// ---------------------------------------------------------------------------// The owner a provider item id embeds — the single parser for the id grammar// the SDK constructs (accessItemId in oauth-service.ts, the connection value// ids in executor.ts, the oauth-client secret ids):////   connection:<owner>:<integration>:<name>:<variable>//   oauth:<owner>:<integration>:<name>[:refresh]//   oauth-client:<owner>:<slug>:secret//// Credential providers file plugin-storage rows by THIS owner, not the acting// caller's binding — an org connection whose OAuth consent completes in one// member's browser session must produce rows every member can resolve// (issues #950, #1453).// --------------------------------------------------------------------------- import { Owner } from "./ids";import type { OwnerBinding } from "./plugin"; /** Item-id prefixes whose SECOND colon-segment is the owning partition. */export const OWNER_SCOPED_ITEM_ID_PREFIXES: ReadonlySet<string> = new Set([  "connection",  "oauth",  "oauth-client",]); /** The owner a logical item id embeds, or null for ids that carry none *  (legacy random `secret_*` ids). Reads the second colon-segment of the *  owner-scoped prefixes. */export const embeddedItemOwner = (id: string): Owner | null => {  const [prefix, owner] = id.split(":");  if (OWNER_SCOPED_ITEM_ID_PREFIXES.has(prefix ?? "") && (owner === "org" || owner === "user")) {    return Owner.make(owner);  }  return null;}; /** Map the executor's (tenant, subject?) binding onto the storage `Owner` *  literal: a bound subject writes the user's own partition, otherwise the *  org-shared one. Fallback only — prefer `ownerForItemId`. */const ownerOf = (binding: OwnerBinding): Owner =>  binding.subject == null ? Owner.make("org") : Owner.make("user"); /** The partition a credential belongs to: the CREDENTIAL's owner (embedded in *  the item id), not the acting caller's binding. Ids without an embedded *  owner fall back to the caller binding. */export const ownerForItemId = (id: string, binding: OwnerBinding): Owner =>  embeddedItemOwner(id) ?? ownerOf(binding);