@contember/engine-tenant-api 2.2.0-alpha.3 → 2.2.0-alpha.6

package/dist/types/model/service/apiKey/ApiKeyManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKeyManager.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/apiKey/ApiKeyManager.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,iBAAiB,EAOjB,MAAM,yBAAyB,CAAA;AAGhC,OAAO,EAAE,QAAQ,EAA6B,MAAM,yBAAyB,CAAA;AAC7E,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAExE,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AACvC,OAAO,EAAuC,SAAS,EAAqC,MAAM,wBAAwB,CAAA;AAI1H,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAA;AACvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA;AAExE,qBAAa,aAAa;IAExB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,wBAAwB;IACzC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;gBAJtB,aAAa,EAAE,aAAa,EAC5B,kBAAkB,EAAE,kBAAkB,EACtC,cAAc,EAAE,cAAc,EAC9B,wBAAwB,GAAE,wBAAyD,EACnF,qBAAqB,CAAC,EAAE,qBAAqB,YAAA;IAGzD,gBAAgB,CACrB,SAAS,EAAE,eAAe,EAC1B,aAAa,EAAE,eAAe,EAC9B,KAAK,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,iBAAiB,EAC/B,aAAa,CAAC,EAAE,iBAAiB,GAC/B,OAAO,CAAC,cAAc,CAAC;IAsHpB,mBAAmB,CACxB,SAAS,EAAE,eAAe,EAC1B,UAAU,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,iBAAiB,EAC/B,kBAAkB,CAAC,EAAE,OAAO,GAC1B,OAAO,CAAC,MAAM,CAAC;IAKlB;;;;OAIG;IACG,yBAAyB,CAC9B,SAAS,EAAE,eAAe,EAC1B,UAAU,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,iBAAiB,EAC/B,kBAAkB,CAAC,EAAE,OAAO,GAC1B,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IA0EnC,UAAU,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAMnF,mBAAmB,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIhF,aAAa,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI7E,sBAAsB,CAAC,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrF,2BAA2B,CAChC,SAAS,EAAE,eAAe,EAC1B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,SAAS,CAAC,EAAE,SAAS,EACrB,kBAAkB,CAAC,EAAE,OAAO,GAC1B,OAAO,CAAC,oBAAoB,CAAC;IAM1B,4BAA4B,CACjC,SAAS,EAAE,eAAe,EAC1B,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,EACtC,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,SAAS,EACrB,kBAAkB,CAAC,EAAE,OAAO,GAC1B,OAAO,CAAC,oBAAoB,CAAC;CAKhC;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;AAEpE,qBAAa,YAAY;aAIP,UAAU,EAAE,MAAM;aAClB,QAAQ,EAAE,MAAM;aAChB,KAAK,EAAE,MAAM,EAAE;aACf,QAAQ,EAAE,MAAM,GAAG,IAAI;aACvB,kBAAkB,EAAE,OAAO;IAP5C,QAAQ,CAAC,KAAK,QAAO;gBAGJ,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EAAE,EACf,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,kBAAkB,GAAE,OAAe;CAEpD;AAED,oBAAY,eAAe;IAC1B,SAAS,cAAc;IACvB,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,cAAc,mBAAmB;IACjC,mBAAmB,wBAAwB;CAC3C"}
+{"version":3,"file":"ApiKeyManager.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/apiKey/ApiKeyManager.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,iBAAiB,EAOjB,MAAM,yBAAyB,CAAA;AAGhC,OAAO,EAAE,QAAQ,EAA6B,MAAM,yBAAyB,CAAA;AAC7E,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAExE,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AACvC,OAAO,EAAuC,SAAS,EAAqC,MAAM,wBAAwB,CAAA;AAI1H,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAA;AACvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA;AAExE,qBAAa,aAAa;IAExB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,wBAAwB;IACzC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IALxC,YACkB,aAAa,EAAE,aAAa,EAC5B,kBAAkB,EAAE,kBAAkB,EACtC,cAAc,EAAE,cAAc,EAC9B,wBAAwB,GAAE,wBAAyD,EACnF,qBAAqB,CAAC,EAAE,qBAAqB,YAAA,EAC3D;IAEE,gBAAgB,CACrB,SAAS,EAAE,eAAe,EAC1B,aAAa,EAAE,eAAe,EAC9B,KAAK,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,iBAAiB,EAC/B,aAAa,CAAC,EAAE,iBAAiB,GAC/B,OAAO,CAAC,cAAc,CAAC,CAsHzB;IAEK,mBAAmB,CACxB,SAAS,EAAE,eAAe,EAC1B,UAAU,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,iBAAiB,EAC/B,kBAAkB,CAAC,EAAE,OAAO,GAC1B,OAAO,CAAC,MAAM,CAAC,CAGjB;IAED;;;;OAIG;IACG,yBAAyB,CAC9B,SAAS,EAAE,eAAe,EAC1B,UAAU,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,iBAAiB,EAC/B,kBAAkB,CAAC,EAAE,OAAO,GAC1B,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAwExC;IAEK,UAAU,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAIxF;IAEK,mBAAmB,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAErF;IAEK,aAAa,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAElF;IAEK,sBAAsB,CAAC,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1F;IAEK,2BAA2B,CAChC,SAAS,EAAE,eAAe,EAC1B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,SAAS,CAAC,EAAE,SAAS,EACrB,kBAAkB,CAAC,EAAE,OAAO,GAC1B,OAAO,CAAC,oBAAoB,CAAC,CAI/B;IAEK,4BAA4B,CACjC,SAAS,EAAE,eAAe,EAC1B,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,EACtC,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,SAAS,EACrB,kBAAkB,CAAC,EAAE,OAAO,GAC1B,OAAO,CAAC,oBAAoB,CAAC,CAI/B;CACD;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;AAEpE,qBAAa,YAAY;aAIP,UAAU,EAAE,MAAM;aAClB,QAAQ,EAAE,MAAM;aAChB,KAAK,EAAE,MAAM,EAAE;aACf,QAAQ,EAAE,MAAM,GAAG,IAAI;aACvB,kBAAkB,EAAE,OAAO;IAP5C,QAAQ,CAAC,KAAK,QAAO;IAErB,YACiB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EAAE,EACf,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,kBAAkB,GAAE,OAAe,EAChD;CACJ;AAED,oBAAY,eAAe;IAC1B,SAAS,cAAc;IACvB,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,cAAc,mBAAmB;IACjC,mBAAmB,wBAAwB;CAC3C"}

package/dist/types/model/service/apiKey/ApiKeyService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKeyService.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/apiKey/ApiKeyService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAKjE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAC1D,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,qBAAa,aAAa;IACnB,qBAAqB,CAC1B,EAAE,EAAE,eAAe,EACnB,WAAW,EAAE,MAAM,EACnB,KAAK,GAAE,SAAS,MAAM,EAAO,EAC7B,SAAS,CAAC,EAAE,SAAS,EACrB,kBAAkB,CAAC,EAAE,OAAO;IAevB,4BAA4B,CACjC,EAAE,EAAE,eAAe,EACnB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,EACtC,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,SAAS,EACrB,kBAAkB,CAAC,EAAE,OAAO;CAY7B;AAED,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAA;AAEtE,qBAAa,kBAAkB;aACF,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;aAAkB,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;gBAAtG,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAAkB,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAGlI,iBAAiB,IAAI,eAAe;CAWpC"}
+{"version":3,"file":"ApiKeyService.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/apiKey/ApiKeyService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAKjE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAC1D,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,qBAAa,aAAa;IACnB,qBAAqB,CAC1B,EAAE,EAAE,eAAe,EACnB,WAAW,EAAE,MAAM,EACnB,KAAK,GAAE,SAAS,MAAM,EAAO,EAC7B,SAAS,CAAC,EAAE,SAAS,EACrB,kBAAkB,CAAC,EAAE,OAAO,2CAa5B;IAEK,4BAA4B,CACjC,EAAE,EAAE,eAAe,EACnB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,EACtC,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,SAAS,EACrB,kBAAkB,CAAC,EAAE,OAAO,2CAW5B;CACD;AAED,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAA;AAEtE,qBAAa,kBAAkB;aACF,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;aAAkB,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAAlI,YAA4B,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAAkB,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,EACjI;IAED,iBAAiB,IAAI,eAAe,CAUnC;CACD"}

package/dist/types/model/service/apiKey/UnpersistedApiKeyManager.d.ts

@@ -7,6 +7,24 @@ import { VerifyResult } from './ApiKeyManager.js';
  * though no row exists in the `identity` table.
  */
 export declare const UNPERSISTED_ROOT_IDENTITY_ID = "f3b2c4d6-0000-4000-8000-000000000001";
+/**
+ * Well-known identity id for the pre-sign-in caller of a first-party UI served by the engine (the
+ * management panel's login screen). It holds exactly {@link TenantRole.LOGIN} and exists only in
+ * memory, so the surface it opens is fixed by this file rather than by whatever token an operator
+ * happened to configure.
+ */
+export declare const UNPERSISTED_LOGIN_IDENTITY_ID = "f3b2c4d6-0000-4000-8000-000000000002";
+/**
+ * Whether an identity id is one of the virtual identities above, i.e. has no row in `identity`.
+ * Anything writing a foreign key to `identity` must ask first — see `AuthLogService`.
+ */
+export declare const isUnpersistedIdentityId: (identityId: string | undefined) => boolean;
+/**
+ * The pre-sign-in caller of an engine-served UI, as an already-verified result. There is no token to
+ * present: the surface is reached by being routed there, so nothing is compared and nothing is read
+ * from the database.
+ */
+export declare const createUnpersistedLoginVerifyResult: () => VerifyResult;
 export interface UnpersistedApiKey {
     readonly tokenHash: TokenHash;
     readonly identityId: string;

package/dist/types/model/service/apiKey/UnpersistedApiKeyManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"UnpersistedApiKeyManager.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/apiKey/UnpersistedApiKeyManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwD,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAEtG,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEjD;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,yCAAyC,CAAA;AAElF,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CACjC;AAED;;;;;;;GAOG;AACH,qBAAa,wBAAwB;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8B;gBAE1C,OAAO,GAAE,SAAS,iBAAiB,EAAO;IAItD,IAAI,OAAO,IAAI,OAAO,CAErB;IAED,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IA0B1C,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,GAAG,iBAAiB;IAQhE;;;OAGG;IACH,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE;QACjC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;QAC1B,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAC/B,GAAG,wBAAwB;CAoB5B"}
+{"version":3,"file":"UnpersistedApiKeyManager.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/apiKey/UnpersistedApiKeyManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwD,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAEtG,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEjD;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,yCAAyC,CAAA;AAElF;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,yCAAyC,CAAA;AAInF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,eAAgB,MAAM,GAAG,SAAS,KAAG,OAA6E,CAAA;AAEtJ;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,QAAO,YAC0D,CAAA;AAEhH,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CACjC;AAED;;;;;;;GAOG;AACH,qBAAa,wBAAwB;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8B;IAEtD,YAAY,OAAO,GAAE,SAAS,iBAAiB,EAAO,EAErD;IAED,IAAI,OAAO,IAAI,OAAO,CAErB;IAED,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAwBzC;IAED,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,GAAG,iBAAiB,CAM/D;IAED;;;OAGG;IACH,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE;QACjC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;QAC1B,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAC/B,GAAG,wBAAwB,CAmB3B;CACD"}

package/dist/types/model/service/captcha/CaptchaValidator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CaptchaValidator.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/captcha/CaptchaValidator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,eAAe,IAAI,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAChF,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAElF,oFAAoF;AACpF,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,eAAe,GAAG,kBAAkB,GAAG,mBAAmB,CAAA;AAExG,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAA;CACvD;AAED,qBAAa,gBAAgB;IAE3B,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,MAAM,CAAC,kBAAkB,EAAE,sBAAsB,CAAC;IAG/E,8EAA8E;IACvE,SAAS,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO;IAIhD;;;;OAIG;IACI,YAAY,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,oBAAoB,GAAG,OAAO;IAI/E;;;OAGG;IACI,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa;IAc7C,MAAM,CAAC,IAAI,EAAE;QAClB,MAAM,EAAE,aAAa,CAAA;QACrB,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;QAChC,QAAQ,CAAC,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,mBAAmB,GAAG;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;CAkB9D"}
+{"version":3,"file":"CaptchaValidator.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/captcha/CaptchaValidator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,eAAe,IAAI,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAChF,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAElF,oFAAoF;AACpF,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,eAAe,GAAG,kBAAkB,GAAG,mBAAmB,CAAA;AAExG,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAA;CACvD;AAED,qBAAa,gBAAgB;IAE3B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAD3B,YACkB,SAAS,EAAE,MAAM,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,EAC3E;IAEJ,8EAA8E;IACvE,SAAS,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAE/C;IAED;;;;OAIG;IACI,YAAY,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAE9E;IAED;;;OAGG;IACI,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAYlD;IAEK,MAAM,CAAC,IAAI,EAAE;QAClB,MAAM,EAAE,aAAa,CAAA;QACrB,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;QAChC,QAAQ,CAAC,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,mBAAmB,GAAG;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC,CAiB7D;CACD"}

package/dist/types/model/service/captcha/HCaptchaProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"HCaptchaProvider.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/captcha/HCaptchaProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAErG,iEAAiE;AACjE,qBAAa,gBAAiB,YAAW,sBAAsB;IAE7D,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,QAAQ,GAAE,MAA0C,EACpD,SAAS,GAAE,OAAO,KAAa;IAG3C,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAqB1F"}
+{"version":3,"file":"HCaptchaProvider.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/captcha/HCaptchaProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAErG,iEAAiE;AACjE,qBAAa,gBAAiB,YAAW,sBAAsB;IAE7D,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAF3B,YACkB,QAAQ,GAAE,MAA0C,EACpD,SAAS,GAAE,OAAO,KAAa,EAC7C;IAEE,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAoBzF;CACD"}

package/dist/types/model/service/captcha/RecaptchaV3Provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RecaptchaV3Provider.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/captcha/RecaptchaV3Provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAIrG;;;GAGG;AACH,qBAAa,mBAAoB,YAAW,sBAAsB;IAEhE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,QAAQ,GAAE,MAA0D,EACpE,SAAS,GAAE,OAAO,KAAa;IAG3C,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC;CA0BrG"}
+{"version":3,"file":"RecaptchaV3Provider.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/captcha/RecaptchaV3Provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAIrG;;;GAGG;AACH,qBAAa,mBAAoB,YAAW,sBAAsB;IAEhE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAF3B,YACkB,QAAQ,GAAE,MAA0D,EACpE,SAAS,GAAE,OAAO,KAAa,EAC7C;IAEE,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAyBpG;CACD"}

package/dist/types/model/service/captcha/TurnstileProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TurnstileProvider.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/captcha/TurnstileProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAErG;;;GAGG;AACH,qBAAa,iBAAkB,YAAW,sBAAsB;IAE9D,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,QAAQ,GAAE,MAAoE,EAC9E,SAAS,GAAE,OAAO,KAAa;IAG3C,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAyB1F"}
+{"version":3,"file":"TurnstileProvider.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/captcha/TurnstileProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAErG;;;GAGG;AACH,qBAAa,iBAAkB,YAAW,sBAAsB;IAE9D,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAF3B,YACkB,QAAQ,GAAE,MAAoE,EAC9E,SAAS,GAAE,OAAO,KAAa,EAC7C;IAEE,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAwBzF;CACD"}

package/dist/types/model/service/helpers/getPreferredProject.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getPreferredProject.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/helpers/getPreferredProject.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAE7C,eAAO,MAAM,mBAAmB,GAAI,UAAU,OAAO,EAAE,EAAE,sBAAsB,MAAM,GAAG,IAAI,KAAG,OAAO,GAAG,IAQxG,CAAA"}
+{"version":3,"file":"getPreferredProject.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/helpers/getPreferredProject.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAE7C,eAAO,MAAM,mBAAmB,aAAc,OAAO,EAAE,wBAAwB,MAAM,GAAG,IAAI,KAAG,OAAO,GAAG,IAQxG,CAAA"}

package/dist/types/model/service/helpers/isPasswordlessEnabled.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"isPasswordlessEnabled.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/helpers/isPasswordlessEnabled.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAEvD;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,GAAI,aAAa,YAAY,EAAE,aAAa,OAAO,GAAG,IAAI,KAAG,OAW9F,CAAA"}
+{"version":3,"file":"isPasswordlessEnabled.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/helpers/isPasswordlessEnabled.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAEvD;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,gBAAiB,YAAY,eAAe,OAAO,GAAG,IAAI,KAAG,OAW9F,CAAA"}

package/dist/types/model/service/idp/BackchannelLogoutManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BackchannelLogoutManager.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/BackchannelLogoutManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAOtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAG5D,MAAM,MAAM,uBAAuB,GAChC;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,MAAM,EAAE,oBAAoB,CAAA;CAAE,GAChC;IAAE,MAAM,EAAE,eAAe,CAAA;CAAE,GAC3B;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAE/C;;;;;;;;;;;;GAYG;AACH,qBAAa,wBAAwB;IAEnC,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAAX,WAAW,EAAE,kBAAkB;IAG3C,MAAM,CAAC,EAAE,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;YAuChG,qBAAqB;YAerB,KAAK;CAoCnB"}
+{"version":3,"file":"BackchannelLogoutManager.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/BackchannelLogoutManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAOtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAG5D,MAAM,MAAM,uBAAuB,GAChC;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,MAAM,EAAE,oBAAoB,CAAA;CAAE,GAChC;IAAE,MAAM,EAAE,eAAe,CAAA;CAAE,GAC3B;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAE/C;;;;;;;;;;;;GAYG;AACH,qBAAa,wBAAwB;IAEnC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAD7B,YACkB,WAAW,EAAE,kBAAkB,EAC7C;IAEE,MAAM,CAAC,EAAE,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAqC7G;YAEa,qBAAqB;YAerB,KAAK;CAoCnB"}

package/dist/types/model/service/idp/ClaimMapping.d.ts

@@ -0,0 +1,330 @@
+import * as Typesafe from '@contember/typesafe';
+/**
+ * Provider-agnostic mapping of IdP claims/attributes to Contember project memberships (A09).
+ * Stored on an IdP's `configuration.claimMapping`, so it rides inside the existing
+ * `identity_provider.configuration` JSONB and needs no schema change — `addIDP` / `updateIDP`
+ * already accept an opaque configuration object.
+ *
+ * The mapping grants **project memberships only** (a project role plus optional membership
+ * variables). It deliberately does NOT grant global/tenant roles: those are privilege-bearing
+ * and granting them from external claims would be a privilege-escalation path, so global-role
+ * mapping was dropped. A project membership stays within what the IdP configurer
+ * (`project_admin`, holding `IDP_ADD` / `IDP_UPDATE`) may already grant directly.
+ *
+ * Coexistence: the OIDC provider also uses `configuration.claimMapping` for an unrelated
+ * identity-field remap (`email` / `name` / `externalIdentifier` / `attributesKey`). A09 only
+ * looks at the `rules` field, so the two coexist in the same object — {@link parseClaimMapping}
+ * returns `null` when no `rules` are present (an OIDC-only remap) instead of rejecting it.
+ *
+ * Each rule inspects one `claim` from the IdP response (the raw claims flow through verbatim,
+ * since `IDPResponse` is `& Record<string, unknown>`) and, when it matches, grants a project
+ * membership. Rules are independent and additive — every matching rule contributes; a
+ * non-matching rule is simply skipped.
+ *
+ * Matching is declarative, never code:
+ * - `equals`   — the claim equals the value (scalar compare; for array claims, the value is one
+ *                of the elements).
+ * - `contains` — the claim contains the value: substring for string claims, membership for array
+ *                claims. This is the natural fit for multi-valued `groups`.
+ * - neither    — the rule matches whenever the claim is merely present (and truthy for booleans).
+ */
+/**
+ * Where a membership variable's values come from when they are not constant. Reads one `claim` from the
+ * IdP response — by exact name first (a URL-namespaced claim with literal dots works), then as a dot-path
+ * (nested claims like `profile.languages`) — and shapes the raw value(s) into a flat list of strings:
+ * - array claim       → its elements (`languages: ['cs','en']`)
+ * - `split`           → split a delimited string claim (`'cs,en'`, OIDC-style `'cs en'`) into elements
+ * - `pick` / `where`  → for an array-of-objects claim, keep elements matching `where` and take their
+ *                       `pick` field (`orgs: [{ code, role }]` → codes of the elements where role matches)
+ *
+ * The extracted raw values are then run through {@link ClaimMappingVariable}'s `map` / `passthrough`.
+ */
+export declare const ClaimValueSource: {
+    (input: unknown, path?: PropertyKey[]): {
+        readonly claim: string;
+    } & {
+        readonly split?: string | undefined;
+        readonly pick?: string | undefined;
+        readonly where?: {
+            readonly field: string;
+            readonly equals: Typesafe.Scalar;
+        } | undefined;
+    };
+    inner: Typesafe.Type<{
+        readonly claim: string;
+    } & {
+        readonly split?: string | undefined;
+        readonly pick?: string | undefined;
+        readonly where?: {
+            readonly field: string;
+            readonly equals: Typesafe.Scalar;
+        } | undefined;
+    }>;
+};
+export type ClaimValueSource = ReturnType<typeof ClaimValueSource>;
+/**
+ * One membership variable to set on a granted membership. Either constant (`values`), claim-derived
+ * (`from`), or both — the two sets are unioned. When derived from a claim:
+ * - `map`         — lookup table from a raw claim value to the value(s) actually set, e.g.
+ *                   `{ cs: ['<locale-uuid>'] }`. A raw value absent from the map is dropped…
+ * - `passthrough` — …unless `passthrough` is `true`, in which case it is set verbatim. Off by
+ *                   default: raw external claim values then flow straight into row-level ACL
+ *                   variables, so enable it only when the variable legitimately holds claim values
+ *                   (not opaque ids), and prefer `map` / `allow` to bound what an IdP can inject.
+ * - `allow`       — optional allowlist applied to the claim-derived values (constants are never filtered).
+ */
+export declare const ClaimMappingVariable: {
+    (input: unknown, path?: PropertyKey[]): {
+        readonly name: string;
+    } & {
+        readonly values?: readonly string[] | undefined;
+        readonly from?: ({
+            readonly claim: string;
+        } & {
+            readonly split?: string | undefined;
+            readonly pick?: string | undefined;
+            readonly where?: {
+                readonly field: string;
+                readonly equals: Typesafe.Scalar;
+            } | undefined;
+        }) | undefined;
+        readonly map?: {
+            readonly [x: string]: readonly string[];
+        } | undefined;
+        readonly passthrough?: boolean | undefined;
+        readonly allow?: readonly string[] | undefined;
+    };
+    inner: Typesafe.Type<{
+        readonly name: string;
+    } & {
+        readonly values?: readonly string[] | undefined;
+        readonly from?: ({
+            readonly claim: string;
+        } & {
+            readonly split?: string | undefined;
+            readonly pick?: string | undefined;
+            readonly where?: {
+                readonly field: string;
+                readonly equals: Typesafe.Scalar;
+            } | undefined;
+        }) | undefined;
+        readonly map?: {
+            readonly [x: string]: readonly string[];
+        } | undefined;
+        readonly passthrough?: boolean | undefined;
+        readonly allow?: readonly string[] | undefined;
+    }>;
+};
+export type ClaimMappingVariable = ReturnType<typeof ClaimMappingVariable>;
+export declare const ClaimMappingMembership: {
+    (input: unknown, path?: PropertyKey[]): {
+        readonly project: string;
+        readonly role: string;
+    } & {
+        readonly variables?: readonly ({
+            readonly name: string;
+        } & {
+            readonly values?: readonly string[] | undefined;
+            readonly from?: ({
+                readonly claim: string;
+            } & {
+                readonly split?: string | undefined;
+                readonly pick?: string | undefined;
+                readonly where?: {
+                    readonly field: string;
+                    readonly equals: Typesafe.Scalar;
+                } | undefined;
+            }) | undefined;
+            readonly map?: {
+                readonly [x: string]: readonly string[];
+            } | undefined;
+            readonly passthrough?: boolean | undefined;
+            readonly allow?: readonly string[] | undefined;
+        })[] | undefined;
+    };
+    inner: Typesafe.Type<{
+        readonly project: string;
+        readonly role: string;
+    } & {
+        readonly variables?: readonly ({
+            readonly name: string;
+        } & {
+            readonly values?: readonly string[] | undefined;
+            readonly from?: ({
+                readonly claim: string;
+            } & {
+                readonly split?: string | undefined;
+                readonly pick?: string | undefined;
+                readonly where?: {
+                    readonly field: string;
+                    readonly equals: Typesafe.Scalar;
+                } | undefined;
+            }) | undefined;
+            readonly map?: {
+                readonly [x: string]: readonly string[];
+            } | undefined;
+            readonly passthrough?: boolean | undefined;
+            readonly allow?: readonly string[] | undefined;
+        })[] | undefined;
+    }>;
+};
+export type ClaimMappingMembership = ReturnType<typeof ClaimMappingMembership>;
+export declare const ClaimMappingRule: {
+    (input: unknown, path?: PropertyKey[]): {
+        readonly claim: string;
+    } & {
+        readonly equals?: Typesafe.Scalar | undefined;
+        readonly contains?: Typesafe.Scalar | undefined;
+        readonly grantMembership?: ({
+            readonly project: string;
+            readonly role: string;
+        } & {
+            readonly variables?: readonly ({
+                readonly name: string;
+            } & {
+                readonly values?: readonly string[] | undefined;
+                readonly from?: ({
+                    readonly claim: string;
+                } & {
+                    readonly split?: string | undefined;
+                    readonly pick?: string | undefined;
+                    readonly where?: {
+                        readonly field: string;
+                        readonly equals: Typesafe.Scalar;
+                    } | undefined;
+                }) | undefined;
+                readonly map?: {
+                    readonly [x: string]: readonly string[];
+                } | undefined;
+                readonly passthrough?: boolean | undefined;
+                readonly allow?: readonly string[] | undefined;
+            })[] | undefined;
+        }) | undefined;
+    };
+    inner: Typesafe.Type<{
+        readonly claim: string;
+    } & {
+        readonly equals?: Typesafe.Scalar | undefined;
+        readonly contains?: Typesafe.Scalar | undefined;
+        readonly grantMembership?: ({
+            readonly project: string;
+            readonly role: string;
+        } & {
+            readonly variables?: readonly ({
+                readonly name: string;
+            } & {
+                readonly values?: readonly string[] | undefined;
+                readonly from?: ({
+                    readonly claim: string;
+                } & {
+                    readonly split?: string | undefined;
+                    readonly pick?: string | undefined;
+                    readonly where?: {
+                        readonly field: string;
+                        readonly equals: Typesafe.Scalar;
+                    } | undefined;
+                }) | undefined;
+                readonly map?: {
+                    readonly [x: string]: readonly string[];
+                } | undefined;
+                readonly passthrough?: boolean | undefined;
+                readonly allow?: readonly string[] | undefined;
+            })[] | undefined;
+        }) | undefined;
+    }>;
+};
+export type ClaimMappingRule = ReturnType<typeof ClaimMappingRule>;
+/**
+ * The validated A09 mapping. `rules` is required here — {@link parseClaimMapping} only returns a
+ * mapping once it has confirmed `rules` is present, and returns `null` otherwise (so an OIDC-only
+ * `claimMapping` is treated as "no role mapping", not an error).
+ */
+export declare const ClaimMapping: Typesafe.Type<{
+    readonly rules: readonly ({
+        readonly claim: string;
+    } & {
+        readonly equals?: Typesafe.Scalar | undefined;
+        readonly contains?: Typesafe.Scalar | undefined;
+        readonly grantMembership?: ({
+            readonly project: string;
+            readonly role: string;
+        } & {
+            readonly variables?: readonly ({
+                readonly name: string;
+            } & {
+                readonly values?: readonly string[] | undefined;
+                readonly from?: ({
+                    readonly claim: string;
+                } & {
+                    readonly split?: string | undefined;
+                    readonly pick?: string | undefined;
+                    readonly where?: {
+                        readonly field: string;
+                        readonly equals: Typesafe.Scalar;
+                    } | undefined;
+                }) | undefined;
+                readonly map?: {
+                    readonly [x: string]: readonly string[];
+                } | undefined;
+                readonly passthrough?: boolean | undefined;
+                readonly allow?: readonly string[] | undefined;
+            })[] | undefined;
+        }) | undefined;
+    })[];
+} & {
+    readonly syncPolicy?: "always" | "sticky" | undefined;
+    readonly unmatched?: "keep" | "remove" | undefined;
+}>;
+export type ClaimMapping = ReturnType<typeof ClaimMapping>;
+export declare const DEFAULT_SYNC_POLICY: NonNullable<ClaimMapping['syncPolicy']>;
+export declare const DEFAULT_UNMATCHED: NonNullable<ClaimMapping['unmatched']>;
+export declare const isRecord: (value: unknown) => value is Record<string, unknown>;
+/**
+ * Parse the optional A09 `claimMapping` out of an IdP `configuration` blob. Returns `null` when no
+ * A09 mapping is present — either no `claimMapping` at all, or a `claimMapping` that carries no
+ * `rules` (e.g. the OIDC identity-field remap, which shares this key). Returning `null` keeps both
+ * the pre-A09 sign-in path and the OIDC remap untouched.
+ *
+ * Only the A09 fields (`rules`, `syncPolicy`, `unmatched`) are validated; any other keys on the
+ * `claimMapping` object (the OIDC remap fields) are ignored, so the two features coexist. Throws via
+ * Typesafe when `rules` is present but structurally malformed (e.g. a rule missing its required
+ * `claim`), so an A09 misconfiguration surfaces loudly rather than silently dropping grants.
+ *
+ * The nested A09 schemas (rule / membership / variable / value-source) are wrapped in
+ * `Typesafe.noExtraProps`, so a typo'd key on any of them (e.g. `grantMembershp`, `equls`) is
+ * REJECTED, not silently stripped — a misconfiguration surfaces loudly instead of degrading into a
+ * grants-nothing or match-everyone rule. The one exception is the top-level `claimMapping` object
+ * itself: it is the key SHARED with the OIDC identity-remap (`email`/`name`/`externalIdentifier`/
+ * `attributesKey`), so this parse first projects only the A09 fields (`rules`/`syncPolicy`/`unmatched`)
+ * into a fresh object (above) and deliberately does NOT apply `noExtraProps` there — the OIDC remap
+ * fields must coexist. The `map` lookup table is likewise a `record` (arbitrary keys are legitimate),
+ * not a strict object. The removed `grantRoles` key is still caught separately by
+ * {@link findRemovedRuleKeys} (run before this parse) for a clearer message than the generic
+ * extra-property error `noExtraProps` would otherwise raise.
+ */
+export declare const parseClaimMapping: (configuration: Record<string, unknown>) => ClaimMapping | null;
+/**
+ * Returns the removed rule keys (currently only `grantRoles`) still present in a raw `claimMapping`,
+ * so config-time validation can reject them with a clear message pointing at `grantMembership`.
+ */
+export declare const findRemovedRuleKeys: (configuration: Record<string, unknown>) => string[];
+/**
+ * Semantic checks on a parsed mapping that the Typesafe shape cannot express. Returns one
+ * human-readable message per problem (empty = ok); run at config time (IdP add/update) so a
+ * contradictory rule is rejected loudly rather than silently mis-matching or granting nothing:
+ * - a rule may use at most one of `equals` / `contains` ({@link ruleMatches} only ever honours `equals`
+ *   when both are set, so the other would be silently ignored);
+ * - a rule's `equals` / `contains` must not be an empty string: an empty `contains` substring-matches EVERY
+ *   string claim (`'...'.includes('')` is always true), i.e. a match-everything grant to every user of the
+ *   IdP, and an empty `equals` is an always-no-op footgun — to match on the claim's mere presence, omit both;
+ * - a rule must carry a `grantMembership` — a rule with none matches but grants nothing. (A *misspelled*
+ *   `grantMembership`, e.g. `grantMembershp`, is now rejected earlier by `noExtraProps` during
+ *   {@link parseClaimMapping}; this check remains for a `grantMembership` that is genuinely OMITTED,
+ *   which the `partial` schema permits.)
+ * - a variable's `from.where` requires a `from.pick` — `where` filters elements but without `pick` there
+ *   is nothing to project, so the source can only ever resolve to no values;
+ * - a variable's `from.split` must not be the empty string — `''.split('')` explodes every claim value
+ *   into its individual characters (the same class of footgun as an empty `equals` / `contains`).
+ */
+export declare const findClaimMappingShapeErrors: (mapping: ClaimMapping) => string[];
+//# sourceMappingURL=ClaimMapping.d.ts.map

package/dist/types/model/service/idp/ClaimMapping.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClaimMapping.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/ClaimMapping.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;CAgB3B,CAAA;AAEF,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAElE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgB/B,CAAA;AAEF,MAAM,MAAM,oBAAoB,GAAG,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAE1E,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYjC,CAAA;AAEF,MAAM,MAAM,sBAAsB,GAAG,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAE9E,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAa3B,CAAA;AAEF,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAElE;;;;GAIG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsBxB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAA;AAE1D,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,YAAY,CAAC,YAAY,CAAC,CAAY,CAAA;AACpF,eAAO,MAAM,iBAAiB,EAAE,WAAW,CAAC,YAAY,CAAC,WAAW,CAAC,CAAU,CAAA;AAE/E,eAAO,MAAM,QAAQ,UAAW,OAAO,KAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAyE,CAAA;AAElJ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,iBAAiB,kBAAmB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,YAAY,GAAG,IAazF,CAAA;AASD;;;GAGG;AACH,eAAO,MAAM,mBAAmB,kBAAmB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,MAAM,EAgBlF,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,2BAA2B,YAAa,YAAY,KAAG,MAAM,EAmCzE,CAAA"}

package/dist/types/model/service/idp/ClaimMappingEvaluator.d.ts

@@ -0,0 +1,30 @@
+import { ClaimMapping, ClaimMappingVariable, ClaimValueSource } from './ClaimMapping.js';
+export type MappedMembership = {
+    readonly project: string;
+    readonly role: string;
+    readonly variables: readonly {
+        readonly name: string;
+        readonly values: readonly string[];
+    }[];
+};
+/**
+ * Evaluate every rule of a claim mapping against the claims of an IdP response and collect the union
+ * of granted project memberships (keyed implicitly by (project, role)). Pure: no DB, no side effects —
+ * the caller decides how to apply the result (and whether to add-only or replace, per `unmatched`).
+ */
+export declare const evaluateClaimMapping: (mapping: ClaimMapping, claims: Record<string, unknown>) => MappedMembership[];
+/**
+ * Resolve a membership variable to its final string values: constant `values` (always kept) unioned
+ * with values derived from `from` (extracted from the claims, then mapped / passed through / allow-
+ * filtered). Pure; an empty result simply means the variable is not applied — `IDPClaimSyncService`
+ * drops empty-valued variables so an empty `set` never soft-deletes the membership.
+ */
+export declare const resolveVariableValues: (variable: ClaimMappingVariable, claims: Record<string, unknown>) => string[];
+/**
+ * Extract a flat, de-duplicated list of string values from a single claim per a {@link ClaimValueSource}:
+ * resolves the (possibly nested) claim, normalises scalar/array, optionally filters + projects an
+ * array of objects (`where` / `pick`), and optionally splits a delimited string (`split`). Non-scalar
+ * leaves (objects, null/undefined) are skipped; finite numbers are coerced to their string form.
+ */
+export declare const extractClaimValues: (source: ClaimValueSource, claims: Record<string, unknown>) => string[];
+//# sourceMappingURL=ClaimMappingEvaluator.d.ts.map

package/dist/types/model/service/idp/ClaimMappingEvaluator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClaimMappingEvaluator.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/ClaimMappingEvaluator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA4C,oBAAoB,EAAE,gBAAgB,EAAY,MAAM,mBAAmB,CAAA;AAE5I,MAAM,MAAM,gBAAgB,GAAG;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,EAAE,CAAA;CAC5F,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,YAAa,YAAY,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,gBAAgB,EAkB7G,CAAA;AA8CD;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,aAAc,oBAAoB,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,MAAM,EAoB7G,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,WAAY,gBAAgB,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,MAAM,EA8BpG,CAAA"}

package/dist/types/model/service/idp/ClaimMappingValidation.d.ts

@@ -0,0 +1,55 @@
+import { Acl } from '@contember/schema';
+import { ClaimMappingMembership } from './ClaimMapping.js';
+/**
+ * Why a granted membership in an A09 claim mapping is invalid against a project's live ACL schema.
+ * Shared by config-time validation ({@link validateClaimMappingMembership} via
+ * `IDPManager.assertValidClaimMapping`, which rejects the whole IdP config) and the apply-time backstop
+ * (`IDPClaimSyncService`, which drops the unsafe grant), so the per-membership ACL validation can never
+ * drift between the two. NOTE this shared check is ONLY the per-membership ACL validation; the rule-shape
+ * checks (`findClaimMappingShapeErrors`) and the removed-key check (`findRemovedRuleKeys`, e.g. `grantRoles`)
+ * run at config time only — the apply-time backstop deliberately re-checks just the ACL safety of each
+ * grant, not the mapping's overall shape (a malformed shape can only arrive via an out-of-band JSONB edit
+ * that bypassed config validation; `evaluateClaimMapping` then honours whatever shape it finds).
+ */
+export declare enum ClaimMappingMembershipErrorType {
+    /** The granted role is not defined in the project ACL. */
+    roleNotFound = "roleNotFound",
+    /** A membership variable is not defined for the granted role. */
+    variableNotFound = "variableNotFound",
+    /** A predefined variable (identityID / personID) cannot be set — the runtime binds it to the signed-in identity. */
+    predefinedVariable = "predefinedVariable",
+    /**
+     * A claim-derived (`from`) value would be written into a `condition` ACL variable without being bounded
+     * by an `allow` allowlist (or with `passthrough`). A condition variable's stored value is parsed as a
+     * row-level ACL condition at every content request, so this is an arbitrary-condition injection vector.
+     */
+    conditionInjection = "conditionInjection",
+    /** A configured value targeting a `condition` variable is not a parseable ACL condition (it would deny at content time). */
+    conditionValueInvalid = "conditionValueInvalid"
+}
+export interface ClaimMappingMembershipError {
+    readonly type: ClaimMappingMembershipErrorType;
+    readonly message: string;
+}
+/**
+ * Validate one A09 granted membership against a project's live ACL schema.
+ *
+ * The shared membership-shape checks (role exists, each set variable is defined for the role, a
+ * predefined variable cannot be set, a `condition` variable's stored value parses as an ACL condition)
+ * are DELEGATED to the very {@link MembershipResolver} the direct add-member path uses — so the IdP path
+ * cannot drift from it. Only the resolver's `VARIABLE_EMPTY` is excluded: A09 grants are *partial* (a
+ * rule sets only some of a role's variables), which is legitimate here but `VARIABLE_EMPTY` to the
+ * resolver. On top of the shared checks A09 adds one claim-aware guard the resolver cannot know about —
+ * the condition-injection guard (a claim-derived value must not flow unbounded into a `condition`
+ * variable). See {@link ClaimMappingMembershipErrorType}.
+ *
+ * Returns every problem found (empty array = valid). The caller decides the consequence: config-time
+ * validation throws on the first error (rejecting the whole IdP config), while the apply-time backstop
+ * (`IDPClaimSyncService`) drops any grant that produces an error.
+ *
+ * Role / variable lookups are own-property only, so a name like `constructor` / `toString` cannot
+ * resolve to an inherited Object.prototype member and pass as defined (the resolver and
+ * `getRoleVariables` are likewise own-property guarded).
+ */
+export declare const validateClaimMappingMembership: (acl: Acl.Schema, membership: ClaimMappingMembership) => ClaimMappingMembershipError[];
+//# sourceMappingURL=ClaimMappingValidation.d.ts.map

package/dist/types/model/service/idp/ClaimMappingValidation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClaimMappingValidation.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/ClaimMappingValidation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,OAAO,EAAE,sBAAsB,EAAwB,MAAM,mBAAmB,CAAA;AAEhF;;;;;;;;;;GAUG;AACH,oBAAY,+BAA+B;IAC1C,0DAA0D;IAC1D,YAAY,iBAAiB;IAC7B,iEAAiE;IACjE,gBAAgB,qBAAqB;IACrC,oHAAoH;IACpH,kBAAkB,uBAAuB;IACzC;;;;OAIG;IACH,kBAAkB,uBAAuB;IACzC,4HAA4H;IAC5H,qBAAqB,0BAA0B;CAC/C;AAED,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,IAAI,EAAE,+BAA+B,CAAA;IAC9C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,8BAA8B,QAAS,GAAG,CAAC,MAAM,cAAc,sBAAsB,KAAG,2BAA2B,EA0C/H,CAAA"}