@xemahq/kernel-contracts 0.23.1 → 0.23.2

package/dist/connector/index.d.ts

@@ -8,4 +8,5 @@ export * from './lib/envelope-schema';
 export * from './lib/filter-expr';
 export * from './lib/filter-expr-schema';
 export * from './lib/filter-expr-validate';
+export * from './lib/integration-provider-contribution';
 //# sourceMappingURL=index.d.ts.map

package/dist/connector/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/connector/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/connector/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,yCAAyC,CAAC"}

package/dist/connector/index.js

@@ -24,4 +24,5 @@ __exportStar(require("./lib/envelope-schema"), exports);
 __exportStar(require("./lib/filter-expr"), exports);
 __exportStar(require("./lib/filter-expr-schema"), exports);
 __exportStar(require("./lib/filter-expr-validate"), exports);
+__exportStar(require("./lib/integration-provider-contribution"), exports);
 //# sourceMappingURL=index.js.map

package/dist/connector/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/connector/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAmC;AACnC,mDAAiC;AACjC,wDAAsC;AACtC,4DAA0C;AAC1C,4DAA0C;AAC1C,6DAA2C;AAC3C,wDAAsC;AACtC,oDAAkC;AAClC,2DAAyC;AACzC,6DAA2C"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/connector/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAmC;AACnC,mDAAiC;AACjC,wDAAsC;AACtC,4DAA0C;AAC1C,4DAA0C;AAC1C,6DAA2C;AAC3C,wDAAsC;AACtC,oDAAkC;AAClC,2DAAyC;AACzC,6DAA2C;AAC3C,0EAAwD"}

package/dist/connector/lib/connector-descriptor.d.ts

@@ -1,5 +1,6 @@
+import { z } from 'zod';
+import { CredentialKind } from './credential-kind';
 import type { AdapterKindRef } from './adapter-kind';
-import type { CredentialKind } from './credential-kind';
 export interface ConnectorDescriptor {
     readonly connectorKey: string;
     readonly displayName: string;
@@ -10,4 +11,20 @@ export interface ConnectorDescriptor {
     readonly connectionCredentialKind: CredentialKind;
     readonly adapterKind: AdapterKindRef;
 }
+export declare const ConnectorDescriptorSchema: z.ZodObject<{
+    connectorKey: z.ZodString;
+    displayName: z.ZodString;
+    description: z.ZodString;
+    iconName: z.ZodString;
+    providerKey: z.ZodString;
+    scopes: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+    connectionCredentialKind: z.ZodEnum<typeof CredentialKind>;
+    adapterKind: z.ZodString;
+}, z.core.$strict>;
+type AssertExtends<T extends U, U> = T;
+export type ConnectorDescriptorValueIdentityGuards = [
+    AssertExtends<z.infer<typeof ConnectorDescriptorSchema>, ConnectorDescriptor>,
+    AssertExtends<ConnectorDescriptor, z.infer<typeof ConnectorDescriptorSchema>>
+];
+export {};
 //# sourceMappingURL=connector-descriptor.d.ts.map

package/dist/connector/lib/connector-descriptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connector-descriptor.d.ts","sourceRoot":"","sources":["../../../src/connector/lib/connector-descriptor.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AASxD,MAAM,WAAW,mBAAmB;IAElC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAG1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAU7B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAOnC,QAAQ,CAAC,wBAAwB,EAAE,cAAc,CAAC;IAOlD,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;CACtC"}
+{"version":3,"file":"connector-descriptor.d.ts","sourceRoot":"","sources":["../../../src/connector/lib/connector-descriptor.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AASrD,MAAM,WAAW,mBAAmB;IAElC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAG1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAU7B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAOnC,QAAQ,CAAC,wBAAwB,EAAE,cAAc,CAAC;IAOlD,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;CACtC;AASD,eAAO,MAAM,yBAAyB;;;;;;;;;kBASpC,CAAC;AAIH,KAAK,aAAa,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;AACvC,MAAM,MAAM,sCAAsC,GAAG;IACnD,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,EAAE,mBAAmB,CAAC;IAC7E,aAAa,CAAC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;CAC9E,CAAC"}

package/dist/connector/lib/connector-descriptor.js

@@ -1,3 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConnectorDescriptorSchema = void 0;
+const zod_1 = require("zod");
+const credential_kind_1 = require("./credential-kind");
+exports.ConnectorDescriptorSchema = zod_1.z.strictObject({
+    connectorKey: zod_1.z.string().min(1),
+    displayName: zod_1.z.string().min(1),
+    description: zod_1.z.string().min(1),
+    iconName: zod_1.z.string().min(1),
+    providerKey: zod_1.z.string().min(1),
+    scopes: zod_1.z.array(zod_1.z.string()).readonly(),
+    connectionCredentialKind: zod_1.z.nativeEnum(credential_kind_1.CredentialKind),
+    adapterKind: zod_1.z.string().min(1),
+});
 //# sourceMappingURL=connector-descriptor.js.map

package/dist/connector/lib/connector-descriptor.js.map

@@ -1 +1 @@
-{"version":3,"file":"connector-descriptor.js","sourceRoot":"","sources":["../../../src/connector/lib/connector-descriptor.ts"],"names":[],"mappings":""}
+{"version":3,"file":"connector-descriptor.js","sourceRoot":"","sources":["../../../src/connector/lib/connector-descriptor.ts"],"names":[],"mappings":";;;AAoBA,6BAAwB;AAExB,uDAAmD;AAwDtC,QAAA,yBAAyB,GAAG,OAAC,CAAC,YAAY,CAAC;IACtD,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,wBAAwB,EAAE,OAAC,CAAC,UAAU,CAAC,gCAAc,CAAC;IACtD,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC"}

package/dist/connector/lib/integration-provider-contribution.d.ts

@@ -0,0 +1,66 @@
+import { z } from 'zod';
+export declare const ContributedProviderDescriptorSchema: z.ZodObject<{
+    description: z.ZodString;
+    displayName: z.ZodString;
+    providerKey: z.ZodString;
+    iconName: z.ZodString;
+    category: z.ZodString;
+    appAuthKind: z.ZodEnum<typeof import("./provider-descriptor").ProviderAppAuthKind>;
+    appCredentialSchema: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        label: z.ZodString;
+        type: z.ZodEnum<typeof import("./onboarding-manifest").CredentialFieldType>;
+        required: z.ZodBoolean;
+        placeholder: z.ZodOptional<z.ZodString>;
+        hint: z.ZodOptional<z.ZodString>;
+        transform: z.ZodEnum<typeof import("./onboarding-manifest").CredentialFieldTransform>;
+    }, z.core.$strict>>>>;
+    oauthEndpoints: z.ZodOptional<z.ZodObject<{
+        authorizationUrl: z.ZodString;
+        tokenUrl: z.ZodString;
+        extraAuthorizeParams: z.ZodOptional<z.ZodReadonly<z.ZodRecord<z.ZodString, z.ZodString>>>;
+        clientIdEnvVar: z.ZodOptional<z.ZodString>;
+        clientSecretEnvVar: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    allowOrgOverride: z.ZodBoolean;
+}, z.core.$strict>;
+export type ContributedProviderDescriptor = z.infer<typeof ContributedProviderDescriptorSchema>;
+export declare const IntegrationProviderContributionManifestSchema: z.ZodObject<{
+    provider: z.ZodObject<{
+        description: z.ZodString;
+        displayName: z.ZodString;
+        providerKey: z.ZodString;
+        iconName: z.ZodString;
+        category: z.ZodString;
+        appAuthKind: z.ZodEnum<typeof import("./provider-descriptor").ProviderAppAuthKind>;
+        appCredentialSchema: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodObject<{
+            key: z.ZodString;
+            label: z.ZodString;
+            type: z.ZodEnum<typeof import("./onboarding-manifest").CredentialFieldType>;
+            required: z.ZodBoolean;
+            placeholder: z.ZodOptional<z.ZodString>;
+            hint: z.ZodOptional<z.ZodString>;
+            transform: z.ZodEnum<typeof import("./onboarding-manifest").CredentialFieldTransform>;
+        }, z.core.$strict>>>>;
+        oauthEndpoints: z.ZodOptional<z.ZodObject<{
+            authorizationUrl: z.ZodString;
+            tokenUrl: z.ZodString;
+            extraAuthorizeParams: z.ZodOptional<z.ZodReadonly<z.ZodRecord<z.ZodString, z.ZodString>>>;
+            clientIdEnvVar: z.ZodOptional<z.ZodString>;
+            clientSecretEnvVar: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+        allowOrgOverride: z.ZodBoolean;
+    }, z.core.$strict>;
+    connectors: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+        connectorKey: z.ZodString;
+        displayName: z.ZodString;
+        description: z.ZodString;
+        iconName: z.ZodString;
+        providerKey: z.ZodString;
+        scopes: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+        connectionCredentialKind: z.ZodEnum<typeof import("./credential-kind").CredentialKind>;
+        adapterKind: z.ZodString;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+export type IntegrationProviderContributionManifest = z.infer<typeof IntegrationProviderContributionManifestSchema>;
+//# sourceMappingURL=integration-provider-contribution.d.ts.map

package/dist/connector/lib/integration-provider-contribution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration-provider-contribution.d.ts","sourceRoot":"","sources":["../../../src/connector/lib/integration-provider-contribution.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA2BxB,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;kBACK,CAAC;AAEtD,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CACjD,OAAO,mCAAmC,CAC3C,CAAC;AAQF,eAAO,MAAM,6CAA6C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAiDtD,CAAC;AAEL,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAC3D,OAAO,6CAA6C,CACrD,CAAC"}

package/dist/connector/lib/integration-provider-contribution.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IntegrationProviderContributionManifestSchema = exports.ContributedProviderDescriptorSchema = void 0;
+const zod_1 = require("zod");
+const connector_descriptor_1 = require("./connector-descriptor");
+const provider_descriptor_1 = require("./provider-descriptor");
+const CONTRIBUTED_PROVIDER_KEY_REGEX = /^[a-z][a-z0-9_-]*$/;
+const CONTRIBUTED_CONNECTOR_KEY_REGEX = /^[A-Z][A-Z0-9_]*$/;
+exports.ContributedProviderDescriptorSchema = provider_descriptor_1.ProviderDescriptorBaseSchema.omit({ origin: true });
+exports.IntegrationProviderContributionManifestSchema = zod_1.z
+    .strictObject({
+    provider: exports.ContributedProviderDescriptorSchema,
+    connectors: zod_1.z.array(connector_descriptor_1.ConnectorDescriptorSchema).min(1).readonly(),
+})
+    .superRefine((manifest, ctx) => {
+    (0, provider_descriptor_1.providerOAuthEndpointsInvariant)(manifest.provider, ctx, ['provider']);
+    if (!CONTRIBUTED_PROVIDER_KEY_REGEX.test(manifest.provider.providerKey)) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['provider', 'providerKey'],
+            message: `providerKey "${manifest.provider.providerKey}" must be a lowercase ` +
+                `slug matching ${CONTRIBUTED_PROVIDER_KEY_REGEX.source}.`,
+        });
+    }
+    const seenConnectorKeys = new Set();
+    manifest.connectors.forEach((connector, index) => {
+        if (!CONTRIBUTED_CONNECTOR_KEY_REGEX.test(connector.connectorKey)) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['connectors', index, 'connectorKey'],
+                message: `connectorKey "${connector.connectorKey}" must be UPPER_SNAKE ` +
+                    `matching ${CONTRIBUTED_CONNECTOR_KEY_REGEX.source}.`,
+            });
+        }
+        if (connector.providerKey !== manifest.provider.providerKey) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['connectors', index, 'providerKey'],
+                message: `Connector "${connector.connectorKey}" references provider ` +
+                    `"${connector.providerKey}" but this manifest contributes provider ` +
+                    `"${manifest.provider.providerKey}" — a contribution's connectors ` +
+                    `must belong to its own provider.`,
+            });
+        }
+        if (seenConnectorKeys.has(connector.connectorKey)) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['connectors', index, 'connectorKey'],
+                message: `Duplicate connectorKey "${connector.connectorKey}" in manifest.`,
+            });
+        }
+        seenConnectorKeys.add(connector.connectorKey);
+    });
+});
+//# sourceMappingURL=integration-provider-contribution.js.map

package/dist/connector/lib/integration-provider-contribution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration-provider-contribution.js","sourceRoot":"","sources":["../../../src/connector/lib/integration-provider-contribution.ts"],"names":[],"mappings":";;;AAwBA,6BAAwB;AAExB,iEAAmE;AACnE,+DAG+B;AAM/B,MAAM,8BAA8B,GAAG,oBAAoB,CAAC;AAQ5D,MAAM,+BAA+B,GAAG,mBAAmB,CAAC;AAO/C,QAAA,mCAAmC,GAC9C,kDAA4B,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAYzC,QAAA,6CAA6C,GAAG,OAAC;KAC3D,YAAY,CAAC;IACZ,QAAQ,EAAE,2CAAmC;IAC7C,UAAU,EAAE,OAAC,CAAC,KAAK,CAAC,gDAAyB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACjE,CAAC;KACD,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAC7B,IAAA,qDAA+B,EAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAEtE,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC;YACjC,OAAO,EACL,gBAAgB,QAAQ,CAAC,QAAQ,CAAC,WAAW,wBAAwB;gBACrE,iBAAiB,8BAA8B,CAAC,MAAM,GAAG;SAC5D,CAAC,CAAC;IACL,CAAC;IAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC5C,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE;QAC/C,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,YAAY,EAAE,KAAK,EAAE,cAAc,CAAC;gBAC3C,OAAO,EACL,iBAAiB,SAAS,CAAC,YAAY,wBAAwB;oBAC/D,YAAY,+BAA+B,CAAC,MAAM,GAAG;aACxD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,SAAS,CAAC,WAAW,KAAK,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC5D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,YAAY,EAAE,KAAK,EAAE,aAAa,CAAC;gBAC1C,OAAO,EACL,cAAc,SAAS,CAAC,YAAY,wBAAwB;oBAC5D,IAAI,SAAS,CAAC,WAAW,2CAA2C;oBACpE,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,kCAAkC;oBACnE,kCAAkC;aACrC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC;YAClD,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,YAAY,EAAE,KAAK,EAAE,cAAc,CAAC;gBAC3C,OAAO,EAAE,2BAA2B,SAAS,CAAC,YAAY,gBAAgB;aAC3E,CAAC,CAAC;QACL,CAAC;QACD,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/connector/lib/onboarding-manifest.d.ts

@@ -1,3 +1,4 @@
+import { z } from 'zod';
 export declare enum CredentialFieldType {
     TEXT = "TEXT",
     PASSWORD = "PASSWORD",
@@ -29,6 +30,15 @@ export interface CredentialFieldSpec {
     readonly hint?: string;
     readonly transform: CredentialFieldTransform;
 }
+export declare const CredentialFieldSpecSchema: z.ZodObject<{
+    key: z.ZodString;
+    label: z.ZodString;
+    type: z.ZodEnum<typeof CredentialFieldType>;
+    required: z.ZodBoolean;
+    placeholder: z.ZodOptional<z.ZodString>;
+    hint: z.ZodOptional<z.ZodString>;
+    transform: z.ZodEnum<typeof CredentialFieldTransform>;
+}, z.core.$strict>;
 export interface ProviderOnboardingManifest {
     readonly provider: string;
     readonly displayName: string;

package/dist/connector/lib/onboarding-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"onboarding-manifest.d.ts","sourceRoot":"","sources":["../../../src/connector/lib/onboarding-manifest.ts"],"names":[],"mappings":"AA2BA,oBAAY,mBAAmB;IAC7B,IAAI,SAAS;IACb,QAAQ,aAAa;IACrB,KAAK,UAAU;IACf,GAAG,QAAQ;IACX,SAAS,cAAc;CACxB;AAQD,oBAAY,wBAAwB;IAClC,IAAI,SAAS;IACb,SAAS,cAAc;IACvB,SAAS,cAAc;IACvB,IAAI,SAAS;CACd;AAWD,oBAAY,yBAAyB;IACnC,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;CAC5B;AAmBD,oBAAY,wBAAwB;IAClC,aAAa,kBAAkB;IAC/B,OAAO,YAAY;IACnB,GAAG,QAAQ;CACZ;AAOD,MAAM,WAAW,mBAAmB;IAElC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAErB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IAEnC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAE3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;CAC9C;AAcD,MAAM,WAAW,0BAA0B;IAEzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAM7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC;IAczC,QAAQ,CAAC,mCAAmC,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAIlF,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAEjD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAMvB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAIlC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B"}
+{"version":3,"file":"onboarding-manifest.d.ts","sourceRoot":"","sources":["../../../src/connector/lib/onboarding-manifest.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,oBAAY,mBAAmB;IAC7B,IAAI,SAAS;IACb,QAAQ,aAAa;IACrB,KAAK,UAAU;IACf,GAAG,QAAQ;IACX,SAAS,cAAc;CACxB;AAQD,oBAAY,wBAAwB;IAClC,IAAI,SAAS;IACb,SAAS,cAAc;IACvB,SAAS,cAAc;IACvB,IAAI,SAAS;CACd;AAWD,oBAAY,yBAAyB;IACnC,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;CAC5B;AAmBD,oBAAY,wBAAwB;IAClC,aAAa,kBAAkB;IAC/B,OAAO,YAAY;IACnB,GAAG,QAAQ;CACZ;AAOD,MAAM,WAAW,mBAAmB;IAElC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAErB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IAEnC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAE3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;CAC9C;AASD,eAAO,MAAM,yBAAyB;;;;;;;;kBAQpC,CAAC;AAcH,MAAM,WAAW,0BAA0B;IAEzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAM7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC;IAczC,QAAQ,CAAC,mCAAmC,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAIlF,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAEjD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAMvB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAIlC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B"}

package/dist/connector/lib/onboarding-manifest.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ProjectBindingAdapterKey = exports.IntegrationOnboardingKind = exports.CredentialFieldTransform = exports.CredentialFieldType = void 0;
+exports.CredentialFieldSpecSchema = exports.ProjectBindingAdapterKey = exports.IntegrationOnboardingKind = exports.CredentialFieldTransform = exports.CredentialFieldType = void 0;
+const zod_1 = require("zod");
 var CredentialFieldType;
 (function (CredentialFieldType) {
     CredentialFieldType["TEXT"] = "TEXT";
@@ -27,4 +28,13 @@ var ProjectBindingAdapterKey;
     ProjectBindingAdapterKey["TRACKER"] = "TRACKER";
     ProjectBindingAdapterKey["SCM"] = "SCM";
 })(ProjectBindingAdapterKey || (exports.ProjectBindingAdapterKey = ProjectBindingAdapterKey = {}));
+exports.CredentialFieldSpecSchema = zod_1.z.strictObject({
+    key: zod_1.z.string().min(1),
+    label: zod_1.z.string().min(1),
+    type: zod_1.z.nativeEnum(CredentialFieldType),
+    required: zod_1.z.boolean(),
+    placeholder: zod_1.z.string().optional(),
+    hint: zod_1.z.string().optional(),
+    transform: zod_1.z.nativeEnum(CredentialFieldTransform),
+});
 //# sourceMappingURL=onboarding-manifest.js.map

package/dist/connector/lib/onboarding-manifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"onboarding-manifest.js","sourceRoot":"","sources":["../../../src/connector/lib/onboarding-manifest.ts"],"names":[],"mappings":";;;AA2BA,IAAY,mBAMX;AAND,WAAY,mBAAmB;IAC7B,oCAAa,CAAA;IACb,4CAAqB,CAAA;IACrB,sCAAe,CAAA;IACf,kCAAW,CAAA;IACX,8CAAuB,CAAA;AACzB,CAAC,EANW,mBAAmB,mCAAnB,mBAAmB,QAM9B;AAQD,IAAY,wBAKX;AALD,WAAY,wBAAwB;IAClC,yCAAa,CAAA;IACb,mDAAuB,CAAA;IACvB,mDAAuB,CAAA;IACvB,yCAAa,CAAA;AACf,CAAC,EALW,wBAAwB,wCAAxB,wBAAwB,QAKnC;AAWD,IAAY,yBAGX;AAHD,WAAY,yBAAyB;IACnC,wDAA2B,CAAA;IAC3B,wDAA2B,CAAA;AAC7B,CAAC,EAHW,yBAAyB,yCAAzB,yBAAyB,QAGpC;AAmBD,IAAY,wBAIX;AAJD,WAAY,wBAAwB;IAClC,2DAA+B,CAAA;IAC/B,+CAAmB,CAAA;IACnB,uCAAW,CAAA;AACb,CAAC,EAJW,wBAAwB,wCAAxB,wBAAwB,QAInC"}
+{"version":3,"file":"onboarding-manifest.js","sourceRoot":"","sources":["../../../src/connector/lib/onboarding-manifest.ts"],"names":[],"mappings":";;;AAsBA,6BAAwB;AAOxB,IAAY,mBAMX;AAND,WAAY,mBAAmB;IAC7B,oCAAa,CAAA;IACb,4CAAqB,CAAA;IACrB,sCAAe,CAAA;IACf,kCAAW,CAAA;IACX,8CAAuB,CAAA;AACzB,CAAC,EANW,mBAAmB,mCAAnB,mBAAmB,QAM9B;AAQD,IAAY,wBAKX;AALD,WAAY,wBAAwB;IAClC,yCAAa,CAAA;IACb,mDAAuB,CAAA;IACvB,mDAAuB,CAAA;IACvB,yCAAa,CAAA;AACf,CAAC,EALW,wBAAwB,wCAAxB,wBAAwB,QAKnC;AAWD,IAAY,yBAGX;AAHD,WAAY,yBAAyB;IACnC,wDAA2B,CAAA;IAC3B,wDAA2B,CAAA;AAC7B,CAAC,EAHW,yBAAyB,yCAAzB,yBAAyB,QAGpC;AAmBD,IAAY,wBAIX;AAJD,WAAY,wBAAwB;IAClC,2DAA+B,CAAA;IAC/B,+CAAmB,CAAA;IACnB,uCAAW,CAAA;AACb,CAAC,EAJW,wBAAwB,wCAAxB,wBAAwB,QAInC;AA+BY,QAAA,yBAAyB,GAAG,OAAC,CAAC,YAAY,CAAC;IACtD,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,IAAI,EAAE,OAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC;IACvC,QAAQ,EAAE,OAAC,CAAC,OAAO,EAAE;IACrB,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,SAAS,EAAE,OAAC,CAAC,UAAU,CAAC,wBAAwB,CAAC;CAClD,CAAC,CAAC"}

package/dist/connector/lib/provider-descriptor.d.ts

@@ -1,4 +1,5 @@
-import type { CredentialFieldSpec } from './onboarding-manifest';
+import { z } from 'zod';
+import { type CredentialFieldSpec } from './onboarding-manifest';
 export declare enum ProviderAppAuthKind {
     OAuth2 = "oauth2",
     AppInstall = "app_install",
@@ -33,5 +34,78 @@ export interface ProviderDescriptor {
     readonly oauthEndpoints?: ProviderOAuthEndpoints;
     readonly allowOrgOverride: boolean;
 }
+export declare const ProviderOAuthEndpointsSchema: z.ZodObject<{
+    authorizationUrl: z.ZodString;
+    tokenUrl: z.ZodString;
+    extraAuthorizeParams: z.ZodOptional<z.ZodReadonly<z.ZodRecord<z.ZodString, z.ZodString>>>;
+    clientIdEnvVar: z.ZodOptional<z.ZodString>;
+    clientSecretEnvVar: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export declare const ProviderDescriptorBaseSchema: z.ZodObject<{
+    providerKey: z.ZodString;
+    displayName: z.ZodString;
+    description: z.ZodString;
+    iconName: z.ZodString;
+    category: z.ZodString;
+    appAuthKind: z.ZodEnum<typeof ProviderAppAuthKind>;
+    origin: z.ZodEnum<typeof ProviderOrigin>;
+    appCredentialSchema: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        label: z.ZodString;
+        type: z.ZodEnum<typeof import("./onboarding-manifest").CredentialFieldType>;
+        required: z.ZodBoolean;
+        placeholder: z.ZodOptional<z.ZodString>;
+        hint: z.ZodOptional<z.ZodString>;
+        transform: z.ZodEnum<typeof import("./onboarding-manifest").CredentialFieldTransform>;
+    }, z.core.$strict>>>>;
+    oauthEndpoints: z.ZodOptional<z.ZodObject<{
+        authorizationUrl: z.ZodString;
+        tokenUrl: z.ZodString;
+        extraAuthorizeParams: z.ZodOptional<z.ZodReadonly<z.ZodRecord<z.ZodString, z.ZodString>>>;
+        clientIdEnvVar: z.ZodOptional<z.ZodString>;
+        clientSecretEnvVar: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    allowOrgOverride: z.ZodBoolean;
+}, z.core.$strict>;
+export declare function providerOAuthEndpointsInvariant(provider: Pick<ProviderDescriptor, 'providerKey' | 'appAuthKind'> & {
+    readonly oauthEndpoints?: unknown;
+}, ctx: z.RefinementCtx, basePath?: readonly (string | number)[]): void;
+export declare const ProviderDescriptorSchema: z.ZodObject<{
+    providerKey: z.ZodString;
+    displayName: z.ZodString;
+    description: z.ZodString;
+    iconName: z.ZodString;
+    category: z.ZodString;
+    appAuthKind: z.ZodEnum<typeof ProviderAppAuthKind>;
+    origin: z.ZodEnum<typeof ProviderOrigin>;
+    appCredentialSchema: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        label: z.ZodString;
+        type: z.ZodEnum<typeof import("./onboarding-manifest").CredentialFieldType>;
+        required: z.ZodBoolean;
+        placeholder: z.ZodOptional<z.ZodString>;
+        hint: z.ZodOptional<z.ZodString>;
+        transform: z.ZodEnum<typeof import("./onboarding-manifest").CredentialFieldTransform>;
+    }, z.core.$strict>>>>;
+    oauthEndpoints: z.ZodOptional<z.ZodObject<{
+        authorizationUrl: z.ZodString;
+        tokenUrl: z.ZodString;
+        extraAuthorizeParams: z.ZodOptional<z.ZodReadonly<z.ZodRecord<z.ZodString, z.ZodString>>>;
+        clientIdEnvVar: z.ZodOptional<z.ZodString>;
+        clientSecretEnvVar: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    allowOrgOverride: z.ZodBoolean;
+}, z.core.$strict>;
+type AssertExtends<T extends U, U> = T;
+type AllowUndefinedOptionals<T> = T extends readonly (infer E)[] ? readonly AllowUndefinedOptionals<E>[] : T extends object ? {
+    [K in keyof T]: AllowUndefinedOptionals<T[K]> | undefined;
+} : T;
+export type ProviderDescriptorValueIdentityGuards = [
+    AssertExtends<z.infer<typeof ProviderOAuthEndpointsSchema>, AllowUndefinedOptionals<ProviderOAuthEndpoints>>,
+    AssertExtends<ProviderOAuthEndpoints, z.infer<typeof ProviderOAuthEndpointsSchema>>,
+    AssertExtends<z.infer<typeof ProviderDescriptorSchema>, AllowUndefinedOptionals<ProviderDescriptor>>,
+    AssertExtends<ProviderDescriptor, z.infer<typeof ProviderDescriptorSchema>>
+];
 export declare function providerRequiresAppCredential(provider: Pick<ProviderDescriptor, 'appAuthKind'>): boolean;
+export {};
 //# sourceMappingURL=provider-descriptor.d.ts.map

package/dist/connector/lib/provider-descriptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-descriptor.d.ts","sourceRoot":"","sources":["../../../src/connector/lib/provider-descriptor.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAQjE,oBAAY,mBAAmB;IAO7B,MAAM,WAAW;IAMjB,UAAU,gBAAgB;IAO1B,IAAI,SAAS;CACd;AAaD,oBAAY,cAAc;IACxB,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,KAAK,UAAU;CAChB;AAiBD,oBAAY,uBAAuB;IACjC,QAAQ,aAAa;IACrB,GAAG,QAAQ;CACZ;AAGD,eAAO,MAAM,+BAA+B,EAAE,SAAS,uBAAuB,EACb,CAAC;AAOlE,MAAM,WAAW,sBAAsB;IAErC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAElC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAQ1B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAQjE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAOD,MAAM,WAAW,kBAAkB;IAEjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAG1B,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC;IAE1C,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAQhC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAM9D,QAAQ,CAAC,cAAc,CAAC,EAAE,sBAAsB,CAAC;IAOjD,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACpC;AAOD,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,aAAa,CAAC,GAChD,OAAO,CAET"}
+{"version":3,"file":"provider-descriptor.d.ts","sourceRoot":"","sources":["../../../src/connector/lib/provider-descriptor.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,uBAAuB,CAAC;AAQ/B,oBAAY,mBAAmB;IAO7B,MAAM,WAAW;IAMjB,UAAU,gBAAgB;IAO1B,IAAI,SAAS;CACd;AAaD,oBAAY,cAAc;IACxB,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,KAAK,UAAU;CAChB;AAiBD,oBAAY,uBAAuB;IACjC,QAAQ,aAAa;IACrB,GAAG,QAAQ;CACZ;AAGD,eAAO,MAAM,+BAA+B,EAAE,SAAS,uBAAuB,EACb,CAAC;AAOlE,MAAM,WAAW,sBAAsB;IAErC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAElC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAQ1B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAQjE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAOD,MAAM,WAAW,kBAAkB;IAEjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAG1B,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC;IAE1C,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAQhC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAM9D,QAAQ,CAAC,cAAc,CAAC,EAAE,sBAAsB,CAAC;IAOjD,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACpC;AAOD,eAAO,MAAM,4BAA4B;;;;;;kBAMvC,CAAC;AAUH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;kBAWvC,CAAC;AASH,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,aAAa,GAAG,aAAa,CAAC,GAAG;IAClE,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACnC,EACD,GAAG,EAAE,CAAC,CAAC,aAAa,EACpB,QAAQ,GAAE,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,EAAO,GAC1C,IAAI,CAWN;AAMD,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;kBAEpC,CAAC;AAOF,KAAK,aAAa,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;AACvC,KAAK,uBAAuB,CAAC,CAAC,IAAI,CAAC,SAAS,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,GAC5D,SAAS,uBAAuB,CAAC,CAAC,CAAC,EAAE,GACrC,CAAC,SAAS,MAAM,GACd;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS;CAAE,GAC7D,CAAC,CAAC;AACR,MAAM,MAAM,qCAAqC,GAAG;IAClD,aAAa,CACX,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,EAC5C,uBAAuB,CAAC,sBAAsB,CAAC,CAChD;IACD,aAAa,CACX,sBAAsB,EACtB,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAC7C;IACD,aAAa,CACX,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,EACxC,uBAAuB,CAAC,kBAAkB,CAAC,CAC5C;IACD,aAAa,CAAC,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;CAC5E,CAAC;AAOF,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,aAAa,CAAC,GAChD,OAAO,CAET"}

package/dist/connector/lib/provider-descriptor.js

@@ -1,7 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PROVIDER_CREDENTIAL_SCOPE_ORDER = exports.ProviderCredentialScope = exports.ProviderOrigin = exports.ProviderAppAuthKind = void 0;
+exports.ProviderDescriptorSchema = exports.ProviderDescriptorBaseSchema = exports.ProviderOAuthEndpointsSchema = exports.PROVIDER_CREDENTIAL_SCOPE_ORDER = exports.ProviderCredentialScope = exports.ProviderOrigin = exports.ProviderAppAuthKind = void 0;
+exports.providerOAuthEndpointsInvariant = providerOAuthEndpointsInvariant;
 exports.providerRequiresAppCredential = providerRequiresAppCredential;
+const zod_1 = require("zod");
+const onboarding_manifest_1 = require("./onboarding-manifest");
 var ProviderAppAuthKind;
 (function (ProviderAppAuthKind) {
     ProviderAppAuthKind["OAuth2"] = "oauth2";
@@ -20,6 +23,36 @@ var ProviderCredentialScope;
     ProviderCredentialScope["Org"] = "org";
 })(ProviderCredentialScope || (exports.ProviderCredentialScope = ProviderCredentialScope = {}));
 exports.PROVIDER_CREDENTIAL_SCOPE_ORDER = [ProviderCredentialScope.Org, ProviderCredentialScope.Platform];
+exports.ProviderOAuthEndpointsSchema = zod_1.z.strictObject({
+    authorizationUrl: zod_1.z.string().url(),
+    tokenUrl: zod_1.z.string().url(),
+    extraAuthorizeParams: zod_1.z.record(zod_1.z.string(), zod_1.z.string()).readonly().optional(),
+    clientIdEnvVar: zod_1.z.string().min(1).optional(),
+    clientSecretEnvVar: zod_1.z.string().min(1).optional(),
+});
+exports.ProviderDescriptorBaseSchema = zod_1.z.strictObject({
+    providerKey: zod_1.z.string().min(1),
+    displayName: zod_1.z.string().min(1),
+    description: zod_1.z.string().min(1),
+    iconName: zod_1.z.string().min(1),
+    category: zod_1.z.string().min(1),
+    appAuthKind: zod_1.z.nativeEnum(ProviderAppAuthKind),
+    origin: zod_1.z.nativeEnum(ProviderOrigin),
+    appCredentialSchema: zod_1.z.array(onboarding_manifest_1.CredentialFieldSpecSchema).readonly().optional(),
+    oauthEndpoints: exports.ProviderOAuthEndpointsSchema.optional(),
+    allowOrgOverride: zod_1.z.boolean(),
+});
+function providerOAuthEndpointsInvariant(provider, ctx, basePath = []) {
+    if (provider.appAuthKind === ProviderAppAuthKind.OAuth2 &&
+        provider.oauthEndpoints === undefined) {
+        ctx.addIssue({
+            code: 'custom',
+            path: [...basePath, 'oauthEndpoints'],
+            message: `Provider "${provider.providerKey}" declares appAuthKind=oauth2 but has no oauthEndpoints.`,
+        });
+    }
+}
+exports.ProviderDescriptorSchema = exports.ProviderDescriptorBaseSchema.superRefine(providerOAuthEndpointsInvariant);
 function providerRequiresAppCredential(provider) {
     return provider.appAuthKind !== ProviderAppAuthKind.None;
 }

package/dist/connector/lib/provider-descriptor.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-descriptor.js","sourceRoot":"","sources":["../../../src/connector/lib/provider-descriptor.ts"],"names":[],"mappings":";;;AAgLA,sEAIC;AAlJD,IAAY,mBAqBX;AArBD,WAAY,mBAAmB;IAO7B,wCAAiB,CAAA;IAMjB,iDAA0B,CAAA;IAO1B,oCAAa,CAAA;AACf,CAAC,EArBW,mBAAmB,mCAAnB,mBAAmB,QAqB9B;AAaD,IAAY,cAIX;AAJD,WAAY,cAAc;IACxB,mCAAiB,CAAA;IACjB,uCAAqB,CAAA;IACrB,iCAAe,CAAA;AACjB,CAAC,EAJW,cAAc,8BAAd,cAAc,QAIzB;AAiBD,IAAY,uBAGX;AAHD,WAAY,uBAAuB;IACjC,gDAAqB,CAAA;IACrB,sCAAW,CAAA;AACb,CAAC,EAHW,uBAAuB,uCAAvB,uBAAuB,QAGlC;AAGY,QAAA,+BAA+B,GAC1C,CAAC,uBAAuB,CAAC,GAAG,EAAE,uBAAuB,CAAC,QAAQ,CAAC,CAAC;AAgFlE,SAAgB,6BAA6B,CAC3C,QAAiD;IAEjD,OAAO,QAAQ,CAAC,WAAW,KAAK,mBAAmB,CAAC,IAAI,CAAC;AAC3D,CAAC"}
+{"version":3,"file":"provider-descriptor.js","sourceRoot":"","sources":["../../../src/connector/lib/provider-descriptor.ts"],"names":[],"mappings":";;;AAyNA,0EAiBC;AA0CD,sEAIC;AA9PD,6BAAwB;AAExB,+DAG+B;AAQ/B,IAAY,mBAqBX;AArBD,WAAY,mBAAmB;IAO7B,wCAAiB,CAAA;IAMjB,iDAA0B,CAAA;IAO1B,oCAAa,CAAA;AACf,CAAC,EArBW,mBAAmB,mCAAnB,mBAAmB,QAqB9B;AAaD,IAAY,cAIX;AAJD,WAAY,cAAc;IACxB,mCAAiB,CAAA;IACjB,uCAAqB,CAAA;IACrB,iCAAe,CAAA;AACjB,CAAC,EAJW,cAAc,8BAAd,cAAc,QAIzB;AAiBD,IAAY,uBAGX;AAHD,WAAY,uBAAuB;IACjC,gDAAqB,CAAA;IACrB,sCAAW,CAAA;AACb,CAAC,EAHW,uBAAuB,uCAAvB,uBAAuB,QAGlC;AAGY,QAAA,+BAA+B,GAC1C,CAAC,uBAAuB,CAAC,GAAG,EAAE,uBAAuB,CAAC,QAAQ,CAAC,CAAC;AAgFrD,QAAA,4BAA4B,GAAG,OAAC,CAAC,YAAY,CAAC;IACzD,gBAAgB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAClC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC1B,oBAAoB,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5E,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5C,kBAAkB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC;AAUU,QAAA,4BAA4B,GAAG,OAAC,CAAC,YAAY,CAAC;IACzD,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,WAAW,EAAE,OAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC;IAC9C,MAAM,EAAE,OAAC,CAAC,UAAU,CAAC,cAAc,CAAC;IACpC,mBAAmB,EAAE,OAAC,CAAC,KAAK,CAAC,+CAAyB,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7E,cAAc,EAAE,oCAA4B,CAAC,QAAQ,EAAE;IACvD,gBAAgB,EAAE,OAAC,CAAC,OAAO,EAAE;CAC9B,CAAC,CAAC;AASH,SAAgB,+BAA+B,CAC7C,QAEC,EACD,GAAoB,EACpB,WAAyC,EAAE;IAE3C,IACE,QAAQ,CAAC,WAAW,KAAK,mBAAmB,CAAC,MAAM;QACnD,QAAQ,CAAC,cAAc,KAAK,SAAS,EACrC,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,GAAG,QAAQ,EAAE,gBAAgB,CAAC;YACrC,OAAO,EAAE,aAAa,QAAQ,CAAC,WAAW,0DAA0D;SACrG,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAMY,QAAA,wBAAwB,GAAG,oCAA4B,CAAC,WAAW,CAC9E,+BAA+B,CAChC,CAAC;AAkCF,SAAgB,6BAA6B,CAC3C,QAAiD;IAEjD,OAAO,QAAQ,CAAC,WAAW,KAAK,mBAAmB,CAAC,IAAI,CAAC;AAC3D,CAAC"}

package/dist/distribution/index.d.ts

@@ -1,3 +1,4 @@
+export * from './lib/install-policy';
 export * from './lib/distribution-selector';
 export * from './lib/distribution';
 export * from './lib/distribution-lock';

package/dist/distribution/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/distribution/index.ts"],"names":[],"mappings":"AAAA,cAAc,6BAA6B,CAAC;AAC5C,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/distribution/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC"}

package/dist/distribution/index.js

@@ -14,6 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./lib/install-policy"), exports);
 __exportStar(require("./lib/distribution-selector"), exports);
 __exportStar(require("./lib/distribution"), exports);
 __exportStar(require("./lib/distribution-lock"), exports);

package/dist/distribution/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/distribution/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8DAA4C;AAC5C,qDAAmC;AACnC,0DAAwC;AACxC,mDAAiC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/distribution/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAqC;AACrC,8DAA4C;AAC5C,qDAAmC;AACnC,0DAAwC;AACxC,mDAAiC"}

package/dist/distribution/lib/distribution-lock.d.ts

@@ -1,6 +1,7 @@
 import { z } from 'zod';
 import { type BiomeTier, type BiomeTarget, type BiomeOrigin, type BiomeAudience } from '../../biome';
 import { type PlatformServiceTier } from './distribution';
+import { type BiomeInstallPolicy, type BiomeLaunchMode } from './install-policy';
 export interface LockedBiome {
     id: string;
     version: string;
@@ -8,6 +9,8 @@ export interface LockedBiome {
     target: BiomeTarget;
     origin: BiomeOrigin;
     mandatory: boolean;
+    installPolicy?: BiomeInstallPolicy;
+    launch?: BiomeLaunchMode;
     repo: string;
     path: string;
     services: readonly string[];

package/dist/distribution/lib/distribution-lock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"distribution-lock.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/distribution-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAKL,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,gBAAgB,CAAC;AAQxB,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,WAAW,CAAC;IAEpB,MAAM,EAAE,WAAW,CAAC;IAEpB,SAAS,EAAE,OAAO,CAAC;IAEnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IASb,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAE5B,WAAW,CAAC,EAAE,MAAM,CAAC;IAWrB,WAAW,CAAC,EAAE,MAAM,CAAC;IAMrB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE5B,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEzC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEzC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAEzB,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAWD,eAAO,MAAM,iBAAiB,EAqBxB,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;AAU7B,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IAEb,IAAI,EAAE,mBAAmB,CAAC;CAC3B;AAED,eAAO,MAAM,2BAA2B,EAGlC,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAYvC,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,CAAC,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IAE/B,gBAAgB,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAEnD,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,sBAAsB,EAO7B,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAOlC,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,CAUpE"}
+{"version":3,"file":"distribution-lock.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/distribution-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAKL,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACrB,MAAM,kBAAkB,CAAC;AAQ1B,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,WAAW,CAAC;IAEpB,MAAM,EAAE,WAAW,CAAC;IAEpB,SAAS,EAAE,OAAO,CAAC;IAOnB,aAAa,CAAC,EAAE,kBAAkB,CAAC;IAKnC,MAAM,CAAC,EAAE,eAAe,CAAC;IAEzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IASb,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAE5B,WAAW,CAAC,EAAE,MAAM,CAAC;IAWrB,WAAW,CAAC,EAAE,MAAM,CAAC;IAMrB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE5B,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEzC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEzC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAEzB,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAWD,eAAO,MAAM,iBAAiB,EAuBxB,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;AAU7B,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IAEb,IAAI,EAAE,mBAAmB,CAAC;CAC3B;AAED,eAAO,MAAM,2BAA2B,EAGlC,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAYvC,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,CAAC,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IAE/B,gBAAgB,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAEnD,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,sBAAsB,EAO7B,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAOlC,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,CAUpE"}

package/dist/distribution/lib/distribution-lock.js

@@ -5,6 +5,7 @@ exports.parseDistributionLock = parseDistributionLock;
 const zod_1 = require("zod");
 const biome_1 = require("../../biome");
 const distribution_1 = require("./distribution");
+const install_policy_1 = require("./install-policy");
 const LockedBiomeDisplaySchema = zod_1.z
     .object({
     icon: zod_1.z.string().min(1).optional(),
@@ -20,6 +21,8 @@ exports.LockedBiomeSchema = zod_1.z.object({
     target: biome_1.BiomeTargetSchema,
     origin: biome_1.BiomeOriginSchema,
     mandatory: zod_1.z.boolean(),
+    installPolicy: install_policy_1.BiomeInstallPolicySchema.optional(),
+    launch: install_policy_1.BiomeLaunchModeSchema.optional(),
     repo: zod_1.z.string().min(1),
     path: zod_1.z.string().min(1),
     services: zod_1.z.array(zod_1.z.string().min(1)).readonly(),

package/dist/distribution/lib/distribution-lock.js.map

@@ -1 +1 @@
-{"version":3,"file":"distribution-lock.js","sourceRoot":"","sources":["../../../src/distribution/lib/distribution-lock.ts"],"names":[],"mappings":";;;AA4KA,sDAUC;AAtLD,6BAAwB;AACxB,uCASqB;AACrB,iDAGwB;AAuExB,MAAM,wBAAwB,GAAG,OAAC;KAC/B,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrC,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,MAAM,EAAmC,CAAC;AAEhC,QAAA,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,uBAAe;IACrB,MAAM,EAAE,yBAAiB;IACzB,MAAM,EAAE,yBAAiB;IACzB,SAAS,EAAE,OAAC,CAAC,OAAO,EAAE;IACtB,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,QAAQ,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEzC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACpD,oBAAoB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtE,oBAAoB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtE,QAAQ,EAAE,2BAAmB,CAAC,QAAQ,EAAE;IACxC,WAAW,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACnC,aAAa,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrC,kBAAkB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,OAAO,EAAE,wBAAwB,CAAC,QAAQ,EAAE;CAC7C,CAA2B,CAAC;AAgBhB,QAAA,2BAA2B,GAAG,OAAC,CAAC,MAAM,CAAC;IAClD,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,wCAAyB;CAChC,CAAqC,CAAC;AAwB1B,QAAA,sBAAsB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC7C,aAAa,EAAE,OAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,yBAAiB,CAAC,CAAC,QAAQ,EAAE;IAC7C,gBAAgB,EAAE,OAAC,CAAC,KAAK,CAAC,mCAA2B,CAAC,CAAC,QAAQ,EAAE;IACjE,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAgC,CAAC;AAOlC,SAAgB,qBAAqB,CAAC,GAAY;IAChD,MAAM,MAAM,GAAG,8BAAsB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,CAAC,KAAK,CAAC,MAAM;aACnD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aAChD,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}
+{"version":3,"file":"distribution-lock.js","sourceRoot":"","sources":["../../../src/distribution/lib/distribution-lock.ts"],"names":[],"mappings":";;;AAgMA,sDAUC;AA1MD,6BAAwB;AACxB,uCASqB;AACrB,iDAGwB;AACxB,qDAK0B;AAmF1B,MAAM,wBAAwB,GAAG,OAAC;KAC/B,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrC,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,MAAM,EAAmC,CAAC;AAEhC,QAAA,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,uBAAe;IACrB,MAAM,EAAE,yBAAiB;IACzB,MAAM,EAAE,yBAAiB;IACzB,SAAS,EAAE,OAAC,CAAC,OAAO,EAAE;IACtB,aAAa,EAAE,yCAAwB,CAAC,QAAQ,EAAE;IAClD,MAAM,EAAE,sCAAqB,CAAC,QAAQ,EAAE;IACxC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,QAAQ,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEzC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACpD,oBAAoB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtE,oBAAoB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtE,QAAQ,EAAE,2BAAmB,CAAC,QAAQ,EAAE;IACxC,WAAW,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACnC,aAAa,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrC,kBAAkB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,OAAO,EAAE,wBAAwB,CAAC,QAAQ,EAAE;CAC7C,CAA2B,CAAC;AAgBhB,QAAA,2BAA2B,GAAG,OAAC,CAAC,MAAM,CAAC;IAClD,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,wCAAyB;CAChC,CAAqC,CAAC;AAwB1B,QAAA,sBAAsB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC7C,aAAa,EAAE,OAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,yBAAiB,CAAC,CAAC,QAAQ,EAAE;IAC7C,gBAAgB,EAAE,OAAC,CAAC,KAAK,CAAC,mCAA2B,CAAC,CAAC,QAAQ,EAAE;IACjE,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAgC,CAAC;AAOlC,SAAgB,qBAAqB,CAAC,GAAY;IAChD,MAAM,MAAM,GAAG,8BAAsB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,CAAC,KAAK,CAAC,MAAM;aACnD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aAChD,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}

package/dist/distribution/lib/distribution-selector.d.ts

@@ -1,14 +1,17 @@
 import { z } from 'zod';
 import { type BiomeTier, type BiomeOrigin } from '../../biome';
+import { type BiomeInstallPolicy } from './install-policy';
 export type DistributionSelector = {
     tier: BiomeTier;
     mandatory?: boolean;
+    installPolicy?: BiomeInstallPolicy;
 } | {
     origin: BiomeOrigin;
 } | {
     biome: string;
     version?: string;
     mandatory?: boolean;
+    installPolicy?: BiomeInstallPolicy;
 };
 export declare const DistributionSelectorSchema: z.ZodType<DistributionSelector>;
 //# sourceMappingURL=distribution-selector.d.ts.map

package/dist/distribution/lib/distribution-selector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"distribution-selector.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/distribution-selector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,WAAW,EACjB,MAAM,aAAa,CAAC;AAyBrB,MAAM,MAAM,oBAAoB,GAC5B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,GACxC;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAE7D,eAAO,MAAM,0BAA0B,EAUjC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC"}
+{"version":3,"file":"distribution-selector.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/distribution-selector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,WAAW,EACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,kBAAkB,CAAC;AAkC1B,MAAM,MAAM,oBAAoB,GAC5B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,aAAa,CAAC,EAAE,kBAAkB,CAAA;CAAE,GAC5E;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IACE,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,kBAAkB,CAAC;CACpC,CAAC;AAEN,eAAO,MAAM,0BAA0B,EAiBjC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC"}

package/dist/distribution/lib/distribution-selector.js

@@ -3,14 +3,22 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DistributionSelectorSchema = void 0;
 const zod_1 = require("zod");
 const biome_1 = require("../../biome");
+const install_policy_1 = require("./install-policy");
 exports.DistributionSelectorSchema = zod_1.z.union([
-    zod_1.z.object({ tier: biome_1.BiomeTierSchema, mandatory: zod_1.z.boolean().optional() }).strict(),
+    zod_1.z
+        .object({
+        tier: biome_1.BiomeTierSchema,
+        mandatory: zod_1.z.boolean().optional(),
+        installPolicy: install_policy_1.BiomeInstallPolicySchema.optional(),
+    })
+        .strict(),
     zod_1.z.object({ origin: biome_1.BiomeOriginSchema }).strict(),
     zod_1.z
         .object({
         biome: zod_1.z.string().min(1),
         version: zod_1.z.string().min(1).optional(),
         mandatory: zod_1.z.boolean().optional(),
+        installPolicy: install_policy_1.BiomeInstallPolicySchema.optional(),
     })
         .strict(),
 ]);

package/dist/distribution/lib/distribution-selector.js.map

@@ -1 +1 @@
-{"version":3,"file":"distribution-selector.js","sourceRoot":"","sources":["../../../src/distribution/lib/distribution-selector.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AACxB,uCAKqB;AA8BR,QAAA,0BAA0B,GAAG,OAAC,CAAC,KAAK,CAAC;IAChD,OAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,uBAAe,EAAE,SAAS,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/E,OAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,yBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChD,OAAC;SACE,MAAM,CAAC;QACN,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACxB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACrC,SAAS,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAClC,CAAC;SACD,MAAM,EAAE;CACZ,CAAoC,CAAC"}
+{"version":3,"file":"distribution-selector.js","sourceRoot":"","sources":["../../../src/distribution/lib/distribution-selector.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AACxB,uCAKqB;AACrB,qDAG0B;AA4Cb,QAAA,0BAA0B,GAAG,OAAC,CAAC,KAAK,CAAC;IAChD,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,uBAAe;QACrB,SAAS,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACjC,aAAa,EAAE,yCAAwB,CAAC,QAAQ,EAAE;KACnD,CAAC;SACD,MAAM,EAAE;IACX,OAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,yBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChD,OAAC;SACE,MAAM,CAAC;QACN,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACxB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACrC,SAAS,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACjC,aAAa,EAAE,yCAAwB,CAAC,QAAQ,EAAE;KACnD,CAAC;SACD,MAAM,EAAE;CACZ,CAAoC,CAAC"}

package/dist/distribution/lib/distribution.d.ts

@@ -3,6 +3,7 @@ import { type BiomeOrigin, type BiomeTier } from '../../biome';
 import { type DistributionSelector } from './distribution-selector';
 export type PlatformServiceTier = BiomeTier | 'edge';
 export declare const PlatformServiceTierSchema: z.ZodType<PlatformServiceTier>;
+export declare const PLATFORM_SERVICE_TIER_RANK: Readonly<Record<PlatformServiceTier | 'infra', number>>;
 export type DistributionSchemaVersion = 1;
 export interface DistributionTrustPolicy {
     allow: readonly BiomeOrigin[];

package/dist/distribution/lib/distribution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"distribution.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/distribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,SAAS,EACf,MAAM,aAAa,CAAC;AACrB,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,yBAAyB,CAAC;AASjC,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,MAAM,CAAC;AAErD,eAAO,MAAM,yBAAyB,EAGhC,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAOrC,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAQ1C,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;CAC/B;AAED,eAAO,MAAM,6BAA6B,EAEpC,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;AAUzC,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,MAAM,CAAC;IAEb,IAAI,EAAE,mBAAmB,CAAC;CAC3B;AAED,eAAO,MAAM,iCAAiC,EAGxC,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;AAiB7C,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,yBAAyB,CAAC;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAEzC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,WAAW,CAAC,EAAE,uBAAuB,CAAC;IAMtC,gBAAgB,CAAC,EAAE,SAAS,2BAA2B,EAAE,CAAC;CAC3D;AAED,eAAO,MAAM,kBAAkB,EAUzB,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;AAM9B,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,YAAY,CAU5D"}
+{"version":3,"file":"distribution.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/distribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,SAAS,EACf,MAAM,aAAa,CAAC;AACrB,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,yBAAyB,CAAC;AASjC,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,MAAM,CAAC;AAErD,eAAO,MAAM,yBAAyB,EAGhC,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAUrC,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAC/C,MAAM,CAAC,mBAAmB,GAAG,OAAO,EAAE,MAAM,CAAC,CAQ9C,CAAC;AAOF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAQ1C,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;CAC/B;AAED,eAAO,MAAM,6BAA6B,EAEpC,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;AAUzC,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,MAAM,CAAC;IAEb,IAAI,EAAE,mBAAmB,CAAC;CAC3B;AAED,eAAO,MAAM,iCAAiC,EAGxC,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;AAiB7C,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,yBAAyB,CAAC;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAEzC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,WAAW,CAAC,EAAE,uBAAuB,CAAC;IAMtC,gBAAgB,CAAC,EAAE,SAAS,2BAA2B,EAAE,CAAC;CAC3D;AAED,eAAO,MAAM,kBAAkB,EAUzB,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;AAM9B,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,YAAY,CAU5D"}

package/dist/distribution/lib/distribution.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DistributionSchema = exports.DistributionPlatformServiceSchema = exports.DistributionTrustPolicySchema = exports.PlatformServiceTierSchema = void 0;
+exports.DistributionSchema = exports.DistributionPlatformServiceSchema = exports.DistributionTrustPolicySchema = exports.PLATFORM_SERVICE_TIER_RANK = exports.PlatformServiceTierSchema = void 0;
 exports.parseDistribution = parseDistribution;
 const zod_1 = require("zod");
 const biome_1 = require("../../biome");
@@ -9,6 +9,14 @@ exports.PlatformServiceTierSchema = zod_1.z.union([
     biome_1.BiomeTierSchema,
     zod_1.z.literal('edge'),
 ]);
+exports.PLATFORM_SERVICE_TIER_RANK = {
+    infra: -1,
+    kernel: 0,
+    system: 1,
+    base: 2,
+    platform: 3,
+    edge: 4,
+};
 exports.DistributionTrustPolicySchema = zod_1.z.object({
     allow: zod_1.z.array(biome_1.BiomeOriginSchema).readonly(),
 });

package/dist/distribution/lib/distribution.js.map

@@ -1 +1 @@
-{"version":3,"file":"distribution.js","sourceRoot":"","sources":["../../../src/distribution/lib/distribution.ts"],"names":[],"mappings":";;;AAoHA,8CAUC;AA9HD,6BAAwB;AACxB,uCAKqB;AACrB,mEAGiC;AAWpB,QAAA,yBAAyB,GAAG,OAAC,CAAC,KAAK,CAAC;IAC/C,uBAAe;IACf,OAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CAClB,CAAmC,CAAC;AAmBxB,QAAA,6BAA6B,GAAG,OAAC,CAAC,MAAM,CAAC;IACpD,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,yBAAiB,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAuC,CAAC;AAgB5B,QAAA,iCAAiC,GAAG,OAAC,CAAC,MAAM,CAAC;IACxD,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,iCAAyB;CAChC,CAA2C,CAAC;AAoChC,QAAA,kBAAkB,GAAG,OAAC,CAAC,MAAM,CAAC;IACzC,aAAa,EAAE,OAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrC,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,kDAA0B,CAAC,CAAC,QAAQ,EAAE;IACvD,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACzD,WAAW,EAAE,qCAA6B,CAAC,QAAQ,EAAE;IACrD,gBAAgB,EAAE,OAAC,CAAC,KAAK,CAAC,yCAAiC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACnF,CAA4B,CAAC;AAM9B,SAAgB,iBAAiB,CAAC,GAAY;IAC5C,MAAM,MAAM,GAAG,0BAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,CAAC,KAAK,CAAC,MAAM;aACnD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aAChD,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}
+{"version":3,"file":"distribution.js","sourceRoot":"","sources":["../../../src/distribution/lib/distribution.ts"],"names":[],"mappings":";;;AAuIA,8CAUC;AAjJD,6BAAwB;AACxB,uCAKqB;AACrB,mEAGiC;AAWpB,QAAA,yBAAyB,GAAG,OAAC,CAAC,KAAK,CAAC;IAC/C,uBAAe;IACf,OAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CAClB,CAAmC,CAAC;AAUxB,QAAA,0BAA0B,GAEnC;IACF,KAAK,EAAE,CAAC,CAAC;IACT,MAAM,EAAE,CAAC;IACT,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;CACR,CAAC;AAmBW,QAAA,6BAA6B,GAAG,OAAC,CAAC,MAAM,CAAC;IACpD,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,yBAAiB,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAuC,CAAC;AAgB5B,QAAA,iCAAiC,GAAG,OAAC,CAAC,MAAM,CAAC;IACxD,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,iCAAyB;CAChC,CAA2C,CAAC;AAoChC,QAAA,kBAAkB,GAAG,OAAC,CAAC,MAAM,CAAC;IACzC,aAAa,EAAE,OAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrC,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,kDAA0B,CAAC,CAAC,QAAQ,EAAE;IACvD,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACzD,WAAW,EAAE,qCAA6B,CAAC,QAAQ,EAAE;IACrD,gBAAgB,EAAE,OAAC,CAAC,KAAK,CAAC,yCAAiC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACnF,CAA4B,CAAC;AAM9B,SAAgB,iBAAiB,CAAC,GAAY;IAC5C,MAAM,MAAM,GAAG,0BAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,CAAC,KAAK,CAAC,MAAM;aACnD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aAChD,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}

package/dist/distribution/lib/install-policy.d.ts

@@ -0,0 +1,13 @@
+import { z } from 'zod';
+export declare enum BiomeInstallPolicy {
+    Required = "required",
+    DefaultSelected = "default-selected",
+    Optional = "optional"
+}
+export declare const BiomeInstallPolicySchema: z.ZodEnum<typeof BiomeInstallPolicy>;
+export declare enum BiomeLaunchMode {
+    Static = "static",
+    PerInstallation = "per-installation"
+}
+export declare const BiomeLaunchModeSchema: z.ZodEnum<typeof BiomeLaunchMode>;
+//# sourceMappingURL=install-policy.d.ts.map

package/dist/distribution/lib/install-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-policy.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/install-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAmBxB,oBAAY,kBAAkB;IAC5B,QAAQ,aAAa;IACrB,eAAe,qBAAqB;IACpC,QAAQ,aAAa;CACtB;AAED,eAAO,MAAM,wBAAwB,sCAAmC,CAAC;AAezE,oBAAY,eAAe;IACzB,MAAM,WAAW;IACjB,eAAe,qBAAqB;CACrC;AAED,eAAO,MAAM,qBAAqB,mCAAgC,CAAC"}

package/dist/distribution/lib/install-policy.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BiomeLaunchModeSchema = exports.BiomeLaunchMode = exports.BiomeInstallPolicySchema = exports.BiomeInstallPolicy = void 0;
+const zod_1 = require("zod");
+var BiomeInstallPolicy;
+(function (BiomeInstallPolicy) {
+    BiomeInstallPolicy["Required"] = "required";
+    BiomeInstallPolicy["DefaultSelected"] = "default-selected";
+    BiomeInstallPolicy["Optional"] = "optional";
+})(BiomeInstallPolicy || (exports.BiomeInstallPolicy = BiomeInstallPolicy = {}));
+exports.BiomeInstallPolicySchema = zod_1.z.nativeEnum(BiomeInstallPolicy);
+var BiomeLaunchMode;
+(function (BiomeLaunchMode) {
+    BiomeLaunchMode["Static"] = "static";
+    BiomeLaunchMode["PerInstallation"] = "per-installation";
+})(BiomeLaunchMode || (exports.BiomeLaunchMode = BiomeLaunchMode = {}));
+exports.BiomeLaunchModeSchema = zod_1.z.nativeEnum(BiomeLaunchMode);
+//# sourceMappingURL=install-policy.js.map

package/dist/distribution/lib/install-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-policy.js","sourceRoot":"","sources":["../../../src/distribution/lib/install-policy.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAmBxB,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC5B,2CAAqB,CAAA;IACrB,0DAAoC,CAAA;IACpC,2CAAqB,CAAA;AACvB,CAAC,EAJW,kBAAkB,kCAAlB,kBAAkB,QAI7B;AAEY,QAAA,wBAAwB,GAAG,OAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;AAezE,IAAY,eAGX;AAHD,WAAY,eAAe;IACzB,oCAAiB,CAAA;IACjB,uDAAoC,CAAA;AACtC,CAAC,EAHW,eAAe,+BAAf,eAAe,QAG1B;AAEY,QAAA,qBAAqB,GAAG,OAAC,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/kernel-contracts",
-  "version": "0.23.1",
+  "version": "0.23.2",
   "description": "Consolidated Xema OS kernel wire contracts — pure types + zod schemas for the kernel protocol surfaces. One package, one npm scope, wildcard per-surface subpath exports. No framework/runtime deps.",
   "license": "Apache-2.0",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
@@ -46,6 +46,8 @@
     "format": "prettier --write \"src/**/*.ts\"",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "lint": "eslint .",
-    "check:boundary": "node scripts/check-subpath-dag.mjs"
+    "check:boundary": "node scripts/check-subpath-dag.mjs",
+    "docs:manifest-reference": "node scripts/generate-biome-manifest-reference.mjs",
+    "test": "node --test \"tests/*.spec.mjs\""
   }
 }

package/src/connector/index.ts

@@ -8,3 +8,4 @@ export * from './lib/envelope-schema';
 export * from './lib/filter-expr';
 export * from './lib/filter-expr-schema';
 export * from './lib/filter-expr-validate';
+export * from './lib/integration-provider-contribution';

package/src/connector/lib/connector-descriptor.ts

@@ -18,8 +18,11 @@
  * ─────────────────────────────────────────────────────────────────────────
  */
 
+import { z } from 'zod';
+
+import { CredentialKind } from './credential-kind';
+
 import type { AdapterKindRef } from './adapter-kind';
-import type { CredentialKind } from './credential-kind';
 
 /**
  * A connector in the catalog. `connectorKey` aligns with the persisted
@@ -65,3 +68,29 @@ export interface ConnectorDescriptor {
    */
   readonly adapterKind: AdapterKindRef;
 }
+
+/**
+ * Zod mirror of {@link ConnectorDescriptor} — value-identical to the
+ * interface. Used wherever a connector descriptor crosses a trust boundary
+ * (biome integration-provider contributions). Strict: unknown keys fail fast.
+ * `adapterKind` stays an open `AdapterKindRef` string — the runtime registry
+ * is the authority on which slugs are currently known.
+ */
+export const ConnectorDescriptorSchema = z.strictObject({
+  connectorKey: z.string().min(1),
+  displayName: z.string().min(1),
+  description: z.string().min(1),
+  iconName: z.string().min(1),
+  providerKey: z.string().min(1),
+  scopes: z.array(z.string()).readonly(),
+  connectionCredentialKind: z.nativeEnum(CredentialKind),
+  adapterKind: z.string().min(1),
+});
+
+// Compile-time value-identity guards: schema output <=> interface. The tuple
+// export exists only so `noUnusedLocals` sees a use; no contract meaning.
+type AssertExtends<T extends U, U> = T;
+export type ConnectorDescriptorValueIdentityGuards = [
+  AssertExtends<z.infer<typeof ConnectorDescriptorSchema>, ConnectorDescriptor>,
+  AssertExtends<ConnectorDescriptor, z.infer<typeof ConnectorDescriptorSchema>>,
+];

package/src/connector/lib/integration-provider-contribution.ts

@@ -0,0 +1,118 @@
+/**
+ * ─────────────────────────────────────────────────────────────────────────
+ * IntegrationProvider contribution manifest — the `integration-provider`
+ * ContributionKind's kind-specific schema (2-file kernel rule: the enum
+ * member lives in `contribution/lib/contribution-kind.ts`, the manifest
+ * schema lives here; the parser lives in biome-host, the ingesting registry
+ * in connector-gateway-api).
+ *
+ * A biome contributes a third-party connector provider as pure data: ONE
+ * {@link ProviderDescriptor} (the authenticating authority) plus its
+ * {@link ConnectorDescriptor}[] (the connectable capability surfaces). This
+ * REUSES the existing provider vocabulary — there is deliberately no second
+ * provider shape: the manifest wraps the exact descriptors the connector
+ * registry already registers for built-ins and locally-loaded biome modules
+ * (`ConnectorRegistryService.registerContributed`).
+ *
+ * Provenance is NOT declared inline (mirrors the `capability` kind): the
+ * discovering parser stamps `biome.id`/`biome.version` from the biome's
+ * `xema-biome.json`, and the provider's `origin` is server-stamped to
+ * `ProviderOrigin.Biome` — an author-supplied `origin` is a strict-schema
+ * validation error, never silently honored.
+ * ─────────────────────────────────────────────────────────────────────────
+ */
+
+import { z } from 'zod';
+
+import { ConnectorDescriptorSchema } from './connector-descriptor';
+import {
+  ProviderDescriptorBaseSchema,
+  providerOAuthEndpointsInvariant,
+} from './provider-descriptor';
+
+/**
+ * Contributed provider keys are lowercase slugs (`sap`, `hubspot`,
+ * `my-crm`) — same convention as the built-in keys (`google`, `smtp`).
+ */
+const CONTRIBUTED_PROVIDER_KEY_REGEX = /^[a-z][a-z0-9_-]*$/;
+
+/**
+ * Contributed connector keys are UPPER_SNAKE (`SAP_S4HANA`) — the same wire
+ * convention as the persisted built-in connector keys (`GMAIL`,
+ * `MICROSOFT_GRAPH`), so slug transforms (`connectorKey.toLowerCase()`)
+ * behave identically for contributed and curated connectors.
+ */
+const CONTRIBUTED_CONNECTOR_KEY_REGEX = /^[A-Z][A-Z0-9_]*$/;
+
+/**
+ * A contributed provider descriptor: {@link ProviderDescriptorBaseSchema}
+ * minus `origin`, which is server-stamped (`ProviderOrigin.Biome`) by the
+ * discovering parser — authors MUST NOT declare it.
+ */
+export const ContributedProviderDescriptorSchema =
+  ProviderDescriptorBaseSchema.omit({ origin: true });
+
+export type ContributedProviderDescriptor = z.infer<
+  typeof ContributedProviderDescriptorSchema
+>;
+
+/**
+ * The `integration-provider` contribution manifest: one provider + its
+ * connectors. Validated fail-fast at BOTH ends of the sync (biome-host's
+ * `IntegrationProviderParser` at discovery time, connector-gateway-api's
+ * sync handler at the wire) — the two ends share this ONE schema.
+ */
+export const IntegrationProviderContributionManifestSchema = z
+  .strictObject({
+    provider: ContributedProviderDescriptorSchema,
+    connectors: z.array(ConnectorDescriptorSchema).min(1).readonly(),
+  })
+  .superRefine((manifest, ctx) => {
+    providerOAuthEndpointsInvariant(manifest.provider, ctx, ['provider']);
+
+    if (!CONTRIBUTED_PROVIDER_KEY_REGEX.test(manifest.provider.providerKey)) {
+      ctx.addIssue({
+        code: 'custom',
+        path: ['provider', 'providerKey'],
+        message:
+          `providerKey "${manifest.provider.providerKey}" must be a lowercase ` +
+          `slug matching ${CONTRIBUTED_PROVIDER_KEY_REGEX.source}.`,
+      });
+    }
+
+    const seenConnectorKeys = new Set<string>();
+    manifest.connectors.forEach((connector, index) => {
+      if (!CONTRIBUTED_CONNECTOR_KEY_REGEX.test(connector.connectorKey)) {
+        ctx.addIssue({
+          code: 'custom',
+          path: ['connectors', index, 'connectorKey'],
+          message:
+            `connectorKey "${connector.connectorKey}" must be UPPER_SNAKE ` +
+            `matching ${CONTRIBUTED_CONNECTOR_KEY_REGEX.source}.`,
+        });
+      }
+      if (connector.providerKey !== manifest.provider.providerKey) {
+        ctx.addIssue({
+          code: 'custom',
+          path: ['connectors', index, 'providerKey'],
+          message:
+            `Connector "${connector.connectorKey}" references provider ` +
+            `"${connector.providerKey}" but this manifest contributes provider ` +
+            `"${manifest.provider.providerKey}" — a contribution's connectors ` +
+            `must belong to its own provider.`,
+        });
+      }
+      if (seenConnectorKeys.has(connector.connectorKey)) {
+        ctx.addIssue({
+          code: 'custom',
+          path: ['connectors', index, 'connectorKey'],
+          message: `Duplicate connectorKey "${connector.connectorKey}" in manifest.`,
+        });
+      }
+      seenConnectorKeys.add(connector.connectorKey);
+    });
+  });
+
+export type IntegrationProviderContributionManifest = z.infer<
+  typeof IntegrationProviderContributionManifestSchema
+>;

package/src/connector/lib/onboarding-manifest.ts

@@ -20,6 +20,8 @@
  * ─────────────────────────────────────────────────────────────────────────
  */
 
+import { z } from 'zod';
+
 /**
  * Closed set of credential-field input types the install wizard renders.
  * Maps 1:1 onto HTML input affordances; extending requires both a backend
@@ -105,6 +107,23 @@ export interface CredentialFieldSpec {
   readonly transform: CredentialFieldTransform;
 }
 
+/**
+ * Zod mirror of {@link CredentialFieldSpec} — value-identical to the
+ * interface above. Used to validate credential-field declarations that cross
+ * a trust boundary (biome integration-provider contribution manifests).
+ * Strict: an unknown key is a fail-fast validation error, never silently
+ * dropped.
+ */
+export const CredentialFieldSpecSchema = z.strictObject({
+  key: z.string().min(1),
+  label: z.string().min(1),
+  type: z.nativeEnum(CredentialFieldType),
+  required: z.boolean(),
+  placeholder: z.string().optional(),
+  hint: z.string().optional(),
+  transform: z.nativeEnum(CredentialFieldTransform),
+});
+
 /**
  * Provider-declared onboarding metadata returned by
  * `GET /adapters/providers`. The frontend renders the install surface

package/src/connector/lib/provider-descriptor.ts

@@ -24,7 +24,12 @@
  * ─────────────────────────────────────────────────────────────────────────
  */
 
-import type { CredentialFieldSpec } from './onboarding-manifest';
+import { z } from 'zod';
+
+import {
+  CredentialFieldSpecSchema,
+  type CredentialFieldSpec,
+} from './onboarding-manifest';
 
 /**
  * How a provider's APP-level credential authenticates. This is distinct from
@@ -169,6 +174,101 @@ export interface ProviderDescriptor {
   readonly allowOrgOverride: boolean;
 }
 
+/**
+ * Zod mirror of {@link ProviderOAuthEndpoints} — value-identical to the
+ * interface. Strict: unknown keys fail fast (a typo'd endpoint field must
+ * never be silently dropped from a contributed descriptor).
+ */
+export const ProviderOAuthEndpointsSchema = z.strictObject({
+  authorizationUrl: z.string().url(),
+  tokenUrl: z.string().url(),
+  extraAuthorizeParams: z.record(z.string(), z.string()).readonly().optional(),
+  clientIdEnvVar: z.string().min(1).optional(),
+  clientSecretEnvVar: z.string().min(1).optional(),
+});
+
+/**
+ * Unrefined strict object mirror of {@link ProviderDescriptor}. Exported so
+ * derived contribution schemas can `.omit()` server-stamped fields (`origin`)
+ * and re-attach the cross-field invariant — zod object transforms drop
+ * refinements, so the invariant lives in
+ * {@link providerOAuthEndpointsInvariant} and is re-applied per derivation.
+ * Validate full descriptors with {@link ProviderDescriptorSchema}, not this.
+ */
+export const ProviderDescriptorBaseSchema = z.strictObject({
+  providerKey: z.string().min(1),
+  displayName: z.string().min(1),
+  description: z.string().min(1),
+  iconName: z.string().min(1),
+  category: z.string().min(1),
+  appAuthKind: z.nativeEnum(ProviderAppAuthKind),
+  origin: z.nativeEnum(ProviderOrigin),
+  appCredentialSchema: z.array(CredentialFieldSpecSchema).readonly().optional(),
+  oauthEndpoints: ProviderOAuthEndpointsSchema.optional(),
+  allowOrgOverride: z.boolean(),
+});
+
+/**
+ * Cross-field invariant shared by every provider-descriptor schema variant:
+ * an `OAuth2` provider MUST carry `oauthEndpoints` (the same rule the
+ * connector registry enforces at registration time) — validated at the
+ * contribution boundary so a malformed contributed descriptor fails at
+ * ingest, not at boot.
+ */
+export function providerOAuthEndpointsInvariant(
+  provider: Pick<ProviderDescriptor, 'providerKey' | 'appAuthKind'> & {
+    readonly oauthEndpoints?: unknown;
+  },
+  ctx: z.RefinementCtx,
+  basePath: readonly (string | number)[] = [],
+): void {
+  if (
+    provider.appAuthKind === ProviderAppAuthKind.OAuth2 &&
+    provider.oauthEndpoints === undefined
+  ) {
+    ctx.addIssue({
+      code: 'custom',
+      path: [...basePath, 'oauthEndpoints'],
+      message: `Provider "${provider.providerKey}" declares appAuthKind=oauth2 but has no oauthEndpoints.`,
+    });
+  }
+}
+
+/**
+ * Zod mirror of {@link ProviderDescriptor} — value-identical to the
+ * interface, plus the `OAuth2` ⇒ `oauthEndpoints` invariant.
+ */
+export const ProviderDescriptorSchema = ProviderDescriptorBaseSchema.superRefine(
+  providerOAuthEndpointsInvariant,
+);
+
+// ── Compile-time value-identity guards (schema output <=> interface) ──────
+// `AllowUndefinedOptionals` bridges zod's `?: T | undefined` optionals to the
+// interfaces' exact optionals (`exactOptionalPropertyTypes`) — runtime shape
+// is identical. The tuple export exists only so `noUnusedLocals` sees a use;
+// it carries no contract meaning.
+type AssertExtends<T extends U, U> = T;
+type AllowUndefinedOptionals<T> = T extends readonly (infer E)[]
+  ? readonly AllowUndefinedOptionals<E>[]
+  : T extends object
+    ? { [K in keyof T]: AllowUndefinedOptionals<T[K]> | undefined }
+    : T;
+export type ProviderDescriptorValueIdentityGuards = [
+  AssertExtends<
+    z.infer<typeof ProviderOAuthEndpointsSchema>,
+    AllowUndefinedOptionals<ProviderOAuthEndpoints>
+  >,
+  AssertExtends<
+    ProviderOAuthEndpoints,
+    z.infer<typeof ProviderOAuthEndpointsSchema>
+  >,
+  AssertExtends<
+    z.infer<typeof ProviderDescriptorSchema>,
+    AllowUndefinedOptionals<ProviderDescriptor>
+  >,
+  AssertExtends<ProviderDescriptor, z.infer<typeof ProviderDescriptorSchema>>,
+];
+
 /**
  * True when a provider needs an app credential provisioned before any of its
  * connectors can be connected (i.e. anything other than `None`). Callers use

package/src/distribution/index.ts

@@ -1,3 +1,4 @@
+export * from './lib/install-policy';
 export * from './lib/distribution-selector';
 export * from './lib/distribution';
 export * from './lib/distribution-lock';

package/src/distribution/lib/distribution-lock.ts

@@ -13,6 +13,12 @@ import {
   PlatformServiceTierSchema,
   type PlatformServiceTier,
 } from './distribution';
+import {
+  BiomeInstallPolicySchema,
+  BiomeLaunchModeSchema,
+  type BiomeInstallPolicy,
+  type BiomeLaunchMode,
+} from './install-policy';
 
 /**
  * A single biome as resolved into a distribution lockfile. Version-pinned and
@@ -29,6 +35,18 @@ export interface LockedBiome {
   origin: BiomeOrigin;
   /** Whether the org may disable this biome once shipped (cannot-disable). */
   mandatory: boolean;
+  /**
+   * Package-model install policy (which biomes come up by default vs only when
+   * explicitly selected). Optional in the SCHEMA only for backward-compat with
+   * locks resolved before the package model — the resolver ALWAYS stamps it;
+   * consumers treat absence as `default-selected`.
+   */
+  installPolicy?: BiomeInstallPolicy;
+  /**
+   * Launch placement (a distribution decision, never manifest-sourced).
+   * Absent = `static` (statically launched in the roster).
+   */
+  launch?: BiomeLaunchMode;
   /** Source repo + path the biome was resolved from (provenance for the build). */
   repo: string;
   path: string;
@@ -99,6 +117,8 @@ export const LockedBiomeSchema = z.object({
   target: BiomeTargetSchema,
   origin: BiomeOriginSchema,
   mandatory: z.boolean(),
+  installPolicy: BiomeInstallPolicySchema.optional(),
+  launch: BiomeLaunchModeSchema.optional(),
   repo: z.string().min(1),
   path: z.string().min(1),
   services: z.array(z.string().min(1)).readonly(),

package/src/distribution/lib/distribution-selector.ts

@@ -5,6 +5,10 @@ import {
   type BiomeTier,
   type BiomeOrigin,
 } from '../../biome';
+import {
+  BiomeInstallPolicySchema,
+  type BiomeInstallPolicy,
+} from './install-policy';
 
 /**
  * A `DistributionSelector` declares which biomes an `include[]` entry pulls
@@ -26,22 +30,43 @@ import {
  * property a biome self-declares in its manifest — the same biome can be
  * force-on in one distribution and optional/installable in another.
  *
+ * **`installPolicy`** (on the `{ tier }` and `{ biome }` forms) stamps the
+ * package-model install policy per selector — e.g.
+ * `{ tier: "base", installPolicy: "default-selected" }` plus
+ * `{ biome: "backlog", installPolicy: "optional" }`. Resolution: kernel- and
+ * system-tier biomes are ALWAYS `required` (resolver invariant); otherwise the
+ * most specific matching selector wins (`{ biome }` beats `{ tier }`;
+ * conflicting policies at the same specificity fail-fast); no selector policy
+ * → `default-selected`. Like `mandatory`, never manifest-sourced.
+ *
  * Selector matching is resolved against the global biome index; the resolver,
  * not any consumer, applies these rules (the lockfile is the hard boundary).
  */
 export type DistributionSelector =
-  | { tier: BiomeTier; mandatory?: boolean }
+  | { tier: BiomeTier; mandatory?: boolean; installPolicy?: BiomeInstallPolicy }
   | { origin: BiomeOrigin }
-  | { biome: string; version?: string; mandatory?: boolean };
+  | {
+      biome: string;
+      version?: string;
+      mandatory?: boolean;
+      installPolicy?: BiomeInstallPolicy;
+    };
 
 export const DistributionSelectorSchema = z.union([
-  z.object({ tier: BiomeTierSchema, mandatory: z.boolean().optional() }).strict(),
+  z
+    .object({
+      tier: BiomeTierSchema,
+      mandatory: z.boolean().optional(),
+      installPolicy: BiomeInstallPolicySchema.optional(),
+    })
+    .strict(),
   z.object({ origin: BiomeOriginSchema }).strict(),
   z
     .object({
       biome: z.string().min(1),
       version: z.string().min(1).optional(),
       mandatory: z.boolean().optional(),
+      installPolicy: BiomeInstallPolicySchema.optional(),
     })
     .strict(),
 ]) as z.ZodType<DistributionSelector>;

package/src/distribution/lib/distribution.ts

@@ -24,6 +24,25 @@ export const PlatformServiceTierSchema = z.union([
   z.literal('edge'),
 ]) as z.ZodType<PlatformServiceTier>;
 
+/**
+ * Canonical boot/wave rank of every tier token — THE single vocabulary source
+ * for tier ordering across the boot graph, the CLI launcher's wave derivation,
+ * and the deploy-roster generators. Lower boots first. `infra` (-1) is the
+ * pre-wave: submodules + the external generic plane (identity, event-hub,
+ * secrets, llm-gateway, keycloak, postgres, etcd) that always boot before the
+ * Xema service mesh. Do NOT redeclare local tier-rank maps in consumers.
+ */
+export const PLATFORM_SERVICE_TIER_RANK: Readonly<
+  Record<PlatformServiceTier | 'infra', number>
+> = {
+  infra: -1,
+  kernel: 0,
+  system: 1,
+  base: 2,
+  platform: 3,
+  edge: 4,
+};
+
 /**
  * Schema-versioning seed for `xema-distribution.json`. Bumped via a coordinated
  * PR on an incompatible shape change; consumers refuse versions they do not

package/src/distribution/lib/install-policy.ts

@@ -0,0 +1,46 @@
+import { z } from 'zod';
+
+/**
+ * `BiomeInstallPolicy` — the package-model install policy a DISTRIBUTION stamps
+ * on every resolved biome (never manifest-sourced; the same biome can be
+ * `required` in one edition and `optional` in another).
+ *
+ * - `required`         — always installed AND always launched. Kernel- and
+ *                        system-tier biomes are forced to this by the resolver
+ *                        (a platform invariant, regardless of selectors).
+ * - `default-selected` — shipped and launched by default; a deployment may
+ *                        opt out.
+ * - `optional`         — shipped in the lock (catalog-visible, image built)
+ *                        but launched only when explicitly selected.
+ *
+ * Orthogonal to `LockedBiome.mandatory`, which is the org-DISABLE governance
+ * flag (may the org switch it off once shipped) — installPolicy decides what
+ * comes up by default; mandatory decides what can be turned off.
+ */
+export enum BiomeInstallPolicy {
+  Required = 'required',
+  DefaultSelected = 'default-selected',
+  Optional = 'optional',
+}
+
+export const BiomeInstallPolicySchema = z.nativeEnum(BiomeInstallPolicy);
+
+/**
+ * `BiomeLaunchMode` — WHERE/HOW a biome's services are launched. A distribution
+ * decision applied at resolve time (never manifest-sourced — the biome only
+ * declares WHAT it is).
+ *
+ * - `static`           — launched as regular services in the static roster
+ *                        (dev launcher waves + prod services.yaml). The default
+ *                        semantics when the lock field is absent.
+ * - `per-installation` — a sidecar-host template instantiated dynamically by
+ *                        biome-host-api once a biome is installed; NOT a
+ *                        statically-launched service, so static rosters must
+ *                        not boot it standalone.
+ */
+export enum BiomeLaunchMode {
+  Static = 'static',
+  PerInstallation = 'per-installation',
+}
+
+export const BiomeLaunchModeSchema = z.nativeEnum(BiomeLaunchMode);