@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/types/model/service/idp/providers/OIDCHelpers.d.ts

@@ -1,10 +1,66 @@
-import { Client } from 'openid-client';
-import { OIDCResponseData } from './OIDCTypes';
-import { IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler';
+import { Client, Issuer, TokenSet } from 'openid-client';
+import { OIDCClaimMapping, OIDCResponseData } from './OIDCTypes.js';
+import { IDPResponse, IDPSessionState, InitIDPAuthResult, LogoutTokenClaims, LogoutUrlRequest, RevalidationResult } from '../IdentityProviderHandler.js';
+/**
+ * Build the persisted session state from an OIDC token set. Stores the tokens needed for
+ * later re-validation (refresh/access) and SLO (id_token); the whole `tokens` blob is
+ * encrypted at rest by the command layer.
+ *
+ * `prevTokens` carries the previously stored tokens forward: a refresh-grant response MAY omit
+ * the refresh token (RFC 6749 §6 — IdPs that don't rotate just don't re-send it), in which case
+ * the client must keep using the old one. Without this fallback a non-rotating IdP would persist
+ * a session with no refresh token and be revoked (`no_refresh_token`) on the very next tick.
+ */
+export declare const tokenSetToSessionState: (tokenSet: TokenSet, sessionId?: string, prevTokens?: Record<string, unknown>) => IDPSessionState;
 export declare const initOIDCAuth: (client: Client, { redirectUrl, scope, responseMode }: {
     redirectUrl: string;
     scope?: string;
     responseMode?: string;
 }) => Promise<InitIDPAuthResult>;
-export declare const handleOIDCResponse: (client: Client, { sessionData, redirectUrl, ...otherData }: OIDCResponseData, fetchUserInfo?: boolean, returnOIDCResult?: boolean) => Promise<IDPResponse>;
+export type HandleOIDCResponseOptions = {
+    fetchUserInfo?: boolean;
+    returnOIDCResult?: boolean;
+    captureSession?: boolean;
+    claimMapping?: OIDCClaimMapping;
+};
+/**
+ * Lift a configured nested attributes object (`attributesKey`, notably Apereo CAS's `attributes`) to the
+ * top level so providers that nest their claims map without a code change. The nested attributes are
+ * UNSIGNED, so they are spread UNDER `source` — a signed top-level claim keeps precedence over an
+ * attributes-level value. Shared by the sign-in response handler ({@link handleOIDCResponse}) and the
+ * session-refresh path ({@link revalidateOIDC}) so BOTH see the same claim surface; without this, an
+ * `attributesKey` provider's A09 claim mapping would resolve at sign-in but silently not on refresh.
+ */
+export declare const liftNestedClaims: (source: Record<string, unknown>, attributesKey: string | undefined) => Record<string, unknown>;
+export declare const handleOIDCResponse: (client: Client, { sessionData, redirectUrl, ...otherData }: OIDCResponseData, { fetchUserInfo, returnOIDCResult, captureSession, claimMapping }?: HandleOIDCResponseOptions) => Promise<IDPResponse>;
+/**
+ * Re-validate a stored OIDC session against the IdP. Returns `revoked` only for definitive
+ * IdP responses (invalid/expired grant or inactive introspection). Transient failures
+ * (network, IdP down) re-throw so the caller can fail-open and keep the session — IdP
+ * downtime must not log everyone out.
+ */
+export declare const revalidateOIDC: (client: Client, method: 'refresh' | 'userinfo' | 'introspection', session: IDPSessionState, options?: {
+    claimMapping?: OIDCClaimMapping;
+    fetchUserInfo?: boolean;
+}) => Promise<RevalidationResult>;
+/**
+ * Build an RP-initiated (front-channel) logout URL (OIDC RP-Initiated Logout 1.0). Returns null
+ * when the IdP advertises no `end_session_endpoint` — the caller then degrades to a local-only
+ * logout (legacy-IdP graceful fallback). The `id_token_hint` lets the IdP identify and confirm the
+ * session to terminate; `post_logout_redirect_uri` is where the IdP returns the browser afterwards.
+ */
+export declare const buildOIDCLogoutUrl: (client: Client, { idToken, postLogoutRedirectUri }: LogoutUrlRequest) => string | null;
+/**
+ * Validate an OIDC back-channel logout token (OIDC Back-Channel Logout 1.0 §2.4–2.6) and extract
+ * the targeted `sid` / `sub`. The token is a JWT signed by the IdP; we verify the signature against
+ * the issuer's JWKS and enforce the issuer + audience (client_id) the same way ID tokens are
+ * verified, pinning the signing algorithm to the provider's configured one, then assert the
+ * back-channel-specific claims:
+ *   - `iat` is present and recent and `exp` is present (§2.4 requires both) — bounds the replay window;
+ *   - `events` contains the back-channel-logout member (it really is a logout token);
+ *   - it carries a `sid` and/or `sub` (otherwise there is nothing to act on);
+ *   - it does NOT carry a `nonce` (a `nonce` means it is an ID token being replayed).
+ * Throws {@link IDPValidationError} on any failure so the caller can answer 400.
+ */
+export declare const validateOIDCLogoutToken: (client: Client, issuer: Issuer<Client>, logoutToken: string) => Promise<LogoutTokenClaims>;
 //# sourceMappingURL=OIDCHelpers.d.ts.map

package/dist/types/model/service/idp/providers/OIDCHelpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OIDCHelpers.d.ts","sourceRoot":"","sources":["../../../../../../src/model/service/idp/providers/OIDCHelpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAA8B,MAAM,eAAe,CAAA;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAG9C,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAE3E,eAAO,MAAM,YAAY,GACxB,QAAQ,MAAM,EACd,sCAAsC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,KAClG,OAAO,CAAC,iBAAiB,CAe3B,CAAA;AAED,eAAO,MAAM,kBAAkB,GAC9B,QAAQ,MAAM,EACd,4CAA4C,gBAAgB,EAC5D,gBAAgB,OAAO,EACvB,mBAAmB,OAAO,KACxB,OAAO,CAAC,WAAW,CA+BrB,CAAA"}
+{"version":3,"file":"OIDCHelpers.d.ts","sourceRoot":"","sources":["../../../../../../src/model/service/idp/providers/OIDCHelpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAA8B,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAEpF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAGnE,OAAO,EACN,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,MAAM,+BAA+B,CAAA;AAEtC;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,aAAc,QAAQ,cAAc,MAAM,eAAe,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,eAYrH,CAAA;AAED,eAAO,MAAM,YAAY,WAChB,MAAM,wCACwB;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,KAClG,OAAO,CAAC,iBAAiB,CAe3B,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACvC,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,YAAY,CAAC,EAAE,gBAAgB,CAAA;CAC/B,CAAA;AAiBD;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,WAAY,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,iBAAiB,MAAM,GAAG,SAAS,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAS3H,CAAA;AAkGD,eAAO,MAAM,kBAAkB,WACtB,MAAM,8CAC8B,gBAAgB,sEACO,yBAAyB,KAC1F,OAAO,CAAC,WAAW,CAqCrB,CAAA;AAKD;;;;;GAKG;AACH,eAAO,MAAM,cAAc,WAClB,MAAM,UACN,SAAS,GAAG,UAAU,GAAG,eAAe,WACvC,eAAe,YACf;IAAE,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CAAE,KACnE,OAAO,CAAC,kBAAkB,CAqF5B,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,WAAY,MAAM,sCAAsC,gBAAgB,KAAG,MAAM,GAAG,IAQlH,CAAA;AAmCD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,WAAkB,MAAM,UAAU,MAAM,CAAC,MAAM,CAAC,eAAe,MAAM,KAAG,OAAO,CAAC,iBAAiB,CAqDpI,CAAA"}

package/dist/types/model/service/idp/providers/OIDCProvider.d.ts

@@ -1,5 +1,5 @@
-import { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler';
-import { OIDCConfiguration } from './OIDCTypes';
+import { IdentityProviderHandler, IDPResponse, IDPSessionState, InitIDPAuthResult, LogoutTokenClaims, LogoutUrlRequest, RevalidationResult } from '../IdentityProviderHandler.js';
+import { OIDCConfiguration } from './OIDCTypes.js';
 export declare class OIDCProvider implements IdentityProviderHandler<OIDCConfiguration> {
     private issuerCache;
     validateConfiguration: (value: unknown) => {
@@ -12,14 +12,40 @@ export declare class OIDCProvider implements IdentityProviderHandler<OIDCConfigu
         readonly scope?: string | undefined;
         readonly additionalAuthorizedParties?: readonly string[] | undefined;
         readonly idTokenSignedResponseAlg?: string | undefined;
+        readonly tokenEndpointAuthMethod?: import("openid-client").ClientAuthMethod | undefined;
         readonly fetchUserInfo?: boolean | undefined;
         readonly returnOIDCResult?: boolean | undefined;
         readonly timeout?: number | undefined;
+        readonly revalidation?: ({
+            readonly enabled?: boolean | undefined;
+            readonly softRefreshThreshold?: number | undefined;
+            readonly minInterval?: string | undefined;
+            readonly fallbackInterval?: string | undefined;
+            readonly mode?: "auto" | "blocking" | undefined;
+            readonly onFailure?: "revoke" | undefined;
+        } & {
+            readonly method?: "introspection" | "refresh" | "userinfo" | undefined;
+        }) | undefined;
+        readonly claimMapping?: {
+            readonly externalIdentifier?: string | undefined;
+            readonly email?: string | undefined;
+            readonly name?: string | undefined;
+            readonly attributesKey?: string | undefined;
+        } | undefined;
+        readonly postLogoutRedirectUri?: string | undefined;
     } & {
         readonly url: string;
     };
     initAuth(configuration: OIDCConfiguration, data: unknown): Promise<InitIDPAuthResult>;
     processResponse(configuration: OIDCConfiguration, data: unknown): Promise<IDPResponse>;
+    revalidate(configuration: OIDCConfiguration, session: IDPSessionState): Promise<RevalidationResult>;
+    buildLogoutUrl(configuration: OIDCConfiguration, request: LogoutUrlRequest): Promise<string | null>;
+    validateLogoutToken(configuration: OIDCConfiguration, logoutToken: string): Promise<LogoutTokenClaims>;
+    /**
+     * Resolve the requested scope, appending `offline_access` when refresh-token
+     * re-validation is enabled (so the IdP issues a refresh token to revalidate against).
+     */
+    private resolveScope;
     getPublicConfiguration({ clientSecret, ...config }: OIDCConfiguration): Partial<OIDCConfiguration>;
     private createOIDCClient;
 }

package/dist/types/model/service/idp/providers/OIDCProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OIDCProvider.d.ts","sourceRoot":"","sources":["../../../../../../src/model/service/idp/providers/OIDCProvider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAGpG,OAAO,EAAE,iBAAiB,EAAkC,MAAM,aAAa,CAAA;AAM/E,qBAAa,YAAa,YAAW,uBAAuB,CAAC,iBAAiB,CAAC;IAC9E,OAAO,CAAC,WAAW,CAAqC;IAExD,qBAAqB;;;;;;;;;;;;;;;MAAiE;IAEzE,QAAQ,CAAC,aAAa,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC;IASrF,eAAe,CAAC,aAAa,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IAWnG,sBAAsB,CAAC,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;YAIpF,gBAAgB;CAoB9B"}
+{"version":3,"file":"OIDCProvider.d.ts","sourceRoot":"","sources":["../../../../../../src/model/service/idp/providers/OIDCProvider.ts"],"names":[],"mappings":"AACA,OAAO,EACN,uBAAuB,EACvB,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,MAAM,+BAA+B,CAAA;AAGtC,OAAO,EAAE,iBAAiB,EAAkC,MAAM,gBAAgB,CAAA;AAOlF,qBAAa,YAAa,YAAW,uBAAuB,CAAC,iBAAiB,CAAC;IAC9E,OAAO,CAAC,WAAW,CAAqC;IAExD,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAAiE;IAEzE,QAAQ,CAAC,aAAa,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAOjG;IAEY,eAAe,CAAC,aAAa,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAalG;IAEY,UAAU,CAAC,aAAa,EAAE,iBAAiB,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAM/G;IAEY,cAAc,CAAC,aAAa,EAAE,iBAAiB,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAG/G;IAEY,mBAAmB,CAAC,aAAa,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAGlH;IAED;;;OAGG;IACH,OAAO,CAAC,YAAY;IAUpB,sBAAsB,CAAC,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAEjG;YAEa,gBAAgB;CAqB9B"}

package/dist/types/model/service/idp/providers/OIDCTypes.d.ts

@@ -1,8 +1,53 @@
 import * as Typesafe from '@contember/typesafe';
+import { ClientAuthMethod } from 'openid-client';
 export interface OIDCSessionData {
     nonce: string;
     state: string;
 }
+/** OIDC re-validation config: the generic settings plus the OIDC-specific probe method. */
+export declare const OIDCRevalidationConfig: Typesafe.Type<{
+    readonly enabled?: boolean | undefined;
+    readonly softRefreshThreshold?: number | undefined;
+    readonly minInterval?: string | undefined;
+    readonly fallbackInterval?: string | undefined;
+    readonly mode?: "auto" | "blocking" | undefined;
+    readonly onFailure?: "revoke" | undefined;
+} & {
+    readonly method?: "introspection" | "refresh" | "userinfo" | undefined;
+}>;
+export type OIDCRevalidationConfig = ReturnType<typeof OIDCRevalidationConfig>;
+/**
+ * Maps provider claims onto the normalized {@link IDPResponse} fields. Each value is a claim
+ * name, dot-path supported (e.g. `address.region`). Lets a provider whose claims don't follow
+ * the OIDC defaults still be consumed without a per-provider code change.
+ */
+export declare const OIDCClaimMapping: {
+    (input: unknown, path?: PropertyKey[]): {
+        readonly externalIdentifier?: string | undefined;
+        readonly email?: string | undefined;
+        readonly name?: string | undefined;
+        readonly attributesKey?: string | undefined;
+    };
+    inner: {
+        /**
+         * Claim used as the stable external identifier (the IdP subject). Default `sub`.
+         * Must resolve to a scalar (string/number) — a non-scalar claim is rejected at sign-in.
+         * Mapping this to a claim that only appears in userInfo / `attributes` takes the federation
+         * key off the signature-verified ID-token subject; prefer a signed claim where possible.
+         */
+        externalIdentifier: Typesafe.Type<string>;
+        /** Claim used as the e-mail address. Default `email`. */
+        email: Typesafe.Type<string>;
+        /** Claim used as the display name. Default `name`. */
+        name: Typesafe.Type<string>;
+        /**
+         * Key of a nested object whose properties are lifted to the top level before mapping.
+         * Some providers (notably Apereo CAS userinfo) nest the actual claims under `attributes`.
+         */
+        attributesKey: Typesafe.Type<string>;
+    };
+};
+export type OIDCClaimMapping = ReturnType<typeof OIDCClaimMapping>;
 export declare const OIDCConfigurationOptions: {
     (input: unknown, path?: PropertyKey[]): {
         readonly responseType?: string | undefined;
@@ -10,9 +55,27 @@ export declare const OIDCConfigurationOptions: {
         readonly scope?: string | undefined;
         readonly additionalAuthorizedParties?: readonly string[] | undefined;
         readonly idTokenSignedResponseAlg?: string | undefined;
+        readonly tokenEndpointAuthMethod?: ClientAuthMethod | undefined;
         readonly fetchUserInfo?: boolean | undefined;
         readonly returnOIDCResult?: boolean | undefined;
         readonly timeout?: number | undefined;
+        readonly revalidation?: ({
+            readonly enabled?: boolean | undefined;
+            readonly softRefreshThreshold?: number | undefined;
+            readonly minInterval?: string | undefined;
+            readonly fallbackInterval?: string | undefined;
+            readonly mode?: "auto" | "blocking" | undefined;
+            readonly onFailure?: "revoke" | undefined;
+        } & {
+            readonly method?: "introspection" | "refresh" | "userinfo" | undefined;
+        }) | undefined;
+        readonly claimMapping?: {
+            readonly externalIdentifier?: string | undefined;
+            readonly email?: string | undefined;
+            readonly name?: string | undefined;
+            readonly attributesKey?: string | undefined;
+        } | undefined;
+        readonly postLogoutRedirectUri?: string | undefined;
     };
     inner: {
         responseType: Typesafe.Type<string>;
@@ -20,9 +83,57 @@ export declare const OIDCConfigurationOptions: {
         scope: Typesafe.Type<string>;
         additionalAuthorizedParties: Typesafe.Type<readonly string[]>;
         idTokenSignedResponseAlg: Typesafe.Type<string>;
+        /**
+         * How the client authenticates to the token endpoint. `openid-client` defaults to
+         * `client_secret_basic`; set `client_secret_post` for providers (e.g. some Apereo CAS
+         * registrations) that only accept the secret in the request body.
+         */
+        tokenEndpointAuthMethod: Typesafe.Type<ClientAuthMethod>;
         fetchUserInfo: Typesafe.Type<boolean>;
         returnOIDCResult: Typesafe.Type<boolean>;
         timeout: Typesafe.Type<number>;
+        revalidation: Typesafe.Type<{
+            readonly enabled?: boolean | undefined;
+            readonly softRefreshThreshold?: number | undefined;
+            readonly minInterval?: string | undefined;
+            readonly fallbackInterval?: string | undefined;
+            readonly mode?: "auto" | "blocking" | undefined;
+            readonly onFailure?: "revoke" | undefined;
+        } & {
+            readonly method?: "introspection" | "refresh" | "userinfo" | undefined;
+        }>;
+        claimMapping: {
+            (input: unknown, path?: PropertyKey[]): {
+                readonly externalIdentifier?: string | undefined;
+                readonly email?: string | undefined;
+                readonly name?: string | undefined;
+                readonly attributesKey?: string | undefined;
+            };
+            inner: {
+                /**
+                 * Claim used as the stable external identifier (the IdP subject). Default `sub`.
+                 * Must resolve to a scalar (string/number) — a non-scalar claim is rejected at sign-in.
+                 * Mapping this to a claim that only appears in userInfo / `attributes` takes the federation
+                 * key off the signature-verified ID-token subject; prefer a signed claim where possible.
+                 */
+                externalIdentifier: Typesafe.Type<string>;
+                /** Claim used as the e-mail address. Default `email`. */
+                email: Typesafe.Type<string>;
+                /** Claim used as the display name. Default `name`. */
+                name: Typesafe.Type<string>;
+                /**
+                 * Key of a nested object whose properties are lifted to the top level before mapping.
+                 * Some providers (notably Apereo CAS userinfo) nest the actual claims under `attributes`.
+                 */
+                attributesKey: Typesafe.Type<string>;
+            };
+        };
+        /**
+         * Where the IdP should send the browser back after an RP-initiated (front-channel) logout
+         * (A10). Used as `post_logout_redirect_uri` in the end-session URL; must be registered at the
+         * IdP. When unset, the IdP applies its own default post-logout behavior.
+         */
+        postLogoutRedirectUri: Typesafe.Type<string>;
     };
 };
 export declare const BaseOIDCConfiguration: Typesafe.Type<{
@@ -35,9 +146,27 @@ export declare const BaseOIDCConfiguration: Typesafe.Type<{
     readonly scope?: string | undefined;
     readonly additionalAuthorizedParties?: readonly string[] | undefined;
     readonly idTokenSignedResponseAlg?: string | undefined;
+    readonly tokenEndpointAuthMethod?: ClientAuthMethod | undefined;
     readonly fetchUserInfo?: boolean | undefined;
     readonly returnOIDCResult?: boolean | undefined;
     readonly timeout?: number | undefined;
+    readonly revalidation?: ({
+        readonly enabled?: boolean | undefined;
+        readonly softRefreshThreshold?: number | undefined;
+        readonly minInterval?: string | undefined;
+        readonly fallbackInterval?: string | undefined;
+        readonly mode?: "auto" | "blocking" | undefined;
+        readonly onFailure?: "revoke" | undefined;
+    } & {
+        readonly method?: "introspection" | "refresh" | "userinfo" | undefined;
+    }) | undefined;
+    readonly claimMapping?: {
+        readonly externalIdentifier?: string | undefined;
+        readonly email?: string | undefined;
+        readonly name?: string | undefined;
+        readonly attributesKey?: string | undefined;
+    } | undefined;
+    readonly postLogoutRedirectUri?: string | undefined;
 }>;
 export declare const OIDCConfiguration: Typesafe.Type<{
     readonly url: string;
@@ -49,9 +178,27 @@ export declare const OIDCConfiguration: Typesafe.Type<{
     readonly scope?: string | undefined;
     readonly additionalAuthorizedParties?: readonly string[] | undefined;
     readonly idTokenSignedResponseAlg?: string | undefined;
+    readonly tokenEndpointAuthMethod?: ClientAuthMethod | undefined;
     readonly fetchUserInfo?: boolean | undefined;
     readonly returnOIDCResult?: boolean | undefined;
     readonly timeout?: number | undefined;
+    readonly revalidation?: ({
+        readonly enabled?: boolean | undefined;
+        readonly softRefreshThreshold?: number | undefined;
+        readonly minInterval?: string | undefined;
+        readonly fallbackInterval?: string | undefined;
+        readonly mode?: "auto" | "blocking" | undefined;
+        readonly onFailure?: "revoke" | undefined;
+    } & {
+        readonly method?: "introspection" | "refresh" | "userinfo" | undefined;
+    }) | undefined;
+    readonly claimMapping?: {
+        readonly externalIdentifier?: string | undefined;
+        readonly email?: string | undefined;
+        readonly name?: string | undefined;
+        readonly attributesKey?: string | undefined;
+    } | undefined;
+    readonly postLogoutRedirectUri?: string | undefined;
 } & {
     readonly url: string;
 }>;

package/dist/types/model/service/idp/providers/OIDCTypes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OIDCTypes.d.ts","sourceRoot":"","sources":["../../../../../../src/model/service/idp/providers/OIDCTypes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAG/C,MAAM,WAAW,eAAe;IAC/B,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;CACb;AAED,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;CASnC,CAAA;AACF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;EAOjC,CAAA;AAED,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;EAK7B,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAEpE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;EAgB5B,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAElE,eAAO,MAAM,YAAY;;;;;;;;;;;CAOvB,CAAA;AAEF,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAA"}
+{"version":3,"file":"OIDCTypes.d.ts","sourceRoot":"","sources":["../../../../../../src/model/service/idp/providers/OIDCTypes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAgB,MAAM,eAAe,CAAA;AAG9D,MAAM,WAAW,eAAe;IAC/B,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;CACb;AAED,2FAA2F;AAC3F,eAAO,MAAM,sBAAsB;;;;;;;;;EAMlC,CAAA;AAED,MAAM,MAAM,sBAAsB,GAAG,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAE9E;;;;GAIG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;QAC5B;;;;;WAKG;;QAEH,yDAAyD;;QAEzD,sDAAsD;;QAEtD;;;WAGG;;;CAEF,CAAA;AAEF,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAElE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAMpC;;;;WAIG;;;;;;;;;;;;;;;;;;;;;;;gBA9BH;;;;;mBAKG;;gBAEH,yDAAyD;;gBAEzD,sDAAsD;;gBAEtD;;;mBAGG;;;;QA+BH;;;;WAIG;;;CAEF,CAAA;AACF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAOjC,CAAA;AAED,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAK7B,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAEpE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;EAgB5B,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAElE,eAAO,MAAM,YAAY;;;;;;;;;;;CAOvB,CAAA;AAEF,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAA"}

package/dist/types/model/service/idp/providers/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../../../src/model/service/idp/providers/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAE/C,eAAO,MAAM,aAAa,GACxB,CAAC,SAAS,QAAQ,CAAC,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,kBAAkB;IAAE,KAAI,OAAO,EAAE,MAAM,GAAG,KAAK,CAAA;CAAE,MAAM,OAAO,OAAO,KAAG,CASzH,CAAA"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../../../src/model/service/idp/providers/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAE/C,eAAO,MAAM,aAAa,GACxB,CAAC,SAAS,QAAQ,CAAC,IAAI,QAAQ,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB;IAAE,KAAI,OAAO,EAAE,MAAM,GAAG,KAAK,CAAA;CAAE,aAAa,OAAO,KAAG,CASzH,CAAA"}

package/dist/types/model/service/index.d.ts

@@ -1,20 +1,34 @@
-export * from './apiKey';
-export * from './idp';
-export * from './EmailValidator';
-export * from './IDPSignInManager';
-export * from './InviteManager';
-export * from './MailTemplateManager';
-export * from './MembershipValidator';
-export * from './OtpAuthenticator';
-export * from './OtpManager';
-export * from './PasswordChangeManager';
-export * from './PasswordResetManager';
-export * from './PersonAccessManager';
-export * from './PersonManager';
-export * from './ProjectManager';
-export * from './ProjectMemberManager';
-export * from './RolesManager';
-export * from './SecretsManager';
-export * from './SignInManager';
-export * from './SignUpManager';
+export * from './apiKey/index.js';
+export * from './captcha/index.js';
+export * from './idp/index.js';
+export * from './AuthLogService.js';
+export * from './AuthPolicyManager.js';
+export * from './CustomRoleManager.js';
+export * from './GlobalRoleValidator.js';
+export * from './AuthPolicyResolver.js';
+export * from './BackupCodeManager.js';
+export * from './EmailChangeManager.js';
+export * from './EmailOtpManager.js';
+export * from './EmailValidator.js';
+export * from './EmailVerificationManager.js';
+export * from './IDPSignInManager.js';
+export * from './InviteManager.js';
+export * from './LoginRiskAnalyzer.js';
+export * from './MailTemplateManager.js';
+export * from './MembershipValidator.js';
+export * from './OtpAuthenticator.js';
+export * from './OtpManager.js';
+export * from './PanelAccessResolver.js';
+export * from './PasswordChangeManager.js';
+export * from './PasswordResetManager.js';
+export * from './PersonAccessManager.js';
+export * from './PersonManager.js';
+export * from './ProjectManager.js';
+export * from './RateLimiter.js';
+export * from './ProjectMemberManager.js';
+export * from './RolesManager.js';
+export * from './SecretsManager.js';
+export * from './SignInManager.js';
+export * from './SignOutManager.js';
+export * from './SignUpManager.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/model/service/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/model/service/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAA;AACxB,cAAc,OAAO,CAAA;AAErB,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,oBAAoB,CAAA;AAClC,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,wBAAwB,CAAA;AACtC,cAAc,uBAAuB,CAAA;AACrC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA;AAChC,cAAc,wBAAwB,CAAA;AACtC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,kBAAkB,CAAA;AAChC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/model/service/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,gBAAgB,CAAA;AAE9B,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,0BAA0B,CAAA;AACxC,cAAc,yBAAyB,CAAA;AACvC,cAAc,wBAAwB,CAAA;AACtC,cAAc,yBAAyB,CAAA;AACvC,cAAc,sBAAsB,CAAA;AACpC,cAAc,qBAAqB,CAAA;AACnC,cAAc,+BAA+B,CAAA;AAC7C,cAAc,uBAAuB,CAAA;AACrC,cAAc,oBAAoB,CAAA;AAClC,cAAc,wBAAwB,CAAA;AACtC,cAAc,0BAA0B,CAAA;AACxC,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,0BAA0B,CAAA;AACxC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,2BAA2B,CAAA;AACzC,cAAc,0BAA0B,CAAA;AACxC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,2BAA2B,CAAA;AACzC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA"}

package/dist/types/model/service/membershipUtils.d.ts

@@ -1,4 +1,4 @@
-import { MembershipInput, MembershipUpdateInput } from '../commands';
+import { MembershipInput, MembershipUpdateInput } from '../commands/index.js';
 import { Acl } from '@contember/schema';
 export declare const createSetMembershipVariables: (memberships: readonly Acl.Membership[]) => MembershipInput[];
 export declare const createAppendMembershipVariables: (memberships: readonly Acl.Membership[]) => MembershipInput[];

package/dist/types/model/service/membershipUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"membershipUtils.d.ts","sourceRoot":"","sources":["../../../../src/model/service/membershipUtils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAuB,MAAM,aAAa,CAAA;AACzF,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,eAAO,MAAM,4BAA4B,GAAI,aAAa,SAAS,GAAG,CAAC,UAAU,EAAE,KAAG,eAAe,EAKpG,CAAA;AACD,eAAO,MAAM,+BAA+B,GAAI,aAAa,SAAS,GAAG,CAAC,UAAU,EAAE,KAAG,eAAe,EAKvG,CAAA;AAED,eAAO,MAAM,4BAA4B,GACxC,gBAAgB,SAAS,GAAG,CAAC,UAAU,EAAE,EACzC,gBAAgB,SAAS,GAAG,CAAC,UAAU,EAAE,KACvC,qBAAqB,EA8BvB,CAAA"}
+{"version":3,"file":"membershipUtils.d.ts","sourceRoot":"","sources":["../../../../src/model/service/membershipUtils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAuB,MAAM,sBAAsB,CAAA;AAClG,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,eAAO,MAAM,4BAA4B,gBAAiB,SAAS,GAAG,CAAC,UAAU,EAAE,KAAG,eAAe,EAKpG,CAAA;AACD,eAAO,MAAM,+BAA+B,gBAAiB,SAAS,GAAG,CAAC,UAAU,EAAE,KAAG,eAAe,EAKvG,CAAA;AAED,eAAO,MAAM,4BAA4B,mBACxB,SAAS,GAAG,CAAC,UAAU,EAAE,kBACzB,SAAS,GAAG,CAAC,UAAU,EAAE,KACvC,qBAAqB,EA8BvB,CAAA"}

package/dist/types/model/type/AuthLog.d.ts

@@ -1,2 +1,2 @@
-export type AuthActionType = 'login' | 'create_session_token' | 'idp_login' | 'password_reset_init' | 'password_reset' | 'password_change' | 'email_change' | '2fa_disable' | '2fa_enable' | 'passwordless_login_init' | 'passwordless_login_exchange' | 'passwordless_login' | 'person_disable';
+export type AuthActionType = 'login' | 'create_session_token' | 'idp_login' | 'password_reset_init' | 'password_reset' | 'password_change' | 'email_change' | 'email_verify_init' | 'email_verify_complete' | 'email_change_init' | 'email_change_complete' | '2fa_disable' | '2fa_enable' | 'passwordless_login_init' | 'passwordless_login_exchange' | 'passwordless_login' | 'person_disable' | 'person_enable' | 'session_revoked_by_user' | 'forced_sign_out' | 'global_role_grant' | 'global_role_revoke' | 'project_membership_create' | 'project_membership_update' | 'project_membership_remove' | 'api_key_create' | 'api_key_disable' | 'idp_create' | 'idp_update' | 'idp_disable' | 'idp_enable' | 'idp_session_revalidated' | 'idp_session_revoked' | 'idp_session_revalidation_failed' | 'idp_logout_initiated' | 'idp_backchannel_logout' | 'idp_disconnect' | 'idp_role_mapped' | 'idp_role_mapping_failed' | 'project_create' | 'project_update' | 'project_secret_change' | 'mail_template_change' | 'tenant_config_change' | 'person_invite' | 'backup_code_generated' | 'backup_code_used' | 'backup_code_regenerated' | 'email_otp_sent' | 'mfa_enrollment_required' | 'mfa_reset' | 'session_expired_idle' | 'session_policy_applied' | 'auth_policy_change' | 'custom_role_change' | 'unusual_login_detected' | 'step_up_required';
 //# sourceMappingURL=AuthLog.d.ts.map

package/dist/types/model/type/AuthLog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthLog.d.ts","sourceRoot":"","sources":["../../../../src/model/type/AuthLog.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,cAAc,GACvB,OAAO,GACP,sBAAsB,GACtB,WAAW,GACX,qBAAqB,GACrB,gBAAgB,GAChB,iBAAiB,GACjB,cAAc,GACd,aAAa,GACb,YAAY,GACZ,yBAAyB,GACzB,6BAA6B,GAC7B,oBAAoB,GACpB,gBAAgB,CAAA"}
+{"version":3,"file":"AuthLog.d.ts","sourceRoot":"","sources":["../../../../src/model/type/AuthLog.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,cAAc,GACvB,OAAO,GACP,sBAAsB,GACtB,WAAW,GACX,qBAAqB,GACrB,gBAAgB,GAChB,iBAAiB,GACjB,cAAc,GACd,mBAAmB,GACnB,uBAAuB,GACvB,mBAAmB,GACnB,uBAAuB,GACvB,aAAa,GACb,YAAY,GACZ,yBAAyB,GACzB,6BAA6B,GAC7B,oBAAoB,GACpB,gBAAgB,GAChB,eAAe,GACf,yBAAyB,GACzB,iBAAiB,GACjB,mBAAmB,GACnB,oBAAoB,GACpB,2BAA2B,GAC3B,2BAA2B,GAC3B,2BAA2B,GAC3B,gBAAgB,GAChB,iBAAiB,GACjB,YAAY,GACZ,YAAY,GACZ,aAAa,GACb,YAAY,GACZ,yBAAyB,GACzB,qBAAqB,GACrB,iCAAiC,GACjC,sBAAsB,GACtB,wBAAwB,GACxB,gBAAgB,GAChB,iBAAiB,GACjB,yBAAyB,GACzB,gBAAgB,GAChB,gBAAgB,GAChB,uBAAuB,GACvB,sBAAsB,GACtB,sBAAsB,GACtB,eAAe,GACf,uBAAuB,GACvB,kBAAkB,GAClB,yBAAyB,GACzB,gBAAgB,GAChB,yBAAyB,GACzB,WAAW,GACX,sBAAsB,GACtB,wBAAwB,GACxB,oBAAoB,GACpB,oBAAoB,GACpB,wBAAwB,GACxB,kBAAkB,CAAA"}

package/dist/types/model/type/AuthPolicy.d.ts

@@ -0,0 +1,30 @@
+import { IPostgresInterval } from 'postgres-interval';
+export type AuthPolicyScope = 'global' | 'project';
+/** A row of the `auth_policy` table. Intervals come back as {@link IPostgresInterval}, like {@link ConfigRow}. */
+export type AuthPolicyRow = {
+    readonly id: string;
+    readonly scope: AuthPolicyScope;
+    readonly project_id: string | null;
+    readonly roles: string[];
+    readonly mfa_required: boolean | null;
+    readonly token_expiration: IPostgresInterval | null;
+    readonly idle_timeout: IPostgresInterval | null;
+    readonly grace_duration: IPostgresInterval | null;
+    readonly remember_me_allowed: boolean | null;
+    readonly created_at: Date;
+    readonly updated_at: Date;
+};
+/**
+ * The effective, aggregated policy for an identity. Shared output of
+ * {@link AuthPolicyResolver}: A06 consumes {@link mfaRequired}; A19 will consume
+ * the session fields. Where nothing matches, this is the inert baseline
+ * (`mfaRequired=false`, session fields null).
+ */
+export type EffectivePolicy = {
+    readonly mfaRequired: boolean;
+    readonly tokenExpiration: IPostgresInterval | null;
+    readonly idleTimeout: IPostgresInterval | null;
+    readonly graceDuration: IPostgresInterval | null;
+    readonly rememberMeAllowed: boolean | null;
+};
+//# sourceMappingURL=AuthPolicy.d.ts.map

package/dist/types/model/type/AuthPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthPolicy.d.ts","sourceRoot":"","sources":["../../../../src/model/type/AuthPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAErD,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,SAAS,CAAA;AAElD,kHAAkH;AAClH,MAAM,MAAM,aAAa,GAAG;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAA;IACxB,QAAQ,CAAC,YAAY,EAAE,OAAO,GAAG,IAAI,CAAA;IACrC,QAAQ,CAAC,gBAAgB,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACnD,QAAQ,CAAC,YAAY,EAAE,iBAAiB,GAAG,IAAI,CAAA;IAC/C,QAAQ,CAAC,cAAc,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACjD,QAAQ,CAAC,mBAAmB,EAAE,OAAO,GAAG,IAAI,CAAA;IAC5C,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;CACzB,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG;IAC7B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,eAAe,EAAE,iBAAiB,GAAG,IAAI,CAAA;IAClD,QAAQ,CAAC,WAAW,EAAE,iBAAiB,GAAG,IAAI,CAAA;IAC9C,QAAQ,CAAC,aAAa,EAAE,iBAAiB,GAAG,IAAI,CAAA;IAChD,QAAQ,CAAC,iBAAiB,EAAE,OAAO,GAAG,IAAI,CAAA;CAC1C,CAAA"}

package/dist/types/model/type/Config.d.ts

@@ -1,8 +1,10 @@
-import { ConfigPolicy } from '../../schema';
+import { CaptchaProvider, ConfigPolicy } from '../../schema/index.js';
 import { IPostgresInterval } from 'postgres-interval';
-import { type Config as ConfigSchema } from '../../schema';
-import { Interval } from '../../schema/types';
+import { type Config as ConfigSchema } from '../../schema/index.js';
+import { Interval } from '../../schema/types.js';
 export type ConfigRow = {
+    signup_require_email_verification: boolean;
+    require_email_change_verification: boolean;
     passwordless_enabled: ConfigPolicy;
     passwordless_url: string | null;
     passwordless_expiration: IPostgresInterval;
@@ -13,16 +15,51 @@ export type ConfigRow = {
     password_require_special: number;
     password_pattern: string | null;
     password_check_blacklist: boolean;
+    password_check_hibp: boolean;
     login_base_backoff: IPostgresInterval;
     login_max_backoff: IPostgresInterval;
     login_attempt_window: IPostgresInterval;
     login_reveal_user_exits: boolean;
+    login_reveal_login_method: boolean;
     login_default_token_expiration: IPostgresInterval;
     login_max_token_expiration: IPostgresInterval | null;
+    login_mfa_grace_duration: IPostgresInterval;
+    login_anomaly_detection_enabled: boolean;
+    login_anomaly_history_size: number;
+    login_anomaly_email_threshold: number;
+    login_anomaly_step_up_threshold: number;
+    captcha_provider: CaptchaProvider | null;
+    captcha_secret: Buffer | null;
+    captcha_secret_version: number | null;
+    captcha_threshold: number | null;
+    captcha_protect_sign_up: boolean;
+    captcha_protect_password_reset: boolean;
+    captcha_protect_passwordless_init: boolean;
+    captcha_protect_email_verification: boolean;
+    rate_limit_sign_up_per_ip_limit: number;
+    rate_limit_sign_up_per_ip_window: IPostgresInterval;
+    rate_limit_login_per_ip_limit: number;
+    rate_limit_login_per_ip_window: IPostgresInterval;
+    rate_limit_password_reset_per_ip_limit: number;
+    rate_limit_password_reset_per_ip_window: IPostgresInterval;
+    rate_limit_passwordless_init_per_ip_limit: number;
+    rate_limit_passwordless_init_per_ip_window: IPostgresInterval;
+    rate_limit_email_otp_per_person_limit: number;
+    rate_limit_email_otp_per_person_window: IPostgresInterval;
+    rate_limit_email_verification_per_ip_limit: number;
+    rate_limit_email_verification_per_ip_window: IPostgresInterval;
+    panel_global_roles: readonly string[];
+    panel_project_roles: readonly string[];
 };
 export type Config = Omit<{
     [K in keyof ConfigSchema]: {
         [K2 in keyof ConfigSchema[K]]: Exclude<ConfigSchema[K][K2], Interval>;
     };
-}, '__typename'>;
+}, '__typename'> & {
+    /**
+     * Decrypted/plaintext captcha secret. Never exposed through the GraphQL
+     * schema — only the runtime validator reads it.
+     */
+    readonly captchaSecret: string | null;
+};
 //# sourceMappingURL=Config.d.ts.map

package/dist/types/model/type/Config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Config.d.ts","sourceRoot":"","sources":["../../../../src/model/type/Config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,KAAK,MAAM,IAAI,YAAY,EAAE,MAAM,cAAc,CAAA;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,MAAM,MAAM,SAAS,GAAG;IACvB,oBAAoB,EAAE,YAAY,CAAA;IAClC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,uBAAuB,EAAE,iBAAiB,CAAA;IAC1C,mBAAmB,EAAE,MAAM,CAAA;IAC3B,0BAA0B,EAAE,MAAM,CAAA;IAClC,0BAA0B,EAAE,MAAM,CAAA;IAClC,sBAAsB,EAAE,MAAM,CAAA;IAC9B,wBAAwB,EAAE,MAAM,CAAA;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,wBAAwB,EAAE,OAAO,CAAA;IACjC,kBAAkB,EAAE,iBAAiB,CAAA;IACrC,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,oBAAoB,EAAE,iBAAiB,CAAA;IACvC,uBAAuB,EAAE,OAAO,CAAA;IAChC,8BAA8B,EAAE,iBAAiB,CAAA;IACjD,0BAA0B,EAAE,iBAAiB,GAAG,IAAI,CAAA;CACpD,CAAA;AAED,MAAM,MAAM,MAAM,GAAG,IAAI,CACxB;KACE,CAAC,IAAI,MAAM,YAAY,GAAG;SACzB,EAAE,IAAI,MAAM,YAAY,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC;KACrE;CACD,EACD,YAAY,CACZ,CAAA"}
+{"version":3,"file":"Config.d.ts","sourceRoot":"","sources":["../../../../src/model/type/Config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,KAAK,MAAM,IAAI,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAChD,MAAM,MAAM,SAAS,GAAG;IACvB,iCAAiC,EAAE,OAAO,CAAA;IAC1C,iCAAiC,EAAE,OAAO,CAAA;IAC1C,oBAAoB,EAAE,YAAY,CAAA;IAClC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,uBAAuB,EAAE,iBAAiB,CAAA;IAC1C,mBAAmB,EAAE,MAAM,CAAA;IAC3B,0BAA0B,EAAE,MAAM,CAAA;IAClC,0BAA0B,EAAE,MAAM,CAAA;IAClC,sBAAsB,EAAE,MAAM,CAAA;IAC9B,wBAAwB,EAAE,MAAM,CAAA;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,wBAAwB,EAAE,OAAO,CAAA;IACjC,mBAAmB,EAAE,OAAO,CAAA;IAC5B,kBAAkB,EAAE,iBAAiB,CAAA;IACrC,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,oBAAoB,EAAE,iBAAiB,CAAA;IACvC,uBAAuB,EAAE,OAAO,CAAA;IAChC,yBAAyB,EAAE,OAAO,CAAA;IAClC,8BAA8B,EAAE,iBAAiB,CAAA;IACjD,0BAA0B,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACpD,wBAAwB,EAAE,iBAAiB,CAAA;IAC3C,+BAA+B,EAAE,OAAO,CAAA;IACxC,0BAA0B,EAAE,MAAM,CAAA;IAClC,6BAA6B,EAAE,MAAM,CAAA;IACrC,+BAA+B,EAAE,MAAM,CAAA;IACvC,gBAAgB,EAAE,eAAe,GAAG,IAAI,CAAA;IACxC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,uBAAuB,EAAE,OAAO,CAAA;IAChC,8BAA8B,EAAE,OAAO,CAAA;IACvC,iCAAiC,EAAE,OAAO,CAAA;IAC1C,kCAAkC,EAAE,OAAO,CAAA;IAC3C,+BAA+B,EAAE,MAAM,CAAA;IACvC,gCAAgC,EAAE,iBAAiB,CAAA;IACnD,6BAA6B,EAAE,MAAM,CAAA;IACrC,8BAA8B,EAAE,iBAAiB,CAAA;IACjD,sCAAsC,EAAE,MAAM,CAAA;IAC9C,uCAAuC,EAAE,iBAAiB,CAAA;IAC1D,yCAAyC,EAAE,MAAM,CAAA;IACjD,0CAA0C,EAAE,iBAAiB,CAAA;IAC7D,qCAAqC,EAAE,MAAM,CAAA;IAC7C,sCAAsC,EAAE,iBAAiB,CAAA;IACzD,0CAA0C,EAAE,MAAM,CAAA;IAClD,2CAA2C,EAAE,iBAAiB,CAAA;IAE9D,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAA;CACtC,CAAA;AAED,MAAM,MAAM,MAAM,GACf,IAAI,CACL;KACE,CAAC,IAAI,MAAM,YAAY,GAAG;SACzB,EAAE,IAAI,MAAM,YAAY,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC;KACrE;CACD,EACD,YAAY,CACZ,GACC;IACD;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;CACrC,CAAA"}

package/dist/types/model/type/CustomRole.d.ts

@@ -0,0 +1,9 @@
+export type CustomRoleRow = {
+    readonly id: string;
+    readonly slug: string;
+    readonly description: string | null;
+    readonly grants: unknown;
+    readonly created_at: Date;
+    readonly updated_at: Date;
+};
+//# sourceMappingURL=CustomRole.d.ts.map

package/dist/types/model/type/CustomRole.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CustomRole.d.ts","sourceRoot":"","sources":["../../../../src/model/type/CustomRole.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;CACzB,CAAA"}

package/dist/types/model/type/IdentityProvider.d.ts

@@ -8,5 +8,9 @@ export interface IdentityProviderOptions {
     autoSignUp: boolean;
     exclusive: boolean;
     initReturnsConfig: boolean;
+    requireVerifiedEmail: boolean;
+    assumeEmailVerified: boolean;
+    /** A person linked to this provider may authenticate only through it. */
+    disableLocalAuthentication: boolean;
 }
 //# sourceMappingURL=IdentityProvider.d.ts.map

package/dist/types/model/type/IdentityProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityProvider.d.ts","sourceRoot":"","sources":["../../../../src/model/type/IdentityProvider.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAClC,OAAO,EAAE,uBAAuB,CAAA;CAChC;AAED,MAAM,WAAW,uBAAuB;IACvC,UAAU,EAAE,OAAO,CAAA;IACnB,SAAS,EAAE,OAAO,CAAA;IAClB,iBAAiB,EAAE,OAAO,CAAA;CAC1B"}
+{"version":3,"file":"IdentityProvider.d.ts","sourceRoot":"","sources":["../../../../src/model/type/IdentityProvider.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAClC,OAAO,EAAE,uBAAuB,CAAA;CAChC;AAED,MAAM,WAAW,uBAAuB;IACvC,UAAU,EAAE,OAAO,CAAA;IACnB,SAAS,EAAE,OAAO,CAAA;IAClB,iBAAiB,EAAE,OAAO,CAAA;IAC1B,oBAAoB,EAAE,OAAO,CAAA;IAC7B,mBAAmB,EAAE,OAAO,CAAA;IAC5B,yEAAyE;IACzE,0BAA0B,EAAE,OAAO,CAAA;CACnC"}

package/dist/types/model/type/PersonToken.d.ts

@@ -1,15 +1,26 @@
 export declare namespace PersonToken {
-    type Type = 'password_reset' | 'passwordless';
+    type Type = 'password_reset' | 'passwordless' | 'mfa_email_otp' | 'email_verification' | 'email_change';
     type ValidationType = 'token' | 'otp';
+    /**
+     * Payload carried by an e-mail-bearing token: the address the token is bound
+     * to. For email_change it is the pending NEW address; for email_verification
+     * it is the address being verified at the time the token was issued.
+     */
+    interface TokenMeta {
+        email: string;
+    }
     interface Row {
         id: string;
         created_at: Date;
         token_hash: string;
         used_at: null | Date;
         expires_at: Date;
+        /** `expires_at <= now()` computed on the DB clock — the authoritative expiry gate. */
+        is_expired: boolean;
         person_id: string;
         otp_hash: string | null;
         otp_attempts: number;
+        meta: TokenMeta | null;
     }
     type TokenValidationError = 'TOKEN_NOT_FOUND' | 'TOKEN_INVALID' | 'TOKEN_USED' | 'TOKEN_EXPIRED';
 }

package/dist/types/model/type/PersonToken.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PersonToken.d.ts","sourceRoot":"","sources":["../../../../src/model/type/PersonToken.ts"],"names":[],"mappings":"AAAA,yBAAiB,WAAW,CAAC;IAC5B,KAAY,IAAI,GAAG,gBAAgB,GAAG,cAAc,CAAA;IACpD,KAAY,cAAc,GAAG,OAAO,GAAG,KAAK,CAAA;IAE5C,UAAiB,GAAG;QACnB,EAAE,EAAE,MAAM,CAAA;QACV,UAAU,EAAE,IAAI,CAAA;QAChB,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,EAAE,IAAI,GAAG,IAAI,CAAA;QACpB,UAAU,EAAE,IAAI,CAAA;QAChB,SAAS,EAAE,MAAM,CAAA;QACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;QACvB,YAAY,EAAE,MAAM,CAAA;KACpB;IAED,KAAY,oBAAoB,GAC7B,iBAAiB,GACjB,eAAe,GACf,YAAY,GACZ,eAAe,CAAA;CAClB"}
+{"version":3,"file":"PersonToken.d.ts","sourceRoot":"","sources":["../../../../src/model/type/PersonToken.ts"],"names":[],"mappings":"AAAA,yBAAiB,WAAW,CAAC;IAC5B,KAAY,IAAI,GAAG,gBAAgB,GAAG,cAAc,GAAG,eAAe,GAAG,oBAAoB,GAAG,cAAc,CAAA;IAC9G,KAAY,cAAc,GAAG,OAAO,GAAG,KAAK,CAAA;IAE5C;;;;OAIG;IACH,UAAiB,SAAS;QACzB,KAAK,EAAE,MAAM,CAAA;KACb;IAED,UAAiB,GAAG;QACnB,EAAE,EAAE,MAAM,CAAA;QACV,UAAU,EAAE,IAAI,CAAA;QAChB,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,EAAE,IAAI,GAAG,IAAI,CAAA;QACpB,UAAU,EAAE,IAAI,CAAA;QAChB,sFAAsF;QACtF,UAAU,EAAE,OAAO,CAAA;QACnB,SAAS,EAAE,MAAM,CAAA;QACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;QACvB,YAAY,EAAE,MAAM,CAAA;QACpB,IAAI,EAAE,SAAS,GAAG,IAAI,CAAA;KACtB;IAED,KAAY,oBAAoB,GAC7B,iBAAiB,GACjB,eAAe,GACf,YAAY,GACZ,eAAe,CAAA;CAClB"}