@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/security/authorizations/roles.shared.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"roles.shared.utils.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/roles.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,cAAc,EAAE,cAAc,EAA2B,MAAM,wBAAwB,CAAC;AACjG,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,WAA+B;IACnF,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,OAAO,GAAuB,OAAO,CAAC;IAC1C,OAAO,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxB,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC;IAC7C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,MAAM,UAAU,gCAAgC,CAAC,aAA4C;IAC3F,OAAO,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAS;IAC/D,cAAc,CAAC,UAAU;IACzB,cAAc,CAAC,aAAa;CAC7B,CAAC,CAAC;AAgBH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAA2C;IACvF,MAAM,EACJ,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,cAAc,GAAG,8BAA8B,EAC/C,cAAc,GAAG,0BAA0B,GAC5C,GAAG,MAAM,CAAC;IAEX,6CAA6C;IAC7C,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9D,2DAA2D;IAC3D,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3E,gEAAgE;IAChE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,IAAI,uBAAuB,GAAG,KAAK,CAAC;IAEpC,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAC7D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,uBAAuB,GAAG,IAAI,CAAC;QAC3D,KAAK,MAAM,SAAS,IAAI,SAAS;YAAE,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAC7D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,uBAAuB,GAAG,IAAI,CAAC;QAC3D,KAAK,MAAM,SAAS,IAAI,SAAS;YAAE,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACnE,CAAC;IAED,yCAAyC;IACzC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtE,4EAA4E;IAC5E,gFAAgF;IAChF,OAAO,uBAAuB,CAAC;AACjC,CAAC;AAED,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAE/E;;;;;;;;;;;;GAYG;AACH,MAAM,mBAAmB,GAAqC;IAC5D,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;IAC9B,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC;IACjC,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC5B,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;IAC7B,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;IAC9B,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;IAC/B,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;IAC7B,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;IAC7B,CAAC,cAAc,CAAC,gBAAgB,CAAC,EAAE,CAAC;IACpC,CAAC,cAAc,CAAC,0BAA0B,CAAC,EAAE,CAAC;IAC9C,CAAC,cAAc,CAAC,yBAAyB,CAAC,EAAE,CAAC;IAC7C,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,CAAC;CAC1C,CAAC;AAEF,+EAA+E;AAC/E,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,eAAe,GAAG,GAAG,CAAC;AAE5B;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAY,EACZ,iBAAqC,8BAA8B,EACnE,iBAAqC,0BAA0B;IAE/D,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC;IAC5D,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IACzG,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,OAAO,IAAI,GAAG,eAAe,GAAG,KAAK,CAAC;AACxC,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAA8B,EAC9B,cAAmC,EACnC,cAAmC;IAEnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,wBAAwB,CAAC,IAAI,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;AACxG,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAAsB,EACtB,cAAmC,EACnC,cAAmC;IAEnC,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtC,OAAO;QACP,IAAI,EAAE,wBAAwB,CAAC,OAAO,EAAE,cAAc,EAAE,cAAc,CAAC;KACxE,CAAC,CAAC,CAAC;IACJ,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACpF,CAAC","sourcesContent":["/**\n * Role-resolution utilities — pure, shared between backend authorization and\n * frontend display gating.\n *\n * The framework authorizes operations against a role **hierarchy**: a user\n * holding a high role (e.g. `ORG_OWNER`) implicitly satisfies every role it\n * inherits from (`ORG_OWNER → ORG_ADMIN → ORG_MANAGER → ORG_MEMBER → ORG_GUEST`).\n * `AuthorizationsBackendService` enforces this on every request; these helpers\n * expose the SAME hierarchy walk so the frontend can decide which operation\n * actions to even surface — without duplicating (and drifting from) the\n * algorithm.\n *\n * **Why this exists on the frontend.** The resource registry the browser holds\n * carries every operation a resource declares, each with its `roles` requirement,\n * but the frontend historically never consulted `operation.roles` when building\n * the action bar — so admin-only / super-admin-only actions rendered for every\n * viewer and only 403'd on click. The backend stays the security authority; this\n * gate is a display optimisation that hides buttons the user provably cannot use.\n *\n * @see roles.shared.defaults.ts — the default app/org role configurations\n * @see roles.shared.schemas.ts — `Roles`, `RolesConfiguration`, `RoleDefinition`\n * @see AuthorizationsBackendService.getRoleHierarchy / validateOperationRoles —\n *   the backend twin this mirrors. If the hierarchy walk changes there, change it\n *   here too (the role *configuration* is already shared via the constants below,\n *   so only the algorithm can drift).\n */\n\nimport { CORE_APP_ROLES, CORE_ORG_ROLES, type RolesConfiguration } from './roles.shared.schemas';\nimport {\n  DEFAULT_APP_ROLE_CONFIGURATION,\n  DEFAULT_ORGANIZATION_ROLES,\n} from './roles.shared.defaults';\n\n/**\n * Walk a role's inheritance chain within a single role configuration, returning\n * the role itself plus every role it (transitively) inherits from, nearest-first.\n *\n * Mirrors `AuthorizationsBackendService.getRoleHierarchy`: starts at `roleKey`\n * and follows `inheritFrom` until a role is absent from the config. A role that\n * is **not present** in `rolesConfig` yields an EMPTY chain (it contributes\n * nothing), exactly like the backend — callers that must not over-restrict on\n * unknown (app-custom) roles handle that case explicitly (see\n * {@link userRolesSatisfyRequiredRoles}).\n *\n * @param roleKey - the assigned role to expand\n * @param rolesConfig - the role configuration owning the hierarchy (app or org)\n * @returns the role + its inherited ancestors, nearest-first; empty if unknown\n */\nexport function computeRoleHierarchy(roleKey: string, rolesConfig: RolesConfiguration): string[] {\n  const hierarchy: string[] = [];\n  let current: string | undefined = roleKey;\n  while (current && rolesConfig[current]) {\n    hierarchy.push(current);\n    current = rolesConfig[current].inheritFrom;\n  }\n  return hierarchy;\n}\n\n/**\n * Does this required-role set declare PUBLIC access — imposing no positive role requirement on ANY\n * caller, credentialed or not?\n *\n * ## The semantic this settles, and why the alternative reading was wrong\n *\n * `APP_PUBLIC` can be read two ways, and for a long time different layers of the framework read it\n * differently:\n *\n *  - *no credential REQUIRED* — reachable when nobody authenticated, and gated on roles otherwise;\n *  - *no credential EXAMINED* — reachable by everyone, whether or not they authenticated.\n *\n * The second is the contract, and the first was a defect. Under the first reading, an operation\n * declaring `APP_PUBLIC` answered 200 to an anonymous probe and **403 to the same request carrying a\n * valid token**, because `APP_PUBLIC` is not a role anybody is GRANTED — so a credentialed caller\n * fell past the public carve-out to an ordinary role gate that nothing in their grant set could\n * satisfy. Authenticating REDUCED access below what anonymity gave, on every public surface an\n * application can build: a price list, a public catalogue, an i18n bundle served as a resource.\n *\n * Three of the four surfaces that consume `roles` already implemented the second reading, which is\n * what makes this the framework's settled contract rather than a preference:\n *\n * | surface | reading |\n * |---|---|\n * | frontend action visibility ({@link userRolesSatisfyRequiredRoles}) | no positive requirement |\n * | OpenAPI generation — `APP_PUBLIC` emits `security: []` | no authentication required |\n * | variant rights ranking ({@link computeRolePrivilegeRank}) | ranks `0`, the floor |\n * | backend role gate (before this predicate existed) | **credentialed callers refused** |\n *\n * An OpenAPI `security: []` says the endpoint imposes no security requirement. A client that sends a\n * bearer token to such an endpoint is conformant, and refusing it contradicts the published\n * contract. And independently of any document: **authenticating must never take access away.**\n *\n * ## What it does NOT relax\n *\n * Only the ROLE question. Tenancy, parent-scope and FK-path gates run unchanged, and the\n * repository's contextual filter still confines every row the caller then reaches. A public\n * declaration says \"no role is required to ask\"; it never says \"no scope confines the answer\".\n *\n * ## Why `APP_ANONYMOUS` is deliberately NOT here\n *\n * {@link OPEN_REQUIRED_ROLES} — the DISPLAY-side set — holds both sentinels, because that gate only\n * decides whether to render a button and is documented to fail OPEN on uncertainty. This predicate\n * is an ADMISSION rule, and the two sentinels are not interchangeable for admission:\n * `APP_ANONYMOUS` is a role an anonymous session genuinely HOLDS (the execution-context creator\n * grants it), so an anonymous caller already satisfies the ordinary gate and needs no carve-out —\n * whereas nobody is ever granted `APP_PUBLIC`. Widening admission to `APP_ANONYMOUS` would therefore\n * change who reaches anonymous-scoped operations without fixing anything, which is the wrong trade\n * for a gate. Keep the two questions separate.\n *\n * @param requiredRoles - an operation's declared `roles` (OR semantics)\n * @returns `true` when the declaration admits every caller, role-wise\n */\nexport function requiredRolesDeclarePublicAccess(requiredRoles: readonly string[] | undefined): boolean {\n  return Array.isArray(requiredRoles) && requiredRoles.includes(CORE_APP_ROLES.APP_PUBLIC);\n}\n\n/**\n * Required-role sentinels that impose NO positive role requirement — an operation\n * gated on public / anonymous access must never be hidden from a viewer. Treated\n * as always-satisfied.\n *\n * DISPLAY-side and deliberately WIDER than {@link requiredRolesDeclarePublicAccess}; see that\n * predicate's JSDoc for why the admission rule must not adopt `APP_ANONYMOUS`.\n */\nconst OPEN_REQUIRED_ROLES: ReadonlySet<string> = new Set<string>([\n  CORE_APP_ROLES.APP_PUBLIC,\n  CORE_APP_ROLES.APP_ANONYMOUS,\n]);\n\n/** Parameters for {@link userRolesSatisfyRequiredRoles}. */\nexport interface UserRolesSatisfyRequiredRolesParams {\n  /** The operation's required roles (OR semantics). Empty/undefined ⇒ unrestricted. */\n  requiredRoles: readonly string[] | undefined;\n  /** The user's APPLICATION-scope roles (e.g. `permissions.appLevel`). */\n  userAppRoles: readonly string[];\n  /** The user's ORGANIZATIONS-scope roles for the CURRENT org (e.g. `permissions.organizations[orgId]`). */\n  userOrgRoles: readonly string[];\n  /** App role configuration (defaults to {@link DEFAULT_APP_ROLE_CONFIGURATION}). */\n  appRolesConfig?: RolesConfiguration;\n  /** Org role configuration (defaults to {@link DEFAULT_ORGANIZATION_ROLES}). */\n  orgRolesConfig?: RolesConfiguration;\n}\n\n/**\n * Decide whether a user's effective roles satisfy an operation's required roles,\n * honouring the role hierarchy — the shared answer to \"can this user perform this\n * operation, role-wise?\".\n *\n * This is the SAME OR-with-hierarchy decision the backend enforces\n * (`validateOperationRoles`): the user passes if ANY required role lies in the\n * inheritance closure of ANY role they hold (app roles expanded against the app\n * config, org roles against the org config).\n *\n * **Conservative on the frontend / display side.** It gates which action buttons\n * are even shown; the backend remains the security authority. It therefore FAILS\n * OPEN on uncertainty so it can never hide a button the user is actually allowed\n * to use:\n *   - no/empty `requiredRoles` ⇒ `true` (unrestricted operation).\n *   - a required role that is a public/anonymous sentinel ⇒ `true`.\n *   - if the user holds a role UNKNOWN to the supplied config (an app-custom role\n *     whose inheritance the default config cannot resolve) and the known-role\n *     expansion did not already satisfy the requirement ⇒ `true` (do not hide —\n *     the custom role might inherit a required role). For core-role-only users\n *     (the common case, and the whole settings hub) the decision is exact.\n *\n * @returns `true` if the operation should be considered role-permitted (shown).\n */\nexport function userRolesSatisfyRequiredRoles(params: UserRolesSatisfyRequiredRolesParams): boolean {\n  const {\n    requiredRoles,\n    userAppRoles,\n    userOrgRoles,\n    appRolesConfig = DEFAULT_APP_ROLE_CONFIGURATION,\n    orgRolesConfig = DEFAULT_ORGANIZATION_ROLES,\n  } = params;\n\n  // Unrestricted operation — always permitted.\n  if (!requiredRoles || requiredRoles.length === 0) return true;\n\n  // A public/anonymous gate imposes no positive requirement.\n  if (requiredRoles.some(role => OPEN_REQUIRED_ROLES.has(role))) return true;\n\n  // Expand the user's roles through their respective hierarchies.\n  const satisfiedRoles = new Set<string>();\n  let hasUnresolvableUserRole = false;\n\n  for (const role of userAppRoles) {\n    const hierarchy = computeRoleHierarchy(role, appRolesConfig);\n    if (hierarchy.length === 0) hasUnresolvableUserRole = true;\n    for (const inherited of hierarchy) satisfiedRoles.add(inherited);\n  }\n  for (const role of userOrgRoles) {\n    const hierarchy = computeRoleHierarchy(role, orgRolesConfig);\n    if (hierarchy.length === 0) hasUnresolvableUserRole = true;\n    for (const inherited of hierarchy) satisfiedRoles.add(inherited);\n  }\n\n  // Direct OR-with-hierarchy satisfaction.\n  if (requiredRoles.some(role => satisfiedRoles.has(role))) return true;\n\n  // Fail open if the user holds a role the supplied config can't expand — its\n  // (unknown) inheritance might cover a required role. Never hide on uncertainty.\n  return hasUnresolvableUserRole;\n}\n\n// ════════════════════════════════════════════════════════════════════════════\n// Variant selection by rights (\"show only the highest-right-level variant\")\n// ════════════════════════════════════════════════════════════════════════════\n\n/**\n * Privilege **tier** of a core role — the product ordering between role families.\n * A variant gated on a higher-tier role represents a \"higher right level\".\n *\n *   3 — platform/app admin (`APP_ADMIN_*`)\n *   2 — organisation roles (`ORG_*`)\n *   1 — authenticated user (`APP_USER`)\n *   0 — public / anonymous\n *\n * This is the one **cross-scope** decision the ranking needs: app-admin outranks\n * org, which outranks the plain authenticated user. Within a tier, the role\n * hierarchy depth breaks ties (a deeper role inherits more, so it is higher).\n */\nconst ROLE_PRIVILEGE_TIER: Readonly<Record<string, number>> = {\n  [CORE_APP_ROLES.APP_PUBLIC]: 0,\n  [CORE_APP_ROLES.APP_ANONYMOUS]: 0,\n  [CORE_APP_ROLES.APP_USER]: 1,\n  [CORE_ORG_ROLES.ORG_GUEST]: 2,\n  [CORE_ORG_ROLES.ORG_MEMBER]: 2,\n  [CORE_ORG_ROLES.ORG_MANAGER]: 2,\n  [CORE_ORG_ROLES.ORG_ADMIN]: 2,\n  [CORE_ORG_ROLES.ORG_OWNER]: 2,\n  [CORE_APP_ROLES.APP_ADMIN_VIEWER]: 3,\n  [CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR]: 3,\n  [CORE_APP_ROLES.APP_ADMIN_BILLING_MANAGER]: 3,\n  [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN]: 3,\n};\n\n/** Tier used for a role unknown to the default config (an app-custom role). */\nconst UNKNOWN_ROLE_TIER = 2;\nconst TIER_MULTIPLIER = 100;\n\n/**\n * Numeric privilege rank of a single role: `tier * 100 + hierarchyDepth`.\n *\n * Higher = more privileged. Derived from {@link ROLE_PRIVILEGE_TIER} (cross-tier\n * ordering) plus the role's hierarchy depth within its config (intra-tier\n * ordering), so e.g. `ORG_OWNER` (205) > `ORG_MEMBER` (202), and\n * `APP_ADMIN_SUPER_ADMIN` (304) outranks every `ORG_*`. Unknown custom roles fall\n * back to the org tier with depth 1 — exact for core-role apps (the common case),\n * conservative otherwise.\n *\n * Public / anonymous gates impose no positive requirement, so they rank `0` — the\n * floor, equal to a truly unrestricted variant (see {@link computeVariantRightsRank}).\n *\n * NOTE: the intra-tier tiebreak uses hierarchy DEPTH, which is a faithful proxy\n * for privilege only when inheritance is (near-)linear, as it is in the default\n * configs. A branching custom `RolesConfiguration` could give a shallow-but-powerful\n * role a lower depth than a deep-but-weak one and mis-order them; thread an explicit\n * rank (or extend this) if such a config is introduced.\n */\nexport function computeRolePrivilegeRank(\n  role: string,\n  appRolesConfig: RolesConfiguration = DEFAULT_APP_ROLE_CONFIGURATION,\n  orgRolesConfig: RolesConfiguration = DEFAULT_ORGANIZATION_ROLES,\n): number {\n  if (OPEN_REQUIRED_ROLES.has(role)) return 0;\n  const tier = ROLE_PRIVILEGE_TIER[role] ?? UNKNOWN_ROLE_TIER;\n  const config = appRolesConfig[role] ? appRolesConfig : orgRolesConfig[role] ? orgRolesConfig : undefined;\n  const depth = config ? computeRoleHierarchy(role, config).length : 1;\n  return tier * TIER_MULTIPLIER + depth;\n}\n\n/** Minimal shape this module needs from an operation variant to rank it by rights. */\nexport interface RightsRankableVariant {\n  /** The roles that may perform this variant (OR semantics). Empty/undefined = unrestricted. */\n  roles?: readonly string[];\n}\n\n/**\n * The rights rank a variant represents = the privilege of its most-privileged\n * required role. An unrestricted variant (no `roles`) ranks `0` — the lowest gate.\n */\nexport function computeVariantRightsRank(\n  variant: RightsRankableVariant,\n  appRolesConfig?: RolesConfiguration,\n  orgRolesConfig?: RolesConfiguration,\n): number {\n  const roles = variant.roles ?? [];\n  if (roles.length === 0) return 0;\n  return Math.max(...roles.map(role => computeRolePrivilegeRank(role, appRolesConfig, orgRolesConfig)));\n}\n\n/**\n * Collapse a set of operation variants to **only the highest-right-level ones**.\n *\n * The framework principle: variants of an operation exist to give different\n * behaviour according to rights, so a surface should show only the variant with\n * the highest right level the user qualifies for — not the lower-rights ones too.\n * (A super-admin who is also an org member otherwise sees both the member READ and\n * the super-admin READ; this keeps only the super-admin one.)\n *\n * **Precondition:** pass variants the user already QUALIFIES for (i.e. post\n * role-gating via {@link userRolesSatisfyRequiredRoles}). This selector then keeps\n * the subset with the maximum {@link computeVariantRightsRank}. Variants that\n * **tie** at the top rank (equal rights — e.g. context/variantKey variants that\n * are not a rights distinction) are all returned, so the caller's existing\n * default/sub-group logic still handles non-rights multiplicity unchanged.\n *\n * Used globally wherever variants surface as user actions; composite / execution\n * views deliberately bypass this (they may show all variants, for now) by not\n * routing through the collapsing path.\n */\nexport function selectHighestRightsVariants<T extends RightsRankableVariant>(\n  variants: readonly T[],\n  appRolesConfig?: RolesConfiguration,\n  orgRolesConfig?: RolesConfiguration,\n): T[] {\n  if (variants.length <= 1) return [...variants];\n  const ranked = variants.map(variant => ({\n    variant,\n    rank: computeVariantRightsRank(variant, appRolesConfig, orgRolesConfig),\n  }));\n  const maxRank = Math.max(...ranked.map(entry => entry.rank));\n  return ranked.filter(entry => entry.rank === maxRank).map(entry => entry.variant);\n}\n"]}
+{"version":3,"file":"roles.shared.utils.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/roles.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,cAAc,EAAE,cAAc,EAA2B,MAAM,wBAAwB,CAAC;AACjG,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,WAA+B;IACnF,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,OAAO,GAAuB,OAAO,CAAC;IAC1C,OAAO,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxB,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC;IAC7C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,MAAM,UAAU,gCAAgC,CAAC,aAA4C;IAC3F,OAAO,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAS;IAC/D,cAAc,CAAC,UAAU;IACzB,cAAc,CAAC,aAAa;CAC7B,CAAC,CAAC;AAgBH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAA2C;IACvF,MAAM,EACJ,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,cAAc,GAAG,8BAA8B,EAC/C,cAAc,GAAG,0BAA0B,GAC5C,GAAG,MAAM,CAAC;IAEX,6CAA6C;IAC7C,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9D,2DAA2D;IAC3D,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3E,gEAAgE;IAChE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,IAAI,uBAAuB,GAAG,KAAK,CAAC;IAEpC,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAC7D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,uBAAuB,GAAG,IAAI,CAAC;QAC3D,KAAK,MAAM,SAAS,IAAI,SAAS;YAAE,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAC7D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,uBAAuB,GAAG,IAAI,CAAC;QAC3D,KAAK,MAAM,SAAS,IAAI,SAAS;YAAE,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACnE,CAAC;IAED,yCAAyC;IACzC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtE,4EAA4E;IAC5E,gFAAgF;IAChF,OAAO,uBAAuB,CAAC;AACjC,CAAC;AAED,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAE/E;;;;;;;;;;;;GAYG;AACH,MAAM,mBAAmB,GAAqC;IAC5D,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;IAC9B,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC;IACjC,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC5B,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;IAC7B,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;IAC9B,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;IAC/B,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;IAC7B,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;IAC7B,CAAC,cAAc,CAAC,gBAAgB,CAAC,EAAE,CAAC;IACpC,CAAC,cAAc,CAAC,0BAA0B,CAAC,EAAE,CAAC;IAC9C,CAAC,cAAc,CAAC,yBAAyB,CAAC,EAAE,CAAC;IAC7C,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,CAAC;IACzC,kFAAkF;IAClF,CAAC,cAAc,CAAC,yBAAyB,CAAC,EAAE,CAAC;CAC9C,CAAC;AAEF,+EAA+E;AAC/E,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,eAAe,GAAG,GAAG,CAAC;AAE5B;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAY,EACZ,iBAAqC,8BAA8B,EACnE,iBAAqC,0BAA0B;IAE/D,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC;IAC5D,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IACzG,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,OAAO,IAAI,GAAG,eAAe,GAAG,KAAK,CAAC;AACxC,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAA8B,EAC9B,cAAmC,EACnC,cAAmC;IAEnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,wBAAwB,CAAC,IAAI,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;AACxG,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAAsB,EACtB,cAAmC,EACnC,cAAmC;IAEnC,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtC,OAAO;QACP,IAAI,EAAE,wBAAwB,CAAC,OAAO,EAAE,cAAc,EAAE,cAAc,CAAC;KACxE,CAAC,CAAC,CAAC;IACJ,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACpF,CAAC","sourcesContent":["/**\n * Role-resolution utilities — pure, shared between backend authorization and\n * frontend display gating.\n *\n * The framework authorizes operations against a role **hierarchy**: a user\n * holding a high role (e.g. `ORG_OWNER`) implicitly satisfies every role it\n * inherits from (`ORG_OWNER → ORG_ADMIN → ORG_MANAGER → ORG_MEMBER → ORG_GUEST`).\n * `AuthorizationsBackendService` enforces this on every request; these helpers\n * expose the SAME hierarchy walk so the frontend can decide which operation\n * actions to even surface — without duplicating (and drifting from) the\n * algorithm.\n *\n * **Why this exists on the frontend.** The resource registry the browser holds\n * carries every operation a resource declares, each with its `roles` requirement,\n * but the frontend historically never consulted `operation.roles` when building\n * the action bar — so admin-only / super-admin-only actions rendered for every\n * viewer and only 403'd on click. The backend stays the security authority; this\n * gate is a display optimisation that hides buttons the user provably cannot use.\n *\n * @see roles.shared.defaults.ts — the default app/org role configurations\n * @see roles.shared.schemas.ts — `Roles`, `RolesConfiguration`, `RoleDefinition`\n * @see AuthorizationsBackendService.getRoleHierarchy / validateOperationRoles —\n *   the backend twin this mirrors. If the hierarchy walk changes there, change it\n *   here too (the role *configuration* is already shared via the constants below,\n *   so only the algorithm can drift).\n */\n\nimport { CORE_APP_ROLES, CORE_ORG_ROLES, type RolesConfiguration } from './roles.shared.schemas';\nimport {\n  DEFAULT_APP_ROLE_CONFIGURATION,\n  DEFAULT_ORGANIZATION_ROLES,\n} from './roles.shared.defaults';\n\n/**\n * Walk a role's inheritance chain within a single role configuration, returning\n * the role itself plus every role it (transitively) inherits from, nearest-first.\n *\n * Mirrors `AuthorizationsBackendService.getRoleHierarchy`: starts at `roleKey`\n * and follows `inheritFrom` until a role is absent from the config. A role that\n * is **not present** in `rolesConfig` yields an EMPTY chain (it contributes\n * nothing), exactly like the backend — callers that must not over-restrict on\n * unknown (app-custom) roles handle that case explicitly (see\n * {@link userRolesSatisfyRequiredRoles}).\n *\n * @param roleKey - the assigned role to expand\n * @param rolesConfig - the role configuration owning the hierarchy (app or org)\n * @returns the role + its inherited ancestors, nearest-first; empty if unknown\n */\nexport function computeRoleHierarchy(roleKey: string, rolesConfig: RolesConfiguration): string[] {\n  const hierarchy: string[] = [];\n  let current: string | undefined = roleKey;\n  while (current && rolesConfig[current]) {\n    hierarchy.push(current);\n    current = rolesConfig[current].inheritFrom;\n  }\n  return hierarchy;\n}\n\n/**\n * Does this required-role set declare PUBLIC access — imposing no positive role requirement on ANY\n * caller, credentialed or not?\n *\n * ## The semantic this settles, and why the alternative reading was wrong\n *\n * `APP_PUBLIC` can be read two ways, and for a long time different layers of the framework read it\n * differently:\n *\n *  - *no credential REQUIRED* — reachable when nobody authenticated, and gated on roles otherwise;\n *  - *no credential EXAMINED* — reachable by everyone, whether or not they authenticated.\n *\n * The second is the contract, and the first was a defect. Under the first reading, an operation\n * declaring `APP_PUBLIC` answered 200 to an anonymous probe and **403 to the same request carrying a\n * valid token**, because `APP_PUBLIC` is not a role anybody is GRANTED — so a credentialed caller\n * fell past the public carve-out to an ordinary role gate that nothing in their grant set could\n * satisfy. Authenticating REDUCED access below what anonymity gave, on every public surface an\n * application can build: a price list, a public catalogue, an i18n bundle served as a resource.\n *\n * Three of the four surfaces that consume `roles` already implemented the second reading, which is\n * what makes this the framework's settled contract rather than a preference:\n *\n * | surface | reading |\n * |---|---|\n * | frontend action visibility ({@link userRolesSatisfyRequiredRoles}) | no positive requirement |\n * | OpenAPI generation — `APP_PUBLIC` emits `security: []` | no authentication required |\n * | variant rights ranking ({@link computeRolePrivilegeRank}) | ranks `0`, the floor |\n * | backend role gate (before this predicate existed) | **credentialed callers refused** |\n *\n * An OpenAPI `security: []` says the endpoint imposes no security requirement. A client that sends a\n * bearer token to such an endpoint is conformant, and refusing it contradicts the published\n * contract. And independently of any document: **authenticating must never take access away.**\n *\n * ## What it does NOT relax\n *\n * Only the ROLE question. Tenancy, parent-scope and FK-path gates run unchanged, and the\n * repository's contextual filter still confines every row the caller then reaches. A public\n * declaration says \"no role is required to ask\"; it never says \"no scope confines the answer\".\n *\n * ## Why `APP_ANONYMOUS` is deliberately NOT here\n *\n * {@link OPEN_REQUIRED_ROLES} — the DISPLAY-side set — holds both sentinels, because that gate only\n * decides whether to render a button and is documented to fail OPEN on uncertainty. This predicate\n * is an ADMISSION rule, and the two sentinels are not interchangeable for admission:\n * `APP_ANONYMOUS` is a role an anonymous session genuinely HOLDS (the execution-context creator\n * grants it), so an anonymous caller already satisfies the ordinary gate and needs no carve-out —\n * whereas nobody is ever granted `APP_PUBLIC`. Widening admission to `APP_ANONYMOUS` would therefore\n * change who reaches anonymous-scoped operations without fixing anything, which is the wrong trade\n * for a gate. Keep the two questions separate.\n *\n * @param requiredRoles - an operation's declared `roles` (OR semantics)\n * @returns `true` when the declaration admits every caller, role-wise\n */\nexport function requiredRolesDeclarePublicAccess(requiredRoles: readonly string[] | undefined): boolean {\n  return Array.isArray(requiredRoles) && requiredRoles.includes(CORE_APP_ROLES.APP_PUBLIC);\n}\n\n/**\n * Required-role sentinels that impose NO positive role requirement — an operation\n * gated on public / anonymous access must never be hidden from a viewer. Treated\n * as always-satisfied.\n *\n * DISPLAY-side and deliberately WIDER than {@link requiredRolesDeclarePublicAccess}; see that\n * predicate's JSDoc for why the admission rule must not adopt `APP_ANONYMOUS`.\n */\nconst OPEN_REQUIRED_ROLES: ReadonlySet<string> = new Set<string>([\n  CORE_APP_ROLES.APP_PUBLIC,\n  CORE_APP_ROLES.APP_ANONYMOUS,\n]);\n\n/** Parameters for {@link userRolesSatisfyRequiredRoles}. */\nexport interface UserRolesSatisfyRequiredRolesParams {\n  /** The operation's required roles (OR semantics). Empty/undefined ⇒ unrestricted. */\n  requiredRoles: readonly string[] | undefined;\n  /** The user's APPLICATION-scope roles (e.g. `permissions.appLevel`). */\n  userAppRoles: readonly string[];\n  /** The user's ORGANIZATIONS-scope roles for the CURRENT org (e.g. `permissions.organizations[orgId]`). */\n  userOrgRoles: readonly string[];\n  /** App role configuration (defaults to {@link DEFAULT_APP_ROLE_CONFIGURATION}). */\n  appRolesConfig?: RolesConfiguration;\n  /** Org role configuration (defaults to {@link DEFAULT_ORGANIZATION_ROLES}). */\n  orgRolesConfig?: RolesConfiguration;\n}\n\n/**\n * Decide whether a user's effective roles satisfy an operation's required roles,\n * honouring the role hierarchy — the shared answer to \"can this user perform this\n * operation, role-wise?\".\n *\n * This is the SAME OR-with-hierarchy decision the backend enforces\n * (`validateOperationRoles`): the user passes if ANY required role lies in the\n * inheritance closure of ANY role they hold (app roles expanded against the app\n * config, org roles against the org config).\n *\n * **Conservative on the frontend / display side.** It gates which action buttons\n * are even shown; the backend remains the security authority. It therefore FAILS\n * OPEN on uncertainty so it can never hide a button the user is actually allowed\n * to use:\n *   - no/empty `requiredRoles` ⇒ `true` (unrestricted operation).\n *   - a required role that is a public/anonymous sentinel ⇒ `true`.\n *   - if the user holds a role UNKNOWN to the supplied config (an app-custom role\n *     whose inheritance the default config cannot resolve) and the known-role\n *     expansion did not already satisfy the requirement ⇒ `true` (do not hide —\n *     the custom role might inherit a required role). For core-role-only users\n *     (the common case, and the whole settings hub) the decision is exact.\n *\n * @returns `true` if the operation should be considered role-permitted (shown).\n */\nexport function userRolesSatisfyRequiredRoles(params: UserRolesSatisfyRequiredRolesParams): boolean {\n  const {\n    requiredRoles,\n    userAppRoles,\n    userOrgRoles,\n    appRolesConfig = DEFAULT_APP_ROLE_CONFIGURATION,\n    orgRolesConfig = DEFAULT_ORGANIZATION_ROLES,\n  } = params;\n\n  // Unrestricted operation — always permitted.\n  if (!requiredRoles || requiredRoles.length === 0) return true;\n\n  // A public/anonymous gate imposes no positive requirement.\n  if (requiredRoles.some(role => OPEN_REQUIRED_ROLES.has(role))) return true;\n\n  // Expand the user's roles through their respective hierarchies.\n  const satisfiedRoles = new Set<string>();\n  let hasUnresolvableUserRole = false;\n\n  for (const role of userAppRoles) {\n    const hierarchy = computeRoleHierarchy(role, appRolesConfig);\n    if (hierarchy.length === 0) hasUnresolvableUserRole = true;\n    for (const inherited of hierarchy) satisfiedRoles.add(inherited);\n  }\n  for (const role of userOrgRoles) {\n    const hierarchy = computeRoleHierarchy(role, orgRolesConfig);\n    if (hierarchy.length === 0) hasUnresolvableUserRole = true;\n    for (const inherited of hierarchy) satisfiedRoles.add(inherited);\n  }\n\n  // Direct OR-with-hierarchy satisfaction.\n  if (requiredRoles.some(role => satisfiedRoles.has(role))) return true;\n\n  // Fail open if the user holds a role the supplied config can't expand — its\n  // (unknown) inheritance might cover a required role. Never hide on uncertainty.\n  return hasUnresolvableUserRole;\n}\n\n// ════════════════════════════════════════════════════════════════════════════\n// Variant selection by rights (\"show only the highest-right-level variant\")\n// ════════════════════════════════════════════════════════════════════════════\n\n/**\n * Privilege **tier** of a core role — the product ordering between role families.\n * A variant gated on a higher-tier role represents a \"higher right level\".\n *\n *   3 — platform/app admin (`APP_ADMIN_*`)\n *   2 — organisation roles (`ORG_*`)\n *   1 — authenticated user (`APP_USER`)\n *   0 — public / anonymous\n *\n * This is the one **cross-scope** decision the ranking needs: app-admin outranks\n * org, which outranks the plain authenticated user. Within a tier, the role\n * hierarchy depth breaks ties (a deeper role inherits more, so it is higher).\n */\nconst ROLE_PRIVILEGE_TIER: Readonly<Record<string, number>> = {\n  [CORE_APP_ROLES.APP_PUBLIC]: 0,\n  [CORE_APP_ROLES.APP_ANONYMOUS]: 0,\n  [CORE_APP_ROLES.APP_USER]: 1,\n  [CORE_ORG_ROLES.ORG_GUEST]: 2,\n  [CORE_ORG_ROLES.ORG_MEMBER]: 2,\n  [CORE_ORG_ROLES.ORG_MANAGER]: 2,\n  [CORE_ORG_ROLES.ORG_ADMIN]: 2,\n  [CORE_ORG_ROLES.ORG_OWNER]: 2,\n  [CORE_APP_ROLES.APP_ADMIN_VIEWER]: 3,\n  [CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR]: 3,\n  [CORE_APP_ROLES.APP_ADMIN_BILLING_MANAGER]: 3,\n  [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN]: 3,\n  // Application tier: it reads across every tenant, which no organisation role can.\n  [CORE_APP_ROLES.APP_AUDIT_EVIDENCE_READER]: 3,\n};\n\n/** Tier used for a role unknown to the default config (an app-custom role). */\nconst UNKNOWN_ROLE_TIER = 2;\nconst TIER_MULTIPLIER = 100;\n\n/**\n * Numeric privilege rank of a single role: `tier * 100 + hierarchyDepth`.\n *\n * Higher = more privileged. Derived from {@link ROLE_PRIVILEGE_TIER} (cross-tier\n * ordering) plus the role's hierarchy depth within its config (intra-tier\n * ordering), so e.g. `ORG_OWNER` (205) > `ORG_MEMBER` (202), and\n * `APP_ADMIN_SUPER_ADMIN` (304) outranks every `ORG_*`. Unknown custom roles fall\n * back to the org tier with depth 1 — exact for core-role apps (the common case),\n * conservative otherwise.\n *\n * Public / anonymous gates impose no positive requirement, so they rank `0` — the\n * floor, equal to a truly unrestricted variant (see {@link computeVariantRightsRank}).\n *\n * NOTE: the intra-tier tiebreak uses hierarchy DEPTH, which is a faithful proxy\n * for privilege only when inheritance is (near-)linear, as it is in the default\n * configs. A branching custom `RolesConfiguration` could give a shallow-but-powerful\n * role a lower depth than a deep-but-weak one and mis-order them; thread an explicit\n * rank (or extend this) if such a config is introduced.\n */\nexport function computeRolePrivilegeRank(\n  role: string,\n  appRolesConfig: RolesConfiguration = DEFAULT_APP_ROLE_CONFIGURATION,\n  orgRolesConfig: RolesConfiguration = DEFAULT_ORGANIZATION_ROLES,\n): number {\n  if (OPEN_REQUIRED_ROLES.has(role)) return 0;\n  const tier = ROLE_PRIVILEGE_TIER[role] ?? UNKNOWN_ROLE_TIER;\n  const config = appRolesConfig[role] ? appRolesConfig : orgRolesConfig[role] ? orgRolesConfig : undefined;\n  const depth = config ? computeRoleHierarchy(role, config).length : 1;\n  return tier * TIER_MULTIPLIER + depth;\n}\n\n/** Minimal shape this module needs from an operation variant to rank it by rights. */\nexport interface RightsRankableVariant {\n  /** The roles that may perform this variant (OR semantics). Empty/undefined = unrestricted. */\n  roles?: readonly string[];\n}\n\n/**\n * The rights rank a variant represents = the privilege of its most-privileged\n * required role. An unrestricted variant (no `roles`) ranks `0` — the lowest gate.\n */\nexport function computeVariantRightsRank(\n  variant: RightsRankableVariant,\n  appRolesConfig?: RolesConfiguration,\n  orgRolesConfig?: RolesConfiguration,\n): number {\n  const roles = variant.roles ?? [];\n  if (roles.length === 0) return 0;\n  return Math.max(...roles.map(role => computeRolePrivilegeRank(role, appRolesConfig, orgRolesConfig)));\n}\n\n/**\n * Collapse a set of operation variants to **only the highest-right-level ones**.\n *\n * The framework principle: variants of an operation exist to give different\n * behaviour according to rights, so a surface should show only the variant with\n * the highest right level the user qualifies for — not the lower-rights ones too.\n * (A super-admin who is also an org member otherwise sees both the member READ and\n * the super-admin READ; this keeps only the super-admin one.)\n *\n * **Precondition:** pass variants the user already QUALIFIES for (i.e. post\n * role-gating via {@link userRolesSatisfyRequiredRoles}). This selector then keeps\n * the subset with the maximum {@link computeVariantRightsRank}. Variants that\n * **tie** at the top rank (equal rights — e.g. context/variantKey variants that\n * are not a rights distinction) are all returned, so the caller's existing\n * default/sub-group logic still handles non-rights multiplicity unchanged.\n *\n * Used globally wherever variants surface as user actions; composite / execution\n * views deliberately bypass this (they may show all variants, for now) by not\n * routing through the collapsing path.\n */\nexport function selectHighestRightsVariants<T extends RightsRankableVariant>(\n  variants: readonly T[],\n  appRolesConfig?: RolesConfiguration,\n  orgRolesConfig?: RolesConfiguration,\n): T[] {\n  if (variants.length <= 1) return [...variants];\n  const ranked = variants.map(variant => ({\n    variant,\n    rank: computeVariantRightsRank(variant, appRolesConfig, orgRolesConfig),\n  }));\n  const maxRank = Math.max(...ranked.map(entry => entry.rank));\n  return ranked.filter(entry => entry.rank === maxRank).map(entry => entry.variant);\n}\n"]}

package/dist/esm/security/connected-accounts/provider-connection-listing.shared.schemas.d.ts

@@ -0,0 +1,86 @@
+/**
+ * What `GET /connections/linked` answers — the CONNECTIONS one owner holds, one entry each (#1727).
+ *
+ * ## Why a connection and not a credential row
+ *
+ * A stored credential is keyed on `(owner, connectionRef, secretSlug)` (#1670), and a vendor served by several refs
+ * — an engine part and the add-on packages beside it, declared in `providers.sharedConnections` (#1725) — holds ONE
+ * grant keyed on its base ref. A screen that listed rows by `providerRef` therefore showed a person one Microsoft
+ * account per ref while they had authorized once, and offered a disconnect per ref for one grant. The connection is
+ * the unit a person granted, so it is the unit this lists.
+ *
+ * Shared because the backend composes it and the connected-accounts screen renders it; one declaration keeps the two
+ * from disagreeing about a field neither compiler would otherwise compare.
+ */
+import { ProviderCredentialValidationState } from './provider-credentials.shared.schemas';
+/** One credential row of a connection — what a disconnect deletes, through the credential resource's own DELETE. */
+export interface LinkedProviderConnectionCredentialView {
+    /** The row's id, addressed by the resource DELETE. */
+    readonly credentialId: string;
+    /** The slot the row holds, as its contract key (`accessToken`). */
+    readonly secretSlug: string;
+    /** The ref whose connect flow or typed door CREATED the row — not necessarily the connection's base. */
+    readonly providerRef: string;
+}
+/** One connection an owner holds. */
+export interface LinkedProviderConnectionView {
+    /** The connection's identity: its base ref, the key every row is stored and sealed under. */
+    readonly connectionRef: string;
+    /**
+     * Every ref this connection SERVES on this application — the base first, then the declared members that are
+     * loaded here. A ref declared in no shared connection serves only itself, which is why a single-ref vendor's entry
+     * reads exactly as it always did.
+     */
+    readonly servesRefs: readonly string[];
+    /**
+     * Set when these rows were stored under a ref BEFORE that ref joined a shared connection: they are keyed and sealed
+     * on the old identity, so nothing reads them any more (there is deliberately no re-seal door, #1670) and
+     * `servesRefs` is empty. Names the connection the ref now belongs to — the person connects that one and disconnects
+     * this residue.
+     */
+    readonly supersededByConnectionRef?: string;
+    /** The rows the connection is made of. More than one only for a vendor whose typed credential has several slots. */
+    readonly credentials: readonly LinkedProviderConnectionCredentialView[];
+    /**
+     * Whether an ENABLED row holds a grant the vendor minted (an authorization flow) that could be opened — as opposed
+     * to a pasted credential. `false` also for a granted connection whose row is disabled or cannot be opened: its scopes
+     * cannot be read, so nothing here may claim what it was consented to. Read `enabled` beside it.
+     */
+    readonly holdsAuthorizationGrant: boolean;
+    /**
+     * The scopes the grant's consent has ACCUMULATED (#1671) — absent for a pasted credential, and for a grant whose
+     * vendor never stated its scopes. Vendor permission identifiers, not secrets; never a token.
+     */
+    readonly grantedScopes?: readonly string[];
+    /**
+     * The connection's standing, the WORST of its rows': one row the vendor refused makes the whole connection need
+     * re-authorization, because every ref it serves spends that row.
+     */
+    readonly validationState: ProviderCredentialValidationState;
+    /** Whether every row is enabled. A disabled row resolves as absent, so one disabled row disables the connection. */
+    readonly enabled: boolean;
+    /** When the connection was last spent, across its rows. */
+    readonly lastUsedAt?: string;
+    /** When the connection was first stored. */
+    readonly connectedAt?: string;
+    /**
+     * On an organization's connection, the member who LINKED it — the person whose vendor account a lent grant is, and
+     * the only member who may grow it (#1671 `NOT_THE_LINKING_MEMBER`). Absent on a person's own connection.
+     */
+    readonly linkedByUserId?: string;
+    /** Whether disconnecting also withdraws the grant at the vendor (RFC 7009, #545), or only deletes this copy. */
+    readonly revocationTellsVendor: boolean;
+}
+/** The answer of `GET /connections/linked`. */
+export interface LinkedProviderConnectionsResponse {
+    readonly connections: readonly LinkedProviderConnectionView[];
+}
+/**
+ * The standing of a connection made of several rows: the worst of theirs.
+ *
+ * A connection is spent as ONE thing, so it is only as healthy as its least healthy row — a refused row is refused
+ * for every ref the connection serves, and reporting the best row instead would show a working connection that every
+ * call fails through. An empty set is `UNVALIDATED`: nothing has been proven about rows that do not exist.
+ */
+export declare function worstProviderCredentialValidationState(states: readonly ProviderCredentialValidationState[]): ProviderCredentialValidationState;
+//# sourceMappingURL=provider-connection-listing.shared.schemas.d.ts.map

package/dist/esm/security/connected-accounts/provider-connection-listing.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-connection-listing.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/provider-connection-listing.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,iCAAiC,EAAE,MAAM,uCAAuC,CAAC;AAE1F,oHAAoH;AACpH,MAAM,WAAW,sCAAsC;IACrD,sDAAsD;IACtD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,mEAAmE;IACnE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,wGAAwG;IACxG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,qCAAqC;AACrC,MAAM,WAAW,4BAA4B;IAC3C,6FAA6F;IAC7F,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAC5C,oHAAoH;IACpH,QAAQ,CAAC,WAAW,EAAE,SAAS,sCAAsC,EAAE,CAAC;IACxE;;;;OAIG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;OAGG;IACH,QAAQ,CAAC,eAAe,EAAE,iCAAiC,CAAC;IAC5D,oHAAoH;IACpH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,4CAA4C;IAC5C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,gHAAgH;IAChH,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;CACzC;AAED,+CAA+C;AAC/C,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,WAAW,EAAE,SAAS,4BAA4B,EAAE,CAAC;CAC/D;AAYD;;;;;;GAMG;AACH,wBAAgB,sCAAsC,CACpD,MAAM,EAAE,SAAS,iCAAiC,EAAE,GACnD,iCAAiC,CAMnC"}

package/dist/esm/security/connected-accounts/provider-connection-listing.shared.schemas.js

@@ -0,0 +1,40 @@
+/**
+ * What `GET /connections/linked` answers — the CONNECTIONS one owner holds, one entry each (#1727).
+ *
+ * ## Why a connection and not a credential row
+ *
+ * A stored credential is keyed on `(owner, connectionRef, secretSlug)` (#1670), and a vendor served by several refs
+ * — an engine part and the add-on packages beside it, declared in `providers.sharedConnections` (#1725) — holds ONE
+ * grant keyed on its base ref. A screen that listed rows by `providerRef` therefore showed a person one Microsoft
+ * account per ref while they had authorized once, and offered a disconnect per ref for one grant. The connection is
+ * the unit a person granted, so it is the unit this lists.
+ *
+ * Shared because the backend composes it and the connected-accounts screen renders it; one declaration keeps the two
+ * from disagreeing about a field neither compiler would otherwise compare.
+ */
+import { ProviderCredentialValidationState } from './provider-credentials.shared.schemas.js';
+/**
+ * How bad each validation state is, for {@link worstProviderCredentialValidationState}. Total over the enum, so a
+ * member added tomorrow is a compile error here rather than a state that silently ranks as healthy.
+ */
+const VALIDATION_STATE_SEVERITY = {
+    [ProviderCredentialValidationState.VALID]: 0,
+    [ProviderCredentialValidationState.UNVALIDATED]: 1,
+    [ProviderCredentialValidationState.INVALID]: 2,
+};
+/**
+ * The standing of a connection made of several rows: the worst of theirs.
+ *
+ * A connection is spent as ONE thing, so it is only as healthy as its least healthy row — a refused row is refused
+ * for every ref the connection serves, and reporting the best row instead would show a working connection that every
+ * call fails through. An empty set is `UNVALIDATED`: nothing has been proven about rows that do not exist.
+ */
+export function worstProviderCredentialValidationState(states) {
+    let worst;
+    for (const state of states) {
+        if (worst === undefined || VALIDATION_STATE_SEVERITY[state] > VALIDATION_STATE_SEVERITY[worst])
+            worst = state;
+    }
+    return worst ?? ProviderCredentialValidationState.UNVALIDATED;
+}
+//# sourceMappingURL=provider-connection-listing.shared.schemas.js.map

package/dist/esm/security/connected-accounts/provider-connection-listing.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-connection-listing.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/provider-connection-listing.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,iCAAiC,EAAE,MAAM,uCAAuC,CAAC;AAmE1F;;;GAGG;AACH,MAAM,yBAAyB,GAAgE;IAC7F,CAAC,iCAAiC,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5C,CAAC,iCAAiC,CAAC,WAAW,CAAC,EAAE,CAAC;IAClD,CAAC,iCAAiC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC/C,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,sCAAsC,CACpD,MAAoD;IAEpD,IAAI,KAAoD,CAAC;IACzD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,KAAK,SAAS,IAAI,yBAAyB,CAAC,KAAK,CAAC,GAAG,yBAAyB,CAAC,KAAK,CAAC;YAAE,KAAK,GAAG,KAAK,CAAC;IAChH,CAAC;IACD,OAAO,KAAK,IAAI,iCAAiC,CAAC,WAAW,CAAC;AAChE,CAAC","sourcesContent":["/**\n * What `GET /connections/linked` answers — the CONNECTIONS one owner holds, one entry each (#1727).\n *\n * ## Why a connection and not a credential row\n *\n * A stored credential is keyed on `(owner, connectionRef, secretSlug)` (#1670), and a vendor served by several refs\n * — an engine part and the add-on packages beside it, declared in `providers.sharedConnections` (#1725) — holds ONE\n * grant keyed on its base ref. A screen that listed rows by `providerRef` therefore showed a person one Microsoft\n * account per ref while they had authorized once, and offered a disconnect per ref for one grant. The connection is\n * the unit a person granted, so it is the unit this lists.\n *\n * Shared because the backend composes it and the connected-accounts screen renders it; one declaration keeps the two\n * from disagreeing about a field neither compiler would otherwise compare.\n */\n\nimport { ProviderCredentialValidationState } from './provider-credentials.shared.schemas';\n\n/** One credential row of a connection — what a disconnect deletes, through the credential resource's own DELETE. */\nexport interface LinkedProviderConnectionCredentialView {\n  /** The row's id, addressed by the resource DELETE. */\n  readonly credentialId: string;\n  /** The slot the row holds, as its contract key (`accessToken`). */\n  readonly secretSlug: string;\n  /** The ref whose connect flow or typed door CREATED the row — not necessarily the connection's base. */\n  readonly providerRef: string;\n}\n\n/** One connection an owner holds. */\nexport interface LinkedProviderConnectionView {\n  /** The connection's identity: its base ref, the key every row is stored and sealed under. */\n  readonly connectionRef: string;\n  /**\n   * Every ref this connection SERVES on this application — the base first, then the declared members that are\n   * loaded here. A ref declared in no shared connection serves only itself, which is why a single-ref vendor's entry\n   * reads exactly as it always did.\n   */\n  readonly servesRefs: readonly string[];\n  /**\n   * Set when these rows were stored under a ref BEFORE that ref joined a shared connection: they are keyed and sealed\n   * on the old identity, so nothing reads them any more (there is deliberately no re-seal door, #1670) and\n   * `servesRefs` is empty. Names the connection the ref now belongs to — the person connects that one and disconnects\n   * this residue.\n   */\n  readonly supersededByConnectionRef?: string;\n  /** The rows the connection is made of. More than one only for a vendor whose typed credential has several slots. */\n  readonly credentials: readonly LinkedProviderConnectionCredentialView[];\n  /**\n   * Whether an ENABLED row holds a grant the vendor minted (an authorization flow) that could be opened — as opposed\n   * to a pasted credential. `false` also for a granted connection whose row is disabled or cannot be opened: its scopes\n   * cannot be read, so nothing here may claim what it was consented to. Read `enabled` beside it.\n   */\n  readonly holdsAuthorizationGrant: boolean;\n  /**\n   * The scopes the grant's consent has ACCUMULATED (#1671) — absent for a pasted credential, and for a grant whose\n   * vendor never stated its scopes. Vendor permission identifiers, not secrets; never a token.\n   */\n  readonly grantedScopes?: readonly string[];\n  /**\n   * The connection's standing, the WORST of its rows': one row the vendor refused makes the whole connection need\n   * re-authorization, because every ref it serves spends that row.\n   */\n  readonly validationState: ProviderCredentialValidationState;\n  /** Whether every row is enabled. A disabled row resolves as absent, so one disabled row disables the connection. */\n  readonly enabled: boolean;\n  /** When the connection was last spent, across its rows. */\n  readonly lastUsedAt?: string;\n  /** When the connection was first stored. */\n  readonly connectedAt?: string;\n  /**\n   * On an organization's connection, the member who LINKED it — the person whose vendor account a lent grant is, and\n   * the only member who may grow it (#1671 `NOT_THE_LINKING_MEMBER`). Absent on a person's own connection.\n   */\n  readonly linkedByUserId?: string;\n  /** Whether disconnecting also withdraws the grant at the vendor (RFC 7009, #545), or only deletes this copy. */\n  readonly revocationTellsVendor: boolean;\n}\n\n/** The answer of `GET /connections/linked`. */\nexport interface LinkedProviderConnectionsResponse {\n  readonly connections: readonly LinkedProviderConnectionView[];\n}\n\n/**\n * How bad each validation state is, for {@link worstProviderCredentialValidationState}. Total over the enum, so a\n * member added tomorrow is a compile error here rather than a state that silently ranks as healthy.\n */\nconst VALIDATION_STATE_SEVERITY: Readonly<Record<ProviderCredentialValidationState, number>> = {\n  [ProviderCredentialValidationState.VALID]: 0,\n  [ProviderCredentialValidationState.UNVALIDATED]: 1,\n  [ProviderCredentialValidationState.INVALID]: 2,\n};\n\n/**\n * The standing of a connection made of several rows: the worst of theirs.\n *\n * A connection is spent as ONE thing, so it is only as healthy as its least healthy row — a refused row is refused\n * for every ref the connection serves, and reporting the best row instead would show a working connection that every\n * call fails through. An empty set is `UNVALIDATED`: nothing has been proven about rows that do not exist.\n */\nexport function worstProviderCredentialValidationState(\n  states: readonly ProviderCredentialValidationState[],\n): ProviderCredentialValidationState {\n  let worst: ProviderCredentialValidationState | undefined;\n  for (const state of states) {\n    if (worst === undefined || VALIDATION_STATE_SEVERITY[state] > VALIDATION_STATE_SEVERITY[worst]) worst = state;\n  }\n  return worst ?? ProviderCredentialValidationState.UNVALIDATED;\n}\n"]}

package/dist/esm/security/connected-accounts/provider-credentials-organization.shared.resources-config.schemas.d.ts

@@ -13,16 +13,20 @@ export declare const orgProviderCredentialsResourceConfiguration_InitializationF
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
     providerRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    connectionRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
     secretSlug: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
     secretValue: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
     enabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>>;
-    validationState: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof ProviderCredentialValidationState>>>>;
+    validationState: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof ProviderCredentialValidationState>>>>>>;
     validationError: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>;
     lastValidatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
     lastUsedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
     setByUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
     secretSetAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
-    connectionParameters: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>>;
+    connectionFacts: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        value: z.ZodString;
+        provenance: z.ZodEnum<typeof import("./provider-credentials.shared.schemas").ProviderConnectionFactProvenance>;
+    }, z.core.$strict>>>>>;
     description: z.ZodOptional<z.ZodString>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;

package/dist/esm/security/connected-accounts/provider-credentials-organization.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-credentials-organization.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/connected-accounts/provider-credentials-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAEL,iCAAiC,EAClC,MAAM,uCAAuC,CAAC;AAK/C,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAA4D,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAY1I,KAAK,oCAAoC,GACrC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,WAAW,CAAC;AAEtC,eAAO,MAAM,iEAAiE,GAC5E,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;mBA8L9C,CAAC"}
+{"version":3,"file":"provider-credentials-organization.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/provider-credentials-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAEL,iCAAiC,EAClC,MAAM,uCAAuC,CAAC;AAK/C,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAA4D,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAa1I,KAAK,oCAAoC,GACrC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,WAAW,CAAC;AAEtC,eAAO,MAAM,iEAAiE,GAC5E,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;mBA8L9C,CAAC"}

package/dist/esm/security/connected-accounts/provider-credentials-organization.shared.resources-config.schemas.js

@@ -12,9 +12,10 @@ import { ResourceSystemAccessMode } from '../../resources/resources-config.share
 import { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions.js';
 import { ResourceOperationRiskLevel, ResourceOperationVariantType } from '../../resources/resources.shared.schemas.js';
 import { CORE_APP_ROLES, CORE_ORG_ROLES } from '../authorizations/roles.shared.schemas.js';
-const ORG_PROVIDER_CREDENTIALS_SORT_FIELDS = ['createdAt', 'updatedAt', 'providerRef', 'lastUsedAt'];
+const ORG_PROVIDER_CREDENTIALS_SORT_FIELDS = ['createdAt', 'updatedAt', 'providerRef', 'connectionRef', 'lastUsedAt'];
 const ORG_PROVIDER_CREDENTIALS_FILTER_FIELDS = {
     providerRef: z.string(),
+    connectionRef: z.string(),
     secretSlug: z.string(),
     enabled: z.boolean(),
     validationState: z.enum(ProviderCredentialValidationState),

package/dist/esm/security/connected-accounts/provider-credentials-organization.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-credentials-organization.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/security/connected-accounts/provider-credentials-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,oCAAoC,EACpC,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,2DAA2D,CAAC;AAC1H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,0CAA0C,CAAC;AAC1I,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExF,MAAM,oCAAoC,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,CAAU,CAAC;AAE9G,MAAM,sCAAsC,GAAG;IAC7C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;CAC3D,CAAC;AAUF,MAAM,CAAC,MAAM,iEAAiE,GAAG,CAC/E,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAI7C;IACA,UAAU,EAAE,oCAAoC;IAChD,kBAAkB,EAAE,gBAAgB,CAAC,wBAAwB;IAC7D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,wBAAwB,CAAC;IACtG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH;;;;;OAKG;IACH,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,SAAS;QACjD,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,WAAW;KACvC;IAED,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,+FAA+F;QAC/F,gGAAgG;QAChG,2EAA2E;QAC3E,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IAED,uBAAuB,EAAE;QACvB;;;;;;;;;;;;;;;;;;WAkBG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,sFAAsF;oBACtF,0DAA0D;oBAC1D,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,sCAAsC;oBACpD,UAAU,EAAE,oCAAoC;oBAChD,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,uFAAuF;oBACvF,wBAAwB;oBACxB,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED;;;;;WAKG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Organization Provider Credentials — resource configuration.\n *\n * The tenant-owned service credential toward a third-party provider. See\n * `provider-credentials.shared.schemas.ts` for what the resource is and what it deliberately is not.\n */\n\nimport { z } from 'zod';\n\nimport {\n  OrganizationProviderCredentialSchema,\n  ProviderCredentialValidationState,\n} from './provider-credentials.shared.schemas';\n\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../../compliance/privacy/impersonalization.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../authorizations/roles.shared.schemas';\n\nconst ORG_PROVIDER_CREDENTIALS_SORT_FIELDS = ['createdAt', 'updatedAt', 'providerRef', 'lastUsedAt'] as const;\n\nconst ORG_PROVIDER_CREDENTIALS_FILTER_FIELDS = {\n  providerRef: z.string(),\n  secretSlug: z.string(),\n  enabled: z.boolean(),\n  validationState: z.enum(ProviderCredentialValidationState),\n};\n\ntype OrgProviderCredentialsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE\n  | CoreResourceOperation.UPDATE_MANY;\n\nexport const orgProviderCredentialsResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[],\n) => createResourceConfiguration_Initialization<\n  undefined,\n  OrgProviderCredentialsCoreOperations,\n  typeof OrganizationProviderCredentialSchema\n>({\n  mainSchema: OrganizationProviderCredentialSchema,\n  resourceIdentifier: CoreResourceType.ORG_PROVIDER_CREDENTIALS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORG_PROVIDER_CREDENTIALS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  /**\n   * ## `read` / `list` — the RESOLVER's door\n   *\n   * A provider call happens on whatever execution context the caller holds: a batch, a queue\n   * consumer, an anonymous webhook return leg. None of those carry an ORG_ADMIN role, and the\n   * resolution must still work — so the resolver reads through `readAsSystem`, which is fail-closed\n   * on this opt-in. The scope is supplied as the organization FK in the system context map, so the\n   * bypass is of the ROLE check only, never of the tenant boundary.\n   *\n   * ## `update` — the resolver's WRITE-BACK door\n   *\n   * `lastUsedAt`, `validationState`, `validationError` and `lastValidatedAt` are all\n   * `.excludeFromUpdate()`, so the strict re-parse on the ordinary update path strips them. The\n   * trusted `updateAsSystem` path is the only one that re-attaches them, which is why it is opted\n   * into here and why those fields are not client-writable: a tenant administrator must not be able\n   * to declare their own credential `VALID`.\n   *\n   * ## `create` — deliberately NOT opted in\n   *\n   * A credential comes into existence only when a human supplies one. There is no seed, no\n   * provisioning step and no import that should mint one on a tenant's behalf, so the system create\n   * door stays shut.\n   *\n   * ## `exportSubject: FORBIDDEN`\n   *\n   * The reserved class. This row is a live credential toward a third party; a subject export that\n   * carried one would hand a working secret to whoever requested the export.\n   */\n  /**\n   * `create` is open for the reason its user-owned sibling documents at length: a credential a\n   * vendor MINTS has no HTTP write that could carry it. An OAuth2 grant arrives through a redirect\n   * after a tenant administrator authorized it on the vendor's consent screen, so the exchange —\n   * engine code, never a request payload — is the only thing that can store it.\n   */\n  systemAccessPolicy: {\n    exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n    read: ResourceSystemAccessMode.ALLOWED,\n    list: ResourceSystemAccessMode.ALLOWED,\n    update: ResourceSystemAccessMode.ALLOWED,\n    create: ResourceSystemAccessMode.ALLOWED,\n  },\n\n  /**\n   * Subject erasure RETAINS this row and scrubs nothing, because there is nothing here that belongs\n   * to a person.\n   *\n   * The row is a TENANT's credential. `setByUserId` names an ACTOR — the administrator who typed it\n   * — which is the first population `NO_PRINCIPAL` describes, and it is exactly the field an\n   * erasure must not use as a reason to destroy the row: a tenant losing its Slack integration\n   * because the admin who configured it left the company is a bug, not a privacy guarantee.\n   *\n   * The erasure walk cannot reach this resource in any case, because no `USERS` relationship is\n   * registered for `setByUserId` — withheld deliberately, since that edge would also put a\n   * credential on the Art. 15 export graph. `RETAIN_ONLY` is therefore a statement of what WOULD\n   * happen rather than a path that runs today, and it is worth declaring for that reason: the next\n   * author who registers a USERS edge inherits the correct answer instead of the default.\n   *\n   * The assertion is checked in both directions by the factory — `RETAIN_ONLY` is refused if any\n   * field carries an impersonalize treatment or declares a personal-data category.\n   */\n  retentionPolicy: {\n    mode: ErasureRetentionMode.RETAIN_ONLY,\n  },\n\n  dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    // Required by the ORGANIZATIONS cascade: `onParentDelete` dispatches the child's DELETE, and a\n    // relationship declaring the cascade against a resource with no DELETE core operation throws at\n    // config build. It is also the tenant's own \"remove this credential\" door.\n    CoreResourceOperation.DELETE,\n    // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n    CoreResourceOperation.UPDATE_MANY,\n  ],\n\n  operationsConfiguration: {\n    /*\n     * ORG_ADMIN everywhere, and NO super-administrator variant anywhere — a deliberate refusal, not\n     * an omission.\n     *\n     * Every sibling security resource (org API keys, org OAuth clients) carries an `admin` variant\n     * so a platform operator can support a tenant. This one does not, because the thing being\n     * supported is a live credential toward a THIRD PARTY: an operator who can list, rotate or spend\n     * a tenant's Slack token can act as that tenant toward Slack, and no audit event afterwards\n     * makes that reversible. `administrative-continuity-floors.md` asks for the reversibility test\n     * before crossing a tenant boundary, and this verb fails it in both directions — reading is\n     * masked but LISTing reveals which vendors a tenant integrates with, and rotating locks the\n     * tenant out of its own integration.\n     *\n     * The cost is real and accepted: a tenant that loses every ORG_ADMIN cannot have its credentials\n     * repaired by support. That is what `organizationMembers.grantOwnership` exists for — restore an\n     * administrator to the tenant, and the tenant repairs its own credentials. The repair path runs\n     * through identity, where it is audited and reversible, rather than through the credential\n     * store, where it would not be.\n     */\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          // LOW because the value never leaves: `.isWriteOnlySecret()` redacts it at the client\n          // boundary, so a READ returns metadata and a placeholder.\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          filterFields: ORG_PROVIDER_CREDENTIALS_FILTER_FIELDS,\n          sortFields: ORG_PROVIDER_CREDENTIALS_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 100,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          // CRITICAL: this is the act of granting the application authority to act as the tenant\n          // toward a third party.\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n\n    /*\n     * Route-less retention plumbing. INTERNAL_CALL registers NO route, and must not be\n     * REPOSITORY_ONLY: that satisfies the factory's boot-time presence guard and then fails to\n     * resolve when an erasure actually runs, because the retention primitives resolve through\n     * `getServiceOperationPathDefault`, which excludes REPOSITORY_ONLY.\n     */\n    [CoreResourceOperation.UPDATE_MANY]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n  },\n});\n"]}
+{"version":3,"file":"provider-credentials-organization.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/provider-credentials-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,oCAAoC,EACpC,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,2DAA2D,CAAC;AAC1H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,0CAA0C,CAAC;AAC1I,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExF,MAAM,oCAAoC,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,YAAY,CAAU,CAAC;AAE/H,MAAM,sCAAsC,GAAG;IAC7C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;CAC3D,CAAC;AAUF,MAAM,CAAC,MAAM,iEAAiE,GAAG,CAC/E,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAI7C;IACA,UAAU,EAAE,oCAAoC;IAChD,kBAAkB,EAAE,gBAAgB,CAAC,wBAAwB;IAC7D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,wBAAwB,CAAC;IACtG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH;;;;;OAKG;IACH,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,SAAS;QACjD,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,WAAW;KACvC;IAED,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,+FAA+F;QAC/F,gGAAgG;QAChG,2EAA2E;QAC3E,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IAED,uBAAuB,EAAE;QACvB;;;;;;;;;;;;;;;;;;WAkBG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,sFAAsF;oBACtF,0DAA0D;oBAC1D,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,sCAAsC;oBACpD,UAAU,EAAE,oCAAoC;oBAChD,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,uFAAuF;oBACvF,wBAAwB;oBACxB,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED;;;;;WAKG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Organization Provider Credentials — resource configuration.\n *\n * The tenant-owned service credential toward a third-party provider. See\n * `provider-credentials.shared.schemas.ts` for what the resource is and what it deliberately is not.\n */\n\nimport { z } from 'zod';\n\nimport {\n  OrganizationProviderCredentialSchema,\n  ProviderCredentialValidationState,\n} from './provider-credentials.shared.schemas';\n\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../../compliance/privacy/impersonalization.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../authorizations/roles.shared.schemas';\n\nconst ORG_PROVIDER_CREDENTIALS_SORT_FIELDS = ['createdAt', 'updatedAt', 'providerRef', 'connectionRef', 'lastUsedAt'] as const;\n\nconst ORG_PROVIDER_CREDENTIALS_FILTER_FIELDS = {\n  providerRef: z.string(),\n  connectionRef: z.string(),\n  secretSlug: z.string(),\n  enabled: z.boolean(),\n  validationState: z.enum(ProviderCredentialValidationState),\n};\n\ntype OrgProviderCredentialsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE\n  | CoreResourceOperation.UPDATE_MANY;\n\nexport const orgProviderCredentialsResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[],\n) => createResourceConfiguration_Initialization<\n  undefined,\n  OrgProviderCredentialsCoreOperations,\n  typeof OrganizationProviderCredentialSchema\n>({\n  mainSchema: OrganizationProviderCredentialSchema,\n  resourceIdentifier: CoreResourceType.ORG_PROVIDER_CREDENTIALS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORG_PROVIDER_CREDENTIALS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  /**\n   * ## `read` / `list` — the RESOLVER's door\n   *\n   * A provider call happens on whatever execution context the caller holds: a batch, a queue\n   * consumer, an anonymous webhook return leg. None of those carry an ORG_ADMIN role, and the\n   * resolution must still work — so the resolver reads through `readAsSystem`, which is fail-closed\n   * on this opt-in. The scope is supplied as the organization FK in the system context map, so the\n   * bypass is of the ROLE check only, never of the tenant boundary.\n   *\n   * ## `update` — the resolver's WRITE-BACK door\n   *\n   * `lastUsedAt`, `validationState`, `validationError` and `lastValidatedAt` are all\n   * `.excludeFromUpdate()`, so the strict re-parse on the ordinary update path strips them. The\n   * trusted `updateAsSystem` path is the only one that re-attaches them, which is why it is opted\n   * into here and why those fields are not client-writable: a tenant administrator must not be able\n   * to declare their own credential `VALID`.\n   *\n   * ## `create` — deliberately NOT opted in\n   *\n   * A credential comes into existence only when a human supplies one. There is no seed, no\n   * provisioning step and no import that should mint one on a tenant's behalf, so the system create\n   * door stays shut.\n   *\n   * ## `exportSubject: FORBIDDEN`\n   *\n   * The reserved class. This row is a live credential toward a third party; a subject export that\n   * carried one would hand a working secret to whoever requested the export.\n   */\n  /**\n   * `create` is open for the reason its user-owned sibling documents at length: a credential a\n   * vendor MINTS has no HTTP write that could carry it. An OAuth2 grant arrives through a redirect\n   * after a tenant administrator authorized it on the vendor's consent screen, so the exchange —\n   * engine code, never a request payload — is the only thing that can store it.\n   */\n  systemAccessPolicy: {\n    exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n    read: ResourceSystemAccessMode.ALLOWED,\n    list: ResourceSystemAccessMode.ALLOWED,\n    update: ResourceSystemAccessMode.ALLOWED,\n    create: ResourceSystemAccessMode.ALLOWED,\n  },\n\n  /**\n   * Subject erasure RETAINS this row and scrubs nothing, because there is nothing here that belongs\n   * to a person.\n   *\n   * The row is a TENANT's credential. `setByUserId` names an ACTOR — the administrator who typed it\n   * — which is the first population `NO_PRINCIPAL` describes, and it is exactly the field an\n   * erasure must not use as a reason to destroy the row: a tenant losing its Slack integration\n   * because the admin who configured it left the company is a bug, not a privacy guarantee.\n   *\n   * The erasure walk cannot reach this resource in any case, because no `USERS` relationship is\n   * registered for `setByUserId` — withheld deliberately, since that edge would also put a\n   * credential on the Art. 15 export graph. `RETAIN_ONLY` is therefore a statement of what WOULD\n   * happen rather than a path that runs today, and it is worth declaring for that reason: the next\n   * author who registers a USERS edge inherits the correct answer instead of the default.\n   *\n   * The assertion is checked in both directions by the factory — `RETAIN_ONLY` is refused if any\n   * field carries an impersonalize treatment or declares a personal-data category.\n   */\n  retentionPolicy: {\n    mode: ErasureRetentionMode.RETAIN_ONLY,\n  },\n\n  dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    // Required by the ORGANIZATIONS cascade: `onParentDelete` dispatches the child's DELETE, and a\n    // relationship declaring the cascade against a resource with no DELETE core operation throws at\n    // config build. It is also the tenant's own \"remove this credential\" door.\n    CoreResourceOperation.DELETE,\n    // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n    CoreResourceOperation.UPDATE_MANY,\n  ],\n\n  operationsConfiguration: {\n    /*\n     * ORG_ADMIN everywhere, and NO super-administrator variant anywhere — a deliberate refusal, not\n     * an omission.\n     *\n     * Every sibling security resource (org API keys, org OAuth clients) carries an `admin` variant\n     * so a platform operator can support a tenant. This one does not, because the thing being\n     * supported is a live credential toward a THIRD PARTY: an operator who can list, rotate or spend\n     * a tenant's Slack token can act as that tenant toward Slack, and no audit event afterwards\n     * makes that reversible. `administrative-continuity-floors.md` asks for the reversibility test\n     * before crossing a tenant boundary, and this verb fails it in both directions — reading is\n     * masked but LISTing reveals which vendors a tenant integrates with, and rotating locks the\n     * tenant out of its own integration.\n     *\n     * The cost is real and accepted: a tenant that loses every ORG_ADMIN cannot have its credentials\n     * repaired by support. That is what `organizationMembers.grantOwnership` exists for — restore an\n     * administrator to the tenant, and the tenant repairs its own credentials. The repair path runs\n     * through identity, where it is audited and reversible, rather than through the credential\n     * store, where it would not be.\n     */\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          // LOW because the value never leaves: `.isWriteOnlySecret()` redacts it at the client\n          // boundary, so a READ returns metadata and a placeholder.\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          filterFields: ORG_PROVIDER_CREDENTIALS_FILTER_FIELDS,\n          sortFields: ORG_PROVIDER_CREDENTIALS_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 100,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          // CRITICAL: this is the act of granting the application authority to act as the tenant\n          // toward a third party.\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n\n    /*\n     * Route-less retention plumbing. INTERNAL_CALL registers NO route, and must not be\n     * REPOSITORY_ONLY: that satisfies the factory's boot-time presence guard and then fails to\n     * resolve when an erasure actually runs, because the retention primitives resolve through\n     * `getServiceOperationPathDefault`, which excludes REPOSITORY_ONLY.\n     */\n    [CoreResourceOperation.UPDATE_MANY]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n  },\n});\n"]}

package/dist/esm/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.d.ts

@@ -9,20 +9,24 @@ import { z } from 'zod';
 import { ProviderCredentialValidationState } from './provider-credentials.shared.schemas';
 import { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';
 import { ResourceRelationship } from '../../resources/resources.shared.schemas';
-type UserProviderCredentialsCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.UPDATE_MANY;
+type UserProviderCredentialsCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE;
 export declare const userProviderCredentialsResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("../..").ResourceConfiguration<undefined, UserProviderCredentialsCoreOperations, import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
     providerRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    connectionRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
     secretSlug: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
     secretValue: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
     enabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>>;
-    validationState: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof ProviderCredentialValidationState>>>>;
+    validationState: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof ProviderCredentialValidationState>>>>>>;
     validationError: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>;
     lastValidatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
     lastUsedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
     secretSetAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
-    connectionParameters: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>>;
+    connectionFacts: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        value: z.ZodString;
+        provenance: z.ZodEnum<typeof import("./provider-credentials.shared.schemas").ProviderConnectionFactProvenance>;
+    }, z.core.$strict>>>>>;
     description: z.ZodOptional<z.ZodString>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;

package/dist/esm/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-credentials-user.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,iCAAiC,EAElC,MAAM,uCAAuC,CAAC;AAK/C,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAA4D,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAY1I,KAAK,qCAAqC,GACtC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,WAAW,CAAC;AAEtC,eAAO,MAAM,kEAAkE,GAC7E,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;mBAsL9C,CAAC"}
+{"version":3,"file":"provider-credentials-user.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,iCAAiC,EAElC,MAAM,uCAAuC,CAAC;AAI/C,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAA4D,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAa1I,KAAK,qCAAqC,GACtC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAEjC,eAAO,MAAM,kEAAkE,GAC7E,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;mBAwJ9C,CAAC"}

package/dist/esm/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.js

@@ -7,15 +7,15 @@
  */
 import { z } from 'zod';
 import { ProviderCredentialValidationState, UserProviderCredentialSchema, } from './provider-credentials.shared.schemas.js';
-import { ErasureRetentionMode, ResourceDataSubjectKind } from '../../compliance/privacy/impersonalization.shared.schemas.js';
 import { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory.js';
 import { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas.js';
 import { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions.js';
 import { ResourceOperationRiskLevel, ResourceOperationVariantType } from '../../resources/resources.shared.schemas.js';
 import { CORE_APP_ROLES } from '../authorizations/roles.shared.schemas.js';
-const USER_PROVIDER_CREDENTIALS_SORT_FIELDS = ['createdAt', 'updatedAt', 'providerRef', 'lastUsedAt'];
+const USER_PROVIDER_CREDENTIALS_SORT_FIELDS = ['createdAt', 'updatedAt', 'providerRef', 'connectionRef', 'lastUsedAt'];
 const USER_PROVIDER_CREDENTIALS_FILTER_FIELDS = {
     providerRef: z.string(),
+    connectionRef: z.string(),
     secretSlug: z.string(),
     enabled: z.boolean(),
     validationState: z.enum(ProviderCredentialValidationState),
@@ -63,38 +63,27 @@ export const userProviderCredentialsResourceConfiguration_InitializationFactory
         update: ResourceSystemAccessMode.ALLOWED,
         create: ResourceSystemAccessMode.ALLOWED,
     },
-    /**
-     * `RETAIN_ONLY`, and the row still does not survive its owner — the CASCADE removes it.
-     *
-     * These are two different mechanisms and reading them as one produces the wrong answer in both
-     * directions. The retention policy governs what the erasure WALK does to a row it retains: here,
-     * nothing, because a secret is not personal data to be pseudonymised. You do not scrub a
-     * credential, you destroy it. The `USERS → USER_PROVIDER_CREDENTIALS` composition is what destroys
-     * it, dispatching this resource's DELETE when the person is removed.
+    /*
+     * NO `retentionPolicy`, and so no `dataSubjectPolicy` (the factory pairs the two). A credential is
+     * destroyed when its owner is, never kept: a secret is not personal data to pseudonymise, and a sealed
+     * envelope kept after an erasure still opens against somebody who asked to be forgotten.
      *
-     * So a person who exercises erasure does not leave a live credential behind, and the mechanism that
-     * guarantees it is the relationship rather than the policy. Declaring `RETAIN_AND_IMPERSONALIZE`
-     * instead would be actively wrong: it would keep the row and replace its fields, leaving a sealed
-     * envelope whose key material still opens against a subject who asked to be forgotten.
+     * This resource used to declare `retentionPolicy: RETAIN_ONLY` on the reasoning that the USERS
+     * composition cascade would remove the row anyway. That held only while an erasure followed the
+     * cascade's default. Since #1279 an erasure reads the CHILD's retention declaration on a silent edge,
+     * because an erasure keeps the (scrubbed) USERS row and the cascade never fires. So RETAIN_ONLY meant
+     * exactly what it says, and every erasure left the person's third-party tokens in place (#1569). The
+     * USERS → USER_PROVIDER_CREDENTIALS edge now AUTHORS `strategy: DELETE`, so both the cascade and the
+     * erasure destroy the rows, and re-adding a retain policy here would be refused as a contradiction.
      */
-    retentionPolicy: {
-        mode: ErasureRetentionMode.RETAIN_ONLY,
-    },
-    /**
-     * `NO_PRINCIPAL` on the axis this enum actually decides: erasing a credential revokes no session,
-     * because no login is reachable from it. `userId` names the OWNER, not a login this row confers.
-     */
-    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },
     coreOperations: [
         CoreResourceOperation.READ,
         CoreResourceOperation.LIST,
         CoreResourceOperation.CREATE,
         CoreResourceOperation.UPDATE,
-        // Required by the USERS cascade — `onParentDelete` dispatches this DELETE — and it is also the
-        // holder's own "remove this credential" door.
+        // Required by the USERS cascade and by a subject erasure, both of which dispatch this DELETE — and
+        // it is also the holder's own "remove this credential" door.
         CoreResourceOperation.DELETE,
-        // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.
-        CoreResourceOperation.UPDATE_MANY,
     ],
     operationsConfiguration: {
         /*
@@ -169,23 +158,6 @@ export const userProviderCredentialsResourceConfiguration_InitializationFactory
                 },
             ],
         },
-        /**
-         * Route-less and INTERNAL_CALL only — the retention machinery's own door, never a client's.
-         *
-         * `retentionPolicy` requires READ + LIST + UPDATE_MANY to exist, and a bulk update reachable over
-         * HTTP on this resource would be a way to change many credentials at once, which no holder needs
-         * and no administrator may have.
-         */
-        [CoreResourceOperation.UPDATE_MANY]: {
-            variants: [
-                {
-                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
-                    isDefault: true,
-                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
-                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
-                },
-            ],
-        },
     },
 });
 //# sourceMappingURL=provider-credentials-user.shared.resources-config.schemas.js.map

package/dist/esm/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-credentials-user.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,2DAA2D,CAAC;AAC1H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,0CAA0C,CAAC;AAC1I,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExE,MAAM,qCAAqC,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,CAAU,CAAC;AAE/G,MAAM,uCAAuC,GAAG;IAC9C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;CAC3D,CAAC;AAUF,MAAM,CAAC,MAAM,kEAAkE,GAAG,CAChF,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAI7C;IACA,UAAU,EAAE,4BAA4B;IACxC,kBAAkB,EAAE,gBAAgB,CAAC,yBAAyB;IAC9D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,yBAAyB,CAAC;IACvG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,SAAS;QACjD,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IAED;;;;;;;;;;;;;OAaG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,WAAW;KACvC;IAED;;;OAGG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,+FAA+F;QAC/F,8CAA8C;QAC9C,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IAED,uBAAuB,EAAE;QACvB;;;;;;;;;;;;WAYG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,sFAAsF;oBACtF,0DAA0D;oBAC1D,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,uCAAuC;oBACrD,UAAU,EAAE,qCAAqC;oBACjD,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,yFAAyF;oBACzF,sFAAsF;oBACtF,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,oFAAoF;oBACpF,eAAe;oBACf,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED;;;;;;WAMG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * User Provider Credentials — resource configuration.\n *\n * A PERSON's own credential toward a third party. See `provider-credentials.shared.schemas.ts` for\n * what the resource is, why it is separate from the organization-owned sibling, and why it is not a\n * delegated OAuth grant.\n */\n\nimport { z } from 'zod';\n\nimport {\n  ProviderCredentialValidationState,\n  UserProviderCredentialSchema,\n} from './provider-credentials.shared.schemas';\n\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../../compliance/privacy/impersonalization.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../authorizations/roles.shared.schemas';\n\nconst USER_PROVIDER_CREDENTIALS_SORT_FIELDS = ['createdAt', 'updatedAt', 'providerRef', 'lastUsedAt'] as const;\n\nconst USER_PROVIDER_CREDENTIALS_FILTER_FIELDS = {\n  providerRef: z.string(),\n  secretSlug: z.string(),\n  enabled: z.boolean(),\n  validationState: z.enum(ProviderCredentialValidationState),\n};\n\ntype UserProviderCredentialsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE\n  | CoreResourceOperation.UPDATE_MANY;\n\nexport const userProviderCredentialsResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[],\n) => createResourceConfiguration_Initialization<\n  undefined,\n  UserProviderCredentialsCoreOperations,\n  typeof UserProviderCredentialSchema\n>({\n  mainSchema: UserProviderCredentialSchema,\n  resourceIdentifier: CoreResourceType.USER_PROVIDER_CREDENTIALS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USER_PROVIDER_CREDENTIALS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  /**\n   * The same four system doors as the organization-owned sibling, for the same reasons: a provider\n   * call runs on whatever execution context the caller holds, so the resolver reads through\n   * `readAsSystem`, and writes back `lastUsedAt` / `validationState` through `updateAsSystem` because\n   * those fields are `.excludeFromUpdate()` and a holder must not be able to declare their own\n   * credential VALID.\n   *\n   * ## `create` was shut, and the sentence that shut it stopped being true\n   *\n   * It read: \"a credential exists only because a person supplied one.\" That is exactly right for a\n   * credential somebody PASTES, and false for one a vendor MINTS. An OAuth2 grant exists because a\n   * person authorized it on the vendor's own consent screen and came back through a redirect;\n   * nobody ever types it, so there is no HTTP write that could carry it. Leaving the door shut would\n   * mean the authorization exchange completes, the vendor records the grant, and this application\n   * has nowhere to put it.\n   *\n   * What keeps that narrow is the door itself rather than a second check: `createAsSystem` is\n   * reachable only from engine code — never an HTTP payload — its re-attach allowlist is DERIVED\n   * from the schema rather than caller-supplied, and the row identity the seal binds to comes from\n   * the scope map, so a caller cannot name whose credential it is writing.\n   *\n   * ## `exportSubject: FORBIDDEN` matters MORE here than on the sibling, and the difference is real\n   *\n   * The organization-owned row is unreachable on the subject-export graph anyway, because no `USERS`\n   * relationship is registered for its `setByUserId` — the export walk simply never arrives. This row\n   * IS reachable: `userId` is a registered `USERS` composition, which is what gives the resource its\n   * USER_SELF scope in the first place. So the export walk arrives here BY CONSTRUCTION, and this\n   * refusal is the only thing standing between a subject-access request and a working third-party\n   * credential in the response.\n   */\n  systemAccessPolicy: {\n    exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n    read: ResourceSystemAccessMode.ALLOWED,\n    list: ResourceSystemAccessMode.ALLOWED,\n    update: ResourceSystemAccessMode.ALLOWED,\n    create: ResourceSystemAccessMode.ALLOWED,\n  },\n\n  /**\n   * `RETAIN_ONLY`, and the row still does not survive its owner — the CASCADE removes it.\n   *\n   * These are two different mechanisms and reading them as one produces the wrong answer in both\n   * directions. The retention policy governs what the erasure WALK does to a row it retains: here,\n   * nothing, because a secret is not personal data to be pseudonymised. You do not scrub a\n   * credential, you destroy it. The `USERS → USER_PROVIDER_CREDENTIALS` composition is what destroys\n   * it, dispatching this resource's DELETE when the person is removed.\n   *\n   * So a person who exercises erasure does not leave a live credential behind, and the mechanism that\n   * guarantees it is the relationship rather than the policy. Declaring `RETAIN_AND_IMPERSONALIZE`\n   * instead would be actively wrong: it would keep the row and replace its fields, leaving a sealed\n   * envelope whose key material still opens against a subject who asked to be forgotten.\n   */\n  retentionPolicy: {\n    mode: ErasureRetentionMode.RETAIN_ONLY,\n  },\n\n  /**\n   * `NO_PRINCIPAL` on the axis this enum actually decides: erasing a credential revokes no session,\n   * because no login is reachable from it. `userId` names the OWNER, not a login this row confers.\n   */\n  dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    // Required by the USERS cascade — `onParentDelete` dispatches this DELETE — and it is also the\n    // holder's own \"remove this credential\" door.\n    CoreResourceOperation.DELETE,\n    // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n    CoreResourceOperation.UPDATE_MANY,\n  ],\n\n  operationsConfiguration: {\n    /*\n     * `APP_USER` everywhere, and NO administrative variant anywhere — a stronger refusal than the\n     * organization-owned sibling's, which refuses only the PLATFORM operator.\n     *\n     * Here an organization administrator is refused too. The row is a key its holder authored against\n     * their own account with a vendor; consent to store it is not consent for somebody else to spend\n     * it, and the vendor would record the act as the holder's own. There is no support story that\n     * makes that reversible, and the USER_SELF primary-scope filter is what enforces it structurally\n     * rather than by a role list somebody could widen.\n     *\n     * The cost is that a personal credential cannot be repaired by anyone but its owner, which is the\n     * correct outcome: if the person is gone, the credential should be too, and the cascade sees to it.\n     */\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          // LOW because the value never leaves: `.isWriteOnlySecret()` redacts it at the client\n          // boundary, so a READ returns metadata and a placeholder.\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          filterFields: USER_PROVIDER_CREDENTIALS_FILTER_FIELDS,\n          sortFields: USER_PROVIDER_CREDENTIALS_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 100,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          // CRITICAL: the act of granting this application authority to act as the person toward a\n          // third party. That it is the person's own decision makes it consented, not low-risk.\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          // Revoking one's own credential is the safe direction and must never be harder than\n          // granting it.\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n\n    /**\n     * Route-less and INTERNAL_CALL only — the retention machinery's own door, never a client's.\n     *\n     * `retentionPolicy` requires READ + LIST + UPDATE_MANY to exist, and a bulk update reachable over\n     * HTTP on this resource would be a way to change many credentials at once, which no holder needs\n     * and no administrator may have.\n     */\n    [CoreResourceOperation.UPDATE_MANY]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n  },\n});\n"]}
+{"version":3,"file":"provider-credentials-user.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,0CAA0C,CAAC;AAC1I,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExE,MAAM,qCAAqC,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,YAAY,CAAU,CAAC;AAEhI,MAAM,uCAAuC,GAAG;IAC9C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;CAC3D,CAAC;AASF,MAAM,CAAC,MAAM,kEAAkE,GAAG,CAChF,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAI7C;IACA,UAAU,EAAE,4BAA4B;IACxC,kBAAkB,EAAE,gBAAgB,CAAC,yBAAyB;IAC9D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,yBAAyB,CAAC;IACvG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,SAAS;QACjD,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IAED;;;;;;;;;;;;OAYG;IAEH,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,mGAAmG;QACnG,6DAA6D;QAC7D,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QACvB;;;;;;;;;;;;WAYG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,sFAAsF;oBACtF,0DAA0D;oBAC1D,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,uCAAuC;oBACrD,UAAU,EAAE,qCAAqC;oBACjD,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,yFAAyF;oBACzF,sFAAsF;oBACtF,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,oFAAoF;oBACpF,eAAe;oBACf,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * User Provider Credentials — resource configuration.\n *\n * A PERSON's own credential toward a third party. See `provider-credentials.shared.schemas.ts` for\n * what the resource is, why it is separate from the organization-owned sibling, and why it is not a\n * delegated OAuth grant.\n */\n\nimport { z } from 'zod';\n\nimport {\n  ProviderCredentialValidationState,\n  UserProviderCredentialSchema,\n} from './provider-credentials.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../authorizations/roles.shared.schemas';\n\nconst USER_PROVIDER_CREDENTIALS_SORT_FIELDS = ['createdAt', 'updatedAt', 'providerRef', 'connectionRef', 'lastUsedAt'] as const;\n\nconst USER_PROVIDER_CREDENTIALS_FILTER_FIELDS = {\n  providerRef: z.string(),\n  connectionRef: z.string(),\n  secretSlug: z.string(),\n  enabled: z.boolean(),\n  validationState: z.enum(ProviderCredentialValidationState),\n};\n\ntype UserProviderCredentialsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE;\n\nexport const userProviderCredentialsResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[],\n) => createResourceConfiguration_Initialization<\n  undefined,\n  UserProviderCredentialsCoreOperations,\n  typeof UserProviderCredentialSchema\n>({\n  mainSchema: UserProviderCredentialSchema,\n  resourceIdentifier: CoreResourceType.USER_PROVIDER_CREDENTIALS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USER_PROVIDER_CREDENTIALS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  /**\n   * The same four system doors as the organization-owned sibling, for the same reasons: a provider\n   * call runs on whatever execution context the caller holds, so the resolver reads through\n   * `readAsSystem`, and writes back `lastUsedAt` / `validationState` through `updateAsSystem` because\n   * those fields are `.excludeFromUpdate()` and a holder must not be able to declare their own\n   * credential VALID.\n   *\n   * ## `create` was shut, and the sentence that shut it stopped being true\n   *\n   * It read: \"a credential exists only because a person supplied one.\" That is exactly right for a\n   * credential somebody PASTES, and false for one a vendor MINTS. An OAuth2 grant exists because a\n   * person authorized it on the vendor's own consent screen and came back through a redirect;\n   * nobody ever types it, so there is no HTTP write that could carry it. Leaving the door shut would\n   * mean the authorization exchange completes, the vendor records the grant, and this application\n   * has nowhere to put it.\n   *\n   * What keeps that narrow is the door itself rather than a second check: `createAsSystem` is\n   * reachable only from engine code — never an HTTP payload — its re-attach allowlist is DERIVED\n   * from the schema rather than caller-supplied, and the row identity the seal binds to comes from\n   * the scope map, so a caller cannot name whose credential it is writing.\n   *\n   * ## `exportSubject: FORBIDDEN` matters MORE here than on the sibling, and the difference is real\n   *\n   * The organization-owned row is unreachable on the subject-export graph anyway, because no `USERS`\n   * relationship is registered for its `setByUserId` — the export walk simply never arrives. This row\n   * IS reachable: `userId` is a registered `USERS` composition, which is what gives the resource its\n   * USER_SELF scope in the first place. So the export walk arrives here BY CONSTRUCTION, and this\n   * refusal is the only thing standing between a subject-access request and a working third-party\n   * credential in the response.\n   */\n  systemAccessPolicy: {\n    exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n    read: ResourceSystemAccessMode.ALLOWED,\n    list: ResourceSystemAccessMode.ALLOWED,\n    update: ResourceSystemAccessMode.ALLOWED,\n    create: ResourceSystemAccessMode.ALLOWED,\n  },\n\n  /*\n   * NO `retentionPolicy`, and so no `dataSubjectPolicy` (the factory pairs the two). A credential is\n   * destroyed when its owner is, never kept: a secret is not personal data to pseudonymise, and a sealed\n   * envelope kept after an erasure still opens against somebody who asked to be forgotten.\n   *\n   * This resource used to declare `retentionPolicy: RETAIN_ONLY` on the reasoning that the USERS\n   * composition cascade would remove the row anyway. That held only while an erasure followed the\n   * cascade's default. Since #1279 an erasure reads the CHILD's retention declaration on a silent edge,\n   * because an erasure keeps the (scrubbed) USERS row and the cascade never fires. So RETAIN_ONLY meant\n   * exactly what it says, and every erasure left the person's third-party tokens in place (#1569). The\n   * USERS → USER_PROVIDER_CREDENTIALS edge now AUTHORS `strategy: DELETE`, so both the cascade and the\n   * erasure destroy the rows, and re-adding a retain policy here would be refused as a contradiction.\n   */\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    // Required by the USERS cascade and by a subject erasure, both of which dispatch this DELETE — and\n    // it is also the holder's own \"remove this credential\" door.\n    CoreResourceOperation.DELETE,\n  ],\n\n  operationsConfiguration: {\n    /*\n     * `APP_USER` everywhere, and NO administrative variant anywhere — a stronger refusal than the\n     * organization-owned sibling's, which refuses only the PLATFORM operator.\n     *\n     * Here an organization administrator is refused too. The row is a key its holder authored against\n     * their own account with a vendor; consent to store it is not consent for somebody else to spend\n     * it, and the vendor would record the act as the holder's own. There is no support story that\n     * makes that reversible, and the USER_SELF primary-scope filter is what enforces it structurally\n     * rather than by a role list somebody could widen.\n     *\n     * The cost is that a personal credential cannot be repaired by anyone but its owner, which is the\n     * correct outcome: if the person is gone, the credential should be too, and the cascade sees to it.\n     */\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          // LOW because the value never leaves: `.isWriteOnlySecret()` redacts it at the client\n          // boundary, so a READ returns metadata and a placeholder.\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          filterFields: USER_PROVIDER_CREDENTIALS_FILTER_FIELDS,\n          sortFields: USER_PROVIDER_CREDENTIALS_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 100,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          // CRITICAL: the act of granting this application authority to act as the person toward a\n          // third party. That it is the person's own decision makes it consented, not low-risk.\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          // Revoking one's own credential is the safe direction and must never be harder than\n          // granting it.\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n  },\n});\n"]}