@wildo-ai/saas-backend-lib 1.1.2 → 1.1.3

package/dist/esm/security/connected-accounts/organization-provider-credential-resolver.port.d.ts

@@ -0,0 +1,59 @@
+/**
+ * The port the provider registry consults for an organization's OWN credential.
+ *
+ * ## Why a port and not the store itself
+ *
+ * `ExternalProvidersRegistryBackendService` is a configuration-tier singleton constructed early in
+ * startup, before repositories exist. Giving it a repository would invert that order and make every
+ * unit harness of every protocol consumer need a database to construct one. A narrow port keeps the
+ * registry's dependency to a type: it knows there is somewhere to ask, and nothing about where.
+ *
+ * ## Why the registry owns the ORDER and the port does not
+ *
+ * The port answers exactly one question — "does this organization have its own credential for this
+ * provider and slug?" — and returns `undefined` when it does not. It never falls back to the
+ * environment and never refuses.
+ *
+ * The ORDER (organization first, deployment environment second, refuse by name third) lives in the
+ * registry because the registry is the only place that can see both halves. Splitting it would give
+ * two components a partial view of the resolution and let them disagree about what "no credential"
+ * means — which is precisely how an empty string reaches a vendor.
+ */
+import type { ProviderCredentialResolutionSource } from '@wildo-ai/saas-models';
+/** Which credential is being asked for. Every field is required — there is no wildcard lookup. */
+export interface OrganizationProviderCredentialQuery {
+    /**
+     * The tenant. Supplied by the CALLER from a trusted execution scope, never parsed out of a
+     * request payload — the port has no way to verify it, so the guarantee has to hold upstream.
+     */
+    organizationId: string;
+    providerRef: string;
+    /** The slug in the provider's `secretsContract`, the same identifier the env projection names. */
+    secretSlug: string;
+}
+/** A credential that was found, opened, and is spendable. */
+export interface OrganizationProviderCredentialResolution {
+    /** The plaintext credential. Never logged, never stored, never returned to a client. */
+    value: string;
+    /** The row it came from, for the audit trail. */
+    credentialId: string;
+}
+export interface OrganizationProviderCredentialResolverPort {
+    /**
+     * The organization's own credential, or `undefined` when the tenant has not set one.
+     *
+     * `undefined` means "this tenant has no credential here" — a normal, expected state that the
+     * registry answers by falling back to the deployment environment. Anything that is NOT that
+     * — a row that exists but cannot be opened, a row whose envelope was tampered with — THROWS,
+     * because silently treating an unopenable credential as an absent one would make the tenant fall
+     * back to the shared deployment principal without anyone noticing. That substitution is the exact
+     * defect this subsystem exists to remove, so it must never be reachable by accident.
+     */
+    resolveOrganizationCredential(query: OrganizationProviderCredentialQuery): Promise<OrganizationProviderCredentialResolution | undefined>;
+}
+/**
+ * Re-exported for the registry's own signatures so a consumer reading the resolution result does not
+ * have to reach into the models package for the one enum that describes it.
+ */
+export type { ProviderCredentialResolutionSource };
+//# sourceMappingURL=organization-provider-credential-resolver.port.d.ts.map

package/dist/esm/security/connected-accounts/organization-provider-credential-resolver.port.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization-provider-credential-resolver.port.d.ts","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/organization-provider-credential-resolver.port.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,uBAAuB,CAAC;AAEhF,kGAAkG;AAClG,MAAM,WAAW,mCAAmC;IAClD;;;OAGG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,kGAAkG;IAClG,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,6DAA6D;AAC7D,MAAM,WAAW,wCAAwC;IACvD,wFAAwF;IACxF,KAAK,EAAE,MAAM,CAAC;IACd,iDAAiD;IACjD,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,0CAA0C;IACzD;;;;;;;;;OASG;IACH,6BAA6B,CAC3B,KAAK,EAAE,mCAAmC,GACzC,OAAO,CAAC,wCAAwC,GAAG,SAAS,CAAC,CAAC;CAClE;AAED;;;GAGG;AACH,YAAY,EAAE,kCAAkC,EAAE,CAAC"}

package/dist/esm/security/connected-accounts/organization-provider-credential-resolver.port.js

@@ -0,0 +1,22 @@
+/**
+ * The port the provider registry consults for an organization's OWN credential.
+ *
+ * ## Why a port and not the store itself
+ *
+ * `ExternalProvidersRegistryBackendService` is a configuration-tier singleton constructed early in
+ * startup, before repositories exist. Giving it a repository would invert that order and make every
+ * unit harness of every protocol consumer need a database to construct one. A narrow port keeps the
+ * registry's dependency to a type: it knows there is somewhere to ask, and nothing about where.
+ *
+ * ## Why the registry owns the ORDER and the port does not
+ *
+ * The port answers exactly one question — "does this organization have its own credential for this
+ * provider and slug?" — and returns `undefined` when it does not. It never falls back to the
+ * environment and never refuses.
+ *
+ * The ORDER (organization first, deployment environment second, refuse by name third) lives in the
+ * registry because the registry is the only place that can see both halves. Splitting it would give
+ * two components a partial view of the resolution and let them disagree about what "no credential"
+ * means — which is precisely how an empty string reaches a vendor.
+ */
+//# sourceMappingURL=organization-provider-credential-resolver.port.js.map

package/dist/esm/security/connected-accounts/organization-provider-credential-resolver.port.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization-provider-credential-resolver.port.js","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/organization-provider-credential-resolver.port.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG","sourcesContent":["/**\n * The port the provider registry consults for an organization's OWN credential.\n *\n * ## Why a port and not the store itself\n *\n * `ExternalProvidersRegistryBackendService` is a configuration-tier singleton constructed early in\n * startup, before repositories exist. Giving it a repository would invert that order and make every\n * unit harness of every protocol consumer need a database to construct one. A narrow port keeps the\n * registry's dependency to a type: it knows there is somewhere to ask, and nothing about where.\n *\n * ## Why the registry owns the ORDER and the port does not\n *\n * The port answers exactly one question — \"does this organization have its own credential for this\n * provider and slug?\" — and returns `undefined` when it does not. It never falls back to the\n * environment and never refuses.\n *\n * The ORDER (organization first, deployment environment second, refuse by name third) lives in the\n * registry because the registry is the only place that can see both halves. Splitting it would give\n * two components a partial view of the resolution and let them disagree about what \"no credential\"\n * means — which is precisely how an empty string reaches a vendor.\n */\n\nimport type { ProviderCredentialResolutionSource } from '@wildo-ai/saas-models';\n\n/** Which credential is being asked for. Every field is required — there is no wildcard lookup. */\nexport interface OrganizationProviderCredentialQuery {\n  /**\n   * The tenant. Supplied by the CALLER from a trusted execution scope, never parsed out of a\n   * request payload — the port has no way to verify it, so the guarantee has to hold upstream.\n   */\n  organizationId: string;\n  providerRef: string;\n  /** The slug in the provider's `secretsContract`, the same identifier the env projection names. */\n  secretSlug: string;\n}\n\n/** A credential that was found, opened, and is spendable. */\nexport interface OrganizationProviderCredentialResolution {\n  /** The plaintext credential. Never logged, never stored, never returned to a client. */\n  value: string;\n  /** The row it came from, for the audit trail. */\n  credentialId: string;\n}\n\nexport interface OrganizationProviderCredentialResolverPort {\n  /**\n   * The organization's own credential, or `undefined` when the tenant has not set one.\n   *\n   * `undefined` means \"this tenant has no credential here\" — a normal, expected state that the\n   * registry answers by falling back to the deployment environment. Anything that is NOT that\n   * — a row that exists but cannot be opened, a row whose envelope was tampered with — THROWS,\n   * because silently treating an unopenable credential as an absent one would make the tenant fall\n   * back to the shared deployment principal without anyone noticing. That substitution is the exact\n   * defect this subsystem exists to remove, so it must never be reachable by accident.\n   */\n  resolveOrganizationCredential(\n    query: OrganizationProviderCredentialQuery,\n  ): Promise<OrganizationProviderCredentialResolution | undefined>;\n}\n\n/**\n * Re-exported for the registry's own signatures so a consumer reading the resolution result does not\n * have to reach into the models package for the one enum that describes it.\n */\nexport type { ProviderCredentialResolutionSource };\n"]}

package/dist/esm/security/connected-accounts/provider-oauth2-refresher.port.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Renewing an expiring grant — the port a credential store consults.
+ *
+ * ## Why the store calls OUT rather than the refresher calling in
+ *
+ * Renewal is two jobs that belong to different owners. Talking to the vendor needs the provider
+ * contract, the application's client registration and an HTTP client, none of which a store has.
+ * Writing the renewed grant back needs the table, the envelope key and the scope map, none of which
+ * a refresher should have. So the store asks for a new grant and persists it itself: each half stays
+ * where its inputs are, and the refresher never learns how a credential is stored.
+ *
+ * ## Why it is OPTIONAL, and what its absence means
+ *
+ * A store constructed without one still resolves every credential that is not an expiring grant —
+ * which is the whole pasted-credential population and every non-expiring token. An expiring grant
+ * with no refresher REFUSES, naming the missing subsystem rather than the credential, because the
+ * alternative is sending a stale token and having the vendor's 401 recorded as "this person's
+ * credential is bad" when it is merely old.
+ */
+import type { ProviderOAuth2Grant } from '@wildo-ai/saas-models';
+import type { ExternalProvider_ConnectionTarget } from '@wildo-ai/external-connectors-models';
+export interface ProviderOAuth2RefreshRequest {
+    readonly providerRef: string;
+    readonly secretSlug: string;
+    /** Whose connection this is. Used only to key the single-flight, never to authorize. */
+    readonly target: ExternalProvider_ConnectionTarget;
+    readonly grant: ProviderOAuth2Grant;
+    /**
+     * Values for the endpoints' `{placeholders}`. Needed AGAIN at refresh: a templated token URL is
+     * still templated an hour later, and 21 of the 96 vendors with recovered endpoints carry one.
+     */
+    readonly connectionParameters?: Readonly<Record<string, string>>;
+}
+export interface ProviderOAuth2RefresherPort {
+    /**
+     * A renewed grant, or a throw naming why renewal is impossible.
+     *
+     * Never returns the OLD grant on failure. A caller that received one could not tell renewal from
+     * a no-op, and would persist an unchanged grant while believing it had refreshed — turning a loud
+     * failure into a silent loop that repeats on every call until the token expires for real.
+     */
+    refreshGrant(request: ProviderOAuth2RefreshRequest): Promise<ProviderOAuth2Grant>;
+}
+//# sourceMappingURL=provider-oauth2-refresher.port.d.ts.map

package/dist/esm/security/connected-accounts/provider-oauth2-refresher.port.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-oauth2-refresher.port.d.ts","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/provider-oauth2-refresher.port.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,sCAAsC,CAAC;AAE9F,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,iCAAiC,CAAC;IACnD,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,2BAA2B;IAC1C;;;;;;OAMG;IACH,YAAY,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACnF"}

package/dist/esm/security/connected-accounts/provider-oauth2-refresher.port.js

@@ -0,0 +1,20 @@
+/**
+ * Renewing an expiring grant — the port a credential store consults.
+ *
+ * ## Why the store calls OUT rather than the refresher calling in
+ *
+ * Renewal is two jobs that belong to different owners. Talking to the vendor needs the provider
+ * contract, the application's client registration and an HTTP client, none of which a store has.
+ * Writing the renewed grant back needs the table, the envelope key and the scope map, none of which
+ * a refresher should have. So the store asks for a new grant and persists it itself: each half stays
+ * where its inputs are, and the refresher never learns how a credential is stored.
+ *
+ * ## Why it is OPTIONAL, and what its absence means
+ *
+ * A store constructed without one still resolves every credential that is not an expiring grant —
+ * which is the whole pasted-credential population and every non-expiring token. An expiring grant
+ * with no refresher REFUSES, naming the missing subsystem rather than the credential, because the
+ * alternative is sending a stale token and having the vendor's 401 recorded as "this person's
+ * credential is bad" when it is merely old.
+ */
+//# sourceMappingURL=provider-oauth2-refresher.port.js.map

package/dist/esm/security/connected-accounts/provider-oauth2-refresher.port.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-oauth2-refresher.port.js","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/provider-oauth2-refresher.port.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG","sourcesContent":["/**\n * Renewing an expiring grant — the port a credential store consults.\n *\n * ## Why the store calls OUT rather than the refresher calling in\n *\n * Renewal is two jobs that belong to different owners. Talking to the vendor needs the provider\n * contract, the application's client registration and an HTTP client, none of which a store has.\n * Writing the renewed grant back needs the table, the envelope key and the scope map, none of which\n * a refresher should have. So the store asks for a new grant and persists it itself: each half stays\n * where its inputs are, and the refresher never learns how a credential is stored.\n *\n * ## Why it is OPTIONAL, and what its absence means\n *\n * A store constructed without one still resolves every credential that is not an expiring grant —\n * which is the whole pasted-credential population and every non-expiring token. An expiring grant\n * with no refresher REFUSES, naming the missing subsystem rather than the credential, because the\n * alternative is sending a stale token and having the vendor's 401 recorded as \"this person's\n * credential is bad\" when it is merely old.\n */\n\nimport type { ProviderOAuth2Grant } from '@wildo-ai/saas-models';\nimport type { ExternalProvider_ConnectionTarget } from '@wildo-ai/external-connectors-models';\n\nexport interface ProviderOAuth2RefreshRequest {\n  readonly providerRef: string;\n  readonly secretSlug: string;\n  /** Whose connection this is. Used only to key the single-flight, never to authorize. */\n  readonly target: ExternalProvider_ConnectionTarget;\n  readonly grant: ProviderOAuth2Grant;\n  /**\n   * Values for the endpoints' `{placeholders}`. Needed AGAIN at refresh: a templated token URL is\n   * still templated an hour later, and 21 of the 96 vendors with recovered endpoints carry one.\n   */\n  readonly connectionParameters?: Readonly<Record<string, string>>;\n}\n\nexport interface ProviderOAuth2RefresherPort {\n  /**\n   * A renewed grant, or a throw naming why renewal is impossible.\n   *\n   * Never returns the OLD grant on failure. A caller that received one could not tell renewal from\n   * a no-op, and would persist an unchanged grant while believing it had refreshed — turning a loud\n   * failure into a silent loop that repeats on every call until the token expires for real.\n   */\n  refreshGrant(request: ProviderOAuth2RefreshRequest): Promise<ProviderOAuth2Grant>;\n}\n"]}

package/dist/esm/security/connected-accounts/services/organization-provider-credential-store.backend.service.d.ts

@@ -0,0 +1,191 @@
+/**
+ * The organization-provider-credential STORE — the port implementation the registry consults.
+ *
+ * ## What makes the isolation structural rather than a filter
+ *
+ * Three independent mechanisms have to agree before a credential is handed back, and none of them
+ * is a predicate somebody has to remember to write at each call site:
+ *
+ * 1. **The scope FK is injected by the context machinery.** The read goes through `readAsSystem`
+ *    with the organization in the system scope map, so `buildContextualFilter` adds the tenant
+ *    clause itself. A caller cannot omit it, because the caller never writes it.
+ * 2. **The filter names the organization explicitly as well.** Belt and braces, deliberately: the
+ *    contextual filter is injected by a mechanism that exists TWICE (a Mongo implementation and a
+ *    PostgreSQL one), so a regression in one adapter is a bypass in that adapter alone. The explicit
+ *    clause is adapter-independent and would still scope the read.
+ * 3. **The envelope is BOUND to the row identity.** Even a read that returned another tenant's row
+ *    would fail to OPEN it — the associated data is the organization, provider and slug, so the seal
+ *    itself refuses. This is the one that holds when the other two are wrong, which is why it exists.
+ *
+ * ## The store never accepts a caller-supplied organization from a request
+ *
+ * `organizationId` arrives from the calling code's trusted execution scope. The port cannot verify
+ * it — nothing at this tier can — so the honest statement is that the guarantee holds one level up,
+ * and the envelope binding is what keeps a mistake there from becoming a cross-tenant credential
+ * disclosure rather than merely a failed read.
+ */
+import { ProviderCredentialResolutionSource, type ProviderOAuth2Grant } from '@wildo-ai/saas-models';
+import type { LoggerService } from '../../../monitoring/logger/services/logger.service';
+import type { AppConfigurationService } from '../../../config/services/app-configuration.backend.service';
+import type { SystemAccessBackendService } from '../../../base-classes/services/services/system-access.backend.service';
+import type { AuditLogsBackendService } from '../../../compliance/audit-trails/services/audit-logs.backend.service';
+import { ProviderCredentialEnvelopeError } from '../utils/provider-credential-envelope.backend.utils';
+import type { ProviderOAuth2RefresherPort } from '../provider-oauth2-refresher.port';
+import type { OrganizationProviderCredentialQuery, OrganizationProviderCredentialResolution, OrganizationProviderCredentialResolverPort } from '../organization-provider-credential-resolver.port';
+export declare class OrganizationProviderCredentialStoreBackendService implements OrganizationProviderCredentialResolverPort {
+    private readonly logger;
+    private readonly appConfigService;
+    private readonly systemAccess;
+    /**
+     * OPTIONAL and lazily used, mirroring `SystemAccessBackendService`'s own treatment of it: audit
+     * emission must never be the reason a provider call fails, and a minimal test container must
+     * still be able to construct this service.
+     */
+    private readonly auditLogs?;
+    /**
+     * Appended LAST, deliberately: a parameter inserted mid-signature silently reassigns every
+     * positional argument after it, and this constructor is called positionally by several harnesses.
+     *
+     * OPTIONAL, and its absence is not a degradation — a store without one resolves every pasted
+     * credential and every non-expiring token exactly as before. Only an EXPIRING grant needs it, and
+     * that case refuses by name rather than sending a stale token.
+     */
+    private readonly refresher?;
+    constructor(logger: LoggerService, appConfigService: AppConfigurationService, systemAccess: SystemAccessBackendService, 
+    /**
+     * OPTIONAL and lazily used, mirroring `SystemAccessBackendService`'s own treatment of it: audit
+     * emission must never be the reason a provider call fails, and a minimal test container must
+     * still be able to construct this service.
+     */
+    auditLogs?: AuditLogsBackendService, 
+    /**
+     * Appended LAST, deliberately: a parameter inserted mid-signature silently reassigns every
+     * positional argument after it, and this constructor is called positionally by several harnesses.
+     *
+     * OPTIONAL, and its absence is not a degradation — a store without one resolves every pasted
+     * credential and every non-expiring token exactly as before. Only an EXPIRING grant needs it, and
+     * that case refuses by name rather than sending a stale token.
+     */
+    refresher?: ProviderOAuth2RefresherPort);
+    /**
+     * The organization's own credential, opened, or `undefined` when the tenant has not set one.
+     *
+     * See the port's JSDoc for why "absent" returns and "present but unopenable" throws.
+     */
+    resolveOrganizationCredential(query: OrganizationProviderCredentialQuery): Promise<OrganizationProviderCredentialResolution | undefined>;
+    /**
+     * The row, read through the system door.
+     *
+     * `readAsSystem` bypasses the CALLER's role check, not the tenant boundary — an outbound provider
+     * call legitimately happens on a batch, a queue consumer or an anonymous webhook return leg, none
+     * of which holds an ORG_ADMIN role, and all of which must still resolve the tenant's credential.
+     * The organization travels in the system scope map, which is the channel both the contextual
+     * filter and the enrichment actually consume.
+     */
+    private readCredentialRow;
+    /**
+     * Record that a credential was spent, and what the provider thought of it.
+     *
+     * Best-effort in both halves and deliberately so: an outbound provider call has already happened
+     * by the time this runs, and failing the caller because a bookkeeping write did not land would
+     * turn a successful integration into an error. Every failure is logged with the row named.
+     *
+     * The audit event is emitted for BOTH sources, including the deployment-environment fallback,
+     * because "this tenant is silently acting as the shared principal" is the condition worth seeing
+     * and it is invisible if only the interesting case is recorded.
+     */
+    recordCredentialUse(use: {
+        organizationId: string;
+        providerRef: string;
+        secretSlug: string;
+        source: ProviderCredentialResolutionSource;
+        credentialId?: string;
+        /** What the provider said. Absent means the outcome is not yet known to the caller. */
+        outcome?: {
+            accepted: boolean;
+            providerMessage?: string;
+        };
+    }): Promise<void>;
+    private emitUseAudit;
+    /**
+     * Record a grant the authorization exchange just minted, replacing one already stored.
+     *
+     * The plaintext goes in and the resource's own WRITE DOOR seals it — the same hook that seals a
+     * credential a person types, and the same reason `persistRenewedGrant` hands over plaintext:
+     * `createAsSystem` / `updateAsSystem` reach the SERVICE tier, so a pre-sealed value arrives at
+     * that hook and the envelope refuses to double-seal.
+     *
+     * ## Reconnecting REPLACES rather than adding a second row
+     *
+     * The business key is (organizationId, providerRef, secretSlug) and it is UNIQUE, so a second connect would
+     * violate the index. Read-then-write is a race, and the honest statement is that the index is what
+     * decides it: two simultaneous connects mean one of them loses, which is the correct outcome —
+     * a person who authorized twice gets one connection, not two half-connections.
+     *
+     * @returns the credential row's id, so the caller can name it in an audit event.
+     */
+    storeGrant(query: OrganizationProviderCredentialQuery, grant: ProviderOAuth2Grant, connectionParameters?: Readonly<Record<string, string>>): Promise<string>;
+    /**
+     * Renew the grant, and RETIRE the connection when the vendor says it is finished.
+     *
+     * Without this the refresh call was unguarded, and the failure was slow and silent in the worst
+     * direction. A vendor that permanently rejects a refresh token — the person removed the app at the
+     * vendor, an administrator revoked it, the token aged past its absolute lifetime — throws, the
+     * error propagates out of the resolve, and NOTHING touches the row. `validationState` stays where
+     * it was, so the connected-accounts screen goes on showing the account as connected, every call
+     * fails identically forever, and the person is never told the one thing they could act on.
+     *
+     * Only `invalid_grant` retires a connection, and the exclusions are the substantive part. A
+     * transport failure, a bare 500 or an unparseable body means the vendor said NOTHING about the
+     * grant, and retiring a working connection because we could not reach a vendor for thirty seconds
+     * would be a self-inflicted outage. `invalid_client` is excluded for a different reason: it is the
+     * APPLICATION's own registration being rejected, one operator's misconfiguration affecting every
+     * connection at once — marking each person's account invalid would blame all of them for something
+     * none of them can fix.
+     *
+     * The mark is best-effort and the ORIGINAL error is always re-thrown: the caller needs the real
+     * cause, and a bookkeeping write that failed must not replace it with a different story.
+     */
+    private renewOrRetire;
+    /**
+     * Record that a delegated authorization was GRANTED, distinct from the row's own `_SET` event.
+     *
+     * Emitted HERE and nowhere else, because this is the only place that holds the three facts an
+     * auditor wants and the row does not: the scopes the vendor actually issued, which account they
+     * were issued for, and whether this replaced a connection that already existed. By the time the
+     * resource's own write hook sees the row, the value is sealed and none of it is recoverable.
+     *
+     * Best-effort, like every other emission on this path. The grant is already stored and the person
+     * has already authorized it; failing their connection because a trail write did not land would
+     * turn a completed authorization into an error and invite them to grant it a second time.
+     */
+    private emitConnectionGranted;
+    /**
+     * Persist a renewed grant through the resource's own WRITE door.
+     *
+     * The plaintext goes in and the CUSTOM IMPLEMENTATION seals it — the same hook that seals a
+     * credential a person types. Sealing here instead would be a second sealing site for one
+     * invariant, and it does not merely duplicate: `updateAsSystem` reaches the service tier, so a
+     * pre-sealed value arrives at that hook and the envelope REFUSES it ("double-sealing would hand
+     * the envelope itself to the provider"). Every refresh would have thrown at the write-back.
+     *
+     * `secretSetAt` therefore moves, and that is correct rather than tolerated: the field is defined
+     * as "when the stored VALUE last changed", and a renewal changes it. An earlier version of this
+     * method held it still on the theory that it should mean "when a HUMAN last supplied a value" —
+     * that is a different field, and inventing the behaviour without the field was the error.
+     *
+     * NOT best-effort. A refresh that is not persisted happens again on every call, and against a
+     * vendor that rotates the refresh token each one invalidates the last — so the connection breaks
+     * while every individual exchange succeeds.
+     */
+    private persistRenewedGrant;
+    /**
+     * Turn an envelope failure into the operator-facing statement.
+     *
+     * Exposed so the registry can distinguish "this tenant has no credential" (fall through to the
+     * environment) from "this tenant HAS one and it is broken" (refuse, loudly) without importing the
+     * envelope's error type and re-deriving the distinction. One definition, one meaning.
+     */
+    static isUnopenableCredential(error: unknown): error is ProviderCredentialEnvelopeError;
+}
+//# sourceMappingURL=organization-provider-credential-store.backend.service.d.ts.map

package/dist/esm/security/connected-accounts/services/organization-provider-credential-store.backend.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization-provider-credential-store.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/connected-accounts/services/organization-provider-credential-store.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,EAEL,kCAAkC,EAGlC,KAAK,mBAAmB,EAEzB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AACpH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAClI,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AAG9H,OAAO,EACL,+BAA+B,EAEhC,MAAM,qDAAqD,CAAC;AAG7D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,mCAAmC,CAAC;AACrF,OAAO,KAAK,EACV,mCAAmC,EACnC,wCAAwC,EACxC,0CAA0C,EAC3C,MAAM,mDAAmD,CAAC;AAE3D,qBACa,iDAAkD,YAAW,0CAA0C;IAE7E,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7E;;;;OAIG;IACsD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IACpF;;;;;;;OAOG;IAC6D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAjBvC,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EACtC,YAAY,EAAE,0BAA0B;IACzG;;;;OAIG;IACuE,SAAS,CAAC,EAAE,uBAAuB;IAC7G;;;;;;;OAOG;IAC8E,SAAS,CAAC,EAAE,2BAA2B;IAG1H;;;;OAIG;IACU,6BAA6B,CACxC,KAAK,EAAE,mCAAmC,GACzC,OAAO,CAAC,wCAAwC,GAAG,SAAS,CAAC;IA6DhE;;;;;;;;OAQG;YACW,iBAAiB;IAc/B;;;;;;;;;;OAUG;IACU,mBAAmB,CAAC,GAAG,EAAE;QACpC,cAAc,EAAE,MAAM,CAAC;QACvB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,kCAAkC,CAAC;QAC3C,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,uFAAuF;QACvF,OAAO,CAAC,EAAE;YAAE,QAAQ,EAAE,OAAO,CAAC;YAAC,eAAe,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAC3D,GAAG,OAAO,CAAC,IAAI,CAAC;YA8DH,YAAY;IA+B1B;;;;;;;;;;;;;;;;OAgBG;IACU,UAAU,CACrB,KAAK,EAAE,mCAAmC,EAC1C,KAAK,EAAE,mBAAmB,EAC1B,oBAAoB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GACtD,OAAO,CAAC,MAAM,CAAC;IA2ClB;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,aAAa;IAuC3B;;;;;;;;;;;OAWG;YACW,qBAAqB;IA2BnC;;;;;;;;;;;;;;;;;OAiBG;YACW,mBAAmB;IAajC;;;;;;OAMG;WACW,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,+BAA+B;CAG/F"}