@cat-factory/server 0.222.2 → 0.224.0

package/dist/config/types.d.ts

@@ -67,8 +67,46 @@ export interface GoogleOAuthConfig {
     /** Userinfo API base; defaults to Google's. */
     apiBase?: string;
 }
+/**
+ * The deployment's OWN identity provider (enterprise SSO), present only when configured.
+ *
+ * One generic OpenID Connect adapter serves every enterprise IdP — Okta, Entra ID, Auth0,
+ * Keycloak, PingFederate, OneLogin, JumpCloud, a Shibboleth IdP with the OIDC OP plugin —
+ * because a discovery document plus a client id/secret IS the configuration. There is
+ * deliberately no per-vendor field here: a vendor name would only ever be a label.
+ *
+ * Built by {@link resolveSsoConfig}, which both facades call, so the parsing and every boot
+ * refusal live in ONE place rather than being restated per runtime.
+ */
+export interface SsoConfig {
+    /**
+     * The issuer / discovery base URL as the operator typed it (`AUTH_SSO_ISSUER_URL`). The
+     * DISCOVERED `issuer` is authoritative for everything downstream (the identity subject, the
+     * `iss` check); this value only locates the document and keys its cache entry.
+     */
+    issuerUrl: string;
+    clientId: string;
+    clientSecret: string;
+    /** Operator-supplied sign-in button label. Never localized: it names their IdP. */
+    label: string;
+    /** Space-separated scopes requested. Always contains `openid`. */
+    scopes: string;
+    /** Explicit redirect_uri; '' means derive `${origin}/auth/sso/callback`. */
+    redirectUrl: string;
+    /**
+     * Lowercased email domains admitted. EMPTY is the normal, correct state and means the IdP's
+     * own app assignment is the whole allowlist — which is the point of SSO, and why this is not
+     * fail-closed the way the GitHub login/org lists are: refusing everyone until an operator
+     * restates their directory here would defeat the feature they adopted SSO to get.
+     */
+    allowedEmailDomains: string[];
+    /** The claim holding group memberships (`groups` by default; Entra/Shibboleth vary). */
+    groupsClaim: string;
+    /** Lowercased group values admitted. Empty ⇒ no group gate. */
+    requiredGroups: string[];
+}
 export interface AuthConfig {
-    /** True when ANY login provider (GitHub OAuth / password / Google) is configured. */
+    /** True when ANY login provider (GitHub OAuth / password / Google / SSO) is configured. */
     enabled: boolean;
     /** Local-dev/test ONLY: permit running with auth unconfigured (open API). */
     devOpen: boolean;
@@ -118,6 +156,8 @@ export interface AuthConfig {
     openSignup: boolean;
     /** Google OAuth config, present only when configured. */
     google?: GoogleOAuthConfig;
+    /** Enterprise SSO (generic OIDC) config, present only when configured. */
+    sso?: SsoConfig;
     /**
      * Lowercased email domains permitted to self-signup (password/Google) without an
      * invite. Empty ⇒ new-user creation is invite-only (the default, fail-closed).

package/dist/config/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/config/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,KAAK,EACV,0BAA0B,EAC1B,eAAe,EACf,WAAW,EACX,WAAW,EACX,mBAAmB,EACnB,2BAA2B,EAC5B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACpF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAA;AACzE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAOtD,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,YAAY,CAAA;IACrB;;;;;;OAMG;IACH,iBAAiB,EAAE,CACjB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,kBAAkB,CAAC,EAAE,SAAS,WAAW,EAAE,KACxC,QAAQ,GAAG,SAAS,CAAA;IACzB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAA;CAC9C;AAED,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAA;IACvB,kFAAkF;IAClF,eAAe,EAAE,MAAM,CAAA;IACvB,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAA;IACnB,sFAAsF;IACtF,uBAAuB,EAAE,MAAM,CAAA;IAC/B,mFAAmF;IACnF,cAAc,EAAE,MAAM,CAAA;IACtB,0EAA0E;IAC1E,UAAU,EAAE,MAAM,CAAA;IAClB,sEAAsE;IACtE,iBAAiB,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,8EAA8E;IAC9E,gBAAgB,EAAE,MAAM,CAAA;IACxB,2FAA2F;IAC3F,aAAa,EAAE,MAAM,CAAA;IACrB,gFAAgF;IAChF,aAAa,CAAC,EAAE,mBAAmB,CAAA;CACpC;AAED,wFAAwF;AACxF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAA;IACnB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,qFAAqF;IACrF,OAAO,EAAE,OAAO,CAAA;IAChB,6EAA6E;IAC7E,OAAO,EAAE,OAAO,CAAA;IAChB;;;;;;;OAOG;IACH,aAAa,EAAE,OAAO,CAAA;IACtB,oEAAoE;IACpE,aAAa,EAAE,OAAO,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;IACrB,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAA;IACf,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAA;IACjB,8CAA8C;IAC9C,YAAY,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,CAAA;IACzB,8EAA8E;IAC9E,kBAAkB,EAAE,MAAM,CAAA;IAC1B,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAA;IACnB,2EAA2E;IAC3E,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,sFAAsF;IACtF,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,2FAA2F;IAC3F,sBAAsB,EAAE,MAAM,EAAE,CAAA;IAChC,wDAAwD;IACxD,eAAe,EAAE,OAAO,CAAA;IACxB;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAA;IACnB,yDAAyD;IACzD,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B;;;OAGG;IACH,mBAAmB,EAAE,MAAM,EAAE,CAAA;IAC7B;;;;;;;;;;OAUG;IACH,iBAAiB,EAAE,OAAO,CAAA;IAC1B;;;;;;;OAOG;IACH,gBAAgB,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,qFAAqF;IACrF,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAA;IAClB;;;;;OAKG;IACH,MAAM,CAAC,EAAE;QACP,QAAQ,EAAE,UAAU,GAAG,QAAQ,CAAA;QAC/B,IAAI,EAAE,MAAM,CAAA;QACZ,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;CACF;AAED,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,yDAAyD;IACzD,OAAO,EAAE,kBAAkB,EAAE,CAAA;IAC7B,kFAAkF;IAClF,OAAO,EAAE,KAAK,GAAG,UAAU,CAAA;IAC3B,sFAAsF;IACtF,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,sFAAsF;IACtF,aAAa,CAAC,EAAE,MAAM,CAAA;CAIvB;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,sEAAsE;IACtE,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;CAC5C;AAED,MAAM,WAAW,gBAAgB;IAC/B,8EAA8E;IAC9E,OAAO,EAAE,OAAO,CAAA;IAChB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,wFAAwF;IACxF,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,kFAAkF;IAClF,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,6FAA6F;IAC7F,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,6FAA6F;IAC7F,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAA;CAGvB;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB;;;OAGG;IACH,gBAAgB,EAAE,MAAM,CAAA;IACxB;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAA;IACzB;;;;;;OAMG;IACH,eAAe,EAAE,MAAM,CAAA;IACvB;;;;;OAKG;IACH,cAAc,EAAE,MAAM,CAAA;IACtB;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,4EAA4E;IAC5E,OAAO,EAAE,OAAO,CAAA;IAChB,mFAAmF;IACnF,QAAQ,EAAE,KAAK,GAAG,eAAe,CAAA;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;;OAMG;IACH,aAAa,EAAE,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,wFAAwF;IACxF,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,qFAAqF;IACrF,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;OAMG;IACH,eAAe,EAAE,yBAAyB,CAAA;IAC1C;;;;;OAKG;IACH,IAAI,EAAE,cAAc,CAAA;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,wFAAwF;IACxF,OAAO,EAAE,OAAO,CAAA;IAChB;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAA;IACvB;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,yBAAyB;IACxC,oGAAoG;IACpG,OAAO,EAAE,OAAO,CAAA;IAChB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,MAAM,EAAE,2BAA2B,CAAA;CACpC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,4CAA4C;IAC5C,OAAO,EAAE,OAAO,CAAA;IAChB;;;;OAIG;IACH,MAAM,EAAE,mBAAmB,CAAA;IAC3B;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB,4EAA4E;IAC5E,UAAU,EAAE,uBAAuB,CAAA;CACpC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,qDAAqD;IACrD,OAAO,EAAE,OAAO,CAAA;IAChB;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,cAAc,EAAE,MAAM,CAAA;CACvB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAA;IAChB,0FAA0F;IAC1F,OAAO,EAAE,MAAM,CAAA;IACf,2FAA2F;IAC3F,YAAY,EAAE,MAAM,CAAA;IACpB,iGAAiG;IACjG,aAAa,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,YAAY,CAAA;IACpB,wEAAwE;IACxE,MAAM,EAAE,WAAW,EAAE,CAAA;IACrB,SAAS,EAAE,eAAe,CAAA;IAC1B,gDAAgD;IAChD,KAAK,EAAE,YAAY,CAAA;IACnB,mFAAmF;IACnF,MAAM,EAAE,YAAY,CAAA;IACpB;;;OAGG;IACH,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,oFAAoF;IACpF,IAAI,EAAE,UAAU,CAAA;IAChB,wFAAwF;IACxF,SAAS,EAAE,eAAe,CAAA;IAC1B,uFAAuF;IACvF,KAAK,EAAE,WAAW,CAAA;IAClB,4FAA4F;IAC5F,YAAY,EAAE,kBAAkB,CAAA;IAChC,0EAA0E;IAC1E,OAAO,EAAE,gBAAgB,CAAA;IACzB,+EAA+E;IAC/E,KAAK,EAAE,WAAW,CAAA;IAClB,mFAAmF;IACnF,oBAAoB,EAAE,yBAAyB,CAAA;IAC/C,oFAAoF;IACpF,aAAa,EAAE,mBAAmB,CAAA;IAClC,oFAAoF;IACpF,KAAK,EAAE,WAAW,CAAA;IAClB,+EAA+E;IAC/E,SAAS,EAAE,eAAe,CAAA;IAC1B,qFAAqF;IACrF,eAAe,EAAE,qBAAqB,CAAA;IACtC,6EAA6E;IAC7E,aAAa,EAAE,mBAAmB,CAAA;IAClC,+EAA+E;IAC/E,QAAQ,EAAE,cAAc,CAAA;IACxB,gGAAgG;IAChG,IAAI,EAAE,UAAU,CAAA;IAChB,yFAAyF;IACzF,cAAc,EAAE,mBAAmB,CAAA;IACnC;;;OAGG;IACH,iBAAiB,EAAE,uBAAuB,CAAA;IAC1C;;;OAGG;IACH,SAAS,CAAC,EAAE,eAAe,CAAA;IAC3B;;;;OAIG;IACH,cAAc,CAAC,EAAE,0BAA0B,CAAA;IAC3C;;;;;;;;;OASG;IACH,iBAAiB,CAAC,EAAE,WAAW,EAAE,CAAA;CAClC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/config/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,KAAK,EACV,0BAA0B,EAC1B,eAAe,EACf,WAAW,EACX,WAAW,EACX,mBAAmB,EACnB,2BAA2B,EAC5B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACpF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAA;AACzE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAOtD,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,YAAY,CAAA;IACrB;;;;;;OAMG;IACH,iBAAiB,EAAE,CACjB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,kBAAkB,CAAC,EAAE,SAAS,WAAW,EAAE,KACxC,QAAQ,GAAG,SAAS,CAAA;IACzB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAA;CAC9C;AAED,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAA;IACvB,kFAAkF;IAClF,eAAe,EAAE,MAAM,CAAA;IACvB,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAA;IACnB,sFAAsF;IACtF,uBAAuB,EAAE,MAAM,CAAA;IAC/B,mFAAmF;IACnF,cAAc,EAAE,MAAM,CAAA;IACtB,0EAA0E;IAC1E,UAAU,EAAE,MAAM,CAAA;IAClB,sEAAsE;IACtE,iBAAiB,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,8EAA8E;IAC9E,gBAAgB,EAAE,MAAM,CAAA;IACxB,2FAA2F;IAC3F,aAAa,EAAE,MAAM,CAAA;IACrB,gFAAgF;IAChF,aAAa,CAAC,EAAE,mBAAmB,CAAA;CACpC;AAED,wFAAwF;AACxF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAA;IACnB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,mFAAmF;IACnF,KAAK,EAAE,MAAM,CAAA;IACb,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAA;IACd,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,mBAAmB,EAAE,MAAM,EAAE,CAAA;IAC7B,wFAAwF;IACxF,WAAW,EAAE,MAAM,CAAA;IACnB,+DAA+D;IAC/D,cAAc,EAAE,MAAM,EAAE,CAAA;CACzB;AAED,MAAM,WAAW,UAAU;IACzB,2FAA2F;IAC3F,OAAO,EAAE,OAAO,CAAA;IAChB,6EAA6E;IAC7E,OAAO,EAAE,OAAO,CAAA;IAChB;;;;;;;OAOG;IACH,aAAa,EAAE,OAAO,CAAA;IACtB,oEAAoE;IACpE,aAAa,EAAE,OAAO,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;IACrB,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAA;IACf,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAA;IACjB,8CAA8C;IAC9C,YAAY,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,CAAA;IACzB,8EAA8E;IAC9E,kBAAkB,EAAE,MAAM,CAAA;IAC1B,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAA;IACnB,2EAA2E;IAC3E,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,sFAAsF;IACtF,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,2FAA2F;IAC3F,sBAAsB,EAAE,MAAM,EAAE,CAAA;IAChC,wDAAwD;IACxD,eAAe,EAAE,OAAO,CAAA;IACxB;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAA;IACnB,yDAAyD;IACzD,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,0EAA0E;IAC1E,GAAG,CAAC,EAAE,SAAS,CAAA;IACf;;;OAGG;IACH,mBAAmB,EAAE,MAAM,EAAE,CAAA;IAC7B;;;;;;;;;;OAUG;IACH,iBAAiB,EAAE,OAAO,CAAA;IAC1B;;;;;;;OAOG;IACH,gBAAgB,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,qFAAqF;IACrF,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAA;IAClB;;;;;OAKG;IACH,MAAM,CAAC,EAAE;QACP,QAAQ,EAAE,UAAU,GAAG,QAAQ,CAAA;QAC/B,IAAI,EAAE,MAAM,CAAA;QACZ,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;CACF;AAED,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,yDAAyD;IACzD,OAAO,EAAE,kBAAkB,EAAE,CAAA;IAC7B,kFAAkF;IAClF,OAAO,EAAE,KAAK,GAAG,UAAU,CAAA;IAC3B,sFAAsF;IACtF,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,sFAAsF;IACtF,aAAa,CAAC,EAAE,MAAM,CAAA;CAIvB;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,sEAAsE;IACtE,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;CAC5C;AAED,MAAM,WAAW,gBAAgB;IAC/B,8EAA8E;IAC9E,OAAO,EAAE,OAAO,CAAA;IAChB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,wFAAwF;IACxF,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,kFAAkF;IAClF,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,6FAA6F;IAC7F,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,6FAA6F;IAC7F,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAA;CAGvB;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB;;;OAGG;IACH,gBAAgB,EAAE,MAAM,CAAA;IACxB;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAA;IACzB;;;;;;OAMG;IACH,eAAe,EAAE,MAAM,CAAA;IACvB;;;;;OAKG;IACH,cAAc,EAAE,MAAM,CAAA;IACtB;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,4EAA4E;IAC5E,OAAO,EAAE,OAAO,CAAA;IAChB,mFAAmF;IACnF,QAAQ,EAAE,KAAK,GAAG,eAAe,CAAA;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;;OAMG;IACH,aAAa,EAAE,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,wFAAwF;IACxF,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,qFAAqF;IACrF,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;OAMG;IACH,eAAe,EAAE,yBAAyB,CAAA;IAC1C;;;;;OAKG;IACH,IAAI,EAAE,cAAc,CAAA;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,wFAAwF;IACxF,OAAO,EAAE,OAAO,CAAA;IAChB;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAA;IACvB;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,yBAAyB;IACxC,oGAAoG;IACpG,OAAO,EAAE,OAAO,CAAA;IAChB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,MAAM,EAAE,2BAA2B,CAAA;CACpC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,4CAA4C;IAC5C,OAAO,EAAE,OAAO,CAAA;IAChB;;;;OAIG;IACH,MAAM,EAAE,mBAAmB,CAAA;IAC3B;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB,4EAA4E;IAC5E,UAAU,EAAE,uBAAuB,CAAA;CACpC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,qDAAqD;IACrD,OAAO,EAAE,OAAO,CAAA;IAChB;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,cAAc,EAAE,MAAM,CAAA;CACvB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAA;IAChB,0FAA0F;IAC1F,OAAO,EAAE,MAAM,CAAA;IACf,2FAA2F;IAC3F,YAAY,EAAE,MAAM,CAAA;IACpB,iGAAiG;IACjG,aAAa,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,YAAY,CAAA;IACpB,wEAAwE;IACxE,MAAM,EAAE,WAAW,EAAE,CAAA;IACrB,SAAS,EAAE,eAAe,CAAA;IAC1B,gDAAgD;IAChD,KAAK,EAAE,YAAY,CAAA;IACnB,mFAAmF;IACnF,MAAM,EAAE,YAAY,CAAA;IACpB;;;OAGG;IACH,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,oFAAoF;IACpF,IAAI,EAAE,UAAU,CAAA;IAChB,wFAAwF;IACxF,SAAS,EAAE,eAAe,CAAA;IAC1B,uFAAuF;IACvF,KAAK,EAAE,WAAW,CAAA;IAClB,4FAA4F;IAC5F,YAAY,EAAE,kBAAkB,CAAA;IAChC,0EAA0E;IAC1E,OAAO,EAAE,gBAAgB,CAAA;IACzB,+EAA+E;IAC/E,KAAK,EAAE,WAAW,CAAA;IAClB,mFAAmF;IACnF,oBAAoB,EAAE,yBAAyB,CAAA;IAC/C,oFAAoF;IACpF,aAAa,EAAE,mBAAmB,CAAA;IAClC,oFAAoF;IACpF,KAAK,EAAE,WAAW,CAAA;IAClB,+EAA+E;IAC/E,SAAS,EAAE,eAAe,CAAA;IAC1B,qFAAqF;IACrF,eAAe,EAAE,qBAAqB,CAAA;IACtC,6EAA6E;IAC7E,aAAa,EAAE,mBAAmB,CAAA;IAClC,+EAA+E;IAC/E,QAAQ,EAAE,cAAc,CAAA;IACxB,gGAAgG;IAChG,IAAI,EAAE,UAAU,CAAA;IAChB,yFAAyF;IACzF,cAAc,EAAE,mBAAmB,CAAA;IACnC;;;OAGG;IACH,iBAAiB,EAAE,uBAAuB,CAAA;IAC1C;;;OAGG;IACH,SAAS,CAAC,EAAE,eAAe,CAAA;IAC3B;;;;OAIG;IACH,cAAc,CAAC,EAAE,0BAA0B,CAAA;IAC3C;;;;;;;;;OASG;IACH,iBAAiB,CAAC,EAAE,WAAW,EAAE,CAAA;CAClC"}

package/dist/http/env.d.ts

@@ -1,6 +1,6 @@
 import type { Context } from 'hono';
 import type { AgentRunRepository, AuthAttemptRepository, ExecutionRepository, MachineNodeRepository, NotificationChannel, PlatformAlertSink, ResolveBinaryArtifactStore, ConsensusSessionRepository, ResolveRunRepoContext, Logger, SealedSecretInventory, ToolSecretResolver, UserRepoAccessRepository, VcsIdentityRegistry, VcsProviderRegistry, VcsWebhookSink, WorkspacePermission, WorkspaceRole } from '@cat-factory/kernel';
-import type { ApiKeyService, EnvironmentBackendRegistry, LocalModelEndpointService, LocalSettingsService, OpenRouterCatalogService, PersonalSubscriptionService, ProviderSubscriptionService, NotificationWebhookService, PublicApiKeyService, RunnerBackendRegistry, TestSecretsService, CapabilityCredentialsService, ValidationConfigService, UserSecretService } from '@cat-factory/integrations';
+import type { ApiKeyService, EnvironmentBackendRegistry, LocalModelEndpointService, LocalSettingsService, OpenRouterCatalogService, PersonalSubscriptionService, ProviderSubscriptionService, NotificationWebhookService, PublicApiKeyService, RunnerBackendRegistry, TestSecretsService, CapabilityCredentialsService, McpOAuthService, ValidationConfigService, UserSecretService } from '@cat-factory/integrations';
 import type { Core } from '@cat-factory/orchestration';
 import type { AgentKindRegistry } from '@cat-factory/agents';
 import type { InitiativePresetRegistry } from '@cat-factory/kernel';
@@ -133,6 +133,31 @@ export interface ServerContainer extends Core {
      * same state, rather than a probe that silently succeeds against an unauthenticated endpoint.
      */
     toolSecretResolver?: ToolSecretResolver;
+    /**
+     * The per-workspace OAUTH GRANT store for remote (`http`) MCP tool servers (sealed). Present
+     * only when a facade wired the repository, which needs `ENCRYPTION_KEY` like every other sealed
+     * store.
+     *
+     * Backs three things: the connect/disconnect routes, the connection state the tool-server
+     * inventory renders per declaration, and the dispatch-time token source the executor mints an
+     * `Authorization` header from. Absent ⇒ a declaration that authenticates with OAuth has nowhere
+     * to keep a grant, so the routes refuse with a 503 naming the key and a dispatch states the
+     * server as `oauth_not_connected` — never a request sent without its token.
+     */
+    mcpOAuth?: McpOAuthService;
+    /**
+     * The redirect URL a vendor's authorization server sends the operator's browser back to
+     * (`MCP_OAUTH_REDIRECT_URL`), which must match what the deployment registered as its OAuth
+     * client's redirect URI.
+     *
+     * Operator-configured rather than derived from the incoming request, because it is a value a
+     * THIRD PARTY has on file: deriving it from a `Host` header would produce a different string
+     * behind every proxy, preview URL and private hostname a deployment sits behind, and the
+     * authorization server rejects the exchange when it does not match to the byte. Absent ⇒ the
+     * interactive grant is refused with a 503 naming the variable; the client-credentials grant
+     * needs no redirect and works without it.
+     */
+    mcpOAuthRedirectUrl?: string;
     /**
      * The per-service PRE-PR VALIDATION CHECK store: the commands the harness runs against the
      * checkout before opening a PR. Present only when the facade wired the validation-config

package/dist/http/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/http/env.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AACnC,OAAO,KAAK,EACV,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,EACjB,0BAA0B,EAC1B,0BAA0B,EAC1B,qBAAqB,EACrB,MAAM,EACN,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,mBAAmB,EACnB,cAAc,EACd,mBAAmB,EACnB,aAAa,EACd,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EACV,aAAa,EACb,0BAA0B,EAC1B,yBAAyB,EACzB,oBAAoB,EACpB,wBAAwB,EACxB,2BAA2B,EAC3B,2BAA2B,EAC3B,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,4BAA4B,EAC5B,uBAAuB,EACvB,iBAAiB,EAClB,MAAM,2BAA2B,CAAA;AAClC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,4BAA4B,CAAA;AACtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAA;AAC5E,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AACnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAQhF,MAAM,WAAW,eAAgB,SAAQ,IAAI;IAC3C,MAAM,EAAE,SAAS,CAAA;IACjB,8EAA8E;IAC9E,kBAAkB,EAAE,kBAAkB,CAAA;IACtC;;;;OAIG;IACH,mBAAmB,EAAE,mBAAmB,CAAA;IACxC;;;;OAIG;IACH,0BAA0B,CAAC,EAAE,0BAA0B,CAAA;IACvD,mFAAmF;IACnF,QAAQ,EAAE,eAAe,CAAA;IACzB;;;;;;;OAOG;IACH,wBAAwB,CAAC,EAAE,iBAAiB,CAAA;IAC5C;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvC;;;;;OAKG;IACH,0BAA0B,EAAE,0BAA0B,CAAA;IACtD,qBAAqB,EAAE,qBAAqB,CAAA;IAC5C;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,CAAA;IACpC;;;;;;OAMG;IACH,wBAAwB,EAAE,wBAAwB,CAAA;IAClD;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;OAGG;IACH,aAAa,CAAC,EAAE,2BAA2B,CAAA;IAC3C;;;;;OAKG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAA;IAChC;;;OAGG;IACH,qBAAqB,CAAC,EAAE,4BAA4B,CAAA;IACpD;;;;;;;;;;;;;;;;OAgBG;IACH,6BAA6B,CAAC,EAAE,OAAO,CAAA;IACvC;;;;;;;;;;;;;OAaG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,uBAAuB,CAAA;IAC1C;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,2BAA2B,CAAA;IACnD;;;;;OAKG;IACH,OAAO,CAAC,EAAE,aAAa,CAAA;IACvB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAA;IACnC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,0BAA0B,CAAA;IACjD;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC3B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IAC5D;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,yBAAyB,CAAA;IAC/C;;;;OAIG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAA;IAC/B;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,wBAAwB,CAAA;IACzC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,wBAAwB,CAAA;IAC5C;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE;QAAE,OAAO,EAAE,oBAAoB,CAAA;KAAE,CAAA;IACjD;;;;;;;OAOG;IACH,0BAA0B,CAAC,EAAE,0BAA0B,CAAA;IACvD;;;;;;;OAOG;IACH,+BAA+B,CAAC,EAAE,OAAO,CAAA;IACzC;;;;;;;;;OASG;IACH,oCAAoC,CAAC,EAAE,OAAO,CAAA;IAC9C;;;;;OAKG;IACH,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B;;;;;;OAMG;IACH,WAAW,EAAE,mBAAmB,CAAA;IAChC;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAA;IACjC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,mBAAmB,CAAA;IAClC;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;;;;;;;;OAUG;IACH,2BAA2B,CAAC,EAAE,mBAAmB,CAAA;IACjD;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,mBAAmB,CAAA;IACvC;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,MAAM,GAAG,SAAS,CAAA;CAClE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,CACf,cAAc,EAAE,MAAM,EACtB,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAC1D,OAAO,CAAC,MAAM,CAAC,CAAA;CACnB;AAED,+FAA+F;AAC/F,MAAM,WAAW,mBAAmB;IAClC,OAAO,CACL,OAAO,EAAE,MAAM,GACd,OAAO,CACN;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,WAAW,CAAA;KAAE,GAClE;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CACjD,CAAA;CACF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,aAAa,CAAA;IACnB,WAAW,EAAE,WAAW,CAAC,mBAAmB,CAAC,CAAA;CAC9C;AAED,4FAA4F;AAC5F,MAAM,MAAM,MAAM,GAAG;IACnB,SAAS,EAAE;QACT,SAAS,EAAE,eAAe,CAAA;QAC1B,yEAAyE;QACzE,IAAI,CAAC,EAAE,cAAc,CAAA;QACrB,oGAAoG;QACpG,eAAe,CAAC,EAAE,sBAAsB,CAAA;QACxC;;;;WAIG;QACH,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB;;;;WAIG;QACH,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ;;;;WAIG;QACH,SAAS,CAAC,EAAE,MAAM,CAAA;KACnB,CAAA;CACF,CAAA"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/http/env.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AACnC,OAAO,KAAK,EACV,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,EACjB,0BAA0B,EAC1B,0BAA0B,EAC1B,qBAAqB,EACrB,MAAM,EACN,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,mBAAmB,EACnB,cAAc,EACd,mBAAmB,EACnB,aAAa,EACd,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EACV,aAAa,EACb,0BAA0B,EAC1B,yBAAyB,EACzB,oBAAoB,EACpB,wBAAwB,EACxB,2BAA2B,EAC3B,2BAA2B,EAC3B,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,4BAA4B,EAC5B,eAAe,EACf,uBAAuB,EACvB,iBAAiB,EAClB,MAAM,2BAA2B,CAAA;AAClC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,4BAA4B,CAAA;AACtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAA;AAC5E,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AACnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAQhF,MAAM,WAAW,eAAgB,SAAQ,IAAI;IAC3C,MAAM,EAAE,SAAS,CAAA;IACjB,8EAA8E;IAC9E,kBAAkB,EAAE,kBAAkB,CAAA;IACtC;;;;OAIG;IACH,mBAAmB,EAAE,mBAAmB,CAAA;IACxC;;;;OAIG;IACH,0BAA0B,CAAC,EAAE,0BAA0B,CAAA;IACvD,mFAAmF;IACnF,QAAQ,EAAE,eAAe,CAAA;IACzB;;;;;;;OAOG;IACH,wBAAwB,CAAC,EAAE,iBAAiB,CAAA;IAC5C;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvC;;;;;OAKG;IACH,0BAA0B,EAAE,0BAA0B,CAAA;IACtD,qBAAqB,EAAE,qBAAqB,CAAA;IAC5C;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,CAAA;IACpC;;;;;;OAMG;IACH,wBAAwB,EAAE,wBAAwB,CAAA;IAClD;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;OAGG;IACH,aAAa,CAAC,EAAE,2BAA2B,CAAA;IAC3C;;;;;OAKG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAA;IAChC;;;OAGG;IACH,qBAAqB,CAAC,EAAE,4BAA4B,CAAA;IACpD;;;;;;;;;;;;;;;;OAgBG;IACH,6BAA6B,CAAC,EAAE,OAAO,CAAA;IACvC;;;;;;;;;;;;;OAaG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAA;IAC1B;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,uBAAuB,CAAA;IAC1C;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,2BAA2B,CAAA;IACnD;;;;;OAKG;IACH,OAAO,CAAC,EAAE,aAAa,CAAA;IACvB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAA;IACnC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,0BAA0B,CAAA;IACjD;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC3B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IAC5D;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,yBAAyB,CAAA;IAC/C;;;;OAIG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAA;IAC/B;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,wBAAwB,CAAA;IACzC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,wBAAwB,CAAA;IAC5C;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE;QAAE,OAAO,EAAE,oBAAoB,CAAA;KAAE,CAAA;IACjD;;;;;;;OAOG;IACH,0BAA0B,CAAC,EAAE,0BAA0B,CAAA;IACvD;;;;;;;OAOG;IACH,+BAA+B,CAAC,EAAE,OAAO,CAAA;IACzC;;;;;;;;;OASG;IACH,oCAAoC,CAAC,EAAE,OAAO,CAAA;IAC9C;;;;;OAKG;IACH,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B;;;;;;OAMG;IACH,WAAW,EAAE,mBAAmB,CAAA;IAChC;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAA;IACjC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,mBAAmB,CAAA;IAClC;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;;;;;;;;OAUG;IACH,2BAA2B,CAAC,EAAE,mBAAmB,CAAA;IACjD;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,mBAAmB,CAAA;IACvC;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,MAAM,GAAG,SAAS,CAAA;CAClE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,CACf,cAAc,EAAE,MAAM,EACtB,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAC1D,OAAO,CAAC,MAAM,CAAC,CAAA;CACnB;AAED,+FAA+F;AAC/F,MAAM,WAAW,mBAAmB;IAClC,OAAO,CACL,OAAO,EAAE,MAAM,GACd,OAAO,CACN;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,WAAW,CAAA;KAAE,GAClE;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CACjD,CAAA;CACF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,aAAa,CAAA;IACnB,WAAW,EAAE,WAAW,CAAC,mBAAmB,CAAC,CAAA;CAC9C;AAED,4FAA4F;AAC5F,MAAM,MAAM,MAAM,GAAG;IACnB,SAAS,EAAE;QACT,SAAS,EAAE,eAAe,CAAA;QAC1B,yEAAyE;QACzE,IAAI,CAAC,EAAE,cAAc,CAAA;QACrB,oGAAoG;QACpG,eAAe,CAAC,EAAE,sBAAsB,CAAA;QACxC;;;;WAIG;QACH,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB;;;;WAIG;QACH,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ;;;;WAIG;QACH,SAAS,CAAC,EAAE,MAAM,CAAA;KACnB,CAAA;CACF,CAAA"}

package/dist/index.d.ts

@@ -18,7 +18,8 @@ export { GitHubOAuth, type GitHubOAuthDependencies, type GitHubIdentity, } from
 export { GoogleOAuth, type GoogleOAuthDependencies, type GoogleIdentity, } from './auth/GoogleOAuth.js';
 export { LinearOAuth, type LinearOAuthDependencies } from './auth/LinearOAuth.js';
 export { WebCryptoPasswordHasher } from './crypto/WebCryptoPasswordHasher.js';
-export { authController, pickPostLoginRedirect } from './modules/auth/AuthController.js';
+export { authController } from './modules/auth/AuthController.js';
+export { mintSession, pickPostLoginRedirect } from './modules/auth/loginFlow.js';
 export { llmProxyController } from './modules/llmProxy/LlmProxyController.js';
 export { ContainerSessionService, DEFAULT_SESSION_TTL_MS, type ContainerSession, type MintInput, } from './containers/ContainerSessionService.js';
 export { CompositeAgentExecutor } from './agents/CompositeAgentExecutor.js';
@@ -28,6 +29,9 @@ export { ensureWorkBranchViaRest, type EnsureWorkBranchInput } from './github/en
 export { RunnerJobClient, type ResolveRunnerTransport } from './agents/RunnerJobClient.js';
 export { type EnvToolSecretResolverOptions, type McpServerJobSpec, type ResolvedToolServers, createEnvToolSecretResolver, resolveToolServers, } from './agents/toolServers.js';
 export { buildToolSecretChain, createWorkspaceToolSecretResolver, composeToolSecretResolvers, toolSecretContainerFields, type ToolSecretChain, type ToolSecretChainInput, type ToolSecretContainerFields, type WorkspaceToolSecretResolverOptions, } from './agents/capabilityCredentialResolver.js';
+export { createMcpOAuthTokenSource, mcpOAuthContainerFields, mcpOAuthExecutorDeps, type McpOAuthContainerFields, type McpOAuthTokenSourceOptions, } from './agents/mcpOAuthTokenSource.js';
+export { resolveOAuthClientSecret, type OAuthClientSecretResolution, type ResolveOAuthClientSecretInput, } from './agents/mcpOAuthClientSecret.js';
+export { MCP_OAUTH_CALLBACK_PATH, requireMcpOAuthRedirectUrl, } from './modules/toolServers/mcpOAuthRedirect.js';
 export { buildCapabilityCredentialsView, collectDeclaredCapabilityCredentials, type DeclaredCapabilityCredential, type DeclaredCapabilityCredentials, } from './modules/capabilityCredentials/declaredCredentials.js';
 export { createScopedModelProviderResolver, wrapResolverWithTelemetry, type InlineInstrumentation, type ResolverTelemetryWraps, type ScopedModelProviderOptions, } from './agents/modelProviderResolver.js';
 export { createInlineInstrumentation, type InlineInstrumentationOptions, } from './agents/inlineInstrumentation.js';
@@ -83,7 +87,11 @@ export { GitHubPrReportPublisher, type GitHubPrReportPublisherDependencies, } fr
 export { HmacSigner, TOKEN_AUDIENCE, type MachinePayload, type SessionPayload, type SessionUser, type TokenAudience, } from './auth/signing.js';
 export { DEFAULT_MACHINE_TOKEN_TTL_MS, mintMachineToken, resolveMachineTokenTtlMs, } from './auth/machineToken.js';
 export { WS_TICKET_TTL_MS, authorizeWsUpgrade, mintWsTicket, type WsTicket, type WsUpgradeAuth, } from './auth/wsTicket.js';
-export type { AgentsConfig, AppConfig, AuthConfig, ReleaseHealthConfig, DocumentsConfig, EmailConfig, EnvironmentsConfig, ExecutionConfig, FragmentLibraryConfig, GitHubConfig, GitLabConfig, GoogleOAuthConfig, LangfuseConfig, ObservabilityConfig, NotificationWebhookConfig, OtelConfig, OtelLogsConfig, InfraReachabilityConfig, PlatformAlertConfig, PrivilegedAppConfig, RetentionConfig, RunnerPoolConfig, SlackConfig, TasksConfig, } from './config/types.js';
+export type { AgentsConfig, AppConfig, AuthConfig, ReleaseHealthConfig, DocumentsConfig, EmailConfig, EnvironmentsConfig, ExecutionConfig, FragmentLibraryConfig, GitHubConfig, GitLabConfig, GoogleOAuthConfig, LangfuseConfig, ObservabilityConfig, NotificationWebhookConfig, OtelConfig, OtelLogsConfig, InfraReachabilityConfig, PlatformAlertConfig, PrivilegedAppConfig, RetentionConfig, RunnerPoolConfig, SlackConfig, SsoConfig, TasksConfig, } from './config/types.js';
+export { resolveSsoConfig, type SsoEnv } from './config/sso.js';
+export { OidcProviderDirectory, readProviderMetadata } from './auth/oidc/discovery.js';
+export { OidcClient, OidcFlowError, createPkcePair, type PkcePair } from './auth/oidc/OidcClient.js';
+export { judgeSsoAdmission, needsUserinfo, readGroupClaim, readSsoIdentity, type SsoAdmission, type SsoIdentity, } from './auth/oidc/claims.js';
 export { parsePlatformObservabilityWindow, resolvePlatformAlertConfig, type PlatformAlertEnvInput, } from './config/platformAlerts.js';
 export { resolveInfraReachabilityConfig, shouldRunReachabilityPass, type InfraReachabilityEnvInput, } from './config/infraReachability.js';
 export { resolveUrlSafetyPolicy } from './config/url-safety.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,gBAAgB,EAChB,MAAM,EACN,UAAU,EACV,WAAW,EACX,UAAU,EACV,aAAa,EACb,WAAW,EACX,UAAU,EACV,KAAK,SAAS,EACd,KAAK,QAAQ,EACb,KAAK,OAAO,EACZ,KAAK,MAAM,GACZ,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAA;AAC1E,OAAO,EACL,wBAAwB,EACxB,WAAW,EACX,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,GACxB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EACL,KAAK,MAAM,EACX,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,eAAe,GACrB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAA;AAC9E,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAG7D,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,EAC/B,wBAAwB,GACzB,MAAM,4DAA4D,CAAA;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAA;AAC/E,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,KAAK,mBAAmB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAClE,OAAO,EACL,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,cAAc,GACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,cAAc,GACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,WAAW,EAAE,KAAK,uBAAuB,EAAE,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,SAAS,GACf,MAAM,yCAAyC,CAAA;AAIhD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAC3E,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,EACvC,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,eAAe,GAChB,MAAM,oCAAoC,CAAA;AAE3C,OAAO,EACL,sBAAsB,EACtB,KAAK,6BAA6B,GACnC,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,uBAAuB,EAAE,KAAK,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAClG,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAI1F,OAAO,EACL,KAAK,4BAA4B,EACjC,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,yBAAyB,CAAA;AAOhC,OAAO,EACL,oBAAoB,EACpB,iCAAiC,EACjC,0BAA0B,EAC1B,yBAAyB,EACzB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,kCAAkC,GACxC,MAAM,0CAA0C,CAAA;AACjD,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,EACpC,KAAK,4BAA4B,EACjC,KAAK,6BAA6B,GACnC,MAAM,wDAAwD,CAAA;AAC/D,OAAO,EACL,iCAAiC,EAGjC,yBAAyB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,GAChC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,2BAA2B,EAC3B,KAAK,4BAA4B,GAClC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,4BAA4B,EAC5B,KAAK,kBAAkB,GACxB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAA;AACpG,OAAO,EACL,yBAAyB,EACzB,KAAK,qCAAqC,GAC3C,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EACL,0BAA0B,EAC1B,KAAK,sCAAsC,GAC5C,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EACnC,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,YAAY,GAClB,MAAM,+BAA+B,CAAA;AAGtC,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,UAAU,GACX,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,qBAAqB,EACrB,KAAK,6BAA6B,GACnC,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EACL,oBAAoB,EACpB,KAAK,gCAAgC,GACtC,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,sBAAsB,GACvB,MAAM,2BAA2B,CAAA;AAIlC,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,6BAA6B,EAC7B,gCAAgC,EAChC,yBAAyB,EACzB,WAAW,EACX,4BAA4B,EAC5B,KAAK,6BAA6B,GACnC,MAAM,8BAA8B,CAAA;AAKrC,OAAO,EACL,KAAK,4BAA4B,EACjC,KAAK,yBAAyB,EAC9B,KAAK,oCAAoC,EACzC,KAAK,gCAAgC,EACrC,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,yCAAyC,CAAA;AAChD,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,KAAK,iCAAiC,EACtC,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,EAC7B,KAAK,qCAAqC,EAC1C,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,8BAA8B,EAC9B,mCAAmC,EACnC,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,EACX,aAAa,EACb,gBAAgB,GACjB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAGxC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC/F,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,UAAU,EACV,oBAAoB,EACpB,0BAA0B,EAC1B,wBAAwB,EACxB,QAAQ,EACR,KAAK,aAAa,GACnB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAA;AACjG,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EACL,eAAe,EACf,0BAA0B,EAC1B,eAAe,EACf,kBAAkB,EAClB,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAIlG,OAAO,EACL,qBAAqB,EACrB,KAAK,4BAA4B,GAClC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAA;AAEzF,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,mBAAmB,GACzB,MAAM,4BAA4B,CAAA;AAEnC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC3F,OAAO,EACL,aAAa,EACb,KAAK,yBAAyB,EAC9B,mCAAmC,GACpC,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,wBAAwB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAA;AAC1F,OAAO,EACL,8BAA8B,EAC9B,KAAK,6BAA6B,GACnC,MAAM,+BAA+B,CAAA;AAKtC,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,KAAK,6BAA6B,GACnC,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,2BAA2B,EAC3B,KAAK,uCAAuC,GAC7C,MAAM,yCAAyC,CAAA;AAChD,OAAO,EACL,sBAAsB,EACtB,KAAK,6BAA6B,GACnC,MAAM,oCAAoC,CAAA;AAG3C,OAAO,EACL,6BAA6B,EAC7B,KAAK,yCAAyC,GAC/C,MAAM,2CAA2C,CAAA;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,GACxC,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,wBAAwB,EACxB,KAAK,oCAAoC,GAC1C,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,+BAA+B,EAC/B,KAAK,2CAA2C,GACjD,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,KAAK,sCAAsC,GAC5C,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,mBAAmB,EACnB,KAAK,+BAA+B,GACrC,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,uBAAuB,EACvB,KAAK,mCAAmC,GACzC,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,uBAAuB,EACvB,KAAK,mCAAmC,GACzC,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,UAAU,EACV,cAAc,EACd,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,KAAK,QAAQ,EACb,KAAK,aAAa,GACnB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,YAAY,EACZ,SAAS,EACT,UAAU,EACV,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,yBAAyB,EACzB,UAAU,EACV,cAAc,EACd,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,WAAW,GACZ,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,gCAAgC,EAChC,0BAA0B,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,KAAK,yBAAyB,GAC/B,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EACL,yBAAyB,EACzB,KAAK,0BAA0B,GAChC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,4BAA4B,CAAA;AAInC,cAAc,0BAA0B,CAAA;AACxC,cAAc,kCAAkC,CAAA;AAGhD,cAAc,yBAAyB,CAAA;AAMvC,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,KAAK,oBAAoB,EACzB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,qCAAqC,CAAA;AAI5C,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAA;AAIrF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAI7E,OAAO,EACL,oCAAoC,EACpC,KAAK,+BAA+B,GACrC,MAAM,gCAAgC,CAAA;AAKvC,OAAO,EACL,uBAAuB,EACvB,KAAK,6BAA6B,GACnC,MAAM,qCAAqC,CAAA;AAI5C,OAAO,EACL,8BAA8B,EAC9B,KAAK,kCAAkC,EACvC,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,8BAA8B,GACpC,MAAM,sCAAsC,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,gBAAgB,EAChB,MAAM,EACN,UAAU,EACV,WAAW,EACX,UAAU,EACV,aAAa,EACb,WAAW,EACX,UAAU,EACV,KAAK,SAAS,EACd,KAAK,QAAQ,EACb,KAAK,OAAO,EACZ,KAAK,MAAM,GACZ,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAA;AAC1E,OAAO,EACL,wBAAwB,EACxB,WAAW,EACX,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,GACxB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EACL,KAAK,MAAM,EACX,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,eAAe,GACrB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAA;AAC9E,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAG7D,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,EAC/B,wBAAwB,GACzB,MAAM,4DAA4D,CAAA;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAA;AAC/E,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,KAAK,mBAAmB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAClE,OAAO,EACL,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,cAAc,GACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,cAAc,GACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,WAAW,EAAE,KAAK,uBAAuB,EAAE,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAA;AAGjE,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,SAAS,GACf,MAAM,yCAAyC,CAAA;AAIhD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAC3E,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,EACvC,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,eAAe,GAChB,MAAM,oCAAoC,CAAA;AAE3C,OAAO,EACL,sBAAsB,EACtB,KAAK,6BAA6B,GACnC,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,uBAAuB,EAAE,KAAK,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAClG,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAI1F,OAAO,EACL,KAAK,4BAA4B,EACjC,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,yBAAyB,CAAA;AAOhC,OAAO,EACL,oBAAoB,EACpB,iCAAiC,EACjC,0BAA0B,EAC1B,yBAAyB,EACzB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,kCAAkC,GACxC,MAAM,0CAA0C,CAAA;AAKjD,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,EACpB,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,GAChC,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,wBAAwB,EACxB,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,GACnC,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,2CAA2C,CAAA;AAClD,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,EACpC,KAAK,4BAA4B,EACjC,KAAK,6BAA6B,GACnC,MAAM,wDAAwD,CAAA;AAC/D,OAAO,EACL,iCAAiC,EAGjC,yBAAyB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,GAChC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,2BAA2B,EAC3B,KAAK,4BAA4B,GAClC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,4BAA4B,EAC5B,KAAK,kBAAkB,GACxB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAA;AACpG,OAAO,EACL,yBAAyB,EACzB,KAAK,qCAAqC,GAC3C,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EACL,0BAA0B,EAC1B,KAAK,sCAAsC,GAC5C,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EACnC,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,YAAY,GAClB,MAAM,+BAA+B,CAAA;AAGtC,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,UAAU,GACX,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,qBAAqB,EACrB,KAAK,6BAA6B,GACnC,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EACL,oBAAoB,EACpB,KAAK,gCAAgC,GACtC,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,sBAAsB,GACvB,MAAM,2BAA2B,CAAA;AAIlC,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,6BAA6B,EAC7B,gCAAgC,EAChC,yBAAyB,EACzB,WAAW,EACX,4BAA4B,EAC5B,KAAK,6BAA6B,GACnC,MAAM,8BAA8B,CAAA;AAKrC,OAAO,EACL,KAAK,4BAA4B,EACjC,KAAK,yBAAyB,EAC9B,KAAK,oCAAoC,EACzC,KAAK,gCAAgC,EACrC,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,yCAAyC,CAAA;AAChD,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,KAAK,iCAAiC,EACtC,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,EAC7B,KAAK,qCAAqC,EAC1C,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,8BAA8B,EAC9B,mCAAmC,EACnC,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,EACX,aAAa,EACb,gBAAgB,GACjB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAGxC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC/F,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,UAAU,EACV,oBAAoB,EACpB,0BAA0B,EAC1B,wBAAwB,EACxB,QAAQ,EACR,KAAK,aAAa,GACnB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAA;AACjG,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EACL,eAAe,EACf,0BAA0B,EAC1B,eAAe,EACf,kBAAkB,EAClB,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAIlG,OAAO,EACL,qBAAqB,EACrB,KAAK,4BAA4B,GAClC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAA;AAEzF,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,mBAAmB,GACzB,MAAM,4BAA4B,CAAA;AAEnC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC3F,OAAO,EACL,aAAa,EACb,KAAK,yBAAyB,EAC9B,mCAAmC,GACpC,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,wBAAwB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAA;AAC1F,OAAO,EACL,8BAA8B,EAC9B,KAAK,6BAA6B,GACnC,MAAM,+BAA+B,CAAA;AAKtC,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,KAAK,6BAA6B,GACnC,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,2BAA2B,EAC3B,KAAK,uCAAuC,GAC7C,MAAM,yCAAyC,CAAA;AAChD,OAAO,EACL,sBAAsB,EACtB,KAAK,6BAA6B,GACnC,MAAM,oCAAoC,CAAA;AAG3C,OAAO,EACL,6BAA6B,EAC7B,KAAK,yCAAyC,GAC/C,MAAM,2CAA2C,CAAA;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,GACxC,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,wBAAwB,EACxB,KAAK,oCAAoC,GAC1C,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,+BAA+B,EAC/B,KAAK,2CAA2C,GACjD,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,KAAK,sCAAsC,GAC5C,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,mBAAmB,EACnB,KAAK,+BAA+B,GACrC,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,uBAAuB,EACvB,KAAK,mCAAmC,GACzC,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,uBAAuB,EACvB,KAAK,mCAAmC,GACzC,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,UAAU,EACV,cAAc,EACd,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,KAAK,QAAQ,EACb,KAAK,aAAa,GACnB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,YAAY,EACZ,SAAS,EACT,UAAU,EACV,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,yBAAyB,EACzB,UAAU,EACV,cAAc,EACd,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,SAAS,EACT,WAAW,GACZ,MAAM,mBAAmB,CAAA;AAG1B,OAAO,EAAE,gBAAgB,EAAE,KAAK,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC/D,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AACtF,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,2BAA2B,CAAA;AACpG,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,eAAe,EACf,KAAK,YAAY,EACjB,KAAK,WAAW,GACjB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,gCAAgC,EAChC,0BAA0B,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,KAAK,yBAAyB,GAC/B,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EACL,yBAAyB,EACzB,KAAK,0BAA0B,GAChC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,4BAA4B,CAAA;AAInC,cAAc,0BAA0B,CAAA;AACxC,cAAc,kCAAkC,CAAA;AAGhD,cAAc,yBAAyB,CAAA;AAMvC,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,KAAK,oBAAoB,EACzB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,qCAAqC,CAAA;AAI5C,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAA;AAIrF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAI7E,OAAO,EACL,oCAAoC,EACpC,KAAK,+BAA+B,GACrC,MAAM,gCAAgC,CAAA;AAKvC,OAAO,EACL,uBAAuB,EACvB,KAAK,6BAA6B,GACnC,MAAM,qCAAqC,CAAA;AAI5C,OAAO,EACL,8BAA8B,EAC9B,KAAK,kCAAkC,EACvC,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,8BAA8B,GACpC,MAAM,sCAAsC,CAAA"}

package/dist/index.js

@@ -24,7 +24,10 @@ export { GitHubOAuth, } from './auth/GitHubOAuth.js';
 export { GoogleOAuth, } from './auth/GoogleOAuth.js';
 export { LinearOAuth } from './auth/LinearOAuth.js';
 export { WebCryptoPasswordHasher } from './crypto/WebCryptoPasswordHasher.js';
-export { authController, pickPostLoginRedirect } from './modules/auth/AuthController.js';
+export { authController } from './modules/auth/AuthController.js';
+// The shared browser-login mechanics (the allow-listed post-login redirect, the session mint),
+// used by every redirecting provider and by the local mothership-connect controller.
+export { mintSession, pickPostLoginRedirect } from './modules/auth/loginFlow.js';
 export { llmProxyController } from './modules/llmProxy/LlmProxyController.js';
 export { ContainerSessionService, DEFAULT_SESSION_TTL_MS, } from './containers/ContainerSessionService.js';
 // Runtime-neutral container-agent execution machinery, shared by both facades: the
@@ -47,6 +50,13 @@ export { createEnvToolSecretResolver, resolveToolServers, } from './agents/toolS
 // its dispatch path asks and the description its credential checklist renders, so the two cannot
 // disagree about whether an unstored key still resolves.
 export { buildToolSecretChain, createWorkspaceToolSecretResolver, composeToolSecretResolvers, toolSecretContainerFields, } from './agents/capabilityCredentialResolver.js';
+// The OAuth half of the same seam: the kernel `McpOAuthTokenSource` a facade wires, joining the
+// sealed per-workspace grant store to the credential chain above (which resolves the OAuth client
+// secret). Every facade builds it beside `buildToolSecretChain`, so a deployment with a grant
+// store dispatches with a live token and one without states the server as `oauth_not_connected`.
+export { createMcpOAuthTokenSource, mcpOAuthContainerFields, mcpOAuthExecutorDeps, } from './agents/mcpOAuthTokenSource.js';
+export { resolveOAuthClientSecret, } from './agents/mcpOAuthClientSecret.js';
+export { MCP_OAUTH_CALLBACK_PATH, requireMcpOAuthRedirectUrl, } from './modules/toolServers/mcpOAuthRedirect.js';
 export { buildCapabilityCredentialsView, collectDeclaredCapabilityCredentials, } from './modules/capabilityCredentials/declaredCredentials.js';
 export { createScopedModelProviderResolver, 
 // The individual instrumentation / limiter wraps are deliberately NOT exported: their
@@ -127,6 +137,12 @@ export { GitHubPrReportPublisher, } from './github/GitHubPrReportPublisher.js';
 export { HmacSigner, TOKEN_AUDIENCE, } from './auth/signing.js';
 export { DEFAULT_MACHINE_TOKEN_TTL_MS, mintMachineToken, resolveMachineTokenTtlMs, } from './auth/machineToken.js';
 export { WS_TICKET_TTL_MS, authorizeWsUpgrade, mintWsTicket, } from './auth/wsTicket.js';
+// Enterprise SSO (generic OIDC): the shared env resolver both facades call, and the pieces a
+// facade or a test needs to reach the flow without going through the HTTP routes.
+export { resolveSsoConfig } from './config/sso.js';
+export { OidcProviderDirectory, readProviderMetadata } from './auth/oidc/discovery.js';
+export { OidcClient, OidcFlowError, createPkcePair } from './auth/oidc/OidcClient.js';
+export { judgeSsoAdmission, needsUserinfo, readGroupClaim, readSsoIdentity, } from './auth/oidc/claims.js';
 export { parsePlatformObservabilityWindow, resolvePlatformAlertConfig, } from './config/platformAlerts.js';
 export { resolveInfraReachabilityConfig, shouldRunReachabilityPass, } from './config/infraReachability.js';
 export { resolveUrlSafetyPolicy } from './config/url-safety.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,gFAAgF;AAChF,8EAA8E;AAC9E,qEAAqE;AACrE,OAAO,EACL,gBAAgB,EAChB,MAAM,EACN,UAAU,EACV,WAAW,EACX,UAAU,EACV,aAAa,EACb,WAAW,EACX,UAAU,GAKX,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAA;AAC1E,OAAO,EACL,wBAAwB,EACxB,WAAW,GAGZ,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAKN,MAAM,eAAe,CAAA;AACtB,OAAO,EAaN,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAA;AAC9E,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,gGAAgG;AAChG,wEAAwE;AACxE,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,EAC/B,wBAAwB,GACzB,MAAM,4DAA4D,CAAA;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAA;AAC/E,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GAEpB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,WAAW,EAAqB,MAAM,mBAAmB,CAAA;AAClE,OAAO,EACL,WAAW,GAGZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,WAAW,GAGZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,WAAW,EAAgC,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EACL,uBAAuB,EACvB,sBAAsB,GAGvB,MAAM,yCAAyC,CAAA;AAChD,mFAAmF;AACnF,kFAAkF;AAClF,oFAAoF;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAC3E,OAAO,EACL,sBAAsB,EAStB,eAAe,GAChB,MAAM,oCAAoC,CAAA;AAC3C,2FAA2F;AAC3F,OAAO,EACL,sBAAsB,GAEvB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,uBAAuB,EAA8B,MAAM,8BAA8B,CAAA;AAClG,OAAO,EAAE,eAAe,EAA+B,MAAM,6BAA6B,CAAA;AAC1F,0FAA0F;AAC1F,2FAA2F;AAC3F,uBAAuB;AACvB,OAAO,EAIL,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,yBAAyB,CAAA;AAChC,+FAA+F;AAC/F,6FAA6F;AAC7F,mGAAmG;AACnG,mGAAmG;AACnG,iGAAiG;AACjG,yDAAyD;AACzD,OAAO,EACL,oBAAoB,EACpB,iCAAiC,EACjC,0BAA0B,EAC1B,yBAAyB,GAK1B,MAAM,0CAA0C,CAAA;AACjD,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,GAGrC,MAAM,wDAAwD,CAAA;AAC/D,OAAO,EACL,iCAAiC;AACjC,sFAAsF;AACtF,qEAAqE;AACrE,yBAAyB,GAI1B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,2BAA2B,GAE5B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,4BAA4B,GAE7B,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAmB,MAAM,qBAAqB,CAAA;AACpG,OAAO,EACL,yBAAyB,GAE1B,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EACL,0BAA0B,GAE3B,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GAMxB,MAAM,+BAA+B,CAAA;AACtC,qFAAqF;AACrF,4FAA4F;AAC5F,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,UAAU,GACX,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,qBAAqB,GAEtB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EACL,oBAAoB,GAErB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAIL,sBAAsB,GACvB,MAAM,2BAA2B,CAAA;AAClC,6FAA6F;AAC7F,gGAAgG;AAChG,sFAAsF;AACtF,OAAO,EAGL,6BAA6B,EAC7B,gCAAgC,EAChC,yBAAyB,EACzB,WAAW,EACX,4BAA4B,GAE7B,MAAM,8BAA8B,CAAA;AACrC,4FAA4F;AAC5F,8FAA8F;AAC9F,+FAA+F;AAC/F,2CAA2C;AAC3C,OAAO,EAKL,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,yCAAyC,CAAA;AAChD,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EAKvB,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,EAQ7B,8BAA8B,EAC9B,mCAAmC,EACnC,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,EACX,aAAa,EACb,gBAAgB,GACjB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,wFAAwF;AACxF,kFAAkF;AAClF,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC/F,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,UAAU,EACV,oBAAoB,EACpB,0BAA0B,EAC1B,wBAAwB,EACxB,QAAQ,GAET,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAA;AACjG,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EACL,eAAe,EACf,0BAA0B,EAC1B,eAAe,EACf,kBAAkB,GAEnB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAClG,kFAAkF;AAClF,8EAA8E;AAC9E,kEAAkE;AAClE,OAAO,EACL,qBAAqB,GAEtB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAA;AACzF,kFAAkF;AAClF,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GAEpB,MAAM,4BAA4B,CAAA;AACnC,oFAAoF;AACpF,OAAO,EAAE,aAAa,EAAE,WAAW,EAAuB,MAAM,2BAA2B,CAAA;AAC3F,OAAO,EACL,aAAa,EAEb,mCAAmC,GACpC,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,iBAAiB,GAIlB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,wBAAwB,GAEzB,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAA;AAC1F,OAAO,EACL,8BAA8B,GAE/B,MAAM,+BAA+B,CAAA;AACtC,gFAAgF;AAChF,kFAAkF;AAClF,qFAAqF;AACrF,6BAA6B;AAC7B,OAAO,EACL,iBAAiB,EACjB,cAAc,GAEf,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,2BAA2B,GAE5B,MAAM,yCAAyC,CAAA;AAChD,OAAO,EACL,sBAAsB,GAEvB,MAAM,oCAAoC,CAAA;AAC3C,oFAAoF;AACpF,qEAAqE;AACrE,OAAO,EACL,6BAA6B,GAE9B,MAAM,2CAA2C,CAAA;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EACL,sBAAsB,GAEvB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,wBAAwB,GAEzB,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,+BAA+B,GAEhC,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,GAErB,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,mBAAmB,GAEpB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,uBAAuB,GAExB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,uBAAuB,GAExB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,UAAU,EACV,cAAc,GAKf,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,GAGb,MAAM,oBAAoB,CAAA;AA2B3B,OAAO,EACL,gCAAgC,EAChC,0BAA0B,GAE3B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,GAE1B,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EACL,yBAAyB,GAE1B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,4BAA4B,CAAA;AAEnC,mFAAmF;AACnF,iEAAiE;AACjE,cAAc,0BAA0B,CAAA;AACxC,cAAc,kCAAkC,CAAA;AAChD,4FAA4F;AAC5F,6FAA6F;AAC7F,cAAc,yBAAyB,CAAA;AAEvC,6FAA6F;AAC7F,wFAAwF;AACxF,6FAA6F;AAC7F,0EAA0E;AAC1E,OAAO,EAWL,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAEL,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,qCAAqC,CAAA;AAC5C,yFAAyF;AACzF,yFAAyF;AACzF,yEAAyE;AACzE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAA;AACrF,iGAAiG;AACjG,gGAAgG;AAChG,iCAAiC;AACjC,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAC7E,gGAAgG;AAChG,kGAAkG;AAClG,sEAAsE;AACtE,OAAO,EACL,oCAAoC,GAErC,MAAM,gCAAgC,CAAA;AACvC,yFAAyF;AACzF,wFAAwF;AACxF,2FAA2F;AAC3F,uFAAuF;AACvF,OAAO,EACL,uBAAuB,GAExB,MAAM,qCAAqC,CAAA;AAE5C,2FAA2F;AAC3F,sEAAsE;AACtE,OAAO,EACL,8BAA8B,GAK/B,MAAM,sCAAsC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,gFAAgF;AAChF,8EAA8E;AAC9E,qEAAqE;AACrE,OAAO,EACL,gBAAgB,EAChB,MAAM,EACN,UAAU,EACV,WAAW,EACX,UAAU,EACV,aAAa,EACb,WAAW,EACX,UAAU,GAKX,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAA;AAC1E,OAAO,EACL,wBAAwB,EACxB,WAAW,GAGZ,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAKN,MAAM,eAAe,CAAA;AACtB,OAAO,EAaN,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAA;AAC9E,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,gGAAgG;AAChG,wEAAwE;AACxE,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,EAC/B,wBAAwB,GACzB,MAAM,4DAA4D,CAAA;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAA;AAC/E,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GAEpB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,WAAW,EAAqB,MAAM,mBAAmB,CAAA;AAClE,OAAO,EACL,WAAW,GAGZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,WAAW,GAGZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,WAAW,EAAgC,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAA;AACjE,+FAA+F;AAC/F,qFAAqF;AACrF,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EACL,uBAAuB,EACvB,sBAAsB,GAGvB,MAAM,yCAAyC,CAAA;AAChD,mFAAmF;AACnF,kFAAkF;AAClF,oFAAoF;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAC3E,OAAO,EACL,sBAAsB,EAStB,eAAe,GAChB,MAAM,oCAAoC,CAAA;AAC3C,2FAA2F;AAC3F,OAAO,EACL,sBAAsB,GAEvB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,uBAAuB,EAA8B,MAAM,8BAA8B,CAAA;AAClG,OAAO,EAAE,eAAe,EAA+B,MAAM,6BAA6B,CAAA;AAC1F,0FAA0F;AAC1F,2FAA2F;AAC3F,uBAAuB;AACvB,OAAO,EAIL,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,yBAAyB,CAAA;AAChC,+FAA+F;AAC/F,6FAA6F;AAC7F,mGAAmG;AACnG,mGAAmG;AACnG,iGAAiG;AACjG,yDAAyD;AACzD,OAAO,EACL,oBAAoB,EACpB,iCAAiC,EACjC,0BAA0B,EAC1B,yBAAyB,GAK1B,MAAM,0CAA0C,CAAA;AACjD,gGAAgG;AAChG,kGAAkG;AAClG,8FAA8F;AAC9F,iGAAiG;AACjG,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,GAGrB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,wBAAwB,GAGzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,2CAA2C,CAAA;AAClD,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,GAGrC,MAAM,wDAAwD,CAAA;AAC/D,OAAO,EACL,iCAAiC;AACjC,sFAAsF;AACtF,qEAAqE;AACrE,yBAAyB,GAI1B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,2BAA2B,GAE5B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,4BAA4B,GAE7B,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAmB,MAAM,qBAAqB,CAAA;AACpG,OAAO,EACL,yBAAyB,GAE1B,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EACL,0BAA0B,GAE3B,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GAMxB,MAAM,+BAA+B,CAAA;AACtC,qFAAqF;AACrF,4FAA4F;AAC5F,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,UAAU,GACX,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,qBAAqB,GAEtB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EACL,oBAAoB,GAErB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAIL,sBAAsB,GACvB,MAAM,2BAA2B,CAAA;AAClC,6FAA6F;AAC7F,gGAAgG;AAChG,sFAAsF;AACtF,OAAO,EAGL,6BAA6B,EAC7B,gCAAgC,EAChC,yBAAyB,EACzB,WAAW,EACX,4BAA4B,GAE7B,MAAM,8BAA8B,CAAA;AACrC,4FAA4F;AAC5F,8FAA8F;AAC9F,+FAA+F;AAC/F,2CAA2C;AAC3C,OAAO,EAKL,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,yCAAyC,CAAA;AAChD,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EAKvB,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,EAQ7B,8BAA8B,EAC9B,mCAAmC,EACnC,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,EACX,aAAa,EACb,gBAAgB,GACjB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,wFAAwF;AACxF,kFAAkF;AAClF,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC/F,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,UAAU,EACV,oBAAoB,EACpB,0BAA0B,EAC1B,wBAAwB,EACxB,QAAQ,GAET,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAA;AACjG,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EACL,eAAe,EACf,0BAA0B,EAC1B,eAAe,EACf,kBAAkB,GAEnB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAClG,kFAAkF;AAClF,8EAA8E;AAC9E,kEAAkE;AAClE,OAAO,EACL,qBAAqB,GAEtB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAA;AACzF,kFAAkF;AAClF,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GAEpB,MAAM,4BAA4B,CAAA;AACnC,oFAAoF;AACpF,OAAO,EAAE,aAAa,EAAE,WAAW,EAAuB,MAAM,2BAA2B,CAAA;AAC3F,OAAO,EACL,aAAa,EAEb,mCAAmC,GACpC,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,iBAAiB,GAIlB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,wBAAwB,GAEzB,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAA;AAC1F,OAAO,EACL,8BAA8B,GAE/B,MAAM,+BAA+B,CAAA;AACtC,gFAAgF;AAChF,kFAAkF;AAClF,qFAAqF;AACrF,6BAA6B;AAC7B,OAAO,EACL,iBAAiB,EACjB,cAAc,GAEf,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,2BAA2B,GAE5B,MAAM,yCAAyC,CAAA;AAChD,OAAO,EACL,sBAAsB,GAEvB,MAAM,oCAAoC,CAAA;AAC3C,oFAAoF;AACpF,qEAAqE;AACrE,OAAO,EACL,6BAA6B,GAE9B,MAAM,2CAA2C,CAAA;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EACL,sBAAsB,GAEvB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,wBAAwB,GAEzB,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,+BAA+B,GAEhC,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,GAErB,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,mBAAmB,GAEpB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,uBAAuB,GAExB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,uBAAuB,GAExB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,UAAU,EACV,cAAc,GAKf,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,GAGb,MAAM,oBAAoB,CAAA;AA4B3B,6FAA6F;AAC7F,kFAAkF;AAClF,OAAO,EAAE,gBAAgB,EAAe,MAAM,iBAAiB,CAAA;AAC/D,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AACtF,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,cAAc,EAAiB,MAAM,2BAA2B,CAAA;AACpG,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,eAAe,GAGhB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,gCAAgC,EAChC,0BAA0B,GAE3B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,GAE1B,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EACL,yBAAyB,GAE1B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,4BAA4B,CAAA;AAEnC,mFAAmF;AACnF,iEAAiE;AACjE,cAAc,0BAA0B,CAAA;AACxC,cAAc,kCAAkC,CAAA;AAChD,4FAA4F;AAC5F,6FAA6F;AAC7F,cAAc,yBAAyB,CAAA;AAEvC,6FAA6F;AAC7F,wFAAwF;AACxF,6FAA6F;AAC7F,0EAA0E;AAC1E,OAAO,EAWL,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAEL,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,qCAAqC,CAAA;AAC5C,yFAAyF;AACzF,yFAAyF;AACzF,yEAAyE;AACzE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAA;AACrF,iGAAiG;AACjG,gGAAgG;AAChG,iCAAiC;AACjC,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAC7E,gGAAgG;AAChG,kGAAkG;AAClG,sEAAsE;AACtE,OAAO,EACL,oCAAoC,GAErC,MAAM,gCAAgC,CAAA;AACvC,yFAAyF;AACzF,wFAAwF;AACxF,2FAA2F;AAC3F,uFAAuF;AACvF,OAAO,EACL,uBAAuB,GAExB,MAAM,qCAAqC,CAAA;AAE5C,2FAA2F;AAC3F,sEAAsE;AACtE,OAAO,EACL,8BAA8B,GAK/B,MAAM,sCAAsC,CAAA"}

package/dist/modules/auth/AuthController.d.ts

@@ -1,22 +1,4 @@
 import { Hono } from 'hono';
-import { type SessionUser } from '../../auth/signing.js';
-import type { AuthConfig } from '../../config/types.js';
 import type { AppEnv } from '../../http/env.js';
-/**
- * Choose the post-login landing URL from the (untrusted) `redirect` query. The
- * session token is appended as a fragment, so an unrestricted redirect is a
- * token-exfiltration primitive — only same-origin, an explicitly allowlisted origin, or a
- * loopback host (the caller's own machine) is honoured, else the request origin.
- */
-export declare function pickPostLoginRedirect(requested: string | undefined, requestOrigin: string, cfg: Pick<AuthConfig, 'successRedirectUrl' | 'allowedRedirectOrigins'>): string;
-/**
- * Mint a user SESSION token, returning the signed token and the exact `exp` it committed to so a
- * caller can report the real expiry without a second clock read. Shared by every login path AND
- * the local-mode mothership-connect controller, so the session claim shape lives in one place.
- */
-export declare function mintSession(cfg: AuthConfig, user: SessionUser): Promise<{
-    token: string;
-    exp: number;
-}>;
 export declare function authController(): Hono<AppEnv>;
 //# sourceMappingURL=AuthController.d.ts.map

package/dist/modules/auth/AuthController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthController.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/AuthController.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAQ3B,OAAO,EAGL,KAAK,WAAW,EAEjB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAgG/C;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,oBAAoB,GAAG,wBAAwB,CAAC,GACrE,MAAM,CAkBR;AAwBD;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,UAAU,EACf,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAIzC;AAmED,wBAAgB,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC,CAW7C"}
+{"version":3,"file":"AuthController.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/AuthController.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAQ3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AA2I/C,wBAAgB,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC,CAgB7C"}

package/dist/modules/auth/AuthController.js

@@ -1,26 +1,27 @@
 import { acceptInvitationContract, authConfigContract, forgotPasswordContract, githubCallbackContract, githubLoginContract, googleCallbackContract, googleLoginContract, listMachineNodesContract, logoutContract, meContract, mintMachineTokenContract, passwordLoginContract, revokeMachineNodeContract, patLoginContract, peekInvitationContract, resetPasswordContract, signupContract, } from '@cat-factory/contracts';
 import { buildHonoRoute } from '@toad-contracts/hono';
 import { Hono } from 'hono';
-import { deleteCookie, getCookie, setCookie } from 'hono/cookie';
 import { GitHubOAuth } from '../../auth/GitHubOAuth.js';
 import { GoogleOAuth } from '../../auth/GoogleOAuth.js';
 import { verifySession } from '../../auth/middleware.js';
 import { mintMachineToken } from '../../auth/machineToken.js';
 import { passwordAttemptLimited, tooManyAttempts } from './authThrottle.js';
-import { HmacSigner, TOKEN_AUDIENCE, } from '../../auth/signing.js';
 import { ConflictError, ForbiddenError, NotFoundError, ValidationError, UnavailableError, UnauthorizedError, } from '@cat-factory/kernel';
 import { requireCapability } from '../../http/guards.js';
+// The mechanics every redirecting login provider shares — the cookie-bound CSRF state, the
+// allow-listed post-login redirect, the session mint, the invite handling. Extracted when
+// enterprise SSO landed so there is exactly ONE implementation of each (see loginFlow.ts).
+import { acceptInvite, authConfig, beginRoundTrip, consumeState, emailDomainAllowed, emailMatchesInvite, mintSession, peekInvite, sessionUser, withToken, } from './loginFlow.js';
+import { registerSsoRoutes } from './ssoRoutes.js';
 // Authentication endpoints. The SPA is handed a signed session token (via the URL
 // fragment for OAuth redirects, or the JSON body for password login) which it carries
-// as `Authorization: Bearer` on subsequent calls. Three login providers compose here:
+// as `Authorization: Bearer` on subsequent calls. Four login providers compose here:
 //   - GitHub OAuth (browser round-trip)
 //   - Google OAuth (browser round-trip)
+//   - enterprise SSO / generic OIDC (browser round-trip, in `ssoRoutes.ts`)
 //   - email/password (direct JSON)
 // All resolve to ONE canonical `users` row via the UserService, so the session id is
 // always the internal `usr_*` id regardless of how the user signed in.
-const OAUTH_STATE_TTL_MS = 10 * 60 * 1000;
-/** Browser-binding cookie for an OAuth round-trip (see the GitHub flow notes below). */
-const OAUTH_STATE_COOKIE = 'cf_oauth_state';
 // The one controller that keeps a local thrower rather than `requireCapability`: what it
 // guards is a boolean FLAG (`cfg.githubEnabled` / `cfg.passwordEnabled`), not an absent
 // value, so there is nothing for the accessor to narrow and return.
@@ -34,9 +35,6 @@ function requireGoogle(cfg) {
 const unavailable = () => {
     throw new UnavailableError('Authentication is not configured');
 };
-function authConfig(c) {
-    return c.get('container').config.auth;
-}
 function githubClient(cfg) {
     return new GitHubOAuth({
         clientId: cfg.clientId,
@@ -65,81 +63,6 @@ function googleCallbackUrl(c, cfg) {
         return cfg.google.redirectUrl;
     return `${new URL(c.req.url).origin}/auth/google/callback`;
 }
-/**
- * A loopback host (the user's OWN machine): `localhost`, the `127.0.0.0/8` block, or IPv6 `::1`.
- * A redirect to one of these is not an exfiltration vector — capturing the fragment there means
- * already running a server on the victim's own machine. This is what lets a mothership honour the
- * post-login redirect back to a mothership-mode LOCAL node (`http://localhost:PORT`), which is
- * neither same-origin nor pre-allowlisted, without an operator hand-listing every dev port.
- */
-function isLoopbackRedirect(url) {
-    const host = url.hostname.toLowerCase().replace(/^\[|\]$/g, '');
-    return host === 'localhost' || host === '::1' || /^127\.\d+\.\d+\.\d+$/.test(host);
-}
-/**
- * Choose the post-login landing URL from the (untrusted) `redirect` query. The
- * session token is appended as a fragment, so an unrestricted redirect is a
- * token-exfiltration primitive — only same-origin, an explicitly allowlisted origin, or a
- * loopback host (the caller's own machine) is honoured, else the request origin.
- */
-export function pickPostLoginRedirect(requested, requestOrigin, cfg) {
-    if (cfg.successRedirectUrl)
-        return cfg.successRedirectUrl;
-    const fallback = `${requestOrigin}/`;
-    if (!requested)
-        return fallback;
-    try {
-        const url = new URL(requested);
-        if (url.protocol !== 'http:' && url.protocol !== 'https:')
-            return fallback;
-        if (url.origin === requestOrigin ||
-            cfg.allowedRedirectOrigins.includes(url.origin) ||
-            isLoopbackRedirect(url)) {
-            return requested;
-        }
-    }
-    catch {
-        // fall through to the safe origin-relative default
-    }
-    return fallback;
-}
-function resolveRedirect(c, cfg) {
-    return pickPostLoginRedirect(c.req.query('redirect'), new URL(c.req.url).origin, cfg);
-}
-/** Append the session token as a URL fragment on the landing URL. */
-function withToken(redirect, token) {
-    const url = new URL(redirect);
-    url.hash = `token=${token}`;
-    return url.toString();
-}
-/** Build the SessionUser surface from a canonical user + chosen display login. */
-function sessionUser(user, login) {
-    return {
-        id: user.id,
-        login,
-        name: user.name,
-        avatarUrl: user.avatarUrl,
-        email: user.email,
-    };
-}
-/**
- * Mint a user SESSION token, returning the signed token and the exact `exp` it committed to so a
- * caller can report the real expiry without a second clock read. Shared by every login path AND
- * the local-mode mothership-connect controller, so the session claim shape lives in one place.
- */
-export async function mintSession(cfg, user) {
-    const exp = Date.now() + cfg.sessionTtlMs;
-    const session = { ...user, aud: TOKEN_AUDIENCE.session, exp };
-    return { token: await new HmacSigner(cfg.sessionSecret).sign(session), exp };
-}
-/** Whether an email's domain is on the self-signup allowlist. */
-function emailDomainAllowed(email, cfg) {
-    const at = email.lastIndexOf('@');
-    if (at < 0)
-        return false;
-    const domain = email.slice(at + 1).toLowerCase();
-    return cfg.allowedEmailDomains.includes(domain);
-}
 /**
  * GitHub allowlist gate — the deployment is private. A user is admitted only if their
  * login is in `allowedLogins` OR they belong to an org in `allowedOrgs`. Both lists
@@ -194,6 +117,11 @@ export function authController() {
     // recovery, session) purely so no single function exceeds the size budget; each registers
     // onto the shared `app` and depends only on the module-level helpers above.
     registerOAuthRoutes(app);
+    // Enterprise SSO lives in its own registrar: its round-trip carries PKCE + OIDC nonce secrets
+    // that must stay out of the URL, so it owns a different state mechanism (a signed httpOnly
+    // cookie) than the two consumer-OAuth legs above, while sharing their signer and redirect
+    // allow-list through `loginFlow.ts`.
+    registerSsoRoutes(app);
     registerCredentialRoutes(app);
     registerMachineNodeRoutes(app);
     registerAccountRecoveryRoutes(app);
@@ -220,7 +148,11 @@ function registerOAuthRoutes(app) {
                 github: cfg.githubEnabled,
                 password: cfg.passwordEnabled,
                 google: !!cfg.google,
+                sso: !!cfg.sso,
             },
+            // The operator's own button wording travels beside the boolean, because it names THEIR
+            // identity provider and so is the one part of the login screen the SPA cannot localize.
+            ...(cfg.sso ? { sso: { label: cfg.sso.label, protocol: 'oidc' } } : {}),
             ...(localMode ? { localMode } : {}),
             ...(patProviders.length > 0 ? { patLogin: { providers: patProviders } } : {}),
             // Test-only: advertise that the deployment runs with no auth, so the SPA renders the
@@ -234,22 +166,7 @@ function registerOAuthRoutes(app) {
         const cfg = authConfig(c);
         if (!cfg.githubEnabled)
             return unavailable();
-        const nonce = crypto.randomUUID();
-        const state = {
-            aud: TOKEN_AUDIENCE.oauthState,
-            nonce,
-            redirect: resolveRedirect(c, cfg),
-            ...(c.req.query('invite') ? { invite: c.req.query('invite') } : {}),
-            exp: Date.now() + OAUTH_STATE_TTL_MS,
-        };
-        const signedState = await new HmacSigner(cfg.sessionSecret).sign(state);
-        setCookie(c, OAUTH_STATE_COOKIE, nonce, {
-            httpOnly: true,
-            secure: new URL(c.req.url).protocol === 'https:',
-            sameSite: 'Lax',
-            path: '/auth',
-            maxAge: OAUTH_STATE_TTL_MS / 1000,
-        });
+        const signedState = await beginRoundTrip(c, cfg);
         const url = githubClient(cfg).authorizeUrl({
             redirectUri: githubCallbackUrl(c, cfg),
             state: signedState,
@@ -301,22 +218,7 @@ function registerOAuthRoutes(app) {
     buildHonoRoute(app, googleLoginContract, async (c) => {
         const cfg = authConfig(c);
         const google = requireGoogle(cfg);
-        const nonce = crypto.randomUUID();
-        const state = {
-            aud: TOKEN_AUDIENCE.oauthState,
-            nonce,
-            redirect: resolveRedirect(c, cfg),
-            ...(c.req.query('invite') ? { invite: c.req.query('invite') } : {}),
-            exp: Date.now() + OAUTH_STATE_TTL_MS,
-        };
-        const signedState = await new HmacSigner(cfg.sessionSecret).sign(state);
-        setCookie(c, OAUTH_STATE_COOKIE, nonce, {
-            httpOnly: true,
-            secure: new URL(c.req.url).protocol === 'https:',
-            sameSite: 'Lax',
-            path: '/auth',
-            maxAge: OAUTH_STATE_TTL_MS / 1000,
-        });
+        const signedState = await beginRoundTrip(c, cfg);
         return c.redirect(google.authorizeUrl({ redirectUri: googleCallbackUrl(c, cfg), state: signedState }));
     });
     buildHonoRoute(app, googleCallbackContract, async (c) => {
@@ -748,38 +650,4 @@ function registerSessionRoutes(app) {
     // Stateless sessions: logout is a client-side token drop. Provided for symmetry.
     buildHonoRoute(app, logoutContract, (c) => c.body(null, 204));
 }
-/** Verify + single-use the OAuth state (signature, expiry, browser-binding cookie). */
-async function consumeState(c, cfg) {
-    const state = await new HmacSigner(cfg.sessionSecret).verify(c.req.query('state'), {
-        aud: TOKEN_AUDIENCE.oauthState,
-    });
-    const boundNonce = getCookie(c, OAUTH_STATE_COOKIE);
-    deleteCookie(c, OAUTH_STATE_COOKIE, { path: '/auth' });
-    if (!state || !boundNonce || boundNonce !== state.nonce)
-        return null;
-    return state;
-}
-async function peekInvite(c, token) {
-    const inv = c.get('container').invitations;
-    return inv ? inv.peek(token) : null;
-}
-/** Whether a sign-in email matches the address an invitation was sent to. */
-function emailMatchesInvite(signInEmail, inviteEmail) {
-    return !!signInEmail && signInEmail.toLowerCase().trim() === inviteEmail;
-}
-async function acceptInvite(c, token, userId, userEmail) {
-    const inv = c.get('container').invitations;
-    if (!inv)
-        return;
-    try {
-        await inv.accept(token, userId, userEmail);
-    }
-    catch (err) {
-        // Expected invite states (expired / already-used / wrong email) must not block an
-        // otherwise-valid login; an unexpected infra error should still surface.
-        if (err instanceof ConflictError || err instanceof NotFoundError)
-            return;
-        throw err;
-    }
-}
 //# sourceMappingURL=AuthController.js.map