@workos-inc/widgets 1.20.0-next.1791237372282 → 1.20.0

package/dist/cjs/pipes-admin.client.cjs

@@ -5,10 +5,11 @@ const require_lib_use_is_hydrated = require("./lib/use-is-hydrated.cjs");
 const require_api_api_provider = require("./api/api-provider.cjs");
 const require_api_client_graphql_hooks = require("./api/client-graphql/hooks.cjs");
 const require_lib_error_boundary = require("./lib/error-boundary.cjs");
+const require_lib_pipes_credential_attribution = require("./lib/pipes-credential-attribution.cjs");
 const require_lib_pipes_admin = require("./lib/pipes-admin.cjs");
 let react_jsx_runtime = require("react/jsx-runtime");
 //#region src/pipes-admin.client.tsx
-const PipesAdmin = ({ authToken, enableSharedConnections, ...domProps }) => {
+const PipesAdmin = ({ authToken, userId, enableSharedConnections, ...domProps }) => {
 	const baseUrl = require_lib_widgets_context.useWorkOsApiUrl();
 	return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(require_lib_error_boundary.ErrorBoundary, {
 		fallbackRender: ({ error }) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)(require_lib_pipes_admin.PipesAdminError, {
@@ -19,9 +20,12 @@ const PipesAdmin = ({ authToken, enableSharedConnections, ...domProps }) => {
 			widgetType: "pipes-admin",
 			authToken,
 			baseUrl,
-			children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(PipesAdminImpl, {
-				enableSharedConnections,
-				...domProps
+			children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(require_lib_pipes_credential_attribution.PipesCredentialUserIdContext.Provider, {
+				value: userId,
+				children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(PipesAdminImpl, {
+					enableSharedConnections,
+					...domProps
+				})
 			})
 		})
 	});

package/dist/cjs/pipes-admin.client.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"pipes-admin.client.cjs","names":["useWorkOsApiUrl","ErrorBoundary","PipesAdminError","ApiProvider","useIsHydrated","useManageableIntegrations","PipesAdminLoading","PipesAdminPresentational","useOrganizationOwnedIntegrations","useClientGraphqlQuery","clientGraphqlQueryKey","PipesAdminSectionsPresentational"],"sources":["../../src/pipes-admin.client.tsx"],"sourcesContent":["\"use client\";\nimport { ApiProvider, AuthToken } from \"./api/api-provider.js\";\nimport { useWorkOsApiUrl } from \"./lib/widgets-context.js\";\nimport {\n  PipesAdmin as PipesAdminPresentational,\n  PipesAdminSections as PipesAdminSectionsPresentational,\n  PipesAdminError,\n  PipesAdminLoading,\n  useManageableIntegrations,\n  useOrganizationOwnedIntegrations,\n} from \"./lib/pipes-admin.js\";\nimport type {\n  PipesAdminErrorProps,\n  PipesAdminLoadingProps,\n} from \"./lib/pipes-admin.js\";\nimport {\n  clientGraphqlQueryKey,\n  useClientGraphqlQuery,\n} from \"./api/client-graphql/hooks.js\";\nimport { useIsHydrated } from \"./lib/use-is-hydrated.js\";\nimport { ErrorBoundary } from \"./lib/error-boundary.js\";\nimport { WidgetRootDomProps } from \"./lib/widget-types.js\";\n\ninterface PipesAdminProps extends WidgetRootDomProps {\n  authToken: AuthToken;\n  /**\n   * Opt in to the sectioned administrator experience: the connections the\n   * organization owns and shares with everyone (which the administrator can\n   * configure, connect, reauthorize and disconnect), followed by the provider\n   * settings that govern what members may connect to on their own.\n   *\n   * The two sections are fetched separately, so provider settings render as\n   * soon as they resolve regardless of the shared section.\n   *\n   * Defaults to `false`, which renders the single unsectioned provider\n   * settings list and never requests organization-owned connections.\n   */\n  enableSharedConnections?: boolean;\n}\n\nconst PipesAdmin: React.FC<PipesAdminProps> = ({\n  authToken,\n  enableSharedConnections,\n  ...domProps\n}) => {\n  const baseUrl = useWorkOsApiUrl();\n\n  return (\n    <ErrorBoundary\n      fallbackRender={({ error }) => (\n        <PipesAdminError {...domProps} error={error} />\n      )}\n    >\n      <ApiProvider\n        widgetType=\"pipes-admin\"\n        authToken={authToken}\n        baseUrl={baseUrl}\n      >\n        <PipesAdminImpl\n          enableSharedConnections={enableSharedConnections}\n          {...domProps}\n        />\n      </ApiProvider>\n    </ErrorBoundary>\n  );\n};\n\n// The two experiences are separate components so the opt-out path mounts no\n// organization-owned hook at all, and therefore issues exactly the requests it\n// always has.\nconst PipesAdminImpl = ({\n  enableSharedConnections,\n  ...props\n}: Omit<PipesAdminProps, \"authToken\">) => {\n  return enableSharedConnections ? (\n    <PipesAdminSectionsImpl {...props} />\n  ) : (\n    <PipesAdminProviderSettingsImpl {...props} />\n  );\n};\n\ntype PipesAdminImplProps = Omit<\n  PipesAdminProps,\n  \"authToken\" | \"enableSharedConnections\"\n>;\n\nconst PipesAdminProviderSettingsImpl = (props: PipesAdminImplProps) => {\n  const isHydrated = useIsHydrated();\n  const integrations = useManageableIntegrations();\n\n  if (!isHydrated || integrations.isLoading) {\n    return <PipesAdminLoading count={6} {...props} />;\n  }\n\n  if (integrations.isError) {\n    return <PipesAdminError error={integrations.error} {...props} />;\n  }\n\n  return (\n    <PipesAdminPresentational integrations={integrations.data} {...props} />\n  );\n};\n\nconst PipesAdminSectionsImpl = (props: PipesAdminImplProps) => {\n  const isHydrated = useIsHydrated();\n  const integrations = useManageableIntegrations();\n  // Both sections have their own cache entry and resolve independently:\n  // provider settings render as soon as they arrive, and a slow or failing\n  // organization request only affects the shared section.\n  const shared = useOrganizationOwnedIntegrations();\n  const organizations = useClientGraphqlQuery({\n    queryKey: clientGraphqlQueryKey(\"ListUserOrganizations\"),\n    queryFn: (sdk) => sdk.ListUserOrganizations(),\n  });\n  const organizationName = organizations.data?.organizations.find(\n    (organization) => organization.isCurrent,\n  )?.name;\n\n  if (!isHydrated || integrations.isLoading) {\n    return <PipesAdminLoading count={6} {...props} />;\n  }\n\n  if (integrations.isError) {\n    return <PipesAdminError error={integrations.error} {...props} />;\n  }\n\n  return (\n    <PipesAdminSectionsPresentational\n      integrations={integrations.data}\n      sharedIntegrations={shared.data}\n      isSharedLoading={shared.isLoading}\n      organizationName={organizationName}\n      {...props}\n    />\n  );\n};\n\nexport type { PipesAdminProps, PipesAdminLoadingProps, PipesAdminErrorProps };\nexport { PipesAdmin, PipesAdminLoading, PipesAdminError };\n"],"mappings":";;;;;;;;;;AAwCA,MAAM,cAAyC,EAC7C,WACA,yBACA,GAAG,eACC;CACJ,MAAM,UAAUA,4BAAAA,gBAAgB;CAEhC,OACE,iBAAA,GAAA,kBAAA,IAAA,CAACC,2BAAAA,eAAD;EACE,iBAAiB,EAAE,YACjB,iBAAA,GAAA,kBAAA,IAAA,CAACC,wBAAAA,iBAAD;GAAiB,GAAI;GAAiB;EAAQ,CAAA;EAGhD,UAAA,iBAAA,GAAA,kBAAA,IAAA,CAACC,yBAAAA,aAAD;GACE,YAAW;GACA;GACF;GAET,UAAA,iBAAA,GAAA,kBAAA,IAAA,CAAC,gBAAD;IAC2B;IACzB,GAAI;GACL,CAAA;EACU,CAAA;CACA,CAAA;AAEnB;AAKA,MAAM,kBAAkB,EACtB,yBACA,GAAG,YACqC;CACxC,OAAO,0BACL,iBAAA,GAAA,kBAAA,IAAA,CAAC,wBAAD,EAAwB,GAAI,MAAQ,CAAA,IAEpC,iBAAA,GAAA,kBAAA,IAAA,CAAC,gCAAD,EAAgC,GAAI,MAAQ,CAAA;AAEhD;AAOA,MAAM,kCAAkC,UAA+B;CACrE,MAAM,aAAaC,4BAAAA,cAAc;CACjC,MAAM,eAAeC,wBAAAA,0BAA0B;CAE/C,IAAI,CAAC,cAAc,aAAa,WAC9B,OAAO,iBAAA,GAAA,kBAAA,IAAA,CAACC,wBAAAA,mBAAD;EAAmB,OAAO;EAAG,GAAI;CAAQ,CAAA;CAGlD,IAAI,aAAa,SACf,OAAO,iBAAA,GAAA,kBAAA,IAAA,CAACJ,wBAAAA,iBAAD;EAAiB,OAAO,aAAa;EAAO,GAAI;CAAQ,CAAA;CAGjE,OACE,iBAAA,GAAA,kBAAA,IAAA,CAACK,wBAAAA,YAAD;EAA0B,cAAc,aAAa;EAAM,GAAI;CAAQ,CAAA;AAE3E;AAEA,MAAM,0BAA0B,UAA+B;CAC7D,MAAM,aAAaH,4BAAAA,cAAc;CACjC,MAAM,eAAeC,wBAAAA,0BAA0B;CAI/C,MAAM,SAASG,wBAAAA,iCAAiC;CAKhD,MAAM,mBAJgBC,iCAAAA,sBAAsB;EAC1C,UAAUC,iCAAAA,sBAAsB,uBAAuB;EACvD,UAAU,QAAQ,IAAI,sBAAsB;CAC9C,CACyB,CAAA,CAAc,MAAM,cAAc,MACxD,iBAAiB,aAAa,SACjC,CAAC,EAAE;CAEH,IAAI,CAAC,cAAc,aAAa,WAC9B,OAAO,iBAAA,GAAA,kBAAA,IAAA,CAACJ,wBAAAA,mBAAD;EAAmB,OAAO;EAAG,GAAI;CAAQ,CAAA;CAGlD,IAAI,aAAa,SACf,OAAO,iBAAA,GAAA,kBAAA,IAAA,CAACJ,wBAAAA,iBAAD;EAAiB,OAAO,aAAa;EAAO,GAAI;CAAQ,CAAA;CAGjE,OACE,iBAAA,GAAA,kBAAA,IAAA,CAACS,wBAAAA,oBAAD;EACE,cAAc,aAAa;EAC3B,oBAAoB,OAAO;EAC3B,iBAAiB,OAAO;EACN;EAClB,GAAI;CACL,CAAA;AAEL"}
+{"version":3,"file":"pipes-admin.client.cjs","names":["useWorkOsApiUrl","ErrorBoundary","PipesAdminError","ApiProvider","PipesCredentialUserIdContext","useIsHydrated","useManageableIntegrations","PipesAdminLoading","PipesAdminPresentational","useOrganizationOwnedIntegrations","useClientGraphqlQuery","clientGraphqlQueryKey","PipesAdminSectionsPresentational"],"sources":["../../src/pipes-admin.client.tsx"],"sourcesContent":["\"use client\";\nimport { ApiProvider, AuthToken } from \"./api/api-provider.js\";\nimport { useWorkOsApiUrl } from \"./lib/widgets-context.js\";\nimport {\n  PipesAdmin as PipesAdminPresentational,\n  PipesAdminSections as PipesAdminSectionsPresentational,\n  PipesAdminError,\n  PipesAdminLoading,\n  useManageableIntegrations,\n  useOrganizationOwnedIntegrations,\n} from \"./lib/pipes-admin.js\";\nimport type {\n  PipesAdminErrorProps,\n  PipesAdminLoadingProps,\n} from \"./lib/pipes-admin.js\";\nimport {\n  clientGraphqlQueryKey,\n  useClientGraphqlQuery,\n} from \"./api/client-graphql/hooks.js\";\nimport { useIsHydrated } from \"./lib/use-is-hydrated.js\";\nimport { ErrorBoundary } from \"./lib/error-boundary.js\";\nimport { WidgetRootDomProps } from \"./lib/widget-types.js\";\nimport { PipesCredentialUserIdContext } from \"./lib/pipes-credential-attribution.js\";\n\ninterface PipesAdminProps extends WidgetRootDomProps {\n  authToken: AuthToken;\n  /**\n   * The acting person's WorkOS user ID for shared API-key and client-credentials\n   * writes with an application credential token. Required for those writes only.\n   * User-backed sessions use the authenticated user; a different ID is rejected.\n   * This prop is not rendered and does not grant authorization. The API validates\n   * identity and organization membership.\n   */\n  userId?: string;\n  /**\n   * Opt in to the sectioned administrator experience: the connections the\n   * organization owns and shares with everyone (which the administrator can\n   * configure, connect, reauthorize and disconnect), followed by the provider\n   * settings that govern what members may connect to on their own.\n   *\n   * The two sections are fetched separately, so provider settings render as\n   * soon as they resolve regardless of the shared section.\n   *\n   * Defaults to `false`, which renders the single unsectioned provider\n   * settings list and never requests organization-owned connections.\n   */\n  enableSharedConnections?: boolean;\n}\n\nconst PipesAdmin: React.FC<PipesAdminProps> = ({\n  authToken,\n  userId,\n  enableSharedConnections,\n  ...domProps\n}) => {\n  const baseUrl = useWorkOsApiUrl();\n\n  return (\n    <ErrorBoundary\n      fallbackRender={({ error }) => (\n        <PipesAdminError {...domProps} error={error} />\n      )}\n    >\n      <ApiProvider\n        widgetType=\"pipes-admin\"\n        authToken={authToken}\n        baseUrl={baseUrl}\n      >\n        <PipesCredentialUserIdContext.Provider value={userId}>\n          <PipesAdminImpl\n            enableSharedConnections={enableSharedConnections}\n            {...domProps}\n          />\n        </PipesCredentialUserIdContext.Provider>\n      </ApiProvider>\n    </ErrorBoundary>\n  );\n};\n\n// The two experiences are separate components so the opt-out path mounts no\n// organization-owned hook at all, and therefore issues exactly the requests it\n// always has.\nconst PipesAdminImpl = ({\n  enableSharedConnections,\n  ...props\n}: Omit<PipesAdminProps, \"authToken\" | \"userId\">) => {\n  return enableSharedConnections ? (\n    <PipesAdminSectionsImpl {...props} />\n  ) : (\n    <PipesAdminProviderSettingsImpl {...props} />\n  );\n};\n\ntype PipesAdminImplProps = Omit<\n  PipesAdminProps,\n  \"authToken\" | \"enableSharedConnections\" | \"userId\"\n>;\n\nconst PipesAdminProviderSettingsImpl = (props: PipesAdminImplProps) => {\n  const isHydrated = useIsHydrated();\n  const integrations = useManageableIntegrations();\n\n  if (!isHydrated || integrations.isLoading) {\n    return <PipesAdminLoading count={6} {...props} />;\n  }\n\n  if (integrations.isError) {\n    return <PipesAdminError error={integrations.error} {...props} />;\n  }\n\n  return (\n    <PipesAdminPresentational integrations={integrations.data} {...props} />\n  );\n};\n\nconst PipesAdminSectionsImpl = (props: PipesAdminImplProps) => {\n  const isHydrated = useIsHydrated();\n  const integrations = useManageableIntegrations();\n  // Both sections have their own cache entry and resolve independently:\n  // provider settings render as soon as they arrive, and a slow or failing\n  // organization request only affects the shared section.\n  const shared = useOrganizationOwnedIntegrations();\n  const organizations = useClientGraphqlQuery({\n    queryKey: clientGraphqlQueryKey(\"ListUserOrganizations\"),\n    queryFn: (sdk) => sdk.ListUserOrganizations(),\n  });\n  const organizationName = organizations.data?.organizations.find(\n    (organization) => organization.isCurrent,\n  )?.name;\n\n  if (!isHydrated || integrations.isLoading) {\n    return <PipesAdminLoading count={6} {...props} />;\n  }\n\n  if (integrations.isError) {\n    return <PipesAdminError error={integrations.error} {...props} />;\n  }\n\n  return (\n    <PipesAdminSectionsPresentational\n      integrations={integrations.data}\n      sharedIntegrations={shared.data}\n      isSharedLoading={shared.isLoading}\n      organizationName={organizationName}\n      {...props}\n    />\n  );\n};\n\nexport type { PipesAdminProps, PipesAdminLoadingProps, PipesAdminErrorProps };\nexport { PipesAdmin, PipesAdminLoading, PipesAdminError };\n"],"mappings":";;;;;;;;;;;AAiDA,MAAM,cAAyC,EAC7C,WACA,QACA,yBACA,GAAG,eACC;CACJ,MAAM,UAAUA,4BAAAA,gBAAgB;CAEhC,OACE,iBAAA,GAAA,kBAAA,IAAA,CAACC,2BAAAA,eAAD;EACE,iBAAiB,EAAE,YACjB,iBAAA,GAAA,kBAAA,IAAA,CAACC,wBAAAA,iBAAD;GAAiB,GAAI;GAAiB;EAAQ,CAAA;EAGhD,UAAA,iBAAA,GAAA,kBAAA,IAAA,CAACC,yBAAAA,aAAD;GACE,YAAW;GACA;GACF;GAET,UAAA,iBAAA,GAAA,kBAAA,IAAA,CAACC,yCAAAA,6BAA6B,UAA9B;IAAuC,OAAO;IAC5C,UAAA,iBAAA,GAAA,kBAAA,IAAA,CAAC,gBAAD;KAC2B;KACzB,GAAI;IACL,CAAA;GACoC,CAAA;EAC5B,CAAA;CACA,CAAA;AAEnB;AAKA,MAAM,kBAAkB,EACtB,yBACA,GAAG,YACgD;CACnD,OAAO,0BACL,iBAAA,GAAA,kBAAA,IAAA,CAAC,wBAAD,EAAwB,GAAI,MAAQ,CAAA,IAEpC,iBAAA,GAAA,kBAAA,IAAA,CAAC,gCAAD,EAAgC,GAAI,MAAQ,CAAA;AAEhD;AAOA,MAAM,kCAAkC,UAA+B;CACrE,MAAM,aAAaC,4BAAAA,cAAc;CACjC,MAAM,eAAeC,wBAAAA,0BAA0B;CAE/C,IAAI,CAAC,cAAc,aAAa,WAC9B,OAAO,iBAAA,GAAA,kBAAA,IAAA,CAACC,wBAAAA,mBAAD;EAAmB,OAAO;EAAG,GAAI;CAAQ,CAAA;CAGlD,IAAI,aAAa,SACf,OAAO,iBAAA,GAAA,kBAAA,IAAA,CAACL,wBAAAA,iBAAD;EAAiB,OAAO,aAAa;EAAO,GAAI;CAAQ,CAAA;CAGjE,OACE,iBAAA,GAAA,kBAAA,IAAA,CAACM,wBAAAA,YAAD;EAA0B,cAAc,aAAa;EAAM,GAAI;CAAQ,CAAA;AAE3E;AAEA,MAAM,0BAA0B,UAA+B;CAC7D,MAAM,aAAaH,4BAAAA,cAAc;CACjC,MAAM,eAAeC,wBAAAA,0BAA0B;CAI/C,MAAM,SAASG,wBAAAA,iCAAiC;CAKhD,MAAM,mBAJgBC,iCAAAA,sBAAsB;EAC1C,UAAUC,iCAAAA,sBAAsB,uBAAuB;EACvD,UAAU,QAAQ,IAAI,sBAAsB;CAC9C,CACyB,CAAA,CAAc,MAAM,cAAc,MACxD,iBAAiB,aAAa,SACjC,CAAC,EAAE;CAEH,IAAI,CAAC,cAAc,aAAa,WAC9B,OAAO,iBAAA,GAAA,kBAAA,IAAA,CAACJ,wBAAAA,mBAAD;EAAmB,OAAO;EAAG,GAAI;CAAQ,CAAA;CAGlD,IAAI,aAAa,SACf,OAAO,iBAAA,GAAA,kBAAA,IAAA,CAACL,wBAAAA,iBAAD;EAAiB,OAAO,aAAa;EAAO,GAAI;CAAQ,CAAA;CAGjE,OACE,iBAAA,GAAA,kBAAA,IAAA,CAACU,wBAAAA,oBAAD;EACE,cAAc,aAAa;EAC3B,oBAAoB,OAAO;EAC3B,iBAAiB,OAAO;EACN;EAClB,GAAI;CACL,CAAA;AAEL"}

package/dist/cjs/pipes-admin.client.d.cts

@@ -4,6 +4,14 @@ import { PipesAdminError, PipesAdminErrorProps, PipesAdminLoading, PipesAdminLoa
 //#region src/pipes-admin.client.d.ts
 interface PipesAdminProps extends WidgetRootDomProps {
   authToken: AuthToken;
+  /**
+   * The acting person's WorkOS user ID for shared API-key and client-credentials
+   * writes with an application credential token. Required for those writes only.
+   * User-backed sessions use the authenticated user; a different ID is rejected.
+   * This prop is not rendered and does not grant authorization. The API validates
+   * identity and organization membership.
+   */
+  userId?: string;
   /**
    * Opt in to the sectioned administrator experience: the connections the
    * organization owns and shares with everyone (which the administrator can

package/dist/esm/api/claims.d.ts

@@ -1,9 +1,14 @@
 //#region src/api/claims.d.ts
 interface Claims {
-  sid: string;
+  sid?: string;
+  sub?: string;
+  sub_type?: string;
+  sub_profile?: string;
+  auth_time?: number;
   permissions?: string[];
   exp?: number;
 }
+export declare function getAuthenticatedUserId(claims: Claims): string | undefined;
 export declare function getClaims(accessToken: string): Claims;
 //#endregion
 //# sourceMappingURL=claims.d.ts.map

package/dist/esm/api/claims.js

@@ -1,8 +1,11 @@
 //#region src/api/claims.ts
+function getAuthenticatedUserId(claims) {
+	return (claims.sub_profile === void 0 || claims.sub_profile === "user") && (claims.sub_type === "authkit" || claims.sub_type === void 0 && !!claims.sid && typeof claims.auth_time === "number") && claims.sub?.startsWith("user_") ? claims.sub : void 0;
+}
 function getClaims(accessToken) {
 	return JSON.parse(atob(accessToken.split(".")[1]));
 }
 //#endregion
-export { getClaims };
+export { getAuthenticatedUserId, getClaims };
 
 //# sourceMappingURL=claims.js.map

package/dist/esm/api/claims.js.map

@@ -1 +1 @@
-{"version":3,"file":"claims.js","names":[],"sources":["../../../src/api/claims.ts"],"sourcesContent":["interface Claims {\n  sid: string;\n  permissions?: string[];\n  exp?: number;\n}\n\nexport function getClaims(accessToken: string): Claims {\n  return JSON.parse(atob(accessToken.split(\".\")[1]));\n}\n"],"mappings":";AAMA,SAAgB,UAAU,aAA6B;CACrD,OAAO,KAAK,MAAM,KAAK,YAAY,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;AACnD"}
+{"version":3,"file":"claims.js","names":[],"sources":["../../../src/api/claims.ts"],"sourcesContent":["interface Claims {\n  sid?: string;\n  sub?: string;\n  sub_type?: string;\n  sub_profile?: string;\n  auth_time?: number;\n  permissions?: string[];\n  exp?: number;\n}\n\nexport function getAuthenticatedUserId(claims: Claims): string | undefined {\n  const isUserSession =\n    (claims.sub_profile === undefined || claims.sub_profile === \"user\") &&\n    (claims.sub_type === \"authkit\" ||\n      (claims.sub_type === undefined &&\n        !!claims.sid &&\n        typeof claims.auth_time === \"number\"));\n\n  return isUserSession && claims.sub?.startsWith(\"user_\")\n    ? claims.sub\n    : undefined;\n}\n\nexport function getClaims(accessToken: string): Claims {\n  return JSON.parse(atob(accessToken.split(\".\")[1]));\n}\n"],"mappings":";AAUA,SAAgB,uBAAuB,QAAoC;CAQzE,QANG,OAAO,gBAAgB,UAAa,OAAO,gBAAgB,YAC3D,OAAO,aAAa,aAClB,OAAO,aAAa,UACnB,CAAC,CAAC,OAAO,OACT,OAAO,OAAO,cAAc,aAEV,OAAO,KAAK,WAAW,OAAO,IAClD,OAAO,MACP;AACN;AAEA,SAAgB,UAAU,aAA6B;CACrD,OAAO,KAAK,MAAM,KAAK,YAAY,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;AACnD"}

package/dist/esm/lib/pipes-credential-attribution.d.ts

@@ -0,0 +1,8 @@
+//#region src/lib/pipes-credential-attribution.d.ts
+export declare const PipesCredentialUserIdContext: import("react").Context<string | undefined>;
+export declare function usePipesCredentialAttribution(): {
+  userId: string | undefined;
+  error: string | undefined;
+};
+//#endregion
+//# sourceMappingURL=pipes-credential-attribution.d.ts.map

package/dist/esm/lib/pipes-credential-attribution.js

@@ -0,0 +1,31 @@
+"use client";
+import { useTranslation } from "./i18n/use-translation.js";
+import { getAuthenticatedUserId, getClaims } from "../api/claims.js";
+import { useApi } from "../api/api-provider.js";
+import { createContext, useContext } from "react";
+//#region src/lib/pipes-credential-attribution.tsx
+const PipesCredentialUserIdContext = createContext(void 0);
+function usePipesCredentialAttribution() {
+	const hostUserId = useContext(PipesCredentialUserIdContext)?.trim();
+	const { authToken } = useApi();
+	const translate = useTranslation();
+	const claims = authToken ? getClaims(authToken) : void 0;
+	const sessionUserId = claims && getAuthenticatedUserId(claims);
+	const userId = sessionUserId ?? (claims?.sub_type === "client_api_credential" && hostUserId?.startsWith("user_") ? hostUserId : void 0);
+	return {
+		userId,
+		error: sessionUserId && hostUserId && hostUserId !== sessionUserId ? translate({
+			defaultMessage: "Shared credentials must be attributed to the signed-in user. The application must omit PipesAdmin's userId prop or pass the signed-in user's WorkOS user ID.",
+			description: "Configuration error when the host-supplied PipesAdmin user ID differs from the authenticated user",
+			id: "pipesCredentialUserMismatch"
+		}) : !userId ? translate({
+			defaultMessage: "Shared credentials require an acting WorkOS user. The application must use a user-backed session or supply the acting person's WorkOS user ID through PipesAdmin's userId prop when using an application credential token.",
+			description: "Configuration guidance for shared credential writes without an acting user; no user ID entry is requested",
+			id: "pipesCredentialUserRequired"
+		}) : void 0
+	};
+}
+//#endregion
+export { PipesCredentialUserIdContext, usePipesCredentialAttribution };
+
+//# sourceMappingURL=pipes-credential-attribution.js.map

package/dist/esm/lib/pipes-credential-attribution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipes-credential-attribution.js","names":[],"sources":["../../../src/lib/pipes-credential-attribution.tsx"],"sourcesContent":["\"use client\";\n\nimport { createContext, useContext } from \"react\";\nimport { useApi } from \"../api/api-provider.js\";\nimport { getAuthenticatedUserId, getClaims } from \"../api/claims.js\";\nimport { useTranslation } from \"./i18n/use-translation.js\";\n\nexport const PipesCredentialUserIdContext = createContext<string | undefined>(\n  undefined,\n);\n\nexport function usePipesCredentialAttribution() {\n  const hostUserId = useContext(PipesCredentialUserIdContext)?.trim();\n  const { authToken } = useApi();\n  const translate = useTranslation();\n  const claims = authToken ? getClaims(authToken) : undefined;\n  const sessionUserId = claims && getAuthenticatedUserId(claims);\n  const userId =\n    sessionUserId ??\n    (claims?.sub_type === \"client_api_credential\" &&\n    hostUserId?.startsWith(\"user_\")\n      ? hostUserId\n      : undefined);\n\n  const error =\n    sessionUserId && hostUserId && hostUserId !== sessionUserId\n      ? translate({\n          defaultMessage:\n            \"Shared credentials must be attributed to the signed-in user. The application must omit PipesAdmin's userId prop or pass the signed-in user's WorkOS user ID.\",\n          description:\n            \"Configuration error when the host-supplied PipesAdmin user ID differs from the authenticated user\",\n          id: \"pipesCredentialUserMismatch\",\n        })\n      : !userId\n        ? translate({\n            defaultMessage:\n              \"Shared credentials require an acting WorkOS user. The application must use a user-backed session or supply the acting person's WorkOS user ID through PipesAdmin's userId prop when using an application credential token.\",\n            description:\n              \"Configuration guidance for shared credential writes without an acting user; no user ID entry is requested\",\n            id: \"pipesCredentialUserRequired\",\n          })\n        : undefined;\n\n  return { userId, error };\n}\n"],"mappings":";;;;;;AAOA,MAAa,+BAA+B,cAC1C,MACF;AAEA,SAAgB,gCAAgC;CAC9C,MAAM,aAAa,WAAW,4BAA4B,CAAC,EAAE,KAAK;CAClE,MAAM,EAAE,cAAc,OAAO;CAC7B,MAAM,YAAY,eAAe;CACjC,MAAM,SAAS,YAAY,UAAU,SAAS,IAAI;CAClD,MAAM,gBAAgB,UAAU,uBAAuB,MAAM;CAC7D,MAAM,SACJ,kBACC,QAAQ,aAAa,2BACtB,YAAY,WAAW,OAAO,IAC1B,aACA;CAqBN,OAAO;EAAE;EAAQ,OAlBf,iBAAiB,cAAc,eAAe,gBAC1C,UAAU;GACR,gBACE;GACF,aACE;GACF,IAAI;EACN,CAAC,IACD,CAAC,SACC,UAAU;GACR,gBACE;GACF,aACE;GACF,IAAI;EACN,CAAC,IACD;CAEe;AACzB"}

package/dist/esm/lib/pipes.js

@@ -18,6 +18,7 @@ import { DataIntegrationIcon } from "./data-integration-icon.js";
 import { myDataIntegrationsQueryKeys, useInvalidateConnections } from "./api/pipes.js";
 import { ADD_CONNECTION, AddConnectionButtonLabel, ConnectAnotherAccountMenuLabel, ConnectionCountStatus, ConnectionNameField, RenameConnectionDialog, RenameMenuLabel, canRenameConnections, createAddConnectionTarget, getConnectionLabel, getConnectionTarget, toAccountDisplayNameInput, toConnectionTargetInput, toCreationTargetInput } from "./pipes-connections.js";
 import { buildRedactedSecret, isRedactedSecret } from "./redacted-secret.js";
+import { usePipesCredentialAttribution } from "./pipes-credential-attribution.js";
 import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import { Callout, Card, Flex, Text } from "@radix-ui/themes";
 import { Fragment, jsx, jsxs } from "react/jsx-runtime";
@@ -744,6 +745,8 @@ const API_KEY_REDACTED_PREFIX = "••••";
 */
 function ApiKeyDialog({ integration, installation = integration.installation, owner = "user", target = getConnectionTarget(installation), open, onOpenChange, onSuccess, collectName = false }) {
 	const invalidateConnections = useInvalidateConnections(owner);
+	const attribution = usePipesCredentialAttribution();
+	const attributionError = owner === "organization" ? attribution.error : void 0;
 	const [name, setName] = useState("");
 	const isRotation = installation?.auth_method === "api_key" && installation.state === "connected";
 	const last4 = installation?.api_key_last_4;
@@ -775,8 +778,13 @@ function ApiKeyDialog({ integration, installation = integration.installation, ow
 			...toCreationTargetInput(target),
 			...collectName ? toAccountDisplayNameInput(name) : {}
 		};
-		if (owner === "organization") organizationUpsert.mutate(input);
-		else userUpsert.mutate(input);
+		if (owner === "organization") {
+			if (attributionError || !attribution.userId) return;
+			organizationUpsert.mutate({
+				...input,
+				userId: attribution.userId
+			});
+		} else userUpsert.mutate(input);
 	};
 	useEffect(() => {
 		reset();
@@ -812,11 +820,11 @@ function ApiKeyDialog({ integration, installation = integration.installation, ow
 					mt: "1",
 					children: integration.description
 				}),
-				error && /* @__PURE__ */ jsx(Callout.Root, {
+				(attributionError || error) && /* @__PURE__ */ jsx(Callout.Root, {
 					my: "3",
 					color: "red",
 					role: "alert",
-					children: /* @__PURE__ */ jsx(Callout.Text, { children: errorMessage ?? /* @__PURE__ */ jsx(Translation, {
+					children: /* @__PURE__ */ jsx(Callout.Text, { children: attributionError ?? errorMessage ?? /* @__PURE__ */ jsx(Translation, {
 						defaultMessage: "An error occurred. Please check the value and try again.",
 						id: "bYLbLL",
 						description: "Generic error message for API key submission failure"
@@ -878,7 +886,7 @@ function ApiKeyDialog({ integration, installation = integration.installation, ow
 						})
 					}) }), /* @__PURE__ */ jsx(Button$1, {
 						type: "button",
-						disabled: isPending || !secret.trim(),
+						disabled: !!attributionError || isPending || !secret.trim(),
 						loading: isPending,
 						onClick: () => upsertApiKey(secret.trim()),
 						children: isRotation ? /* @__PURE__ */ jsx(Translation, {
@@ -929,6 +937,8 @@ function ApiKeyConnectButton({ integration }) {
 */
 function ClientCredentialsDialog({ integration, installation = integration.installation, owner = "user", target = getConnectionTarget(installation), fields, open, onOpenChange, onSuccess, collectName = false }) {
 	const invalidateConnections = useInvalidateConnections(owner);
+	const attribution = usePipesCredentialAttribution();
+	const attributionError = owner === "organization" ? attribution.error : void 0;
 	const [name, setName] = useState("");
 	const isUpdate = installation?.auth_method === "client_credentials";
 	const storedConfig = useMemo(() => isUpdate ? installation?.config ?? {} : {}, [isUpdate, installation?.config]);
@@ -971,6 +981,7 @@ function ClientCredentialsDialog({ integration, installation = integration.insta
 	const { error, isPending } = owner === "organization" ? organizationUpsert : userUpsert;
 	const errorMessage = error instanceof ApiError && error.message ? error.message : null;
 	const handleSubmit = () => {
+		if (attributionError) return;
 		if (!configForm.validate()) return;
 		const config = configForm.isDirty ? configForm.buildConfigPayload(storedConfig) : void 0;
 		const input = {
@@ -981,8 +992,13 @@ function ClientCredentialsDialog({ integration, installation = integration.insta
 			...toCreationTargetInput(target),
 			...collectName ? toAccountDisplayNameInput(name) : {}
 		};
-		if (owner === "organization") organizationUpsert.mutate(input);
-		else userUpsert.mutate(input);
+		if (owner === "organization") {
+			if (!attribution.userId) return;
+			organizationUpsert.mutate({
+				...input,
+				userId: attribution.userId
+			});
+		} else userUpsert.mutate(input);
 	};
 	return /* @__PURE__ */ jsx(Root$1, {
 		open,
@@ -1005,11 +1021,11 @@ function ClientCredentialsDialog({ integration, installation = integration.insta
 						values: { integrationName: integration.name }
 					})
 				}),
-				error && /* @__PURE__ */ jsx(Callout.Root, {
+				(attributionError || error) && /* @__PURE__ */ jsx(Callout.Root, {
 					my: "3",
 					color: "red",
 					role: "alert",
-					children: /* @__PURE__ */ jsx(Callout.Text, { children: errorMessage ?? /* @__PURE__ */ jsx(Translation, {
+					children: /* @__PURE__ */ jsx(Callout.Text, { children: attributionError ?? errorMessage ?? /* @__PURE__ */ jsx(Translation, {
 						defaultMessage: "An error occurred. Please check the value and try again.",
 						id: "bYLbLL",
 						description: "Generic error message for API key submission failure"
@@ -1105,7 +1121,7 @@ function ClientCredentialsDialog({ integration, installation = integration.insta
 						})
 					}) }), /* @__PURE__ */ jsx(Button$1, {
 						type: "button",
-						disabled: isPending || !clientId.trim() || secretMissing || configForm.hasMissingRequired,
+						disabled: !!attributionError || isPending || !clientId.trim() || secretMissing || configForm.hasMissingRequired,
 						loading: isPending,
 						onClick: handleSubmit,
 						children: isUpdate ? /* @__PURE__ */ jsx(Translation, {