@endora-commerce/mod-credentials 0.100.0

package/dist/backend/index.d.ts

@@ -0,0 +1,73 @@
+import type { FastifyRequest } from 'fastify';
+import type { EntityManager } from '@mikro-orm/postgresql';
+import type { CommandBus } from '@endora-commerce/platform/commands';
+import type { ModuleContext } from '@endora-commerce/platform/kernel';
+import type { RequireAdminFactory } from '@endora-commerce/platform/kernel';
+import type { ConfigurationTypeRegistry } from './services/configuration-type-registry.js';
+import { CredentialsService, type CredentialsSettingsPort } from './services/credentials.service.js';
+import { CredentialConfiguration } from './entities/credential-configuration.entity.js';
+/**
+ * `credentials` — the module three others read secrets through (feature 072,
+ * wave 1).
+ *
+ * `search`, `newsletter` and `prompt_actions` resolve `credentialsService` for
+ * the `credential_ref` path, so it is a **port**: a module reaching for a
+ * decrypted secret while `credentials` is absent gets an explicit 503 rather
+ * than a service that half-answers.
+ *
+ * One input stays with the composition root: **`adminContextResolver`** answers
+ * "who is this admin", which production and the harness resolve differently.
+ * That difference is exactly what the root exists to hold.
+ *
+ * The secret key is read from the environment here rather than threaded
+ * through two roots: it is configuration, and both roots were passing the same
+ * `process.env` lookup through identical spread expressions.
+ *
+ * **`configurationTypeRegistry` came home in T143a.** Both roots registered the
+ * name — importing this module's singleton to do it — and then pushed four
+ * descriptors into it, two of which are this module's own. Which configuration
+ * types exist is decided by which modules a deployment ships, but that is a
+ * statement about the *contributors*, not about the registry: each of them
+ * declares its own type from its own boot hook now, and the registry is
+ * declared here, by the module that owns the class.
+ *
+ * It is `ctx.di.register` rather than `ctx.di.providePort`, deliberately. A
+ * gated port throws `MODULE_DISABLED` on resolution, and the two other
+ * contributors resolve this name from `ctx.onBoot` — so gating it would turn
+ * "an operator switched `credentials` off" into "the platform does not boot".
+ * Nothing leaks by leaving it ungated: a descriptor is inert data, and the
+ * service that reads secrets out of it (`credentialsService`) is a port and
+ * does fail closed.
+ *
+ * The instance stays the process-wide singleton rather than becoming one per
+ * composition, because it is the documented extension seam an external or
+ * overlay module reaches through from an install hook, where no container is
+ * available (see `services/registry-singleton.ts`, and
+ * `test/integration/credentials/registry-extensibility.test.ts`, which is that
+ * path under test).
+ */
+export interface CredentialsCradle {
+    readonly emFactory: () => EntityManager;
+    readonly commandBus: CommandBus;
+    readonly requireAdmin: RequireAdminFactory;
+    readonly configurationTypeRegistry: ConfigurationTypeRegistry;
+    readonly credentialsSettingsPort: CredentialsSettingsPort | undefined;
+    readonly adminContextResolver: (req: FastifyRequest) => {
+        adminUserId: string;
+    };
+    readonly credentialsService: CredentialsService;
+}
+export declare function registerModule(ctx: ModuleContext): void;
+/**
+ * The module's persisted entity classes, on the `./backend` subpath, as one
+ * array and **no named class export** (D-168).
+ *
+ * This is the shape the platform reads when the package is *installed*: the
+ * boot-time loader (`src/packages/package-runtime.ts`, `exported['entities']`)
+ * and the static declaration reader (`scripts/lib/package-declarations.ts`),
+ * which is the third source of `check:module-boundary`'s `table→owner` map and
+ * the package pass of `check-entity-tenant-classification`. A missing array is
+ * answered with `[]` — zero entities registered, no error anywhere.
+ */
+export declare const entities: (typeof CredentialConfiguration)[];
+//# sourceMappingURL=index.d.ts.map

package/dist/backend/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/backend/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AAErE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAEtE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAE5E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2CAA2C,CAAC;AAI3F,OAAO,EACL,kBAAkB,EAClB,KAAK,uBAAuB,EAC7B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,aAAa,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,QAAQ,CAAC,yBAAyB,EAAE,yBAAyB,CAAC;IAC9D,QAAQ,CAAC,uBAAuB,EAAE,uBAAuB,GAAG,SAAS,CAAC;IACtE,QAAQ,CAAC,oBAAoB,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAChF,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;CACjD;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CAiEvD;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ,oCAEpB,CAAC"}

package/dist/backend/index.js

@@ -0,0 +1,80 @@
+import { lazyPort } from '@endora-commerce/platform/kernel';
+import { registerCredentialsAdminRoutes } from './routes.admin.js';
+import { configurationTypeRegistry } from './services/registry-singleton.js';
+import { llmConfigurationType } from './types/llm.type.js';
+import { emailAdapterConfigurationType } from './types/email-adapter.type.js';
+import { CredentialsService, } from './services/credentials.service.js';
+import { CredentialConfiguration } from './entities/credential-configuration.entity.js';
+export function registerModule(ctx) {
+    ctx.di.register({
+        configurationTypeRegistry: ctx
+            .asFunction(() => configurationTypeRegistry)
+            .singleton(),
+    });
+    ctx.di.providePort('credentialsService', ctx
+        .asFunction(({ emFactory, commandBus }) => {
+        const key = process.env['SETTINGS_SECRET_ENCRYPTION_KEY'];
+        // Read at construction, and that is a real constraint rather than an
+        // oversight — see `ALLOWED_CAPTURES` in check-port-dependencies.ts.
+        // A presence test cannot be deferred: `lazyPort` would hand back a
+        // proxy that is always defined, so the "omit the property" branch
+        // below could never be taken. Both roots register this port two lines
+        // before they resolve `credentialsService`, and that ordering is what
+        // makes the read work. It stops being load-bearing when `settings`
+        // converts and provides the port itself.
+        const settings = ctx.cradle().credentialsSettingsPort;
+        // Spread-built so an absent key or port is an **omitted** property
+        // rather than an explicit `undefined`, which `exactOptionalPropertyTypes`
+        // treats as a different thing.
+        return new CredentialsService({
+            emFactory,
+            commandBus,
+            registry: lazyPort(ctx, 'configurationTypeRegistry'),
+            ...(key === undefined ? {} : { secretEncryptionKey: key }),
+            ...(settings === undefined ? {} : { settings }),
+        });
+    })
+        .singleton());
+    /**
+     * This module's own two configuration types (T143a).
+     *
+     * `ctx.onBoot` rather than a registration: the registry is *read* — by the
+     * type catalogue endpoint and by every credential write — and a registration
+     * declares without resolving. Boot hooks run once every module has
+     * registered and before any request is served, so a type is in the catalogue
+     * from the first one.
+     */
+    ctx.onBoot(() => {
+        const registry = lazyPort(ctx, 'configurationTypeRegistry');
+        registry.register(llmConfigurationType);
+        registry.register(emailAdapterConfigurationType);
+    });
+    ctx.routes(async (app) => {
+        const { requireAdmin, adminContextResolver } = ctx.cradle();
+        await registerCredentialsAdminRoutes(app, {
+            // Lazily, even though the module owns this port: route *registration* runs
+            // inside `buildServer` whatever the module's effective state is, so
+            // destructuring the gate here would stop the next start instead of
+            // stopping the routes (D-40). The construction-time read of
+            // `credentialsSettingsPort` above is a different thing and stays.
+            service: lazyPort(ctx, 'credentialsService'),
+            requireAdmin,
+            resolveAdminContext: adminContextResolver,
+        });
+    });
+}
+/**
+ * The module's persisted entity classes, on the `./backend` subpath, as one
+ * array and **no named class export** (D-168).
+ *
+ * This is the shape the platform reads when the package is *installed*: the
+ * boot-time loader (`src/packages/package-runtime.ts`, `exported['entities']`)
+ * and the static declaration reader (`scripts/lib/package-declarations.ts`),
+ * which is the third source of `check:module-boundary`'s `table→owner` map and
+ * the package pass of `check-entity-tenant-classification`. A missing array is
+ * answered with `[]` — zero entities registered, no error anywhere.
+ */
+export const entities = [
+    CredentialConfiguration,
+];
+//# sourceMappingURL=index.js.map

package/dist/backend/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/backend/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAE5D,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAEnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,EACL,kBAAkB,GAEnB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAC;AAqDxF,MAAM,UAAU,cAAc,CAAC,GAAkB;IAC/C,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC;QACd,yBAAyB,EAAE,GAAG;aAC3B,UAAU,CAAC,GAA8B,EAAE,CAAC,yBAAyB,CAAC;aACtE,SAAS,EAAE;KACf,CAAC,CAAC;IAEH,GAAG,CAAC,EAAE,CAAC,WAAW,CAChB,oBAAoB,EACpB,GAAG;SACA,UAAU,CACT,CAAC,EAAE,SAAS,EAAE,UAAU,EAAqB,EAAE,EAAE;QAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;QAC1D,qEAAqE;QACrE,oEAAoE;QACpE,mEAAmE;QACnE,kEAAkE;QAClE,sEAAsE;QACtE,sEAAsE;QACtE,mEAAmE;QACnE,yCAAyC;QACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAqB,CAAC,uBAAuB,CAAC;QACzE,mEAAmE;QACnE,0EAA0E;QAC1E,+BAA+B;QAC/B,OAAO,IAAI,kBAAkB,CAAC;YAC5B,SAAS;YACT,UAAU;YACV,QAAQ,EAAE,QAAQ,CAA4B,GAAG,EAAE,2BAA2B,CAAC;YAC/E,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAAC;YAC1D,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;SACO,CAAC,CAAC;IAC5D,CAAC,CACF;SACA,SAAS,EAAE,CACf,CAAC;IAEF;;;;;;;;OAQG;IACH,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;QACd,MAAM,QAAQ,GAAG,QAAQ,CAA4B,GAAG,EAAE,2BAA2B,CAAC,CAAC;QACvF,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;QACxC,QAAQ,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACvB,MAAM,EAAE,YAAY,EAAE,oBAAoB,EAAE,GAAG,GAAG,CAAC,MAAM,EAAqB,CAAC;QAC/E,MAAM,8BAA8B,CAAC,GAAG,EAAE;YACxC,2EAA2E;YAC3E,oEAAoE;YACpE,mEAAmE;YACnE,4DAA4D;YAC5D,kEAAkE;YAClE,OAAO,EAAE,QAAQ,CAAqB,GAAG,EAAE,oBAAoB,CAAC;YAChE,YAAY;YACZ,mBAAmB,EAAE,oBAAoB;SAC1C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,uBAAuB;CACxB,CAAC"}

package/dist/backend/plugin.d.ts

@@ -0,0 +1,43 @@
+import type { FastifyInstance, FastifyRequest } from 'fastify';
+import type { EntityManager } from '@mikro-orm/postgresql';
+import type { CommandBus } from '@endora-commerce/platform/commands';
+import type { AuditPort } from '@endora-commerce/platform/kernel';
+import type { ConfigurationTypeRegistry } from './services/configuration-type-registry.js';
+import { CredentialsService, type CredentialsSettingsPort } from './services/credentials.service.js';
+import type { RequireAdminFactory } from '@endora-commerce/platform/kernel';
+/**
+ * Composition root for the credentials module — feature 058.
+ *
+ * The module owns a `credential_configurations` table and reads configuration
+ * types from the process-wide `ConfigurationTypeRegistry` (the cross-module
+ * extension seam). Core types (LLM, email adapter) are registered in
+ * `composition.ts` at boot (US1), never here.
+ */
+export type { CredentialsSettingsPort };
+export interface CredentialsModuleOptions {
+    emFactory: () => EntityManager;
+    /** The settings port backing the delete-integrity guard (Principle I, FR-012). */
+    settings?: CredentialsSettingsPort;
+    permissionService: {
+        hasPermission(adminUserId: string, permission: string): Promise<boolean>;
+    };
+    requireAdmin: RequireAdminFactory;
+    resolveAdminContext: (req: FastifyRequest) => {
+        adminUserId: string;
+    };
+    commandBus: CommandBus;
+    configurationTypeRegistry: ConfigurationTypeRegistry;
+    auditLogService?: AuditPort;
+    /** Base64 AES-256 key for secret fields; shared with settings (research §R4). */
+    secretEncryptionKey?: string;
+}
+export interface CredentialsModuleHandle {
+    configurationTypeRegistry: ConfigurationTypeRegistry;
+    service: CredentialsService;
+}
+export interface CredentialsModuleResult {
+    plugin: (app: FastifyInstance) => Promise<void>;
+    handle: CredentialsModuleHandle;
+}
+export declare function credentialsModule(options: CredentialsModuleOptions): CredentialsModuleResult;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/backend/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/backend/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EACL,kBAAkB,EAClB,KAAK,uBAAuB,EAC7B,MAAM,mCAAmC,CAAC;AAI3C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAE5E;;;;;;;GAOG;AAEH,YAAY,EAAE,uBAAuB,EAAE,CAAC;AAExC,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,aAAa,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,EAAE,uBAAuB,CAAC;IACnC,iBAAiB,EAAE;QACjB,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KAC1E,CAAC;IACF,YAAY,EAAE,mBAAmB,CAAC;IAClC,mBAAmB,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IACtE,UAAU,EAAE,UAAU,CAAC;IACvB,yBAAyB,EAAE,yBAAyB,CAAC;IACrD,eAAe,CAAC,EAAE,SAAS,CAAC;IAC5B,iFAAiF;IACjF,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,uBAAuB;IACtC,yBAAyB,EAAE,yBAAyB,CAAC;IACrD,OAAO,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,EAAE,uBAAuB,CAAC;CACjC;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,uBAAuB,CAsB5F"}

package/dist/backend/plugin.js

@@ -0,0 +1,25 @@
+import { CredentialsService, } from './services/credentials.service.js';
+import { registerCredentialsAdminRoutes, } from './routes.admin.js';
+export function credentialsModule(options) {
+    const service = new CredentialsService({
+        emFactory: options.emFactory,
+        commandBus: options.commandBus,
+        registry: options.configurationTypeRegistry,
+        secretEncryptionKey: options.secretEncryptionKey,
+        ...(options.settings ? { settings: options.settings } : {}),
+    });
+    return {
+        handle: {
+            configurationTypeRegistry: options.configurationTypeRegistry,
+            service,
+        },
+        plugin: async (app) => {
+            await registerCredentialsAdminRoutes(app, {
+                service,
+                requireAdmin: options.requireAdmin,
+                resolveAdminContext: options.resolveAdminContext,
+            });
+        },
+    };
+}
+//# sourceMappingURL=plugin.js.map

package/dist/backend/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/backend/plugin.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,kBAAkB,GAEnB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,8BAA8B,GAC/B,MAAM,mBAAmB,CAAC;AAwC3B,MAAM,UAAU,iBAAiB,CAAC,OAAiC;IACjE,MAAM,OAAO,GAAG,IAAI,kBAAkB,CAAC;QACrC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ,EAAE,OAAO,CAAC,yBAAyB;QAC3C,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,EAAE;YACN,yBAAyB,EAAE,OAAO,CAAC,yBAAyB;YAC5D,OAAO;SACR;QACD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACpB,MAAM,8BAA8B,CAAC,GAAG,EAAE;gBACxC,OAAO;gBACP,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;aACjD,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/backend/routes.admin.d.ts

@@ -0,0 +1,27 @@
+import type { FastifyInstance, FastifyRequest } from 'fastify';
+import type { CredentialsService } from './services/credentials.service.js';
+import type { RequireAdminFactory } from '@endora-commerce/platform/kernel';
+/**
+ * Admin HTTP surface for the credentials module — feature 058
+ * (contracts/admin-api.md).
+ *
+ *   GET    /api/v1/admin/credentials/types
+ *   GET    /api/v1/admin/credentials            (?type=)
+ *   GET    /api/v1/admin/credentials/:code
+ *   POST   /api/v1/admin/credentials
+ *   PUT    /api/v1/admin/credentials/:code
+ *   DELETE /api/v1/admin/credentials/:code
+ *   GET    /api/v1/admin/credentials/:code/preview
+ *
+ * Reads gated by `credentials:read`, writes by `credentials:write`. Secrets are
+ * masked on every read; only the server-side `resolve` (US2) decrypts.
+ */
+export interface CredentialsRoutesDeps {
+    service: CredentialsService;
+    requireAdmin: RequireAdminFactory;
+    resolveAdminContext: (req: FastifyRequest) => {
+        adminUserId: string;
+    };
+}
+export declare function registerCredentialsAdminRoutes(app: FastifyInstance, deps: CredentialsRoutesDeps): Promise<void>;
+//# sourceMappingURL=routes.admin.d.ts.map

package/dist/backend/routes.admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.admin.d.ts","sourceRoot":"","sources":["../../src/backend/routes.admin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAS/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAE5E;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,YAAY,EAAE,mBAAmB,CAAC;IAClC,mBAAmB,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;CACvE;AAED,wBAAsB,8BAA8B,CAClD,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAwEf"}

package/dist/backend/routes.admin.js

@@ -0,0 +1,50 @@
+import { ConfigurationListQuerySchema, CreateConfigurationSchema, ERROR_CODES, UpdateConfigurationSchema, } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+import { CREDENTIALS_READ_PERMISSION, CREDENTIALS_WRITE_PERMISSION } from '../manifest.js';
+export async function registerCredentialsAdminRoutes(app, deps) {
+    const { service, requireAdmin } = deps;
+    const readGuard = requireAdmin(CREDENTIALS_READ_PERMISSION);
+    const writeGuard = requireAdmin(CREDENTIALS_WRITE_PERMISSION);
+    app.get('/api/v1/admin/credentials/types', { preHandler: readGuard }, async () => ({
+        types: service.describeTypes(),
+    }));
+    app.get('/api/v1/admin/credentials', { preHandler: readGuard }, async (request) => {
+        const q = ConfigurationListQuerySchema.parse(request.query ?? {});
+        return { configurations: await service.list(q.type) };
+    });
+    app.get('/api/v1/admin/credentials/:code', { preHandler: readGuard }, async (request) => {
+        const dto = await service.getByCode(request.params.code);
+        if (!dto) {
+            throw new HttpError(404, ERROR_CODES.CREDENTIAL_NOT_FOUND, 'Configuration not found.');
+        }
+        return dto;
+    });
+    // Preview target for the settings-field preview button — same masked shape as
+    // GET /:code (documented separately in the contract, served identically).
+    app.get('/api/v1/admin/credentials/:code/preview', { preHandler: readGuard }, async (request) => {
+        const dto = await service.getByCode(request.params.code);
+        if (!dto) {
+            throw new HttpError(404, ERROR_CODES.CREDENTIAL_NOT_FOUND, 'Configuration not found.');
+        }
+        return dto;
+    });
+    app.post('/api/v1/admin/credentials', { preHandler: writeGuard }, async (request, reply) => {
+        const body = CreateConfigurationSchema.parse(request.body);
+        const dto = await service.create(body);
+        return reply.code(201).send(dto);
+    });
+    app.put('/api/v1/admin/credentials/:code', { preHandler: writeGuard }, async (request) => {
+        // `typeCode` / `providerCode` are immutable after create (edge case).
+        const raw = (request.body ?? {});
+        if ('typeCode' in raw || 'providerCode' in raw) {
+            throw new HttpError(422, ERROR_CODES.CREDENTIAL_TYPE_IMMUTABLE, 'The type and provider cannot be changed after creation — create a new configuration instead.');
+        }
+        const body = UpdateConfigurationSchema.parse(request.body);
+        return service.update(request.params.code, body);
+    });
+    app.delete('/api/v1/admin/credentials/:code', { preHandler: writeGuard }, async (request, reply) => {
+        await service.delete(request.params.code);
+        return reply.code(204).send();
+    });
+}
+//# sourceMappingURL=routes.admin.js.map

package/dist/backend/routes.admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.admin.js","sourceRoot":"","sources":["../../src/backend/routes.admin.ts"],"names":[],"mappings":"AACA,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,WAAW,EACX,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,2BAA2B,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AA0B3F,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,GAAoB,EACpB,IAA2B;IAE3B,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,SAAS,GAAG,YAAY,CAAC,2BAA2B,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,YAAY,CAAC,4BAA4B,CAAC,CAAC;IAE9D,GAAG,CAAC,GAAG,CAAC,iCAAiC,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QACjF,KAAK,EAAE,OAAO,CAAC,aAAa,EAAE;KAC/B,CAAC,CAAC,CAAC;IAEJ,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChF,MAAM,CAAC,GAAG,4BAA4B,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAClE,OAAO,EAAE,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CACL,iCAAiC,EACjC,EAAE,UAAU,EAAE,SAAS,EAAE,EACzB,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,oBAAoB,EAAE,0BAA0B,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CACF,CAAC;IAEF,8EAA8E;IAC9E,0EAA0E;IAC1E,GAAG,CAAC,GAAG,CACL,yCAAyC,EACzC,EAAE,UAAU,EAAE,SAAS,EAAE,EACzB,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,oBAAoB,EAAE,0BAA0B,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACzF,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CACL,iCAAiC,EACjC,EAAE,UAAU,EAAE,UAAU,EAAE,EAC1B,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,sEAAsE;QACtE,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QAC5D,IAAI,UAAU,IAAI,GAAG,IAAI,cAAc,IAAI,GAAG,EAAE,CAAC;YAC/C,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,yBAAyB,EACrC,8FAA8F,CAC/F,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3D,OAAO,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnD,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,MAAM,CACR,iCAAiC,EACjC,EAAE,UAAU,EAAE,UAAU,EAAE,EAC1B,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1C,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/backend/services/configuration-type-registry.d.ts

@@ -0,0 +1,105 @@
+import type { ConfigurationTypeDescriptor, ConfigurationTypeRegistryPort } from '@endora-commerce/contracts';
+/**
+ * ConfigurationTypeRegistry (feature 058) — in-memory map of configuration-type
+ * code → descriptor. This is the documented extension point by which the
+ * platform and other/overlay modules contribute configuration types WITHOUT
+ * editing the credentials core (Principle XIV / XV).
+ *
+ * Shape copied from the payment/shipping adapter-registry pattern
+ * (`payment_methods/services/payment-adapter-registry.ts`): `register` / `get` /
+ * `resolve` / `list`, last-writer-wins + warn on a duplicate code so a
+ * re-registration during a hot reload or re-enable does not throw.
+ *
+ * The credentials service reads a descriptor only to (a) render fields, (b)
+ * derive the write-validator, (c) know which fields are `secret`. It MUST NOT
+ * branch on a specific `code` / `providerCode` for business meaning — provider
+ * meaning lives with the consumer (Principle XIV).
+ *
+ * **The absent-contributor policy this registry states (issue #129): skip.**
+ * The push is ungated — a contributor declares its type from a boot hook, which
+ * runs whatever the module's effective state is, and gating the push would turn
+ * a deactivation into a permanently missing type — so the presence question is
+ * answered here, at enumeration, keyed on `descriptor.ownerModule`.
+ *
+ * A configuration type is a *surface*: it is what the credentials screen offers
+ * to configure and what a write is validated against, so a capability an
+ * operator switched off must not be on offer and must not be creatable
+ * (Principle XVII). `get`, `resolve`, `list` and `describe` therefore answer as
+ * if an absent contributor's type were not registered.
+ *
+ * `entry`, `ownerOf`, `isRegistered` and `listAll` deliberately do not filter.
+ * Switching a module off is not uninstalling it: the configurations an operator
+ * already stored keep their rows, so the paths that *render* one and the paths
+ * that redact one into an audit snapshot need the field shape whatever the
+ * contributor's state, and the admin surface needs the owner's id to say which
+ * module is off. Dropping the descriptor there would report a stored credential
+ * as having lost its type — the state `unregister` produces, and a different
+ * thing entirely.
+ *
+ * The probe is deliberately **tri-state**, and that is not a convenience: this
+ * registry is the seam an overlay or external module pushes a type through, so
+ * `ownerModule` may be a string no manifest declares. `isPresent` collapses
+ * "switched off" and "not a module" into one `false` — right for a gating seam,
+ * wrong here, where it would delete the extension point. `undefined` means the
+ * platform says nothing about that id, and the entry is honoured.
+ */
+export interface RegistryLogger {
+    warn(message: string): void;
+}
+/** Thrown by `resolve` when a type code is not registered (maps to 400). */
+export declare class ConfigurationTypeUnknown extends Error {
+    readonly name = "ConfigurationTypeUnknown";
+    readonly code: "CREDENTIAL_TYPE_UNKNOWN";
+    constructor(typeCode: string);
+}
+/**
+ * Whether the platform holds `moduleId` present. `undefined` when the id is not
+ * a module the platform knows anything about — see the class doc comment.
+ */
+export type ModulePresenceProbe = (moduleId: string) => boolean | undefined;
+/**
+ * `implements` the shape feature 075's Phase P published — the two integration
+ * modules read the published type, and `tsc` refuses the day a method here
+ * stops matching.
+ */
+export declare class ConfigurationTypeRegistry implements ConfigurationTypeRegistryPort {
+    private readonly log;
+    private readonly presenceOfModule;
+    private readonly types;
+    /**
+     * @param log         duplicate-code warnings.
+     * @param presenceOfModule the effective-state probe. Defaults to "the platform
+     *   says nothing", so a registry built for a unit test or a bare harness
+     *   behaves exactly as it did before this filter existed; the process
+     *   singleton wires it to the kernel's effective state.
+     */
+    constructor(log?: RegistryLogger, presenceOfModule?: ModulePresenceProbe);
+    register(descriptor: ConfigurationTypeDescriptor): void;
+    unregister(code: string): void;
+    /** Whether any module has contributed this code — presence-blind. */
+    isRegistered(code: string): boolean;
+    /** The contributed descriptor, presence-blind. Admin rendering and audit read this. */
+    entry(code: string): ConfigurationTypeDescriptor | undefined;
+    /** The module that contributed `code`, or `null` when nobody did. */
+    ownerOf(code: string): string | null;
+    /** Registered AND its contributor effectively present. */
+    isAvailable(code: string): boolean;
+    /** Every contributed descriptor, presence-blind (stable order of insertion). */
+    listAll(): ConfigurationTypeDescriptor[];
+    /** The descriptor, or `undefined` when unregistered or its contributor is absent. */
+    get(code: string): ConfigurationTypeDescriptor | undefined;
+    /**
+     * The descriptor, or a throw. An unregistered code is a client error and stays
+     * {@link ConfigurationTypeUnknown}; a registered one whose contributor is
+     * absent is the ordinary 503 envelope, so an operator is told which module is
+     * off rather than that a type they can see has become unknown.
+     */
+    resolve(code: string): ConfigurationTypeDescriptor;
+    /** Descriptors whose contributor is present (stable order of insertion). */
+    list(): ConfigurationTypeDescriptor[];
+    /** Admin-safe view powering `GET /api/v1/admin/credentials/types`. */
+    describe(): ConfigurationTypeDescriptor[];
+    /** Absent only when the platform knows the contributor and holds it off. */
+    private contributorAbsent;
+}
+//# sourceMappingURL=configuration-type-registry.d.ts.map

package/dist/backend/services/configuration-type-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration-type-registry.d.ts","sourceRoot":"","sources":["../../../src/backend/services/configuration-type-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,2BAA2B,EAC3B,6BAA6B,EAC9B,MAAM,4BAA4B,CAAC;AAIpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAMD,4EAA4E;AAC5E,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,SAAkB,IAAI,8BAA8B;IACpD,QAAQ,CAAC,IAAI,4BAAuC;gBACxC,QAAQ,EAAE,MAAM;CAG7B;AAED;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,GAAG,SAAS,CAAC;AAE5E;;;;GAIG;AACH,qBAAa,yBAA0B,YAAW,6BAA6B;IAW3E,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAXnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkD;IAExE;;;;;;OAMG;gBAEgB,GAAG,GAAE,cAA8B,EACnC,gBAAgB,GAAE,mBAAqC;IAG1E,QAAQ,CAAC,UAAU,EAAE,2BAA2B,GAAG,IAAI;IAmBvD,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAI9B,qEAAqE;IACrE,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAInC,uFAAuF;IACvF,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,2BAA2B,GAAG,SAAS;IAI5D,qEAAqE;IACrE,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAIpC,0DAA0D;IAC1D,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAKlC,gFAAgF;IAChF,OAAO,IAAI,2BAA2B,EAAE;IAIxC,qFAAqF;IACrF,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,2BAA2B,GAAG,SAAS;IAM1D;;;;;OAKG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,2BAA2B;IAWlD,4EAA4E;IAC5E,IAAI,IAAI,2BAA2B,EAAE;IAIrC,sEAAsE;IACtE,QAAQ,IAAI,2BAA2B,EAAE;IAIzC,4EAA4E;IAC5E,OAAO,CAAC,iBAAiB;CAG1B"}

package/dist/backend/services/configuration-type-registry.js

@@ -0,0 +1,111 @@
+import { ERROR_CODES } from '@endora-commerce/contracts';
+import { ModuleDisabledError } from '@endora-commerce/platform/kernel';
+const consoleLogger = {
+    warn: (message) => console.warn(message),
+};
+/** Thrown by `resolve` when a type code is not registered (maps to 400). */
+export class ConfigurationTypeUnknown extends Error {
+    name = 'ConfigurationTypeUnknown';
+    code = ERROR_CODES.CREDENTIAL_TYPE_UNKNOWN;
+    constructor(typeCode) {
+        super(`ConfigurationTypeRegistry: no configuration type registered for code "${typeCode}".`);
+    }
+}
+/**
+ * `implements` the shape feature 075's Phase P published — the two integration
+ * modules read the published type, and `tsc` refuses the day a method here
+ * stops matching.
+ */
+export class ConfigurationTypeRegistry {
+    log;
+    presenceOfModule;
+    types = new Map();
+    /**
+     * @param log         duplicate-code warnings.
+     * @param presenceOfModule the effective-state probe. Defaults to "the platform
+     *   says nothing", so a registry built for a unit test or a bare harness
+     *   behaves exactly as it did before this filter existed; the process
+     *   singleton wires it to the kernel's effective state.
+     */
+    constructor(log = consoleLogger, presenceOfModule = () => undefined) {
+        this.log = log;
+        this.presenceOfModule = presenceOfModule;
+    }
+    register(descriptor) {
+        const existing = this.types.get(descriptor.code);
+        // Re-registering the *same* descriptor overwrites nothing, so it warns
+        // about nothing. That distinction started to matter in T143a, when the four
+        // core registrations moved out of the composition roots and into the boot
+        // hooks of the modules that own the types: this registry is process-wide
+        // (it is the seam an overlay module's install hook imports), while a test
+        // run composes it several hundred times, so each of those hooks re-declares
+        // an identical descriptor once per composition. A genuine override — a
+        // different descriptor under a code someone already claimed — still warns.
+        if (existing === descriptor)
+            return;
+        if (existing !== undefined) {
+            this.log.warn(`ConfigurationTypeRegistry: type "${descriptor.code}" re-registered; overwriting previous registration.`);
+        }
+        this.types.set(descriptor.code, descriptor);
+    }
+    unregister(code) {
+        this.types.delete(code);
+    }
+    /** Whether any module has contributed this code — presence-blind. */
+    isRegistered(code) {
+        return this.types.has(code);
+    }
+    /** The contributed descriptor, presence-blind. Admin rendering and audit read this. */
+    entry(code) {
+        return this.types.get(code);
+    }
+    /** The module that contributed `code`, or `null` when nobody did. */
+    ownerOf(code) {
+        return this.types.get(code)?.ownerModule ?? null;
+    }
+    /** Registered AND its contributor effectively present. */
+    isAvailable(code) {
+        const descriptor = this.types.get(code);
+        return descriptor !== undefined && !this.contributorAbsent(descriptor);
+    }
+    /** Every contributed descriptor, presence-blind (stable order of insertion). */
+    listAll() {
+        return [...this.types.values()];
+    }
+    /** The descriptor, or `undefined` when unregistered or its contributor is absent. */
+    get(code) {
+        const descriptor = this.types.get(code);
+        if (!descriptor || this.contributorAbsent(descriptor))
+            return undefined;
+        return descriptor;
+    }
+    /**
+     * The descriptor, or a throw. An unregistered code is a client error and stays
+     * {@link ConfigurationTypeUnknown}; a registered one whose contributor is
+     * absent is the ordinary 503 envelope, so an operator is told which module is
+     * off rather than that a type they can see has become unknown.
+     */
+    resolve(code) {
+        const descriptor = this.types.get(code);
+        if (!descriptor) {
+            throw new ConfigurationTypeUnknown(code);
+        }
+        if (this.contributorAbsent(descriptor)) {
+            throw new ModuleDisabledError(descriptor.ownerModule);
+        }
+        return descriptor;
+    }
+    /** Descriptors whose contributor is present (stable order of insertion). */
+    list() {
+        return this.listAll().filter((descriptor) => !this.contributorAbsent(descriptor));
+    }
+    /** Admin-safe view powering `GET /api/v1/admin/credentials/types`. */
+    describe() {
+        return this.list();
+    }
+    /** Absent only when the platform knows the contributor and holds it off. */
+    contributorAbsent(descriptor) {
+        return this.presenceOfModule(descriptor.ownerModule) === false;
+    }
+}
+//# sourceMappingURL=configuration-type-registry.js.map

package/dist/backend/services/configuration-type-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration-type-registry.js","sourceRoot":"","sources":["../../../src/backend/services/configuration-type-registry.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAmDvE,MAAM,aAAa,GAAmB;IACpC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;CACzC,CAAC;AAEF,4EAA4E;AAC5E,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAC/B,IAAI,GAAG,0BAA0B,CAAC;IAC3C,IAAI,GAAG,WAAW,CAAC,uBAAuB,CAAC;IACpD,YAAY,QAAgB;QAC1B,KAAK,CAAC,yEAAyE,QAAQ,IAAI,CAAC,CAAC;IAC/F,CAAC;CACF;AAQD;;;;GAIG;AACH,MAAM,OAAO,yBAAyB;IAWjB;IACA;IAXF,KAAK,GAAG,IAAI,GAAG,EAAuC,CAAC;IAExE;;;;;;OAMG;IACH,YACmB,MAAsB,aAAa,EACnC,mBAAwC,GAAG,EAAE,CAAC,SAAS;QADvD,QAAG,GAAH,GAAG,CAAgC;QACnC,qBAAgB,GAAhB,gBAAgB,CAAuC;IACvE,CAAC;IAEJ,QAAQ,CAAC,UAAuC;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACjD,uEAAuE;QACvE,4EAA4E;QAC5E,0EAA0E;QAC1E,yEAAyE;QACzE,0EAA0E;QAC1E,4EAA4E;QAC5E,uEAAuE;QACvE,2EAA2E;QAC3E,IAAI,QAAQ,KAAK,UAAU;YAAE,OAAO;QACpC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,CAAC,IAAI,CACX,oCAAoC,UAAU,CAAC,IAAI,qDAAqD,CACzG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC9C,CAAC;IAED,UAAU,CAAC,IAAY;QACrB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,qEAAqE;IACrE,YAAY,CAAC,IAAY;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,uFAAuF;IACvF,KAAK,CAAC,IAAY;QAChB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,qEAAqE;IACrE,OAAO,CAAC,IAAY;QAClB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,IAAI,IAAI,CAAC;IACnD,CAAC;IAED,0DAA0D;IAC1D,WAAW,CAAC,IAAY;QACtB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,UAAU,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACzE,CAAC;IAED,gFAAgF;IAChF,OAAO;QACL,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAClC,CAAC;IAED,qFAAqF;IACrF,GAAG,CAAC,IAAY;QACd,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC;YAAE,OAAO,SAAS,CAAC;QACxE,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,IAAY;QAClB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,mBAAmB,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,4EAA4E;IAC5E,IAAI;QACF,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;IACpF,CAAC;IAED,sEAAsE;IACtE,QAAQ;QACN,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;IAED,4EAA4E;IACpE,iBAAiB,CAAC,UAAuC;QAC/D,OAAO,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,KAAK,CAAC;IACjE,CAAC;CACF"}

package/dist/backend/services/credentials.service.d.ts

@@ -0,0 +1,63 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import { type ConfigurationDto, type ConfigurationReference, type ConfigurationTypeDescriptor, type CreateConfiguration, type ResolveResult, type UpdateConfiguration } from '@endora-commerce/contracts';
+import type { CommandBus } from '@endora-commerce/platform/commands';
+import type { ConfigurationTypeRegistry } from './configuration-type-registry.js';
+/**
+ * Narrow settings port — the ONLY channel through which credentials reaches the
+ * settings module (Principle I). Backs the delete-integrity lookup (FR-012).
+ */
+export interface CredentialsSettingsPort {
+    listReferencesToConfiguration(configurationCode: string): Promise<ConfigurationReference[]>;
+}
+/**
+ * CredentialsService (feature 058) — the module's read + orchestration surface.
+ *
+ * All writes go through the Command Bus (Principle XIII); every read returns a
+ * MASKED DTO (secrets never leave as plaintext, SC-003 / FR-005). A configuration
+ * whose `typeCode` is no longer registered is surfaced `inert` (read-only,
+ * FR-016).
+ *
+ * Principle XIV — the core is type-agnostic: it reads a descriptor ONLY to
+ * render fields, derive the write-validator, and learn which fields are
+ * `secret`. It MUST NOT branch on a specific `typeCode`/`providerCode` for
+ * business meaning (provider meaning lives with the consumer). This invariant
+ * is grep-asserted in `test/integration/credentials/registry-extensibility.test.ts`.
+ */
+export interface CredentialsServiceDeps {
+    emFactory: () => EntityManager;
+    commandBus: CommandBus;
+    registry: ConfigurationTypeRegistry;
+    secretEncryptionKey: string | undefined;
+    /** Wired in US2 — backs the delete-integrity guard (FR-012). */
+    settings?: CredentialsSettingsPort;
+}
+export declare class CredentialsService {
+    private readonly deps;
+    constructor(deps: CredentialsServiceDeps);
+    /** Registered configuration types powering the admin type picker + form. */
+    describeTypes(): ConfigurationTypeDescriptor[];
+    list(typeFilter?: string): Promise<ConfigurationDto[]>;
+    getByCode(code: string): Promise<ConfigurationDto | null>;
+    create(data: CreateConfiguration): Promise<ConfigurationDto>;
+    update(code: string, data: UpdateConfiguration): Promise<ConfigurationDto>;
+    delete(code: string): Promise<void>;
+    /**
+     * Server-side resolution (feature 058 US2) — the single path that returns
+     * DECRYPTED secret values, for a consumer's in-memory use only. Never exposed
+     * over HTTP. Fails closed: an unset reference is `not_configured`; a
+     * deleted/inert one is `unavailable` — never a foreign configuration
+     * (FR-012 / SC-005).
+     */
+    resolve(configurationCode: string): Promise<ResolveResult>;
+    /**
+     * Map an entity to a masked DTO, marking unregistered-type rows as inert.
+     *
+     * The registry's **diagnostic** read (issue #129): a stored configuration
+     * whose contributing module is merely switched off keeps its label and its
+     * field shape, because deactivation drops no data and an inert row would say
+     * the type is gone. `resolve` above stays on the acting read, so nothing
+     * decrypted leaves for the same configuration.
+     */
+    private toDto;
+}
+//# sourceMappingURL=credentials.service.d.ts.map

package/dist/backend/services/credentials.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.service.d.ts","sourceRoot":"","sources":["../../../src/backend/services/credentials.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,2BAA2B,EAChC,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AAGrE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAOlF;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,6BAA6B,CAAC,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC;CAC7F;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,aAAa,CAAC;IAC/B,UAAU,EAAE,UAAU,CAAC;IACvB,QAAQ,EAAE,yBAAyB,CAAC;IACpC,mBAAmB,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,gEAAgE;IAChE,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC;AAED,qBAAa,kBAAkB;IACjB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,sBAAsB;IAEzD,4EAA4E;IAC5E,aAAa,IAAI,2BAA2B,EAAE;IAIxC,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAOtD,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAMzD,MAAM,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAW5D,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAY1E,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBzC;;;;;;OAMG;IACG,OAAO,CAAC,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAgChE;;;;;;;;OAQG;IACH,OAAO,CAAC,KAAK;CAoBd"}