@contember/engine-tenant-api 2.2.0-alpha.3 → 2.2.0-alpha.6

package/dist/types/model/service/idp/IDPClaimSyncService.d.ts

@@ -0,0 +1,113 @@
+import { DatabaseContext } from '../../utils/index.js';
+import { ClaimMapping } from './ClaimMapping.js';
+import { MappedMembership } from './ClaimMappingEvaluator.js';
+import { ProjectSchemaResolver } from '../../type/index.js';
+export type ClaimMappingSnapshot = {
+    readonly memberships: readonly MappedMembership[];
+};
+export type ClaimMappingAudit = {
+    readonly before: ClaimMappingSnapshot;
+    readonly after: ClaimMappingSnapshot;
+    readonly syncPolicy: NonNullable<ClaimMapping['syncPolicy']>;
+    readonly unmatched: NonNullable<ClaimMapping['unmatched']>;
+};
+export type ClaimMappingSyncResult = {
+    /** Membership before/after delta — present only when the apply actually changed grants. */
+    readonly audit: ClaimMappingAudit | null;
+    /** True when the apply-time safety backstop dropped one or more configured rules (a fail-open marker for the caller's audit). */
+    readonly droppedUnsafeRules: boolean;
+};
+/**
+ * Applies an IdP's `claimMapping` (A09) after a person has been resolved: evaluates the declarative
+ * rules against the IdP claims and grants the resulting project memberships, honouring the per-IdP
+ * `syncPolicy` (`always` vs `sticky`) and `unmatched` (`keep` vs `remove`) settings. The mapping
+ * grants project memberships only — never global/tenant roles (see {@link ClaimMapping}).
+ *
+ * Runs at sign-in (inside the sign-in transaction) and, for `always` mappings, again on each OIDC
+ * session refresh (see `IdpSessionRevalidator`). Returns a {@link ClaimMappingSyncResult}: an
+ * `{ before, after }` audit delta (`null` when nothing changed) plus `droppedUnsafeRules` (true when the
+ * apply-time safety backstop dropped a configured rule). The caller emits the `idp_role_mapped` audit
+ * from the delta and the `idp_role_mapping_failed` fail-open marker from `droppedUnsafeRules` — audit
+ * lives at the caller layer, never here.
+ *
+ * The caller parses the mapping (via {@link parseClaimMapping}) and decides the fail-open policy: a
+ * malformed config is caught by the caller before this runs, while a DB error raised here propagates
+ * so the surrounding transaction rolls back the partial apply (no half-applied grants).
+ */
+export declare class IDPClaimSyncService {
+    private readonly projectSchemaResolver;
+    constructor(projectSchemaResolver: ProjectSchemaResolver);
+    sync(db: DatabaseContext, mapping: ClaimMapping, claims: Record<string, unknown>, identity: {
+        id: string;
+    }, isNewPerson: boolean, options?: {
+        allowRemoval?: boolean;
+    }): Promise<ClaimMappingSyncResult>;
+    /**
+     * Partition rules into those safe to apply and those dropped by the apply-time safety backstop. A rule
+     * is dropped when its granted membership produces ANY validation error against the project's CURRENT ACL
+     * schema (fail-closed) — condition-injection above all, but also an unknown role/variable, a malformed
+     * condition value, or a forbidden predefined variable. A validation throw is treated as unsafe (we cannot
+     * prove the grant safe). Schemas (and, when needed, project existence) are resolved at most once per
+     * project. The dropped set is returned so the caller can emit a fail-open audit marker.
+     *
+     * When `getSchema` returns no ACL it does NOT mean "the project does not exist": it returns undefined both
+     * for a project that has no row yet AND for one whose row exists but whose container / content schema is
+     * momentarily unresolvable (mid-provisioning, transient). The two need OPPOSITE handling, so we
+     * disambiguate via the tenant `project` table:
+     *   - no project row → the grant is genuinely inert (`applyMemberships` resolves the same slug and skips
+     *     it, so nothing is written). KEEP the rule for when the project is created later.
+     *   - project row EXISTS but the ACL is unresolvable → `applyMemberships` WOULD still write the membership
+     *     (it resolves the slug from the tenant `project` table, independent of the content schema), so an
+     *     UNVALIDATED grant — including a claim-derived value targeting a `condition` ACL variable — could
+     *     land. Fail closed: DROP the rule (it re-applies on a later sign-in once the schema resolves). This
+     *     matches the direct add-member path, which refuses a membership whose project schema can't be resolved.
+     *
+     * Returns the per-project ACL map it built (`aclByProject`) so the runtime backstop
+     * ({@link dropUnsafeEvaluatedMemberships}) can re-use it without re-resolving any schema.
+     */
+    private dropUnsafeRules;
+    /**
+     * RUNTIME companion to {@link dropUnsafeRules} (A09 apply-time backstop, part 2). `dropUnsafeRules`
+     * validates each rule's static CONFIG shape and — like config-time validation — TOLERATES a missing
+     * membership variable (`VARIABLE_EMPTY`): an A09 grant may legitimately set only some of a role's
+     * variables. For an ordinary role that tolerance is safe: a variable that resolves to no value just
+     * narrows CONTENT access (the membership resolver maps it to `{ never: true }` — strictly LESS access,
+     * never more), and a role's tenant permissions are matched against that role's OWN tenant rule (a
+     * missing variable there denies, never escalates).
+     *
+     * The ONE role that breaks the assumption is the project `admin` role: {@link ProjectScope} grants the
+     * PROJECT_ADMIN tenant role (project secrets, member management, IdP config, deploy, …) to ANY identity
+     * holding an `admin` membership in the project — keyed on the role NAME alone, independent of the
+     * membership's variables. So when a claim-derived variable meant to SCOPE an `admin` grant resolves
+     * empty, `applyMemberships` drops the empty variable before the write and persists a BARE `admin`
+     * membership — i.e. UNSCOPED project-admin, even though the operator intended a scoped grant, and a
+     * membership the direct add-member path ({@link MembershipResolver}, via `MembershipValidator`) would
+     * REJECT as `VARIABLE_EMPTY`. (`admin` is the only role-name-based grant in the whole authorization
+     * layer; every other privilege is gated by ACL variables/predicates, so it cannot be widened this way.)
+     *
+     * So, fail-closed, we re-validate every evaluated `admin` grant EXACTLY as it would be written (empty
+     * variables filtered out, as `applyMemberships` does) against the live ACL and DROP it if the resolver
+     * reports any error — i.e. if a required (non-fallback) `admin` variable would be absent. Under `keep`
+     * the bare grant is then never written; under `remove` it is absent from the granted set, so
+     * reconciliation revokes any pre-existing one. Non-`admin` grants are left untouched (their partial
+     * grants stay valid). The drop folds into `droppedUnsafeRules`, so the caller still emits the
+     * `idp_role_mapping_failed` fail-open marker.
+     */
+    private dropUnsafeEvaluatedMemberships;
+    private applyMemberships;
+    /**
+     * Snapshot the identity's mapping-relevant memberships for the audit delta: its memberships (with
+     * variable values) for exactly the (project, role) pairs in the mapping's vocabulary. Bounding is by
+     * (project, role) — a membership whose ROLE no rule names is excluded entirely — which keeps the audit
+     * consistent with the (also vocabulary-bounded) reconciliation. NOTE the bound is per-(project, role),
+     * NOT per-variable-name: for an in-vocabulary membership ALL its variables are snapshotted, including any
+     * variable managed OUTSIDE the mapping on that same role (e.g. an admin-set `condition` filter), and a
+     * `passthrough` variable's value IS the verbatim external claim value. So the idp_role_mapped event_data
+     * can disclose claim-derived / admin-managed variable values for a mapped role to system:viewAuthLog
+     * readers — by design (the recorded value is the ACL grant being audited). Variable values are included
+     * so a sign-in that only changes a claim-derived membership variable — itself a row-level ACL grant — is
+     * still detected as a change and audited.
+     */
+    private snapshot;
+}
+//# sourceMappingURL=IDPClaimSyncService.d.ts.map

package/dist/types/model/service/idp/IDPClaimSyncService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IDPClaimSyncService.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/IDPClaimSyncService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,YAAY,EAA4D,MAAM,mBAAmB,CAAA;AAC1G,OAAO,EAAwB,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAEnF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAM3D,MAAM,MAAM,oBAAoB,GAAG;IAClC,QAAQ,CAAC,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAA;CACjD,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC/B,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAA;IACrC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAA;IACpC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAA;IAC5D,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,MAAM,MAAM,sBAAsB,GAAG;IACpC,2FAA2F;IAC3F,QAAQ,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACxC,iIAAiI;IACjI,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAA;CACpC,CAAA;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,mBAAmB;IAE9B,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IADvC,YACkB,qBAAqB,EAAE,qBAAqB,EAE7D;IAEK,IAAI,CACT,EAAE,EAAE,eAAe,EACnB,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,EACxB,WAAW,EAAE,OAAO,EACpB,OAAO,GAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAO,GACtC,OAAO,CAAC,sBAAsB,CAAC,CAiEjC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;YACW,eAAe;IAgD7B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,8BAA8B;YAyCxB,gBAAgB;IAkF9B;;;;;;;;;;;;OAYG;YACW,QAAQ;CAuBtB"}

package/dist/types/model/service/idp/IDPHandlerRegistry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IDPHandlerRegistry.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/IDPHandlerRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AAGtE,qBAAa,kBAAkB;IAC9B,OAAO,CAAC,SAAS,CAAmD;IAE7D,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,uBAAuB,CAAC,GAAG,CAAC,GAAG,IAAI;IAI3E,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,CAAC,EAAE,CAAC,GAAG,IAAI;IAIlE,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,CAAC,EAAE,CAAC;CAO5D"}
+{"version":3,"file":"IDPHandlerRegistry.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/IDPHandlerRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AAGtE,qBAAa,kBAAkB;IAC9B,OAAO,CAAC,SAAS,CAAmD;IAE7D,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,uBAAuB,CAAC,GAAG,CAAC,GAAG,IAAI,CAEjF;IAEM,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,CAAC,EAAE,CAAC,GAAG,IAAI,CAExE;IAEM,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,CAAC,EAAE,CAAC,CAM3D;CACD"}

package/dist/types/model/service/idp/IDPManager.d.ts

@@ -3,15 +3,45 @@ import { AddIdpErrorCode, DisableIdpErrorCode, EnableIdpErrorCode, UpdateIdpErro
 import { DatabaseContext } from '../../utils/index.js';
 import { IdentityProviderData } from '../../type/index.js';
 import { IDPHandlerRegistry } from './IDPHandlerRegistry.js';
+import { ProjectSchemaResolver } from '../../type/index.js';
 import { UpdateIdpData } from '../../commands/idp/UpdateIdpCommand.js';
 import { IdentityProviderDto } from '../../queries/idp/types.js';
 export declare class IDPManager {
     private readonly idpRegistry;
-    constructor(idpRegistry: IDPHandlerRegistry);
+    private readonly projectSchemaResolver;
+    constructor(idpRegistry: IDPHandlerRegistry, projectSchemaResolver: ProjectSchemaResolver);
     addIDP(db: DatabaseContext, idp: IdentityProviderData): Promise<RegisterIDPResponse>;
     disableIDP(db: DatabaseContext, slug: string): Promise<DisableIDPResponse>;
     enableIDP(db: DatabaseContext, slug: string): Promise<EnableIDPResponse>;
     updateIDP(db: DatabaseContext, slug: string, data: UpdateIdpData, mergeConfiguration: boolean): Promise<UpdateIDPResponse>;
+    /**
+     * Reject top-level `configuration` keys the provider does not recognise.
+     *
+     * Every provider configuration is parsed with `Typesafe.partial`, which silently DROPS unknown
+     * properties. Without this check `addIDP` / `updateIDP` answer `ok` to a configuration the
+     * provider will never act on — a typo like `fetchUserinfo` (lowercase i) reads as a successfully
+     * applied setting while the option stays off, and an option that a given engine version does not
+     * support yet looks indistinguishable from one that works.
+     *
+     * The parsed result carries exactly the keys the provider understood, so the difference against
+     * the submitted object is the set of ignored keys. All of them are reported at once (rather than
+     * the first, as `Typesafe.noExtraProps` would) so a configuration with several typos takes one
+     * round trip to fix, matching {@link findRemovedRuleKeys}.
+     *
+     * Only the top level is checked: nested shapes that need strictness validate themselves
+     * (`claimMapping` via {@link parseClaimMapping}). Reading a stored configuration is deliberately
+     * left untouched — this runs at write time only, so a row written before this check keeps
+     * authenticating instead of locking its users out.
+     */
+    private assertNoUnknownConfigurationKeys;
+    /**
+     * Validate the optional A09 `claimMapping` embedded in an IdP `configuration`: reject a removed
+     * `grantRoles` (global-role mapping was dropped — see {@link parseClaimMapping}), reject a
+     * malformed shape, and validate each granted membership's role against the target project's ACL
+     * schema (mirroring the direct add-member path). Throws {@link InvalidIDPConfigurationError},
+     * surfaced as `INVALID_CONFIGURATION`.
+     */
+    private assertValidClaimMapping;
     listIDP(db: DatabaseContext): Promise<IdentityProviderDto[]>;
 }
 export type RegisterIDPResponse = Response<null, AddIdpErrorCode>;

package/dist/types/model/service/idp/IDPManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IDPManager.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/IDPManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAA6B,MAAM,yBAAyB,CAAA;AAC7E,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AACvH,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAG1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAK5D,OAAO,EAAoB,aAAa,EAAE,MAAM,wCAAwC,CAAA;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAEhE,qBAAa,UAAU;IAErB,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAAX,WAAW,EAAE,kBAAkB;IAIpC,MAAM,CAAC,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAwBpF,UAAU,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAa1E,SAAS,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAaxE,SAAS,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,kBAAkB,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAmD1H,OAAO,CAAC,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC;CAWzE;AAED,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC,CAAA;AACjE,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAA;AACpE,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA;AAClE,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA"}
+{"version":3,"file":"IDPManager.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/IDPManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAA6B,MAAM,yBAAyB,CAAA;AAC7E,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AACvH,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAG1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAK5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAG3D,OAAO,EAAoB,aAAa,EAAE,MAAM,wCAAwC,CAAA;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAEhE,qBAAa,UAAU;IAErB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IAFvC,YACkB,WAAW,EAAE,kBAAkB,EAC/B,qBAAqB,EAAE,qBAAqB,EAE7D;IAEY,MAAM,CAAC,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAuBhG;IAEY,UAAU,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAWtF;IAEY,SAAS,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAWpF;IAEY,SAAS,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,kBAAkB,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAkCtI;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,gCAAgC;IAWxC;;;;;;OAMG;YACW,uBAAuB;IA8CxB,OAAO,CAAC,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAUxE;CACD;AAkCD,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC,CAAA;AACjE,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAA;AACpE,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA;AAClE,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA"}

package/dist/types/model/service/idp/IdentityProviderHandler.d.ts

@@ -48,6 +48,13 @@ export type RevalidationResult = {
     status: 'valid';
     /** Fresh claims, if the revalidation method returned any (e.g. userinfo). */
     claims?: Record<string, unknown>;
+    /**
+     * Whether `claims` represent the IdP's COMPLETE claim surface — the same one sign-in sees — so a
+     * claim-mapping reconciliation may safely remove memberships under `unmatched: "remove"`. A partial
+     * surface (a userinfo-only probe, or a refresh whose userinfo fetch failed) leaves this false, and the
+     * caller keeps refresh-time sync additive-only to avoid stripping a grant the IdP still asserts.
+     */
+    claimsComplete?: boolean;
     /** Updated session state to persist (e.g. a rotated refresh token). */
     idpSession?: IDPSessionState;
 } | {

package/dist/types/model/service/idp/IdentityProviderHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityProviderHandler.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/IdentityProviderHandler.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,OAAO,CAAA;CACpB;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG;IAC7B,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,uFAAuF;IACvF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAChC,uEAAuE;IACvE,SAAS,CAAC,EAAE,IAAI,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACzB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,2FAA2F;IAC3F,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB;;;;OAIG;IACH,UAAU,CAAC,EAAE,eAAe,CAAA;CAC5B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE3B,8EAA8E;AAC9E,MAAM,MAAM,gBAAgB,GAAG;IAC9B,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,kFAAkF;IAClF,qBAAqB,CAAC,EAAE,MAAM,CAAA;CAC9B,CAAA;AAED,+FAA+F;AAC/F,MAAM,MAAM,iBAAiB,GAAG;IAC/B,iGAAiG;IACjG,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,oGAAoG;IACpG,GAAG,CAAC,EAAE,MAAM,CAAA;CACZ,CAAA;AAED,oEAAoE;AACpE,MAAM,MAAM,kBAAkB,GAC3B;IACD,MAAM,EAAE,OAAO,CAAA;IACf,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAChC,uEAAuE;IACvE,UAAU,CAAC,EAAE,eAAe,CAAA;CAC5B,GACC;IACD,MAAM,EAAE,SAAS,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;CACd,CAAA;AAEF,MAAM,WAAW,uBAAuB,CAAC,aAAa,SAAS,EAAE;IAChE,QAAQ,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAErF,eAAe,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,CAAC,CAAA;IAE9F,qBAAqB,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,aAAa,CAAA;IAEzD,sBAAsB,CAAC,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,aAAa,CAAC,CAAA;IAE1E;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAEpG;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAEpG;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAA;CACvG"}
+{"version":3,"file":"IdentityProviderHandler.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/IdentityProviderHandler.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,OAAO,CAAA;CACpB;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG;IAC7B,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,uFAAuF;IACvF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAChC,uEAAuE;IACvE,SAAS,CAAC,EAAE,IAAI,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACzB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,2FAA2F;IAC3F,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB;;;;OAIG;IACH,UAAU,CAAC,EAAE,eAAe,CAAA;CAC5B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE3B,8EAA8E;AAC9E,MAAM,MAAM,gBAAgB,GAAG;IAC9B,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,kFAAkF;IAClF,qBAAqB,CAAC,EAAE,MAAM,CAAA;CAC9B,CAAA;AAED,+FAA+F;AAC/F,MAAM,MAAM,iBAAiB,GAAG;IAC/B,iGAAiG;IACjG,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,oGAAoG;IACpG,GAAG,CAAC,EAAE,MAAM,CAAA;CACZ,CAAA;AAED,oEAAoE;AACpE,MAAM,MAAM,kBAAkB,GAC3B;IACD,MAAM,EAAE,OAAO,CAAA;IACf,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAChC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,uEAAuE;IACvE,UAAU,CAAC,EAAE,eAAe,CAAA;CAC5B,GACC;IACD,MAAM,EAAE,SAAS,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;CACd,CAAA;AAEF,MAAM,WAAW,uBAAuB,CAAC,aAAa,SAAS,EAAE;IAChE,QAAQ,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAErF,eAAe,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,CAAC,CAAA;IAE9F,qBAAqB,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,aAAa,CAAA;IAEzD,sBAAsB,CAAC,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,aAAa,CAAC,CAAA;IAE1E;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAEpG;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAEpG;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAA;CACvG"}

package/dist/types/model/service/idp/IdpSessionRevalidator.d.ts

@@ -2,6 +2,7 @@ import { DatabaseContext } from '../../utils/index.js';
 import { ApiKeyRequestInfo } from '../../commands/index.js';
 import { ApiKeyRow } from '../../queries/apiKey/ApiKeyQuery.js';
 import { IDPHandlerRegistry } from './IDPHandlerRegistry.js';
+import { IDPClaimSyncService } from './IDPClaimSyncService.js';
 export type RevalidationOutcome = 'valid' | 'revoked';
 /**
  * Re-validates IdP-backed sessions against their identity provider on the verify hot path
@@ -18,7 +19,8 @@ export type RevalidationOutcome = 'valid' | 'revoked';
  */
 export declare class IdpSessionRevalidator {
     private readonly idpRegistry;
-    constructor(idpRegistry: IDPHandlerRegistry);
+    private readonly claimSyncService;
+    constructor(idpRegistry: IDPHandlerRegistry, claimSyncService: IDPClaimSyncService);
     revalidate(dbContext: DatabaseContext, readDbContext: DatabaseContext, apiKeyRow: ApiKeyRow, requestInfo?: ApiKeyRequestInfo): Promise<RevalidationOutcome>;
     /**
      * Decide whether (and how) to revalidate, purely from timestamps — no interval parsing in
@@ -26,6 +28,16 @@ export declare class IdpSessionRevalidator {
      */
     private decide;
     private runRevalidation;
+    /**
+     * Re-apply the claim mapping on a successful refresh. Runs in its own transaction (atomic apply of
+     * the membership changes) and never throws: the IdP has already vouched for the session, so a
+     * malformed mapping or a transient apply error must not revoke or fail it. A real membership change
+     * is audited as `idp_role_mapped`; a failure is audited as `idp_role_mapping_failed` (fail-open
+     * marker), mirroring the sign-in path. `claimsComplete` carries whether the refresh rebuilt sign-in's
+     * full claim surface (so removal reconciliation is safe) — see `allowRemoval` below.
+     */
+    private syncClaims;
+    private logRoleMapping;
     private logRevalidated;
     /**
      * Audit a fail-open: the IdP couldn't be consulted (transient outage) or the stored config is

package/dist/types/model/service/idp/IdpSessionRevalidator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IdpSessionRevalidator.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/IdpSessionRevalidator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAA;AAE/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAQ5D,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,SAAS,CAAA;AAgBrD;;;;;;;;;;;;GAYG;AACH,qBAAa,qBAAqB;IAEhC,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAAX,WAAW,EAAE,kBAAkB;IAI3C,UAAU,CACf,SAAS,EAAE,eAAe,EAC1B,aAAa,EAAE,eAAe,EAC9B,SAAS,EAAE,SAAS,EACpB,WAAW,CAAC,EAAE,iBAAiB,GAC7B,OAAO,CAAC,mBAAmB,CAAC;IAyD/B;;;OAGG;IACH,OAAO,CAAC,MAAM;YAqBA,eAAe;YAwDf,cAAc;IAe5B;;;;;;OAMG;YACW,qBAAqB;YA4BrB,MAAM;IA2BpB,OAAO,CAAC,aAAa;CAarB"}
+{"version":3,"file":"IdpSessionRevalidator.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/IdpSessionRevalidator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAA;AAE/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAO5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAI9D,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,SAAS,CAAA;AAgBrD;;;;;;;;;;;;GAYG;AACH,qBAAa,qBAAqB;IAEhC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAFlC,YACkB,WAAW,EAAE,kBAAkB,EAC/B,gBAAgB,EAAE,mBAAmB,EAEtD;IAEK,UAAU,CACf,SAAS,EAAE,eAAe,EAC1B,aAAa,EAAE,eAAe,EAC9B,SAAS,EAAE,SAAS,EACpB,WAAW,CAAC,EAAE,iBAAiB,GAC7B,OAAO,CAAC,mBAAmB,CAAC,CAuD9B;IAED;;;OAGG;IACH,OAAO,CAAC,MAAM;YAqBA,eAAe;IAiE7B;;;;;;;OAOG;YACW,UAAU;YAsCV,cAAc;YA+Bd,cAAc;IAe5B;;;;;;OAMG;YACW,qBAAqB;YA4BrB,MAAM;IA2BpB,OAAO,CAAC,aAAa;CAarB"}

package/dist/types/model/service/idp/PersonIdentityProviderManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PersonIdentityProviderManager.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/PersonIdentityProviderManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAA6B,MAAM,yBAAyB,CAAA;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAsB,yBAAyB,EAAgC,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAI/H;;;;;;;;;;GAUG;AACH,qBAAa,6BAA6B;IAC5B,2BAA2B,CAAC,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC;IAIxG,0BAA0B,CAAC,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;CAwBrI;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,CAAA"}
+{"version":3,"file":"PersonIdentityProviderManager.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/PersonIdentityProviderManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAA6B,MAAM,yBAAyB,CAAA;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAsB,yBAAyB,EAAgC,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAI/H;;;;;;;;;;GAUG;AACH,qBAAa,6BAA6B;IAC5B,2BAA2B,CAAC,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAEpH;IAEY,0BAA0B,CAAC,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA+BpI;CACD;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,CAAA"}

package/dist/types/model/service/idp/index.d.ts

@@ -6,6 +6,10 @@ export * from './BackchannelLogoutManager.js';
 export * from './IDPRevalidation.js';
 export * from './IDPManager.js';
 export * from './PersonIdentityProviderManager.js';
+export * from './ClaimMapping.js';
+export * from './ClaimMappingEvaluator.js';
+export * from './ClaimMappingValidation.js';
+export * from './IDPClaimSyncService.js';
 export * from './IDPResponseError.js';
 export * from './IDPValidationError.js';
 export * from './InvalidIDPConfigurationError.js';

package/dist/types/model/service/idp/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/index.ts"],"names":[],"mappings":"AAAA,cAAc,8BAA8B,CAAA;AAC5C,cAAc,oCAAoC,CAAA;AAClD,cAAc,yBAAyB,CAAA;AACvC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,+BAA+B,CAAA;AAC7C,cAAc,sBAAsB,CAAA;AACpC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oCAAoC,CAAA;AAClD,cAAc,uBAAuB,CAAA;AACrC,cAAc,yBAAyB,CAAA;AACvC,cAAc,mCAAmC,CAAA;AACjD,cAAc,8BAA8B,CAAA;AAC5C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,iCAAiC,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/index.ts"],"names":[],"mappings":"AAAA,cAAc,8BAA8B,CAAA;AAC5C,cAAc,oCAAoC,CAAA;AAClD,cAAc,yBAAyB,CAAA;AACvC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,+BAA+B,CAAA;AAC7C,cAAc,sBAAsB,CAAA;AACpC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oCAAoC,CAAA;AAClD,cAAc,mBAAmB,CAAA;AACjC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,yBAAyB,CAAA;AACvC,cAAc,mCAAmC,CAAA;AACjD,cAAc,8BAA8B,CAAA;AAC5C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,iCAAiC,CAAA"}

package/dist/types/model/service/idp/providers/AppleProvider.d.ts

@@ -23,7 +23,7 @@ export declare const AppleConfiguration: Typesafe.Type<{
         readonly mode?: "auto" | "blocking" | undefined;
         readonly onFailure?: "revoke" | undefined;
     } & {
-        readonly method?: "refresh" | "userinfo" | "introspection" | undefined;
+        readonly method?: "introspection" | "refresh" | "userinfo" | undefined;
     }) | undefined;
     readonly claimMapping?: {
         readonly externalIdentifier?: string | undefined;
@@ -59,7 +59,7 @@ export declare class AppleProvider implements IdentityProviderHandler<AppleConfi
             readonly mode?: "auto" | "blocking" | undefined;
             readonly onFailure?: "revoke" | undefined;
         } & {
-            readonly method?: "refresh" | "userinfo" | "introspection" | undefined;
+            readonly method?: "introspection" | "refresh" | "userinfo" | undefined;
         }) | undefined;
         readonly claimMapping?: {
             readonly externalIdentifier?: string | undefined;

package/dist/types/model/service/idp/providers/AppleProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AppleProvider.d.ts","sourceRoot":"","sources":["../../../../../../src/model/service/idp/providers/AppleProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AASvG,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQ9B,CAAA;AAED,KAAK,kBAAkB,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAI/D,qBAAa,aAAc,YAAW,uBAAuB,CAAC,kBAAkB,CAAC;IAChF,OAAO,CAAC,MAAM,CAA4B;IAE1C,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAAkE;IAE1E,QAAQ,CAAC,aAAa,EAAE,kBAAkB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAStF,eAAe,CAAC,aAAa,EAAE,kBAAkB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IAMpG,sBAAsB,CAAC,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;YAIpF,gBAAgB;CAyB9B"}
+{"version":3,"file":"AppleProvider.d.ts","sourceRoot":"","sources":["../../../../../../src/model/service/idp/providers/AppleProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AASvG,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQ9B,CAAA;AAED,KAAK,kBAAkB,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAI/D,qBAAa,aAAc,YAAW,uBAAuB,CAAC,kBAAkB,CAAC;IAChF,OAAO,CAAC,MAAM,CAA4B;IAE1C,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAAkE;IAE1E,QAAQ,CAAC,aAAa,EAAE,kBAAkB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAOlG;IAEY,eAAe,CAAC,aAAa,EAAE,kBAAkB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAInG;IAED,sBAAsB,CAAC,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAEjG;YAEa,gBAAgB;CAyB9B"}

package/dist/types/model/service/idp/providers/FacebookProvider.d.ts

@@ -22,7 +22,7 @@ declare const FacebookConfiguration: Typesafe.Type<{
         readonly mode?: "auto" | "blocking" | undefined;
         readonly onFailure?: "revoke" | undefined;
     } & {
-        readonly method?: "refresh" | "userinfo" | "introspection" | undefined;
+        readonly method?: "introspection" | "refresh" | "userinfo" | undefined;
     }) | undefined;
     readonly claimMapping?: {
         readonly externalIdentifier?: string | undefined;
@@ -57,7 +57,7 @@ export declare class FacebookProvider implements IdentityProviderHandler<Faceboo
             readonly mode?: "auto" | "blocking" | undefined;
             readonly onFailure?: "revoke" | undefined;
         } & {
-            readonly method?: "refresh" | "userinfo" | "introspection" | undefined;
+            readonly method?: "introspection" | "refresh" | "userinfo" | undefined;
         }) | undefined;
         readonly claimMapping?: {
             readonly externalIdentifier?: string | undefined;

package/dist/types/model/service/idp/providers/FacebookProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"FacebookProvider.d.ts","sourceRoot":"","sources":["../../../../../../src/model/service/idp/providers/FacebookProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAE/C,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AASvG,QAAA,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAAwB,CAAA;AACnD,KAAK,qBAAqB,GAAG,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAkBrE,qBAAa,gBAAiB,YAAW,uBAAuB,CAAC,qBAAqB,CAAC;IAGtF,OAAO,CAAC,cAAc,CAsCpB;IAEF,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAAqE;IAE7E,QAAQ,CAAC,aAAa,EAAE,qBAAqB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC;IASzF,eAAe,CAAC,aAAa,EAAE,qBAAqB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IA8BvG,sBAAsB,CAAC,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE,EAAE,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;YAI5F,gBAAgB;CAa9B"}
+{"version":3,"file":"FacebookProvider.d.ts","sourceRoot":"","sources":["../../../../../../src/model/service/idp/providers/FacebookProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAE/C,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AASvG,QAAA,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAAwB,CAAA;AACnD,KAAK,qBAAqB,GAAG,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAkBrE,qBAAa,gBAAiB,YAAW,uBAAuB,CAAC,qBAAqB,CAAC;IAGtF,OAAO,CAAC,cAAc,CAsCpB;IAEF,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAAqE;IAE7E,QAAQ,CAAC,aAAa,EAAE,qBAAqB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAOrG;IAEY,eAAe,CAAC,aAAa,EAAE,qBAAqB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CA4BtG;IAED,sBAAsB,CAAC,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE,EAAE,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAEzG;YAEa,gBAAgB;CAa9B"}

package/dist/types/model/service/idp/providers/OIDCHelpers.d.ts

@@ -23,6 +23,15 @@ export type HandleOIDCResponseOptions = {
     captureSession?: boolean;
     claimMapping?: OIDCClaimMapping;
 };
+/**
+ * Lift a configured nested attributes object (`attributesKey`, notably Apereo CAS's `attributes`) to the
+ * top level so providers that nest their claims map without a code change. The nested attributes are
+ * UNSIGNED, so they are spread UNDER `source` — a signed top-level claim keeps precedence over an
+ * attributes-level value. Shared by the sign-in response handler ({@link handleOIDCResponse}) and the
+ * session-refresh path ({@link revalidateOIDC}) so BOTH see the same claim surface; without this, an
+ * `attributesKey` provider's A09 claim mapping would resolve at sign-in but silently not on refresh.
+ */
+export declare const liftNestedClaims: (source: Record<string, unknown>, attributesKey: string | undefined) => Record<string, unknown>;
 export declare const handleOIDCResponse: (client: Client, { sessionData, redirectUrl, ...otherData }: OIDCResponseData, { fetchUserInfo, returnOIDCResult, captureSession, claimMapping }?: HandleOIDCResponseOptions) => Promise<IDPResponse>;
 /**
  * Re-validate a stored OIDC session against the IdP. Returns `revoked` only for definitive
@@ -30,7 +39,10 @@ export declare const handleOIDCResponse: (client: Client, { sessionData, redirec
  * (network, IdP down) re-throw so the caller can fail-open and keep the session — IdP
  * downtime must not log everyone out.
  */
-export declare const revalidateOIDC: (client: Client, method: "refresh" | "userinfo" | "introspection", session: IDPSessionState) => Promise<RevalidationResult>;
+export declare const revalidateOIDC: (client: Client, method: 'refresh' | 'userinfo' | 'introspection', session: IDPSessionState, options?: {
+    claimMapping?: OIDCClaimMapping;
+    fetchUserInfo?: boolean;
+}) => Promise<RevalidationResult>;
 /**
  * Build an RP-initiated (front-channel) logout URL (OIDC RP-Initiated Logout 1.0). Returns null
  * when the IdP advertises no `end_session_endpoint` — the caller then degrades to a local-only

package/dist/types/model/service/idp/providers/OIDCHelpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OIDCHelpers.d.ts","sourceRoot":"","sources":["../../../../../../src/model/service/idp/providers/OIDCHelpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAA8B,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAEpF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAGnE,OAAO,EACN,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,MAAM,+BAA+B,CAAA;AAEtC;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,GAAI,UAAU,QAAQ,EAAE,YAAY,MAAM,EAAE,aAAa,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,eAYrH,CAAA;AAED,eAAO,MAAM,YAAY,GACxB,QAAQ,MAAM,EACd,sCAAsC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,KAClG,OAAO,CAAC,iBAAiB,CAe3B,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACvC,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,YAAY,CAAC,EAAE,gBAAgB,CAAA;CAC/B,CAAA;AASD,eAAO,MAAM,kBAAkB,GAC9B,QAAQ,MAAM,EACd,4CAA4C,gBAAgB,EAC5D,oEAAmE,yBAA8B,KAC/F,OAAO,CAAC,WAAW,CAgFrB,CAAA;AAKD;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAC1B,QAAQ,MAAM,EACd,QAAQ,SAAS,GAAG,UAAU,GAAG,eAAe,EAChD,SAAS,eAAe,KACtB,OAAO,CAAC,kBAAkB,CA0D5B,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAAI,QAAQ,MAAM,EAAE,oCAAoC,gBAAgB,KAAG,MAAM,GAAG,IAQlH,CAAA;AAmCD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,GAAU,QAAQ,MAAM,EAAE,QAAQ,MAAM,CAAC,MAAM,CAAC,EAAE,aAAa,MAAM,KAAG,OAAO,CAAC,iBAAiB,CAqDpI,CAAA"}
+{"version":3,"file":"OIDCHelpers.d.ts","sourceRoot":"","sources":["../../../../../../src/model/service/idp/providers/OIDCHelpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAA8B,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAEpF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAGnE,OAAO,EACN,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,MAAM,+BAA+B,CAAA;AAEtC;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,aAAc,QAAQ,cAAc,MAAM,eAAe,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,eAYrH,CAAA;AAED,eAAO,MAAM,YAAY,WAChB,MAAM,wCACwB;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,KAClG,OAAO,CAAC,iBAAiB,CAe3B,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACvC,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,YAAY,CAAC,EAAE,gBAAgB,CAAA;CAC/B,CAAA;AAiBD;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,WAAY,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,iBAAiB,MAAM,GAAG,SAAS,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAS3H,CAAA;AAkGD,eAAO,MAAM,kBAAkB,WACtB,MAAM,8CAC8B,gBAAgB,sEACO,yBAAyB,KAC1F,OAAO,CAAC,WAAW,CAqCrB,CAAA;AAKD;;;;;GAKG;AACH,eAAO,MAAM,cAAc,WAClB,MAAM,UACN,SAAS,GAAG,UAAU,GAAG,eAAe,WACvC,eAAe,YACf;IAAE,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CAAE,KACnE,OAAO,CAAC,kBAAkB,CAqF5B,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,WAAY,MAAM,sCAAsC,gBAAgB,KAAG,MAAM,GAAG,IAQlH,CAAA;AAmCD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,WAAkB,MAAM,UAAU,MAAM,CAAC,MAAM,CAAC,eAAe,MAAM,KAAG,OAAO,CAAC,iBAAiB,CAqDpI,CAAA"}

package/dist/types/model/service/idp/providers/OIDCProvider.d.ts

@@ -24,7 +24,7 @@ export declare class OIDCProvider implements IdentityProviderHandler<OIDCConfigu
             readonly mode?: "auto" | "blocking" | undefined;
             readonly onFailure?: "revoke" | undefined;
         } & {
-            readonly method?: "refresh" | "userinfo" | "introspection" | undefined;
+            readonly method?: "introspection" | "refresh" | "userinfo" | undefined;
         }) | undefined;
         readonly claimMapping?: {
             readonly externalIdentifier?: string | undefined;

package/dist/types/model/service/idp/providers/OIDCProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OIDCProvider.d.ts","sourceRoot":"","sources":["../../../../../../src/model/service/idp/providers/OIDCProvider.ts"],"names":[],"mappings":"AACA,OAAO,EACN,uBAAuB,EACvB,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,MAAM,+BAA+B,CAAA;AAGtC,OAAO,EAAE,iBAAiB,EAAkC,MAAM,gBAAgB,CAAA;AAOlF,qBAAa,YAAa,YAAW,uBAAuB,CAAC,iBAAiB,CAAC;IAC9E,OAAO,CAAC,WAAW,CAAqC;IAExD,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAAiE;IAEzE,QAAQ,CAAC,aAAa,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC;IASrF,eAAe,CAAC,aAAa,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IAetF,UAAU,CAAC,aAAa,EAAE,iBAAiB,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAKnG,cAAc,CAAC,aAAa,EAAE,iBAAiB,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAKnG,mBAAmB,CAAC,aAAa,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAKnH;;;OAGG;IACH,OAAO,CAAC,YAAY;IAUpB,sBAAsB,CAAC,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;YAIpF,gBAAgB;CAqB9B"}
+{"version":3,"file":"OIDCProvider.d.ts","sourceRoot":"","sources":["../../../../../../src/model/service/idp/providers/OIDCProvider.ts"],"names":[],"mappings":"AACA,OAAO,EACN,uBAAuB,EACvB,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,MAAM,+BAA+B,CAAA;AAGtC,OAAO,EAAE,iBAAiB,EAAkC,MAAM,gBAAgB,CAAA;AAOlF,qBAAa,YAAa,YAAW,uBAAuB,CAAC,iBAAiB,CAAC;IAC9E,OAAO,CAAC,WAAW,CAAqC;IAExD,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAAiE;IAEzE,QAAQ,CAAC,aAAa,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAOjG;IAEY,eAAe,CAAC,aAAa,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAalG;IAEY,UAAU,CAAC,aAAa,EAAE,iBAAiB,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAM/G;IAEY,cAAc,CAAC,aAAa,EAAE,iBAAiB,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAG/G;IAEY,mBAAmB,CAAC,aAAa,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAGlH;IAED;;;OAGG;IACH,OAAO,CAAC,YAAY;IAUpB,sBAAsB,CAAC,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAEjG;YAEa,gBAAgB;CAqB9B"}

package/dist/types/model/service/idp/providers/OIDCTypes.d.ts

@@ -13,7 +13,7 @@ export declare const OIDCRevalidationConfig: Typesafe.Type<{
     readonly mode?: "auto" | "blocking" | undefined;
     readonly onFailure?: "revoke" | undefined;
 } & {
-    readonly method?: "refresh" | "userinfo" | "introspection" | undefined;
+    readonly method?: "introspection" | "refresh" | "userinfo" | undefined;
 }>;
 export type OIDCRevalidationConfig = ReturnType<typeof OIDCRevalidationConfig>;
 /**
@@ -67,7 +67,7 @@ export declare const OIDCConfigurationOptions: {
             readonly mode?: "auto" | "blocking" | undefined;
             readonly onFailure?: "revoke" | undefined;
         } & {
-            readonly method?: "refresh" | "userinfo" | "introspection" | undefined;
+            readonly method?: "introspection" | "refresh" | "userinfo" | undefined;
         }) | undefined;
         readonly claimMapping?: {
             readonly externalIdentifier?: string | undefined;
@@ -100,7 +100,7 @@ export declare const OIDCConfigurationOptions: {
             readonly mode?: "auto" | "blocking" | undefined;
             readonly onFailure?: "revoke" | undefined;
         } & {
-            readonly method?: "refresh" | "userinfo" | "introspection" | undefined;
+            readonly method?: "introspection" | "refresh" | "userinfo" | undefined;
         }>;
         claimMapping: {
             (input: unknown, path?: PropertyKey[]): {
@@ -158,7 +158,7 @@ export declare const BaseOIDCConfiguration: Typesafe.Type<{
         readonly mode?: "auto" | "blocking" | undefined;
         readonly onFailure?: "revoke" | undefined;
     } & {
-        readonly method?: "refresh" | "userinfo" | "introspection" | undefined;
+        readonly method?: "introspection" | "refresh" | "userinfo" | undefined;
     }) | undefined;
     readonly claimMapping?: {
         readonly externalIdentifier?: string | undefined;
@@ -190,7 +190,7 @@ export declare const OIDCConfiguration: Typesafe.Type<{
         readonly mode?: "auto" | "blocking" | undefined;
         readonly onFailure?: "revoke" | undefined;
     } & {
-        readonly method?: "refresh" | "userinfo" | "introspection" | undefined;
+        readonly method?: "introspection" | "refresh" | "userinfo" | undefined;
     }) | undefined;
     readonly claimMapping?: {
         readonly externalIdentifier?: string | undefined;

package/dist/types/model/service/idp/providers/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../../../src/model/service/idp/providers/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAE/C,eAAO,MAAM,aAAa,GACxB,CAAC,SAAS,QAAQ,CAAC,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,kBAAkB;IAAE,KAAI,OAAO,EAAE,MAAM,GAAG,KAAK,CAAA;CAAE,MAAM,OAAO,OAAO,KAAG,CASzH,CAAA"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../../../src/model/service/idp/providers/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAE/C,eAAO,MAAM,aAAa,GACxB,CAAC,SAAS,QAAQ,CAAC,IAAI,QAAQ,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB;IAAE,KAAI,OAAO,EAAE,MAAM,GAAG,KAAK,CAAA;CAAE,aAAa,OAAO,KAAG,CASzH,CAAA"}

package/dist/types/model/service/index.d.ts

@@ -16,6 +16,7 @@ export * from './MailTemplateManager.js';
 export * from './MembershipValidator.js';
 export * from './OtpAuthenticator.js';
 export * from './OtpManager.js';
+export * from './PanelAccessResolver.js';
 export * from './PasswordChangeManager.js';
 export * from './PasswordResetManager.js';
 export * from './PersonAccessManager.js';

package/dist/types/model/service/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/model/service/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,gBAAgB,CAAA;AAE9B,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,yBAAyB,CAAA;AACvC,cAAc,wBAAwB,CAAA;AACtC,cAAc,yBAAyB,CAAA;AACvC,cAAc,sBAAsB,CAAA;AACpC,cAAc,qBAAqB,CAAA;AACnC,cAAc,+BAA+B,CAAA;AAC7C,cAAc,uBAAuB,CAAA;AACrC,cAAc,oBAAoB,CAAA;AAClC,cAAc,wBAAwB,CAAA;AACtC,cAAc,0BAA0B,CAAA;AACxC,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,4BAA4B,CAAA;AAC1C,cAAc,2BAA2B,CAAA;AACzC,cAAc,0BAA0B,CAAA;AACxC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,2BAA2B,CAAA;AACzC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/model/service/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,gBAAgB,CAAA;AAE9B,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,yBAAyB,CAAA;AACvC,cAAc,wBAAwB,CAAA;AACtC,cAAc,yBAAyB,CAAA;AACvC,cAAc,sBAAsB,CAAA;AACpC,cAAc,qBAAqB,CAAA;AACnC,cAAc,+BAA+B,CAAA;AAC7C,cAAc,uBAAuB,CAAA;AACrC,cAAc,oBAAoB,CAAA;AAClC,cAAc,wBAAwB,CAAA;AACtC,cAAc,0BAA0B,CAAA;AACxC,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,0BAA0B,CAAA;AACxC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,2BAA2B,CAAA;AACzC,cAAc,0BAA0B,CAAA;AACxC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,2BAA2B,CAAA;AACzC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA"}

package/dist/types/model/service/membershipUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"membershipUtils.d.ts","sourceRoot":"","sources":["../../../../src/model/service/membershipUtils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAuB,MAAM,sBAAsB,CAAA;AAClG,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,eAAO,MAAM,4BAA4B,GAAI,aAAa,SAAS,GAAG,CAAC,UAAU,EAAE,KAAG,eAAe,EAKpG,CAAA;AACD,eAAO,MAAM,+BAA+B,GAAI,aAAa,SAAS,GAAG,CAAC,UAAU,EAAE,KAAG,eAAe,EAKvG,CAAA;AAED,eAAO,MAAM,4BAA4B,GACxC,gBAAgB,SAAS,GAAG,CAAC,UAAU,EAAE,EACzC,gBAAgB,SAAS,GAAG,CAAC,UAAU,EAAE,KACvC,qBAAqB,EA8BvB,CAAA"}
+{"version":3,"file":"membershipUtils.d.ts","sourceRoot":"","sources":["../../../../src/model/service/membershipUtils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAuB,MAAM,sBAAsB,CAAA;AAClG,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,eAAO,MAAM,4BAA4B,gBAAiB,SAAS,GAAG,CAAC,UAAU,EAAE,KAAG,eAAe,EAKpG,CAAA;AACD,eAAO,MAAM,+BAA+B,gBAAiB,SAAS,GAAG,CAAC,UAAU,EAAE,KAAG,eAAe,EAKvG,CAAA;AAED,eAAO,MAAM,4BAA4B,mBACxB,SAAS,GAAG,CAAC,UAAU,EAAE,kBACzB,SAAS,GAAG,CAAC,UAAU,EAAE,KACvC,qBAAqB,EA8BvB,CAAA"}

package/dist/types/model/type/AuthLog.d.ts

@@ -1,2 +1,2 @@
-export type AuthActionType = 'login' | 'create_session_token' | 'idp_login' | 'password_reset_init' | 'password_reset' | 'password_change' | 'email_change' | 'email_verify_init' | 'email_verify_complete' | 'email_change_init' | 'email_change_complete' | '2fa_disable' | '2fa_enable' | 'passwordless_login_init' | 'passwordless_login_exchange' | 'passwordless_login' | 'person_disable' | 'session_revoked_by_user' | 'forced_sign_out' | 'global_role_grant' | 'global_role_revoke' | 'project_membership_create' | 'project_membership_update' | 'project_membership_remove' | 'api_key_create' | 'api_key_disable' | 'idp_create' | 'idp_update' | 'idp_disable' | 'idp_enable' | 'idp_session_revalidated' | 'idp_session_revoked' | 'idp_session_revalidation_failed' | 'idp_logout_initiated' | 'idp_backchannel_logout' | 'idp_disconnect' | 'project_create' | 'project_update' | 'project_secret_change' | 'mail_template_change' | 'tenant_config_change' | 'person_invite' | 'backup_code_generated' | 'backup_code_used' | 'backup_code_regenerated' | 'email_otp_sent' | 'mfa_enrollment_required' | 'mfa_reset' | 'session_expired_idle' | 'session_policy_applied' | 'auth_policy_change' | 'unusual_login_detected' | 'step_up_required';
+export type AuthActionType = 'login' | 'create_session_token' | 'idp_login' | 'password_reset_init' | 'password_reset' | 'password_change' | 'email_change' | 'email_verify_init' | 'email_verify_complete' | 'email_change_init' | 'email_change_complete' | '2fa_disable' | '2fa_enable' | 'passwordless_login_init' | 'passwordless_login_exchange' | 'passwordless_login' | 'person_disable' | 'person_enable' | 'session_revoked_by_user' | 'forced_sign_out' | 'global_role_grant' | 'global_role_revoke' | 'project_membership_create' | 'project_membership_update' | 'project_membership_remove' | 'api_key_create' | 'api_key_disable' | 'idp_create' | 'idp_update' | 'idp_disable' | 'idp_enable' | 'idp_session_revalidated' | 'idp_session_revoked' | 'idp_session_revalidation_failed' | 'idp_logout_initiated' | 'idp_backchannel_logout' | 'idp_disconnect' | 'idp_role_mapped' | 'idp_role_mapping_failed' | 'project_create' | 'project_update' | 'project_secret_change' | 'mail_template_change' | 'tenant_config_change' | 'person_invite' | 'backup_code_generated' | 'backup_code_used' | 'backup_code_regenerated' | 'email_otp_sent' | 'mfa_enrollment_required' | 'mfa_reset' | 'session_expired_idle' | 'session_policy_applied' | 'auth_policy_change' | 'unusual_login_detected' | 'step_up_required';
 //# sourceMappingURL=AuthLog.d.ts.map

package/dist/types/model/type/AuthLog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthLog.d.ts","sourceRoot":"","sources":["../../../../src/model/type/AuthLog.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,cAAc,GACvB,OAAO,GACP,sBAAsB,GACtB,WAAW,GACX,qBAAqB,GACrB,gBAAgB,GAChB,iBAAiB,GACjB,cAAc,GACd,mBAAmB,GACnB,uBAAuB,GACvB,mBAAmB,GACnB,uBAAuB,GACvB,aAAa,GACb,YAAY,GACZ,yBAAyB,GACzB,6BAA6B,GAC7B,oBAAoB,GACpB,gBAAgB,GAChB,yBAAyB,GACzB,iBAAiB,GACjB,mBAAmB,GACnB,oBAAoB,GACpB,2BAA2B,GAC3B,2BAA2B,GAC3B,2BAA2B,GAC3B,gBAAgB,GAChB,iBAAiB,GACjB,YAAY,GACZ,YAAY,GACZ,aAAa,GACb,YAAY,GACZ,yBAAyB,GACzB,qBAAqB,GACrB,iCAAiC,GACjC,sBAAsB,GACtB,wBAAwB,GACxB,gBAAgB,GAChB,gBAAgB,GAChB,gBAAgB,GAChB,uBAAuB,GACvB,sBAAsB,GACtB,sBAAsB,GACtB,eAAe,GACf,uBAAuB,GACvB,kBAAkB,GAClB,yBAAyB,GACzB,gBAAgB,GAChB,yBAAyB,GACzB,WAAW,GACX,sBAAsB,GACtB,wBAAwB,GACxB,oBAAoB,GACpB,wBAAwB,GACxB,kBAAkB,CAAA"}
+{"version":3,"file":"AuthLog.d.ts","sourceRoot":"","sources":["../../../../src/model/type/AuthLog.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,cAAc,GACvB,OAAO,GACP,sBAAsB,GACtB,WAAW,GACX,qBAAqB,GACrB,gBAAgB,GAChB,iBAAiB,GACjB,cAAc,GACd,mBAAmB,GACnB,uBAAuB,GACvB,mBAAmB,GACnB,uBAAuB,GACvB,aAAa,GACb,YAAY,GACZ,yBAAyB,GACzB,6BAA6B,GAC7B,oBAAoB,GACpB,gBAAgB,GAChB,eAAe,GACf,yBAAyB,GACzB,iBAAiB,GACjB,mBAAmB,GACnB,oBAAoB,GACpB,2BAA2B,GAC3B,2BAA2B,GAC3B,2BAA2B,GAC3B,gBAAgB,GAChB,iBAAiB,GACjB,YAAY,GACZ,YAAY,GACZ,aAAa,GACb,YAAY,GACZ,yBAAyB,GACzB,qBAAqB,GACrB,iCAAiC,GACjC,sBAAsB,GACtB,wBAAwB,GACxB,gBAAgB,GAChB,iBAAiB,GACjB,yBAAyB,GACzB,gBAAgB,GAChB,gBAAgB,GAChB,uBAAuB,GACvB,sBAAsB,GACtB,sBAAsB,GACtB,eAAe,GACf,uBAAuB,GACvB,kBAAkB,GAClB,yBAAyB,GACzB,gBAAgB,GAChB,yBAAyB,GACzB,WAAW,GACX,sBAAsB,GACtB,wBAAwB,GACxB,oBAAoB,GACpB,wBAAwB,GACxB,kBAAkB,CAAA"}

package/dist/types/model/type/Config.d.ts

@@ -48,6 +48,8 @@ export type ConfigRow = {
     rate_limit_email_otp_per_person_window: IPostgresInterval;
     rate_limit_email_verification_per_ip_limit: number;
     rate_limit_email_verification_per_ip_window: IPostgresInterval;
+    panel_global_roles: readonly string[];
+    panel_project_roles: readonly string[];
 };
 export type Config = Omit<{
     [K in keyof ConfigSchema]: {

package/dist/types/model/type/Config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Config.d.ts","sourceRoot":"","sources":["../../../../src/model/type/Config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,KAAK,MAAM,IAAI,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAChD,MAAM,MAAM,SAAS,GAAG;IACvB,iCAAiC,EAAE,OAAO,CAAA;IAC1C,iCAAiC,EAAE,OAAO,CAAA;IAC1C,oBAAoB,EAAE,YAAY,CAAA;IAClC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,uBAAuB,EAAE,iBAAiB,CAAA;IAC1C,mBAAmB,EAAE,MAAM,CAAA;IAC3B,0BAA0B,EAAE,MAAM,CAAA;IAClC,0BAA0B,EAAE,MAAM,CAAA;IAClC,sBAAsB,EAAE,MAAM,CAAA;IAC9B,wBAAwB,EAAE,MAAM,CAAA;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,wBAAwB,EAAE,OAAO,CAAA;IACjC,mBAAmB,EAAE,OAAO,CAAA;IAC5B,kBAAkB,EAAE,iBAAiB,CAAA;IACrC,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,oBAAoB,EAAE,iBAAiB,CAAA;IACvC,uBAAuB,EAAE,OAAO,CAAA;IAChC,yBAAyB,EAAE,OAAO,CAAA;IAClC,8BAA8B,EAAE,iBAAiB,CAAA;IACjD,0BAA0B,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACpD,wBAAwB,EAAE,iBAAiB,CAAA;IAC3C,+BAA+B,EAAE,OAAO,CAAA;IACxC,0BAA0B,EAAE,MAAM,CAAA;IAClC,6BAA6B,EAAE,MAAM,CAAA;IACrC,+BAA+B,EAAE,MAAM,CAAA;IACvC,gBAAgB,EAAE,eAAe,GAAG,IAAI,CAAA;IACxC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,uBAAuB,EAAE,OAAO,CAAA;IAChC,8BAA8B,EAAE,OAAO,CAAA;IACvC,iCAAiC,EAAE,OAAO,CAAA;IAC1C,kCAAkC,EAAE,OAAO,CAAA;IAC3C,+BAA+B,EAAE,MAAM,CAAA;IACvC,gCAAgC,EAAE,iBAAiB,CAAA;IACnD,6BAA6B,EAAE,MAAM,CAAA;IACrC,8BAA8B,EAAE,iBAAiB,CAAA;IACjD,sCAAsC,EAAE,MAAM,CAAA;IAC9C,uCAAuC,EAAE,iBAAiB,CAAA;IAC1D,yCAAyC,EAAE,MAAM,CAAA;IACjD,0CAA0C,EAAE,iBAAiB,CAAA;IAC7D,qCAAqC,EAAE,MAAM,CAAA;IAC7C,sCAAsC,EAAE,iBAAiB,CAAA;IACzD,0CAA0C,EAAE,MAAM,CAAA;IAClD,2CAA2C,EAAE,iBAAiB,CAAA;CAC9D,CAAA;AAED,MAAM,MAAM,MAAM,GACf,IAAI,CACL;KACE,CAAC,IAAI,MAAM,YAAY,GAAG;SACzB,EAAE,IAAI,MAAM,YAAY,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC;KACrE;CACD,EACD,YAAY,CACZ,GACC;IACD;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;CACrC,CAAA"}
+{"version":3,"file":"Config.d.ts","sourceRoot":"","sources":["../../../../src/model/type/Config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,KAAK,MAAM,IAAI,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAChD,MAAM,MAAM,SAAS,GAAG;IACvB,iCAAiC,EAAE,OAAO,CAAA;IAC1C,iCAAiC,EAAE,OAAO,CAAA;IAC1C,oBAAoB,EAAE,YAAY,CAAA;IAClC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,uBAAuB,EAAE,iBAAiB,CAAA;IAC1C,mBAAmB,EAAE,MAAM,CAAA;IAC3B,0BAA0B,EAAE,MAAM,CAAA;IAClC,0BAA0B,EAAE,MAAM,CAAA;IAClC,sBAAsB,EAAE,MAAM,CAAA;IAC9B,wBAAwB,EAAE,MAAM,CAAA;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,wBAAwB,EAAE,OAAO,CAAA;IACjC,mBAAmB,EAAE,OAAO,CAAA;IAC5B,kBAAkB,EAAE,iBAAiB,CAAA;IACrC,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,oBAAoB,EAAE,iBAAiB,CAAA;IACvC,uBAAuB,EAAE,OAAO,CAAA;IAChC,yBAAyB,EAAE,OAAO,CAAA;IAClC,8BAA8B,EAAE,iBAAiB,CAAA;IACjD,0BAA0B,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACpD,wBAAwB,EAAE,iBAAiB,CAAA;IAC3C,+BAA+B,EAAE,OAAO,CAAA;IACxC,0BAA0B,EAAE,MAAM,CAAA;IAClC,6BAA6B,EAAE,MAAM,CAAA;IACrC,+BAA+B,EAAE,MAAM,CAAA;IACvC,gBAAgB,EAAE,eAAe,GAAG,IAAI,CAAA;IACxC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,uBAAuB,EAAE,OAAO,CAAA;IAChC,8BAA8B,EAAE,OAAO,CAAA;IACvC,iCAAiC,EAAE,OAAO,CAAA;IAC1C,kCAAkC,EAAE,OAAO,CAAA;IAC3C,+BAA+B,EAAE,MAAM,CAAA;IACvC,gCAAgC,EAAE,iBAAiB,CAAA;IACnD,6BAA6B,EAAE,MAAM,CAAA;IACrC,8BAA8B,EAAE,iBAAiB,CAAA;IACjD,sCAAsC,EAAE,MAAM,CAAA;IAC9C,uCAAuC,EAAE,iBAAiB,CAAA;IAC1D,yCAAyC,EAAE,MAAM,CAAA;IACjD,0CAA0C,EAAE,iBAAiB,CAAA;IAC7D,qCAAqC,EAAE,MAAM,CAAA;IAC7C,sCAAsC,EAAE,iBAAiB,CAAA;IACzD,0CAA0C,EAAE,MAAM,CAAA;IAClD,2CAA2C,EAAE,iBAAiB,CAAA;IAE9D,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAA;CACtC,CAAA;AAED,MAAM,MAAM,MAAM,GACf,IAAI,CACL;KACE,CAAC,IAAI,MAAM,YAAY,GAAG;SACzB,EAAE,IAAI,MAAM,YAAY,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC;KACrE;CACD,EACD,YAAY,CACZ,GACC;IACD;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;CACrC,CAAA"}

package/dist/types/model/type/IdentityProvider.d.ts

@@ -10,5 +10,7 @@ export interface IdentityProviderOptions {
     initReturnsConfig: boolean;
     requireVerifiedEmail: boolean;
     assumeEmailVerified: boolean;
+    /** A person linked to this provider may authenticate only through it. */
+    disableLocalAuthentication: boolean;
 }
 //# sourceMappingURL=IdentityProvider.d.ts.map

package/dist/types/model/type/IdentityProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityProvider.d.ts","sourceRoot":"","sources":["../../../../src/model/type/IdentityProvider.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAClC,OAAO,EAAE,uBAAuB,CAAA;CAChC;AAED,MAAM,WAAW,uBAAuB;IACvC,UAAU,EAAE,OAAO,CAAA;IACnB,SAAS,EAAE,OAAO,CAAA;IAClB,iBAAiB,EAAE,OAAO,CAAA;IAC1B,oBAAoB,EAAE,OAAO,CAAA;IAC7B,mBAAmB,EAAE,OAAO,CAAA;CAC5B"}
+{"version":3,"file":"IdentityProvider.d.ts","sourceRoot":"","sources":["../../../../src/model/type/IdentityProvider.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAClC,OAAO,EAAE,uBAAuB,CAAA;CAChC;AAED,MAAM,WAAW,uBAAuB;IACvC,UAAU,EAAE,OAAO,CAAA;IACnB,SAAS,EAAE,OAAO,CAAA;IAClB,iBAAiB,EAAE,OAAO,CAAA;IAC1B,oBAAoB,EAAE,OAAO,CAAA;IAC7B,mBAAmB,EAAE,OAAO,CAAA;IAC5B,yEAAyE;IACzE,0BAA0B,EAAE,OAAO,CAAA;CACnC"}

package/dist/types/model/type/RateLimit.d.ts

@@ -1,10 +1,10 @@
 export declare const RateLimitScopes: {
-    readonly signUpPerIp: "sign_up_per_ip";
-    readonly loginPerIp: "login_per_ip";
-    readonly passwordResetPerIp: "password_reset_per_ip";
-    readonly passwordlessInitPerIp: "passwordless_init_per_ip";
-    readonly emailOtpPerPerson: "email_otp_per_person";
-    readonly emailVerificationPerIp: "email_verification_per_ip";
+    readonly signUpPerIp: 'sign_up_per_ip';
+    readonly loginPerIp: 'login_per_ip';
+    readonly passwordResetPerIp: 'password_reset_per_ip';
+    readonly passwordlessInitPerIp: 'passwordless_init_per_ip';
+    readonly emailOtpPerPerson: 'email_otp_per_person';
+    readonly emailVerificationPerIp: 'email_verification_per_ip';
 };
 export type RateLimitScope = typeof RateLimitScopes[keyof typeof RateLimitScopes];
 //# sourceMappingURL=RateLimit.d.ts.map

package/dist/types/model/type/RateLimit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RateLimit.d.ts","sourceRoot":"","sources":["../../../../src/model/type/RateLimit.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe;;;;;;;CAOlB,CAAA;AAEV,MAAM,MAAM,cAAc,GAAG,OAAO,eAAe,CAAC,MAAM,OAAO,eAAe,CAAC,CAAA"}
+{"version":3,"file":"RateLimit.d.ts","sourceRoot":"","sources":["../../../../src/model/type/RateLimit.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe;aAC3B,WAAW,EAAE,gBAAgB;aAC7B,UAAU,EAAE,cAAc;aAC1B,kBAAkB,EAAE,uBAAuB;aAC3C,qBAAqB,EAAE,0BAA0B;aACjD,iBAAiB,EAAE,sBAAsB;aACzC,sBAAsB,EAAE,2BAA2B;CAC1C,CAAA;AAEV,MAAM,MAAM,cAAc,GAAG,OAAO,eAAe,CAAC,MAAM,OAAO,eAAe,CAAC,CAAA"}

package/dist/types/model/utils/DatabaseContext.d.ts

@@ -1,7 +1,20 @@
 import { Client, Connection } from '@contember/database';
+import { Logger } from '@contember/logger';
 import { Providers } from '../providers.js';
 import { CommandBus } from '../commands/index.js';
 import { BatchLoaderArgs } from '../../utils/batchQuery.js';
+export interface TransactionOptions {
+    /**
+     * Repeat the transaction when postgres aborts it with a serialization failure (40001) — the standing cost of the
+     * repeatable-read level every transaction here runs at.
+     *
+     * Opt in only when the callback has no effect outside the transaction: several managers send a mail from inside
+     * one (InviteManager, EmailChangeManager, PasswordlessSignInManager) and a retry would send it twice.
+     */
+    retry?: {
+        logger: Logger;
+    };
+}
 export declare class DatabaseContext<Conn extends Connection.ConnectionLike = Connection.ConnectionLike> {
     readonly client: Client<Conn>;
     readonly providers: Providers;
@@ -9,7 +22,7 @@ export declare class DatabaseContext<Conn extends Connection.ConnectionLike = Co
     constructor(client: Client<Conn>, providers: Providers);
     get commandBus(): CommandBus<Conn>;
     get queryHandler(): import("@contember/queryable").QueryHandler<import("@contember/database").DatabaseQueryable>;
-    transaction<T>(cb: (dbContext: DatabaseContext<Connection.TransactionLike>) => Promise<T>): Promise<T>;
+    transaction<T>(cb: (dbContext: DatabaseContext<Connection.TransactionLike>) => Promise<T>, options?: TransactionOptions): Promise<T>;
     scope<T>(cb: (dbContext: DatabaseContext<Connection.AcquiredConnectionLike>) => Promise<T>): Promise<T>;
     batchLoad<Arg, Result, Item>(loaderArgs: BatchLoaderArgs<Arg, Result, Item>, arg: Arg): Promise<Item>;
 }

package/dist/types/model/utils/DatabaseContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DatabaseContext.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/DatabaseContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACjD,OAAO,EAAE,eAAe,EAA+B,MAAM,2BAA2B,CAAA;AAExF,qBAAa,eAAe,CAAC,IAAI,SAAS,UAAU,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc;aAI7E,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;aACpB,SAAS,EAAE,SAAS;IAJrC,OAAO,CAAC,OAAO,CAAkE;gBAGhE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EACpB,SAAS,EAAE,SAAS;IAIrC,IAAW,UAAU,qBAEpB;IAED,IAAW,YAAY,iGAEtB;IAEY,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,EAAE,eAAe,CAAC,UAAU,CAAC,eAAe,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAOtG,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,EAAE,eAAe,CAAC,UAAU,CAAC,sBAAsB,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAM7G,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;CAS5G"}
+{"version":3,"file":"DatabaseContext.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/DatabaseContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAoB,MAAM,qBAAqB,CAAA;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACjD,OAAO,EAAE,eAAe,EAA+B,MAAM,2BAA2B,CAAA;AAExF,MAAM,WAAW,kBAAkB;IAClC;;;;;;OAMG;IACH,KAAK,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;CAC1B;AAED,qBAAa,eAAe,CAAC,IAAI,SAAS,UAAU,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc;aAI7E,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;aACpB,SAAS,EAAE,SAAS;IAJrC,OAAO,CAAC,OAAO,CAAkE;IAEjF,YACiB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EACpB,SAAS,EAAE,SAAS,EAEpC;IAED,IAAW,UAAU,qBAEpB;IAED,IAAW,YAAY,iGAEtB;IAEY,WAAW,CAAC,CAAC,EACzB,EAAE,EAAE,CAAC,SAAS,EAAE,eAAe,CAAC,UAAU,CAAC,eAAe,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,EAC1E,OAAO,GAAE,kBAAuB,GAC9B,OAAO,CAAC,CAAC,CAAC,CAWZ;IAEY,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,EAAE,eAAe,CAAC,UAAU,CAAC,sBAAsB,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAInH;IAEM,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ3G;CACD"}