credentials
Generated by the pinned ess generate --kind docs from ess. Structural validation establishes consistency; behaviour, storage and cross-record predicates remain implementation obligations.
Host-private immutable credential snapshot identities shared by refresh and evidence.
connectors.credentials is one of connectors's bounded contexts. Back to the index.
Types
ConnectionBinding
connectors.credentials.ConnectionBinding is a record of four fields:
instance_id—Stringconnection_ref—Stringprofile_ref—Stringprovider_authority—String
CredentialGenerationId
connectors.credentials.CredentialGenerationId wraps Uuid and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses.
ExternalIdentity
connectors.credentials.ExternalIdentity is a record of two fields:
kind—Stringsubject—String
Entities
An entity is what this context is about: something with an identity that outlives any one request, a shape, and a lifecycle. The lifecycle is exhaustive — a move that is not drawn below is a move this specification does not permit, and that is the only way it says so. Every move is labelled with the command that takes it, because a move nothing can trigger is refused rather than drawn.
CredentialGeneration
connectors.credentials.CredentialGeneration.
An instance is identified by generation_id, a connectors.credentials.CredentialGenerationId. The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view.
It holds:
instance_id—Stringconnection_ref—Stringprofile_ref—Stringprovider_authority—Stringcaptured_snapshot_ref—Stringexpected_external_identity—connectors.credentials.ExternalIdentity
It references at most one connectors.auth_bindings.Connection, as connection, carried by CredentialGeneration.connection_ref. It references at most one connectors.declarations.ServiceConfiguration, as instance, carried by CredentialGeneration.instance_id.
No invariant is declared, so nothing here constrains an instance at rest.
Its state is a connectors.credentials.CredentialGeneration.State, one of Captured. That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree.
An instance is created in Captured. Captured is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which.
It declares no moves, so nothing changes its state once it exists.
It has one state, so there is no move to permit or to forbid.
One view projects it: CredentialGenerations.
Views
A view is what the outside world is promised it can observe. Each one says which instances it contains and how soon it reflects a command that has already returned, because "you can read this" without "how soon" is the promise every flaky suite is built on.
CredentialGenerations
connectors.credentials.CredentialGenerations.
It reads CredentialGeneration.
It contains every instance of that entity: no filter narrows it, which is a decision somebody made and not a line somebody omitted.
It exposes:
generation_id—connectors.credentials.CredentialGenerationIdinstance_id—Stringconnection_ref—Stringprofile_ref—Stringprovider_authority—Stringcaptured_snapshot_ref—Stringstate—connectors.credentials.CredentialGeneration.State
It declares no order, so the rows come back in whatever order the implementation has, and two reads may disagree.
Read-your-writes: it is current the moment the command that changed it returns. A caller that has just created an invoice and cannot see it in here has been told a lie about what it did.
A generated scenario asserts it once, immediately after the command: a view promising this and not keeping the promise has to fail the suite rather than be retried until it passes.
Commands
RecordCredentialGeneration
connectors.credentials.RecordCredentialGeneration.
It takes:
generation_id—connectors.credentials.CredentialGenerationIdinstance_id—Stringconnection_ref—Stringprofile_ref—Stringprovider_authority—Stringcaptured_snapshot_ref—Stringexpected_external_identity—connectors.credentials.ExternalIdentity
It has one outcome.
recorded — The default branch, taken when no other outcome's condition matched. It creates a connectors.credentials.CredentialGeneration, which starts in Captured. The new instance's identity is published as generation_id on connectors.credentials.CredentialGenerationRecorded. It emits connectors.credentials.CredentialGenerationRecorded. It sets instance_id from input.instance_id, connection_ref from input.connection_ref, profile_ref from input.profile_ref, provider_authority from input.provider_authority, captured_snapshot_ref from input.captured_snapshot_ref and expected_external_identity from input.expected_external_identity. A test reaches it by constructing an input that satisfies no other outcome's condition.
Events
CredentialGenerationRecorded
connectors.credentials.CredentialGenerationRecorded.
It carries:
generation_id—connectors.credentials.CredentialGenerationId
Emitted by connectors.credentials.RecordCredentialGeneration on its recorded outcome.
Nothing in this system reacts to it.
Actors
An actor is who may ask this context for something. Every grant below points at a command this specification declares — a grant is a resolved reference, so "may invoke" something nobody wrote is not a permission this model can express, and an authorisation that authorises nothing cannot ship quietly.
LocalHost
connectors.credentials.LocalHost.
It may invoke RecordCredentialGeneration.
Generated from connectors v1 · model digest e1e1672d0af4753cb8f2da6c0b22a7f6ae8ce9f7abc168f86169babdf1325787 · contract digest slice-sha256/2:2805b1e77629b2fb519c9b7008d6fe993823c101818aa03e1c9309edbb7573c6. Do not edit this file; change the specification and regenerate it with ess generate.