@wildo-ai/saas-models 1.1.5 → 1.1.7

package/dist/esm/security/connected-accounts/provider-credentials.shared.schemas.d.ts

@@ -50,7 +50,7 @@ export declare enum ProviderCredentialValidationState {
  * Why a write door refused to store a credential VALUE under the slot it named — the stable,
  * client-branchable `code` every door carries (#624).
  *
- * A stored row is keyed `(owner, providerRef, secretSlug)` on the provider's secrets-contract KEY, and
+ * A stored row is keyed `(owner, connectionRef, secretSlug)` on the provider's secrets-contract KEY, and
  * every reader asks for that key. A value written under any other name is a secret nothing can ever
  * read, and before these refusals the write reported success — which is how a regenerated provider,
  * a free-text slug or a test script produced rows that looked connected and resolved as absent.
@@ -72,9 +72,9 @@ export declare enum ProviderCredentialSlotWriteRefusal {
      */
     SECRET_SLUG_NOT_A_CREDENTIAL = "SECRET_SLUG_NOT_A_CREDENTIAL",
     /**
-     * An UPDATE named a different `providerRef` or `secretSlug` for an existing row. The sealed value is
-     * bound to both, so a row cannot move: a credential for another slot is a new row, and the old one is
-     * deleted.
+     * An UPDATE named a different `providerRef`, `connectionRef` or `secretSlug` for an existing row. The sealed
+     * value is bound to the connection and the slot, and `providerRef` records which ref created the row, so a row
+     * cannot move: a credential for another slot or connection is a new row, and the old one is deleted.
      */
     CREDENTIAL_SLOT_IMMUTABLE = "CREDENTIAL_SLOT_IMMUTABLE"
 }
@@ -240,16 +240,42 @@ export declare enum ProviderCredentialDeletionReason {
      */
     USER_DELETED = "user_deleted"
 }
+/** @wildo_source:part:start saas.models.provider-credential-identity facet:layer:shared facet:audience:app-developer */
 /**
- * The fields that IDENTIFY a credential within its tenant.
+ * Where a stored credential LIVES: the connection it belongs to and the slot within it (#1670).
  *
- * One tenant holds at most one credential per (provider, slug). Exported rather than repeated so
- * the uniqueness contract, the resolver's lookup and the tests cannot drift apart — three copies
- * of a compound key is how two of them come to disagree about what identity means.
+ * The owner is not part of it because every caller already holds the owner from its own trusted scope;
+ * this is the half the provider registry answers. `ExternalProvidersRegistryBackendService.resolveCredentialAddress`
+ * is the ONE producer, so "which row does a call through ref R spend" has one answer on every read path.
  */
-export declare const ORGANIZATION_PROVIDER_CREDENTIAL_IDENTITY_FIELDS: readonly ["organizationId", "providerRef", "secretSlug"];
+export interface ProviderCredentialAddress {
+    /**
+     * The CONNECTION the credential belongs to — the key component that used to be the provider ref.
+     * Today every ref is its own connection, so this equals the ref; #1725 lets an application declare
+     * several refs of one vendor as one connection, and then every ref of it resolves the same row.
+     */
+    readonly connectionRef: string;
+    /** The provider's secrets-contract KEY — see `canonicalCredentialSlug` (#624). */
+    readonly secretSlug: string;
+}
+/**
+ * The fields that IDENTIFY a credential within its tenant: `(organizationId, connectionRef, secretSlug)`.
+ *
+ * One tenant holds at most one credential per (CONNECTION, slug) — not per provider ref (#1670). A
+ * connection is the unit a vendor grant belongs to: by default every provider ref is its own connection
+ * (`connectionRef` = `providerRef`), and a vendor served by several refs (an engine part plus add-on
+ * packages) can hold ONE grant that all of them spend. Keying on the ref made that impossible — two refs
+ * of one vendor could never share a stored credential, whatever the client side did.
+ *
+ * Exported rather than repeated so the uniqueness contract, the resolver's lookup and the tests cannot
+ * drift apart — three copies of a compound key is how two of them come to disagree about what identity
+ * means. The sealed value binds the same three components (the connection, never the ref), so a row's
+ * key and its seal always name one identity.
+ */
+export declare const ORGANIZATION_PROVIDER_CREDENTIAL_IDENTITY_FIELDS: readonly ["organizationId", "connectionRef", "secretSlug"];
+/** @wildo_source:part:end saas.models.provider-credential-identity */
 /**
- * The organization's credential for one (provider, secret slug) pair.
+ * The organization's credential for one (connection, secret slug) pair.
  *
  * ## The scope identifier is TOP-LEVEL and stays that way
  *
@@ -264,10 +290,11 @@ export declare const OrganizationProviderCredentialSchema: import("@wildo-ai/zod
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
     providerRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    connectionRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
     secretSlug: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
     secretValue: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
     enabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>>;
-    validationState: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof ProviderCredentialValidationState>>>>;
+    validationState: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof ProviderCredentialValidationState>>>>>>;
     validationError: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>;
     lastValidatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
     lastUsedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
@@ -282,14 +309,17 @@ export declare const OrganizationProviderCredentialSchema: import("@wildo-ai/zod
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
 }, z.core.$strip>>;
 export type OrganizationProviderCredential = z.infer<typeof OrganizationProviderCredentialSchema>;
+/** @wildo_source:part:start saas.models.provider-credential-identity facet:layer:shared facet:audience:app-developer */
 /**
- * The fields that IDENTIFY a credential within its OWNER.
+ * The fields that IDENTIFY a credential within its OWNER: `(userId, connectionRef, secretSlug)` — keyed on
+ * the CONNECTION, never the provider ref, as the organization-owned sibling explains (#1670).
  *
  * Exported per owner rather than shared, because the compound key differs in its first component and
  * a single constant would have to be assembled by each side — which is how two copies of a key come
  * to disagree about what identity means.
  */
-export declare const USER_PROVIDER_CREDENTIAL_IDENTITY_FIELDS: readonly ["userId", "providerRef", "secretSlug"];
+export declare const USER_PROVIDER_CREDENTIAL_IDENTITY_FIELDS: readonly ["userId", "connectionRef", "secretSlug"];
+/** @wildo_source:part:end saas.models.provider-credential-identity */
 /**
  * A PERSON's own credential toward a third party — the key they authored for themselves.
  *
@@ -322,10 +352,11 @@ export declare const UserProviderCredentialSchema: import("@wildo-ai/zod-decorat
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
     providerRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    connectionRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
     secretSlug: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
     secretValue: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
     enabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>>;
-    validationState: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof ProviderCredentialValidationState>>>>;
+    validationState: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof ProviderCredentialValidationState>>>>>>;
     validationError: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>;
     lastValidatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
     lastUsedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
@@ -455,6 +486,7 @@ export declare const ProviderOAuth2GrantSchema: z.ZodObject<{
     expiresAt: z.ZodOptional<z.ZodISODateTime>;
     grantedScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
     accountRef: z.ZodOptional<z.ZodString>;
+    grantId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type ProviderOAuth2Grant = z.infer<typeof ProviderOAuth2GrantSchema>;
 /**

package/dist/esm/security/connected-accounts/provider-credentials.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-credentials.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/provider-credentials.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;GAOG;AACH,oBAAY,iCAAiC;IAC3C,0FAA0F;IAC1F,WAAW,gBAAgB;IAC3B,gDAAgD;IAChD,KAAK,UAAU;IACf,8EAA8E;IAC9E,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;GAWG;AACH,oBAAY,kCAAkC;IAC5C;;;;;OAKG;IACH,wBAAwB,6BAA6B;IACrD;;;OAGG;IACH,4BAA4B,iCAAiC;IAC7D;;;;OAIG;IACH,yBAAyB,8BAA8B;CACxD;AAED;;;;GAIG;AACH,oBAAY,gCAAgC;IAC1C;;;;OAIG;IACH,mBAAmB,wBAAwB;IAC3C,+GAA+G;IAC/G,kBAAkB,uBAAuB;CAC1C;AAED,yDAAyD;AACzD,eAAO,MAAM,4BAA4B;;;kBAGvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,oDAAoD;AACpD,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAEvF;;;;;;;;GAQG;AACH,oBAAY,kCAAkC;IAC5C,yEAAyE;IACzE,uBAAuB,4BAA4B;IACnD;;;OAGG;IACH,sBAAsB,2BAA2B;IACjD;;;;;;;;;OASG;IACH,eAAe,oBAAoB;CACpC;AAED;;;;;;;;;GASG;AACH,oBAAY,+BAA+B;IACzC;;;;;;;OAOG;IACH,OAAO,YAAY;IACnB;;;;;;OAMG;IACH,YAAY,iBAAiB;IAC7B,oGAAoG;IACpG,cAAc,mBAAmB;IACjC,gFAAgF;IAChF,WAAW,gBAAgB;IAC3B,+CAA+C;IAC/C,OAAO,YAAY;CACpB;AAED,4FAA4F;AAC5F,eAAO,MAAM,qCAAqC,wCAAkC,CAAC;AAErF;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,oBAAY,gCAAgC;IAC1C,wDAAwD;IACxD,qBAAqB,0BAA0B;IAC/C,iGAAiG;IACjG,mBAAmB,wBAAwB;IAC3C,gEAAgE;IAChE,aAAa,kBAAkB;IAC/B;;;;;;;;;;;OAWG;IACH,WAAW,gBAAgB;IAC3B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,YAAY,iBAAiB;CAC9B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gDAAgD,0DAInD,CAAC;AAEX;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;kBA6HuB,CAAC;AAEzE,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAQlG;;;;;;GAMG;AACH,eAAO,MAAM,wCAAwC,kDAI3C,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;kBAkFuB,CAAC;AAEjE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAsBlF;;;;;;GAMG;AACH;;;;;;;;GAQG;AACH;;;;;;;;;;GAUG;AACH;;;;;;GAMG;AACH,oBAAY,kBAAkB;IAC5B,+FAA+F;IAC/F,yBAAyB,8BAA8B;IACvD;;;OAGG;IACH,eAAe,oBAAoB;CACpC;AAED,oBAAY,6BAA6B;IACvC;;;;OAIG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;OAKG;IACH,0BAA0B,+BAA+B;IACzD;;;;;OAKG;IACH,0BAA0B,+BAA+B;IACzD;;;;OAIG;IACH,2BAA2B,gCAAgC;IAC3D;;;OAGG;IACH,4BAA4B,iCAAiC;IAC7D;;;;OAIG;IACH,mCAAmC,wCAAwC;IAC3E;;;;;;OAMG;IACH,0BAA0B,+BAA+B;CAC1D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wFAAwF;IACxF,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED,oBAAY,4BAA4B;IACtC,wEAAwE;IACxE,YAAY,iBAAiB;CAC9B;AAED,eAAO,MAAM,yBAAyB;;;;;;;iBAgDpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,wBAAwB,CAAC;AAElE,0EAA0E;AAC1E,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEzE;AAED,mFAAmF;AACnF,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,mBAAmB,GAAG,MAAM,CAE/E;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAqB3F;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oCAAoC,KAAK,CAAC;AAEvD,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,mBAAmB,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAK3G"}
+{"version":3,"file":"provider-credentials.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/connected-accounts/provider-credentials.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;GAOG;AACH,oBAAY,iCAAiC;IAC3C,0FAA0F;IAC1F,WAAW,gBAAgB;IAC3B,gDAAgD;IAChD,KAAK,UAAU;IACf,8EAA8E;IAC9E,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;GAWG;AACH,oBAAY,kCAAkC;IAC5C;;;;;OAKG;IACH,wBAAwB,6BAA6B;IACrD;;;OAGG;IACH,4BAA4B,iCAAiC;IAC7D;;;;OAIG;IACH,yBAAyB,8BAA8B;CACxD;AAED;;;;GAIG;AACH,oBAAY,gCAAgC;IAC1C;;;;OAIG;IACH,mBAAmB,wBAAwB;IAC3C,+GAA+G;IAC/G,kBAAkB,uBAAuB;CAC1C;AAED,yDAAyD;AACzD,eAAO,MAAM,4BAA4B;;;kBAGvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,oDAAoD;AACpD,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAEvF;;;;;;;;GAQG;AACH,oBAAY,kCAAkC;IAC5C,yEAAyE;IACzE,uBAAuB,4BAA4B;IACnD;;;OAGG;IACH,sBAAsB,2BAA2B;IACjD;;;;;;;;;OASG;IACH,eAAe,oBAAoB;CACpC;AAED;;;;;;;;;GASG;AACH,oBAAY,+BAA+B;IACzC;;;;;;;OAOG;IACH,OAAO,YAAY;IACnB;;;;;;OAMG;IACH,YAAY,iBAAiB;IAC7B,oGAAoG;IACpG,cAAc,mBAAmB;IACjC,gFAAgF;IAChF,WAAW,gBAAgB;IAC3B,+CAA+C;IAC/C,OAAO,YAAY;CACpB;AAED,4FAA4F;AAC5F,eAAO,MAAM,qCAAqC,wCAAkC,CAAC;AAErF;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,oBAAY,gCAAgC;IAC1C,wDAAwD;IACxD,qBAAqB,0BAA0B;IAC/C,iGAAiG;IACjG,mBAAmB,wBAAwB;IAC3C,gEAAgE;IAChE,aAAa,kBAAkB;IAC/B;;;;;;;;;;;OAWG;IACH,WAAW,gBAAgB;IAC3B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,YAAY,iBAAiB;CAC9B;AAED,wHAAwH;AACxH;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gDAAgD,4DAInD,CAAC;AACX,sEAAsE;AAEtE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;kBAqJuB,CAAC;AAEzE,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAQlG,wHAAwH;AACxH;;;;;;;GAOG;AACH,eAAO,MAAM,wCAAwC,oDAI3C,CAAC;AACX,sEAAsE;AAEtE;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;kBAkGuB,CAAC;AAEjE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAsBlF;;;;;;GAMG;AACH;;;;;;;;GAQG;AACH;;;;;;;;;;GAUG;AACH;;;;;;GAMG;AACH,oBAAY,kBAAkB;IAC5B,+FAA+F;IAC/F,yBAAyB,8BAA8B;IACvD;;;OAGG;IACH,eAAe,oBAAoB;CACpC;AAED,oBAAY,6BAA6B;IACvC;;;;OAIG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;OAKG;IACH,0BAA0B,+BAA+B;IACzD;;;;;OAKG;IACH,0BAA0B,+BAA+B;IACzD;;;;OAIG;IACH,2BAA2B,gCAAgC;IAC3D;;;OAGG;IACH,4BAA4B,iCAAiC;IAC7D;;;;OAIG;IACH,mCAAmC,wCAAwC;IAC3E;;;;;;OAMG;IACH,0BAA0B,+BAA+B;CAC1D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wFAAwF;IACxF,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED,oBAAY,4BAA4B;IACtC,wEAAwE;IACxE,YAAY,iBAAiB;CAC9B;AAED,eAAO,MAAM,yBAAyB;;;;;;;;iBA4DpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,wBAAwB,CAAC;AAElE,0EAA0E;AAC1E,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEzE;AAED,mFAAmF;AACnF,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,mBAAmB,GAAG,MAAM,CAE/E;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAqB3F;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oCAAoC,KAAK,CAAC;AAEvD,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,mBAAmB,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAK3G"}

package/dist/esm/security/connected-accounts/provider-credentials.shared.schemas.js

@@ -51,7 +51,7 @@ export var ProviderCredentialValidationState;
  * Why a write door refused to store a credential VALUE under the slot it named — the stable,
  * client-branchable `code` every door carries (#624).
  *
- * A stored row is keyed `(owner, providerRef, secretSlug)` on the provider's secrets-contract KEY, and
+ * A stored row is keyed `(owner, connectionRef, secretSlug)` on the provider's secrets-contract KEY, and
  * every reader asks for that key. A value written under any other name is a secret nothing can ever
  * read, and before these refusals the write reported success — which is how a regenerated provider,
  * a free-text slug or a test script produced rows that looked connected and resolved as absent.
@@ -74,9 +74,9 @@ export var ProviderCredentialSlotWriteRefusal;
      */
     ProviderCredentialSlotWriteRefusal["SECRET_SLUG_NOT_A_CREDENTIAL"] = "SECRET_SLUG_NOT_A_CREDENTIAL";
     /**
-     * An UPDATE named a different `providerRef` or `secretSlug` for an existing row. The sealed value is
-     * bound to both, so a row cannot move: a credential for another slot is a new row, and the old one is
-     * deleted.
+     * An UPDATE named a different `providerRef`, `connectionRef` or `secretSlug` for an existing row. The sealed
+     * value is bound to the connection and the slot, and `providerRef` records which ref created the row, so a row
+     * cannot move: a credential for another slot or connection is a new row, and the old one is deleted.
      */
     ProviderCredentialSlotWriteRefusal["CREDENTIAL_SLOT_IMMUTABLE"] = "CREDENTIAL_SLOT_IMMUTABLE";
 })(ProviderCredentialSlotWriteRefusal || (ProviderCredentialSlotWriteRefusal = {}));
@@ -98,8 +98,8 @@ export var ProviderConnectionFactProvenance;
 })(ProviderConnectionFactProvenance || (ProviderConnectionFactProvenance = {}));
 /** One value in a credential row's `connectionFacts`. */
 export const ProviderConnectionFactSchema = z.strictObject({
-    value: z.string(),
-    provenance: z.enum(ProviderConnectionFactProvenance),
+    value: z.string().describe("The fact's value, such as a tenant id or an instance URL."),
+    provenance: z.enum(ProviderConnectionFactProvenance).describe("Where the value came from: `ANSWERED_AT_CONNECT` was entered by the person connecting and changes only when they reconnect or re-enter the credential; `REPORTED_BY_VENDOR` came from the vendor's token response and may change at a token refresh."),
 });
 /**
  * WHERE a resolved provider secret came from.
@@ -244,19 +244,27 @@ export var ProviderCredentialDeletionReason;
     ProviderCredentialDeletionReason["USER_DELETED"] = "user_deleted";
 })(ProviderCredentialDeletionReason || (ProviderCredentialDeletionReason = {}));
 /**
- * The fields that IDENTIFY a credential within its tenant.
- *
- * One tenant holds at most one credential per (provider, slug). Exported rather than repeated so
- * the uniqueness contract, the resolver's lookup and the tests cannot drift apart — three copies
- * of a compound key is how two of them come to disagree about what identity means.
+ * The fields that IDENTIFY a credential within its tenant: `(organizationId, connectionRef, secretSlug)`.
+ *
+ * One tenant holds at most one credential per (CONNECTION, slug) — not per provider ref (#1670). A
+ * connection is the unit a vendor grant belongs to: by default every provider ref is its own connection
+ * (`connectionRef` = `providerRef`), and a vendor served by several refs (an engine part plus add-on
+ * packages) can hold ONE grant that all of them spend. Keying on the ref made that impossible — two refs
+ * of one vendor could never share a stored credential, whatever the client side did.
+ *
+ * Exported rather than repeated so the uniqueness contract, the resolver's lookup and the tests cannot
+ * drift apart — three copies of a compound key is how two of them come to disagree about what identity
+ * means. The sealed value binds the same three components (the connection, never the ref), so a row's
+ * key and its seal always name one identity.
  */
 export const ORGANIZATION_PROVIDER_CREDENTIAL_IDENTITY_FIELDS = [
     'organizationId',
-    'providerRef',
+    'connectionRef',
     'secretSlug',
 ];
+/** @wildo_source:part:end saas.models.provider-credential-identity */
 /**
- * The organization's credential for one (provider, secret slug) pair.
+ * The organization's credential for one (connection, secret slug) pair.
  *
  * ## The scope identifier is TOP-LEVEL and stays that way
  *
@@ -280,8 +288,24 @@ export const OrganizationProviderCredentialSchema = z.object({
      * ref). An OPEN string, matching `ProviderRef`'s own openness — the whole point of the provider
      * work is that the set is not closed, so a closed enum here would refuse every generated
      * provider.
+     *
+     * NOT the row's identity since #1670: it records which ref's connect flow (or write) CREATED the row,
+     * and `connectionRef` below is what the row is keyed and sealed on. A reconnect through another ref of
+     * the same connection replaces the value and leaves this unchanged.
      */
     providerRef: z.string().min(1).max(200).isDBIndexed().isSummaryField().excludeFromUpdate(),
+    /**
+     * The CONNECTION this credential belongs to — the row's identity, where `providerRef` records only which
+     * ref's connect flow (or write) CREATED it (#1670).
+     *
+     * Derived by the server from `providerRef` through the provider registry's connection mapping, never
+     * supplied by a client: `.excludeFromCreate()` because a caller naming a connection would choose which
+     * grant its value lands beside, and `.excludeFromUpdate()` because the sealed value binds it — a row
+     * cannot move to another connection, only be replaced (`CREDENTIAL_SLOT_IMMUTABLE`). Every ref is its own
+     * connection until an application declares otherwise (#1725), so today it always equals `providerRef`,
+     * and every row stored before the field existed was backfilled to exactly that.
+     */
+    connectionRef: z.string().min(1).max(200).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),
     /**
      * The provider's `secretsContract` KEY this value satisfies (`accessToken`, `clientSecret`) —
      * NOT the slot's env-var spelling (`ASANA_ACCESS_TOKEN`), which is what the deployment's env
@@ -312,11 +336,18 @@ export const OrganizationProviderCredentialSchema = z.object({
      * which matters during an incident, where deleting is not reversible and disabling is.
      */
     enabled: z.boolean().default(true).isDBIndexed().isSummaryField(),
+    /**
+     * What the last USE of this credential proved — written only by the credential store after a provider accepted
+     * or rejected it (#1809). Excluded from create and update like its three siblings, so the owner cannot declare a
+     * credential VALID that no provider ever accepted, or clear an INVALID the resolver recorded.
+     */
     validationState: z
         .enum(ProviderCredentialValidationState)
         .default(ProviderCredentialValidationState.UNVALIDATED)
         .isDBIndexed()
-        .isSummaryField(),
+        .isSummaryField()
+        .excludeFromCreate()
+        .excludeFromUpdate(),
     /**
      * Why the last use failed, when it did. PROVIDER-supplied text about the CREDENTIAL's status —
      * never the credential. A resolver writing anything derived from `secretValue` here would defeat
@@ -366,7 +397,7 @@ export const OrganizationProviderCredentialSchema = z.object({
     updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),
 })
     /**
-     * One credential per tenant per (provider, slug), enforced by a compound UNIQUE index rather
+     * One credential per tenant per (connection, slug), enforced by a compound UNIQUE index rather
      * than by a read-then-write.
      *
      * The race it closes is not academic: two administrators saving a rotated Slack token in the
@@ -382,8 +413,10 @@ export const OrganizationProviderCredentialSchema = z.object({
 // =============================================================================
 // USER-OWNED CREDENTIALS
 // =============================================================================
+/** @wildo_source:part:start saas.models.provider-credential-identity facet:layer:shared facet:audience:app-developer */
 /**
- * The fields that IDENTIFY a credential within its OWNER.
+ * The fields that IDENTIFY a credential within its OWNER: `(userId, connectionRef, secretSlug)` — keyed on
+ * the CONNECTION, never the provider ref, as the organization-owned sibling explains (#1670).
  *
  * Exported per owner rather than shared, because the compound key differs in its first component and
  * a single constant would have to be assembled by each side — which is how two copies of a key come
@@ -391,9 +424,10 @@ export const OrganizationProviderCredentialSchema = z.object({
  */
 export const USER_PROVIDER_CREDENTIAL_IDENTITY_FIELDS = [
     'userId',
-    'providerRef',
+    'connectionRef',
     'secretSlug',
 ];
+/** @wildo_source:part:end saas.models.provider-credential-identity */
 /**
  * A PERSON's own credential toward a third party — the key they authored for themselves.
  *
@@ -430,8 +464,16 @@ export const UserProviderCredentialSchema = z.object({
      * sibling relies on, which is what makes "another user's key" unreachable rather than filtered.
      */
     userId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),
-    /** As the organization-owned sibling: an OPEN string, because the provider set is not closed. */
+    /**
+     * As the organization-owned sibling: an OPEN string, because the provider set is not closed. Records which
+     * ref's connect flow (or write) CREATED the row; the row's identity is `connectionRef` (#1670).
+     */
     providerRef: z.string().min(1).max(200).isDBIndexed().isSummaryField().excludeFromUpdate(),
+    /**
+     * The CONNECTION this credential belongs to — the row's identity (#1670). Server-derived from `providerRef`,
+     * never client-supplied, and immutable because the seal binds it; see the organization-owned sibling.
+     */
+    connectionRef: z.string().min(1).max(200).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),
     /** The provider's `secretsContract` KEY this value satisfies — never the env-var spelling, as the
      * sibling explains (#624). Immutable, for the same reason as the sibling: re-pointing a stored secret
      * at a different slug would hand one vendor credential to a different vendor field. */
@@ -445,11 +487,18 @@ export const UserProviderCredentialSchema = z.object({
      */
     secretValue: z.string().min(1).isWriteOnlySecret(),
     enabled: z.boolean().default(true).isDBIndexed().isSummaryField(),
+    /**
+     * What the last USE of this credential proved — written only by the credential store after a provider accepted
+     * or rejected it (#1809). Excluded from create and update like its three siblings, so the owner cannot declare a
+     * credential VALID that no provider ever accepted, or clear an INVALID the resolver recorded.
+     */
     validationState: z
         .enum(ProviderCredentialValidationState)
         .default(ProviderCredentialValidationState.UNVALIDATED)
         .isDBIndexed()
-        .isSummaryField(),
+        .isSummaryField()
+        .excludeFromCreate()
+        .excludeFromUpdate(),
     /** Why the last use failed. PROVIDER text about the CREDENTIAL, never anything derived from it —
      * this field IS client-readable. */
     validationError: z.string().max(500).optional().excludeFromCreate().excludeFromUpdate(),
@@ -486,7 +535,7 @@ export const UserProviderCredentialSchema = z.object({
     updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),
 })
     /**
-     * One credential per person per (provider, slug), enforced by a compound UNIQUE index rather than
+     * One credential per person per (connection, slug), enforced by a compound UNIQUE index rather than
      * a read-then-write — the same race the organization-owned sibling closes, and for the same
      * reason: two rows would leave the resolver picking one arbitrarily, so half the holder's outbound
      * calls would carry a rotated-away credential and nothing would say which half.
@@ -500,7 +549,7 @@ export const UserProviderCredentialSchema = z.object({
 //
 // ## Why the same rows rather than a third resource
 //
-// The identity is the same triple (owner, providerRef, secretSlug), the ownership semantics are the
+// The identity is the same triple (owner, connectionRef, secretSlug), the ownership semantics are the
 // same, the authorization is the same, the erasure is the same, and the resolver already routes by
 // scope. Only the PAYLOAD differs. A separate resource would duplicate every one of those and force
 // each consumer to ask "which store?" before it could ask anything useful.
@@ -650,6 +699,17 @@ export const ProviderOAuth2GrantSchema = z.object({
      * answer for anyone who has two.
      */
     accountRef: z.string().optional(),
+    /**
+     * An identifier minted when the person AUTHORIZES — at the code exchange — and carried unchanged through every
+     * renewal (#1725). A reconnect mints a new one.
+     *
+     * It is what a cached token of another resource audience is bound to: a Dataverse token minted from this grant's
+     * refresh token belongs to THIS authorization, and a reconnect — possibly to a different Microsoft account, on the
+     * same row — must never be answered from the previous authorization's cache. The row's id cannot do this (a
+     * reconnect updates the row in place) and the refresh token cannot either (Microsoft replaces it on every use).
+     * Absent on a grant stored before #1725, which then binds its cache entries to the row instead.
+     */
+    grantId: z.string().min(1).optional(),
 });
 /**
  * The marker that opens the sealed plaintext of a grant rather than a pasted credential.