@grantjs/schema 1.16.1 → 1.18.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@grantjs/schema",
-  "version": "1.16.1",
+  "version": "1.18.0",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/events/event-catalog.ts

@@ -83,6 +83,17 @@ const INTEGRATIONS_OWNERS: EventCatalogEntry = {
   audienceRule: { primitives: ['owners'], excludeActor: true },
 };
 
+/**
+ * An event that exists for webhook consumers only: delivered transactionally to
+ * subscriptions, never turned into a notification. The empty audience is what
+ * keeps the notification generator from creating rows for it.
+ */
+const webhookOnly = (category: EventCategory): EventCatalogEntry => ({
+  category,
+  deliveryClass: 'transactional',
+  audienceRule: { primitives: [] },
+});
+
 export const EVENT_TYPES = [
   // IAM mutations (Phase 1 slice)
   'role.created',
@@ -135,6 +146,17 @@ export const EVENT_TYPES = [
   // CDM / project sync job summaries (entity events suppressed during import)
   'project_sync.completed',
   'project_sync.failed',
+  // Webhook-only lifecycle events (no notification): users, project users, API keys, tags
+  'user.created',
+  'user.updated',
+  'user.deleted',
+  'project.user_updated',
+  'api_key.deleted',
+  'tag.created',
+  'tag.updated',
+  'tag.deleted',
+  'tag.linked',
+  'tag.unlinked',
 ] as const;
 
 export type EventType = (typeof EVENT_TYPES)[number];
@@ -200,6 +222,16 @@ export const EVENT_CATALOG: Readonly<Record<EventType, EventCatalogEntry>> = {
   'user.password_changed': SECURITY_SUBJECT,
   'project_sync.completed': INTEGRATIONS_OWNERS,
   'project_sync.failed': INTEGRATIONS_OWNERS,
+  'user.created': webhookOnly('membership'),
+  'user.updated': webhookOnly('membership'),
+  'user.deleted': webhookOnly('membership'),
+  'project.user_updated': webhookOnly('membership'),
+  'api_key.deleted': webhookOnly('security'),
+  'tag.created': webhookOnly('iam'),
+  'tag.updated': webhookOnly('iam'),
+  'tag.deleted': webhookOnly('iam'),
+  'tag.linked': webhookOnly('iam'),
+  'tag.unlinked': webhookOnly('iam'),
 };
 
 export function getEventCatalogEntry(type: EventType): EventCatalogEntry {

package/src/events/event-envelope.ts

@@ -33,6 +33,13 @@ export interface DomainEventInput {
   aggregate?: EventAggregateRef;
   data: EventData;
   occurredAt?: Date;
+  /**
+   * Projects this event is relevant to beyond the one named by its scope. The
+   * publisher adds the projects an entity-bound aggregate is linked to; a caller
+   * passes it only to capture the links before a write that destroys them (a
+   * delete). Never part of the external envelope.
+   */
+  projectIds?: string[];
 }
 
 /**
@@ -51,6 +58,11 @@ export interface DomainEvent {
   aggregate?: EventAggregateRef;
   data: EventData;
   occurredAt: Date;
+  /**
+   * Projects the event is relevant to in addition to the project its scope names
+   * (webhook fan-out, ADR 0012). Internal: not carried by the webhook envelope.
+   */
+  projectIds?: string[];
 }
 
 /**
@@ -68,6 +80,14 @@ export interface CloudEventEnvelope {
   grantsequence: string;
   grantscope: { tenant: string; id: string };
   grantactor?: { userId: string } | null;
+  /**
+   * The user the event is about, when it has one (`user.role_revoked`,
+   * `project.user_removed`, `organization.invitation_sent`, ...). `null` when
+   * the event has no subject user. Needed because the internal `before`
+   * snapshot is dropped from external `data`, so revoke/remove events would
+   * otherwise not say whose access changed.
+   */
+  grantsubjectuser?: { userId: string } | null;
   grantcategory: EventCategory;
   data: EventData;
 }

package/src/generated/graphql.ts

@@ -583,6 +583,14 @@ export type MyUserDataExportQuery = {
       lastUsedAt: Date | null;
       createdAt: Date;
     }>;
+    credentials: Array<{
+      scope: string;
+      projectId: string | null;
+      source: string;
+      lastUsedAt: Date | null;
+      createdAt: Date;
+      updatedAt: Date;
+    }>;
     sessions: Array<{
       userAgent: string | null;
       ipAddress: string | null;
@@ -4520,6 +4528,21 @@ export const MyUserDataExportDocument = {
                     ],
                   },
                 },
+                {
+                  kind: 'Field',
+                  name: { kind: 'Name', value: 'credentials' },
+                  selectionSet: {
+                    kind: 'SelectionSet',
+                    selections: [
+                      { kind: 'Field', name: { kind: 'Name', value: 'scope' } },
+                      { kind: 'Field', name: { kind: 'Name', value: 'projectId' } },
+                      { kind: 'Field', name: { kind: 'Name', value: 'source' } },
+                      { kind: 'Field', name: { kind: 'Name', value: 'lastUsedAt' } },
+                      { kind: 'Field', name: { kind: 'Name', value: 'createdAt' } },
+                      { kind: 'Field', name: { kind: 'Name', value: 'updatedAt' } },
+                    ],
+                  },
+                },
                 {
                   kind: 'Field',
                   name: { kind: 'Name', value: 'sessions' },

package/src/generated/resolvers.ts

@@ -270,6 +270,7 @@ export type ResolversTypes = ResolversObject<{
   CreateUserInput: Types.CreateUserInput;
   CreateUserSessionInput: Types.CreateUserSessionInput;
   CreateWebhookSubscriptionMutationInput: Types.CreateWebhookSubscriptionMutationInput;
+  CredentialExportData: ResolverTypeWrapper<Types.CredentialExportData>;
   Date: ResolverTypeWrapper<Types.Scalars['Date']['output']>;
   DeleteApiKeyInput: Types.DeleteApiKeyInput;
   DeleteMyAccountsInput: Types.DeleteMyAccountsInput;
@@ -680,6 +681,7 @@ export type ResolversParentTypes = ResolversObject<{
   CreateUserInput: Types.CreateUserInput;
   CreateUserSessionInput: Types.CreateUserSessionInput;
   CreateWebhookSubscriptionMutationInput: Types.CreateWebhookSubscriptionMutationInput;
+  CredentialExportData: Types.CredentialExportData;
   Date: Types.Scalars['Date']['output'];
   DeleteApiKeyInput: Types.DeleteApiKeyInput;
   DeleteMyAccountsInput: Types.DeleteMyAccountsInput;
@@ -1295,6 +1297,19 @@ export type CreateProjectAppResultResolvers<
   signUpRoleId?: Resolver<Types.Maybe<ResolversTypes['ID']>, ParentType, ContextType>;
 }>;
 
+export type CredentialExportDataResolvers<
+  ContextType = any,
+  ParentType extends ResolversParentTypes['CredentialExportData'] =
+    ResolversParentTypes['CredentialExportData'],
+> = ResolversObject<{
+  createdAt?: Resolver<ResolversTypes['Date'], ParentType, ContextType>;
+  lastUsedAt?: Resolver<Types.Maybe<ResolversTypes['Date']>, ParentType, ContextType>;
+  projectId?: Resolver<Types.Maybe<ResolversTypes['ID']>, ParentType, ContextType>;
+  scope?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
+  source?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
+  updatedAt?: Resolver<ResolversTypes['Date'], ParentType, ContextType>;
+}>;
+
 export interface DateScalarConfig extends GraphQLScalarTypeConfig<ResolversTypes['Date'], any> {
   name: 'Date';
 }
@@ -3469,6 +3484,7 @@ export type UserDataExportResolvers<
     ParentType,
     ContextType
   >;
+  credentials?: Resolver<Array<ResolversTypes['CredentialExportData']>, ParentType, ContextType>;
   exportedAt?: Resolver<ResolversTypes['Date'], ParentType, ContextType>;
   organizationMemberships?: Resolver<
     Array<ResolversTypes['OrganizationMembershipExportData']>,
@@ -3736,6 +3752,7 @@ export type Resolvers<ContextType = any> = ResolversObject<{
   CreateApiKeyResult?: CreateApiKeyResultResolvers<ContextType>;
   CreateMySecondaryAccountResult?: CreateMySecondaryAccountResultResolvers<ContextType>;
   CreateProjectAppResult?: CreateProjectAppResultResolvers<ContextType>;
+  CredentialExportData?: CredentialExportDataResolvers<ContextType>;
   Date?: GraphQLScalarType;
   ExchangeApiKeyResult?: ExchangeApiKeyResultResolvers<ContextType>;
   Group?: GroupResolvers<ContextType>;

package/src/generated/schema-types.ts

@@ -448,8 +448,8 @@ export enum CdmIfMissing {
 export type CdmKeyResolverInput = {
   /**
    * `id` references an existing Grant user id. `email` resolves or creates a
-   * global email authentication method, passwordless unless the user carries a
-   * `password`. Other values are treated as CDM-local external keys for project
+   * global email authentication method, passwordless on the platform; a `password`
+   * becomes a credential of the importing project only. Other values are treated as CDM-local external keys for project
    * import/export.
    */
   findBy?: InputMaybe<CdmFindBy>;
@@ -489,8 +489,8 @@ export enum CdmPasswordAlgorithm {
 }
 
 /**
- * A password hash the importer already holds, to be stored as the user's email
- * password credential (ADR 0010). Never the plaintext password.
+ * A password hash the importer already holds, to be stored as the importing project's
+ * password credential (ADR 0011). Never the plaintext password.
  */
 export type CdmPasswordInput = {
   algorithm: CdmPasswordAlgorithm;
@@ -677,7 +677,7 @@ export type CreatePermissionInput = {
 export type CreateProjectAppInput = {
   /** Allow new users to sign up when authenticating via this app. Default true. */
   allowSignUp?: InputMaybe<Scalars['Boolean']['input']>;
-  /** Auth providers enabled for this app (e.g. github, email). Empty/null = all configured providers. */
+  /** Auth providers enabled for this app: `email` (magic link), `github`, `google` and `password` (email and password, checked against the project's own credential). Empty/null = every provider except `password`, which is opt-in and is on only when named here. */
   enabledProviders?: InputMaybe<Array<Scalars['String']['input']>>;
   name?: InputMaybe<Scalars['String']['input']>;
   primaryTagId?: InputMaybe<Scalars['ID']['input']>;
@@ -699,7 +699,7 @@ export type CreateProjectAppResult = {
   /** Shown only once at creation. Null for public clients. */
   clientSecret?: Maybe<Scalars['String']['output']>;
   createdAt: Scalars['Date']['output'];
-  /** Auth providers enabled for this app (e.g. github, email). Empty/null = all configured providers. */
+  /** Auth providers enabled for this app: `email` (magic link), `github`, `google` and `password` (email and password, checked against the project's own credential). Empty/null = every provider except `password`, which is opt-in and is on only when named here. */
   enabledProviders?: Maybe<Array<Scalars['String']['output']>>;
   id: Scalars['ID']['output'];
   name?: Maybe<Scalars['String']['output']>;
@@ -787,6 +787,22 @@ export type CreateWebhookSubscriptionMutationInput = {
   url: Scalars['String']['input'];
 };
 
+/**
+ * A password credential the user holds, per scope. Existence, scope, source and dates only:
+ * the hash is never exported.
+ */
+export type CredentialExportData = {
+  __typename?: 'CredentialExportData';
+  createdAt: Scalars['Date']['output'];
+  lastUsedAt?: Maybe<Scalars['Date']['output']>;
+  /** Set for a project credential */
+  projectId?: Maybe<Scalars['ID']['output']>;
+  /** platform (the Grant console) or project (that project's apps) */
+  scope: Scalars['String']['output'];
+  source: Scalars['String']['output'];
+  updatedAt: Scalars['Date']['output'];
+};
+
 export type DeleteApiKeyInput = {
   hardDelete?: InputMaybe<Scalars['Boolean']['input']>;
   id: Scalars['ID']['input'];
@@ -2185,7 +2201,7 @@ export type ProjectApp = Auditable & {
   clientId: Scalars['String']['output'];
   createdAt: Scalars['Date']['output'];
   deletedAt?: Maybe<Scalars['Date']['output']>;
-  /** Auth providers enabled for this app (e.g. github, email). Empty/null = all configured providers. */
+  /** Auth providers enabled for this app: `email` (magic link), `github`, `google` and `password` (email and password, checked against the project's own credential). Empty/null = every provider except `password`, which is opt-in and is on only when named here. */
   enabledProviders?: Maybe<Array<Scalars['String']['output']>>;
   id: Scalars['ID']['output'];
   name?: Maybe<Scalars['String']['output']>;
@@ -3617,20 +3633,24 @@ export type SyncProjectResult = {
   groupTagsLinked: Scalars['Int']['output'];
   groupsCreated: Scalars['Int']['output'];
   importId?: Maybe<Scalars['String']['output']>;
-  /** Users whose `password` hash was stored as their email credential for the first time. */
+  /**
+   * Users whose `password` hash was stored as the importing project's credential for the
+   * first time.
+   */
   passwordsImported: Scalars['Int']['output'];
   /**
-   * Users whose `password` hash was not stored because the credential or the identity is
-   * not the import's to write: a password set in Grant, an address the owner has verified,
-   * or an identity that already existed and was not created by an earlier import of this
-   * project.
+   * Users whose project credential was not written because the person owns it: it was set or
+   * reset in Grant, not imported.
    */
   passwordsSkippedExisting: Scalars['Int']['output'];
-  /** Users whose imported credential already equalled the hash in the document. */
+  /**
+   * Users whose project credential, stored by an earlier import of this project, already
+   * equalled the hash in the document.
+   */
   passwordsUnchanged: Scalars['Int']['output'];
   /**
-   * Users whose imported credential was replaced because the document carried a different
-   * hash for it.
+   * Users whose project credential was replaced because an earlier import of this project had
+   * stored a different hash.
    */
   passwordsUpdated: Scalars['Int']['output'];
   permissionsCreated: Scalars['Int']['output'];
@@ -3830,7 +3850,7 @@ export type UpdatePermissionTagInput = {
 export type UpdateProjectAppInput = {
   /** Allow new users to sign up when authenticating via this app. */
   allowSignUp?: InputMaybe<Scalars['Boolean']['input']>;
-  /** Auth providers enabled for this app (e.g. github, email). Empty/null = all configured providers. */
+  /** Auth providers enabled for this app: `email` (magic link), `github`, `google` and `password` (email and password, checked against the project's own credential). Empty/null = every provider except `password`, which is opt-in and is on only when named here. */
   enabledProviders?: InputMaybe<Array<Scalars['String']['input']>>;
   /** Display name for the app. */
   name?: InputMaybe<Scalars['String']['input']>;
@@ -4137,19 +4157,22 @@ export type UserCdmInput = {
   metadata?: InputMaybe<Scalars['JSON']['input']>;
   name: Scalars['String']['input'];
   /**
-   * Existing password credential to import for this user. Only valid with
-   * `key.findBy: email`, because the credential lives on the email authentication
-   * method; any other resolver is a validation error.
+   * Existing password credential to import for this user as a credential of the importing
+   * project only. Only valid with `key.findBy: email`, because the person is resolved by
+   * address; any other resolver is a validation error.
+   *
+   * The person must be a member of the project after the import: assigned in the same
+   * document (`roles`, `groups` or `permissions`) or already a member. A password for anyone
+   * else is a validation error raised when the import is applied, which rolls the import back
+   * and names the position in `users`.
    *
-   * Ownership is forward-only. An imported credential is marked as imported and stays
-   * owned by the importing system while the email is unverified: a later import of this
-   * project with a different hash replaces it, an identical one changes nothing. Once the
-   * owner verifies the address, or the password is set, changed or reset in Grant, Grant owns
-   * it and imports never touch it again. A credential is written only for an identity the
-   * import creates, or one an earlier import of this project created whose email is still
-   * unverified; any other existing identity, including one found through GitHub or Google,
-   * is left untouched. An absent `password` never removes a
-   * stored credential. See `SyncProjectResult` for the counters.
+   * Ownership is forward-only. An imported credential is marked as imported and stays owned
+   * by the importing system until the person resets or changes it: a later import of this
+   * project with a different hash replaces it, an identical one changes nothing. Once it is
+   * set, changed or reset in Grant, Grant owns it and imports never touch it again. Verified
+   * and GitHub or Google linked identities are not excluded: the credential opens this
+   * project's apps only. An absent `password` never removes a stored credential. See
+   * `SyncProjectResult` for the counters.
    */
   password?: InputMaybe<CdmPasswordInput>;
   /** Direct user → permission grants (document keys or catalog `resourceSlug:action` refs). */
@@ -4166,6 +4189,7 @@ export type UserDataExport = {
   __typename?: 'UserDataExport';
   accounts: Array<AccountExportData>;
   authenticationMethods: Array<AuthenticationMethodExportData>;
+  credentials: Array<CredentialExportData>;
   exportedAt: Scalars['Date']['output'];
   organizationMemberships: Array<OrganizationMembershipExportData>;
   projectMemberships: Array<ProjectMembershipExportData>;

package/src/index.ts

@@ -13,5 +13,6 @@ export {
   type ProjectConsentInfoUser,
   type ProjectConsentRedirectResult,
   type ProjectOAuthThemeMode,
+  type ProjectPasswordSignInResult,
 } from './project-oauth.types';
 export * from './webhooks/webhook.types';

package/src/operations/me/my-user-data-export.graphql

@@ -21,6 +21,14 @@ query MyUserDataExport {
       lastUsedAt
       createdAt
     }
+    credentials {
+      scope
+      projectId
+      source
+      lastUsedAt
+      createdAt
+      updatedAt
+    }
     sessions {
       userAgent
       ipAddress

package/src/project-oauth.types.ts

@@ -62,3 +62,10 @@ export interface ProjectConsentInfo {
 export interface ProjectConsentRedirectResult {
   redirectUrl: string;
 }
+
+/**
+ * Response from POST /api/auth/project/password: the consent page to continue to, or a
+ * pending MFA step when the platform requires MFA at sign-in (ADR 0011 slice 4).
+ */
+export type ProjectPasswordSignInResult =
+  { status: 'authenticated'; redirectUrl: string } | { status: 'mfa_required'; mfaToken: string };

package/src/schema/project-apps/inputs/create-project-app.graphql

@@ -10,7 +10,7 @@ input CreateProjectAppInput {
   """
   scopes: [String!]
   """
-  Auth providers enabled for this app (e.g. github, email). Empty/null = all configured providers.
+  Auth providers enabled for this app: `email` (magic link), `github`, `google` and `password` (email and password, checked against the project's own credential). Empty/null = every provider except `password`, which is opt-in and is on only when named here.
   """
   enabledProviders: [String!]
   """

package/src/schema/project-apps/inputs/update-project-app.graphql

@@ -25,7 +25,7 @@ input UpdateProjectAppInput {
   """
   scopes: [String!]
   """
-  Auth providers enabled for this app (e.g. github, email). Empty/null = all configured providers.
+  Auth providers enabled for this app: `email` (magic link), `github`, `google` and `password` (email and password, checked against the project's own credential). Empty/null = every provider except `password`, which is opt-in and is on only when named here.
   """
   enabledProviders: [String!]
   """

package/src/schema/project-apps/types/create-project-app-result.graphql

@@ -8,7 +8,7 @@ type CreateProjectAppResult {
   name: String
   redirectUris: [String!]!
   """
-  Auth providers enabled for this app (e.g. github, email). Empty/null = all configured providers.
+  Auth providers enabled for this app: `email` (magic link), `github`, `google` and `password` (email and password, checked against the project's own credential). Empty/null = every provider except `password`, which is opt-in and is on only when named here.
   """
   enabledProviders: [String!]
   """

package/src/schema/project-apps/types/project-app.graphql

@@ -19,7 +19,7 @@ type ProjectApp implements Auditable {
   redirectUris: [String!]!
   scopes: [String!]
   """
-  Auth providers enabled for this app (e.g. github, email). Empty/null = all configured providers.
+  Auth providers enabled for this app: `email` (magic link), `github`, `google` and `password` (email and password, checked against the project's own credential). Empty/null = every provider except `password`, which is opt-in and is on only when named here.
   """
   enabledProviders: [String!]
   """

package/src/schema/projects/inputs/sync-project-cdm.graphql

@@ -47,8 +47,8 @@ input CdmKeyResolverInput {
   value: String!
   """
   `id` references an existing Grant user id. `email` resolves or creates a
-  global email authentication method, passwordless unless the user carries a
-  `password`. Other values are treated as CDM-local external keys for project
+  global email authentication method, passwordless on the platform; a `password`
+  becomes a credential of the importing project only. Other values are treated as CDM-local external keys for project
   import/export.
   """
   findBy: CdmFindBy
@@ -138,8 +138,8 @@ input UserApiKeyCdmInput {
 }
 
 """
-A password hash the importer already holds, to be stored as the user's email
-password credential (ADR 0010). Never the plaintext password.
+A password hash the importer already holds, to be stored as the importing project's
+password credential (ADR 0011). Never the plaintext password.
 """
 input CdmPasswordInput {
   algorithm: CdmPasswordAlgorithm!
@@ -173,19 +173,22 @@ input UserCdmInput {
   primaryTag: String
   apiKeys: [UserApiKeyCdmInput!]
   """
-  Existing password credential to import for this user. Only valid with
-  `key.findBy: email`, because the credential lives on the email authentication
-  method; any other resolver is a validation error.
-
-  Ownership is forward-only. An imported credential is marked as imported and stays
-  owned by the importing system while the email is unverified: a later import of this
-  project with a different hash replaces it, an identical one changes nothing. Once the
-  owner verifies the address, or the password is set, changed or reset in Grant, Grant owns
-  it and imports never touch it again. A credential is written only for an identity the
-  import creates, or one an earlier import of this project created whose email is still
-  unverified; any other existing identity, including one found through GitHub or Google,
-  is left untouched. An absent `password` never removes a
-  stored credential. See `SyncProjectResult` for the counters.
+  Existing password credential to import for this user as a credential of the importing
+  project only. Only valid with `key.findBy: email`, because the person is resolved by
+  address; any other resolver is a validation error.
+
+  The person must be a member of the project after the import: assigned in the same
+  document (`roles`, `groups` or `permissions`) or already a member. A password for anyone
+  else is a validation error raised when the import is applied, which rolls the import back
+  and names the position in `users`.
+
+  Ownership is forward-only. An imported credential is marked as imported and stays owned
+  by the importing system until the person resets or changes it: a later import of this
+  project with a different hash replaces it, an identical one changes nothing. Once it is
+  set, changed or reset in Grant, Grant owns it and imports never touch it again. Verified
+  and GitHub or Google linked identities are not excluded: the credential opens this
+  project's apps only. An absent `password` never removes a stored credential. See
+  `SyncProjectResult` for the counters.
   """
   password: CdmPasswordInput
   """

package/src/schema/projects/types/sync-project-result.graphql

@@ -17,23 +17,23 @@ type SyncProjectResult {
   userRolesAssigned: Int!
   projectUserApiKeysCreated: Int!
   """
-  Users whose `password` hash was stored as their email credential for the first time.
+  Users whose `password` hash was stored as the importing project's credential for the
+  first time.
   """
   passwordsImported: Int!
   """
-  Users whose imported credential was replaced because the document carried a different
-  hash for it.
+  Users whose project credential was replaced because an earlier import of this project had
+  stored a different hash.
   """
   passwordsUpdated: Int!
   """
-  Users whose imported credential already equalled the hash in the document.
+  Users whose project credential, stored by an earlier import of this project, already
+  equalled the hash in the document.
   """
   passwordsUnchanged: Int!
   """
-  Users whose `password` hash was not stored because the credential or the identity is
-  not the import's to write: a password set in Grant, an address the owner has verified,
-  or an identity that already existed and was not created by an earlier import of this
-  project.
+  Users whose project credential was not written because the person owns it: it was set or
+  reset in Grant, not imported.
   """
   passwordsSkippedExisting: Int!
   resourcesCreated: Int!

package/src/schema/users/types/user-data-export.graphql

@@ -2,6 +2,7 @@ type UserDataExport {
   user: UserExportData!
   accounts: [AccountExportData!]!
   authenticationMethods: [AuthenticationMethodExportData!]!
+  credentials: [CredentialExportData!]!
   sessions: [SessionExportData!]!
   organizationMemberships: [OrganizationMembershipExportData!]!
   projectMemberships: [ProjectMembershipExportData!]!
@@ -32,6 +33,21 @@ type AuthenticationMethodExportData {
   createdAt: Date!
 }
 
+"""
+A password credential the user holds, per scope. Existence, scope, source and dates only:
+the hash is never exported.
+"""
+type CredentialExportData {
+  "platform (the Grant console) or project (that project's apps)"
+  scope: String!
+  "Set for a project credential"
+  projectId: ID
+  source: String!
+  lastUsedAt: Date
+  createdAt: Date!
+  updatedAt: Date!
+}
+
 type SessionExportData {
   userAgent: String
   ipAddress: String