@xemahq/kernel-contracts 0.34.0 → 0.36.0

package/dist/agent-composition/lib/agent.d.ts

@@ -36,6 +36,9 @@ export interface AgentNode extends NodeOverlayFragment, BiomeAvailabilityScoped
     readonly children: readonly AgentNode[];
     readonly limits?: AgentLimits;
 }
+export interface StandingSessionRef {
+    readonly pinKey: string;
+}
 export interface Agent {
     readonly slug: string;
     readonly version: string;
@@ -48,6 +51,7 @@ export interface Agent {
     readonly capability?: CapabilityLayer;
     readonly workspace?: AgentWorkspaceConfig;
     readonly workspaceSharing?: WorkspaceSharingPolicy;
+    readonly standingSession?: StandingSessionRef;
 }
 export interface ResolvedAgentNode extends NodeOverlayFragment, BiomeAvailabilityScoped {
     readonly kernel: Required<AgentKernelRef>;
@@ -66,5 +70,6 @@ export interface ResolvedAgent {
     readonly capability: CapabilityLayer;
     readonly workspace?: AgentWorkspaceConfig;
     readonly workspaceSharing?: WorkspaceSharingPolicy;
+    readonly standingSession?: StandingSessionRef;
 }
 //# sourceMappingURL=agent.d.ts.map

package/dist/agent-composition/lib/agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../../src/agent-composition/lib/agent.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAKxE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAOD,oBAAY,UAAU;IACpB,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,GAAG,QAAQ;IACX,OAAO,YAAY;IACnB,IAAI,SAAS;CACd;AAQD,oBAAY,cAAc;IACxB,KAAK,UAAU;IACf,SAAS,cAAc;IACvB,QAAQ,aAAa;CACtB;AAwBD,MAAM,WAAW,WAAW;IAE1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAQ3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AASD,MAAM,WAAW,SACf,SAAQ,mBAAmB,EACzB,uBAAuB;IAEzB,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAEhC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAC;IAErC,QAAQ,CAAC,KAAK,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAM9C,QAAQ,CAAC,QAAQ,EAAE,SAAS,SAAS,EAAE,CAAC;IAQxC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAKD,MAAM,WAAW,KAAK;IAEpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IAUnC,QAAQ,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC;IAEpC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAEzB,QAAQ,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC;IAStC,QAAQ,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC;IAS1C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;CACpD;AAWD,MAAM,WAAW,iBACf,SAAQ,mBAAmB,EACzB,uBAAuB;IAEzB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAC;IAErC,QAAQ,CAAC,KAAK,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAM9C,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAQhD,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAMD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAE3B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAEjC,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IAOrC,QAAQ,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC;IAO1C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;CACpD"}
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../../src/agent-composition/lib/agent.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAKxE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAOD,oBAAY,UAAU;IACpB,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,GAAG,QAAQ;IACX,OAAO,YAAY;IACnB,IAAI,SAAS;CACd;AAQD,oBAAY,cAAc;IACxB,KAAK,UAAU;IACf,SAAS,cAAc;IACvB,QAAQ,aAAa;CACtB;AAwBD,MAAM,WAAW,WAAW;IAE1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAQ3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AASD,MAAM,WAAW,SACf,SAAQ,mBAAmB,EACzB,uBAAuB;IAEzB,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAEhC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAC;IAErC,QAAQ,CAAC,KAAK,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAM9C,QAAQ,CAAC,QAAQ,EAAE,SAAS,SAAS,EAAE,CAAC;IAQxC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAgBD,MAAM,WAAW,kBAAkB;IAMjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAKD,MAAM,WAAW,KAAK;IAEpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IAUnC,QAAQ,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC;IAEpC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAEzB,QAAQ,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC;IAStC,QAAQ,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC;IAS1C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAQnD,QAAQ,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAC;CAC/C;AAWD,MAAM,WAAW,iBACf,SAAQ,mBAAmB,EACzB,uBAAuB;IAEzB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAC;IAErC,QAAQ,CAAC,KAAK,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAM9C,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAQhD,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAMD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAE3B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAEjC,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IAOrC,QAAQ,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC;IAO1C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAMnD,QAAQ,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAC;CAC/C"}

package/dist/app-runtime/index.d.ts

@@ -6,6 +6,7 @@ export * from './lib/app-client';
 export * from './lib/app-lockfile';
 export * from './lib/branding-config';
 export * from './lib/surface-kind';
+export * from './lib/app-shell-binding';
 export * from './lib/app-channel';
 export * from './lib/app-release';
 export * from './lib/app';

package/dist/app-runtime/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/app-runtime/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/app-runtime/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,WAAW,CAAC"}

package/dist/app-runtime/index.js

@@ -22,6 +22,7 @@ __exportStar(require("./lib/app-client"), exports);
 __exportStar(require("./lib/app-lockfile"), exports);
 __exportStar(require("./lib/branding-config"), exports);
 __exportStar(require("./lib/surface-kind"), exports);
+__exportStar(require("./lib/app-shell-binding"), exports);
 __exportStar(require("./lib/app-channel"), exports);
 __exportStar(require("./lib/app-release"), exports);
 __exportStar(require("./lib/app"), exports);

package/dist/app-runtime/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/app-runtime/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sDAAoC;AACpC,wDAAsC;AACtC,yDAAuC;AACvC,0DAAwC;AACxC,mDAAiC;AACjC,qDAAmC;AACnC,wDAAsC;AACtC,qDAAmC;AACnC,oDAAkC;AAClC,oDAAkC;AAClC,4CAA0B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/app-runtime/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sDAAoC;AACpC,wDAAsC;AACtC,yDAAuC;AACvC,0DAAwC;AACxC,mDAAiC;AACjC,qDAAmC;AACnC,wDAAsC;AACtC,qDAAmC;AACnC,0DAAwC;AACxC,oDAAkC;AAClC,oDAAkC;AAClC,4CAA0B"}

package/dist/app-runtime/lib/app-shell-binding.d.ts

@@ -0,0 +1,38 @@
+import { z } from 'zod';
+import { AudienceKind } from './audience-policy';
+export declare enum AppShellKind {
+    Hosted = "hosted",
+    Standalone = "standalone",
+    Embedded = "embedded",
+    Headless = "headless"
+}
+export declare const AppShellKindSchema: z.ZodEnum<typeof AppShellKind>;
+export declare enum AppHostBinding {
+    Xema = "xema",
+    CustomDomain = "custom-domain",
+    PathBased = "path-based"
+}
+export declare const AppHostBindingSchema: z.ZodEnum<typeof AppHostBinding>;
+export interface AppSurfaceDimensions {
+    readonly shell: AppShellKind;
+    readonly audience: AudienceKind;
+    readonly host: AppHostBinding;
+}
+export declare const AppSurfaceDimensionsSchema: z.ZodType<AppSurfaceDimensions>;
+export declare enum AppSurfaceConflictCode {
+    HeadlessWithChrome = "headless-with-chrome",
+    EmbeddedIsChrome = "embedded-is-chrome",
+    StandaloneNeedsOwnHost = "standalone-needs-own-host",
+    EmbeddedNeedsXemaHost = "embedded-needs-xema-host"
+}
+export interface AppSurfaceConflict {
+    readonly code: AppSurfaceConflictCode;
+    readonly message: string;
+}
+export interface AppSurfaceValidation {
+    readonly ok: boolean;
+    readonly conflicts: readonly AppSurfaceConflict[];
+}
+export declare function validateAppSurfaceCombination(dims: AppSurfaceDimensions): AppSurfaceValidation;
+export declare function isHeadlessEmbeddedContradiction(shell: AppShellKind, alsoEmbedded: boolean): boolean;
+//# sourceMappingURL=app-shell-binding.d.ts.map

package/dist/app-runtime/lib/app-shell-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-shell-binding.d.ts","sourceRoot":"","sources":["../../../src/app-runtime/lib/app-shell-binding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAyBjD,oBAAY,YAAY;IACtB,MAAM,WAAW;IACjB,UAAU,eAAe;IACzB,QAAQ,aAAa;IACrB,QAAQ,aAAa;CACtB;AAED,eAAO,MAAM,kBAAkB,gCAA6B,CAAC;AAY7D,oBAAY,cAAc;IACxB,IAAI,SAAS;IACb,YAAY,kBAAkB;IAC9B,SAAS,eAAe;CACzB;AAED,eAAO,MAAM,oBAAoB,kCAA+B,CAAC;AAGjE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;CAC/B;AAED,eAAO,MAAM,0BAA0B,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAMzB,CAAC;AAM/C,oBAAY,sBAAsB;IAChC,kBAAkB,yBAAyB;IAC3C,gBAAgB,uBAAuB;IACvC,sBAAsB,8BAA8B;IACpD,qBAAqB,6BAA6B;CACnD;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACnD;AAsBD,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,oBAAoB,GACzB,oBAAoB,CAgCtB;AASD,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,YAAY,EACnB,YAAY,EAAE,OAAO,GACpB,OAAO,CAET"}

package/dist/app-runtime/lib/app-shell-binding.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppSurfaceConflictCode = exports.AppSurfaceDimensionsSchema = exports.AppHostBindingSchema = exports.AppHostBinding = exports.AppShellKindSchema = exports.AppShellKind = void 0;
+exports.validateAppSurfaceCombination = validateAppSurfaceCombination;
+exports.isHeadlessEmbeddedContradiction = isHeadlessEmbeddedContradiction;
+const zod_1 = require("zod");
+const audience_policy_1 = require("./audience-policy");
+var AppShellKind;
+(function (AppShellKind) {
+    AppShellKind["Hosted"] = "hosted";
+    AppShellKind["Standalone"] = "standalone";
+    AppShellKind["Embedded"] = "embedded";
+    AppShellKind["Headless"] = "headless";
+})(AppShellKind || (exports.AppShellKind = AppShellKind = {}));
+exports.AppShellKindSchema = zod_1.z.nativeEnum(AppShellKind);
+var AppHostBinding;
+(function (AppHostBinding) {
+    AppHostBinding["Xema"] = "xema";
+    AppHostBinding["CustomDomain"] = "custom-domain";
+    AppHostBinding["PathBased"] = "path-based";
+})(AppHostBinding || (exports.AppHostBinding = AppHostBinding = {}));
+exports.AppHostBindingSchema = zod_1.z.nativeEnum(AppHostBinding);
+exports.AppSurfaceDimensionsSchema = zod_1.z
+    .object({
+    shell: exports.AppShellKindSchema,
+    audience: zod_1.z.nativeEnum(audience_policy_1.AudienceKind),
+    host: exports.AppHostBindingSchema,
+})
+    .strict();
+var AppSurfaceConflictCode;
+(function (AppSurfaceConflictCode) {
+    AppSurfaceConflictCode["HeadlessWithChrome"] = "headless-with-chrome";
+    AppSurfaceConflictCode["EmbeddedIsChrome"] = "embedded-is-chrome";
+    AppSurfaceConflictCode["StandaloneNeedsOwnHost"] = "standalone-needs-own-host";
+    AppSurfaceConflictCode["EmbeddedNeedsXemaHost"] = "embedded-needs-xema-host";
+})(AppSurfaceConflictCode || (exports.AppSurfaceConflictCode = AppSurfaceConflictCode = {}));
+function validateAppSurfaceCombination(dims) {
+    const conflicts = [];
+    if (dims.shell === AppShellKind.Standalone &&
+        dims.host === AppHostBinding.PathBased) {
+        conflicts.push({
+            code: AppSurfaceConflictCode.StandaloneNeedsOwnHost,
+            message: 'A standalone app has its own full-page surface and cannot be path-based on a shared host; use xema or custom-domain.',
+        });
+    }
+    if (dims.shell === AppShellKind.Embedded &&
+        dims.host !== AppHostBinding.Xema) {
+        conflicts.push({
+            code: AppSurfaceConflictCode.EmbeddedNeedsXemaHost,
+            message: "An embedded app is served into a third-party page and relies on the Xema origin's CSP/cookies; it must be xema-hosted.",
+        });
+    }
+    return { ok: conflicts.length === 0, conflicts };
+}
+function isHeadlessEmbeddedContradiction(shell, alsoEmbedded) {
+    return shell === AppShellKind.Headless && alsoEmbedded;
+}
+//# sourceMappingURL=app-shell-binding.js.map

package/dist/app-runtime/lib/app-shell-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-shell-binding.js","sourceRoot":"","sources":["../../../src/app-runtime/lib/app-shell-binding.ts"],"names":[],"mappings":";;;AA8GA,sEAkCC;AASD,0EAKC;AA9JD,6BAAwB;AAExB,uDAAiD;AAyBjD,IAAY,YAKX;AALD,WAAY,YAAY;IACtB,iCAAiB,CAAA;IACjB,yCAAyB,CAAA;IACzB,qCAAqB,CAAA;IACrB,qCAAqB,CAAA;AACvB,CAAC,EALW,YAAY,4BAAZ,YAAY,QAKvB;AAEY,QAAA,kBAAkB,GAAG,OAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AAY7D,IAAY,cAIX;AAJD,WAAY,cAAc;IACxB,+BAAa,CAAA;IACb,gDAA8B,CAAA;IAC9B,0CAAwB,CAAA;AAC1B,CAAC,EAJW,cAAc,8BAAd,cAAc,QAIzB;AAEY,QAAA,oBAAoB,GAAG,OAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AASpD,QAAA,0BAA0B,GAAoC,OAAC;KACzE,MAAM,CAAC;IACN,KAAK,EAAE,0BAAkB;IACzB,QAAQ,EAAE,OAAC,CAAC,UAAU,CAAC,8BAAY,CAAC;IACpC,IAAI,EAAE,4BAAoB;CAC3B,CAAC;KACD,MAAM,EAAqC,CAAC;AAM/C,IAAY,sBAKX;AALD,WAAY,sBAAsB;IAChC,qEAA2C,CAAA;IAC3C,iEAAuC,CAAA;IACvC,8EAAoD,CAAA;IACpD,4EAAkD,CAAA;AACpD,CAAC,EALW,sBAAsB,sCAAtB,sBAAsB,QAKjC;AAgCD,SAAgB,6BAA6B,CAC3C,IAA0B;IAE1B,MAAM,SAAS,GAAyB,EAAE,CAAC;IAQ3C,IACE,IAAI,CAAC,KAAK,KAAK,YAAY,CAAC,UAAU;QACtC,IAAI,CAAC,IAAI,KAAK,cAAc,CAAC,SAAS,EACtC,CAAC;QACD,SAAS,CAAC,IAAI,CAAC;YACb,IAAI,EAAE,sBAAsB,CAAC,sBAAsB;YACnD,OAAO,EACL,sHAAsH;SACzH,CAAC,CAAC;IACL,CAAC;IAED,IACE,IAAI,CAAC,KAAK,KAAK,YAAY,CAAC,QAAQ;QACpC,IAAI,CAAC,IAAI,KAAK,cAAc,CAAC,IAAI,EACjC,CAAC;QACD,SAAS,CAAC,IAAI,CAAC;YACb,IAAI,EAAE,sBAAsB,CAAC,qBAAqB;YAClD,OAAO,EACL,wHAAwH;SAC3H,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC;AACnD,CAAC;AASD,SAAgB,+BAA+B,CAC7C,KAAmB,EACnB,YAAqB;IAErB,OAAO,KAAK,KAAK,YAAY,CAAC,QAAQ,IAAI,YAAY,CAAC;AACzD,CAAC"}

package/dist/app-runtime/lib/branding-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"branding-config.d.ts","sourceRoot":"","sources":["../../../src/app-runtime/lib/branding-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAkCxB,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAED,eAAO,MAAM,oBAAoB,EAkB3B,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC"}
+{"version":3,"file":"branding-config.d.ts","sourceRoot":"","sources":["../../../src/app-runtime/lib/branding-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAoCxB,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAED,eAAO,MAAM,oBAAoB,EAkB3B,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC"}

package/dist/app-runtime/lib/branding-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"branding-config.js","sourceRoot":"","sources":["../../../src/app-runtime/lib/branding-config.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAaxB,MAAM,mBAAmB,GACvB,uIAAuI,CAAC;AA2B7H,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE;QAC7B,OAAO,EAAE,wDAAwD;KAClE,CAAC;IACF,OAAO,EAAE,OAAC;SACP,MAAM,EAAE;SACR,GAAG,CAAC;QACH,OAAO,EAAE,6CAA6C;KACvD,CAAC;SACD,QAAQ,EAAE;IACb,YAAY,EAAE,OAAC;SACZ,MAAM,EAAE;SACR,KAAK,CAAC,mBAAmB,EAAE;QAC1B,OAAO,EACL,6IAA6I;KAChJ,CAAC;SACD,QAAQ,EAAE;IACb,SAAS,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrE,CAA8B,CAAC"}
+{"version":3,"file":"branding-config.js","sourceRoot":"","sources":["../../../src/app-runtime/lib/branding-config.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAaxB,MAAM,mBAAmB,GACvB,uIAAuI,CAAC;AA6B7H,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE;QAC7B,OAAO,EAAE,wDAAwD;KAClE,CAAC;IACF,OAAO,EAAE,OAAC;SACP,MAAM,EAAE;SACR,GAAG,CAAC;QACH,OAAO,EAAE,6CAA6C;KACvD,CAAC;SACD,QAAQ,EAAE;IACb,YAAY,EAAE,OAAC;SACZ,MAAM,EAAE;SACR,KAAK,CAAC,mBAAmB,EAAE;QAC1B,OAAO,EACL,6IAA6I;KAChJ,CAAC;SACD,QAAQ,EAAE;IACb,SAAS,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrE,CAA8B,CAAC"}

package/dist/connector/index.d.ts

@@ -3,6 +3,7 @@ export * from './lib/connector-adapter-kind';
 export * from './lib/connector-http-request';
 export * from './lib/capability';
 export * from './lib/credential-kind';
+export * from './lib/credential-strategy-contribution';
 export * from './lib/onboarding-manifest';
 export * from './lib/provider-descriptor';
 export * from './lib/connector-descriptor';

package/dist/connector/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/connector/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,yCAAyC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/connector/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,wCAAwC,CAAC;AACvD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,yCAAyC,CAAC"}

package/dist/connector/index.js

@@ -19,6 +19,7 @@ __exportStar(require("./lib/connector-adapter-kind"), exports);
 __exportStar(require("./lib/connector-http-request"), exports);
 __exportStar(require("./lib/capability"), exports);
 __exportStar(require("./lib/credential-kind"), exports);
+__exportStar(require("./lib/credential-strategy-contribution"), exports);
 __exportStar(require("./lib/onboarding-manifest"), exports);
 __exportStar(require("./lib/provider-descriptor"), exports);
 __exportStar(require("./lib/connector-descriptor"), exports);

package/dist/connector/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/connector/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAmC;AACnC,+DAA6C;AAC7C,+DAA6C;AAC7C,mDAAiC;AACjC,wDAAsC;AACtC,4DAA0C;AAC1C,4DAA0C;AAC1C,6DAA2C;AAC3C,wDAAsC;AACtC,oDAAkC;AAClC,2DAAyC;AACzC,6DAA2C;AAC3C,0EAAwD"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/connector/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAmC;AACnC,+DAA6C;AAC7C,+DAA6C;AAC7C,mDAAiC;AACjC,wDAAsC;AACtC,yEAAuD;AACvD,4DAA0C;AAC1C,4DAA0C;AAC1C,6DAA2C;AAC3C,wDAAsC;AACtC,oDAAkC;AAClC,2DAAyC;AACzC,6DAA2C;AAC3C,0EAAwD"}

package/dist/connector/lib/connector-descriptor.d.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { type CapabilityRef } from '../../capability';
-import { CredentialKind } from './credential-kind';
+import { type CredentialKindRef } from './credential-kind';
 import { ConnectorAdapterKind } from './connector-adapter-kind';
 import { type ConnectorHttpRequestTemplate } from './connector-http-request';
 import type { AdapterKindRef } from './adapter-kind';
@@ -37,7 +37,7 @@ export interface ConnectorDescriptor {
     readonly iconName: string;
     readonly providerKey: string;
     readonly scopes: readonly string[];
-    readonly connectionCredentialKind: CredentialKind;
+    readonly connectionCredentialKind: CredentialKindRef;
     readonly adapterKind: AdapterKindRef;
     readonly operations?: readonly ConnectorOperationDescriptor[];
 }
@@ -48,7 +48,7 @@ export declare const ConnectorDescriptorSchema: z.ZodObject<{
     iconName: z.ZodString;
     providerKey: z.ZodString;
     scopes: z.ZodReadonly<z.ZodArray<z.ZodString>>;
-    connectionCredentialKind: z.ZodEnum<typeof CredentialKind>;
+    connectionCredentialKind: z.ZodString;
     adapterKind: z.ZodString;
     operations: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodObject<{
         capabilityRef: z.ZodType<CapabilityRef, unknown, z.core.$ZodTypeInternals<CapabilityRef, unknown>>;

package/dist/connector/lib/connector-descriptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connector-descriptor.d.ts","sourceRoot":"","sources":["../../../src/connector/lib/connector-descriptor.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE3E,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EACL,oBAAoB,EAErB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAkBrD,MAAM,WAAW,4BAA4B;IAO3C,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IAKtC,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC;IAQ3C,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAQnC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IASrC,QAAQ,CAAC,WAAW,CAAC,EAAE,4BAA4B,CAAC;CACrD;AAOD,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;kBA2B3C,CAAC;AASL,MAAM,WAAW,mBAAmB;IAElC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAG1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAU7B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAOnC,QAAQ,CAAC,wBAAwB,EAAE,cAAc,CAAC;IAOlD,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IAQrC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,4BAA4B,EAAE,CAAC;CAC/D;AASD,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAUpC,CAAC;AAOH,KAAK,aAAa,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;AACvC,KAAK,uBAAuB,CAAC,CAAC,IAAI,CAAC,SAAS,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,GAC5D,SAAS,uBAAuB,CAAC,CAAC,CAAC,EAAE,GACrC,CAAC,SAAS,MAAM,GACd;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS;CAAE,GAC7D,CAAC,CAAC;AACR,MAAM,MAAM,+CAA+C,GAAG;IAC5D,aAAa,CACX,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,EAClD,uBAAuB,CAAC,4BAA4B,CAAC,CACtD;IACD,aAAa,CACX,4BAA4B,EAC5B,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CACnD;CACF,CAAC;AACF,MAAM,MAAM,sCAAsC,GAAG;IACnD,aAAa,CACX,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,EACzC,uBAAuB,CAAC,mBAAmB,CAAC,CAC7C;IACD,aAAa,CAAC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;CAC9E,CAAC"}
+{"version":3,"file":"connector-descriptor.d.ts","sourceRoot":"","sources":["../../../src/connector/lib/connector-descriptor.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE3E,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,oBAAoB,EAErB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAkBrD,MAAM,WAAW,4BAA4B;IAO3C,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IAKtC,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC;IAQ3C,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAQnC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IASrC,QAAQ,CAAC,WAAW,CAAC,EAAE,4BAA4B,CAAC;CACrD;AAOD,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;kBA2B3C,CAAC;AASL,MAAM,WAAW,mBAAmB;IAElC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAG1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAU7B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAanC,QAAQ,CAAC,wBAAwB,EAAE,iBAAiB,CAAC;IAOrD,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IAQrC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,4BAA4B,EAAE,CAAC;CAC/D;AASD,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAUpC,CAAC;AAOH,KAAK,aAAa,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;AACvC,KAAK,uBAAuB,CAAC,CAAC,IAAI,CAAC,SAAS,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,GAC5D,SAAS,uBAAuB,CAAC,CAAC,CAAC,EAAE,GACrC,CAAC,SAAS,MAAM,GACd;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS;CAAE,GAC7D,CAAC,CAAC;AACR,MAAM,MAAM,+CAA+C,GAAG;IAC5D,aAAa,CACX,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,EAClD,uBAAuB,CAAC,4BAA4B,CAAC,CACtD;IACD,aAAa,CACX,4BAA4B,EAC5B,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CACnD;CACF,CAAC;AACF,MAAM,MAAM,sCAAsC,GAAG;IACnD,aAAa,CACX,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,EACzC,uBAAuB,CAAC,mBAAmB,CAAC,CAC7C;IACD,aAAa,CAAC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;CAC9E,CAAC"}

package/dist/connector/lib/connector-descriptor.js

@@ -39,7 +39,7 @@ exports.ConnectorDescriptorSchema = zod_1.z.strictObject({
     iconName: zod_1.z.string().min(1),
     providerKey: zod_1.z.string().min(1),
     scopes: zod_1.z.array(zod_1.z.string()).readonly(),
-    connectionCredentialKind: zod_1.z.nativeEnum(credential_kind_1.CredentialKind),
+    connectionCredentialKind: credential_kind_1.CredentialKindRefSchema,
     adapterKind: zod_1.z.string().min(1),
     operations: zod_1.z.array(exports.ConnectorOperationDescriptorSchema).readonly().optional(),
 });

package/dist/connector/lib/connector-descriptor.js.map

@@ -1 +1 @@
-{"version":3,"file":"connector-descriptor.js","sourceRoot":"","sources":["../../../src/connector/lib/connector-descriptor.ts"],"names":[],"mappings":";;;AAoBA,6BAAwB;AAExB,iDAA2E;AAE3E,uDAAmD;AACnD,qEAGkC;AAClC,qEAGkC;AAiErB,QAAA,kCAAkC,GAAG,OAAC;KAChD,YAAY,CAAC;IACZ,aAAa,EAAE,gCAAmB;IAClC,WAAW,EAAE,mDAA0B;IACvC,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,kBAAkB,EAAE,OAAC,CAAC,OAAO,EAAE;IAC/B,WAAW,EAAE,2DAAkC,CAAC,QAAQ,EAAE;CAC3D,CAAC;KACD,WAAW,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE;IACvB,MAAM,aAAa,GACjB,EAAE,CAAC,WAAW,KAAK,6CAAoB,CAAC,eAAe,CAAC;IAC1D,IAAI,aAAa,IAAI,EAAE,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAClD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EACL,qEAAqE;gBACrE,6CAA6C;SAChD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACnD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EAAE,sEAAsE,EAAE,CAAC,WAAW,KAAK;SACnG,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AA8DQ,QAAA,yBAAyB,GAAG,OAAC,CAAC,YAAY,CAAC;IACtD,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,wBAAwB,EAAE,OAAC,CAAC,UAAU,CAAC,gCAAc,CAAC;IACtD,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,UAAU,EAAE,OAAC,CAAC,KAAK,CAAC,0CAAkC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC9E,CAAC,CAAC"}
+{"version":3,"file":"connector-descriptor.js","sourceRoot":"","sources":["../../../src/connector/lib/connector-descriptor.ts"],"names":[],"mappings":";;;AAoBA,6BAAwB;AAExB,iDAA2E;AAE3E,uDAG2B;AAC3B,qEAGkC;AAClC,qEAGkC;AAiErB,QAAA,kCAAkC,GAAG,OAAC;KAChD,YAAY,CAAC;IACZ,aAAa,EAAE,gCAAmB;IAClC,WAAW,EAAE,mDAA0B;IACvC,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,kBAAkB,EAAE,OAAC,CAAC,OAAO,EAAE;IAC/B,WAAW,EAAE,2DAAkC,CAAC,QAAQ,EAAE;CAC3D,CAAC;KACD,WAAW,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE;IACvB,MAAM,aAAa,GACjB,EAAE,CAAC,WAAW,KAAK,6CAAoB,CAAC,eAAe,CAAC;IAC1D,IAAI,aAAa,IAAI,EAAE,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAClD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EACL,qEAAqE;gBACrE,6CAA6C;SAChD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACnD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EAAE,sEAAsE,EAAE,CAAC,WAAW,KAAK;SACnG,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAoEQ,QAAA,yBAAyB,GAAG,OAAC,CAAC,YAAY,CAAC;IACtD,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,wBAAwB,EAAE,yCAAuB;IACjD,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,UAAU,EAAE,OAAC,CAAC,KAAK,CAAC,0CAAkC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC9E,CAAC,CAAC"}

package/dist/connector/lib/credential-kind.d.ts

@@ -1,3 +1,4 @@
+import { z } from 'zod';
 export declare enum CredentialKind {
     AppInstall = "app_install",
     OAuthUser = "oauth_user",
@@ -12,6 +13,10 @@ export declare enum CredentialKind {
     SmtpAuth = "smtp_auth",
     ImapAuth = "imap_auth"
 }
+export declare const CURATED_CREDENTIAL_KINDS: readonly CredentialKind[];
+export type CredentialKindRef = string;
+export declare const CredentialKindRefSchema: z.ZodString;
+export declare function isCuratedCredentialKind(value: string): value is CredentialKind;
 export declare enum EmailTlsMode {
     Auto = "auto",
     Tls = "tls",

package/dist/connector/lib/credential-kind.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-kind.d.ts","sourceRoot":"","sources":["../../../src/connector/lib/credential-kind.ts"],"names":[],"mappings":"AAQA,oBAAY,cAAc;IAExB,UAAU,gBAAgB;IAE1B,SAAS,eAAe;IAExB,WAAW,iBAAiB;IAE5B,GAAG,QAAQ;IAEX,MAAM,YAAY;IAElB,QAAQ,cAAc;IAEtB,KAAK,UAAU;IAEf,aAAa,mBAAmB;IAEhC,OAAO,aAAa;IAKpB,aAAa,mBAAmB;IAQhC,QAAQ,cAAc;IAMtB,QAAQ,cAAc;CACvB;AAUD,oBAAY,YAAY;IACtB,IAAI,SAAS;IACb,GAAG,QAAQ;IACX,QAAQ,aAAa;IACrB,KAAK,UAAU;CAChB;AAYD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,YAAY,CAAC;IAEtB,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAOD,MAAM,MAAM,eAAe,GACvB,QAAQ,GACR,OAAO,GACP,WAAW,GACX,QAAQ,GAMR,gBAAgB,CAAC;AAErB,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,eAAe,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACjD;AAOD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ"}
+{"version":3,"file":"credential-kind.d.ts","sourceRoot":"","sources":["../../../src/connector/lib/credential-kind.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAmBxB,oBAAY,cAAc;IAExB,UAAU,gBAAgB;IAE1B,SAAS,eAAe;IAExB,WAAW,iBAAiB;IAE5B,GAAG,QAAQ;IAEX,MAAM,YAAY;IAElB,QAAQ,cAAc;IAEtB,KAAK,UAAU;IAEf,aAAa,mBAAmB;IAEhC,OAAO,aAAa;IAKpB,aAAa,mBAAmB;IAQhC,QAAQ,cAAc;IAMtB,QAAQ,cAAc;CACvB;AAOD,eAAO,MAAM,wBAAwB,EAAE,SAAS,cAAc,EAChB,CAAC;AAgB/C,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAQvC,eAAO,MAAM,uBAAuB,aAOjC,CAAC;AAGJ,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,GACZ,KAAK,IAAI,cAAc,CAEzB;AAUD,oBAAY,YAAY;IACtB,IAAI,SAAS;IACb,GAAG,QAAQ;IACX,QAAQ,aAAa;IACrB,KAAK,UAAU;CAChB;AAYD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,YAAY,CAAC;IAEtB,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAOD,MAAM,MAAM,eAAe,GACvB,QAAQ,GACR,OAAO,GACP,WAAW,GACX,QAAQ,GAMR,gBAAgB,CAAC;AAErB,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,eAAe,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACjD;AAOD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ"}

package/dist/connector/lib/credential-kind.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EmailTlsMode = exports.CredentialKind = void 0;
+exports.EmailTlsMode = exports.CredentialKindRefSchema = exports.CURATED_CREDENTIAL_KINDS = exports.CredentialKind = void 0;
+exports.isCuratedCredentialKind = isCuratedCredentialKind;
+const zod_1 = require("zod");
 var CredentialKind;
 (function (CredentialKind) {
     CredentialKind["AppInstall"] = "app_install";
@@ -16,6 +18,16 @@ var CredentialKind;
     CredentialKind["SmtpAuth"] = "smtp_auth";
     CredentialKind["ImapAuth"] = "imap_auth";
 })(CredentialKind || (exports.CredentialKind = CredentialKind = {}));
+exports.CURATED_CREDENTIAL_KINDS = Object.freeze(Object.values(CredentialKind));
+const CURATED_CREDENTIAL_KIND_VALUES = new Set(exports.CURATED_CREDENTIAL_KINDS);
+exports.CredentialKindRefSchema = zod_1.z
+    .string()
+    .min(1)
+    .max(64)
+    .regex(/^[A-Za-z][A-Za-z0-9_-]*$/, 'credential-kind ref must be a slug: an initial letter then letters/digits/_/-');
+function isCuratedCredentialKind(value) {
+    return CURATED_CREDENTIAL_KIND_VALUES.has(value);
+}
 var EmailTlsMode;
 (function (EmailTlsMode) {
     EmailTlsMode["Auto"] = "auto";

package/dist/connector/lib/credential-kind.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-kind.js","sourceRoot":"","sources":["../../../src/connector/lib/credential-kind.ts"],"names":[],"mappings":";;;AAQA,IAAY,cAsCX;AAtCD,WAAY,cAAc;IAExB,4CAA0B,CAAA;IAE1B,0CAAwB,CAAA;IAExB,8CAA4B,CAAA;IAE5B,6BAAW,CAAA;IAEX,oCAAkB,CAAA;IAElB,wCAAsB,CAAA;IAEtB,iCAAe,CAAA;IAEf,kDAAgC,CAAA;IAEhC,sCAAoB,CAAA;IAKpB,kDAAgC,CAAA;IAQhC,wCAAsB,CAAA;IAMtB,wCAAsB,CAAA;AACxB,CAAC,EAtCW,cAAc,8BAAd,cAAc,QAsCzB;AAUD,IAAY,YAKX;AALD,WAAY,YAAY;IACtB,6BAAa,CAAA;IACb,2BAAW,CAAA;IACX,qCAAqB,CAAA;IACrB,+BAAe,CAAA;AACjB,CAAC,EALW,YAAY,4BAAZ,YAAY,QAKvB"}
+{"version":3,"file":"credential-kind.js","sourceRoot":"","sources":["../../../src/connector/lib/credential-kind.ts"],"names":[],"mappings":";;;AAmGA,0DAIC;AAvGD,6BAAwB;AAmBxB,IAAY,cAsCX;AAtCD,WAAY,cAAc;IAExB,4CAA0B,CAAA;IAE1B,0CAAwB,CAAA;IAExB,8CAA4B,CAAA;IAE5B,6BAAW,CAAA;IAEX,oCAAkB,CAAA;IAElB,wCAAsB,CAAA;IAEtB,iCAAe,CAAA;IAEf,kDAAgC,CAAA;IAEhC,sCAAoB,CAAA;IAKpB,kDAAgC,CAAA;IAQhC,wCAAsB,CAAA;IAMtB,wCAAsB,CAAA;AACxB,CAAC,EAtCW,cAAc,8BAAd,cAAc,QAsCzB;AAOY,QAAA,wBAAwB,GACnC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;AAE/C,MAAM,8BAA8B,GAAwB,IAAI,GAAG,CACjE,gCAA6C,CAC9C,CAAC;AAoBW,QAAA,uBAAuB,GAAG,OAAC;KACrC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CACJ,0BAA0B,EAC1B,+EAA+E,CAChF,CAAC;AAGJ,SAAgB,uBAAuB,CACrC,KAAa;IAEb,OAAO,8BAA8B,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACnD,CAAC;AAUD,IAAY,YAKX;AALD,WAAY,YAAY;IACtB,6BAAa,CAAA;IACb,2BAAW,CAAA;IACX,qCAAqB,CAAA;IACrB,+BAAe,CAAA;AACjB,CAAC,EALW,YAAY,4BAAZ,YAAY,QAKvB"}

package/dist/connector/lib/credential-strategy-contribution.d.ts

@@ -0,0 +1,23 @@
+import { z } from 'zod';
+import { type CredentialKindRef } from './credential-kind';
+export declare enum CredentialProjectionScheme {
+    Bearer = "bearer",
+    Basic = "basic",
+    Header = "header"
+}
+export declare const CredentialProjectionSchemeSchema: z.ZodEnum<typeof CredentialProjectionScheme>;
+export interface CredentialStrategyContributionManifest {
+    readonly key: CredentialKindRef;
+    readonly displayName: string;
+    readonly scheme: CredentialProjectionScheme;
+    readonly tokenField?: string;
+    readonly usernameField?: string;
+    readonly passwordField?: string;
+    readonly headerName?: string;
+    readonly valuePrefix?: string;
+    readonly valueTemplate?: string;
+    readonly staticParams?: Readonly<Record<string, string>>;
+}
+export declare const CredentialStrategyContributionManifestSchema: z.ZodType<CredentialStrategyContributionManifest>;
+export declare function templateFieldNames(valueTemplate: string): readonly string[];
+//# sourceMappingURL=credential-strategy-contribution.d.ts.map

package/dist/connector/lib/credential-strategy-contribution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-strategy-contribution.d.ts","sourceRoot":"","sources":["../../../src/connector/lib/credential-strategy-contribution.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,mBAAmB,CAAC;AAiB3B,oBAAY,0BAA0B;IACpC,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,MAAM,WAAW;CAClB;AAED,eAAO,MAAM,gCAAgC,8CAE5C,CAAC;AA6BF,MAAM,WAAW,sCAAsC;IAMrD,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC;IAEhC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAE5C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAMhC,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC1D;AAED,eAAO,MAAM,4CAA4C,EAAE,CAAC,CAAC,OAAO,CAAC,sCAAsC,CAiFrC,CAAC;AAOvE,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAU3E"}

package/dist/connector/lib/credential-strategy-contribution.js

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CredentialStrategyContributionManifestSchema = exports.CredentialProjectionSchemeSchema = exports.CredentialProjectionScheme = void 0;
+exports.templateFieldNames = templateFieldNames;
+const zod_1 = require("zod");
+const credential_kind_1 = require("./credential-kind");
+const CREDENTIAL_STRATEGY_STRING_MAX = 200;
+const CREDENTIAL_STRATEGY_STATIC_PARAMS_MAX = 20;
+var CredentialProjectionScheme;
+(function (CredentialProjectionScheme) {
+    CredentialProjectionScheme["Bearer"] = "bearer";
+    CredentialProjectionScheme["Basic"] = "basic";
+    CredentialProjectionScheme["Header"] = "header";
+})(CredentialProjectionScheme || (exports.CredentialProjectionScheme = CredentialProjectionScheme = {}));
+exports.CredentialProjectionSchemeSchema = zod_1.z.nativeEnum(CredentialProjectionScheme);
+const VALUE_TEMPLATE_MAX = 500;
+const FieldNameSchema = zod_1.z
+    .string()
+    .min(1)
+    .max(CREDENTIAL_STRATEGY_STRING_MAX)
+    .regex(/^[A-Za-z][A-Za-z0-9_]*$/, 'field name must be an identifier-like key of the resolved credential');
+exports.CredentialStrategyContributionManifestSchema = zod_1.z
+    .object({
+    key: credential_kind_1.CredentialKindRefSchema.regex(/^[A-Z][A-Z0-9_]*$/, 'a contributed credential-strategy key must be UPPER_SNAKE (e.g. ACME_HMAC)').refine((k) => !(0, credential_kind_1.isCuratedCredentialKind)(k), {
+        message: 'a contributed credential-strategy key must not collide with a curated CredentialKind (curated always wins)',
+    }),
+    displayName: zod_1.z.string().min(1).max(CREDENTIAL_STRATEGY_STRING_MAX),
+    scheme: exports.CredentialProjectionSchemeSchema,
+    tokenField: FieldNameSchema.optional(),
+    usernameField: FieldNameSchema.optional(),
+    passwordField: FieldNameSchema.optional(),
+    headerName: zod_1.z
+        .string()
+        .min(1)
+        .max(CREDENTIAL_STRATEGY_STRING_MAX)
+        .regex(/^[A-Za-z][A-Za-z0-9-]*$/, 'headerName must be a valid HTTP header name')
+        .optional(),
+    valuePrefix: zod_1.z.string().max(CREDENTIAL_STRATEGY_STRING_MAX).optional(),
+    valueTemplate: zod_1.z.string().min(1).max(VALUE_TEMPLATE_MAX).optional(),
+    staticParams: zod_1.z
+        .record(zod_1.z.string().min(1).max(CREDENTIAL_STRATEGY_STRING_MAX), zod_1.z.string().max(CREDENTIAL_STRATEGY_STRING_MAX))
+        .refine((r) => Object.keys(r).length <= CREDENTIAL_STRATEGY_STATIC_PARAMS_MAX, `at most ${CREDENTIAL_STRATEGY_STATIC_PARAMS_MAX} static params`)
+        .optional(),
+})
+    .superRefine((m, ctx) => {
+    const requireField = (present, field, why) => {
+        if (present === undefined) {
+            ctx.addIssue({ code: 'custom', path: [field], message: why });
+        }
+    };
+    const forbidField = (present, field) => {
+        if (present !== undefined) {
+            ctx.addIssue({
+                code: 'custom',
+                path: [field],
+                message: `"${String(field)}" is not valid for scheme "${m.scheme}"`,
+            });
+        }
+    };
+    switch (m.scheme) {
+        case CredentialProjectionScheme.Bearer:
+            requireField(m.tokenField, 'tokenField', 'bearer scheme requires tokenField');
+            forbidField(m.usernameField, 'usernameField');
+            forbidField(m.passwordField, 'passwordField');
+            forbidField(m.headerName, 'headerName');
+            forbidField(m.valuePrefix, 'valuePrefix');
+            forbidField(m.valueTemplate, 'valueTemplate');
+            break;
+        case CredentialProjectionScheme.Basic:
+            requireField(m.usernameField, 'usernameField', 'basic scheme requires usernameField');
+            requireField(m.passwordField, 'passwordField', 'basic scheme requires passwordField');
+            forbidField(m.tokenField, 'tokenField');
+            forbidField(m.headerName, 'headerName');
+            forbidField(m.valuePrefix, 'valuePrefix');
+            forbidField(m.valueTemplate, 'valueTemplate');
+            break;
+        case CredentialProjectionScheme.Header:
+            requireField(m.headerName, 'headerName', 'header scheme requires headerName');
+            requireField(m.valueTemplate, 'valueTemplate', 'header scheme requires valueTemplate');
+            forbidField(m.tokenField, 'tokenField');
+            forbidField(m.usernameField, 'usernameField');
+            forbidField(m.passwordField, 'passwordField');
+            break;
+    }
+});
+function templateFieldNames(valueTemplate) {
+    const out = [];
+    const re = /\{([A-Za-z][A-Za-z0-9_]*)\}/g;
+    let match;
+    while ((match = re.exec(valueTemplate)) !== null) {
+        if (!out.includes(match[1])) {
+            out.push(match[1]);
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=credential-strategy-contribution.js.map

package/dist/connector/lib/credential-strategy-contribution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-strategy-contribution.js","sourceRoot":"","sources":["../../../src/connector/lib/credential-strategy-contribution.ts"],"names":[],"mappings":";;;AA4MA,gDAUC;AA7LD,6BAAwB;AAExB,uDAI2B;AAG3B,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAG3C,MAAM,qCAAqC,GAAG,EAAE,CAAC;AAWjD,IAAY,0BAIX;AAJD,WAAY,0BAA0B;IACpC,+CAAiB,CAAA;IACjB,6CAAe,CAAA;IACf,+CAAiB,CAAA;AACnB,CAAC,EAJW,0BAA0B,0CAA1B,0BAA0B,QAIrC;AAEY,QAAA,gCAAgC,GAAG,OAAC,CAAC,UAAU,CAC1D,0BAA0B,CAC3B,CAAC;AAOF,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAG/B,MAAM,eAAe,GAAG,OAAC;KACtB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,8BAA8B,CAAC;KACnC,KAAK,CACJ,yBAAyB,EACzB,sEAAsE,CACvE,CAAC;AA2CS,QAAA,4CAA4C,GACvD,OAAC;KACE,MAAM,CAAC;IACN,GAAG,EAAE,yCAAuB,CAAC,KAAK,CAChC,mBAAmB,EACnB,4EAA4E,CAC7E,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,yCAAuB,EAAC,CAAC,CAAC,EAAE;QAC3C,OAAO,EACL,4GAA4G;KAC/G,CAAC;IACF,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,8BAA8B,CAAC;IAClE,MAAM,EAAE,wCAAgC;IACxC,UAAU,EAAE,eAAe,CAAC,QAAQ,EAAE;IACtC,aAAa,EAAE,eAAe,CAAC,QAAQ,EAAE;IACzC,aAAa,EAAE,eAAe,CAAC,QAAQ,EAAE;IACzC,UAAU,EAAE,OAAC;SACV,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,8BAA8B,CAAC;SACnC,KAAK,CAAC,yBAAyB,EAAE,6CAA6C,CAAC;SAC/E,QAAQ,EAAE;IACb,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC,QAAQ,EAAE;IACtE,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACnE,YAAY,EAAE,OAAC;SACZ,MAAM,CACL,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,8BAA8B,CAAC,EACrD,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAC/C;SACA,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,qCAAqC,EACrE,WAAW,qCAAqC,gBAAgB,CACjE;SACA,QAAQ,EAAE;CACd,CAAC;KACD,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;IACtB,MAAM,YAAY,GAAG,CACnB,OAAgB,EAChB,KAAmD,EACnD,GAAW,EACL,EAAE;QACR,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC,CAAC;IACF,MAAM,WAAW,GAAG,CAClB,OAAgB,EAChB,KAAmD,EAC7C,EAAE;QACR,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,KAAK,CAAC;gBACb,OAAO,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC,MAAM,GAAG;aACpE,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IACF,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;QACjB,KAAK,0BAA0B,CAAC,MAAM;YACpC,YAAY,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,mCAAmC,CAAC,CAAC;YAC9E,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;YAC9C,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;YAC9C,WAAW,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YACxC,WAAW,CAAC,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YAC1C,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;YAC9C,MAAM;QACR,KAAK,0BAA0B,CAAC,KAAK;YACnC,YAAY,CAAC,CAAC,CAAC,aAAa,EAAE,eAAe,EAAE,qCAAqC,CAAC,CAAC;YACtF,YAAY,CAAC,CAAC,CAAC,aAAa,EAAE,eAAe,EAAE,qCAAqC,CAAC,CAAC;YACtF,WAAW,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YACxC,WAAW,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YACxC,WAAW,CAAC,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YAC1C,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;YAC9C,MAAM;QACR,KAAK,0BAA0B,CAAC,MAAM;YACpC,YAAY,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,mCAAmC,CAAC,CAAC;YAC9E,YAAY,CAAC,CAAC,CAAC,aAAa,EAAE,eAAe,EAAE,sCAAsC,CAAC,CAAC;YACvF,WAAW,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YACxC,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;YAC9C,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;YAC9C,MAAM;IACV,CAAC;AACH,CAAC,CAAiE,CAAC;AAOvE,SAAgB,kBAAkB,CAAC,aAAqB;IACtD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,EAAE,GAAG,8BAA8B,CAAC;IAC1C,IAAI,KAA6B,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/connector/lib/integration-provider-contribution.d.ts

@@ -61,7 +61,7 @@ export declare const IntegrationProviderContributionManifestSchema: z.ZodObject<
         iconName: z.ZodString;
         providerKey: z.ZodString;
         scopes: z.ZodReadonly<z.ZodArray<z.ZodString>>;
-        connectionCredentialKind: z.ZodEnum<typeof import("./credential-kind").CredentialKind>;
+        connectionCredentialKind: z.ZodString;
         adapterKind: z.ZodString;
         operations: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodObject<{
             capabilityRef: z.ZodType<import("../../capability").CapabilityRef, unknown, z.core.$ZodTypeInternals<import("../../capability").CapabilityRef, unknown>>;

package/dist/contribution/lib/contribution-kind.d.ts

@@ -30,7 +30,8 @@ export declare enum ContributionKind {
     Capability = "capability",
     ResourceOwnership = "resource-ownership",
     StageMachine = "stage-machine",
-    SearchType = "search-type"
+    SearchType = "search-type",
+    CredentialStrategy = "credential-strategy"
 }
 export declare const ContributionKindSchema: z.ZodEnum<typeof ContributionKind>;
 export type ContributionKindValue = `${ContributionKind}`;

package/dist/contribution/lib/contribution-kind.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contribution-kind.d.ts","sourceRoot":"","sources":["../../../src/contribution/lib/contribution-kind.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAkDxB,oBAAY,gBAAgB;IAS1B,WAAW,iBAAiB;IAO5B,OAAO,aAAa;IACpB,YAAY,kBAAkB;IAQ9B,UAAU,gBAAgB;IAK1B,YAAY,kBAAkB;IAC9B,UAAU,gBAAgB;IAC1B,WAAW,iBAAiB;IAS5B,wBAAwB,+BAA+B;IACvD,UAAU,gBAAgB;IAQ1B,YAAY,kBAAkB;IAM9B,WAAW,iBAAiB;IAW5B,cAAc,oBAAoB;IAMlC,kBAAkB,yBAAyB;IAK3C,IAAI,SAAS;IAEb,UAAU,gBAAgB;IAM1B,oBAAoB,0BAA0B;IAK9C,oBAAoB,2BAA2B;IAK/C,yBAAyB,gCAAgC;IAGzD,mBAAmB,yBAAyB;IAI5C,cAAc,oBAAoB;IAElC,eAAe,qBAAqB;IAEpC,iBAAiB,uBAAuB;IAMxC,yBAAyB,gCAAgC;IAEzD,WAAW,iBAAiB;IAI5B,UAAU,gBAAgB;IAO1B,YAAY,kBAAkB;IAM9B,cAAc,oBAAoB;IAgBlC,UAAU,eAAe;IAezB,iBAAiB,uBAAuB;IAcxC,YAAY,kBAAkB;IAkB9B,UAAU,gBAAgB;CAC3B;AAMD,eAAO,MAAM,sBAAsB,oCAAiC,CAAC;AAErE,MAAM,MAAM,qBAAqB,GAAG,GAAG,gBAAgB,EAAE,CAAC"}
+{"version":3,"file":"contribution-kind.d.ts","sourceRoot":"","sources":["../../../src/contribution/lib/contribution-kind.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAkDxB,oBAAY,gBAAgB;IAS1B,WAAW,iBAAiB;IAO5B,OAAO,aAAa;IACpB,YAAY,kBAAkB;IAQ9B,UAAU,gBAAgB;IAK1B,YAAY,kBAAkB;IAC9B,UAAU,gBAAgB;IAC1B,WAAW,iBAAiB;IAS5B,wBAAwB,+BAA+B;IACvD,UAAU,gBAAgB;IAQ1B,YAAY,kBAAkB;IAM9B,WAAW,iBAAiB;IAW5B,cAAc,oBAAoB;IAMlC,kBAAkB,yBAAyB;IAK3C,IAAI,SAAS;IAEb,UAAU,gBAAgB;IAM1B,oBAAoB,0BAA0B;IAK9C,oBAAoB,2BAA2B;IAK/C,yBAAyB,gCAAgC;IAGzD,mBAAmB,yBAAyB;IAI5C,cAAc,oBAAoB;IAElC,eAAe,qBAAqB;IAEpC,iBAAiB,uBAAuB;IAMxC,yBAAyB,gCAAgC;IAEzD,WAAW,iBAAiB;IAI5B,UAAU,gBAAgB;IAO1B,YAAY,kBAAkB;IAM9B,cAAc,oBAAoB;IAgBlC,UAAU,eAAe;IAezB,iBAAiB,uBAAuB;IAcxC,YAAY,kBAAkB;IAkB9B,UAAU,gBAAgB;IAoB1B,kBAAkB,wBAAwB;CAC3C;AAMD,eAAO,MAAM,sBAAsB,oCAAiC,CAAC;AAErE,MAAM,MAAM,qBAAqB,GAAG,GAAG,gBAAgB,EAAE,CAAC"}

package/dist/contribution/lib/contribution-kind.js

@@ -35,6 +35,7 @@ var ContributionKind;
     ContributionKind["ResourceOwnership"] = "resource-ownership";
     ContributionKind["StageMachine"] = "stage-machine";
     ContributionKind["SearchType"] = "search-type";
+    ContributionKind["CredentialStrategy"] = "credential-strategy";
 })(ContributionKind || (exports.ContributionKind = ContributionKind = {}));
 exports.ContributionKindSchema = zod_1.z.nativeEnum(ContributionKind);
 //# sourceMappingURL=contribution-kind.js.map

package/dist/contribution/lib/contribution-kind.js.map

@@ -1 +1 @@
-{"version":3,"file":"contribution-kind.js","sourceRoot":"","sources":["../../../src/contribution/lib/contribution-kind.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAkDxB,IAAY,gBAoMX;AApMD,WAAY,gBAAgB;IAS1B,gDAA4B,CAAA;IAO5B,wCAAoB,CAAA;IACpB,kDAA8B,CAAA;IAQ9B,8CAA0B,CAAA;IAK1B,kDAA8B,CAAA;IAC9B,8CAA0B,CAAA;IAC1B,gDAA4B,CAAA;IAS5B,2EAAuD,CAAA;IACvD,8CAA0B,CAAA;IAQ1B,kDAA8B,CAAA;IAM9B,gDAA4B,CAAA;IAW5B,sDAAkC,CAAA;IAMlC,+DAA2C,CAAA;IAK3C,iCAAa,CAAA;IAEb,8CAA0B,CAAA;IAM1B,kEAA8C,CAAA;IAK9C,mEAA+C,CAAA;IAK/C,6EAAyD,CAAA;IAGzD,gEAA4C,CAAA;IAI5C,sDAAkC,CAAA;IAElC,wDAAoC,CAAA;IAEpC,4DAAwC,CAAA;IAMxC,6EAAyD,CAAA;IAEzD,gDAA4B,CAAA;IAI5B,8CAA0B,CAAA;IAO1B,kDAA8B,CAAA;IAM9B,sDAAkC,CAAA;IAgBlC,6CAAyB,CAAA;IAezB,4DAAwC,CAAA;IAcxC,kDAA8B,CAAA;IAkB9B,8CAA0B,CAAA;AAC5B,CAAC,EApMW,gBAAgB,gCAAhB,gBAAgB,QAoM3B;AAMY,QAAA,sBAAsB,GAAG,OAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC"}
+{"version":3,"file":"contribution-kind.js","sourceRoot":"","sources":["../../../src/contribution/lib/contribution-kind.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAkDxB,IAAY,gBAwNX;AAxND,WAAY,gBAAgB;IAS1B,gDAA4B,CAAA;IAO5B,wCAAoB,CAAA;IACpB,kDAA8B,CAAA;IAQ9B,8CAA0B,CAAA;IAK1B,kDAA8B,CAAA;IAC9B,8CAA0B,CAAA;IAC1B,gDAA4B,CAAA;IAS5B,2EAAuD,CAAA;IACvD,8CAA0B,CAAA;IAQ1B,kDAA8B,CAAA;IAM9B,gDAA4B,CAAA;IAW5B,sDAAkC,CAAA;IAMlC,+DAA2C,CAAA;IAK3C,iCAAa,CAAA;IAEb,8CAA0B,CAAA;IAM1B,kEAA8C,CAAA;IAK9C,mEAA+C,CAAA;IAK/C,6EAAyD,CAAA;IAGzD,gEAA4C,CAAA;IAI5C,sDAAkC,CAAA;IAElC,wDAAoC,CAAA;IAEpC,4DAAwC,CAAA;IAMxC,6EAAyD,CAAA;IAEzD,gDAA4B,CAAA;IAI5B,8CAA0B,CAAA;IAO1B,kDAA8B,CAAA;IAM9B,sDAAkC,CAAA;IAgBlC,6CAAyB,CAAA;IAezB,4DAAwC,CAAA;IAcxC,kDAA8B,CAAA;IAkB9B,8CAA0B,CAAA;IAoB1B,8DAA0C,CAAA;AAC5C,CAAC,EAxNW,gBAAgB,gCAAhB,gBAAgB,QAwN3B;AAMY,QAAA,sBAAsB,GAAG,OAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/kernel-contracts",
-  "version": "0.34.0",
+  "version": "0.36.0",
   "description": "Consolidated Xema OS kernel wire contracts — pure types + zod schemas for the kernel protocol surfaces. One package, one npm scope, wildcard per-surface subpath exports. No framework/runtime deps.",
   "license": "Apache-2.0",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",

package/src/agent-composition/lib/agent.ts

@@ -130,6 +130,29 @@ export interface AgentNode
   readonly limits?: AgentLimits;
 }
 
+/**
+ * Declares that an agent/composition ALWAYS runs inside a single, reusable
+ * "standing" session keyed by {@link pinKey}, instead of minting a fresh
+ * session per launch. When present, the session layer (agent-session-api)
+ * does a get-or-create keyed by `(orgId, projectId, pinKey)` at
+ * `POST /sessions` — a non-terminal existing session for the same key is
+ * ADOPTED; otherwise a new one is minted and pinned.
+ *
+ * OPTIONAL + additive: absent ⇒ today's behaviour (a fresh session per
+ * launch). A standing session is paired with a `persistent` lifecycle so it
+ * is not idle-reaped, but it STILL participates in the resume-tier idle
+ * scale-to-zero (`soft_pause` → `warm_pod` → `cold`) — standing ≠
+ * always-warm; it rehydrates from the durable workspace on the next message.
+ */
+export interface StandingSessionRef {
+  /**
+   * Stable key identifying the standing session for a purpose/biome, e.g.
+   * `{biomeId}:{purpose}`. Two launches of the same agent within the same
+   * `(orgId, projectId)` that carry the same `pinKey` reuse ONE session row.
+   */
+  readonly pinKey: string;
+}
+
 /**
  * A named, versioned, reusable Agent.
  */
@@ -173,6 +196,14 @@ export interface Agent {
    * chat-style agents; see {@link WorkspaceSharingPolicy}.
    */
   readonly workspaceSharing?: WorkspaceSharingPolicy;
+  /**
+   * When set, this agent ALWAYS runs inside its standing (pinned) session
+   * keyed by `pinKey` — the session layer adopts a non-terminal existing
+   * session for `(orgId, projectId, pinKey)` instead of minting a new one.
+   * OPTIONAL + additive: absent ⇒ a fresh session per launch. See
+   * {@link StandingSessionRef}.
+   */
+  readonly standingSession?: StandingSessionRef;
 }
 
 /**
@@ -237,4 +268,10 @@ export interface ResolvedAgent {
    * (`isolated`), applied explicitly at the read site.
    */
   readonly workspaceSharing?: WorkspaceSharingPolicy;
+  /**
+   * Resolved standing-session pin — carried from the source `Agent` so the
+   * session layer can do its `(orgId, projectId, pinKey)` get-or-create
+   * without re-fetching the definition. Absent ⇒ a fresh session per launch.
+   */
+  readonly standingSession?: StandingSessionRef;
 }

package/src/app-runtime/index.ts

@@ -6,6 +6,7 @@ export * from './lib/app-client';
 export * from './lib/app-lockfile';
 export * from './lib/branding-config';
 export * from './lib/surface-kind';
+export * from './lib/app-shell-binding';
 export * from './lib/app-channel';
 export * from './lib/app-release';
 export * from './lib/app';

package/src/app-runtime/lib/app-shell-binding.ts

@@ -0,0 +1,159 @@
+import { z } from 'zod';
+
+import { AudienceKind } from './audience-policy';
+
+/**
+ * D14 — Shell, audience and host are THREE ORTHOGONAL dimensions of an App.
+ * A public page is not necessarily embedded; a standalone app may be anonymous
+ * or internally authenticated. This file owns two of the three closed dimensions
+ * (the third, audience, is the existing {@link AudienceKind} — D14 forbids
+ * minting a second audience enum) and the rules for which COMBINATIONS are legal.
+ *
+ * The legality rules live here, in the kernel, next to the dimensions they
+ * constrain — not scattered across each consumer. app-forge's publish path calls
+ * {@link validateAppSurfaceCombination}; it does not re-encode the rules.
+ */
+
+/**
+ * `AppShellKind` — how much host chrome / navigation / layout an App surface
+ * carries. Owns: chrome, nav, layout.
+ *
+ * - `Hosted`     — rendered inside the Xema host shell (rail, topbar, org switch).
+ * - `Standalone` — its own full-page surface, no host shell (e.g. a custom domain).
+ * - `Embedded`   — rendered inside a third-party page via an iframe/snippet.
+ * - `Headless`   — no UI at all; an API/automation surface.
+ *
+ * Values are stable wire strings — never compare against a free-form string.
+ */
+export enum AppShellKind {
+  Hosted = 'hosted',
+  Standalone = 'standalone',
+  Embedded = 'embedded',
+  Headless = 'headless',
+}
+
+export const AppShellKindSchema = z.nativeEnum(AppShellKind);
+
+/**
+ * `AppHostBinding` — where an App is served from. Owns: origin, CSP, cookies,
+ * SEO, certificates.
+ *
+ * - `Xema`         — under a Xema-owned origin/path.
+ * - `CustomDomain` — the customer's own domain (needs ACME cert issuance).
+ * - `PathBased`    — a path on a shared host, not its own origin.
+ *
+ * Values are stable wire strings.
+ */
+export enum AppHostBinding {
+  Xema = 'xema',
+  CustomDomain = 'custom-domain',
+  PathBased = 'path-based',
+}
+
+export const AppHostBindingSchema = z.nativeEnum(AppHostBinding);
+
+/** The three-dimension surface descriptor an App declares. */
+export interface AppSurfaceDimensions {
+  readonly shell: AppShellKind;
+  readonly audience: AudienceKind;
+  readonly host: AppHostBinding;
+}
+
+export const AppSurfaceDimensionsSchema: z.ZodType<AppSurfaceDimensions> = z
+  .object({
+    shell: AppShellKindSchema,
+    audience: z.nativeEnum(AudienceKind),
+    host: AppHostBindingSchema,
+  })
+  .strict() as z.ZodType<AppSurfaceDimensions>;
+
+/**
+ * A single reason a `(shell, audience, host)` combination is illegal. `code` is a
+ * closed set so consumers can branch on it; `message` is human-facing.
+ */
+export enum AppSurfaceConflictCode {
+  HeadlessWithChrome = 'headless-with-chrome',
+  EmbeddedIsChrome = 'embedded-is-chrome',
+  StandaloneNeedsOwnHost = 'standalone-needs-own-host',
+  EmbeddedNeedsXemaHost = 'embedded-needs-xema-host',
+}
+
+export interface AppSurfaceConflict {
+  readonly code: AppSurfaceConflictCode;
+  readonly message: string;
+}
+
+export interface AppSurfaceValidation {
+  readonly ok: boolean;
+  readonly conflicts: readonly AppSurfaceConflict[];
+}
+
+/**
+ * Validate a `(shell, audience, host)` combination against D14's legality rules.
+ * PURE and total — returns every conflict, never throws. The empty-conflict case
+ * is `ok: true`.
+ *
+ * Rules (each with a reason, so the publish screen can explain it):
+ * - `Headless` is a NO-UI surface, so it cannot also be `Embedded` (which is a UI
+ *   shell). `headless` + `embedded` is the canonical contradiction the plan names.
+ * - `Embedded` IS a chrome mode; it is meaningful only for a UI shell, so an
+ *   `Embedded` + `Headless` pairing is caught by the same rule from the other side.
+ * - `Standalone` (its own full-page surface) implies its own origin — it cannot be
+ *   `PathBased` (a path on a shared host). `custom-domain` or `xema` are fine.
+ * - `Embedded` is served to a third-party page and relies on the Xema origin's
+ *   CSP/cookies, so it must be `Xema`-hosted, not a `CustomDomain`/`PathBased`.
+ *
+ * `public-anon` + `custom-domain` is explicitly LEGAL (a public citizen portal on
+ * the customer's own domain) — there is no rule against it, so it returns `ok`.
+ * Audience does not currently gate shell/host on its own; the dimension is passed
+ * so the rules can grow without a signature change.
+ */
+export function validateAppSurfaceCombination(
+  dims: AppSurfaceDimensions,
+): AppSurfaceValidation {
+  const conflicts: AppSurfaceConflict[] = [];
+
+  // The headless+embedded contradiction cannot be expressed as a SINGLE
+  // AppShellKind value (they are distinct enum members), so a surface with one
+  // declared shell is internally consistent on that axis. A consumer that models
+  // "embedded" as a separate flag alongside the shell must use
+  // isHeadlessEmbeddedContradiction() to reject the pair — documented there.
+
+  if (
+    dims.shell === AppShellKind.Standalone &&
+    dims.host === AppHostBinding.PathBased
+  ) {
+    conflicts.push({
+      code: AppSurfaceConflictCode.StandaloneNeedsOwnHost,
+      message:
+        'A standalone app has its own full-page surface and cannot be path-based on a shared host; use xema or custom-domain.',
+    });
+  }
+
+  if (
+    dims.shell === AppShellKind.Embedded &&
+    dims.host !== AppHostBinding.Xema
+  ) {
+    conflicts.push({
+      code: AppSurfaceConflictCode.EmbeddedNeedsXemaHost,
+      message:
+        "An embedded app is served into a third-party page and relies on the Xema origin's CSP/cookies; it must be xema-hosted.",
+    });
+  }
+
+  return { ok: conflicts.length === 0, conflicts };
+}
+
+/**
+ * The `headless` + `embedded` contradiction the plan names explicitly. Because
+ * `AppShellKind` is a single value, a surface cannot BE both at once — but a
+ * consumer that models shell as a SET, or that derives "embedded" from a separate
+ * `embed` flag alongside a `headless` shell, must reject the pair. This helper
+ * makes that cross-field rule reusable and named, so no consumer re-encodes it.
+ */
+export function isHeadlessEmbeddedContradiction(
+  shell: AppShellKind,
+  alsoEmbedded: boolean,
+): boolean {
+  return shell === AppShellKind.Headless && alsoEmbedded;
+}

package/src/app-runtime/lib/branding-config.ts

@@ -24,13 +24,15 @@ const PRIMARY_COLOR_REGEX =
  * - `cssTokens` is the escape hatch for richer theming — keys are intended to
  *   map to CSS custom-property names (without the leading `--`).
  *
- * STATUS (2026-07-10): this is a VALIDATED CONTRACT ONLY. Nothing applies it at
- * runtime yet — `logoUrl` and `primaryColor` never reach the DOM, and there is
- * no host CSS pipeline reading `cssTokens`. An earlier version of this docstring
- * claimed the public ingress themes the audience-facing UI with it; that reader
- * does not exist. The runtime branding applier (a theming provider writing CSS
- * custom properties, resolved per-sub-tenant from `AppRoleBinding.tenantId`) is
- * Wave 8.4 — do not assume a value set here has any visual effect until then.
+ * STATUS (2026-07-13): the runtime applier SHIPPED (Wave 8.4). `@xemahq/ui-kernel`'s
+ * `AppBrandingProvider` writes `primaryColor` → `--app-primary-color` and each
+ * `cssTokens` entry → a `--<key>` CSS custom property on its OWN subtree wrapper
+ * (never `documentElement` — no leak into host chrome), sanitising unsafe CSS /
+ * non-http(s) logo URLs; it is wired into the app-forge `ExternalAppPage` /
+ * `AppRuntimePage`. The remaining gap is upstream of this contract: the external/
+ * public app-definition response DTO surfaces only `displayName`, so `logoUrl` /
+ * `primaryColor` / `cssTokens` (and the per-`AppRoleBinding.tenantId` override)
+ * must still be threaded onto that wire before the applier can render them.
  */
 export interface BrandingConfig {
   displayName: string;

package/src/app-runtime/lib/delegated-session.ts

@@ -13,7 +13,7 @@ import {
  * for an `ExternalSubject` audience:
  *
  * ```
- * sub          = external-subject:<externalId>  (or anon:<random>)
+ * sub          = external-subject:<externalId>     (or anon:<random>)
  * act          = app:<appClientId>
  * org          = <orgId>
  * project      = <projectId>

package/src/connector/index.ts

@@ -3,6 +3,7 @@ export * from './lib/connector-adapter-kind';
 export * from './lib/connector-http-request';
 export * from './lib/capability';
 export * from './lib/credential-kind';
+export * from './lib/credential-strategy-contribution';
 export * from './lib/onboarding-manifest';
 export * from './lib/provider-descriptor';
 export * from './lib/connector-descriptor';

package/src/connector/lib/connector-descriptor.ts

@@ -22,7 +22,10 @@ import { z } from 'zod';
 
 import { CapabilityRefSchema, type CapabilityRef } from '../../capability';
 
-import { CredentialKind } from './credential-kind';
+import {
+  CredentialKindRefSchema,
+  type CredentialKindRef,
+} from './credential-kind';
 import {
   ConnectorAdapterKind,
   ConnectorAdapterKindSchema,
@@ -158,8 +161,14 @@ export interface ConnectorDescriptor {
    * How an individual connection to THIS connector authenticates at runtime
    * (the per-connection wallet/token). `oauth_user` for OAuth connectors,
    * `imap_auth` / `smtp_auth` for the mail wallets, `pat` / `api_key`, …
+   *
+   * OPEN registry-backed key ({@link CredentialKindRef}): a curated
+   * {@link CredentialKind} value OR a biome-contributed strategy key. The
+   * kernel constrains the shape only; the connector-gateway credential-strategy
+   * registry decides validity (curated OR registered contributed), fail-fast on
+   * an unknown key — mirroring how `OrgIntegration.provider` was opened.
    */
-  readonly connectionCredentialKind: CredentialKind;
+  readonly connectionCredentialKind: CredentialKindRef;
 
   /**
    * The adapter category this connector plugs into (`mail`, `scm`, …). Drives
@@ -191,7 +200,7 @@ export const ConnectorDescriptorSchema = z.strictObject({
   iconName: z.string().min(1),
   providerKey: z.string().min(1),
   scopes: z.array(z.string()).readonly(),
-  connectionCredentialKind: z.nativeEnum(CredentialKind),
+  connectionCredentialKind: CredentialKindRefSchema,
   adapterKind: z.string().min(1),
   operations: z.array(ConnectorOperationDescriptorSchema).readonly().optional(),
 });

package/src/connector/lib/credential-kind.ts

@@ -1,10 +1,21 @@
+import { z } from 'zod';
+
 /**
- * Closed enum of credential strategies the platform knows how to mint,
- * cache, refresh and revoke. Biomes contributing new providers MUST
- * declare one of these — they never ship custom mint code.
+ * The CURATED credential strategies the platform ships built-in. This enum is
+ * the closed vocabulary of first-party mint strategies (pure field-projection
+ * plus the two delegated kinds `app_install` / `iam_role`).
+ *
+ * It is NO LONGER the whole universe of credential kinds. As of the
+ * credential-strategy contribution seam, a biome may CONTRIBUTE an additional
+ * DECLARATIVE strategy under its own open key ({@link CredentialKindRef}),
+ * registered at runtime — exactly the way `OrgIntegration.provider` was opened
+ * from the closed `ConnectorKind` enum to an open registry-backed key. The
+ * curated values below always WIN a key collision; a contributed strategy that
+ * names a curated value is rejected at the registry seam.
  *
- * Adding a kind here is a one-line schema change plus a matching
- * strategy implementation for that kind.
+ * Adding a CURATED kind here is a one-line schema change plus a matching
+ * built-in strategy implementation. Adding a THIRD-PARTY kind needs no kernel
+ * change — it flows through `ContributionKind.CredentialStrategy`.
  */
 export enum CredentialKind {
   /** GitHub App / GitLab App style installation token (per-installation, 1h). */
@@ -46,6 +57,52 @@ export enum CredentialKind {
   ImapAuth = 'imap_auth',
 }
 
+/**
+ * Every curated `CredentialKind` wire value, frozen. The single source of truth
+ * for "is this a first-party built-in kind?" used by {@link isCuratedCredentialKind}
+ * and by the connector-gateway registry seam (curated always wins a collision).
+ */
+export const CURATED_CREDENTIAL_KINDS: readonly CredentialKind[] =
+  Object.freeze(Object.values(CredentialKind));
+
+const CURATED_CREDENTIAL_KIND_VALUES: ReadonlySet<string> = new Set(
+  CURATED_CREDENTIAL_KINDS as readonly string[],
+);
+
+/**
+ * An OPEN credential-kind key carried on `ConnectorDescriptor
+ * .connectionCredentialKind` and on the credential resolve wire. It is EITHER a
+ * curated {@link CredentialKind} wire value (`oauth_user`, `api_key`, …) OR a
+ * biome-contributed strategy key (UPPER_SNAKE, e.g. `ACME_HMAC`). The kernel
+ * intentionally does NOT close this set — validity is enforced at the runtime
+ * seam by the connector-gateway credential-strategy registry (curated OR
+ * registered contributed), exactly like `OrgIntegration.provider`. The kernel
+ * only constrains the SHAPE (a non-empty slug), never the membership.
+ */
+export type CredentialKindRef = string;
+
+/**
+ * Shape validator for a {@link CredentialKindRef}. Permissive enough for BOTH
+ * the curated lowercase_snake values AND contributed UPPER_SNAKE / kebab keys;
+ * membership (known vs unknown) is a runtime-registry decision, never a kernel
+ * one. Bounded so persisted rows and envelopes stay small.
+ */
+export const CredentialKindRefSchema = z
+  .string()
+  .min(1)
+  .max(64)
+  .regex(
+    /^[A-Za-z][A-Za-z0-9_-]*$/,
+    'credential-kind ref must be a slug: an initial letter then letters/digits/_/-',
+  );
+
+/** Whether `value` is one of the CURATED (first-party built-in) credential kinds. */
+export function isCuratedCredentialKind(
+  value: string,
+): value is CredentialKind {
+  return CURATED_CREDENTIAL_KIND_VALUES.has(value);
+}
+
 /**
  * Closed TLS-mode enum shared by SMTP + IMAP wallets. `auto` lets the
  * client library pick the right mode for the configured port:

package/src/connector/lib/credential-strategy-contribution.ts

@@ -0,0 +1,215 @@
+/**
+ * ─────────────────────────────────────────────────────────────────────────
+ * Credential-strategy contribution — the DECLARATIVE tier
+ *
+ * A biome that ships a connector needing an auth scheme the platform does not
+ * have built-in (a custom API-key header, an unusual basic-auth field naming, a
+ * templated bearer value) contributes a `ContributionKind.CredentialStrategy`
+ * envelope carrying THIS manifest. It is pure DATA: a projection of the fields
+ * already resolved from custody into an outbound token — NO executable code.
+ *
+ * This is the answer to "the credential plane must fit ANY connector" WITHOUT
+ * closing `CredentialKind` to 12 values. The contributed strategy registers
+ * under its own open key ({@link CredentialKindRef}); the connector-gateway
+ * credential resolver builds a runtime `CredentialStrategy` from the projection
+ * and mints exactly as a built-in would. Novel MINT LOGIC that cannot be
+ * expressed as a projection (custom signing, multi-step token exchange) is the
+ * SEPARATE code-bearing tier and is NOT expressible here — by design.
+ *
+ * Provenance (`biome.id`, `biome.version`) is NOT a field here — the parser and
+ * the receiving service stamp it from the discovering biome's manifest.
+ * Validation is fail-fast: a contribution that violates any constraint is
+ * rejected at boot. No silent coercion.
+ * ─────────────────────────────────────────────────────────────────────────
+ */
+
+import { z } from 'zod';
+
+import {
+  CredentialKindRefSchema,
+  isCuratedCredentialKind,
+  type CredentialKindRef,
+} from './credential-kind';
+
+/** Bound on the display name + template + header strings, keeping envelopes small. */
+const CREDENTIAL_STRATEGY_STRING_MAX = 200;
+
+/** Hard cap on the number of static providerHints a strategy may declare. */
+const CREDENTIAL_STRATEGY_STATIC_PARAMS_MAX = 20;
+
+/**
+ * The declarative projection SCHEME a contributed strategy uses — a closed set,
+ * each mapping 1:1 onto an existing `MintedTokenType`. A biome that needs a
+ * scheme NOT in this set needs the code-bearing tier, not a wider enum.
+ *
+ *   - `bearer`  → `Authorization: Bearer <field>`         (MintedTokenType `bearer`)
+ *   - `basic`   → `Authorization: Basic base64(user:pass)` (MintedTokenType `basic`)
+ *   - `header`  → `<headerName>: <valuePrefix><templated>` (MintedTokenType `header`)
+ */
+export enum CredentialProjectionScheme {
+  Bearer = 'bearer',
+  Basic = 'basic',
+  Header = 'header',
+}
+
+export const CredentialProjectionSchemeSchema = z.nativeEnum(
+  CredentialProjectionScheme,
+);
+
+/**
+ * A `{placeholder}` template referencing decrypted credential fields, e.g.
+ * `"{apiKey}"` or `"v1:{keyId}:{secret}"`. Every `{name}` MUST resolve to a
+ * present string field on the resolved credential at mint time (fail-fast).
+ */
+const VALUE_TEMPLATE_MAX = 500;
+
+/** Field-name shape shared by every `*Field` selector (a decrypted-blob key). */
+const FieldNameSchema = z
+  .string()
+  .min(1)
+  .max(CREDENTIAL_STRATEGY_STRING_MAX)
+  .regex(
+    /^[A-Za-z][A-Za-z0-9_]*$/,
+    'field name must be an identifier-like key of the resolved credential',
+  );
+
+/**
+ * Manifest shape carried by every `ContributionKind.CredentialStrategy`
+ * envelope. One contribution = one declarative credential strategy.
+ *
+ * Mirrors `CapabilityContributionManifest` / `SearchTypeContributionManifest`:
+ * a value-identical subset of the wire body the owning service
+ * (`connector-gateway-api`) accepts, validated fail-fast at biome-discovery
+ * time. Cross-field validation binds the scheme-specific selectors so a
+ * malformed projection can never reach the registry.
+ */
+export interface CredentialStrategyContributionManifest {
+  /**
+   * The OPEN credential-kind key this strategy mints under (UPPER_SNAKE, e.g.
+   * `ACME_HMAC`). MUST NOT be a curated {@link CredentialKind} value — curated
+   * always wins, so a contributed strategy may never shadow one.
+   */
+  readonly key: CredentialKindRef;
+  /** Human-readable strategy name for catalog/admin surfaces. */
+  readonly displayName: string;
+  /** Which projection scheme mints the outbound token. */
+  readonly scheme: CredentialProjectionScheme;
+  /** `bearer` — the decrypted field carrying the raw bearer token. */
+  readonly tokenField?: string;
+  /** `basic` — the decrypted field carrying the username. */
+  readonly usernameField?: string;
+  /** `basic` — the decrypted field carrying the password/secret. */
+  readonly passwordField?: string;
+  /** `header` — the outbound header name (e.g. `X-Api-Key`). */
+  readonly headerName?: string;
+  /** `header` — optional static prefix prepended to the templated value (e.g. `"Token "`). */
+  readonly valuePrefix?: string;
+  /** `header` — `{field}` template producing the header value from decrypted fields. */
+  readonly valueTemplate?: string;
+  /**
+   * Optional static, NON-SECRET routing hints merged verbatim into the minted
+   * token's `providerHints` (regional endpoint, app id, …). Never a secret —
+   * secrets flow only through the projected fields.
+   */
+  readonly staticParams?: Readonly<Record<string, string>>;
+}
+
+export const CredentialStrategyContributionManifestSchema: z.ZodType<CredentialStrategyContributionManifest> =
+  z
+    .object({
+      key: CredentialKindRefSchema.regex(
+        /^[A-Z][A-Z0-9_]*$/,
+        'a contributed credential-strategy key must be UPPER_SNAKE (e.g. ACME_HMAC)',
+      ).refine((k) => !isCuratedCredentialKind(k), {
+        message:
+          'a contributed credential-strategy key must not collide with a curated CredentialKind (curated always wins)',
+      }),
+      displayName: z.string().min(1).max(CREDENTIAL_STRATEGY_STRING_MAX),
+      scheme: CredentialProjectionSchemeSchema,
+      tokenField: FieldNameSchema.optional(),
+      usernameField: FieldNameSchema.optional(),
+      passwordField: FieldNameSchema.optional(),
+      headerName: z
+        .string()
+        .min(1)
+        .max(CREDENTIAL_STRATEGY_STRING_MAX)
+        .regex(/^[A-Za-z][A-Za-z0-9-]*$/, 'headerName must be a valid HTTP header name')
+        .optional(),
+      valuePrefix: z.string().max(CREDENTIAL_STRATEGY_STRING_MAX).optional(),
+      valueTemplate: z.string().min(1).max(VALUE_TEMPLATE_MAX).optional(),
+      staticParams: z
+        .record(
+          z.string().min(1).max(CREDENTIAL_STRATEGY_STRING_MAX),
+          z.string().max(CREDENTIAL_STRATEGY_STRING_MAX),
+        )
+        .refine(
+          (r) => Object.keys(r).length <= CREDENTIAL_STRATEGY_STATIC_PARAMS_MAX,
+          `at most ${CREDENTIAL_STRATEGY_STATIC_PARAMS_MAX} static params`,
+        )
+        .optional(),
+    })
+    .superRefine((m, ctx) => {
+      const requireField = (
+        present: unknown,
+        field: keyof CredentialStrategyContributionManifest,
+        why: string,
+      ): void => {
+        if (present === undefined) {
+          ctx.addIssue({ code: 'custom', path: [field], message: why });
+        }
+      };
+      const forbidField = (
+        present: unknown,
+        field: keyof CredentialStrategyContributionManifest,
+      ): void => {
+        if (present !== undefined) {
+          ctx.addIssue({
+            code: 'custom',
+            path: [field],
+            message: `"${String(field)}" is not valid for scheme "${m.scheme}"`,
+          });
+        }
+      };
+      switch (m.scheme) {
+        case CredentialProjectionScheme.Bearer:
+          requireField(m.tokenField, 'tokenField', 'bearer scheme requires tokenField');
+          forbidField(m.usernameField, 'usernameField');
+          forbidField(m.passwordField, 'passwordField');
+          forbidField(m.headerName, 'headerName');
+          forbidField(m.valuePrefix, 'valuePrefix');
+          forbidField(m.valueTemplate, 'valueTemplate');
+          break;
+        case CredentialProjectionScheme.Basic:
+          requireField(m.usernameField, 'usernameField', 'basic scheme requires usernameField');
+          requireField(m.passwordField, 'passwordField', 'basic scheme requires passwordField');
+          forbidField(m.tokenField, 'tokenField');
+          forbidField(m.headerName, 'headerName');
+          forbidField(m.valuePrefix, 'valuePrefix');
+          forbidField(m.valueTemplate, 'valueTemplate');
+          break;
+        case CredentialProjectionScheme.Header:
+          requireField(m.headerName, 'headerName', 'header scheme requires headerName');
+          requireField(m.valueTemplate, 'valueTemplate', 'header scheme requires valueTemplate');
+          forbidField(m.tokenField, 'tokenField');
+          forbidField(m.usernameField, 'usernameField');
+          forbidField(m.passwordField, 'passwordField');
+          break;
+      }
+    }) as unknown as z.ZodType<CredentialStrategyContributionManifest>;
+
+/**
+ * Extract the ordered set of `{field}` placeholders a header `valueTemplate`
+ * references. Centralized so the manifest, the runtime builder, and any
+ * validator agree on the exact tokens that must resolve.
+ */
+export function templateFieldNames(valueTemplate: string): readonly string[] {
+  const out: string[] = [];
+  const re = /\{([A-Za-z][A-Za-z0-9_]*)\}/g;
+  let match: RegExpExecArray | null;
+  while ((match = re.exec(valueTemplate)) !== null) {
+    if (!out.includes(match[1]!)) {
+      out.push(match[1]!);
+    }
+  }
+  return out;
+}

package/src/contribution/lib/contribution-kind.ts

@@ -244,6 +244,26 @@ export enum ContributionKind {
    * document INSTANCES are event-fed (runtime, via `IndexableDocument`).
    */
   SearchType = 'search-type',
+
+  // -- Credential-strategy self-registration ---------------------------------
+  /**
+   * A DECLARATIVE credential-mint strategy contributed by a connector biome —
+   * the open credential-kind key it registers, the projection SCHEME
+   * (`bearer` / `basic` / `header`), and the field/template selectors that map
+   * a custody-resolved credential into an outbound token. The kernel owns this
+   * enum member AND the manifest schema
+   * (`CredentialStrategyContributionManifestSchema`, exported from
+   * `@xemahq/kernel-contracts/connector`), mirroring the `Capability` /
+   * `SearchType` kinds: a single value-identical wire shape both the
+   * contribution-file parser (`credential-strategy.parser.ts` in
+   * `biome-host-api`) and the owning service (`connector-gateway-api`) validate
+   * fail-fast. Provenance (`biome.id/version`) is stamped by the parser — never
+   * declared inline. This OPENS `CredentialKind` from a closed 12-value enum to
+   * a registry-backed key (curated always wins a collision), the same way
+   * `OrgIntegration.provider` was opened. NOVEL mint code (custom signing,
+   * token exchange) is the separate code-bearing tier — NOT expressible here.
+   */
+  CredentialStrategy = 'credential-strategy',
 }
 
 /**