjC,qDAA0B,CAAA;IAQ1B,4CAAiB,CAAA;IAMjB,6CAAkB,CAAA;AACpB,CAAC,EApBW,uBAAuB,uCAAvB,uBAAuB,QAoBlC;AAGD,IAAY,2BAqBX;AArBD,WAAY,2BAA2B;IAErC,gDAAiB,CAAA;IAYjB,qDAAsB,CAAA;IAMtB,kDAAmB,CAAA;AACrB,CAAC,EArBW,2BAA2B,2CAA3B,2BAA2B,QAqBtC;AAGD,IAAY,2BAGX;AAHD,WAAY,2BAA2B;IACrC,gDAAiB,CAAA;IACjB,qDAAsB,CAAA;AACxB,CAAC,EAHW,2BAA2B,2CAA3B,2BAA2B,QAGtC;AAED,MAAM,IAAI,GAAG,gCAAgC,CAAC;AAEjC,QAAA,yBAAyB,GAAG,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACpE,OAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,UAAU,CAAC;QAEnD,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QASlC,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAE5B,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACvC,CAAC;IACF,OAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,MAAM,CAAC;QAC/C,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC7B,CAAC;IACF,OAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,SAAS,CAAC;QAClD,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACnC,CAAC;CACH,CAAC,CAAC;AAGU,QAAA,6BAA6B,GAAG,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACxE,OAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,MAAM,CAAC;QACnD,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC1B,CAAC;IACF,OAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,QAAQ,CAAC;QACrD,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACxB,CAAC;IACF,OAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,OAAO,CAAC;QAkBpD,WAAW,EAAE,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;YACxC,OAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,OAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CAAC;KACH,CAAC;CACH,CAAC,CAAC;AAKU,QAAA,wBAAwB,GAAG,OAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IACrE,OAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,OAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,MAAM,CAAC;QACrD,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC1B,CAAC;IACF,OAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,OAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,QAAQ,CAAC;QACvD,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACxB,CAAC;CACH,CAAC,CAAC;AAGU,QAAA,yCAAyC,GAAG,OAAC;KACvD,MAAM,CAAC;IAQN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;IAE5B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,YAAY,EAAE,iCAAyB;IACvC,gBAAgB,EAAE,qCAA6B;IAO/C,WAAW,EAAE,gCAAwB;IAOrC,SAAS,EAAE,OAAC,CAAC,MAAM,CAAC;QAClB,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;KACjC,CAAC;IAMF,kBAAkB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACtC,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/connector/lib/oauth-endpoints.d.ts

@@ -0,0 +1,7 @@
+export interface OAuthAuthorityEndpoints {
+    readonly authorizationUrl: string;
+    readonly tokenUrl: string;
+}
+export declare const GOOGLE_OAUTH_ENDPOINTS: OAuthAuthorityEndpoints;
+export declare const MICROSOFT_OAUTH_ENDPOINTS: OAuthAuthorityEndpoints;
+//# sourceMappingURL=oauth-endpoints.d.ts.map

package/dist/connector/lib/oauth-endpoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-endpoints.d.ts","sourceRoot":"","sources":["../../../src/connector/lib/oauth-endpoints.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,uBAAuB;IAEtC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAElC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAMD,eAAO,MAAM,sBAAsB,EAAE,uBAG3B,CAAC;AAOX,eAAO,MAAM,yBAAyB,EAAE,uBAI9B,CAAC"}

package/dist/connector/lib/oauth-endpoints.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MICROSOFT_OAUTH_ENDPOINTS = exports.GOOGLE_OAUTH_ENDPOINTS = void 0;
+exports.GOOGLE_OAUTH_ENDPOINTS = {
+    authorizationUrl: 'https://accounts.google.com/o/oauth2/v2/auth',
+    tokenUrl: 'https://oauth2.googleapis.com/token',
+};
+exports.MICROSOFT_OAUTH_ENDPOINTS = {
+    authorizationUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize',
+    tokenUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/token',
+};
+//# sourceMappingURL=oauth-endpoints.js.map

package/dist/connector/lib/oauth-endpoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-endpoints.js","sourceRoot":"","sources":["../../../src/connector/lib/oauth-endpoints.ts"],"names":[],"mappings":";;;AAmCa,QAAA,sBAAsB,GAA4B;IAC7D,gBAAgB,EAAE,8CAA8C;IAChE,QAAQ,EAAE,qCAAqC;CACvC,CAAC;AAOE,QAAA,yBAAyB,GAA4B;IAChE,gBAAgB,EACd,gEAAgE;IAClE,QAAQ,EAAE,4DAA4D;CAC9D,CAAC"}

package/dist/connector/lib/onboarding-manifest.d.ts

@@ -0,0 +1,57 @@
+import { z } from 'zod';
+export declare enum CredentialFieldType {
+    TEXT = "TEXT",
+    PASSWORD = "PASSWORD",
+    EMAIL = "EMAIL",
+    URL = "URL",
+    JSON_BLOB = "JSON_BLOB"
+}
+export declare enum CredentialFieldTransform {
+    NONE = "NONE",
+    UPPERCASE = "UPPERCASE",
+    LOWERCASE = "LOWERCASE",
+    TRIM = "TRIM"
+}
+export declare enum ConnectorOnboardingKind {
+    CREDENTIALS = "CREDENTIALS",
+    APP_INSTALL = "APP_INSTALL"
+}
+export declare enum ProjectBindingAdapterKey {
+    DOCUMENTATION = "DOCUMENTATION",
+    TRACKER = "TRACKER",
+    SCM = "SCM"
+}
+export interface CredentialFieldSpec {
+    readonly key: string;
+    readonly label: string;
+    readonly type: CredentialFieldType;
+    readonly required: boolean;
+    readonly isSecret: boolean;
+    readonly placeholder?: string;
+    readonly hint?: string;
+    readonly transform: CredentialFieldTransform;
+}
+export declare const CredentialFieldSpecSchema: z.ZodObject<{
+    key: z.ZodString;
+    label: z.ZodString;
+    type: z.ZodEnum<typeof CredentialFieldType>;
+    required: z.ZodBoolean;
+    isSecret: z.ZodBoolean;
+    placeholder: z.ZodOptional<z.ZodString>;
+    hint: z.ZodOptional<z.ZodString>;
+    transform: z.ZodEnum<typeof CredentialFieldTransform>;
+}, z.core.$strict>;
+export interface ProviderOnboardingManifest {
+    readonly provider: string;
+    readonly displayName: string;
+    readonly description: string;
+    readonly iconName: string;
+    readonly kind: ConnectorOnboardingKind;
+    readonly supportedProjectBindingAdapterKinds: readonly ProjectBindingAdapterKey[];
+    readonly fields?: readonly CredentialFieldSpec[];
+    readonly hint?: string;
+    readonly jsonPlaceholder?: string;
+    readonly launchLabel?: string;
+    readonly launchHint?: string;
+}
+//# sourceMappingURL=onboarding-manifest.d.ts.map

package/dist/connector/lib/onboarding-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"onboarding-manifest.d.ts","sourceRoot":"","sources":["../../../src/connector/lib/onboarding-manifest.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,oBAAY,mBAAmB;IAC7B,IAAI,SAAS;IACb,QAAQ,aAAa;IACrB,KAAK,UAAU;IACf,GAAG,QAAQ;IACX,SAAS,cAAc;CACxB;AAQD,oBAAY,wBAAwB;IAClC,IAAI,SAAS;IACb,SAAS,cAAc;IACvB,SAAS,cAAc;IACvB,IAAI,SAAS;CACd;AAWD,oBAAY,uBAAuB;IACjC,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;CAC5B;AAoBD,oBAAY,wBAAwB;IAClC,aAAa,kBAAkB;IAC/B,OAAO,YAAY;IACnB,GAAG,QAAQ;CACZ;AAOD,MAAM,WAAW,mBAAmB;IAElC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAErB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IAEnC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAe3B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAE3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;CAC9C;AASD,eAAO,MAAM,yBAAyB;;;;;;;;;kBASpC,CAAC;AAcH,MAAM,WAAW,0BAA0B;IAEzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAM7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IAcvC,QAAQ,CAAC,mCAAmC,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAIlF,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAEjD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAMvB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAIlC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B"}

package/dist/connector/lib/onboarding-manifest.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CredentialFieldSpecSchema = exports.ProjectBindingAdapterKey = exports.ConnectorOnboardingKind = exports.CredentialFieldTransform = exports.CredentialFieldType = void 0;
+const zod_1 = require("zod");
+var CredentialFieldType;
+(function (CredentialFieldType) {
+    CredentialFieldType["TEXT"] = "TEXT";
+    CredentialFieldType["PASSWORD"] = "PASSWORD";
+    CredentialFieldType["EMAIL"] = "EMAIL";
+    CredentialFieldType["URL"] = "URL";
+    CredentialFieldType["JSON_BLOB"] = "JSON_BLOB";
+})(CredentialFieldType || (exports.CredentialFieldType = CredentialFieldType = {}));
+var CredentialFieldTransform;
+(function (CredentialFieldTransform) {
+    CredentialFieldTransform["NONE"] = "NONE";
+    CredentialFieldTransform["UPPERCASE"] = "UPPERCASE";
+    CredentialFieldTransform["LOWERCASE"] = "LOWERCASE";
+    CredentialFieldTransform["TRIM"] = "TRIM";
+})(CredentialFieldTransform || (exports.CredentialFieldTransform = CredentialFieldTransform = {}));
+var ConnectorOnboardingKind;
+(function (ConnectorOnboardingKind) {
+    ConnectorOnboardingKind["CREDENTIALS"] = "CREDENTIALS";
+    ConnectorOnboardingKind["APP_INSTALL"] = "APP_INSTALL";
+})(ConnectorOnboardingKind || (exports.ConnectorOnboardingKind = ConnectorOnboardingKind = {}));
+var ProjectBindingAdapterKey;
+(function (ProjectBindingAdapterKey) {
+    ProjectBindingAdapterKey["DOCUMENTATION"] = "DOCUMENTATION";
+    ProjectBindingAdapterKey["TRACKER"] = "TRACKER";
+    ProjectBindingAdapterKey["SCM"] = "SCM";
+})(ProjectBindingAdapterKey || (exports.ProjectBindingAdapterKey = ProjectBindingAdapterKey = {}));
+exports.CredentialFieldSpecSchema = zod_1.z.strictObject({
+    key: zod_1.z.string().min(1),
+    label: zod_1.z.string().min(1),
+    type: zod_1.z.nativeEnum(CredentialFieldType),
+    required: zod_1.z.boolean(),
+    isSecret: zod_1.z.boolean(),
+    placeholder: zod_1.z.string().optional(),
+    hint: zod_1.z.string().optional(),
+    transform: zod_1.z.nativeEnum(CredentialFieldTransform),
+});
+//# sourceMappingURL=onboarding-manifest.js.map

package/dist/connector/lib/onboarding-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"onboarding-manifest.js","sourceRoot":"","sources":["../../../src/connector/lib/onboarding-manifest.ts"],"names":[],"mappings":";;;AAuBA,6BAAwB;AAOxB,IAAY,mBAMX;AAND,WAAY,mBAAmB;IAC7B,oCAAa,CAAA;IACb,4CAAqB,CAAA;IACrB,sCAAe,CAAA;IACf,kCAAW,CAAA;IACX,8CAAuB,CAAA;AACzB,CAAC,EANW,mBAAmB,mCAAnB,mBAAmB,QAM9B;AAQD,IAAY,wBAKX;AALD,WAAY,wBAAwB;IAClC,yCAAa,CAAA;IACb,mDAAuB,CAAA;IACvB,mDAAuB,CAAA;IACvB,yCAAa,CAAA;AACf,CAAC,EALW,wBAAwB,wCAAxB,wBAAwB,QAKnC;AAWD,IAAY,uBAGX;AAHD,WAAY,uBAAuB;IACjC,sDAA2B,CAAA;IAC3B,sDAA2B,CAAA;AAC7B,CAAC,EAHW,uBAAuB,uCAAvB,uBAAuB,QAGlC;AAoBD,IAAY,wBAIX;AAJD,WAAY,wBAAwB;IAClC,2DAA+B,CAAA;IAC/B,+CAAmB,CAAA;IACnB,uCAAW,CAAA;AACb,CAAC,EAJW,wBAAwB,wCAAxB,wBAAwB,QAInC;AA8CY,QAAA,yBAAyB,GAAG,OAAC,CAAC,YAAY,CAAC;IACtD,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,IAAI,EAAE,OAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC;IACvC,QAAQ,EAAE,OAAC,CAAC,OAAO,EAAE;IACrB,QAAQ,EAAE,OAAC,CAAC,OAAO,EAAE;IACrB,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,SAAS,EAAE,OAAC,CAAC,UAAU,CAAC,wBAAwB,CAAC;CAClD,CAAC,CAAC"}

package/dist/connector/lib/provider-descriptor.d.ts

@@ -0,0 +1,129 @@
+import { z } from 'zod';
+import { type CredentialFieldSpec } from './onboarding-manifest';
+import { ProviderTokenRevocationSupport, type ProviderTokenRevocationEndpoint } from './provider-token-revocation';
+export declare enum ProviderAppAuthKind {
+    OAuth2 = "oauth2",
+    AppInstall = "app_install",
+    None = "none"
+}
+export declare enum ProviderOrigin {
+    Kernel = "kernel",
+    Platform = "platform",
+    Biome = "biome"
+}
+export interface ProviderOAuthEndpoints {
+    readonly authorizationUrl: string;
+    readonly tokenUrl: string;
+    readonly extraAuthorizeParams?: Readonly<Record<string, string>>;
+    readonly clientIdEnvVar?: string;
+    readonly clientSecretEnvVar?: string;
+    readonly revocationSupport: ProviderTokenRevocationSupport;
+    readonly revocation?: ProviderTokenRevocationEndpoint;
+}
+export interface ProviderDescriptor {
+    readonly providerKey: string;
+    readonly displayName: string;
+    readonly description: string;
+    readonly iconName: string;
+    readonly category: string;
+    readonly apiBaseUrl?: string;
+    readonly appAuthKind: ProviderAppAuthKind;
+    readonly origin: ProviderOrigin;
+    readonly appCredentialSchema?: readonly CredentialFieldSpec[];
+    readonly oauthEndpoints?: ProviderOAuthEndpoints;
+    readonly allowOrgOverride: boolean;
+}
+export declare const ProviderOAuthEndpointsSchema: z.ZodObject<{
+    authorizationUrl: z.ZodString;
+    tokenUrl: z.ZodString;
+    extraAuthorizeParams: z.ZodOptional<z.ZodReadonly<z.ZodRecord<z.ZodString, z.ZodString>>>;
+    clientIdEnvVar: z.ZodOptional<z.ZodString>;
+    clientSecretEnvVar: z.ZodOptional<z.ZodString>;
+    revocationSupport: z.ZodEnum<typeof ProviderTokenRevocationSupport>;
+    revocation: z.ZodOptional<z.ZodObject<{
+        revocationUrl: z.ZodString;
+        clientAuthentication: z.ZodEnum<typeof import("./provider-token-revocation").RevocationClientAuthentication>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const ProviderDescriptorBaseSchema: z.ZodObject<{
+    providerKey: z.ZodString;
+    displayName: z.ZodString;
+    description: z.ZodString;
+    iconName: z.ZodString;
+    category: z.ZodString;
+    apiBaseUrl: z.ZodOptional<z.ZodString>;
+    appAuthKind: z.ZodEnum<typeof ProviderAppAuthKind>;
+    origin: z.ZodEnum<typeof ProviderOrigin>;
+    appCredentialSchema: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        label: z.ZodString;
+        type: z.ZodEnum<typeof import("./onboarding-manifest").CredentialFieldType>;
+        required: z.ZodBoolean;
+        isSecret: z.ZodBoolean;
+        placeholder: z.ZodOptional<z.ZodString>;
+        hint: z.ZodOptional<z.ZodString>;
+        transform: z.ZodEnum<typeof import("./onboarding-manifest").CredentialFieldTransform>;
+    }, z.core.$strict>>>>;
+    oauthEndpoints: z.ZodOptional<z.ZodObject<{
+        authorizationUrl: z.ZodString;
+        tokenUrl: z.ZodString;
+        extraAuthorizeParams: z.ZodOptional<z.ZodReadonly<z.ZodRecord<z.ZodString, z.ZodString>>>;
+        clientIdEnvVar: z.ZodOptional<z.ZodString>;
+        clientSecretEnvVar: z.ZodOptional<z.ZodString>;
+        revocationSupport: z.ZodEnum<typeof ProviderTokenRevocationSupport>;
+        revocation: z.ZodOptional<z.ZodObject<{
+            revocationUrl: z.ZodString;
+            clientAuthentication: z.ZodEnum<typeof import("./provider-token-revocation").RevocationClientAuthentication>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    allowOrgOverride: z.ZodBoolean;
+}, z.core.$strict>;
+export declare function providerOAuthEndpointsInvariant(provider: Pick<ProviderDescriptor, 'providerKey' | 'appAuthKind'> & {
+    readonly oauthEndpoints?: unknown;
+}, ctx: z.RefinementCtx, basePath?: readonly (string | number)[]): void;
+export declare const ProviderDescriptorSchema: z.ZodObject<{
+    providerKey: z.ZodString;
+    displayName: z.ZodString;
+    description: z.ZodString;
+    iconName: z.ZodString;
+    category: z.ZodString;
+    apiBaseUrl: z.ZodOptional<z.ZodString>;
+    appAuthKind: z.ZodEnum<typeof ProviderAppAuthKind>;
+    origin: z.ZodEnum<typeof ProviderOrigin>;
+    appCredentialSchema: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        label: z.ZodString;
+        type: z.ZodEnum<typeof import("./onboarding-manifest").CredentialFieldType>;
+        required: z.ZodBoolean;
+        isSecret: z.ZodBoolean;
+        placeholder: z.ZodOptional<z.ZodString>;
+        hint: z.ZodOptional<z.ZodString>;
+        transform: z.ZodEnum<typeof import("./onboarding-manifest").CredentialFieldTransform>;
+    }, z.core.$strict>>>>;
+    oauthEndpoints: z.ZodOptional<z.ZodObject<{
+        authorizationUrl: z.ZodString;
+        tokenUrl: z.ZodString;
+        extraAuthorizeParams: z.ZodOptional<z.ZodReadonly<z.ZodRecord<z.ZodString, z.ZodString>>>;
+        clientIdEnvVar: z.ZodOptional<z.ZodString>;
+        clientSecretEnvVar: z.ZodOptional<z.ZodString>;
+        revocationSupport: z.ZodEnum<typeof ProviderTokenRevocationSupport>;
+        revocation: z.ZodOptional<z.ZodObject<{
+            revocationUrl: z.ZodString;
+            clientAuthentication: z.ZodEnum<typeof import("./provider-token-revocation").RevocationClientAuthentication>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    allowOrgOverride: z.ZodBoolean;
+}, z.core.$strict>;
+type AssertExtends<T extends U, U> = T;
+type AllowUndefinedOptionals<T> = T extends readonly (infer E)[] ? readonly AllowUndefinedOptionals<E>[] : T extends object ? {
+    [K in keyof T]: AllowUndefinedOptionals<T[K]> | undefined;
+} : T;
+export type ProviderDescriptorValueIdentityGuards = [
+    AssertExtends<z.infer<typeof ProviderOAuthEndpointsSchema>, AllowUndefinedOptionals<ProviderOAuthEndpoints>>,
+    AssertExtends<ProviderOAuthEndpoints, z.infer<typeof ProviderOAuthEndpointsSchema>>,
+    AssertExtends<z.infer<typeof ProviderDescriptorSchema>, AllowUndefinedOptionals<ProviderDescriptor>>,
+    AssertExtends<ProviderDescriptor, z.infer<typeof ProviderDescriptorSchema>>
+];
+export declare function providerRequiresAppCredential(provider: Pick<ProviderDescriptor, 'appAuthKind'>): boolean;
+export {};
+//# sourceMappingURL=provider-descriptor.d.ts.map

package/dist/connector/lib/provider-descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-descriptor.d.ts","sourceRoot":"","sources":["../../../src/connector/lib/provider-descriptor.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,8BAA8B,EAE9B,KAAK,+BAA+B,EACrC,MAAM,6BAA6B,CAAC;AAQrC,oBAAY,mBAAmB;IAO7B,MAAM,WAAW;IAMjB,UAAU,gBAAgB;IAO1B,IAAI,SAAS;CACd;AAaD,oBAAY,cAAc;IACxB,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,KAAK,UAAU;CAChB;AAiDD,MAAM,WAAW,sBAAsB;IAErC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAElC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAQ1B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAQjE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAarC,QAAQ,CAAC,iBAAiB,EAAE,8BAA8B,CAAC;IAO3D,QAAQ,CAAC,UAAU,CAAC,EAAE,+BAA+B,CAAC;CACvD;AAOD,MAAM,WAAW,kBAAkB;IAEjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAS1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAG7B,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC;IAE1C,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAQhC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAM9D,QAAQ,CAAC,cAAc,CAAC,EAAE,sBAAsB,CAAC;IAOjD,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACpC;AAOD,eAAO,MAAM,4BAA4B;;;;;;;;;;;kBAetC,CAAC;AAUJ,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAYvC,CAAC;AASH,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,aAAa,GAAG,aAAa,CAAC,GAAG;IAClE,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACnC,EACD,GAAG,EAAE,CAAC,CAAC,aAAa,EACpB,QAAQ,GAAE,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,EAAO,GAC1C,IAAI,CAWN;AAMD,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBACsC,CAAC;AAO5E,KAAK,aAAa,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;AACvC,KAAK,uBAAuB,CAAC,CAAC,IAAI,CAAC,SAAS,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,GAC5D,SAAS,uBAAuB,CAAC,CAAC,CAAC,EAAE,GACrC,CAAC,SAAS,MAAM,GACd;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS;CAAE,GAC7D,CAAC,CAAC;AACR,MAAM,MAAM,qCAAqC,GAAG;IAClD,aAAa,CACX,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,EAC5C,uBAAuB,CAAC,sBAAsB,CAAC,CAChD;IACD,aAAa,CACX,sBAAsB,EACtB,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAC7C;IACD,aAAa,CACX,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,EACxC,uBAAuB,CAAC,kBAAkB,CAAC,CAC5C;IACD,aAAa,CAAC,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;CAC5E,CAAC;AAOF,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,aAAa,CAAC,GAChD,OAAO,CAET"}

package/dist/connector/lib/provider-descriptor.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProviderDescriptorSchema = exports.ProviderDescriptorBaseSchema = exports.ProviderOAuthEndpointsSchema = exports.ProviderOrigin = exports.ProviderAppAuthKind = void 0;
+exports.providerOAuthEndpointsInvariant = providerOAuthEndpointsInvariant;
+exports.providerRequiresAppCredential = providerRequiresAppCredential;
+const zod_1 = require("zod");
+const onboarding_manifest_1 = require("./onboarding-manifest");
+const provider_token_revocation_1 = require("./provider-token-revocation");
+var ProviderAppAuthKind;
+(function (ProviderAppAuthKind) {
+    ProviderAppAuthKind["OAuth2"] = "oauth2";
+    ProviderAppAuthKind["AppInstall"] = "app_install";
+    ProviderAppAuthKind["None"] = "none";
+})(ProviderAppAuthKind || (exports.ProviderAppAuthKind = ProviderAppAuthKind = {}));
+var ProviderOrigin;
+(function (ProviderOrigin) {
+    ProviderOrigin["Kernel"] = "kernel";
+    ProviderOrigin["Platform"] = "platform";
+    ProviderOrigin["Biome"] = "biome";
+})(ProviderOrigin || (exports.ProviderOrigin = ProviderOrigin = {}));
+exports.ProviderOAuthEndpointsSchema = zod_1.z
+    .strictObject({
+    authorizationUrl: zod_1.z.string().url(),
+    tokenUrl: zod_1.z.string().url(),
+    extraAuthorizeParams: zod_1.z
+        .record(zod_1.z.string(), zod_1.z.string())
+        .readonly()
+        .optional(),
+    clientIdEnvVar: zod_1.z.string().min(1).optional(),
+    clientSecretEnvVar: zod_1.z.string().min(1).optional(),
+    revocationSupport: zod_1.z.nativeEnum(provider_token_revocation_1.ProviderTokenRevocationSupport),
+    revocation: provider_token_revocation_1.ProviderTokenRevocationEndpointSchema.optional(),
+})
+    .superRefine((endpoints, ctx) => (0, provider_token_revocation_1.providerTokenRevocationInvariant)(endpoints, ctx));
+exports.ProviderDescriptorBaseSchema = zod_1.z.strictObject({
+    providerKey: zod_1.z.string().min(1),
+    displayName: zod_1.z.string().min(1),
+    description: zod_1.z.string().min(1),
+    iconName: zod_1.z.string().min(1),
+    category: zod_1.z.string().min(1),
+    apiBaseUrl: zod_1.z.string().url().optional(),
+    appAuthKind: zod_1.z.nativeEnum(ProviderAppAuthKind),
+    origin: zod_1.z.nativeEnum(ProviderOrigin),
+    appCredentialSchema: zod_1.z.array(onboarding_manifest_1.CredentialFieldSpecSchema).readonly().optional(),
+    oauthEndpoints: exports.ProviderOAuthEndpointsSchema.optional(),
+    allowOrgOverride: zod_1.z.boolean(),
+});
+function providerOAuthEndpointsInvariant(provider, ctx, basePath = []) {
+    if (provider.appAuthKind === ProviderAppAuthKind.OAuth2 &&
+        provider.oauthEndpoints === undefined) {
+        ctx.addIssue({
+            code: 'custom',
+            path: [...basePath, 'oauthEndpoints'],
+            message: `Provider "${provider.providerKey}" declares appAuthKind=oauth2 but has no oauthEndpoints.`,
+        });
+    }
+}
+exports.ProviderDescriptorSchema = exports.ProviderDescriptorBaseSchema.superRefine(providerOAuthEndpointsInvariant);
+function providerRequiresAppCredential(provider) {
+    return provider.appAuthKind !== ProviderAppAuthKind.None;
+}
+//# sourceMappingURL=provider-descriptor.js.map

package/dist/connector/lib/provider-descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-descriptor.js","sourceRoot":"","sources":["../../../src/connector/lib/provider-descriptor.ts"],"names":[],"mappings":";;;AAwRA,0EAiBC;AAyCD,sEAIC;AA5TD,6BAAwB;AAExB,+DAG+B;AAC/B,2EAKqC;AAQrC,IAAY,mBAqBX;AArBD,WAAY,mBAAmB;IAO7B,wCAAiB,CAAA;IAMjB,iDAA0B,CAAA;IAO1B,oCAAa,CAAA;AACf,CAAC,EArBW,mBAAmB,mCAAnB,mBAAmB,QAqB9B;AAaD,IAAY,cAIX;AAJD,WAAY,cAAc;IACxB,mCAAiB,CAAA;IACjB,uCAAqB,CAAA;IACrB,iCAAe,CAAA;AACjB,CAAC,EAJW,cAAc,8BAAd,cAAc,QAIzB;AAuJY,QAAA,4BAA4B,GAAG,OAAC;KAC1C,YAAY,CAAC;IACZ,gBAAgB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAClC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC1B,oBAAoB,EAAE,OAAC;SACpB,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC;SAC9B,QAAQ,EAAE;SACV,QAAQ,EAAE;IACb,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5C,kBAAkB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,iBAAiB,EAAE,OAAC,CAAC,UAAU,CAAC,0DAA8B,CAAC;IAC/D,UAAU,EAAE,iEAAqC,CAAC,QAAQ,EAAE;CAC7D,CAAC;KACD,WAAW,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAC9B,IAAA,4DAAgC,EAAC,SAAS,EAAE,GAAG,CAAC,CACjD,CAAC;AAUS,QAAA,4BAA4B,GAAG,OAAC,CAAC,YAAY,CAAC;IACzD,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,OAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC;IAC9C,MAAM,EAAE,OAAC,CAAC,UAAU,CAAC,cAAc,CAAC;IACpC,mBAAmB,EAAE,OAAC,CAAC,KAAK,CAAC,+CAAyB,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7E,cAAc,EAAE,oCAA4B,CAAC,QAAQ,EAAE;IACvD,gBAAgB,EAAE,OAAC,CAAC,OAAO,EAAE;CAC9B,CAAC,CAAC;AASH,SAAgB,+BAA+B,CAC7C,QAEC,EACD,GAAoB,EACpB,WAAyC,EAAE;IAE3C,IACE,QAAQ,CAAC,WAAW,KAAK,mBAAmB,CAAC,MAAM;QACnD,QAAQ,CAAC,cAAc,KAAK,SAAS,EACrC,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,GAAG,QAAQ,EAAE,gBAAgB,CAAC;YACrC,OAAO,EAAE,aAAa,QAAQ,CAAC,WAAW,0DAA0D;SACrG,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAMY,QAAA,wBAAwB,GACnC,oCAA4B,CAAC,WAAW,CAAC,+BAA+B,CAAC,CAAC;AAkC5E,SAAgB,6BAA6B,CAC3C,QAAiD;IAEjD,OAAO,QAAQ,CAAC,WAAW,KAAK,mBAAmB,CAAC,IAAI,CAAC;AAC3D,CAAC"}

package/dist/connector/lib/provider-token-revocation.d.ts

@@ -0,0 +1,30 @@
+import { z } from 'zod';
+export declare enum ProviderTokenRevocationSupport {
+    Rfc7009 = "rfc7009",
+    NotImplemented = "not_implemented",
+    Unsupported = "unsupported"
+}
+export declare enum RevocationClientAuthentication {
+    None = "none",
+    ClientSecretPost = "client_secret_post"
+}
+export interface ProviderTokenRevocationEndpoint {
+    readonly revocationUrl: string;
+    readonly clientAuthentication: RevocationClientAuthentication;
+}
+export declare const ProviderTokenRevocationEndpointSchema: z.ZodObject<{
+    revocationUrl: z.ZodString;
+    clientAuthentication: z.ZodEnum<typeof RevocationClientAuthentication>;
+}, z.core.$strict>;
+export declare function revocationSupportIsActionable(support: ProviderTokenRevocationSupport): support is ProviderTokenRevocationSupport.Rfc7009;
+export declare function providerTokenRevocationInvariant(endpoints: {
+    readonly revocationSupport?: unknown;
+    readonly revocation?: unknown;
+}, ctx: z.RefinementCtx, basePath?: readonly (string | number)[]): void;
+type AssertExtends<T extends U, U> = T;
+export type ProviderTokenRevocationValueIdentityGuards = [
+    AssertExtends<z.infer<typeof ProviderTokenRevocationEndpointSchema>, ProviderTokenRevocationEndpoint>,
+    AssertExtends<ProviderTokenRevocationEndpoint, z.infer<typeof ProviderTokenRevocationEndpointSchema>>
+];
+export {};
+//# sourceMappingURL=provider-token-revocation.d.ts.map

package/dist/connector/lib/provider-token-revocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-token-revocation.d.ts","sourceRoot":"","sources":["../../../src/connector/lib/provider-token-revocation.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAaxB,oBAAY,8BAA8B;IAQxC,OAAO,YAAY;IAWnB,cAAc,oBAAoB;IAUlC,WAAW,gBAAgB;CAC5B;AAWD,oBAAY,8BAA8B;IAExC,IAAI,SAAS;IAEb,gBAAgB,uBAAuB;CACxC;AAUD,MAAM,WAAW,+BAA+B;IAK9C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B,QAAQ,CAAC,oBAAoB,EAAE,8BAA8B,CAAC;CAC/D;AAGD,eAAO,MAAM,qCAAqC;;;kBAGhD,CAAC;AAQH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,8BAA8B,GACtC,OAAO,IAAI,8BAA8B,CAAC,OAAO,CAEnD;AAgBD,wBAAgB,gCAAgC,CAC9C,SAAS,EAAE;IACT,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B,EACD,GAAG,EAAE,CAAC,CAAC,aAAa,EACpB,QAAQ,GAAE,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,EAAO,GAC1C,IAAI,CAyBN;AAGD,KAAK,aAAa,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;AACvC,MAAM,MAAM,0CAA0C,GAAG;IACvD,aAAa,CACX,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,EACrD,+BAA+B,CAChC;IACD,aAAa,CACX,+BAA+B,EAC/B,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CACtD;CACF,CAAC"}

package/dist/connector/lib/provider-token-revocation.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProviderTokenRevocationEndpointSchema = exports.RevocationClientAuthentication = exports.ProviderTokenRevocationSupport = void 0;
+exports.revocationSupportIsActionable = revocationSupportIsActionable;
+exports.providerTokenRevocationInvariant = providerTokenRevocationInvariant;
+const zod_1 = require("zod");
+var ProviderTokenRevocationSupport;
+(function (ProviderTokenRevocationSupport) {
+    ProviderTokenRevocationSupport["Rfc7009"] = "rfc7009";
+    ProviderTokenRevocationSupport["NotImplemented"] = "not_implemented";
+    ProviderTokenRevocationSupport["Unsupported"] = "unsupported";
+})(ProviderTokenRevocationSupport || (exports.ProviderTokenRevocationSupport = ProviderTokenRevocationSupport = {}));
+var RevocationClientAuthentication;
+(function (RevocationClientAuthentication) {
+    RevocationClientAuthentication["None"] = "none";
+    RevocationClientAuthentication["ClientSecretPost"] = "client_secret_post";
+})(RevocationClientAuthentication || (exports.RevocationClientAuthentication = RevocationClientAuthentication = {}));
+exports.ProviderTokenRevocationEndpointSchema = zod_1.z.strictObject({
+    revocationUrl: zod_1.z.string().url(),
+    clientAuthentication: zod_1.z.nativeEnum(RevocationClientAuthentication),
+});
+function revocationSupportIsActionable(support) {
+    return support === ProviderTokenRevocationSupport.Rfc7009;
+}
+function providerTokenRevocationInvariant(endpoints, ctx, basePath = []) {
+    const declaresRfc7009 = endpoints.revocationSupport === ProviderTokenRevocationSupport.Rfc7009;
+    const hasEndpoint = endpoints.revocation !== undefined;
+    if (declaresRfc7009 && !hasEndpoint) {
+        ctx.addIssue({
+            code: 'custom',
+            path: [...basePath, 'revocation'],
+            message: `revocationSupport="${ProviderTokenRevocationSupport.Rfc7009}" requires a ` +
+                '`revocation` endpoint — a provider that declares revocation support and ' +
+                'carries no endpoint would silently revoke nothing on disconnect.',
+        });
+    }
+    if (!declaresRfc7009 && hasEndpoint) {
+        ctx.addIssue({
+            code: 'custom',
+            path: [...basePath, 'revocation'],
+            message: 'a `revocation` endpoint is only ever called under ' +
+                `revocationSupport="${ProviderTokenRevocationSupport.Rfc7009}" — remove one or ` +
+                'the other rather than declaring an endpoint nothing invokes.',
+        });
+    }
+}
+//# sourceMappingURL=provider-token-revocation.js.map

package/dist/connector/lib/provider-token-revocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-token-revocation.js","sourceRoot":"","sources":["../../../src/connector/lib/provider-token-revocation.ts"],"names":[],"mappings":";;;AAgIA,sEAIC;AAgBD,4EAgCC;AA/ID,6BAAwB;AAaxB,IAAY,8BA8BX;AA9BD,WAAY,8BAA8B;IAQxC,qDAAmB,CAAA;IAWnB,oEAAkC,CAAA;IAUlC,6DAA2B,CAAA;AAC7B,CAAC,EA9BW,8BAA8B,8CAA9B,8BAA8B,QA8BzC;AAWD,IAAY,8BAKX;AALD,WAAY,8BAA8B;IAExC,+CAAa,CAAA;IAEb,yEAAuC,CAAA;AACzC,CAAC,EALW,8BAA8B,8CAA9B,8BAA8B,QAKzC;AAqBY,QAAA,qCAAqC,GAAG,OAAC,CAAC,YAAY,CAAC;IAClE,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC/B,oBAAoB,EAAE,OAAC,CAAC,UAAU,CAAC,8BAA8B,CAAC;CACnE,CAAC,CAAC;AAQH,SAAgB,6BAA6B,CAC3C,OAAuC;IAEvC,OAAO,OAAO,KAAK,8BAA8B,CAAC,OAAO,CAAC;AAC5D,CAAC;AAgBD,SAAgB,gCAAgC,CAC9C,SAGC,EACD,GAAoB,EACpB,WAAyC,EAAE;IAE3C,MAAM,eAAe,GACnB,SAAS,CAAC,iBAAiB,KAAK,8BAA8B,CAAC,OAAO,CAAC;IACzE,MAAM,WAAW,GAAG,SAAS,CAAC,UAAU,KAAK,SAAS,CAAC;IAEvD,IAAI,eAAe,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,GAAG,QAAQ,EAAE,YAAY,CAAC;YACjC,OAAO,EACL,sBAAsB,8BAA8B,CAAC,OAAO,eAAe;gBAC3E,0EAA0E;gBAC1E,kEAAkE;SACrE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,eAAe,IAAI,WAAW,EAAE,CAAC;QACpC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,GAAG,QAAQ,EAAE,YAAY,CAAC;YACjC,OAAO,EACL,oDAAoD;gBACpD,sBAAsB,8BAA8B,CAAC,OAAO,oBAAoB;gBAChF,8DAA8D;SACjE,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/connector/lib/runtime-materialization-audience.d.ts

@@ -0,0 +1,2 @@
+export declare const RUNTIME_MATERIALIZATION_WORKER_AUDIENCE: "platform-agent-worker";
+//# sourceMappingURL=runtime-materialization-audience.d.ts.map

package/dist/connector/lib/runtime-materialization-audience.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-materialization-audience.d.ts","sourceRoot":"","sources":["../../../src/connector/lib/runtime-materialization-audience.ts"],"names":[],"mappings":"AAwCA,eAAO,MAAM,uCAAuC,EAClD,uBAAgC,CAAC"}

package/dist/connector/lib/runtime-materialization-audience.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RUNTIME_MATERIALIZATION_WORKER_AUDIENCE = void 0;
+exports.RUNTIME_MATERIALIZATION_WORKER_AUDIENCE = 'platform-agent-worker';
+//# sourceMappingURL=runtime-materialization-audience.js.map

package/dist/connector/lib/runtime-materialization-audience.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-materialization-audience.js","sourceRoot":"","sources":["../../../src/connector/lib/runtime-materialization-audience.ts"],"names":[],"mappings":";;;AAwCa,QAAA,uCAAuC,GAClD,uBAAgC,CAAC"}

package/dist/connector/lib/sealed-connection-credential.d.ts

@@ -0,0 +1,7 @@
+export declare const SEALED_CONNECTION_CREDENTIAL_PAYLOAD_CONTRACT: "xema-sealed-connection-credential-v1";
+export interface SealedConnectionCredentialPayload {
+    readonly contract: typeof SEALED_CONNECTION_CREDENTIAL_PAYLOAD_CONTRACT;
+    readonly secretValue: string;
+}
+export declare function parseSealedConnectionCredentialPayload(payload: unknown, context: string): SealedConnectionCredentialPayload;
+//# sourceMappingURL=sealed-connection-credential.d.ts.map

package/dist/connector/lib/sealed-connection-credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealed-connection-credential.d.ts","sourceRoot":"","sources":["../../../src/connector/lib/sealed-connection-credential.ts"],"names":[],"mappings":"AAmCA,eAAO,MAAM,6CAA6C,EACxD,sCAA+C,CAAC;AAGlD,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,QAAQ,EAAE,OAAO,6CAA6C,CAAC;IAOxE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAaD,wBAAgB,sCAAsC,CACpD,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,GACd,iCAAiC,CAwBnC"}

package/dist/connector/lib/sealed-connection-credential.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SEALED_CONNECTION_CREDENTIAL_PAYLOAD_CONTRACT = void 0;
+exports.parseSealedConnectionCredentialPayload = parseSealedConnectionCredentialPayload;
+exports.SEALED_CONNECTION_CREDENTIAL_PAYLOAD_CONTRACT = 'xema-sealed-connection-credential-v1';
+function parseSealedConnectionCredentialPayload(payload, context) {
+    if (typeof payload !== 'object' || payload === null) {
+        throw new Error(`Sealed connection-credential payload for ${context} is not an object.`);
+    }
+    const record = payload;
+    if (record['contract'] !== exports.SEALED_CONNECTION_CREDENTIAL_PAYLOAD_CONTRACT) {
+        throw new Error(`Sealed connection-credential payload for ${context} declares an ` +
+            `unrecognised contract (expected ` +
+            `"${exports.SEALED_CONNECTION_CREDENTIAL_PAYLOAD_CONTRACT}").`);
+    }
+    const secretValue = record['secretValue'];
+    if (typeof secretValue !== 'string' || secretValue.length === 0) {
+        throw new Error(`Sealed connection-credential payload for ${context} carries no secretValue.`);
+    }
+    return {
+        contract: exports.SEALED_CONNECTION_CREDENTIAL_PAYLOAD_CONTRACT,
+        secretValue,
+    };
+}
+//# sourceMappingURL=sealed-connection-credential.js.map

package/dist/connector/lib/sealed-connection-credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealed-connection-credential.js","sourceRoot":"","sources":["../../../src/connector/lib/sealed-connection-credential.ts"],"names":[],"mappings":";;;AA6DA,wFA2BC;AArDY,QAAA,6CAA6C,GACxD,sCAA+C,CAAC;AAyBlD,SAAgB,sCAAsC,CACpD,OAAgB,EAChB,OAAe;IAEf,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,4CAA4C,OAAO,oBAAoB,CACxE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,OAAkC,CAAC;IAClD,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,qDAA6C,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CACb,4CAA4C,OAAO,eAAe;YAChE,kCAAkC;YAClC,IAAI,qDAA6C,KAAK,CACzD,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;IAC1C,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,4CAA4C,OAAO,0BAA0B,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,qDAA6C;QACvD,WAAW;KACZ,CAAC;AACJ,CAAC"}

package/dist/content-address/index.d.ts

@@ -0,0 +1,2 @@
+export * from './lib/content-address';
+//# sourceMappingURL=index.d.ts.map

package/dist/content-address/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/content-address/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC"}

package/dist/content-address/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./lib/content-address"), exports);
+//# sourceMappingURL=index.js.map

package/dist/content-address/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/content-address/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,wDAAsC"}