npm - @wildo-ai/saas-models - Versions diffs - 1.1.5 → 1.1.6 - Mend

@wildo-ai/saas-models 1.1.5 → 1.1.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (888) hide show

package/dist/esm/security/connected-accounts/provider-connection-listing.shared.schemas.d.ts ADDED Viewed

@@ -0,0 +1,86 @@
+/**
+ * What `GET /connections/linked` answers — the CONNECTIONS one owner holds, one entry each (#1727).
+ *
+ * ## Why a connection and not a credential row
+ *
+ * A stored credential is keyed on `(owner, connectionRef, secretSlug)` (#1670), and a vendor served by several refs
+ * — an engine part and the add-on packages beside it, declared in `providers.sharedConnections` (#1725) — holds ONE
+ * grant keyed on its base ref. A screen that listed rows by `providerRef` therefore showed a person one Microsoft
+ * account per ref while they had authorized once, and offered a disconnect per ref for one grant. The connection is
+ * the unit a person granted, so it is the unit this lists.
+ *
+ * Shared because the backend composes it and the connected-accounts screen renders it; one declaration keeps the two
+ * from disagreeing about a field neither compiler would otherwise compare.
+ */
+import { ProviderCredentialValidationState } from './provider-credentials.shared.schemas';
+/** One credential row of a connection — what a disconnect deletes, through the credential resource's own DELETE. */
+export interface LinkedProviderConnectionCredentialView {
+    /** The row's id, addressed by the resource DELETE. */
+    readonly credentialId: string;
+    /** The slot the row holds, as its contract key (`accessToken`). */
+    readonly secretSlug: string;
+    /** The ref whose connect flow or typed door CREATED the row — not necessarily the connection's base. */
+    readonly providerRef: string;
+}
+/** One connection an owner holds. */
+export interface LinkedProviderConnectionView {
+    /** The connection's identity: its base ref, the key every row is stored and sealed under. */
+    readonly connectionRef: string;
+    /**
+     * Every ref this connection SERVES on this application — the base first, then the declared members that are
+     * loaded here. A ref declared in no shared connection serves only itself, which is why a single-ref vendor's entry
+     * reads exactly as it always did.
+     */
+    readonly servesRefs: readonly string[];
+    /**
+     * Set when these rows were stored under a ref BEFORE that ref joined a shared connection: they are keyed and sealed
+     * on the old identity, so nothing reads them any more (there is deliberately no re-seal door, #1670) and
+     * `servesRefs` is empty. Names the connection the ref now belongs to — the person connects that one and disconnects
+     * this residue.
+     */
+    readonly supersededByConnectionRef?: string;
+    /** The rows the connection is made of. More than one only for a vendor whose typed credential has several slots. */
+    readonly credentials: readonly LinkedProviderConnectionCredentialView[];
+    /**
+     * Whether an ENABLED row holds a grant the vendor minted (an authorization flow) that could be opened — as opposed
+     * to a pasted credential. `false` also for a granted connection whose row is disabled or cannot be opened: its scopes
+     * cannot be read, so nothing here may claim what it was consented to. Read `enabled` beside it.
+     */
+    readonly holdsAuthorizationGrant: boolean;
+    /**
+     * The scopes the grant's consent has ACCUMULATED (#1671) — absent for a pasted credential, and for a grant whose
+     * vendor never stated its scopes. Vendor permission identifiers, not secrets; never a token.
+     */
+    readonly grantedScopes?: readonly string[];
+    /**
+     * The connection's standing, the WORST of its rows': one row the vendor refused makes the whole connection need
+     * re-authorization, because every ref it serves spends that row.
+     */
+    readonly validationState: ProviderCredentialValidationState;
+    /** Whether every row is enabled. A disabled row resolves as absent, so one disabled row disables the connection. */
+    readonly enabled: boolean;
+    /** When the connection was last spent, across its rows. */
+    readonly lastUsedAt?: string;
+    /** When the connection was first stored. */
+    readonly connectedAt?: string;
+    /**
+     * On an organization's connection, the member who LINKED it — the person whose vendor account a lent grant is, and
+     * the only member who may grow it (#1671 `NOT_THE_LINKING_MEMBER`). Absent on a person's own connection.
+     */
+    readonly linkedByUserId?: string;
+    /** Whether disconnecting also withdraws the grant at the vendor (RFC 7009, #545), or only deletes this copy. */
+    readonly revocationTellsVendor: boolean;
+}
+/** The answer of `GET /connections/linked`. */
+export interface LinkedProviderConnectionsResponse {
+    readonly connections: readonly LinkedProviderConnectionView[];
+}
+/**
+ * The standing of a connection made of several rows: the worst of theirs.
+ *
+ * A connection is spent as ONE thing, so it is only as healthy as its least healthy row — a refused row is refused
+ * for every ref the connection serves, and reporting the best row instead would show a working connection that every
+ * call fails through. An empty set is `UNVALIDATED`: nothing has been proven about rows that do not exist.
+ */
+export declare function worstProviderCredentialValidationState(states: readonly ProviderCredentialValidationState[]): ProviderCredentialValidationState;
+//# sourceMappingURL=provider-connection-listing.shared.schemas.d.ts.map

package/dist/esm/security/connected-accounts/provider-connection-listing.shared.schemas.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"provider-connection-listing.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/provider-connection-listing.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,iCAAiC,EAAE,MAAM,uCAAuC,CAAC;AAE1F,oHAAoH;AACpH,MAAM,WAAW,sCAAsC;IACrD,sDAAsD;IACtD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,mEAAmE;IACnE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,wGAAwG;IACxG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,qCAAqC;AACrC,MAAM,WAAW,4BAA4B;IAC3C,6FAA6F;IAC7F,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAC5C,oHAAoH;IACpH,QAAQ,CAAC,WAAW,EAAE,SAAS,sCAAsC,EAAE,CAAC;IACxE;;;;OAIG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;OAGG;IACH,QAAQ,CAAC,eAAe,EAAE,iCAAiC,CAAC;IAC5D,oHAAoH;IACpH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,4CAA4C;IAC5C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,gHAAgH;IAChH,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;CACzC;AAED,+CAA+C;AAC/C,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,WAAW,EAAE,SAAS,4BAA4B,EAAE,CAAC;CAC/D;AAYD;;;;;;GAMG;AACH,wBAAgB,sCAAsC,CACpD,MAAM,EAAE,SAAS,iCAAiC,EAAE,GACnD,iCAAiC,CAMnC"}

package/dist/esm/security/connected-accounts/provider-connection-listing.shared.schemas.js ADDED Viewed

@@ -0,0 +1,40 @@
+/**
+ * What `GET /connections/linked` answers — the CONNECTIONS one owner holds, one entry each (#1727).
+ *
+ * ## Why a connection and not a credential row
+ *
+ * A stored credential is keyed on `(owner, connectionRef, secretSlug)` (#1670), and a vendor served by several refs
+ * — an engine part and the add-on packages beside it, declared in `providers.sharedConnections` (#1725) — holds ONE
+ * grant keyed on its base ref. A screen that listed rows by `providerRef` therefore showed a person one Microsoft
+ * account per ref while they had authorized once, and offered a disconnect per ref for one grant. The connection is
+ * the unit a person granted, so it is the unit this lists.
+ *
+ * Shared because the backend composes it and the connected-accounts screen renders it; one declaration keeps the two
+ * from disagreeing about a field neither compiler would otherwise compare.
+ */
+import { ProviderCredentialValidationState } from './provider-credentials.shared.schemas.js';
+/**
+ * How bad each validation state is, for {@link worstProviderCredentialValidationState}. Total over the enum, so a
+ * member added tomorrow is a compile error here rather than a state that silently ranks as healthy.
+ */
+const VALIDATION_STATE_SEVERITY = {
+    [ProviderCredentialValidationState.VALID]: 0,
+    [ProviderCredentialValidationState.UNVALIDATED]: 1,
+    [ProviderCredentialValidationState.INVALID]: 2,
+};
+/**
+ * The standing of a connection made of several rows: the worst of theirs.
+ *
+ * A connection is spent as ONE thing, so it is only as healthy as its least healthy row — a refused row is refused
+ * for every ref the connection serves, and reporting the best row instead would show a working connection that every
+ * call fails through. An empty set is `UNVALIDATED`: nothing has been proven about rows that do not exist.
+ */
+export function worstProviderCredentialValidationState(states) {
+    let worst;
+    for (const state of states) {
+        if (worst === undefined || VALIDATION_STATE_SEVERITY[state] > VALIDATION_STATE_SEVERITY[worst])
+            worst = state;
+    }
+    return worst ?? ProviderCredentialValidationState.UNVALIDATED;
+}
+//# sourceMappingURL=provider-connection-listing.shared.schemas.js.map

package/dist/esm/security/connected-accounts/provider-connection-listing.shared.schemas.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"provider-connection-listing.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/provider-connection-listing.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,iCAAiC,EAAE,MAAM,uCAAuC,CAAC;AAmE1F;;;GAGG;AACH,MAAM,yBAAyB,GAAgE;IAC7F,CAAC,iCAAiC,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5C,CAAC,iCAAiC,CAAC,WAAW,CAAC,EAAE,CAAC;IAClD,CAAC,iCAAiC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC/C,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,sCAAsC,CACpD,MAAoD;IAEpD,IAAI,KAAoD,CAAC;IACzD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,KAAK,SAAS,IAAI,yBAAyB,CAAC,KAAK,CAAC,GAAG,yBAAyB,CAAC,KAAK,CAAC;YAAE,KAAK,GAAG,KAAK,CAAC;IAChH,CAAC;IACD,OAAO,KAAK,IAAI,iCAAiC,CAAC,WAAW,CAAC;AAChE,CAAC","sourcesContent":["/**\n * What `GET /connections/linked` answers — the CONNECTIONS one owner holds, one entry each (#1727).\n *\n * ## Why a connection and not a credential row\n *\n * A stored credential is keyed on `(owner, connectionRef, secretSlug)` (#1670), and a vendor served by several refs\n * — an engine part and the add-on packages beside it, declared in `providers.sharedConnections` (#1725) — holds ONE\n * grant keyed on its base ref. A screen that listed rows by `providerRef` therefore showed a person one Microsoft\n * account per ref while they had authorized once, and offered a disconnect per ref for one grant. The connection is\n * the unit a person granted, so it is the unit this lists.\n *\n * Shared because the backend composes it and the connected-accounts screen renders it; one declaration keeps the two\n * from disagreeing about a field neither compiler would otherwise compare.\n */\n\nimport { ProviderCredentialValidationState } from './provider-credentials.shared.schemas';\n\n/** One credential row of a connection — what a disconnect deletes, through the credential resource's own DELETE. */\nexport interface LinkedProviderConnectionCredentialView {\n /** The row's id, addressed by the resource DELETE. */\n readonly credentialId: string;\n /** The slot the row holds, as its contract key (`accessToken`). */\n readonly secretSlug: string;\n /** The ref whose connect flow or typed door CREATED the row — not necessarily the connection's base. */\n readonly providerRef: string;\n}\n\n/** One connection an owner holds. */\nexport interface LinkedProviderConnectionView {\n /** The connection's identity: its base ref, the key every row is stored and sealed under. */\n readonly connectionRef: string;\n /**\n * Every ref this connection SERVES on this application — the base first, then the declared members that are\n * loaded here. A ref declared in no shared connection serves only itself, which is why a single-ref vendor's entry\n * reads exactly as it always did.\n */\n readonly servesRefs: readonly string[];\n /**\n * Set when these rows were stored under a ref BEFORE that ref joined a shared connection: they are keyed and sealed\n * on the old identity, so nothing reads them any more (there is deliberately no re-seal door, #1670) and\n * `servesRefs` is empty. Names the connection the ref now belongs to — the person connects that one and disconnects\n * this residue.\n */\n readonly supersededByConnectionRef?: string;\n /** The rows the connection is made of. More than one only for a vendor whose typed credential has several slots. */\n readonly credentials: readonly LinkedProviderConnectionCredentialView[];\n /**\n * Whether an ENABLED row holds a grant the vendor minted (an authorization flow) that could be opened — as opposed\n * to a pasted credential. `false` also for a granted connection whose row is disabled or cannot be opened: its scopes\n * cannot be read, so nothing here may claim what it was consented to. Read `enabled` beside it.\n */\n readonly holdsAuthorizationGrant: boolean;\n /**\n * The scopes the grant's consent has ACCUMULATED (#1671) — absent for a pasted credential, and for a grant whose\n * vendor never stated its scopes. Vendor permission identifiers, not secrets; never a token.\n */\n readonly grantedScopes?: readonly string[];\n /**\n * The connection's standing, the WORST of its rows': one row the vendor refused makes the whole connection need\n * re-authorization, because every ref it serves spends that row.\n */\n readonly validationState: ProviderCredentialValidationState;\n /** Whether every row is enabled. A disabled row resolves as absent, so one disabled row disables the connection. */\n readonly enabled: boolean;\n /** When the connection was last spent, across its rows. */\n readonly lastUsedAt?: string;\n /** When the connection was first stored. */\n readonly connectedAt?: string;\n /**\n * On an organization's connection, the member who LINKED it — the person whose vendor account a lent grant is, and\n * the only member who may grow it (#1671 `NOT_THE_LINKING_MEMBER`). Absent on a person's own connection.\n */\n readonly linkedByUserId?: string;\n /** Whether disconnecting also withdraws the grant at the vendor (RFC 7009, #545), or only deletes this copy. */\n readonly revocationTellsVendor: boolean;\n}\n\n/** The answer of `GET /connections/linked`. */\nexport interface LinkedProviderConnectionsResponse {\n readonly connections: readonly LinkedProviderConnectionView[];\n}\n\n/**\n * How bad each validation state is, for {@link worstProviderCredentialValidationState}. Total over the enum, so a\n * member added tomorrow is a compile error here rather than a state that silently ranks as healthy.\n */\nconst VALIDATION_STATE_SEVERITY: Readonly<Record<ProviderCredentialValidationState, number>> = {\n [ProviderCredentialValidationState.VALID]: 0,\n [ProviderCredentialValidationState.UNVALIDATED]: 1,\n [ProviderCredentialValidationState.INVALID]: 2,\n};\n\n/**\n * The standing of a connection made of several rows: the worst of theirs.\n *\n * A connection is spent as ONE thing, so it is only as healthy as its least healthy row — a refused row is refused\n * for every ref the connection serves, and reporting the best row instead would show a working connection that every\n * call fails through. An empty set is `UNVALIDATED`: nothing has been proven about rows that do not exist.\n */\nexport function worstProviderCredentialValidationState(\n states: readonly ProviderCredentialValidationState[],\n): ProviderCredentialValidationState {\n let worst: ProviderCredentialValidationState | undefined;\n for (const state of states) {\n if (worst === undefined || VALIDATION_STATE_SEVERITY[state] > VALIDATION_STATE_SEVERITY[worst]) worst = state;\n }\n return worst ?? ProviderCredentialValidationState.UNVALIDATED;\n}\n"]}

package/dist/esm/security/connected-accounts/provider-credentials-organization.shared.resources-config.schemas.d.ts CHANGED Viewed

@@ -13,10 +13,11 @@ export declare const orgProviderCredentialsResourceConfiguration_InitializationF
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
     providerRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    connectionRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
     secretSlug: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
     secretValue: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
     enabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>>;
-    validationState: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof ProviderCredentialValidationState>>>>;
+    validationState: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof ProviderCredentialValidationState>>>>>>;
     validationError: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>;
     lastValidatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
     lastUsedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;

package/dist/esm/security/connected-accounts/provider-credentials-organization.shared.resources-config.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"provider-credentials-organization.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/provider-credentials-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAEL,iCAAiC,EAClC,MAAM,uCAAuC,CAAC;AAK/C,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAA4D,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;~~AAY1I~~,KAAK,oCAAoC,GACrC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,WAAW,CAAC;AAEtC,eAAO,MAAM,iEAAiE,GAC5E,wBAAwB,oBAAoB,EAAE~~;;;;;;;;;;;;;;;;;;;;~~mBA8L9C,CAAC"}
1	+ {"version":3,"file":"provider-credentials-organization.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/provider-credentials-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAEL,iCAAiC,EAClC,MAAM,uCAAuC,CAAC;AAK/C,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAA4D,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAa1I,KAAK,oCAAoC,GACrC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,WAAW,CAAC;AAEtC,eAAO,MAAM,iEAAiE,GAC5E,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;mBA8L9C,CAAC"}

package/dist/esm/security/connected-accounts/provider-credentials-organization.shared.resources-config.schemas.js CHANGED Viewed

@@ -12,9 +12,10 @@ import { ResourceSystemAccessMode } from '../../resources/resources-config.share
 import { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions.js';
 import { ResourceOperationRiskLevel, ResourceOperationVariantType } from '../../resources/resources.shared.schemas.js';
 import { CORE_APP_ROLES, CORE_ORG_ROLES } from '../authorizations/roles.shared.schemas.js';
-const ORG_PROVIDER_CREDENTIALS_SORT_FIELDS = ['createdAt', 'updatedAt', 'providerRef', 'lastUsedAt'];
+const ORG_PROVIDER_CREDENTIALS_SORT_FIELDS = ['createdAt', 'updatedAt', 'providerRef', 'connectionRef', 'lastUsedAt'];
 const ORG_PROVIDER_CREDENTIALS_FILTER_FIELDS = {
     providerRef: z.string(),
+    connectionRef: z.string(),
     secretSlug: z.string(),
     enabled: z.boolean(),
     validationState: z.enum(ProviderCredentialValidationState),

package/dist/esm/security/connected-accounts/provider-credentials-organization.shared.resources-config.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"provider-credentials-organization.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/provider-credentials-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,oCAAoC,EACpC,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,2DAA2D,CAAC;AAC1H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,0CAA0C,CAAC;AAC1I,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExF,MAAM,oCAAoC,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,CAAU,CAAC;AAE9G,MAAM,sCAAsC,GAAG;IAC7C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;CAC3D,CAAC;AAUF,MAAM,CAAC,MAAM,iEAAiE,GAAG,CAC/E,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAI7C;IACA,UAAU,EAAE,oCAAoC;IAChD,kBAAkB,EAAE,gBAAgB,CAAC,wBAAwB;IAC7D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,wBAAwB,CAAC;IACtG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH;;;;;OAKG;IACH,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,SAAS;QACjD,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,WAAW;KACvC;IAED,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,+FAA+F;QAC/F,gGAAgG;QAChG,2EAA2E;QAC3E,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IAED,uBAAuB,EAAE;QACvB;;;;;;;;;;;;;;;;;;WAkBG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,sFAAsF;oBACtF,0DAA0D;oBAC1D,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,sCAAsC;oBACpD,UAAU,EAAE,oCAAoC;oBAChD,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,uFAAuF;oBACvF,wBAAwB;oBACxB,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED;;;;;WAKG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/*\n Organization Provider Credentials — resource configuration.\n \n The tenant-owned service credential toward a third-party provider. See\n * `provider-credentials.shared.schemas.ts` for what the resource is and what it deliberately is not.\n /\n\nimport { z } from 'zod';\n\nimport {\n OrganizationProviderCredentialSchema,\n ProviderCredentialValidationState,\n} from './provider-credentials.shared.schemas';\n\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../../compliance/privacy/impersonalization.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../authorizations/roles.shared.schemas';\n\nconst ORG_PROVIDER_CREDENTIALS_SORT_FIELDS = ['createdAt', 'updatedAt', 'providerRef', 'lastUsedAt'] as const;\n\nconst ORG_PROVIDER_CREDENTIALS_FILTER_FIELDS = {\n providerRef: z.string(),\n secretSlug: z.string(),\n enabled: z.boolean(),\n validationState: z.enum(ProviderCredentialValidationState),\n};\n\ntype OrgProviderCredentialsCoreOperations =\n \| CoreResourceOperation.READ\n \| CoreResourceOperation.LIST\n \| CoreResourceOperation.CREATE\n \| CoreResourceOperation.UPDATE\n \| CoreResourceOperation.DELETE\n \| CoreResourceOperation.UPDATE_MANY;\n\nexport const orgProviderCredentialsResourceConfiguration_InitializationFactory = (\n resourcesRelationships: ResourceRelationship[],\n) => createResourceConfiguration_Initialization<\n undefined,\n OrgProviderCredentialsCoreOperations,\n typeof OrganizationProviderCredentialSchema\n>({\n mainSchema: OrganizationProviderCredentialSchema,\n resourceIdentifier: CoreResourceType.ORG_PROVIDER_CREDENTIALS,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORG_PROVIDER_CREDENTIALS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true,\n\n /\n ## `read` / `list` — the RESOLVER's door\n \n A provider call happens on whatever execution context the caller holds: a batch, a queue\n * consumer, an anonymous webhook return leg. None of those carry an ORG_ADMIN role, and the\n * resolution must still work — so the resolver reads through `readAsSystem`, which is fail-closed\n * on this opt-in. The scope is supplied as the organization FK in the system context map, so the\n * bypass is of the ROLE check only, never of the tenant boundary.\n \n ## `update` — the resolver's WRITE-BACK door\n \n `lastUsedAt`, `validationState`, `validationError` and `lastValidatedAt` are all\n * `.excludeFromUpdate()`, so the strict re-parse on the ordinary update path strips them. The\n * trusted `updateAsSystem` path is the only one that re-attaches them, which is why it is opted\n * into here and why those fields are not client-writable: a tenant administrator must not be able\n * to declare their own credential `VALID`.\n \n ## `create` — deliberately NOT opted in\n \n A credential comes into existence only when a human supplies one. There is no seed, no\n * provisioning step and no import that should mint one on a tenant's behalf, so the system create\n * door stays shut.\n \n ## `exportSubject: FORBIDDEN`\n \n The reserved class. This row is a live credential toward a third party; a subject export that\n * carried one would hand a working secret to whoever requested the export.\n /\n /\n `create` is open for the reason its user-owned sibling documents at length: a credential a\n * vendor MINTS has no HTTP write that could carry it. An OAuth2 grant arrives through a redirect\n * after a tenant administrator authorized it on the vendor's consent screen, so the exchange —\n * engine code, never a request payload — is the only thing that can store it.\n /\n systemAccessPolicy: {\n exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n read: ResourceSystemAccessMode.ALLOWED,\n list: ResourceSystemAccessMode.ALLOWED,\n update: ResourceSystemAccessMode.ALLOWED,\n create: ResourceSystemAccessMode.ALLOWED,\n },\n\n /\n Subject erasure RETAINS this row and scrubs nothing, because there is nothing here that belongs\n * to a person.\n \n The row is a TENANT's credential. `setByUserId` names an ACTOR — the administrator who typed it\n * — which is the first population `NO_PRINCIPAL` describes, and it is exactly the field an\n * erasure must not use as a reason to destroy the row: a tenant losing its Slack integration\n * because the admin who configured it left the company is a bug, not a privacy guarantee.\n \n The erasure walk cannot reach this resource in any case, because no `USERS` relationship is\n * registered for `setByUserId` — withheld deliberately, since that edge would also put a\n * credential on the Art. 15 export graph. `RETAIN_ONLY` is therefore a statement of what WOULD\n * happen rather than a path that runs today, and it is worth declaring for that reason: the next\n * author who registers a USERS edge inherits the correct answer instead of the default.\n \n The assertion is checked in both directions by the factory — `RETAIN_ONLY` is refused if any\n * field carries an impersonalize treatment or declares a personal-data category.\n /\n retentionPolicy: {\n mode: ErasureRetentionMode.RETAIN_ONLY,\n },\n\n dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.UPDATE,\n // Required by the ORGANIZATIONS cascade: `onParentDelete` dispatches the child's DELETE, and a\n // relationship declaring the cascade against a resource with no DELETE core operation throws at\n // config build. It is also the tenant's own \"remove this credential\" door.\n CoreResourceOperation.DELETE,\n // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n CoreResourceOperation.UPDATE_MANY,\n ],\n\n operationsConfiguration: {\n /\n * ORG_ADMIN everywhere, and NO super-administrator variant anywhere — a deliberate refusal, not\n * an omission.\n \n Every sibling security resource (org API keys, org OAuth clients) carries an `admin` variant\n * so a platform operator can support a tenant. This one does not, because the thing being\n * supported is a live credential toward a THIRD PARTY: an operator who can list, rotate or spend\n * a tenant's Slack token can act as that tenant toward Slack, and no audit event afterwards\n * makes that reversible. `administrative-continuity-floors.md` asks for the reversibility test\n * before crossing a tenant boundary, and this verb fails it in both directions — reading is\n * masked but LISTing reveals which vendors a tenant integrates with, and rotating locks the\n * tenant out of its own integration.\n \n The cost is real and accepted: a tenant that loses every ORG_ADMIN cannot have its credentials\n * repaired by support. That is what `organizationMembers.grantOwnership` exists for — restore an\n * administrator to the tenant, and the tenant repairs its own credentials. The repair path runs\n * through identity, where it is audited and reversible, rather than through the credential\n * store, where it would not be.\n /\n [CoreResourceOperation.READ]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN],\n // LOW because the value never leaves: `.isWriteOnlySecret()` redacts it at the client\n // boundary, so a READ returns metadata and a placeholder.\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n\n [CoreResourceOperation.LIST]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n filterFields: ORG_PROVIDER_CREDENTIALS_FILTER_FIELDS,\n sortFields: ORG_PROVIDER_CREDENTIALS_SORT_FIELDS,\n maxPaginatedResultPerPageLimit: 100,\n },\n ],\n },\n\n [CoreResourceOperation.CREATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN],\n // CRITICAL: this is the act of granting the application authority to act as the tenant\n // toward a third party.\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n },\n ],\n },\n\n [CoreResourceOperation.UPDATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN],\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n },\n ],\n },\n\n [CoreResourceOperation.DELETE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN],\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n },\n ],\n },\n\n /\n * Route-less retention plumbing. INTERNAL_CALL registers NO route, and must not be\n * REPOSITORY_ONLY: that satisfies the factory's boot-time presence guard and then fails to\n * resolve when an erasure actually runs, because the retention primitives resolve through\n * `getServiceOperationPathDefault`, which excludes REPOSITORY_ONLY.\n */\n [CoreResourceOperation.UPDATE_MANY]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n },\n ],\n },\n },\n});\n"]}
1	+ {"version":3,"file":"provider-credentials-organization.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/provider-credentials-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,oCAAoC,EACpC,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,2DAA2D,CAAC;AAC1H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,0CAA0C,CAAC;AAC1I,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExF,MAAM,oCAAoC,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,YAAY,CAAU,CAAC;AAE/H,MAAM,sCAAsC,GAAG;IAC7C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;CAC3D,CAAC;AAUF,MAAM,CAAC,MAAM,iEAAiE,GAAG,CAC/E,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAI7C;IACA,UAAU,EAAE,oCAAoC;IAChD,kBAAkB,EAAE,gBAAgB,CAAC,wBAAwB;IAC7D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,wBAAwB,CAAC;IACtG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH;;;;;OAKG;IACH,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,SAAS;QACjD,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,WAAW;KACvC;IAED,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,+FAA+F;QAC/F,gGAAgG;QAChG,2EAA2E;QAC3E,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IAED,uBAAuB,EAAE;QACvB;;;;;;;;;;;;;;;;;;WAkBG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,sFAAsF;oBACtF,0DAA0D;oBAC1D,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,sCAAsC;oBACpD,UAAU,EAAE,oCAAoC;oBAChD,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,uFAAuF;oBACvF,wBAAwB;oBACxB,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED;;;;;WAKG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/*\n Organization Provider Credentials — resource configuration.\n \n The tenant-owned service credential toward a third-party provider. See\n * `provider-credentials.shared.schemas.ts` for what the resource is and what it deliberately is not.\n /\n\nimport { z } from 'zod';\n\nimport {\n OrganizationProviderCredentialSchema,\n ProviderCredentialValidationState,\n} from './provider-credentials.shared.schemas';\n\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../../compliance/privacy/impersonalization.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../authorizations/roles.shared.schemas';\n\nconst ORG_PROVIDER_CREDENTIALS_SORT_FIELDS = ['createdAt', 'updatedAt', 'providerRef', 'connectionRef', 'lastUsedAt'] as const;\n\nconst ORG_PROVIDER_CREDENTIALS_FILTER_FIELDS = {\n providerRef: z.string(),\n connectionRef: z.string(),\n secretSlug: z.string(),\n enabled: z.boolean(),\n validationState: z.enum(ProviderCredentialValidationState),\n};\n\ntype OrgProviderCredentialsCoreOperations =\n \| CoreResourceOperation.READ\n \| CoreResourceOperation.LIST\n \| CoreResourceOperation.CREATE\n \| CoreResourceOperation.UPDATE\n \| CoreResourceOperation.DELETE\n \| CoreResourceOperation.UPDATE_MANY;\n\nexport const orgProviderCredentialsResourceConfiguration_InitializationFactory = (\n resourcesRelationships: ResourceRelationship[],\n) => createResourceConfiguration_Initialization<\n undefined,\n OrgProviderCredentialsCoreOperations,\n typeof OrganizationProviderCredentialSchema\n>({\n mainSchema: OrganizationProviderCredentialSchema,\n resourceIdentifier: CoreResourceType.ORG_PROVIDER_CREDENTIALS,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORG_PROVIDER_CREDENTIALS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true,\n\n /\n ## `read` / `list` — the RESOLVER's door\n \n A provider call happens on whatever execution context the caller holds: a batch, a queue\n * consumer, an anonymous webhook return leg. None of those carry an ORG_ADMIN role, and the\n * resolution must still work — so the resolver reads through `readAsSystem`, which is fail-closed\n * on this opt-in. The scope is supplied as the organization FK in the system context map, so the\n * bypass is of the ROLE check only, never of the tenant boundary.\n \n ## `update` — the resolver's WRITE-BACK door\n \n `lastUsedAt`, `validationState`, `validationError` and `lastValidatedAt` are all\n * `.excludeFromUpdate()`, so the strict re-parse on the ordinary update path strips them. The\n * trusted `updateAsSystem` path is the only one that re-attaches them, which is why it is opted\n * into here and why those fields are not client-writable: a tenant administrator must not be able\n * to declare their own credential `VALID`.\n \n ## `create` — deliberately NOT opted in\n \n A credential comes into existence only when a human supplies one. There is no seed, no\n * provisioning step and no import that should mint one on a tenant's behalf, so the system create\n * door stays shut.\n \n ## `exportSubject: FORBIDDEN`\n \n The reserved class. This row is a live credential toward a third party; a subject export that\n * carried one would hand a working secret to whoever requested the export.\n /\n /\n `create` is open for the reason its user-owned sibling documents at length: a credential a\n * vendor MINTS has no HTTP write that could carry it. An OAuth2 grant arrives through a redirect\n * after a tenant administrator authorized it on the vendor's consent screen, so the exchange —\n * engine code, never a request payload — is the only thing that can store it.\n /\n systemAccessPolicy: {\n exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n read: ResourceSystemAccessMode.ALLOWED,\n list: ResourceSystemAccessMode.ALLOWED,\n update: ResourceSystemAccessMode.ALLOWED,\n create: ResourceSystemAccessMode.ALLOWED,\n },\n\n /\n Subject erasure RETAINS this row and scrubs nothing, because there is nothing here that belongs\n * to a person.\n \n The row is a TENANT's credential. `setByUserId` names an ACTOR — the administrator who typed it\n * — which is the first population `NO_PRINCIPAL` describes, and it is exactly the field an\n * erasure must not use as a reason to destroy the row: a tenant losing its Slack integration\n * because the admin who configured it left the company is a bug, not a privacy guarantee.\n \n The erasure walk cannot reach this resource in any case, because no `USERS` relationship is\n * registered for `setByUserId` — withheld deliberately, since that edge would also put a\n * credential on the Art. 15 export graph. `RETAIN_ONLY` is therefore a statement of what WOULD\n * happen rather than a path that runs today, and it is worth declaring for that reason: the next\n * author who registers a USERS edge inherits the correct answer instead of the default.\n \n The assertion is checked in both directions by the factory — `RETAIN_ONLY` is refused if any\n * field carries an impersonalize treatment or declares a personal-data category.\n /\n retentionPolicy: {\n mode: ErasureRetentionMode.RETAIN_ONLY,\n },\n\n dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.UPDATE,\n // Required by the ORGANIZATIONS cascade: `onParentDelete` dispatches the child's DELETE, and a\n // relationship declaring the cascade against a resource with no DELETE core operation throws at\n // config build. It is also the tenant's own \"remove this credential\" door.\n CoreResourceOperation.DELETE,\n // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n CoreResourceOperation.UPDATE_MANY,\n ],\n\n operationsConfiguration: {\n /\n * ORG_ADMIN everywhere, and NO super-administrator variant anywhere — a deliberate refusal, not\n * an omission.\n \n Every sibling security resource (org API keys, org OAuth clients) carries an `admin` variant\n * so a platform operator can support a tenant. This one does not, because the thing being\n * supported is a live credential toward a THIRD PARTY: an operator who can list, rotate or spend\n * a tenant's Slack token can act as that tenant toward Slack, and no audit event afterwards\n * makes that reversible. `administrative-continuity-floors.md` asks for the reversibility test\n * before crossing a tenant boundary, and this verb fails it in both directions — reading is\n * masked but LISTing reveals which vendors a tenant integrates with, and rotating locks the\n * tenant out of its own integration.\n \n The cost is real and accepted: a tenant that loses every ORG_ADMIN cannot have its credentials\n * repaired by support. That is what `organizationMembers.grantOwnership` exists for — restore an\n * administrator to the tenant, and the tenant repairs its own credentials. The repair path runs\n * through identity, where it is audited and reversible, rather than through the credential\n * store, where it would not be.\n /\n [CoreResourceOperation.READ]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN],\n // LOW because the value never leaves: `.isWriteOnlySecret()` redacts it at the client\n // boundary, so a READ returns metadata and a placeholder.\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n\n [CoreResourceOperation.LIST]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n filterFields: ORG_PROVIDER_CREDENTIALS_FILTER_FIELDS,\n sortFields: ORG_PROVIDER_CREDENTIALS_SORT_FIELDS,\n maxPaginatedResultPerPageLimit: 100,\n },\n ],\n },\n\n [CoreResourceOperation.CREATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN],\n // CRITICAL: this is the act of granting the application authority to act as the tenant\n // toward a third party.\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n },\n ],\n },\n\n [CoreResourceOperation.UPDATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN],\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n },\n ],\n },\n\n [CoreResourceOperation.DELETE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN],\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n },\n ],\n },\n\n /\n * Route-less retention plumbing. INTERNAL_CALL registers NO route, and must not be\n * REPOSITORY_ONLY: that satisfies the factory's boot-time presence guard and then fails to\n * resolve when an erasure actually runs, because the retention primitives resolve through\n * `getServiceOperationPathDefault`, which excludes REPOSITORY_ONLY.\n */\n [CoreResourceOperation.UPDATE_MANY]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n },\n ],\n },\n },\n});\n"]}

package/dist/esm/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.d.ts CHANGED Viewed

@@ -14,10 +14,11 @@ export declare const userProviderCredentialsResourceConfiguration_Initialization
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
     providerRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    connectionRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
     secretSlug: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
     secretValue: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
     enabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>>;
-    validationState: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof ProviderCredentialValidationState>>>>;
+    validationState: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof ProviderCredentialValidationState>>>>>>;
     validationError: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>;
     lastValidatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
     lastUsedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;

package/dist/esm/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"provider-credentials-user.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,iCAAiC,EAElC,MAAM,uCAAuC,CAAC;AAI/C,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAA4D,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;~~AAY1I~~,KAAK,qCAAqC,GACtC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAEjC,eAAO,MAAM,kEAAkE,GAC7E,wBAAwB,oBAAoB,EAAE~~;;;;;;;;;;;;;;;;;;;~~mBAwJ9C,CAAC"}
1	+ {"version":3,"file":"provider-credentials-user.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,iCAAiC,EAElC,MAAM,uCAAuC,CAAC;AAI/C,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAA4D,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAa1I,KAAK,qCAAqC,GACtC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAEjC,eAAO,MAAM,kEAAkE,GAC7E,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;mBAwJ9C,CAAC"}

package/dist/esm/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.js CHANGED Viewed

@@ -12,9 +12,10 @@ import { ResourceSystemAccessMode } from '../../resources/resources-config.share
 import { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions.js';
 import { ResourceOperationRiskLevel, ResourceOperationVariantType } from '../../resources/resources.shared.schemas.js';
 import { CORE_APP_ROLES } from '../authorizations/roles.shared.schemas.js';
-const USER_PROVIDER_CREDENTIALS_SORT_FIELDS = ['createdAt', 'updatedAt', 'providerRef', 'lastUsedAt'];
+const USER_PROVIDER_CREDENTIALS_SORT_FIELDS = ['createdAt', 'updatedAt', 'providerRef', 'connectionRef', 'lastUsedAt'];
 const USER_PROVIDER_CREDENTIALS_FILTER_FIELDS = {
     providerRef: z.string(),
+    connectionRef: z.string(),
     secretSlug: z.string(),
     enabled: z.boolean(),
     validationState: z.enum(ProviderCredentialValidationState),

package/dist/esm/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"provider-credentials-user.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,0CAA0C,CAAC;AAC1I,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExE,MAAM,qCAAqC,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,CAAU,CAAC;AAE/G,MAAM,uCAAuC,GAAG;IAC9C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;CAC3D,CAAC;AASF,MAAM,CAAC,MAAM,kEAAkE,GAAG,CAChF,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAI7C;IACA,UAAU,EAAE,4BAA4B;IACxC,kBAAkB,EAAE,gBAAgB,CAAC,yBAAyB;IAC9D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,yBAAyB,CAAC;IACvG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,SAAS;QACjD,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IAED;;;;;;;;;;;;OAYG;IAEH,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,mGAAmG;QACnG,6DAA6D;QAC7D,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QACvB;;;;;;;;;;;;WAYG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,sFAAsF;oBACtF,0DAA0D;oBAC1D,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,uCAAuC;oBACrD,UAAU,EAAE,qCAAqC;oBACjD,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,yFAAyF;oBACzF,sFAAsF;oBACtF,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,oFAAoF;oBACpF,eAAe;oBACf,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/*\n User Provider Credentials — resource configuration.\n \n A PERSON's own credential toward a third party. See `provider-credentials.shared.schemas.ts` for\n * what the resource is, why it is separate from the organization-owned sibling, and why it is not a\n * delegated OAuth grant.\n /\n\nimport { z } from 'zod';\n\nimport {\n ProviderCredentialValidationState,\n UserProviderCredentialSchema,\n} from './provider-credentials.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../authorizations/roles.shared.schemas';\n\nconst USER_PROVIDER_CREDENTIALS_SORT_FIELDS = ['createdAt', 'updatedAt', 'providerRef', 'lastUsedAt'] as const;\n\nconst USER_PROVIDER_CREDENTIALS_FILTER_FIELDS = {\n providerRef: z.string(),\n secretSlug: z.string(),\n enabled: z.boolean(),\n validationState: z.enum(ProviderCredentialValidationState),\n};\n\ntype UserProviderCredentialsCoreOperations =\n \| CoreResourceOperation.READ\n \| CoreResourceOperation.LIST\n \| CoreResourceOperation.CREATE\n \| CoreResourceOperation.UPDATE\n \| CoreResourceOperation.DELETE;\n\nexport const userProviderCredentialsResourceConfiguration_InitializationFactory = (\n resourcesRelationships: ResourceRelationship[],\n) => createResourceConfiguration_Initialization<\n undefined,\n UserProviderCredentialsCoreOperations,\n typeof UserProviderCredentialSchema\n>({\n mainSchema: UserProviderCredentialSchema,\n resourceIdentifier: CoreResourceType.USER_PROVIDER_CREDENTIALS,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USER_PROVIDER_CREDENTIALS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true,\n\n /\n The same four system doors as the organization-owned sibling, for the same reasons: a provider\n * call runs on whatever execution context the caller holds, so the resolver reads through\n * `readAsSystem`, and writes back `lastUsedAt` / `validationState` through `updateAsSystem` because\n * those fields are `.excludeFromUpdate()` and a holder must not be able to declare their own\n * credential VALID.\n \n ## `create` was shut, and the sentence that shut it stopped being true\n \n It read: \"a credential exists only because a person supplied one.\" That is exactly right for a\n * credential somebody PASTES, and false for one a vendor MINTS. An OAuth2 grant exists because a\n * person authorized it on the vendor's own consent screen and came back through a redirect;\n * nobody ever types it, so there is no HTTP write that could carry it. Leaving the door shut would\n * mean the authorization exchange completes, the vendor records the grant, and this application\n * has nowhere to put it.\n \n What keeps that narrow is the door itself rather than a second check: `createAsSystem` is\n * reachable only from engine code — never an HTTP payload — its re-attach allowlist is DERIVED\n * from the schema rather than caller-supplied, and the row identity the seal binds to comes from\n * the scope map, so a caller cannot name whose credential it is writing.\n \n ## `exportSubject: FORBIDDEN` matters MORE here than on the sibling, and the difference is real\n \n The organization-owned row is unreachable on the subject-export graph anyway, because no `USERS`\n * relationship is registered for its `setByUserId` — the export walk simply never arrives. This row\n * IS reachable: `userId` is a registered `USERS` composition, which is what gives the resource its\n * USER_SELF scope in the first place. So the export walk arrives here BY CONSTRUCTION, and this\n * refusal is the only thing standing between a subject-access request and a working third-party\n * credential in the response.\n /\n systemAccessPolicy: {\n exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n read: ResourceSystemAccessMode.ALLOWED,\n list: ResourceSystemAccessMode.ALLOWED,\n update: ResourceSystemAccessMode.ALLOWED,\n create: ResourceSystemAccessMode.ALLOWED,\n },\n\n /\n * NO `retentionPolicy`, and so no `dataSubjectPolicy` (the factory pairs the two). A credential is\n * destroyed when its owner is, never kept: a secret is not personal data to pseudonymise, and a sealed\n * envelope kept after an erasure still opens against somebody who asked to be forgotten.\n \n This resource used to declare `retentionPolicy: RETAIN_ONLY` on the reasoning that the USERS\n * composition cascade would remove the row anyway. That held only while an erasure followed the\n * cascade's default. Since #1279 an erasure reads the CHILD's retention declaration on a silent edge,\n * because an erasure keeps the (scrubbed) USERS row and the cascade never fires. So RETAIN_ONLY meant\n * exactly what it says, and every erasure left the person's third-party tokens in place (#1569). The\n * USERS → USER_PROVIDER_CREDENTIALS edge now AUTHORS `strategy: DELETE`, so both the cascade and the\n * erasure destroy the rows, and re-adding a retain policy here would be refused as a contradiction.\n /\n\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.UPDATE,\n // Required by the USERS cascade and by a subject erasure, both of which dispatch this DELETE — and\n // it is also the holder's own \"remove this credential\" door.\n CoreResourceOperation.DELETE,\n ],\n\n operationsConfiguration: {\n /\n * `APP_USER` everywhere, and NO administrative variant anywhere — a stronger refusal than the\n * organization-owned sibling's, which refuses only the PLATFORM operator.\n \n Here an organization administrator is refused too. The row is a key its holder authored against\n * their own account with a vendor; consent to store it is not consent for somebody else to spend\n * it, and the vendor would record the act as the holder's own. There is no support story that\n * makes that reversible, and the USER_SELF primary-scope filter is what enforces it structurally\n * rather than by a role list somebody could widen.\n \n The cost is that a personal credential cannot be repaired by anyone but its owner, which is the\n * correct outcome: if the person is gone, the credential should be too, and the cascade sees to it.\n */\n [CoreResourceOperation.READ]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_USER],\n // LOW because the value never leaves: `.isWriteOnlySecret()` redacts it at the client\n // boundary, so a READ returns metadata and a placeholder.\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n\n [CoreResourceOperation.LIST]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_USER],\n riskLevel: ResourceOperationRiskLevel.LOW,\n filterFields: USER_PROVIDER_CREDENTIALS_FILTER_FIELDS,\n sortFields: USER_PROVIDER_CREDENTIALS_SORT_FIELDS,\n maxPaginatedResultPerPageLimit: 100,\n },\n ],\n },\n\n [CoreResourceOperation.CREATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_USER],\n // CRITICAL: the act of granting this application authority to act as the person toward a\n // third party. That it is the person's own decision makes it consented, not low-risk.\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n },\n ],\n },\n\n [CoreResourceOperation.UPDATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_USER],\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n },\n ],\n },\n\n [CoreResourceOperation.DELETE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_USER],\n // Revoking one's own credential is the safe direction and must never be harder than\n // granting it.\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n },\n});\n"]}
1	+ {"version":3,"file":"provider-credentials-user.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,0CAA0C,CAAC;AAC1I,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExE,MAAM,qCAAqC,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,YAAY,CAAU,CAAC;AAEhI,MAAM,uCAAuC,GAAG;IAC9C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;CAC3D,CAAC;AASF,MAAM,CAAC,MAAM,kEAAkE,GAAG,CAChF,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAI7C;IACA,UAAU,EAAE,4BAA4B;IACxC,kBAAkB,EAAE,gBAAgB,CAAC,yBAAyB;IAC9D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,yBAAyB,CAAC;IACvG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,SAAS;QACjD,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IAED;;;;;;;;;;;;OAYG;IAEH,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,mGAAmG;QACnG,6DAA6D;QAC7D,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QACvB;;;;;;;;;;;;WAYG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,sFAAsF;oBACtF,0DAA0D;oBAC1D,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,uCAAuC;oBACrD,UAAU,EAAE,qCAAqC;oBACjD,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,yFAAyF;oBACzF,sFAAsF;oBACtF,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,oFAAoF;oBACpF,eAAe;oBACf,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/*\n User Provider Credentials — resource configuration.\n \n A PERSON's own credential toward a third party. See `provider-credentials.shared.schemas.ts` for\n * what the resource is, why it is separate from the organization-owned sibling, and why it is not a\n * delegated OAuth grant.\n /\n\nimport { z } from 'zod';\n\nimport {\n ProviderCredentialValidationState,\n UserProviderCredentialSchema,\n} from './provider-credentials.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../authorizations/roles.shared.schemas';\n\nconst USER_PROVIDER_CREDENTIALS_SORT_FIELDS = ['createdAt', 'updatedAt', 'providerRef', 'connectionRef', 'lastUsedAt'] as const;\n\nconst USER_PROVIDER_CREDENTIALS_FILTER_FIELDS = {\n providerRef: z.string(),\n connectionRef: z.string(),\n secretSlug: z.string(),\n enabled: z.boolean(),\n validationState: z.enum(ProviderCredentialValidationState),\n};\n\ntype UserProviderCredentialsCoreOperations =\n \| CoreResourceOperation.READ\n \| CoreResourceOperation.LIST\n \| CoreResourceOperation.CREATE\n \| CoreResourceOperation.UPDATE\n \| CoreResourceOperation.DELETE;\n\nexport const userProviderCredentialsResourceConfiguration_InitializationFactory = (\n resourcesRelationships: ResourceRelationship[],\n) => createResourceConfiguration_Initialization<\n undefined,\n UserProviderCredentialsCoreOperations,\n typeof UserProviderCredentialSchema\n>({\n mainSchema: UserProviderCredentialSchema,\n resourceIdentifier: CoreResourceType.USER_PROVIDER_CREDENTIALS,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USER_PROVIDER_CREDENTIALS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true,\n\n /\n The same four system doors as the organization-owned sibling, for the same reasons: a provider\n * call runs on whatever execution context the caller holds, so the resolver reads through\n * `readAsSystem`, and writes back `lastUsedAt` / `validationState` through `updateAsSystem` because\n * those fields are `.excludeFromUpdate()` and a holder must not be able to declare their own\n * credential VALID.\n \n ## `create` was shut, and the sentence that shut it stopped being true\n \n It read: \"a credential exists only because a person supplied one.\" That is exactly right for a\n * credential somebody PASTES, and false for one a vendor MINTS. An OAuth2 grant exists because a\n * person authorized it on the vendor's own consent screen and came back through a redirect;\n * nobody ever types it, so there is no HTTP write that could carry it. Leaving the door shut would\n * mean the authorization exchange completes, the vendor records the grant, and this application\n * has nowhere to put it.\n \n What keeps that narrow is the door itself rather than a second check: `createAsSystem` is\n * reachable only from engine code — never an HTTP payload — its re-attach allowlist is DERIVED\n * from the schema rather than caller-supplied, and the row identity the seal binds to comes from\n * the scope map, so a caller cannot name whose credential it is writing.\n \n ## `exportSubject: FORBIDDEN` matters MORE here than on the sibling, and the difference is real\n \n The organization-owned row is unreachable on the subject-export graph anyway, because no `USERS`\n * relationship is registered for its `setByUserId` — the export walk simply never arrives. This row\n * IS reachable: `userId` is a registered `USERS` composition, which is what gives the resource its\n * USER_SELF scope in the first place. So the export walk arrives here BY CONSTRUCTION, and this\n * refusal is the only thing standing between a subject-access request and a working third-party\n * credential in the response.\n /\n systemAccessPolicy: {\n exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n read: ResourceSystemAccessMode.ALLOWED,\n list: ResourceSystemAccessMode.ALLOWED,\n update: ResourceSystemAccessMode.ALLOWED,\n create: ResourceSystemAccessMode.ALLOWED,\n },\n\n /\n * NO `retentionPolicy`, and so no `dataSubjectPolicy` (the factory pairs the two). A credential is\n * destroyed when its owner is, never kept: a secret is not personal data to pseudonymise, and a sealed\n * envelope kept after an erasure still opens against somebody who asked to be forgotten.\n \n This resource used to declare `retentionPolicy: RETAIN_ONLY` on the reasoning that the USERS\n * composition cascade would remove the row anyway. That held only while an erasure followed the\n * cascade's default. Since #1279 an erasure reads the CHILD's retention declaration on a silent edge,\n * because an erasure keeps the (scrubbed) USERS row and the cascade never fires. So RETAIN_ONLY meant\n * exactly what it says, and every erasure left the person's third-party tokens in place (#1569). The\n * USERS → USER_PROVIDER_CREDENTIALS edge now AUTHORS `strategy: DELETE`, so both the cascade and the\n * erasure destroy the rows, and re-adding a retain policy here would be refused as a contradiction.\n /\n\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.UPDATE,\n // Required by the USERS cascade and by a subject erasure, both of which dispatch this DELETE — and\n // it is also the holder's own \"remove this credential\" door.\n CoreResourceOperation.DELETE,\n ],\n\n operationsConfiguration: {\n /\n * `APP_USER` everywhere, and NO administrative variant anywhere — a stronger refusal than the\n * organization-owned sibling's, which refuses only the PLATFORM operator.\n \n Here an organization administrator is refused too. The row is a key its holder authored against\n * their own account with a vendor; consent to store it is not consent for somebody else to spend\n * it, and the vendor would record the act as the holder's own. There is no support story that\n * makes that reversible, and the USER_SELF primary-scope filter is what enforces it structurally\n * rather than by a role list somebody could widen.\n \n The cost is that a personal credential cannot be repaired by anyone but its owner, which is the\n * correct outcome: if the person is gone, the credential should be too, and the cascade sees to it.\n */\n [CoreResourceOperation.READ]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_USER],\n // LOW because the value never leaves: `.isWriteOnlySecret()` redacts it at the client\n // boundary, so a READ returns metadata and a placeholder.\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n\n [CoreResourceOperation.LIST]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_USER],\n riskLevel: ResourceOperationRiskLevel.LOW,\n filterFields: USER_PROVIDER_CREDENTIALS_FILTER_FIELDS,\n sortFields: USER_PROVIDER_CREDENTIALS_SORT_FIELDS,\n maxPaginatedResultPerPageLimit: 100,\n },\n ],\n },\n\n [CoreResourceOperation.CREATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_USER],\n // CRITICAL: the act of granting this application authority to act as the person toward a\n // third party. That it is the person's own decision makes it consented, not low-risk.\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n },\n ],\n },\n\n [CoreResourceOperation.UPDATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_USER],\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n },\n ],\n },\n\n [CoreResourceOperation.DELETE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_USER],\n // Revoking one's own credential is the safe direction and must never be harder than\n // granting it.\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n },\n});\n"]}

package/dist/esm/security/connected-accounts/provider-credentials.shared.schemas.d.ts CHANGED Viewed

@@ -50,7 +50,7 @@ export declare enum ProviderCredentialValidationState {
  * Why a write door refused to store a credential VALUE under the slot it named — the stable,
  * client-branchable `code` every door carries (#624).
  *
- * A stored row is keyed `(owner, providerRef, secretSlug)` on the provider's secrets-contract KEY, and
+ * A stored row is keyed `(owner, connectionRef, secretSlug)` on the provider's secrets-contract KEY, and
  * every reader asks for that key. A value written under any other name is a secret nothing can ever
  * read, and before these refusals the write reported success — which is how a regenerated provider,
  * a free-text slug or a test script produced rows that looked connected and resolved as absent.
@@ -72,9 +72,9 @@ export declare enum ProviderCredentialSlotWriteRefusal {
      */
     SECRET_SLUG_NOT_A_CREDENTIAL = "SECRET_SLUG_NOT_A_CREDENTIAL",
     /**
-     * An UPDATE named a different `providerRef` or `secretSlug` for an existing row. The sealed value is
-     * bound to both, so a row cannot move: a credential for another slot is a new row, and the old one is
-     * deleted.
+     * An UPDATE named a different `providerRef`, `connectionRef` or `secretSlug` for an existing row. The sealed
+     * value is bound to the connection and the slot, and `providerRef` records which ref created the row, so a row
+     * cannot move: a credential for another slot or connection is a new row, and the old one is deleted.
      */
     CREDENTIAL_SLOT_IMMUTABLE = "CREDENTIAL_SLOT_IMMUTABLE"
 }
@@ -240,16 +240,42 @@ export declare enum ProviderCredentialDeletionReason {
      */
     USER_DELETED = "user_deleted"
 }
+/** @wildo_source:part:start saas.models.provider-credential-identity facet:layer:shared facet:audience:app-developer */
 /**
- * The fields that IDENTIFY a credential within its tenant.
+ * Where a stored credential LIVES: the connection it belongs to and the slot within it (#1670).
  *
- * One tenant holds at most one credential per (provider, slug). Exported rather than repeated so
- * the uniqueness contract, the resolver's lookup and the tests cannot drift apart — three copies
- * of a compound key is how two of them come to disagree about what identity means.
+ * The owner is not part of it because every caller already holds the owner from its own trusted scope;
+ * this is the half the provider registry answers. `ExternalProvidersRegistryBackendService.resolveCredentialAddress`
+ * is the ONE producer, so "which row does a call through ref R spend" has one answer on every read path.
  */
-export declare const ORGANIZATION_PROVIDER_CREDENTIAL_IDENTITY_FIELDS: readonly ["organizationId", "providerRef", "secretSlug"];
+export interface ProviderCredentialAddress {
+    /**
+     * The CONNECTION the credential belongs to — the key component that used to be the provider ref.
+     * Today every ref is its own connection, so this equals the ref; #1725 lets an application declare
+     * several refs of one vendor as one connection, and then every ref of it resolves the same row.
+     */
+    readonly connectionRef: string;
+    /** The provider's secrets-contract KEY — see `canonicalCredentialSlug` (#624). */
+    readonly secretSlug: string;
+}
+/**
+ * The fields that IDENTIFY a credential within its tenant: `(organizationId, connectionRef, secretSlug)`.
+ *
+ * One tenant holds at most one credential per (CONNECTION, slug) — not per provider ref (#1670). A
+ * connection is the unit a vendor grant belongs to: by default every provider ref is its own connection
+ * (`connectionRef` = `providerRef`), and a vendor served by several refs (an engine part plus add-on
+ * packages) can hold ONE grant that all of them spend. Keying on the ref made that impossible — two refs
+ * of one vendor could never share a stored credential, whatever the client side did.
+ *
+ * Exported rather than repeated so the uniqueness contract, the resolver's lookup and the tests cannot
+ * drift apart — three copies of a compound key is how two of them come to disagree about what identity
+ * means. The sealed value binds the same three components (the connection, never the ref), so a row's
+ * key and its seal always name one identity.
+ */
+export declare const ORGANIZATION_PROVIDER_CREDENTIAL_IDENTITY_FIELDS: readonly ["organizationId", "connectionRef", "secretSlug"];
+/** @wildo_source:part:end saas.models.provider-credential-identity */
 /**
- * The organization's credential for one (provider, secret slug) pair.
+ * The organization's credential for one (connection, secret slug) pair.
  *
  * ## The scope identifier is TOP-LEVEL and stays that way
  *
@@ -264,10 +290,11 @@ export declare const OrganizationProviderCredentialSchema: import("@wildo-ai/zod
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
     providerRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    connectionRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
     secretSlug: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
     secretValue: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
     enabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>>;
-    validationState: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof ProviderCredentialValidationState>>>>;
+    validationState: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof ProviderCredentialValidationState>>>>>>;
     validationError: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>;
     lastValidatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
     lastUsedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
@@ -282,14 +309,17 @@ export declare const OrganizationProviderCredentialSchema: import("@wildo-ai/zod
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
 }, z.core.$strip>>;
 export type OrganizationProviderCredential = z.infer<typeof OrganizationProviderCredentialSchema>;
+/** @wildo_source:part:start saas.models.provider-credential-identity facet:layer:shared facet:audience:app-developer */
 /**
- * The fields that IDENTIFY a credential within its OWNER.
+ * The fields that IDENTIFY a credential within its OWNER: `(userId, connectionRef, secretSlug)` — keyed on
+ * the CONNECTION, never the provider ref, as the organization-owned sibling explains (#1670).
  *
  * Exported per owner rather than shared, because the compound key differs in its first component and
  * a single constant would have to be assembled by each side — which is how two copies of a key come
  * to disagree about what identity means.
  */
-export declare const USER_PROVIDER_CREDENTIAL_IDENTITY_FIELDS: readonly ["userId", "providerRef", "secretSlug"];
+export declare const USER_PROVIDER_CREDENTIAL_IDENTITY_FIELDS: readonly ["userId", "connectionRef", "secretSlug"];
+/** @wildo_source:part:end saas.models.provider-credential-identity */
 /**
  * A PERSON's own credential toward a third party — the key they authored for themselves.
  *
@@ -322,10 +352,11 @@ export declare const UserProviderCredentialSchema: import("@wildo-ai/zod-decorat
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
     providerRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    connectionRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
     secretSlug: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
     secretValue: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
     enabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>>;
-    validationState: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof ProviderCredentialValidationState>>>>;
+    validationState: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof ProviderCredentialValidationState>>>>>>;
     validationError: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>;
     lastValidatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
     lastUsedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
@@ -455,6 +486,7 @@ export declare const ProviderOAuth2GrantSchema: z.ZodObject<{
     expiresAt: z.ZodOptional<z.ZodISODateTime>;
     grantedScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
     accountRef: z.ZodOptional<z.ZodString>;
+    grantId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type ProviderOAuth2Grant = z.infer<typeof ProviderOAuth2GrantSchema>;
 /**

package/dist/esm/security/connected-accounts/provider-credentials.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"provider-credentials.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/provider-credentials.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;GAOG;AACH,oBAAY,iCAAiC;IAC3C,0FAA0F;IAC1F,WAAW,gBAAgB;IAC3B,gDAAgD;IAChD,KAAK,UAAU;IACf,8EAA8E;IAC9E,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;GAWG;AACH,oBAAY,kCAAkC;IAC5C;;;;;OAKG;IACH,wBAAwB,6BAA6B;IACrD;;;OAGG;IACH,4BAA4B,iCAAiC;IAC7D;;;;OAIG;IACH,yBAAyB,8BAA8B;CACxD;AAED;;;;GAIG;AACH,oBAAY,gCAAgC;IAC1C;;;;OAIG;IACH,mBAAmB,wBAAwB;IAC3C,+GAA+G;IAC/G,kBAAkB,uBAAuB;CAC1C;AAED,yDAAyD;AACzD,eAAO,MAAM,4BAA4B;;;kBAGvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,oDAAoD;AACpD,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAEvF;;;;;;;;GAQG;AACH,oBAAY,kCAAkC;IAC5C,yEAAyE;IACzE,uBAAuB,4BAA4B;IACnD;;;OAGG;IACH,sBAAsB,2BAA2B;IACjD;;;;;;;;;OASG;IACH,eAAe,oBAAoB;CACpC;AAED;;;;;;;;;GASG;AACH,oBAAY,+BAA+B;IACzC;;;;;;;OAOG;IACH,OAAO,YAAY;IACnB;;;;;;OAMG;IACH,YAAY,iBAAiB;IAC7B,oGAAoG;IACpG,cAAc,mBAAmB;IACjC,gFAAgF;IAChF,WAAW,gBAAgB;IAC3B,+CAA+C;IAC/C,OAAO,YAAY;CACpB;AAED,4FAA4F;AAC5F,eAAO,MAAM,qCAAqC,wCAAkC,CAAC;AAErF;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,oBAAY,gCAAgC;IAC1C,wDAAwD;IACxD,qBAAqB,0BAA0B;IAC/C,iGAAiG;IACjG,mBAAmB,wBAAwB;IAC3C,gEAAgE;IAChE,aAAa,kBAAkB;IAC/B;;;;;;;;;;;OAWG;IACH,WAAW,gBAAgB;IAC3B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,YAAY,iBAAiB;CAC9B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gDAAgD,~~0DAInD~~,CAAC;~~AAEX~~;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oCAAoC~~;;;;;;;;;;;;;;;;;;;;kBA6HuB~~,CAAC;AAEzE,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAQlG~~;;;;;;GAMG~~;AACH,eAAO,MAAM,wCAAwC,~~kDAI3C~~,CAAC;~~AAEX~~;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,4BAA4B~~;;;;;;;;;;;;;;;;;;;kBAkFuB~~,CAAC;AAEjE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAsBlF;;;;;;GAMG;AACH;;;;;;;;GAQG;AACH;;;;;;;;;;GAUG;AACH;;;;;;GAMG;AACH,oBAAY,kBAAkB;IAC5B,+FAA+F;IAC/F,yBAAyB,8BAA8B;IACvD;;;OAGG;IACH,eAAe,oBAAoB;CACpC;AAED,oBAAY,6BAA6B;IACvC;;;;OAIG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;OAKG;IACH,0BAA0B,+BAA+B;IACzD;;;;;OAKG;IACH,0BAA0B,+BAA+B;IACzD;;;;OAIG;IACH,2BAA2B,gCAAgC;IAC3D;;;OAGG;IACH,4BAA4B,iCAAiC;IAC7D;;;;OAIG;IACH,mCAAmC,wCAAwC;IAC3E;;;;;;OAMG;IACH,0BAA0B,+BAA+B;CAC1D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wFAAwF;IACxF,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED,oBAAY,4BAA4B;IACtC,wEAAwE;IACxE,YAAY,iBAAiB;CAC9B;AAED,eAAO,MAAM,yBAAyB~~;;;;;;;iBAgDpC~~,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,wBAAwB,CAAC;AAElE,0EAA0E;AAC1E,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEzE;AAED,mFAAmF;AACnF,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,mBAAmB,GAAG,MAAM,CAE/E;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAqB3F;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oCAAoC,KAAK,CAAC;AAEvD,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,mBAAmB,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAK3G"}
1	+ {"version":3,"file":"provider-credentials.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/provider-credentials.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;GAOG;AACH,oBAAY,iCAAiC;IAC3C,0FAA0F;IAC1F,WAAW,gBAAgB;IAC3B,gDAAgD;IAChD,KAAK,UAAU;IACf,8EAA8E;IAC9E,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;GAWG;AACH,oBAAY,kCAAkC;IAC5C;;;;;OAKG;IACH,wBAAwB,6BAA6B;IACrD;;;OAGG;IACH,4BAA4B,iCAAiC;IAC7D;;;;OAIG;IACH,yBAAyB,8BAA8B;CACxD;AAED;;;;GAIG;AACH,oBAAY,gCAAgC;IAC1C;;;;OAIG;IACH,mBAAmB,wBAAwB;IAC3C,+GAA+G;IAC/G,kBAAkB,uBAAuB;CAC1C;AAED,yDAAyD;AACzD,eAAO,MAAM,4BAA4B;;;kBAGvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,oDAAoD;AACpD,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAEvF;;;;;;;;GAQG;AACH,oBAAY,kCAAkC;IAC5C,yEAAyE;IACzE,uBAAuB,4BAA4B;IACnD;;;OAGG;IACH,sBAAsB,2BAA2B;IACjD;;;;;;;;;OASG;IACH,eAAe,oBAAoB;CACpC;AAED;;;;;;;;;GASG;AACH,oBAAY,+BAA+B;IACzC;;;;;;;OAOG;IACH,OAAO,YAAY;IACnB;;;;;;OAMG;IACH,YAAY,iBAAiB;IAC7B,oGAAoG;IACpG,cAAc,mBAAmB;IACjC,gFAAgF;IAChF,WAAW,gBAAgB;IAC3B,+CAA+C;IAC/C,OAAO,YAAY;CACpB;AAED,4FAA4F;AAC5F,eAAO,MAAM,qCAAqC,wCAAkC,CAAC;AAErF;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,oBAAY,gCAAgC;IAC1C,wDAAwD;IACxD,qBAAqB,0BAA0B;IAC/C,iGAAiG;IACjG,mBAAmB,wBAAwB;IAC3C,gEAAgE;IAChE,aAAa,kBAAkB;IAC/B;;;;;;;;;;;OAWG;IACH,WAAW,gBAAgB;IAC3B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,YAAY,iBAAiB;CAC9B;AAED,wHAAwH;AACxH;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gDAAgD,4DAInD,CAAC;AACX,sEAAsE;AAEtE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;kBAqJuB,CAAC;AAEzE,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAQlG,wHAAwH;AACxH;;;;;;;GAOG;AACH,eAAO,MAAM,wCAAwC,oDAI3C,CAAC;AACX,sEAAsE;AAEtE;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;kBAkGuB,CAAC;AAEjE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAsBlF;;;;;;GAMG;AACH;;;;;;;;GAQG;AACH;;;;;;;;;;GAUG;AACH;;;;;;GAMG;AACH,oBAAY,kBAAkB;IAC5B,+FAA+F;IAC/F,yBAAyB,8BAA8B;IACvD;;;OAGG;IACH,eAAe,oBAAoB;CACpC;AAED,oBAAY,6BAA6B;IACvC;;;;OAIG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;OAKG;IACH,0BAA0B,+BAA+B;IACzD;;;;;OAKG;IACH,0BAA0B,+BAA+B;IACzD;;;;OAIG;IACH,2BAA2B,gCAAgC;IAC3D;;;OAGG;IACH,4BAA4B,iCAAiC;IAC7D;;;;OAIG;IACH,mCAAmC,wCAAwC;IAC3E;;;;;;OAMG;IACH,0BAA0B,+BAA+B;CAC1D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wFAAwF;IACxF,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED,oBAAY,4BAA4B;IACtC,wEAAwE;IACxE,YAAY,iBAAiB;CAC9B;AAED,eAAO,MAAM,yBAAyB;;;;;;;;iBA4DpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,wBAAwB,CAAC;AAElE,0EAA0E;AAC1E,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEzE;AAED,mFAAmF;AACnF,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,mBAAmB,GAAG,MAAM,CAE/E;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAqB3F;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oCAAoC,KAAK,CAAC;AAEvD,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,mBAAmB,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAK3G"}