@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/security/connected-accounts/provider-credentials.shared.schemas.d.ts

@@ -24,7 +24,8 @@
  *
  * `secretValue` holds an AES-256-GCM envelope, never the plaintext an operator typed. The seal is
  * applied on the way in and opened only by the resolver — see
- * `provider-credential-envelope.backend.utils.ts` for the envelope and its key derivation. The
+ * `provider-credential-envelope.backend.utils.ts` for its key domains and binding, over the shared
+ * `bound-secret-envelope` core that does the sealing (#366). The
  * schema cannot enforce that (a string is a string), so the write path is what guarantees it and
  * the pins are what keep it guaranteed.
  */
@@ -46,17 +47,60 @@ export declare enum ProviderCredentialValidationState {
     INVALID = "invalid"
 }
 /**
- * The organization's credential for one (provider, secret slug) pair.
+ * Why a write door refused to store a credential VALUE under the slot it named — the stable,
+ * client-branchable `code` every door carries (#624).
  *
- * ## The scope identifier is TOP-LEVEL and stays that way
+ * A stored row is keyed `(owner, connectionRef, secretSlug)` on the provider's secrets-contract KEY, and
+ * every reader asks for that key. A value written under any other name is a secret nothing can ever
+ * read, and before these refusals the write reported success — which is how a regenerated provider,
+ * a free-text slug or a test script produced rows that looked connected and resolved as absent.
  *
- * `organizationId` is the only `organizationId`-named path in this schema, and nothing nested may
- * ever be named `organizationId` or `userId`. `buildContextualFilter` injects the scope FK by
- * matching that field name at EVERY schema path, so a nested key of the same name adds a phantom
- * exact-subdocument clause and the scoped read silently matches zero rows — a credential that
- * exists and cannot be resolved, which reads exactly like a credential that was never set.
- * `setByUserId` is deliberately spelled so it cannot be caught by that matcher.
+ * The member values are the wire codes the connect leg already answered with, so one vocabulary
+ * serves the connect leg, the resource's own CREATE / UPDATE doors and any client that branches.
+ */
+export declare enum ProviderCredentialSlotWriteRefusal {
+    /**
+     * The provider's current secrets contract declares no slot by that name — under either of a slot's
+     * two names. Also the answer for a provider that is not registered at all, and for ROTATING a value
+     * into an existing row whose stored name is not a contract KEY — a retired name, or a spelling no
+     * reader asks for: a fresh secret sealed there is as unreadable as the old one.
+     */
+    SECRET_SLUG_NOT_DECLARED = "SECRET_SLUG_NOT_DECLARED",
+    /**
+     * The slot exists but holds the APPLICATION's own registration (an OAuth2 client id or secret),
+     * which is authored in the deployment environment and never read from a credential row.
+     */
+    SECRET_SLUG_NOT_A_CREDENTIAL = "SECRET_SLUG_NOT_A_CREDENTIAL",
+    /**
+     * An UPDATE named a different `providerRef`, `connectionRef` or `secretSlug` for an existing row. The sealed
+     * value is bound to the connection and the slot, and `providerRef` records which ref created the row, so a row
+     * cannot move: a credential for another slot or connection is a new row, and the old one is deleted.
+     */
+    CREDENTIAL_SLOT_IMMUTABLE = "CREDENTIAL_SLOT_IMMUTABLE"
+}
+/**
+ * How one connection fact got onto a credential row (#333, #1047). The distinction is what decides who may
+ * change it: an answer changes only when the person reconnects, a vendor report whenever the vendor
+ * reports it again.
  */
+export declare enum ProviderConnectionFactProvenance {
+    /**
+     * Typed by the person connecting, for an endpoint or scope `{placeholder}` at the OAuth2 start — or, for a
+     * vendor whose credential is PASTED, for a `{placeholder}` of the REST base URL at the typed-credential store
+     * (#1097). Replaced only by reconnecting or re-entering the credential.
+     */
+    ANSWERED_AT_CONNECT = "ANSWERED_AT_CONNECT",
+    /** Reported by the vendor in its token answer, at the authorization or at a refresh. A refresh may move it. */
+    REPORTED_BY_VENDOR = "REPORTED_BY_VENDOR"
+}
+/** One value in a credential row's `connectionFacts`. */
+export declare const ProviderConnectionFactSchema: z.ZodObject<{
+    value: z.ZodString;
+    provenance: z.ZodEnum<typeof ProviderConnectionFactProvenance>;
+}, z.core.$strict>;
+export type ProviderConnectionFact = z.infer<typeof ProviderConnectionFactSchema>;
+/** A credential row's facts, keyed by fact name. */
+export type ProviderConnectionFacts = Readonly<Record<string, ProviderConnectionFact>>;
 /**
  * WHERE a resolved provider secret came from.
  *
@@ -86,7 +130,72 @@ export declare enum ProviderCredentialResolutionSource {
      */
     USER_CREDENTIAL = "user_credential"
 }
-/** Why a credential row stopped existing. */
+/**
+ * What telling the VENDOR achieved when a credential was removed (#545).
+ *
+ * A separate axis from {@link ProviderCredentialDeletionReason} on purpose: that one says why OUR
+ * COPY stopped existing, this one says whether the authorization itself was withdrawn where it
+ * lives. They were one question for as long as the answer was always "it was not".
+ *
+ * Every member is EVIDENCE, and none of them is control flow — the local delete proceeds whatever
+ * this says, because a vendor being unreachable must not stop somebody disconnecting.
+ */
+export declare enum ProviderOAuth2RevocationOutcome {
+    /**
+     * The vendor answered 200.
+     *
+     * Under RFC 7009 that also covers a token the server did not recognise, which is the intended
+     * reading: the grant is gone either way.
+     * spec-cite: RFC 7009 §2.2 — *"The authorization server responds with HTTP status code 200 if the
+     * token has been revoked successfully or if the client submitted an invalid token"*.
+     */
+    REVOKED = "revoked",
+    /**
+     * Nothing was sent, and that is the ordinary case rather than a failure.
+     *
+     * Three situations share this member because they are one fact from the person's side — the vendor
+     * was not told: the provider declares no `rfc7009RevocationUrl`; the credential was a PASTED
+     * long-lived key rather than a grant, so there is nothing to revoke; or the grant carried no token.
+     */
+    NOT_DECLARED = "not_declared",
+    /** The application's own client registration for this vendor is unset, so nothing could be sent. */
+    NOT_CONFIGURED = "not_configured",
+    /** The endpoint could not be reached, or did not answer within the deadline. */
+    UNREACHABLE = "unreachable",
+    /** The endpoint answered, and not with 200. */
+    REFUSED = "refused"
+}
+/** The wire values of {@link ProviderOAuth2RevocationOutcome}, for a Zod enum over them. */
+export declare const ProviderOAuth2RevocationOutcomeValues: typeof ProviderOAuth2RevocationOutcome;
+/**
+ * Why a credential row stopped existing.
+ *
+ * ## Every member describes OUR COPY; whether the VENDOR was told is a SECOND axis (#545)
+ *
+ * Removing a credential deletes the token Wildo holds. Until 2026-09-18 it also did nothing else,
+ * so the GRANT survived at the vendor: the person's connected-accounts screen showed the application
+ * gone while Asana or Google still listed it as authorized, and a stored refresh token remained
+ * valid until it expired on the vendor's schedule — which, for a refresh token, is frequently never.
+ *
+ * That is stated HERE because this vocabulary is what an operator points at when asked whether an
+ * erasure reached someone's third-party credentials, and silence on a compliance surface reads as
+ * "done".
+ *
+ * **It is no longer silent.** Both deletion events now carry
+ * {@link ProviderOAuth2RevocationOutcome}, so the trail answers the vendor question separately from
+ * the local one. What that outcome can SAY still depends on the vendor: RFC 7009 is the only
+ * revocation standard and the vendors do not agree with it, so `google-drive` and `asana` declare an
+ * endpoint and are told, while Slack's `auth.revoke` (a Web API method) and GitHub's
+ * `DELETE /applications/{client_id}/token` (basic auth, JSON body) are not expressible as one and
+ * record `not_declared` rather than implying they were reached.
+ *
+ * An earlier revision of this block argued the mechanism should NOT be built, because *"no
+ * admissible provider declares one today, so the field would ship inert"*. That was true when it was
+ * written and stopped being true when `google-drive` gained an admissible USER connection: Google's
+ * `https://oauth2.googleapis.com/revoke` is RFC 7009-conformant, so the mechanism has a reachable
+ * user and a proven vendor. Kept as history rather than deleted, because the reasoning was sound and
+ * the thing that changed was the world, not the argument.
+ */
 export declare enum ProviderCredentialDeletionReason {
     /** An administrator of the owning tenant removed it. */
     ADMINISTRATOR_REVOKED = "administrator_revoked",
@@ -100,44 +209,117 @@ export declare enum ProviderCredentialDeletionReason {
      * Distinct from `ORGANIZATION_PURGED` because this one is EVIDENCE: it is what an operator points
      * at when asked whether a subject-erasure request reached the person's third-party credentials.
      * Collapsing the two into a generic "cascade" would make that question unanswerable from the trail.
+     *
+     * **Who sets it:** the cascade observer, for a cascade declaring itself a `SUBJECT_ERASURE`. The record
+     * carries `deletedBy` = whoever EXECUTED the erasure (a person's id when one was carried on the erasure's
+     * context, else the `SYSTEM` sentinel), so the erased person is the record's SUBJECT and never its actor
+     * (#1088).
+     */
+    USER_ERASED = "user_erased",
+    /**
+     * The owning user ROW was deleted outright and the composition cascade destroyed the credential with it (#1016).
+     *
+     * **Who sets it:** the user-credential parent-cascade removal observer
+     * (`registerUserProviderCredentialCascadeEvidence`), for a cascade that declares its cause as an ordinary parent
+     * delete of the `users` row. Two doors reach it today: an administrator's hard `DELETE` (`deletedBy` is that
+     * administrator), and the organization-member invitation sweep reaping an orphaned pending user under an internal
+     * context (`deletedBy` is the `SYSTEM` sentinel). The record carries `deletedBy`, resolved from the deleting
+     * execution context, so it names the principal who deleted the account rather than the person whose credential
+     * it was.
+     *
+     * **Distinct from `USER_ERASED`**, and the distinction is the reason this member exists: an erasure answers a
+     * data-subject request, keeps the person's row scrubbed and is evidence that the request reached their third-party
+     * credentials. A deletion asserts no such request. Recording it as `USER_ERASED` would forge erasure evidence;
+     * recording nothing left an account deletion that destroyed OAuth grants and API keys with no row naming them.
+     *
+     * **Distinct from `ORGANIZATION_PURGED`**: that is a tenant teardown removing the ORGANIZATION's credentials. This
+     * removes one PERSON's own credentials, which no organization owns.
+     *
+     * Named for what happened to the owner, not for who did it: the cascade cannot tell an administrator's delete from
+     * any other deletion of the row, and `deletedBy` is where the actor is stated.
+     */
+    USER_DELETED = "user_deleted"
+}
+/** @wildo_source:part:start saas.models.provider-credential-identity facet:layer:shared facet:audience:app-developer */
+/**
+ * Where a stored credential LIVES: the connection it belongs to and the slot within it (#1670).
+ *
+ * The owner is not part of it because every caller already holds the owner from its own trusted scope;
+ * this is the half the provider registry answers. `ExternalProvidersRegistryBackendService.resolveCredentialAddress`
+ * is the ONE producer, so "which row does a call through ref R spend" has one answer on every read path.
+ */
+export interface ProviderCredentialAddress {
+    /**
+     * The CONNECTION the credential belongs to — the key component that used to be the provider ref.
+     * Today every ref is its own connection, so this equals the ref; #1725 lets an application declare
+     * several refs of one vendor as one connection, and then every ref of it resolves the same row.
      */
-    USER_ERASED = "user_erased"
+    readonly connectionRef: string;
+    /** The provider's secrets-contract KEY — see `canonicalCredentialSlug` (#624). */
+    readonly secretSlug: string;
 }
 /**
- * The fields that IDENTIFY a credential within its tenant.
+ * The fields that IDENTIFY a credential within its tenant: `(organizationId, connectionRef, secretSlug)`.
+ *
+ * One tenant holds at most one credential per (CONNECTION, slug) — not per provider ref (#1670). A
+ * connection is the unit a vendor grant belongs to: by default every provider ref is its own connection
+ * (`connectionRef` = `providerRef`), and a vendor served by several refs (an engine part plus add-on
+ * packages) can hold ONE grant that all of them spend. Keying on the ref made that impossible — two refs
+ * of one vendor could never share a stored credential, whatever the client side did.
+ *
+ * Exported rather than repeated so the uniqueness contract, the resolver's lookup and the tests cannot
+ * drift apart — three copies of a compound key is how two of them come to disagree about what identity
+ * means. The sealed value binds the same three components (the connection, never the ref), so a row's
+ * key and its seal always name one identity.
+ */
+export declare const ORGANIZATION_PROVIDER_CREDENTIAL_IDENTITY_FIELDS: readonly ["organizationId", "connectionRef", "secretSlug"];
+/** @wildo_source:part:end saas.models.provider-credential-identity */
+/**
+ * The organization's credential for one (connection, secret slug) pair.
  *
- * One tenant holds at most one credential per (provider, slug). Exported rather than repeated so
- * the uniqueness contract, the resolver's lookup and the tests cannot drift apart — three copies
- * of a compound key is how two of them come to disagree about what identity means.
+ * ## The scope identifier is TOP-LEVEL and stays that way
+ *
+ * `organizationId` is the only `organizationId`-named path in this schema, and nothing nested may
+ * ever be named `organizationId` or `userId`. `buildContextualFilter` injects the scope FK by
+ * matching that field name at EVERY schema path, so a nested key of the same name adds a phantom
+ * exact-subdocument clause and the scoped read silently matches zero rows — a credential that
+ * exists and cannot be resolved, which reads exactly like a credential that was never set.
+ * `setByUserId` is deliberately spelled so it cannot be caught by that matcher.
  */
-export declare const ORGANIZATION_PROVIDER_CREDENTIAL_IDENTITY_FIELDS: readonly ["organizationId", "providerRef", "secretSlug"];
 export declare const OrganizationProviderCredentialSchema: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
     providerRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    connectionRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
     secretSlug: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
     secretValue: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
     enabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>>;
-    validationState: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof ProviderCredentialValidationState>>>>;
+    validationState: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof ProviderCredentialValidationState>>>>>>;
     validationError: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>;
     lastValidatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
     lastUsedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
     setByUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
     secretSetAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
-    connectionParameters: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>>;
+    connectionFacts: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        value: z.ZodString;
+        provenance: z.ZodEnum<typeof ProviderConnectionFactProvenance>;
+    }, z.core.$strict>>>>>;
     description: z.ZodOptional<z.ZodString>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
 }, z.core.$strip>>;
 export type OrganizationProviderCredential = z.infer<typeof OrganizationProviderCredentialSchema>;
+/** @wildo_source:part:start saas.models.provider-credential-identity facet:layer:shared facet:audience:app-developer */
 /**
- * The fields that IDENTIFY a credential within its OWNER.
+ * The fields that IDENTIFY a credential within its OWNER: `(userId, connectionRef, secretSlug)` — keyed on
+ * the CONNECTION, never the provider ref, as the organization-owned sibling explains (#1670).
  *
  * Exported per owner rather than shared, because the compound key differs in its first component and
  * a single constant would have to be assembled by each side — which is how two copies of a key come
  * to disagree about what identity means.
  */
-export declare const USER_PROVIDER_CREDENTIAL_IDENTITY_FIELDS: readonly ["userId", "providerRef", "secretSlug"];
+export declare const USER_PROVIDER_CREDENTIAL_IDENTITY_FIELDS: readonly ["userId", "connectionRef", "secretSlug"];
+/** @wildo_source:part:end saas.models.provider-credential-identity */
 /**
  * A PERSON's own credential toward a third party — the key they authored for themselves.
  *
@@ -170,15 +352,19 @@ export declare const UserProviderCredentialSchema: import("@wildo-ai/zod-decorat
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
     providerRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    connectionRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
     secretSlug: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
     secretValue: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
     enabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>>;
-    validationState: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof ProviderCredentialValidationState>>>>;
+    validationState: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof ProviderCredentialValidationState>>>>>>;
     validationError: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>;
     lastValidatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
     lastUsedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
     secretSetAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
-    connectionParameters: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>>;
+    connectionFacts: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        value: z.ZodString;
+        provenance: z.ZodEnum<typeof ProviderConnectionFactProvenance>;
+    }, z.core.$strict>>>>>;
     description: z.ZodOptional<z.ZodString>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
@@ -240,7 +426,39 @@ export declare enum ProviderConnectabilityBlocker {
      * variables the provider's contract names. Distinct from the above because the vendor is perfectly
      * connectable and the gap is ours.
      */
-    APPLICATION_NOT_REGISTERED = "application-not-registered"
+    APPLICATION_NOT_REGISTERED = "application-not-registered",
+    /**
+     * An OAuth2 endpoint's HOST or ORIGIN — or the origin a SCOPE names (`{hostUrl}/.default`, #991) — is a
+     * placeholder the provider declares no allowance for, so no value can ever be admitted there (#623):
+     * the token endpoint receives the application's client secret, and a host is never taken from what
+     * somebody types. Nobody connecting can fix it; the provider needs a recorded host allowance.
+     */
+    ENDPOINT_HOST_NOT_DECLARED = "endpoint-host-not-declared",
+    /**
+     * The provider's OAuth2 endpoint definition cannot be resolved safely whatever is supplied — a
+     * malformed template, an unresolved source expression, or an allowance that cannot apply where its
+     * placeholder sits. A provider-definition defect, not a deployment or account gap.
+     */
+    ENDPOINT_DEFINITION_INVALID = "endpoint-definition-invalid",
+    /**
+     * The provider's OAuth2 origin is filled from this DEPLOYMENT's configured base URL (a self-hosted
+     * vendor such as Gitea), and that base URL is unset or unusable. An OPERATOR acts.
+     */
+    DEPLOYMENT_BASE_URL_UNUSABLE = "deployment-base-url-unusable",
+    /**
+     * An OAuth2 endpoint host is filled from a deployment environment variable dedicated to it (Workday's
+     * `WORKDAY_AUTH_HOST` / `WORKDAY_API_HOST`, #992), and that variable is unset or not a DNS name. An
+     * OPERATOR acts; the variable is named in the catalogue entry's `missingRegistration`.
+     */
+    DEPLOYMENT_CONFIGURED_HOST_UNUSABLE = "deployment-configured-host-unusable",
+    /**
+     * The vendor's credential is PASTED and its REST base URL forms its HOST or ORIGIN from a placeholder the
+     * provider declares no allowance for (`https://{subdomain}.vendor.com` with no `baseUrlHostAllowances`
+     * entry), so no answer the typed-credential store could collect is ever admitted and every call would
+     * refuse (#1097). Nobody connecting can fix it; the provider needs a recorded host allowance — the
+     * base-URL twin of `ENDPOINT_HOST_NOT_DECLARED`.
+     */
+    BASE_URL_HOST_NOT_DECLARED = "base-url-host-not-declared"
 }
 /**
  * One secret slot a provider declares, as a SCREEN needs it — never the value.
@@ -268,6 +486,7 @@ export declare const ProviderOAuth2GrantSchema: z.ZodObject<{
     expiresAt: z.ZodOptional<z.ZodISODateTime>;
     grantedScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
     accountRef: z.ZodOptional<z.ZodString>;
+    grantId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type ProviderOAuth2Grant = z.infer<typeof ProviderOAuth2GrantSchema>;
 /**

package/dist/esm/security/connected-accounts/provider-credentials.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-credentials.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/connected-accounts/provider-credentials.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;GAOG;AACH,oBAAY,iCAAiC;IAC3C,0FAA0F;IAC1F,WAAW,gBAAgB;IAC3B,gDAAgD;IAChD,KAAK,UAAU;IACf,8EAA8E;IAC9E,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;GAWG;AACH;;;;;;;;GAQG;AACH,oBAAY,kCAAkC;IAC5C,yEAAyE;IACzE,uBAAuB,4BAA4B;IACnD;;;OAGG;IACH,sBAAsB,2BAA2B;IACjD;;;;;;;;;OASG;IACH,eAAe,oBAAoB;CACpC;AAED,6CAA6C;AAC7C,oBAAY,gCAAgC;IAC1C,wDAAwD;IACxD,qBAAqB,0BAA0B;IAC/C,iGAAiG;IACjG,mBAAmB,wBAAwB;IAC3C,gEAAgE;IAChE,aAAa,kBAAkB;IAC/B;;;;;;OAMG;IACH,WAAW,gBAAgB;CAC5B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gDAAgD,0DAInD,CAAC;AAEX,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;kBAwHuB,CAAC;AAEzE,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAQlG;;;;;;GAMG;AACH,eAAO,MAAM,wCAAwC,kDAI3C,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;kBAgFuB,CAAC;AAEjE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAsBlF;;;;;;GAMG;AACH;;;;;;;;GAQG;AACH;;;;;;;;;;GAUG;AACH;;;;;;GAMG;AACH,oBAAY,kBAAkB;IAC5B,+FAA+F;IAC/F,yBAAyB,8BAA8B;IACvD;;;OAGG;IACH,eAAe,oBAAoB;CACpC;AAED,oBAAY,6BAA6B;IACvC;;;;OAIG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;OAKG;IACH,0BAA0B,+BAA+B;CAC1D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wFAAwF;IACxF,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED,oBAAY,4BAA4B;IACtC,wEAAwE;IACxE,YAAY,iBAAiB;CAC9B;AAED,eAAO,MAAM,yBAAyB;;;;;;;iBAgDpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,wBAAwB,CAAC;AAElE,0EAA0E;AAC1E,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEzE;AAED,mFAAmF;AACnF,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,mBAAmB,GAAG,MAAM,CAE/E;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAqB3F;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oCAAoC,KAAK,CAAC;AAEvD,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,mBAAmB,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAK3G"}
+{"version":3,"file":"provider-credentials.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/provider-credentials.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;GAOG;AACH,oBAAY,iCAAiC;IAC3C,0FAA0F;IAC1F,WAAW,gBAAgB;IAC3B,gDAAgD;IAChD,KAAK,UAAU;IACf,8EAA8E;IAC9E,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;GAWG;AACH,oBAAY,kCAAkC;IAC5C;;;;;OAKG;IACH,wBAAwB,6BAA6B;IACrD;;;OAGG;IACH,4BAA4B,iCAAiC;IAC7D;;;;OAIG;IACH,yBAAyB,8BAA8B;CACxD;AAED;;;;GAIG;AACH,oBAAY,gCAAgC;IAC1C;;;;OAIG;IACH,mBAAmB,wBAAwB;IAC3C,+GAA+G;IAC/G,kBAAkB,uBAAuB;CAC1C;AAED,yDAAyD;AACzD,eAAO,MAAM,4BAA4B;;;kBAGvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,oDAAoD;AACpD,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAEvF;;;;;;;;GAQG;AACH,oBAAY,kCAAkC;IAC5C,yEAAyE;IACzE,uBAAuB,4BAA4B;IACnD;;;OAGG;IACH,sBAAsB,2BAA2B;IACjD;;;;;;;;;OASG;IACH,eAAe,oBAAoB;CACpC;AAED;;;;;;;;;GASG;AACH,oBAAY,+BAA+B;IACzC;;;;;;;OAOG;IACH,OAAO,YAAY;IACnB;;;;;;OAMG;IACH,YAAY,iBAAiB;IAC7B,oGAAoG;IACpG,cAAc,mBAAmB;IACjC,gFAAgF;IAChF,WAAW,gBAAgB;IAC3B,+CAA+C;IAC/C,OAAO,YAAY;CACpB;AAED,4FAA4F;AAC5F,eAAO,MAAM,qCAAqC,wCAAkC,CAAC;AAErF;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,oBAAY,gCAAgC;IAC1C,wDAAwD;IACxD,qBAAqB,0BAA0B;IAC/C,iGAAiG;IACjG,mBAAmB,wBAAwB;IAC3C,gEAAgE;IAChE,aAAa,kBAAkB;IAC/B;;;;;;;;;;;OAWG;IACH,WAAW,gBAAgB;IAC3B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,YAAY,iBAAiB;CAC9B;AAED,wHAAwH;AACxH;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gDAAgD,4DAInD,CAAC;AACX,sEAAsE;AAEtE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;kBAqJuB,CAAC;AAEzE,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAQlG,wHAAwH;AACxH;;;;;;;GAOG;AACH,eAAO,MAAM,wCAAwC,oDAI3C,CAAC;AACX,sEAAsE;AAEtE;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;kBAkGuB,CAAC;AAEjE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAsBlF;;;;;;GAMG;AACH;;;;;;;;GAQG;AACH;;;;;;;;;;GAUG;AACH;;;;;;GAMG;AACH,oBAAY,kBAAkB;IAC5B,+FAA+F;IAC/F,yBAAyB,8BAA8B;IACvD;;;OAGG;IACH,eAAe,oBAAoB;CACpC;AAED,oBAAY,6BAA6B;IACvC;;;;OAIG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;OAKG;IACH,0BAA0B,+BAA+B;IACzD;;;;;OAKG;IACH,0BAA0B,+BAA+B;IACzD;;;;OAIG;IACH,2BAA2B,gCAAgC;IAC3D;;;OAGG;IACH,4BAA4B,iCAAiC;IAC7D;;;;OAIG;IACH,mCAAmC,wCAAwC;IAC3E;;;;;;OAMG;IACH,0BAA0B,+BAA+B;CAC1D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wFAAwF;IACxF,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED,oBAAY,4BAA4B;IACtC,wEAAwE;IACxE,YAAY,iBAAiB;CAC9B;AAED,eAAO,MAAM,yBAAyB;;;;;;;;iBA4DpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,wBAAwB,CAAC;AAElE,0EAA0E;AAC1E,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEzE;AAED,mFAAmF;AACnF,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,mBAAmB,GAAG,MAAM,CAE/E;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAqB3F;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oCAAoC,KAAK,CAAC;AAEvD,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,mBAAmB,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAK3G"}