@entifix/zitadel 0.1.0-0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 r10c Technologies
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/actions/action-webhook.d.ts

@@ -0,0 +1,93 @@
+import { EntifixLogicError } from '@entifix/core';
+import { Context, Effect, Layer } from 'effect';
+/**
+ * The header Zitadel signs an Actions v2 payload with.
+ *
+ * Read from the sender, not from the docs: `internal/execution/execution.go`
+ * sets `actions.SigningHeader`, which is this exact spelling. The `CreateTarget`
+ * proto comment claims `X-ZITADEL-Signature` and is wrong for v4.16.2 — we pin
+ * the one the running instance actually sends rather than accepting both, since
+ * a second accepted spelling is a second thing to get wrong later.
+ */
+export declare const ACTION_SIGNATURE_HEADER = "zitadel-signature";
+/**
+ * How far the signature's own timestamp may be from now, matching Zitadel's
+ * `DefaultTolerance`. It is what bounds replay: the payload is signed over the
+ * timestamp, so an old capture cannot be re-dated without breaking the MAC.
+ */
+export declare const ACTION_SIGNATURE_TOLERANCE_SECONDS = 300;
+/**
+ * The user-lifecycle events that must end an r10c session.
+ *
+ * All three are `user` aggregate events, so `aggregateID` is the Zitadel user id
+ * in every case — the same value that arrives as `sub` in an `id_token` and is
+ * stored as the account's `external-subject` identifier. That is what lets one
+ * handler serve all three without knowing anything about them individually.
+ */
+export declare const PROVIDER_USER_LIFECYCLE_EVENTS: readonly ["user.deactivated", "user.locked", "user.removed"];
+export type ProviderUserLifecycleEvent = (typeof PROVIDER_USER_LIFECYCLE_EVENTS)[number];
+/** A verified Actions v2 event, reduced to what session revocation needs. */
+export interface ProviderUserEvent {
+    /** e.g. `user.deactivated`. Kept for logging and for the no-op branch. */
+    readonly eventType: string;
+    /** The `aggregateID`: the provider's user id, i.e. the OIDC `sub`. */
+    readonly subject: string;
+    /**
+     * True when {@link eventType} is one this platform acts on. An execution can be
+     * added at the provider without a deploy here, so an unrecognised type must be
+     * a no-op rather than an error.
+     */
+    readonly revokesSessions: boolean;
+}
+/** How the verifier is pointed at a target. Resolved from config-service at boot. */
+export interface ZitadelActionsConfig {
+    /**
+     * The key Zitadel minted when the target was created. It is returned **only**
+     * from `CreateTarget` and can never be read back, which is why
+     * `tools/zitadel-seed.mjs` stamps it into `.generated.env` and carries it
+     * forward across re-seeds.
+     */
+    readonly signingKey: string;
+}
+export interface ZitadelActions {
+    /**
+     * Verify a webhook call and say what it asks for.
+     *
+     * Takes the **raw** body, not a parsed object: the MAC covers the bytes
+     * Zitadel sent, and a re-serialised object is a different sequence of bytes.
+     */
+    verifyEvent(rawBody: string, signatureHeader: string | undefined): Effect.Effect<ProviderUserEvent, EntifixLogicError>;
+}
+declare const ZitadelActionsTag_base: Context.TagClass<ZitadelActionsTag, "ZitadelActionsTag", ZitadelActions>;
+export declare class ZitadelActionsTag extends ZitadelActionsTag_base {
+}
+/**
+ * The security boundary of this file: whether a request that named a user
+ * deactivation really came from the identity provider.
+ *
+ * The endpoint it guards is unauthenticated by necessity — the caller is a
+ * server holding no cookie — exactly as the back-channel logout route is
+ * (ADR 0017). There the token's own signature is the authentication; here it is
+ * this HMAC, computed the way Zitadel's `pkg/actions/signing.go` computes it:
+ * `HMAC-SHA256(signingKey, "<unix timestamp>.<raw body>")`, hex.
+ *
+ * An empty key **fails closed**. A fleet whose signing key never arrived (the
+ * seed did not run, the config row is blank) must reject every call rather than
+ * accept anonymous requests to revoke anyone's sessions — the one failure mode
+ * that would be strictly worse than the bug this closes.
+ */
+export declare const verifyActionSignature: (rawBody: string, signatureHeader: string | undefined, signingKey: string, nowSeconds?: number) => boolean;
+/**
+ * A verifier for the Actions v2 webhook a Zitadel event execution calls.
+ *
+ * Deliberately separate from {@link ZitadelOidc}: that one speaks OIDC and
+ * verifies asymmetric provider JWTs against a published key set, this one
+ * verifies a shared-secret MAC over an arbitrary JSON body. Folding them
+ * together would put a symmetric key next to the pinned-`algorithms` verifier
+ * whose whole purpose is that no symmetric key is ever accepted there.
+ */
+export declare const makeZitadelActions: (config: ZitadelActionsConfig) => ZitadelActions;
+/** Binds {@link ZitadelActionsTag} from a resolved configuration. */
+export declare const ZitadelActionsLayer: (config: ZitadelActionsConfig) => Layer.Layer<ZitadelActionsTag>;
+export {};
+//# sourceMappingURL=action-webhook.d.ts.map

package/dist/actions/action-webhook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-webhook.d.ts","sourceRoot":"","sources":["../../src/actions/action-webhook.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAEhD;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,sBAAsB,CAAC;AAE3D;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,MAAM,CAAC;AAEtD;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,8DAIjC,CAAC;AAEX,MAAM,MAAM,0BAA0B,GACpC,CAAC,OAAO,8BAA8B,CAAC,CAAC,MAAM,CAAC,CAAC;AAElD,6EAA6E;AAC7E,MAAM,WAAW,iBAAiB;IAChC,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC;AAED,qFAAqF;AACrF,MAAM,WAAW,oBAAoB;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,WAAW,CACT,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,MAAM,GAAG,SAAS,GAClC,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;CACxD;;AAED,qBAAa,iBAAkB,SAAQ,sBAGpC;CAAG;AAkCN;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,GAChC,SAAS,MAAM,EACf,iBAAiB,MAAM,GAAG,SAAS,EACnC,YAAY,MAAM,EAClB,aAAY,MAAsC,KACjD,OAeF,CAAC;AA8BF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAC7B,QAAQ,oBAAoB,KAC3B,cAiBD,CAAC;AAEH,qEAAqE;AACrE,eAAO,MAAM,mBAAmB,GAC9B,QAAQ,oBAAoB,KAC3B,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAC8B,CAAC"}

package/dist/actions/action-webhook.js

@@ -0,0 +1,126 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { EntifixLogicError } from '@entifix/core';
+import { Context, Effect, Layer } from 'effect';
+/**
+ * The header Zitadel signs an Actions v2 payload with.
+ *
+ * Read from the sender, not from the docs: `internal/execution/execution.go`
+ * sets `actions.SigningHeader`, which is this exact spelling. The `CreateTarget`
+ * proto comment claims `X-ZITADEL-Signature` and is wrong for v4.16.2 — we pin
+ * the one the running instance actually sends rather than accepting both, since
+ * a second accepted spelling is a second thing to get wrong later.
+ */ export const ACTION_SIGNATURE_HEADER = 'zitadel-signature';
+/**
+ * How far the signature's own timestamp may be from now, matching Zitadel's
+ * `DefaultTolerance`. It is what bounds replay: the payload is signed over the
+ * timestamp, so an old capture cannot be re-dated without breaking the MAC.
+ */ export const ACTION_SIGNATURE_TOLERANCE_SECONDS = 300;
+/**
+ * The user-lifecycle events that must end an r10c session.
+ *
+ * All three are `user` aggregate events, so `aggregateID` is the Zitadel user id
+ * in every case — the same value that arrives as `sub` in an `id_token` and is
+ * stored as the account's `external-subject` identifier. That is what lets one
+ * handler serve all three without knowing anything about them individually.
+ */ export const PROVIDER_USER_LIFECYCLE_EVENTS = [
+    'user.deactivated',
+    'user.locked',
+    'user.removed'
+];
+export class ZitadelActionsTag extends Context.Tag('ZitadelActionsTag')() {
+}
+/**
+ * `t=<unix>,v1=<hex>` — and there may be more than one `v1=`, because Zitadel's
+ * `ComputeSignatureHeader` takes a list of keys and appends one part per key.
+ * Accepting only the first would break the moment a key is rotated with an
+ * overlap window.
+ */ const parseSignatureHeader = (header)=>{
+    let timestamp;
+    const signatures = [];
+    for (const part of header.split(',')){
+        const [name, value] = part.trim().split('=', 2);
+        if (value === undefined || value === '') continue;
+        if (name === 't') timestamp = Number(value);
+        if (name === 'v1') signatures.push(value);
+    }
+    if (timestamp === undefined || !Number.isFinite(timestamp)) return undefined;
+    if (signatures.length === 0) return undefined;
+    return {
+        timestamp,
+        signatures
+    };
+};
+const signaturesMatch = (expected, candidate)=>{
+    const actual = Buffer.from(candidate, 'hex');
+    // `timingSafeEqual` throws on a length mismatch, and a wrong-length signature
+    // is a mismatch we can answer without looking at the bytes anyway.
+    return actual.length === expected.length && timingSafeEqual(actual, expected);
+};
+/**
+ * The security boundary of this file: whether a request that named a user
+ * deactivation really came from the identity provider.
+ *
+ * The endpoint it guards is unauthenticated by necessity — the caller is a
+ * server holding no cookie — exactly as the back-channel logout route is
+ * (ADR 0017). There the token's own signature is the authentication; here it is
+ * this HMAC, computed the way Zitadel's `pkg/actions/signing.go` computes it:
+ * `HMAC-SHA256(signingKey, "<unix timestamp>.<raw body>")`, hex.
+ *
+ * An empty key **fails closed**. A fleet whose signing key never arrived (the
+ * seed did not run, the config row is blank) must reject every call rather than
+ * accept anonymous requests to revoke anyone's sessions — the one failure mode
+ * that would be strictly worse than the bug this closes.
+ */ export const verifyActionSignature = (rawBody, signatureHeader, signingKey, nowSeconds = Math.floor(Date.now() / 1000))=>{
+    if (signingKey === '' || signatureHeader === undefined) return false;
+    const parsed = parseSignatureHeader(signatureHeader);
+    if (parsed === undefined) return false;
+    if (Math.abs(nowSeconds - parsed.timestamp) > ACTION_SIGNATURE_TOLERANCE_SECONDS) {
+        return false;
+    }
+    const expected = createHmac('sha256', signingKey).update(`${String(parsed.timestamp)}.${rawBody}`).digest();
+    return parsed.signatures.some((candidate)=>signaturesMatch(expected, candidate));
+};
+const isLifecycleEvent = (eventType)=>PROVIDER_USER_LIFECYCLE_EVENTS.includes(eventType);
+/**
+ * Zitadel's event payload, of which only two fields matter here. `event_type` is
+ * snake_case in the JSON while `aggregateID` is not — that asymmetry is the
+ * provider's, not a typo.
+ */ const readEvent = (rawBody)=>{
+    let parsed;
+    try {
+        parsed = JSON.parse(rawBody);
+    } catch (unused) {
+        return undefined;
+    }
+    if (typeof parsed !== 'object' || parsed === null) return undefined;
+    const body = parsed;
+    const eventType = body['event_type'];
+    const subject = body['aggregateID'];
+    if (typeof eventType !== 'string' || eventType === '') return undefined;
+    if (typeof subject !== 'string' || subject === '') return undefined;
+    return {
+        eventType,
+        subject,
+        revokesSessions: isLifecycleEvent(eventType)
+    };
+};
+/**
+ * A verifier for the Actions v2 webhook a Zitadel event execution calls.
+ *
+ * Deliberately separate from {@link ZitadelOidc}: that one speaks OIDC and
+ * verifies asymmetric provider JWTs against a published key set, this one
+ * verifies a shared-secret MAC over an arbitrary JSON body. Folding them
+ * together would put a symmetric key next to the pinned-`algorithms` verifier
+ * whose whole purpose is that no symmetric key is ever accepted there.
+ */ export const makeZitadelActions = (config)=>({
+        verifyEvent: (rawBody, signatureHeader)=>Effect.suspend(()=>{
+                if (!verifyActionSignature(rawBody, signatureHeader, config.signingKey)) {
+                    return Effect.fail(new EntifixLogicError('the action payload signature did not verify'));
+                }
+                const event = readEvent(rawBody);
+                return event === undefined ? Effect.fail(new EntifixLogicError('the action payload is not a user event: no event_type or aggregateID')) : Effect.succeed(event);
+            })
+    });
+/** Binds {@link ZitadelActionsTag} from a resolved configuration. */ export const ZitadelActionsLayer = (config)=>Layer.succeed(ZitadelActionsTag, makeZitadelActions(config));
+
+//# sourceMappingURL=action-webhook.js.map

package/dist/actions/action-webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/actions/action-webhook.ts"],"sourcesContent":["import { createHmac, timingSafeEqual } from 'node:crypto';\n\nimport { EntifixLogicError } from '@entifix/core';\nimport { Context, Effect, Layer } from 'effect';\n\n/**\n * The header Zitadel signs an Actions v2 payload with.\n *\n * Read from the sender, not from the docs: `internal/execution/execution.go`\n * sets `actions.SigningHeader`, which is this exact spelling. The `CreateTarget`\n * proto comment claims `X-ZITADEL-Signature` and is wrong for v4.16.2 — we pin\n * the one the running instance actually sends rather than accepting both, since\n * a second accepted spelling is a second thing to get wrong later.\n */\nexport const ACTION_SIGNATURE_HEADER = 'zitadel-signature';\n\n/**\n * How far the signature's own timestamp may be from now, matching Zitadel's\n * `DefaultTolerance`. It is what bounds replay: the payload is signed over the\n * timestamp, so an old capture cannot be re-dated without breaking the MAC.\n */\nexport const ACTION_SIGNATURE_TOLERANCE_SECONDS = 300;\n\n/**\n * The user-lifecycle events that must end an r10c session.\n *\n * All three are `user` aggregate events, so `aggregateID` is the Zitadel user id\n * in every case — the same value that arrives as `sub` in an `id_token` and is\n * stored as the account's `external-subject` identifier. That is what lets one\n * handler serve all three without knowing anything about them individually.\n */\nexport const PROVIDER_USER_LIFECYCLE_EVENTS = [\n  'user.deactivated',\n  'user.locked',\n  'user.removed',\n] as const;\n\nexport type ProviderUserLifecycleEvent =\n  (typeof PROVIDER_USER_LIFECYCLE_EVENTS)[number];\n\n/** A verified Actions v2 event, reduced to what session revocation needs. */\nexport interface ProviderUserEvent {\n  /** e.g. `user.deactivated`. Kept for logging and for the no-op branch. */\n  readonly eventType: string;\n  /** The `aggregateID`: the provider's user id, i.e. the OIDC `sub`. */\n  readonly subject: string;\n  /**\n   * True when {@link eventType} is one this platform acts on. An execution can be\n   * added at the provider without a deploy here, so an unrecognised type must be\n   * a no-op rather than an error.\n   */\n  readonly revokesSessions: boolean;\n}\n\n/** How the verifier is pointed at a target. Resolved from config-service at boot. */\nexport interface ZitadelActionsConfig {\n  /**\n   * The key Zitadel minted when the target was created. It is returned **only**\n   * from `CreateTarget` and can never be read back, which is why\n   * `tools/zitadel-seed.mjs` stamps it into `.generated.env` and carries it\n   * forward across re-seeds.\n   */\n  readonly signingKey: string;\n}\n\nexport interface ZitadelActions {\n  /**\n   * Verify a webhook call and say what it asks for.\n   *\n   * Takes the **raw** body, not a parsed object: the MAC covers the bytes\n   * Zitadel sent, and a re-serialised object is a different sequence of bytes.\n   */\n  verifyEvent(\n    rawBody: string,\n    signatureHeader: string | undefined,\n  ): Effect.Effect<ProviderUserEvent, EntifixLogicError>;\n}\n\nexport class ZitadelActionsTag extends Context.Tag('ZitadelActionsTag')<\n  ZitadelActionsTag,\n  ZitadelActions\n>() {}\n\ninterface ParsedSignature {\n  readonly timestamp: number;\n  readonly signatures: readonly string[];\n}\n\n/**\n * `t=<unix>,v1=<hex>` — and there may be more than one `v1=`, because Zitadel's\n * `ComputeSignatureHeader` takes a list of keys and appends one part per key.\n * Accepting only the first would break the moment a key is rotated with an\n * overlap window.\n */\nconst parseSignatureHeader = (header: string): ParsedSignature | undefined => {\n  let timestamp: number | undefined;\n  const signatures: string[] = [];\n  for (const part of header.split(',')) {\n    const [name, value] = part.trim().split('=', 2);\n    if (value === undefined || value === '') continue;\n    if (name === 't') timestamp = Number(value);\n    if (name === 'v1') signatures.push(value);\n  }\n  if (timestamp === undefined || !Number.isFinite(timestamp)) return undefined;\n  if (signatures.length === 0) return undefined;\n  return { timestamp, signatures };\n};\n\nconst signaturesMatch = (expected: Buffer, candidate: string): boolean => {\n  const actual = Buffer.from(candidate, 'hex');\n  // `timingSafeEqual` throws on a length mismatch, and a wrong-length signature\n  // is a mismatch we can answer without looking at the bytes anyway.\n  return actual.length === expected.length && timingSafeEqual(actual, expected);\n};\n\n/**\n * The security boundary of this file: whether a request that named a user\n * deactivation really came from the identity provider.\n *\n * The endpoint it guards is unauthenticated by necessity — the caller is a\n * server holding no cookie — exactly as the back-channel logout route is\n * (ADR 0017). There the token's own signature is the authentication; here it is\n * this HMAC, computed the way Zitadel's `pkg/actions/signing.go` computes it:\n * `HMAC-SHA256(signingKey, \"<unix timestamp>.<raw body>\")`, hex.\n *\n * An empty key **fails closed**. A fleet whose signing key never arrived (the\n * seed did not run, the config row is blank) must reject every call rather than\n * accept anonymous requests to revoke anyone's sessions — the one failure mode\n * that would be strictly worse than the bug this closes.\n */\nexport const verifyActionSignature = (\n  rawBody: string,\n  signatureHeader: string | undefined,\n  signingKey: string,\n  nowSeconds: number = Math.floor(Date.now() / 1000),\n): boolean => {\n  if (signingKey === '' || signatureHeader === undefined) return false;\n  const parsed = parseSignatureHeader(signatureHeader);\n  if (parsed === undefined) return false;\n  if (\n    Math.abs(nowSeconds - parsed.timestamp) > ACTION_SIGNATURE_TOLERANCE_SECONDS\n  ) {\n    return false;\n  }\n  const expected = createHmac('sha256', signingKey)\n    .update(`${String(parsed.timestamp)}.${rawBody}`)\n    .digest();\n  return parsed.signatures.some(candidate =>\n    signaturesMatch(expected, candidate),\n  );\n};\n\nconst isLifecycleEvent = (eventType: string): boolean =>\n  (PROVIDER_USER_LIFECYCLE_EVENTS as readonly string[]).includes(eventType);\n\n/**\n * Zitadel's event payload, of which only two fields matter here. `event_type` is\n * snake_case in the JSON while `aggregateID` is not — that asymmetry is the\n * provider's, not a typo.\n */\nconst readEvent = (rawBody: string): ProviderUserEvent | undefined => {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(rawBody);\n  } catch {\n    return undefined;\n  }\n  if (typeof parsed !== 'object' || parsed === null) return undefined;\n  const body = parsed as Record<string, unknown>;\n  const eventType = body['event_type'];\n  const subject = body['aggregateID'];\n  if (typeof eventType !== 'string' || eventType === '') return undefined;\n  if (typeof subject !== 'string' || subject === '') return undefined;\n  return {\n    eventType,\n    subject,\n    revokesSessions: isLifecycleEvent(eventType),\n  };\n};\n\n/**\n * A verifier for the Actions v2 webhook a Zitadel event execution calls.\n *\n * Deliberately separate from {@link ZitadelOidc}: that one speaks OIDC and\n * verifies asymmetric provider JWTs against a published key set, this one\n * verifies a shared-secret MAC over an arbitrary JSON body. Folding them\n * together would put a symmetric key next to the pinned-`algorithms` verifier\n * whose whole purpose is that no symmetric key is ever accepted there.\n */\nexport const makeZitadelActions = (\n  config: ZitadelActionsConfig,\n): ZitadelActions => ({\n  verifyEvent: (rawBody, signatureHeader) =>\n    Effect.suspend(() => {\n      if (!verifyActionSignature(rawBody, signatureHeader, config.signingKey)) {\n        return Effect.fail(\n          new EntifixLogicError('the action payload signature did not verify'),\n        );\n      }\n      const event = readEvent(rawBody);\n      return event === undefined\n        ? Effect.fail(\n            new EntifixLogicError(\n              'the action payload is not a user event: no event_type or aggregateID',\n            ),\n          )\n        : Effect.succeed(event);\n    }),\n});\n\n/** Binds {@link ZitadelActionsTag} from a resolved configuration. */\nexport const ZitadelActionsLayer = (\n  config: ZitadelActionsConfig,\n): Layer.Layer<ZitadelActionsTag> =>\n  Layer.succeed(ZitadelActionsTag, makeZitadelActions(config));\n"],"names":["createHmac","timingSafeEqual","EntifixLogicError","Context","Effect","Layer","ACTION_SIGNATURE_HEADER","ACTION_SIGNATURE_TOLERANCE_SECONDS","PROVIDER_USER_LIFECYCLE_EVENTS","ZitadelActionsTag","Tag","parseSignatureHeader","header","timestamp","signatures","part","split","name","value","trim","undefined","Number","push","isFinite","length","signaturesMatch","expected","candidate","actual","Buffer","from","verifyActionSignature","rawBody","signatureHeader","signingKey","nowSeconds","Math","floor","Date","now","parsed","abs","update","String","digest","some","isLifecycleEvent","eventType","includes","readEvent","JSON","parse","body","subject","revokesSessions","makeZitadelActions","config","verifyEvent","suspend","fail","event","succeed","ZitadelActionsLayer"],"mappings":"AAAA,SAASA,UAAU,EAAEC,eAAe,QAAQ,cAAc;AAE1D,SAASC,iBAAiB,QAAQ,gBAAgB;AAClD,SAASC,OAAO,EAAEC,MAAM,EAAEC,KAAK,QAAQ,SAAS;AAEhD;;;;;;;;CAQC,GACD,OAAO,MAAMC,0BAA0B,oBAAoB;AAE3D;;;;CAIC,GACD,OAAO,MAAMC,qCAAqC,IAAI;AAEtD;;;;;;;CAOC,GACD,OAAO,MAAMC,iCAAiC;IAC5C;IACA;IACA;CACD,CAAU;AA2CX,OAAO,MAAMC,0BAA0BN,QAAQO,GAAG,CAAC;AAG9C;AAOL;;;;;CAKC,GACD,MAAMC,uBAAuB,CAACC;IAC5B,IAAIC;IACJ,MAAMC,aAAuB,EAAE;IAC/B,KAAK,MAAMC,QAAQH,OAAOI,KAAK,CAAC,KAAM;QACpC,MAAM,CAACC,MAAMC,MAAM,GAAGH,KAAKI,IAAI,GAAGH,KAAK,CAAC,KAAK;QAC7C,IAAIE,UAAUE,aAAaF,UAAU,IAAI;QACzC,IAAID,SAAS,KAAKJ,YAAYQ,OAAOH;QACrC,IAAID,SAAS,MAAMH,WAAWQ,IAAI,CAACJ;IACrC;IACA,IAAIL,cAAcO,aAAa,CAACC,OAAOE,QAAQ,CAACV,YAAY,OAAOO;IACnE,IAAIN,WAAWU,MAAM,KAAK,GAAG,OAAOJ;IACpC,OAAO;QAAEP;QAAWC;IAAW;AACjC;AAEA,MAAMW,kBAAkB,CAACC,UAAkBC;IACzC,MAAMC,SAASC,OAAOC,IAAI,CAACH,WAAW;IACtC,8EAA8E;IAC9E,mEAAmE;IACnE,OAAOC,OAAOJ,MAAM,KAAKE,SAASF,MAAM,IAAIvB,gBAAgB2B,QAAQF;AACtE;AAEA;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMK,wBAAwB,CACnCC,SACAC,iBACAC,YACAC,aAAqBC,KAAKC,KAAK,CAACC,KAAKC,GAAG,KAAK,KAAK;IAElD,IAAIL,eAAe,MAAMD,oBAAoBb,WAAW,OAAO;IAC/D,MAAMoB,SAAS7B,qBAAqBsB;IACpC,IAAIO,WAAWpB,WAAW,OAAO;IACjC,IACEgB,KAAKK,GAAG,CAACN,aAAaK,OAAO3B,SAAS,IAAIN,oCAC1C;QACA,OAAO;IACT;IACA,MAAMmB,WAAW1B,WAAW,UAAUkC,YACnCQ,MAAM,CAAC,GAAGC,OAAOH,OAAO3B,SAAS,EAAE,CAAC,EAAEmB,SAAS,EAC/CY,MAAM;IACT,OAAOJ,OAAO1B,UAAU,CAAC+B,IAAI,CAAClB,CAAAA,YAC5BF,gBAAgBC,UAAUC;AAE9B,EAAE;AAEF,MAAMmB,mBAAmB,CAACC,YACxB,AAACvC,+BAAqDwC,QAAQ,CAACD;AAEjE;;;;CAIC,GACD,MAAME,YAAY,CAACjB;IACjB,IAAIQ;IACJ,IAAI;QACFA,SAASU,KAAKC,KAAK,CAACnB;IACtB,EAAE,eAAM;QACN,OAAOZ;IACT;IACA,IAAI,OAAOoB,WAAW,YAAYA,WAAW,MAAM,OAAOpB;IAC1D,MAAMgC,OAAOZ;IACb,MAAMO,YAAYK,IAAI,CAAC,aAAa;IACpC,MAAMC,UAAUD,IAAI,CAAC,cAAc;IACnC,IAAI,OAAOL,cAAc,YAAYA,cAAc,IAAI,OAAO3B;IAC9D,IAAI,OAAOiC,YAAY,YAAYA,YAAY,IAAI,OAAOjC;IAC1D,OAAO;QACL2B;QACAM;QACAC,iBAAiBR,iBAAiBC;IACpC;AACF;AAEA;;;;;;;;CAQC,GACD,OAAO,MAAMQ,qBAAqB,CAChCC,SACoB,CAAA;QACpBC,aAAa,CAACzB,SAASC,kBACrB7B,OAAOsD,OAAO,CAAC;gBACb,IAAI,CAAC3B,sBAAsBC,SAASC,iBAAiBuB,OAAOtB,UAAU,GAAG;oBACvE,OAAO9B,OAAOuD,IAAI,CAChB,IAAIzD,kBAAkB;gBAE1B;gBACA,MAAM0D,QAAQX,UAAUjB;gBACxB,OAAO4B,UAAUxC,YACbhB,OAAOuD,IAAI,CACT,IAAIzD,kBACF,2EAGJE,OAAOyD,OAAO,CAACD;YACrB;IACJ,CAAA,EAAG;AAEH,mEAAmE,GACnE,OAAO,MAAME,sBAAsB,CACjCN,SAEAnD,MAAMwD,OAAO,CAACpD,mBAAmB8C,mBAAmBC,SAAS"}

package/dist/health/zitadel-health-probe.d.ts

@@ -0,0 +1,19 @@
+import { HealthRegistryTag } from '@entifix/business';
+import { Layer } from 'effect';
+/** Probe name reported by `/api/health/ready` when Zitadel is unreachable. */
+export declare const ZITADEL_PROBE_NAME = "zitadel";
+/**
+ * Registers a readiness probe against the instance's `/debug/ready`.
+ *
+ * A service that cannot reach Zitadel can still answer liveness — its process
+ * is fine — while readiness reports the truth, which is the split Kubernetes
+ * acts on: drain traffic, do not restart.
+ *
+ * The endpoint is unauthenticated on purpose: a readiness check must not spend
+ * a credential, and `/debug/ready` reveals nothing beyond "this instance is
+ * serving". The deadline matters as much as the check, because an instance that
+ * is mid-init accepts the connection and then simply does not answer — which
+ * would leave readiness hanging at the one moment it must reply.
+ */
+export declare const ZitadelHealthProbeLayer: (issuer: string) => Layer.Layer<never, never, HealthRegistryTag>;
+//# sourceMappingURL=zitadel-health-probe.d.ts.map

package/dist/health/zitadel-health-probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zitadel-health-probe.d.ts","sourceRoot":"","sources":["../../src/health/zitadel-health-probe.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAU,KAAK,EAAE,MAAM,QAAQ,CAAC;AAEvC,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YAAY,CAAC;AAK5C;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,GAClC,QAAQ,MAAM,KACb,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,iBAAiB,CAsB3C,CAAC"}

package/dist/health/zitadel-health-probe.js

@@ -0,0 +1,34 @@
+import { HealthRegistryTag } from '@entifix/business';
+import { Effect, Layer } from 'effect';
+/** Probe name reported by `/api/health/ready` when Zitadel is unreachable. */ export const ZITADEL_PROBE_NAME = 'zitadel';
+/** How long the probe waits before calling the instance unreachable. */ const PROBE_TIMEOUT_MILLIS = 2000;
+/**
+ * Registers a readiness probe against the instance's `/debug/ready`.
+ *
+ * A service that cannot reach Zitadel can still answer liveness — its process
+ * is fine — while readiness reports the truth, which is the split Kubernetes
+ * acts on: drain traffic, do not restart.
+ *
+ * The endpoint is unauthenticated on purpose: a readiness check must not spend
+ * a credential, and `/debug/ready` reveals nothing beyond "this instance is
+ * serving". The deadline matters as much as the check, because an instance that
+ * is mid-init accepts the connection and then simply does not answer — which
+ * would leave readiness hanging at the one moment it must reply.
+ */ export const ZitadelHealthProbeLayer = (issuer)=>Layer.effectDiscard(Effect.gen(function*() {
+        const registry = yield* HealthRegistryTag;
+        const url = `${issuer.replace(/\/$/, '')}/debug/ready`;
+        yield* registry.register({
+            name: ZITADEL_PROBE_NAME,
+            kind: 'upstream',
+            // A foreign system, deliberately not a Store (`docs/_shared/planes.md`):
+            // it has an owner, and the owner is not us.
+            targets: [
+                ZITADEL_PROBE_NAME
+            ],
+            check: Effect.tryPromise(()=>fetch(url, {
+                    signal: AbortSignal.timeout(PROBE_TIMEOUT_MILLIS)
+                })).pipe(Effect.map((response)=>response.ok), Effect.catchAll(()=>Effect.succeed(false)))
+        });
+    }));
+
+//# sourceMappingURL=zitadel-health-probe.js.map

package/dist/health/zitadel-health-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/health/zitadel-health-probe.ts"],"sourcesContent":["import { HealthRegistryTag } from '@entifix/business';\nimport { Effect, Layer } from 'effect';\n\n/** Probe name reported by `/api/health/ready` when Zitadel is unreachable. */\nexport const ZITADEL_PROBE_NAME = 'zitadel';\n\n/** How long the probe waits before calling the instance unreachable. */\nconst PROBE_TIMEOUT_MILLIS = 2_000;\n\n/**\n * Registers a readiness probe against the instance's `/debug/ready`.\n *\n * A service that cannot reach Zitadel can still answer liveness — its process\n * is fine — while readiness reports the truth, which is the split Kubernetes\n * acts on: drain traffic, do not restart.\n *\n * The endpoint is unauthenticated on purpose: a readiness check must not spend\n * a credential, and `/debug/ready` reveals nothing beyond \"this instance is\n * serving\". The deadline matters as much as the check, because an instance that\n * is mid-init accepts the connection and then simply does not answer — which\n * would leave readiness hanging at the one moment it must reply.\n */\nexport const ZitadelHealthProbeLayer = (\n  issuer: string,\n): Layer.Layer<never, never, HealthRegistryTag> =>\n  Layer.effectDiscard(\n    Effect.gen(function* () {\n      const registry = yield* HealthRegistryTag;\n      const url = `${issuer.replace(/\\/$/, '')}/debug/ready`;\n\n      yield* registry.register({\n        name: ZITADEL_PROBE_NAME,\n        kind: 'upstream',\n        // A foreign system, deliberately not a Store (`docs/_shared/planes.md`):\n        // it has an owner, and the owner is not us.\n        targets: [ZITADEL_PROBE_NAME],\n        check: Effect.tryPromise(() =>\n          fetch(url, {\n            signal: AbortSignal.timeout(PROBE_TIMEOUT_MILLIS),\n          }),\n        ).pipe(\n          Effect.map(response => response.ok),\n          Effect.catchAll(() => Effect.succeed(false)),\n        ),\n      });\n    }),\n  );\n"],"names":["HealthRegistryTag","Effect","Layer","ZITADEL_PROBE_NAME","PROBE_TIMEOUT_MILLIS","ZitadelHealthProbeLayer","issuer","effectDiscard","gen","registry","url","replace","register","name","kind","targets","check","tryPromise","fetch","signal","AbortSignal","timeout","pipe","map","response","ok","catchAll","succeed"],"mappings":"AAAA,SAASA,iBAAiB,QAAQ,oBAAoB;AACtD,SAASC,MAAM,EAAEC,KAAK,QAAQ,SAAS;AAEvC,4EAA4E,GAC5E,OAAO,MAAMC,qBAAqB,UAAU;AAE5C,sEAAsE,GACtE,MAAMC,uBAAuB;AAE7B;;;;;;;;;;;;CAYC,GACD,OAAO,MAAMC,0BAA0B,CACrCC,SAEAJ,MAAMK,aAAa,CACjBN,OAAOO,GAAG,CAAC;QACT,MAAMC,WAAW,OAAOT;QACxB,MAAMU,MAAM,GAAGJ,OAAOK,OAAO,CAAC,OAAO,IAAI,YAAY,CAAC;QAEtD,OAAOF,SAASG,QAAQ,CAAC;YACvBC,MAAMV;YACNW,MAAM;YACN,yEAAyE;YACzE,4CAA4C;YAC5CC,SAAS;gBAACZ;aAAmB;YAC7Ba,OAAOf,OAAOgB,UAAU,CAAC,IACvBC,MAAMR,KAAK;oBACTS,QAAQC,YAAYC,OAAO,CAACjB;gBAC9B,IACAkB,IAAI,CACJrB,OAAOsB,GAAG,CAACC,CAAAA,WAAYA,SAASC,EAAE,GAClCxB,OAAOyB,QAAQ,CAAC,IAAMzB,OAAO0B,OAAO,CAAC;QAEzC;IACF,IACA"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export * from './actions/action-webhook.js';
+export * from './health/zitadel-health-probe.js';
+export * from './management/management-client.js';
+export * from './oidc/discovery.js';
+export * from './oidc/oidc-client.js';
+export * from './oidc/pkce.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,6BAA6B,CAAC;AAC5C,cAAc,kCAAkC,CAAC;AACjD,cAAc,mCAAmC,CAAC;AAClD,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC"}

package/dist/index.js

@@ -0,0 +1,8 @@
+export * from './actions/action-webhook.js';
+export * from './health/zitadel-health-probe.js';
+export * from './management/management-client.js';
+export * from './oidc/discovery.js';
+export * from './oidc/oidc-client.js';
+export * from './oidc/pkce.js';
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export * from './actions/action-webhook.js';\nexport * from './health/zitadel-health-probe.js';\nexport * from './management/management-client.js';\nexport * from './oidc/discovery.js';\nexport * from './oidc/oidc-client.js';\nexport * from './oidc/pkce.js';\n"],"names":[],"mappings":"AAAA,cAAc,8BAA8B;AAC5C,cAAc,mCAAmC;AACjD,cAAc,oCAAoC;AAClD,cAAc,sBAAsB;AACpC,cAAc,wBAAwB;AACtC,cAAc,iBAAiB"}

package/dist/management/management-client.d.ts

@@ -0,0 +1,102 @@
+import { EntifixConnError } from '@entifix/core';
+import { Context, Effect, Layer } from 'effect';
+/** How the management client reaches an instance. */
+export interface ZitadelManagementConfig {
+    readonly issuer: string;
+    /**
+     * Personal access token of the seed machine user. Zitadel mints it at first
+     * init and `infra/local/ensure.sh` extracts it, so it is per-instance and
+     * disposable rather than a configured constant.
+     */
+    readonly personalAccessToken: string;
+}
+/** A human user as this client cares about it. */
+export interface ZitadelUser {
+    readonly userId: string;
+    readonly username: string;
+    readonly email?: string;
+    readonly emailVerified: boolean;
+    readonly displayName?: string;
+    readonly active: boolean;
+}
+/** What it takes to create one. */
+export interface ZitadelHumanInput {
+    readonly username: string;
+    readonly email: string;
+    readonly emailVerified?: boolean;
+    readonly givenName: string;
+    readonly familyName: string;
+    readonly displayName?: string;
+    /** Optional: a user created without one signs in through a social provider. */
+    readonly password?: string;
+    readonly passwordChangeRequired?: boolean;
+}
+/** What to ask the event store for. */
+export interface ZitadelEventQuery {
+    /** Event types to match, e.g. `user.deactivated`. */
+    readonly eventTypes: readonly string[];
+    /** Oldest event to return, as an ISO timestamp. */
+    readonly since: string;
+    /** Page size. The caller sweeps on an interval, so this is a ceiling. */
+    readonly limit: number;
+}
+/**
+ * One event, reduced to what a reconciler needs.
+ *
+ * ⚠️ **`payload` is deliberately dropped.** A `user.human.added` event carries
+ * the user's `encodedHash` — a bcrypt hash of their password — and this fleet
+ * has no reason to hold one, log one, or move one across a process boundary.
+ * What a reconciler acts on is *which user* and *when*, which is the whole of
+ * this shape.
+ */
+export interface ZitadelEvent {
+    /** The aggregate the event is about — for a user event, the user id. */
+    readonly subject: string;
+    /** The event's own type, e.g. `user.locked`. */
+    readonly type: string;
+    /** When the instance recorded it, as an ISO timestamp. */
+    readonly createdAt: string;
+}
+export interface ZitadelManagement {
+    findUserByEmail(email: string): Effect.Effect<ZitadelUser | null, EntifixConnError>;
+    getUser(userId: string): Effect.Effect<ZitadelUser | null, EntifixConnError>;
+    createHuman(input: ZitadelHumanInput): Effect.Effect<string, EntifixConnError>;
+    updateProfile(userId: string, profile: {
+        readonly givenName: string;
+        readonly familyName: string;
+        readonly displayName?: string;
+    }): Effect.Effect<void, EntifixConnError>;
+    setActive(userId: string, active: boolean): Effect.Effect<void, EntifixConnError>;
+    /** Compensating delete. Used when a provisioning half-write must be undone. */
+    deleteUser(userId: string): Effect.Effect<void, EntifixConnError>;
+    /**
+     * Lifecycle events the instance recorded, oldest first, from a cursor.
+     *
+     * The one read here that is not about a single user: it answers "what
+     * happened while I was not listening". Zitadel's Actions v2 target is
+     * `restAsync` — it sends the call and ignores the response, and it does not
+     * retry — so an event fired while auth-service is down is gone for good
+     * ([ADR 0019](../../../../../../docs/adr/0019-provider-user-lifecycle-events-revoke-sessions.md)).
+     */
+    searchEvents(query: ZitadelEventQuery): Effect.Effect<readonly ZitadelEvent[], EntifixConnError>;
+}
+declare const ZitadelManagementTag_base: Context.TagClass<ZitadelManagementTag, "ZitadelManagementTag", ZitadelManagement>;
+export declare class ZitadelManagementTag extends ZitadelManagementTag_base {
+}
+/**
+ * The slice of Zitadel's management API r10c drives.
+ *
+ * Only user lifecycle: everything about *credentials* — passwords, TOTP, linked
+ * social accounts, recovery — is Zitadel's alone and has no method here on
+ * purpose. r10c must not be able to read or set a credential, because the whole
+ * point of the swap is that it no longer holds any.
+ *
+ * Endpoints are a deliberate mix of API versions, matching what Zitadel v4
+ * actually offers: search is v1 (the v2 surface has no equivalent email query),
+ * everything else is v2.
+ */
+export declare const makeZitadelManagement: (config: ZitadelManagementConfig) => ZitadelManagement;
+/** Binds {@link ZitadelManagementTag} from a resolved configuration. */
+export declare const ZitadelManagementLayer: (config: ZitadelManagementConfig) => Layer.Layer<ZitadelManagementTag>;
+export {};
+//# sourceMappingURL=management-client.d.ts.map

package/dist/management/management-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"management-client.d.ts","sourceRoot":"","sources":["../../src/management/management-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAEhD,qDAAqD;AACrD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACtC;AAED,kDAAkD;AAClD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,mCAAmC;AACnC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAC3C;AAED,uCAAuC;AACvC,MAAM,WAAW,iBAAiB;IAChC,qDAAqD;IACrD,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,mDAAmD;IACnD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0DAA0D;IAC1D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAQD,MAAM,WAAW,iBAAiB;IAChC,eAAe,CACb,KAAK,EAAE,MAAM,GACZ,MAAM,CAAC,MAAM,CAAC,WAAW,GAAG,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACvD,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,GAAG,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAC7E,WAAW,CACT,KAAK,EAAE,iBAAiB,GACvB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3C,aAAa,CACX,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;QACP,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;KAC/B,GACA,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACzC,SAAS,CACP,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,OAAO,GACd,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACzC,+EAA+E;IAC/E,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAClE;;;;;;;;OAQG;IACH,YAAY,CACV,KAAK,EAAE,iBAAiB,GACvB,MAAM,CAAC,MAAM,CAAC,SAAS,YAAY,EAAE,EAAE,gBAAgB,CAAC,CAAC;CAC7D;;AAED,qBAAa,oBAAqB,SAAQ,yBAGvC;CAAG;AA2BN;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,GAChC,QAAQ,uBAAuB,KAC9B,iBAgMF,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,sBAAsB,GACjC,QAAQ,uBAAuB,KAC9B,KAAK,CAAC,KAAK,CAAC,oBAAoB,CACiC,CAAC"}

package/dist/management/management-client.js

@@ -0,0 +1,152 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+import { EntifixConnError } from '@entifix/core';
+import { Context, Effect, Layer } from 'effect';
+export class ZitadelManagementTag extends Context.Tag('ZitadelManagementTag')() {
+}
+const ACTIVE = 'USER_STATE_ACTIVE';
+/**
+ * The slice of Zitadel's management API r10c drives.
+ *
+ * Only user lifecycle: everything about *credentials* — passwords, TOTP, linked
+ * social accounts, recovery — is Zitadel's alone and has no method here on
+ * purpose. r10c must not be able to read or set a credential, because the whole
+ * point of the swap is that it no longer holds any.
+ *
+ * Endpoints are a deliberate mix of API versions, matching what Zitadel v4
+ * actually offers: search is v1 (the v2 surface has no equivalent email query),
+ * everything else is v2.
+ */ export const makeZitadelManagement = (config)=>{
+    const base = config.issuer.replace(/\/$/, '');
+    const call = (method, path, body)=>Effect.tryPromise({
+            try: async ()=>{
+                const response = await fetch(`${base}${path}`, _extends({
+                    method,
+                    headers: {
+                        authorization: `Bearer ${config.personalAccessToken}`,
+                        'content-type': 'application/json'
+                    }
+                }, body === undefined ? {} : {
+                    body: JSON.stringify(body)
+                }));
+                const text = await response.text();
+                const payload = text === '' ? {} : JSON.parse(text);
+                if (!response.ok) {
+                    var _payload_message;
+                    const message = (_payload_message = payload.message) != null ? _payload_message : `${method} ${path} answered ${String(response.status)}`;
+                    throw new Error(message);
+                }
+                return payload;
+            },
+            catch: (error)=>new EntifixConnError(`zitadel management call failed (${method} ${path}): ${String(error)}`)
+        });
+    const findUserByEmail = (email)=>call('POST', '/management/v1/users/_search', {
+            queries: [
+                {
+                    emailQuery: {
+                        emailAddress: email,
+                        method: 'TEXT_QUERY_METHOD_EQUALS_IGNORE_CASE'
+                    }
+                }
+            ]
+        }).pipe(Effect.map((payload)=>{
+            var _payload_result, _row_userName;
+            var _row_human_email, _row_human, _row_human_email1, _row_human1, _row_human_profile, _row_human2;
+            const row = ((_payload_result = payload.result) != null ? _payload_result : [])[0];
+            if ((row == null ? void 0 : row.id) === undefined) return null;
+            return {
+                userId: row.id,
+                username: (_row_userName = row.userName) != null ? _row_userName : '',
+                email: (_row_human = row.human) == null ? void 0 : (_row_human_email = _row_human.email) == null ? void 0 : _row_human_email.email,
+                emailVerified: ((_row_human1 = row.human) == null ? void 0 : (_row_human_email1 = _row_human1.email) == null ? void 0 : _row_human_email1.isEmailVerified) === true,
+                displayName: (_row_human2 = row.human) == null ? void 0 : (_row_human_profile = _row_human2.profile) == null ? void 0 : _row_human_profile.displayName,
+                active: row.state === ACTIVE
+            };
+        }));
+    const getUser = (userId)=>call('GET', `/v2/users/${userId}`).pipe(Effect.map((payload)=>{
+            var _user_username;
+            var _user_human_email, _user_human, _user_human_email1, _user_human1, _user_human_profile, _user_human2;
+            const user = payload.user;
+            if ((user == null ? void 0 : user.userId) === undefined) return null;
+            return {
+                userId: user.userId,
+                username: (_user_username = user.username) != null ? _user_username : '',
+                email: (_user_human = user.human) == null ? void 0 : (_user_human_email = _user_human.email) == null ? void 0 : _user_human_email.email,
+                emailVerified: ((_user_human1 = user.human) == null ? void 0 : (_user_human_email1 = _user_human1.email) == null ? void 0 : _user_human_email1.isVerified) === true,
+                displayName: (_user_human2 = user.human) == null ? void 0 : (_user_human_profile = _user_human2.profile) == null ? void 0 : _user_human_profile.displayName,
+                active: user.state === ACTIVE
+            };
+        }), // A deleted or never-existing id is a `404`, which is an answer rather
+        // than a failure: callers ask precisely because they do not know.
+        Effect.catchAll((error)=>/404|NotFound|doesn't exist/i.test(error.message) ? Effect.succeed(null) : Effect.fail(error)));
+    const createHuman = (input)=>call('POST', '/v2/users/human', _extends({
+            username: input.username,
+            profile: _extends({
+                givenName: input.givenName,
+                familyName: input.familyName
+            }, input.displayName === undefined ? {} : {
+                displayName: input.displayName
+            }),
+            email: {
+                email: input.email,
+                isVerified: input.emailVerified === true
+            }
+        }, input.password === undefined ? {} : {
+            password: {
+                password: input.password,
+                changeRequired: input.passwordChangeRequired === true
+            }
+        })).pipe(Effect.flatMap((payload)=>payload.userId === undefined ? Effect.fail(new EntifixConnError('zitadel accepted the user but returned no id')) : Effect.succeed(payload.userId)));
+    const updateProfile = (userId, profile)=>call('PUT', `/v2/users/human/${userId}`, {
+            profile
+        }).pipe(Effect.asVoid);
+    const setActive = (userId, active)=>call('POST', `/v2/users/${userId}/${active ? 'reactivate' : 'deactivate'}`, {}).pipe(Effect.asVoid);
+    const deleteUser = (userId)=>call('DELETE', `/v2/users/${userId}`).pipe(Effect.asVoid);
+    /**
+   * ⚠️ **Snake_case, and that is the API rather than a slip.** The admin event
+   * search takes `event_types`, `creation_date` and `asc` while every other
+   * call in this module takes camelCase — the v1 surface and the v2 surface do
+   * not agree, and this is the one v1 endpoint with a body.
+   *
+   * `asc: true` because a reconciler advances a cursor: processing newest-first
+   * and then storing the newest timestamp would skip everything behind a page
+   * boundary.
+   *
+   * A row missing its aggregate id is dropped rather than failing the sweep.
+   * There is nothing to act on, and one malformed row must not stop the ones
+   * behind it from being reconciled.
+   */ const searchEvents = (query)=>call('POST', '/admin/v1/events/_search', {
+            asc: true,
+            limit: query.limit,
+            creation_date: query.since,
+            event_types: query.eventTypes
+        }).pipe(Effect.map((payload)=>{
+            var _payload_events;
+            return ((_payload_events = payload.events) != null ? _payload_events : []).flatMap((row)=>{
+                var _row_aggregate, _row_type;
+                const subject = (_row_aggregate = row.aggregate) == null ? void 0 : _row_aggregate.id;
+                const type = (_row_type = row.type) == null ? void 0 : _row_type.type;
+                if (typeof subject !== 'string' || typeof type !== 'string' || typeof row.creationDate !== 'string') {
+                    return [];
+                }
+                return [
+                    {
+                        subject,
+                        type,
+                        createdAt: row.creationDate
+                    }
+                ];
+            });
+        }));
+    return {
+        findUserByEmail,
+        getUser,
+        createHuman,
+        updateProfile,
+        setActive,
+        deleteUser,
+        searchEvents
+    };
+};
+/** Binds {@link ZitadelManagementTag} from a resolved configuration. */ export const ZitadelManagementLayer = (config)=>Layer.succeed(ZitadelManagementTag, makeZitadelManagement(config));
+
+//# sourceMappingURL=management-client.js.map