@xemahq/kernel-contracts 0.35.0 → 0.37.0

package/dist/agent-composition/lib/agent-workspace-sharing.d.ts

@@ -1,6 +1,7 @@
 export declare enum WorkspaceSharingPolicy {
     Isolated = "isolated",
-    Shareable = "shareable"
+    Shareable = "shareable",
+    Shared = "shared"
 }
 export declare const WORKSPACE_SHARING_DEFAULT: WorkspaceSharingPolicy;
 //# sourceMappingURL=agent-workspace-sharing.d.ts.map

package/dist/agent-composition/lib/agent-workspace-sharing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-workspace-sharing.d.ts","sourceRoot":"","sources":["../../../src/agent-composition/lib/agent-workspace-sharing.ts"],"names":[],"mappings":"AAoBA,oBAAY,sBAAsB;IAMhC,QAAQ,aAAa;IAOrB,SAAS,cAAc;CACxB;AAOD,eAAO,MAAM,yBAAyB,EAAE,sBACP,CAAC"}
+{"version":3,"file":"agent-workspace-sharing.d.ts","sourceRoot":"","sources":["../../../src/agent-composition/lib/agent-workspace-sharing.ts"],"names":[],"mappings":"AAoBA,oBAAY,sBAAsB;IAMhC,QAAQ,aAAa;IAOrB,SAAS,cAAc;IAavB,MAAM,WAAW;CAClB;AAOD,eAAO,MAAM,yBAAyB,EAAE,sBACP,CAAC"}

package/dist/agent-composition/lib/agent-workspace-sharing.js

@@ -5,6 +5,7 @@ var WorkspaceSharingPolicy;
 (function (WorkspaceSharingPolicy) {
     WorkspaceSharingPolicy["Isolated"] = "isolated";
     WorkspaceSharingPolicy["Shareable"] = "shareable";
+    WorkspaceSharingPolicy["Shared"] = "shared";
 })(WorkspaceSharingPolicy || (exports.WorkspaceSharingPolicy = WorkspaceSharingPolicy = {}));
 exports.WORKSPACE_SHARING_DEFAULT = WorkspaceSharingPolicy.Isolated;
 //# sourceMappingURL=agent-workspace-sharing.js.map

package/dist/agent-composition/lib/agent-workspace-sharing.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-workspace-sharing.js","sourceRoot":"","sources":["../../../src/agent-composition/lib/agent-workspace-sharing.ts"],"names":[],"mappings":";;;AAoBA,IAAY,sBAcX;AAdD,WAAY,sBAAsB;IAMhC,+CAAqB,CAAA;IAOrB,iDAAuB,CAAA;AACzB,CAAC,EAdW,sBAAsB,sCAAtB,sBAAsB,QAcjC;AAOY,QAAA,yBAAyB,GACpC,sBAAsB,CAAC,QAAQ,CAAC"}
+{"version":3,"file":"agent-workspace-sharing.js","sourceRoot":"","sources":["../../../src/agent-composition/lib/agent-workspace-sharing.ts"],"names":[],"mappings":";;;AAoBA,IAAY,sBA2BX;AA3BD,WAAY,sBAAsB;IAMhC,+CAAqB,CAAA;IAOrB,iDAAuB,CAAA;IAavB,2CAAiB,CAAA;AACnB,CAAC,EA3BW,sBAAsB,sCAAtB,sBAAsB,QA2BjC;AAOY,QAAA,yBAAyB,GACpC,sBAAsB,CAAC,QAAQ,CAAC"}

package/dist/agent-composition/lib/agent.d.ts

@@ -36,6 +36,13 @@ export interface AgentNode extends NodeOverlayFragment, BiomeAvailabilityScoped
     readonly children: readonly AgentNode[];
     readonly limits?: AgentLimits;
 }
+export interface StandingSessionRef {
+    readonly pinKey: string;
+}
+export type WorkspaceRef = string;
+export interface DurableWorkspaceRef {
+    readonly workspaceRef: WorkspaceRef;
+}
 export interface Agent {
     readonly slug: string;
     readonly version: string;
@@ -48,6 +55,8 @@ export interface Agent {
     readonly capability?: CapabilityLayer;
     readonly workspace?: AgentWorkspaceConfig;
     readonly workspaceSharing?: WorkspaceSharingPolicy;
+    readonly standingSession?: StandingSessionRef;
+    readonly durableWorkspace?: DurableWorkspaceRef;
 }
 export interface ResolvedAgentNode extends NodeOverlayFragment, BiomeAvailabilityScoped {
     readonly kernel: Required<AgentKernelRef>;
@@ -66,5 +75,7 @@ export interface ResolvedAgent {
     readonly capability: CapabilityLayer;
     readonly workspace?: AgentWorkspaceConfig;
     readonly workspaceSharing?: WorkspaceSharingPolicy;
+    readonly standingSession?: StandingSessionRef;
+    readonly durableWorkspace?: DurableWorkspaceRef;
 }
 //# sourceMappingURL=agent.d.ts.map

package/dist/agent-composition/lib/agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../../src/agent-composition/lib/agent.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAKxE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAOD,oBAAY,UAAU;IACpB,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,GAAG,QAAQ;IACX,OAAO,YAAY;IACnB,IAAI,SAAS;CACd;AAQD,oBAAY,cAAc;IACxB,KAAK,UAAU;IACf,SAAS,cAAc;IACvB,QAAQ,aAAa;CACtB;AAwBD,MAAM,WAAW,WAAW;IAE1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAQ3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AASD,MAAM,WAAW,SACf,SAAQ,mBAAmB,EACzB,uBAAuB;IAEzB,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAEhC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAC;IAErC,QAAQ,CAAC,KAAK,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAM9C,QAAQ,CAAC,QAAQ,EAAE,SAAS,SAAS,EAAE,CAAC;IAQxC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAKD,MAAM,WAAW,KAAK;IAEpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IAUnC,QAAQ,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC;IAEpC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAEzB,QAAQ,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC;IAStC,QAAQ,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC;IAS1C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;CACpD;AAWD,MAAM,WAAW,iBACf,SAAQ,mBAAmB,EACzB,uBAAuB;IAEzB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAC;IAErC,QAAQ,CAAC,KAAK,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAM9C,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAQhD,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAMD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAE3B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAEjC,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IAOrC,QAAQ,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC;IAO1C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;CACpD"}
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../../src/agent-composition/lib/agent.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAKxE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAOD,oBAAY,UAAU;IACpB,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,GAAG,QAAQ;IACX,OAAO,YAAY;IACnB,IAAI,SAAS;CACd;AAQD,oBAAY,cAAc;IACxB,KAAK,UAAU;IACf,SAAS,cAAc;IACvB,QAAQ,aAAa;CACtB;AAwBD,MAAM,WAAW,WAAW;IAE1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAQ3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AASD,MAAM,WAAW,SACf,SAAQ,mBAAmB,EACzB,uBAAuB;IAEzB,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAEhC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAC;IAErC,QAAQ,CAAC,KAAK,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAM9C,QAAQ,CAAC,QAAQ,EAAE,SAAS,SAAS,EAAE,CAAC;IAQxC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAgBD,MAAM,WAAW,kBAAkB;IAMjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAcD,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAclC,MAAM,WAAW,mBAAmB;IAOlC,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;CACrC;AAKD,MAAM,WAAW,KAAK;IAEpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IAUnC,QAAQ,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC;IAEpC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAEzB,QAAQ,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC;IAStC,QAAQ,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC;IAS1C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAQnD,QAAQ,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAC;IAQ9C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;CACjD;AAWD,MAAM,WAAW,iBACf,SAAQ,mBAAmB,EACzB,uBAAuB;IAEzB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAC;IAErC,QAAQ,CAAC,KAAK,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAM9C,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAQhD,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAMD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAE3B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAEjC,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IAOrC,QAAQ,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC;IAO1C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAMnD,QAAQ,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAC;IAO9C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;CACjD"}

package/dist/app-runtime/lib/branding-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"branding-config.d.ts","sourceRoot":"","sources":["../../../src/app-runtime/lib/branding-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAkCxB,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAED,eAAO,MAAM,oBAAoB,EAkB3B,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC"}
+{"version":3,"file":"branding-config.d.ts","sourceRoot":"","sources":["../../../src/app-runtime/lib/branding-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAoCxB,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAED,eAAO,MAAM,oBAAoB,EAkB3B,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC"}

package/dist/app-runtime/lib/branding-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"branding-config.js","sourceRoot":"","sources":["../../../src/app-runtime/lib/branding-config.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAaxB,MAAM,mBAAmB,GACvB,uIAAuI,CAAC;AA2B7H,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE;QAC7B,OAAO,EAAE,wDAAwD;KAClE,CAAC;IACF,OAAO,EAAE,OAAC;SACP,MAAM,EAAE;SACR,GAAG,CAAC;QACH,OAAO,EAAE,6CAA6C;KACvD,CAAC;SACD,QAAQ,EAAE;IACb,YAAY,EAAE,OAAC;SACZ,MAAM,EAAE;SACR,KAAK,CAAC,mBAAmB,EAAE;QAC1B,OAAO,EACL,6IAA6I;KAChJ,CAAC;SACD,QAAQ,EAAE;IACb,SAAS,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrE,CAA8B,CAAC"}
+{"version":3,"file":"branding-config.js","sourceRoot":"","sources":["../../../src/app-runtime/lib/branding-config.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAaxB,MAAM,mBAAmB,GACvB,uIAAuI,CAAC;AA6B7H,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE;QAC7B,OAAO,EAAE,wDAAwD;KAClE,CAAC;IACF,OAAO,EAAE,OAAC;SACP,MAAM,EAAE;SACR,GAAG,CAAC;QACH,OAAO,EAAE,6CAA6C;KACvD,CAAC;SACD,QAAQ,EAAE;IACb,YAAY,EAAE,OAAC;SACZ,MAAM,EAAE;SACR,KAAK,CAAC,mBAAmB,EAAE;QAC1B,OAAO,EACL,6IAA6I;KAChJ,CAAC;SACD,QAAQ,EAAE;IACb,SAAS,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrE,CAA8B,CAAC"}

package/dist/connector/index.d.ts

@@ -3,8 +3,10 @@ export * from './lib/connector-adapter-kind';
 export * from './lib/connector-http-request';
 export * from './lib/capability';
 export * from './lib/credential-kind';
+export * from './lib/credential-strategy-contribution';
 export * from './lib/onboarding-manifest';
 export * from './lib/provider-descriptor';
+export * from './lib/oauth-endpoints';
 export * from './lib/connector-descriptor';
 export * from './lib/envelope-schema';
 export * from './lib/filter-expr';

package/dist/connector/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/connector/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,yCAAyC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/connector/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,wCAAwC,CAAC;AACvD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,yCAAyC,CAAC"}

package/dist/connector/index.js

@@ -19,8 +19,10 @@ __exportStar(require("./lib/connector-adapter-kind"), exports);
 __exportStar(require("./lib/connector-http-request"), exports);
 __exportStar(require("./lib/capability"), exports);
 __exportStar(require("./lib/credential-kind"), exports);
+__exportStar(require("./lib/credential-strategy-contribution"), exports);
 __exportStar(require("./lib/onboarding-manifest"), exports);
 __exportStar(require("./lib/provider-descriptor"), exports);
+__exportStar(require("./lib/oauth-endpoints"), exports);
 __exportStar(require("./lib/connector-descriptor"), exports);
 __exportStar(require("./lib/envelope-schema"), exports);
 __exportStar(require("./lib/filter-expr"), exports);

package/dist/connector/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/connector/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAmC;AACnC,+DAA6C;AAC7C,+DAA6C;AAC7C,mDAAiC;AACjC,wDAAsC;AACtC,4DAA0C;AAC1C,4DAA0C;AAC1C,6DAA2C;AAC3C,wDAAsC;AACtC,oDAAkC;AAClC,2DAAyC;AACzC,6DAA2C;AAC3C,0EAAwD"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/connector/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAmC;AACnC,+DAA6C;AAC7C,+DAA6C;AAC7C,mDAAiC;AACjC,wDAAsC;AACtC,yEAAuD;AACvD,4DAA0C;AAC1C,4DAA0C;AAC1C,wDAAsC;AACtC,6DAA2C;AAC3C,wDAAsC;AACtC,oDAAkC;AAClC,2DAAyC;AACzC,6DAA2C;AAC3C,0EAAwD"}

package/dist/connector/lib/connector-descriptor.d.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { type CapabilityRef } from '../../capability';
-import { CredentialKind } from './credential-kind';
+import { type CredentialKindRef } from './credential-kind';
 import { ConnectorAdapterKind } from './connector-adapter-kind';
 import { type ConnectorHttpRequestTemplate } from './connector-http-request';
 import type { AdapterKindRef } from './adapter-kind';
@@ -37,7 +37,7 @@ export interface ConnectorDescriptor {
     readonly iconName: string;
     readonly providerKey: string;
     readonly scopes: readonly string[];
-    readonly connectionCredentialKind: CredentialKind;
+    readonly connectionCredentialKind: CredentialKindRef;
     readonly adapterKind: AdapterKindRef;
     readonly operations?: readonly ConnectorOperationDescriptor[];
 }
@@ -48,7 +48,7 @@ export declare const ConnectorDescriptorSchema: z.ZodObject<{
     iconName: z.ZodString;
     providerKey: z.ZodString;
     scopes: z.ZodReadonly<z.ZodArray<z.ZodString>>;
-    connectionCredentialKind: z.ZodEnum<typeof CredentialKind>;
+    connectionCredentialKind: z.ZodString;
     adapterKind: z.ZodString;
     operations: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodObject<{
         capabilityRef: z.ZodType<CapabilityRef, unknown, z.core.$ZodTypeInternals<CapabilityRef, unknown>>;

package/dist/connector/lib/connector-descriptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connector-descriptor.d.ts","sourceRoot":"","sources":["../../../src/connector/lib/connector-descriptor.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE3E,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EACL,oBAAoB,EAErB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAkBrD,MAAM,WAAW,4BAA4B;IAO3C,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IAKtC,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC;IAQ3C,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAQnC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IASrC,QAAQ,CAAC,WAAW,CAAC,EAAE,4BAA4B,CAAC;CACrD;AAOD,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;kBA2B3C,CAAC;AASL,MAAM,WAAW,mBAAmB;IAElC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAG1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAU7B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAOnC,QAAQ,CAAC,wBAAwB,EAAE,cAAc,CAAC;IAOlD,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IAQrC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,4BAA4B,EAAE,CAAC;CAC/D;AASD,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAUpC,CAAC;AAOH,KAAK,aAAa,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;AACvC,KAAK,uBAAuB,CAAC,CAAC,IAAI,CAAC,SAAS,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,GAC5D,SAAS,uBAAuB,CAAC,CAAC,CAAC,EAAE,GACrC,CAAC,SAAS,MAAM,GACd;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS;CAAE,GAC7D,CAAC,CAAC;AACR,MAAM,MAAM,+CAA+C,GAAG;IAC5D,aAAa,CACX,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,EAClD,uBAAuB,CAAC,4BAA4B,CAAC,CACtD;IACD,aAAa,CACX,4BAA4B,EAC5B,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CACnD;CACF,CAAC;AACF,MAAM,MAAM,sCAAsC,GAAG;IACnD,aAAa,CACX,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,EACzC,uBAAuB,CAAC,mBAAmB,CAAC,CAC7C;IACD,aAAa,CAAC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;CAC9E,CAAC"}
+{"version":3,"file":"connector-descriptor.d.ts","sourceRoot":"","sources":["../../../src/connector/lib/connector-descriptor.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE3E,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,oBAAoB,EAErB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAkBrD,MAAM,WAAW,4BAA4B;IAO3C,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IAKtC,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC;IAQ3C,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAQnC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IASrC,QAAQ,CAAC,WAAW,CAAC,EAAE,4BAA4B,CAAC;CACrD;AAOD,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;kBA2B3C,CAAC;AASL,MAAM,WAAW,mBAAmB;IAElC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAG1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAU7B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAanC,QAAQ,CAAC,wBAAwB,EAAE,iBAAiB,CAAC;IAOrD,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IAQrC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,4BAA4B,EAAE,CAAC;CAC/D;AASD,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAUpC,CAAC;AAOH,KAAK,aAAa,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;AACvC,KAAK,uBAAuB,CAAC,CAAC,IAAI,CAAC,SAAS,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,GAC5D,SAAS,uBAAuB,CAAC,CAAC,CAAC,EAAE,GACrC,CAAC,SAAS,MAAM,GACd;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS;CAAE,GAC7D,CAAC,CAAC;AACR,MAAM,MAAM,+CAA+C,GAAG;IAC5D,aAAa,CACX,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,EAClD,uBAAuB,CAAC,4BAA4B,CAAC,CACtD;IACD,aAAa,CACX,4BAA4B,EAC5B,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CACnD;CACF,CAAC;AACF,MAAM,MAAM,sCAAsC,GAAG;IACnD,aAAa,CACX,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,EACzC,uBAAuB,CAAC,mBAAmB,CAAC,CAC7C;IACD,aAAa,CAAC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;CAC9E,CAAC"}

package/dist/connector/lib/connector-descriptor.js

@@ -39,7 +39,7 @@ exports.ConnectorDescriptorSchema = zod_1.z.strictObject({
     iconName: zod_1.z.string().min(1),
     providerKey: zod_1.z.string().min(1),
     scopes: zod_1.z.array(zod_1.z.string()).readonly(),
-    connectionCredentialKind: zod_1.z.nativeEnum(credential_kind_1.CredentialKind),
+    connectionCredentialKind: credential_kind_1.CredentialKindRefSchema,
     adapterKind: zod_1.z.string().min(1),
     operations: zod_1.z.array(exports.ConnectorOperationDescriptorSchema).readonly().optional(),
 });

package/dist/connector/lib/connector-descriptor.js.map

@@ -1 +1 @@
-{"version":3,"file":"connector-descriptor.js","sourceRoot":"","sources":["../../../src/connector/lib/connector-descriptor.ts"],"names":[],"mappings":";;;AAoBA,6BAAwB;AAExB,iDAA2E;AAE3E,uDAAmD;AACnD,qEAGkC;AAClC,qEAGkC;AAiErB,QAAA,kCAAkC,GAAG,OAAC;KAChD,YAAY,CAAC;IACZ,aAAa,EAAE,gCAAmB;IAClC,WAAW,EAAE,mDAA0B;IACvC,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,kBAAkB,EAAE,OAAC,CAAC,OAAO,EAAE;IAC/B,WAAW,EAAE,2DAAkC,CAAC,QAAQ,EAAE;CAC3D,CAAC;KACD,WAAW,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE;IACvB,MAAM,aAAa,GACjB,EAAE,CAAC,WAAW,KAAK,6CAAoB,CAAC,eAAe,CAAC;IAC1D,IAAI,aAAa,IAAI,EAAE,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAClD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EACL,qEAAqE;gBACrE,6CAA6C;SAChD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACnD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EAAE,sEAAsE,EAAE,CAAC,WAAW,KAAK;SACnG,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AA8DQ,QAAA,yBAAyB,GAAG,OAAC,CAAC,YAAY,CAAC;IACtD,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,wBAAwB,EAAE,OAAC,CAAC,UAAU,CAAC,gCAAc,CAAC;IACtD,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,UAAU,EAAE,OAAC,CAAC,KAAK,CAAC,0CAAkC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC9E,CAAC,CAAC"}
+{"version":3,"file":"connector-descriptor.js","sourceRoot":"","sources":["../../../src/connector/lib/connector-descriptor.ts"],"names":[],"mappings":";;;AAoBA,6BAAwB;AAExB,iDAA2E;AAE3E,uDAG2B;AAC3B,qEAGkC;AAClC,qEAGkC;AAiErB,QAAA,kCAAkC,GAAG,OAAC;KAChD,YAAY,CAAC;IACZ,aAAa,EAAE,gCAAmB;IAClC,WAAW,EAAE,mDAA0B;IACvC,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,kBAAkB,EAAE,OAAC,CAAC,OAAO,EAAE;IAC/B,WAAW,EAAE,2DAAkC,CAAC,QAAQ,EAAE;CAC3D,CAAC;KACD,WAAW,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE;IACvB,MAAM,aAAa,GACjB,EAAE,CAAC,WAAW,KAAK,6CAAoB,CAAC,eAAe,CAAC;IAC1D,IAAI,aAAa,IAAI,EAAE,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAClD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EACL,qEAAqE;gBACrE,6CAA6C;SAChD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACnD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EAAE,sEAAsE,EAAE,CAAC,WAAW,KAAK;SACnG,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAoEQ,QAAA,yBAAyB,GAAG,OAAC,CAAC,YAAY,CAAC;IACtD,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,wBAAwB,EAAE,yCAAuB;IACjD,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,UAAU,EAAE,OAAC,CAAC,KAAK,CAAC,0CAAkC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC9E,CAAC,CAAC"}

package/dist/connector/lib/credential-kind.d.ts

@@ -1,3 +1,4 @@
+import { z } from 'zod';
 export declare enum CredentialKind {
     AppInstall = "app_install",
     OAuthUser = "oauth_user",
@@ -12,6 +13,10 @@ export declare enum CredentialKind {
     SmtpAuth = "smtp_auth",
     ImapAuth = "imap_auth"
 }
+export declare const CURATED_CREDENTIAL_KINDS: readonly CredentialKind[];
+export type CredentialKindRef = string;
+export declare const CredentialKindRefSchema: z.ZodString;
+export declare function isCuratedCredentialKind(value: string): value is CredentialKind;
 export declare enum EmailTlsMode {
     Auto = "auto",
     Tls = "tls",

package/dist/connector/lib/credential-kind.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-kind.d.ts","sourceRoot":"","sources":["../../../src/connector/lib/credential-kind.ts"],"names":[],"mappings":"AAQA,oBAAY,cAAc;IAExB,UAAU,gBAAgB;IAE1B,SAAS,eAAe;IAExB,WAAW,iBAAiB;IAE5B,GAAG,QAAQ;IAEX,MAAM,YAAY;IAElB,QAAQ,cAAc;IAEtB,KAAK,UAAU;IAEf,aAAa,mBAAmB;IAEhC,OAAO,aAAa;IAKpB,aAAa,mBAAmB;IAQhC,QAAQ,cAAc;IAMtB,QAAQ,cAAc;CACvB;AAUD,oBAAY,YAAY;IACtB,IAAI,SAAS;IACb,GAAG,QAAQ;IACX,QAAQ,aAAa;IACrB,KAAK,UAAU;CAChB;AAYD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,YAAY,CAAC;IAEtB,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAOD,MAAM,MAAM,eAAe,GACvB,QAAQ,GACR,OAAO,GACP,WAAW,GACX,QAAQ,GAMR,gBAAgB,CAAC;AAErB,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,eAAe,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACjD;AAOD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ"}
+{"version":3,"file":"credential-kind.d.ts","sourceRoot":"","sources":["../../../src/connector/lib/credential-kind.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAmBxB,oBAAY,cAAc;IAExB,UAAU,gBAAgB;IAE1B,SAAS,eAAe;IAExB,WAAW,iBAAiB;IAE5B,GAAG,QAAQ;IAEX,MAAM,YAAY;IAElB,QAAQ,cAAc;IAEtB,KAAK,UAAU;IAEf,aAAa,mBAAmB;IAEhC,OAAO,aAAa;IAKpB,aAAa,mBAAmB;IAQhC,QAAQ,cAAc;IAMtB,QAAQ,cAAc;CACvB;AAOD,eAAO,MAAM,wBAAwB,EAAE,SAAS,cAAc,EAChB,CAAC;AAgB/C,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAQvC,eAAO,MAAM,uBAAuB,aAOjC,CAAC;AAGJ,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,GACZ,KAAK,IAAI,cAAc,CAEzB;AAUD,oBAAY,YAAY;IACtB,IAAI,SAAS;IACb,GAAG,QAAQ;IACX,QAAQ,aAAa;IACrB,KAAK,UAAU;CAChB;AAYD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,YAAY,CAAC;IAEtB,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAOD,MAAM,MAAM,eAAe,GACvB,QAAQ,GACR,OAAO,GACP,WAAW,GACX,QAAQ,GAMR,gBAAgB,CAAC;AAErB,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,eAAe,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACjD;AAOD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ"}

package/dist/connector/lib/credential-kind.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EmailTlsMode = exports.CredentialKind = void 0;
+exports.EmailTlsMode = exports.CredentialKindRefSchema = exports.CURATED_CREDENTIAL_KINDS = exports.CredentialKind = void 0;
+exports.isCuratedCredentialKind = isCuratedCredentialKind;
+const zod_1 = require("zod");
 var CredentialKind;
 (function (CredentialKind) {
     CredentialKind["AppInstall"] = "app_install";
@@ -16,6 +18,16 @@ var CredentialKind;
     CredentialKind["SmtpAuth"] = "smtp_auth";
     CredentialKind["ImapAuth"] = "imap_auth";
 })(CredentialKind || (exports.CredentialKind = CredentialKind = {}));
+exports.CURATED_CREDENTIAL_KINDS = Object.freeze(Object.values(CredentialKind));
+const CURATED_CREDENTIAL_KIND_VALUES = new Set(exports.CURATED_CREDENTIAL_KINDS);
+exports.CredentialKindRefSchema = zod_1.z
+    .string()
+    .min(1)
+    .max(64)
+    .regex(/^[A-Za-z][A-Za-z0-9_-]*$/, 'credential-kind ref must be a slug: an initial letter then letters/digits/_/-');
+function isCuratedCredentialKind(value) {
+    return CURATED_CREDENTIAL_KIND_VALUES.has(value);
+}
 var EmailTlsMode;
 (function (EmailTlsMode) {
     EmailTlsMode["Auto"] = "auto";

package/dist/connector/lib/credential-kind.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-kind.js","sourceRoot":"","sources":["../../../src/connector/lib/credential-kind.ts"],"names":[],"mappings":";;;AAQA,IAAY,cAsCX;AAtCD,WAAY,cAAc;IAExB,4CAA0B,CAAA;IAE1B,0CAAwB,CAAA;IAExB,8CAA4B,CAAA;IAE5B,6BAAW,CAAA;IAEX,oCAAkB,CAAA;IAElB,wCAAsB,CAAA;IAEtB,iCAAe,CAAA;IAEf,kDAAgC,CAAA;IAEhC,sCAAoB,CAAA;IAKpB,kDAAgC,CAAA;IAQhC,wCAAsB,CAAA;IAMtB,wCAAsB,CAAA;AACxB,CAAC,EAtCW,cAAc,8BAAd,cAAc,QAsCzB;AAUD,IAAY,YAKX;AALD,WAAY,YAAY;IACtB,6BAAa,CAAA;IACb,2BAAW,CAAA;IACX,qCAAqB,CAAA;IACrB,+BAAe,CAAA;AACjB,CAAC,EALW,YAAY,4BAAZ,YAAY,QAKvB"}
+{"version":3,"file":"credential-kind.js","sourceRoot":"","sources":["../../../src/connector/lib/credential-kind.ts"],"names":[],"mappings":";;;AAmGA,0DAIC;AAvGD,6BAAwB;AAmBxB,IAAY,cAsCX;AAtCD,WAAY,cAAc;IAExB,4CAA0B,CAAA;IAE1B,0CAAwB,CAAA;IAExB,8CAA4B,CAAA;IAE5B,6BAAW,CAAA;IAEX,oCAAkB,CAAA;IAElB,wCAAsB,CAAA;IAEtB,iCAAe,CAAA;IAEf,kDAAgC,CAAA;IAEhC,sCAAoB,CAAA;IAKpB,kDAAgC,CAAA;IAQhC,wCAAsB,CAAA;IAMtB,wCAAsB,CAAA;AACxB,CAAC,EAtCW,cAAc,8BAAd,cAAc,QAsCzB;AAOY,QAAA,wBAAwB,GACnC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;AAE/C,MAAM,8BAA8B,GAAwB,IAAI,GAAG,CACjE,gCAA6C,CAC9C,CAAC;AAoBW,QAAA,uBAAuB,GAAG,OAAC;KACrC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CACJ,0BAA0B,EAC1B,+EAA+E,CAChF,CAAC;AAGJ,SAAgB,uBAAuB,CACrC,KAAa;IAEb,OAAO,8BAA8B,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACnD,CAAC;AAUD,IAAY,YAKX;AALD,WAAY,YAAY;IACtB,6BAAa,CAAA;IACb,2BAAW,CAAA;IACX,qCAAqB,CAAA;IACrB,+BAAe,CAAA;AACjB,CAAC,EALW,YAAY,4BAAZ,YAAY,QAKvB"}

package/dist/connector/lib/credential-strategy-contribution.d.ts

@@ -0,0 +1,23 @@
+import { z } from 'zod';
+import { type CredentialKindRef } from './credential-kind';
+export declare enum CredentialProjectionScheme {
+    Bearer = "bearer",
+    Basic = "basic",
+    Header = "header"
+}
+export declare const CredentialProjectionSchemeSchema: z.ZodEnum<typeof CredentialProjectionScheme>;
+export interface CredentialStrategyContributionManifest {
+    readonly key: CredentialKindRef;
+    readonly displayName: string;
+    readonly scheme: CredentialProjectionScheme;
+    readonly tokenField?: string;
+    readonly usernameField?: string;
+    readonly passwordField?: string;
+    readonly headerName?: string;
+    readonly valuePrefix?: string;
+    readonly valueTemplate?: string;
+    readonly staticParams?: Readonly<Record<string, string>>;
+}
+export declare const CredentialStrategyContributionManifestSchema: z.ZodType<CredentialStrategyContributionManifest>;
+export declare function templateFieldNames(valueTemplate: string): readonly string[];
+//# sourceMappingURL=credential-strategy-contribution.d.ts.map

package/dist/connector/lib/credential-strategy-contribution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-strategy-contribution.d.ts","sourceRoot":"","sources":["../../../src/connector/lib/credential-strategy-contribution.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,mBAAmB,CAAC;AAiB3B,oBAAY,0BAA0B;IACpC,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,MAAM,WAAW;CAClB;AAED,eAAO,MAAM,gCAAgC,8CAE5C,CAAC;AA6BF,MAAM,WAAW,sCAAsC;IAMrD,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC;IAEhC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAE5C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAMhC,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC1D;AAED,eAAO,MAAM,4CAA4C,EAAE,CAAC,CAAC,OAAO,CAAC,sCAAsC,CAiFrC,CAAC;AAOvE,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAU3E"}

package/dist/connector/lib/credential-strategy-contribution.js

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CredentialStrategyContributionManifestSchema = exports.CredentialProjectionSchemeSchema = exports.CredentialProjectionScheme = void 0;
+exports.templateFieldNames = templateFieldNames;
+const zod_1 = require("zod");
+const credential_kind_1 = require("./credential-kind");
+const CREDENTIAL_STRATEGY_STRING_MAX = 200;
+const CREDENTIAL_STRATEGY_STATIC_PARAMS_MAX = 20;
+var CredentialProjectionScheme;
+(function (CredentialProjectionScheme) {
+    CredentialProjectionScheme["Bearer"] = "bearer";
+    CredentialProjectionScheme["Basic"] = "basic";
+    CredentialProjectionScheme["Header"] = "header";
+})(CredentialProjectionScheme || (exports.CredentialProjectionScheme = CredentialProjectionScheme = {}));
+exports.CredentialProjectionSchemeSchema = zod_1.z.nativeEnum(CredentialProjectionScheme);
+const VALUE_TEMPLATE_MAX = 500;
+const FieldNameSchema = zod_1.z
+    .string()
+    .min(1)
+    .max(CREDENTIAL_STRATEGY_STRING_MAX)
+    .regex(/^[A-Za-z][A-Za-z0-9_]*$/, 'field name must be an identifier-like key of the resolved credential');
+exports.CredentialStrategyContributionManifestSchema = zod_1.z
+    .object({
+    key: credential_kind_1.CredentialKindRefSchema.regex(/^[A-Z][A-Z0-9_]*$/, 'a contributed credential-strategy key must be UPPER_SNAKE (e.g. ACME_HMAC)').refine((k) => !(0, credential_kind_1.isCuratedCredentialKind)(k), {
+        message: 'a contributed credential-strategy key must not collide with a curated CredentialKind (curated always wins)',
+    }),
+    displayName: zod_1.z.string().min(1).max(CREDENTIAL_STRATEGY_STRING_MAX),
+    scheme: exports.CredentialProjectionSchemeSchema,
+    tokenField: FieldNameSchema.optional(),
+    usernameField: FieldNameSchema.optional(),
+    passwordField: FieldNameSchema.optional(),
+    headerName: zod_1.z
+        .string()
+        .min(1)
+        .max(CREDENTIAL_STRATEGY_STRING_MAX)
+        .regex(/^[A-Za-z][A-Za-z0-9-]*$/, 'headerName must be a valid HTTP header name')
+        .optional(),
+    valuePrefix: zod_1.z.string().max(CREDENTIAL_STRATEGY_STRING_MAX).optional(),
+    valueTemplate: zod_1.z.string().min(1).max(VALUE_TEMPLATE_MAX).optional(),
+    staticParams: zod_1.z
+        .record(zod_1.z.string().min(1).max(CREDENTIAL_STRATEGY_STRING_MAX), zod_1.z.string().max(CREDENTIAL_STRATEGY_STRING_MAX))
+        .refine((r) => Object.keys(r).length <= CREDENTIAL_STRATEGY_STATIC_PARAMS_MAX, `at most ${CREDENTIAL_STRATEGY_STATIC_PARAMS_MAX} static params`)
+        .optional(),
+})
+    .superRefine((m, ctx) => {
+    const requireField = (present, field, why) => {
+        if (present === undefined) {
+            ctx.addIssue({ code: 'custom', path: [field], message: why });
+        }
+    };
+    const forbidField = (present, field) => {
+        if (present !== undefined) {
+            ctx.addIssue({
+                code: 'custom',
+                path: [field],
+                message: `"${String(field)}" is not valid for scheme "${m.scheme}"`,
+            });
+        }
+    };
+    switch (m.scheme) {
+        case CredentialProjectionScheme.Bearer:
+            requireField(m.tokenField, 'tokenField', 'bearer scheme requires tokenField');
+            forbidField(m.usernameField, 'usernameField');
+            forbidField(m.passwordField, 'passwordField');
+            forbidField(m.headerName, 'headerName');
+            forbidField(m.valuePrefix, 'valuePrefix');
+            forbidField(m.valueTemplate, 'valueTemplate');
+            break;
+        case CredentialProjectionScheme.Basic:
+            requireField(m.usernameField, 'usernameField', 'basic scheme requires usernameField');
+            requireField(m.passwordField, 'passwordField', 'basic scheme requires passwordField');
+            forbidField(m.tokenField, 'tokenField');
+            forbidField(m.headerName, 'headerName');
+            forbidField(m.valuePrefix, 'valuePrefix');
+            forbidField(m.valueTemplate, 'valueTemplate');
+            break;
+        case CredentialProjectionScheme.Header:
+            requireField(m.headerName, 'headerName', 'header scheme requires headerName');
+            requireField(m.valueTemplate, 'valueTemplate', 'header scheme requires valueTemplate');
+            forbidField(m.tokenField, 'tokenField');
+            forbidField(m.usernameField, 'usernameField');
+            forbidField(m.passwordField, 'passwordField');
+            break;
+    }
+});
+function templateFieldNames(valueTemplate) {
+    const out = [];
+    const re = /\{([A-Za-z][A-Za-z0-9_]*)\}/g;
+    let match;
+    while ((match = re.exec(valueTemplate)) !== null) {
+        if (!out.includes(match[1])) {
+            out.push(match[1]);
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=credential-strategy-contribution.js.map

package/dist/connector/lib/credential-strategy-contribution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-strategy-contribution.js","sourceRoot":"","sources":["../../../src/connector/lib/credential-strategy-contribution.ts"],"names":[],"mappings":";;;AA4MA,gDAUC;AA7LD,6BAAwB;AAExB,uDAI2B;AAG3B,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAG3C,MAAM,qCAAqC,GAAG,EAAE,CAAC;AAWjD,IAAY,0BAIX;AAJD,WAAY,0BAA0B;IACpC,+CAAiB,CAAA;IACjB,6CAAe,CAAA;IACf,+CAAiB,CAAA;AACnB,CAAC,EAJW,0BAA0B,0CAA1B,0BAA0B,QAIrC;AAEY,QAAA,gCAAgC,GAAG,OAAC,CAAC,UAAU,CAC1D,0BAA0B,CAC3B,CAAC;AAOF,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAG/B,MAAM,eAAe,GAAG,OAAC;KACtB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,8BAA8B,CAAC;KACnC,KAAK,CACJ,yBAAyB,EACzB,sEAAsE,CACvE,CAAC;AA2CS,QAAA,4CAA4C,GACvD,OAAC;KACE,MAAM,CAAC;IACN,GAAG,EAAE,yCAAuB,CAAC,KAAK,CAChC,mBAAmB,EACnB,4EAA4E,CAC7E,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,yCAAuB,EAAC,CAAC,CAAC,EAAE;QAC3C,OAAO,EACL,4GAA4G;KAC/G,CAAC;IACF,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,8BAA8B,CAAC;IAClE,MAAM,EAAE,wCAAgC;IACxC,UAAU,EAAE,eAAe,CAAC,QAAQ,EAAE;IACtC,aAAa,EAAE,eAAe,CAAC,QAAQ,EAAE;IACzC,aAAa,EAAE,eAAe,CAAC,QAAQ,EAAE;IACzC,UAAU,EAAE,OAAC;SACV,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,8BAA8B,CAAC;SACnC,KAAK,CAAC,yBAAyB,EAAE,6CAA6C,CAAC;SAC/E,QAAQ,EAAE;IACb,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC,QAAQ,EAAE;IACtE,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACnE,YAAY,EAAE,OAAC;SACZ,MAAM,CACL,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,8BAA8B,CAAC,EACrD,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAC/C;SACA,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,qCAAqC,EACrE,WAAW,qCAAqC,gBAAgB,CACjE;SACA,QAAQ,EAAE;CACd,CAAC;KACD,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;IACtB,MAAM,YAAY,GAAG,CACnB,OAAgB,EAChB,KAAmD,EACnD,GAAW,EACL,EAAE;QACR,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC,CAAC;IACF,MAAM,WAAW,GAAG,CAClB,OAAgB,EAChB,KAAmD,EAC7C,EAAE;QACR,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,KAAK,CAAC;gBACb,OAAO,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC,MAAM,GAAG;aACpE,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IACF,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;QACjB,KAAK,0BAA0B,CAAC,MAAM;YACpC,YAAY,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,mCAAmC,CAAC,CAAC;YAC9E,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;YAC9C,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;YAC9C,WAAW,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YACxC,WAAW,CAAC,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YAC1C,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;YAC9C,MAAM;QACR,KAAK,0BAA0B,CAAC,KAAK;YACnC,YAAY,CAAC,CAAC,CAAC,aAAa,EAAE,eAAe,EAAE,qCAAqC,CAAC,CAAC;YACtF,YAAY,CAAC,CAAC,CAAC,aAAa,EAAE,eAAe,EAAE,qCAAqC,CAAC,CAAC;YACtF,WAAW,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YACxC,WAAW,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YACxC,WAAW,CAAC,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YAC1C,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;YAC9C,MAAM;QACR,KAAK,0BAA0B,CAAC,MAAM;YACpC,YAAY,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,mCAAmC,CAAC,CAAC;YAC9E,YAAY,CAAC,CAAC,CAAC,aAAa,EAAE,eAAe,EAAE,sCAAsC,CAAC,CAAC;YACvF,WAAW,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YACxC,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;YAC9C,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;YAC9C,MAAM;IACV,CAAC;AACH,CAAC,CAAiE,CAAC;AAOvE,SAAgB,kBAAkB,CAAC,aAAqB;IACtD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,EAAE,GAAG,8BAA8B,CAAC;IAC1C,IAAI,KAA6B,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/connector/lib/integration-provider-contribution.d.ts

@@ -61,7 +61,7 @@ export declare const IntegrationProviderContributionManifestSchema: z.ZodObject<
         iconName: z.ZodString;
         providerKey: z.ZodString;
         scopes: z.ZodReadonly<z.ZodArray<z.ZodString>>;
-        connectionCredentialKind: z.ZodEnum<typeof import("./credential-kind").CredentialKind>;
+        connectionCredentialKind: z.ZodString;
         adapterKind: z.ZodString;
         operations: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodObject<{
             capabilityRef: z.ZodType<import("../../capability").CapabilityRef, unknown, z.core.$ZodTypeInternals<import("../../capability").CapabilityRef, unknown>>;

package/dist/connector/lib/oauth-endpoints.d.ts

@@ -0,0 +1,7 @@
+export interface OAuthAuthorityEndpoints {
+    readonly authorizationUrl: string;
+    readonly tokenUrl: string;
+}
+export declare const GOOGLE_OAUTH_ENDPOINTS: OAuthAuthorityEndpoints;
+export declare const MICROSOFT_OAUTH_ENDPOINTS: OAuthAuthorityEndpoints;
+//# sourceMappingURL=oauth-endpoints.d.ts.map

package/dist/connector/lib/oauth-endpoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-endpoints.d.ts","sourceRoot":"","sources":["../../../src/connector/lib/oauth-endpoints.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,uBAAuB;IAEtC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAElC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAMD,eAAO,MAAM,sBAAsB,EAAE,uBAG3B,CAAC;AAOX,eAAO,MAAM,yBAAyB,EAAE,uBAI9B,CAAC"}

package/dist/connector/lib/oauth-endpoints.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MICROSOFT_OAUTH_ENDPOINTS = exports.GOOGLE_OAUTH_ENDPOINTS = void 0;
+exports.GOOGLE_OAUTH_ENDPOINTS = {
+    authorizationUrl: 'https://accounts.google.com/o/oauth2/v2/auth',
+    tokenUrl: 'https://oauth2.googleapis.com/token',
+};
+exports.MICROSOFT_OAUTH_ENDPOINTS = {
+    authorizationUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize',
+    tokenUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/token',
+};
+//# sourceMappingURL=oauth-endpoints.js.map

package/dist/connector/lib/oauth-endpoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-endpoints.js","sourceRoot":"","sources":["../../../src/connector/lib/oauth-endpoints.ts"],"names":[],"mappings":";;;AAmCa,QAAA,sBAAsB,GAA4B;IAC7D,gBAAgB,EAAE,8CAA8C;IAChE,QAAQ,EAAE,qCAAqC;CACvC,CAAC;AAOE,QAAA,yBAAyB,GAA4B;IAChE,gBAAgB,EACd,gEAAgE;IAClE,QAAQ,EAAE,4DAA4D;CAC9D,CAAC"}

package/dist/contribution/lib/contribution-kind.d.ts

@@ -30,7 +30,8 @@ export declare enum ContributionKind {
     Capability = "capability",
     ResourceOwnership = "resource-ownership",
     StageMachine = "stage-machine",
-    SearchType = "search-type"
+    SearchType = "search-type",
+    CredentialStrategy = "credential-strategy"
 }
 export declare const ContributionKindSchema: z.ZodEnum<typeof ContributionKind>;
 export type ContributionKindValue = `${ContributionKind}`;

package/dist/contribution/lib/contribution-kind.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contribution-kind.d.ts","sourceRoot":"","sources":["../../../src/contribution/lib/contribution-kind.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAkDxB,oBAAY,gBAAgB;IAS1B,WAAW,iBAAiB;IAO5B,OAAO,aAAa;IACpB,YAAY,kBAAkB;IAQ9B,UAAU,gBAAgB;IAK1B,YAAY,kBAAkB;IAC9B,UAAU,gBAAgB;IAC1B,WAAW,iBAAiB;IAS5B,wBAAwB,+BAA+B;IACvD,UAAU,gBAAgB;IAQ1B,YAAY,kBAAkB;IAM9B,WAAW,iBAAiB;IAW5B,cAAc,oBAAoB;IAMlC,kBAAkB,yBAAyB;IAK3C,IAAI,SAAS;IAEb,UAAU,gBAAgB;IAM1B,oBAAoB,0BAA0B;IAK9C,oBAAoB,2BAA2B;IAK/C,yBAAyB,gCAAgC;IAGzD,mBAAmB,yBAAyB;IAI5C,cAAc,oBAAoB;IAElC,eAAe,qBAAqB;IAEpC,iBAAiB,uBAAuB;IAMxC,yBAAyB,gCAAgC;IAEzD,WAAW,iBAAiB;IAI5B,UAAU,gBAAgB;IAO1B,YAAY,kBAAkB;IAM9B,cAAc,oBAAoB;IAgBlC,UAAU,eAAe;IAezB,iBAAiB,uBAAuB;IAcxC,YAAY,kBAAkB;IAkB9B,UAAU,gBAAgB;CAC3B;AAMD,eAAO,MAAM,sBAAsB,oCAAiC,CAAC;AAErE,MAAM,MAAM,qBAAqB,GAAG,GAAG,gBAAgB,EAAE,CAAC"}
+{"version":3,"file":"contribution-kind.d.ts","sourceRoot":"","sources":["../../../src/contribution/lib/contribution-kind.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAkDxB,oBAAY,gBAAgB;IAS1B,WAAW,iBAAiB;IAO5B,OAAO,aAAa;IACpB,YAAY,kBAAkB;IAQ9B,UAAU,gBAAgB;IAK1B,YAAY,kBAAkB;IAC9B,UAAU,gBAAgB;IAC1B,WAAW,iBAAiB;IAS5B,wBAAwB,+BAA+B;IACvD,UAAU,gBAAgB;IAQ1B,YAAY,kBAAkB;IAM9B,WAAW,iBAAiB;IAW5B,cAAc,oBAAoB;IAMlC,kBAAkB,yBAAyB;IAK3C,IAAI,SAAS;IAEb,UAAU,gBAAgB;IAM1B,oBAAoB,0BAA0B;IAK9C,oBAAoB,2BAA2B;IAK/C,yBAAyB,gCAAgC;IAGzD,mBAAmB,yBAAyB;IAI5C,cAAc,oBAAoB;IAElC,eAAe,qBAAqB;IAEpC,iBAAiB,uBAAuB;IAMxC,yBAAyB,gCAAgC;IAEzD,WAAW,iBAAiB;IAI5B,UAAU,gBAAgB;IAO1B,YAAY,kBAAkB;IAM9B,cAAc,oBAAoB;IAgBlC,UAAU,eAAe;IAezB,iBAAiB,uBAAuB;IAcxC,YAAY,kBAAkB;IAkB9B,UAAU,gBAAgB;IAoB1B,kBAAkB,wBAAwB;CAC3C;AAMD,eAAO,MAAM,sBAAsB,oCAAiC,CAAC;AAErE,MAAM,MAAM,qBAAqB,GAAG,GAAG,gBAAgB,EAAE,CAAC"}

package/dist/contribution/lib/contribution-kind.js

@@ -35,6 +35,7 @@ var ContributionKind;
     ContributionKind["ResourceOwnership"] = "resource-ownership";
     ContributionKind["StageMachine"] = "stage-machine";
     ContributionKind["SearchType"] = "search-type";
+    ContributionKind["CredentialStrategy"] = "credential-strategy";
 })(ContributionKind || (exports.ContributionKind = ContributionKind = {}));
 exports.ContributionKindSchema = zod_1.z.nativeEnum(ContributionKind);
 //# sourceMappingURL=contribution-kind.js.map

package/dist/contribution/lib/contribution-kind.js.map

@@ -1 +1 @@
-{"version":3,"file":"contribution-kind.js","sourceRoot":"","sources":["../../../src/contribution/lib/contribution-kind.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAkDxB,IAAY,gBAoMX;AApMD,WAAY,gBAAgB;IAS1B,gDAA4B,CAAA;IAO5B,wCAAoB,CAAA;IACpB,kDAA8B,CAAA;IAQ9B,8CAA0B,CAAA;IAK1B,kDAA8B,CAAA;IAC9B,8CAA0B,CAAA;IAC1B,gDAA4B,CAAA;IAS5B,2EAAuD,CAAA;IACvD,8CAA0B,CAAA;IAQ1B,kDAA8B,CAAA;IAM9B,gDAA4B,CAAA;IAW5B,sDAAkC,CAAA;IAMlC,+DAA2C,CAAA;IAK3C,iCAAa,CAAA;IAEb,8CAA0B,CAAA;IAM1B,kEAA8C,CAAA;IAK9C,mEAA+C,CAAA;IAK/C,6EAAyD,CAAA;IAGzD,gEAA4C,CAAA;IAI5C,sDAAkC,CAAA;IAElC,wDAAoC,CAAA;IAEpC,4DAAwC,CAAA;IAMxC,6EAAyD,CAAA;IAEzD,gDAA4B,CAAA;IAI5B,8CAA0B,CAAA;IAO1B,kDAA8B,CAAA;IAM9B,sDAAkC,CAAA;IAgBlC,6CAAyB,CAAA;IAezB,4DAAwC,CAAA;IAcxC,kDAA8B,CAAA;IAkB9B,8CAA0B,CAAA;AAC5B,CAAC,EApMW,gBAAgB,gCAAhB,gBAAgB,QAoM3B;AAMY,QAAA,sBAAsB,GAAG,OAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC"}
+{"version":3,"file":"contribution-kind.js","sourceRoot":"","sources":["../../../src/contribution/lib/contribution-kind.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAkDxB,IAAY,gBAwNX;AAxND,WAAY,gBAAgB;IAS1B,gDAA4B,CAAA;IAO5B,wCAAoB,CAAA;IACpB,kDAA8B,CAAA;IAQ9B,8CAA0B,CAAA;IAK1B,kDAA8B,CAAA;IAC9B,8CAA0B,CAAA;IAC1B,gDAA4B,CAAA;IAS5B,2EAAuD,CAAA;IACvD,8CAA0B,CAAA;IAQ1B,kDAA8B,CAAA;IAM9B,gDAA4B,CAAA;IAW5B,sDAAkC,CAAA;IAMlC,+DAA2C,CAAA;IAK3C,iCAAa,CAAA;IAEb,8CAA0B,CAAA;IAM1B,kEAA8C,CAAA;IAK9C,mEAA+C,CAAA;IAK/C,6EAAyD,CAAA;IAGzD,gEAA4C,CAAA;IAI5C,sDAAkC,CAAA;IAElC,wDAAoC,CAAA;IAEpC,4DAAwC,CAAA;IAMxC,6EAAyD,CAAA;IAEzD,gDAA4B,CAAA;IAI5B,8CAA0B,CAAA;IAO1B,kDAA8B,CAAA;IAM9B,sDAAkC,CAAA;IAgBlC,6CAAyB,CAAA;IAezB,4DAAwC,CAAA;IAcxC,kDAA8B,CAAA;IAkB9B,8CAA0B,CAAA;IAoB1B,8DAA0C,CAAA;AAC5C,CAAC,EAxNW,gBAAgB,gCAAhB,gBAAgB,QAwN3B;AAMY,QAAA,sBAAsB,GAAG,OAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/kernel-contracts",
-  "version": "0.35.0",
+  "version": "0.37.0",
   "description": "Consolidated Xema OS kernel wire contracts — pure types + zod schemas for the kernel protocol surfaces. One package, one npm scope, wildcard per-surface subpath exports. No framework/runtime deps.",
   "license": "Apache-2.0",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",

package/src/agent-composition/lib/agent-workspace-sharing.ts

@@ -32,6 +32,19 @@ export enum WorkspaceSharingPolicy {
    * / chat-style agents.
    */
   Shareable = 'shareable',
+  /**
+   * N INDEPENDENT sessions/pods operate on ONE durable, named workspace whose
+   * files are the source of truth (a session is a disposable cache; a lost
+   * session re-reads the files). Unlike {@link Shareable} — which pools
+   * multiple threads onto ONE pod's `/workspace` — `shared` binds SEPARATE
+   * pods to the same durable storage identified by a
+   * {@link DurableWorkspaceRef}, coordinated by an advisory single-writer
+   * cross-session write-lease (readers free; one in-flight mutating turn at a
+   * time across the sharing sessions). This is the multi-pod tier; it engages
+   * only for an agent that also binds a `durableWorkspace`. OPTIONAL +
+   * additive: absent ⇒ today's behaviour.
+   */
+  Shared = 'shared',
 }
 
 /**

package/src/agent-composition/lib/agent.ts

@@ -130,6 +130,65 @@ export interface AgentNode
   readonly limits?: AgentLimits;
 }
 
+/**
+ * Declares that an agent/composition ALWAYS runs inside a single, reusable
+ * "standing" session keyed by {@link pinKey}, instead of minting a fresh
+ * session per launch. When present, the session layer (agent-session-api)
+ * does a get-or-create keyed by `(orgId, projectId, pinKey)` at
+ * `POST /sessions` — a non-terminal existing session for the same key is
+ * ADOPTED; otherwise a new one is minted and pinned.
+ *
+ * OPTIONAL + additive: absent ⇒ today's behaviour (a fresh session per
+ * launch). A standing session is paired with a `persistent` lifecycle so it
+ * is not idle-reaped, but it STILL participates in the resume-tier idle
+ * scale-to-zero (`soft_pause` → `warm_pod` → `cold`) — standing ≠
+ * always-warm; it rehydrates from the durable workspace on the next message.
+ */
+export interface StandingSessionRef {
+  /**
+   * Stable key identifying the standing session for a purpose/biome, e.g.
+   * `{biomeId}:{purpose}`. Two launches of the same agent within the same
+   * `(orgId, projectId)` that carry the same `pinKey` reuse ONE session row.
+   */
+  readonly pinKey: string;
+}
+
+/**
+ * A stable, opaque identifier for a DURABLE, NAMED workspace whose files are
+ * the source of truth and which MANY independent sessions/pods may attach to
+ * (the multi-pod {@link WorkspaceSharingPolicy.Shared} tier). Unlike the
+ * default sessionId-derived, per-session workspace path, a durable workspace
+ * lives at a `workspaceRef`-keyed storage sub-path shared across every session
+ * that binds the same ref, and cross-session writes are serialized by an
+ * advisory single-writer write-lease keyed on the ref.
+ *
+ * OPTIONAL + additive: when an agent declares none, each session gets its own
+ * private, sessionId-derived workspace exactly as today.
+ */
+export type WorkspaceRef = string;
+
+/**
+ * Declares that an agent/composition binds to a DURABLE, NAMED workspace shared
+ * across N independent sessions (separate pods), instead of a private
+ * per-session workspace. When present, the session layer stores the
+ * {@link workspaceRef} on the session and the storage layer resolves a
+ * `workspaceRef`-keyed shared sub-path (not the sessionId-derived one); a
+ * cross-session write-lease keyed on the ref serializes mutating turns across
+ * the sharing sessions (readers free).
+ *
+ * OPTIONAL + additive: absent ⇒ today's private per-session workspace. Pairs
+ * with {@link WorkspaceSharingPolicy.Shared}.
+ */
+export interface DurableWorkspaceRef {
+  /**
+   * Stable, opaque durable-workspace identity. Two sessions that carry the same
+   * `workspaceRef` (within the same `(orgId, projectId)`) attach to the SAME
+   * durable storage sub-path and coordinate through ONE cross-session
+   * write-lease.
+   */
+  readonly workspaceRef: WorkspaceRef;
+}
+
 /**
  * A named, versioned, reusable Agent.
  */
@@ -173,6 +232,22 @@ export interface Agent {
    * chat-style agents; see {@link WorkspaceSharingPolicy}.
    */
   readonly workspaceSharing?: WorkspaceSharingPolicy;
+  /**
+   * When set, this agent ALWAYS runs inside its standing (pinned) session
+   * keyed by `pinKey` — the session layer adopts a non-terminal existing
+   * session for `(orgId, projectId, pinKey)` instead of minting a new one.
+   * OPTIONAL + additive: absent ⇒ a fresh session per launch. See
+   * {@link StandingSessionRef}.
+   */
+  readonly standingSession?: StandingSessionRef;
+  /**
+   * When set, sessions running this agent attach to a DURABLE, NAMED workspace
+   * shared across independent pods (the multi-pod
+   * {@link WorkspaceSharingPolicy.Shared} tier) instead of a private
+   * per-session workspace. OPTIONAL + additive: absent ⇒ today's private
+   * per-session workspace. See {@link DurableWorkspaceRef}.
+   */
+  readonly durableWorkspace?: DurableWorkspaceRef;
 }
 
 /**
@@ -237,4 +312,17 @@ export interface ResolvedAgent {
    * (`isolated`), applied explicitly at the read site.
    */
   readonly workspaceSharing?: WorkspaceSharingPolicy;
+  /**
+   * Resolved standing-session pin — carried from the source `Agent` so the
+   * session layer can do its `(orgId, projectId, pinKey)` get-or-create
+   * without re-fetching the definition. Absent ⇒ a fresh session per launch.
+   */
+  readonly standingSession?: StandingSessionRef;
+  /**
+   * Resolved durable-workspace binding — carried from the source `Agent` so the
+   * session layer can store the `workspaceRef` and the storage layer can
+   * resolve the shared, `workspaceRef`-keyed sub-path. Absent ⇒ today's private
+   * per-session workspace. See {@link DurableWorkspaceRef}.
+   */
+  readonly durableWorkspace?: DurableWorkspaceRef;
 }

package/src/app-runtime/lib/branding-config.ts

@@ -24,13 +24,15 @@ const PRIMARY_COLOR_REGEX =
  * - `cssTokens` is the escape hatch for richer theming — keys are intended to
  *   map to CSS custom-property names (without the leading `--`).
  *
- * STATUS (2026-07-10): this is a VALIDATED CONTRACT ONLY. Nothing applies it at
- * runtime yet — `logoUrl` and `primaryColor` never reach the DOM, and there is
- * no host CSS pipeline reading `cssTokens`. An earlier version of this docstring
- * claimed the public ingress themes the audience-facing UI with it; that reader
- * does not exist. The runtime branding applier (a theming provider writing CSS
- * custom properties, resolved per-sub-tenant from `AppRoleBinding.tenantId`) is
- * Wave 8.4 — do not assume a value set here has any visual effect until then.
+ * STATUS (2026-07-13): the runtime applier SHIPPED (Wave 8.4). `@xemahq/ui-kernel`'s
+ * `AppBrandingProvider` writes `primaryColor` → `--app-primary-color` and each
+ * `cssTokens` entry → a `--<key>` CSS custom property on its OWN subtree wrapper
+ * (never `documentElement` — no leak into host chrome), sanitising unsafe CSS /
+ * non-http(s) logo URLs; it is wired into the app-forge `ExternalAppPage` /
+ * `AppRuntimePage`. The remaining gap is upstream of this contract: the external/
+ * public app-definition response DTO surfaces only `displayName`, so `logoUrl` /
+ * `primaryColor` / `cssTokens` (and the per-`AppRoleBinding.tenantId` override)
+ * must still be threaded onto that wire before the applier can render them.
  */
 export interface BrandingConfig {
   displayName: string;

package/src/app-runtime/lib/delegated-session.ts

@@ -13,7 +13,7 @@ import {
  * for an `ExternalSubject` audience:
  *
  * ```
- * sub          = external-subject:<externalId>  (or anon:<random>)
+ * sub          = external-subject:<externalId>     (or anon:<random>)
  * act          = app:<appClientId>
  * org          = <orgId>
  * project      = <projectId>

package/src/connector/index.ts

@@ -3,8 +3,10 @@ export * from './lib/connector-adapter-kind';
 export * from './lib/connector-http-request';
 export * from './lib/capability';
 export * from './lib/credential-kind';
+export * from './lib/credential-strategy-contribution';
 export * from './lib/onboarding-manifest';
 export * from './lib/provider-descriptor';
+export * from './lib/oauth-endpoints';
 export * from './lib/connector-descriptor';
 export * from './lib/envelope-schema';
 export * from './lib/filter-expr';

package/src/connector/lib/connector-descriptor.ts

@@ -22,7 +22,10 @@ import { z } from 'zod';
 
 import { CapabilityRefSchema, type CapabilityRef } from '../../capability';
 
-import { CredentialKind } from './credential-kind';
+import {
+  CredentialKindRefSchema,
+  type CredentialKindRef,
+} from './credential-kind';
 import {
   ConnectorAdapterKind,
   ConnectorAdapterKindSchema,
@@ -158,8 +161,14 @@ export interface ConnectorDescriptor {
    * How an individual connection to THIS connector authenticates at runtime
    * (the per-connection wallet/token). `oauth_user` for OAuth connectors,
    * `imap_auth` / `smtp_auth` for the mail wallets, `pat` / `api_key`, …
+   *
+   * OPEN registry-backed key ({@link CredentialKindRef}): a curated
+   * {@link CredentialKind} value OR a biome-contributed strategy key. The
+   * kernel constrains the shape only; the connector-gateway credential-strategy
+   * registry decides validity (curated OR registered contributed), fail-fast on
+   * an unknown key — mirroring how `OrgIntegration.provider` was opened.
    */
-  readonly connectionCredentialKind: CredentialKind;
+  readonly connectionCredentialKind: CredentialKindRef;
 
   /**
    * The adapter category this connector plugs into (`mail`, `scm`, …). Drives
@@ -191,7 +200,7 @@ export const ConnectorDescriptorSchema = z.strictObject({
   iconName: z.string().min(1),
   providerKey: z.string().min(1),
   scopes: z.array(z.string()).readonly(),
-  connectionCredentialKind: z.nativeEnum(CredentialKind),
+  connectionCredentialKind: CredentialKindRefSchema,
   adapterKind: z.string().min(1),
   operations: z.array(ConnectorOperationDescriptorSchema).readonly().optional(),
 });

package/src/connector/lib/credential-kind.ts

@@ -1,10 +1,21 @@
+import { z } from 'zod';
+
 /**
- * Closed enum of credential strategies the platform knows how to mint,
- * cache, refresh and revoke. Biomes contributing new providers MUST
- * declare one of these — they never ship custom mint code.
+ * The CURATED credential strategies the platform ships built-in. This enum is
+ * the closed vocabulary of first-party mint strategies (pure field-projection
+ * plus the two delegated kinds `app_install` / `iam_role`).
+ *
+ * It is NO LONGER the whole universe of credential kinds. As of the
+ * credential-strategy contribution seam, a biome may CONTRIBUTE an additional
+ * DECLARATIVE strategy under its own open key ({@link CredentialKindRef}),
+ * registered at runtime — exactly the way `OrgIntegration.provider` was opened
+ * from the closed `ConnectorKind` enum to an open registry-backed key. The
+ * curated values below always WIN a key collision; a contributed strategy that
+ * names a curated value is rejected at the registry seam.
  *
- * Adding a kind here is a one-line schema change plus a matching
- * strategy implementation for that kind.
+ * Adding a CURATED kind here is a one-line schema change plus a matching
+ * built-in strategy implementation. Adding a THIRD-PARTY kind needs no kernel
+ * change — it flows through `ContributionKind.CredentialStrategy`.
  */
 export enum CredentialKind {
   /** GitHub App / GitLab App style installation token (per-installation, 1h). */
@@ -46,6 +57,52 @@ export enum CredentialKind {
   ImapAuth = 'imap_auth',
 }
 
+/**
+ * Every curated `CredentialKind` wire value, frozen. The single source of truth
+ * for "is this a first-party built-in kind?" used by {@link isCuratedCredentialKind}
+ * and by the connector-gateway registry seam (curated always wins a collision).
+ */
+export const CURATED_CREDENTIAL_KINDS: readonly CredentialKind[] =
+  Object.freeze(Object.values(CredentialKind));
+
+const CURATED_CREDENTIAL_KIND_VALUES: ReadonlySet<string> = new Set(
+  CURATED_CREDENTIAL_KINDS as readonly string[],
+);
+
+/**
+ * An OPEN credential-kind key carried on `ConnectorDescriptor
+ * .connectionCredentialKind` and on the credential resolve wire. It is EITHER a
+ * curated {@link CredentialKind} wire value (`oauth_user`, `api_key`, …) OR a
+ * biome-contributed strategy key (UPPER_SNAKE, e.g. `ACME_HMAC`). The kernel
+ * intentionally does NOT close this set — validity is enforced at the runtime
+ * seam by the connector-gateway credential-strategy registry (curated OR
+ * registered contributed), exactly like `OrgIntegration.provider`. The kernel
+ * only constrains the SHAPE (a non-empty slug), never the membership.
+ */
+export type CredentialKindRef = string;
+
+/**
+ * Shape validator for a {@link CredentialKindRef}. Permissive enough for BOTH
+ * the curated lowercase_snake values AND contributed UPPER_SNAKE / kebab keys;
+ * membership (known vs unknown) is a runtime-registry decision, never a kernel
+ * one. Bounded so persisted rows and envelopes stay small.
+ */
+export const CredentialKindRefSchema = z
+  .string()
+  .min(1)
+  .max(64)
+  .regex(
+    /^[A-Za-z][A-Za-z0-9_-]*$/,
+    'credential-kind ref must be a slug: an initial letter then letters/digits/_/-',
+  );
+
+/** Whether `value` is one of the CURATED (first-party built-in) credential kinds. */
+export function isCuratedCredentialKind(
+  value: string,
+): value is CredentialKind {
+  return CURATED_CREDENTIAL_KIND_VALUES.has(value);
+}
+
 /**
  * Closed TLS-mode enum shared by SMTP + IMAP wallets. `auto` lets the
  * client library pick the right mode for the configured port:

package/src/connector/lib/credential-strategy-contribution.ts

@@ -0,0 +1,215 @@
+/**
+ * ─────────────────────────────────────────────────────────────────────────
+ * Credential-strategy contribution — the DECLARATIVE tier
+ *
+ * A biome that ships a connector needing an auth scheme the platform does not
+ * have built-in (a custom API-key header, an unusual basic-auth field naming, a
+ * templated bearer value) contributes a `ContributionKind.CredentialStrategy`
+ * envelope carrying THIS manifest. It is pure DATA: a projection of the fields
+ * already resolved from custody into an outbound token — NO executable code.
+ *
+ * This is the answer to "the credential plane must fit ANY connector" WITHOUT
+ * closing `CredentialKind` to 12 values. The contributed strategy registers
+ * under its own open key ({@link CredentialKindRef}); the connector-gateway
+ * credential resolver builds a runtime `CredentialStrategy` from the projection
+ * and mints exactly as a built-in would. Novel MINT LOGIC that cannot be
+ * expressed as a projection (custom signing, multi-step token exchange) is the
+ * SEPARATE code-bearing tier and is NOT expressible here — by design.
+ *
+ * Provenance (`biome.id`, `biome.version`) is NOT a field here — the parser and
+ * the receiving service stamp it from the discovering biome's manifest.
+ * Validation is fail-fast: a contribution that violates any constraint is
+ * rejected at boot. No silent coercion.
+ * ─────────────────────────────────────────────────────────────────────────
+ */
+
+import { z } from 'zod';
+
+import {
+  CredentialKindRefSchema,
+  isCuratedCredentialKind,
+  type CredentialKindRef,
+} from './credential-kind';
+
+/** Bound on the display name + template + header strings, keeping envelopes small. */
+const CREDENTIAL_STRATEGY_STRING_MAX = 200;
+
+/** Hard cap on the number of static providerHints a strategy may declare. */
+const CREDENTIAL_STRATEGY_STATIC_PARAMS_MAX = 20;
+
+/**
+ * The declarative projection SCHEME a contributed strategy uses — a closed set,
+ * each mapping 1:1 onto an existing `MintedTokenType`. A biome that needs a
+ * scheme NOT in this set needs the code-bearing tier, not a wider enum.
+ *
+ *   - `bearer`  → `Authorization: Bearer <field>`         (MintedTokenType `bearer`)
+ *   - `basic`   → `Authorization: Basic base64(user:pass)` (MintedTokenType `basic`)
+ *   - `header`  → `<headerName>: <valuePrefix><templated>` (MintedTokenType `header`)
+ */
+export enum CredentialProjectionScheme {
+  Bearer = 'bearer',
+  Basic = 'basic',
+  Header = 'header',
+}
+
+export const CredentialProjectionSchemeSchema = z.nativeEnum(
+  CredentialProjectionScheme,
+);
+
+/**
+ * A `{placeholder}` template referencing decrypted credential fields, e.g.
+ * `"{apiKey}"` or `"v1:{keyId}:{secret}"`. Every `{name}` MUST resolve to a
+ * present string field on the resolved credential at mint time (fail-fast).
+ */
+const VALUE_TEMPLATE_MAX = 500;
+
+/** Field-name shape shared by every `*Field` selector (a decrypted-blob key). */
+const FieldNameSchema = z
+  .string()
+  .min(1)
+  .max(CREDENTIAL_STRATEGY_STRING_MAX)
+  .regex(
+    /^[A-Za-z][A-Za-z0-9_]*$/,
+    'field name must be an identifier-like key of the resolved credential',
+  );
+
+/**
+ * Manifest shape carried by every `ContributionKind.CredentialStrategy`
+ * envelope. One contribution = one declarative credential strategy.
+ *
+ * Mirrors `CapabilityContributionManifest` / `SearchTypeContributionManifest`:
+ * a value-identical subset of the wire body the owning service
+ * (`connector-gateway-api`) accepts, validated fail-fast at biome-discovery
+ * time. Cross-field validation binds the scheme-specific selectors so a
+ * malformed projection can never reach the registry.
+ */
+export interface CredentialStrategyContributionManifest {
+  /**
+   * The OPEN credential-kind key this strategy mints under (UPPER_SNAKE, e.g.
+   * `ACME_HMAC`). MUST NOT be a curated {@link CredentialKind} value — curated
+   * always wins, so a contributed strategy may never shadow one.
+   */
+  readonly key: CredentialKindRef;
+  /** Human-readable strategy name for catalog/admin surfaces. */
+  readonly displayName: string;
+  /** Which projection scheme mints the outbound token. */
+  readonly scheme: CredentialProjectionScheme;
+  /** `bearer` — the decrypted field carrying the raw bearer token. */
+  readonly tokenField?: string;
+  /** `basic` — the decrypted field carrying the username. */
+  readonly usernameField?: string;
+  /** `basic` — the decrypted field carrying the password/secret. */
+  readonly passwordField?: string;
+  /** `header` — the outbound header name (e.g. `X-Api-Key`). */
+  readonly headerName?: string;
+  /** `header` — optional static prefix prepended to the templated value (e.g. `"Token "`). */
+  readonly valuePrefix?: string;
+  /** `header` — `{field}` template producing the header value from decrypted fields. */
+  readonly valueTemplate?: string;
+  /**
+   * Optional static, NON-SECRET routing hints merged verbatim into the minted
+   * token's `providerHints` (regional endpoint, app id, …). Never a secret —
+   * secrets flow only through the projected fields.
+   */
+  readonly staticParams?: Readonly<Record<string, string>>;
+}
+
+export const CredentialStrategyContributionManifestSchema: z.ZodType<CredentialStrategyContributionManifest> =
+  z
+    .object({
+      key: CredentialKindRefSchema.regex(
+        /^[A-Z][A-Z0-9_]*$/,
+        'a contributed credential-strategy key must be UPPER_SNAKE (e.g. ACME_HMAC)',
+      ).refine((k) => !isCuratedCredentialKind(k), {
+        message:
+          'a contributed credential-strategy key must not collide with a curated CredentialKind (curated always wins)',
+      }),
+      displayName: z.string().min(1).max(CREDENTIAL_STRATEGY_STRING_MAX),
+      scheme: CredentialProjectionSchemeSchema,
+      tokenField: FieldNameSchema.optional(),
+      usernameField: FieldNameSchema.optional(),
+      passwordField: FieldNameSchema.optional(),
+      headerName: z
+        .string()
+        .min(1)
+        .max(CREDENTIAL_STRATEGY_STRING_MAX)
+        .regex(/^[A-Za-z][A-Za-z0-9-]*$/, 'headerName must be a valid HTTP header name')
+        .optional(),
+      valuePrefix: z.string().max(CREDENTIAL_STRATEGY_STRING_MAX).optional(),
+      valueTemplate: z.string().min(1).max(VALUE_TEMPLATE_MAX).optional(),
+      staticParams: z
+        .record(
+          z.string().min(1).max(CREDENTIAL_STRATEGY_STRING_MAX),
+          z.string().max(CREDENTIAL_STRATEGY_STRING_MAX),
+        )
+        .refine(
+          (r) => Object.keys(r).length <= CREDENTIAL_STRATEGY_STATIC_PARAMS_MAX,
+          `at most ${CREDENTIAL_STRATEGY_STATIC_PARAMS_MAX} static params`,
+        )
+        .optional(),
+    })
+    .superRefine((m, ctx) => {
+      const requireField = (
+        present: unknown,
+        field: keyof CredentialStrategyContributionManifest,
+        why: string,
+      ): void => {
+        if (present === undefined) {
+          ctx.addIssue({ code: 'custom', path: [field], message: why });
+        }
+      };
+      const forbidField = (
+        present: unknown,
+        field: keyof CredentialStrategyContributionManifest,
+      ): void => {
+        if (present !== undefined) {
+          ctx.addIssue({
+            code: 'custom',
+            path: [field],
+            message: `"${String(field)}" is not valid for scheme "${m.scheme}"`,
+          });
+        }
+      };
+      switch (m.scheme) {
+        case CredentialProjectionScheme.Bearer:
+          requireField(m.tokenField, 'tokenField', 'bearer scheme requires tokenField');
+          forbidField(m.usernameField, 'usernameField');
+          forbidField(m.passwordField, 'passwordField');
+          forbidField(m.headerName, 'headerName');
+          forbidField(m.valuePrefix, 'valuePrefix');
+          forbidField(m.valueTemplate, 'valueTemplate');
+          break;
+        case CredentialProjectionScheme.Basic:
+          requireField(m.usernameField, 'usernameField', 'basic scheme requires usernameField');
+          requireField(m.passwordField, 'passwordField', 'basic scheme requires passwordField');
+          forbidField(m.tokenField, 'tokenField');
+          forbidField(m.headerName, 'headerName');
+          forbidField(m.valuePrefix, 'valuePrefix');
+          forbidField(m.valueTemplate, 'valueTemplate');
+          break;
+        case CredentialProjectionScheme.Header:
+          requireField(m.headerName, 'headerName', 'header scheme requires headerName');
+          requireField(m.valueTemplate, 'valueTemplate', 'header scheme requires valueTemplate');
+          forbidField(m.tokenField, 'tokenField');
+          forbidField(m.usernameField, 'usernameField');
+          forbidField(m.passwordField, 'passwordField');
+          break;
+      }
+    }) as unknown as z.ZodType<CredentialStrategyContributionManifest>;
+
+/**
+ * Extract the ordered set of `{field}` placeholders a header `valueTemplate`
+ * references. Centralized so the manifest, the runtime builder, and any
+ * validator agree on the exact tokens that must resolve.
+ */
+export function templateFieldNames(valueTemplate: string): readonly string[] {
+  const out: string[] = [];
+  const re = /\{([A-Za-z][A-Za-z0-9_]*)\}/g;
+  let match: RegExpExecArray | null;
+  while ((match = re.exec(valueTemplate)) !== null) {
+    if (!out.includes(match[1]!)) {
+      out.push(match[1]!);
+    }
+  }
+  return out;
+}

package/src/connector/lib/oauth-endpoints.ts

@@ -0,0 +1,50 @@
+/**
+ * ─────────────────────────────────────────────────────────────────────────
+ * Stable OAuth authority endpoints — single source of truth
+ *
+ * The authorization-code + token-exchange endpoints for the well-known OAuth
+ * authorities (Google, Microsoft Entra "common" tenant) are STABLE — they do
+ * not change per consumer and are not secrets. Before this module they were
+ * hardcoded independently in every OAuth consumer (gmail-connector,
+ * ms365-connector, mailops), inviting drift. They are now declared ONCE here.
+ *
+ * SCOPE — authority endpoints ONLY. `scopes`, `extraAuthorizeParams`
+ * (e.g. Google's `access_type=offline` / `prompt=consent`, Microsoft's
+ * `prompt`), redirect URIs, client credentials, and connector slugs
+ * legitimately DIFFER per consumer and MUST stay local to each consumer. Do
+ * NOT add any of those here — this file carries the two URLs and nothing else.
+ *
+ * The shape is value-compatible with the required fields of
+ * {@link ProviderOAuthEndpoints} (`authorizationUrl` + `tokenUrl`), so a
+ * consumer can spread these into a full `ProviderOAuthEndpoints` and add its
+ * own scopes/params.
+ * ─────────────────────────────────────────────────────────────────────────
+ */
+
+/** The stable authority endpoints of one OAuth provider — no scopes, no params. */
+export interface OAuthAuthorityEndpoints {
+  /** Authorization-code consent endpoint (where the user is redirected). */
+  readonly authorizationUrl: string;
+  /** Token-exchange endpoint (code→token, refresh-token rotation). */
+  readonly tokenUrl: string;
+}
+
+/**
+ * Google OAuth 2.0 authority endpoints (v2 auth + token). Stable across all
+ * Google APIs; consumers supply their own scopes and authorize params.
+ */
+export const GOOGLE_OAUTH_ENDPOINTS: OAuthAuthorityEndpoints = {
+  authorizationUrl: 'https://accounts.google.com/o/oauth2/v2/auth',
+  tokenUrl: 'https://oauth2.googleapis.com/token',
+} as const;
+
+/**
+ * Microsoft Entra ID (Azure AD) OAuth 2.0 authority endpoints on the multi-
+ * tenant `common` authority. Consumers that must pin a single tenant build
+ * their own URLs; this constant is the shared multi-tenant default.
+ */
+export const MICROSOFT_OAUTH_ENDPOINTS: OAuthAuthorityEndpoints = {
+  authorizationUrl:
+    'https://login.microsoftonline.com/common/oauth2/v2.0/authorize',
+  tokenUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/token',
+} as const;

package/src/contribution/lib/contribution-kind.ts

@@ -244,6 +244,26 @@ export enum ContributionKind {
    * document INSTANCES are event-fed (runtime, via `IndexableDocument`).
    */
   SearchType = 'search-type',
+
+  // -- Credential-strategy self-registration ---------------------------------
+  /**
+   * A DECLARATIVE credential-mint strategy contributed by a connector biome —
+   * the open credential-kind key it registers, the projection SCHEME
+   * (`bearer` / `basic` / `header`), and the field/template selectors that map
+   * a custody-resolved credential into an outbound token. The kernel owns this
+   * enum member AND the manifest schema
+   * (`CredentialStrategyContributionManifestSchema`, exported from
+   * `@xemahq/kernel-contracts/connector`), mirroring the `Capability` /
+   * `SearchType` kinds: a single value-identical wire shape both the
+   * contribution-file parser (`credential-strategy.parser.ts` in
+   * `biome-host-api`) and the owning service (`connector-gateway-api`) validate
+   * fail-fast. Provenance (`biome.id/version`) is stamped by the parser — never
+   * declared inline. This OPENS `CredentialKind` from a closed 12-value enum to
+   * a registry-backed key (curated always wins a collision), the same way
+   * `OrgIntegration.provider` was opened. NOVEL mint code (custom signing,
+   * token exchange) is the separate code-bearing tier — NOT expressible here.
+   */
+  CredentialStrategy = 'credential-strategy',
 }
 
 /**