npm - @wildo-ai/saas-models - Versions diffs - 1.1.4 → 1.1.5 - Mend

@wildo-ai/saas-models 1.1.4 → 1.1.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1032) hide show

package/dist/esm/security/connected-accounts/provider-credentials-organization.shared.resources-config.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"provider-credentials-organization.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/security/connected-accounts/provider-credentials-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,oCAAoC,EACpC,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,2DAA2D,CAAC;AAC1H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,0CAA0C,CAAC;AAC1I,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExF,MAAM,oCAAoC,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,CAAU,CAAC;AAE9G,MAAM,sCAAsC,GAAG;IAC7C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;CAC3D,CAAC;AAUF,MAAM,CAAC,MAAM,iEAAiE,GAAG,CAC/E,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAI7C;IACA,UAAU,EAAE,oCAAoC;IAChD,kBAAkB,EAAE,gBAAgB,CAAC,wBAAwB;IAC7D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,wBAAwB,CAAC;IACtG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH;;;;;OAKG;IACH,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,SAAS;QACjD,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,WAAW;KACvC;IAED,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,+FAA+F;QAC/F,gGAAgG;QAChG,2EAA2E;QAC3E,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IAED,uBAAuB,EAAE;QACvB;;;;;;;;;;;;;;;;;;WAkBG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,sFAAsF;oBACtF,0DAA0D;oBAC1D,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,sCAAsC;oBACpD,UAAU,EAAE,oCAAoC;oBAChD,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,uFAAuF;oBACvF,wBAAwB;oBACxB,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED;;;;;WAKG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/*\n Organization Provider Credentials — resource configuration.\n \n The tenant-owned service credential toward a third-party provider. See\n * `provider-credentials.shared.schemas.ts` for what the resource is and what it deliberately is not.\n /\n\nimport { z } from 'zod';\n\nimport {\n OrganizationProviderCredentialSchema,\n ProviderCredentialValidationState,\n} from './provider-credentials.shared.schemas';\n\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../../compliance/privacy/impersonalization.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../authorizations/roles.shared.schemas';\n\nconst ORG_PROVIDER_CREDENTIALS_SORT_FIELDS = ['createdAt', 'updatedAt', 'providerRef', 'lastUsedAt'] as const;\n\nconst ORG_PROVIDER_CREDENTIALS_FILTER_FIELDS = {\n providerRef: z.string(),\n secretSlug: z.string(),\n enabled: z.boolean(),\n validationState: z.enum(ProviderCredentialValidationState),\n};\n\ntype OrgProviderCredentialsCoreOperations =\n \| CoreResourceOperation.READ\n \| CoreResourceOperation.LIST\n \| CoreResourceOperation.CREATE\n \| CoreResourceOperation.UPDATE\n \| CoreResourceOperation.DELETE\n \| CoreResourceOperation.UPDATE_MANY;\n\nexport const orgProviderCredentialsResourceConfiguration_InitializationFactory = (\n resourcesRelationships: ResourceRelationship[],\n) => createResourceConfiguration_Initialization<\n undefined,\n OrgProviderCredentialsCoreOperations,\n typeof OrganizationProviderCredentialSchema\n>({\n mainSchema: OrganizationProviderCredentialSchema,\n resourceIdentifier: CoreResourceType.ORG_PROVIDER_CREDENTIALS,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORG_PROVIDER_CREDENTIALS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true,\n\n /\n ## `read` / `list` — the RESOLVER's door\n \n A provider call happens on whatever execution context the caller holds: a batch, a queue\n * consumer, an anonymous webhook return leg. None of those carry an ORG_ADMIN role, and the\n * resolution must still work — so the resolver reads through `readAsSystem`, which is fail-closed\n * on this opt-in. The scope is supplied as the organization FK in the system context map, so the\n * bypass is of the ROLE check only, never of the tenant boundary.\n \n ## `update` — the resolver's WRITE-BACK door\n \n `lastUsedAt`, `validationState`, `validationError` and `lastValidatedAt` are all\n * `.excludeFromUpdate()`, so the strict re-parse on the ordinary update path strips them. The\n * trusted `updateAsSystem` path is the only one that re-attaches them, which is why it is opted\n * into here and why those fields are not client-writable: a tenant administrator must not be able\n * to declare their own credential `VALID`.\n \n ## `create` — deliberately NOT opted in\n \n A credential comes into existence only when a human supplies one. There is no seed, no\n * provisioning step and no import that should mint one on a tenant's behalf, so the system create\n * door stays shut.\n \n ## `exportSubject: FORBIDDEN`\n \n The reserved class. This row is a live credential toward a third party; a subject export that\n * carried one would hand a working secret to whoever requested the export.\n /\n /\n `create` is open for the reason its user-owned sibling documents at length: a credential a\n * vendor MINTS has no HTTP write that could carry it. An OAuth2 grant arrives through a redirect\n * after a tenant administrator authorized it on the vendor's consent screen, so the exchange —\n * engine code, never a request payload — is the only thing that can store it.\n /\n systemAccessPolicy: {\n exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n read: ResourceSystemAccessMode.ALLOWED,\n list: ResourceSystemAccessMode.ALLOWED,\n update: ResourceSystemAccessMode.ALLOWED,\n create: ResourceSystemAccessMode.ALLOWED,\n },\n\n /\n Subject erasure RETAINS this row and scrubs nothing, because there is nothing here that belongs\n * to a person.\n \n The row is a TENANT's credential. `setByUserId` names an ACTOR — the administrator who typed it\n * — which is the first population `NO_PRINCIPAL` describes, and it is exactly the field an\n * erasure must not use as a reason to destroy the row: a tenant losing its Slack integration\n * because the admin who configured it left the company is a bug, not a privacy guarantee.\n \n The erasure walk cannot reach this resource in any case, because no `USERS` relationship is\n * registered for `setByUserId` — withheld deliberately, since that edge would also put a\n * credential on the Art. 15 export graph. `RETAIN_ONLY` is therefore a statement of what WOULD\n * happen rather than a path that runs today, and it is worth declaring for that reason: the next\n * author who registers a USERS edge inherits the correct answer instead of the default.\n \n The assertion is checked in both directions by the factory — `RETAIN_ONLY` is refused if any\n * field carries an impersonalize treatment or declares a personal-data category.\n /\n retentionPolicy: {\n mode: ErasureRetentionMode.RETAIN_ONLY,\n },\n\n dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.UPDATE,\n // Required by the ORGANIZATIONS cascade: `onParentDelete` dispatches the child's DELETE, and a\n // relationship declaring the cascade against a resource with no DELETE core operation throws at\n // config build. It is also the tenant's own \"remove this credential\" door.\n CoreResourceOperation.DELETE,\n // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n CoreResourceOperation.UPDATE_MANY,\n ],\n\n operationsConfiguration: {\n /\n * ORG_ADMIN everywhere, and NO super-administrator variant anywhere — a deliberate refusal, not\n * an omission.\n \n Every sibling security resource (org API keys, org OAuth clients) carries an `admin` variant\n * so a platform operator can support a tenant. This one does not, because the thing being\n * supported is a live credential toward a THIRD PARTY: an operator who can list, rotate or spend\n * a tenant's Slack token can act as that tenant toward Slack, and no audit event afterwards\n * makes that reversible. `administrative-continuity-floors.md` asks for the reversibility test\n * before crossing a tenant boundary, and this verb fails it in both directions — reading is\n * masked but LISTing reveals which vendors a tenant integrates with, and rotating locks the\n * tenant out of its own integration.\n \n The cost is real and accepted: a tenant that loses every ORG_ADMIN cannot have its credentials\n * repaired by support. That is what `organizationMembers.grantOwnership` exists for — restore an\n * administrator to the tenant, and the tenant repairs its own credentials. The repair path runs\n * through identity, where it is audited and reversible, rather than through the credential\n * store, where it would not be.\n /\n [CoreResourceOperation.READ]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN],\n // LOW because the value never leaves: `.isWriteOnlySecret()` redacts it at the client\n // boundary, so a READ returns metadata and a placeholder.\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n\n [CoreResourceOperation.LIST]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n filterFields: ORG_PROVIDER_CREDENTIALS_FILTER_FIELDS,\n sortFields: ORG_PROVIDER_CREDENTIALS_SORT_FIELDS,\n maxPaginatedResultPerPageLimit: 100,\n },\n ],\n },\n\n [CoreResourceOperation.CREATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN],\n // CRITICAL: this is the act of granting the application authority to act as the tenant\n // toward a third party.\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n },\n ],\n },\n\n [CoreResourceOperation.UPDATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN],\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n },\n ],\n },\n\n [CoreResourceOperation.DELETE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN],\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n },\n ],\n },\n\n /\n * Route-less retention plumbing. INTERNAL_CALL registers NO route, and must not be\n * REPOSITORY_ONLY: that satisfies the factory's boot-time presence guard and then fails to\n * resolve when an erasure actually runs, because the retention primitives resolve through\n * `getServiceOperationPathDefault`, which excludes REPOSITORY_ONLY.\n */\n [CoreResourceOperation.UPDATE_MANY]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n },\n ],\n },\n },\n});\n"]}
1	+ {"version":3,"file":"provider-credentials-organization.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/provider-credentials-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,oCAAoC,EACpC,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,2DAA2D,CAAC;AAC1H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,0CAA0C,CAAC;AAC1I,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExF,MAAM,oCAAoC,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,CAAU,CAAC;AAE9G,MAAM,sCAAsC,GAAG;IAC7C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;CAC3D,CAAC;AAUF,MAAM,CAAC,MAAM,iEAAiE,GAAG,CAC/E,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAI7C;IACA,UAAU,EAAE,oCAAoC;IAChD,kBAAkB,EAAE,gBAAgB,CAAC,wBAAwB;IAC7D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,wBAAwB,CAAC;IACtG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH;;;;;OAKG;IACH,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,SAAS;QACjD,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,WAAW;KACvC;IAED,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,+FAA+F;QAC/F,gGAAgG;QAChG,2EAA2E;QAC3E,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IAED,uBAAuB,EAAE;QACvB;;;;;;;;;;;;;;;;;;WAkBG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,sFAAsF;oBACtF,0DAA0D;oBAC1D,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,sCAAsC;oBACpD,UAAU,EAAE,oCAAoC;oBAChD,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,uFAAuF;oBACvF,wBAAwB;oBACxB,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED;;;;;WAKG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/*\n Organization Provider Credentials — resource configuration.\n \n The tenant-owned service credential toward a third-party provider. See\n * `provider-credentials.shared.schemas.ts` for what the resource is and what it deliberately is not.\n /\n\nimport { z } from 'zod';\n\nimport {\n OrganizationProviderCredentialSchema,\n ProviderCredentialValidationState,\n} from './provider-credentials.shared.schemas';\n\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../../compliance/privacy/impersonalization.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../authorizations/roles.shared.schemas';\n\nconst ORG_PROVIDER_CREDENTIALS_SORT_FIELDS = ['createdAt', 'updatedAt', 'providerRef', 'lastUsedAt'] as const;\n\nconst ORG_PROVIDER_CREDENTIALS_FILTER_FIELDS = {\n providerRef: z.string(),\n secretSlug: z.string(),\n enabled: z.boolean(),\n validationState: z.enum(ProviderCredentialValidationState),\n};\n\ntype OrgProviderCredentialsCoreOperations =\n \| CoreResourceOperation.READ\n \| CoreResourceOperation.LIST\n \| CoreResourceOperation.CREATE\n \| CoreResourceOperation.UPDATE\n \| CoreResourceOperation.DELETE\n \| CoreResourceOperation.UPDATE_MANY;\n\nexport const orgProviderCredentialsResourceConfiguration_InitializationFactory = (\n resourcesRelationships: ResourceRelationship[],\n) => createResourceConfiguration_Initialization<\n undefined,\n OrgProviderCredentialsCoreOperations,\n typeof OrganizationProviderCredentialSchema\n>({\n mainSchema: OrganizationProviderCredentialSchema,\n resourceIdentifier: CoreResourceType.ORG_PROVIDER_CREDENTIALS,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORG_PROVIDER_CREDENTIALS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true,\n\n /\n ## `read` / `list` — the RESOLVER's door\n \n A provider call happens on whatever execution context the caller holds: a batch, a queue\n * consumer, an anonymous webhook return leg. None of those carry an ORG_ADMIN role, and the\n * resolution must still work — so the resolver reads through `readAsSystem`, which is fail-closed\n * on this opt-in. The scope is supplied as the organization FK in the system context map, so the\n * bypass is of the ROLE check only, never of the tenant boundary.\n \n ## `update` — the resolver's WRITE-BACK door\n \n `lastUsedAt`, `validationState`, `validationError` and `lastValidatedAt` are all\n * `.excludeFromUpdate()`, so the strict re-parse on the ordinary update path strips them. The\n * trusted `updateAsSystem` path is the only one that re-attaches them, which is why it is opted\n * into here and why those fields are not client-writable: a tenant administrator must not be able\n * to declare their own credential `VALID`.\n \n ## `create` — deliberately NOT opted in\n \n A credential comes into existence only when a human supplies one. There is no seed, no\n * provisioning step and no import that should mint one on a tenant's behalf, so the system create\n * door stays shut.\n \n ## `exportSubject: FORBIDDEN`\n \n The reserved class. This row is a live credential toward a third party; a subject export that\n * carried one would hand a working secret to whoever requested the export.\n /\n /\n `create` is open for the reason its user-owned sibling documents at length: a credential a\n * vendor MINTS has no HTTP write that could carry it. An OAuth2 grant arrives through a redirect\n * after a tenant administrator authorized it on the vendor's consent screen, so the exchange —\n * engine code, never a request payload — is the only thing that can store it.\n /\n systemAccessPolicy: {\n exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n read: ResourceSystemAccessMode.ALLOWED,\n list: ResourceSystemAccessMode.ALLOWED,\n update: ResourceSystemAccessMode.ALLOWED,\n create: ResourceSystemAccessMode.ALLOWED,\n },\n\n /\n Subject erasure RETAINS this row and scrubs nothing, because there is nothing here that belongs\n * to a person.\n \n The row is a TENANT's credential. `setByUserId` names an ACTOR — the administrator who typed it\n * — which is the first population `NO_PRINCIPAL` describes, and it is exactly the field an\n * erasure must not use as a reason to destroy the row: a tenant losing its Slack integration\n * because the admin who configured it left the company is a bug, not a privacy guarantee.\n \n The erasure walk cannot reach this resource in any case, because no `USERS` relationship is\n * registered for `setByUserId` — withheld deliberately, since that edge would also put a\n * credential on the Art. 15 export graph. `RETAIN_ONLY` is therefore a statement of what WOULD\n * happen rather than a path that runs today, and it is worth declaring for that reason: the next\n * author who registers a USERS edge inherits the correct answer instead of the default.\n \n The assertion is checked in both directions by the factory — `RETAIN_ONLY` is refused if any\n * field carries an impersonalize treatment or declares a personal-data category.\n /\n retentionPolicy: {\n mode: ErasureRetentionMode.RETAIN_ONLY,\n },\n\n dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.UPDATE,\n // Required by the ORGANIZATIONS cascade: `onParentDelete` dispatches the child's DELETE, and a\n // relationship declaring the cascade against a resource with no DELETE core operation throws at\n // config build. It is also the tenant's own \"remove this credential\" door.\n CoreResourceOperation.DELETE,\n // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n CoreResourceOperation.UPDATE_MANY,\n ],\n\n operationsConfiguration: {\n /\n * ORG_ADMIN everywhere, and NO super-administrator variant anywhere — a deliberate refusal, not\n * an omission.\n \n Every sibling security resource (org API keys, org OAuth clients) carries an `admin` variant\n * so a platform operator can support a tenant. This one does not, because the thing being\n * supported is a live credential toward a THIRD PARTY: an operator who can list, rotate or spend\n * a tenant's Slack token can act as that tenant toward Slack, and no audit event afterwards\n * makes that reversible. `administrative-continuity-floors.md` asks for the reversibility test\n * before crossing a tenant boundary, and this verb fails it in both directions — reading is\n * masked but LISTing reveals which vendors a tenant integrates with, and rotating locks the\n * tenant out of its own integration.\n \n The cost is real and accepted: a tenant that loses every ORG_ADMIN cannot have its credentials\n * repaired by support. That is what `organizationMembers.grantOwnership` exists for — restore an\n * administrator to the tenant, and the tenant repairs its own credentials. The repair path runs\n * through identity, where it is audited and reversible, rather than through the credential\n * store, where it would not be.\n /\n [CoreResourceOperation.READ]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN],\n // LOW because the value never leaves: `.isWriteOnlySecret()` redacts it at the client\n // boundary, so a READ returns metadata and a placeholder.\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n\n [CoreResourceOperation.LIST]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n filterFields: ORG_PROVIDER_CREDENTIALS_FILTER_FIELDS,\n sortFields: ORG_PROVIDER_CREDENTIALS_SORT_FIELDS,\n maxPaginatedResultPerPageLimit: 100,\n },\n ],\n },\n\n [CoreResourceOperation.CREATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN],\n // CRITICAL: this is the act of granting the application authority to act as the tenant\n // toward a third party.\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n },\n ],\n },\n\n [CoreResourceOperation.UPDATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN],\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n },\n ],\n },\n\n [CoreResourceOperation.DELETE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN],\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n },\n ],\n },\n\n /\n * Route-less retention plumbing. INTERNAL_CALL registers NO route, and must not be\n * REPOSITORY_ONLY: that satisfies the factory's boot-time presence guard and then fails to\n * resolve when an erasure actually runs, because the retention primitives resolve through\n * `getServiceOperationPathDefault`, which excludes REPOSITORY_ONLY.\n */\n [CoreResourceOperation.UPDATE_MANY]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n },\n ],\n },\n },\n});\n"]}

package/dist/esm/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.d.ts CHANGED Viewed

@@ -9,7 +9,7 @@ import { z } from 'zod';
 import { ProviderCredentialValidationState } from './provider-credentials.shared.schemas';
 import { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';
 import { ResourceRelationship } from '../../resources/resources.shared.schemas';
-type UserProviderCredentialsCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.UPDATE_MANY;
+type UserProviderCredentialsCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE;
 export declare const userProviderCredentialsResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("../..").ResourceConfiguration<undefined, UserProviderCredentialsCoreOperations, import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
@@ -22,7 +22,10 @@ export declare const userProviderCredentialsResourceConfiguration_Initialization
     lastValidatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
     lastUsedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
     secretSetAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
-    connectionParameters: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>>;
+    connectionFacts: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        value: z.ZodString;
+        provenance: z.ZodEnum<typeof import("./provider-credentials.shared.schemas").ProviderConnectionFactProvenance>;
+    }, z.core.$strict>>>>>;
     description: z.ZodOptional<z.ZodString>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;

package/dist/esm/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"provider-credentials-user.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,iCAAiC,EAElC,MAAM,uCAAuC,CAAC;~~AAK~~/C,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAA4D,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAY1I,KAAK,qCAAqC,GACtC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,~~GAC5B,qBAAqB,~~CAAC~~,WAAW,CAAC~~;~~AAEtC~~,eAAO,MAAM,kEAAkE,GAC7E,wBAAwB,oBAAoB,EAAE~~;;;;;;;;;;;;;;;;mBAsL9C~~,CAAC"}
1	+ {"version":3,"file":"provider-credentials-user.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,iCAAiC,EAElC,MAAM,uCAAuC,CAAC;AAI/C,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAA4D,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAY1I,KAAK,qCAAqC,GACtC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAEjC,eAAO,MAAM,kEAAkE,GAC7E,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;mBAwJ9C,CAAC"}

package/dist/esm/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.js CHANGED Viewed

@@ -7,7 +7,6 @@
  */
 import { z } from 'zod';
 import { ProviderCredentialValidationState, UserProviderCredentialSchema, } from './provider-credentials.shared.schemas.js';
-import { ErasureRetentionMode, ResourceDataSubjectKind } from '../../compliance/privacy/impersonalization.shared.schemas.js';
 import { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory.js';
 import { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas.js';
 import { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions.js';
@@ -63,38 +62,27 @@ export const userProviderCredentialsResourceConfiguration_InitializationFactory
         update: ResourceSystemAccessMode.ALLOWED,
         create: ResourceSystemAccessMode.ALLOWED,
     },
-    /**
-     * `RETAIN_ONLY`, and the row still does not survive its owner — the CASCADE removes it.
-     *
-     * These are two different mechanisms and reading them as one produces the wrong answer in both
-     * directions. The retention policy governs what the erasure WALK does to a row it retains: here,
-     * nothing, because a secret is not personal data to be pseudonymised. You do not scrub a
-     * credential, you destroy it. The `USERS → USER_PROVIDER_CREDENTIALS` composition is what destroys
-     * it, dispatching this resource's DELETE when the person is removed.
+    /*
+     * NO `retentionPolicy`, and so no `dataSubjectPolicy` (the factory pairs the two). A credential is
+     * destroyed when its owner is, never kept: a secret is not personal data to pseudonymise, and a sealed
+     * envelope kept after an erasure still opens against somebody who asked to be forgotten.
      *
-     * So a person who exercises erasure does not leave a live credential behind, and the mechanism that
-     * guarantees it is the relationship rather than the policy. Declaring `RETAIN_AND_IMPERSONALIZE`
-     * instead would be actively wrong: it would keep the row and replace its fields, leaving a sealed
-     * envelope whose key material still opens against a subject who asked to be forgotten.
+     * This resource used to declare `retentionPolicy: RETAIN_ONLY` on the reasoning that the USERS
+     * composition cascade would remove the row anyway. That held only while an erasure followed the
+     * cascade's default. Since #1279 an erasure reads the CHILD's retention declaration on a silent edge,
+     * because an erasure keeps the (scrubbed) USERS row and the cascade never fires. So RETAIN_ONLY meant
+     * exactly what it says, and every erasure left the person's third-party tokens in place (#1569). The
+     * USERS → USER_PROVIDER_CREDENTIALS edge now AUTHORS `strategy: DELETE`, so both the cascade and the
+     * erasure destroy the rows, and re-adding a retain policy here would be refused as a contradiction.
      */
-    retentionPolicy: {
-        mode: ErasureRetentionMode.RETAIN_ONLY,
-    },
-    /**
-     * `NO_PRINCIPAL` on the axis this enum actually decides: erasing a credential revokes no session,
-     * because no login is reachable from it. `userId` names the OWNER, not a login this row confers.
-     */
-    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },
     coreOperations: [
         CoreResourceOperation.READ,
         CoreResourceOperation.LIST,
         CoreResourceOperation.CREATE,
         CoreResourceOperation.UPDATE,
-        // Required by the USERS cascade — `onParentDelete` dispatches this DELETE — and it is also the
-        // holder's own "remove this credential" door.
+        // Required by the USERS cascade and by a subject erasure, both of which dispatch this DELETE — and
+        // it is also the holder's own "remove this credential" door.
         CoreResourceOperation.DELETE,
-        // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.
-        CoreResourceOperation.UPDATE_MANY,
     ],
     operationsConfiguration: {
         /*
@@ -169,23 +157,6 @@ export const userProviderCredentialsResourceConfiguration_InitializationFactory
                 },
             ],
         },
-        /**
-         * Route-less and INTERNAL_CALL only — the retention machinery's own door, never a client's.
-         *
-         * `retentionPolicy` requires READ + LIST + UPDATE_MANY to exist, and a bulk update reachable over
-         * HTTP on this resource would be a way to change many credentials at once, which no holder needs
-         * and no administrator may have.
-         */
-        [CoreResourceOperation.UPDATE_MANY]: {
-            variants: [
-                {
-                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
-                    isDefault: true,
-                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
-                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
-                },
-            ],
-        },
     },
 });
 //# sourceMappingURL=provider-credentials-user.shared.resources-config.schemas.js.map

package/dist/esm/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"provider-credentials-user.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,2DAA2D,CAAC;AAC1H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,0CAA0C,CAAC;AAC1I,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExE,MAAM,qCAAqC,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,CAAU,CAAC;AAE/G,MAAM,uCAAuC,GAAG;IAC9C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;CAC3D,CAAC;AAUF,MAAM,CAAC,MAAM,kEAAkE,GAAG,CAChF,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAI7C;IACA,UAAU,EAAE,4BAA4B;IACxC,kBAAkB,EAAE,gBAAgB,CAAC,yBAAyB;IAC9D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,yBAAyB,CAAC;IACvG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,SAAS;QACjD,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IAED;;;;;;;;;;;;;OAaG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,WAAW;KACvC;IAED;;;OAGG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,+FAA+F;QAC/F,8CAA8C;QAC9C,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IAED,uBAAuB,EAAE;QACvB;;;;;;;;;;;;WAYG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,sFAAsF;oBACtF,0DAA0D;oBAC1D,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,uCAAuC;oBACrD,UAAU,EAAE,qCAAqC;oBACjD,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,yFAAyF;oBACzF,sFAAsF;oBACtF,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,oFAAoF;oBACpF,eAAe;oBACf,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED;;;;;;WAMG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/*\n User Provider Credentials — resource configuration.\n \n A PERSON's own credential toward a third party. See `provider-credentials.shared.schemas.ts` for\n * what the resource is, why it is separate from the organization-owned sibling, and why it is not a\n * delegated OAuth grant.\n /\n\nimport { z } from 'zod';\n\nimport {\n ProviderCredentialValidationState,\n UserProviderCredentialSchema,\n} from './provider-credentials.shared.schemas';\n\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../../compliance/privacy/impersonalization.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../authorizations/roles.shared.schemas';\n\nconst USER_PROVIDER_CREDENTIALS_SORT_FIELDS = ['createdAt', 'updatedAt', 'providerRef', 'lastUsedAt'] as const;\n\nconst USER_PROVIDER_CREDENTIALS_FILTER_FIELDS = {\n providerRef: z.string(),\n secretSlug: z.string(),\n enabled: z.boolean(),\n validationState: z.enum(ProviderCredentialValidationState),\n};\n\ntype UserProviderCredentialsCoreOperations =\n \| CoreResourceOperation.READ\n \| CoreResourceOperation.LIST\n \| CoreResourceOperation.CREATE\n \| CoreResourceOperation.UPDATE\n \| CoreResourceOperation.DELETE\n \| CoreResourceOperation.UPDATE_MANY;\n\nexport const userProviderCredentialsResourceConfiguration_InitializationFactory = (\n resourcesRelationships: ResourceRelationship[],\n) => createResourceConfiguration_Initialization<\n undefined,\n UserProviderCredentialsCoreOperations,\n typeof UserProviderCredentialSchema\n>({\n mainSchema: UserProviderCredentialSchema,\n resourceIdentifier: CoreResourceType.USER_PROVIDER_CREDENTIALS,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USER_PROVIDER_CREDENTIALS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true,\n\n /\n The same four system doors as the organization-owned sibling, for the same reasons: a provider\n * call runs on whatever execution context the caller holds, so the resolver reads through\n * `readAsSystem`, and writes back `lastUsedAt` / `validationState` through `updateAsSystem` because\n * those fields are `.excludeFromUpdate()` and a holder must not be able to declare their own\n * credential VALID.\n \n ## `create` was shut, and the sentence that shut it stopped being true\n \n It read: \"a credential exists only because a person supplied one.\" That is exactly right for a\n * credential somebody PASTES, and false for one a vendor MINTS. An OAuth2 grant exists because a\n * person authorized it on the vendor's own consent screen and came back through a redirect;\n * nobody ever types it, so there is no HTTP write that could carry it. Leaving the door shut would\n * mean the authorization exchange completes, the vendor records the grant, and this application\n * has nowhere to put it.\n \n What keeps that narrow is the door itself rather than a second check: `createAsSystem` is\n * reachable only from engine code — never an HTTP payload — its re-attach allowlist is DERIVED\n * from the schema rather than caller-supplied, and the row identity the seal binds to comes from\n * the scope map, so a caller cannot name whose credential it is writing.\n \n ## `exportSubject: FORBIDDEN` matters MORE here than on the sibling, and the difference is real\n \n The organization-owned row is unreachable on the subject-export graph anyway, because no `USERS`\n * relationship is registered for its `setByUserId` — the export walk simply never arrives. This row\n * IS reachable: `userId` is a registered `USERS` composition, which is what gives the resource its\n * USER_SELF scope in the first place. So the export walk arrives here BY CONSTRUCTION, and this\n * refusal is the only thing standing between a subject-access request and a working third-party\n * credential in the response.\n /\n systemAccessPolicy: {\n exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n read: ResourceSystemAccessMode.ALLOWED,\n list: ResourceSystemAccessMode.ALLOWED,\n update: ResourceSystemAccessMode.ALLOWED,\n create: ResourceSystemAccessMode.ALLOWED,\n },\n\n /\n `RETAIN_ONLY`, and the row still does not survive its owner — the CASCADE removes it.\n \n These are two different mechanisms and reading them as one produces the wrong answer in both\n * directions. The retention policy governs what the erasure WALK does to a row it retains: here,\n * nothing, because a secret is not personal data to be pseudonymised. You do not scrub a\n * credential, you destroy it. The `USERS → USER_PROVIDER_CREDENTIALS` composition is what destroys\n * it, dispatching this resource's DELETE when the person is removed.\n \n So a person who exercises erasure does not leave a live credential behind, and the mechanism that\n * guarantees it is the relationship rather than the policy. Declaring `RETAIN_AND_IMPERSONALIZE`\n * instead would be actively wrong: it would keep the row and replace its fields, leaving a sealed\n * envelope whose key material still opens against a subject who asked to be forgotten.\n /\n retentionPolicy: {\n mode: ErasureRetentionMode.RETAIN_ONLY,\n },\n\n /\n `NO_PRINCIPAL` on the axis this enum actually decides: erasing a credential revokes no session,\n * because no login is reachable from it. `userId` names the OWNER, not a login this row confers.\n /\n dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.UPDATE,\n // Required by the USERS cascade — `onParentDelete` dispatches this DELETE — and it is also the\n // holder's own \"remove this credential\" door.\n CoreResourceOperation.DELETE,\n // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n CoreResourceOperation.UPDATE_MANY,\n ],\n\n operationsConfiguration: {\n /\n * `APP_USER` everywhere, and NO administrative variant anywhere — a stronger refusal than the\n * organization-owned sibling's, which refuses only the PLATFORM operator.\n \n Here an organization administrator is refused too. The row is a key its holder authored against\n * their own account with a vendor; consent to store it is not consent for somebody else to spend\n * it, and the vendor would record the act as the holder's own. There is no support story that\n * makes that reversible, and the USER_SELF primary-scope filter is what enforces it structurally\n * rather than by a role list somebody could widen.\n \n The cost is that a personal credential cannot be repaired by anyone but its owner, which is the\n * correct outcome: if the person is gone, the credential should be too, and the cascade sees to it.\n /\n [CoreResourceOperation.READ]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_USER],\n // LOW because the value never leaves: `.isWriteOnlySecret()` redacts it at the client\n // boundary, so a READ returns metadata and a placeholder.\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n\n [CoreResourceOperation.LIST]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_USER],\n riskLevel: ResourceOperationRiskLevel.LOW,\n filterFields: USER_PROVIDER_CREDENTIALS_FILTER_FIELDS,\n sortFields: USER_PROVIDER_CREDENTIALS_SORT_FIELDS,\n maxPaginatedResultPerPageLimit: 100,\n },\n ],\n },\n\n [CoreResourceOperation.CREATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_USER],\n // CRITICAL: the act of granting this application authority to act as the person toward a\n // third party. That it is the person's own decision makes it consented, not low-risk.\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n },\n ],\n },\n\n [CoreResourceOperation.UPDATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_USER],\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n },\n ],\n },\n\n [CoreResourceOperation.DELETE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_USER],\n // Revoking one's own credential is the safe direction and must never be harder than\n // granting it.\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n\n /\n Route-less and INTERNAL_CALL only — the retention machinery's own door, never a client's.\n \n `retentionPolicy` requires READ + LIST + UPDATE_MANY to exist, and a bulk update reachable over\n * HTTP on this resource would be a way to change many credentials at once, which no holder needs\n * and no administrator may have.\n */\n [CoreResourceOperation.UPDATE_MANY]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n },\n ],\n },\n },\n});\n"]}
1	+ {"version":3,"file":"provider-credentials-user.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,0CAA0C,CAAC;AAC1I,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExE,MAAM,qCAAqC,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,CAAU,CAAC;AAE/G,MAAM,uCAAuC,GAAG;IAC9C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;CAC3D,CAAC;AASF,MAAM,CAAC,MAAM,kEAAkE,GAAG,CAChF,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAI7C;IACA,UAAU,EAAE,4BAA4B;IACxC,kBAAkB,EAAE,gBAAgB,CAAC,yBAAyB;IAC9D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,yBAAyB,CAAC;IACvG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,SAAS;QACjD,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IAED;;;;;;;;;;;;OAYG;IAEH,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,mGAAmG;QACnG,6DAA6D;QAC7D,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QACvB;;;;;;;;;;;;WAYG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,sFAAsF;oBACtF,0DAA0D;oBAC1D,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,uCAAuC;oBACrD,UAAU,EAAE,qCAAqC;oBACjD,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,yFAAyF;oBACzF,sFAAsF;oBACtF,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,oFAAoF;oBACpF,eAAe;oBACf,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/*\n User Provider Credentials — resource configuration.\n \n A PERSON's own credential toward a third party. See `provider-credentials.shared.schemas.ts` for\n * what the resource is, why it is separate from the organization-owned sibling, and why it is not a\n * delegated OAuth grant.\n /\n\nimport { z } from 'zod';\n\nimport {\n ProviderCredentialValidationState,\n UserProviderCredentialSchema,\n} from './provider-credentials.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../authorizations/roles.shared.schemas';\n\nconst USER_PROVIDER_CREDENTIALS_SORT_FIELDS = ['createdAt', 'updatedAt', 'providerRef', 'lastUsedAt'] as const;\n\nconst USER_PROVIDER_CREDENTIALS_FILTER_FIELDS = {\n providerRef: z.string(),\n secretSlug: z.string(),\n enabled: z.boolean(),\n validationState: z.enum(ProviderCredentialValidationState),\n};\n\ntype UserProviderCredentialsCoreOperations =\n \| CoreResourceOperation.READ\n \| CoreResourceOperation.LIST\n \| CoreResourceOperation.CREATE\n \| CoreResourceOperation.UPDATE\n \| CoreResourceOperation.DELETE;\n\nexport const userProviderCredentialsResourceConfiguration_InitializationFactory = (\n resourcesRelationships: ResourceRelationship[],\n) => createResourceConfiguration_Initialization<\n undefined,\n UserProviderCredentialsCoreOperations,\n typeof UserProviderCredentialSchema\n>({\n mainSchema: UserProviderCredentialSchema,\n resourceIdentifier: CoreResourceType.USER_PROVIDER_CREDENTIALS,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USER_PROVIDER_CREDENTIALS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true,\n\n /\n The same four system doors as the organization-owned sibling, for the same reasons: a provider\n * call runs on whatever execution context the caller holds, so the resolver reads through\n * `readAsSystem`, and writes back `lastUsedAt` / `validationState` through `updateAsSystem` because\n * those fields are `.excludeFromUpdate()` and a holder must not be able to declare their own\n * credential VALID.\n \n ## `create` was shut, and the sentence that shut it stopped being true\n \n It read: \"a credential exists only because a person supplied one.\" That is exactly right for a\n * credential somebody PASTES, and false for one a vendor MINTS. An OAuth2 grant exists because a\n * person authorized it on the vendor's own consent screen and came back through a redirect;\n * nobody ever types it, so there is no HTTP write that could carry it. Leaving the door shut would\n * mean the authorization exchange completes, the vendor records the grant, and this application\n * has nowhere to put it.\n \n What keeps that narrow is the door itself rather than a second check: `createAsSystem` is\n * reachable only from engine code — never an HTTP payload — its re-attach allowlist is DERIVED\n * from the schema rather than caller-supplied, and the row identity the seal binds to comes from\n * the scope map, so a caller cannot name whose credential it is writing.\n \n ## `exportSubject: FORBIDDEN` matters MORE here than on the sibling, and the difference is real\n \n The organization-owned row is unreachable on the subject-export graph anyway, because no `USERS`\n * relationship is registered for its `setByUserId` — the export walk simply never arrives. This row\n * IS reachable: `userId` is a registered `USERS` composition, which is what gives the resource its\n * USER_SELF scope in the first place. So the export walk arrives here BY CONSTRUCTION, and this\n * refusal is the only thing standing between a subject-access request and a working third-party\n * credential in the response.\n /\n systemAccessPolicy: {\n exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n read: ResourceSystemAccessMode.ALLOWED,\n list: ResourceSystemAccessMode.ALLOWED,\n update: ResourceSystemAccessMode.ALLOWED,\n create: ResourceSystemAccessMode.ALLOWED,\n },\n\n /\n * NO `retentionPolicy`, and so no `dataSubjectPolicy` (the factory pairs the two). A credential is\n * destroyed when its owner is, never kept: a secret is not personal data to pseudonymise, and a sealed\n * envelope kept after an erasure still opens against somebody who asked to be forgotten.\n \n This resource used to declare `retentionPolicy: RETAIN_ONLY` on the reasoning that the USERS\n * composition cascade would remove the row anyway. That held only while an erasure followed the\n * cascade's default. Since #1279 an erasure reads the CHILD's retention declaration on a silent edge,\n * because an erasure keeps the (scrubbed) USERS row and the cascade never fires. So RETAIN_ONLY meant\n * exactly what it says, and every erasure left the person's third-party tokens in place (#1569). The\n * USERS → USER_PROVIDER_CREDENTIALS edge now AUTHORS `strategy: DELETE`, so both the cascade and the\n * erasure destroy the rows, and re-adding a retain policy here would be refused as a contradiction.\n /\n\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.UPDATE,\n // Required by the USERS cascade and by a subject erasure, both of which dispatch this DELETE — and\n // it is also the holder's own \"remove this credential\" door.\n CoreResourceOperation.DELETE,\n ],\n\n operationsConfiguration: {\n /\n * `APP_USER` everywhere, and NO administrative variant anywhere — a stronger refusal than the\n * organization-owned sibling's, which refuses only the PLATFORM operator.\n \n Here an organization administrator is refused too. The row is a key its holder authored against\n * their own account with a vendor; consent to store it is not consent for somebody else to spend\n * it, and the vendor would record the act as the holder's own. There is no support story that\n * makes that reversible, and the USER_SELF primary-scope filter is what enforces it structurally\n * rather than by a role list somebody could widen.\n \n The cost is that a personal credential cannot be repaired by anyone but its owner, which is the\n * correct outcome: if the person is gone, the credential should be too, and the cascade sees to it.\n */\n [CoreResourceOperation.READ]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_USER],\n // LOW because the value never leaves: `.isWriteOnlySecret()` redacts it at the client\n // boundary, so a READ returns metadata and a placeholder.\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n\n [CoreResourceOperation.LIST]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_USER],\n riskLevel: ResourceOperationRiskLevel.LOW,\n filterFields: USER_PROVIDER_CREDENTIALS_FILTER_FIELDS,\n sortFields: USER_PROVIDER_CREDENTIALS_SORT_FIELDS,\n maxPaginatedResultPerPageLimit: 100,\n },\n ],\n },\n\n [CoreResourceOperation.CREATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_USER],\n // CRITICAL: the act of granting this application authority to act as the person toward a\n // third party. That it is the person's own decision makes it consented, not low-risk.\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n },\n ],\n },\n\n [CoreResourceOperation.UPDATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_USER],\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n },\n ],\n },\n\n [CoreResourceOperation.DELETE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_USER],\n // Revoking one's own credential is the safe direction and must never be harder than\n // granting it.\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n },\n});\n"]}

package/dist/esm/security/connected-accounts/provider-credentials.shared.schemas.d.ts CHANGED Viewed

@@ -24,7 +24,8 @@
  *
  * `secretValue` holds an AES-256-GCM envelope, never the plaintext an operator typed. The seal is
  * applied on the way in and opened only by the resolver — see
- * `provider-credential-envelope.backend.utils.ts` for the envelope and its key derivation. The
+ * `provider-credential-envelope.backend.utils.ts` for its key domains and binding, over the shared
+ * `bound-secret-envelope` core that does the sealing (#366). The
  * schema cannot enforce that (a string is a string), so the write path is what guarantees it and
  * the pins are what keep it guaranteed.
  */
@@ -46,17 +47,60 @@ export declare enum ProviderCredentialValidationState {
     INVALID = "invalid"
 }
 /**
- * The organization's credential for one (provider, secret slug) pair.
+ * Why a write door refused to store a credential VALUE under the slot it named — the stable,
+ * client-branchable `code` every door carries (#624).
  *
- * ## The scope identifier is TOP-LEVEL and stays that way
+ * A stored row is keyed `(owner, providerRef, secretSlug)` on the provider's secrets-contract KEY, and
+ * every reader asks for that key. A value written under any other name is a secret nothing can ever
+ * read, and before these refusals the write reported success — which is how a regenerated provider,
+ * a free-text slug or a test script produced rows that looked connected and resolved as absent.
  *
- * `organizationId` is the only `organizationId`-named path in this schema, and nothing nested may
- * ever be named `organizationId` or `userId`. `buildContextualFilter` injects the scope FK by
- * matching that field name at EVERY schema path, so a nested key of the same name adds a phantom
- * exact-subdocument clause and the scoped read silently matches zero rows — a credential that
- * exists and cannot be resolved, which reads exactly like a credential that was never set.
- * `setByUserId` is deliberately spelled so it cannot be caught by that matcher.
+ * The member values are the wire codes the connect leg already answered with, so one vocabulary
+ * serves the connect leg, the resource's own CREATE / UPDATE doors and any client that branches.
+ */
+export declare enum ProviderCredentialSlotWriteRefusal {
+    /**
+     * The provider's current secrets contract declares no slot by that name — under either of a slot's
+     * two names. Also the answer for a provider that is not registered at all, and for ROTATING a value
+     * into an existing row whose stored name is not a contract KEY — a retired name, or a spelling no
+     * reader asks for: a fresh secret sealed there is as unreadable as the old one.
+     */
+    SECRET_SLUG_NOT_DECLARED = "SECRET_SLUG_NOT_DECLARED",
+    /**
+     * The slot exists but holds the APPLICATION's own registration (an OAuth2 client id or secret),
+     * which is authored in the deployment environment and never read from a credential row.
+     */
+    SECRET_SLUG_NOT_A_CREDENTIAL = "SECRET_SLUG_NOT_A_CREDENTIAL",
+    /**
+     * An UPDATE named a different `providerRef` or `secretSlug` for an existing row. The sealed value is
+     * bound to both, so a row cannot move: a credential for another slot is a new row, and the old one is
+     * deleted.
+     */
+    CREDENTIAL_SLOT_IMMUTABLE = "CREDENTIAL_SLOT_IMMUTABLE"
+}
+/**
+ * How one connection fact got onto a credential row (#333, #1047). The distinction is what decides who may
+ * change it: an answer changes only when the person reconnects, a vendor report whenever the vendor
+ * reports it again.
  */
+export declare enum ProviderConnectionFactProvenance {
+    /**
+     * Typed by the person connecting, for an endpoint or scope `{placeholder}` at the OAuth2 start — or, for a
+     * vendor whose credential is PASTED, for a `{placeholder}` of the REST base URL at the typed-credential store
+     * (#1097). Replaced only by reconnecting or re-entering the credential.
+     */
+    ANSWERED_AT_CONNECT = "ANSWERED_AT_CONNECT",
+    /** Reported by the vendor in its token answer, at the authorization or at a refresh. A refresh may move it. */
+    REPORTED_BY_VENDOR = "REPORTED_BY_VENDOR"
+}
+/** One value in a credential row's `connectionFacts`. */
+export declare const ProviderConnectionFactSchema: z.ZodObject<{
+    value: z.ZodString;
+    provenance: z.ZodEnum<typeof ProviderConnectionFactProvenance>;
+}, z.core.$strict>;
+export type ProviderConnectionFact = z.infer<typeof ProviderConnectionFactSchema>;
+/** A credential row's facts, keyed by fact name. */
+export type ProviderConnectionFacts = Readonly<Record<string, ProviderConnectionFact>>;
 /**
  * WHERE a resolved provider secret came from.
  *
@@ -86,7 +130,72 @@ export declare enum ProviderCredentialResolutionSource {
      */
     USER_CREDENTIAL = "user_credential"
 }
-/** Why a credential row stopped existing. */
+/**
+ * What telling the VENDOR achieved when a credential was removed (#545).
+ *
+ * A separate axis from {@link ProviderCredentialDeletionReason} on purpose: that one says why OUR
+ * COPY stopped existing, this one says whether the authorization itself was withdrawn where it
+ * lives. They were one question for as long as the answer was always "it was not".
+ *
+ * Every member is EVIDENCE, and none of them is control flow — the local delete proceeds whatever
+ * this says, because a vendor being unreachable must not stop somebody disconnecting.
+ */
+export declare enum ProviderOAuth2RevocationOutcome {
+    /**
+     * The vendor answered 200.
+     *
+     * Under RFC 7009 that also covers a token the server did not recognise, which is the intended
+     * reading: the grant is gone either way.
+     * spec-cite: RFC 7009 §2.2 — *"The authorization server responds with HTTP status code 200 if the
+     * token has been revoked successfully or if the client submitted an invalid token"*.
+     */
+    REVOKED = "revoked",
+    /**
+     * Nothing was sent, and that is the ordinary case rather than a failure.
+     *
+     * Three situations share this member because they are one fact from the person's side — the vendor
+     * was not told: the provider declares no `rfc7009RevocationUrl`; the credential was a PASTED
+     * long-lived key rather than a grant, so there is nothing to revoke; or the grant carried no token.
+     */
+    NOT_DECLARED = "not_declared",
+    /** The application's own client registration for this vendor is unset, so nothing could be sent. */
+    NOT_CONFIGURED = "not_configured",
+    /** The endpoint could not be reached, or did not answer within the deadline. */
+    UNREACHABLE = "unreachable",
+    /** The endpoint answered, and not with 200. */
+    REFUSED = "refused"
+}
+/** The wire values of {@link ProviderOAuth2RevocationOutcome}, for a Zod enum over them. */
+export declare const ProviderOAuth2RevocationOutcomeValues: typeof ProviderOAuth2RevocationOutcome;
+/**
+ * Why a credential row stopped existing.
+ *
+ * ## Every member describes OUR COPY; whether the VENDOR was told is a SECOND axis (#545)
+ *
+ * Removing a credential deletes the token Wildo holds. Until 2026-09-18 it also did nothing else,
+ * so the GRANT survived at the vendor: the person's connected-accounts screen showed the application
+ * gone while Asana or Google still listed it as authorized, and a stored refresh token remained
+ * valid until it expired on the vendor's schedule — which, for a refresh token, is frequently never.
+ *
+ * That is stated HERE because this vocabulary is what an operator points at when asked whether an
+ * erasure reached someone's third-party credentials, and silence on a compliance surface reads as
+ * "done".
+ *
+ * **It is no longer silent.** Both deletion events now carry
+ * {@link ProviderOAuth2RevocationOutcome}, so the trail answers the vendor question separately from
+ * the local one. What that outcome can SAY still depends on the vendor: RFC 7009 is the only
+ * revocation standard and the vendors do not agree with it, so `google-drive` and `asana` declare an
+ * endpoint and are told, while Slack's `auth.revoke` (a Web API method) and GitHub's
+ * `DELETE /applications/{client_id}/token` (basic auth, JSON body) are not expressible as one and
+ * record `not_declared` rather than implying they were reached.
+ *
+ * An earlier revision of this block argued the mechanism should NOT be built, because *"no
+ * admissible provider declares one today, so the field would ship inert"*. That was true when it was
+ * written and stopped being true when `google-drive` gained an admissible USER connection: Google's
+ * `https://oauth2.googleapis.com/revoke` is RFC 7009-conformant, so the mechanism has a reachable
+ * user and a proven vendor. Kept as history rather than deleted, because the reasoning was sound and
+ * the thing that changed was the world, not the argument.
+ */
 export declare enum ProviderCredentialDeletionReason {
     /** An administrator of the owning tenant removed it. */
     ADMINISTRATOR_REVOKED = "administrator_revoked",
@@ -100,8 +209,36 @@ export declare enum ProviderCredentialDeletionReason {
      * Distinct from `ORGANIZATION_PURGED` because this one is EVIDENCE: it is what an operator points
      * at when asked whether a subject-erasure request reached the person's third-party credentials.
      * Collapsing the two into a generic "cascade" would make that question unanswerable from the trail.
+     *
+     * **Who sets it:** the cascade observer, for a cascade declaring itself a `SUBJECT_ERASURE`. The record
+     * carries `deletedBy` = whoever EXECUTED the erasure (a person's id when one was carried on the erasure's
+     * context, else the `SYSTEM` sentinel), so the erased person is the record's SUBJECT and never its actor
+     * (#1088).
      */
-    USER_ERASED = "user_erased"
+    USER_ERASED = "user_erased",
+    /**
+     * The owning user ROW was deleted outright and the composition cascade destroyed the credential with it (#1016).
+     *
+     * **Who sets it:** the user-credential parent-cascade removal observer
+     * (`registerUserProviderCredentialCascadeEvidence`), for a cascade that declares its cause as an ordinary parent
+     * delete of the `users` row. Two doors reach it today: an administrator's hard `DELETE` (`deletedBy` is that
+     * administrator), and the organization-member invitation sweep reaping an orphaned pending user under an internal
+     * context (`deletedBy` is the `SYSTEM` sentinel). The record carries `deletedBy`, resolved from the deleting
+     * execution context, so it names the principal who deleted the account rather than the person whose credential
+     * it was.
+     *
+     * **Distinct from `USER_ERASED`**, and the distinction is the reason this member exists: an erasure answers a
+     * data-subject request, keeps the person's row scrubbed and is evidence that the request reached their third-party
+     * credentials. A deletion asserts no such request. Recording it as `USER_ERASED` would forge erasure evidence;
+     * recording nothing left an account deletion that destroyed OAuth grants and API keys with no row naming them.
+     *
+     * **Distinct from `ORGANIZATION_PURGED`**: that is a tenant teardown removing the ORGANIZATION's credentials. This
+     * removes one PERSON's own credentials, which no organization owns.
+     *
+     * Named for what happened to the owner, not for who did it: the cascade cannot tell an administrator's delete from
+     * any other deletion of the row, and `deletedBy` is where the actor is stated.
+     */
+    USER_DELETED = "user_deleted"
 }
 /**
  * The fields that IDENTIFY a credential within its tenant.
@@ -111,6 +248,18 @@ export declare enum ProviderCredentialDeletionReason {
  * of a compound key is how two of them come to disagree about what identity means.
  */
 export declare const ORGANIZATION_PROVIDER_CREDENTIAL_IDENTITY_FIELDS: readonly ["organizationId", "providerRef", "secretSlug"];
+/**
+ * The organization's credential for one (provider, secret slug) pair.
+ *
+ * ## The scope identifier is TOP-LEVEL and stays that way
+ *
+ * `organizationId` is the only `organizationId`-named path in this schema, and nothing nested may
+ * ever be named `organizationId` or `userId`. `buildContextualFilter` injects the scope FK by
+ * matching that field name at EVERY schema path, so a nested key of the same name adds a phantom
+ * exact-subdocument clause and the scoped read silently matches zero rows — a credential that
+ * exists and cannot be resolved, which reads exactly like a credential that was never set.
+ * `setByUserId` is deliberately spelled so it cannot be caught by that matcher.
+ */
 export declare const OrganizationProviderCredentialSchema: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
@@ -124,7 +273,10 @@ export declare const OrganizationProviderCredentialSchema: import("@wildo-ai/zod
     lastUsedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
     setByUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
     secretSetAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
-    connectionParameters: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>>;
+    connectionFacts: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        value: z.ZodString;
+        provenance: z.ZodEnum<typeof ProviderConnectionFactProvenance>;
+    }, z.core.$strict>>>>>;
     description: z.ZodOptional<z.ZodString>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
@@ -178,7 +330,10 @@ export declare const UserProviderCredentialSchema: import("@wildo-ai/zod-decorat
     lastValidatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
     lastUsedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
     secretSetAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
-    connectionParameters: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>>;
+    connectionFacts: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        value: z.ZodString;
+        provenance: z.ZodEnum<typeof ProviderConnectionFactProvenance>;
+    }, z.core.$strict>>>>>;
     description: z.ZodOptional<z.ZodString>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
@@ -240,7 +395,39 @@ export declare enum ProviderConnectabilityBlocker {
      * variables the provider's contract names. Distinct from the above because the vendor is perfectly
      * connectable and the gap is ours.
      */
-    APPLICATION_NOT_REGISTERED = "application-not-registered"
+    APPLICATION_NOT_REGISTERED = "application-not-registered",
+    /**
+     * An OAuth2 endpoint's HOST or ORIGIN — or the origin a SCOPE names (`{hostUrl}/.default`, #991) — is a
+     * placeholder the provider declares no allowance for, so no value can ever be admitted there (#623):
+     * the token endpoint receives the application's client secret, and a host is never taken from what
+     * somebody types. Nobody connecting can fix it; the provider needs a recorded host allowance.
+     */
+    ENDPOINT_HOST_NOT_DECLARED = "endpoint-host-not-declared",
+    /**
+     * The provider's OAuth2 endpoint definition cannot be resolved safely whatever is supplied — a
+     * malformed template, an unresolved source expression, or an allowance that cannot apply where its
+     * placeholder sits. A provider-definition defect, not a deployment or account gap.
+     */
+    ENDPOINT_DEFINITION_INVALID = "endpoint-definition-invalid",
+    /**
+     * The provider's OAuth2 origin is filled from this DEPLOYMENT's configured base URL (a self-hosted
+     * vendor such as Gitea), and that base URL is unset or unusable. An OPERATOR acts.
+     */
+    DEPLOYMENT_BASE_URL_UNUSABLE = "deployment-base-url-unusable",
+    /**
+     * An OAuth2 endpoint host is filled from a deployment environment variable dedicated to it (Workday's
+     * `WORKDAY_AUTH_HOST` / `WORKDAY_API_HOST`, #992), and that variable is unset or not a DNS name. An
+     * OPERATOR acts; the variable is named in the catalogue entry's `missingRegistration`.
+     */
+    DEPLOYMENT_CONFIGURED_HOST_UNUSABLE = "deployment-configured-host-unusable",
+    /**
+     * The vendor's credential is PASTED and its REST base URL forms its HOST or ORIGIN from a placeholder the
+     * provider declares no allowance for (`https://{subdomain}.vendor.com` with no `baseUrlHostAllowances`
+     * entry), so no answer the typed-credential store could collect is ever admitted and every call would
+     * refuse (#1097). Nobody connecting can fix it; the provider needs a recorded host allowance — the
+     * base-URL twin of `ENDPOINT_HOST_NOT_DECLARED`.
+     */
+    BASE_URL_HOST_NOT_DECLARED = "base-url-host-not-declared"
 }
 /**
  * One secret slot a provider declares, as a SCREEN needs it — never the value.

package/dist/esm/security/connected-accounts/provider-credentials.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"provider-credentials.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/security/connected-accounts/provider-credentials.shared.schemas.ts"],"names":[],"mappings":"AAAA~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG~~;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;GAOG;AACH,oBAAY,iCAAiC;IAC3C,0FAA0F;IAC1F,WAAW,gBAAgB;IAC3B,gDAAgD;IAChD,KAAK,UAAU;IACf,8EAA8E;IAC9E,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;GAWG;AACH;;;;;;;;GAQG;AACH,oBAAY,kCAAkC;IAC5C,yEAAyE;IACzE,uBAAuB,4BAA4B;IACnD;;;OAGG;IACH,sBAAsB,2BAA2B;IACjD;;;;;;;;;OASG;IACH,eAAe,oBAAoB;CACpC;AAED,~~6CAA6C~~;~~AAC7C~~,oBAAY,gCAAgC;IAC1C,wDAAwD;IACxD,qBAAqB,0BAA0B;IAC/C,iGAAiG;IACjG,mBAAmB,wBAAwB;IAC3C,gEAAgE;IAChE,aAAa,kBAAkB;IAC/B~~;;;;;;OAMG~~;IACH,WAAW,gBAAgB;~~CAC5B~~;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gDAAgD,0DAInD,CAAC;AAEX,eAAO,MAAM,oCAAoC~~;;;;;;;;;;;;;;;;;kBAwHuB~~,CAAC;AAEzE,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAQlG;;;;;;GAMG;AACH,eAAO,MAAM,wCAAwC,kDAI3C,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,4BAA4B~~;;;;;;;;;;;;;;;;kBAgFuB~~,CAAC;AAEjE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAsBlF;;;;;;GAMG;AACH;;;;;;;;GAQG;AACH;;;;;;;;;;GAUG;AACH;;;;;;GAMG;AACH,oBAAY,kBAAkB;IAC5B,+FAA+F;IAC/F,yBAAyB,8BAA8B;IACvD;;;OAGG;IACH,eAAe,oBAAoB;CACpC;AAED,oBAAY,6BAA6B;IACvC;;;;OAIG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;OAKG;IACH,0BAA0B,+BAA+B;CAC1D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wFAAwF;IACxF,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED,oBAAY,4BAA4B;IACtC,wEAAwE;IACxE,YAAY,iBAAiB;CAC9B;AAED,eAAO,MAAM,yBAAyB;;;;;;;iBAgDpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,wBAAwB,CAAC;AAElE,0EAA0E;AAC1E,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEzE;AAED,mFAAmF;AACnF,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,mBAAmB,GAAG,MAAM,CAE/E;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAqB3F;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oCAAoC,KAAK,CAAC;AAEvD,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,mBAAmB,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAK3G"}
1	+ {"version":3,"file":"provider-credentials.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/provider-credentials.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;GAOG;AACH,oBAAY,iCAAiC;IAC3C,0FAA0F;IAC1F,WAAW,gBAAgB;IAC3B,gDAAgD;IAChD,KAAK,UAAU;IACf,8EAA8E;IAC9E,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;GAWG;AACH,oBAAY,kCAAkC;IAC5C;;;;;OAKG;IACH,wBAAwB,6BAA6B;IACrD;;;OAGG;IACH,4BAA4B,iCAAiC;IAC7D;;;;OAIG;IACH,yBAAyB,8BAA8B;CACxD;AAED;;;;GAIG;AACH,oBAAY,gCAAgC;IAC1C;;;;OAIG;IACH,mBAAmB,wBAAwB;IAC3C,+GAA+G;IAC/G,kBAAkB,uBAAuB;CAC1C;AAED,yDAAyD;AACzD,eAAO,MAAM,4BAA4B;;;kBAGvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,oDAAoD;AACpD,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAEvF;;;;;;;;GAQG;AACH,oBAAY,kCAAkC;IAC5C,yEAAyE;IACzE,uBAAuB,4BAA4B;IACnD;;;OAGG;IACH,sBAAsB,2BAA2B;IACjD;;;;;;;;;OASG;IACH,eAAe,oBAAoB;CACpC;AAED;;;;;;;;;GASG;AACH,oBAAY,+BAA+B;IACzC;;;;;;;OAOG;IACH,OAAO,YAAY;IACnB;;;;;;OAMG;IACH,YAAY,iBAAiB;IAC7B,oGAAoG;IACpG,cAAc,mBAAmB;IACjC,gFAAgF;IAChF,WAAW,gBAAgB;IAC3B,+CAA+C;IAC/C,OAAO,YAAY;CACpB;AAED,4FAA4F;AAC5F,eAAO,MAAM,qCAAqC,wCAAkC,CAAC;AAErF;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,oBAAY,gCAAgC;IAC1C,wDAAwD;IACxD,qBAAqB,0BAA0B;IAC/C,iGAAiG;IACjG,mBAAmB,wBAAwB;IAC3C,gEAAgE;IAChE,aAAa,kBAAkB;IAC/B;;;;;;;;;;;OAWG;IACH,WAAW,gBAAgB;IAC3B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,YAAY,iBAAiB;CAC9B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gDAAgD,0DAInD,CAAC;AAEX;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;kBA6HuB,CAAC;AAEzE,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAQlG;;;;;;GAMG;AACH,eAAO,MAAM,wCAAwC,kDAI3C,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;kBAkFuB,CAAC;AAEjE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAsBlF;;;;;;GAMG;AACH;;;;;;;;GAQG;AACH;;;;;;;;;;GAUG;AACH;;;;;;GAMG;AACH,oBAAY,kBAAkB;IAC5B,+FAA+F;IAC/F,yBAAyB,8BAA8B;IACvD;;;OAGG;IACH,eAAe,oBAAoB;CACpC;AAED,oBAAY,6BAA6B;IACvC;;;;OAIG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;OAKG;IACH,0BAA0B,+BAA+B;IACzD;;;;;OAKG;IACH,0BAA0B,+BAA+B;IACzD;;;;OAIG;IACH,2BAA2B,gCAAgC;IAC3D;;;OAGG;IACH,4BAA4B,iCAAiC;IAC7D;;;;OAIG;IACH,mCAAmC,wCAAwC;IAC3E;;;;;;OAMG;IACH,0BAA0B,+BAA+B;CAC1D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wFAAwF;IACxF,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED,oBAAY,4BAA4B;IACtC,wEAAwE;IACxE,YAAY,iBAAiB;CAC9B;AAED,eAAO,MAAM,yBAAyB;;;;;;;iBAgDpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,wBAAwB,CAAC;AAElE,0EAA0E;AAC1E,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEzE;AAED,mFAAmF;AACnF,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,mBAAmB,GAAG,MAAM,CAE/E;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAqB3F;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oCAAoC,KAAK,CAAC;AAEvD,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,mBAAmB,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAK3G"}