Interface ConnectorPolicies

Optional audit logger for connector decisions and failures.

Custom tool-boundary evaluators, run pre-execute after the built-in network-egress gate, in registration order. A present value must be an array of evaluators, each with a string name and an evaluate function.

Base fetch the per-call egress guard wraps before handing it to execute as ConnectorRuntime.fetch (tests inject the vendor mock here). Defaults to the runtime's global fetch.

Explicit v2 composite-key rollout acknowledgement. Set only after every legacy writer sharing the store has been stopped and drained and legacy rows have been inventoried. Without it, an absent legacy key fails closed instead of racing an old writer that could still create a v1 record.

Store used when the manifest requires an idempotency key.

Organization allowlist applied to the manifest's declared hosts. A present value must be an object.

Required when the manifest declares rateLimit.

Refuse, at construction, any connector whose resolved egress posture is not 'enforced'. Pass it on a createConnector() call whose connector must not rely on a boundary outside ConnectorRuntime.fetch.

The construction gate reads this flag for truthiness and validates no value: a falsy one leaves the posture unrequired, which is what a caller passing false asks for. singleTenantConnectorPolicies() is stricter because it parses its options object through a schema, where the same field accepts the literal true alone.

Organization approval rules for write-class connector IDs.