@memberjunction/auth-providers 6.1.0-edge.2 → 6.1.0-edge.3

package/dist/providers/Auth0Provider.js

@@ -16,6 +16,27 @@ let Auth0Provider = class Auth0Provider extends BaseAuthProvider {
     constructor(config) {
         super(config);
     }
+    /**
+     * Configures Auth0 from AUTH0_DOMAIN + AUTH0_CLIENT_ID (AUTH0_CLIENT_SECRET optional).
+     *
+     * Mapping preserved byte-for-byte from the env block that previously lived in MJServer's
+     * config, so a deployment upgrading to the hook-based discovery sees no change.
+     */
+    static ConfigFromEnvironment(env) {
+        if (!env.AUTH0_DOMAIN || !env.AUTH0_CLIENT_ID) {
+            return null;
+        }
+        return {
+            name: 'auth0',
+            type: 'auth0',
+            issuer: `https://${env.AUTH0_DOMAIN}/`,
+            audience: env.AUTH0_CLIENT_ID,
+            jwksUri: `https://${env.AUTH0_DOMAIN}/.well-known/jwks.json`,
+            clientId: env.AUTH0_CLIENT_ID,
+            clientSecret: env.AUTH0_CLIENT_SECRET,
+            domain: env.AUTH0_DOMAIN
+        };
+    }
     /**
      * Extracts user information from Auth0 JWT payload
      */

package/dist/providers/Auth0Provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"Auth0Provider.js","sourceRoot":"","sources":["../../src/providers/Auth0Provider.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D;;GAEG;AAEI,IAAM,aAAa,GAAnB,MAAM,aAAc,SAAQ,gBAAgB;IACjD,YAAY,MAA0B;QACpC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,OAAmB;QACjC,kCAAkC;QAClC,MAAM,KAAK,GAAG,OAAO,CAAC,KAA2B,CAAC;QAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAA0B,CAAC;QACpD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAgC,CAAC;QAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAiC,CAAC;QAC3D,MAAM,iBAAiB,GAAG,OAAO,CAAC,kBAAwC,IAAI,KAAK,CAAC;QAEpF,OAAO;YACL,KAAK;YACL,SAAS,EAAE,SAAS,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/C,QAAQ,EAAE,QAAQ,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACxE,QAAQ;YACR,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC3C,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAEvC,OAAO,SAAS,IAAI,WAAW,IAAI,SAAS,CAAC;IAC/C,CAAC;CACF,CAAA;AAnCY,aAAa;IADzB,aAAa,CAAC,gBAAgB,EAAE,OAAO,CAAC;;GAC5B,aAAa,CAmCzB"}
+{"version":3,"file":"Auth0Provider.js","sourceRoot":"","sources":["../../src/providers/Auth0Provider.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D;;GAEG;AAEI,IAAM,aAAa,GAAnB,MAAM,aAAc,SAAQ,gBAAgB;IACjD,YAAY,MAA0B;QACpC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,qBAAqB,CAAC,GAAsB;QACjD,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,WAAW,GAAG,CAAC,YAAY,GAAG;YACtC,QAAQ,EAAE,GAAG,CAAC,eAAe;YAC7B,OAAO,EAAE,WAAW,GAAG,CAAC,YAAY,wBAAwB;YAC5D,QAAQ,EAAE,GAAG,CAAC,eAAe;YAC7B,YAAY,EAAE,GAAG,CAAC,mBAAmB;YACrC,MAAM,EAAE,GAAG,CAAC,YAAY;SACzB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,OAAmB;QACjC,kCAAkC;QAClC,MAAM,KAAK,GAAG,OAAO,CAAC,KAA2B,CAAC;QAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAA0B,CAAC;QACpD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAgC,CAAC;QAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAiC,CAAC;QAC3D,MAAM,iBAAiB,GAAG,OAAO,CAAC,kBAAwC,IAAI,KAAK,CAAC;QAEpF,OAAO;YACL,KAAK;YACL,SAAS,EAAE,SAAS,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/C,QAAQ,EAAE,QAAQ,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACxE,QAAQ;YACR,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC3C,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAEvC,OAAO,SAAS,IAAI,WAAW,IAAI,SAAS,CAAC;IAC/C,CAAC;CACF,CAAA;AAzDY,aAAa;IADzB,aAAa,CAAC,gBAAgB,EAAE,OAAO,CAAC;;GAC5B,aAAa,CAyDzB"}

package/dist/providers/CognitoProvider.d.ts

@@ -6,6 +6,12 @@ import { BaseAuthProvider } from '../BaseAuthProvider.js';
  */
 export declare class CognitoProvider extends BaseAuthProvider {
     constructor(config: AuthProviderConfig);
+    /**
+     * Configures Amazon Cognito from COGNITO_USER_POOL_ID + COGNITO_CLIENT_ID + AWS_REGION.
+     *
+     * Mapping preserved byte-for-byte from the env block that previously lived in MJServer's config.
+     */
+    static ConfigFromEnvironment(env: NodeJS.ProcessEnv): AuthProviderConfig | null;
     /**
      * Extracts user information from Cognito JWT payload
      */

package/dist/providers/CognitoProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CognitoProvider.d.ts","sourceRoot":"","sources":["../../src/providers/CognitoProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D;;GAEG;AACH,qBACa,eAAgB,SAAQ,gBAAgB;gBACvC,MAAM,EAAE,kBAAkB;IAItC;;OAEG;IACH,eAAe,CAAC,OAAO,EAAE,UAAU,GAAG,YAAY;IAoBlD;;OAEG;IACH,cAAc,IAAI,OAAO;CAQ1B"}
+{"version":3,"file":"CognitoProvider.d.ts","sourceRoot":"","sources":["../../src/providers/CognitoProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D;;GAEG;AACH,qBACa,eAAgB,SAAQ,gBAAgB;gBACvC,MAAM,EAAE,kBAAkB;IAItC;;;;OAIG;IACH,MAAM,CAAC,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,kBAAkB,GAAG,IAAI;IAgB/E;;OAEG;IACH,eAAe,CAAC,OAAO,EAAE,UAAU,GAAG,YAAY;IAoBlD;;OAEG;IACH,cAAc,IAAI,OAAO;CAQ1B"}

package/dist/providers/CognitoProvider.js

@@ -16,6 +16,26 @@ let CognitoProvider = class CognitoProvider extends BaseAuthProvider {
     constructor(config) {
         super(config);
     }
+    /**
+     * Configures Amazon Cognito from COGNITO_USER_POOL_ID + COGNITO_CLIENT_ID + AWS_REGION.
+     *
+     * Mapping preserved byte-for-byte from the env block that previously lived in MJServer's config.
+     */
+    static ConfigFromEnvironment(env) {
+        if (!env.COGNITO_USER_POOL_ID || !env.COGNITO_CLIENT_ID || !env.AWS_REGION) {
+            return null;
+        }
+        return {
+            name: 'cognito',
+            type: 'cognito',
+            issuer: `https://cognito-idp.${env.AWS_REGION}.amazonaws.com/${env.COGNITO_USER_POOL_ID}`,
+            audience: env.COGNITO_CLIENT_ID,
+            jwksUri: `https://cognito-idp.${env.AWS_REGION}.amazonaws.com/${env.COGNITO_USER_POOL_ID}/.well-known/jwks.json`,
+            clientId: env.COGNITO_CLIENT_ID,
+            region: env.AWS_REGION,
+            userPoolId: env.COGNITO_USER_POOL_ID
+        };
+    }
     /**
      * Extracts user information from Cognito JWT payload
      */

package/dist/providers/CognitoProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"CognitoProvider.js","sourceRoot":"","sources":["../../src/providers/CognitoProvider.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D;;GAEG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,gBAAgB;IACnD,YAAY,MAA0B;QACpC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,OAAmB;QACjC,oEAAoE;QACpE,MAAM,KAAK,GAAG,OAAO,CAAC,KAA2B;YACnC,OAAO,CAAC,kBAAkB,CAAuB,CAAC;QAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,IAA0B,CAAC;QACpD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAgC,CAAC;QAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAiC,CAAC;QAC3D,MAAM,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAuB;YAClD,OAAO,CAAC,kBAAwC;YAChD,KAAK,CAAC;QAE/B,OAAO;YACL,KAAK;YACL,SAAS,EAAE,SAAS,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/C,QAAQ,EAAE,QAAQ,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACxE,QAAQ;YACR,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC3C,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QACvC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;QAE/C,OAAO,SAAS,IAAI,WAAW,IAAI,SAAS,IAAI,aAAa,CAAC;IAChE,CAAC;CACF,CAAA;AAvCY,eAAe;IAD3B,aAAa,CAAC,gBAAgB,EAAE,SAAS,CAAC;;GAC9B,eAAe,CAuC3B"}
+{"version":3,"file":"CognitoProvider.js","sourceRoot":"","sources":["../../src/providers/CognitoProvider.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D;;GAEG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,gBAAgB;IACnD,YAAY,MAA0B;QACpC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,qBAAqB,CAAC,GAAsB;QACjD,IAAI,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,uBAAuB,GAAG,CAAC,UAAU,kBAAkB,GAAG,CAAC,oBAAoB,EAAE;YACzF,QAAQ,EAAE,GAAG,CAAC,iBAAiB;YAC/B,OAAO,EAAE,uBAAuB,GAAG,CAAC,UAAU,kBAAkB,GAAG,CAAC,oBAAoB,wBAAwB;YAChH,QAAQ,EAAE,GAAG,CAAC,iBAAiB;YAC/B,MAAM,EAAE,GAAG,CAAC,UAAU;YACtB,UAAU,EAAE,GAAG,CAAC,oBAAoB;SACrC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,OAAmB;QACjC,oEAAoE;QACpE,MAAM,KAAK,GAAG,OAAO,CAAC,KAA2B;YACnC,OAAO,CAAC,kBAAkB,CAAuB,CAAC;QAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,IAA0B,CAAC;QACpD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAgC,CAAC;QAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAiC,CAAC;QAC3D,MAAM,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAuB;YAClD,OAAO,CAAC,kBAAwC;YAChD,KAAK,CAAC;QAE/B,OAAO;YACL,KAAK;YACL,SAAS,EAAE,SAAS,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/C,QAAQ,EAAE,QAAQ,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACxE,QAAQ;YACR,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC3C,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QACvC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;QAE/C,OAAO,SAAS,IAAI,WAAW,IAAI,SAAS,IAAI,aAAa,CAAC;IAChE,CAAC;CACF,CAAA;AA5DY,eAAe;IAD3B,aAAa,CAAC,gBAAgB,EAAE,SAAS,CAAC;;GAC9B,eAAe,CA4D3B"}

package/dist/providers/MSALProvider.d.ts

@@ -6,6 +6,14 @@ import { BaseAuthProvider } from '../BaseAuthProvider.js';
  */
 export declare class MSALProvider extends BaseAuthProvider {
     constructor(config: AuthProviderConfig);
+    /**
+     * Configures Microsoft Entra ID from TENANT_ID + WEB_CLIENT_ID.
+     *
+     * Mapping preserved byte-for-byte from the env block that previously lived in MJServer's
+     * config — including the provider name 'azure', which predates the Entra rename and is kept
+     * so existing deployments' registered provider names do not shift.
+     */
+    static ConfigFromEnvironment(env: NodeJS.ProcessEnv): AuthProviderConfig | null;
     /**
      * Extracts user information from MSAL/Azure AD JWT payload
      */

package/dist/providers/MSALProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MSALProvider.d.ts","sourceRoot":"","sources":["../../src/providers/MSALProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D;;GAEG;AACH,qBACa,YAAa,SAAQ,gBAAgB;gBACpC,MAAM,EAAE,kBAAkB;IAItC;;OAEG;IACH,eAAe,CAAC,OAAO,EAAE,UAAU,GAAG,YAAY;IAiBlD;;OAEG;IACH,cAAc,IAAI,OAAO;CAO1B"}
+{"version":3,"file":"MSALProvider.d.ts","sourceRoot":"","sources":["../../src/providers/MSALProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D;;GAEG;AACH,qBACa,YAAa,SAAQ,gBAAgB;gBACpC,MAAM,EAAE,kBAAkB;IAItC;;;;;;OAMG;IACH,MAAM,CAAC,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,kBAAkB,GAAG,IAAI;IAe/E;;OAEG;IACH,eAAe,CAAC,OAAO,EAAE,UAAU,GAAG,YAAY;IAiBlD;;OAEG;IACH,cAAc,IAAI,OAAO;CAO1B"}

package/dist/providers/MSALProvider.js

@@ -16,6 +16,27 @@ let MSALProvider = class MSALProvider extends BaseAuthProvider {
     constructor(config) {
         super(config);
     }
+    /**
+     * Configures Microsoft Entra ID from TENANT_ID + WEB_CLIENT_ID.
+     *
+     * Mapping preserved byte-for-byte from the env block that previously lived in MJServer's
+     * config — including the provider name 'azure', which predates the Entra rename and is kept
+     * so existing deployments' registered provider names do not shift.
+     */
+    static ConfigFromEnvironment(env) {
+        if (!env.TENANT_ID || !env.WEB_CLIENT_ID) {
+            return null;
+        }
+        return {
+            name: 'azure',
+            type: 'msal',
+            issuer: `https://login.microsoftonline.com/${env.TENANT_ID}/v2.0`,
+            audience: env.WEB_CLIENT_ID,
+            jwksUri: `https://login.microsoftonline.com/${env.TENANT_ID}/discovery/v2.0/keys`,
+            clientId: env.WEB_CLIENT_ID,
+            tenantId: env.TENANT_ID
+        };
+    }
     /**
      * Extracts user information from MSAL/Azure AD JWT payload
      */

package/dist/providers/MSALProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"MSALProvider.js","sourceRoot":"","sources":["../../src/providers/MSALProvider.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D;;GAEG;AAEI,IAAM,YAAY,GAAlB,MAAM,YAAa,SAAQ,gBAAgB;IAChD,YAAY,MAA0B;QACpC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,OAAmB;QACjC,wCAAwC;QACxC,MAAM,KAAK,GAAG,OAAO,CAAC,KAA2B,IAAI,OAAO,CAAC,kBAAwC,CAAC;QACtG,MAAM,QAAQ,GAAG,OAAO,CAAC,IAA0B,CAAC;QACpD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAgC,CAAC;QAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAiC,CAAC;QAC3D,MAAM,iBAAiB,GAAG,OAAO,CAAC,kBAAwC,CAAC;QAE3E,OAAO;YACL,KAAK;YACL,SAAS,EAAE,SAAS,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/C,QAAQ,EAAE,QAAQ,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACxE,QAAQ;YACR,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC3C,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAE3C,OAAO,SAAS,IAAI,WAAW,IAAI,WAAW,CAAC;IACjD,CAAC;CACF,CAAA;AAnCY,YAAY;IADxB,aAAa,CAAC,gBAAgB,EAAE,MAAM,CAAC;;GAC3B,YAAY,CAmCxB"}
+{"version":3,"file":"MSALProvider.js","sourceRoot":"","sources":["../../src/providers/MSALProvider.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D;;GAEG;AAEI,IAAM,YAAY,GAAlB,MAAM,YAAa,SAAQ,gBAAgB;IAChD,YAAY,MAA0B;QACpC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,qBAAqB,CAAC,GAAsB;QACjD,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,qCAAqC,GAAG,CAAC,SAAS,OAAO;YACjE,QAAQ,EAAE,GAAG,CAAC,aAAa;YAC3B,OAAO,EAAE,qCAAqC,GAAG,CAAC,SAAS,sBAAsB;YACjF,QAAQ,EAAE,GAAG,CAAC,aAAa;YAC3B,QAAQ,EAAE,GAAG,CAAC,SAAS;SACxB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,OAAmB;QACjC,wCAAwC;QACxC,MAAM,KAAK,GAAG,OAAO,CAAC,KAA2B,IAAI,OAAO,CAAC,kBAAwC,CAAC;QACtG,MAAM,QAAQ,GAAG,OAAO,CAAC,IAA0B,CAAC;QACpD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAgC,CAAC;QAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAiC,CAAC;QAC3D,MAAM,iBAAiB,GAAG,OAAO,CAAC,kBAAwC,CAAC;QAE3E,OAAO;YACL,KAAK;YACL,SAAS,EAAE,SAAS,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/C,QAAQ,EAAE,QAAQ,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACxE,QAAQ;YACR,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC3C,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAE3C,OAAO,SAAS,IAAI,WAAW,IAAI,WAAW,CAAC;IACjD,CAAC;CACF,CAAA;AAzDY,YAAY;IADxB,aAAa,CAAC,gBAAgB,EAAE,MAAM,CAAC;;GAC3B,YAAY,CAyDxB"}

package/dist/providers/OktaProvider.d.ts

@@ -6,6 +6,14 @@ import { BaseAuthProvider } from '../BaseAuthProvider.js';
  */
 export declare class OktaProvider extends BaseAuthProvider {
     constructor(config: AuthProviderConfig);
+    /**
+     * Configures Okta from OKTA_DOMAIN + OKTA_CLIENT_ID, with OKTA_ISSUER overriding the issuer
+     * for orgs that use a custom authorization server rather than the default one.
+     *
+     * NEW capability: Okta had no env-var form before the discovery hook existed — it was one of
+     * the providers the old hard-coded block did not cover, so it required a config-file entry.
+     */
+    static ConfigFromEnvironment(env: NodeJS.ProcessEnv): AuthProviderConfig | null;
     /**
      * Extracts user information from Okta JWT payload
      */

package/dist/providers/OktaProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OktaProvider.d.ts","sourceRoot":"","sources":["../../src/providers/OktaProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D;;GAEG;AACH,qBACa,YAAa,SAAQ,gBAAgB;gBACpC,MAAM,EAAE,kBAAkB;IAItC;;OAEG;IACH,eAAe,CAAC,OAAO,EAAE,UAAU,GAAG,YAAY;IAiBlD;;OAEG;IACH,cAAc,IAAI,OAAO;CAO1B"}
+{"version":3,"file":"OktaProvider.d.ts","sourceRoot":"","sources":["../../src/providers/OktaProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D;;GAEG;AACH,qBACa,YAAa,SAAQ,gBAAgB;gBACpC,MAAM,EAAE,kBAAkB;IAItC;;;;;;OAMG;IACH,MAAM,CAAC,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,kBAAkB,GAAG,IAAI;IAgB/E;;OAEG;IACH,eAAe,CAAC,OAAO,EAAE,UAAU,GAAG,YAAY;IAiBlD;;OAEG;IACH,cAAc,IAAI,OAAO;CAO1B"}

package/dist/providers/OktaProvider.js

@@ -16,6 +16,28 @@ let OktaProvider = class OktaProvider extends BaseAuthProvider {
     constructor(config) {
         super(config);
     }
+    /**
+     * Configures Okta from OKTA_DOMAIN + OKTA_CLIENT_ID, with OKTA_ISSUER overriding the issuer
+     * for orgs that use a custom authorization server rather than the default one.
+     *
+     * NEW capability: Okta had no env-var form before the discovery hook existed — it was one of
+     * the providers the old hard-coded block did not cover, so it required a config-file entry.
+     */
+    static ConfigFromEnvironment(env) {
+        if (!env.OKTA_DOMAIN || !env.OKTA_CLIENT_ID) {
+            return null;
+        }
+        const issuer = env.OKTA_ISSUER || `https://${env.OKTA_DOMAIN}/oauth2/default`;
+        return {
+            name: 'okta',
+            type: 'okta',
+            issuer,
+            audience: env.OKTA_AUDIENCE || env.OKTA_CLIENT_ID,
+            jwksUri: `${issuer.replace(/\/$/, '')}/v1/keys`,
+            clientId: env.OKTA_CLIENT_ID,
+            domain: env.OKTA_DOMAIN
+        };
+    }
     /**
      * Extracts user information from Okta JWT payload
      */

package/dist/providers/OktaProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"OktaProvider.js","sourceRoot":"","sources":["../../src/providers/OktaProvider.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D;;GAEG;AAEI,IAAM,YAAY,GAAlB,MAAM,YAAa,SAAQ,gBAAgB;IAChD,YAAY,MAA0B;QACpC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,OAAmB;QACjC,uDAAuD;QACvD,MAAM,KAAK,GAAG,OAAO,CAAC,KAA2B,IAAI,OAAO,CAAC,kBAAwC,CAAC;QACtG,MAAM,QAAQ,GAAG,OAAO,CAAC,IAA0B,CAAC;QACpD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAgC,CAAC;QAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAiC,CAAC;QAC3D,MAAM,iBAAiB,GAAG,OAAO,CAAC,kBAAwC,IAAI,KAAK,CAAC;QAEpF,OAAO;YACL,KAAK;YACL,SAAS,EAAE,SAAS,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/C,QAAQ,EAAE,QAAQ,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACxE,QAAQ;YACR,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC3C,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAEvC,OAAO,SAAS,IAAI,WAAW,IAAI,SAAS,CAAC;IAC/C,CAAC;CACF,CAAA;AAnCY,YAAY;IADxB,aAAa,CAAC,gBAAgB,EAAE,MAAM,CAAC;;GAC3B,YAAY,CAmCxB"}
+{"version":3,"file":"OktaProvider.js","sourceRoot":"","sources":["../../src/providers/OktaProvider.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D;;GAEG;AAEI,IAAM,YAAY,GAAlB,MAAM,YAAa,SAAQ,gBAAgB;IAChD,YAAY,MAA0B;QACpC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,qBAAqB,CAAC,GAAsB;QACjD,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,IAAI,WAAW,GAAG,CAAC,WAAW,iBAAiB,CAAC;QAC9E,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,MAAM;YACZ,MAAM;YACN,QAAQ,EAAE,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,cAAc;YACjD,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU;YAC/C,QAAQ,EAAE,GAAG,CAAC,cAAc;YAC5B,MAAM,EAAE,GAAG,CAAC,WAAW;SACxB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,OAAmB;QACjC,uDAAuD;QACvD,MAAM,KAAK,GAAG,OAAO,CAAC,KAA2B,IAAI,OAAO,CAAC,kBAAwC,CAAC;QACtG,MAAM,QAAQ,GAAG,OAAO,CAAC,IAA0B,CAAC;QACpD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAgC,CAAC;QAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAiC,CAAC;QAC3D,MAAM,iBAAiB,GAAG,OAAO,CAAC,kBAAwC,IAAI,KAAK,CAAC;QAEpF,OAAO;YACL,KAAK;YACL,SAAS,EAAE,SAAS,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/C,QAAQ,EAAE,QAAQ,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACxE,QAAQ;YACR,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC3C,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAEvC,OAAO,SAAS,IAAI,WAAW,IAAI,SAAS,CAAC;IAC/C,CAAC;CACF,CAAA;AA1DY,YAAY;IADxB,aAAa,CAAC,gBAAgB,EAAE,MAAM,CAAC;;GAC3B,YAAY,CA0DxB"}

package/dist/providers/WorkOSProvider.d.ts

@@ -27,6 +27,20 @@ import { BaseAuthProvider } from '../BaseAuthProvider.js';
  */
 export declare class WorkOSProvider extends BaseAuthProvider {
     constructor(config: AuthProviderConfig);
+    /**
+     * Configures WorkOS AuthKit from WORKOS_CLIENT_ID.
+     *
+     * Issuer and JWKS are both derived from the client ID — AuthKit's issuer is
+     * https://api.workos.com/user_management/<clientId> and its JWKS lives at
+     * https://api.workos.com/sso/jwks/<clientId> — so a single variable is enough.
+     * WORKOS_AUDIENCE overrides the audience when a Resource Indicator is configured.
+     *
+     * NEW capability: WorkOS had no env-var form before the discovery hook existed.
+     *
+     * Remember the AuthKit email caveat: access tokens omit `email` unless a JWT Template adds it,
+     * and MJ resolves users by email. See WORKOS.md.
+     */
+    static ConfigFromEnvironment(env: NodeJS.ProcessEnv): AuthProviderConfig | null;
     /**
      * Extracts user information from a WorkOS AuthKit JWT payload.
      *

package/dist/providers/WorkOSProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"WorkOSProvider.d.ts","sourceRoot":"","sources":["../../src/providers/WorkOSProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBACa,cAAe,SAAQ,gBAAgB;gBACtC,MAAM,EAAE,kBAAkB;IAItC;;;;;;;OAOG;IACH,eAAe,CAAC,OAAO,EAAE,UAAU,GAAG,YAAY;IAoBlD;;;;;;OAMG;IACH,cAAc,IAAI,OAAO;CAM1B"}
+{"version":3,"file":"WorkOSProvider.d.ts","sourceRoot":"","sources":["../../src/providers/WorkOSProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBACa,cAAe,SAAQ,gBAAgB;gBACtC,MAAM,EAAE,kBAAkB;IAItC;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,kBAAkB,GAAG,IAAI;IAc/E;;;;;;;OAOG;IACH,eAAe,CAAC,OAAO,EAAE,UAAU,GAAG,YAAY;IAoBlD;;;;;;OAMG;IACH,cAAc,IAAI,OAAO;CAM1B"}

package/dist/providers/WorkOSProvider.js

@@ -37,6 +37,32 @@ let WorkOSProvider = class WorkOSProvider extends BaseAuthProvider {
     constructor(config) {
         super(config);
     }
+    /**
+     * Configures WorkOS AuthKit from WORKOS_CLIENT_ID.
+     *
+     * Issuer and JWKS are both derived from the client ID — AuthKit's issuer is
+     * https://api.workos.com/user_management/<clientId> and its JWKS lives at
+     * https://api.workos.com/sso/jwks/<clientId> — so a single variable is enough.
+     * WORKOS_AUDIENCE overrides the audience when a Resource Indicator is configured.
+     *
+     * NEW capability: WorkOS had no env-var form before the discovery hook existed.
+     *
+     * Remember the AuthKit email caveat: access tokens omit `email` unless a JWT Template adds it,
+     * and MJ resolves users by email. See WORKOS.md.
+     */
+    static ConfigFromEnvironment(env) {
+        if (!env.WORKOS_CLIENT_ID) {
+            return null;
+        }
+        return {
+            name: 'workos',
+            type: 'workos',
+            issuer: `https://api.workos.com/user_management/${env.WORKOS_CLIENT_ID}`,
+            audience: env.WORKOS_AUDIENCE || env.WORKOS_CLIENT_ID,
+            jwksUri: `https://api.workos.com/sso/jwks/${env.WORKOS_CLIENT_ID}`,
+            clientId: env.WORKOS_CLIENT_ID
+        };
+    }
     /**
      * Extracts user information from a WorkOS AuthKit JWT payload.
      *

package/dist/providers/WorkOSProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"WorkOSProvider.js","sourceRoot":"","sources":["../../src/providers/WorkOSProvider.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,gBAAgB;IAClD,YAAY,MAA0B;QACpC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChB,CAAC;IAED;;;;;;;OAOG;IACH,eAAe,CAAC,OAAmB;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAA2B,CAAC;QAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAA0B,CAAC;QACpD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAgC,CAAC;QAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAiC,CAAC;QAC3D,kFAAkF;QAClF,MAAM,iBAAiB,GAAG,OAAO,CAAC,kBAAwC,IAAI,KAAK,CAAC;QACpF,4DAA4D;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAyB,CAAC;QAEjD,OAAO;YACL,KAAK;YACL,SAAS,EAAE,SAAS,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/C,QAAQ,EAAE,QAAQ,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACxE,QAAQ;YACR,iBAAiB;YACjB,MAAM;SACP,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,cAAc;QACZ,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAE3C,OAAO,SAAS,IAAI,WAAW,CAAC;IAClC,CAAC;CACF,CAAA;AA9CY,cAAc;IAD1B,aAAa,CAAC,gBAAgB,EAAE,QAAQ,CAAC;;GAC7B,cAAc,CA8C1B"}
+{"version":3,"file":"WorkOSProvider.js","sourceRoot":"","sources":["../../src/providers/WorkOSProvider.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,gBAAgB;IAClD,YAAY,MAA0B;QACpC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,qBAAqB,CAAC,GAAsB;QACjD,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,0CAA0C,GAAG,CAAC,gBAAgB,EAAE;YACxE,QAAQ,EAAE,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,gBAAgB;YACrD,OAAO,EAAE,mCAAmC,GAAG,CAAC,gBAAgB,EAAE;YAClE,QAAQ,EAAE,GAAG,CAAC,gBAAgB;SAC/B,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,eAAe,CAAC,OAAmB;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAA2B,CAAC;QAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAA0B,CAAC;QACpD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAgC,CAAC;QAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAiC,CAAC;QAC3D,kFAAkF;QAClF,MAAM,iBAAiB,GAAG,OAAO,CAAC,kBAAwC,IAAI,KAAK,CAAC;QACpF,4DAA4D;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAyB,CAAC;QAEjD,OAAO;YACL,KAAK;YACL,SAAS,EAAE,SAAS,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/C,QAAQ,EAAE,QAAQ,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACxE,QAAQ;YACR,iBAAiB;YACjB,MAAM;SACP,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,cAAc;QACZ,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAE3C,OAAO,SAAS,IAAI,WAAW,CAAC;IAClC,CAAC;CACF,CAAA;AAzEY,cAAc;IAD1B,aAAa,CAAC,gBAAgB,EAAE,QAAQ,CAAC;;GAC7B,cAAc,CAyE1B"}

package/package.json

@@ -1,13 +1,14 @@
 {
   "name": "@memberjunction/auth-providers",
-  "version": "6.1.0-edge.2",
+  "license": "BUSL-1.1",
+  "version": "6.1.0-edge.3",
   "description": "Authentication provider interfaces, base classes, and implementations for MemberJunction",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "dependencies": {
-    "@memberjunction/core": "6.1.0-edge.2",
-    "@memberjunction/global": "6.1.0-edge.2",
+    "@memberjunction/core": "6.1.0-edge.3",
+    "@memberjunction/global": "6.1.0-edge.3",
     "graphql": "^16.12.0",
     "jsonwebtoken": "9.0.3",
     "jwks-rsa": "^3.2.2"

package/src/AuthProviderFactory.ts

@@ -1,16 +1,22 @@
 import { AuthProviderConfig, LogStatusEx } from '@memberjunction/core';
 import { IAuthProvider } from './IAuthProvider.js';
 import { BaseAuthProvider } from './BaseAuthProvider.js';
+import { isEnvironmentConfigurable } from './IEnvironmentConfigurableProvider.js';
 import { MJGlobal, BaseSingleton, MJLruCache } from '@memberjunction/global';
 
-// Import providers to ensure they're registered
-import './providers/Auth0Provider.js';
-import './providers/MSALProvider.js';
-import './providers/OktaProvider.js';
-import './providers/CognitoProvider.js';
-import './providers/GoogleProvider.js';
-import './providers/WorkOSProvider.js';
-import './providers/MagicLinkProvider.js';
+// NOTE: this file deliberately contains NO list of concrete providers.
+//
+// It used to carry a literal `import './providers/Auth0Provider.js'` roster, which made the
+// built-ins look like a closed set that had to be edited to add a provider. They never were:
+// providers are @RegisterClass plugins resolved by key, and `index.ts` already exports all of
+// them by name, so importing anything from '@memberjunction/auth-providers' loads and registers
+// every built-in. HostIdentityProvider — added later — was never in that roster and has always
+// registered fine through the package entry point and the server-bootstrap manifest, which is
+// the proof the roster was redundant rather than load-bearing.
+//
+// Adding a provider is therefore: ship a @RegisterClass(BaseAuthProvider, 'x') subclass (in this
+// package, or in any package covered by a class-registration manifest) and add an
+// `MJ: Authentication Providers` row naming 'x' as its DriverClass. No edit here.
 
 /**
  * Factory and registry for managing authentication providers
@@ -182,6 +188,48 @@ export class AuthProviderFactory extends BaseSingleton<AuthProviderFactory> {
     return Array.from(new Set(providerTypes));
   }
 
+  /**
+   * Collects provider configurations from environment variables by asking every registered
+   * provider class to configure itself.
+   *
+   * This replaces the hard-coded env block that used to live in MJServer's config and
+   * enumerated Entra / Auth0 / Cognito inline. Discovery is now driven by the same
+   * `@RegisterClass` registry that resolves drivers, so a third-party provider gets the
+   * env-var experience without a core edit — see {@link IEnvironmentConfigurableProvider}.
+   *
+   * A provider whose variables are absent returns null and is skipped. A provider whose
+   * mapping throws is skipped with an error rather than taking down startup, because one
+   * malformed mapping must not cost a deployment its other providers.
+   *
+   * @param env Environment to read from; defaults to `process.env`.
+   * @returns One config per provider that found its variables, deduplicated by name.
+   */
+  static DiscoverFromEnvironment(env: NodeJS.ProcessEnv = process.env): AuthProviderConfig[] {
+    const registrations = MJGlobal.Instance.ClassFactory.GetAllRegistrations(BaseAuthProvider);
+    const configs = new Map<string, AuthProviderConfig>();
+
+    for (const registration of registrations) {
+      const providerClass: unknown = registration.SubClass;
+      if (!isEnvironmentConfigurable(providerClass)) {
+        continue;
+      }
+      try {
+        const config = providerClass.ConfigFromEnvironment(env);
+        if (config && !configs.has(config.name)) {
+          configs.set(config.name, config);
+        }
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        LogStatusEx({
+          message: `Auth provider '${registration.Key}' failed to build a configuration from environment variables: ${message}`,
+          verboseOnly: true
+        });
+      }
+    }
+
+    return Array.from(configs.values());
+  }
+
   /**
    * Checks if a provider type is registered
    */

package/src/IEnvironmentConfigurableProvider.ts

@@ -0,0 +1,54 @@
+import type { AuthProviderConfig } from '@memberjunction/core';
+
+/**
+ * Optional static contract a provider class implements to configure itself from environment
+ * variables.
+ *
+ * **Why this is a hook and not a list.** MJServer used to derive env-based providers from a
+ * hard-coded block that enumerated Entra, Auth0 and Cognito inline. That block was a closed
+ * domain in the one place the architecture is otherwise open: a third-party provider could
+ * register a class and take a metadata row or a `mj.config.cjs` entry, but it could never offer
+ * the "set two environment variables and you are done" experience the built-ins got, because
+ * the enumeration lived in core. Moving the mapping onto the provider class puts every provider
+ * — shipped or third-party — on the same footing.
+ *
+ * A provider that has no meaningful env-var form simply omits the static, and discovery skips it.
+ *
+ * @example
+ * ```ts
+ * @RegisterClass(BaseAuthProvider, 'my-idp')
+ * export class MyIdpProvider extends BaseAuthProvider {
+ *   static ConfigFromEnvironment(env: NodeJS.ProcessEnv): AuthProviderConfig | null {
+ *     if (!env.MY_IDP_DOMAIN || !env.MY_IDP_CLIENT_ID) return null;
+ *     return {
+ *       name: 'my-idp',
+ *       type: 'my-idp',
+ *       issuer: `https://${env.MY_IDP_DOMAIN}/`,
+ *       audience: env.MY_IDP_CLIENT_ID,
+ *       jwksUri: `https://${env.MY_IDP_DOMAIN}/.well-known/jwks.json`,
+ *       clientId: env.MY_IDP_CLIENT_ID
+ *     };
+ *   }
+ * }
+ * ```
+ */
+export interface IEnvironmentConfigurableProvider {
+  /**
+   * Builds this provider's configuration from environment variables.
+   *
+   * MUST return `null` — not a partial config — when its variables are absent or incomplete.
+   * A half-populated config would fail `validateConfig()` at registration and surface as a
+   * startup error on every deployment that simply does not use this provider.
+   *
+   * @param env The environment to read (injected rather than read from `process.env` directly
+   *        so the mapping is testable without mutating global state).
+   */
+  ConfigFromEnvironment(env: NodeJS.ProcessEnv): AuthProviderConfig | null;
+}
+
+/**
+ * Narrows an unknown provider class to one that offers env-var configuration.
+ */
+export function isEnvironmentConfigurable(subject: unknown): subject is IEnvironmentConfigurableProvider {
+  return typeof (subject as IEnvironmentConfigurableProvider | undefined)?.ConfigFromEnvironment === 'function';
+}

package/src/__tests__/BuiltInProviderRegistration.test.ts

@@ -0,0 +1,37 @@
+/**
+ * Locks in the invariant that `AuthProviderFactory` now depends on.
+ *
+ * The factory used to carry a literal `import './providers/Auth0Provider.js'` roster to force
+ * registration. That roster was removed because it made the built-ins look like a closed set
+ * that had to be edited to add a provider — registration actually comes from importing the
+ * package ENTRY POINT, which exports every provider by name.
+ *
+ * That makes `index.ts` load-bearing in a way nothing previously asserted: dropping a provider's
+ * export would silently stop registering it, and the failure would surface only as production
+ * tokens from that issuer being rejected. These tests import the entry point exactly as every
+ * real consumer does, and fail loudly if an export goes missing.
+ */
+import { describe, it, expect } from 'vitest';
+
+// Import the package entry point (NOT a deep path) — this is the behaviour under test.
+import { AuthProviderFactory } from '../index.js';
+
+/** Every driver key MJ ships, matching the @RegisterClass keys on the concrete providers. */
+const BUILT_IN_DRIVER_KEYS = ['auth0', 'msal', 'okta', 'cognito', 'google', 'workos', 'magic-link'] as const;
+
+describe('built-in auth provider registration via the package entry point', () => {
+  it.each(BUILT_IN_DRIVER_KEYS)("registers the '%s' driver", (key) => {
+    expect(AuthProviderFactory.isProviderTypeRegistered(key)).toBe(true);
+  });
+
+  it('exposes every built-in driver key through the ClassFactory', () => {
+    const registered = AuthProviderFactory.getRegisteredProviderTypes();
+    for (const key of BUILT_IN_DRIVER_KEYS) {
+      expect(registered).toContain(key);
+    }
+  });
+
+  it('reports an unregistered driver key as unregistered', () => {
+    expect(AuthProviderFactory.isProviderTypeRegistered('not-a-real-provider')).toBe(false);
+  });
+});

package/src/__tests__/EnvironmentDiscovery.test.ts

@@ -0,0 +1,146 @@
+/**
+ * Tests for environment-variable provider discovery.
+ *
+ * The mappings for Entra, Auth0 and Cognito were lifted out of a hard-coded block in MJServer's
+ * config and onto the provider classes. The parity tests below assert the exact shape that block
+ * produced, because any drift silently changes which issuer a deployment's tokens are validated
+ * against — a failure that surfaces as "everyone is logged out" rather than as a type error.
+ */
+import { describe, it, expect } from 'vitest';
+import { AuthProviderFactory } from '../index.js';
+import { Auth0Provider } from '../providers/Auth0Provider.js';
+import { MSALProvider } from '../providers/MSALProvider.js';
+import { CognitoProvider } from '../providers/CognitoProvider.js';
+import { OktaProvider } from '../providers/OktaProvider.js';
+import { WorkOSProvider } from '../providers/WorkOSProvider.js';
+
+const EMPTY: NodeJS.ProcessEnv = {};
+
+describe('ConfigFromEnvironment — parity with the previous hard-coded block', () => {
+  it('Auth0 maps AUTH0_DOMAIN + AUTH0_CLIENT_ID exactly as before', () => {
+    expect(
+      Auth0Provider.ConfigFromEnvironment({
+        AUTH0_DOMAIN: 'example.us.auth0.com',
+        AUTH0_CLIENT_ID: 'cid',
+        AUTH0_CLIENT_SECRET: 'secret'
+      })
+    ).toEqual({
+      name: 'auth0',
+      type: 'auth0',
+      issuer: 'https://example.us.auth0.com/',
+      audience: 'cid',
+      jwksUri: 'https://example.us.auth0.com/.well-known/jwks.json',
+      clientId: 'cid',
+      clientSecret: 'secret',
+      domain: 'example.us.auth0.com'
+    });
+  });
+
+  it('Entra maps TENANT_ID + WEB_CLIENT_ID exactly as before, keeping the legacy name "azure"', () => {
+    const config = MSALProvider.ConfigFromEnvironment({ TENANT_ID: 'tid', WEB_CLIENT_ID: 'wcid' });
+    expect(config).toEqual({
+      name: 'azure',
+      type: 'msal',
+      issuer: 'https://login.microsoftonline.com/tid/v2.0',
+      audience: 'wcid',
+      jwksUri: 'https://login.microsoftonline.com/tid/discovery/v2.0/keys',
+      clientId: 'wcid',
+      tenantId: 'tid'
+    });
+  });
+
+  it('Cognito maps its three variables exactly as before', () => {
+    expect(
+      CognitoProvider.ConfigFromEnvironment({
+        COGNITO_USER_POOL_ID: 'pool',
+        COGNITO_CLIENT_ID: 'ccid',
+        AWS_REGION: 'us-east-1'
+      })
+    ).toEqual({
+      name: 'cognito',
+      type: 'cognito',
+      issuer: 'https://cognito-idp.us-east-1.amazonaws.com/pool',
+      audience: 'ccid',
+      jwksUri: 'https://cognito-idp.us-east-1.amazonaws.com/pool/.well-known/jwks.json',
+      clientId: 'ccid',
+      region: 'us-east-1',
+      userPoolId: 'pool'
+    });
+  });
+});
+
+describe('ConfigFromEnvironment — incomplete configuration', () => {
+  it.each([
+    ['Auth0 without a client id', () => Auth0Provider.ConfigFromEnvironment({ AUTH0_DOMAIN: 'd' })],
+    ['Entra without a client id', () => MSALProvider.ConfigFromEnvironment({ TENANT_ID: 't' })],
+    ['Cognito without a region', () => CognitoProvider.ConfigFromEnvironment({ COGNITO_USER_POOL_ID: 'p', COGNITO_CLIENT_ID: 'c' })],
+    ['Okta without a client id', () => OktaProvider.ConfigFromEnvironment({ OKTA_DOMAIN: 'd' })],
+    ['WorkOS with nothing set', () => WorkOSProvider.ConfigFromEnvironment(EMPTY)]
+  ])('returns null for %s rather than a partial config', (_label, build) => {
+    // A partial config would fail validateConfig() at registration and surface as a startup
+    // error on every deployment that simply does not use that provider.
+    expect(build()).toBeNull();
+  });
+});
+
+describe('ConfigFromEnvironment — providers that previously had no env-var form', () => {
+  it('Okta derives the default authorization server, and honours OKTA_ISSUER', () => {
+    const base = OktaProvider.ConfigFromEnvironment({ OKTA_DOMAIN: 'org.okta.com', OKTA_CLIENT_ID: 'ocid' });
+    expect(base?.issuer).toBe('https://org.okta.com/oauth2/default');
+    expect(base?.jwksUri).toBe('https://org.okta.com/oauth2/default/v1/keys');
+
+    const custom = OktaProvider.ConfigFromEnvironment({
+      OKTA_DOMAIN: 'org.okta.com',
+      OKTA_CLIENT_ID: 'ocid',
+      OKTA_ISSUER: 'https://org.okta.com/oauth2/aus123'
+    });
+    expect(custom?.issuer).toBe('https://org.okta.com/oauth2/aus123');
+    expect(custom?.jwksUri).toBe('https://org.okta.com/oauth2/aus123/v1/keys');
+  });
+
+  it('WorkOS derives issuer and JWKS from the client id alone', () => {
+    const config = WorkOSProvider.ConfigFromEnvironment({ WORKOS_CLIENT_ID: 'client_01H' });
+    expect(config).toMatchObject({
+      name: 'workos',
+      type: 'workos',
+      issuer: 'https://api.workos.com/user_management/client_01H',
+      jwksUri: 'https://api.workos.com/sso/jwks/client_01H',
+      audience: 'client_01H'
+    });
+  });
+});
+
+describe('AuthProviderFactory.DiscoverFromEnvironment', () => {
+  it('returns nothing for an empty environment', () => {
+    expect(AuthProviderFactory.DiscoverFromEnvironment(EMPTY)).toEqual([]);
+  });
+
+  it('discovers every provider whose variables are present, through the ClassFactory registry', () => {
+    const discovered = AuthProviderFactory.DiscoverFromEnvironment({
+      AUTH0_DOMAIN: 'example.us.auth0.com',
+      AUTH0_CLIENT_ID: 'a',
+      TENANT_ID: 't',
+      WEB_CLIENT_ID: 'w',
+      WORKOS_CLIENT_ID: 'client_01H'
+    });
+
+    expect(discovered.map((p) => p.name).sort()).toEqual(['auth0', 'azure', 'workos']);
+  });
+
+  it('skips providers whose variables are absent', () => {
+    const discovered = AuthProviderFactory.DiscoverFromEnvironment({ AUTH0_DOMAIN: 'd', AUTH0_CLIENT_ID: 'c' });
+    expect(discovered.map((p) => p.name)).toEqual(['auth0']);
+  });
+
+  it('produces configs that pass the provider validity check', () => {
+    for (const config of AuthProviderFactory.DiscoverFromEnvironment({
+      AUTH0_DOMAIN: 'example.us.auth0.com',
+      AUTH0_CLIENT_ID: 'a',
+      OKTA_DOMAIN: 'org.okta.com',
+      OKTA_CLIENT_ID: 'o',
+      WORKOS_CLIENT_ID: 'client_01H'
+    })) {
+      expect(AuthProviderFactory.createProvider(config).validateConfig()).toBe(true);
+    }
+  });
+});

package/src/index.ts

@@ -2,6 +2,7 @@ export { IAuthProvider } from './IAuthProvider.js';
 export { BaseAuthProvider } from './BaseAuthProvider.js';
 export { AuthProviderFactory } from './AuthProviderFactory.js';
 export { TokenExpiredError } from './tokenExpiredError.js';
+export { type IEnvironmentConfigurableProvider, isEnvironmentConfigurable } from './IEnvironmentConfigurableProvider.js';
 export { MagicLinkProvider } from './providers/MagicLinkProvider.js';
 export {
   HostIdentityProvider,