@wildo-ai/saas-backend-lib 1.1.3 → 1.1.4

package/dist/esm/security/connected-accounts/user-provider-credential-resolver.port.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-provider-credential-resolver.port.js","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/user-provider-credential-resolver.port.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG","sourcesContent":["/**\n * The port the provider registry consults for a PERSON's own credential.\n *\n * ## Why this is a second port and not a parameter on the organization's\n *\n * The two answer the same shape of question and mean different things, and the differences are the\n * kind that a shared port would have to represent as optional fields — which is how a caller ends\n * up able to describe a row that cannot exist.\n *\n * - **The owner differs, and so does the guarantee upstream.** An organization id reaches the\n *   organization port from a tenant scope that several administrators share. A user id reaches this\n *   one from the initiator's own identity, and there is no legitimate case where one person's call\n *   resolves another person's credential — so a port that accepted either would be accepting an\n *   argument whose safe range differs per member.\n * - **There is no fallback here, at all.** The organization's resolution has a documented second\n *   place to look when a tenant has set nothing (the deployment environment, refused by the current\n *   target resolver but still meaningful in the older per-organization path). A person's credential\n *   has none: spending the deployment's shared principal on behalf of somebody who did not connect\n *   an account would attribute the act to the wrong party at the vendor, and the vendor's own record\n *   is the one that survives us.\n *\n * ## What `undefined` means, and what it must never mean\n *\n * `undefined` is \"this person has not connected this provider\" — an ordinary state, and the answer\n * a caller turns into a refusal naming what to connect. Anything else THROWS: a row that exists and\n * cannot be opened must never be reported as an absent one, because the two are indistinguishable to\n * the caller and only one of them is safe to treat as \"nothing configured\".\n */\n\nimport type { ProviderCredentialResolutionSource } from '@wildo-ai/saas-models';\n\n/** Which credential is being asked for. Every field is required — there is no wildcard lookup. */\nexport interface UserProviderCredentialQuery {\n  /**\n   * The person. Supplied by the CALLER from the initiator's own identity, never parsed out of a\n   * request payload — the port has no way to verify it, so the guarantee has to hold upstream, and\n   * the envelope binding below is what keeps a mistake there from becoming a disclosure.\n   */\n  userId: string;\n  providerRef: string;\n  /** The slug in the provider's `secretsContract`, the same identifier the env projection names. */\n  secretSlug: string;\n}\n\n/** A credential that was found, opened, and is spendable. */\nexport interface UserProviderCredentialResolution {\n  /** The plaintext credential. Never logged, never stored, never returned to a client. */\n  value: string;\n  /** The row it came from, for the audit trail. */\n  credentialId: string;\n}\n\nexport interface UserProviderCredentialResolverPort {\n  /**\n   * The person's own credential, or `undefined` when they have not connected this provider.\n   *\n   * See the module JSDoc for why absence returns and unopenability throws.\n   */\n  resolveUserCredential(\n    query: UserProviderCredentialQuery,\n  ): Promise<UserProviderCredentialResolution | undefined>;\n}\n\n/**\n * Re-exported for the registry's own signatures so a consumer reading the resolution result does not\n * have to reach into the models package for the one enum that describes it.\n */\nexport type { ProviderCredentialResolutionSource };\n"]}
+{"version":3,"file":"user-provider-credential-resolver.port.js","sourceRoot":"","sources":["../../../../src/security/connected-accounts/user-provider-credential-resolver.port.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG","sourcesContent":["/**\n * The port the provider registry consults for a PERSON's own credential.\n *\n * ## Why this is a second port and not a parameter on the organization's\n *\n * The two answer the same shape of question and mean different things, and the differences are the\n * kind that a shared port would have to represent as optional fields — which is how a caller ends\n * up able to describe a row that cannot exist.\n *\n * - **The owner differs, and so does the guarantee upstream.** An organization id reaches the\n *   organization port from a tenant scope that several administrators share. A user id reaches this\n *   one from the initiator's own identity, and there is no legitimate case where one person's call\n *   resolves another person's credential — so a port that accepted either would be accepting an\n *   argument whose safe range differs per member.\n * - **There is no fallback here, at all.** The organization's resolution has a documented second\n *   place to look when a tenant has set nothing (the deployment environment, refused by the current\n *   target resolver but still meaningful in the older per-organization path). A person's credential\n *   has none: spending the deployment's shared principal on behalf of somebody who did not connect\n *   an account would attribute the act to the wrong party at the vendor, and the vendor's own record\n *   is the one that survives us.\n *\n * ## What `undefined` means, and what it must never mean\n *\n * `undefined` is \"this person has not connected this provider\" — an ordinary state, and the answer\n * a caller turns into a refusal naming what to connect. Anything else THROWS: a row that exists and\n * cannot be opened must never be reported as an absent one, because the two are indistinguishable to\n * the caller and only one of them is safe to treat as \"nothing configured\".\n */\n\nimport type { ProviderCredentialResolutionSource } from '@wildo-ai/saas-models';\n\n/** Which credential is being asked for. Every field is required — there is no wildcard lookup. */\nexport interface UserProviderCredentialQuery {\n  /**\n   * The person. Supplied by the CALLER from the initiator's own identity, never parsed out of a\n   * request payload — the port has no way to verify it, so the guarantee has to hold upstream, and\n   * the envelope binding below is what keeps a mistake there from becoming a disclosure.\n   */\n  userId: string;\n  providerRef: string;\n  /** The slug in the provider's `secretsContract`, the same identifier the env projection names. */\n  secretSlug: string;\n}\n\n/** A credential that was found, opened, and is spendable. */\nexport interface UserProviderCredentialResolution {\n  /**\n   * The plaintext credential. Never logged, never stored — and returned to a client by exactly ONE\n   * door, the access-token route, which hands a person their own OAuth2 access token so a vendor's\n   * picker can open as them (#394 P4). Every other caller keeps it server-side.\n   */\n  value: string;\n  /** The row it came from, for the audit trail. */\n  credentialId: string;\n  /**\n   * When the vendor said the access token expires — carried out for an OAuth2 grant so a browser\n   * handed the token knows when to ask again, absent for a pasted credential.\n   */\n  expiresAt?: string;\n  /** What the vendor granted, when it stated it. Lets a picker refuse to open with a scope it lacks rather than fail inside. */\n  grantedScopes?: readonly string[];\n}\n\nexport interface UserProviderCredentialResolverPort {\n  /**\n   * The person's own credential, or `undefined` when they have not connected this provider.\n   *\n   * See the module JSDoc for why absence returns and unopenability throws.\n   */\n  resolveUserCredential(\n    query: UserProviderCredentialQuery,\n  ): Promise<UserProviderCredentialResolution | undefined>;\n\n  /**\n   * Stamp the person's row with what the provider said about the credential it just spent.\n   *\n   * Required, and on this port rather than a port of its own, for the reasons the organization port\n   * states at its own member: the store that was READ must be the store that is STAMPED, and an\n   * optional method would leave \"resolves credentials, records nothing\" representable — which is\n   * exactly the state this subsystem shipped in.\n   *\n   * `credentialId` is REQUIRED here and optional on the organization's, and the asymmetry is the\n   * fallback: an organization's resolution may legitimately have come from the deployment\n   * environment, which has no row. A person's never can — there is nothing for a person to fall\n   * through to — so a recorded use without a row to name would describe a resolution that cannot\n   * happen.\n   */\n  recordCredentialUse(use: {\n    userId: string;\n    providerRef: string;\n    secretSlug: string;\n    credentialId: string;\n    /** What the provider said. Absent means the outcome is not yet known to the caller. */\n    outcome?: { accepted: boolean; providerMessage?: string };\n  }): Promise<void>;\n}\n\n/**\n * Re-exported for the registry's own signatures so a consumer reading the resolution result does not\n * have to reach into the models package for the one enum that describes it.\n */\nexport type { ProviderCredentialResolutionSource };\n"]}

package/dist/esm/security/connected-accounts/utils/provider-credential-envelope.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-credential-envelope.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/security/connected-accounts/utils/provider-credential-envelope.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAIH,OAAO,EAAE,sCAAsC,EAAE,MAAM,sCAAsC,CAAC;AAwB9F;;;;GAIG;AACH,eAAO,MAAM,mCAAmC,8BAA8B,CAAC;AAyB/E,wGAAwG;AACxG,qBAAa,+BAAgC,SAAQ,KAAK;gBAC5C,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iCAAiC;IAChD,UAAU,EAAE,sCAAsC,CAAC,YAAY,GAAG,sCAAsC,CAAC,IAAI,CAAC;IAC9G,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAmDD,qFAAqF;AACrF,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAEpF;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,iBAAiB,EAAE,MAAM,EACzB,OAAO,EAAE,iCAAiC,GACzC,MAAM,CAsBR;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,iBAAiB,EAAE,MAAM,EACzB,OAAO,EAAE,iCAAiC,GACzC,MAAM,CAkER;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qCAAqC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAU1F"}
+{"version":3,"file":"provider-credential-envelope.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/utils/provider-credential-envelope.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAIH,OAAO,EAAE,sCAAsC,EAAE,MAAM,sCAAsC,CAAC;AAwB9F;;;;GAIG;AACH,eAAO,MAAM,mCAAmC,8BAA8B,CAAC;AAyB/E,wGAAwG;AACxG,qBAAa,+BAAgC,SAAQ,KAAK;gBAC5C,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iCAAiC;IAChD,UAAU,EAAE,sCAAsC,CAAC,YAAY,GAAG,sCAAsC,CAAC,IAAI,CAAC;IAC9G,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAmDD,qFAAqF;AACrF,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAEpF;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,iBAAiB,EAAE,MAAM,EACzB,OAAO,EAAE,iCAAiC,GACzC,MAAM,CAsBR;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,iBAAiB,EAAE,MAAM,EACzB,OAAO,EAAE,iCAAiC,GACzC,MAAM,CAkER;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qCAAqC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAU1F"}

package/dist/esm/security/connected-accounts/utils/provider-credential-envelope.backend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-credential-envelope.backend.utils.js","sourceRoot":"","sources":["../../../../../../src/security/connected-accounts/utils/provider-credential-envelope.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEzG,OAAO,EAAE,sCAAsC,EAAE,MAAM,sCAAsC,CAAC;AAE9F;;;;;;;;;;;;;GAaG;AACH,MAAM,+BAA+B,GAGhC;IACH,CAAC,sCAAsC,CAAC,YAAY,CAAC,EAAE,2CAA2C;IAClG,CAAC,sCAAsC,CAAC,IAAI,CAAC,EAAE,mCAAmC;CACnF,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,2BAA2B,CAAC;AAE/E,mEAAmE;AACnE,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAE3C;;;;;;;;GAQG;AACH,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAEnC,wGAAwG;AACxG,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IACxD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;IAChD,CAAC;CACF;AAgBD;;;;;;;;;;;GAWG;AACH,SAAS,2BAA2B,CAClC,iBAAyB,EACzB,UAA2D;IAE3D,IAAI,OAAO,iBAAiB,KAAK,QAAQ,IAAI,iBAAiB,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC3E,MAAM,IAAI,+BAA+B,CACvC,gEAAgE;cAC9D,kGAAkG;cAClG,mGAAmG;cACnG,sDAAsD,CACzD,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,+BAA+B,CAAC,UAAU,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,+BAA+B,CACvC,6DAA6D,UAAU,gCAAgC;cACrG,kGAAkG;cAClG,kGAAkG,CACrG,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAChF,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,OAA0C;IAC/D,OAAO,MAAM,CAAC,IAAI,CAChB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAClF,MAAM,CACP,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,0BAA0B,CAAC,KAAgC;IACzE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,mCAAmC,CAAC,CAAC;AAC5F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,SAAiB,EACjB,iBAAyB,EACzB,OAA0C;IAE1C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,+BAA+B,CAAC,gDAAgD,CAAC,CAAC;IAC9F,CAAC;IACD,4FAA4F;IAC5F,iGAAiG;IACjG,IAAI,0BAA0B,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,+BAA+B,CACvC,sGAAsG;cACpG,0CAA0C,CAC7C,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,2BAA2B,CAAC,iBAAiB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/E,MAAM,EAAE,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAEtC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEpC,OAAO,GAAG,mCAAmC,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAChI,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CACpC,WAAmB,EACnB,iBAAyB,EACzB,OAA0C;IAE1C,MAAM,cAAc,GAClB,GAAG,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,OAAO,gBAAgB,OAAO,CAAC,WAAW,YAAY,OAAO,CAAC,UAAU,GAAG,CAAC;IAEhH,IAAI,CAAC,0BAA0B,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,+BAA+B,CACvC,kCAAkC,cAAc,uDAAuD;cACrG,qGAAqG;cACrG,kDAAkD,CACrD,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,mCAAmC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,+BAA+B,CAAC,2BAA2B,cAAc,oBAAoB,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,GAAG,KAAiC,CAAC;IAE7E,IAAI,CAAC;QACH,+FAA+F;QAC/F,gGAAgG;QAChG,gGAAgG;QAChG,gGAAgG;QAChG,mDAAmD;QACnD,EAAE;QACF,gGAAgG;QAChG,iGAAiG;QACjG,iGAAiG;QACjG,6FAA6F;QAC7F,yFAAyF;QACzF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YAC/F,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QAErD,gGAAgG;QAChG,kGAAkG;QAClG,wDAAwD;QACxD,IAAI,EAAE,CAAC,MAAM,KAAK,cAAc,IAAI,OAAO,CAAC,MAAM,KAAK,oBAAoB,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvG,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,GAAG,GAAG,2BAA2B,CAAC,iBAAiB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC/E,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1D,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;QACxC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE7B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAClG,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,0FAA0F;QAC1F,gEAAgE;QAChE,IAAI,KAAK,YAAY,+BAA+B,EAAE,CAAC;YACrD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,+BAA+B,CACvC,2BAA2B,cAAc,8DAA8D;cACrG,wGAAwG,CAC3G,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qCAAqC,CAAC,IAAY,EAAE,KAAa;IAC/E,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,UAAU,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;AAClD,CAAC","sourcesContent":["/**\n * Sealing an OWNER's provider credential at rest — an organization's, or a person's own.\n *\n * ## What this is for\n *\n * A credential toward a third party is stored in the application's own database, in a row its owner\n * can create over HTTP. A database backup, a snapshot handed to a support engineer, or a read\n * replica reached through an unrelated defect would otherwise expose every stored vendor credential\n * in plaintext. Sealing them does not make the store safe to lose — nothing does — but it means\n * losing the store is not the same event as losing every tenant's and every person's Slack, CRM and\n * SMTP access.\n *\n * ## The key is the platform's existing material, deliberately\n *\n * `secrets.security.session.encryptionKey` is provisioned for every application by the platform\n * (apps-manager mints it, the schema requires at least 32 characters, and readiness refuses an\n * application without one). Introducing a second key here would mean a second thing to provision, a\n * second thing to rotate, and a second way for an application to be half-configured — and the first\n * application to hit that would discover it as \"my credentials cannot be decrypted\", after the\n * values were already stored.\n *\n * The base key is NOT used directly. It is domain-separated through SHA-256 so this subsystem's key\n * is unrelated to the session subsystem's, and to the SIEM delivery subsystem's, even though all\n * three derive from the same material. Without the separator, a weakness or an oracle in one becomes\n * a weakness in the others.\n *\n * ## AES-256-GCM, and why authentication is the load-bearing half\n *\n * GCM authenticates as well as encrypts, so a modified ciphertext FAILS rather than decrypting to\n * garbage. That matters more than the confidentiality here: an attacker with write access to the\n * store but not the key must not be able to flip a tenant's credential to a value of their choosing,\n * or to swap tenant A's sealed credential into tenant B's row and have it silently work. The\n * associated data below closes the second half of that.\n *\n * ## The envelope BINDS the row's identity\n *\n * The additional authenticated data is the owner, the provider and the slug. Moving a sealed value\n * to a different owner, a different provider or a different slug therefore makes it fail to open —\n * the seal is not merely \"this is a secret\", it is \"this is THIS owner's secret for THIS provider\".\n * Cut-and-paste of ciphertext between rows is the attack a plain AES-GCM envelope would let through,\n * and it is exactly the attack a shared multi-tenant table invites.\n *\n * ## The SCOPE separates the KEY, not the associated data\n *\n * An organization's credential and a person's own credential are sealed under DIFFERENT derived\n * keys, selected by `ownerScope`. Two reasons, and the second is why it is the key rather than one\n * more field in the associated data.\n *\n * A key split is strictly stronger: with a scope field in the AAD, one derived key protects both\n * populations, so anything that compromises it compromises both. With separate keys, a user\n * envelope cannot be opened as an organization envelope even by an attacker who controls the AAD.\n *\n * And it PRESERVES what is already stored. Adding a component to the associated data changes the\n * AAD of every organization envelope ever written, so every credential in every live application\n * would stop opening the moment this file changed — the failure would surface as \"my Slack\n * integration broke\", far from the edit that caused it. Selecting the key domain by scope leaves\n * the organization derivation and the organization AAD byte-identical, so existing rows are\n * untouched by construction rather than by care.\n *\n * ## A second implementation exists, and this is not it\n *\n * `siem-webhook-delivery.backend.service.ts` carries a private AES-256-GCM envelope with the same\n * shape and its own domain separator. It is deliberately NOT reused or refactored here: that file\n * belongs to another workstream's territory, its envelope binds no associated data, and it tolerates\n * plaintext for rows written before it existed — a tolerance this subsystem must not inherit.\n * Converging the two is real work with a real migration, and it is recorded as such rather than done\n * opportunistically inside a security slice.\n */\n\nimport { createCipheriv, createDecipheriv, createHash, randomBytes, timingSafeEqual } from 'node:crypto';\n\nimport { ExternalProvider_Connection_OwnerScope } from '@wildo-ai/external-connectors-models';\n\n/**\n * Domain separators, one per owner scope. Changing one of these strings makes every credential\n * stored under it unopenable, so they are versioned constants rather than descriptions: if a\n * derivation ever has to change, the new scheme gets a new prefix and a migration, never an edit\n * here.\n *\n * The ORGANIZATION value predates the USER scope and is reproduced exactly — every organization\n * credential in every live application is sealed under it.\n *\n * Total over the two scopes that reach a store. APPLICATION is deliberately absent rather than\n * mapped to something: the application's own credential lives in the deployment environment and\n * never enters this module, so a call arriving with that scope is a routing defect, and giving it a\n * key would let the defect store a row instead of announcing itself.\n */\nconst PROVIDER_CREDENTIAL_KEY_DOMAINS: Readonly<Record<\n  ExternalProvider_Connection_OwnerScope.ORGANIZATION | ExternalProvider_Connection_OwnerScope.USER,\n  string\n>> = {\n  [ExternalProvider_Connection_OwnerScope.ORGANIZATION]: 'wildo:organization-provider-credential:v1',\n  [ExternalProvider_Connection_OwnerScope.USER]: 'wildo:user-provider-credential:v1',\n};\n\n/**\n * Envelope prefix. Present so a stored value can be RECOGNISED as sealed without attempting to\n * decrypt it — which is what lets the write path refuse to persist an unsealed value, rather than\n * discovering the problem at read time when the plaintext is already at rest.\n */\nexport const PROVIDER_CREDENTIAL_ENVELOPE_PREFIX = 'wildo-sealed:aes-256-gcm:';\n\n/** 96 bits — the GCM nonce size every implementation agrees on. */\nconst IV_BYTE_LENGTH = 12;\nconst AUTH_TAG_BYTE_LENGTH = 16;\n\n/**\n * An even-length run of hex digits and nothing else.\n *\n * Even-length because two hex characters encode one byte — an odd-length component cannot have come\n * from `Buffer.toString('hex')`, and `Buffer.from` would drop the trailing nibble without complaint.\n */\nconst STRICT_HEX = /^(?:[0-9a-fA-F]{2})+$/;\n\n/**\n * The separator inside the associated data.\n *\n * A NUL, not a colon, and that is what makes the encoding injective: with a `:` join,\n * `('org', 'a:b', 'c')` and `('org', 'a', 'b:c')` produce IDENTICAL associated data, so a sealed\n * value could be moved between two rows whose identities differ only in where a colon falls. A NUL\n * cannot appear in any of the three components — they come from an id generator and from\n * schema-validated identifiers — so no two distinct identities can collide.\n */\nconst BINDING_SEPARATOR = '\\u0000';\n\n/** Raised when a sealed value cannot be sealed or opened. Never carries the value or any part of it. */\nexport class ProviderCredentialEnvelopeError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'ProviderCredentialEnvelopeError';\n  }\n}\n\n/**\n * The row identity a sealed value is bound to. All four are required — see the module JSDoc.\n *\n * `ownerId` is the organization id or the user id, per `ownerScope`. One field rather than two\n * optional ones, because exactly one owner exists per row and a shape with two nullable ids can\n * represent a row with neither — a state the seal would then bind to nothing.\n */\nexport interface ProviderCredentialEnvelopeBinding {\n  ownerScope: ExternalProvider_Connection_OwnerScope.ORGANIZATION | ExternalProvider_Connection_OwnerScope.USER;\n  ownerId: string;\n  providerRef: string;\n  secretSlug: string;\n}\n\n/**\n * Derive this subsystem's 32-byte key for one owner scope from the platform's base key material.\n *\n * The refusal on a short or absent base key is deliberate and loud. The alternative — deriving from\n * whatever is there — would produce a working seal from a misconfigured application, and every\n * credential stored under it would be protected by a key an attacker could guess. A configuration\n * error must not be survivable here.\n *\n * The refusal on an unknown scope is the same posture applied to the routing question: a scope with\n * no domain must not silently fall back to another scope's key, because that would seal a person's\n * credential under the tenant key and make it openable by the wrong half of the system.\n */\nfunction deriveProviderCredentialKey(\n  baseEncryptionKey: string,\n  ownerScope: ProviderCredentialEnvelopeBinding['ownerScope'],\n): Buffer {\n  if (typeof baseEncryptionKey !== 'string' || baseEncryptionKey.length < 32) {\n    throw new ProviderCredentialEnvelopeError(\n      'Cannot seal or open a provider credential: the application\\'s '\n      + 'secrets.security.session.encryptionKey is absent or shorter than the 32 characters the platform '\n      + 'guarantees. This is a provisioning fault, not a runtime condition — an application reaching this '\n      + 'point would store credentials under a guessable key.',\n    );\n  }\n  const domain = PROVIDER_CREDENTIAL_KEY_DOMAINS[ownerScope];\n  if (!domain) {\n    throw new ProviderCredentialEnvelopeError(\n      `Cannot seal or open a provider credential owned at scope '${ownerScope}': only ORGANIZATION and USER `\n      + 'credentials are stored. An APPLICATION credential lives in the deployment environment and never '\n      + 'reaches this module, so arriving here with one is a resolution defect rather than a missing key.',\n    );\n  }\n  return createHash('sha256').update(`${domain}:${baseEncryptionKey}`).digest();\n}\n\n/**\n * The additional authenticated data — the row identity, unambiguously encoded.\n *\n * The SCOPE is deliberately not a component: it selects the key instead (module JSDoc), which both\n * separates the two populations more strongly and leaves the encoding of an organization row exactly\n * as it was before the USER scope existed.\n */\nfunction encodeBinding(binding: ProviderCredentialEnvelopeBinding): Buffer {\n  return Buffer.from(\n    [binding.ownerId, binding.providerRef, binding.secretSlug].join(BINDING_SEPARATOR),\n    'utf8',\n  );\n}\n\n/** Whether a stored value is a sealed envelope. Cheap, and does not need the key. */\nexport function isSealedProviderCredential(value: string | undefined | null): boolean {\n  return typeof value === 'string' && value.startsWith(PROVIDER_CREDENTIAL_ENVELOPE_PREFIX);\n}\n\n/**\n * Seal a plaintext credential for storage.\n *\n * Format: `wildo-sealed:aes-256-gcm:<iv hex>:<auth tag hex>:<ciphertext hex>`.\n */\nexport function sealProviderCredential(\n  plaintext: string,\n  baseEncryptionKey: string,\n  binding: ProviderCredentialEnvelopeBinding,\n): string {\n  if (typeof plaintext !== 'string' || plaintext.length === 0) {\n    throw new ProviderCredentialEnvelopeError('Refusing to seal an empty provider credential.');\n  }\n  // Sealing an already-sealed value would double-wrap it, and the second open would return an\n  // envelope string that a provider would then receive as its credential. Refuse rather than nest.\n  if (isSealedProviderCredential(plaintext)) {\n    throw new ProviderCredentialEnvelopeError(\n      'Refusing to seal a value that is already a sealed envelope — double-sealing would hand the envelope '\n      + 'itself to the provider on the next open.',\n    );\n  }\n\n  const key = deriveProviderCredentialKey(baseEncryptionKey, binding.ownerScope);\n  const iv = randomBytes(IV_BYTE_LENGTH);\n  const cipher = createCipheriv('aes-256-gcm', key, iv);\n  cipher.setAAD(encodeBinding(binding));\n\n  const ciphertext = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);\n  const authTag = cipher.getAuthTag();\n\n  return `${PROVIDER_CREDENTIAL_ENVELOPE_PREFIX}${iv.toString('hex')}:${authTag.toString('hex')}:${ciphertext.toString('hex')}`;\n}\n\n/**\n * Open a sealed credential.\n *\n * Every failure — a malformed envelope, a wrong key, a tampered ciphertext, a value lifted from\n * another tenant's row — raises the SAME error type with a message that names the row and nothing\n * else. Distinguishing the causes in the message would tell an attacker holding write access which\n * of their manipulations got closer.\n *\n * Plaintext is REFUSED rather than passed through. The SIEM sibling tolerates it because it has rows\n * predating its own encryption; this subsystem shipped sealed, so a plaintext value in the store can\n * only mean the write path was bypassed — a fact worth failing on, not one worth quietly working\n * around.\n */\nexport function openProviderCredential(\n  sealedValue: string,\n  baseEncryptionKey: string,\n  binding: ProviderCredentialEnvelopeBinding,\n): string {\n  const rowDescription =\n    `${binding.ownerScope} '${binding.ownerId}', provider '${binding.providerRef}', slug '${binding.secretSlug}'`;\n\n  if (!isSealedProviderCredential(sealedValue)) {\n    throw new ProviderCredentialEnvelopeError(\n      `Stored provider credential for ${rowDescription} is not a sealed envelope. Credentials are sealed on `\n      + 'write, so an unsealed value means the row was written by something other than the credential write '\n      + 'path. Rotate it through the credential resource.',\n    );\n  }\n\n  const parts = sealedValue.slice(PROVIDER_CREDENTIAL_ENVELOPE_PREFIX.length).split(':');\n  if (parts.length !== 3) {\n    throw new ProviderCredentialEnvelopeError(`Provider credential for ${rowDescription} cannot be opened.`);\n  }\n  const [ivHex, authTagHex, ciphertextHex] = parts as [string, string, string];\n\n  try {\n    // STRICT hex first, before any decoding. `Buffer.from(value, 'hex')` does not throw on invalid\n    // input — it silently STOPS at the first non-hex character and returns the prefix it managed to\n    // decode. So a stored envelope with trailing garbage would decode to exactly the original bytes\n    // and open successfully, and a component with junk in the middle would decode to a short buffer\n    // that the length checks below might still accept.\n    //\n    // That is not a break of the seal (GCM still authenticates the bytes it is given, so nobody can\n    // CHANGE the credential this way) but it does mean a value that is not what was written could be\n    // accepted as if it were. This module's posture everywhere else is that a stored value which the\n    // write path could not have produced is a fault worth failing on, and this is the same rule.\n    // Found by a pin whose \"tampered\" fixture appended non-hex characters and opened anyway.\n    if (!STRICT_HEX.test(ivHex) || !STRICT_HEX.test(authTagHex) || !STRICT_HEX.test(ciphertextHex)) {\n      throw new Error('malformed envelope components');\n    }\n\n    const iv = Buffer.from(ivHex, 'hex');\n    const authTag = Buffer.from(authTagHex, 'hex');\n    const ciphertext = Buffer.from(ciphertextHex, 'hex');\n\n    // `createDecipheriv` accepts a wrong-length IV for GCM, and a wrong-length tag is rejected only\n    // at `final()`. Both are checked here: a truncated tag is the classic GCM forgery attempt, and it\n    // should be refused before any decryption work happens.\n    if (iv.length !== IV_BYTE_LENGTH || authTag.length !== AUTH_TAG_BYTE_LENGTH || ciphertext.length === 0) {\n      throw new Error('malformed envelope components');\n    }\n\n    const key = deriveProviderCredentialKey(baseEncryptionKey, binding.ownerScope);\n    const decipher = createDecipheriv('aes-256-gcm', key, iv);\n    decipher.setAAD(encodeBinding(binding));\n    decipher.setAuthTag(authTag);\n\n    const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8');\n    if (plaintext.length === 0) {\n      throw new Error('empty plaintext');\n    }\n    return plaintext;\n  } catch (error) {\n    // The cause is deliberately NOT propagated: a crypto-layer message is uninformative to an\n    // operator and informative to an attacker probing the envelope.\n    if (error instanceof ProviderCredentialEnvelopeError) {\n      throw error;\n    }\n    throw new ProviderCredentialEnvelopeError(\n      `Provider credential for ${rowDescription} cannot be opened. Either it was sealed under different key `\n      + 'material, or the stored value has been altered. Rotate the credential through the credential resource.',\n    );\n  }\n}\n\n/**\n * Whether two sealed envelopes are byte-identical, WITHOUT opening either.\n *\n * Returns false whenever it cannot tell — which, because the IV is random per seal, is almost always\n * for two independent seals of the same secret. That is the honest answer and the reason this\n * exists: the write path needs to know whether the stored value actually changed so it can emit a\n * rotation event rather than a set event, and the only alternative was to open both and compare\n * plaintexts, which puts two secrets in memory to answer a bookkeeping question. A false negative\n * costs a slightly noisier audit trail; opening the values costs the property this module exists to\n * hold.\n */\nexport function sealedProviderCredentialsAreIdentical(left: string, right: string): boolean {\n  if (!isSealedProviderCredential(left) || !isSealedProviderCredential(right)) {\n    return false;\n  }\n  const leftBuffer = Buffer.from(left, 'utf8');\n  const rightBuffer = Buffer.from(right, 'utf8');\n  if (leftBuffer.length !== rightBuffer.length) {\n    return false;\n  }\n  return timingSafeEqual(leftBuffer, rightBuffer);\n}\n"]}
+{"version":3,"file":"provider-credential-envelope.backend.utils.js","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/utils/provider-credential-envelope.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEzG,OAAO,EAAE,sCAAsC,EAAE,MAAM,sCAAsC,CAAC;AAE9F;;;;;;;;;;;;;GAaG;AACH,MAAM,+BAA+B,GAGhC;IACH,CAAC,sCAAsC,CAAC,YAAY,CAAC,EAAE,2CAA2C;IAClG,CAAC,sCAAsC,CAAC,IAAI,CAAC,EAAE,mCAAmC;CACnF,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,2BAA2B,CAAC;AAE/E,mEAAmE;AACnE,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAE3C;;;;;;;;GAQG;AACH,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAEnC,wGAAwG;AACxG,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IACxD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;IAChD,CAAC;CACF;AAgBD;;;;;;;;;;;GAWG;AACH,SAAS,2BAA2B,CAClC,iBAAyB,EACzB,UAA2D;IAE3D,IAAI,OAAO,iBAAiB,KAAK,QAAQ,IAAI,iBAAiB,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC3E,MAAM,IAAI,+BAA+B,CACvC,gEAAgE;cAC9D,kGAAkG;cAClG,mGAAmG;cACnG,sDAAsD,CACzD,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,+BAA+B,CAAC,UAAU,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,+BAA+B,CACvC,6DAA6D,UAAU,gCAAgC;cACrG,kGAAkG;cAClG,kGAAkG,CACrG,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAChF,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,OAA0C;IAC/D,OAAO,MAAM,CAAC,IAAI,CAChB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAClF,MAAM,CACP,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,0BAA0B,CAAC,KAAgC;IACzE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,mCAAmC,CAAC,CAAC;AAC5F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,SAAiB,EACjB,iBAAyB,EACzB,OAA0C;IAE1C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,+BAA+B,CAAC,gDAAgD,CAAC,CAAC;IAC9F,CAAC;IACD,4FAA4F;IAC5F,iGAAiG;IACjG,IAAI,0BAA0B,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,+BAA+B,CACvC,sGAAsG;cACpG,0CAA0C,CAC7C,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,2BAA2B,CAAC,iBAAiB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/E,MAAM,EAAE,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAEtC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEpC,OAAO,GAAG,mCAAmC,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAChI,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CACpC,WAAmB,EACnB,iBAAyB,EACzB,OAA0C;IAE1C,MAAM,cAAc,GAClB,GAAG,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,OAAO,gBAAgB,OAAO,CAAC,WAAW,YAAY,OAAO,CAAC,UAAU,GAAG,CAAC;IAEhH,IAAI,CAAC,0BAA0B,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,+BAA+B,CACvC,kCAAkC,cAAc,uDAAuD;cACrG,qGAAqG;cACrG,kDAAkD,CACrD,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,mCAAmC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,+BAA+B,CAAC,2BAA2B,cAAc,oBAAoB,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,GAAG,KAAiC,CAAC;IAE7E,IAAI,CAAC;QACH,+FAA+F;QAC/F,gGAAgG;QAChG,gGAAgG;QAChG,gGAAgG;QAChG,mDAAmD;QACnD,EAAE;QACF,gGAAgG;QAChG,iGAAiG;QACjG,iGAAiG;QACjG,6FAA6F;QAC7F,yFAAyF;QACzF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YAC/F,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QAErD,gGAAgG;QAChG,kGAAkG;QAClG,wDAAwD;QACxD,IAAI,EAAE,CAAC,MAAM,KAAK,cAAc,IAAI,OAAO,CAAC,MAAM,KAAK,oBAAoB,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvG,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,GAAG,GAAG,2BAA2B,CAAC,iBAAiB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC/E,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1D,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;QACxC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE7B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAClG,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,0FAA0F;QAC1F,gEAAgE;QAChE,IAAI,KAAK,YAAY,+BAA+B,EAAE,CAAC;YACrD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,+BAA+B,CACvC,2BAA2B,cAAc,8DAA8D;cACrG,wGAAwG,CAC3G,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qCAAqC,CAAC,IAAY,EAAE,KAAa;IAC/E,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,UAAU,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;AAClD,CAAC","sourcesContent":["/**\n * Sealing an OWNER's provider credential at rest — an organization's, or a person's own.\n *\n * ## What this is for\n *\n * A credential toward a third party is stored in the application's own database, in a row its owner\n * can create over HTTP. A database backup, a snapshot handed to a support engineer, or a read\n * replica reached through an unrelated defect would otherwise expose every stored vendor credential\n * in plaintext. Sealing them does not make the store safe to lose — nothing does — but it means\n * losing the store is not the same event as losing every tenant's and every person's Slack, CRM and\n * SMTP access.\n *\n * ## The key is the platform's existing material, deliberately\n *\n * `secrets.security.session.encryptionKey` is provisioned for every application by the platform\n * (apps-manager mints it, the schema requires at least 32 characters, and readiness refuses an\n * application without one). Introducing a second key here would mean a second thing to provision, a\n * second thing to rotate, and a second way for an application to be half-configured — and the first\n * application to hit that would discover it as \"my credentials cannot be decrypted\", after the\n * values were already stored.\n *\n * The base key is NOT used directly. It is domain-separated through SHA-256 so this subsystem's key\n * is unrelated to the session subsystem's, and to the SIEM delivery subsystem's, even though all\n * three derive from the same material. Without the separator, a weakness or an oracle in one becomes\n * a weakness in the others.\n *\n * ## AES-256-GCM, and why authentication is the load-bearing half\n *\n * GCM authenticates as well as encrypts, so a modified ciphertext FAILS rather than decrypting to\n * garbage. That matters more than the confidentiality here: an attacker with write access to the\n * store but not the key must not be able to flip a tenant's credential to a value of their choosing,\n * or to swap tenant A's sealed credential into tenant B's row and have it silently work. The\n * associated data below closes the second half of that.\n *\n * ## The envelope BINDS the row's identity\n *\n * The additional authenticated data is the owner, the provider and the slug. Moving a sealed value\n * to a different owner, a different provider or a different slug therefore makes it fail to open —\n * the seal is not merely \"this is a secret\", it is \"this is THIS owner's secret for THIS provider\".\n * Cut-and-paste of ciphertext between rows is the attack a plain AES-GCM envelope would let through,\n * and it is exactly the attack a shared multi-tenant table invites.\n *\n * ## The SCOPE separates the KEY, not the associated data\n *\n * An organization's credential and a person's own credential are sealed under DIFFERENT derived\n * keys, selected by `ownerScope`. Two reasons, and the second is why it is the key rather than one\n * more field in the associated data.\n *\n * A key split is strictly stronger: with a scope field in the AAD, one derived key protects both\n * populations, so anything that compromises it compromises both. With separate keys, a user\n * envelope cannot be opened as an organization envelope even by an attacker who controls the AAD.\n *\n * And it PRESERVES what is already stored. Adding a component to the associated data changes the\n * AAD of every organization envelope ever written, so every credential in every live application\n * would stop opening the moment this file changed — the failure would surface as \"my Slack\n * integration broke\", far from the edit that caused it. Selecting the key domain by scope leaves\n * the organization derivation and the organization AAD byte-identical, so existing rows are\n * untouched by construction rather than by care.\n *\n * ## A second implementation exists, and this is not it\n *\n * `siem-webhook-delivery.backend.service.ts` carries a private AES-256-GCM envelope with the same\n * shape and its own domain separator. It is deliberately NOT reused or refactored here: that file\n * belongs to another workstream's territory, its envelope binds no associated data, and it tolerates\n * plaintext for rows written before it existed — a tolerance this subsystem must not inherit.\n * Converging the two is real work with a real migration, and it is recorded as such rather than done\n * opportunistically inside a security slice.\n */\n\nimport { createCipheriv, createDecipheriv, createHash, randomBytes, timingSafeEqual } from 'node:crypto';\n\nimport { ExternalProvider_Connection_OwnerScope } from '@wildo-ai/external-connectors-models';\n\n/**\n * Domain separators, one per owner scope. Changing one of these strings makes every credential\n * stored under it unopenable, so they are versioned constants rather than descriptions: if a\n * derivation ever has to change, the new scheme gets a new prefix and a migration, never an edit\n * here.\n *\n * The ORGANIZATION value predates the USER scope and is reproduced exactly — every organization\n * credential in every live application is sealed under it.\n *\n * Total over the two scopes that reach a store. APPLICATION is deliberately absent rather than\n * mapped to something: the application's own credential lives in the deployment environment and\n * never enters this module, so a call arriving with that scope is a routing defect, and giving it a\n * key would let the defect store a row instead of announcing itself.\n */\nconst PROVIDER_CREDENTIAL_KEY_DOMAINS: Readonly<Record<\n  ExternalProvider_Connection_OwnerScope.ORGANIZATION | ExternalProvider_Connection_OwnerScope.USER,\n  string\n>> = {\n  [ExternalProvider_Connection_OwnerScope.ORGANIZATION]: 'wildo:organization-provider-credential:v1',\n  [ExternalProvider_Connection_OwnerScope.USER]: 'wildo:user-provider-credential:v1',\n};\n\n/**\n * Envelope prefix. Present so a stored value can be RECOGNISED as sealed without attempting to\n * decrypt it — which is what lets the write path refuse to persist an unsealed value, rather than\n * discovering the problem at read time when the plaintext is already at rest.\n */\nexport const PROVIDER_CREDENTIAL_ENVELOPE_PREFIX = 'wildo-sealed:aes-256-gcm:';\n\n/** 96 bits — the GCM nonce size every implementation agrees on. */\nconst IV_BYTE_LENGTH = 12;\nconst AUTH_TAG_BYTE_LENGTH = 16;\n\n/**\n * An even-length run of hex digits and nothing else.\n *\n * Even-length because two hex characters encode one byte — an odd-length component cannot have come\n * from `Buffer.toString('hex')`, and `Buffer.from` would drop the trailing nibble without complaint.\n */\nconst STRICT_HEX = /^(?:[0-9a-fA-F]{2})+$/;\n\n/**\n * The separator inside the associated data.\n *\n * A NUL, not a colon, and that is what makes the encoding injective: with a `:` join,\n * `('org', 'a:b', 'c')` and `('org', 'a', 'b:c')` produce IDENTICAL associated data, so a sealed\n * value could be moved between two rows whose identities differ only in where a colon falls. A NUL\n * cannot appear in any of the three components — they come from an id generator and from\n * schema-validated identifiers — so no two distinct identities can collide.\n */\nconst BINDING_SEPARATOR = '\\u0000';\n\n/** Raised when a sealed value cannot be sealed or opened. Never carries the value or any part of it. */\nexport class ProviderCredentialEnvelopeError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'ProviderCredentialEnvelopeError';\n  }\n}\n\n/**\n * The row identity a sealed value is bound to. All four are required — see the module JSDoc.\n *\n * `ownerId` is the organization id or the user id, per `ownerScope`. One field rather than two\n * optional ones, because exactly one owner exists per row and a shape with two nullable ids can\n * represent a row with neither — a state the seal would then bind to nothing.\n */\nexport interface ProviderCredentialEnvelopeBinding {\n  ownerScope: ExternalProvider_Connection_OwnerScope.ORGANIZATION | ExternalProvider_Connection_OwnerScope.USER;\n  ownerId: string;\n  providerRef: string;\n  secretSlug: string;\n}\n\n/**\n * Derive this subsystem's 32-byte key for one owner scope from the platform's base key material.\n *\n * The refusal on a short or absent base key is deliberate and loud. The alternative — deriving from\n * whatever is there — would produce a working seal from a misconfigured application, and every\n * credential stored under it would be protected by a key an attacker could guess. A configuration\n * error must not be survivable here.\n *\n * The refusal on an unknown scope is the same posture applied to the routing question: a scope with\n * no domain must not silently fall back to another scope's key, because that would seal a person's\n * credential under the tenant key and make it openable by the wrong half of the system.\n */\nfunction deriveProviderCredentialKey(\n  baseEncryptionKey: string,\n  ownerScope: ProviderCredentialEnvelopeBinding['ownerScope'],\n): Buffer {\n  if (typeof baseEncryptionKey !== 'string' || baseEncryptionKey.length < 32) {\n    throw new ProviderCredentialEnvelopeError(\n      'Cannot seal or open a provider credential: the application\\'s '\n      + 'secrets.security.session.encryptionKey is absent or shorter than the 32 characters the platform '\n      + 'guarantees. This is a provisioning fault, not a runtime condition — an application reaching this '\n      + 'point would store credentials under a guessable key.',\n    );\n  }\n  const domain = PROVIDER_CREDENTIAL_KEY_DOMAINS[ownerScope];\n  if (!domain) {\n    throw new ProviderCredentialEnvelopeError(\n      `Cannot seal or open a provider credential owned at scope '${ownerScope}': only ORGANIZATION and USER `\n      + 'credentials are stored. An APPLICATION credential lives in the deployment environment and never '\n      + 'reaches this module, so arriving here with one is a resolution defect rather than a missing key.',\n    );\n  }\n  return createHash('sha256').update(`${domain}:${baseEncryptionKey}`).digest();\n}\n\n/**\n * The additional authenticated data — the row identity, unambiguously encoded.\n *\n * The SCOPE is deliberately not a component: it selects the key instead (module JSDoc), which both\n * separates the two populations more strongly and leaves the encoding of an organization row exactly\n * as it was before the USER scope existed.\n */\nfunction encodeBinding(binding: ProviderCredentialEnvelopeBinding): Buffer {\n  return Buffer.from(\n    [binding.ownerId, binding.providerRef, binding.secretSlug].join(BINDING_SEPARATOR),\n    'utf8',\n  );\n}\n\n/** Whether a stored value is a sealed envelope. Cheap, and does not need the key. */\nexport function isSealedProviderCredential(value: string | undefined | null): boolean {\n  return typeof value === 'string' && value.startsWith(PROVIDER_CREDENTIAL_ENVELOPE_PREFIX);\n}\n\n/**\n * Seal a plaintext credential for storage.\n *\n * Format: `wildo-sealed:aes-256-gcm:<iv hex>:<auth tag hex>:<ciphertext hex>`.\n */\nexport function sealProviderCredential(\n  plaintext: string,\n  baseEncryptionKey: string,\n  binding: ProviderCredentialEnvelopeBinding,\n): string {\n  if (typeof plaintext !== 'string' || plaintext.length === 0) {\n    throw new ProviderCredentialEnvelopeError('Refusing to seal an empty provider credential.');\n  }\n  // Sealing an already-sealed value would double-wrap it, and the second open would return an\n  // envelope string that a provider would then receive as its credential. Refuse rather than nest.\n  if (isSealedProviderCredential(plaintext)) {\n    throw new ProviderCredentialEnvelopeError(\n      'Refusing to seal a value that is already a sealed envelope — double-sealing would hand the envelope '\n      + 'itself to the provider on the next open.',\n    );\n  }\n\n  const key = deriveProviderCredentialKey(baseEncryptionKey, binding.ownerScope);\n  const iv = randomBytes(IV_BYTE_LENGTH);\n  const cipher = createCipheriv('aes-256-gcm', key, iv);\n  cipher.setAAD(encodeBinding(binding));\n\n  const ciphertext = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);\n  const authTag = cipher.getAuthTag();\n\n  return `${PROVIDER_CREDENTIAL_ENVELOPE_PREFIX}${iv.toString('hex')}:${authTag.toString('hex')}:${ciphertext.toString('hex')}`;\n}\n\n/**\n * Open a sealed credential.\n *\n * Every failure — a malformed envelope, a wrong key, a tampered ciphertext, a value lifted from\n * another tenant's row — raises the SAME error type with a message that names the row and nothing\n * else. Distinguishing the causes in the message would tell an attacker holding write access which\n * of their manipulations got closer.\n *\n * Plaintext is REFUSED rather than passed through. The SIEM sibling tolerates it because it has rows\n * predating its own encryption; this subsystem shipped sealed, so a plaintext value in the store can\n * only mean the write path was bypassed — a fact worth failing on, not one worth quietly working\n * around.\n */\nexport function openProviderCredential(\n  sealedValue: string,\n  baseEncryptionKey: string,\n  binding: ProviderCredentialEnvelopeBinding,\n): string {\n  const rowDescription =\n    `${binding.ownerScope} '${binding.ownerId}', provider '${binding.providerRef}', slug '${binding.secretSlug}'`;\n\n  if (!isSealedProviderCredential(sealedValue)) {\n    throw new ProviderCredentialEnvelopeError(\n      `Stored provider credential for ${rowDescription} is not a sealed envelope. Credentials are sealed on `\n      + 'write, so an unsealed value means the row was written by something other than the credential write '\n      + 'path. Rotate it through the credential resource.',\n    );\n  }\n\n  const parts = sealedValue.slice(PROVIDER_CREDENTIAL_ENVELOPE_PREFIX.length).split(':');\n  if (parts.length !== 3) {\n    throw new ProviderCredentialEnvelopeError(`Provider credential for ${rowDescription} cannot be opened.`);\n  }\n  const [ivHex, authTagHex, ciphertextHex] = parts as [string, string, string];\n\n  try {\n    // STRICT hex first, before any decoding. `Buffer.from(value, 'hex')` does not throw on invalid\n    // input — it silently STOPS at the first non-hex character and returns the prefix it managed to\n    // decode. So a stored envelope with trailing garbage would decode to exactly the original bytes\n    // and open successfully, and a component with junk in the middle would decode to a short buffer\n    // that the length checks below might still accept.\n    //\n    // That is not a break of the seal (GCM still authenticates the bytes it is given, so nobody can\n    // CHANGE the credential this way) but it does mean a value that is not what was written could be\n    // accepted as if it were. This module's posture everywhere else is that a stored value which the\n    // write path could not have produced is a fault worth failing on, and this is the same rule.\n    // Found by a pin whose \"tampered\" fixture appended non-hex characters and opened anyway.\n    if (!STRICT_HEX.test(ivHex) || !STRICT_HEX.test(authTagHex) || !STRICT_HEX.test(ciphertextHex)) {\n      throw new Error('malformed envelope components');\n    }\n\n    const iv = Buffer.from(ivHex, 'hex');\n    const authTag = Buffer.from(authTagHex, 'hex');\n    const ciphertext = Buffer.from(ciphertextHex, 'hex');\n\n    // `createDecipheriv` accepts a wrong-length IV for GCM, and a wrong-length tag is rejected only\n    // at `final()`. Both are checked here: a truncated tag is the classic GCM forgery attempt, and it\n    // should be refused before any decryption work happens.\n    if (iv.length !== IV_BYTE_LENGTH || authTag.length !== AUTH_TAG_BYTE_LENGTH || ciphertext.length === 0) {\n      throw new Error('malformed envelope components');\n    }\n\n    const key = deriveProviderCredentialKey(baseEncryptionKey, binding.ownerScope);\n    const decipher = createDecipheriv('aes-256-gcm', key, iv);\n    decipher.setAAD(encodeBinding(binding));\n    decipher.setAuthTag(authTag);\n\n    const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8');\n    if (plaintext.length === 0) {\n      throw new Error('empty plaintext');\n    }\n    return plaintext;\n  } catch (error) {\n    // The cause is deliberately NOT propagated: a crypto-layer message is uninformative to an\n    // operator and informative to an attacker probing the envelope.\n    if (error instanceof ProviderCredentialEnvelopeError) {\n      throw error;\n    }\n    throw new ProviderCredentialEnvelopeError(\n      `Provider credential for ${rowDescription} cannot be opened. Either it was sealed under different key `\n      + 'material, or the stored value has been altered. Rotate the credential through the credential resource.',\n    );\n  }\n}\n\n/**\n * Whether two sealed envelopes are byte-identical, WITHOUT opening either.\n *\n * Returns false whenever it cannot tell — which, because the IV is random per seal, is almost always\n * for two independent seals of the same secret. That is the honest answer and the reason this\n * exists: the write path needs to know whether the stored value actually changed so it can emit a\n * rotation event rather than a set event, and the only alternative was to open both and compare\n * plaintexts, which puts two secrets in memory to answer a bookkeeping question. A false negative\n * costs a slightly noisier audit trail; opening the values costs the property this module exists to\n * hold.\n */\nexport function sealedProviderCredentialsAreIdentical(left: string, right: string): boolean {\n  if (!isSealedProviderCredential(left) || !isSealedProviderCredential(right)) {\n    return false;\n  }\n  const leftBuffer = Buffer.from(left, 'utf8');\n  const rightBuffer = Buffer.from(right, 'utf8');\n  if (leftBuffer.length !== rightBuffer.length) {\n    return false;\n  }\n  return timingSafeEqual(leftBuffer, rightBuffer);\n}\n"]}

package/dist/esm/security/connected-accounts/utils/stored-credential-value.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stored-credential-value.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/security/connected-accounts/utils/stored-credential-value.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,uBAAuB,CAAC;AAE/B,mGAAmG;AACnG,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,wBAAwB;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC;CACtC;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM;AACnB;;;;;;;GAOG;AACH,UAAU,UAAQ,GACjB,wBAAwB,CAmC1B"}
+{"version":3,"file":"stored-credential-value.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/utils/stored-credential-value.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,uBAAuB,CAAC;AAE/B,mGAAmG;AACnG,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,wBAAwB;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC;CACtC;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM;AACnB;;;;;;;GAOG;AACH,UAAU,UAAQ,GACjB,wBAAwB,CAmC1B"}

package/dist/esm/security/connected-accounts/utils/stored-credential-value.backend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"stored-credential-value.backend.utils.js","sourceRoot":"","sources":["../../../../../../src/security/connected-accounts/utils/stored-credential-value.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EACL,wBAAwB,EACxB,+BAA+B,GAEhC,MAAM,uBAAuB,CAAC;AAE/B,mGAAmG;AACnG,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AA4BD;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,SAAiB,EACjB,WAAmB;AACnB;;;;;;;GAOG;AACH,UAAU,GAAG,KAAK;IAElB,gGAAgG;IAChG,iGAAiG;IACjG,gGAAgG;IAChG,MAAM,KAAK,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,+BAA+B,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QACtD,CAAC;QACD,0EAA0E;QAC1E,EAAE;QACF,8FAA8F;QAC9F,8FAA8F;QAC9F,iGAAiG;QACjG,+FAA+F;QAC/F,WAAW;QACX,EAAE;QACF,+FAA+F;QAC/F,2FAA2F;QAC3F,gGAAgG;QAChG,+FAA+F;QAC/F,gGAAgG;QAChG,iGAAiG;QACjG,MAAM,IAAI,0BAA0B,CAClC,wBAAwB,WAAW,6DAA6D;cAC9F,6FAA6F;cAC7F,yDAAyD,CAC5D,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC;AACjD,CAAC","sourcesContent":["/**\n * Turning what a credential row STORES into what goes on the wire.\n *\n * Two things can be sealed into `secretValue`, and they are spent differently:\n *\n * - a credential a person PASTED, which is already the wire value;\n * - an OAuth2 grant a vendor MINTED, whose wire value is one field of a JSON document.\n *\n * This is the single place that distinction is resolved. It exists as one function rather than a\n * branch in each store because both stores — organization and user — hold both shapes, and an\n * invariant applied at one of its two call sites is this repository's most repeated defect. The\n * failure it prevents is specific and silent: a store that returned the opened plaintext directly\n * would put `wildo-oauth2-grant:{\"kind\":…}` on the wire as a bearer token, and the vendor's 401\n * would name a credential problem rather than a serialization one.\n *\n * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — the token actually presented to a\n * third party is derived from the stored grant rather than from whatever the field happens to hold.\n */\n\nimport {\n  parseProviderOAuth2Grant,\n  providerOAuth2GrantNeedsRefresh,\n  type ProviderOAuth2Grant,\n} from '@wildo-ai/saas-models';\n\n/** Raised when a stored credential cannot be turned into a wire value. Never carries the value. */\nexport class StoredCredentialValueError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'StoredCredentialValueError';\n  }\n}\n\nexport interface ResolvedStoredCredential {\n  /**\n   * What goes in the Authorization header.\n   *\n   * Empty string when {@link needsRefresh} is set — there is no honest wire value for a grant that\n   * must be renewed first, and returning the expired token would let a caller that ignored the flag\n   * send it. A caller must branch on `needsRefresh` before reading this.\n   */\n  readonly wireValue: string;\n  /**\n   * The grant is expiring and a refresher is available: the caller must renew it, persist the\n   * result, and use the renewed access token.\n   *\n   * A FLAG rather than a refresh performed here, because renewing needs the provider contract and\n   * the application's registration while persisting needs the table and the envelope key — and this\n   * function is a pure transformation with neither.\n   */\n  readonly needsRefresh?: true;\n  /**\n   * The grant it came from, when it came from one. Carried out so a caller can record what the\n   * vendor granted, or refresh it — and ABSENT for a pasted credential, which is what lets a caller\n   * tell the two apart without re-parsing.\n   */\n  readonly grant?: ProviderOAuth2Grant;\n}\n\n/**\n * Resolve the opened plaintext of one credential row into the value a request should carry.\n *\n * @param plaintext the opened envelope contents — already decrypted, never the sealed form.\n * @param describeRow how to name the row in a refusal. Never the value, and never the owner's id\n *   alone: an operator reading a log needs the provider and slug to act.\n */\nexport function resolveStoredCredentialValue(\n  plaintext: string,\n  describeRow: string,\n  /**\n   * Whether the caller can actually renew an expiring grant.\n   *\n   * Passed in rather than assumed, so the two outcomes stay distinguishable: with a refresher this\n   * returns `needsRefresh` and the caller renews; without one it REFUSES, naming the missing\n   * subsystem. Defaulting to \"yes\" would have a store with no refresher return `needsRefresh` and\n   * then dereference a refresher it does not hold.\n   */\n  canRefresh = false,\n): ResolvedStoredCredential {\n  // Throws when the value announces itself as a grant and is not one — deliberately not caught. A\n  // credential claiming a shape it does not have was written by something other than the exchange,\n  // and falling back to \"treat it as pasted\" would send the malformed document itself as a token.\n  const grant = parseProviderOAuth2Grant(plaintext);\n  if (grant === undefined) {\n    return { wireValue: plaintext };\n  }\n\n  if (providerOAuth2GrantNeedsRefresh(grant)) {\n    if (canRefresh) {\n      return { wireValue: '', grant, needsRefresh: true };\n    }\n    // Fail CLOSED, and name the missing subsystem rather than the credential.\n    //\n    // The alternative — send it anyway and let the vendor reject it — was rejected: the 401 comes\n    // back as an authentication failure, the row is stamped INVALID, and the person reading their\n    // connections is told their credential is bad when it is merely stale. That is a false statement\n    // about their account, and it points them at reconnecting rather than at the refresh that does\n    // not run.\n    //\n    // The population is NO LONGER empty. This was written when nothing could store a grant, so the\n    // refusal was unreachable; the authorization exchange has since landed and real grants are\n    // stored, which makes this the live answer whenever a store is constructed without a refresher.\n    // The engine's container always binds one — pinned in `container-boot-graph-resolves.test.ts`,\n    // because the injection is `@optional()` and an absent binding is otherwise silent for about an\n    // hour. So reaching this in a running application means the wiring is wrong, not the credential.\n    throw new StoredCredentialValueError(\n      `The OAuth2 grant for ${describeRow} has expired or is within the refresh window, and no token `\n      + 'refresher is wired to renew it. The stored credential is not at fault — reconnecting would '\n      + 'work, and so would the refresh exchange once it exists.',\n    );\n  }\n\n  return { wireValue: grant.accessToken, grant };\n}\n"]}
+{"version":3,"file":"stored-credential-value.backend.utils.js","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/utils/stored-credential-value.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EACL,wBAAwB,EACxB,+BAA+B,GAEhC,MAAM,uBAAuB,CAAC;AAE/B,mGAAmG;AACnG,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AA4BD;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,SAAiB,EACjB,WAAmB;AACnB;;;;;;;GAOG;AACH,UAAU,GAAG,KAAK;IAElB,gGAAgG;IAChG,iGAAiG;IACjG,gGAAgG;IAChG,MAAM,KAAK,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,+BAA+B,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QACtD,CAAC;QACD,0EAA0E;QAC1E,EAAE;QACF,8FAA8F;QAC9F,8FAA8F;QAC9F,iGAAiG;QACjG,+FAA+F;QAC/F,WAAW;QACX,EAAE;QACF,+FAA+F;QAC/F,2FAA2F;QAC3F,gGAAgG;QAChG,+FAA+F;QAC/F,gGAAgG;QAChG,iGAAiG;QACjG,MAAM,IAAI,0BAA0B,CAClC,wBAAwB,WAAW,6DAA6D;cAC9F,6FAA6F;cAC7F,yDAAyD,CAC5D,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC;AACjD,CAAC","sourcesContent":["/**\n * Turning what a credential row STORES into what goes on the wire.\n *\n * Two things can be sealed into `secretValue`, and they are spent differently:\n *\n * - a credential a person PASTED, which is already the wire value;\n * - an OAuth2 grant a vendor MINTED, whose wire value is one field of a JSON document.\n *\n * This is the single place that distinction is resolved. It exists as one function rather than a\n * branch in each store because both stores — organization and user — hold both shapes, and an\n * invariant applied at one of its two call sites is this repository's most repeated defect. The\n * failure it prevents is specific and silent: a store that returned the opened plaintext directly\n * would put `wildo-oauth2-grant:{\"kind\":…}` on the wire as a bearer token, and the vendor's 401\n * would name a credential problem rather than a serialization one.\n *\n * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — the token actually presented to a\n * third party is derived from the stored grant rather than from whatever the field happens to hold.\n */\n\nimport {\n  parseProviderOAuth2Grant,\n  providerOAuth2GrantNeedsRefresh,\n  type ProviderOAuth2Grant,\n} from '@wildo-ai/saas-models';\n\n/** Raised when a stored credential cannot be turned into a wire value. Never carries the value. */\nexport class StoredCredentialValueError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'StoredCredentialValueError';\n  }\n}\n\nexport interface ResolvedStoredCredential {\n  /**\n   * What goes in the Authorization header.\n   *\n   * Empty string when {@link needsRefresh} is set — there is no honest wire value for a grant that\n   * must be renewed first, and returning the expired token would let a caller that ignored the flag\n   * send it. A caller must branch on `needsRefresh` before reading this.\n   */\n  readonly wireValue: string;\n  /**\n   * The grant is expiring and a refresher is available: the caller must renew it, persist the\n   * result, and use the renewed access token.\n   *\n   * A FLAG rather than a refresh performed here, because renewing needs the provider contract and\n   * the application's registration while persisting needs the table and the envelope key — and this\n   * function is a pure transformation with neither.\n   */\n  readonly needsRefresh?: true;\n  /**\n   * The grant it came from, when it came from one. Carried out so a caller can record what the\n   * vendor granted, or refresh it — and ABSENT for a pasted credential, which is what lets a caller\n   * tell the two apart without re-parsing.\n   */\n  readonly grant?: ProviderOAuth2Grant;\n}\n\n/**\n * Resolve the opened plaintext of one credential row into the value a request should carry.\n *\n * @param plaintext the opened envelope contents — already decrypted, never the sealed form.\n * @param describeRow how to name the row in a refusal. Never the value, and never the owner's id\n *   alone: an operator reading a log needs the provider and slug to act.\n */\nexport function resolveStoredCredentialValue(\n  plaintext: string,\n  describeRow: string,\n  /**\n   * Whether the caller can actually renew an expiring grant.\n   *\n   * Passed in rather than assumed, so the two outcomes stay distinguishable: with a refresher this\n   * returns `needsRefresh` and the caller renews; without one it REFUSES, naming the missing\n   * subsystem. Defaulting to \"yes\" would have a store with no refresher return `needsRefresh` and\n   * then dereference a refresher it does not hold.\n   */\n  canRefresh = false,\n): ResolvedStoredCredential {\n  // Throws when the value announces itself as a grant and is not one — deliberately not caught. A\n  // credential claiming a shape it does not have was written by something other than the exchange,\n  // and falling back to \"treat it as pasted\" would send the malformed document itself as a token.\n  const grant = parseProviderOAuth2Grant(plaintext);\n  if (grant === undefined) {\n    return { wireValue: plaintext };\n  }\n\n  if (providerOAuth2GrantNeedsRefresh(grant)) {\n    if (canRefresh) {\n      return { wireValue: '', grant, needsRefresh: true };\n    }\n    // Fail CLOSED, and name the missing subsystem rather than the credential.\n    //\n    // The alternative — send it anyway and let the vendor reject it — was rejected: the 401 comes\n    // back as an authentication failure, the row is stamped INVALID, and the person reading their\n    // connections is told their credential is bad when it is merely stale. That is a false statement\n    // about their account, and it points them at reconnecting rather than at the refresh that does\n    // not run.\n    //\n    // The population is NO LONGER empty. This was written when nothing could store a grant, so the\n    // refusal was unreachable; the authorization exchange has since landed and real grants are\n    // stored, which makes this the live answer whenever a store is constructed without a refresher.\n    // The engine's container always binds one — pinned in `container-boot-graph-resolves.test.ts`,\n    // because the injection is `@optional()` and an absent binding is otherwise silent for about an\n    // hour. So reaching this in a running application means the wiring is wrong, not the credential.\n    throw new StoredCredentialValueError(\n      `The OAuth2 grant for ${describeRow} has expired or is within the refresh window, and no token `\n      + 'refresher is wired to renew it. The stored credential is not at fault — reconnecting would '\n      + 'work, and so would the refresh exchange once it exists.',\n    );\n  }\n\n  return { wireValue: grant.accessToken, grant };\n}\n"]}

package/dist/esm/security/connected-accounts/utils/user-delegated-access-token-slot.backend.utils.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Which secret slot holds a PERSON's delegated OAuth2 access token for a provider, and whether the
+ * provider admits such a connection at all.
+ *
+ * Two doors ask this exact question and must answer it identically: the browser access-token route
+ * (#394 P4 — a vendor picker opens as the caller) and a vendor-backed file storage (#394 P5 — a
+ * Drive file is read through the account of the person who linked it). The predicate lived inline
+ * in the route first; it moved here the day the storage needed it, because two copies of "does this
+ * provider hand out a personal token" would be two copies that drift, and the one that drifts
+ * silently is the one no route pins.
+ */
+import type { ExternalProvidersRegistryBackendService } from '../../../external-providers/services/external-providers-registry.backend.service';
+/** Why a provider cannot hand out a personal delegated token. */
+export declare enum UserDelegatedAccessTokenRefusal {
+    /** No REST contract carrying OAuth2, so nothing delegated ever gets minted. */
+    PROVIDER_NOT_CONNECTABLE = "PROVIDER_NOT_CONNECTABLE",
+    /** The provider's admissible-connection catalogue names no USER-owned, SERVICE-delegated shape. */
+    CONNECTION_NOT_ADMISSIBLE = "CONNECTION_NOT_ADMISSIBLE"
+}
+export type UserDelegatedAccessTokenSlot = {
+    readonly admitted: true;
+    readonly secretSlug: string;
+} | {
+    readonly admitted: false;
+    readonly refusal: UserDelegatedAccessTokenRefusal;
+};
+/**
+ * Resolves the slot a person's delegated access token for `providerRef` is stored under, or says
+ * why there is none. `requestedSlug` lets a caller name a different slot of the same provider,
+ * which the browser route accepts as a query parameter; the default is the REST contract's own
+ * `apiKey.secretRef`, which is where the OAuth2 exchange writes the access token.
+ */
+export declare function resolveUserDelegatedAccessTokenSlot(registry: Pick<ExternalProvidersRegistryBackendService, 'getProviderRuntimeContract' | 'getProviderAdmissibleConnections'>, providerRef: string, requestedSlug?: string): UserDelegatedAccessTokenSlot;
+//# sourceMappingURL=user-delegated-access-token-slot.backend.utils.d.ts.map

package/dist/esm/security/connected-accounts/utils/user-delegated-access-token-slot.backend.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-delegated-access-token-slot.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/utils/user-delegated-access-token-slot.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AAE1J,iEAAiE;AACjE,oBAAY,+BAA+B;IACzC,+EAA+E;IAC/E,wBAAwB,6BAA6B;IACrD,mGAAmG;IACnG,yBAAyB,8BAA8B;CACxD;AAED,MAAM,MAAM,4BAA4B,GACpC;IAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,+BAA+B,CAAA;CAAE,CAAC;AAEpF;;;;;GAKG;AACH,wBAAgB,mCAAmC,CACjD,QAAQ,EAAE,IAAI,CAAC,uCAAuC,EAAE,4BAA4B,GAAG,kCAAkC,CAAC,EAC1H,WAAW,EAAE,MAAM,EACnB,aAAa,CAAC,EAAE,MAAM,GACrB,4BAA4B,CAgB9B"}

package/dist/esm/security/connected-accounts/utils/user-delegated-access-token-slot.backend.utils.js

@@ -0,0 +1,39 @@
+/**
+ * Which secret slot holds a PERSON's delegated OAuth2 access token for a provider, and whether the
+ * provider admits such a connection at all.
+ *
+ * Two doors ask this exact question and must answer it identically: the browser access-token route
+ * (#394 P4 — a vendor picker opens as the caller) and a vendor-backed file storage (#394 P5 — a
+ * Drive file is read through the account of the person who linked it). The predicate lived inline
+ * in the route first; it moved here the day the storage needed it, because two copies of "does this
+ * provider hand out a personal token" would be two copies that drift, and the one that drifts
+ * silently is the one no route pins.
+ */
+import { ExternalProvider_Connection_DelegationMode, ExternalProvider_Connection_OwnerScope, ExternalProvider_ExchangeProtocol_Kind, ProviderProtocolRuntimeKind, } from '@wildo-ai/external-connectors-models';
+/** Why a provider cannot hand out a personal delegated token. */
+export var UserDelegatedAccessTokenRefusal;
+(function (UserDelegatedAccessTokenRefusal) {
+    /** No REST contract carrying OAuth2, so nothing delegated ever gets minted. */
+    UserDelegatedAccessTokenRefusal["PROVIDER_NOT_CONNECTABLE"] = "PROVIDER_NOT_CONNECTABLE";
+    /** The provider's admissible-connection catalogue names no USER-owned, SERVICE-delegated shape. */
+    UserDelegatedAccessTokenRefusal["CONNECTION_NOT_ADMISSIBLE"] = "CONNECTION_NOT_ADMISSIBLE";
+})(UserDelegatedAccessTokenRefusal || (UserDelegatedAccessTokenRefusal = {}));
+/**
+ * Resolves the slot a person's delegated access token for `providerRef` is stored under, or says
+ * why there is none. `requestedSlug` lets a caller name a different slot of the same provider,
+ * which the browser route accepts as a query parameter; the default is the REST contract's own
+ * `apiKey.secretRef`, which is where the OAuth2 exchange writes the access token.
+ */
+export function resolveUserDelegatedAccessTokenSlot(registry, providerRef, requestedSlug) {
+    const contract = registry.getProviderRuntimeContract(providerRef, ExternalProvider_ExchangeProtocol_Kind.REST_API);
+    if (contract?.kind !== ProviderProtocolRuntimeKind.REST || contract.oauth2 === undefined) {
+        return { admitted: false, refusal: UserDelegatedAccessTokenRefusal.PROVIDER_NOT_CONNECTABLE };
+    }
+    const admitted = registry.getProviderAdmissibleConnections(providerRef).some((shape) => shape.ownerScope === ExternalProvider_Connection_OwnerScope.USER
+        && shape.delegation === ExternalProvider_Connection_DelegationMode.SERVICE);
+    if (!admitted) {
+        return { admitted: false, refusal: UserDelegatedAccessTokenRefusal.CONNECTION_NOT_ADMISSIBLE };
+    }
+    return { admitted: true, secretSlug: requestedSlug ?? contract.apiKey.secretRef };
+}
+//# sourceMappingURL=user-delegated-access-token-slot.backend.utils.js.map

package/dist/esm/security/connected-accounts/utils/user-delegated-access-token-slot.backend.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-delegated-access-token-slot.backend.utils.js","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/utils/user-delegated-access-token-slot.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,0CAA0C,EAC1C,sCAAsC,EACtC,sCAAsC,EACtC,2BAA2B,GAC5B,MAAM,sCAAsC,CAAC;AAG9C,iEAAiE;AACjE,MAAM,CAAN,IAAY,+BAKX;AALD,WAAY,+BAA+B;IACzC,+EAA+E;IAC/E,wFAAqD,CAAA;IACrD,mGAAmG;IACnG,0FAAuD,CAAA;AACzD,CAAC,EALW,+BAA+B,KAA/B,+BAA+B,QAK1C;AAMD;;;;;GAKG;AACH,MAAM,UAAU,mCAAmC,CACjD,QAA0H,EAC1H,WAAmB,EACnB,aAAsB;IAEtB,MAAM,QAAQ,GAAG,QAAQ,CAAC,0BAA0B,CAAC,WAAW,EAAE,sCAAsC,CAAC,QAAQ,CAAC,CAAC;IACnH,IAAI,QAAQ,EAAE,IAAI,KAAK,2BAA2B,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACzF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,+BAA+B,CAAC,wBAAwB,EAAE,CAAC;IAChG,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,gCAAgC,CAAC,WAAW,CAAC,CAAC,IAAI,CAC1E,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,UAAU,KAAK,sCAAsC,CAAC,IAAI;WAC7D,KAAK,CAAC,UAAU,KAAK,0CAA0C,CAAC,OAAO,CAC7E,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,+BAA+B,CAAC,yBAAyB,EAAE,CAAC;IACjG,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,IAAI,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;AACpF,CAAC","sourcesContent":["/**\n * Which secret slot holds a PERSON's delegated OAuth2 access token for a provider, and whether the\n * provider admits such a connection at all.\n *\n * Two doors ask this exact question and must answer it identically: the browser access-token route\n * (#394 P4 — a vendor picker opens as the caller) and a vendor-backed file storage (#394 P5 — a\n * Drive file is read through the account of the person who linked it). The predicate lived inline\n * in the route first; it moved here the day the storage needed it, because two copies of \"does this\n * provider hand out a personal token\" would be two copies that drift, and the one that drifts\n * silently is the one no route pins.\n */\n\nimport {\n  ExternalProvider_Connection_DelegationMode,\n  ExternalProvider_Connection_OwnerScope,\n  ExternalProvider_ExchangeProtocol_Kind,\n  ProviderProtocolRuntimeKind,\n} from '@wildo-ai/external-connectors-models';\nimport type { ExternalProvidersRegistryBackendService } from '~wildo-backend-lib/external-providers/services/external-providers-registry.backend.service';\n\n/** Why a provider cannot hand out a personal delegated token. */\nexport enum UserDelegatedAccessTokenRefusal {\n  /** No REST contract carrying OAuth2, so nothing delegated ever gets minted. */\n  PROVIDER_NOT_CONNECTABLE = 'PROVIDER_NOT_CONNECTABLE',\n  /** The provider's admissible-connection catalogue names no USER-owned, SERVICE-delegated shape. */\n  CONNECTION_NOT_ADMISSIBLE = 'CONNECTION_NOT_ADMISSIBLE',\n}\n\nexport type UserDelegatedAccessTokenSlot =\n  | { readonly admitted: true; readonly secretSlug: string }\n  | { readonly admitted: false; readonly refusal: UserDelegatedAccessTokenRefusal };\n\n/**\n * Resolves the slot a person's delegated access token for `providerRef` is stored under, or says\n * why there is none. `requestedSlug` lets a caller name a different slot of the same provider,\n * which the browser route accepts as a query parameter; the default is the REST contract's own\n * `apiKey.secretRef`, which is where the OAuth2 exchange writes the access token.\n */\nexport function resolveUserDelegatedAccessTokenSlot(\n  registry: Pick<ExternalProvidersRegistryBackendService, 'getProviderRuntimeContract' | 'getProviderAdmissibleConnections'>,\n  providerRef: string,\n  requestedSlug?: string,\n): UserDelegatedAccessTokenSlot {\n  const contract = registry.getProviderRuntimeContract(providerRef, ExternalProvider_ExchangeProtocol_Kind.REST_API);\n  if (contract?.kind !== ProviderProtocolRuntimeKind.REST || contract.oauth2 === undefined) {\n    return { admitted: false, refusal: UserDelegatedAccessTokenRefusal.PROVIDER_NOT_CONNECTABLE };\n  }\n\n  const admitted = registry.getProviderAdmissibleConnections(providerRef).some(\n    (shape) =>\n      shape.ownerScope === ExternalProvider_Connection_OwnerScope.USER\n      && shape.delegation === ExternalProvider_Connection_DelegationMode.SERVICE,\n  );\n  if (!admitted) {\n    return { admitted: false, refusal: UserDelegatedAccessTokenRefusal.CONNECTION_NOT_ADMISSIBLE };\n  }\n\n  return { admitted: true, secretSlug: requestedSlug ?? contract.apiKey.secretRef };\n}\n"]}

package/dist/esm/security/consumable-tokens/batches/consumable-tokens-cleanup.batch.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consumable-tokens-cleanup.batch.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/consumable-tokens/batches/consumable-tokens-cleanup.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAGH,OAAO,EAAE,iCAAiC,EAAE,MAAM,4FAA4F,CAAC;AAuC/I;;;;GAIG;AACH,wBAAgB,kCAAkC,IAAI,UAAU,CAAC,OAAO,iCAAiC,CAAC,CAsLzG"}
+{"version":3,"file":"consumable-tokens-cleanup.batch.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/security/consumable-tokens/batches/consumable-tokens-cleanup.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAGH,OAAO,EAAE,iCAAiC,EAAE,MAAM,4FAA4F,CAAC;AAuC/I;;;;GAIG;AACH,wBAAgB,kCAAkC,IAAI,UAAU,CAAC,OAAO,iCAAiC,CAAC,CAsLzG"}

package/dist/esm/security/consumable-tokens/consumable-token-models.exports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consumable-token-models.exports.d.ts","sourceRoot":"","sources":["../../../../../src/security/consumable-tokens/consumable-token-models.exports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,cAAc,2CAA2C,CAAC;AAC1D,cAAc,6DAA6D,CAAC"}
+{"version":3,"file":"consumable-token-models.exports.d.ts","sourceRoot":"","sources":["../../../../src/security/consumable-tokens/consumable-token-models.exports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,cAAc,2CAA2C,CAAC;AAC1D,cAAc,6DAA6D,CAAC"}

package/dist/esm/security/consumable-tokens/models/consumable-tokens.backend.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consumable-tokens.backend.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/consumable-tokens/models/consumable-tokens.backend.resources-config.schemas.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAM3G,OAAO,EAAyB,yBAAyB,EAAoC,MAAM,oCAAoC,CAAC;AAExI,KAAK,+BAA+B,GAChC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAEjC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4DAA4D,GACvE,wBAAwB,oBAAoB,EAAE,KAC7C,qBAAqB,CAAC,SAAS,EAAE,+BAA+B,EAAE,OAAO,yBAAyB,CA0EpG,CAAC"}
+{"version":3,"file":"consumable-tokens.backend.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/consumable-tokens/models/consumable-tokens.backend.resources-config.schemas.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAM3G,OAAO,EAAyB,yBAAyB,EAAoC,MAAM,oCAAoC,CAAC;AAExI,KAAK,+BAA+B,GAChC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAEjC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4DAA4D,GACvE,wBAAwB,oBAAoB,EAAE,KAC7C,qBAAqB,CAAC,SAAS,EAAE,+BAA+B,EAAE,OAAO,yBAAyB,CA0EpG,CAAC"}

package/dist/esm/security/consumable-tokens/models/consumable-tokens.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consumable-tokens.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/consumable-tokens/models/consumable-tokens.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAEL,+BAA+B,EAGhC,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;oEAOoE;AAEpE,QAAA,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwF/B,CAAC;AAEH;;;;;oEAKoE;AAEpE,eAAO,MAAM,qBAAqB,yEAAoC,CAAC;AACvE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAmC,CAAC;AAC1E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAA0D,CAAC;AAExG,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,IAAI,CAAC,GAAG;IAC/E,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC"}
+{"version":3,"file":"consumable-tokens.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/consumable-tokens/models/consumable-tokens.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAEL,+BAA+B,EAGhC,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;oEAOoE;AAEpE,QAAA,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwF/B,CAAC;AAEH;;;;;oEAKoE;AAEpE,eAAO,MAAM,qBAAqB,yEAAoC,CAAC;AACvE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAmC,CAAC;AAC1E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAA0D,CAAC;AAExG,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,IAAI,CAAC,GAAG;IAC/E,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC"}

package/dist/esm/security/consumable-tokens/models/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/security/consumable-tokens/models/index.ts"],"names":[],"mappings":"AAAA,cAAc,oCAAoC,CAAC;AACnD,cAAc,sDAAsD,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/security/consumable-tokens/models/index.ts"],"names":[],"mappings":"AAAA,cAAc,oCAAoC,CAAC;AACnD,cAAc,sDAAsD,CAAC"}

package/dist/esm/security/consumable-tokens/services/__tests__/mock-consumable-token.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mock-consumable-token.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/consumable-tokens/services/__tests__/mock-consumable-token.service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+CAA+C,CAAC;AASrF,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD;AAED,qBACa,0BAA0B;IACrC,WAAW;mBAEI,MAAM;yBACA,MAAM;mBACZ,OAAO;mBACP,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;;QAYpC;IAOF,YAAY,4EAaT;IAEH;;;;;OAKG;IAOH,aAAa,4EAYV;IAEH,KAAK;CAKN"}
+{"version":3,"file":"mock-consumable-token.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/consumable-tokens/services/__tests__/mock-consumable-token.service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+CAA+C,CAAC;AASrF,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD;AAED,qBACa,0BAA0B;IACrC,WAAW;mBAEI,MAAM;yBACA,MAAM;mBACZ,OAAO;mBACP,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;;QAYpC;IAOF,YAAY,4EAaT;IAEH;;;;;OAKG;IAOH,aAAa,4EAYV;IAEH,KAAK;CAKN"}

package/dist/esm/security/consumable-tokens/services/consumable-token.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consumable-token.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/consumable-tokens/services/consumable-token.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,EACL,+BAA+B,EAQ/B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAE1B,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAqB,KAAK,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAGjF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAIrK,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mEAAmE,CAAC;AAClH,OAAO,KAAK,EACV,eAAe,EAChB,MAAM,uFAAuF,CAAC;AAC/F,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,gEAAgE,CAAC;AAQxE,MAAM,WAAW,iBAAiB;IAChC,8GAA8G;IAC9G,SAAS,EAAE,oBAAoB,CAAC;IAChC,eAAe,EAAE,+BAA+B,CAAC;IACjD,SAAS,EAAE,aAAa,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/B,KAAK,CAAC,EAAE,yBAAyB,EAAE,CAAC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,wFAAwF;IACxF,SAAS,CAAC,EAAE,UAAU,GAAG,kBAAkB,CAAC;IAC5C,2EAA2E;IAC3E,SAAS,CAAC,EAAE;QACV,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACvC,CAAC;IACF;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;CACtB;AAOD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,oCAAoC,QAAU,CAAC;AAE5D,qBACa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAC1D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAA4C;gBAGrD,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAC7C,cAAc,EAAE,cAAc,EAGR,iBAAiB,CAAC,EAAE,wBAAwB;IAC7G;;;;;;OAMG;IACwE,oBAAoB,CAAC,EAAE,yCAAyC;IAc7I;;;;;;OAMG;IACU,WAAW,CACtB,MAAM,EAAE,iBAAiB,EACzB,WAAW,CAAC,EAAE,kBAAkB,GAC/B,OAAO,CAAC,eAAe,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAoJ/C;;;;;;;;OAQG;IACU,aAAa,CACxB,UAAU,EAAE,MAAM,EAClB,aAAa,CAAC,EAAE,oBAAoB,EAAE,GACrC,OAAO,CAAC,eAAe,CAAC;IA4E3B;;;;;;;;;;;OAWG;IACU,YAAY,CACvB,UAAU,EAAE,MAAM,EAClB,WAAW,CAAC,EAAE,kBAAkB,GAC/B,OAAO,CAAC,eAAe,CAAC;IA+J3B;;;;;;;;;;;OAWG;IACH;;;;;;OAMG;IACU,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IASrE,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAc5E;;;;;;;;;;OAUG;IACH;;;;;;;;;;OAUG;IACU,iCAAiC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAcpF,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAwB3D;;;;;OAKG;IACU,uBAAuB,CAClC,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,oBAAoB,EAChC,WAAW,CAAC,EAAE,kBAAkB,GAC/B,OAAO,CAAC,MAAM,CAAC;IA4ClB;;;;;OAKG;IACU,qBAAqB,CAChC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,oBAAoB,GAC9B,OAAO,CAAC,eAAe,EAAE,CAAC;IAqB7B;;;;;OAKG;IACU,sBAAsB,CACjC,MAAM,EAAE,qBAAqB,EAC7B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,gBAAgB,EAAE;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,EACD,WAAW,EAAE,kBAAkB,GAC9B,OAAO,CAAC,qBAAqB,CAAC;IA2EjC;;;;;OAKG;IACU,sBAAsB,CACjC,MAAM,EAAE,qBAAqB,EAC7B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,iBAAiB,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,EAC9C,WAAW,CAAC,EAAE,kBAAkB,GAC/B,OAAO,CAAC,qBAAqB,CAAC;IA6CjC,OAAO,CAAC,wBAAwB;IAUhC,OAAO,CAAC,uBAAuB;IAO/B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,wBAAwB;IAQhC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,OAAO,KAAK,oBAAoB,GAO/B;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAavB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,8BAA8B;IAQtC;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAK1B;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;CAM/B"}
+{"version":3,"file":"consumable-token.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/security/consumable-tokens/services/consumable-token.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,EACL,+BAA+B,EAQ/B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAE1B,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAqB,KAAK,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAGjF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAIrK,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mEAAmE,CAAC;AAClH,OAAO,KAAK,EACV,eAAe,EAChB,MAAM,uFAAuF,CAAC;AAC/F,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,gEAAgE,CAAC;AAQxE,MAAM,WAAW,iBAAiB;IAChC,8GAA8G;IAC9G,SAAS,EAAE,oBAAoB,CAAC;IAChC,eAAe,EAAE,+BAA+B,CAAC;IACjD,SAAS,EAAE,aAAa,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/B,KAAK,CAAC,EAAE,yBAAyB,EAAE,CAAC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,wFAAwF;IACxF,SAAS,CAAC,EAAE,UAAU,GAAG,kBAAkB,CAAC;IAC5C,2EAA2E;IAC3E,SAAS,CAAC,EAAE;QACV,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACvC,CAAC;IACF;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;CACtB;AAOD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,oCAAoC,QAAU,CAAC;AAE5D,qBACa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAC1D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAA4C;gBAGrD,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAC7C,cAAc,EAAE,cAAc,EAGR,iBAAiB,CAAC,EAAE,wBAAwB;IAC7G;;;;;;OAMG;IACwE,oBAAoB,CAAC,EAAE,yCAAyC;IAc7I;;;;;;OAMG;IACU,WAAW,CACtB,MAAM,EAAE,iBAAiB,EACzB,WAAW,CAAC,EAAE,kBAAkB,GAC/B,OAAO,CAAC,eAAe,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAoJ/C;;;;;;;;OAQG;IACU,aAAa,CACxB,UAAU,EAAE,MAAM,EAClB,aAAa,CAAC,EAAE,oBAAoB,EAAE,GACrC,OAAO,CAAC,eAAe,CAAC;IA4E3B;;;;;;;;;;;OAWG;IACU,YAAY,CACvB,UAAU,EAAE,MAAM,EAClB,WAAW,CAAC,EAAE,kBAAkB,GAC/B,OAAO,CAAC,eAAe,CAAC;IA+J3B;;;;;;;;;;;OAWG;IACH;;;;;;OAMG;IACU,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IASrE,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAc5E;;;;;;;;;;OAUG;IACH;;;;;;;;;;OAUG;IACU,iCAAiC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAcpF,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAwB3D;;;;;OAKG;IACU,uBAAuB,CAClC,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,oBAAoB,EAChC,WAAW,CAAC,EAAE,kBAAkB,GAC/B,OAAO,CAAC,MAAM,CAAC;IA4ClB;;;;;OAKG;IACU,qBAAqB,CAChC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,oBAAoB,GAC9B,OAAO,CAAC,eAAe,EAAE,CAAC;IAqB7B;;;;;OAKG;IACU,sBAAsB,CACjC,MAAM,EAAE,qBAAqB,EAC7B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,gBAAgB,EAAE;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,EACD,WAAW,EAAE,kBAAkB,GAC9B,OAAO,CAAC,qBAAqB,CAAC;IA2EjC;;;;;OAKG;IACU,sBAAsB,CACjC,MAAM,EAAE,qBAAqB,EAC7B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,iBAAiB,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,EAC9C,WAAW,CAAC,EAAE,kBAAkB,GAC/B,OAAO,CAAC,qBAAqB,CAAC;IA6CjC,OAAO,CAAC,wBAAwB;IAUhC,OAAO,CAAC,uBAAuB;IAO/B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,wBAAwB;IAQhC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,OAAO,KAAK,oBAAoB,GAO/B;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAavB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,8BAA8B;IAQtC;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAK1B;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;CAM/B"}