viq.guardian.contract 6.2.1

## v6.2.1 (2026-07-23) ### Added - POST /connect/tenant-token — per-tenant SF package machine token (sf-integration-{tenant}); JWT azp stays tenant-specific - GET /connect/sf-integration-credentials — authorized retrieve of AES-decrypted SF machine credentials - UpsertSpaceGateTenant provisions sf-integration machine user, secret, and CRMDetails credentials - Redis index ClientIdx:ZitadelSfClientId for tenant-token client lookup (no cache scan) ### Changed - ZitadelSfClientSecret stored as AES-GCM (SecretFieldEncryption), same as CRM/user tokens - X-RP-User-Email enrichment for sf-integration / Apex clients → X-Login-UserId - Shared UamUserIdFromEmailResolver in viq.guardian.addon (replaces per-host copies) ### Unchanged - POST /connect/token (viqconfig M2M) - POST /connect/openctitoken and /connect/sfclienttoken (viqapex user-token flows) ## v6.2.0 (2026-07-10) ### Added - SpaceGate (ZITADEL) JWT validation, claim enrichment, and scope authorization in viq.guardian.addon - SpaceGate client credential, SF integration, and user-bridge token flows in viq.guardian - Zitadel identity column support aligned with viq.services.datastore.postgres 6.1.0 ## v6.1.0 ### Changed - Auth token encryption added to the application