CONTRIBUTING.md; this page summarizes the connector-specific path.
Trust tiers
Five-step flow
1
Open a `New connector` issue first
Use the
new-connector issue template so we can flag any compliance / regulatory concerns before you write code. Include vendor name, slug, capabilities, regions, regulatory posture, and rationale.2
Read the `_base/` interfaces
Capability contracts live at
packages/connectors/_base/src/capabilities/. Pick the subset your vendor implements:orchestration— fiat ↔ crypto conversion.kyc— identity verification.card— card issuance.screening— sanctions / AML lookup.chain-receipt— on-chain confirmation reads.balance— multi-chain balance reads.auth— token verification.banking— direct bank-rail (ACH / wire / SWIFT).qr-gateway— QR-code merchant payments.- And 5 more (oauth-authorization-server, attestation, merkle-anchor, timelock-module, recovery).
3
Scaffold the package
4
Write the contract test
Extend The test asserts manifest validity + capability presence + egress-host invariant (every host the connector touches must appear in
ContractTestSuite from @repo/connectors-base:manifest.egressHosts).5
Submit the PR
All eight CI gates must pass:
- DCO sign-off check.
- Signed-commits check (Verified tier and above).
- Manifest schema validation.
- Contract-test runner.
- License-compat scan (M5.5+).
- Supply-chain scans (Snyk + Socket — M5.5+).
- Egress-host lint via
ts-morph(M5.5+). - Compliance review (counsel sign-off for verified-tier promotions).
Review SLA
- Community-tier: 5 business days.
- Verified-tier promotion: 10 business days (includes Trusted Partner Agreement review).
Reading list
- Connector catalog — every connector currently in the repo.
- License compatibility — accept / warn / block matrix.
- Threat model — T7 (malicious connector PR).