{ "schemaVersion": "nexuscrm.appPacks.browserCredentialLaneInventory.v2", "owner": "nexuscrm-app-packs", "pack": "salesforce-crm-standard", "auditedAppPacksCommit": "d81891bb0f9ed47bce2326b53869869bb4056408", "designContract": { "repository": "pingcap-inc/NexusCRM", "path": "docs/design/browser-programmatic-auth-context-split.md", "orderedStep": 3, "issues": ["1865", "1867"] }, "runtimeBehaviorChange": "none", "scope": "Records which app frontend modules depend on which API surface class, and every place the browser credential is read or shipped. A surface class is decided by the leading path segment, which is always literal and always precedes any interpolation, so classification does not depend on reconstructing a full route. This inventory deliberately does not record resolved route strings: the migration acts on surface-class dependencies per module and per endpoint symbol, and an exact-route registry could not be derived soundly from frontend source.", "dataApiBase": "/services/data/v63.0", "targetLaneBySurfaceClass": {"external_identity_provider": "not_nexuscrm_browser_authority", "external_salesforce_identity": "not_nexuscrm_browser_authority", "nexuscrm_oauth_browser_credential": "deferred_to_browser_session_contract", "raw_actions": "programmatic_only", "raw_analytics": "programmatic_only", "raw_application_navigation": "programmatic_only", "raw_connect": "programmatic_only", "raw_data_composite": "programmatic_only", "raw_data_query": "programmatic_only", "raw_data_records": "programmatic_only", "raw_data_search": "programmatic_only", "raw_files": "programmatic_only", "raw_folders": "programmatic_only", "raw_metadata": "programmatic_only", "raw_permissions": "programmatic_only", "raw_platform": "programmatic_only", "raw_process": "programmatic_only", "raw_product_connected_mailbox": "programmatic_only", "raw_product_notifications": "programmatic_only", "raw_recyclebin": "programmatic_only", "raw_service_identity_admin": "programmatic_only", "raw_settings_self_service": "programmatic_only", "raw_tooling": "programmatic_only", "semantic_ui_api": "browser_or_programmatic", "unauthenticated_static_asset": "no_nexuscrm_credential"}, "dataApiSegmentClasses": {"actions": "raw_actions", "analytics": "raw_analytics", "app-navigation": "raw_application_navigation", "chatter": "raw_connect", "composite": "raw_data_composite", "connect": "raw_connect", "files": "raw_files", "folders": "raw_folders", "limits": "raw_platform", "metadata": "raw_metadata", "parameterizedSearch": "raw_data_search", "permissions": "raw_permissions", "process": "raw_process", "query": "raw_data_query", "queryAll": "raw_data_query", "recyclebin": "raw_recyclebin", "search": "raw_data_search", "sobjects": "raw_data_records", "theme": "raw_platform", "tooling": "raw_tooling", "ui-api": "semantic_ui_api"}, "otherPrefixClasses": {"/api/connected-mailboxes": "raw_product_connected_mailbox", "/product/": "raw_product_notifications", "/services/identity-sync/": "raw_service_identity_admin", "/services/settings/": "raw_settings_self_service", "/sf-instance/": "external_salesforce_identity", "/sf-oauth/": "external_salesforce_identity", "/version.json": "unauthenticated_static_asset"}, "leadingSegmentClosure": { "networkPrefixes": ["/services/", "/product/", "/api/", "/sf-oauth/", "/sf-instance/", "/version.json"], "uiRouterSegments": ["", "analytics", "app", "approval-processes", "approvals", "chatter", "dashboard", "dashboards", "default", "flow", "flows", "help", "lightning", "login", "object", "recyclebin", "reports", "search", "settings", "setup", "studio", "web", "{param}"] }, "interpolatedBaseOrigins": {"authBaseUrl": "external_provider", "issuer": "first_party_backend", "proxyPath": "external_provider", "request.authorizationBaseUrl": "external_provider", "request.oauthProxyBasePath": "external_provider"}, "absoluteHostClasses": {"http://www.w3.org": "specification_reference_host", "https://": "documentation_or_placeholder_host", "https://...": "documentation_or_placeholder_host", "https://accounts.google.com": "external_identity_provider_host", "https://example.com": "documentation_or_placeholder_host", "https://expr-lang.org": "specification_reference_host", "https://instance.example.com": "documentation_or_placeholder_host", "https://login.salesforce.com": "external_identity_provider_host", "https://navigation.invalid": "url_parser_base_only", "https://test.salesforce.com": "external_identity_provider_host", "https://via.placeholder.com": "documentation_or_placeholder_host", "https://your-nexuscrm-host": "documentation_or_placeholder_host", "https://your-org.example.com": "documentation_or_placeholder_host", "https://your-org.my.salesforce.com": "documentation_or_placeholder_host", "https://yourcompany.my.salesforce.com": "documentation_or_placeholder_host", "https://{param}.my.salesforce.com": "external_identity_provider_host"}, "symbolsBySurfaceClass": { "nexuscrm_oauth_browser_credential": ["API_ENDPOINTS.AUTH.AUTHORIZE_RESUME", "API_ENDPOINTS.AUTH.CHANGE_PASSWORD", "API_ENDPOINTS.AUTH.FORGOT_PASSWORD", "API_ENDPOINTS.AUTH.GOOGLE_LOGIN_STATE", "API_ENDPOINTS.AUTH.GOOGLE_TOKEN", "API_ENDPOINTS.AUTH.LOGIN", "API_ENDPOINTS.AUTH.LOGIN_OPTIONS", "API_ENDPOINTS.AUTH.LOGOUT", "API_ENDPOINTS.AUTH.ME", "API_ENDPOINTS.AUTH.RESET_PASSWORD"], "raw_actions": ["API_ENDPOINTS.ACTIONS.CHANGE_OWNER", "API_ENDPOINTS.ACTIONS.CREATE_RECORD", "API_ENDPOINTS.ACTIONS.CUSTOM", "API_ENDPOINTS.ACTIONS.EXECUTE", "API_ENDPOINTS.ACTIONS.LIST_ALL", "API_ENDPOINTS.ACTIONS.OUTPUT_PREVIEW", "API_ENDPOINTS.ACTIONS.STANDARD", "API_ENDPOINTS.ACTIONS.STANDARD_PREVIEW", "API_ENDPOINTS.FLOWS.EXECUTE", "API_ENDPOINTS.FLOWS.LIST"], "raw_analytics": ["API_ENDPOINTS.ANALYTICS.REFRESH_DASHBOARD", "API_ENDPOINTS.ANALYTICS.REPORT", "API_ENDPOINTS.ANALYTICS.REPORTS", "API_ENDPOINTS.ANALYTICS.REPORT_DESCRIBE", "API_ENDPOINTS.ANALYTICS.REPORT_EXECUTE", "API_ENDPOINTS.ANALYTICS.REPORT_EXECUTION", "API_ENDPOINTS.DATA.ANALYTICS", "API_ENDPOINTS.METADATA.DASHBOARD", "API_ENDPOINTS.METADATA.DASHBOARDS"], "raw_connect": ["API_ENDPOINTS.CONNECT.CURRENT_USER", "API_ENDPOINTS.CONNECT.NEWS_FEED", "API_ENDPOINTS.CONNECT.NOTIFICATIONS", "API_ENDPOINTS.CONNECT.USER_FILES", "API_ENDPOINTS.CONNECT.USER_FOLLOWERS", "API_ENDPOINTS.CONNECT.USER_FOLLOWING"], "raw_data_composite": ["API_ENDPOINTS.COMPOSITE.BATCH", "API_ENDPOINTS.COMPOSITE.REQUEST", "API_ENDPOINTS.COMPOSITE.SOBJECTS", "API_ENDPOINTS.COMPOSITE.TREE"], "raw_data_query": ["API_ENDPOINTS.DATA.QUERY", "API_ENDPOINTS.DATA.QUERY_ALL", "API_ENDPOINTS.FLOWS.INTERVIEWS"], "raw_data_records": ["API_ENDPOINTS.DATA.RECORD", "API_ENDPOINTS.DATA.RECORDS", "API_ENDPOINTS.DATA.RELEVANT_ITEMS", "API_ENDPOINTS.DATA.RELEVANT_ITEMS_FILTERED", "API_ENDPOINTS.FILES.UPLOAD", "API_ENDPOINTS.FLOWS.INTERVIEW", "API_ENDPOINTS.METADATA.ACTIONS", "API_ENDPOINTS.METADATA.DESCRIBE_LAYOUTS", "API_ENDPOINTS.METADATA.FIELDS", "API_ENDPOINTS.METADATA.FIELD_TYPES", "API_ENDPOINTS.METADATA.LIST_VIEW", "API_ENDPOINTS.METADATA.LIST_VIEWS", "API_ENDPOINTS.METADATA.LIST_VIEW_DESCRIBE", "API_ENDPOINTS.METADATA.LIST_VIEW_FOR_OBJECT", "API_ENDPOINTS.METADATA.OBJECTS"], "raw_data_search": ["API_ENDPOINTS.DATA.PARAMETERIZED_SEARCH", "API_ENDPOINTS.DATA.SEARCH", "API_ENDPOINTS.DATA.SEARCH_LAYOUT", "API_ENDPOINTS.DATA.SEARCH_OBJECT", "API_ENDPOINTS.DATA.SEARCH_SCOPE_ORDER", "API_ENDPOINTS.DATA.SUGGESTIONS"], "raw_files": ["API_ENDPOINTS.FILES.DELETE", "API_ENDPOINTS.FILES.DOWNLOAD", "API_ENDPOINTS.FILES.RECORD_UPLOAD"], "raw_folders": ["API_ENDPOINTS.FOLDERS.CHILDREN", "API_ENDPOINTS.FOLDERS.FOLDER", "API_ENDPOINTS.FOLDERS.LIST", "API_ENDPOINTS.FOLDERS.SHARE", "API_ENDPOINTS.FOLDERS.SHARES"], "raw_metadata": ["API_ENDPOINTS.METADATA.APPLICATION_DEFINITIONS", "API_ENDPOINTS.METADATA.FIELD", "API_ENDPOINTS.METADATA.OBJECTS_AUTHORING", "API_ENDPOINTS.METADATA.OBJECT_SCHEMA", "API_ENDPOINTS.METADATA.SEARCH_SCOPE_ORDER", "API_ENDPOINTS.METADATA.UPDATE_OBJECT", "API_ENDPOINTS.METADATA.VALIDATION_RULE", "API_ENDPOINTS.METADATA.VALIDATION_RULES", "API_ENDPOINTS.METADATA.VALIDATION_RULES_BY_OBJECT", "API_ENDPOINTS.METADATA.VALIDATION_RULE_COLLECTION"], "raw_permissions": ["API_ENDPOINTS.PERMISSIONS.EFFECTIVE"], "raw_platform": ["API_ENDPOINTS.LIMITS", "API_ENDPOINTS.METADATA.THEMES"], "raw_process": ["API_ENDPOINTS.APPROVALS.CLONE", "API_ENDPOINTS.APPROVALS.NOTIFICATION_FLOWS", "API_ENDPOINTS.APPROVALS.PENDING", "API_ENDPOINTS.APPROVALS.RECORD_INSTANCE", "API_ENDPOINTS.APPROVALS.RECORD_STEP_DISPLAY", "API_ENDPOINTS.APPROVALS.SUBMIT", "API_ENDPOINTS.PROCESS.RULES", "API_ENDPOINTS.PROCESS.RULES_FOR_OBJECT"], "raw_recyclebin": ["API_ENDPOINTS.DATA.PURGE", "API_ENDPOINTS.DATA.RECYCLE_BIN", "API_ENDPOINTS.DATA.RESTORE"], "raw_tooling": ["API_ENDPOINTS.FLOWS.DEFINITION", "API_ENDPOINTS.FLOWS.DEFINITIONS", "API_ENDPOINTS.FLOWS.DEFINITIONS_COLLECTION", "API_ENDPOINTS.FLOWS.DEFINITION_QUERY", "API_ENDPOINTS.FLOWS.TEST_COVERAGE", "API_ENDPOINTS.FLOWS.VERSION", "API_ENDPOINTS.FLOWS.VERSIONS", "API_ENDPOINTS.FLOWS.VERSIONS_BY_DEFINITION", "API_ENDPOINTS.METADATA.APPS", "API_ENDPOINTS.METADATA.CREATE_FIELD", "API_ENDPOINTS.METADATA.CREATE_OBJECT", "API_ENDPOINTS.METADATA.TOOLING_QUERY"], "semantic_ui_api": ["API_ENDPOINTS.DATA.RELATED_LIST_CANDIDATES", "API_ENDPOINTS.DATA.RELATED_LIST_COUNTS", "API_ENDPOINTS.METADATA.LAYOUT", "API_ENDPOINTS.UI.APPS", "API_ENDPOINTS.UI.LIST_INFO", "API_ENDPOINTS.UI.NAV_ITEMS", "API_ENDPOINTS.UI.OBJECT_INFO", "API_ENDPOINTS.UI.RECORD_ACCESS", "API_ENDPOINTS.UI.RECORD_DEFAULTS_CLONE", "API_ENDPOINTS.UI.RECORD_DEFAULTS_CREATE", "API_ENDPOINTS.UI.RECORD_UI"] }, "modulesBySurfaceClass": { "raw_application_navigation": ["src/platform/infrastructure/api/application-navigation.ts"], "external_identity_provider": ["src/platform/infrastructure/api/auth.ts", "src/register.tsx"], "external_salesforce_identity": ["src/platform/infrastructure/api/auth.ts", "src/platform/infrastructure/api/client.ts", "src/register.tsx"], "nexuscrm_oauth_browser_credential": ["src/platform/infrastructure/api/approvals.ts", "src/platform/infrastructure/api/auth.ts", "src/platform/infrastructure/api/metadataDeploy.ts"], "raw_actions": ["src/platform/infrastructure/api/actions.ts", "src/platform/infrastructure/api/data/actions.ts", "src/platform/infrastructure/api/flows/execution.ts", "src/send-record-email-modal.tsx", "src/task-activity-quick-create-modal.tsx"], "raw_analytics": ["src/platform/infrastructure/api/analytics.ts", "src/platform/infrastructure/api/dashboards.ts"], "raw_connect": ["src/platform/infrastructure/api/chatter.ts", "src/platform/infrastructure/api/data/actions.ts"], "raw_data_composite": ["src/platform/infrastructure/api/app-adapters.ts", "src/platform/infrastructure/api/composite.ts", "src/platform/infrastructure/api/data/collections.ts", "src/platform/infrastructure/api/schemas.ts"], "raw_data_query": ["src/platform/infrastructure/api/approvals.ts", "src/platform/infrastructure/api/data/analyticsData.ts", "src/platform/infrastructure/api/data/query.ts", "src/platform/infrastructure/api/flows/execution.ts", "src/platform/infrastructure/api/folders.ts", "src/platform/infrastructure/api/metadataDeploy.ts", "src/platform/infrastructure/api/salesforce-application.ts"], "raw_data_records": ["src/platform/infrastructure/api/actions.ts", "src/platform/infrastructure/api/approvals.ts", "src/platform/infrastructure/api/chatter.ts", "src/platform/infrastructure/api/data/crud.ts", "src/platform/infrastructure/api/data/recordUtils.ts", "src/platform/infrastructure/api/data/search.ts", "src/platform/infrastructure/api/email-templates.ts", "src/platform/infrastructure/api/files.ts", "src/platform/infrastructure/api/flows/execution.ts", "src/platform/infrastructure/api/schemas.ts", "src/platform/infrastructure/api/users.ts"], "raw_data_search": ["src/platform/infrastructure/api/data/search.ts"], "raw_files": ["src/platform/infrastructure/api/files.ts"], "raw_folders": ["src/platform/infrastructure/api/folders.ts", "src/platform/pages/FolderShareManager.tsx"], "raw_metadata": ["src/platform/features/studio/components/FormulaFieldEditor.tsx", "src/platform/infrastructure/api/layoutAuthoring.ts", "src/platform/infrastructure/api/metadata.ts", "src/platform/infrastructure/api/metadataDeploy.ts", "src/platform/infrastructure/api/schemas.ts"], "raw_permissions": ["src/platform/infrastructure/api/effectivePermissions.ts", "src/platform/infrastructure/api/permissionAuthoring.ts", "src/platform/infrastructure/api/users.ts"], "raw_process": ["src/platform/infrastructure/api/approvals.ts", "src/platform/infrastructure/api/flows/execution.ts"], "raw_product_connected_mailbox": ["src/register.tsx"], "raw_product_notifications": ["src/platform/infrastructure/api/notifications.ts"], "raw_recyclebin": ["src/platform/infrastructure/api/data/recycleBin.ts"], "raw_service_identity_admin": ["src/platform/infrastructure/api/identitySync.ts"], "raw_settings_self_service": ["src/platform/infrastructure/api/apiTokens.ts", "src/platform/infrastructure/api/connections.ts"], "raw_tooling": ["src/platform/infrastructure/api/app-adapters.ts", "src/platform/infrastructure/api/data/search.ts", "src/platform/infrastructure/api/flows/definitions.ts", "src/platform/infrastructure/api/flows/execution.ts", "src/platform/infrastructure/api/flows/versions.ts", "src/platform/infrastructure/api/metadataDeploy.ts", "src/platform/infrastructure/api/salesforce-application.ts", "src/platform/infrastructure/api/schemas.ts"], "semantic_ui_api": ["src/platform/features/record/components/RelatedListQuickLinks.tsx", "src/platform/infrastructure/api/data/crud.ts", "src/platform/infrastructure/api/metadata.ts", "src/platform/infrastructure/api/schemas.ts", "src/platform/infrastructure/api/ui.ts"], "unauthenticated_static_asset": ["src/platform/core/hooks/useVersionCheck.ts"] }, "currentBrowserCredential": { "storage": "localStorage", "storedTokenSymbol": "STORAGE_KEYS.AUTH_TOKEN", "shippedFirstPartySecretLiteral": "nexuscrm-ui-internal", "summary": "First-party browser requests have one JS-readable NexusCRM Bearer seam in APIClient; external-provider bearer seams remain separate. The first-party password grant additionally ships a hardcoded client secret from browser code. Seams are derived, not spot-checked.", "bearerSeamRule": "credentialClass is nexuscrm_browser_bearer exactly when storedTokenAccessCount is above zero", "clientSecretRule": "a file containing the shipped first-party secret literal is first_party_browser_client_secret; a file whose client_secret mentions are all client_secret_post only names an OAuth auth method", "bearerSeams": [ {"path": "src/platform/infrastructure/api/auth.ts", "storedTokenAccessCount": 0, "bearerInjectionCount": 1, "credentialClass": "external_provider_bearer"}, {"path": "src/platform/infrastructure/api/client.ts", "storedTokenAccessCount": 5, "bearerInjectionCount": 1, "credentialClass": "nexuscrm_browser_bearer"}, {"path": "src/register.tsx", "storedTokenAccessCount": 0, "bearerInjectionCount": 1, "credentialClass": "external_provider_bearer"} ], "clientSecretSeams": [ {"declaringSource": "src/platform/components/auth/LoginScreen.tsx", "occurrences": 1, "credentialClass": "external_provider_client_secret"}, {"declaringSource": "src/platform/infrastructure/api/auth.ts", "occurrences": 8, "credentialClass": "first_party_browser_client_secret"}, {"declaringSource": "src/platform/pages/ConnectedAppManager.tsx", "occurrences": 4, "credentialClass": "oauth_auth_method_name"}, {"declaringSource": "src/register.tsx", "occurrences": 2, "credentialClass": "external_provider_client_secret"} ] }, "indirectEndpointSeams": [ {"declaringSource": "src/convert-lead-modal.tsx", "symbol": "actionEndpoint", "declarationCount": 1, "kind": "action_executor_parameter"}, {"declaringSource": "src/convert-lead-modal.tsx", "symbol": "actionPreviewEndpoint", "declarationCount": 1, "kind": "action_executor_parameter"}, {"declaringSource": "src/convert-lead-modal.tsx", "symbol": "endpoint", "declarationCount": 1, "kind": "metadata_owned_action_endpoint"}, {"declaringSource": "src/convert-lead-modal.tsx", "symbol": "previewEndpoint", "declarationCount": 1, "kind": "metadata_owned_action_endpoint"}, {"declaringSource": "src/create-record-from-source-modal.tsx", "symbol": "actionEndpoint", "declarationCount": 1, "kind": "action_executor_parameter"}, {"declaringSource": "src/create-record-from-source-modal.tsx", "symbol": "actionPreviewEndpoint", "declarationCount": 1, "kind": "action_executor_parameter"}, {"declaringSource": "src/create-record-from-source-modal.tsx", "symbol": "endpoint", "declarationCount": 1, "kind": "metadata_owned_action_endpoint"}, {"declaringSource": "src/create-record-from-source-modal.tsx", "symbol": "previewEndpoint", "declarationCount": 1, "kind": "metadata_owned_action_endpoint"}, {"declaringSource": "src/platform/infrastructure/api/actions.ts", "symbol": "endpoint", "declarationCount": 1, "kind": "metadata_owned_action_endpoint"}, {"declaringSource": "src/platform/infrastructure/api/actions.ts", "symbol": "previewEndpoint", "declarationCount": 1, "kind": "metadata_owned_action_endpoint"}, {"declaringSource": "src/platform/infrastructure/api/client.ts", "symbol": "endpoint", "declarationCount": 8, "kind": "transport_parameter"}, {"declaringSource": "src/platform/infrastructure/api/data/actions.ts", "symbol": "actionEndpoint", "declarationCount": 1, "kind": "action_executor_parameter"}, {"declaringSource": "src/platform/infrastructure/api/data/actions.ts", "symbol": "actionPreviewEndpoint", "declarationCount": 1, "kind": "action_executor_parameter"}, {"declaringSource": "src/platform/infrastructure/api/flows/definitions.ts", "symbol": "endpoint", "declarationCount": 1, "kind": "transport_parameter"}, {"declaringSource": "src/send-record-email-modal.tsx", "symbol": "actionEndpoint", "declarationCount": 2, "kind": "action_executor_parameter"}, {"declaringSource": "src/send-record-email-modal.tsx", "symbol": "endpoint", "declarationCount": 1, "kind": "metadata_owned_action_endpoint"}, {"declaringSource": "src/task-activity-quick-create-modal.tsx", "symbol": "actionEndpoint", "declarationCount": 1, "kind": "action_executor_parameter"}, {"declaringSource": "src/task-activity-quick-create-modal.tsx", "symbol": "endpoint", "declarationCount": 1, "kind": "metadata_owned_action_endpoint"} ], "declarationSeams": [ {"id": "api_endpoints_module", "path": "src/platform/infrastructure/api/endpoints.ts", "symbol": "API_ENDPOINTS", "derivation": "runtime_walk", "symbolCount": 118}, {"id": "identity_sync_endpoints_module", "path": "src/platform/infrastructure/api/identitySync.ts", "symbol": "IDENTITY_SYNC_ENDPOINTS", "derivation": "source_scan"}, {"id": "product_notification_endpoints_module", "path": "src/platform/infrastructure/api/notifications.ts", "symbol": "PRODUCT_NOTIFICATION_ENDPOINTS", "derivation": "source_scan"}, {"id": "settings_connections_endpoint_module", "path": "src/platform/infrastructure/api/connections.ts", "symbol": "BASE_ENDPOINT", "derivation": "source_scan"}, {"id": "settings_api_tokens_endpoint_module", "path": "src/platform/infrastructure/api/apiTokens.ts", "symbol": "BASE_ENDPOINT", "derivation": "source_scan"} ], "derivationPreconditions": [ {"id": "no_endpoint_map_aliasing", "statement": "API_ENDPOINTS is always referenced by its full dotted path. Destructuring, reassignment, or computed member access would make symbol references undecidable, so the guard fails if any appears."}, {"id": "interpolations_fully_consumed", "statement": "Flattening must consume every interpolation in every literal. A leftover ${ means the scan lost track of the literal."}, {"id": "every_network_path_classifies", "statement": "Every network-prefixed path literal must resolve to a declared surface class from its leading segment."}, {"id": "leading_segment_closure", "statement": "Every absolute path literal must start with a declared network prefix or a declared UI router segment, so a surface under a brand-new prefix cannot pass unrecorded."}, {"id": "absolute_host_closure", "statement": "Every absolute http(s) URL literal must have a declared host class, so an external destination reached by absolute URL rather than by app-relative path cannot pass unrecorded. An identity provider host is a provider-establishment surface even though it is never an app-relative route."} ], "migrationBlockers": [ {"id": "runtime_supplied_action_endpoints", "statement": "StandardAction.endpoint and previewEndpoint are server-authoritative, so the reached route is not decidable from frontend source. Their declarations are enumerated in indirectEndpointSeams; the routes must be bounded at the backend registration boundary and by the step 7 dialect annotation.", "requiredBeforeBrowserMigration": "classify metadata-owned action routes at the backend registration boundary"}, {"id": "shipped_first_party_client_secret", "statement": "The first-party password grant still sends a hardcoded client secret from browser code, so the browser ships a credential in addition to holding a JS-readable bearer. Removing it is a later ordered step.", "requiredBeforeBrowserMigration": "remove the built-in browser secret in its own ordered step"}, {"id": "surface_class_granularity", "statement": "Migration slices act on surface-class dependencies per module and per endpoint symbol. Changing a route within the same surface class does not change this inventory, which is intended: an exact-route registry cannot be soundly derived from frontend source, and claiming one produced false precision.", "requiredBeforeBrowserMigration": "use the backend route inventory for exact-route facts"}, {"id": "external_identity_lane_separation", "statement": "The frontend also reaches an external Salesforce IdP and org instance proxy. The same OAuth path is first-party when built from the NexusCRM issuer and external when built from the Salesforce proxy or login host, so both lanes appear and must stay distinct.", "requiredBeforeBrowserMigration": "keep external identity admission distinct from the NexusCRM browser session"} ] }