@hilbras/keystone 1.1.0

package/dist/services/workflows/steps.js

@@ -0,0 +1,109 @@
+import { createOrganization, addOrgMembership, findOrganizationBySlug } from "../organizations.js";
+import { findApplicationByClientId } from "../applications.js";
+import { updateUser } from "../users.js";
+import { queue } from "../queue/index.js";
+import { getPluginWorkflowStep } from "../plugins/registry.js";
+function interpolate(template, context) {
+    return template.replace(/\{\{(\w+)\}\}/g, (_, key) => {
+        const value = context.payload[key] ?? context.outputs[key] ?? "";
+        return String(value);
+    });
+}
+export async function executeStep(step, context) {
+    const log = (msg) => console.log(`[workflow] step ${step.type}: ${msg}`);
+    switch (step.type) {
+        case "assign_role": {
+            const role = String(step.role || "user");
+            if (context.user) {
+                await updateUser(context.user.id, { role });
+                log(`assigned role ${role} to ${context.user.id}`);
+            }
+            return {};
+        }
+        case "create_organization": {
+            const nameTemplate = String(step.orgName || "{{username}}-personal");
+            const name = interpolate(nameTemplate, context);
+            const slugTemplate = String(step.slug || "{{username}}-personal");
+            const slug = interpolate(slugTemplate, context);
+            const existing = await findOrganizationBySlug(slug);
+            if (existing) {
+                return { output: { [String(step.outputKey || "orgId")]: existing.id } };
+            }
+            const org = await createOrganization({ name, slug });
+            log(`created organization ${org.id}`);
+            return { output: { [String(step.outputKey || "orgId")]: org.id } };
+        }
+        case "add_membership": {
+            const userId = context.user?.id;
+            if (!userId)
+                return { error: "missing user" };
+            const orgRef = String(step.orgRef || "personalOrgId");
+            const orgId = context.outputs[orgRef];
+            if (!orgId)
+                return { error: `missing output ${orgRef}` };
+            const role = String(step.role || "member");
+            await addOrgMembership({ orgId, userId, role: role });
+            log(`added membership ${userId} -> ${orgId} as ${role}`);
+            return {};
+        }
+        case "add_app_membership": {
+            const userId = context.user?.id;
+            if (!userId)
+                return { error: "missing user" };
+            const clientId = String(step.clientId || context.payload.client_id || "");
+            if (!clientId)
+                return { error: "missing client_id" };
+            const app = await findApplicationByClientId(clientId);
+            if (!app)
+                return { error: "application not found" };
+            await addOrgMembership({ orgId: app.orgId, userId, role: "member" });
+            log(`added app membership ${userId} -> ${app.orgId}`);
+            return {};
+        }
+        case "send_email": {
+            const to = String(step.to || context.user?.email || "");
+            if (!to)
+                return { error: "missing email" };
+            const message = {
+                to,
+                subject: String(step.subject || "Hilbras notification"),
+                text: String(step.text || ""),
+            };
+            await queue.enqueue({ type: "email", payload: { message } });
+            log(`enqueued email to ${to}`);
+            return {};
+        }
+        case "send_welcome_email": {
+            const to = context.user?.email;
+            if (!to || !context.user)
+                return { error: "missing user email" };
+            const message = {
+                to,
+                subject: "Welcome to Hilbras",
+                text: `Hi ${context.user.name || context.user.username},\n\nWelcome to Hilbras! Your account has been created.`,
+            };
+            await queue.enqueue({ type: "email", payload: { message } });
+            log(`enqueued welcome email to ${to}`);
+            return {};
+        }
+        case "webhook": {
+            const url = String(step.url || "");
+            if (!url)
+                return { error: "missing webhook url" };
+            await queue.enqueue({
+                type: "webhook",
+                payload: { url, method: String(step.method || "POST"), body: context.payload },
+            });
+            log(`enqueued webhook ${url}`);
+            return {};
+        }
+        default: {
+            const pluginExecutor = getPluginWorkflowStep(step.type);
+            if (pluginExecutor) {
+                return pluginExecutor(step, context);
+            }
+            return { error: `unknown step type ${step.type}` };
+        }
+    }
+}
+//# sourceMappingURL=steps.js.map

package/dist/services/workflows/steps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"steps.js","sourceRoot":"","sources":["../../../src/services/workflows/steps.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACnG,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAqB/D,SAAS,WAAW,CAAC,QAAgB,EAAE,OAAoB;IACzD,OAAO,QAAQ,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;QACnD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACjE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAkB,EAAE,OAAoB;IACxE,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC;IAEjF,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC;YACzC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,MAAM,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC5C,GAAG,CAAC,iBAAiB,IAAI,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACrD,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,KAAK,qBAAqB,CAAC,CAAC,CAAC;YAC3B,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,uBAAuB,CAAC,CAAC;YACrE,MAAM,IAAI,GAAG,WAAW,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YAChD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,uBAAuB,CAAC,CAAC;YAClE,MAAM,IAAI,GAAG,WAAW,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC;YACpD,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;YAC1E,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,wBAAwB,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACtC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC;QACrE,CAAC;QAED,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;YAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC;YACtD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACtC,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB,MAAM,EAAE,EAAE,CAAC;YACzD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,CAAC;YAC3C,MAAM,gBAAgB,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAA6C,EAAE,CAAC,CAAC;YAC/F,GAAG,CAAC,oBAAoB,MAAM,OAAO,KAAK,OAAO,IAAI,EAAE,CAAC,CAAC;YACzD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,KAAK,oBAAoB,CAAC,CAAC,CAAC;YAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;YAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YAC1E,IAAI,CAAC,QAAQ;gBAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;YACrD,MAAM,GAAG,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;YACtD,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;YACpD,MAAM,gBAAgB,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YACrE,GAAG,CAAC,wBAAwB,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;YACtD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YACxD,IAAI,CAAC,EAAE;gBAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;YAC3C,MAAM,OAAO,GAAiB;gBAC5B,EAAE;gBACF,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,sBAAsB,CAAC;gBACvD,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;aAC9B,CAAC;YACF,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;YAC7D,GAAG,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;YAC/B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,KAAK,oBAAoB,CAAC,CAAC,CAAC;YAC1B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;YAC/B,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;gBAAE,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACjE,MAAM,OAAO,GAAiB;gBAC5B,EAAE;gBACF,OAAO,EAAE,oBAAoB;gBAC7B,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,yDAAyD;aAChH,CAAC;YACF,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;YAC7D,GAAG,CAAC,6BAA6B,EAAE,EAAE,CAAC,CAAC;YACvC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;YACnC,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;YAClD,MAAM,KAAK,CAAC,OAAO,CAAC;gBAClB,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE;aAC/E,CAAC,CAAC;YACH,GAAG,CAAC,oBAAoB,GAAG,EAAE,CAAC,CAAC;YAC/B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,cAAc,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,cAAc,EAAE,CAAC;gBACnB,OAAO,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACvC,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,qBAAqB,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACrD,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/services/zitadel.d.ts

@@ -0,0 +1,21 @@
+export declare function getServiceToken(): Promise<string | undefined>;
+export interface CreateHumanUserInput {
+    userId?: string;
+    username: string;
+    email: string;
+    name: string;
+    password: string;
+}
+export declare function createHumanUser(input: CreateHumanUserInput): Promise<string>;
+export declare function verifyPassword(email: string, password: string): Promise<boolean>;
+export declare function requestPasswordReset(zitadelUserId: string, redirectUrl: string): Promise<void>;
+export declare function setPassword(zitadelUserId: string, verificationCode: string, newPassword: string): Promise<void>;
+export declare function buildAuthorizeUrl(provider: "google" | "github", state: string): string;
+export declare function exchangeOAuthCode(provider: "google" | "github", code: string): Promise<{
+    idToken: string;
+    accessToken: string;
+    refreshToken?: string;
+}>;
+export declare function getZitadelJwksUrl(): Promise<string>;
+export declare function getDiscovery(): Promise<Record<string, unknown>>;
+//# sourceMappingURL=zitadel.d.ts.map

package/dist/services/zitadel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zitadel.d.ts","sourceRoot":"","sources":["../../src/services/zitadel.ts"],"names":[],"mappings":"AAWA,wBAAsB,eAAe,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAoCnE;AAkBD,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAsB,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CA0ClF;AAED,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAsBtF;AAED,wBAAsB,oBAAoB,CAAC,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBpG;AAED,wBAAsB,WAAW,CAC/B,aAAa,EAAE,MAAM,EACrB,gBAAgB,EAAE,MAAM,EACxB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAwBf;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAgBtF;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,EAC7B,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA+B1E;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,CAMzD;AAED,wBAAsB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAQrE"}

package/dist/services/zitadel.js

@@ -0,0 +1,228 @@
+import { config, zitadelBaseUrl } from "../config.js";
+let cachedServiceToken = null;
+let cachedJwksUrl = null;
+let cachedDiscovery = null;
+export async function getServiceToken() {
+    if (config.ZITADEL_SERVICE_PAT) {
+        return config.ZITADEL_SERVICE_PAT;
+    }
+    if (!config.ZITADEL_SERVICE_CLIENT_ID || !config.ZITADEL_SERVICE_CLIENT_SECRET) {
+        return undefined;
+    }
+    const now = Date.now();
+    if (cachedServiceToken && cachedServiceToken.expiresAt > now + 60_000) {
+        return cachedServiceToken.token;
+    }
+    const params = new URLSearchParams();
+    params.set("grant_type", "client_credentials");
+    params.set("client_id", config.ZITADEL_SERVICE_CLIENT_ID);
+    params.set("client_secret", config.ZITADEL_SERVICE_CLIENT_SECRET);
+    params.set("scope", serviceAccountScope());
+    const res = await fetch(`${zitadelBaseUrl()}/oauth/v2/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: params.toString(),
+    });
+    if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`Zitadel service token failed: ${res.status} ${text}`);
+    }
+    const data = (await res.json());
+    cachedServiceToken = {
+        token: data.access_token,
+        expiresAt: now + (data.expires_in ?? 3600) * 1000,
+    };
+    return cachedServiceToken.token;
+}
+function serviceAccountScope() {
+    const scopes = ["urn:zitadel:iam:org:project:id:zitadel:aud"];
+    if (config.ZITADEL_ORG_ID) {
+        scopes.push(`urn:zitadel:iam:org:id:${config.ZITADEL_ORG_ID}:aud`);
+    }
+    return scopes.join(" ");
+}
+function orgHeader() {
+    const headers = {};
+    if (config.ZITADEL_ORG_ID) {
+        headers["x-zitadel-orgid"] = config.ZITADEL_ORG_ID;
+    }
+    return headers;
+}
+export async function createHumanUser(input) {
+    const token = await getServiceToken();
+    const headers = {
+        "Content-Type": "application/json",
+        ...orgHeader(),
+    };
+    if (token)
+        headers["Authorization"] = `Bearer ${token}`;
+    const names = splitName(input.name || input.username);
+    const body = {
+        username: input.username,
+        profile: {
+            givenName: names.givenName,
+            familyName: names.familyName,
+        },
+        email: {
+            email: input.email,
+            isVerified: true,
+        },
+        password: {
+            password: input.password,
+            changeRequired: false,
+        },
+    };
+    if (input.userId)
+        body.userId = input.userId;
+    if (config.ZITADEL_ORG_ID) {
+        body.organization = { orgId: config.ZITADEL_ORG_ID };
+    }
+    const res = await fetch(`${zitadelBaseUrl()}/v2/users/human`, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(body),
+    });
+    if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`Zitadel create user failed: ${res.status} ${text}`);
+    }
+    const data = (await res.json());
+    return data.userId ?? data.user?.userId ?? "";
+}
+export async function verifyPassword(email, password) {
+    const token = await getServiceToken();
+    const headers = {
+        "Content-Type": "application/json",
+        ...orgHeader(),
+    };
+    if (token)
+        headers["Authorization"] = `Bearer ${token}`;
+    const res = await fetch(`${zitadelBaseUrl()}/v2/sessions`, {
+        method: "POST",
+        headers,
+        body: JSON.stringify({
+            checks: {
+                user: { loginName: email },
+                password: { password },
+            },
+            lifetime: "3600s",
+        }),
+    });
+    // Consume/close the session? Zitadel does not require explicit cleanup for short-lived sessions.
+    return res.ok;
+}
+export async function requestPasswordReset(zitadelUserId, redirectUrl) {
+    const token = await getServiceToken();
+    if (!token)
+        throw new Error("Zitadel service token not available for password reset");
+    const res = await fetch(`${zitadelBaseUrl()}/v2/users/${zitadelUserId}/password_reset`, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            Authorization: `Bearer ${token}`,
+            ...orgHeader(),
+        },
+        body: JSON.stringify({
+            sendLink: {
+                notificationType: "NOTIFICATION_TYPE_Email",
+                urlTemplate: redirectUrl,
+            },
+        }),
+    });
+    if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`Zitadel password reset failed: ${res.status} ${text}`);
+    }
+}
+export async function setPassword(zitadelUserId, verificationCode, newPassword) {
+    const token = await getServiceToken();
+    if (!token)
+        throw new Error("Zitadel service token not available for password reset");
+    const res = await fetch(`${zitadelBaseUrl()}/v2/users/${zitadelUserId}/password`, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            Authorization: `Bearer ${token}`,
+            ...orgHeader(),
+        },
+        body: JSON.stringify({
+            newPassword: {
+                password: newPassword,
+                changeRequired: false,
+            },
+            verificationCode,
+        }),
+    });
+    if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`Zitadel set password failed: ${res.status} ${text}`);
+    }
+}
+export function buildAuthorizeUrl(provider, state) {
+    const redirectUri = `${configPublicUrl()}/auth/callback/${provider}`;
+    const params = new URLSearchParams({
+        client_id: config.ZITADEL_CLIENT_ID,
+        redirect_uri: redirectUri,
+        response_type: "code",
+        scope: "openid profile email",
+        state,
+    });
+    const idpId = provider === "google" ? config.ZITADEL_GOOGLE_IDP_ID : config.ZITADEL_GITHUB_IDP_ID;
+    if (idpId) {
+        params.set("idp_hint", idpId);
+    }
+    return `${zitadelBaseUrl()}/oauth/v2/authorize?${params.toString()}`;
+}
+export async function exchangeOAuthCode(provider, code) {
+    const redirectUri = `${configPublicUrl()}/auth/callback/${provider}`;
+    const params = new URLSearchParams({
+        grant_type: "authorization_code",
+        client_id: config.ZITADEL_CLIENT_ID,
+        client_secret: config.ZITADEL_CLIENT_SECRET,
+        code,
+        redirect_uri: redirectUri,
+    });
+    const res = await fetch(`${zitadelBaseUrl()}/oauth/v2/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: params.toString(),
+    });
+    if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`Zitadel token exchange failed: ${res.status} ${text}`);
+    }
+    const data = (await res.json());
+    return {
+        idToken: data.id_token,
+        accessToken: data.access_token,
+        refreshToken: data.refresh_token,
+    };
+}
+export async function getZitadelJwksUrl() {
+    if (cachedJwksUrl)
+        return cachedJwksUrl;
+    const discovery = await getDiscovery();
+    const url = discovery.jwks_uri || `${zitadelBaseUrl()}/oauth/v2/keys`;
+    cachedJwksUrl = url;
+    return url;
+}
+export async function getDiscovery() {
+    if (cachedDiscovery)
+        return cachedDiscovery;
+    const res = await fetch(`${zitadelBaseUrl()}/.well-known/openid-configuration`);
+    if (!res.ok) {
+        throw new Error(`Zitadel discovery failed: ${res.status}`);
+    }
+    cachedDiscovery = (await res.json());
+    return cachedDiscovery;
+}
+function configPublicUrl() {
+    return process.env.AUTH_API_PUBLIC_URL || `http://localhost:${config.PORT}`;
+}
+function splitName(name) {
+    const parts = name.trim().split(/\s+/);
+    if (parts.length === 1)
+        return { givenName: parts[0], familyName: "" };
+    return { givenName: parts[0], familyName: parts.slice(1).join(" ") };
+}
+//# sourceMappingURL=zitadel.js.map

package/dist/services/zitadel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zitadel.js","sourceRoot":"","sources":["../../src/services/zitadel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAOtD,IAAI,kBAAkB,GAAwB,IAAI,CAAC;AACnD,IAAI,aAAa,GAAkB,IAAI,CAAC;AACxC,IAAI,eAAe,GAAmC,IAAI,CAAC;AAE3D,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,mBAAmB,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,yBAAyB,IAAI,CAAC,MAAM,CAAC,6BAA6B,EAAE,CAAC;QAC/E,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,kBAAkB,IAAI,kBAAkB,CAAC,SAAS,GAAG,GAAG,GAAG,MAAM,EAAE,CAAC;QACtE,OAAO,kBAAkB,CAAC,KAAK,CAAC;IAClC,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;IAC/C,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,yBAAyB,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,6BAA6B,CAAC,CAAC;IAClE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAE3C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,cAAc,EAAE,iBAAiB,EAAE;QAC5D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;KACxB,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkD,CAAC;IACjF,kBAAkB,GAAG;QACnB,KAAK,EAAE,IAAI,CAAC,YAAY;QACxB,SAAS,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI;KAClD,CAAC;IACF,OAAO,kBAAkB,CAAC,KAAK,CAAC;AAClC,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,MAAM,GAAG,CAAC,4CAA4C,CAAC,CAAC;IAC9D,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,cAAc,MAAM,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,OAAO,CAAC,iBAAiB,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC;IACrD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAA2B;IAC/D,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;IACtC,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,GAAG,SAAS,EAAE;KACf,CAAC;IACF,IAAI,KAAK;QAAE,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,EAAE,CAAC;IAExD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,IAAI,GAA4B;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE;YACP,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B;QACD,KAAK,EAAE;YACL,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,IAAI;SACjB;QACD,QAAQ,EAAE;YACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,cAAc,EAAE,KAAK;SACtB;KACF,CAAC;IACF,IAAI,KAAK,CAAC,MAAM;QAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC7C,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,IAAI,CAAC,YAAY,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC;IACvD,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,cAAc,EAAE,iBAAiB,EAAE;QAC5D,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAoD,CAAC;IACnF,OAAO,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa,EAAE,QAAgB;IAClE,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;IACtC,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,GAAG,SAAS,EAAE;KACf,CAAC;IACF,IAAI,KAAK;QAAE,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,EAAE,CAAC;IAExD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,cAAc,EAAE,cAAc,EAAE;QACzD,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,MAAM,EAAE;gBACN,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;gBAC1B,QAAQ,EAAE,EAAE,QAAQ,EAAE;aACvB;YACD,QAAQ,EAAE,OAAO;SAClB,CAAC;KACH,CAAC,CAAC;IAEH,iGAAiG;IACjG,OAAO,GAAG,CAAC,EAAE,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,aAAqB,EAAE,WAAmB;IACnF,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;IACtC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAEtF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,cAAc,EAAE,aAAa,aAAa,iBAAiB,EAAE;QACtF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,GAAG,SAAS,EAAE;SACf;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,QAAQ,EAAE;gBACR,gBAAgB,EAAE,yBAAyB;gBAC3C,WAAW,EAAE,WAAW;aACzB;SACF,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,aAAqB,EACrB,gBAAwB,EACxB,WAAmB;IAEnB,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;IACtC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAEtF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,cAAc,EAAE,aAAa,aAAa,WAAW,EAAE;QAChF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,GAAG,SAAS,EAAE;SACf;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,WAAW,EAAE;gBACX,QAAQ,EAAE,WAAW;gBACrB,cAAc,EAAE,KAAK;aACtB;YACD,gBAAgB;SACjB,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAA6B,EAAE,KAAa;IAC5E,MAAM,WAAW,GAAG,GAAG,eAAe,EAAE,kBAAkB,QAAQ,EAAE,CAAC;IACrE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,SAAS,EAAE,MAAM,CAAC,iBAAiB;QACnC,YAAY,EAAE,WAAW;QACzB,aAAa,EAAE,MAAM;QACrB,KAAK,EAAE,sBAAsB;QAC7B,KAAK;KACN,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC;IAClG,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,GAAG,cAAc,EAAE,uBAAuB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAA6B,EAC7B,IAAY;IAEZ,MAAM,WAAW,GAAG,GAAG,eAAe,EAAE,kBAAkB,QAAQ,EAAE,CAAC;IACrE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,MAAM,CAAC,iBAAiB;QACnC,aAAa,EAAE,MAAM,CAAC,qBAAqB;QAC3C,IAAI;QACJ,YAAY,EAAE,WAAW;KAC1B,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,cAAc,EAAE,iBAAiB,EAAE;QAC5D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;KACxB,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI7B,CAAC;IACF,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,QAAQ;QACtB,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;KACjC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IACxC,MAAM,SAAS,GAAG,MAAM,YAAY,EAAE,CAAC;IACvC,MAAM,GAAG,GAAI,SAAS,CAAC,QAAmB,IAAI,GAAG,cAAc,EAAE,gBAAgB,CAAC;IAClF,aAAa,GAAG,GAAG,CAAC;IACpB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAC5C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,cAAc,EAAE,mCAAmC,CAAC,CAAC;IAChF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,eAAe,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;IAChE,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,oBAAoB,MAAM,CAAC,IAAI,EAAE,CAAC;AAC9E,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IACvE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACvE,CAAC"}

package/dist/setup-server.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=setup-server.d.ts.map

package/dist/setup-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-server.d.ts","sourceRoot":"","sources":["../src/setup-server.ts"],"names":[],"mappings":""}

package/dist/setup-server.js

@@ -0,0 +1,63 @@
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import fs from "node:fs/promises";
+import fastify from "fastify";
+import cors from "@fastify/cors";
+import { config } from "./config.js";
+import { generateSetupToken, printSetupToken } from "./services/setup/token.js";
+import setupRoutes from "./routes/setup.js";
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+async function buildSetupApp() {
+    const app = fastify({
+        logger: { level: config.NODE_ENV === "production" ? "info" : "debug" },
+        trustProxy: true,
+        genReqId: () => crypto.randomUUID(),
+    });
+    await app.register(cors, {
+        origin: true,
+        credentials: true,
+    });
+    await app.register(setupRoutes, { prefix: "/setup" });
+    // Serve the built setup frontend if available.
+    const frontendDist = path.resolve(__dirname, "../frontend/dist");
+    try {
+        const stat = await fs.stat(frontendDist);
+        if (stat.isDirectory()) {
+            app.register(import("@fastify/static"), {
+                root: frontendDist,
+                wildcard: true,
+            });
+        }
+    }
+    catch {
+        // Built frontend not present; the Vite dev server should be used instead.
+    }
+    app.get("/health", async () => ({ status: "setup" }));
+    app.setErrorHandler((error, request, reply) => {
+        if (error && typeof error === "object" && "validation" in error) {
+            const message = error instanceof Error ? error.message : String(error);
+            return reply.status(400).send({ error: "Invalid input", details: message });
+        }
+        request.log.error({ err: error }, "Unhandled error");
+        const message = config.NODE_ENV === "production" ? "Internal server error" : String(error);
+        return reply.status(500).send({ error: message });
+    });
+    return app;
+}
+async function start() {
+    generateSetupToken();
+    printSetupToken();
+    const app = await buildSetupApp();
+    try {
+        await app.listen({ port: config.PORT, host: config.HOST });
+        app.log.info(`Hilbras Keystone setup server running on http://${config.HOST}:${config.PORT}`);
+    }
+    catch (err) {
+        app.log.error(err);
+        process.exit(1);
+    }
+}
+if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
+    start();
+}
+//# sourceMappingURL=setup-server.js.map

package/dist/setup-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-server.js","sourceRoot":"","sources":["../src/setup-server.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,IAAI,MAAM,eAAe,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAChF,OAAO,WAAW,MAAM,mBAAmB,CAAC;AAE5C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE/D,KAAK,UAAU,aAAa;IAC1B,MAAM,GAAG,GAAG,OAAO,CAAC;QAClB,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE;QACtE,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE;KACpC,CAAC,CAAC;IAEH,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE;QACvB,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IAEH,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAEtD,+CAA+C;IAC/C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE;gBACtC,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAEtD,GAAG,CAAC,eAAe,CAAC,CAAC,KAAc,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACrD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,YAAY,IAAI,KAAK,EAAE,CAAC;YAChE,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,iBAAiB,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3F,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,KAAK;IAClB,kBAAkB,EAAE,CAAC;IACrB,eAAe,EAAE,CAAC;IAElB,MAAM,GAAG,GAAG,MAAM,aAAa,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,mDAAmD,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAChG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,KAAK,EAAE,CAAC;AACV,CAAC"}

package/dist/tests/errors.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=errors.test.d.ts.map

package/dist/tests/errors.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.test.d.ts","sourceRoot":"","sources":["../../src/tests/errors.test.ts"],"names":[],"mappings":""}

package/dist/tests/errors.test.js

@@ -0,0 +1,64 @@
+import { describe, it } from "node:test";
+import assert from "node:assert";
+process.env.DATABASE_URL = process.env.DATABASE_URL || "postgresql://hilbras:hilbras@localhost:5432/hilbras";
+const { classifyOAuthError, buildOAuthErrorRedirect, buildOAuthErrorResponse } = await import("../lib/errors.js");
+describe("OAuth error sanitization", () => {
+    it("classifies state mismatches as access_denied", () => {
+        const result = classifyOAuthError(new Error("Invalid OAuth state"));
+        assert.strictEqual(result.code, "access_denied");
+        assert.strictEqual(result.statusCode, 400);
+    });
+    it("classifies unknown clients as invalid_client", () => {
+        const result = classifyOAuthError(new Error("Unknown client"));
+        assert.strictEqual(result.code, "invalid_client");
+        assert.strictEqual(result.statusCode, 400);
+    });
+    it("classifies token exchange failures as invalid_grant", () => {
+        const result = classifyOAuthError(new Error("Token exchange failed: invalid code"));
+        assert.strictEqual(result.code, "invalid_grant");
+        assert.strictEqual(result.statusCode, 400);
+    });
+    it("classifies provider communication failures as identity_broker_failure", () => {
+        const result = classifyOAuthError(new Error("Federation callback failed"));
+        assert.strictEqual(result.code, "identity_broker_failure");
+        assert.strictEqual(result.statusCode, 502);
+    });
+    it("classifies configuration errors as server_error", () => {
+        const result = classifyOAuthError(new Error("Connector not configured"));
+        assert.strictEqual(result.code, "server_error");
+        assert.strictEqual(result.statusCode, 500);
+    });
+    it("classifies generic errors as server_error", () => {
+        const result = classifyOAuthError(new Error("Something went wrong"));
+        assert.strictEqual(result.code, "server_error");
+        assert.strictEqual(result.statusCode, 500);
+    });
+    it("builds a redirect URL with a sanitized code and state", () => {
+        const url = buildOAuthErrorRedirect(new Error("secret details"), "http://example.com/cb?foo=bar", {
+            state: "xyz",
+            includeDescription: false,
+        });
+        assert.ok(url.startsWith("http://example.com/cb"));
+        assert.ok(url.includes("error=server_error"));
+        assert.ok(url.includes("state=xyz"));
+        assert.ok(url.includes("foo=bar"));
+        assert.ok(!url.includes("secret"));
+    });
+    it("includes descriptions in development mode", () => {
+        const { statusCode, body } = buildOAuthErrorResponse(new Error("detailed message"), {
+            includeDescription: true,
+        });
+        assert.strictEqual(statusCode, 500);
+        assert.strictEqual(body.error, "server_error");
+        assert.strictEqual(body.error_description, "detailed message");
+    });
+    it("omits descriptions outside development mode", () => {
+        const { statusCode, body } = buildOAuthErrorResponse(new Error("detailed message"), {
+            includeDescription: false,
+        });
+        assert.strictEqual(statusCode, 500);
+        assert.strictEqual(body.error, "server_error");
+        assert.strictEqual(body.error_description, undefined);
+    });
+});
+//# sourceMappingURL=errors.test.js.map

package/dist/tests/errors.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.test.js","sourceRoot":"","sources":["../../src/tests/errors.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,qDAAqD,CAAC;AAE7G,MAAM,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;AAElH,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC;QACpE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QACjD,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAC/D,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAClD,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC,CAAC;QACpF,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QACjD,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAC;QAC3E,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;QAC3D,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC;QACzE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAChD,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC;QACrE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAChD,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,GAAG,GAAG,uBAAuB,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,EAAE,+BAA+B,EAAE;YAChG,KAAK,EAAE,KAAK;YACZ,kBAAkB,EAAE,KAAK;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QACnC,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,EAAE;YAClF,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC;QACH,MAAM,CAAC,WAAW,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACpC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QAC/C,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,EAAE;YAClF,kBAAkB,EAAE,KAAK;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,WAAW,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACpC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QAC/C,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/tests/events.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=events.test.d.ts.map

package/dist/tests/events.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.test.d.ts","sourceRoot":"","sources":["../../src/tests/events.test.ts"],"names":[],"mappings":""}

package/dist/tests/events.test.js

@@ -0,0 +1,45 @@
+import { describe, it } from "node:test";
+import assert from "node:assert";
+import { validateEvent, normalizeEvent } from "../services/events/validate.js";
+import { emit, subscribe, buildEvent } from "../services/events/bus.js";
+describe("Event validation", () => {
+    it("accepts a valid event", () => {
+        const result = validateEvent(buildEvent("user_login", { userId: "1" }));
+        assert.strictEqual(result.valid, true);
+        assert.deepStrictEqual(result.errors, []);
+    });
+    it("rejects an unknown event type", () => {
+        const result = validateEvent(buildEvent("unknown_event", {}));
+        assert.strictEqual(result.valid, false);
+        assert.ok(result.errors.some((e) => e.includes("Unknown event type")));
+    });
+    it("rejects a missing payload", () => {
+        const result = validateEvent({ type: "user_login" });
+        assert.strictEqual(result.valid, false);
+        assert.ok(result.errors.some((e) => e.includes("payload")));
+    });
+    it("rejects an invalid version", () => {
+        const result = validateEvent({ type: "user_login", version: 0, payload: {} });
+        assert.strictEqual(result.valid, false);
+        assert.ok(result.errors.some((e) => e.includes("version")));
+    });
+    it("normalizes an event with version and timestamp", () => {
+        const event = normalizeEvent(buildEvent("user_login", { userId: "1" }));
+        assert.strictEqual(event.type, "user_login");
+        assert.strictEqual(event.version, 1);
+        assert.ok(event.timestamp instanceof Date);
+    });
+});
+describe("Event bus", () => {
+    it("delivers emitted events to subscribers", async () => {
+        const received = [];
+        const unsubscribe = subscribe("user_login", (event) => {
+            received.push(event.payload);
+        });
+        await emit(buildEvent("user_login", { userId: "42" }));
+        unsubscribe();
+        assert.strictEqual(received.length, 1);
+        assert.deepStrictEqual(received[0].userId, "42");
+    });
+});
+//# sourceMappingURL=events.test.js.map

package/dist/tests/events.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.test.js","sourceRoot":"","sources":["../../src/tests/events.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAExE,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACxE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACvC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,CAAC;QAC9D,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,IAAI,EAAE,YAAY,EAAW,CAAC,CAAC;QAC9D,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAW,CAAC,CAAC;QACvF,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,KAAK,GAAG,cAAc,CAAC,UAAU,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACxE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAC7C,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,SAAS,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE;YACpD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACvD,WAAW,EAAE,CAAC;QAEd,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACvC,MAAM,CAAC,eAAe,CAAE,QAAQ,CAAC,CAAC,CAAwB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/tests/featureFlags.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=featureFlags.test.d.ts.map

package/dist/tests/featureFlags.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"featureFlags.test.d.ts","sourceRoot":"","sources":["../../src/tests/featureFlags.test.ts"],"names":[],"mappings":""}

package/dist/tests/featureFlags.test.js

@@ -0,0 +1,24 @@
+import { describe, it } from "node:test";
+import assert from "node:assert";
+import { getConfigurationProfile, listConfigurationProfiles } from "../services/configuration/profiles.js";
+describe("Configuration profiles", () => {
+    it("lists all predefined profiles", () => {
+        const profiles = listConfigurationProfiles();
+        assert.ok(profiles.some((p) => p.id === "development"));
+        assert.ok(profiles.some((p) => p.id === "production"));
+        assert.ok(profiles.some((p) => p.id === "docker"));
+        assert.ok(profiles.some((p) => p.id === "docker-compose"));
+        assert.ok(profiles.some((p) => p.id === "kubernetes"));
+        assert.ok(profiles.some((p) => p.id === "high-availability"));
+    });
+    it("returns a profile with values", () => {
+        const profile = getConfigurationProfile("development");
+        assert.ok(profile);
+        assert.strictEqual(profile.values.NODE_ENV, "development");
+        assert.ok(profile.values.DATABASE_URL);
+    });
+    it("returns undefined for unknown profiles", () => {
+        assert.strictEqual(getConfigurationProfile("unknown"), undefined);
+    });
+});
+//# sourceMappingURL=featureFlags.test.js.map