{
  "$id": "https://glide.co/schemas/agent-banking/draft/connector-manifest.json",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "title": "ConnectorManifest",
  "description": "The OSS connector manifest. Every package at packages/connectors/<slug>/ ships one of these as src/manifest.ts. Validated by the manifest CI gate (M5) and at boot by the registry. Forward-compat: capability + amlPosture vocabularies grow additively in minor releases; new fields are optional.",
  "channel": "v1",
  "examples": [
    {
      "schemaVersion": "v1",
      "slug": "bridge-payouts",
      "displayName": "Bridge Payouts",
      "vendor": "Bridge.xyz",
      "trust": "core",
      "capabilities": ["banking", "chain-receipt"],
      "regions": ["US", "GB", "DE"],
      "currencies": ["USD", "EUR", "USDC"],
      "egressHosts": ["api.bridge.xyz"],
      "compliance": {
        "jurisdictions": ["US"],
        "licenses": ["FinCEN MSB"],
        "dataResidency": ["US"],
        "amlPosture": "vendor-screened",
        "retentionDays": 2555
      },
      "packageVersion": "0.2.0",
      "iconPath": "./icon.svg",
      "isMock": false
    }
  ],
  "schema": {
    "$schema": "https://json-schema.org/draft/2020-12/schema",
    "type": "object",
    "properties": {
      "schemaVersion": {
        "type": "string",
        "const": "v1",
        "description": "Schema major version. Pinned to 'v1'. Manifests with a different schemaVersion are refused at registry boot."
      },
      "slug": {
        "$ref": "_types.json#/$defs/kebabSlug",
        "description": "URL-safe identifier. Surfaces in /admin/connectors/[slug] and at the npm package name `@glideco/connector-<slug>`. Globally unique across the connector registry."
      },
      "displayName": {
        "type": "string",
        "minLength": 1,
        "maxLength": 64,
        "description": "Human-friendly name shown in the connector picker UI."
      },
      "vendor": {
        "type": "string",
        "minLength": 1,
        "maxLength": 128,
        "description": "Vendor / company name. Plain text; not a URL or slug."
      },
      "trust": {
        "$ref": "_types.json#/$defs/trustTier",
        "description": "Trust tier. Bumping a connector from `community` → `verified` requires a separate PR with TPA PDF hash + 2 core reviewers."
      },
      "capabilities": {
        "type": "array",
        "minItems": 1,
        "uniqueItems": true,
        "description": "Set of capabilities this connector implements. Connector code must export an implementation for each capability listed here; the registry verifies at boot.",
        "items": { "$ref": "_types.json#/$defs/connectorCapability" }
      },
      "regions": {
        "type": "array",
        "minItems": 1,
        "uniqueItems": true,
        "description": "Regions where this connector can be activated. Each entry is either an ISO 3166-1 alpha-2 country code or a region tag. The router refuses to activate a connector for a vault whose entity_country isn't covered.",
        "items": { "$ref": "_types.json#/$defs/regionCode" }
      },
      "currencies": {
        "type": "array",
        "minItems": 1,
        "uniqueItems": true,
        "description": "Currencies this connector can settle in. Each entry is either an ISO 4217 alpha-3 fiat code (`USD`, `EUR`) or a stablecoin symbol (`USDC`, `PYUSD`).",
        "items": { "$ref": "_types.json#/$defs/currencyCode" }
      },
      "egressHosts": {
        "type": "array",
        "uniqueItems": true,
        "description": "Hostnames the connector's runtime contacts. Enforced by the egress-host lint CI gate — every fetch/axios target a connector touches MUST appear here. No scheme, no path, no port.",
        "items": { "$ref": "_types.json#/$defs/hostname" }
      },
      "compliance": {
        "type": "object",
        "description": "Compliance disclosures. Surfaced verbatim in /admin/connectors/[slug] so superadmins see the jurisdiction posture before flipping a connector on.",
        "properties": {
          "jurisdictions": {
            "type": "array",
            "uniqueItems": true,
            "description": "Regions the vendor is licensed in. Each entry is either an ISO 3166-1 alpha-2 country code (`US`, `GB`) or a region tag (`EU`, `LATAM`).",
            "items": { "$ref": "_types.json#/$defs/regionCode" }
          },
          "licenses": {
            "type": "array",
            "uniqueItems": true,
            "description": "Human-readable license names, e.g. 'FinCEN MSB', 'BitLicense'. Free-text; aim for the canonical regulator-issued name.",
            "items": {
              "type": "string",
              "minLength": 1,
              "maxLength": 128
            }
          },
          "dataResidency": {
            "type": "array",
            "uniqueItems": true,
            "description": "Regions where the vendor stores customer PII. Each entry is either an ISO 3166-1 alpha-2 code or a region tag.",
            "items": { "$ref": "_types.json#/$defs/regionCode" }
          },
          "amlPosture": {
            "$ref": "_types.json#/$defs/amlPosture",
            "description": "Vendor's AML/sanctions screening posture. Optional; absent = unknown (treated as `unscreened` for safety)."
          },
          "retentionDays": {
            "$ref": "_types.json#/$defs/nonNegativeInt",
            "description": "How long the vendor retains PII tied to this connector, in days. 0 means 'no retention' (don't trust without an audit). Optional; absent = unknown."
          }
        },
        "required": ["jurisdictions", "licenses", "dataResidency"],
        "additionalProperties": false
      },
      "packageVersion": {
        "$ref": "_types.json#/$defs/semver",
        "description": "SemVer of the connector package. Must match the package.json version; a CI gate verifies."
      },
      "homepage": {
        "$ref": "_types.json#/$defs/httpsUrl",
        "description": "Public homepage / docs URL. https-only — http: is rejected to prevent silent downgrade."
      },
      "iconPath": {
        "type": "string",
        "minLength": 1,
        "maxLength": 256,
        "default": "./icon.svg",
        "pattern": "^\\./[A-Za-z0-9._\\-/]+\\.(svg|png)$",
        "description": "Path to the connector icon, relative to the package root. Must point to an SVG or PNG inside the package; absolute paths and URLs are rejected to keep manifests self-contained."
      },
      "isMock": {
        "type": "boolean",
        "default": false,
        "description": "Mock connectors REQUIRE this to be true and refuse to run in NODE_ENV=production unless GLIDE_ALLOW_MOCKS_IN_PROD=true is set. Real connectors set false."
      },
      "changelogUrl": {
        "$ref": "_types.json#/$defs/httpsUrl",
        "description": "Public changelog URL. https-only."
      }
    },
    "required": [
      "schemaVersion",
      "slug",
      "displayName",
      "vendor",
      "trust",
      "capabilities",
      "regions",
      "currencies",
      "egressHosts",
      "compliance",
      "packageVersion",
      "iconPath",
      "isMock"
    ],
    "additionalProperties": false
  }
}