@numa-tech/numa 1.23.1 → 1.25.0

package/dist/authorization/managed-keycloak-client.js

@@ -0,0 +1,182 @@
+import { z } from "zod";
+import { resolveBackendUrl } from "../backend.js";
+import { ensureAccessToken, fetchWithKeycloakIdentity } from "../oauth.js";
+import { AuthorizationError, authorizationHttpErrorCode } from "./errors.js";
+import { uuid, positive, document, version, publicationJob } from "./application-schemas.js";
+import * as s from "./managed-keycloak-schemas.js";
+const ROOT = "/api/v1/admin/authorization";
+const LIMIT = 2 * 1024 * 1024;
+const currentConfiguration = z.object({ issuerId: uuid, issuerVersion: version, version,
+    intentVersion: version, appliedVersion: version, exchangeClientVersion: version.nullable().optional(), exchangeClientInstanceId: uuid.nullable().optional(), configuration: s.managedKeycloakConfiguration.nullable() }).passthrough();
+function requireScope(matches) {
+    if (!matches)
+        throw new AuthorizationError("Managed Keycloak response target differs from the requested target.", "authorization_invalid_response");
+}
+async function safeServerCode(response) {
+    if (!response.headers.get("content-type")?.includes("application/json")) {
+        await response.body?.cancel().catch(() => undefined);
+        return;
+    }
+    const reader = response.body?.getReader();
+    if (!reader)
+        return;
+    const chunks = [];
+    let bytes = 0;
+    try {
+        for (;;) {
+            const item = await reader.read();
+            if (item.done)
+                break;
+            bytes += item.value.byteLength;
+            if (bytes > 8192)
+                throw new Error("limit");
+            chunks.push(item.value);
+        }
+        const body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+        if (body && typeof body === "object" && "code" in body && typeof body.code === "string"
+            && /^[A-Z][A-Z0-9_]{1,100}$/u.test(body.code))
+            return body.code;
+    }
+    catch {
+        await reader.cancel().catch(() => undefined);
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
+export class ManagedKeycloakClient {
+    config;
+    dependencies;
+    constructor(config, dependencies = {}) {
+        this.config = config;
+        this.dependencies = dependencies;
+    }
+    async request(path, schema, method = "GET", body) {
+        let response;
+        try {
+            response = await fetchWithKeycloakIdentity(this.config, resolveBackendUrl(this.config, { path, method }), () => ({
+                method, redirect: "error", signal: AbortSignal.timeout(60_000), headers: { Accept: "application/json", ...(body === undefined ? {} : { "Content-Type": "application/json" }) },
+                ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+            }), { fetch: this.dependencies.fetch ?? fetch, tokenProvider: this.dependencies.tokenProvider ?? ensureAccessToken, retryUnauthorized: method === "GET" });
+        }
+        catch {
+            throw new AuthorizationError("Managed Keycloak request did not complete. Read the original task before retrying; writes are never replayed.", "authorization_api_error");
+        }
+        if (!response.ok) {
+            // Preserve only the canonical error code, never reflected messages or bodies.
+            const code = await safeServerCode(response);
+            throw new AuthorizationError(`Managed Keycloak API returned HTTP ${response.status}.`, authorizationHttpErrorCode(response.status), response.status, undefined, code);
+        }
+        const reader = response.body?.getReader();
+        if (!reader)
+            throw new AuthorizationError("Empty managed Keycloak response.", "authorization_invalid_response");
+        const chunks = [];
+        let total = 0;
+        try {
+            for (;;) {
+                const item = await reader.read();
+                if (item.done)
+                    break;
+                total += item.value.byteLength;
+                if (total > LIMIT)
+                    throw new Error("limit");
+                chunks.push(item.value);
+            }
+        }
+        catch {
+            await reader.cancel().catch(() => undefined);
+            throw new AuthorizationError("Managed Keycloak response exceeded its limit or could not be read.", "authorization_invalid_response");
+        }
+        finally {
+            reader.releaseLock();
+        }
+        let value;
+        try {
+            value = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+        }
+        catch {
+            throw new AuthorizationError("Invalid managed Keycloak JSON response.", "authorization_invalid_response");
+        }
+        return s.parseManaged(schema, value, true);
+    }
+    capabilities(issuerId) {
+        return this.request(`${ROOT}/issuers/${s.parseManaged(uuid, issuerId)}/managed-configuration/capabilities`, document);
+    }
+    async configuration(context, exchangeClientInstanceId) {
+        context = s.parseManaged(s.managedKeycloakContext, context);
+        const query = new URLSearchParams({ applicationId: String(context.applicationId), platformEnvironmentId: String(context.platformEnvironmentId) });
+        if (exchangeClientInstanceId !== undefined)
+            query.set("exchangeClientInstanceId", s.parseManaged(uuid, exchangeClientInstanceId));
+        const result = await this.request(`${ROOT}/issuers/${context.issuerId}/managed-configuration?${query}`, currentConfiguration);
+        if (exchangeClientInstanceId !== undefined)
+            requireScope(result.exchangeClientInstanceId === exchangeClientInstanceId && result.exchangeClientVersion != null);
+        requireScope(result.issuerId === context.issuerId);
+        if (result.configuration)
+            requireScope(result.configuration.target.applicationId === context.applicationId
+                && result.configuration.target.platformEnvironmentId === context.platformEnvironmentId
+                && result.configuration.target.issuerId === context.issuerId);
+        return result;
+    }
+    async save(issuerId, input) {
+        issuerId = s.parseManaged(uuid, issuerId);
+        const body = s.parseManaged(s.managedKeycloakSave, input);
+        requireScope(body.configuration.target.issuerId === issuerId);
+        const result = await this.request(`${ROOT}/issuers/${issuerId}/managed-configuration`, currentConfiguration, "PUT", body);
+        requireScope(result.issuerId === issuerId);
+        requireScope(result.configuration !== null && result.configuration.target.issuerId === issuerId
+            && result.configuration.target.applicationId === body.configuration.target.applicationId
+            && result.configuration.target.platformEnvironmentId === body.configuration.target.platformEnvironmentId);
+        return result;
+    }
+    async preview(applicationId, input) {
+        applicationId = s.parseManaged(positive, applicationId);
+        const body = s.parseManaged(s.managedKeycloakPreview, input);
+        requireScope(body.configuration.target.applicationId === applicationId);
+        const result = await this.request(`${ROOT}/applications/${applicationId}/managed-keycloak-imports/preview`, publicationJob, "POST", body);
+        requireScope(result.applicationId === applicationId && result.id === body.requestId && result.operation === "MANAGED_KEYCLOAK_IMPORT");
+        if (result.operation === "MANAGED_KEYCLOAK_IMPORT") {
+            const target = result.plan.managedConfiguration.configuration.target;
+            requireScope(target.issuerId === body.configuration.target.issuerId
+                && target.platformEnvironmentId === body.configuration.target.platformEnvironmentId);
+        }
+        return result;
+    }
+    async export(context, view) {
+        context = s.parseManaged(s.managedKeycloakContext, context);
+        s.parseManaged(z.enum(["current", "observed"]), view);
+        const query = new URLSearchParams({ issuerId: context.issuerId, platformEnvironmentId: String(context.platformEnvironmentId), view });
+        const path = `${ROOT}/applications/${context.applicationId}/managed-keycloak-imports/export?${query}`;
+        if (view === "current") {
+            const result = await this.request(path, s.managedKeycloakConfiguration);
+            requireScope(result.target.issuerId === context.issuerId && result.target.platformEnvironmentId === context.platformEnvironmentId && result.target.applicationId === context.applicationId);
+            return result;
+        }
+        const result = await this.request(path, document);
+        requireScope(result.kind === "KEYCLOAK_MANAGED_OBSERVATION");
+        const target = s.parseManaged(s.managedKeycloakContext.passthrough(), result.target, true);
+        requireScope(target.issuerId === context.issuerId && target.platformEnvironmentId === context.platformEnvironmentId && target.applicationId === context.applicationId);
+        return s.managedKeycloakEvidence(result);
+    }
+    async restorePreview(applicationId, sourceJobId, input) {
+        applicationId = s.parseManaged(positive, applicationId);
+        sourceJobId = s.parseManaged(uuid, sourceJobId);
+        const body = s.parseManaged(s.managedKeycloakRestorePreview, input);
+        const source = await this.request(`${ROOT}/applications/${applicationId}/publication-jobs/${sourceJobId}`, publicationJob);
+        requireScope(source.id === sourceJobId && source.applicationId === applicationId
+            && source.operation === "MANAGED_KEYCLOAK_IMPORT");
+        if (source.version !== body.expectedVersion || source.planDigest !== body.expectedDigest)
+            throw new AuthorizationError("The source publication has changed. Read it again before requesting recovery.", "authorization_conflict", 409);
+        const result = await this.request(`${ROOT}/applications/${applicationId}/managed-keycloak-imports/${sourceJobId}/restore-preview`, publicationJob, "POST", body);
+        requireScope(result.id === body.requestId && result.applicationId === applicationId
+            && result.operation === "MANAGED_KEYCLOAK_IMPORT");
+        if (source.operation === "MANAGED_KEYCLOAK_IMPORT" && result.operation === "MANAGED_KEYCLOAK_IMPORT") {
+            const original = source.plan.managedConfiguration.configuration.target;
+            const target = result.plan.managedConfiguration.configuration.target;
+            const recovery = s.parseManaged(z.object({ sourceJobId: uuid }).passthrough(), result.plan.managedConfiguration.restoration, true);
+            requireScope(recovery.sourceJobId === sourceJobId && original.issuerId === target.issuerId
+                && original.platformEnvironmentId === target.platformEnvironmentId);
+        }
+        return result;
+    }
+}
+//# sourceMappingURL=managed-keycloak-client.js.map

package/dist/authorization/managed-keycloak-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-keycloak-client.js","sourceRoot":"","sources":["../../src/authorization/managed-keycloak-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAA8B,MAAM,aAAa,CAAC;AACvG,OAAO,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC7F,OAAO,KAAK,CAAC,MAAM,+BAA+B,CAAC;AAEnD,MAAM,IAAI,GAAG,6BAA6B,CAAC;AAC3C,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAC9B,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAC,QAAQ,EAAC,IAAI,EAAC,aAAa,EAAC,OAAO,EAAC,OAAO;IAChF,aAAa,EAAC,OAAO,EAAC,cAAc,EAAC,OAAO,EAAC,qBAAqB,EAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAC,wBAAwB,EAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAC,aAAa,EAAC,CAAC,CAAC,4BAA4B,CAAC,QAAQ,EAAE,EAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAE/N,SAAS,YAAY,CAAC,OAAgB;IACpC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,kBAAkB,CAAC,qEAAqE,EAAE,gCAAgC,CAAC,CAAC;AACtJ,CAAC;AACD,KAAK,UAAU,cAAc,CAAC,QAAkB;IAC9C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACxE,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACrD,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IAC1C,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,MAAM,MAAM,GAAiB,EAAE,CAAC;IAAC,IAAI,KAAK,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAAC,IAAI,IAAI,CAAC,IAAI;gBAAE,MAAM;YACvD,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YAC/B,IAAI,KAAK,GAAG,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACzE,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;eAClF,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC;YAAS,CAAC;QAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IAAC,CAAC;AACrC,CAAC;AACD,MAAM,OAAO,qBAAqB;IACH,MAAM;IAA+B,YAAY;IAA9E,YAA6B,MAAkB,EAAmB,YAAY,GAAgC,EAAE;sBAAnF,MAAM;4BAA+B,YAAY;IAAqC,CAAC;IAC5G,KAAK,CAAC,OAAO,CAAI,IAAY,EAAE,MAAoB,EAAE,MAAM,GAA2B,KAAK,EAAE,IAAc;QACjH,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC/G,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,EAAE;gBAC9K,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;aAC9D,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC,aAAa,IAAI,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,KAAK,KAAK,EAAE,CAAC,CAAC;QAC7J,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,kBAAkB,CAAC,+GAA+G,EAAE,yBAAyB,CAAC,CAAC;QAC3K,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,8EAA8E;YAC9E,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC5C,MAAM,IAAI,kBAAkB,CAAC,sCAAsC,QAAQ,CAAC,MAAM,GAAG,EAAE,0BAA0B,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QACxK,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,kBAAkB,CAAC,kCAAkC,EAAE,gCAAgC,CAAC,CAAC;QAChH,MAAM,MAAM,GAAiB,EAAE,CAAC;QAAC,IAAI,KAAK,GAAG,CAAC,CAAC;QAC/C,IAAI,CAAC;YACH,SAAS,CAAC;gBACR,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAAC,IAAI,IAAI,CAAC,IAAI;oBAAE,MAAM;gBACvD,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;gBAC/B,IAAI,KAAK,GAAG,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC5C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC7C,MAAM,IAAI,kBAAkB,CAAC,oEAAoE,EAAE,gCAAgC,CAAC,CAAC;QACvI,CAAC;gBAAS,CAAC;YAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAAC,CAAC;QACnC,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAAC,CAAC;QACnE,MAAM,CAAC;YAAC,MAAM,IAAI,kBAAkB,CAAC,yCAAyC,EAAE,gCAAgC,CAAC,CAAC;QAAC,CAAC;QACpH,OAAO,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IACD,YAAY,CAAC,QAAgB;QAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,YAAY,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,qCAAqC,EAAE,QAAQ,CAAC,CAAC;IACxH,CAAC;IACD,KAAK,CAAC,aAAa,CAAC,OAAiC,EAAE,wBAAiC;QACtF,OAAO,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;QAClJ,IAAI,wBAAwB,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,0BAA0B,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC,CAAC;QAClI,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,YAAY,OAAO,CAAC,QAAQ,0BAA0B,KAAK,EAAE,EAAE,oBAAoB,CAAC,CAAC;QAC9H,IAAI,wBAAwB,KAAK,SAAS;YAAE,YAAY,CAAC,MAAM,CAAC,wBAAwB,KAAK,wBAAwB,IAAI,MAAM,CAAC,qBAAqB,IAAI,IAAI,CAAC,CAAC;QAC/J,YAAY,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,aAAa;YAAE,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa;mBACrG,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,qBAAqB,KAAK,OAAO,CAAC,qBAAqB;mBACnF,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;QAChE,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,QAAgB,EAAE,KAAc;QACzC,QAAQ,GAAG,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;QAC1D,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,YAAY,QAAQ,wBAAwB,EAAE,oBAAoB,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC1H,YAAY,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QAC3C,YAAY,CAAC,MAAM,CAAC,aAAa,KAAK,IAAI,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ;eAC1F,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,aAAa;eACrF,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,qBAAqB,KAAK,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;QAC5G,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,aAAqB,EAAE,KAAc;QACjD,aAAa,GAAG,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;QAC7D,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,aAAa,KAAK,aAAa,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,iBAAiB,aAAa,mCAAmC,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC1I,YAAY,CAAC,MAAM,CAAC,aAAa,KAAK,aAAa,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,yBAAyB,CAAC,CAAC;QACvI,IAAI,MAAM,CAAC,SAAS,KAAK,yBAAyB,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,MAAM,CAAC;YACrE,YAAY,CAAC,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ;mBAC9D,MAAM,CAAC,qBAAqB,KAAK,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,OAAiC,EAAE,IAA4B;QAC1E,OAAO,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC;QAC5D,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACtI,MAAM,IAAI,GAAG,GAAG,IAAI,iBAAiB,OAAO,CAAC,aAAa,oCAAoC,KAAK,EAAE,CAAC;QACtG,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,4BAA4B,CAAC,CAAC;YACxE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,qBAAqB,KAAK,OAAO,CAAC,qBAAqB,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;YAC5L,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAClD,YAAY,CAAC,MAAM,CAAC,IAAI,KAAK,8BAA8B,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,sBAAsB,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC3F,YAAY,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,qBAAqB,KAAK,OAAO,CAAC,qBAAqB,IAAI,MAAM,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;QACvK,OAAO,CAAC,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IACD,KAAK,CAAC,cAAc,CAAC,aAAqB,EAAE,WAAmB,EAAE,KAAc;QAC7E,aAAa,GAAG,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACxD,WAAW,GAAG,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,iBAAiB,aAAa,qBAAqB,WAAW,EAAE,EAAE,cAAc,CAAC,CAAC;QAC3H,YAAY,CAAC,MAAM,CAAC,EAAE,KAAK,WAAW,IAAI,MAAM,CAAC,aAAa,KAAK,aAAa;eAC3E,MAAM,CAAC,SAAS,KAAK,yBAAyB,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,cAAc;YACtF,MAAM,IAAI,kBAAkB,CAAC,+EAA+E,EAAE,wBAAwB,EAAE,GAAG,CAAC,CAAC;QAC/I,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,iBAAiB,aAAa,6BAA6B,WAAW,kBAAkB,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACjK,YAAY,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,aAAa,KAAK,aAAa;eAC9E,MAAM,CAAC,SAAS,KAAK,yBAAyB,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,SAAS,KAAK,yBAAyB,IAAI,MAAM,CAAC,SAAS,KAAK,yBAAyB,EAAE,CAAC;YACrG,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,MAAM,CAAC;YACvE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,MAAM,CAAC;YACrE,MAAM,QAAQ,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,EAAC,WAAW,EAAE,IAAI,EAAC,CAAC,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACjI,YAAY,CAAC,QAAQ,CAAC,WAAW,KAAK,WAAW,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;mBACrF,QAAQ,CAAC,qBAAqB,KAAK,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/authorization/managed-keycloak-commands.d.ts

@@ -0,0 +1,10 @@
+import type { Command } from "commander";
+import type { CommandDescriptor } from "../command-catalog.js";
+import { ManagedKeycloakClient } from "./managed-keycloak-client.js";
+export interface ManagedKeycloakCommandDependencies {
+    managedKeycloakClientFactory?: () => ManagedKeycloakClient;
+}
+export declare function readManagedKeycloakFile(path: string): Promise<unknown>;
+export declare function writeManagedKeycloakFile(path: string, value: unknown): Promise<void>;
+export declare function registerManagedKeycloakCommands(auth: Command, dependencies?: ManagedKeycloakCommandDependencies): void;
+export declare const managedKeycloakCommandCatalog: CommandDescriptor[];

package/dist/authorization/managed-keycloak-commands.js

@@ -0,0 +1,113 @@
+import process from "node:process";
+import { constants } from "node:fs";
+import { lstat, open, unlink } from "node:fs/promises";
+import { loadConfig } from "../config.js";
+import { AuthorizationError } from "./errors.js";
+import { ManagedKeycloakClient } from "./managed-keycloak-client.js";
+import { managedKeycloakEvidence, parseManaged, managedKeycloakConfiguration } from "./managed-keycloak-schemas.js";
+const LIMIT = 2 * 1024 * 1024;
+function number(value) {
+    if (typeof value !== "string" || !/^[1-9]\d*$/u.test(value) || !Number.isSafeInteger(Number(value)))
+        throw new AuthorizationError("Expected a positive numeric catalog ID.", "authorization_input_invalid");
+    return Number(value);
+}
+export async function readManagedKeycloakFile(path) {
+    let handle;
+    try {
+        handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        const stat = await handle.stat();
+        if (!stat.isFile() || stat.size > LIMIT)
+            throw new Error("Invalid input file");
+        const buffer = Buffer.alloc(LIMIT + 1);
+        let total = 0;
+        while (total < buffer.length) {
+            const { bytesRead } = await handle.read(buffer, total, buffer.length - total, null);
+            if (!bytesRead)
+                break;
+            total += bytesRead;
+        }
+        if (total > LIMIT)
+            throw new Error("Too large");
+        return JSON.parse(buffer.subarray(0, total).toString("utf8"));
+    }
+    catch {
+        throw new AuthorizationError("Cannot read managed Keycloak JSON: use a regular JSON file up to 2 MiB, not a symlink.", "authorization_input_invalid");
+    }
+    finally {
+        await handle?.close();
+    }
+}
+export async function writeManagedKeycloakFile(path, value) {
+    let handle;
+    let created = false;
+    try {
+        handle = await open(path, "wx", 0o600);
+        created = true;
+        await handle.writeFile(`${JSON.stringify(value, null, 2)}\n`, "utf8");
+        await handle.sync();
+    }
+    catch {
+        if (created && handle) {
+            // Only remove the inode this invocation created, never a replacement path.
+            const original = await handle.stat().catch(() => undefined);
+            const current = await lstat(path).catch(() => undefined);
+            if (original && current && original.dev === current.dev && original.ino === current.ino) {
+                await unlink(path).catch(() => undefined);
+            }
+        }
+        throw new AuthorizationError("Cannot create export file. Choose a new path; existing files and symlinks are never overwritten.", "authorization_input_invalid");
+    }
+    finally {
+        await handle?.close();
+    }
+}
+export function registerManagedKeycloakCommands(auth, dependencies = {}) {
+    const group = auth.command("keycloak-config").description("受管 Keycloak 配置导入导出；平台持有管理凭据");
+    group.addHelpText("after", "\n流程：show → save（仅当前配置）→ preview → 既有 application publication execute/show/recheck。\n导出 current 可回导；observed 是只读诊断快照。所有操作固定使用 Numa 平台身份，无 Keycloak 管理员凭据参数。\n");
+    function action(command, handler, write = false) {
+        command.action(async (...args) => {
+            const options = args.at(-2);
+            if (write && options.yes !== true)
+                throw new AuthorizationError("Review the complete input and supply --yes to save it. This does not publish Keycloak configuration.", "authorization_input_invalid");
+            const result = await handler(dependencies.managedKeycloakClientFactory?.() ?? new ManagedKeycloakClient(loadConfig("platform")), args.slice(0, -2), options);
+            process.stdout.write(`${JSON.stringify({ ok: true, data: managedKeycloakEvidence(result) }, null, 2)}\n`);
+        });
+    }
+    function target(command) {
+        return command.requiredOption("--issuer-id <uuid>", "Registered target issuer UUID")
+            .requiredOption("--app <number>", "Application catalog ID")
+            .requiredOption("--platform-environment-id <number>", "Numeric platform environment ID, not application binding UUID");
+    }
+    function context(options) { return { issuerId: String(options.issuerId), applicationId: number(options.app), platformEnvironmentId: number(options.platformEnvironmentId) }; }
+    action(group.command("capabilities <issuer-id>"), (client, [id]) => client.capabilities(id));
+    action(target(group.command("show")).option("--exchange-client-instance-id <uuid>", "Read the selected Client revision before creating or changing its declaration"), (client, _, options) => client.configuration(context(options), options.exchangeClientInstanceId));
+    action(group.command("save <issuer-id>").requiredOption("--file <path>", "JSON containing expected versions and configuration").option("--yes", "Confirm local revisioned save").option("--adopt-current-fields", "Explicitly adopt the observed controlled fields as a baseline; never the full Client"), async (client, [id], options) => {
+        const input = await readManagedKeycloakFile(String(options.file));
+        if (options.adoptCurrentFields === true) {
+            if (!input || typeof input !== "object" || Array.isArray(input))
+                throw new AuthorizationError("Invalid save input.", "authorization_input_invalid");
+            return client.save(id, { ...input, adoptCurrentFields: true });
+        }
+        return client.save(id, input);
+    }, true);
+    action(group.command("preview").requiredOption("--file <path>", "Declaration bundle JSON").requiredOption("--request-id <uuid>", "Stable idempotency request ID"), async (client, _, options) => {
+        const configuration = parseManaged(managedKeycloakConfiguration, await readManagedKeycloakFile(String(options.file)));
+        return client.preview(configuration.target.applicationId, { requestId: options.requestId, configuration });
+    });
+    action(group.command("restore-preview <source-job-id>").requiredOption("--app <number>", "Application catalog ID")
+        .requiredOption("--file <path>", "JSON containing requestId, expectedVersion and expectedDigest of the source publication"), async (client, [id], options) => client.restorePreview(number(options.app), id, await readManagedKeycloakFile(String(options.file))));
+    action(target(group.command("export")).option("--view <view>", "current (importable) or observed (read-only)", "current").requiredOption("--output <path>", "New output file; does not overwrite"), async (client, _, options) => {
+        const value = await client.export(context(options), String(options.view));
+        await writeManagedKeycloakFile(String(options.output), value);
+        return { output: String(options.output), view: options.view, importable: options.view === "current" };
+    });
+}
+export const managedKeycloakCommandCatalog = [
+    ["capabilities <issuer-id>", "查询已登记目标的受管配置能力"],
+    ["show --issuer-id <uuid> --app <number> --platform-environment-id <number>", "读取当前配置与乐观版本"],
+    ["save <issuer-id> --file <path> --yes", "保存已审阅的当前配置，不发布"],
+    ["preview --file <path> --request-id <uuid>", "校验声明包并预览远端差异，不执行远端写入"],
+    ["restore-preview <source-job-id> --app <number> --file <path>", "预览原任务受控字段恢复，显示保留项和冲突，不执行远端写入"],
+    ["export --issuer-id <uuid> --app <number> --platform-environment-id <number> --view <current|observed> --output <path>", "导出声明配置包或只读观察快照"],
+].map(([suffix, summary]) => ({ command: `authorization keycloak-config ${suffix}`, summary: summary, access: "role", roles: ["mci-devops-platform-ops-admin"], examples: [], operationalNotes: ["与Web共用平台预览、审批、发布与回读；配置包不包含凭据，观察快照不可导入。"] }));
+//# sourceMappingURL=managed-keycloak-commands.js.map

package/dist/authorization/managed-keycloak-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-keycloak-commands.js","sourceRoot":"","sources":["../../src/authorization/managed-keycloak-commands.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAGvD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,YAAY,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAIpH,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAC9B,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,kBAAkB,CAAC,yCAAyC,EAAE,6BAA6B,CAAC,CAAC;IAC5M,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAY;IACxD,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QAC5F,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAAC,IAAI,KAAK,GAAG,CAAC,CAAC;QACtD,OAAO,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YAC7B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC;YACpF,IAAI,CAAC,SAAS;gBAAE,MAAM;YAAC,KAAK,IAAI,SAAS,CAAC;QAC5C,CAAC;QACD,IAAI,KAAK,GAAG,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,kBAAkB,CAAC,wFAAwF,EAAE,6BAA6B,CAAC,CAAC;IAAC,CAAC;YAC1J,CAAC;QAAC,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC;IAAC,CAAC;AACpC,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,IAAY,EAAE,KAAc;IACzE,IAAI,MAAM,CAAC;IAAC,IAAI,OAAO,GAAG,KAAK,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAAC,OAAO,GAAG,IAAI,CAAC;QACvD,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtE,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;YACtB,2EAA2E;YAC3E,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACzD,IAAI,QAAQ,IAAI,OAAO,IAAI,QAAQ,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;gBACxF,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QACD,MAAM,IAAI,kBAAkB,CAAC,kGAAkG,EAAE,6BAA6B,CAAC,CAAC;IAClK,CAAC;YAAS,CAAC;QAAC,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC;IAAC,CAAC;AACtC,CAAC;AACD,MAAM,UAAU,+BAA+B,CAAC,IAAa,EAAE,YAAY,GAAuC,EAAE;IAClH,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,WAAW,CAAC,6BAA6B,CAAC,CAAC;IACzF,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,+JAA+J,CAAC,CAAC;IAE5L,SAAS,MAAM,CAAC,OAAgB,EAAE,OAAgB,EAAE,KAAK,GAAG,KAAK;QAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,IAAe,EAAE,EAAE;YAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAY,CAAC;YACvC,IAAI,KAAK,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI;gBAAE,MAAM,IAAI,kBAAkB,CAAC,sGAAsG,EAAE,6BAA6B,CAAC,CAAC;YACvM,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,4BAA4B,EAAE,EAAE,IAAI,IAAI,qBAAqB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAa,EAAE,OAAO,CAAC,CAAC;YACzK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,uBAAuB,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5G,CAAC,CAAC,CAAC;IACL,CAAC;IACD,SAAS,MAAM,CAAC,OAAgB;QAC9B,OAAO,OAAO,CAAC,cAAc,CAAC,oBAAoB,EAAE,+BAA+B,CAAC;aACjF,cAAc,CAAC,gBAAgB,EAAE,wBAAwB,CAAC;aAC1D,cAAc,CAAC,oCAAoC,EAAE,+DAA+D,CAAC,CAAC;IAC3H,CAAC;IACD,SAAS,OAAO,CAAC,OAAgB,IAAI,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC;IACvL,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,0BAA0B,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EAAG,CAAC,CAAC,CAAC;IAC9F,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,sCAAsC,EAAE,+EAA+E,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,wBAA8C,CAAC,CAAC,CAAC;IAC9R,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,cAAc,CAAC,eAAe,EAAE,qDAAqD,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,+BAA+B,CAAC,CAAC,MAAM,CAAC,wBAAwB,EAAE,sFAAsF,CAAC,EACvS,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE;QAC9B,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAClE,IAAI,OAAO,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;YACxC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,6BAA6B,CAAC,CAAC;YACpJ,OAAO,MAAM,CAAC,IAAI,CAAC,EAAG,EAAE,EAAE,GAAG,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,EAAG,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC,EAAE,IAAI,CAAC,CAAC;IACX,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,cAAc,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC,cAAc,CAAC,qBAAqB,EAAE,+BAA+B,CAAC,EAC/J,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE;QAC3B,MAAM,aAAa,GAAG,YAAY,CAAC,4BAA4B,EAAE,MAAM,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtH,OAAO,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC;IAC7G,CAAC,CAAC,CAAC;IACL,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC,cAAc,CAAC,gBAAgB,EAAE,wBAAwB,CAAC;SAC/G,cAAc,CAAC,eAAe,EAAE,yFAAyF,CAAC,EAC3H,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAG,EAAE,MAAM,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACzI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,8CAA8C,EAAE,SAAS,CAAC,CAAC,cAAc,CAAC,iBAAiB,EAAE,qCAAqC,CAAC,EAChM,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAA2B,CAAC,CAAC;QACpG,MAAM,wBAAwB,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;QAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;IACxG,CAAC,CAAC,CAAC;AACP,CAAC;AACD,MAAM,CAAC,MAAM,6BAA6B,GAAwB;IAChE,CAAC,0BAA0B,EAAE,gBAAgB,CAAC;IAC9C,CAAC,2EAA2E,EAAE,aAAa,CAAC;IAC5F,CAAC,sCAAsC,EAAE,gBAAgB,CAAC;IAC1D,CAAC,2CAA2C,EAAE,sBAAsB,CAAC;IACrE,CAAC,8DAA8D,EAAE,8BAA8B,CAAC;IAChG,CAAC,uHAAuH,EAAE,gBAAgB,CAAC;CAC5I,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,iCAAiC,MAAM,EAAE,EAAE,OAAO,EAAE,OAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,+BAA+B,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,wCAAwC,CAAC,EAAE,CAAC,CAAC,CAAC"}

package/dist/authorization/managed-keycloak-schemas.d.ts

@@ -0,0 +1,178 @@
+import { z } from "zod";
+export declare const managedKeycloakConfiguration: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"1">;
+    kind: z.ZodLiteral<"KEYCLOAK_API_KEY_CONFIGURATION">;
+    target: z.ZodObject<{
+        issuerId: z.ZodString;
+        platformEnvironmentId: z.ZodNumber;
+        applicationId: z.ZodNumber;
+    }, z.core.$strict>;
+    realm: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        adminRoleClientRef: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    protectedUserAttribute: z.ZodObject<{
+        name: z.ZodLiteral<"mci_api_keys">;
+        multivalued: z.ZodLiteral<true>;
+        permissions: z.ZodObject<{
+            view: z.ZodTuple<[z.ZodLiteral<"admin">], null>;
+            edit: z.ZodTuple<[z.ZodLiteral<"admin">], null>;
+        }, z.core.$strict>;
+        validations: z.ZodObject<{
+            length: z.ZodObject<{
+                max: z.ZodLiteral<2048>;
+            }, z.core.$strict>;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    exchangeClient: z.ZodObject<{
+        clientInstanceId: z.ZodString;
+        enabled: z.ZodBoolean;
+    }, z.core.$strict>;
+    managementRoles: z.ZodObject<{
+        ownerClientRef: z.ZodString;
+        definitions: z.ZodArray<z.ZodEnum<{
+            "mci-devops-platform-api-key-user": "mci-devops-platform-api-key-user";
+            "mci-devops-platform-ops-admin": "mci-devops-platform-ops-admin";
+        }>>;
+    }, z.core.$strict>;
+    clientConfigurationRefs: z.ZodArray<z.ZodObject<{
+        clientInstanceId: z.ZodString;
+        applicationReferenceId: z.ZodString;
+    }, z.core.$strict>>;
+    authorization: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        mode: z.ZodLiteral<"PRESERVE">;
+    }, z.core.$strict>, z.ZodObject<{
+        mode: z.ZodLiteral<"APPLY_REFERENCED">;
+        applicationEnvironmentId: z.ZodString;
+        definitionVersion: z.ZodNumber;
+        enableAuthorization: z.ZodBoolean;
+    }, z.core.$strict>], "mode">;
+}, z.core.$strict>;
+export type ManagedKeycloakConfiguration = z.infer<typeof managedKeycloakConfiguration>;
+export declare const managedKeycloakSave: z.ZodObject<{
+    expectedVersion: z.ZodNumber;
+    expectedIssuerVersion: z.ZodNumber;
+    expectedIntentVersion: z.ZodNumber;
+    expectedExchangeClientVersion: z.ZodNumber;
+    adoptCurrentFields: z.ZodOptional<z.ZodBoolean>;
+    configuration: z.ZodObject<{
+        schemaVersion: z.ZodLiteral<"1">;
+        kind: z.ZodLiteral<"KEYCLOAK_API_KEY_CONFIGURATION">;
+        target: z.ZodObject<{
+            issuerId: z.ZodString;
+            platformEnvironmentId: z.ZodNumber;
+            applicationId: z.ZodNumber;
+        }, z.core.$strict>;
+        realm: z.ZodObject<{
+            enabled: z.ZodBoolean;
+            adminRoleClientRef: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+        protectedUserAttribute: z.ZodObject<{
+            name: z.ZodLiteral<"mci_api_keys">;
+            multivalued: z.ZodLiteral<true>;
+            permissions: z.ZodObject<{
+                view: z.ZodTuple<[z.ZodLiteral<"admin">], null>;
+                edit: z.ZodTuple<[z.ZodLiteral<"admin">], null>;
+            }, z.core.$strict>;
+            validations: z.ZodObject<{
+                length: z.ZodObject<{
+                    max: z.ZodLiteral<2048>;
+                }, z.core.$strict>;
+            }, z.core.$strict>;
+        }, z.core.$strict>;
+        exchangeClient: z.ZodObject<{
+            clientInstanceId: z.ZodString;
+            enabled: z.ZodBoolean;
+        }, z.core.$strict>;
+        managementRoles: z.ZodObject<{
+            ownerClientRef: z.ZodString;
+            definitions: z.ZodArray<z.ZodEnum<{
+                "mci-devops-platform-api-key-user": "mci-devops-platform-api-key-user";
+                "mci-devops-platform-ops-admin": "mci-devops-platform-ops-admin";
+            }>>;
+        }, z.core.$strict>;
+        clientConfigurationRefs: z.ZodArray<z.ZodObject<{
+            clientInstanceId: z.ZodString;
+            applicationReferenceId: z.ZodString;
+        }, z.core.$strict>>;
+        authorization: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            mode: z.ZodLiteral<"PRESERVE">;
+        }, z.core.$strict>, z.ZodObject<{
+            mode: z.ZodLiteral<"APPLY_REFERENCED">;
+            applicationEnvironmentId: z.ZodString;
+            definitionVersion: z.ZodNumber;
+            enableAuthorization: z.ZodBoolean;
+        }, z.core.$strict>], "mode">;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const managedKeycloakPreview: z.ZodObject<{
+    requestId: z.ZodString;
+    configuration: z.ZodObject<{
+        schemaVersion: z.ZodLiteral<"1">;
+        kind: z.ZodLiteral<"KEYCLOAK_API_KEY_CONFIGURATION">;
+        target: z.ZodObject<{
+            issuerId: z.ZodString;
+            platformEnvironmentId: z.ZodNumber;
+            applicationId: z.ZodNumber;
+        }, z.core.$strict>;
+        realm: z.ZodObject<{
+            enabled: z.ZodBoolean;
+            adminRoleClientRef: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+        protectedUserAttribute: z.ZodObject<{
+            name: z.ZodLiteral<"mci_api_keys">;
+            multivalued: z.ZodLiteral<true>;
+            permissions: z.ZodObject<{
+                view: z.ZodTuple<[z.ZodLiteral<"admin">], null>;
+                edit: z.ZodTuple<[z.ZodLiteral<"admin">], null>;
+            }, z.core.$strict>;
+            validations: z.ZodObject<{
+                length: z.ZodObject<{
+                    max: z.ZodLiteral<2048>;
+                }, z.core.$strict>;
+            }, z.core.$strict>;
+        }, z.core.$strict>;
+        exchangeClient: z.ZodObject<{
+            clientInstanceId: z.ZodString;
+            enabled: z.ZodBoolean;
+        }, z.core.$strict>;
+        managementRoles: z.ZodObject<{
+            ownerClientRef: z.ZodString;
+            definitions: z.ZodArray<z.ZodEnum<{
+                "mci-devops-platform-api-key-user": "mci-devops-platform-api-key-user";
+                "mci-devops-platform-ops-admin": "mci-devops-platform-ops-admin";
+            }>>;
+        }, z.core.$strict>;
+        clientConfigurationRefs: z.ZodArray<z.ZodObject<{
+            clientInstanceId: z.ZodString;
+            applicationReferenceId: z.ZodString;
+        }, z.core.$strict>>;
+        authorization: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            mode: z.ZodLiteral<"PRESERVE">;
+        }, z.core.$strict>, z.ZodObject<{
+            mode: z.ZodLiteral<"APPLY_REFERENCED">;
+            applicationEnvironmentId: z.ZodString;
+            definitionVersion: z.ZodNumber;
+            enableAuthorization: z.ZodBoolean;
+        }, z.core.$strict>], "mode">;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const managedKeycloakRestorePreview: z.ZodObject<{
+    requestId: z.ZodString;
+    expectedVersion: z.ZodNumber;
+    expectedDigest: z.ZodString;
+}, z.core.$strict>;
+export declare const managedKeycloakExecute: z.ZodObject<{
+    expectedVersion: z.ZodNumber;
+    expectedDigest: z.ZodString;
+    expectedBundleDigest: z.ZodString;
+}, z.core.$strict>;
+export declare const managedKeycloakContext: z.ZodObject<{
+    issuerId: z.ZodString;
+    applicationId: z.ZodNumber;
+    platformEnvironmentId: z.ZodNumber;
+}, z.core.$strict>;
+export type ManagedKeycloakContext = z.infer<typeof managedKeycloakContext>;
+export declare function parseManaged<T>(schema: z.ZodType<T>, value: unknown, response?: boolean): T;
+/** Preserve configuration.authorization while excluding credential-bearing diagnostics. */
+export declare function managedKeycloakEvidence(value: unknown): unknown;

package/dist/authorization/managed-keycloak-schemas.js

@@ -0,0 +1,55 @@
+import { z } from "zod";
+import { uuid, positive, version, digest } from "./application-schemas.js";
+import { AuthorizationError, redactAuthorizationText } from "./errors.js";
+const roles = ["mci-devops-platform-api-key-user", "mci-devops-platform-ops-admin"];
+export const managedKeycloakConfiguration = z.object({
+    schemaVersion: z.literal("1"),
+    kind: z.literal("KEYCLOAK_API_KEY_CONFIGURATION"),
+    target: z.object({ issuerId: uuid, platformEnvironmentId: positive, applicationId: positive }).strict(),
+    realm: z.object({ enabled: z.boolean(), adminRoleClientRef: uuid.optional() }).strict(),
+    protectedUserAttribute: z.object({
+        name: z.literal("mci_api_keys"), multivalued: z.literal(true),
+        permissions: z.object({ view: z.tuple([z.literal("admin")]), edit: z.tuple([z.literal("admin")]) }).strict(),
+        validations: z.object({ length: z.object({ max: z.literal(2048) }).strict() }).strict(),
+    }).strict(),
+    exchangeClient: z.object({ clientInstanceId: uuid, enabled: z.boolean() }).strict(),
+    managementRoles: z.object({
+        ownerClientRef: uuid, definitions: z.array(z.enum(roles)).length(2).refine(v => new Set(v).size === 2),
+    }).strict(),
+    clientConfigurationRefs: z.array(z.object({ clientInstanceId: uuid, applicationReferenceId: uuid }).strict()).max(32)
+        .refine(v => new Set(v.map(x => `${x.clientInstanceId}/${x.applicationReferenceId}`)).size === v.length),
+    authorization: z.discriminatedUnion("mode", [
+        z.object({ mode: z.literal("PRESERVE") }).strict(),
+        z.object({ mode: z.literal("APPLY_REFERENCED"), applicationEnvironmentId: uuid, definitionVersion: positive, enableAuthorization: z.boolean() }).strict(),
+    ]),
+}).strict();
+export const managedKeycloakSave = z.object({
+    expectedVersion: version, expectedIssuerVersion: version, expectedIntentVersion: version,
+    expectedExchangeClientVersion: positive,
+    adoptCurrentFields: z.boolean().optional(),
+    configuration: managedKeycloakConfiguration,
+}).strict();
+export const managedKeycloakPreview = z.object({ requestId: uuid, configuration: managedKeycloakConfiguration }).strict();
+export const managedKeycloakRestorePreview = z.object({ requestId: uuid, expectedVersion: version, expectedDigest: digest }).strict();
+export const managedKeycloakExecute = z.object({ expectedVersion: version, expectedDigest: digest, expectedBundleDigest: digest }).strict();
+export const managedKeycloakContext = z.object({ issuerId: uuid, applicationId: positive, platformEnvironmentId: positive }).strict();
+export function parseManaged(schema, value, response = false) {
+    const result = schema.safeParse(value);
+    if (!result.success)
+        throw new AuthorizationError(response ? "Managed Keycloak response does not match the contract." : "Invalid managed Keycloak input. Use a declaration bundle; observation snapshots and credentials cannot be imported.", response ? "authorization_invalid_response" : "authorization_input_invalid");
+    return result.data;
+}
+/** Preserve configuration.authorization while excluding credential-bearing diagnostics. */
+export function managedKeycloakEvidence(value) {
+    if (typeof value === "string")
+        return redactAuthorizationText(value).replace(/\bmciak\.v1\.[A-Za-z0-9_.-]+/gu, "[REDACTED_API_KEY]");
+    if (Array.isArray(value))
+        return value.map(managedKeycloakEvidence);
+    if (value && typeof value === "object")
+        return Object.fromEntries(Object.entries(value)
+            .filter(([key, item]) => !/(?:secret|password|passwd|access.?token|refresh.?token|session.?cookie|^token$|^cookie$|^key$|^hash$|^api.?key$|^mci_api_keys$)/iu.test(key)
+            && !(key.toLowerCase() === "authorization" && typeof item === "string"))
+            .map(([key, item]) => [key, managedKeycloakEvidence(item)]));
+    return value;
+}
+//# sourceMappingURL=managed-keycloak-schemas.js.map

package/dist/authorization/managed-keycloak-schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-keycloak-schemas.js","sourceRoot":"","sources":["../../src/authorization/managed-keycloak-schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE1E,MAAM,KAAK,GAAG,CAAC,kCAAkC,EAAE,+BAA+B,CAAU,CAAC;AAC7F,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAC7B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,gCAAgC,CAAC;IACjD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACvG,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,kBAAkB,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACvF,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC/B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QAC7D,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;QAC5G,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;KACxF,CAAC,CAAC,MAAM,EAAE;IACX,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACnF,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;QACxB,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC;KACvG,CAAC,CAAC,MAAM,EAAE;IACX,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;SAClH,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC;IAC1G,aAAa,EAAE,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;QAC1C,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;QAClD,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;KAC1J,CAAC;CACH,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,eAAe,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO;IACxF,6BAA6B,EAAE,QAAQ;IACvC,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC1C,aAAa,EAAE,4BAA4B;CAC5C,CAAC,CAAC,MAAM,EAAE,CAAC;AACZ,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC1H,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACtI,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC5I,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,qBAAqB,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAGtI,MAAM,UAAU,YAAY,CAAI,MAAoB,EAAE,KAAc,EAAE,QAAQ,GAAG,KAAK;IACpF,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,kBAAkB,CAC/C,QAAQ,CAAC,CAAC,CAAC,wDAAwD,CAAC,CAAC,CAAC,qHAAqH,EAC3L,QAAQ,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,6BAA6B,CAC5E,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,uBAAuB,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,gCAAgC,EAAE,oBAAoB,CAAC,CAAC;IACrI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACpE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;aACpF,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,mIAAmI,CAAC,IAAI,CAAC,GAAG,CAAC;eAClK,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,eAAe,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC;aACzE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/business-issuer.js

@@ -7,9 +7,7 @@ export function loginConfig(command) {
         if (options.platform)
             throw new Error("--service 不能与 --platform 同时使用。");
         if (options.service === "kb") {
-            if (options.issuer)
-                throw new Error("--service kb 不能与 --issuer 同时使用。");
-            return loadKbAuthConfig();
+            return loadKbAuthConfig(options.issuer);
         }
         const services = ["platform", "oss", "media", "pipeline", "aiRegistry", "codex"];
         if (!services.includes(options.service))
@@ -33,12 +31,12 @@ export function assertIssuerCommand(command) {
         root = root.parent;
     if (root.name() === "oss" && command.parent?.name() === "bootstrap")
         throw new Error("OSS 初始化使用固定的平台管理 issuer。");
-    if (root.name() === "oss" || root.name() === "login" || root.name() === "profile")
+    if (root.name() === "oss" || root.name() === "kb" || root.name() === "login" || root.name() === "profile")
         return;
     if (root.name() === "auth" && ["status", "logout"].includes(command.name()))
         return;
     if (root.name() === "request" && businessRequest(command.args[0] ?? "", options.method ?? "GET"))
         return;
-    throw new Error("--issuer 仅适用于 OSS 业务、业务登录和会话命令；平台管理 issuer 固定，请使用 numa login --platform。");
+    throw new Error("--issuer 仅适用于 OSS、KB 业务、业务登录和会话命令；平台管理 issuer 固定，请使用 numa login --platform。");
 }
 //# sourceMappingURL=business-issuer.js.map

package/dist/business-issuer.js.map

@@ -1 +1 @@
-{"version":3,"file":"business-issuer.js","sourceRoot":"","sources":["../src/business-issuer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAA2B,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,EAA2D,CAAC;IACnG,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACxE,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC7B,IAAI,OAAO,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACvE,OAAO,gBAAgB,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,QAAQ,GAAyB,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QACvG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,OAA6B,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACzG,OAAO,UAAU,CAAC,OAAO,CAAC,OAA6B,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACzF,OAAO,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,sBAAsB,EAAE,EAAE,mBAAmB,IAAI,UAAU,CAAuB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;AACzJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,MAAc;IAC1D,OAAO,IAAI,KAAK,2BAA2B,IAAI,MAAM,KAAK,KAAK;WAC1D,IAAI,KAAK,6BAA6B,IAAI,MAAM,KAAK,MAAM,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,EAAsC,CAAC;IAC9E,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO;IAC5B,IAAI,IAAI,GAAG,OAAO,CAAC;IACnB,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM;QAAE,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC;IAC/C,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACjH,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO;IAC1F,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,MAAM,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO;IACpF,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,SAAS,IAAI,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;QAAE,OAAO;IACzG,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;AAC9F,CAAC"}
+{"version":3,"file":"business-issuer.js","sourceRoot":"","sources":["../src/business-issuer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAA2B,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,EAA2D,CAAC;IACnG,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACxE,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC7B,OAAO,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,QAAQ,GAAyB,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QACvG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,OAA6B,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACzG,OAAO,UAAU,CAAC,OAAO,CAAC,OAA6B,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACzF,OAAO,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,sBAAsB,EAAE,EAAE,mBAAmB,IAAI,UAAU,CAAuB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;AACzJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,MAAc;IAC1D,OAAO,IAAI,KAAK,2BAA2B,IAAI,MAAM,KAAK,KAAK;WAC1D,IAAI,KAAK,6BAA6B,IAAI,MAAM,KAAK,MAAM,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,EAAsC,CAAC;IAC9E,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO;IAC5B,IAAI,IAAI,GAAG,OAAO,CAAC;IACnB,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM;QAAE,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC;IAC/C,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACjH,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO;IAClH,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,MAAM,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO;IACpF,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,SAAS,IAAI,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;QAAE,OAAO;IACzG,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;AACjG,CAAC"}