@hilbras/keystone 1.1.0

package/dist/services/cache.js

@@ -0,0 +1,114 @@
+import { Redis } from "ioredis";
+import { Counter } from "prom-client";
+import { config } from "../config.js";
+const cacheHits = new Counter({ name: "keystone_cache_hits_total", help: "Cache hits", labelNames: ["cache"] });
+const cacheMisses = new Counter({ name: "keystone_cache_misses_total", help: "Cache misses", labelNames: ["cache"] });
+const cacheSets = new Counter({ name: "keystone_cache_sets_total", help: "Cache writes", labelNames: ["cache"] });
+const cacheDeletes = new Counter({ name: "keystone_cache_deletes_total", help: "Cache invalidations", labelNames: ["cache"] });
+class CacheProvider {
+    redis = null;
+    memory = new Map();
+    metrics = { hits: 0, misses: 0, sets: 0, deletes: 0 };
+    prefix;
+    constructor() {
+        this.prefix = config.CACHE_KEY_PREFIX || "keystone:";
+        if (config.REDIS_URL) {
+            this.redis = new Redis(config.REDIS_URL, { maxRetriesPerRequest: 2 });
+            this.redis.on("error", (err) => {
+                console.warn("[cache] redis error, falling back to in-memory:", err.message);
+            });
+        }
+    }
+    key(k) {
+        return `${this.prefix}${k}`;
+    }
+    async get(key) {
+        if (this.redis?.status === "ready") {
+            try {
+                const value = await this.redis.get(this.key(key));
+                if (value !== null) {
+                    this.metrics.hits++;
+                    cacheHits.inc({ cache: "redis" });
+                    return JSON.parse(value);
+                }
+            }
+            catch {
+                // fall through to memory fallback
+            }
+        }
+        const entry = this.memory.get(key);
+        if (entry && entry.expiresAt > Date.now()) {
+            this.metrics.hits++;
+            cacheHits.inc({ cache: "memory" });
+            return entry.value;
+        }
+        if (entry)
+            this.memory.delete(key);
+        this.metrics.misses++;
+        cacheMisses.inc({ cache: this.redis ? "redis" : "memory" });
+        return null;
+    }
+    async set(key, value, ttlSeconds = 60) {
+        if (this.redis?.status === "ready") {
+            try {
+                await this.redis.setex(this.key(key), ttlSeconds, JSON.stringify(value));
+                this.metrics.sets++;
+                cacheSets.inc({ cache: "redis" });
+                return;
+            }
+            catch {
+                // fall through to memory fallback
+            }
+        }
+        this.memory.set(key, { value, expiresAt: Date.now() + ttlSeconds * 1000 });
+        this.metrics.sets++;
+        cacheSets.inc({ cache: "memory" });
+    }
+    async del(key) {
+        this.memory.delete(key);
+        if (this.redis?.status === "ready") {
+            try {
+                await this.redis.del(this.key(key));
+            }
+            catch {
+                // ignore
+            }
+        }
+        this.metrics.deletes++;
+        cacheDeletes.inc({ cache: this.redis ? "redis" : "memory" });
+    }
+    async invalidate(pattern) {
+        const memoryKeys = [...this.memory.keys()].filter((k) => k.includes(pattern));
+        for (const k of memoryKeys)
+            this.memory.delete(k);
+        if (this.redis?.status === "ready") {
+            try {
+                let cursor = "0";
+                do {
+                    const result = await this.redis.scan(cursor, "MATCH", this.key(`*${pattern}*`), "COUNT", 100);
+                    cursor = result[0];
+                    const keys = result[1];
+                    if (keys.length)
+                        await this.redis.del(...keys);
+                } while (cursor !== "0");
+            }
+            catch {
+                // ignore
+            }
+        }
+        this.metrics.deletes += memoryKeys.length;
+        cacheDeletes.inc({ cache: this.redis ? "redis" : "memory" }, memoryKeys.length);
+    }
+    getMetrics() {
+        return { ...this.metrics };
+    }
+    async close() {
+        this.memory.clear();
+        if (this.redis) {
+            await this.redis.quit();
+            this.redis = null;
+        }
+    }
+}
+export const cache = new CacheProvider();
+//# sourceMappingURL=cache.js.map

package/dist/services/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../src/services/cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,MAAM,SAAS,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAChH,MAAM,WAAW,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AACtH,MAAM,SAAS,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAClH,MAAM,YAAY,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,qBAAqB,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAc/H,MAAM,aAAa;IACT,KAAK,GAAiB,IAAI,CAAC;IAC3B,MAAM,GAAG,IAAI,GAAG,EAA+B,CAAC;IAChD,OAAO,GAAiB,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACpE,MAAM,CAAS;IAEvB;QACE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,gBAAgB,IAAI,WAAW,CAAC;QACrD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,CAAC;YACtE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC7B,OAAO,CAAC,IAAI,CAAC,iDAAiD,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAC/E,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,GAAG,CAAC,CAAS;QACnB,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,GAAW;QACtB,IAAI,IAAI,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;gBAClD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;oBACnB,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;oBACpB,SAAS,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;oBAClC,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAM,CAAC;gBAChC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,kCAAkC;YACpC,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC1C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACpB,SAAS,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YACnC,OAAO,KAAK,CAAC,KAAU,CAAC;QAC1B,CAAC;QACD,IAAI,KAAK;YAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACtB,WAAW,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,GAAW,EAAE,KAAQ,EAAE,UAAU,GAAG,EAAE;QACjD,IAAI,IAAI,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;gBACzE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBACpB,SAAS,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;gBAClC,OAAO;YACT,CAAC;YAAC,MAAM,CAAC;gBACP,kCAAkC;YACpC,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACpB,SAAS,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,IAAI,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACvB,YAAY,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAAe;QAC9B,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9E,KAAK,MAAM,CAAC,IAAI,UAAU;YAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAElD,IAAI,IAAI,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,IAAI,MAAM,GAAG,GAAG,CAAC;gBACjB,GAAG,CAAC;oBACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;oBAC9F,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;oBACnB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;oBACvB,IAAI,IAAI,CAAC,MAAM;wBAAE,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;gBACjD,CAAC,QAAQ,MAAM,KAAK,GAAG,EAAE;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC;QAC1C,YAAY,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAClF,CAAC;IAED,UAAU;QACR,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,CAAC;IACH,CAAC;CACF;AAED,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,aAAa,EAAE,CAAC"}

package/dist/services/configuration/profiles.d.ts

@@ -0,0 +1,13 @@
+export interface ConfigurationProfile {
+    name: string;
+    description: string;
+    values: Record<string, string>;
+}
+export declare const CONFIGURATION_PROFILES: Record<string, ConfigurationProfile>;
+export declare function listConfigurationProfiles(): Array<{
+    id: string;
+    name: string;
+    description: string;
+}>;
+export declare function getConfigurationProfile(id: string): ConfigurationProfile | undefined;
+//# sourceMappingURL=profiles.d.ts.map

package/dist/services/configuration/profiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../../src/services/configuration/profiles.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAgGvE,CAAC;AAEF,wBAAgB,yBAAyB,IAAI,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAMpG;AAED,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS,CAEpF"}

package/dist/services/configuration/profiles.js

@@ -0,0 +1,108 @@
+export const CONFIGURATION_PROFILES = {
+    development: {
+        name: "Development",
+        description: "Local development with debug logging and relaxed security defaults.",
+        values: {
+            NODE_ENV: "development",
+            PORT: "4001",
+            HOST: "0.0.0.0",
+            DATABASE_URL: "postgresql://hilbras:hilbras@localhost:5432/hilbras",
+            REDIS_URL: "redis://localhost:6379",
+            KEYSTONE_QUEUE_PROVIDER: "in-process",
+            KEYSTONE_SECRETS_PROVIDER: "database",
+            EMAIL_PROVIDER: "console",
+            SMS_PROVIDER: "none",
+            AUDIT_CONSOLE_EXPORT: "true",
+            KEYSTONE_FEATURE_FLAGS: "workflows=true,beta_auth=false",
+        },
+    },
+    production: {
+        name: "Production",
+        description: "Production-grade settings with external queue and secrets providers.",
+        values: {
+            NODE_ENV: "production",
+            PORT: "4001",
+            HOST: "0.0.0.0",
+            KEYSTONE_QUEUE_PROVIDER: "bullmq",
+            KEYSTONE_SECRETS_PROVIDER: "database",
+            EMAIL_PROVIDER: "smtp",
+            SMS_PROVIDER: "twilio",
+            AUDIT_CONSOLE_EXPORT: "false",
+            KEYSTONE_FEATURE_FLAGS: "workflows=true",
+        },
+    },
+    docker: {
+        name: "Docker",
+        description: "Single-container deployment using linked Postgres and Redis services.",
+        values: {
+            NODE_ENV: "production",
+            PORT: "4001",
+            HOST: "0.0.0.0",
+            DATABASE_URL: "postgresql://hilbras:hilbras@postgres:5432/hilbras",
+            REDIS_URL: "redis://redis:6379",
+            KEYSTONE_QUEUE_PROVIDER: "bullmq",
+            KEYSTONE_SECRETS_PROVIDER: "database",
+            EMAIL_PROVIDER: "smtp",
+            SMS_PROVIDER: "none",
+            AUDIT_CONSOLE_EXPORT: "false",
+        },
+    },
+    "docker-compose": {
+        name: "Docker Compose",
+        description: "Multi-service deployment via Docker Compose.",
+        values: {
+            NODE_ENV: "production",
+            PORT: "4001",
+            HOST: "0.0.0.0",
+            DATABASE_URL: "postgresql://hilbras:hilbras@postgres:5432/hilbras",
+            REDIS_URL: "redis://redis:6379",
+            KEYSTONE_QUEUE_PROVIDER: "bullmq",
+            KEYSTONE_SECRETS_PROVIDER: "database",
+            EMAIL_PROVIDER: "smtp",
+            SMS_PROVIDER: "none",
+            AUDIT_CONSOLE_EXPORT: "false",
+            KEYSTONE_CONFIG_MODE: "json",
+        },
+    },
+    kubernetes: {
+        name: "Kubernetes",
+        description: "Kubernetes deployment with external secrets and HA queue.",
+        values: {
+            NODE_ENV: "production",
+            PORT: "4001",
+            HOST: "0.0.0.0",
+            KEYSTONE_QUEUE_PROVIDER: "bullmq",
+            KEYSTONE_SECRETS_PROVIDER: "environment",
+            EMAIL_PROVIDER: "smtp",
+            SMS_PROVIDER: "twilio",
+            AUDIT_CONSOLE_EXPORT: "false",
+            KEYSTONE_CONFIG_MODE: "json",
+        },
+    },
+    "high-availability": {
+        name: "High Availability",
+        description: "Scaled deployment with dedicated Redis, Postgres, and external secrets.",
+        values: {
+            NODE_ENV: "production",
+            PORT: "4001",
+            HOST: "0.0.0.0",
+            KEYSTONE_QUEUE_PROVIDER: "bullmq",
+            KEYSTONE_SECRETS_PROVIDER: "environment",
+            EMAIL_PROVIDER: "smtp",
+            SMS_PROVIDER: "twilio",
+            AUDIT_CONSOLE_EXPORT: "false",
+            KEYSTONE_FEATURE_FLAGS: "workflows=true,advanced_audit=true",
+        },
+    },
+};
+export function listConfigurationProfiles() {
+    return Object.entries(CONFIGURATION_PROFILES).map(([id, profile]) => ({
+        id,
+        name: profile.name,
+        description: profile.description,
+    }));
+}
+export function getConfigurationProfile(id) {
+    return CONFIGURATION_PROFILES[id];
+}
+//# sourceMappingURL=profiles.js.map

package/dist/services/configuration/profiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../../../src/services/configuration/profiles.ts"],"names":[],"mappings":"AAMA,MAAM,CAAC,MAAM,sBAAsB,GAAyC;IAC1E,WAAW,EAAE;QACX,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,qEAAqE;QAClF,MAAM,EAAE;YACN,QAAQ,EAAE,aAAa;YACvB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,YAAY,EAAE,qDAAqD;YACnE,SAAS,EAAE,wBAAwB;YACnC,uBAAuB,EAAE,YAAY;YACrC,yBAAyB,EAAE,UAAU;YACrC,cAAc,EAAE,SAAS;YACzB,YAAY,EAAE,MAAM;YACpB,oBAAoB,EAAE,MAAM;YAC5B,sBAAsB,EAAE,gCAAgC;SACzD;KACF;IACD,UAAU,EAAE;QACV,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,sEAAsE;QACnF,MAAM,EAAE;YACN,QAAQ,EAAE,YAAY;YACtB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,uBAAuB,EAAE,QAAQ;YACjC,yBAAyB,EAAE,UAAU;YACrC,cAAc,EAAE,MAAM;YACtB,YAAY,EAAE,QAAQ;YACtB,oBAAoB,EAAE,OAAO;YAC7B,sBAAsB,EAAE,gBAAgB;SACzC;KACF;IACD,MAAM,EAAE;QACN,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,uEAAuE;QACpF,MAAM,EAAE;YACN,QAAQ,EAAE,YAAY;YACtB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,YAAY,EAAE,oDAAoD;YAClE,SAAS,EAAE,oBAAoB;YAC/B,uBAAuB,EAAE,QAAQ;YACjC,yBAAyB,EAAE,UAAU;YACrC,cAAc,EAAE,MAAM;YACtB,YAAY,EAAE,MAAM;YACpB,oBAAoB,EAAE,OAAO;SAC9B;KACF;IACD,gBAAgB,EAAE;QAChB,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,8CAA8C;QAC3D,MAAM,EAAE;YACN,QAAQ,EAAE,YAAY;YACtB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,YAAY,EAAE,oDAAoD;YAClE,SAAS,EAAE,oBAAoB;YAC/B,uBAAuB,EAAE,QAAQ;YACjC,yBAAyB,EAAE,UAAU;YACrC,cAAc,EAAE,MAAM;YACtB,YAAY,EAAE,MAAM;YACpB,oBAAoB,EAAE,OAAO;YAC7B,oBAAoB,EAAE,MAAM;SAC7B;KACF;IACD,UAAU,EAAE;QACV,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,2DAA2D;QACxE,MAAM,EAAE;YACN,QAAQ,EAAE,YAAY;YACtB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,uBAAuB,EAAE,QAAQ;YACjC,yBAAyB,EAAE,aAAa;YACxC,cAAc,EAAE,MAAM;YACtB,YAAY,EAAE,QAAQ;YACtB,oBAAoB,EAAE,OAAO;YAC7B,oBAAoB,EAAE,MAAM;SAC7B;KACF;IACD,mBAAmB,EAAE;QACnB,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,yEAAyE;QACtF,MAAM,EAAE;YACN,QAAQ,EAAE,YAAY;YACtB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,uBAAuB,EAAE,QAAQ;YACjC,yBAAyB,EAAE,aAAa;YACxC,cAAc,EAAE,MAAM;YACtB,YAAY,EAAE,QAAQ;YACtB,oBAAoB,EAAE,OAAO;YAC7B,sBAAsB,EAAE,oCAAoC;SAC7D;KACF;CACF,CAAC;AAEF,MAAM,UAAU,yBAAyB;IACvC,OAAO,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACpE,EAAE;QACF,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,EAAU;IAChD,OAAO,sBAAsB,CAAC,EAAE,CAAC,CAAC;AACpC,CAAC"}

package/dist/services/configuration.d.ts

@@ -0,0 +1,50 @@
+export interface RuntimeConfiguration {
+    nodeEnv: string;
+    port: number;
+    host: string;
+    databaseUrl: string;
+    redisUrl: string;
+    publicUrl?: string;
+    cookieDomain?: string;
+    cookieSecure: boolean;
+    internalApiKey?: string;
+    accessTokenTtlSeconds: number;
+    refreshTokenTtlSeconds: number;
+    secretsProvider: "database" | "environment";
+    queueProvider: "in-process" | "bullmq";
+    hibpCheckEnabled: boolean;
+    magicLinkTtlSeconds: number;
+    oauthCodeTtlSeconds: number;
+    totpIssuer: string;
+    emailProvider: string;
+    smsProvider: string;
+    auditWebhookUrl?: string;
+    auditConsoleExport: boolean;
+    featureFlags: Record<string, boolean>;
+    plugins: string[];
+    allowedOrigins: string[];
+    zitadel?: {
+        domain?: string;
+        orgId?: string;
+        projectId?: string;
+        serviceClientId?: string;
+        serviceClientSecret?: string;
+        servicePat?: string;
+        clientId?: string;
+        clientSecret?: string;
+        googleIdpId?: string;
+        githubIdpId?: string;
+    };
+}
+export declare class ConfigurationService {
+    private readonly values;
+    constructor(overrides?: Partial<RuntimeConfiguration>);
+    private load;
+    private parseFeatureFlags;
+    get(): RuntimeConfiguration;
+    getValue<K extends keyof RuntimeConfiguration>(key: K): RuntimeConfiguration[K];
+    isEnabled(flag: string): boolean;
+    isProduction(): boolean;
+}
+export declare const configurationService: ConfigurationService;
+//# sourceMappingURL=configuration.d.ts.map

package/dist/services/configuration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration.d.ts","sourceRoot":"","sources":["../../src/services/configuration.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,OAAO,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,eAAe,EAAE,UAAU,GAAG,aAAa,CAAC;IAC5C,aAAa,EAAE,YAAY,GAAG,QAAQ,CAAC;IACvC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAED,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;gBAElC,SAAS,GAAE,OAAO,CAAC,oBAAoB,CAAM;IAIzD,OAAO,CAAC,IAAI;IA4CZ,OAAO,CAAC,iBAAiB;IAUzB,GAAG,IAAI,oBAAoB;IAI3B,QAAQ,CAAC,CAAC,SAAS,MAAM,oBAAoB,EAAE,GAAG,EAAE,CAAC,GAAG,oBAAoB,CAAC,CAAC,CAAC;IAI/E,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIhC,YAAY,IAAI,OAAO;CAGxB;AAED,eAAO,MAAM,oBAAoB,sBAA6B,CAAC"}

package/dist/services/configuration.js

@@ -0,0 +1,74 @@
+import { config as rawConfig } from "../config.js";
+export class ConfigurationService {
+    values;
+    constructor(overrides = {}) {
+        this.values = this.load(overrides);
+    }
+    load(overrides) {
+        const featureFlags = this.parseFeatureFlags(process.env.KEYSTONE_FEATURE_FLAGS);
+        return {
+            nodeEnv: rawConfig.NODE_ENV,
+            port: rawConfig.PORT,
+            host: rawConfig.HOST,
+            databaseUrl: rawConfig.DATABASE_URL,
+            redisUrl: rawConfig.REDIS_URL,
+            publicUrl: rawConfig.AUTH_API_PUBLIC_URL,
+            cookieDomain: rawConfig.COOKIE_DOMAIN,
+            cookieSecure: rawConfig.COOKIE_SECURE,
+            internalApiKey: rawConfig.INTERNAL_API_KEY,
+            accessTokenTtlSeconds: rawConfig.ACCESS_TOKEN_TTL_SECONDS,
+            refreshTokenTtlSeconds: rawConfig.REFRESH_TOKEN_TTL_SECONDS,
+            secretsProvider: rawConfig.KEYSTONE_SECRETS_PROVIDER,
+            queueProvider: rawConfig.KEYSTONE_QUEUE_PROVIDER,
+            hibpCheckEnabled: rawConfig.HIBP_CHECK_ENABLED,
+            magicLinkTtlSeconds: rawConfig.MAGIC_LINK_TTL_SECONDS,
+            oauthCodeTtlSeconds: rawConfig.OAUTH_CODE_TTL_SECONDS,
+            totpIssuer: rawConfig.TOTP_ISSUER,
+            emailProvider: rawConfig.EMAIL_PROVIDER,
+            smsProvider: rawConfig.SMS_PROVIDER,
+            auditWebhookUrl: rawConfig.AUDIT_WEBHOOK_URL,
+            auditConsoleExport: rawConfig.AUDIT_CONSOLE_EXPORT === "true",
+            featureFlags: { ...featureFlags, ...overrides.featureFlags },
+            plugins: (rawConfig.KEYSTONE_PLUGINS || "").split(",").map((s) => s.trim()).filter(Boolean),
+            allowedOrigins: rawConfig.ALLOWED_ORIGINS,
+            zitadel: {
+                domain: rawConfig.ZITADEL_DOMAIN,
+                orgId: rawConfig.ZITADEL_ORG_ID,
+                projectId: rawConfig.ZITADEL_PROJECT_ID,
+                serviceClientId: rawConfig.ZITADEL_SERVICE_CLIENT_ID,
+                serviceClientSecret: rawConfig.ZITADEL_SERVICE_CLIENT_SECRET,
+                servicePat: rawConfig.ZITADEL_SERVICE_PAT,
+                clientId: rawConfig.ZITADEL_CLIENT_ID,
+                clientSecret: rawConfig.ZITADEL_CLIENT_SECRET,
+                googleIdpId: rawConfig.ZITADEL_GOOGLE_IDP_ID,
+                githubIdpId: rawConfig.ZITADEL_GITHUB_IDP_ID,
+            },
+            ...overrides,
+        };
+    }
+    parseFeatureFlags(value) {
+        if (!value)
+            return {};
+        const flags = {};
+        for (const part of value.split(",")) {
+            const [key, val] = part.trim().split("=");
+            if (key)
+                flags[key] = val === "true" || val === "1";
+        }
+        return flags;
+    }
+    get() {
+        return this.values;
+    }
+    getValue(key) {
+        return this.values[key];
+    }
+    isEnabled(flag) {
+        return this.values.featureFlags[flag] === true;
+    }
+    isProduction() {
+        return this.values.nodeEnv === "production";
+    }
+}
+export const configurationService = new ConfigurationService();
+//# sourceMappingURL=configuration.js.map

package/dist/services/configuration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration.js","sourceRoot":"","sources":["../../src/services/configuration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,cAAc,CAAC;AAyCnD,MAAM,OAAO,oBAAoB;IACd,MAAM,CAAuB;IAE9C,YAAY,YAA2C,EAAE;QACvD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAEO,IAAI,CAAC,SAAwC;QACnD,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QAEhF,OAAO;YACL,OAAO,EAAE,SAAS,CAAC,QAAQ;YAC3B,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,WAAW,EAAE,SAAS,CAAC,YAAY;YACnC,QAAQ,EAAE,SAAS,CAAC,SAAS;YAC7B,SAAS,EAAE,SAAS,CAAC,mBAAmB;YACxC,YAAY,EAAE,SAAS,CAAC,aAAa;YACrC,YAAY,EAAE,SAAS,CAAC,aAAa;YACrC,cAAc,EAAE,SAAS,CAAC,gBAAgB;YAC1C,qBAAqB,EAAE,SAAS,CAAC,wBAAwB;YACzD,sBAAsB,EAAE,SAAS,CAAC,yBAAyB;YAC3D,eAAe,EAAE,SAAS,CAAC,yBAAoE;YAC/F,aAAa,EAAE,SAAS,CAAC,uBAAgE;YACzF,gBAAgB,EAAE,SAAS,CAAC,kBAAkB;YAC9C,mBAAmB,EAAE,SAAS,CAAC,sBAAsB;YACrD,mBAAmB,EAAE,SAAS,CAAC,sBAAsB;YACrD,UAAU,EAAE,SAAS,CAAC,WAAW;YACjC,aAAa,EAAE,SAAS,CAAC,cAAc;YACvC,WAAW,EAAE,SAAS,CAAC,YAAY;YACnC,eAAe,EAAE,SAAS,CAAC,iBAAiB;YAC5C,kBAAkB,EAAE,SAAS,CAAC,oBAAoB,KAAK,MAAM;YAC7D,YAAY,EAAE,EAAE,GAAG,YAAY,EAAE,GAAG,SAAS,CAAC,YAAY,EAAE;YAC5D,OAAO,EAAE,CAAC,SAAS,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;YAC3F,cAAc,EAAE,SAAS,CAAC,eAAe;YACzC,OAAO,EAAE;gBACP,MAAM,EAAE,SAAS,CAAC,cAAc;gBAChC,KAAK,EAAE,SAAS,CAAC,cAAc;gBAC/B,SAAS,EAAE,SAAS,CAAC,kBAAkB;gBACvC,eAAe,EAAE,SAAS,CAAC,yBAAyB;gBACpD,mBAAmB,EAAE,SAAS,CAAC,6BAA6B;gBAC5D,UAAU,EAAE,SAAS,CAAC,mBAAmB;gBACzC,QAAQ,EAAE,SAAS,CAAC,iBAAiB;gBACrC,YAAY,EAAE,SAAS,CAAC,qBAAqB;gBAC7C,WAAW,EAAE,SAAS,CAAC,qBAAqB;gBAC5C,WAAW,EAAE,SAAS,CAAC,qBAAqB;aAC7C;YACD,GAAG,SAAS;SACb,CAAC;IACJ,CAAC;IAEO,iBAAiB,CAAC,KAAc;QACtC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAC;QACtB,MAAM,KAAK,GAA4B,EAAE,CAAC;QAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,GAAG;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC;QACtD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,GAAG;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,QAAQ,CAAuC,GAAM;QACnD,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,SAAS,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;IACjD,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,YAAY,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,oBAAoB,EAAE,CAAC"}

package/dist/services/connectors/google.d.ts

@@ -0,0 +1,17 @@
+import { OidcConnector } from "./oidc.js";
+import type { ExternalIdentity, AuthorizeUrlOptions } from "./types.js";
+/**
+ * Google-specific OIDC connector.
+ *
+ * Extends the generic OIDC connector with Google-specific authorization
+ * parameters and a userinfo fallback. Google returns most claims in the
+ * id_token, but the userinfo endpoint is used as a fallback when claims
+ * are missing.
+ */
+export declare class GoogleConnector extends OidcConnector {
+    getAuthorizeUrl(opts: AuthorizeUrlOptions): string;
+    exchangeCode(code: string, redirectUri: string): Promise<ExternalIdentity>;
+    private fetchUserinfo;
+    private logDebug;
+}
+//# sourceMappingURL=google.d.ts.map

package/dist/services/connectors/google.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.d.ts","sourceRoot":"","sources":["../../../src/services/connectors/google.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAoB,MAAM,WAAW,CAAC;AAC5D,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAExE;;;;;;;GAOG;AACH,qBAAa,eAAgB,SAAQ,aAAa;IAChD,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM;IAW5C,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;YAuBlE,aAAa;IAuC3B,OAAO,CAAC,QAAQ;CAMjB"}

package/dist/services/connectors/google.js

@@ -0,0 +1,81 @@
+import { OidcConnector, normalizePayload } from "./oidc.js";
+/**
+ * Google-specific OIDC connector.
+ *
+ * Extends the generic OIDC connector with Google-specific authorization
+ * parameters and a userinfo fallback. Google returns most claims in the
+ * id_token, but the userinfo endpoint is used as a fallback when claims
+ * are missing.
+ */
+export class GoogleConnector extends OidcConnector {
+    getAuthorizeUrl(opts) {
+        // Ask the user to pick an account every time. This avoids silent
+        // logins with the wrong Google account when multiple accounts exist.
+        opts.extraParams = {
+            ...opts.extraParams,
+            prompt: "select_account",
+            access_type: "online",
+        };
+        return super.getAuthorizeUrl(opts);
+    }
+    async exchangeCode(code, redirectUri) {
+        const identity = await super.exchangeCode(code, redirectUri);
+        // Google usually returns picture, email_verified, etc. in the id_token.
+        // If something is missing, enrich from the userinfo endpoint.
+        if (!identity.name || !identity.picture || identity.emailVerified === undefined) {
+            try {
+                const enriched = await this.fetchUserinfo(code, redirectUri);
+                return {
+                    ...identity,
+                    name: identity.name || enriched.name,
+                    picture: identity.picture || enriched.picture,
+                    emailVerified: identity.emailVerified ?? enriched.emailVerified,
+                };
+            }
+            catch (err) {
+                // Userinfo enrichment is best-effort; the id_token identity is still valid.
+                this.logDebug("Google userinfo enrichment failed", err);
+            }
+        }
+        return identity;
+    }
+    async fetchUserinfo(code, redirectUri) {
+        // Re-exchange the code for an access token. In practice the parent
+        // exchange already did this, but we do not retain the access token.
+        // A future refactor could pass it through to avoid a second request.
+        const params = new URLSearchParams({
+            grant_type: "authorization_code",
+            client_id: this.config.clientId,
+            client_secret: this.config.clientSecret,
+            code,
+            redirect_uri: redirectUri,
+        });
+        const tokenRes = await fetch(this.config.tokenEndpoint, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: params.toString(),
+        });
+        if (!tokenRes.ok) {
+            throw new Error(`Google token refresh for userinfo failed: ${tokenRes.status}`);
+        }
+        const tokenData = (await tokenRes.json());
+        if (!tokenData.access_token) {
+            throw new Error("Google did not return an access_token for userinfo");
+        }
+        const userinfoRes = await fetch(this.config.userinfoEndpoint, {
+            headers: { Authorization: `Bearer ${tokenData.access_token}` },
+        });
+        if (!userinfoRes.ok) {
+            throw new Error(`Google userinfo request failed: ${userinfoRes.status}`);
+        }
+        const payload = (await userinfoRes.json());
+        return normalizePayload(payload, this.config.attributeMapping);
+    }
+    logDebug(message, err) {
+        if (process.env.NODE_ENV !== "test") {
+            // eslint-disable-next-line no-console
+            console.debug(`[GoogleConnector] ${message}:`, err);
+        }
+    }
+}
+//# sourceMappingURL=google.js.map

package/dist/services/connectors/google.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.js","sourceRoot":"","sources":["../../../src/services/connectors/google.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAG5D;;;;;;;GAOG;AACH,MAAM,OAAO,eAAgB,SAAQ,aAAa;IAChD,eAAe,CAAC,IAAyB;QACvC,iEAAiE;QACjE,qEAAqE;QACrE,IAAI,CAAC,WAAW,GAAG;YACjB,GAAG,IAAI,CAAC,WAAW;YACnB,MAAM,EAAE,gBAAgB;YACxB,WAAW,EAAE,QAAQ;SACtB,CAAC;QACF,OAAO,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,WAAmB;QAClD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAE7D,wEAAwE;QACxE,8DAA8D;QAC9D,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YAChF,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;gBAC7D,OAAO;oBACL,GAAG,QAAQ;oBACX,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI;oBACpC,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO;oBAC7C,aAAa,EAAE,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa;iBAChE,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,4EAA4E;gBAC5E,IAAI,CAAC,QAAQ,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,IAAY,EAAE,WAAmB;QAC3D,mEAAmE;QACnE,oEAAoE;QACpE,qEAAqE;QACrE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACvC,IAAI;YACJ,YAAY,EAAE,WAAW;SAC1B,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAc,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,6CAA6C,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,SAAS,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA8B,CAAC;QACvE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAiB,EAAE;YAC7D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,SAAS,CAAC,YAAY,EAAE,EAAE;SAC/D,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,mCAAmC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,CAA4B,CAAC;QACtE,OAAO,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjE,CAAC;IAEO,QAAQ,CAAC,OAAe,EAAE,GAAY;QAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YACpC,sCAAsC;YACtC,OAAO,CAAC,KAAK,CAAC,qBAAqB,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;CACF"}

package/dist/services/connectors/oidc.d.ts

@@ -0,0 +1,14 @@
+import type { IdentityConnector, ExternalIdentity, AuthorizeUrlOptions, ConnectorConfig } from "./types.js";
+export declare class OidcConnector implements IdentityConnector {
+    id: string;
+    name: string;
+    type: string;
+    protected config: ConnectorConfig;
+    constructor(id: string, name: string, type: string, config: ConnectorConfig);
+    getAuthorizeUrl(opts: AuthorizeUrlOptions): string;
+    exchangeCode(code: string, redirectUri: string): Promise<ExternalIdentity>;
+    verifyToken(token: string): Promise<ExternalIdentity>;
+    private discovery;
+}
+export declare function normalizePayload(payload: Record<string, unknown>, mapping?: Record<string, string>): ExternalIdentity;
+//# sourceMappingURL=oidc.d.ts.map

package/dist/services/connectors/oidc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../../../src/services/connectors/oidc.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAG5G,qBAAa,aAAc,YAAW,iBAAiB;IACrD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,MAAM,EAAE,eAAe,CAAC;gBAEtB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe;IAO3E,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM;IAoB5C,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA2B1E,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;YAa7C,SAAS;CAYxB;AAED,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,gBAAgB,CAgBlB"}

package/dist/services/connectors/oidc.js

@@ -0,0 +1,100 @@
+import { createRemoteJWKSet, jwtVerify } from "jose";
+import { cache } from "../cache.js";
+export class OidcConnector {
+    id;
+    name;
+    type;
+    config;
+    constructor(id, name, type, config) {
+        this.id = id;
+        this.name = name;
+        this.type = type;
+        this.config = config;
+    }
+    getAuthorizeUrl(opts) {
+        const scopes = opts.scopes ?? this.config.scopes ?? ["openid", "profile", "email"];
+        const params = new URLSearchParams({
+            client_id: this.config.clientId,
+            redirect_uri: opts.redirectUri,
+            response_type: "code",
+            scope: scopes.join(" "),
+            state: opts.state,
+        });
+        if (this.config.idpHint) {
+            params.set("idp_hint", this.config.idpHint);
+        }
+        if (opts.extraParams) {
+            for (const [k, v] of Object.entries(opts.extraParams)) {
+                params.set(k, v);
+            }
+        }
+        return `${this.config.authorizationEndpoint}?${params.toString()}`;
+    }
+    async exchangeCode(code, redirectUri) {
+        const params = new URLSearchParams({
+            grant_type: "authorization_code",
+            client_id: this.config.clientId,
+            client_secret: this.config.clientSecret,
+            code,
+            redirect_uri: redirectUri,
+        });
+        const res = await fetch(this.config.tokenEndpoint, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: params.toString(),
+        });
+        if (!res.ok) {
+            const text = await res.text();
+            throw new Error(`OIDC token exchange failed: ${res.status} ${text}`);
+        }
+        const data = (await res.json());
+        if (!data.id_token) {
+            throw new Error("OIDC provider did not return an id_token");
+        }
+        return this.verifyToken(data.id_token);
+    }
+    async verifyToken(token) {
+        const jwksUrl = this.config.jwksUri || (await this.discovery())?.jwks_uri;
+        if (!jwksUrl) {
+            throw new Error("OIDC connector missing jwks_uri");
+        }
+        const JWKS = createRemoteJWKSet(new URL(jwksUrl));
+        const { payload } = await jwtVerify(token, JWKS, {
+            issuer: this.config.issuer,
+            audience: this.config.clientId,
+        });
+        return normalizePayload(payload, this.config.attributeMapping);
+    }
+    async discovery() {
+        if (!this.config.issuer)
+            throw new Error("OIDC connector missing issuer for discovery");
+        const key = `oidc:discovery:${this.config.issuer}`;
+        const cached = await cache.get(key);
+        if (cached)
+            return cached;
+        const res = await fetch(`${this.config.issuer.replace(/\/$/, "")}/.well-known/openid-configuration`);
+        if (!res.ok)
+            throw new Error(`OIDC discovery failed: ${res.status}`);
+        const data = (await res.json());
+        await cache.set(key, data, 3600);
+        return data;
+    }
+}
+export function normalizePayload(payload, mapping) {
+    const m = mapping ?? {};
+    const get = (key) => payload[m[key] || key];
+    const email = String(get("email") || "");
+    if (!email) {
+        throw new Error("Identity provider did not return an email address");
+    }
+    return {
+        sub: String(get("sub") || ""),
+        email,
+        emailVerified: get("email_verified") === true,
+        name: get("name") ? String(get("name")) : undefined,
+        picture: get("picture") ? String(get("picture")) : undefined,
+        username: get("preferred_username") ? String(get("preferred_username")) : undefined,
+        raw: payload,
+    };
+}
+//# sourceMappingURL=oidc.js.map

package/dist/services/connectors/oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../../../src/services/connectors/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAErD,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEpC,MAAM,OAAO,aAAa;IACxB,EAAE,CAAS;IACX,IAAI,CAAS;IACb,IAAI,CAAS;IACH,MAAM,CAAkB;IAElC,YAAY,EAAU,EAAE,IAAY,EAAE,IAAY,EAAE,MAAuB;QACzE,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,eAAe,CAAC,IAAyB;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACnF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,WAAW;YAC9B,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtD,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QACD,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,WAAmB;QAClD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACvC,IAAI;YACJ,YAAY,EAAE,WAAW;SAC1B,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAc,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAgD,CAAC;QAC/E,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAK,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,QAAmB,CAAC;QACtF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAClD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;YAC/C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YAC1B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;SAC/B,CAAC,CAAC;QACH,OAAO,gBAAgB,CAAC,OAAkC,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC5F,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACxF,MAAM,GAAG,GAAG,kBAAkB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAA0B,GAAG,CAAC,CAAC;QAC7D,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CAAC,CAAC;QACrG,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC3D,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,MAAM,UAAU,gBAAgB,CAC9B,OAAgC,EAChC,OAAgC;IAEhC,MAAM,CAAC,GAAG,OAAO,IAAI,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,KAAK;QACL,aAAa,EAAE,GAAG,CAAC,gBAAgB,CAAC,KAAK,IAAI;QAC7C,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QACnD,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QAC5D,QAAQ,EAAE,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QACnF,GAAG,EAAE,OAAO;KACb,CAAC;AACJ,CAAC"}

package/dist/services/connectors/registry.d.ts

@@ -0,0 +1,13 @@
+import type { IdentityConnector, ConnectorConfig } from "./types.js";
+export declare function buildConnector(type: string, overrides?: Partial<ConnectorConfig>): IdentityConnector;
+export declare function listSupportedProviders(): string[];
+/**
+ * Returns supported providers annotated with whether they are currently
+ * configured with client credentials in the environment.
+ */
+export declare function listConfiguredProviders(): Array<{
+    type: string;
+    name: string;
+    configured: boolean;
+}>;
+//# sourceMappingURL=registry.d.ts.map