Schift Integration Contracts

Shared Zod schemas for first-party integration setup payloads.

This package validates the user-facing credential/setup boundary before a UI, SDK, or broker calls Connect Security or Workflow v2. It intentionally accepts credential references and OAuth connection IDs, not raw provider secrets.

What Schift owns:

• OAuth app references for Slack, Google Workspace, and Notion.
• SES sender identity for Schift-managed email.
• Secret references such as secret://... or kv://...; never raw client secrets in UI node config.

What each user or org owns:

• OAuth connectionId values after authorizing their own workspace/account.
• Discord webhook URLs for the channel they control.
• Sealed credentialRef values for PAT/API-key providers.

V1 setup modes:

• discord: webhook URL
• email: Schift-managed sender domain
• slack: OAuth connection
• gdrive: OAuth connection
• gmail: OAuth connection
• google_sheets: OAuth connection
• notion: OAuth connection or sealed API-key reference
• bolta: sealed API-key reference

API-doc-derived minimum scopes:

• Slack send: chat:write
• Google Drive file search: https://www.googleapis.com/auth/drive.metadata.readonly
• Gmail thread search: https://www.googleapis.com/auth/gmail.readonly
• Google Sheets row append: https://www.googleapis.com/auth/spreadsheets